src/pvefw-logger.c

   1 /*
   2
   3   Copyright (C) 2014 Proxmox Server Solutions GmbH
   4
   5   This software is written by Proxmox Server Solutions GmbH <support@proxmox.com>
   6
   7   This program is free software: you can redistribute it and/or modify
   8   it under the terms of the GNU Affero General Public License as published by
   9   the Free Software Foundation, either version 3 of the License, or
  10   (at your option) any later version.
  11
  12   This program is distributed in the hope that it will be useful,
  13   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15   GNU Affero General Public License for more details.
  16
  17   You should have received a copy of the GNU Affero General Public License
  18   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19
  20   Author: Dietmar Maurer <dietmar@proxmox.com>
  21
  22 */
  23
  24 #define _GNU_SOURCE
  25
  26 #include <stdlib.h>
  27 #include <stdio.h>
  28 #include <errno.h>
  29 #include <stdarg.h>
  30 #include <string.h>
  31 #include <signal.h>
  32 #include <sys/types.h>
  33 #include <sys/stat.h>
  34 #include <fcntl.h>
  35 #include <unistd.h>
  36 #include <arpa/inet.h>
  37 #include <sys/socket.h>
  38 #include <sys/file.h>
  39 #include <linux/netlink.h>
  40 #include <libnfnetlink/libnfnetlink.h>
  41 #include <libnetfilter_log/libnetfilter_log.h>
  42 #include <netinet/ip.h>
  43 #include <netinet/ip_icmp.h>
  44 #include <netinet/udp.h>
  45 #include <netinet/tcp.h>
  46 #include <netinet/if_ether.h>
  47 #include <syslog.h>
  48
  49 #include <glib.h>
  50 #include <glib-unix.h>
  51
  52 static struct nflog_handle *logh = NULL;
  53 static struct nlif_handle *nlifh = NULL;
  54 GMainLoop *main_loop;
  55
  56 /*
  57
  58 LOG FORMAT:
  59
  60 Special care was taken to allow fast parsing (and filer messages for a singl VM).
  61
  62 <VMID> <LOGLEVEL> <CHAIN> <TIME> <TIMEZONE> <MSG>
  63
  64 Example:
  65
  66 117 6 tap117i0-IN 14/Mar/2014:12:47:07 +0100 policy REJECT: IN=vmbr1 ...
  67
  68 */
  69
  70 #define LOGFILE "/var/log/pve-firewall.log"
  71
  72 #define LOCKFILE "/var/lock/pvefw-logger.lck"
  73 #define PIDFILE "/var/run/pvefw-logger.pid"
  74
  75 #define LQ_LEN 512
  76 #define LE_MAX (512 - 16) // try to fit into 512 bytes
  77
  78 #define MAX_CHAIN_LEN 28
  79
  80 struct log_entry {
  81     guint32 len; // max LE_MAX chars
  82     char buf[LE_MAX];
  83 };
  84
  85 int outfd = -1;
  86
  87 gboolean terminate_threads = FALSE;
  88
  89 static gboolean write_pidfile(pid_t pid)
  90 {
  91     gboolean res;
  92
  93     char *strpid = g_strdup_printf("%d\n", pid);
  94     res = g_file_set_contents(PIDFILE, strpid, strlen(strpid), NULL);
  95     g_free(strpid);
  96
  97     return res;
  98 }
  99
 100 static GAsyncQueue *queue;
 101
 102 ssize_t
 103 safe_write(int fd, char *buf, size_t count)
 104 {
 105   ssize_t n;
 106
 107   do {
 108     n = write(fd, buf, count);
 109   } while (n < 0 && errno == EINTR);
 110
 111   return n;
 112 }
 113
 114 static gpointer
 115 log_writer_thread(gpointer data)
 116 {
 117     while (1) {
 118         struct log_entry *le = (struct log_entry *)g_async_queue_timeout_pop(queue, 250000);
 119         if (le == NULL) {
 120             if (terminate_threads) {
 121                 return NULL;
 122             }
 123             continue;
 124         }
 125
 126         int res = safe_write(outfd, le->buf, le->len);
 127
 128         g_free(le);
 129
 130         if (res < 0) {
 131             syslog(3, "writing log failed, stopping daemon - %s", strerror (errno));
 132             g_main_loop_quit(main_loop);
 133             return NULL;
 134         }
 135     }
 136
 137     return NULL;
 138 }
 139
 140 static int skipped_logs = 0;
 141
 142 static void log_status_message(guint loglevel, const char *fmt, ...);
 143
 144 static void
 145 queue_log_entry(struct log_entry *le)
 146 {
 147     gint len = g_async_queue_length(queue);
 148
 149     if (skipped_logs > 0) {
 150         if (len >= (LQ_LEN - 1)) {
 151             skipped_logs++;
 152         } else {
 153             int skip_tmp = skipped_logs;
 154             skipped_logs = 0; // clear before calling log_status_message()
 155             log_status_message(3, "skipped %d log entries (queue full)", skip_tmp);
 156             g_async_queue_push(queue, le);
 157         }
 158     } else {
 159         if (len >= LQ_LEN) {
 160             skipped_logs++;
 161         } else {
 162             g_async_queue_push(queue, le);
 163         }
 164     }
 165 }
 166
 167
 168 #define LEPRINTF(format, ...) { if (le->len < LE_MAX) le->len += snprintf(le->buf + le->len, LE_MAX - le->len, format, ##__VA_ARGS__); }
 169 #define LEPRINTTIME(sec) { time_t tmp_sec = sec; if (le->len < (LE_MAX - 30)) le->len += strftime(le->buf + le->len, LE_MAX - le->len, "%d/%b/%Y:%H:%M:%S %z ", localtime(&tmp_sec)); }
 170
 171 static void
 172 log_status_message(guint loglevel, const char *fmt, ...)
 173 {
 174     va_list ap;
 175     va_start(ap, fmt);
 176
 177     if (loglevel > 7 ) loglevel = 7; // syslog defines level 0-7
 178
 179     struct log_entry *le = g_new0(struct log_entry, 1);
 180
 181     LEPRINTF("0 %d - ", loglevel);
 182
 183     LEPRINTTIME(time(NULL));
 184
 185     le->len += vsnprintf(le->buf + le->len, LE_MAX - le->len, fmt, ap);
 186
 187     LEPRINTF("\n");
 188
 189     queue_log_entry(le);
 190
 191     // also log to syslog
 192
 193     vsyslog(loglevel, fmt, ap);
 194 }
 195
 196 static int
 197 print_tcp(struct log_entry *le, struct tcphdr *h, int payload_len)
 198 {
 199     LEPRINTF("PROTO=TCP ");
 200
 201     if (payload_len < sizeof(struct tcphdr)) {
 202         LEPRINTF("LEN=%d ", payload_len);
 203         LEPRINTF("INVALID=LEN ");
 204         return -1;
 205     }
 206
 207     LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
 208     LEPRINTF("SEQ=%u ACK=%u ", ntohl(h->seq), ntohl(h->ack_seq));
 209     LEPRINTF("WINDOW=%u ", ntohs(h->window));
 210
 211     if (h->urg) LEPRINTF("URG ");
 212     if (h->ack) LEPRINTF("ACK ");
 213     if (h->psh) LEPRINTF("PSH ");
 214     if (h->rst) LEPRINTF("RST ");
 215     if (h->syn) LEPRINTF("SYN ");
 216     if (h->fin) LEPRINTF("FIN ");
 217
 218     if (h->urg) LEPRINTF("URGP=%u ",ntohs(h->urg_ptr));
 219
 220     return 0;
 221 }
 222
 223 static int
 224 print_udp(struct log_entry *le, struct udphdr *h, int payload_len)
 225 {
 226     LEPRINTF("PROTO=UDP ");
 227
 228     if (payload_len < sizeof(struct udphdr)) {
 229         LEPRINTF("LEN=%d ", payload_len);
 230         LEPRINTF("INVALID=LEN ");
 231         return -1;
 232     }
 233
 234     LEPRINTF("SPT=%u DPT=%u LEN=%u", ntohs(h->source), ntohs(h->dest), ntohs(h->len));
 235
 236     return 0;
 237 }
 238
 239 static int
 240 print_icmp(struct log_entry *le, struct icmphdr *h, int payload_len)
 241 {
 242     char tmp[INET_ADDRSTRLEN];
 243     u_int32_t gateway;
 244
 245     LEPRINTF("PROTO=ICMP ");
 246
 247     if (payload_len < sizeof(struct icmphdr)) {
 248         LEPRINTF("LEN=%d ", payload_len);
 249         LEPRINTF("INVALID=LEN ");
 250         return -1;
 251     }
 252
 253     LEPRINTF("TYPE=%u CODE=%u ", h->type, h->code);
 254
 255     switch (h->type) {
 256     case ICMP_ECHO:
 257     case ICMP_ECHOREPLY:
 258         LEPRINTF("ID=%u SEQ=%u ", ntohs(h->un.echo.id), ntohs(h->un.echo.sequence));
 259         break;
 260     case ICMP_PARAMETERPROB:
 261         LEPRINTF("PARAMETER=%u ", ntohl(h->un.gateway) >> 24);
 262         break;
 263     case ICMP_REDIRECT:
 264         gateway = ntohl(h->un.gateway);
 265         inet_ntop(AF_INET, &gateway, tmp, sizeof(tmp));
 266         LEPRINTF("GATEWAY=%s ", tmp);
 267         break;
 268     case ICMP_DEST_UNREACH:
 269         if (h->code == ICMP_FRAG_NEEDED) {
 270             LEPRINTF("MTU=%u ", ntohs(h->un.frag.mtu));
 271         }
 272         break;
 273     }
 274
 275     return 0;
 276 }
 277
 278 /* Section 3.1.  SCTP Common Header Format */
 279 typedef struct sctphdr {
 280         __be16 source;
 281         __be16 dest;
 282         __be32 vtag;
 283         __be32 checksum;
 284 } __attribute__((packed)) sctp_sctphdr_t;
 285
 286 static int
 287 print_sctp(struct log_entry *le, struct sctphdr *h, int payload_len)
 288 {
 289     LEPRINTF("PROTO=SCTP ");
 290
 291     if (payload_len < sizeof(struct sctphdr)) {
 292         LEPRINTF("LEN=%d ", payload_len);
 293         LEPRINTF("INVALID=LEN ");
 294         return -1;
 295     }
 296
 297     LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
 298
 299     return 0;
 300 }
 301
 302 static int
 303 print_iphdr(struct log_entry *le, char * payload, int payload_len)
 304 {
 305     if (payload_len < sizeof(struct iphdr)) {
 306        LEPRINTF("LEN=%d ", payload_len);
 307        LEPRINTF("INVALID=LEN ");
 308        return -1;
 309     }
 310
 311     struct iphdr *h = (struct iphdr *)payload;
 312
 313     if (payload_len <= (u_int32_t)(h->ihl * 4)) {
 314         LEPRINTF("INVALID=IHL ");
 315         return -1;
 316     }
 317
 318     char tmp[INET_ADDRSTRLEN];
 319
 320     inet_ntop(AF_INET, &h->saddr, tmp, sizeof(tmp));
 321     LEPRINTF("SRC=%s ", tmp);
 322     inet_ntop(AF_INET, &h->daddr, tmp, sizeof(tmp));
 323     LEPRINTF("DST=%s ", tmp);
 324
 325     LEPRINTF("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
 326              ntohs(h->tot_len),  h->tos & IPTOS_TOS_MASK,
 327              h->tos & IPTOS_PREC_MASK, h->ttl, ntohs(h->id));
 328
 329     short ip_off = ntohs(h->frag_off);
 330     if (ip_off & IP_OFFMASK)
 331         LEPRINTF("FRAG=%u ", ip_off & IP_OFFMASK);
 332
 333     if (ip_off & IP_DF) LEPRINTF("DF ");
 334     if (ip_off & IP_MF) LEPRINTF("MF ");
 335
 336     void *nexthdr = (u_int32_t *)h + h->ihl;
 337     payload_len -= h->ihl * 4;
 338
 339     switch (h->protocol) {
 340     case IPPROTO_TCP:
 341         print_tcp(le, (struct tcphdr *)nexthdr, payload_len);
 342         break;
 343     case IPPROTO_UDP:
 344         print_udp(le, (struct udphdr *)nexthdr, payload_len);
 345         break;
 346     case IPPROTO_ICMP:
 347         print_icmp(le, (struct icmphdr *)nexthdr, payload_len);
 348         break;
 349     case IPPROTO_SCTP:
 350         print_sctp(le, (struct sctphdr *)nexthdr, payload_len);
 351         break;
 352     case IPPROTO_AH:
 353         LEPRINTF("PROTO=AH ");
 354         break;
 355     case IPPROTO_ESP:
 356         LEPRINTF("PROTO=ESP ");
 357         break;
 358     case IPPROTO_IGMP:
 359         LEPRINTF("PROTO=IGMP ");
 360         break;
 361      default:
 362         LEPRINTF("PROTO=%u ", h->protocol);
 363     }
 364
 365     return 0;
 366 }
 367
 368 static int
 369 print_ip6hdr(struct log_entry *le, char * payload, int payload_len)
 370 {
 371     LEPRINTF("IPV6 logging not implemented ");
 372
 373     return 0;
 374 }
 375
 376 // ebtables -I FORWARD --nflog --nflog-group 0
 377 static int
 378 print_arp(struct log_entry *le, struct ether_arp *h, int payload_len)
 379 {
 380     if (payload_len < sizeof(struct ether_arp)) {
 381         LEPRINTF("LEN=%d ", payload_len);
 382         LEPRINTF("INVALID=LEN ");
 383         return -1;
 384     }
 385
 386     LEPRINTF("SRC=%u.%u.%u.%u ", h->arp_spa[0], h->arp_spa[1],
 387              h->arp_spa[2], h->arp_spa[3]);
 388
 389     LEPRINTF("DST=%u.%u.%u.%u ", h->arp_tpa[0], h->arp_tpa[1],
 390              h->arp_tpa[2], h->arp_tpa[3]);
 391
 392     LEPRINTF("PROTO=ARP ");
 393
 394     unsigned short code = ntohs(h->arp_op);
 395     switch (code) {
 396     case ARPOP_REQUEST:
 397         LEPRINTF("REQUEST ");
 398         break;
 399     case ARPOP_REPLY:
 400         LEPRINTF("REPLY MAC=%02x:%02x:%02x:%02x:%02x:%02x ",
 401                  h->arp_sha[0], h->arp_sha[1], h->arp_sha[2],
 402                  h->arp_sha[3], h->arp_sha[4], h->arp_sha[5]);
 403         break;
 404     case ARPOP_NAK:
 405         LEPRINTF("NAK ");
 406         break;
 407     default:
 408         LEPRINTF("CODE=%u ", code);
 409     }
 410
 411
 412     // LEPRINTF("HTYPE=%u ", ntohs(h->arp_hrd));
 413
 414     // LEPRINTF("PTYPE=%u ", ntohs(h->arp_pro));
 415
 416     return 0;
 417 }
 418
 419
 420 static int print_pkt(struct log_entry *le, struct nflog_data *ldata, u_int8_t family)
 421 {
 422     u_int32_t mark = nflog_get_nfmark(ldata);
 423     u_int32_t indev = nflog_get_indev(ldata);
 424     u_int32_t outdev = nflog_get_outdev(ldata);
 425     u_int32_t physindev = nflog_get_physindev(ldata);
 426     u_int32_t physoutdev = nflog_get_physoutdev(ldata);
 427
 428     char *prefix = nflog_get_prefix(ldata);
 429     char *payload;
 430     char devname[256];
 431
 432     guint32 vmid = 0;
 433
 434     guint8 log_level = 6; // info
 435
 436     char *chain_name = "-";
 437
 438     if (prefix != NULL) {
 439         // Note: parse ":$vmid:$loglevel:$chain: $msg"
 440         if (prefix[0] == ':') {
 441             char *p = prefix + 1;
 442             guint32 tmpid = 0;
 443             while(*p  >= '0' && *p <= '9') { tmpid *= 10; tmpid += *p - '0'; p++; }
 444
 445             if ((*p == ':') &&
 446                 (p[1] >= '0' && p[1] <= '7') &&
 447                 (p[2] == ':')) {
 448
 449                 guint8 tmp_level = p[1] - '0'; // store for later use
 450                 char *chain_start = p + 3; // store for later use
 451                 p = chain_start;
 452                 while (*p && *p != ':' && *p != ' ') p++;
 453                 int len = p - chain_start;
 454
 455                 if (*p == ':' && p[1] == ' ' && len && (len <= MAX_CHAIN_LEN)) {
 456                     // parsing successful
 457
 458                     *p = 0; // terminate string
 459
 460                     vmid = tmpid;
 461                     log_level = tmp_level;
 462                     chain_name = chain_start;
 463                     prefix = p + 2; // the rest
 464                 }
 465             }
 466         }
 467     }
 468
 469     LEPRINTF("%d ", vmid);
 470
 471     LEPRINTF("%d ", log_level);
 472
 473     LEPRINTF("%s ", chain_name);
 474
 475     struct timeval ts;
 476     nflog_get_timestamp(ldata, &ts);
 477
 478     LEPRINTTIME(ts.tv_sec);
 479
 480     if (prefix != NULL) {
 481         LEPRINTF("%s", prefix);
 482     }
 483
 484     if (indev > 0) {
 485         if (nlif_index2name(nlifh, indev, devname) != -1) {
 486             LEPRINTF("IN=%s ", devname);
 487         } else {
 488             LEPRINTF("IN=%u ", indev);
 489         }
 490     }
 491
 492     if (outdev > 0) {
 493         if (nlif_index2name(nlifh, outdev, devname) != -1) {
 494             LEPRINTF("OUT=%s ", devname);
 495         } else {
 496             LEPRINTF("OUT=%u ", outdev);
 497         }
 498     }
 499
 500     if (physindev > 0) {
 501         if (nlif_index2name(nlifh, physindev, devname) != -1) {
 502             LEPRINTF("PHYSIN=%s ", devname);
 503         } else {
 504             LEPRINTF("PHYSIN=%u ", physindev);
 505         }
 506     }
 507
 508     if (physoutdev > 0) {
 509         if (nlif_index2name(nlifh, physoutdev, devname) != -1) {
 510             LEPRINTF("PHYSOUT=%s ", devname);
 511         } else {
 512             LEPRINTF("PHYSOUT=%u ", physoutdev);
 513         }
 514     }
 515
 516     int payload_len = nflog_get_payload(ldata, &payload);
 517
 518     int hwhdrlen = nflog_get_msg_packet_hwhdrlen(ldata);
 519     if (hwhdrlen > 0) {
 520         unsigned char *hwhdr = (unsigned char *)nflog_get_msg_packet_hwhdr(ldata);
 521         if (hwhdr != NULL) {
 522             int i;
 523             LEPRINTF("MAC=");
 524             for (i = 0; i < hwhdrlen; i++) {
 525                 LEPRINTF("%02x", hwhdr[i]);
 526                 if (i < (hwhdrlen -1 )) LEPRINTF(":");
 527             }
 528             LEPRINTF(" ");
 529         }
 530     }
 531
 532     u_int16_t hw_protocol = 0;
 533     struct nfulnl_msg_packet_hdr *ph = NULL;
 534
 535     switch (family) {
 536     case AF_INET:
 537         print_iphdr(le, payload, payload_len);
 538         break;
 539     case AF_INET6:
 540         print_ip6hdr(le, payload, payload_len);
 541         break;
 542     case AF_BRIDGE:
 543         ph = nflog_get_msg_packet_hdr(ldata);
 544         if (ph) hw_protocol = ntohs(ph->hw_protocol);
 545
 546         switch (hw_protocol) {
 547         case ETH_P_IP:
 548             print_iphdr(le, payload, payload_len);
 549             break;
 550         case ETH_P_IPV6:
 551              print_ip6hdr(le, payload, payload_len);
 552             break;
 553         case ETH_P_ARP:
 554             print_arp(le, (struct ether_arp *)payload, payload_len);
 555             break;
 556         }
 557         break;
 558     }
 559
 560     if (mark) LEPRINTF("mark=%u ", mark);
 561
 562
 563     return 0;
 564
 565 }
 566
 567 static int
 568 nflog_cb(struct nflog_g_handle *gh, struct nfgenmsg *nfmsg,
 569                struct nflog_data *nfa, void *data)
 570 {
 571     struct log_entry *le = g_new0(struct log_entry, 1);
 572
 573     print_pkt(le, nfa, nfmsg->nfgen_family);
 574
 575     LEPRINTF("\n"); // add newline
 576
 577     queue_log_entry(le);
 578
 579     return 0;
 580 }
 581
 582 static gboolean
 583 nflog_read_cb(GIOChannel *source,
 584               GIOCondition condition,
 585               gpointer data)
 586 {
 587     int rv = 0;
 588     gchar buf[8192];
 589
 590     int fd =  g_io_channel_unix_get_fd(source);
 591
 592     if ((rv = recv(fd, buf, sizeof(buf), 0)) && rv >= 0) {
 593          nflog_handle_packet(logh, buf, rv);
 594     }
 595
 596     return TRUE;
 597 }
 598
 599 static gboolean
 600 nlif_read_cb(GIOChannel *source,
 601              GIOCondition condition,
 602              gpointer data)
 603 {
 604     static int last_res = 0;
 605     int res;
 606
 607     if ((res = nlif_catch(nlifh)) < 0) {
 608         if (last_res == 0) { // only report once
 609             log_status_message(3, "nlif_catch failed (res = %d)", res);
 610         }
 611         last_res = res;
 612     } else {
 613         last_res = 0;
 614     }
 615
 616     return TRUE;
 617 }
 618
 619 static gboolean
 620 terminate_request(gpointer data)
 621 {
 622     terminate_threads = TRUE;
 623
 624     log_status_message(5, "received terminate request (signal)");
 625
 626     g_main_loop_quit(main_loop);
 627
 628     return TRUE;
 629 }
 630
 631
 632 int
 633 main(int argc, char *argv[])
 634 {
 635     int lockfd = -1;
 636     gboolean foreground = FALSE;
 637     gboolean wrote_pidfile = FALSE;
 638
 639     g_thread_init(NULL);
 640
 641     openlog("pvepw-logger", LOG_CONS|LOG_PID, LOG_DAEMON);
 642
 643     if ((lockfd = open(LOCKFILE, O_RDWR|O_CREAT|O_APPEND, 0644)) == -1) {
 644         fprintf(stderr, "unable to create lock '%s': %s", LOCKFILE, strerror (errno) );
 645         exit(-1);
 646     }
 647
 648     for (int i = 10; i >= 0; i--) {
 649         if (flock(lockfd, LOCK_EX|LOCK_NB) != 0) {
 650             if (!i) {
 651                 fprintf(stderr, "unable to aquire lock '%s': %s", LOCKFILE, strerror (errno));
 652                 exit(-1);
 653             }
 654             if (i == 10)
 655                 fprintf(stderr, "unable to aquire lock '%s' - trying again.\n", LOCKFILE);
 656
 657             sleep(1);
 658         }
 659     }
 660
 661     if ((outfd = open(LOGFILE, O_WRONLY|O_CREAT|O_APPEND, 0644)) == -1) {
 662         fprintf(stderr, "unable to open file '%s': %s", LOGFILE, strerror (errno));
 663         exit(-1);
 664     }
 665
 666     if ((logh = nflog_open())  == NULL) {
 667         fprintf(stderr, "unable to open nflog\n");
 668         exit(-1);
 669     }
 670
 671     if (!nflog_bind_pf(logh, AF_INET) <= 0) {
 672         fprintf(stderr, "nflog_bind_pf AF_INET failed\n");
 673         exit(-1);
 674     }
 675
 676 #if 0
 677     if (!nflog_bind_pf(logh, AF_INET6) <= 0) {
 678         fprintf(stderr, "nflog_bind_pf AF_INET6 failed\n");
 679         exit(-1);
 680     }
 681 #endif
 682
 683     if (!nflog_bind_pf(logh, AF_BRIDGE) <= 0) {
 684         fprintf(stderr, "nflog_bind_pf AF_BRIDGE failed\n");
 685         exit(-1);
 686     }
 687
 688     struct nflog_g_handle *qh = nflog_bind_group(logh, 0);
 689     if (!qh) {
 690         fprintf(stderr, "no handle for group 1\n");
 691         exit(-1);
 692     }
 693
 694     if (nflog_set_mode(qh, NFULNL_COPY_PACKET, 0xffff) < 0) {
 695         fprintf(stderr, "can't set packet copy mode\n");
 696         exit(-1);
 697     }
 698
 699     if ((nlifh = nlif_open()) == NULL) {
 700         fprintf(stderr, "unable to open netlink interface handle\n");
 701         exit(-1);
 702     }
 703
 704     if (!foreground) {
 705         pid_t cpid = fork();
 706
 707         if (cpid == -1) {
 708             fprintf(stderr, "failed to daemonize program - %s\n", strerror (errno));
 709             exit(-1);
 710         } else if (cpid) {
 711             write_pidfile(cpid);
 712             _exit(0);
 713         } else {
 714             int nullfd;
 715
 716             if (chroot("/") != 0) fprintf(stderr, "chroot '/' failed - %s\n", strerror (errno));
 717
 718             if ((nullfd = open("/dev/null", O_RDWR, 0)) != -1) {
 719                 dup2(nullfd, 0);
 720                 dup2(nullfd, 1);
 721                 dup2(nullfd, 2);
 722                 if (nullfd > 2)
 723                     close (nullfd);
 724             }
 725
 726             setsid();
 727         }
 728     } else {
 729         write_pidfile(getpid());
 730     }
 731
 732     wrote_pidfile = TRUE;
 733
 734     nflog_callback_register(qh, &nflog_cb, logh);
 735
 736     queue = g_async_queue_new_full(g_free);
 737
 738     log_status_message(5, "starting pvefw logger");
 739
 740     nlif_query(nlifh);
 741
 742     GIOChannel *nlif_ch = g_io_channel_unix_new(nlif_fd(nlifh));
 743
 744     g_io_add_watch(nlif_ch, G_IO_IN, nlif_read_cb, NULL);
 745
 746     int logfd = nflog_fd(logh);
 747     GIOChannel *nflog_ch = g_io_channel_unix_new(logfd);
 748
 749     g_io_add_watch(nflog_ch, G_IO_IN, nflog_read_cb, NULL);
 750
 751     GThread *wthread = g_thread_new("log_writer_thread", log_writer_thread, NULL);
 752
 753     main_loop = g_main_loop_new(NULL, TRUE);
 754
 755     g_unix_signal_add(SIGINT, terminate_request, NULL);
 756     g_unix_signal_add(SIGTERM, terminate_request, NULL);
 757
 758     g_main_loop_run(main_loop);
 759
 760     log_status_message(5, "stopping pvefw logger");
 761
 762     g_thread_join(wthread);
 763
 764     close(outfd);
 765
 766     nflog_close(logh);
 767
 768     if (wrote_pidfile)
 769         unlink(PIDFILE);
 770
 771     exit(0);
 772 }