#include "yaid.h"
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+
/*----- Static variables --------------------------------------------------*/
+static FILE *natfp; /* File handle for NAT table */
+static int randfd; /* File descriptor for random data */
+
+/*----- Miscellaneous system services -------------------------------------*/
+
+/* Fill the buffer at P with SZ random bytes. The buffer will be moderately
+ * large: this is intended to be a low-level interface, not a general-purpose
+ * utility.
+ */
+void fill_random(void *p, size_t sz)
+{
+ ssize_t n;
+
+ n = read(randfd, p, sz);
+ if (n < 0) fatal("error reading `/dev/urandom': %s", strerror(errno));
+ else if (n < sz) fatal("unexpected short read from `/dev/urandom'");
+}
+
+/*----- Address-type operations -------------------------------------------*/
+
struct addrops_sys {
const char *procfile;
+ const char *nfl3name;
int (*parseaddr)(char **, union addr *);
};
+#define PROCFILE_IPV4 "/proc/net/tcp"
+#define NFL3NAME_IPV4 "ipv4"
+
static int parseaddr_ipv4(char **pp, union addr *a)
{ a->ipv4.s_addr = strtoul(*pp, pp, 16); return (0); }
-const struct addrops_sys addrops_sys_ipv4 = {
- "/proc/net/tcp", parseaddr_ipv4
-};
+#define PROCFILE_IPV6 "/proc/net/tcp6"
+#define NFL3NAME_IPV6 "ipv6"
static int parseaddr_ipv6(char **pp, union addr *a)
{
char *p = *pp;
unsigned x;
+ /* The format is byteswapped in a really annoying way. */
for (i = 0; i < 4; i++) {
y = 0;
for (j = 0; j < 8; j++) {
if ('0' <= *p && *p <= '9') x = *p - '0';
- else if ('a' <= *p && *p <= 'f') x = *p - 'a'+ 10;
- else if ('A' <= *p && *p <= 'F') x = *p - 'A'+ 10;
+ else if ('a' <= *p && *p <= 'f') x = *p - 'a' + 10;
+ else if ('A' <= *p && *p <= 'F') x = *p - 'A' + 10;
else return (-1);
y = (y << 4) | x;
p++;
return (0);
}
-const struct addrops_sys addrops_sys_ipv6 = {
- "/proc/net/tcp6", parseaddr_ipv6
-};
+#define DEFOPSYS(ty, TY) \
+ const struct addrops_sys addrops_sys_##ty = { \
+ PROCFILE_##TY, NFL3NAME_##TY, parseaddr_##ty \
+ };
+ADDRTYPES(DEFOPSYS)
+#undef DEFOPSYS
/*----- Main code ---------------------------------------------------------*/
-int get_default_gw(int af, union addr *a)
+/* Store in A the default gateway address for the given address family.
+ * Return zero on success, or nonzero on error.
+ */
+static int get_default_gw(int af, union addr *a)
{
int fd;
char buf[32768];
const struct rtattr *rta;
const struct rtmsg *rtm;
ssize_t n, nn;
- int rc = 0;
+ int rc = -1;
static unsigned long seq = 0x48b4aec4;
+ /* Open a netlink socket for interrogating the kernel. */
if ((fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE)) < 0)
- die(1, "failed to create netlink socket: %s", strerror(errno));
+ fatal("failed to create netlink socket: %s", strerror(errno));
+ /* We want to read the routing table. There doesn't seem to be a good way
+ * to do this without just crawling through the whole thing.
+ */
nlmsg = (struct nlmsghdr *)buf;
assert(NLMSG_SPACE(sizeof(*rtgen)) < sizeof(buf));
nlmsg->nlmsg_len = NLMSG_LENGTH(sizeof(*rtgen));
rtgen->rtgen_family = af;
if (write(fd, nlmsg, nlmsg->nlmsg_len) < 0)
- die(1, "failed to send RTM_GETROUTE request: %s", strerror(errno));
+ fatal("failed to send RTM_GETROUTE request: %s", strerror(errno));
+ /* Now we try to parse the answer. */
for (;;) {
+
+ /* Not finished yet, so read another chunk of answer. */
if ((n = read(fd, buf, sizeof(buf))) < 0)
- die(1, "failed to read RTM_GETROUTE response: %s", strerror(errno));
+ fatal("failed to read RTM_GETROUTE response: %s", strerror(errno));
+
+ /* Start at the beginning of the response. */
nlmsg = (struct nlmsghdr *)buf;
+
+ /* Make sure this looks plausible. The precise rules don't appear to be
+ * documented, so it seems advisable to fail messily if my understanding
+ * is wrong.
+ */
if (nlmsg->nlmsg_seq != seq) continue;
assert(nlmsg->nlmsg_flags & NLM_F_MULTI);
+ /* Work through all of the individual routes. */
for (; NLMSG_OK(nlmsg, n); nlmsg = NLMSG_NEXT(nlmsg, n)) {
if (nlmsg->nlmsg_type == NLMSG_DONE) goto done;
if (nlmsg->nlmsg_type != RTM_NEWROUTE) continue;
rtm = (const struct rtmsg *)NLMSG_DATA(nlmsg);
- if (rtm->rtm_family != af ||
- rtm->rtm_dst_len > 0 ||
- rtm->rtm_src_len > 0 ||
- rtm->rtm_type != RTN_UNICAST ||
- rtm->rtm_scope != RT_SCOPE_UNIVERSE ||
- rtm->rtm_tos != 0)
+ /* If this record doesn't look interesting then skip it. */
+ if (rtm->rtm_family != af || /* wrong address family */
+ rtm->rtm_dst_len > 0 || /* specific destination */
+ rtm->rtm_src_len > 0 || /* specific source */
+ rtm->rtm_type != RTN_UNICAST || /* not for unicast */
+ rtm->rtm_scope != RT_SCOPE_UNIVERSE || /* wrong scope */
+ rtm->rtm_tos != 0) /* specific type of service */
continue;
+ /* Trundle through the attributes and find the gateway address. */
for (rta = RTM_RTA(rtm), nn = RTM_PAYLOAD(nlmsg);
RTA_OK(rta, nn); rta = RTA_NEXT(rta, nn)) {
+
+ /* Got one. We're all done. Except that we should carry on reading
+ * to the end, or something bad will happen.
+ */
if (rta->rta_type == RTA_GATEWAY) {
assert(RTA_PAYLOAD(rta) <= sizeof(*a));
memcpy(a, RTA_DATA(rta), RTA_PAYLOAD(rta));
- rc = 1;
+ rc = 0;
}
}
}
return (rc);
}
-void identify(struct query *q)
+/* Initially, PP points into a string containing whitespace-separated fields.
+ * Point P to the next field, null-terminate it, and advance PP so that we
+ * can read the next field in the next call.
+ */
+#define NEXTFIELD do { \
+ for (p = pp; isspace((unsigned char)*p); p++); \
+ for (pp = p; *pp && !isspace((unsigned char)*pp); pp++); \
+ if (*pp) *pp++ = 0; \
+} while (0)
+
+/* Search the `tcp' connection table for the address family AO, looking for a
+ * connection between the addresses in QS. GWP is nonzero if the query's
+ * remote address is our gateway and we shouldn't expect the remote address
+ * in the system table to actually match it because of NAT. Return nonzero
+ * if we have filled in Q conclusively; return zero if the caller should try
+ * a different approach.
+ */
+static int search_tcp_file(struct query *q, int gwp,
+ const struct addrops *ao,
+ struct socket qs[NDIR])
{
FILE *fp = 0;
dstr d = DSTR_INIT;
char *p, *pp;
- struct socket s[4];
+ struct socket s[NDIR];
int i;
- int gwp = 0;
- unsigned fl;
-#define F_SADDR 1u
-#define F_SPORT 2u
-#define F_DADDR 4u
-#define F_DPORT 8u
-#define F_ALL (F_SADDR | F_SPORT | F_DADDR | F_DPORT)
-#define F_ESTAB 16u
uid_t uid;
enum { LOC, REM, ST, UID, NFIELD };
int f, ff[NFIELD];
+ int rc = 1;
- if (get_default_gw(q->ao->af, &s[0].addr) &&
- q->ao->addreq(&s[0].addr, &q->s[R].addr))
- gwp = 1;
-
- if ((fp = fopen(q->ao->sys->procfile, "r")) == 0) {
+ /* Open the relevant TCP connection table. */
+ if ((fp = fopen(ao->sys->procfile, "r")) == 0) {
logmsg(q, LOG_ERR, "failed to open `%s' for reading: %s",
- q->ao->sys->procfile, strerror(errno));
+ ao->sys->procfile, strerror(errno));
goto err_unk;
}
-#define NEXTFIELD do { \
- for (p = pp; isspace((unsigned char)*p); p++); \
- for (pp = p; *pp && !isspace((unsigned char)*pp); pp++); \
- if (*pp) *pp++ = 0; \
-} while (0)
-
+ /* Read the header line from the file. */
if (dstr_putline(&d, fp) == EOF) {
logmsg(q, LOG_ERR, "failed to read header line from `%s': %s",
- q->ao->sys->procfile,
+ ao->sys->procfile,
ferror(fp) ? strerror(errno) : "unexpected EOF");
goto err_unk;
}
+ /* Now scan the header line to identify which columns the various
+ * interesting fields are in. Store these in the map `ff'. Problems:
+ * `tx_queue rx_queue' and `tr tm->when' are both really single columns in
+ * disguise; and the remote address column has a different heading
+ * depending on which address family we're using. Rather than dispatch,
+ * just recognize both of them.
+ */
for (i = 0; i < NFIELD; i++) ff[i] = -1;
pp = d.buf;
for (f = 0;; f++) {
strcmp(p, "tm->when") == 0)
f--;
}
+
+ /* Make sure that we found all of the fields we actually want. */
for (i = 0; i < NFIELD; i++) {
if (ff[i] < 0) {
logmsg(q, LOG_ERR, "failed to find required fields in `%s'",
- q->ao->sys->procfile);
+ ao->sys->procfile);
goto err_unk;
}
}
+ /* Work through the lines in the file. */
for (;;) {
+
+ /* Read a line, and prepare to scan the fields. */
DRESET(&d);
if (dstr_putline(&d, fp) == EOF) break;
pp = d.buf;
uid = -1;
+
+ /* Work through the fields. If an address field fails to match then we
+ * skip this record. If the state field isn't 1 (`ESTABLISHED') then
+ * skip the record. If it's the UID, then remember it: if we get all the
+ * way to the end then we've won.
+ */
for (f = 0;; f++) {
NEXTFIELD; if (!*p) break;
if (f == ff[LOC]) { i = L; goto compare; }
continue;
compare:
- if (q->ao->sys->parseaddr(&p, &s[0].addr)) goto next_row;
- if (*p != ':') break; p++;
- s[0].port = strtoul(p, 0, 16);
- if (!sockeq(q->ao, &q->s[i], &s[0]) &&
- (i != R || !gwp || q->s[R].port != s[0].port))
+ /* Compare an address (in the current field) with the local or remote
+ * address in the query, as indicated by `i'. The address field looks
+ * like `ADDR:PORT', where the ADDR is in some mad format which
+ * `sys->parseaddr' knows how to unpick. If the remote address in the
+ * query is our gateway then don't check the remote address in the
+ * field (but do check the port number).
+ */
+ if (ao->sys->parseaddr(&p, &s[i].addr)) goto next_row;
+ if (*p != ':') break;
+ p++;
+ s[i].port = strtoul(p, 0, 16);
+ if ((i == R && gwp) ?
+ qs[R].port != s[i].port :
+ !sockeq(ao, &qs[i], &s[i]))
goto next_row;
}
+
+ /* We got to the end, and everything matched. If we found a UID then
+ * we're done. If the apparent remote address is our gateway then copy
+ * the true one into the query structure.
+ */
if (uid != -1) {
q->resp = R_UID;
q->u.uid = uid;
+ if (gwp) qs[R].addr = s[i].addr;
goto done;
}
next_row:;
}
+ /* We got to the end of the file and didn't find anything. */
if (ferror(fp)) {
- logmsg(q, LOG_ERR, "failed to read connection table: %s",
- strerror(errno));
+ logmsg(q, LOG_ERR, "failed to read connection table `%s': %s",
+ ao->sys->procfile, strerror(errno));
goto err_unk;
}
+ rc = 0;
+
+err_unk:
+ /* Something went wrong and the protocol can't express what. We should
+ * have logged what the problem actually was.
+ */
+ q->resp = R_ERROR;
+ q->u.error = E_UNKNOWN;
+done:
+ /* All done. */
+ dstr_destroy(&d);
+ if (fp) fclose(fp);
+ return (rc);
+}
+
+/* Convert the IPv4 socket address IN into the equivalent IPv4-mapped IPv6
+ * address OUT.
+ */
+static void map_v4(struct socket *out, const struct socket *in)
+{
+ unsigned i;
+ in_addr_t a4 = ntohl(in->addr.ipv4.s_addr);
+
+ for (i = 0; i < 10; i++) out->addr.ipv6.s6_addr[i] = 0;
+ for (i = 10; i < 12; i++) out->addr.ipv6.s6_addr[i] = 0xff;
+ for (i = 0; i < 4; i++) out->addr.ipv6.s6_addr[15 - i] = (a4 >> 8*i)&0xff;
+ out->port = in->port;
+}
+
+/* Convert the IPv4-mapped IPv6 socket address IN into the equivalent IPv4
+ * address OUT; return -1 if the IN address isn't actually IPv4-mapped.
+ */
+static int unmap_v4(struct socket *out, const struct socket *in)
+{
+ unsigned i;
+ in_addr_t a4 = 0;
+
+ for (i = 0; i < 10; i++) if (in->addr.ipv6.s6_addr[i] != 0) return (-1);
+ for (i = 10; i < 12; i++) if (in->addr.ipv6.s6_addr[i] != 0xff) return (-1);
+ for (i = 0; i < 4; i++) a4 |= in->addr.ipv6.s6_addr[15 - i] << 8*i;
+ out->addr.ipv4.s_addr = htonl(a4);
+ out->port = in->port;
+ return (0);
+}
+
+/* Find out who is responsible for the connection described in the query Q.
+ * Write the answer to Q. Errors are logged and reported via the query
+ * structure.
+ */
+void identify(struct query *q)
+{
+ FILE *fp = 0;
+ dstr d = DSTR_INIT;
+ char *p, *pp;
+ struct socket s[4];
+ int i;
+ int gwp = 0;
+ unsigned fl;
+#define F_SADDR 1u
+#define F_SPORT 2u
+#define F_DADDR 4u
+#define F_DPORT 8u
+#define F_ALL (F_SADDR | F_SPORT | F_DADDR | F_DPORT)
+#define F_ESTAB 16u
+
+ /* If we have a default gateway, and it matches the remote address then
+ * this may be a proxy connection from our NAT, so remember this, and don't
+ * inspect the remote addresses in the TCP tables.
+ */
+ if (!get_default_gw(q->ao->af, &s[0].addr) &&
+ q->ao->addreq(&s[0].addr, &q->s[R].addr))
+ gwp = 1;
+
+ /* Search the main `tcp' table. */
+ if (search_tcp_file(q, gwp, q->ao, q->s)) goto done;
+
+ /* Oh, dear. If this is IPv4, then the entry might actually be in the IPv6
+ * table, with weird addresses. So we must try again.
+ */
if (q->ao->af == AF_INET) {
- fclose(fp);
- if ((fp = fopen("/proc/net/ip_conntrack", "r")) == 0) {
- if (errno == ENOENT)
- goto err_nouser;
- else {
- logmsg(q, LOG_ERR,
- "failed to open `/proc/net/ip_conntrack' for reading: %s",
- strerror(errno));
+ map_v4(&s[L], &q->s[L]); map_v4(&s[R], &q->s[R]);
+ if (search_tcp_file(q, gwp, &addroptab[ADDR_IPV6], s)) {
+ if (gwp && unmap_v4(&q->s[R], &s[R])) {
+ logmsg(q, LOG_ERR, "can't unmap NATted destination address");
goto err_unk;
}
+ goto done;
}
+ }
+
+ /* If we opened the NAT table file, and we're using IPv4, then check to see
+ * whether we should proxy the connection. At least the addresses in this
+ * file aren't crazy.
+ */
+ if (natfp) {
+
+ /* Start again from the beginning. */
+ rewind(natfp);
+ /* Read a line at a time. */
for (;;) {
+
+ /* Read the line. */
DRESET(&d);
- if (dstr_putline(&d, fp) == EOF) break;
+ if (dstr_putline(&d, natfp) == EOF) break;
pp = d.buf;
+
+ /* Check that this is for the right protocol. */
+ NEXTFIELD; if (!*p) break;
+ if (strcmp(p, q->ao->sys->nfl3name)) continue;
+ NEXTFIELD; if (!*p) break;
NEXTFIELD; if (!*p) break;
if (strcmp(p, "tcp") != 0) continue;
+
+ /* Parse the other fields. Each line has two src/dst pairs, for the
+ * outgoing and incoming directions. Depending on exactly what kind of
+ * NAT is in use, either the outgoing source or the incoming
+ * destination might be the client we're after. Collect all of the
+ * addresses and sort out the mess later.
+ */
i = 0;
fl = 0;
for (;;) {
if (strcmp(p, "ESTABLISHED") == 0)
fl |= F_ESTAB;
else if (strncmp(p, "src=", 4) == 0) {
- inet_pton(AF_INET, p + 4, &s[i].addr);
+ inet_pton(q->ao->af, p + 4, &s[i].addr);
fl |= F_SADDR;
} else if (strncmp(p, "dst=", 4) == 0) {
- inet_pton(AF_INET, p + 4, &s[i + 1].addr);
+ inet_pton(q->ao->af, p + 4, &s[i + 1].addr);
fl |= F_DADDR;
} else if (strncmp(p, "sport=", 6) == 0) {
s[i].port = atoi(p + 6);
}
}
-#ifdef notdef
+#ifdef DEBUG
{
+ /* Print the record we found. */
dstr dd = DSTR_INIT;
dstr_putf(&dd, "%sestab ", (fl & F_ESTAB) ? " " : "!");
dputsock(&dd, q->ao, &s[0]);
}
#endif
+ /* If the connection isn't ESTABLISHED then skip it. */
if (!(fl & F_ESTAB)) continue;
+ /* Now we try to piece together what's going on. One of these
+ * addresses will be us. So let's just try to find it.
+ */
for (i = 0; i < 4; i++)
if (sockeq(q->ao, &s[i], &q->s[L])) goto found_local;
continue;
- putchar('.');
+
found_local:
+ /* So address `i' is us. In that case, we expect the other address in
+ * the same direction, and the same address in the opposite direction,
+ * to match each other and be the remote address in the query.
+ */
if (!sockeq(q->ao, &s[i^1], &s[i^2]) ||
!sockeq(q->ao, &s[i^1], &q->s[R]))
continue;
+
+ /* As a trap for the unwary, this file contains unhelpful entries which
+ * just mirror the source/destination addresses. If this is one of
+ * those, we'll be stuck in a cycle talking to ourselves.
+ */
+ if (sockeq(q->ao, &s[i], &s[i^3]))
+ continue;
+
+ /* We win. The remaining address must be the client host. We should
+ * proxy this query.
+ */
q->resp = R_NAT;
q->u.nat = s[i^3];
goto done;
}
- if (ferror(fp)) {
- logmsg(q, LOG_ERR, "failed to read `/proc/net/ip_conntrack': %s",
+ /* Reached the end of the NAT file. */
+ if (ferror(natfp)) {
+ logmsg(q, LOG_ERR, "failed to read `/proc/net/nf_conntrack': %s",
strerror(errno));
goto err_unk;
}
- logmsg(q, LOG_ERR, "connection not found");
}
-#undef NEXTFIELD
-
-err_nouser:
+ /* We didn't find a match anywhere. How unfortunate. */
+ logmsg(q, LOG_NOTICE, "connection not found");
q->resp = R_ERROR;
q->u.error = E_NOUSER;
goto done;
+
err_unk:
+ /* Something went wrong and the protocol can't express what. We should
+ * have logged what the problem actually was.
+ */
q->resp = R_ERROR;
q->u.error = E_UNKNOWN;
+
done:
+ /* All done. */
dstr_destroy(&d);
if (fp) fclose(fp);
}
+#undef NEXTFIELD
+
+/* Initialize the system-specific code. */
+void init_sys(void)
+{
+ /* Open the NAT connection map. */
+ if ((natfp = fopen("/proc/net/nf_conntrack", "r")) == 0 &&
+ errno != ENOENT) {
+ die(1, "failed to open `/proc/net/nf_conntrack' for reading: %s",
+ strerror(errno));
+ }
+
+ /* Open the random data source. */
+ if ((randfd = open("/dev/urandom", O_RDONLY)) < 0) {
+ die(1, "failed to open `/dev/urandom' for reading: %s",
+ strerror(errno));
+ }
+}
+
/*----- That's all, folks -------------------------------------------------*/
~mdw / yaid / blobdiff