[apple/configd.git] / get-network-info

#!/bin/sh

#
#  Copyright © 2015, 2016 Apple Inc.
#
#  get-network-info
#
#  Collect network information.
#

PATH=/bin:/usr/bin:/sbin:/usr/sbin

# __SETUP_ROUTINES_BEGIN__

process_opts () {

	for i in $ARGS
	   do
		case "$i" in
		    -c)
			   COLLECT_CONFIGURATION_FILES="Y"
			   shift
			   ;;
		    -n)
			   COLLECT_NDF_INFO="Y"
			   shift
			   ;;
		   -P)
			   COLLECT_PCAP="N"
			   shift
			   ;;
		    -s)
			   COLLECT_SENSITIVE_INFO="Y"
			   shift
			   ;;
		    --)
			   shift
			   ;;
		    *)
			   REQUESTED_OUTDIR="${i}"
			   shift
			   ;;
		esac
	   done

}

set_root () {

	PRIV=""
	if [ ${EUID} -ne 0 ]; then
		PRIV="sudo"
	fi

}

#
# Setup
#
setup () {

	set_root
	umask 077
	cd "${REQUESTED_OUTDIR}"

}

# __SETUP_ROUTINES_END__


# __COMMAND_ROUTINES_BEGIN__

# note: the daemons dump to syslog so you need to wait a bit before
# capturing the logs.
collect_state_dump_sensitive () {

	${PRIV} /usr/bin/killall -INFO mDNSResponder						2>/dev/null

	sleep 1											&

}

#
# network interface configuration
#
run_ifconfig () {

	if [ ! -x /sbin/ifconfig ]; then
		return
	fi

	/sbin/ifconfig -a -L -b -m -r -v -v				> ifconfig.txt		2>&1
	if [ $? -ne 0 ]; then
		/sbin/ifconfig -a					> ifconfig.txt		2>&1
	fi

}

#
# network route configuration and statistics
#
run_netstat () {

	if [ ! -x /usr/sbin/netstat ]; then
		return
	fi

	echo "#"							 > netstat.txt
	echo "# netstat -n -r -a -l"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -n -r -a -l					>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -A -a -l -n -v"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -A -a -l -n -v				>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -s"						>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -s						>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -rs"						>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -rs						>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -mmm"						>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -mmm						>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -i -n -d"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -i -n -d					>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -i -x R"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -i -x R					>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -a -n -p mptcp"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -anp mptcp					>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -s -p mptcp"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -s -p mptcp					>> netstat.txt		2>&1

	echo "#"							>> netstat.txt
	echo "# netstat -g -n -s"					>> netstat.txt
	echo "#"							>> netstat.txt
	/usr/sbin/netstat -g -n -s					>> netstat.txt		2>&1

	if [ -x /sbin/ifconfig ]; then
		for if in ${IF_LIST}
		do
			IF_INFO=`/sbin/ifconfig -v ${if}`
			`echo $IF_INFO | grep -q TXSTART`
			if [ $? -eq 0 ]; then
				echo "#"				>> netstat.txt
				echo "# netstat -qq -I ${if}"		>> netstat.txt
				echo "#"				>> netstat.txt
				/usr/sbin/netstat -qq -I ${if}		>> netstat.txt		2>&1
			fi
			`echo $IF_INFO | grep -q RXPOLL`
			if [ $? -eq 0 ]; then
				echo "#"				>> netstat.txt
				echo "# netstat -Q -I ${if}"		>> netstat.txt
				echo "#"				>> netstat.txt
				/usr/sbin/netstat -Q -I ${if}		>> netstat.txt		2>&1
			fi
		done
	fi

}

#
# ndp
#
run_ndp () {

	if [ ! -x /usr/sbin/ndp ]; then
		return
	fi

	echo "#"							 > ndp-info.txt
	echo "# ndp -n -a"						>> ndp-info.txt
	echo "#"							>> ndp-info.txt
	/usr/sbin/ndp -n -a						>> ndp-info.txt		2>&1

	echo "#"							>> ndp-info.txt
	echo "# ndp -n -p"						>> ndp-info.txt
	echo "#"							>> ndp-info.txt
	/usr/sbin/ndp -n -p						>> ndp-info.txt		2>&1

	echo "#"							>> ndp-info.txt
	echo "# ndp -n -r"						>> ndp-info.txt
	echo "#"							>> ndp-info.txt
	/usr/sbin/ndp -n -r						>> ndp-info.txt		2>&1

	if [ -x /sbin/ifconfig ]; then
		for if in ${IF_LIST}
		do
			echo "#"					>> ndp-info.txt
			echo "# ndp -i ${if}"				>> ndp-info.txt
			echo "#"					>> ndp-info.txt
			/usr/sbin/ndp -i ${if}				>> ndp-info.txt		2>&1
		done
	fi

}

#
# arp
#
run_arp () {

	if   [ ! -x /usr/sbin/arp ]; then
		return
	fi

	echo "#"							 > arp-info.txt
	echo "# arp -n -a"						>> arp-info.txt
	echo "#"							>> arp-info.txt
	/usr/sbin/arp -n -a						>> arp-info.txt		2>&1

}

#
# DHCP configuration
#
run_ipconfig () {

	if [ ! -x /usr/sbin/ipconfig ]; then
		return
	fi

	for if in ${IF_LIST}
	do
		case ${if} in
		    lo* )
			;;
		    *)
			echo "#"					>> ipconfig-info.txt
			echo "# INTERFACE ${if}"			>> ipconfig-info.txt
			echo "#"					>> ipconfig-info.txt

			echo "DHCPv4 information:"			>> ipconfig-info.txt

			IPCONFIG_INFO=`/usr/sbin/ipconfig getpacket ${if}`
			if [ "${IPCONFIG_INFO}" != "" ]; then
				echo "${IPCONFIG_INFO}"			>> ipconfig-info.txt
			else
				echo "not available"			>> ipconfig-info.txt
			fi

			echo""						>> ipconfig-info.txt

			echo "DHCPv6 information:"			>> ipconfig-info.txt

			IPCONFIG_INFO=`/usr/sbin/ipconfig getv6packet ${if}`
			if [ "${IPCONFIG_INFO}" != "" ]; then
				echo "${IPCONFIG_INFO}"			>> ipconfig-info.txt
			else
				echo "not available"			>> ipconfig-info.txt
			fi

			echo""						>> ipconfig-info.txt
			;;
		esac
	done

}

#
# IPsec configuration
#
run_setkey () {

	if [ ! -x /usr/sbin/setkey -o ! -x /usr/bin/perl ]; then
		return
	fi

	echo "#"									>  ipsec.txt
	echo "# setkey -D"								>> ipsec.txt
	echo "#"									>> ipsec.txt
	${PRIV} /usr/sbin/setkey -D				\
	| /usr/bin/perl -l -n -e '
		if (/^(\s+[AE]:\s+\S+\s+)"?(.*)"?\s*$/) {
			printf "%s[redacted]%s\n", $1, $3;
		} else {
			printf "%s\n", $_;
		}
	'										>> ipsec.txt

	echo ""										>> ipsec.txt
	echo "#"									>> ipsec.txt
	echo "# setkey -Pp -D"								>> ipsec.txt
	echo "#"									>> ipsec.txt
	${PRIV} /usr/sbin/setkey -Pp -D							>> ipsec.txt

	for CF in /var/run/racoon/*.conf
	do
		if [ ! -r "${CF}" ]; then
			continue
		fi

		echo ""									>> ipsec.txt
		echo "#"								>> ipsec.txt
		echo "# ${CF}"								>> ipsec.txt
		echo "#"								>> ipsec.txt
		${PRIV} cat ${CF}				\
		| /usr/bin/perl -l -n -e '
			if (/^(\s+shared_secret\s+use\s+)"?([^\s;"]+)"?(.*)/) {
				printf "%s[redacted]%s\n", $1, $3;
			} else {
				printf "%s\n", $_;
			}
		'									>> ipsec.txt
	done

}

#
# Network preferences
#
collect_configuration_files () {

	for f in										\
		/Library/Preferences/com.apple.networkextension.plist				\
		/Library/Preferences/com.apple.networkextension.control.plist			\
		/Library/Preferences/com.apple.networkextension.necp.plist			\
		/Library/Preferences/SystemConfiguration/com.apple.nat.plist			\
		/Library/Preferences/SystemConfiguration/com.apple.RemoteAccessServers.plist	\
		/Library/Preferences/SystemConfiguration/com.apple.smb.server.plist		\
		/Library/Preferences/com.apple.mDNSResponder.plist				\
		/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist		\
		/Library/Preferences/SystemConfiguration/preferences.plist			\

	do
		if [ -e "${f}" ]; then
			b="`basename ${f}`"
			cat "${f}"							> "${b}"			2>&1
		fi
	done

	if [ -e /etc/resolv.conf ]; then
		cat /etc/resolv.conf							> etc-resolv-conf.txt		2>&1
	fi
	if [ -e /var/run/resolv.conf ]; then
		cat /var/run/resolv.conf						> var-run-resolv-conf.txt	2>&1
	fi
	if [ -e /etc/resolver ]; then
		tar -c -H /etc/resolver							> etc-resolver.tar		2>/dev/null
	fi
}

#
# VPN
#
collect_vpn_logs () {

	for f in										\
		/var/log/vpnd.log								\
		/var/log/racoon.log								\

	do
		if [ -e "${f}" ]; then
			b="`basename ${f}`"
			${PRIV} cat "${f}"							> "${b}".txt	2>&1
		fi
	done
}

#
# Policy
#
run_neutil () {

	if [ ! -x /usr/local/bin/neutil ]; then
		return
	fi

	echo "#"								>  necp.txt
	echo "# neutil policy dump"						>> necp.txt
	echo "#"								>> necp.txt
	/usr/local/bin/neutil policy dump					>> necp.txt		2>&1

	echo "#"								>  network-agents.txt
	echo "# neutil agent dump"						>> network-agents.txt
	echo "#"								>> network-agents.txt
	/usr/local/bin/neutil agent dump					>> network-agents.txt	2>&1

}

#
# Path
#
run_network_test () {

	if [ ! -x /usr/local/bin/network_test ]; then
		return
	fi

	/usr/local/bin/network_test path_watcher				> nw_path.txt	2>&1

}

#
# Network, DNS, Proxy, Reachability, Cache information
#
run_scutil () {

	if [ ! -x /usr/sbin/scutil ]; then
		return
	fi

	echo "#"								>  network-information.txt
	echo "# scutil -d -v --nwi"						>> network-information.txt
	echo "#"								>> network-information.txt
	/usr/sbin/scutil -d -v --nwi						>> network-information.txt	2>&1
	for if in ${IF_LIST}
	do
		echo ""								>> network-information.txt
		echo "#"							>> network-information.txt
		echo "# scutil --nwi ${if}"					>> network-information.txt
		echo "#"							>> network-information.txt
		scutil --nwi ${if}						>> network-information.txt	2>&1
	done

	echo "#"								>  dns-configuration.txt
	echo "# scutil -d -v --dns"						>> dns-configuration.txt
	echo "#"								>> dns-configuration.txt
	/usr/sbin/scutil -d -v --dns						>> dns-configuration.txt	2>&1

	echo "#"								>  proxy-configuration.txt
	echo "# scutil -d -v --proxy"						>> proxy-configuration.txt
	echo "#"								>> proxy-configuration.txt
	/usr/sbin/scutil -d -v --proxy						>> proxy-configuration.txt	2>&1

	echo "#"								>  reachability-info.txt
	echo '# scutil -d -v -r www.apple.com'					>> reachability-info.txt
	echo "#"								>> reachability-info.txt
	/usr/sbin/scutil -d -v -r www.apple.com					>> reachability-info.txt	2>&1

	echo "#"								>> reachability-info.txt
	echo '# scutil -d -v -r 0.0.0.0'					>> reachability-info.txt
	echo "#"								>> reachability-info.txt
	/usr/sbin/scutil -d -v -r 0.0.0.0					>> reachability-info.txt	2>&1

	echo "#"								>> reachability-info.txt
	echo '# scutil -d -v -r 169.254.0.0'					>> reachability-info.txt
	echo "#"								>> reachability-info.txt
	/usr/sbin/scutil -d -v -r 169.254.0.0					>> reachability-info.txt	2>&1

	echo "#"								>  nc-info.txt
	echo '# scutil --nc list'						>> nc-info.txt
	echo "#"								>> nc-info.txt
	/usr/sbin/scutil --nc list						>> nc-info.txt			2>&1

	${PRIV} /usr/sbin/scutil -p --snapshot
	if [ -f /var/tmp/configd-store.plist ]; then
		cat /var/tmp/configd-store.plist				> configd-store.plist		2>&1
	fi
	if [ -f /var/tmp/configd-pattern.plist ]; then
		cat /var/tmp/configd-pattern.plist				> configd-pattern.plist		2>&1
	fi
	if [ -f /var/tmp/configd-session.plist ]; then
		cat /var/tmp/configd-session.plist				> configd-session.plist		2>&1
	fi
	if [ -f /var/tmp/configd-state ]; then
		cat /var/tmp/configd-state					> configd-state			2>&1
	fi

}

#
# route
#
run_route () {

	if [ ! -x /sbin/route ]; then
		return
	fi

	echo "#"								>  route-info.txt
	echo '# route -n -v get www.apple.com'					>> route-info.txt
	echo "#"								>> route-info.txt
	/sbin/route -n -v get www.apple.com					>> route-info.txt	2>&1

	echo "#"								>> route-info.txt
	echo '# route -n -v get 0.0.0.0'					>> route-info.txt
	echo "#"								>> route-info.txt
	/sbin/route -n -v get 0.0.0.0						>> route-info.txt	2>&1

}

#
# dig
#
run_dig () {

	if [ ! -x /usr/bin/dig -o ! -f /etc/resolv.conf ]; then
		return
	fi

	echo "#"								>  dig-info.txt
	echo '# dig -t any -c any www.apple.com'				>> dig-info.txt
	echo "#"								>> dig-info.txt
	/usr/bin/dig +time=2 -t any -c any www.apple.com			>> dig-info.txt		2>/dev/null

}

#
# hostname
#
run_hostname () {

	if [ ! -x /bin/hostname ]; then
		return
	fi

	/bin/hostname								> hostname.txt		2>&1

}

#
# lsof
#
run_lsof () {

	if [ ! -x /usr/sbin/lsof ]; then
		return
	fi

	${PRIV} /usr/sbin/lsof -i -n -O -P -T q					> lsof.txt		2>&1	&
	LSOF_PID=$!
	# start a watchdog for lsof
	(
		WAIT_TIME=5
		while [ $WAIT_TIME -gt 0 ]
		do
			${PRIV} kill -0 ${LSOF_PID}							2>/dev/null
			if [ $? -eq 0 ]; then
				# lsof is [still] gathering data...
				sleep 1
				WAIT_TIME=$((WAIT_TIME - 1))
				continue
			fi

			# lsof completed gathering data
			break
		done

		if [ $WAIT_TIME -eq 0 ]; then
			# lsof timed out
			${PRIV} kill ${LSOF_PID}							2>/dev/null
		fi
	) &

}

start_pcap() {

	#
	# collect a packet capture if netdiagnose is available
	#
	if [ -x /usr/local/bin/netdiagnose ]; then
		/usr/local/bin/netdiagnose -p "${REQUESTED_OUTDIR}" start sysdiagpcap			2>&1

		PCAP_STARTED=1
	fi
}

stop_pcap () {
	if [ ${PCAP_STARTED} -ne 0 ]; then
		/usr/local/bin/netdiagnose stop sysdiagpcap						2>&1
	fi
}

collect_ndf_info () {
	run_lsof
}

collect_sensitive_info () {

	if [ "${COLLECT_PCAP}" == "Y" ]; then
		start_pcap
	fi

	collect_state_dump_sensitive
	run_ndp
	run_arp
	run_neutil
	run_network_test
}

collect_info () {

	if [ "${COLLECT_NDF_INFO}" == "Y" ]; then
		collect_ndf_info
	fi

	if [ "${COLLECT_SENSITIVE_INFO}" == "Y" ]; then
		collect_sensitive_info
	fi

	run_scutil
	run_dig
	run_ifconfig
	run_netstat
	run_ipconfig
	run_setkey
	collect_vpn_logs
	run_route
	run_hostname

	if [ "${COLLECT_CONFIGURATION_FILES}" == "Y" ]; then
		collect_configuration_files
	fi

	stop_pcap
}

# __COMMAND_ROUTINES_END__

# __HELPER_ROUTINES_BEGIN__

usage () {

	echo "Usage: get-network-info [-c] [-n] [-s] <info-directory>"
	echo "		-c		    collects system configuration files"
	echo "		-n		    collects NDF information (lsof)"
	echo "		-P		    do not collect a packet capture"
	echo "		-s		    collects sensitive information (ARP/NDP/mDNS cache)"
	echo "		<info-directory>    path to directory where all the information will be collected"

}

is_outdir_valid () {

	if [ ! -d ${REQUESTED_OUTDIR} ] ||
	   [ "${REQUESTED_OUTDIR}" = "" ]; then
		usage
		exit 1
	fi

	if [ ! -w ${REQUESTED_OUTDIR} ]; then
		echo "${REQUESTED_OUTDIR} is write-protected"
		exit 1
	fi
}

#
# Collect most used command output to be used later
#
optimize () {

	if [ ! -x /sbin/ifconfig ]; then
		return
	fi

	IF_LIST=`/sbin/ifconfig -l`

}

init_globals () {
	REQUESTED_OUTDIR=""
	COLLECT_SENSITIVE_INFO=""
	COLLECT_CONFIGURATION_FILES=""
	COLLECT_PCAP="Y"
	PCAP_STARTED=0

}

# __HELPER_ROUTINES_END__

#
# __MAIN__
#
ARGS=`getopt cnPs $*`
if [ $? != 0 ]; then
	usage
	exit 1
fi

init_globals
process_opts
is_outdir_valid
setup
optimize
collect_info
wait

exit 0
Commit	Line	Data
9de8ab86 A	1	#!/bin/sh
	2
	3	#
942cecd7	4	# Copyright © 2015, 2016 Apple Inc.
9de8ab86 A	5	#
	6	# get-network-info
	7	#
	8	# Collect network information.
	9	#
	10
	11	PATH=/bin:/usr/bin:/sbin:/usr/sbin
	12
	13	# __SETUP_ROUTINES_BEGIN__
	14
	15	process_opts () {
	16
	17	for i in $ARGS
942cecd7 A	18	do
	19	case "$i" in
	20	-c)
	21	COLLECT_CONFIGURATION_FILES="Y"
	22	shift
	23	;;
	24	-n)
	25	COLLECT_NDF_INFO="Y"
	26	shift
	27	;;
43bfd57e A	28	-P)
	29	COLLECT_PCAP="N"
	30	shift
	31	;;
942cecd7 A	32	-s)
	33	COLLECT_SENSITIVE_INFO="Y"
	34	shift
	35	;;
	36	--)
	37	shift
	38	;;
	39	*)
	40	REQUESTED_OUTDIR="${i}"
	41	shift
	42	;;
	43	esac
	44	done
9de8ab86 A	45
	46	}
	47
	48	set_root () {
	49
	50	PRIV=""
	51	if [ ${EUID} -ne 0 ]; then
	52	PRIV="sudo"
	53	fi
	54
	55	}
	56
	57	#
	58	# Setup
	59	#
	60	setup () {
	61
	62	set_root
	63	umask 077
	64	cd "${REQUESTED_OUTDIR}"
	65
	66	}
	67
	68	# __SETUP_ROUTINES_END__
	69
	70
	71	# __COMMAND_ROUTINES_BEGIN__
	72
	73	# note: the daemons dump to syslog so you need to wait a bit before
	74	# capturing the logs.
9de8ab86 A	75	collect_state_dump_sensitive () {
	76
	77	${PRIV} /usr/bin/killall -INFO mDNSResponder 2>/dev/null
	78
	79	sleep 1 &
	80
	81	}
	82
	83	#
	84	# network interface configuration
	85	#
	86	run_ifconfig () {
	87
	88	if [ ! -x /sbin/ifconfig ]; then
	89	return
	90	fi
	91
	92	/sbin/ifconfig -a -L -b -m -r -v -v > ifconfig.txt 2>&1
	93	if [ $? -ne 0 ]; then
	94	/sbin/ifconfig -a > ifconfig.txt 2>&1
	95	fi
	96
	97	}
	98
	99	#
	100	# network route configuration and statistics
	101	#
	102	run_netstat () {
	103
	104	if [ ! -x /usr/sbin/netstat ]; then
	105	return
	106	fi
	107
	108	echo "#" > netstat.txt
	109	echo "# netstat -n -r -a -l" >> netstat.txt
	110	echo "#" >> netstat.txt
	111	/usr/sbin/netstat -n -r -a -l >> netstat.txt 2>&1
	112
	113	echo "#" >> netstat.txt
	114	echo "# netstat -A -a -l -n -v" >> netstat.txt
	115	echo "#" >> netstat.txt
	116	/usr/sbin/netstat -A -a -l -n -v >> netstat.txt 2>&1
	117
	118	echo "#" >> netstat.txt
	119	echo "# netstat -s" >> netstat.txt
	120	echo "#" >> netstat.txt
	121	/usr/sbin/netstat -s >> netstat.txt 2>&1
	122
942cecd7 A	123	echo "#" >> netstat.txt
	124	echo "# netstat -rs" >> netstat.txt
	125	echo "#" >> netstat.txt
	126	/usr/sbin/netstat -rs >> netstat.txt 2>&1
	127
9de8ab86 A	128	echo "#" >> netstat.txt
	129	echo "# netstat -mmm" >> netstat.txt
	130	echo "#" >> netstat.txt
	131	/usr/sbin/netstat -mmm >> netstat.txt 2>&1
	132
	133	echo "#" >> netstat.txt
	134	echo "# netstat -i -n -d" >> netstat.txt
	135	echo "#" >> netstat.txt
	136	/usr/sbin/netstat -i -n -d >> netstat.txt 2>&1
	137
	138	echo "#" >> netstat.txt
	139	echo "# netstat -i -x R" >> netstat.txt
	140	echo "#" >> netstat.txt
	141	/usr/sbin/netstat -i -x R >> netstat.txt 2>&1
	142
	143	echo "#" >> netstat.txt
	144	echo "# netstat -a -n -p mptcp" >> netstat.txt
	145	echo "#" >> netstat.txt
	146	/usr/sbin/netstat -anp mptcp >> netstat.txt 2>&1
	147
	148	echo "#" >> netstat.txt
	149	echo "# netstat -s -p mptcp" >> netstat.txt
	150	echo "#" >> netstat.txt
	151	/usr/sbin/netstat -s -p mptcp >> netstat.txt 2>&1
	152
	153	echo "#" >> netstat.txt
	154	echo "# netstat -g -n -s" >> netstat.txt
	155	echo "#" >> netstat.txt
	156	/usr/sbin/netstat -g -n -s >> netstat.txt 2>&1
	157
	158	if [ -x /sbin/ifconfig ]; then
	159	for if in ${IF_LIST}
	160	do
	161	IF_INFO=`/sbin/ifconfig -v ${if}`
	162	`echo $IF_INFO \| grep -q TXSTART`
	163	if [ $? -eq 0 ]; then
	164	echo "#" >> netstat.txt
	165	echo "# netstat -qq -I ${if}" >> netstat.txt
	166	echo "#" >> netstat.txt
	167	/usr/sbin/netstat -qq -I ${if} >> netstat.txt 2>&1
	168	fi
	169	`echo $IF_INFO \| grep -q RXPOLL`
	170	if [ $? -eq 0 ]; then
	171	echo "#" >> netstat.txt
	172	echo "# netstat -Q -I ${if}" >> netstat.txt
	173	echo "#" >> netstat.txt
	174	/usr/sbin/netstat -Q -I ${if} >> netstat.txt 2>&1
	175	fi
	176	done
	177	fi
	178
	179	}
	180
942cecd7 A	181	#
	182	# ndp
	183	#
9de8ab86 A	184	run_ndp () {
	185
	186	if [ ! -x /usr/sbin/ndp ]; then
	187	return
	188	fi
	189
	190	echo "#" > ndp-info.txt
	191	echo "# ndp -n -a" >> ndp-info.txt
	192	echo "#" >> ndp-info.txt
	193	/usr/sbin/ndp -n -a >> ndp-info.txt 2>&1
	194
	195	echo "#" >> ndp-info.txt
	196	echo "# ndp -n -p" >> ndp-info.txt
	197	echo "#" >> ndp-info.txt
	198	/usr/sbin/ndp -n -p >> ndp-info.txt 2>&1
	199
	200	echo "#" >> ndp-info.txt
	201	echo "# ndp -n -r" >> ndp-info.txt
	202	echo "#" >> ndp-info.txt
	203	/usr/sbin/ndp -n -r >> ndp-info.txt 2>&1
	204
	205	if [ -x /sbin/ifconfig ]; then
	206	for if in ${IF_LIST}
	207	do
	208	echo "#" >> ndp-info.txt
	209	echo "# ndp -i ${if}" >> ndp-info.txt
	210	echo "#" >> ndp-info.txt
	211	/usr/sbin/ndp -i ${if} >> ndp-info.txt 2>&1
	212	done
	213	fi
	214
	215	}
	216
942cecd7 A	217	#
	218	# arp
	219	#
9de8ab86 A	220	run_arp () {
	221
	222	if [ ! -x /usr/sbin/arp ]; then
	223	return
	224	fi
	225
	226	echo "#" > arp-info.txt
	227	echo "# arp -n -a" >> arp-info.txt
	228	echo "#" >> arp-info.txt
	229	/usr/sbin/arp -n -a >> arp-info.txt 2>&1
	230
	231	}
	232
	233	#
	234	# DHCP configuration
	235	#
	236	run_ipconfig () {
	237
	238	if [ ! -x /usr/sbin/ipconfig ]; then
	239	return
	240	fi
	241
	242	for if in ${IF_LIST}
	243	do
	244	case ${if} in
942cecd7 A	245	lo* )
	246	;;
	247	*)
9de8ab86 A	248	echo "#" >> ipconfig-info.txt
	249	echo "# INTERFACE ${if}" >> ipconfig-info.txt
	250	echo "#" >> ipconfig-info.txt
	251
	252	echo "DHCPv4 information:" >> ipconfig-info.txt
	253
	254	IPCONFIG_INFO=`/usr/sbin/ipconfig getpacket ${if}`
	255	if [ "${IPCONFIG_INFO}" != "" ]; then
	256	echo "${IPCONFIG_INFO}" >> ipconfig-info.txt
	257	else
	258	echo "not available" >> ipconfig-info.txt
	259	fi
	260
	261	echo"" >> ipconfig-info.txt
	262
	263	echo "DHCPv6 information:" >> ipconfig-info.txt
	264
	265	IPCONFIG_INFO=`/usr/sbin/ipconfig getv6packet ${if}`
	266	if [ "${IPCONFIG_INFO}" != "" ]; then
	267	echo "${IPCONFIG_INFO}" >> ipconfig-info.txt
	268	else
	269	echo "not available" >> ipconfig-info.txt
	270	fi
	271
	272	echo"" >> ipconfig-info.txt
	273	;;
	274	esac
	275	done
	276
	277	}
	278
	279	#
	280	# IPsec configuration
	281	#
	282	run_setkey () {
	283
	284	if [ ! -x /usr/sbin/setkey -o ! -x /usr/bin/perl ]; then
	285	return
	286	fi
	287
	288	echo "#" > ipsec.txt
	289	echo "# setkey -D" >> ipsec.txt
	290	echo "#" >> ipsec.txt
	291	${PRIV} /usr/sbin/setkey -D \
	292	\| /usr/bin/perl -l -n -e '
	293	if (/^(\s+[AE]:\s+\S+\s+)"?(.)"?\s$/) {
	294	printf "%s[redacted]%s\n", $1, $3;
	295	} else {
	296	printf "%s\n", $_;
	297	}
	298	' >> ipsec.txt
	299
	300	echo "" >> ipsec.txt
	301	echo "#" >> ipsec.txt
	302	echo "# setkey -Pp -D" >> ipsec.txt
	303	echo "#" >> ipsec.txt
	304	${PRIV} /usr/sbin/setkey -Pp -D >> ipsec.txt
	305
	306	for CF in /var/run/racoon/*.conf
	307	do
	308	if [ ! -r "${CF}" ]; then
	309	continue
	310	fi
	311
312	echo "" >> ipsec.txt
313	echo "#" >> ipsec.txt
314	echo "# ${CF}" >> ipsec.txt
315	echo "#" >> ipsec.txt
316	${PRIV} cat ${CF} \
317	\| /usr/bin/perl -l -n -e '
318	if (/^(\s+shared_secret\s+use\s+)"?([^\s;"]+)"?(.*)/) {
319	printf "%s[redacted]%s\n", $1, $3;
320	} else {
321	printf "%s\n", $_;
322	}
323	' >> ipsec.txt
324	done
325
326	}
327
328	#
329	# Network preferences
330	#
331	collect_configuration_files () {
332
333	for f in \
334	/Library/Preferences/com.apple.networkextension.plist \
335	/Library/Preferences/com.apple.networkextension.control.plist \
336	/Library/Preferences/com.apple.networkextension.necp.plist \
337	/Library/Preferences/SystemConfiguration/com.apple.nat.plist \
338	/Library/Preferences/SystemConfiguration/com.apple.RemoteAccessServers.plist \
339	/Library/Preferences/SystemConfiguration/com.apple.smb.server.plist \
340	/Library/Preferences/com.apple.mDNSResponder.plist \
341	/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist \
342	/Library/Preferences/SystemConfiguration/preferences.plist \
343
344	do
345	if [ -e "${f}" ]; then
346	b="`basename ${f}`"
347	cat "${f}" > "${b}" 2>&1
348	fi
349	done
350
351	if [ -e /etc/resolv.conf ]; then
352	cat /etc/resolv.conf > etc-resolv-conf.txt 2>&1
353	fi
354	if [ -e /var/run/resolv.conf ]; then
355	cat /var/run/resolv.conf > var-run-resolv-conf.txt 2>&1
356	fi
357	if [ -e /etc/resolver ]; then
358	tar -c -H /etc/resolver > etc-resolver.tar 2>/dev/null
359	fi
360	}
361
942cecd7 A	362	#
	363	# VPN
	364	#
9de8ab86 A	365	collect_vpn_logs () {
	366
	367	for f in \
	368	/var/log/vpnd.log \
	369	/var/log/racoon.log \
	370
	371	do
	372	if [ -e "${f}" ]; then
	373	b="`basename ${f}`"
	374	${PRIV} cat "${f}" > "${b}".txt 2>&1
	375	fi
	376	done
	377	}
	378
942cecd7 A	379	#
	380	# Policy
	381	#
	382	run_neutil () {
	383
	384	if [ ! -x /usr/local/bin/neutil ]; then
	385	return
	386	fi
	387
	388	echo "#" > necp.txt
	389	echo "# neutil policy dump" >> necp.txt
	390	echo "#" >> necp.txt
	391	/usr/local/bin/neutil policy dump >> necp.txt 2>&1
	392
	393	echo "#" > network-agents.txt
	394	echo "# neutil agent dump" >> network-agents.txt
	395	echo "#" >> network-agents.txt
	396	/usr/local/bin/neutil agent dump >> network-agents.txt 2>&1
	397
	398	}
	399
	400	#
	401	# Path
	402	#
	403	run_network_test () {
	404
	405	if [ ! -x /usr/local/bin/network_test ]; then
	406	return
	407	fi
	408
	409	/usr/local/bin/network_test path_watcher > nw_path.txt 2>&1
	410
	411	}
	412
9de8ab86 A	413	#
	414	# Network, DNS, Proxy, Reachability, Cache information
	415	#
	416	run_scutil () {
	417
	418	if [ ! -x /usr/sbin/scutil ]; then
	419	return
	420	fi
	421
	422	echo "#" > network-information.txt
	423	echo "# scutil -d -v --nwi" >> network-information.txt
	424	echo "#" >> network-information.txt
	425	/usr/sbin/scutil -d -v --nwi >> network-information.txt 2>&1
	426	for if in ${IF_LIST}
	427	do
	428	echo "" >> network-information.txt
	429	echo "#" >> network-information.txt
	430	echo "# scutil --nwi ${if}" >> network-information.txt
	431	echo "#" >> network-information.txt
	432	scutil --nwi ${if} >> network-information.txt 2>&1
	433	done
	434
	435	echo "#" > dns-configuration.txt
	436	echo "# scutil -d -v --dns" >> dns-configuration.txt
	437	echo "#" >> dns-configuration.txt
	438	/usr/sbin/scutil -d -v --dns >> dns-configuration.txt 2>&1
	439
	440	echo "#" > proxy-configuration.txt
	441	echo "# scutil -d -v --proxy" >> proxy-configuration.txt
	442	echo "#" >> proxy-configuration.txt
	443	/usr/sbin/scutil -d -v --proxy >> proxy-configuration.txt 2>&1
	444
	445	echo "#" > reachability-info.txt
	446	echo '# scutil -d -v -r www.apple.com' >> reachability-info.txt
	447	echo "#" >> reachability-info.txt
	448	/usr/sbin/scutil -d -v -r www.apple.com >> reachability-info.txt 2>&1
	449
	450	echo "#" >> reachability-info.txt
	451	echo '# scutil -d -v -r 0.0.0.0' >> reachability-info.txt
	452	echo "#" >> reachability-info.txt
	453	/usr/sbin/scutil -d -v -r 0.0.0.0 >> reachability-info.txt 2>&1
	454
942cecd7 A	455	echo "#" >> reachability-info.txt
	456	echo '# scutil -d -v -r 169.254.0.0' >> reachability-info.txt
	457	echo "#" >> reachability-info.txt
	458	/usr/sbin/scutil -d -v -r 169.254.0.0 >> reachability-info.txt 2>&1
	459
	460	echo "#" > nc-info.txt
	461	echo '# scutil --nc list' >> nc-info.txt
	462	echo "#" >> nc-info.txt
	463	/usr/sbin/scutil --nc list >> nc-info.txt 2>&1
	464
9de8ab86 A	465	${PRIV} /usr/sbin/scutil -p --snapshot
	466	if [ -f /var/tmp/configd-store.plist ]; then
	467	cat /var/tmp/configd-store.plist > configd-store.plist 2>&1
	468	fi
	469	if [ -f /var/tmp/configd-pattern.plist ]; then
	470	cat /var/tmp/configd-pattern.plist > configd-pattern.plist 2>&1
	471	fi
	472	if [ -f /var/tmp/configd-session.plist ]; then
	473	cat /var/tmp/configd-session.plist > configd-session.plist 2>&1
	474	fi
	475	if [ -f /var/tmp/configd-state ]; then
	476	cat /var/tmp/configd-state > configd-state 2>&1
	477	fi
	478
	479	}
	480
942cecd7 A	481	#
	482	# route
	483	#
9de8ab86 A	484	run_route () {
	485
	486	if [ ! -x /sbin/route ]; then
	487	return
	488	fi
	489
	490	echo "#" > route-info.txt
	491	echo '# route -n -v get www.apple.com' >> route-info.txt
	492	echo "#" >> route-info.txt
	493	/sbin/route -n -v get www.apple.com >> route-info.txt 2>&1
	494
	495	echo "#" >> route-info.txt
	496	echo '# route -n -v get 0.0.0.0' >> route-info.txt
	497	echo "#" >> route-info.txt
	498	/sbin/route -n -v get 0.0.0.0 >> route-info.txt 2>&1
	499
	500	}
	501
942cecd7 A	502	#
	503	# dig
	504	#
9de8ab86 A	505	run_dig () {
	506
	507	if [ ! -x /usr/bin/dig -o ! -f /etc/resolv.conf ]; then
	508	return
	509	fi
	510
	511	echo "#" > dig-info.txt
	512	echo '# dig -t any -c any www.apple.com' >> dig-info.txt
	513	echo "#" >> dig-info.txt
	514	/usr/bin/dig +time=2 -t any -c any www.apple.com >> dig-info.txt 2>/dev/null
	515
	516	}
	517
	518	#
942cecd7	519	# hostname
9de8ab86 A	520	#
	521	run_hostname () {
	522
	523	if [ ! -x /bin/hostname ]; then
	524	return
	525	fi
	526
	527	/bin/hostname > hostname.txt 2>&1
	528
	529	}
	530
942cecd7 A	531	#
	532	# lsof
	533	#
	534	run_lsof () {
	535
	536	if [ ! -x /usr/sbin/lsof ]; then
	537	return
	538	fi
	539
	540	${PRIV} /usr/sbin/lsof -i -n -O -P -T q > lsof.txt 2>&1 &
	541	LSOF_PID=$!
	542	# start a watchdog for lsof
	543	(
	544	WAIT_TIME=5
	545	while [ $WAIT_TIME -gt 0 ]
	546	do
	547	${PRIV} kill -0 ${LSOF_PID} 2>/dev/null
	548	if [ $? -eq 0 ]; then
	549	# lsof is [still] gathering data...
	550	sleep 1
	551	WAIT_TIME=$((WAIT_TIME - 1))
	552	continue
	553	fi
	554
	555	# lsof completed gathering data
	556	break
	557	done
	558
	559	if [ $WAIT_TIME -eq 0 ]; then
	560	# lsof timed out
	561	${PRIV} kill ${LSOF_PID} 2>/dev/null
	562	fi
	563	) &
	564
	565	}
	566
43bfd57e A	567	start_pcap() {
	568
	569	#
	570	# collect a packet capture if netdiagnose is available
	571	#
	572	if [ -x /usr/local/bin/netdiagnose ]; then
	573	/usr/local/bin/netdiagnose -p "${REQUESTED_OUTDIR}" start sysdiagpcap 2>&1
	574
	575	PCAP_STARTED=1
	576	fi
	577	}
	578
	579	stop_pcap () {
	580	if [ ${PCAP_STARTED} -ne 0 ]; then
	581	/usr/local/bin/netdiagnose stop sysdiagpcap 2>&1
	582	fi
	583	}
	584
942cecd7 A	585	collect_ndf_info () {
	586	run_lsof
	587	}
	588
9de8ab86	589	collect_sensitive_info () {
43bfd57e A	590
	591	if [ "${COLLECT_PCAP}" == "Y" ]; then
	592	start_pcap
	593	fi
	594
9de8ab86 A	595	collect_state_dump_sensitive
	596	run_ndp
	597	run_arp
942cecd7 A	598	run_neutil
942cecd7 A	599	run_network_test
9de8ab86 A	600	}
	601
	602	collect_info () {
942cecd7 A	603
	604	if [ "${COLLECT_NDF_INFO}" == "Y" ]; then
	605	collect_ndf_info
	606	fi
9de8ab86 A	607
	608	if [ "${COLLECT_SENSITIVE_INFO}" == "Y" ]; then
	609	collect_sensitive_info
	610	fi
	611
	612	run_scutil
	613	run_dig
	614	run_ifconfig
	615	run_netstat
	616	run_ipconfig
	617	run_setkey
	618	collect_vpn_logs
	619	run_route
	620	run_hostname
	621
	622	if [ "${COLLECT_CONFIGURATION_FILES}" == "Y" ]; then
	623	collect_configuration_files
	624	fi
43bfd57e A	625
43bfd57e A	626	stop_pcap
9de8ab86 A	627	}
	628
	629	# __COMMAND_ROUTINES_END__
	630
	631	# __HELPER_ROUTINES_BEGIN__
	632
	633	usage () {
	634
942cecd7	635	echo "Usage: get-network-info [-c] [-n] [-s] <info-directory>"
9de8ab86	636	echo " -c collects system configuration files"
942cecd7	637	echo " -n collects NDF information (lsof)"
43bfd57e	638	echo " -P do not collect a packet capture"
942cecd7	639	echo " -s collects sensitive information (ARP/NDP/mDNS cache)"
9de8ab86 A	640	echo " <info-directory> path to directory where all the information will be collected"
	641
	642	}
	643
	644	is_outdir_valid () {
	645
	646	if [ ! -d ${REQUESTED_OUTDIR} ] \|\|
	647	[ "${REQUESTED_OUTDIR}" = "" ]; then
	648	usage
	649	exit 1
	650	fi
	651
	652	if [ ! -w ${REQUESTED_OUTDIR} ]; then
	653	echo "${REQUESTED_OUTDIR} is write-protected"
	654	exit 1
	655	fi
	656	}
	657
	658	#
	659	# Collect most used command output to be used later
	660	#
	661	optimize () {
	662
	663	if [ ! -x /sbin/ifconfig ]; then
	664	return
	665	fi
	666
	667	IF_LIST=`/sbin/ifconfig -l`
	668
	669	}
	670
	671	init_globals () {
	672	REQUESTED_OUTDIR=""
	673	COLLECT_SENSITIVE_INFO=""
	674	COLLECT_CONFIGURATION_FILES=""
43bfd57e A	675	COLLECT_PCAP="Y"
	676	PCAP_STARTED=0
	677
9de8ab86 A	678	}
	679
	680	# __HELPER_ROUTINES_END__
	681
	682	#
	683	# __MAIN__
	684	#
43bfd57e	685	ARGS=`getopt cnPs $*`
9de8ab86 A	686	if [ $? != 0 ]; then
	687	usage
	688	exit 1
	689	fi
	690
	691	init_globals
	692	process_opts
	693	is_outdir_valid
	694	setup
	695	optimize
	696	collect_info
	697	wait
	698
9de8ab86	699	exit 0