/*	$NetBSD: ipmon.c,v 1.3 1997/03/29 04:31:25 darrenr Exp $	*/

/*
 * (C)opyright 1993-1996 by Darren Reed.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that this notice is preserved and due credit is given
 * to the original author and the contributors.
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#if !defined(__SVR4) && !defined(__svr4__)
#include <strings.h>
#include <sys/dir.h>
#else
#include <sys/byteorder.h>
#endif
#include <sys/types.h>
#include <sys/param.h>
#include <sys/file.h>
#include <stdlib.h>
#include <stddef.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <net/if.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <arpa/nameser.h>
#include <resolv.h>

#include <sys/uio.h>
#include <sys/protosw.h>
#include <sys/user.h>

#include <netinet/ip_var.h>
#include <netinet/tcp.h>
#include <netinet/tcpip.h>
#include <netinet/ip_icmp.h>

#include <ctype.h>
#include <syslog.h>

#include <netinet/ip_fil.h>
#include <netinet/ip_compat.h>

#if !defined(lint) && defined(LIBC_SCCS)
static	char	sccsid[] = "@(#)ipmon.c	1.21 6/5/96 (C)1993-1996 Darren Reed";
static	char	rcsid[] = "Id: ipmon.c,v 2.0.2.4 1997/03/29 02:49:44 darrenr Exp ";
#endif


struct	flags {
	int	value;
	char	flag;
};

struct	flags	tcpfl[] = {
	{ TH_ACK, 'A' },
	{ TH_RST, 'R' },
	{ TH_SYN, 'S' },
	{ TH_FIN, 'F' },
	{ TH_URG, 'U' },
	{ TH_PUSH,'P' },
	{ 0, '\0' }
};


static	char	line[2048];
static	int	opts = 0;
static	void	usage __P((char *));
static	void	printpacket __P((FILE *, char *, int));
static	void	dumphex __P((FILE *, u_char *, int));
static	void	printiplci __P((struct ipl_ci *));
static	void	resynclog __P((int, struct ipl_ci *, FILE *));
static	int	readlogentry __P((int, int *, char *, int, FILE *));
char	*hostname __P((int, struct in_addr));
char	*portname __P((int, char *, u_short));
int	main __P((int, char *[]));

#define	OPT_SYSLOG	0x01
#define	OPT_RESOLVE	0x02
#define	OPT_HEXBODY	0x04
#define	OPT_VERBOSE	0x08
#define	OPT_HEXHDR	0x10
#define	OPT_TAIL	0x20

#ifndef	LOGFAC
#define	LOGFAC	LOG_LOCAL0
#endif

static void printiplci(icp)
struct ipl_ci *icp;
{
	printf("sec %ld usec %ld hlen %d plen %d\n", icp->sec, icp->usec,
		icp->hlen, icp->plen);
}


void resynclog(fd, iplcp, log)
int fd;
struct ipl_ci *iplcp;
FILE *log;
{
	time_t	now;
	char	*s = NULL;
	int	len, nr = 0;

	do {
		if (s) {
			s = (char *)&iplcp->sec;
			if (opts & OPT_SYSLOG) {
				syslog(LOG_INFO, "Sync bytes:");
				syslog(LOG_INFO, " %02x %02x %02x %02x",
					*s, *(s+1), *(s+2), *(s+3));
				syslog(LOG_INFO, " %02x %02x %02x %02x\n",
					*(s+4), *(s+5), *(s+6), *(s+7));
			} else {
				fprintf(log, "Sync bytes:");
				fprintf(log, " %02x %02x %02x %02x",
					*s, *(s+1), *(s+2), *(s+3));
				fprintf(log, " %02x %02x %02x %02x\n",
					*(s+4), *(s+5), *(s+6), *(s+7));
			}
		}
		do {
			s = (char *)&iplcp->sec;
			len = sizeof(iplcp->sec);
			while (len) {
				switch ((nr = read(fd, s, len)))
				{
				case -1:
				case 0:
					return;
				default :
					s += nr;
					len -= nr;
					now = time(NULL);
					break;
				}
			}
		} while ((now < iplcp->sec) ||
			 ((iplcp->sec - now) > (86400*5)));

		len = sizeof(iplcp->usec);
		while (len) {
			switch ((nr = read(fd, s, len)))
			{
			case -1:
			case 0:
				return;
			default :
				s += nr;
				len -= nr;
				break;
			}
		}
	} while (iplcp->usec > 1000000);

	len = sizeof(*iplcp) - sizeof(iplcp->sec) - sizeof(iplcp->usec);
	while (len) {
		switch ((nr = read(fd, s, len)))
		{
		case -1:
		case 0:
			return;
		default :
			s += nr;
			len -= nr;
			break;
		}
	}
}


static int readlogentry(fd, lenp, buf, bufsize, log)
int fd, bufsize, *lenp;
char *buf;
FILE *log;
{
	struct	ipl_ci	*icp = (struct ipl_ci *)buf;
	time_t	now;
	char	*s;
	int	len, n = bufsize, tr = sizeof(struct ipl_ci), nr;

	if (bufsize < tr)
		return 1;
	for (s = buf; (n > 0) && (tr > 0); s += nr, n -= nr) {
		nr = read(fd, s, tr);
		if (nr > 0)
			tr -= nr;
		else {
			if (!nr && (opts & OPT_TAIL))
				sleep(1);
			else
				return -1;
		}
	}

	now = time(NULL);
	if ((icp->hlen > 92) || (now < icp->sec) ||
	    ((now - icp->sec) > (86400*5))) {
		if (opts & OPT_SYSLOG)
			syslog(LOG_INFO, "Out of sync! (1,%x)\n", now);
		else
			fprintf(log, "Out of sync! (1,%x)\n", now);
		dumphex(log, buf, sizeof(struct ipl_ci));
		resynclog(fd, icp, log);
	}


	len = (int)((u_int)icp->plen);
	if (len > 128 || len < 0) {
		if (opts & OPT_SYSLOG)
			syslog(LOG_INFO, "Out of sync! (2,%d)\n", len);
		else
			fprintf(log, "Out of sync! (2,%d)\n", len);
		dumphex(log, buf, sizeof(struct ipl_ci));
		resynclog(fd, icp, log);
	}


	tr = icp->hlen + icp->plen;
	if (n < tr)
		return 1;

	for (; (n > 0) && (tr > 0); s += nr, n-= nr) {
		nr = read(fd, s, tr);
		if (nr > 0)
			tr -= nr;
		else
			return -1;
	}
	*lenp = s - buf;
	return 0;
}


char	*hostname(res, ip)
int	res;
struct	in_addr	ip;
{
	struct hostent *hp;

	if (!res)
		return inet_ntoa(ip);
	hp = gethostbyaddr((char *)&ip, sizeof(ip), AF_INET);
	if (!hp)
		return inet_ntoa(ip);
	return hp->h_name;
}


char	*portname(res, proto, port)
int	res;
char	*proto;
u_short	port;
{
	static	char	pname[8];
	struct	servent	*serv;

	(void) sprintf(pname, "%hu", htons(port));
	if (!res)
		return pname;
	serv = getservbyport((int)port, proto);
	if (!serv)
		return pname;
	return serv->s_name;
}


static	void	dumphex(log, buf, len)
FILE	*log;
u_char	*buf;
int	len;
{
	char	line[80];
	int	i, j, k;
	u_char	*s = buf, *t = (u_char *)line;

	for (i = len, j = 0; i; i--, j++, s++) {
		if (j && !(j & 0xf)) {
			*t++ = '\n';
			*t = '\0';
			fputs(line, stdout);
			t = (u_char *)line;
			*t = '\0';
		}
		sprintf(t, "%02x", *s & 0xff);
		t += 2;
		if (!((j + 1) & 0xf)) {
			s -= 15;
			sprintf(t, "        ");
			t += 8;
			for (k = 16; k; k--, s++)
				*t++ = (isprint(*s) ? *s : '.');
			s--;
		}
			
		if ((j + 1) & 0xf)
			*t++ = ' ';;
	}

	if (j & 0xf) {
		for (k = 16 - (j & 0xf); k; k--) {
			*t++ = ' ';
			*t++ = ' ';
			*t++ = ' ';
		}
		sprintf(t, "       ");
		t += 7;
		s -= j & 0xf;
		for (k = j & 0xf; k; k--, s++)
			*t++ = (isprint(*s) ? *s : '.');
		*t++ = '\n';
		*t = '\0';
	}
	fputs(line, stdout);
	fflush(stdout);
}


static	void	printpacket(log, buf, blen)
FILE	*log;
char	*buf;
int	blen;
{
	struct	protoent *pr;
	struct	tcphdr	*tp;
	struct	icmp	*ic;
	struct	ip	*ipc;
	struct	tm	*tm;
	char	c[3], pname[8], *t, *proto;
	u_short	hl, p;
	int	i, lvl, res;
#if !SOLARIS && !(defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603))
	int	len;
#endif
	struct	ip	*ip;
	struct	ipl_ci	*lp;

	lp = (struct ipl_ci *)buf;
	ip = (struct ip *)(buf + sizeof(*lp));
	res = (opts & OPT_RESOLVE) ? 1 : 0;
	t = line;
	*t = '\0';
	hl = (ip->ip_hl << 2);
	p = (u_short)ip->ip_p;
	tm = localtime((time_t *)&lp->sec);
	if (!(opts & OPT_SYSLOG)) {
		(void) sprintf(t, "%2d/%02d/%4d ",
			tm->tm_mday, tm->tm_mon + 1, tm->tm_year + 1900);
		t += strlen(t);
	}
#if SOLARIS || (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603))
	(void) sprintf(t, "%02d:%02d:%02d.%-.6ld %.*s @%hd ",
		tm->tm_hour, tm->tm_min, tm->tm_sec, lp->usec,
		(int)sizeof(lp->ifname), lp->ifname, lp->rule);
#else
	for (len = 0; len < 3; len++)
		if (!lp->ifname[len])
			break;
	if (lp->ifname[len])
		len++;
	(void) sprintf(t, "%02d:%02d:%02d.%-.6ld %*.*s%ld @%hd ",
		tm->tm_hour, tm->tm_min, tm->tm_sec, lp->usec,
		len, len, lp->ifname, lp->unit, lp->rule);
#endif
	pr = getprotobynumber((int)p);
	if (!pr) {
		proto = pname;
		sprintf(proto, "%d", (u_int)p);
	} else
		proto = pr->p_name;

 	if (lp->flags & (FI_SHORT << 20)) {
		c[0] = 'S';
		lvl = LOG_ERR;
	} else if (lp->flags & FR_PASS) {
		if (lp->flags & FR_LOGP)
			c[0] = 'p';
		else
			c[0] = 'P';
		lvl = LOG_NOTICE;
	} else if (lp->flags & FR_BLOCK) {
		if (lp->flags & FR_LOGB)
			c[0] = 'b';
		else
			c[0] = 'B';
		lvl = LOG_WARNING;
	} else if (lp->flags & FF_LOGNOMATCH) {
		c[0] = 'n';
		lvl = LOG_NOTICE;
	} else {
		c[0] = 'L';
		lvl = LOG_INFO;
	}
	c[1] = ' ';
	c[2] = '\0';
	(void) strcat(line, c);
	t = line + strlen(line);

	if ((p == IPPROTO_TCP || p == IPPROTO_UDP) && !(ip->ip_off & 0x1fff)) {
		tp = (struct tcphdr *)((char *)ip + hl);
		if (!(lp->flags & (FI_SHORT << 16))) {
			(void) sprintf(t, "%s,%s -> ",
				hostname(res, ip->ip_src),
				portname(res, proto, tp->th_sport));
			t += strlen(t);
			(void) sprintf(t, "%s,%s PR %s len %hu %hu ",
				hostname(res, ip->ip_dst),
				portname(res, proto, tp->th_dport),
				proto, hl, ip->ip_len);
			t += strlen(t);

			if (p == IPPROTO_TCP) {
				*t++ = '-';
				for (i = 0; tcpfl[i].value; i++)
					if (tp->th_flags & tcpfl[i].value)
						*t++ = tcpfl[i].flag;
			}
			if (opts & OPT_VERBOSE) {
				(void) sprintf(t, " %lu %lu %hu",
					(u_long)tp->th_seq,
					(u_long)tp->th_ack, tp->th_win);
				t += strlen(t);
			}
			*t = '\0';
		} else {
			(void) sprintf(t, "%s -> ", hostname(res, ip->ip_src));
			t += strlen(t);
			(void) sprintf(t, "%s PR %s len %hu %hu",
				hostname(res, ip->ip_dst), proto,
				hl, ip->ip_len);
		}
	} else if (p == IPPROTO_ICMP) {
		ic = (struct icmp *)((char *)ip + hl);
		(void) sprintf(t, "%s -> ", hostname(res, ip->ip_src));
		t += strlen(t);
		(void) sprintf(t, "%s PR icmp len %hu (%hu) icmp %d/%d",
			hostname(res, ip->ip_dst), hl,
			ip->ip_len, ic->icmp_type, ic->icmp_code);
		if (ic->icmp_type == ICMP_UNREACH ||
		    ic->icmp_type == ICMP_SOURCEQUENCH ||
		    ic->icmp_type == ICMP_PARAMPROB ||
		    ic->icmp_type == ICMP_REDIRECT ||
		    ic->icmp_type == ICMP_TIMXCEED) {
			ipc = &ic->icmp_ip;
			tp = (struct tcphdr *)((char *)ipc + hl);

			p = (u_short)ipc->ip_p;
			pr = getprotobynumber((int)p);
			if (!pr) {
				proto = pname;
				(void) sprintf(proto, "%d", (int)p);
			} else
				proto = pr->p_name;

			t += strlen(t);
			(void) sprintf(t, " for %s,%s -",
				hostname(res, ipc->ip_src),
				portname(res, proto, tp->th_sport));
			t += strlen(t);
			(void) sprintf(t, " %s,%s PR %s len %hu %hu",
				hostname(res, ipc->ip_dst),
				portname(res, proto, tp->th_dport),
				proto, ipc->ip_hl << 2, ipc->ip_len);
		}
	} else {
		(void) sprintf(t, "%s -> ", hostname(res, ip->ip_src));
		t += strlen(t);
		(void) sprintf(t, "%s PR %s len %hu (%hu)",
			hostname(res, ip->ip_dst), proto, hl, ip->ip_len);
		t += strlen(t);
		if (ip->ip_off & 0x1fff)
			(void) sprintf(t, " frag %s%s%hu@%hu",
				ip->ip_off & IP_MF ? "+" : "",
				ip->ip_off & IP_DF ? "-" : "",
				ip->ip_len - hl, (ip->ip_off & 0x1fff) << 3);
	}
	t += strlen(t);

	if (lp->flags & FR_KEEPSTATE) {
		(void) strcpy(t, " K-S");
		t += strlen(t);
	}

	if (lp->flags & FR_KEEPFRAG) {
		(void) strcpy(t, " K-F");
		t += strlen(t);
	}

	*t++ = '\n';
	*t++ = '\0';
	if (opts & OPT_SYSLOG)
		syslog(lvl, "%s", line);
	else
		(void) fprintf(log, "%s", line);
	if (opts & OPT_HEXHDR)
		dumphex(log, buf, sizeof(struct ipl_ci));
	if (opts & OPT_HEXBODY)
		dumphex(log, (u_char *)ip, lp->plen + lp->hlen);
	if (!(opts & OPT_SYSLOG))
		fflush(log);
}


void static usage(prog)
char *prog;
{
	fprintf(stderr, "%s: [-NFhstvxX] [-f <logfile>]\n", prog);
	exit(1);
}


int main(argc, argv)
int argc;
char *argv[];
{
	FILE	*log = NULL;
	int	fd = -1, flushed = 0, doread, n;
	char	buf[512], *iplfile = IPL_NAME;
	int	c;
	extern	int	optind;
	extern	char	*optarg;

	while ((c = getopt(argc, argv, "?Nf:FhstvxX")) != -1)
		switch (c)
		{
		case 'f' :
			iplfile = optarg;
			break;
		case 'F' :
			if ((fd == -1) &&
			    (fd = open(iplfile, O_RDWR)) == -1) {
				(void) fprintf(stderr, "%s: ", IPL_NAME);
				perror("open");
				exit(-1);
			}
			if (ioctl(fd, SIOCIPFFB, &flushed) == 0) {
				printf("%d bytes flushed from log buffer\n",
					flushed);
				fflush(stdout);
			} else
				perror("SIOCIPFFB");
			break;
		case 'N' :
			opts |= OPT_RESOLVE;
			break;
		case 's' :
			openlog(argv[0], LOG_NDELAY|LOG_PID, LOGFAC);
			opts |= OPT_SYSLOG;
			break;
		case 't' :
			opts |= OPT_TAIL;
			break;
		case 'v' :
			opts |= OPT_VERBOSE;
			break;
		case 'x' :
			opts |= OPT_HEXBODY;
			break;
		case 'X' :
			opts |= OPT_HEXHDR;
			break;
		default :
		case 'h' :
		case '?' :
			usage(argv[0]);
		}

	if ((fd == -1) && (fd = open(iplfile, O_RDONLY)) == -1) {
		(void) fprintf(stderr, "%s: ", IPL_NAME);
		perror("open");
		exit(-1);
	}

	if (!(opts & OPT_SYSLOG)) {
		log = argv[optind] ? fopen(argv[optind], "a") : stdout;
		setvbuf(log, NULL, _IONBF, 0);
	}

	if (flushed) {
		if (opts & OPT_SYSLOG)
			syslog(LOG_INFO, "%d bytes flushed from log\n",
				flushed);
		else
			fprintf(log, "%d bytes flushed from log\n", flushed);
	}

	for (doread = 1; doread; )
		switch (readlogentry(fd, &n, buf, sizeof(buf), log))
		{
		case -1 :
			if (opts & OPT_SYSLOG)
				syslog(LOG_ERR, "read: %m\n");
			else
				perror("read");
			doread = 0;
			break;
		case 1 :
			if (opts & OPT_SYSLOG)
				syslog(LOG_ERR, "aborting logging\n");
			else
				fprintf(log, "aborting logging\n");
			doread = 0;
			break;
		case 2 :
			break;
		case 0 :
			printpacket(log, buf, n);
			break;
		}
	exit(0);
	/* NOTREACHED */
}