3 * Discover the owner of a connection
5 * (c) 2012 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Yet Another Ident Daemon (YAID).
12 * YAID is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * YAID is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with YAID; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 /*----- Header files ------------------------------------------------------*/
31 /*----- Static variables --------------------------------------------------*/
33 const char *const errtok
[] = {
34 #define DEFTOK(err, tok) tok,
39 static int parseaddr4(char **pp
, union addr
*a
)
40 { a
->ipv4
.s_addr
= strtoul(*pp
, pp
, 16); return (0); }
42 static int addreq4(const union addr
*a
, const union addr
*aa
)
43 { return a
->ipv4
.s_addr
== aa
->ipv4
.s_addr
; }
45 static int parseaddr6(char **pp
, union addr
*a
)
52 for (i
= 0; i
< 4; i
++) {
54 for (j
= 0; j
< 8; j
++) {
55 if ('0' <= *p
&& *p
<= '9') x
= *p
- '0';
56 else if ('a' <= *p
&& *p
<= 'f') x
= *p
- 'a'+ 10;
57 else if ('A' <= *p
&& *p
<= 'F') x
= *p
- 'A'+ 10;
62 a
->ipv6
.s6_addr32
[i
] = y
;
68 static int addreq6(const union addr
*a
, const union addr
*b
)
69 { return !memcmp(a
->ipv6
.s6_addr
, b
->ipv6
.s6_addr
, 16); }
71 static const struct addrfamily
{
74 int (*parseaddr
)(char **pp
, union addr
*a
);
75 int (*addreq
)(const union addr
*a
, const union addr
*aa
);
77 { AF_INET
, "/proc/net/tcp", parseaddr4
, addreq4
},
78 { AF_INET6
, "/proc/net/tcp6", parseaddr6
, addreq6
},
82 /*----- Main code ---------------------------------------------------------*/
84 static int sockeq(const struct addrfamily
*af
,
85 const struct socket
*sa
, const struct socket
*sb
)
86 { return (af
->addreq(&sa
->addr
, &sb
->addr
) && sa
->port
== sb
->port
); }
88 int get_default_gw(int af
, union addr
*a
)
92 struct nlmsghdr
*nlmsg
;
93 struct rtgenmsg
*rtgen
;
94 const struct rtattr
*rta
;
95 const struct rtmsg
*rtm
;
98 static unsigned long seq
= 0x48b4aec4;
100 if ((fd
= socket(AF_NETLINK
, SOCK_DGRAM
, NETLINK_ROUTE
)) < 0)
101 die(1, "failed to create netlink socket: %s", strerror(errno
));
103 nlmsg
= (struct nlmsghdr
*)buf
;
104 assert(NLMSG_SPACE(sizeof(*rtgen
)) < sizeof(buf
));
105 nlmsg
->nlmsg_len
= NLMSG_LENGTH(sizeof(*rtgen
));
106 nlmsg
->nlmsg_type
= RTM_GETROUTE
;
107 nlmsg
->nlmsg_flags
= NLM_F_REQUEST
| NLM_F_ROOT
;
108 nlmsg
->nlmsg_seq
= ++seq
;
109 nlmsg
->nlmsg_pid
= 0;
111 rtgen
= (struct rtgenmsg
*)NLMSG_DATA(nlmsg
);
112 rtgen
->rtgen_family
= af
;
114 if (write(fd
, nlmsg
, nlmsg
->nlmsg_len
) < 0)
115 die(1, "failed to send RTM_GETROUTE request: %s", strerror(errno
));
118 if ((n
= read(fd
, buf
, sizeof(buf
))) < 0)
119 die(1, "failed to read RTM_GETROUTE response: %s", strerror(errno
));
120 nlmsg
= (struct nlmsghdr
*)buf
;
121 if (nlmsg
->nlmsg_seq
!= seq
) continue;
122 assert(nlmsg
->nlmsg_flags
& NLM_F_MULTI
);
124 for (; NLMSG_OK(nlmsg
, n
); nlmsg
= NLMSG_NEXT(nlmsg
, n
)) {
125 if (nlmsg
->nlmsg_type
== NLMSG_DONE
) goto done
;
126 if (nlmsg
->nlmsg_type
!= RTM_NEWROUTE
) continue;
127 rtm
= (const struct rtmsg
*)NLMSG_DATA(nlmsg
);
129 if (rtm
->rtm_family
!= af
||
130 rtm
->rtm_dst_len
> 0 ||
131 rtm
->rtm_src_len
> 0 ||
132 rtm
->rtm_type
!= RTN_UNICAST
||
133 rtm
->rtm_scope
!= RT_SCOPE_UNIVERSE
||
137 for (rta
= RTM_RTA(rtm
), nn
= RTM_PAYLOAD(nlmsg
);
138 RTA_OK(rta
, nn
); rta
= RTA_NEXT(rta
, nn
)) {
139 if (rta
->rta_type
== RTA_GATEWAY
) {
140 assert(RTA_PAYLOAD(rta
) <= sizeof(*a
));
141 memcpy(a
, RTA_DATA(rta
), RTA_PAYLOAD(rta
));
153 void identify(struct query
*q
)
155 const struct addrfamily
*af
;
167 #define F_ALL (F_SADDR | F_SPORT | F_DADDR | F_DPORT)
170 enum { LOC
, REM
, ST
, UID
, NFIELD
};
173 for (af
= addrfamilytab
; af
->af
>= 0; af
++)
174 if (af
->af
== q
->af
) goto found_af
;
175 logmsg(q
, LOG_ERR
, "unexpected address family `%d'", q
->af
);
179 if (get_default_gw(q
->af
, &s
[0].addr
) &&
180 af
->addreq(&s
[0].addr
, &q
->s
[R
].addr
))
183 if ((fp
= fopen(af
->procfile
, "r")) == 0) {
184 logmsg(q
, LOG_ERR
, "failed to open `%s' for reading: %s",
185 af
->procfile
, strerror(errno
));
189 #define NEXTFIELD do { \
190 for (p = pp; isspace((unsigned char)*p); p++); \
191 for (pp = p; *pp && !isspace((unsigned char)*pp); pp++); \
192 if (*pp) *pp++ = 0; \
195 if (dstr_putline(&d
, fp
) == EOF
) {
196 logmsg(q
, LOG_ERR
, "failed to read header line from `%s': %s",
197 af
->procfile
, ferror(fp
) ?
strerror(errno
) : "unexpected EOF");
201 for (i
= 0; i
< NFIELD
; i
++) ff
[i
] = -1;
204 NEXTFIELD
; if (!*p
) break;
205 if (strcmp(p
, "local_address") == 0)
207 else if (strcmp(p
, "rem_address") == 0 ||
208 strcmp(p
, "remote_address") == 0)
210 else if (strcmp(p
, "uid") == 0)
212 else if (strcmp(p
, "st") == 0)
214 else if (strcmp(p
, "rx_queue") == 0 ||
215 strcmp(p
, "tm->when") == 0)
218 for (i
= 0; i
< NFIELD
; i
++) {
220 logmsg(q
, LOG_ERR
, "failed to find required fields in `%s'",
228 if (dstr_putline(&d
, fp
) == EOF
) break;
232 NEXTFIELD
; if (!*p
) break;
233 if (f
== ff
[LOC
]) { i
= L
; goto compare
; }
234 else if (f
== ff
[REM
]) { i
= R
; goto compare
; }
235 else if (f
== ff
[UID
]) uid
= atoi(p
);
236 else if (f
== ff
[ST
]) {
237 if (strtol(p
, 0, 16) != 1) goto next_row
;
242 if (af
->parseaddr(&p
, &s
[0].addr
)) goto next_row
;
243 if (*p
!= ':') break; p
++;
244 s
[0].port
= strtoul(p
, 0, 16);
245 if (!sockeq(af
, &q
->s
[i
], &s
[0]) &&
246 (i
!= R
|| !gwp
|| q
->s
[R
].port
!= s
[0].port
))
258 logmsg(q
, LOG_ERR
, "failed to read connection table: %s",
263 if (q
->af
== AF_INET
) {
265 if ((fp
= fopen("/proc/net/ip_conntrack", "r")) == 0) {
270 "failed to open `/proc/net/ip_conntrack' for reading: %s",
278 if (dstr_putline(&d
, fp
) == EOF
) break;
280 NEXTFIELD
; if (!*p
) break;
281 if (strcmp(p
, "tcp") != 0) continue;
285 NEXTFIELD
; if (!*p
) break;
286 if (strcmp(p
, "ESTABLISHED") == 0)
288 else if (strncmp(p
, "src=", 4) == 0) {
289 inet_pton(AF_INET
, p
+ 4, &s
[i
].addr
);
291 } else if (strncmp(p
, "dst=", 4) == 0) {
292 inet_pton(AF_INET
, p
+ 4, &s
[i
+ 1].addr
);
294 } else if (strncmp(p
, "sport=", 6) == 0) {
295 s
[i
].port
= atoi(p
+ 6);
297 } else if (strncmp(p
, "dport=", 6) == 0) {
298 s
[i
+ 1].port
= atoi(p
+ 6);
301 if ((fl
& F_ALL
) == F_ALL
) {
311 dstr_putf(&dd
, "%sestab ", (fl
& F_ESTAB
) ?
" " : "!");
312 dputsock(&dd
, af
->af
, &s
[0]);
313 dstr_puts(&dd
, "<->");
314 dputsock(&dd
, af
->af
, &s
[1]);
315 dstr_puts(&dd
, " | ");
316 dputsock(&dd
, af
->af
, &s
[2]);
317 dstr_puts(&dd
, "<->");
318 dputsock(&dd
, af
->af
, &s
[3]);
319 printf("parsed: %s\n", dd
.buf
);
324 if (!(fl
& F_ESTAB
)) continue;
326 for (i
= 0; i
< 4; i
++)
327 if (sockeq(af
, &s
[i
], &q
->s
[L
])) goto found_local
;
331 if (!sockeq(af
, &s
[i
^1], &s
[i
^2]) ||
332 !sockeq(af
, &s
[i
^1], &q
->s
[R
]))
340 logmsg(q
, LOG_ERR
, "failed to read `/proc/net/ip_conntrack': %s",
344 logmsg(q
, LOG_ERR
, "connection not found");
351 q
->u
.error
= E_NOUSER
;
355 q
->u
.error
= E_UNKNOWN
;
360 /*----- That's all, folks -------------------------------------------------*/