mdw@git.distorted.org.uk Git - yaid/blob - linux.c

   1 /* -*-c-*-
   2  *
   3  * Discover the owner of a connection (Linux version)
   4  *
   5  * (c) 2012 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Yet Another Ident Daemon (YAID).
  11  *
  12  * YAID is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License as published by
  14  * the Free Software Foundation; either version 2 of the License, or
  15  * (at your option) any later version.
  16  *
  17  * YAID is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with YAID; if not, write to the Free Software Foundation,
  24  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  25  */
  26
  27 /*----- Header files ------------------------------------------------------*/
  28
  29 #include "yaid.h"
  30
  31 /*----- Static variables --------------------------------------------------*/
  32
  33 struct addrops_sys {
  34   const char *procfile;
  35   int (*parseaddr)(char **, union addr *);
  36 };
  37
  38 #define PROCFILE_IPV4 "/proc/net/tcp"
  39
  40 static int parseaddr_ipv4(char **pp, union addr *a)
  41   { a->ipv4.s_addr = strtoul(*pp, pp, 16); return (0); }
  42
  43 #define PROCFILE_IPV6 "/proc/net/tcp6"
  44
  45 static int parseaddr_ipv6(char **pp, union addr *a)
  46 {
  47   int i, j;
  48   unsigned long y;
  49   char *p = *pp;
  50   unsigned x;
  51
  52   for (i = 0; i < 4; i++) {
  53     y = 0;
  54     for (j = 0; j < 8; j++) {
  55       if ('0' <= *p && *p <= '9') x = *p - '0';
  56       else if ('a' <= *p && *p <= 'f') x = *p - 'a'+ 10;
  57       else if ('A' <= *p && *p <= 'F') x = *p - 'A'+ 10;
  58       else return (-1);
  59       y = (y << 4) | x;
  60       p++;
  61     }
  62     a->ipv6.s6_addr32[i] = y;
  63   }
  64   *pp = p;
  65   return (0);
  66 }
  67
  68 #define DEFOPSYS(ty, TY)                                                \
  69   const struct addrops_sys addrops_sys_##ty = {                         \
  70     PROCFILE_##TY, parseaddr_##ty                                       \
  71   };
  72 ADDRTYPES(DEFOPSYS)
  73 #undef DEFOPSYS
  74
  75 /*----- Main code ---------------------------------------------------------*/
  76
  77 int get_default_gw(int af, union addr *a)
  78 {
  79   int fd;
  80   char buf[32768];
  81   struct nlmsghdr *nlmsg;
  82   struct rtgenmsg *rtgen;
  83   const struct rtattr *rta;
  84   const struct rtmsg *rtm;
  85   ssize_t n, nn;
  86   int rc = 0;
  87   static unsigned long seq = 0x48b4aec4;
  88
  89   if ((fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE)) < 0)
  90     die(1, "failed to create netlink socket: %s", strerror(errno));
  91
  92   nlmsg = (struct nlmsghdr *)buf;
  93   assert(NLMSG_SPACE(sizeof(*rtgen)) < sizeof(buf));
  94   nlmsg->nlmsg_len = NLMSG_LENGTH(sizeof(*rtgen));
  95   nlmsg->nlmsg_type = RTM_GETROUTE;
  96   nlmsg->nlmsg_flags = NLM_F_REQUEST | NLM_F_ROOT;
  97   nlmsg->nlmsg_seq = ++seq;
  98   nlmsg->nlmsg_pid = 0;
  99
 100   rtgen = (struct rtgenmsg *)NLMSG_DATA(nlmsg);
 101   rtgen->rtgen_family = af;
 102
 103   if (write(fd, nlmsg, nlmsg->nlmsg_len) < 0)
 104     die(1, "failed to send RTM_GETROUTE request: %s", strerror(errno));
 105
 106   for (;;) {
 107     if ((n = read(fd, buf, sizeof(buf))) < 0)
 108       die(1, "failed to read RTM_GETROUTE response: %s", strerror(errno));
 109     nlmsg = (struct nlmsghdr *)buf;
 110     if (nlmsg->nlmsg_seq != seq) continue;
 111     assert(nlmsg->nlmsg_flags & NLM_F_MULTI);
 112
 113     for (; NLMSG_OK(nlmsg, n); nlmsg = NLMSG_NEXT(nlmsg, n)) {
 114       if (nlmsg->nlmsg_type == NLMSG_DONE) goto done;
 115       if (nlmsg->nlmsg_type != RTM_NEWROUTE) continue;
 116       rtm = (const struct rtmsg *)NLMSG_DATA(nlmsg);
 117
 118       if (rtm->rtm_family != af ||
 119           rtm->rtm_dst_len > 0 ||
 120           rtm->rtm_src_len > 0 ||
 121           rtm->rtm_type != RTN_UNICAST ||
 122           rtm->rtm_scope != RT_SCOPE_UNIVERSE ||
 123           rtm->rtm_tos != 0)
 124         continue;
 125
 126       for (rta = RTM_RTA(rtm), nn = RTM_PAYLOAD(nlmsg);
 127            RTA_OK(rta, nn); rta = RTA_NEXT(rta, nn)) {
 128         if (rta->rta_type == RTA_GATEWAY) {
 129           assert(RTA_PAYLOAD(rta) <= sizeof(*a));
 130           memcpy(a, RTA_DATA(rta), RTA_PAYLOAD(rta));
 131           rc = 1;
 132         }
 133       }
 134     }
 135   }
 136
 137 done:
 138   close(fd);
 139   return (rc);
 140 }
 141
 142 void identify(struct query *q)
 143 {
 144   FILE *fp = 0;
 145   dstr d = DSTR_INIT;
 146   char *p, *pp;
 147   struct socket s[4];
 148   int i;
 149   int gwp = 0;
 150   unsigned fl;
 151 #define F_SADDR 1u
 152 #define F_SPORT 2u
 153 #define F_DADDR 4u
 154 #define F_DPORT 8u
 155 #define F_ALL (F_SADDR | F_SPORT | F_DADDR | F_DPORT)
 156 #define F_ESTAB 16u
 157   uid_t uid;
 158   enum { LOC, REM, ST, UID, NFIELD };
 159   int f, ff[NFIELD];
 160
 161   if (get_default_gw(q->ao->af, &s[0].addr) &&
 162       q->ao->addreq(&s[0].addr, &q->s[R].addr))
 163     gwp = 1;
 164
 165   if ((fp = fopen(q->ao->sys->procfile, "r")) == 0) {
 166     logmsg(q, LOG_ERR, "failed to open `%s' for reading: %s",
 167            q->ao->sys->procfile, strerror(errno));
 168     goto err_unk;
 169   }
 170
 171 #define NEXTFIELD do {                                                  \
 172   for (p = pp; isspace((unsigned char)*p); p++);                        \
 173   for (pp = p; *pp && !isspace((unsigned char)*pp); pp++);              \
 174   if (*pp) *pp++ = 0;                                                   \
 175 } while (0)
 176
 177   if (dstr_putline(&d, fp) == EOF) {
 178     logmsg(q, LOG_ERR, "failed to read header line from `%s': %s",
 179            q->ao->sys->procfile,
 180            ferror(fp) ? strerror(errno) : "unexpected EOF");
 181     goto err_unk;
 182   }
 183
 184   for (i = 0; i < NFIELD; i++) ff[i] = -1;
 185   pp = d.buf;
 186   for (f = 0;; f++) {
 187     NEXTFIELD; if (!*p) break;
 188     if (strcmp(p, "local_address") == 0)
 189       ff[LOC] = f;
 190     else if (strcmp(p, "rem_address") == 0 ||
 191              strcmp(p, "remote_address") == 0)
 192       ff[REM] = f;
 193     else if (strcmp(p, "uid") == 0)
 194       ff[UID] = f;
 195     else if (strcmp(p, "st") == 0)
 196       ff[ST] = f;
 197     else if (strcmp(p, "rx_queue") == 0 ||
 198              strcmp(p, "tm->when") == 0)
 199       f--;
 200   }
 201   for (i = 0; i < NFIELD; i++) {
 202     if (ff[i] < 0) {
 203       logmsg(q, LOG_ERR, "failed to find required fields in `%s'",
 204              q->ao->sys->procfile);
 205       goto err_unk;
 206     }
 207   }
 208
 209   for (;;) {
 210     DRESET(&d);
 211     if (dstr_putline(&d, fp) == EOF) break;
 212     pp = d.buf;
 213     uid = -1;
 214     for (f = 0;; f++) {
 215       NEXTFIELD; if (!*p) break;
 216       if (f == ff[LOC]) { i = L; goto compare; }
 217       else if (f == ff[REM]) { i = R; goto compare; }
 218       else if (f == ff[UID]) uid = atoi(p);
 219       else if (f == ff[ST]) {
 220         if (strtol(p, 0, 16) != 1) goto next_row;
 221       }
 222       continue;
 223
 224     compare:
 225       if (q->ao->sys->parseaddr(&p, &s[0].addr)) goto next_row;
 226       if (*p != ':') break; p++;
 227       s[0].port = strtoul(p, 0, 16);
 228       if (!sockeq(q->ao, &q->s[i], &s[0]) &&
 229           (i != R || !gwp || q->s[R].port != s[0].port))
 230         goto next_row;
 231     }
 232     if (uid != -1) {
 233       q->resp = R_UID;
 234       q->u.uid = uid;
 235       goto done;
 236     }
 237   next_row:;
 238   }
 239
 240   if (ferror(fp)) {
 241     logmsg(q, LOG_ERR, "failed to read connection table: %s",
 242            strerror(errno));
 243     goto err_unk;
 244   }
 245
 246   if (q->ao->af == AF_INET) {
 247     fclose(fp);
 248     if ((fp = fopen("/proc/net/ip_conntrack", "r")) == 0) {
 249       if (errno == ENOENT)
 250         goto err_nouser;
 251       else {
 252         logmsg(q, LOG_ERR,
 253                "failed to open `/proc/net/ip_conntrack' for reading: %s",
 254                strerror(errno));
 255         goto err_unk;
 256       }
 257     }
 258
 259     for (;;) {
 260       DRESET(&d);
 261       if (dstr_putline(&d, fp) == EOF) break;
 262       pp = d.buf;
 263       NEXTFIELD; if (!*p) break;
 264       if (strcmp(p, "tcp") != 0) continue;
 265       i = 0;
 266       fl = 0;
 267       for (;;) {
 268         NEXTFIELD; if (!*p) break;
 269         if (strcmp(p, "ESTABLISHED") == 0)
 270           fl |= F_ESTAB;
 271         else if (strncmp(p, "src=", 4) == 0) {
 272           inet_pton(AF_INET, p + 4, &s[i].addr);
 273           fl |= F_SADDR;
 274         } else if (strncmp(p, "dst=", 4) == 0) {
 275           inet_pton(AF_INET, p + 4, &s[i + 1].addr);
 276           fl |= F_DADDR;
 277         } else if (strncmp(p, "sport=", 6) == 0) {
 278           s[i].port = atoi(p + 6);
 279           fl |= F_SPORT;
 280         } else if (strncmp(p, "dport=", 6) == 0) {
 281           s[i + 1].port = atoi(p + 6);
 282           fl |= F_DPORT;
 283         }
 284         if ((fl & F_ALL) == F_ALL) {
 285           fl &= ~F_ALL;
 286           if (i < 4) i += 2;
 287           else break;
 288         }
 289       }
 290
 291 #ifdef notdef
 292       {
 293         dstr dd = DSTR_INIT;
 294         dstr_putf(&dd, "%sestab ", (fl & F_ESTAB) ? " " : "!");
 295         dputsock(&dd, q->ao, &s[0]);
 296         dstr_puts(&dd, "<->");
 297         dputsock(&dd, q->ao, &s[1]);
 298         dstr_puts(&dd, " | ");
 299         dputsock(&dd, q->ao, &s[2]);
 300         dstr_puts(&dd, "<->");
 301         dputsock(&dd, q->ao, &s[3]);
 302         printf("parsed: %s\n", dd.buf);
 303         dstr_destroy(&dd);
 304       }
 305 #endif
 306
 307       if (!(fl & F_ESTAB)) continue;
 308
 309       for (i = 0; i < 4; i++)
 310         if (sockeq(q->ao, &s[i], &q->s[L])) goto found_local;
 311       continue;
 312       putchar('.');
 313     found_local:
 314       if (!sockeq(q->ao, &s[i^1], &s[i^2]) ||
 315           !sockeq(q->ao, &s[i^1], &q->s[R]))
 316         continue;
 317       q->resp = R_NAT;
 318       q->u.nat = s[i^3];
 319       goto done;
 320     }
 321
 322     if (ferror(fp)) {
 323       logmsg(q, LOG_ERR, "failed to read `/proc/net/ip_conntrack': %s",
 324              strerror(errno));
 325       goto err_unk;
 326     }
 327     logmsg(q, LOG_ERR, "connection not found");
 328   }
 329
 330 #undef NEXTFIELD
 331
 332 err_nouser:
 333   q->resp = R_ERROR;
 334   q->u.error = E_NOUSER;
 335   goto done;
 336 err_unk:
 337   q->resp = R_ERROR;
 338   q->u.error = E_UNKNOWN;
 339 done:
 340   dstr_destroy(&d);
 341   if (fp) fclose(fp);
 342 }
 343
 344 /*----- That's all, folks -------------------------------------------------*/