Added optional interface information (output interface only)

Small fix for daemon mode.

Change-Id: I8fa3974ad54f5fd4b403672ba3a4abe3c8e7c568

diff --git a/include/nether_Daemon.h b/include/nether_Daemon.h
index 760fadf..cf6f386 100644 (file)
--- a/include/nether_Daemon.h
+++ b/include/nether_Daemon.h
@@ -73,20 +73,5 @@ bool runAsDaemon()
 
        umask(0);
 
-       /** Close all open file descriptors */
-       for(int x = sysconf(_SC_OPEN_MAX); x>0; x--)
-       {
-               close(x);
-       }
-
-       if(open("/dev/null",O_RDONLY) == -1)
-               return (false);
-
-       if(open("/dev/null",O_WRONLY) == -1)
-               return (false);
-
-       if(open("/dev/null",O_RDWR) == -1)
-               return (false);
-
        return (true);
 }

diff --git a/include/nether_Netlink.h b/include/nether_Netlink.h
index 39a1b44..a665be5 100644 (file)
--- a/include/nether_Netlink.h
+++ b/include/nether_Netlink.h
@@ -41,6 +41,8 @@ class NetherNetlink : public NetherPacketProcessor
                bool processPacket(char *packetBuffer, const int packetReadSize);
                void setVerdict(const u_int32_t packetId, const NetherVerdict verdict);
                int getDescriptor();
+               const NetherConfig &getNetherConfig();
+               void getInterfaceInfo(struct nfq_data *nfa, NetherPacket &netherPacket);
 
        protected:
                NetherPacket *processedPacket;

diff --git a/include/nether_Types.h b/include/nether_Types.h
index d634584..83e9962 100644 (file)
--- a/include/nether_Types.h
+++ b/include/nether_Types.h
@@ -78,6 +78,8 @@
 #define NETLINK_COPY_PACKETS                   0
 #endif // COPY_PACKETS
 
+#define NETLINK_INTERFACE_INFO                 0
+
 #ifndef NETHER_RULES_PATH
 #define NETHER_RULES_PATH                              "/etc/nether/nether.rules"
 #endif // NETHER_RULES_PATH
@@ -162,6 +164,7 @@ struct NetherPacket
        char remoteAddress[NETHER_NETWORK_ADDR_LEN];
        NetherTransportType transportType;
        NetherProtocolType protocolType;
+       char outdevName[IFNAMSIZ];
 };
 
 struct NetherConfig
@@ -180,6 +183,7 @@ struct NetherConfig
        int enableAudit                                                         = 0;
        int noRules                                                                     = 0;
        int copyPackets                                                         = NETLINK_COPY_PACKETS;
+       int interfaceInfo                                                       = NETLINK_INTERFACE_INFO;
        std::string backupBackendArgs                           = NETHER_POLICY_FILE;
        std::string rulesPath                                           = NETHER_RULES_PATH;
        std::string iptablesRestorePath                         = NETHER_IPTABLES_RESTORE_PATH;

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 94d39ef..f4e2920 100644 (file)
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -78,7 +78,6 @@ TARGET_LINK_LIBRARIES (nether
 )
 
 ADD_DEFINITIONS (-DNETHER_RULES_PATH="${CMAKE_INSTALL_DIR}/etc/nether/nether.rules"
-                                       -DNETHER_POLICY_FILE="${CMAKE_INSTALL_DIR}/etc/nether/nether.policy"
-)
+               -DNETHER_POLICY_FILE="${CMAKE_INSTALL_DIR}/etc/nether/nether.policy")
 
 INSTALL (TARGETS nether RUNTIME DESTINATION bin)

diff --git a/src/nether_Main.cpp b/src/nether_Main.cpp
index 13d29b1..eca8914 100644 (file)
--- a/src/nether_Main.cpp
+++ b/src/nether_Main.cpp
@@ -38,30 +38,31 @@ int main(int argc, char *argv[])
        static struct option longOptions[] =
        {
 #if defined(HAVE_AUDIT)
-               {"enable-audit",            no_argument,        &netherConfig.enableAudit,  0},
+               {"enable-audit",            no_argument,        &netherConfig.enableAudit,              0},
 #endif
-               {"daemon",                  no_argument,        &netherConfig.daemonMode,   0},
-               {"no-rules",                no_argument,        &netherConfig.noRules,      0},
-               {"copy-packets",                        no_argument,            &netherConfig.copyPackets,      0},
-               {"log",                     required_argument,  0,                          'l'},
-               {"log-args",                required_argument,  0,                          'L'},
-               {"default-verdict",         required_argument,  0,                          'V'},
-               {"primary-backend",         required_argument,  0,                          'p'},
-               {"primary-backend-args",    required_argument,  0,                          'P'},
-               {"backup-backend",          required_argument,  0,                          'b'},
-               {"backup-backend-args",     required_argument,  0,                          'B'},
-               {"queue-num",               required_argument,  0,                          'q'},
-               {"mark-deny",               required_argument,  0,                          'm'},
-               {"mark-allow-log",          required_argument,  0,                          'M'},
-               {"rules-path",              required_argument,  0,                          'r'},
-               {"iptables-restore-path",   required_argument,  0,                          'i'},
-               {"help",                    no_argument,        0,                          'h'},
+               {"daemon",                  no_argument,        &netherConfig.daemonMode,               0},
+               {"no-rules",                no_argument,        &netherConfig.noRules,                  0},
+               {"copy-packets",                        no_argument,            &netherConfig.copyPackets,              0},
+               {"interface-info",                      no_argument,            &netherConfig.interfaceInfo,    0},
+               {"log",                     required_argument,  0,                                                              'l'},
+               {"log-args",                required_argument,  0,                                                              'L'},
+               {"default-verdict",         required_argument,  0,                                                              'V'},
+               {"primary-backend",         required_argument,  0,                                                              'p'},
+               {"primary-backend-args",    required_argument,  0,                                                              'P'},
+               {"backup-backend",          required_argument,  0,                                                              'b'},
+               {"backup-backend-args",     required_argument,  0,                                                              'B'},
+               {"queue-num",               required_argument,  0,                                                              'q'},
+               {"mark-deny",               required_argument,  0,                                                              'm'},
+               {"mark-allow-log",          required_argument,  0,                                                              'M'},
+               {"rules-path",              required_argument,  0,                                                              'r'},
+               {"iptables-restore-path",   required_argument,  0,                                                              'i'},
+               {"help",                    no_argument,        0,                                                              'h'},
                {0, 0, 0, 0}
        };
 
        while(1)
        {
-               c = getopt_long(argc, argv, ":daxcl:L:V:p:P:b:B:q:m:M:a:r:i:h", longOptions, &optionIndex);
+               c = getopt_long(argc, argv, ":daxcIl:L:V:p:P:b:B:q:m:M:a:r:i:h", longOptions, &optionIndex);
 
                if(c == -1)
                        break;
@@ -83,6 +84,10 @@ int main(int argc, char *argv[])
                                netherConfig.copyPackets                        = 1;
                                break;
 
+                       case 'I':
+                               netherConfig.interfaceInfo                      = 1;
+                               break;
+
 #if defined(HAVE_AUDIT)
                        case 'a':
                                netherConfig.enableAudit            = 1;
@@ -181,21 +186,23 @@ int main(int argc, char *argv[])
 #if defined(_DEBUG)
                 << " debug"
 #endif
-                << " daemon="                << netherConfig.daemonMode
-                << " queue="                 << netherConfig.queueNumber);
-       LOGD("primary-backend="       << backendTypeToString(netherConfig.primaryBackendType)
-                << " primary-backend-args="  << netherConfig.primaryBackendArgs);
-       LOGD("backup-backend="        << backendTypeToString(netherConfig.backupBackendType)
-                << " backup-backend-args="   << netherConfig.backupBackendArgs);
-       LOGD("default-verdict="       << verdictToString(netherConfig.defaultVerdict)
-                << " mark-deny="             << (int)netherConfig.markDeny
-                << " mark-allow-log="        << (int)netherConfig.markAllowAndLog);
-       LOGD("log-backend="           << logBackendTypeToString(netherConfig.logBackend)
-                << " log-backend-args="      << netherConfig.logBackendArgs);
-       LOGD("enable-audit="          << (netherConfig.enableAudit ? "yes" : "no")
-                << " rules-path="            << netherConfig.rulesPath);
-       LOGD("no-rules="              << (netherConfig.noRules ? "yes" : "no")
-                << " iptables-restore-path=" << netherConfig.iptablesRestorePath);
+                << " daemon="                                  << netherConfig.daemonMode
+                << " queue="                                   << netherConfig.queueNumber);
+       LOGD("primary-backend="                         << backendTypeToString(netherConfig.primaryBackendType)
+                << " primary-backend-args="    << netherConfig.primaryBackendArgs);
+       LOGD("backup-backend="                          << backendTypeToString(netherConfig.backupBackendType)
+                << " backup-backend-args="             << netherConfig.backupBackendArgs);
+       LOGD("default-verdict="                         << verdictToString(netherConfig.defaultVerdict)
+                << " mark-deny="                               << (int)netherConfig.markDeny
+                << " mark-allow-log="                  << (int)netherConfig.markAllowAndLog);
+       LOGD("log-backend="                                     << logBackendTypeToString(netherConfig.logBackend)
+                << " log-backend-args="                << netherConfig.logBackendArgs);
+       LOGD("enable-audit="                            << (netherConfig.enableAudit ? "yes" : "no")
+                << " rules-path="                              << netherConfig.rulesPath);
+       LOGD("no-rules="                                        << (netherConfig.noRules ? "yes" : "no")
+                << " iptables-restore-path="   << netherConfig.iptablesRestorePath);
+       LOGD("interface-info="                          << (netherConfig.interfaceInfo ? "yes" : "no")
+               << " copy-packets="                             << (netherConfig.copyPackets ? "yes" : "no"));
 
        NetherManager manager(netherConfig);
 
@@ -207,14 +214,22 @@ int main(int argc, char *argv[])
 
        if(netherConfig.daemonMode)
        {
+               LOGD("FORKING TO BACKGROUND");
                if(!runAsDaemon())
                {
                        LOGE("Failed to run as daemon: " << strerror(errno));
                        exit(1);
                }
+               else
+               {
+                       manager.process();
+               }
+       }
+       else
+       {
+               LOGD("RUNNING IF FOREGROUND");
+               manager.process();
        }
-
-       manager.process();
 
        return (0);
 }
@@ -225,6 +240,7 @@ void showHelp(char *arg)
        cout<< "  -d,--daemon\t\t\t\tRun as daemon in the background (default:no)\n";
        cout<< "  -x,--no-rules\t\t\t\tDon't load iptables rules on start (default:no)\n";
        cout<< "  -c,--copy-packets\t\t\tCopy entire packets, needed to read TCP/IP information (default:no)\n";
+       cout<< "  -I,--interface-info\t\t\tGet interface info for every packet (default:no)\n";
        cout<< "  -l,--log=<backend>\t\t\tSet logging backend STDERR,SYSLOG";
 #if defined(HAVE_SYSTEMD_JOURNAL)
        cout << ",JOURNAL\n";

diff --git a/src/nether_Netlink.cpp b/src/nether_Netlink.cpp
index 1f5084c..08af86f 100644 (file)
--- a/src/nether_Netlink.cpp
+++ b/src/nether_Netlink.cpp
@@ -82,9 +82,15 @@ bool NetherNetlink::initialize()
                return (false);
        }
 
-       nlif = nlif_open();
-       if(!nlif)
-               LOGI("Failed to initialize NLIF subsystem, interface information won't be available");
+       if (netherConfig.interfaceInfo)
+       {
+               nlif = nlif_open();
+
+               if(!nlif)
+                       LOGI("Failed to initialize NLIF subsystem, interface information won't be available");
+               else
+                       nlif_query(nlif);
+       }
 
        return (true);
 }
@@ -109,6 +115,26 @@ bool NetherNetlink::processPacket(char *packetBuffer, const int packetReadSize)
        return (true);
 }
 
+void NetherNetlink::getInterfaceInfo(struct nfq_data *nfa, NetherPacket &netherPacket)
+{
+       if (netherConfig.interfaceInfo)
+       {
+               uint32_t ifi;
+
+        ifi = nfq_get_outdev(nfa);
+
+               if (ifi)
+               {
+                nfq_get_outdev_name(nlif, nfa, netherPacket.outdevName);
+        }
+        else
+               {
+                strncpy(netherPacket.outdevName, "(unknown)", IFNAMSIZ);
+                netherPacket.outdevName[IFNAMSIZ-1] = '\0';
+        }
+       }
+}
+
 int NetherNetlink::callback(struct nfq_q_handle *, struct nfgenmsg *, struct nfq_data *nfa, void *data)
 {
        NetherNetlink *me = static_cast<NetherNetlink *>(data);
@@ -128,6 +154,9 @@ int NetherNetlink::callback(struct nfq_q_handle *, struct nfgenmsg *, struct nfq
                return (1);
        }
 
+       /* get interface information if requested */
+       me->getInterfaceInfo(nfa, packet);
+
        if(nfq_get_uid(nfa, &packet.uid) == 0)
                LOGW("Failed to get uid for packet id=" << packet.id);
 
@@ -168,3 +197,8 @@ bool NetherNetlink::reload()
 {
        return (true);
 }
+
+const NetherConfig &NetherNetlink::getNetherConfig()
+{
+       return (netherConfig);
+}

diff --git a/src/nether_Utils.cpp b/src/nether_Utils.cpp
index 90460fa..29554e0 100644 (file)
--- a/src/nether_Utils.cpp
+++ b/src/nether_Utils.cpp
@@ -152,6 +152,8 @@ std::string packetToString(const NetherPacket &packet)
        stream << packet.id;
        stream << " SECCTX=";
        stream << packet.securityContext;
+       stream << " OUTDEV=";
+       stream << packet.outdevName;
        stream << " UID=";
        stream << packet.uid;
        stream << " GID=";