linux.c: Detect hall-of-mirrors effect in `nf_conntrack'.

[yaid] / linux.c

diff --git a/linux.c b/linux.c
index 25fcb6c..ec4fe4e 100644 (file)
--- a/linux.c
+++ b/linux.c
@@ -34,6 +34,22 @@
 /*----- Static variables --------------------------------------------------*/
 
 static FILE *natfp;                    /* File handle for NAT table */
+static int randfd;                     /* File descriptor for random data */
+
+/*----- Miscellaneous system services -------------------------------------*/
+
+/* Fill the buffer at P with SZ random bytes.  The buffer will be moderately
+ * large: this is intended to be a low-level interface, not a general-purpose
+ * utility.
+ */
+void fill_random(void *p, size_t sz)
+{
+  ssize_t n;
+
+  n = read(randfd, p, sz);
+  if (n < 0) fatal("error reading `/dev/urandom': %s", strerror(errno));
+  else if (n < sz) fatal("unexpected short read from `/dev/urandom'");
+}
 
 /*----- Address-type operations -------------------------------------------*/
 
@@ -102,7 +118,7 @@ static int get_default_gw(int af, union addr *a)
 
   /* Open a netlink socket for interrogating the kernel. */
   if ((fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE)) < 0)
-    die(1, "failed to create netlink socket: %s", strerror(errno));
+    fatal("failed to create netlink socket: %s", strerror(errno));
 
   /* We want to read the routing table.  There doesn't seem to be a good way
    * to do this without just crawling through the whole thing.
@@ -119,14 +135,14 @@ static int get_default_gw(int af, union addr *a)
   rtgen->rtgen_family = af;
 
   if (write(fd, nlmsg, nlmsg->nlmsg_len) < 0)
-    die(1, "failed to send RTM_GETROUTE request: %s", strerror(errno));
+    fatal("failed to send RTM_GETROUTE request: %s", strerror(errno));
 
   /* Now we try to parse the answer. */
   for (;;) {
 
     /* Not finished yet, so read another chunk of answer. */
     if ((n = read(fd, buf, sizeof(buf))) < 0)
-      die(1, "failed to read RTM_GETROUTE response: %s", strerror(errno));
+      fatal("failed to read RTM_GETROUTE response: %s", strerror(errno));
 
     /* Start at the beginning of the response. */
     nlmsg = (struct nlmsghdr *)buf;
@@ -297,7 +313,8 @@ void identify(struct query *q)
        * field (but do check the port number).
        */
       if (q->ao->sys->parseaddr(&p, &s[i].addr)) goto next_row;
-      if (*p != ':') break; p++;
+      if (*p != ':') break;
+      p++;
       s[i].port = strtoul(p, 0, 16);
       if ((i == R && gwp) ?
            q->s[R].port != s[i].port :
@@ -417,6 +434,13 @@ void identify(struct query *q)
          !sockeq(q->ao, &s[i^1], &q->s[R]))
        continue;
 
+      /* As a trap for the unwary, this file contains unhelpful entries which
+       * just mirror the source/destination addresses.  If this is one of
+       * those, we'll be stuck in a cycle talking to ourselves.
+       */
+      if (sockeq(q->ao, &s[i], &s[i^3]))
+       continue;
+
       /* We win.  The remaining address must be the client host.  We should
        * proxy this query.
        */
@@ -457,11 +481,18 @@ done:
 /* Initialize the system-specific code. */
 void init_sys(void)
 {
+  /* Open the NAT connection map. */
   if ((natfp = fopen("/proc/net/nf_conntrack", "r")) == 0 &&
       errno != ENOENT) {
     die(1, "failed to open `/proc/net/nf_conntrack' for reading: %s",
        strerror(errno));
   }
+
+  /* Open the random data source. */
+  if ((randfd = open("/dev/urandom", O_RDONLY)) < 0) {
+    die(1, "failed to open `/dev/urandom' for reading: %s",
+       strerror(errno));
+  }
 }
 
 /*----- That's all, folks -------------------------------------------------*/