4 files changed, 309 insertions, 322 deletions

diff --git a/src/fnettrace/fnettrace.h b/src/fnettrace/fnettrace.h
index b1a2f5b6c..b4a8f26c7 100644
--- a/src/fnettrace/fnettrace.h
+++ b/src/fnettrace/fnettrace.h
@@ -75,4 +75,7 @@ void terminal_handler(int s);
 void terminal_set(void);
 void terminal_restore(void);
 
+// runprog.c
+int runprog(const char *program);
+
 #endif
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c
index 932afff61..3bafd9090 100644
--- a/src/fnettrace/main.c
+++ b/src/fnettrace/main.c
@@ -25,15 +25,63 @@
 #include <signal.h>
 #define MAX_BUF_SIZE (64 * 1024)
 
-static int arg_netfilter = 0;
-static int arg_tail = 0;
 static char *arg_log = NULL;
 
+//*****************************************************************
+// packet stats
+//*****************************************************************
 uint32_t stats_pkts = 0;
-uint32_t stats_icmp = 0;
+uint32_t stats_icmp_echo = 0;
 uint32_t stats_dns = 0;
+uint32_t stats_dns_dot = 0;
+uint32_t stats_dns_doh = 0;
+uint32_t stats_dns_doq = 0;
+uint32_t stats_tls = 0;
+uint32_t stats_quic = 0;
+uint32_t stats_tor = 0;
+uint32_t stats_http = 0;
+uint32_t stats_ssh = 0;
+
+//*****************************************************************
+// sni/dns log storage
+//*****************************************************************
+typedef struct lognode_t {
+#define LOG_RECORD_LEN 255
+        char record[LOG_RECORD_LEN + 1];
+} LogNode;
+// circular list of SNI log records
+#define SNIMAX 64
+LogNode sni_table[SNIMAX] = {0};
+int sni_index = 0;
+
+// circular list of SNI log records
+#define DNSMAX 64
+LogNode dns_table[SNIMAX] = {0};
+int dns_index = 0;
+
+static void print_sni(void) {
+        int i;
+        for (i = sni_index; i < SNIMAX; i++)
+                if (*sni_table[i].record)
+                        printf("   %s", sni_table[i].record);
+        for (i = 0; i < sni_index; i++)
+                if (*sni_table[i].record)
+                        printf("   %s", sni_table[i].record);
+}
 
+static void print_dns(void) {
+        int i;
+        for (i = dns_index; i < DNSMAX; i++)
+                if (*dns_table[i].record)
+                        printf("   %s", dns_table[i].record);
+        for (i = 0; i < dns_index; i++)
+                if (*dns_table[i].record)
+                        printf("   %s", dns_table[i].record);
+}
 
+//*****************************************************************
+// traffic trace storage - hash table for fast access + linked list for display purposes
+//*****************************************************************
 typedef struct hnode_t {
         struct hnode_t *hnext;  // used for hash table and unused linked list
         struct hnode_t *dnext;  // used to display streams on the screen
@@ -42,6 +90,7 @@ typedef struct hnode_t {
 
         // stats
         uint32_t  bytes;        // number of bytes received in the last display interval
+        uint32_t pkts;  // number of packets received in the last display interval
         uint16_t port_src;
         uint8_t protocol;
 
@@ -97,6 +146,7 @@ static void hnode_add(uint32_t ip_src, uint8_t protocol, uint16_t port_src, uint
                         ip_instance++;
                         if (ptr->port_src == port_src && ptr->protocol == protocol) {
                                 ptr->bytes += bytes;
+                                ptr->pkts++;
                                 assert(ptr->rnode);
                                 ptr->rnode->pkts++;
                                 return;
@@ -115,6 +165,7 @@ static void hnode_add(uint32_t ip_src, uint8_t protocol, uint16_t port_src, uint
         hnew->protocol = protocol;
         hnew->hnext = NULL;
         hnew->bytes = bytes;
+        hnew->pkts = 1;
         hnew->ip_instance = ip_instance + 1;
         hnew->ttl = DISPLAY_TTL;
         if (htable[h] == NULL)
@@ -139,9 +190,6 @@ static void hnode_add(uint32_t ip_src, uint8_t protocol, uint16_t port_src, uint
         if (!hnew->rnode)
                 hnew->rnode = radix_add(hnew->ip_src, 0xffffffff, NULL);
         hnew->rnode->pkts++;
-
-        if (arg_netfilter)
-                logprintf(" %d.%d.%d.%d ", PRINT_IP(hnew->ip_src));
 }
 
 static void hnode_free(HNode *elem) {
@@ -242,23 +290,23 @@ typedef struct port_type_t {
         char *service;
 } PortType;
 static PortType ports[] = {
-        {20, "(FTP)"},
-        {21, "(FTP)"},
-        {22, "(SSH)"},
-        {23, "(telnet)"},
-        {25, "(SMTP)"},
-        {43, "(WHOIS)"},
-        {67, "(DHCP)"},
-        {68, "(DHCP)"},
-        {69, "(TFTP)"},
-        {80, "(HTTP)"},
-        {109, "(POP2)"},
-        {110, "(POP3)"},
-        {113, "(IRC)"},
-        {123, "(NTP)"},
-        {161, "(SNMP)"},
-        {162, "(SNMP)"},
-        {194, "(IRC)"},
+        {20, "FTP"},
+        {21, "FTP"},
+        {22, "SSH"},
+        {23, "telnet"},
+        {25, "SMTP"},
+        {43, "WHOIS"},
+        {67, "DHCP"},
+        {68, "DHCP"},
+        {69, "TFTP"},
+        {80, "HTTP"},
+        {109, "POP2"},
+        {110, "POP3"},
+        {113, "IRC"},
+        {123, "NTP"},
+        {161, "SNMP"},
+        {162, "SNMP"},
+        {194, "IRC"},
         {0, NULL},
 };
 
@@ -266,32 +314,32 @@ static PortType ports[] = {
 static inline const char *common_port(uint16_t port) {
         if (port >= 6660 && port <= 10162) {
                 if (port >= 6660 && port <= 6669)
-                        return "(IRC)";
+                        return "IRC";
                 else if (port == 6679)
-                        return "(IRC)";
+                        return "IRC";
                 else if (port == 6771)
-                        return "(BitTorrent)";
+                        return "BitTorrent";
                 else if (port >= 6881 && port <= 6999)
-                        return "(BitTorrent)";
+                        return "BitTorrent";
                 else if (port == 9001)
-                        return "(Tor)";
+                        return "Tor";
                 else if (port == 9030)
-                        return "(Tor)";
+                        return "Tor";
                 else if (port == 9050)
-                        return "(Tor)";
+                        return "Tor";
                 else if (port == 9051)
-                        return "(Tor)";
+                        return "Tor";
                 else if (port == 9150)
-                        return "(Tor)";
+                        return "Tor";
                 else if (port == 10161)
-                        return "(secure SNMP)";
+                        return "secure SNMP";
                 else if (port == 10162)
-                        return "(secure SNMP)";
+                        return "secure SNMP";
                 return NULL;
         }
 
         if (port <= 194) {
-                PortType *ptr =&ports[0];
+                PortType *ptr = &ports[0];
                 while(ptr->service != NULL) {
                         if (ptr->port == port)
                                 return ptr->service;
@@ -305,7 +353,6 @@ static inline const char *common_port(uint16_t port) {
 
 
 static void hnode_print(unsigned bw) {
-        assert(!arg_netfilter);
         bw = (bw < 1024 * DISPLAY_INTERVAL) ? 1024 * DISPLAY_INTERVAL : bw;
 #ifdef DEBUG
         printf("*********************\n");
@@ -336,7 +383,7 @@ static void hnode_print(unsigned bw) {
         else
                 sprintf(stats, "%u KB/s ", bw / (1024 * DISPLAY_INTERVAL));
 //      int len = snprintf(line, LINE_MAX, "%32s geoip %d, IP database %d\n", stats, geoip_calls, radix_nodes);
-        int len = snprintf(line, LINE_MAX, "%32s address:port (protocol) network (packets)\n", stats);
+        int len = snprintf(line, LINE_MAX, "%32s address:port (protocol) network\n", stats);
         adjust_line(line, len, cols);
         printf("%s", line);
 
@@ -369,47 +416,67 @@ static void hnode_print(unsigned bw) {
                                 bwline = print_bw(ptr->bytes / bwunit);
 
                         const char *protocol = NULL;
-                        if (ptr->port_src == 443 && ptr->protocol == 0x06) // TCP
-                                protocol = "(TLS)";
-                        else if (ptr->port_src == 443 && ptr->protocol == 0x11) // UDP
-                                protocol = "(QUIC)";
-                        else if (ptr->port_src == 53)
-                                protocol = "(DNS)";
+                        if (ptr->port_src == 443 && ptr->protocol == 0x06) { // TCP
+                                protocol = "TLS";
+                                stats_tls += ptr->pkts;
+                                if (strstr(ptr->rnode->name, "DNS")) {
+                                        protocol = "DoH";
+                                        stats_dns_doh += ptr->pkts;
+                                }
+
+                        }
+                        else if (ptr->port_src == 443 && ptr->protocol == 0x11) { // UDP
+                                protocol = "QUIC";
+                                stats_quic +=  ptr->pkts;
+                                if (strstr(ptr->rnode->name, "DNS")) {
+                                        protocol = "DoQ";
+                                        stats_dns_doq += ptr->pkts;
+                                }
+                        }
+                        else if (ptr->port_src == 53) {
+                                protocol = "DNS";
+                                stats_dns += ptr->pkts;
+                        }
                         else if (ptr->port_src == 853) {
-                                if (ptr->protocol == 0x06)
-                                        protocol = "(DoT)";
-                                else if (ptr->protocol == 0x11)
-                                        protocol = "(DoQ)";
+                                if (ptr->protocol == 0x06) {
+                                        protocol = "DoT";
+                                        stats_dns_dot += ptr->pkts;
+                                }
+                                else if (ptr->protocol == 0x11) {
+                                        protocol = "DoQ";
+                                        stats_dns_doq += ptr->pkts;
+                                }
                                 else
                                         protocol = NULL;
                         }
-                        else if ((protocol = common_port(ptr->port_src)) != NULL)
-                                ;
+                        else if ((protocol = common_port(ptr->port_src)) != NULL) {
+                                if (strcmp(protocol, "HTTP") == 0)
+                                        stats_http += ptr->pkts;
+                                else if (strcmp(protocol, "Tor") == 0)
+                                        stats_tor += ptr->pkts;
+                                else if (strcmp(protocol, "SSH") == 0)
+                                        stats_ssh += ptr->pkts;
+                        }
                         else if (ptr->protocol == 0x11)
-                                protocol = "(UDP)";
+                                protocol = "UDP";
                         else if (ptr->protocol == 0x06)
-                                protocol = "(TCP)";
+                                protocol = "TCP";
 
                         if (protocol == NULL)
                                 protocol = "";
                         if (ptr->port_src == 0)
                                 len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d (ICMP) %s\n",
                                                bytes, bwline, PRINT_IP(ptr->ip_src), ptr->rnode->name);
-                        else if (ptr->rnode->pkts > 1000000)
-                                len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d:%u%s %s (%.01fM)\n",
-                                               bytes, bwline, PRINT_IP(ptr->ip_src), ptr->port_src, protocol, ptr->rnode->name, ((double) ptr->rnode->pkts) / 1000000);
-                        else if (ptr->rnode->pkts > 1000)
-                                len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d:%u%s %s (%.01fK)\n",
-                                               bytes, bwline, PRINT_IP(ptr->ip_src), ptr->port_src, protocol, ptr->rnode->name, ((double) ptr->rnode->pkts) / 1000);
                         else
-                                len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d:%u%s %s (%u)\n",
-                                               bytes, bwline, PRINT_IP(ptr->ip_src), ptr->port_src, protocol, ptr->rnode->name, ptr->rnode->pkts);
+                                len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d:%u (%s) %s\n",
+                                               bytes, bwline, PRINT_IP(ptr->ip_src), ptr->port_src, protocol, ptr->rnode->name);
                         adjust_line(line, len, cols);
                         printf("%s", line);
 
                         if (ptr->bytes)
                                 ptr->ttl = DISPLAY_TTL;
                         ptr->bytes = 0;
+                        ptr->pkts = 0;
                         prev = ptr;
                 }
                 else {
@@ -440,17 +507,10 @@ static void hnode_print(unsigned bw) {
 
 
 void print_stats(void) {
-        printf("\nIP table: %d entries, %d unknown\n", radix_nodes, geoip_calls);
-        printf("   address network (packets)\n");
-        radix_print(1);
-        printf("Packets: %u total, ICMP %u, DNS %u\n", stats_pkts, stats_icmp, stats_dns);
 }
 
 // trace rx traffic coming in
 static void run_trace(void) {
-        if (arg_netfilter)
-                logprintf("accumulating traffic for %d seconds\n", NETLOCK_INTERVAL);
-
         // trace only rx ipv4 tcp and upd
         int s1 = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
         int s2 = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
@@ -458,37 +518,45 @@ static void run_trace(void) {
         if (s1 < 0 || s2 < 0 || s3 < 0)
                 errExit("socket");
 
-        unsigned start = time(NULL);
+
+        int p1 = runprog(LIBDIR "/firejail/fnettrace-sni");
+        if (p1 != -1)
+                printf("loading snitrace...");
+
+        int p2 = runprog(LIBDIR "/firejail/fnettrace-dns --nolocal");
+        if (p2 != -1)
+                printf("loading dnstrace...");
         unsigned last_print_traces = 0;
-        unsigned last_print_remaining = 0;
         unsigned char buf[MAX_BUF_SIZE];
         unsigned bw = 0; // bandwidth calculations
 
         while (1) {
                 unsigned end = time(NULL);
-                if (arg_netfilter && end - start >= NETLOCK_INTERVAL)
-                        break;
                 if (end % DISPLAY_INTERVAL == 1 && last_print_traces != end) { // first print after 1 second
-                        if (!arg_netfilter)
-                                hnode_print(bw);
+                        hnode_print(bw);
                         last_print_traces = end;
                         bw = 0;
                 }
-                if (arg_netfilter && last_print_remaining != end) {
-                        logprintf(".");
-                        fflush(0);
-                        last_print_remaining = end;
-                }
 
                 fd_set rfds;
                 FD_ZERO(&rfds);
+                FD_SET(0, &rfds);
+
                 FD_SET(s1, &rfds);
                 FD_SET(s2, &rfds);
                 FD_SET(s3, &rfds);
-                if (!arg_netfilter)
-                        FD_SET(0, &rfds);
                 int maxfd = (s1 > s2) ? s1 : s2;
                 maxfd = (s3 > maxfd) ? s3 : maxfd;
+
+                if (p1 != -1) {
+                        FD_SET(p1, &rfds);
+                        maxfd = (p1 > maxfd) ? p1 : maxfd;
+                }
+
+                if (p2 != -1) {
+                        FD_SET(p2, &rfds);
+                        maxfd = (p2 > maxfd) ? p2 : maxfd;
+                }
                 maxfd++;
 
                 struct timeval tv;
@@ -508,10 +576,78 @@ static void run_trace(void) {
 
                 if (FD_ISSET(0, &rfds)) {
                         getchar();
-                        print_stats();
+                        printf("\n\nStats: %u packets\n", stats_pkts);
+                        printf("   encrypted: TLS %u, QUIC %u, SSH %u, Tor %u\n",
+                                stats_tls, stats_quic, stats_ssh, stats_tor);
+                        printf("   unencrypted: HTTP %u\n", stats_http);
+                        printf("   C&C backchannel: PING %u, DNS %u, DoH %u, DoT %u, DoQ %u\n",
+                                stats_icmp_echo, stats_dns, stats_dns_doh, stats_dns_dot, stats_dns_doq);
+                        printf("press any key to continue...");
+                        fflush(0);
+
+                        getchar();
+                        printf("\n\nSNI log - time server-address SNI\n");
+                        print_sni();
                         printf("press any key to continue...");
                         fflush(0);
+
+                        getchar();
+                        printf("\n\nDNS log - time server-address domain\n");
+                        print_dns();
+                        printf("press any key to continue...");
+                        fflush(0);
+
                         getchar();
+                        printf("\n\nIP table: %d addresses - server-address network (packets)\n", radix_nodes);
+                        radix_print(1);
+                        printf("press any key to continue...");
+                        fflush(0);
+
+                        getchar();
+                        continue;
+                }
+                else if (FD_ISSET(p1, &rfds)) {
+                        char buf[1024];
+                        ssize_t sz = read(p1, buf, 1024 - 1);
+                        if (sz == -1)
+                                errExit("error reading snitrace");
+                        if (sz == 0) {
+                                fprintf(stderr, "Error: snitrace EOF!!!\n");
+                                p1 = -1;
+                        }
+                        if (strncmp(buf, "SNI trace", 9) == 0)
+                                continue;
+
+                        if (sz > LOG_RECORD_LEN)
+                                sz = LOG_RECORD_LEN;
+                        buf[sz] = '\0';
+                        strcpy(sni_table[sni_index].record, buf);
+                        if (++sni_index >= SNIMAX) {
+                                sni_index = 0;
+                                *sni_table[sni_index].record = '\0';
+                        }
+                        continue;
+                }
+                else if (FD_ISSET(p2, &rfds)) {
+                        char buf[1024];
+                        ssize_t sz = read(p2, buf, 1024 - 1);
+                        if (sz == -1)
+                                errExit("error reading dnstrace");
+                        if (sz == 0) {
+                                fprintf(stderr, "Error: dnstrace EOF!!!\n");
+                                p2 = -1;
+                        }
+                        if (strncmp(buf, "DNS trace", 9) == 0)
+                                continue;
+
+                        if (sz > LOG_RECORD_LEN)
+                                sz = LOG_RECORD_LEN;
+                        buf[sz] = '\0';
+                        strcpy(dns_table[dns_index].record, buf);
+                        if (++dns_index >= DNSMAX) {
+                                dns_index = 0;
+                                *dns_table[dns_index].record = '\0';
+                        }
                         continue;
                 }
                 else if (FD_ISSET(s2, &rfds))
@@ -557,10 +693,10 @@ static void run_trace(void) {
 
                                 // stats
                                 stats_pkts++;
-                                if (icmp)
-                                        stats_icmp++;
-                                if (port_src == 53)
-                                        stats_dns++;
+                                if (icmp)  {
+                                        if (*(buf + hlen) == 0 || *(buf + hlen) == 8)
+                                                stats_icmp_echo++;
+                                }
 
                         }
                 }
@@ -572,142 +708,6 @@ static void run_trace(void) {
         print_stats();
 }
 
-static char *filter_start =
-        "*filter\n"
-        ":INPUT DROP [0:0]\n"
-        ":FORWARD DROP [0:0]\n"
-        ":OUTPUT DROP [0:0]\n";
-
-// return 1 if error
-static int print_filter(FILE *fp) {
-        if (dlist == NULL)
-                return 1;
-        fprintf(fp, "%s\n", filter_start);
-        fprintf(fp, "-A INPUT -s 127.0.0.0/8 -j ACCEPT\n");
-        fprintf(fp, "-A OUTPUT -d 127.0.0.0/8 -j ACCEPT\n");
-        fprintf(fp, "\n");
-
-        int i;
-        for (i = 0; i < HMAX; i++) {
-                HNode *ptr = htable[i];
-                while (ptr) {
-                        // filter rules are targeting ip address, the port number is disregarded,
-                        // so we look only at the first instance of an address
-                        if (ptr->ip_instance == 1) {
-                                char *protocol = (ptr->protocol == 6) ? "tcp" : "udp";
-                                fprintf(fp, "-A INPUT -s %d.%d.%d.%d -p %s  -j ACCEPT\n",
-                                        PRINT_IP(ptr->ip_src),
-                                        protocol);
-                                fprintf(fp, "-A OUTPUT -d %d.%d.%d.%d -p %s  -j ACCEPT\n",
-                                        PRINT_IP(ptr->ip_src),
-                                        protocol);
-                                fprintf(fp, "\n");
-                        }
-                        ptr = ptr->hnext;
-                }
-        }
-        fprintf(fp, "COMMIT\n");
-
-        return 0;
-}
-
-static char *flush_rules[] = {
-        "-P INPUT ACCEPT",
-//      "-P FORWARD DENY",
-        "-P OUTPUT ACCEPT",
-        "-F",
-        "-X",
-//      "-t nat -F",
-//      "-t nat -X",
-//      "-t mangle -F",
-//      "-t mangle -X",
-//      "iptables -t raw -F",
-//      "-t raw -X",
-        NULL
-};
-
-static void deploy_netfilter(void) {
-        int rv;
-        char *cmd;
-        int i;
-
-        if (dlist == NULL) {
-                logprintf("Sorry, no network traffic was detected. The firewall was not configured.\n");
-                return;
-        }
-        // find iptables command
-        char *iptables = NULL;
-        char *iptables_restore = NULL;
-        if (access("/sbin/iptables", X_OK) == 0) {
-                iptables = "/sbin/iptables";
-                iptables_restore = "/sbin/iptables-restore";
-        }
-        else if (access("/usr/sbin/iptables", X_OK) == 0) {
-                iptables = "/usr/sbin/iptables";
-                iptables_restore = "/usr/sbin/iptables-restore";
-        }
-        if (iptables == NULL || iptables_restore == NULL) {
-                fprintf(stderr, "Error: iptables command not found, netfilter not configured\n");
-                exit(1);
-        }
-
-        // flush all netfilter rules
-        i = 0;
-        while (flush_rules[i]) {
-                char *cmd;
-                if (asprintf(&cmd, "%s %s", iptables, flush_rules[i]) == -1)
-                        errExit("asprintf");
-                int rv = system(cmd);
-                (void) rv;
-                free(cmd);
-                i++;
-        }
-
-        // create temporary file
-        char fname[] = "/tmp/firejail-XXXXXX";
-        int fd = mkstemp(fname);
-        if (fd == -1) {
-                fprintf(stderr, "Error: cannot create temporary configuration file\n");
-                exit(1);
-        }
-
-        FILE *fp = fdopen(fd, "w");
-        if (!fp) {
-                rv = unlink(fname);
-                (void) rv;
-                fprintf(stderr, "Error: cannot create temporary configuration file\n");
-                exit(1);
-        }
-        print_filter(fp);
-        fclose(fp);
-
-        logprintf("\n\n");
-        logprintf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-        if (asprintf(&cmd, "cat %s >> %s", fname, arg_log) == -1)
-                errExit("asprintf");
-        rv = system(cmd);
-        (void) rv;
-        free(cmd);
-
-        if (asprintf(&cmd, "cat %s", fname) == -1)
-                errExit("asprintf");
-        rv = system(cmd);
-        (void) rv;
-        free(cmd);
-        logprintf("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
-
-        // configuring
-        if (asprintf(&cmd, "%s %s", iptables_restore, fname) == -1)
-                errExit("asprintf");
-        rv = system(cmd);
-        if (rv)
-                fprintf(stdout, "Warning: possible netfilter problem!");
-        free(cmd);
-
-        rv = unlink(fname);
-        (void) rv;
-        logprintf("\nfirewall deployed\n");
-}
 
 void logprintf(char *fmt, ...) {
         if (!arg_log)
@@ -733,14 +733,8 @@ static const char *const usage_str =
         "Options:\n"
         "   --help, -? - this help screen\n"
         "   --log=filename - netlocker logfile\n"
-        "   --netfilter - build the firewall rules and commit them\n"
         "   --print-map - print IP map\n"
-        "   --squash-map - compress IP map\n"
-        "   --tail - \"tail -f\" functionality\n"
-        "Examples:\n"
-        "   # fnettrace                              - traffic trace\n"
-        "   # fnettrace --netfilter --log=logfile    - netlocker, dump output in logfile\n"
-        "   # fnettrace --tail --log=logifile        - similar to \"tail -f logfile\"\n";
+        "   --squash-map - compress IP map\n";
 
 static void usage(void) {
         puts(usage_str);
@@ -775,7 +769,7 @@ int main(int argc, char **argv) {
                         return 0;
                 }
                 else if (strncmp(argv[i], "--squash-map=", 13) == 0) {
-                        if (i !=(argc - 1)) {
+                        if (i != (argc - 1)) {
                                 fprintf(stderr, "Error: please provide a map file\n");
                                 return 1;
                         }
@@ -798,10 +792,6 @@ int main(int argc, char **argv) {
                         fprintf(stderr, "static ip map: input %d, output %d\n", in, radix_nodes);
                         return 0;
                 }
-                else if (strcmp(argv[i], "--netfilter") == 0)
-                        arg_netfilter = 1;
-                else if (strcmp(argv[i], "--tail") == 0)
-                        arg_tail = 1;
                 else if (strncmp(argv[i], "--log=", 6) == 0)
                         arg_log = argv[i] + 6;
                 else {
@@ -810,19 +800,6 @@ int main(int argc, char **argv) {
                 }
         }
 
-        // tail
-        if (arg_tail) {
-                if (!arg_log) {
-                        fprintf(stderr, "Error: no log file\n");
-                        usage();
-                        exit(1);
-                }
-
-                tail(arg_log);
-                sleep(5);
-                exit(0);
-        }
-
         if (getuid() != 0) {
                 fprintf(stderr, "Error: you need to be root to run this program\n");
                 return 1;
@@ -838,25 +815,10 @@ int main(int argc, char **argv) {
         prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
 
         ansi_clrscr();
-        if (arg_netfilter)
-                logprintf("starting network lockdown\n");
-        else  {
-                char *fname = LIBDIR "/firejail/static-ip-map";
-                load_hostnames(fname);
-        }
+        char *fname = LIBDIR "/firejail/static-ip-map";
+        load_hostnames(fname);
 
         run_trace();
-        if (arg_netfilter) {
-                // TCP path MTU discovery will not work properly since the firewall drops all ICMP packets
-                // Instead, we use iPacketization Layer PMTUD (RFC 4821) support in Linux kernel
-                int rv = system("echo 1 > /proc/sys/net/ipv4/tcp_mtu_probing");
-                (void) rv;
-
-                deploy_netfilter();
-                sleep(3);
-                if (arg_log)
-                        unlink(arg_log);
-        }
 
         return 0;
 }
diff --git a/src/fnettrace/tail.c b/src/fnettrace/runprog.c
index 3b1b274f8..e30d8a16c 100644
--- a/src/fnettrace/tail.c
+++ b/src/fnettrace/runprog.c
@@ -19,45 +19,13 @@
 */
 #include "fnettrace.h"
 
-void tail(const char *logfile) {
-        assert(logfile);
-
-        // wait for no more than 5 seconds for the logfile to appear in the filesystem
-        int cnt = 5;
-        while (access(logfile, R_OK) && cnt > 0)
-                cnt--;
-        if (cnt == 0)
-                exit(1);
-
-        off_t last_size = 0;
-
-        while (1) {
-                int fd = open(logfile, O_RDONLY);
-                if (fd == -1)
-                        return;
-
-                off_t size = lseek(fd, 0, SEEK_END);
-                if (size < 0) {
-                        close(fd);
-                        return;
-                }
-
-                char *content = NULL;
-                int mmapped = 0;
-                if (size && size != last_size) {
-                        content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
-                        close(fd);
-                        if (content != MAP_FAILED)
-                                mmapped = 1;
-                }
-
-                if (mmapped) {
-                        printf("%.*s", (int) (size - last_size), content + last_size);
-                        fflush(0);
-                        munmap(content, size);
-                        last_size = size;
-                }
-
-                sleep(1);
+int runprog(const char *program) {
+        assert(program);
+        FILE *fp = popen(program, "r");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot run %s\n", program);
+                return -1;
         }
+
+        return fileno(fp);
 }
diff --git a/src/fnettrace/static-ip-map.txt b/src/fnettrace/static-ip-map.txt
index 756658562..59ec79f8f 100644
--- a/src/fnettrace/static-ip-map.txt
+++ b/src/fnettrace/static-ip-map.txt
@@ -38,14 +38,19 @@
 #
 
 
-# local network addresses
-192.168.0.0/16 local network
-10.0.0.0/8 local network
-172.16.0.0/16 local network
-169.254.0.0/16 local link
+# local network addresses (based on https://en.wikipedia.org/wiki/Reserved_IP_addresses)
+10.0.0.0/8 Local network
+100.64.0.0/10 Carrier-grade NAT
+127.0.0.0/8 Local host
+169.254.0.0/16 Local link
+172.16.0.0/12 Local network
+192.0.2.0/24 Documentation
+192.168.0.0/16 Local network
+198.51.100.0/24 Documentation
+203.0.113.0/24 Documentation
 
 # multicast
-224.0.0.0/4 multicast
+224.0.0.0/4 Multicast
 224.0.0.9/32 RIPv2
 224.0.0.5/32 OSPF
 224.0.0.6/32 OSPF
@@ -86,15 +91,40 @@
 4.2.2.4/32 Level3 DNS
 8.8.4.0/24 Google DNS
 8.8.8.0/24 Google DNS
+8.20.247.20/32 Comodo DNS
+8.26.56.26/32 Comodo DNS
 9.9.9.0/24 Quad9 DNS
 45.90.28.0/22 NextDNS
+45.11.45.0/24 DNS-SB
+64.6.64.6/32 Neustar DNS
+64.6.65.6/32 Neustar DNS
+74.82.42.42/32 Hurricane Electric DNS
+76.76.2.0/24 ControlD DNS
+76.76.10.0/24 ControlD DNS
+76.76.19.0/24 Alternate DNS
+76.223.122.150/32 Alternate DNS
+77.88.8.8/32 Yandex DNS
+77.88.8.1/32 Yandex DNS
+80.80.80.0/24 Freenom DNS Cloud
+80.80.81.0/24 Freenom DNS Cloud
+84.200.69.80/32 DSN Watch
+84.200.70.40/32 DNS Watch
 94.140.14.0/23 Adguard DNS
 149.112.112.0/24 Quad9 DNS
 149.112.120.0/21 CIRA DNS Canada
-146.255.56.96/29 Applied Privacy
+146.255.56.96/29 Applied Privacy DNS
 176.103.128.0/19 Adguard DNS
+185.222.222.0/24 DNS-SB
 185.228.168.0/24 Cleanbrowsing DNS
+185.236.104.0/24 FlashStart DNS
+185.236.105.0/24 FlashStart DNS
+185.253.5.0/24 NextDNS
+193.110.81.0/24 NextDNS
+205.171.3.66/32 CentyrLink DNS
+205.171.202.166/32 CentyrLink DNS
 208.67.216.0/21 OpenDNS
+216.146.35.35/32 Dyn DNS
+216.146.36.36/32 Dyn DNS
 
 # whois
 192.0.32.0/20 ICANN
@@ -106,13 +136,15 @@
 199.212.0.0/24 whois.arin.net US
 200.3.12.0/22 whois.lacnic.net Uruguay
 201.159.220.0/22 whois.lacnic.net Ecuador
+203.119.100.0/22 apnic.net Australia
 
 # some popular websites
 5.255.255.0/24 Yandex
 23.160.0.0/24 Twitch
+23.229.128.0/17 GoDaddy
 23.246.0.0/18 Netflix
 31.13.24.0/21 Facebook
-31.13.64.0/18 Facebook
+31.13.64.0/17 Facebook
 37.77.184.0/21 Netflix
 45.57.0.0/17 Netflix
 45.58.64.0/20 Dropbox
@@ -132,9 +164,14 @@
 66.211.168.0/22 PayPal
 66.211.172.0/22 eBay
 66.211.176.0/20 eBay
+66.218.64.0/19 Yahoo
 66.220.144.0/20 Facebook
+69.30.200.200/29 BitChute
 69.53.224.0/19 Netflix
 69.171.224.0/19 Facebook
+69.197.182.184/29 BitChute
+74.6.0.0/16 Yahoo
+74.91.29.208/29 BitChute
 87.250.254.0/24 Yandex
 91.105.192.0/23 Telegram
 91.108.4.0/22 Telegram
@@ -147,14 +184,21 @@
 91.189.94.0/24 Ubuntu One
 95.161.64.0/20 Telegram
 99.181.64.0/18 Twitch
-103.53.48.0/23 Twitch
-104.244.40.0/21 Twitter
+69.197.138.24/29 BitChute
 103.10.124.0/23 Steam
 103.28.54.0/24 Steam
+103.53.48.0/23 Twitch
+104.244.40.0/21 Twitter
+107.150.32.0/19 BitChute
+107.150.35.192/29 BitChute
+107.150.45.120/29 BitChute
 108.160.160.0/20 Dropbox
 108.175.32.0/20 Netflix
 129.134.0.0/16 Facebook
 140.82.112.0/20 GitHub
+142.54.180.104/29 BitChute
+142.54.181.184/29 BitChute
+142.54.189.192/29 BitChute
 143.55.64.0/20 Github
 146.66.152.0/24 Steam
 146.66.155.0/24 Steam
@@ -174,6 +218,10 @@
 162.213.32.0/22 Ubuntu One
 162.254.192.0/21 Steam
 172.98.56.0/22 Rumble
+173.208.154.8/29 BitChute
+173.208.154.160/29 BitChute
+173.208.185.200/29 BitChute
+173.208.219.112/29 BitChute
 178.154.131.0/24 Yandex
 185.2.220.0/22 Netflix
 185.9.188.0/22 Netflix
@@ -194,23 +242,33 @@
 192.30.252.0/22 GitHub
 192.69.96.0/22 Steam
 192.108.239.0/24 Twitch
+192.151.158.136/29 BitChute
 192.173.64.0/18 Netflix
+192.187.97.88/29 BitChute
+192.187.114.96/29 BitChute
+192.187.123.112/29 BitChute
 192.189.200.0/23 Dropbox
 194.169.254.0/24 Ubuntu One
 198.38.96.0/19 Netflix
 198.45.48.0/20 Netflix
+198.204.226.120/29 BitChute
+198.204.245.88/29 BitChute
+198.252.206.0/24 Stack Exchange
 199.9.248.0/21 Twitch
 199.16.156.0/22 Twitter
 199.59.148.0/22 Twitter
 199.168.96.24/29 BitChute
+204.12.194.176/29 BitChute
 205.185.194.0/24 Steam
 205.196.6.0/24 Steam
 207.45.72.0/22 Netflix
 207.241.224.0/20 Internet Archive
+208.82.236.0/22 Creiglist
 208.64.200.0/22 Steam
 208.75.76.0/22 Netflix
 208.78.164.0/22 Steam
 208.80.152.0/22 Wikipedia
+208.110.68.56/29 BitChute
 209.140.128.0/18 eBay
 
 # Imperva
@@ -261,15 +319,6 @@
 205.224.0.0/14 Level 3
 209.244.0.0/14 Level 3
 
-# WholeSale Internet
-69.30.192.0/18 WholeSale Internet
-69.197.128.0/18 WholeSale Internet
-173.208.128.0/17 WholeSale Internet
-204.12.192.0/18 WholeSale Internet
-208.67.0.0/21 WholeSale Internet
-208.110.64.0/19 WholeSale Internet
-208.110.91.0/24 WholeSale Internet
-
 # StackPath
 69.16.173.0/24 StackPath
 69.16.174.0/23 StackPath
@@ -279,6 +328,7 @@
 205.185.196.0/23 StackPath
 205.185.198.0/24 StackPath
 205.185.200.0/21 StackPath
+205.185.208.0/24 StackPath
 205.185.212.0/23 StackPath
 205.185.215.0/24 StackPath
 205.185.216.0/23 StackPath
@@ -299,6 +349,8 @@
 205.185.220.0/24 StackPath
 
 # Linode
+45.79.0.0/16 Linode
+50.116.0.0/18 Linode
 66.175.208.0/20 Linode
 103.29.68.0/22 Linode
 104.200.16.0/21 Linode
@@ -397,6 +449,7 @@
 172.105.0.0/19 Linode
 172.105.112.0/20 Linode
 172.105.128.0/23 Linode
+173.255.192.0/18 Linode
 
 # Akamai
 2.16.0.0/13 Akamai
@@ -576,7 +629,7 @@
 103.21.244.0/22 Cloudflare
 103.22.200.0/22 Cloudflare
 103.31.4.0/22 Cloudflare
-104.16.0.0/13 Cloudflare
+104.16.0.0/12 Cloudflare
 104.24.0.0/14 Cloudflare
 108.162.192.0/18 Cloudflare
 131.0.72.0/22 Cloudflare
@@ -684,6 +737,7 @@
 3.136.0.0/13 Amazon
 3.144.0.0/13 Amazon
 3.152.0.0/13 Amazon
+3.160.0.0/14 Amazon
 3.208.0.0/12 Amazon
 3.224.0.0/12 Amazon
 3.240.0.0/13 Amazon