usr.bin/systat/pftop.c

   1 /*
   2  * Copyright (c) 2013 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Matthew Dillon <dillon@backplane.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #define _KERNEL_STRUCTURES
  36 #include <sys/param.h>
  37 #include <sys/queue.h>
  38 #include <sys/tree.h>
  39 #include <sys/socket.h>
  40 #include <sys/socketvar.h>
  41 #include <sys/protosw.h>
  42 #include <sys/sysctl.h>
  43 #include <sys/endian.h>
  44
  45 #include <netinet/in.h>
  46 #include <arpa/inet.h>
  47 #include <net/route.h>
  48 #include <net/if.h>
  49 #include <net/pf/pfvar.h>
  50 #include <netinet/in_systm.h>
  51 #include <netinet/ip.h>
  52 #ifdef INET6
  53 #include <netinet/ip6.h>
  54 #endif
  55 #include <netinet/in_pcb.h>
  56 #include <netinet/ip_icmp.h>
  57 #include <netinet/icmp_var.h>
  58 #include <netinet/ip_var.h>
  59 #include <netinet/tcp.h>
  60 #include <netinet/tcpip.h>
  61 #include <netinet/tcp_seq.h>
  62 #include <netinet/tcp_fsm.h>
  63 #include <netinet/tcp_timer.h>
  64 #include <netinet/tcp_var.h>
  65 #include <netinet/tcp_debug.h>
  66 #include <netinet/udp.h>
  67 #include <netinet/udp_var.h>
  68
  69 #include <stdio.h>
  70 #include <stdlib.h>
  71 #include <string.h>
  72 #include <unistd.h>
  73 #include <fcntl.h>
  74 #include <nlist.h>
  75 #include <paths.h>
  76 #include <err.h>
  77 #include <errno.h>
  78 #include <netdb.h>
  79
  80 #include "systat.h"
  81 #include "extern.h"
  82
  83 struct mypfstate {
  84         RB_ENTRY(mypfstate)     rb_node;
  85         int                     seq;
  86         struct pfsync_state     state;
  87         struct pfsync_state     last_state;
  88 };
  89
  90 static int
  91 mypfstate_cmp(struct mypfstate *pf1, struct mypfstate *pf2)
  92 {
  93         struct pfsync_state_key *nk1, *nk2;
  94         int r;
  95
  96         if (pf1->state.proto < pf2->state.proto)
  97                 return(-1);
  98         if (pf1->state.proto > pf2->state.proto)
  99                 return(1);
 100
 101         if (pf1->state.direction == PF_OUT) {
 102                 nk1 = &pf1->state.key[PF_SK_WIRE];
 103         } else {
 104                 nk1 = &pf1->state.key[PF_SK_STACK];
 105         }
 106         if (pf2->state.direction == PF_OUT) {
 107                 nk2 = &pf2->state.key[PF_SK_WIRE];
 108         } else {
 109                 nk2 = &pf2->state.key[PF_SK_STACK];
 110         }
 111         if (pf1->state.proto == IPPROTO_TCP || pf1->state.proto == IPPROTO_UDP) {
 112                 if (ntohs(nk1->port[0]) >= 1024 &&
 113                     ntohs(nk2->port[0]) >= 1024) {
 114                         if (ntohs(nk1->port[1]) < ntohs(nk2->port[1]))
 115                                 return(-1);
 116                         if (ntohs(nk1->port[1]) > ntohs(nk2->port[1]))
 117                                 return(1);
 118                 }
 119                 if (ntohs(nk1->port[0]) < ntohs(nk2->port[0]))
 120                         return(-1);
 121                 if (ntohs(nk1->port[0]) > ntohs(nk2->port[0]))
 122                         return(1);
 123                 if (ntohs(nk1->port[1]) < ntohs(nk2->port[1]))
 124                         return(-1);
 125                 if (ntohs(nk1->port[1]) > ntohs(nk2->port[1]))
 126                         return(1);
 127         }
 128
 129         /*
 130          * Sort IPV4 vs IPV6 addresses
 131          */
 132         if (pf1->state.af < pf2->state.af)
 133                 return(-1);
 134         if (pf1->state.af > pf2->state.af)
 135                 return(1);
 136
 137         /*
 138          * Local and foreign addresses
 139          */
 140         if (pf1->state.af == AF_INET) {
 141                 if (ntohl(nk1->addr[0].v4.s_addr) <
 142                     ntohl(nk2->addr[0].v4.s_addr))
 143                         return(-1);
 144                 if (ntohl(nk1->addr[0].v4.s_addr) >
 145                     ntohl(nk2->addr[0].v4.s_addr))
 146                         return(1);
 147                 if (ntohl(nk1->addr[1].v4.s_addr) <
 148                     ntohl(nk2->addr[1].v4.s_addr))
 149                         return(-1);
 150                 if (ntohl(nk1->addr[1].v4.s_addr) >
 151                     ntohl(nk2->addr[1].v4.s_addr))
 152                         return(1);
 153         } else if (pf1->state.af == AF_INET6) {
 154                 r = bcmp(&nk1->addr[0].v6,
 155                          &nk2->addr[0].v6,
 156                          sizeof(nk1->addr[0].v6));
 157                 if (r)
 158                         return(r);
 159         } else {
 160                 r = bcmp(&nk1->addr[0].v6,
 161                          &nk2->addr[0].v6,
 162                          sizeof(nk1->addr[0].v6));
 163                 if (r)
 164                         return(r);
 165         }
 166         return(0);
 167 }
 168
 169 struct mypfstate_tree;
 170 RB_HEAD(mypfstate_tree, mypfstate);
 171 RB_PROTOTYPE(mypfstate_tree, mypfstate, rb_node, mypfstate_cmp);
 172 RB_GENERATE(mypfstate_tree, mypfstate, rb_node, mypfstate_cmp);
 173
 174 static struct mypfstate_tree mypf_tree;
 175 static struct timeval tv_curr;
 176 static struct timeval tv_last;
 177 static int tcp_pcb_seq;
 178
 179 static const char *numtok(double value);
 180 static const char *netaddrstr(sa_family_t af, struct pf_addr *addr,
 181                         u_int16_t port);
 182 static void updatestate(struct pfsync_state *state);
 183 static int statebwcmp(const void *data1, const void *data2);
 184
 185 #define DELTARATE(field)        \
 186         ((double)(be64toh(*(uint64_t *)elm->state.field) - \
 187                   be64toh(*(uint64_t *)elm->last_state.field)) / delta_time)
 188
 189 WINDOW *
 190 openpftop(void)
 191 {
 192         RB_INIT(&mypf_tree);
 193         return (subwin(stdscr, LINES-0-1, 0, 0, 0));
 194 }
 195
 196 void
 197 closepftop(WINDOW *w)
 198 {
 199         struct mypfstate *mypf;
 200
 201         while ((mypf = RB_ROOT(&mypf_tree)) != NULL) {
 202                 RB_REMOVE(mypfstate_tree, &mypf_tree, mypf);
 203                 free(mypf);
 204         }
 205
 206         if (w != NULL) {
 207                 wclear(w);
 208                 wrefresh(w);
 209                 delwin(w);
 210         }
 211 }
 212
 213 int
 214 initpftop(void)
 215 {
 216         return(1);
 217 }
 218
 219 void
 220 fetchpftop(void)
 221 {
 222         struct pfioc_states ps;
 223         struct pfsync_state *states;
 224         size_t nstates;
 225         size_t i;
 226         int fd;
 227
 228         fd = open("/dev/pf", O_RDONLY);
 229         if (fd < 0)
 230                 return;
 231
 232         /*
 233          * Extract PCB list
 234          */
 235         bzero(&ps, sizeof(ps));
 236         if (ioctl(fd, DIOCGETSTATES, &ps) < 0) {
 237                 close(fd);
 238                 return;
 239         }
 240         ps.ps_len += 1024 * 1024;
 241         ps.ps_buf = malloc(ps.ps_len);
 242         if (ioctl(fd, DIOCGETSTATES, &ps) < 0) {
 243                 free(ps.ps_buf);
 244                 close(fd);
 245                 return;
 246         }
 247
 248         states = (void *)ps.ps_buf;
 249         nstates = ps.ps_len / sizeof(*states);
 250
 251         ++tcp_pcb_seq;
 252
 253         for (i = 0; i < nstates; ++i)
 254                 updatestate(&states[i]);
 255         free(ps.ps_buf);
 256         close(fd);
 257         states = NULL;
 258         fd = -1;
 259
 260         tv_last = tv_curr;
 261         gettimeofday(&tv_curr, NULL);
 262 }
 263
 264 void
 265 labelpftop(void)
 266 {
 267         wmove(wnd, 0, 0);
 268         wclrtobot(wnd);
 269 #if 0
 270         mvwaddstr(wnd, 0, LADDR, "Local Address");
 271         mvwaddstr(wnd, 0, FADDR, "Foreign Address");
 272         mvwaddstr(wnd, 0, PROTO, "Proto");
 273         mvwaddstr(wnd, 0, RCVCC, "Recv-Q");
 274         mvwaddstr(wnd, 0, SNDCC, "Send-Q");
 275         mvwaddstr(wnd, 0, STATE, "(state)");
 276 #endif
 277 }
 278
 279 void
 280 showpftop(void)
 281 {
 282         double delta_time;
 283         struct mypfstate *elm;
 284         struct mypfstate *delm;
 285         struct mypfstate **array;
 286         size_t i;
 287         size_t n;
 288         struct pfsync_state_key *nk;
 289         int row;
 290
 291         delta_time = (double)(tv_curr.tv_sec - tv_last.tv_sec) - 1.0 +
 292                      (tv_curr.tv_usec + 1000000 - tv_last.tv_usec) / 1e6;
 293         if (delta_time < 0.1)
 294                 return;
 295
 296         /*
 297          * Delete and collect pass
 298          */
 299         delm = NULL;
 300         i = 0;
 301         n = 1024;
 302         array = malloc(n * sizeof(*array));
 303         RB_FOREACH(elm, mypfstate_tree, &mypf_tree) {
 304                 if (delm) {
 305                         RB_REMOVE(mypfstate_tree, &mypf_tree, delm);
 306                         free(delm);
 307                         delm = NULL;
 308                 }
 309                 if (elm->seq == tcp_pcb_seq &&
 310                     (DELTARATE(bytes[0]) ||
 311                      DELTARATE(bytes[1]))
 312                 ) {
 313                         array[i++] = elm;
 314                         if (i == n) {
 315                                 n *= 2;
 316                                 array = realloc(array, n * sizeof(*array));
 317                         }
 318                 } else if (elm->seq != tcp_pcb_seq) {
 319                         delm = elm;
 320                 }
 321         }
 322         if (delm) {
 323                 RB_REMOVE(mypfstate_tree, &mypf_tree, delm);
 324                 free(delm);
 325                 delm = NULL;
 326         }
 327         qsort(array, i, sizeof(array[0]), statebwcmp);
 328
 329         row = 2;
 330         n = i;
 331         for (i = 0; i < n; ++i) {
 332                 elm = array[i];
 333                 if (elm->state.direction == PF_OUT) {
 334                         nk = &elm->state.key[PF_SK_WIRE];
 335                 } else {
 336                         nk = &elm->state.key[PF_SK_STACK];
 337                 }
 338                 mvwprintw(wnd, row, 0,
 339                           "%s %s "
 340                           /*"rxb %s txb %s "*/
 341                           "rcv %s snd %s ",
 342                           netaddrstr(elm->state.af, &nk->addr[0], nk->port[0]),
 343                           netaddrstr(elm->state.af, &nk->addr[1], nk->port[1]),
 344                           numtok(DELTARATE(bytes[0])),
 345                           numtok(DELTARATE(bytes[1]))
 346                 );
 347                 wclrtoeol(wnd);
 348                 if (++row >= LINES-3)
 349                         break;
 350         }
 351         free(array);
 352         wmove(wnd, row, 0);
 353         wclrtobot(wnd);
 354         mvwprintw(wnd, LINES-2, 0, "Rate bytes/sec, active pf states");
 355 }
 356
 357 /*
 358  * Sort by total bytes transfered, highest first
 359  */
 360 static
 361 int
 362 statebwcmp(const void *data1, const void *data2)
 363 {
 364         const struct mypfstate *elm1 = *__DECONST(struct mypfstate **, data1);
 365         const struct mypfstate *elm2 = *__DECONST(struct mypfstate **, data2);
 366         uint64_t v1;
 367         uint64_t v2;
 368
 369         v1 = be64toh(*(const uint64_t *)elm1->state.bytes[0]) +
 370              be64toh(*(const uint64_t *)elm1->state.bytes[1]);
 371         v1 -= be64toh(*(const uint64_t *)elm1->last_state.bytes[0]) +
 372              be64toh(*(const uint64_t *)elm1->last_state.bytes[1]);
 373         v2 = be64toh(*(const uint64_t *)elm2->state.bytes[0]) +
 374              be64toh(*(const uint64_t *)elm2->state.bytes[1]);
 375         v2 -= be64toh(*(const uint64_t *)elm2->last_state.bytes[0]) +
 376              be64toh(*(const uint64_t *)elm2->last_state.bytes[1]);
 377         if (v1 < v2)
 378                 return(1);
 379         if (v1 > v2)
 380                 return(-1);
 381         return(0);
 382 }
 383
 384 #if 0
 385 int
 386 cmdpftop(const char *cmd __unused, char *args __unused)
 387 {
 388         fetchpftop();
 389         showpftop();
 390         refresh();
 391
 392         return (0);
 393 }
 394 #endif
 395
 396 #define MAXINDEXES 8
 397
 398 static
 399 const char *
 400 numtok(double value)
 401 {
 402         static char buf[MAXINDEXES][32];
 403         static int nexti;
 404         static const char *suffixes[] = { " ", "K", "M", "G", "T", NULL };
 405         int suffix = 0;
 406         const char *fmt;
 407
 408         while (value >= 1000.0 && suffixes[suffix+1]) {
 409                 value /= 1000.0;
 410                 ++suffix;
 411         }
 412         nexti = (nexti + 1) % MAXINDEXES;
 413         if (value < 0.001) {
 414                 fmt = "      ";
 415         } else if (value < 1.0) {
 416                 fmt = "%5.3f%s";
 417         } else if (value < 10.0) {
 418                 fmt = "%5.3f%s";
 419         } else if (value < 100.0) {
 420                 fmt = "%5.2f%s";
 421         } else if (value < 1000.0) {
 422                 fmt = "%5.1f%s";
 423         } else {
 424                 fmt = "<huge>";
 425         }
 426         snprintf(buf[nexti], sizeof(buf[nexti]),
 427                  fmt, value, suffixes[suffix]);
 428         return (buf[nexti]);
 429 }
 430
 431 static const char *
 432 netaddrstr(sa_family_t af, struct pf_addr *addr, u_int16_t port)
 433 {
 434         static char buf[MAXINDEXES][64];
 435         static int nexta;
 436         char bufip[64];
 437
 438         nexta = (nexta + 1) % MAXINDEXES;
 439
 440         port = ntohs(port);
 441
 442         if (af == AF_INET) {
 443                 snprintf(bufip, sizeof(bufip),
 444                          "%d.%d.%d.%d",
 445                          (ntohl(addr->v4.s_addr) >> 24) & 255,
 446                          (ntohl(addr->v4.s_addr) >> 16) & 255,
 447                          (ntohl(addr->v4.s_addr) >> 8) & 255,
 448                          (ntohl(addr->v4.s_addr) >> 0) & 255);
 449                 snprintf(buf[nexta], sizeof(buf[nexta]),
 450                          "%15s:%-5d", bufip, port);
 451         } else if (af == AF_INET6) {
 452                 snprintf(bufip, sizeof(bufip),
 453                          "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x",
 454                          ntohs(addr->v6.s6_addr16[0]),
 455                          ntohs(addr->v6.s6_addr16[1]),
 456                          ntohs(addr->v6.s6_addr16[2]),
 457                          ntohs(addr->v6.s6_addr16[3]),
 458                          ntohs(addr->v6.s6_addr16[4]),
 459                          ntohs(addr->v6.s6_addr16[5]),
 460                          ntohs(addr->v6.s6_addr16[6]),
 461                          ntohs(addr->v6.s6_addr16[7]));
 462                 snprintf(buf[nexta], sizeof(buf[nexta]),
 463                          "%39s:%-5d", bufip, port);
 464         } else {
 465                 snprintf(bufip, sizeof(bufip), "<unknown>:%-5d", port);
 466                 snprintf(buf[nexta], sizeof(buf[nexta]),
 467                          "%15s:%-5d", bufip, port);
 468         }
 469         return (buf[nexta]);
 470 }
 471
 472 static
 473 void
 474 updatestate(struct pfsync_state *state)
 475 {
 476         struct mypfstate dummy;
 477         struct mypfstate *elm;
 478
 479         dummy.state = *state;
 480         if ((elm = RB_FIND(mypfstate_tree, &mypf_tree, &dummy)) == NULL) {
 481                 elm = malloc(sizeof(*elm));
 482                 bzero(elm, sizeof(*elm));
 483                 elm->state = *state;
 484                 elm->last_state = *state;
 485                 bzero(elm->last_state.bytes,
 486                         sizeof(elm->last_state.bytes));
 487                 bzero(elm->last_state.packets,
 488                         sizeof(elm->last_state.packets));
 489                 RB_INSERT(mypfstate_tree, &mypf_tree, elm);
 490         } else {
 491                 elm->last_state = elm->state;
 492                 elm->state = *state;
 493         }
 494         elm->seq = tcp_pcb_seq;
 495 }