/*

(c) Copyright 2005 Apple Computer, Inc. All rights reserved.

IMPORTANT:  This Apple software is supplied to you by Apple Computer, Inc. (ÒAppleÓ) in 

consideration of your agreement to the following terms, and your use, installation, 

modification or redistribution of this Apple software constitutes acceptance of these 

terms.  If you do not agree with these terms, please do not use, install, modify or 

redistribute this Apple software.

In consideration of your agreement to abide by the following terms, and subject to 

these terms, Apple grants you a personal, non-exclusive license, under AppleÕs copyrights 

in this original Apple software (the ÒApple SoftwareÓ), to use, reproduce, modify and 

redistribute the Apple Software, with or without modifications, in source and/or binary 

forms; provided that if you redistribute the Apple Software in its entirety and without 

modifications, you must retain this notice and the following text and disclaimers in all 

such redistributions of the Apple Software.  Neither the name, trademarks, service marks 

or logos of Apple Computer, Inc. may be used to endorse or promote products derived 

from the Apple Software without specific prior written permission from Apple.  Except 

as expressly stated in this notice, no other rights or licenses, express or implied, 

are granted by Apple herein, including but not limited to any patent rights that may

 be infringed by your derivative works or by other works in which the Apple Software 

 may be incorporated.

The Apple Software is provided by Apple on an "AS IS" basis.  APPLE MAKES NO 

WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES 

OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, REGARDING 

THE APPLE SOFTWARE OR ITS USE AND OPERATION ALONE OR IN COMBINATION WITH YOUR PRODUCTS. 

IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL OR 

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE 

GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ARISING 

IN ANY WAY OUT OF THE USE, REPRODUCTION, MODIFICATION AND/OR DISTRIBUTION OF THE 

APPLE SOFTWARE, HOWEVER CAUSED AND WHETHER UNDER THEORY OF CONTRACT, TORT (INCLUDING 

NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN ADVISED OF THE 

POSSIBILITY OF SUCH DAMAGE.

 */

/* 

 * Based on TCPLogger,  a Mac OS X 'global' plug-in

 * used to test out designs for the extensible stack mechanisms for Mac OS X

 *

 * This version uses system domain control sockets, it takes more options, and it

 * displays each TCP connection log entry on a single line

 */

#if !defined(DEBUG)

#define DEBUG   1               // DEBUG == 1 - print logging messsages to system.log

                                // DEBUG == 0 - no logging messages.

                                /* When DEBUG is enabled, this sample uses the prinff statement from within a

                                    a signal handle which is not a supported call as per 

                                    man 2 sigaction.

                                */ 

#endif

#include <sys/types.h>

#include <sys/param.h>

#include <sys/socket.h>

#include <sys/errno.h>

#include <sys/ioctl.h>

#include <sys/kern_control.h>

#include <sys/sys_domain.h>

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <string.h>

#include <arpa/inet.h>

#include "tcplogger.h"

static int      banner = 40;

static int      gSocket = -1;

static double

tvsub(struct timeval *t1, struct timeval *t0)

{   double elapsed;

    struct timeval tdiff; 

    tdiff.tv_sec = t1->tv_sec - t0->tv_sec;

    tdiff.tv_usec = t1->tv_usec - t0->tv_usec;

    if (tdiff.tv_usec < 0)

        tdiff.tv_sec--, tdiff.tv_usec += 1000000;

    elapsed = tdiff.tv_sec + ((double)tdiff.tv_usec) / 1000000;

    if( elapsed < 0.00001 )  elapsed = 0.00001;

    return(elapsed);

}

static void

TLEPrint(struct TCPLogInfo *tlp)

{   

/*

    const char *ruler =

"123456789x123456789x123456789x123456789x123456789x123456789x123456789x123456789x123456789x123456789x123456789x123456789x";

*/

    const char *normal_banner = 

"       Type   Local Address                  Remote Address                     Ipkts     Ibytes   Opkts     Obytes   uid    pid      duration";

    char        buffer[64];

    const char  *type;

    static int  lines = 0;

    if (banner) {

        if ((banner > 0 && (lines % (banner + 1)) == 0) || (banner < 0 && lines == 0))  {

            printf("%s\n", normal_banner);

            lines++;

        }

    }

    if (tlp != 0) {

        switch (tlp->tli_state) {

            case TLS_CONNECT_IN:

                type = "INCON ";

                break;

            case TLS_CONNECT_OUT:

                type = "OUTCON";

                break;

            case TLS_LISTENING:

                type = "LISTEN";

                break;

            case 0:

                type = "NONE  ";

                break;

            default:

                printf("state %x\n", tlp->tli_state);

                type = "?     ";

                break;

        }

        printf("%6ld %6s ",

               tlp->tli_genid, type);

        if (tlp->tli_protocol == AF_INET)

        {

            snprintf(buffer, sizeof(buffer), "%s:%d",

                   inet_ntoa(tlp->tli_local.addr4.sin_addr), tlp->tli_local.addr4.sin_port);

            printf("%-30s ", buffer);

            snprintf(buffer, sizeof(buffer), "%s:%d",

                   inet_ntoa(tlp->tli_remote.addr4.sin_addr), tlp->tli_remote.addr4.sin_port);

            printf("%-32s ", buffer);

        }

        else

        {

            unsigned char   addrString[256];

            inet_ntop(AF_INET6, &(tlp->tli_local.addr6.sin6_addr), (char*)addrString, sizeof(addrString));

            snprintf(buffer, sizeof(buffer), "%s:%d", addrString, tlp->tli_local.addr6.sin6_port);

            printf("%-30s ", buffer);

            inet_ntop(AF_INET6, &(tlp->tli_remote.addr6.sin6_addr), (char*)addrString, sizeof(addrString));

            snprintf(buffer, sizeof(buffer), "%s:%d", addrString, tlp->tli_remote.addr6.sin6_port);

            printf("%-32s ", buffer);

        }

        printf("%7ld %10ld ",

               (long int)tlp->tli_pkts_in, (long int)tlp->tli_bytes_in);

        printf("%7ld %10ld ",

              (long int) tlp->tli_pkts_out, (long int)tlp->tli_bytes_out);

        printf("%5d %6d",

               tlp->tli_uid, tlp->tli_pid);

        snprintf(buffer, sizeof(buffer), "%6f",

               tvsub(&tlp->tli_stop, &tlp->tli_start));

        printf("  %12s\n", buffer);

        lines++;

    }

    fflush(stdout);

}

static void

test_print()

{

    struct TCPLogInfo tli;

    bzero(&tli, sizeof(tli));

    TLEPrint(&tli);

    memset(&tli, 127, sizeof(tli));

    TLEPrint(&tli);

    return;

}

/*

    SignalHandler - implemented to handle an interrupt from the command line using Ctrl-C.

*/

static void SignalHandler(int sigraised)

{

#if DEBUG

    printf("\ntcplog Interrupted - %d\n", sigraised); // note - printf is unsupported function call from a signal handler

#endif

    if (gSocket > 0);

    {

#if DEBUG

        printf("closing socket %d\n", gSocket); // note - printf is an unsupported function call from a signal handler

#endif

        close (gSocket);    // per man 2 sigaction, close can be invoked from a signal-catching function.

    }

    // exit(0) should not be called from a signal handler.  Use _exit(0) instead

    //

    _exit(0);

}

static void

usage(int help, const char *s)

{

    printf("usage: %s [-m] [-v] [-s] [-q] [-Q max] [-E] [-F]\n", s);

    if (help == 0)

        return;

    printf("tcplog is used to control the tcplognke kernel extension\n");

    printf("The command takes the following options that are evaluated in order, \n");

    printf("and several options may be combined:\n");

    printf(" %-10s%s\n", "-h", "display this help and exit");

    printf(" %-10s%s\n", "-s", "get statistics");

    printf(" %-10s%s\n", "-Q max", "set size of queue for pending log entries");

    printf(" %-10s%s\n", "-q", "get size of queue for pending log entries");

    printf(" %-10s%s\n", "-L n", "set log of tcplognke KEXT on (n > 0) or off (n = 0)");

    printf(" %-10s%s\n", "-E n", "enable log on (n > 0) or off (n = 0)");

    printf(" %-10s%s\n", "-F", "flush pending log entries");

    printf(" %-10s%s\n", "-b n", "use banner once (n < 0), never (n = 0), or every n lines");

    printf(" %-10s%s\n", "-m", "display TCP log entries");

}

int main(int argc, char * const *argv)

{

    struct sockaddr_ctl sc;

    struct TCPLogInfo tlp;

    int n;

    int c;

    int getstats = 0;

    int getqmax = 0;

    int setqmax = 0;

    int monitor = 0;

    struct tl_stats tl_stats;

    socklen_t size;

    int qmax;

    int set_enabled = -1;

    int set_log = -1;

    int flush = 0;

    struct ctl_info ctl_info;

    sig_t   oldHandler;

    // Set up a signal handler so we can clean up when we're interrupted from the command line

    // Otherwise we stay in our run loop forever.

    oldHandler = signal(SIGINT, SignalHandler);

    if (oldHandler == SIG_ERR)

        printf("Could not establish new signal handler");

    while ((c = getopt(argc, argv, "mvsqQ:E:FL:xb:h")) != -1) {

        switch(c) {

            case 'm':

                monitor++;

                break;

            case 's':

                getstats++;

                break;

            case 'q':

                getqmax++;

                break;

            case 'Q':

                setqmax++;

                qmax = strtoul(optarg, 0, 0);

                break;

            case 'E':

                set_enabled = strtol(optarg, 0, 0);;

                break;

            case 'F':

                flush++;

                break;

            case 'L':

                set_log = strtol(optarg, 0, 0);;

                break;

            case 'x':

                test_print();

                exit(0);

            case 'b':

                banner = strtol(optarg, 0, 0);

                break;

            case 'h':

                usage(1, argv[0]);

                exit(0);

            case '?':

            default:

                usage(0, argv[0]);

                exit(-1);

        }

    }

    gSocket = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);

    if (gSocket < 0) {

        perror("socket SYSPROTO_CONTROL");

        exit(0);

    }

    bzero(&ctl_info, sizeof(struct ctl_info));

    strcpy(ctl_info.ctl_name, MYBUNDLEID);

    if (ioctl(gSocket, CTLIOCGINFO, &ctl_info) == -1) {

        perror("ioctl CTLIOCGINFO");

        exit(0);

    } else

        printf("ctl_id: 0x%x for ctl_name: %s\n", ctl_info.ctl_id, ctl_info.ctl_name);

    bzero(&sc, sizeof(struct sockaddr_ctl));

    sc.sc_len = sizeof(struct sockaddr_ctl);

    sc.sc_family = AF_SYSTEM;

    sc.ss_sysaddr = SYSPROTO_CONTROL;

    sc.sc_id = ctl_info.ctl_id;

    sc.sc_unit = 0;

    if (connect(gSocket, (struct sockaddr *)&sc, sizeof(struct sockaddr_ctl))) {

        perror("connect");

        exit(0);

    }

    if (getstats != 0) {

        size = sizeof(tl_stats);

        if (getsockopt(gSocket, SYSPROTO_CONTROL, TCPLOGGER_STATS, &tl_stats, &size) == -1) {

            perror("getsockopt TCPLOGGER_STATS");

            exit(0);

        }

        printf("tls_done_count: %d\n", tl_stats.tls_done_count);

        printf("tls_done_max: %d\n", tl_stats.tls_done_max);

        printf("tls_qmax: %d\n", tl_stats.tls_qmax);

        printf("tls_overflow: %d\n", tl_stats.tls_overflow);

        printf("tls_active: %d\n", tl_stats.tls_active);

        printf("tls_active_max: %d\n", tl_stats.tls_active_max);

        printf("tls_inuse: %d\n", tl_stats.tls_inuse);

        printf("tls_attached: %ld\n", tl_stats.tls_attached);

        printf("tls_freed: %ld\n", tl_stats.tls_freed);

        printf("tls_cannotfree: %ld\n", tl_stats.tls_cannotfree);

        printf("tls_dupfree: %ld\n", tl_stats.tls_dupfree);

        printf("tls_info: %d\n", tl_stats.tls_info);

        printf("tls_ctl_connected: %ld\n", tl_stats.tls_ctl_connected);

        printf("tls_enabled: %d\n", tl_stats.tls_enabled);

        printf("tls_initted: %d\n", tl_stats.tls_initted);

        printf("tls_log: %d\n", tl_stats.tls_log);

    }

    if (setqmax != 0) {

        if (setsockopt(gSocket, SYSPROTO_CONTROL, TCPLOGGER_QMAX, &qmax, sizeof(qmax)) == -1) {

            perror("setsockopt TCPLOGGER_QMAX");

            exit(0);

        }

    }

    if (getqmax != 0) {

        size = sizeof(qmax);

        if (getsockopt(gSocket, SYSPROTO_CONTROL, TCPLOGGER_QMAX, &qmax, &size) == -1) {

            perror("getsockopt TCPLOGGER_QMAX");

            exit(0);

        }

        printf("qmax: %d\n", qmax);

    }

    if (set_log >= 0) {

                printf("TCPLOGGER_LOG called with value %d\n", set_log);

        if (setsockopt(gSocket, SYSPROTO_CONTROL, TCPLOGGER_LOG, &set_log, sizeof(set_log)) == -1) {

            perror("setsockopt TCPLOGGER_LOG");

            exit(0);

        }

    }

    if (set_enabled >= 0) {

        if (setsockopt(gSocket, SYSPROTO_CONTROL, TCPLOGGER_ENABLED, &set_enabled, sizeof(set_enabled)) == -1) {

            perror("setsockopt TCPLOGGER_ENABLED");

            exit(0);

        }

    }

    if (flush > 0) {

        if (setsockopt(gSocket, SYSPROTO_CONTROL, TCPLOGGER_FLUSH, &flush, sizeof(flush)) == -1) {

            perror("getsockopt TCPLOGGER_FLUSH");

            exit(0);

        }

    }

    if (monitor != 0) {

        /* Print the first banner */

        TLEPrint(0);

        /* Now, just read the stuff up! */

        while ((n = recv(gSocket, &tlp, sizeof (tlp), 0)) == sizeof (tlp))

        {

            TLEPrint(&tlp);

        }

    }

    close(gSocket);

    gSocket = -1;

    return 0;

}