test program for viewing netlink packets from the ulog watcher

1 files changed, 286 insertions, 0 deletions

diff --git a/examples/ulog/test_ulog.c b/examples/ulog/test_ulog.c
new file mode 100644
index 0000000..754d677
--- /dev/null
+++ b/examples/ulog/test_ulog.c
@@ -0,0 +1,286 @@
+
+/*
+ * Simple example program to log packets received with the ulog
+ * watcher of ebtables.
+ *
+ * usage:
+ * Add the appropriate ebtables ulog rule, e.g. (0 < NLGROUP < 33):
+ *   ebtables -A FORWARD --ulog-nlgroup NLGROUP
+ * Start this application somewhere:
+ *   test_ulog NLGROUP
+ *
+ * compile with make test_ulog KERNEL_INCLUDES=<path_to_kernel_include_dir>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+
+#include <asm/types.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <linux/netlink.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <netdb.h>
+#include <errno.h>
+#include <netinet/if_ether.h>
+#include <netinet/ether.h>
+#include <netinet/ip.h>
+#include <netinet/ip_icmp.h>
+#include "../../include/ebtables_u.h"
+#include "../../include/ethernetdb.h"
+#include <linux/netfilter_bridge/ebt_ulog.h>
+
+/* <linux/if_vlan.h> doesn't hand this to userspace :-( */
+#define VLAN_HLEN 4
+struct vlan_hdr {
+	unsigned short TCI;
+	unsigned short encap;
+};
+
+static struct sockaddr_nl sa_local =
+{
+	.nl_family = AF_NETLINK,
+	.nl_groups = 1,
+};
+
+static struct sockaddr_nl sa_kernel =
+{
+	.nl_family = AF_NETLINK,
+	.nl_pid = 0,
+	.nl_groups = 1,
+};
+
+static const char *hookstr[NF_BR_NUMHOOKS] =
+{
+        [NF_BR_POST_ROUTING] "POSTROUTING",
+         [NF_BR_PRE_ROUTING] "PREROUTING",
+           [NF_BR_LOCAL_OUT] "OUTPUT",
+            [NF_BR_LOCAL_IN] "INPUT",
+            [NF_BR_BROUTING] "BROUTING",
+             [NF_BR_FORWARD] "FORWARD"
+};
+
+#define DEBUG_QUEUE 0
+#define BUFLEN 65536
+static char buf[BUFLEN];
+static int sfd;
+
+/* Get the next ebt_ulog packet, talk to the kernel if necessary */
+ebt_ulog_packet_msg_t *ulog_get_packet()
+{
+	static struct nlmsghdr *nlh = NULL;
+	static int len, remain_len;
+	static int pkts_per_msg = 0;
+	ebt_ulog_packet_msg_t *msg;
+	socklen_t addrlen = sizeof(sa_kernel);
+
+	if (!nlh) {
+recv_new:
+		if (pkts_per_msg && DEBUG_QUEUE)
+			printf("PACKETS IN LAST MSG: %d\n", pkts_per_msg);
+		pkts_per_msg = 0;
+		len = recvfrom(sfd, buf, BUFLEN, 0,
+		               (struct sockaddr *)&sa_kernel, &addrlen);
+		if (errno == EINTR)
+			goto recv_new;
+		if (addrlen != sizeof(sa_kernel)) {
+			printf("addrlen %d != %d\n", addrlen,
+			       sizeof(sa_kernel));
+			exit(-1);
+		}
+		if (len == -1) {
+			perror("recvmsg");
+			exit(-1);
+		}
+		nlh = (struct nlmsghdr *)buf;
+		if (nlh->nlmsg_flags & MSG_TRUNC || len > BUFLEN) {
+			printf("Packet truncated");
+			exit(-1);
+		}
+		if (!NLMSG_OK(nlh, BUFLEN)) {
+			perror("Netlink message parse error\n");
+			return NULL;
+		}
+	}
+
+	msg = NLMSG_DATA(nlh);
+
+	remain_len = (len - ((char *)nlh - buf));
+	if (nlh->nlmsg_flags & NLM_F_MULTI && nlh->nlmsg_type != NLMSG_DONE)
+		nlh = NLMSG_NEXT(nlh, remain_len);
+	else
+		nlh = NULL;
+
+	pkts_per_msg++;
+	return msg;
+}
+
+int main(int argc, char **argv)
+{
+	int i, curr_len, pktcnt = 0;
+	int rcvbufsize = BUFLEN;
+	ebt_ulog_packet_msg_t *msg;
+	struct ethhdr *ehdr;
+	struct ethertypeent *etype;
+	struct protoent *prototype;
+	struct iphdr *iph;
+	struct icmphdr *icmph;
+	struct tm* ptm;
+	char time_str[40], *ctmp;
+
+	if (argc == 2) {
+		i = strtoul(argv[1], &ctmp, 10);
+		if (*ctmp != '\0' || i < 1 || i > 32) {
+			printf("Usage: %s <group number>\nWith  0 < group "
+			       "number < 33\n", argv[0]);
+			exit(0);
+		}
+		sa_local.nl_groups = sa_kernel.nl_groups = 1 << (i - 1);
+	}
+
+	sa_local.nl_pid = getpid();
+	sfd = socket(PF_NETLINK, SOCK_RAW, NETLINK_NFLOG);
+	if (!sfd) {
+		perror("socket");
+		exit(-1);
+	}
+
+	if (bind(sfd, (struct sockaddr *)(&sa_local), sizeof(sa_local)) ==
+	    -1) {
+		perror("bind");
+		exit(-1);
+	}
+	i = setsockopt(sfd, SOL_SOCKET, SO_RCVBUF, &rcvbufsize,
+	               sizeof(rcvbufsize));
+
+	while (1) {
+		if (!(msg = ulog_get_packet()))
+			continue;
+
+		printf("PACKET NR: %d\n", ++pktcnt);
+		iph = NULL;
+		curr_len = ETH_HLEN;
+
+		printf("INDEV=%s\nOUTDEV=%s\nPHYSINDEV=%s\nPHYSOUTDEV=%s\n"
+		       "PREFIX='%s'", msg->indev, msg->outdev, msg->physindev,
+		       msg->physoutdev, msg->prefix);
+
+		ptm = localtime(&msg->stamp.tv_sec);
+		strftime (time_str, sizeof(time_str), "%Y-%m-%d %H:%M:%S", ptm);
+		printf("\nARRIVAL TIME: %s\nMARK=%lu\nHOOK=%s\n", time_str,
+		       msg->mark, hookstr[msg->hook]);
+
+		if (msg->data_len < curr_len) {
+			printf("====>Packet smaller than Ethernet header "
+			       "length<====\n");
+			goto letscontinue;
+		}
+
+		printf("::::::::ETHERNET:HEADER::::::::\n");
+
+		ehdr = (struct ethhdr *)msg->data;
+		printf("MAC SRC=%s\n", ether_ntoa((const struct ether_addr *)
+		       ehdr->h_source));
+		printf("MAC DST=%s\nETHERNET PROTOCOL=", ether_ntoa(
+		       (const struct ether_addr *)ehdr->h_dest));
+		etype = getethertypebynumber(ntohs(ehdr->h_proto));
+		if (!etype)
+			printf("0x%x\n", ntohs(ehdr->h_proto));
+		else
+			printf("%s\n", etype->e_name);
+
+		if (ehdr->h_proto == htons(ETH_P_8021Q)) {
+			struct vlan_hdr *vlanh = (struct vlan_hdr *)
+			                          (((char *)ehdr) + curr_len);
+			printf("::::::::::VLAN:HEADER::::::::::\n");
+			curr_len += VLAN_HLEN;
+			if (msg->data_len < curr_len) {
+				printf("====>Packet only contains partial "
+				       "VLAN header<====\n");
+				goto letscontinue;
+			}
+
+			printf("VLAN TCI=%d\n", ntohs(vlanh->TCI));
+			printf("VLAN ENCAPS PROTOCOL=");
+			etype = getethertypebynumber(ntohs(vlanh->encap));
+			if (!etype)
+				printf("0x%x\n", ntohs(vlanh->encap));
+			else
+				printf("%s\n", etype->e_name);
+			if (ehdr->h_proto == htons(ETH_P_IP))
+				iph = (struct iphdr *)(vlanh + 1);
+		} else if (ehdr->h_proto == htons(ETH_P_IP))
+			iph = (struct iphdr *)(((char *)ehdr) + curr_len);
+		if (!iph)
+			goto letscontinue;
+
+		curr_len += sizeof(struct iphdr);
+		if (msg->data_len < curr_len || msg->data_len <
+		    (curr_len += iph->ihl * 4 - sizeof(struct iphdr))) {
+			printf("====>Packet only contains partial IP "
+			       "header<====\n");
+			goto letscontinue;
+		}
+
+		printf(":::::::::::IP:HEADER:::::::::::\n");
+		printf("IP SRC ADDR=");
+		for (i = 0; i < 4; i++)
+			printf("%d%s", ((unsigned char *)&iph->saddr)[i],
+			   (i == 3) ? "" : ".");
+		printf("\nIP DEST ADDR=");
+		for (i = 0; i < 4; i++)
+			printf("%d%s", ((unsigned char *)&iph->daddr)[i],
+			   (i == 3) ? "" : ".");
+		printf("\nIP PROTOCOL=");
+		if (!(prototype = getprotobynumber(iph->protocol)))
+			printf("%d\n", iph->protocol);
+		else
+			printf("%s\n", prototype->p_name);
+
+		if (iph->protocol != IPPROTO_ICMP)
+			goto letscontinue;
+
+		icmph = (struct icmphdr *)(((char *)ehdr) + curr_len);
+		curr_len += 4;
+		if (msg->data_len < curr_len) {
+truncated_icmp:
+			printf("====>Packet only contains partial ICMP "
+			       "header<====\n");
+			goto letscontinue;
+		}
+		if (icmph->type != ICMP_ECHO && icmph->type != ICMP_ECHOREPLY)
+			goto letscontinue;
+
+		curr_len += 4;
+		if (msg->data_len < curr_len)
+			goto truncated_icmp;
+		/* Normally the process id, it's sent out in machine
+		 * byte order */
+
+		printf("ICMP_ECHO IDENTIFIER=%u\n", icmph->un.echo.id);
+		printf("ICMP_ECHO SEQ NR=%u\n", ntohs(icmph->un.echo.sequence));
+
+letscontinue:
+		printf("===>Total Packet length: %d, of which we examined "
+		       "%d bytes\n", msg->data_len, curr_len);
+		printf("###############################\n"
+		       "######END#OF##PACKET#DUMP######\n"
+		       "###############################\n");
+	}
+
+	return 0;
+}