Context Navigation

source: trunk/src/sh_port2proc.c@ 296

Last change on this file since 296 was 295, checked in by katerina, 14 years ago
Support for IPv6 (ticket #222).
File size: 27.9 KB

Rev	Line
[180]	1	/* SAMHAIN file system integrity testing */
	2	/* Copyright (C) 2008 Rainer Wichmann */
	3	/* */
	4	/* This program is free software; you can redistribute it */
	5	/* and/or modify */
	6	/* it under the terms of the GNU General Public License as */
	7	/* published by */
	8	/* the Free Software Foundation; either version 2 of the License, or */
	9	/* (at your option) any later version. */
	10	/* */
	11	/* This program is distributed in the hope that it will be useful, */
	12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
	13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
	14	/* GNU General Public License for more details. */
	15	/* */
	16	/* You should have received a copy of the GNU General Public License */
	17	/* along with this program; if not, write to the Free Software */
	18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
	19
	20	#include "config_xor.h"
	21
	22	#include <stdio.h>
	23	#include <stdlib.h>
	24	#include <string.h>
	25	#include <sys/types.h>
[290]	26	#include <netinet/in.h>
	27	#include <arpa/inet.h>
[180]	28	#include <unistd.h>
	29
	30	#ifdef HAVE_DIRENT_H
	31	#include <dirent.h>
	32	#define NAMLEN(dirent) sl_strlen((dirent)->d_name)
	33	#else
	34	#define dirent direct
	35	#define NAMLEN(dirent) (dirent)->d_namlen
	36	#ifdef HAVE_SYS_NDIR_H
	37	#include <sys/ndir.h>
	38	#endif
	39	#ifdef HAVE_SYS_DIR_H
	40	#include <sys/dir.h>
	41	#endif
	42	#ifdef HAVE_NDIR_H
	43	#include <ndir.h>
	44	#endif
	45	#endif
	46	#define NEED_ADD_DIRENT
	47
	48	#if defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE))
	49
[251]	50	/* #define DEBUG_P2P 1 */
	51
[290]	52	#include "samhain.h"
	53	#include "sh_utils.h"
	54
[193]	55	/****************************************************************************
	56	*
	57	* >>> COMMON CODE <<<
	58	*
	59	****************************************************************************/
	60	#if defined(__linux__) \|\| defined(__FreeBSD__)
[180]	61
	62	#include "sh_error_min.h"
	63	#include "sh_pthread.h"
[295]	64	#include "sh_ipvx.h"
[180]	65
	66	#define FIL__ _("sh_port2proc.c")
	67
	68	struct sock_store {
	69	unsigned long sock;
	70	size_t pid;
	71	char * path;
	72	char * user;
	73	struct sock_store * next;
	74	};
	75
	76	/* /proc:
	77	* linux: /proc/pid/exe
	78	* freebsd: /proc/pid/file
	79	* solaris10: /proc/pid/path/a.out
	80	*/
	81	static void get_user_and_path (struct sock_store * add)
	82	{
	83	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
	84
	85	char path[128];
	86	char * buf;
	87	struct stat sbuf;
	88	int len;
	89	char * tmp;
	90
	91	sl_snprintf (path, sizeof(path), "/proc/%ld/exe", (unsigned long) add->pid);
	92
	93	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
	94	{
	95	goto linkread;
	96	}
	97
	98	sl_snprintf (path, sizeof(path), "/proc/%ld/file", (unsigned long) add->pid);
	99
	100	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
	101	{
	102	goto linkread;
	103	}
	104
	105	sl_snprintf (path, sizeof(path), "/proc/%ld/path/a.out", (unsigned long) add->pid);
	106
	107	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
	108	{
	109	goto linkread;
	110	}
	111
	112	return;
	113
	114	linkread:
	115
	116	buf = SH_ALLOC(PATH_MAX);
	117	len = readlink(path, buf, PATH_MAX); /* flawfinder: ignore */
	118	len = (len >= PATH_MAX) ? (PATH_MAX-1) : len;
	119
	120	if (len > 0)
	121	{
	122	buf[len] = '\0';
	123	add->path = buf;
	124	}
	125	else
	126	{
	127	SH_FREE(buf);
	128	}
	129
	130	add->user = SH_ALLOC(USER_MAX);
	131	tmp = sh_unix_getUIDname (SH_ERR_ALL, sbuf.st_uid, add->user, USER_MAX);
	132
	133	if (!tmp)
	134	sl_snprintf (add->user, USER_MAX, "%ld", (unsigned long) sbuf.st_uid);
	135
	136	return;
	137	}
	138
[195]	139	#endif
	140
	141	/****************************************************************************
	142	*
	143	* >>> LINUX CODE <<<
	144	*
	145	****************************************************************************/
	146
[180]	147	#if defined(__linux__)
[195]	148
	149	static size_t sh_minpid = 0x0001;
	150	static size_t sh_maxpid = 0x8000;
	151
	152	#ifndef HAVE_LSTAT
	153	#define lstat(x,y) stat(x,y)
	154	#endif /* HAVE_LSTAT */
	155
	156	#if defined(S_IFLNK) && !defined(S_ISLNK)
	157	# define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
	158	#else
	159	# if !defined(S_ISLNK)
	160	# define S_ISLNK(mode) (0)
	161	# endif
	162	#endif
	163
	164	#if defined(__linux__)
[180]	165	#define PROC_PID_MAX _("/proc/sys/kernel/pid_max")
	166
	167	static int proc_max_pid (size_t * procpid)
	168	{
	169	char * ret;
	170	unsigned long pid;
	171	FILE * fd;
	172	char str[128];
	173	char * ptr;
	174
	175	SL_ENTER(_("proc_max_pid"));
	176
	177	if (0 == access(PROC_PID_MAX, R_OK)) /* flawfinder: ignore */
	178	{
	179	if (NULL != (fd = fopen(PROC_PID_MAX, "r")))
	180	{
	181	str[0] = '\0';
	182	ret = fgets(str, 128, fd);
	183	if (ret && *str != '\0')
	184	{
	185	pid = strtoul(str, &ptr, 0);
	186	if (ptr == '\0' \|\| ptr == '\n')
	187	{
[252]	188	sl_fclose(FIL__, __LINE__, fd);
[180]	189	*procpid = (size_t) pid;
	190	SL_RETURN(0, _("proc_max_pid"));
	191	}
	192	}
[252]	193	sl_fclose(FIL__, __LINE__, fd);
[180]	194	}
	195	}
	196	SL_RETURN((-1), _("proc_max_pid"));
	197	}
	198	#else
	199	static int proc_max_pid(size_t * procpid)
	200	{
	201	*procpid = sh_maxpid;
	202	return 0;
	203	}
	204	#endif
	205
	206	static struct sock_store * socklist = NULL;
	207
	208	static void del_sock_all()
	209	{
	210	struct sock_store * del = socklist;
	211
	212	while (del)
	213	{
	214	socklist = del->next;
	215	if (del->path)
	216	SH_FREE(del->path);
	217	if (del->user)
	218	SH_FREE(del->user);
	219	SH_FREE(del);
	220	del = socklist;
	221	}
	222	socklist = NULL;
	223	return;
	224	}
	225
	226	static void add_sock(unsigned long sock, size_t pid)
	227	{
	228	struct sock_store * add = SH_ALLOC(sizeof(struct sock_store));
	229
	230	add->sock = sock;
	231	add->pid = pid;
	232	add->path = NULL;
	233	add->user = NULL;
	234	SH_MUTEX_LOCK(mutex_thread_nolog);
	235	get_user_and_path(add);
	236	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	237	add->next = socklist;
	238	socklist = add;
	239	return;
	240	}
	241
	242	static void check_and_add_sock(char * fbuf, size_t pid)
	243	{
	244	if (0 == strncmp(_("socket:["), fbuf, 8))
	245	{
	246	char * end;
	247	unsigned long sock;
	248	size_t len = strlen(fbuf);
	249	if (fbuf[len-1] == ']')
	250	fbuf[len-1] = '\0';
	251	sock = strtoul(&fbuf[8], &end, 0);
	252	if (*end == '\0' && fbuf[8] != '\0')
	253	{
	254	add_sock(sock, pid);
	255	}
	256	}
	257	}
	258
	259	static void fetch_socks(size_t pid)
	260	{
	261	char path[128];
	262	DIR * dir;
	263	sl_snprintf(path, sizeof(path), _("/proc/%lu/fd"), (unsigned long) pid);
	264
	265	dir = opendir(path);
	266	if (dir)
	267	{
	268	struct dirent *entry;
	269	while (NULL != (entry = readdir(dir)))
	270	{
	271	char fpath[384];
	272	char fbuf[64];
	273	int ret;
	274	/* /proc/PID/fd/N-> socket:[15713] */
	275	sl_snprintf(fpath, sizeof(fpath), _("%s/%s"), path, entry->d_name);
	276	ret = readlink(fpath, fbuf, sizeof(fbuf)-1); /* flawfinder: ignore */
	277	if (ret > 0)
	278	{
	279	fbuf[ret] = '\0';
	280	check_and_add_sock(fbuf, pid);
	281	}
	282	}
	283	closedir(dir);
	284	}
	285	}
	286
	287	int sh_port2proc_prepare()
	288	{
	289	size_t i;
	290
	291	if (0 != proc_max_pid(&sh_maxpid))
	292	{
	293	SH_MUTEX_LOCK(mutex_thread_nolog);
	294	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	295	_("Failed to detect max_pid"),
	296	_("sh_port2proc"));
	297	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	298	SL_RETURN ((-1), _("sh_port2proc"));
	299	}
	300
	301	/* Delete old socket list and re-create it
	302	*/
	303	del_sock_all();
	304
	305	for (i = sh_minpid; i < sh_maxpid; ++i)
	306	{
	307	fetch_socks(i);
	308	}
	309
	310	return 0;
	311	}
	312
[235]	313	void sh_port2proc_finish()
	314	{
	315	/* Delete old socket list
	316	*/
	317	del_sock_all();
	318	return;
	319	}
	320
	321
[180]	322	#include <sys/socket.h>
	323	#include <netinet/in.h>
	324	#include <arpa/inet.h>
	325
[193]	326	/* returns the command and fills the 'user' array
	327	*/
[295]	328	static char * port2proc_query(char * file, int proto, int domain,
	329	struct sh_sockaddr * saddr, int sport,
[250]	330	unsigned long * pid, char * user, size_t userlen)
[180]	331	{
	332	FILE * fd;
	333
[250]	334	fd = fopen(file, "r");
[180]	335
[206]	336	*pid = 0;
	337
[251]	338	#ifdef DEBUG_P2P
	339	{
	340	char errmsg[256];
[295]	341	char siface[SH_IP_BUF];
	342	sh_ipvx_ntoa(siface, sizeof(siface), saddr);
[251]	343	sl_snprintf(errmsg, sizeof(errmsg),
	344	"query, file=%s, proto=%d, port=%d, iface=%s\n",
[295]	345	file, proto, sport, siface);
[251]	346	fprintf(stderr, "%s", errmsg);
	347	}
	348	#endif
	349
[180]	350	if (fd)
	351	{
[295]	352	unsigned int n, i, port, niface, inode, istatus;
[180]	353	char line[512];
[295]	354	char iface[SH_IP_BUF];
[180]	355
	356	while (NULL != fgets(line, sizeof(line), fd))
	357	{
	358
[251]	359	#ifdef DEBUG_P2P
	360	{
	361	fprintf(stderr, "%s", line);
	362	}
	363	#endif
	364
	365	if (5 == sscanf(line,
[295]	366	"%u: %s:%X %X:%X %X %X:%X %X:%X %X %d %d %u %s",
	367	&n, iface, &port, &istatus, &inode))
[180]	368	{
[295]	369	struct sockaddr_in addr4;
	370	struct sockaddr_in6 addr6;
	371	struct sh_sockaddr ss;
	372
	373	niface = 0;
[251]	374
[295]	375	switch (domain)
	376	{
	377	case AF_INET:
	378	addr4.sin_addr.s_addr = (int) strtol(iface, NULL, 16);
	379	niface = (unsigned int) addr4.sin_addr.s_addr;
	380	sh_ipvx_save(&ss, AF_INET, (struct sockaddr *)&addr4);
	381	break;
[180]	382
[295]	383	case AF_INET6:
	384	sscanf(iface,
	385	"%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx",
	386	&addr6.sin6_addr.s6_addr[3], &addr6.sin6_addr.s6_addr[2], &addr6.sin6_addr.s6_addr[1], &addr6.sin6_addr.s6_addr[0],
	387	&addr6.sin6_addr.s6_addr[7], &addr6.sin6_addr.s6_addr[6], &addr6.sin6_addr.s6_addr[5], &addr6.sin6_addr.s6_addr[4],
	388	&addr6.sin6_addr.s6_addr[11], &addr6.sin6_addr.s6_addr[10], &addr6.sin6_addr.s6_addr[9], &addr6.sin6_addr.s6_addr[8],
	389	&addr6.sin6_addr.s6_addr[15], &addr6.sin6_addr.s6_addr[14], &addr6.sin6_addr.s6_addr[13], &addr6.sin6_addr.s6_addr[12]);
	390
	391	for (i = 0; i < 16; ++i)
	392	{
	393	if (0 != (unsigned int) addr6.sin6_addr.s6_addr[i])
	394	++niface;
	395	}
	396	sh_ipvx_save(&ss, AF_INET6, (struct sockaddr *)&addr6);
	397	break;
	398	}
	399
[251]	400	#ifdef DEBUG_P2P
	401	{
[295]	402	char a[SH_IP_BUF];
	403	char b[SH_IP_BUF];
[251]	404
[295]	405	sh_ipvx_ntoa(a, sizeof(a), &ss);
	406	sh_ipvx_ntoa(b, sizeof(b), &ss);
[251]	407
	408	fprintf(stderr, " -> inode %u, iface/port %s,%u, status %u, searching %s,%u, %u\n",
	409	inode, a, port, istatus, b, sport,
	410	proto == IPPROTO_TCP ? 0x0a : 0x07);
	411	}
	412	#endif
	413
	414	if (proto == IPPROTO_TCP && istatus != 0x0a)
	415	continue;
	416	if (proto == IPPROTO_UDP && istatus == 0x01)
	417	continue;
	418
	419	#ifdef DEBUG_P2P
	420	{
	421	fprintf(stderr, "check iface %u..\n", iface);
	422	}
	423	#endif
	424
[295]	425	if ((proto == IPPROTO_UDP \|\| niface == 0 \|\| 0 == sh_ipvx_cmp(&ss, saddr)) &&
	426	port == (unsigned int)sport)
[180]	427	{
	428	struct sock_store * new = socklist;
	429
[251]	430	#ifdef DEBUG_P2P
	431	{
	432	fprintf(stderr, "found it\n");
	433	}
	434	#endif
	435
[180]	436	while (new)
	437	{
[251]	438	#ifdef DEBUG_P2P
	439	{
	440	fprintf(stderr, "searching inode %u: %lu\n",
	441	inode, new->sock);
	442	}
	443	#endif
	444	if (inode == new->sock)
[180]	445	{
[251]	446	#ifdef DEBUG_P2P
	447	{
	448	fprintf(stderr, "found it: path=(%s), user=(%s)\n",
	449	new->path == NULL ? "NULL" : new->path,
	450	new->user == NULL ? "NULL" : new->user);
	451	}
	452	#endif
[252]	453	sl_fclose(FIL__, __LINE__, fd);
[206]	454	*pid = (unsigned long) new->pid;
[180]	455	if (new->path)
	456	{
	457	if (new->user)
	458	sl_strlcpy(user, new->user, userlen);
	459	else
	460	sl_strlcpy(user, "-", userlen);
	461	return sh_util_strdup(new->path);
	462	}
	463	goto err_out;
	464	}
	465	new = new->next;
	466	}
	467	}
	468	}
	469	}
[252]	470	sl_fclose(FIL__, __LINE__, fd);
[180]	471	}
	472	err_out:
[206]	473	sl_strlcpy(user, "-", userlen);
[180]	474	return sh_util_strdup("-");
	475	}
	476
[250]	477	/* returns the command and fills the 'user' array
	478	*/
[295]	479	char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
[250]	480	unsigned long * pid, char * user, size_t userlen)
	481	{
	482	char file[32];
[295]	483	char * ret;
	484
[250]	485	if (proto == IPPROTO_TCP)
	486	{
	487	sl_strlcpy(file, _("/proc/net/tcp"), sizeof(file));
[295]	488	ret = port2proc_query(file, proto, AF_INET, saddr, sport, pid, user, userlen);
	489
	490	if (ret[0] == '-' && ret[1] == '\0')
	491	{
	492	SH_FREE(ret);
	493	sl_strlcpy(file, _("/proc/net/tcp6"), sizeof(file));
	494	ret = port2proc_query(file, proto, AF_INET6, saddr, sport, pid, user, userlen);
	495	}
	496	return ret;
[250]	497	}
	498	else
	499	{
	500	char * ret;
	501	sl_strlcpy(file, _("/proc/net/udp"), sizeof(file));
[295]	502	ret = port2proc_query(file, proto, AF_INET, saddr, sport, pid, user, userlen);
	503
[250]	504	if (ret[0] == '-' && ret[1] == '\0')
	505	{
	506	SH_FREE(ret);
	507	sl_strlcpy(file, _("/proc/net/udp6"), sizeof(file));
[295]	508	ret = port2proc_query(file, proto, AF_INET6, saddr, sport, pid, user, userlen);
[250]	509	}
	510	return ret;
	511	}
	512	}
	513
	514
[193]	515	/****************************************************************************
	516	*
	517	* >>> FREEBSD CODE <<<
	518	*
	519	****************************************************************************/
	520
	521	#elif defined(__FreeBSD__)
	522
	523	/* Uses code from sockstat.c. Error and memory handling modified.
	524	* Only required functions from sockstat.c are included.
	525	*/
	526
	527	/*-
	528	* Copyright (c) 2002 Dag-Erling Co<EF>dan Sm<F8>rgrav
	529	* All rights reserved.
	530	*
	531	* Redistribution and use in source and binary forms, with or without
	532	* modification, are permitted provided that the following conditions
	533	* are met:
	534	* 1. Redistributions of source code must retain the above copyright
	535	* notice, this list of conditions and the following disclaimer
	536	* in this position and unchanged.
	537	* 2. Redistributions in binary form must reproduce the above copyright
	538	* notice, this list of conditions and the following disclaimer in the
	539	* documentation and/or other materials provided with the distribution.
	540	* 3. The name of the author may not be used to endorse or promote products
	541	* derived from this software without specific prior written permission.
	542	*
	543	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	544	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	545	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	546	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	547	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	548	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	549	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	550	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	551	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	552	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	553	*/
	554	#include <sys/cdefs.h>
	555	__FBSDID("$FreeBSD: src/usr.bin/sockstat/sockstat.c,v 1.13.2.1.4.1 2008/10/02 02:57:24 kensmith Exp $");
	556
	557	#include <sys/param.h>
	558	#include <sys/socket.h>
	559	#include <sys/socketvar.h>
	560	#include <sys/sysctl.h>
	561	#include <sys/file.h>
	562	#include <sys/user.h>
	563
	564	#include <sys/un.h>
	565	#include <sys/unpcb.h>
	566
	567	#include <net/route.h>
	568
	569	#include <netinet/in.h>
	570	#include <netinet/in_pcb.h>
	571	#include <netinet/tcp.h>
	572	#include <netinet/tcp_seq.h>
	573	#include <netinet/tcp_var.h>
	574	#include <arpa/inet.h>
	575
	576	#include <ctype.h>
	577	#include <errno.h>
	578	#include <netdb.h>
	579	#include <stdio.h>
	580	#include <stdlib.h>
	581
	582	#include <unistd.h>
	583
	584	static int opt_4 = 1; /* Show IPv4 sockets */
[295]	585	static int opt_6 = 1; /* Show IPv6 sockets */
[193]	586	static int opt_c = 0; /* Show connected sockets */
	587	static int opt_l = 1; /* Show listening sockets */
	588	static int opt_v = 0; /* Verbose mode */
	589
	590	struct sock {
	591	void *socket;
	592	void *pcb;
	593	int vflag;
	594	int family;
	595	int proto;
	596
	597	struct sockaddr_storage laddr;
	598	struct sockaddr_storage faddr;
	599	struct sock *next;
	600	};
	601
	602	#define HASHSIZE 1009
	603	static struct sock *sockhash[HASHSIZE];
	604
	605	static struct xfile *xfiles;
	606	static int nxfiles;
	607
	608
	609	static void * xrealloc(void * buf, size_t len0, size_t len)
	610	{
	611	if (len > 0)
	612	{
[195]	613	void * xbuf = SH_ALLOC(len);
	614	if (buf)
	615	{
	616	if (len0 <= len)
	617	memcpy(xbuf, buf, len0);
	618	else
	619	memset(xbuf, '\0', len);
	620	SH_FREE(buf);
	621	}
[193]	622	return xbuf;
	623	}
	624	SH_FREE(buf);
	625	return NULL;
	626	}
	627
	628	/* Sets address and port in struct sockaddr_storage *sa
	629	*/
	630	static void
	631	sockaddr(struct sockaddr_storage sa, int af, void addr, int port)
	632	{
	633	struct sockaddr_in *sin4;
	634	struct sockaddr_in6 *sin6;
	635
	636	bzero(sa, sizeof *sa);
	637	switch (af) {
	638	case AF_INET:
	639	sin4 = (struct sockaddr_in *)sa;
	640	sin4->sin_len = sizeof *sin4;
	641	sin4->sin_family = af;
	642	sin4->sin_port = port;
	643	sin4->sin_addr = (struct in_addr )addr;
	644	break;
	645	case AF_INET6:
	646	sin6 = (struct sockaddr_in6 *)sa;
	647	sin6->sin6_len = sizeof *sin6;
	648	sin6->sin6_family = af;
	649	sin6->sin6_port = port;
	650	sin6->sin6_addr = (struct in6_addr )addr;
	651	break;
	652	default:
	653	return;
	654	}
	655	}
	656
	657	/* Get socket information from the kernel.
	658	*/
	659	static void
	660	gather_inet(int proto)
	661	{
	662	struct xinpgen xig, exig;
	663	struct xinpcb *xip;
	664	struct xtcpcb *xtp;
	665	struct inpcb *inp;
	666	struct xsocket *so;
	667	struct sock *sock;
	668	char varname[32];
	669	size_t len, bufsize, bufsize0;
	670	void *buf;
	671	int hash, retry, vflag;
	672
	673	vflag = 0;
	674	if (opt_4)
	675	vflag \|= INP_IPV4;
	676	if (opt_6)
	677	vflag \|= INP_IPV6;
	678
	679	switch (proto) {
	680	case IPPROTO_TCP:
	681	sl_strlcpy(varname, _("net.inet.tcp.pcblist"), sizeof(varname));
	682	break;
	683	case IPPROTO_UDP:
	684	sl_strlcpy(varname, _("net.inet.udp.pcblist"), sizeof(varname));
	685	break;
	686	case IPPROTO_DIVERT:
	687	sl_strlcpy(varname, _("net.inet.divert.pcblist"), sizeof(varname));
	688	break;
	689	default:
	690	return;
	691	}
	692
	693	buf = NULL;
[196]	694	bufsize = 8192;
[193]	695	bufsize0 = bufsize;
	696	retry = 5;
	697	do {
	698	for (;;) {
	699	buf = xrealloc(buf, bufsize0, bufsize);
	700	bufsize0 = bufsize;
	701	len = bufsize;
	702	if (sysctlbyname(varname, buf, &len, NULL, 0) == 0)
	703	break;
[195]	704	if (errno == ENOENT)
[193]	705	goto out;
	706	if (errno != ENOMEM)
	707	{
	708	SH_MUTEX_LOCK(mutex_thread_nolog);
[195]	709	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__,
	710	0, MSG_E_SUBGEN,
[193]	711	_("sysctlbyname()"),
	712	_("gather_inet"));
	713	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[195]	714	SH_FREE(buf);
[193]	715	return;
	716	}
	717	bufsize *= 2;
	718	}
	719	xig = (struct xinpgen *)buf;
	720	exig = (struct xinpgen )(void )
	721	((char )buf + len - sizeof exig);
	722	if (xig->xig_len != sizeof *xig \|\|
	723	exig->xig_len != sizeof *exig)
	724	{
	725	SH_MUTEX_LOCK(mutex_thread_nolog);
	726	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	727	_("struct xinpgen size mismatch"),
	728	_("gather_inet"));
	729	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	730	goto out;
	731	}
	732
	733	} while (xig->xig_gen != exig->xig_gen && retry--);
	734
	735	if (xig->xig_gen != exig->xig_gen && opt_v)
	736	{
	737	SH_MUTEX_LOCK(mutex_thread_nolog);
	738	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	739	_("data may be inconsistent"),
	740	_("gather_inet"));
	741	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	742	}
	743
	744	for (;;) {
	745	xig = (struct xinpgen )(void )((char *)xig + xig->xig_len);
	746	if (xig >= exig)
	747	break;
	748	switch (proto) {
	749	case IPPROTO_TCP:
	750	xtp = (struct xtcpcb *)xig;
	751	if (xtp->xt_len != sizeof *xtp) {
	752	SH_MUTEX_LOCK(mutex_thread_nolog);
	753	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	754	_("struct xtcpcb size mismatch"),
	755	_("gather_inet"));
	756	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	757	goto out;
	758	}
	759	inp = &xtp->xt_inp;
	760	so = &xtp->xt_socket;
	761	break;
	762	case IPPROTO_UDP:
	763	case IPPROTO_DIVERT:
	764	xip = (struct xinpcb *)xig;
	765	if (xip->xi_len != sizeof *xip) {
	766	SH_MUTEX_LOCK(mutex_thread_nolog);
	767	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	768	_("struct xinpcb size mismatch"),
	769	_("gather_inet"));
	770	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	771	goto out;
	772	}
	773	inp = &xip->xi_inp;
	774	so = &xip->xi_socket;
	775	break;
	776	default:
	777	return;
	778	}
	779	if ((inp->inp_vflag & vflag) == 0)
	780	continue;
	781	if (inp->inp_vflag & INP_IPV4) {
	782	if ((inp->inp_fport == 0 && !opt_l) \|\|
	783	(inp->inp_fport != 0 && !opt_c))
	784	continue;
	785	} else if (inp->inp_vflag & INP_IPV6) {
	786	if ((inp->in6p_fport == 0 && !opt_l) \|\|
	787	(inp->in6p_fport != 0 && !opt_c))
	788	continue;
	789	} else {
	790	if (opt_v) {
	791	char errmsg[64];
	792	sl_snprintf(errmsg, sizeof(errmsg),
	793	_("invalid vflag 0x%x"), inp->inp_vflag);
	794	SH_MUTEX_LOCK(mutex_thread_nolog);
	795	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	796	errmsg,
	797	_("gather_inet"));
	798	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	799	continue;
	800	}
	801	}
	802
	803	sock = SH_ALLOC(sizeof *sock);
	804	memset(sock, '\0', sizeof (*sock));
	805
	806	sock->socket = so->xso_so;
	807	sock->proto = proto;
	808	if (inp->inp_vflag & INP_IPV4) {
	809	sock->family = AF_INET;
	810	sockaddr(&sock->laddr, sock->family,
	811	&inp->inp_laddr, inp->inp_lport);
	812	sockaddr(&sock->faddr, sock->family,
	813	&inp->inp_faddr, inp->inp_fport);
	814	} else if (inp->inp_vflag & INP_IPV6) {
	815	sock->family = AF_INET6;
	816	sockaddr(&sock->laddr, sock->family,
	817	&inp->in6p_laddr, inp->in6p_lport);
	818	sockaddr(&sock->faddr, sock->family,
	819	&inp->in6p_faddr, inp->in6p_fport);
	820	}
	821	sock->vflag = inp->inp_vflag;
	822
	823	hash = (int)((uintptr_t)sock->socket % HASHSIZE);
	824	sock->next = sockhash[hash];
	825	sockhash[hash] = sock;
	826	}
	827	out:
[195]	828	if (buf)
	829	SH_FREE(buf);
[193]	830	}
	831
	832	static void
	833	getfiles(void)
	834	{
	835	size_t len;
	836	size_t len0;
	837
	838	xfiles = SH_ALLOC(len = sizeof *xfiles);
	839	len0 = len;
	840
	841	while (sysctlbyname(_("kern.file"), xfiles, &len, 0, 0) == -1) {
	842	if (errno != ENOMEM)
	843	{
[195]	844	volatile int status = errno;
[193]	845	SH_MUTEX_LOCK(mutex_thread_nolog);
	846	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
	847	_("sysctlbyname()"),
	848	_("getfiles"));
	849	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	850	}
	851	len *= 2;
	852	xfiles = xrealloc(xfiles, len0, len);
	853	len0 = len;
	854	}
	855	if (len > 0 && xfiles->xf_size != sizeof *xfiles)
	856	if (errno != ENOMEM)
	857	{
[195]	858	volatile int status = errno;
[193]	859	SH_MUTEX_LOCK(mutex_thread_nolog);
	860	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
	861	_("struct xfile size mismatch"),
	862	_("getfiles"));
	863	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	864	}
	865	nxfiles = len / sizeof *xfiles;
	866	}
	867
	868	static const char *
	869	getprocname(pid_t pid)
	870	{
	871	static struct kinfo_proc proc;
	872	size_t len;
	873	int mib[4];
	874
	875	mib[0] = CTL_KERN;
	876	mib[1] = KERN_PROC;
	877	mib[2] = KERN_PROC_PID;
	878	mib[3] = (int)pid;
	879	len = sizeof proc;
	880	if (sysctl(mib, 4, &proc, &len, NULL, 0) == -1) {
	881	/* Do not warn if the process exits before we get its name. */
	882	if (errno != ESRCH)
	883	{
[195]	884	volatile int status = errno;
[193]	885	SH_MUTEX_LOCK(mutex_thread_nolog);
	886	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, status, MSG_E_SUBGEN,
	887	_("sysctl()"),
	888	_("getfiles"));
	889	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	890	}
	891	return ("-");
	892	}
	893	return (proc.ki_ocomm);
	894	}
	895
[295]	896	char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
[206]	897	unsigned long * pid, char * user, size_t userlen)
[180]	898	{
[195]	899	int n, hash;
[193]	900	struct xfile *xf;
[295]	901	struct in_addr * haddr;
	902	struct in6_addr * haddr6;
[195]	903	struct sock * s;
[295]	904	struct in6_addr anyaddr = IN6ADDR_ANY_INIT;
[206]	905
	906	*pid = 0;
[193]	907
	908	for (xf = xfiles, n = 0; n < nxfiles; ++n, ++xf) {
	909
	910	if (xf->xf_data == NULL)
	911	continue;
	912
	913	/* Find the socket in sockhash[] that corresponds to it
	914	*/
	915	hash = (int)((uintptr_t)xf->xf_data % HASHSIZE);
	916	for (s = sockhash[hash]; s != NULL; s = s->next)
	917	if ((void *)s->socket == xf->xf_data)
	918	break;
	919
[195]	920	if (!s)
	921	continue;
	922
	923	/* fprintf(stderr, "FIXME: %d %d, %d %d, %d %d, %d, %d\n", s->proto, proto,
	924	s->family, AF_INET,
	925	sport, ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port),
	926	(int) xf->xf_uid, (int)xf->xf_pid);
	927	*/
	928
[193]	929	if (s->proto != proto)
	930	continue;
	931
[295]	932	if (s->family != AF_INET && s->family != AF_INET6)
[193]	933	continue;
	934
[295]	935	if (s->family == AF_INET &&
	936	(sport != ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port)))
[193]	937	continue;
	938
[295]	939	if (s->family == AF_INET6 &&
	940	(sport != ntohs(((struct sockaddr_in6 *)(&s->laddr))->sin6_port)))
	941	continue;
[195]	942
[295]	943	if (s->family == AF_INET)
	944	haddr = &((struct sockaddr_in *)(&s->laddr))->sin_addr;
	945	if (s->family == AF_INET6)
	946	haddr6 = &((struct sockaddr_in6 *)(&s->laddr))->sin6_addr;
	947
	948
[195]	949	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(haddr)); /
	950	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(saddr)); /
	951
[295]	952	if ( (s->family == AF_INET &&
	953	(haddr->s_addr == (saddr->sin).sin_addr.s_addr \|\|
	954	sh_ipvx_isany(saddr) \|\|
	955	inet_lnaof(*haddr) == INADDR_ANY))
	956	\|\|
	957	(s->family == AF_INET6 &&
	958	(0 == memcmp(haddr6->s6_addr, &((saddr->sin6).sin6_addr.s6_addr), 16) \|\|
	959	0 == memcmp(haddr6->s6_addr, &(anyaddr.s6_addr), 16) \|\|
	960	sh_ipvx_isany(saddr) ))
	961	)
[193]	962	{
[195]	963	struct sock_store try;
	964
[206]	965	*pid = xf->xf_pid;
	966
[195]	967	try.pid = xf->xf_pid;
	968	try.path = NULL;
	969	try.user = NULL;
	970	get_user_and_path (&try); /* Try to get info from /proc */
	971
	972	if (try.path == NULL)
	973	{
	974	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
	975	char * tmp = sh_unix_getUIDname (SH_ERR_ALL, xf->xf_uid, user, userlen);
	976	if (!tmp)
	977	sl_snprintf (user, userlen, "%ld", (unsigned long) xf->xf_uid);
	978	return sh_util_strdup(getprocname(xf->xf_pid));
	979	}
	980	else
	981	{
	982	sl_strlcpy(user, try.user, userlen);
	983	SH_FREE(try.user);
	984	return try.path;
	985	}
[193]	986	}
	987	}
[195]	988	sl_strlcpy(user, "-", userlen);
	989	return sh_util_strdup("-");
[193]	990	}
	991
	992	static void sockdel(struct sock * sock)
	993	{
	994	if (sock)
	995	{
	996	if (sock->next)
	997	sockdel(sock->next);
	998	SH_FREE(sock);
	999	}
	1000	return;
	1001	}
	1002
	1003	int sh_port2proc_prepare()
	1004	{
	1005	int i;
	1006
	1007	if (xfiles)
	1008	{
	1009	SH_FREE(xfiles);
	1010	xfiles = NULL;
	1011	}
	1012
	1013	for (i = 0; i < HASHSIZE; ++i)
[195]	1014	{
	1015	sockdel(sockhash[i]);
	1016	sockhash[i] = NULL;
	1017	}
[193]	1018
	1019	/* Inet connections
	1020	*/
	1021	gather_inet(IPPROTO_TCP);
	1022	gather_inet(IPPROTO_UDP);
	1023	gather_inet(IPPROTO_DIVERT);
	1024
	1025	getfiles();
	1026
	1027	return 0;
	1028	}
	1029
[235]	1030	void sh_port2proc_finish()
	1031	{
	1032	return;
	1033	}
	1034
[193]	1035	#else /* !defined(__linux__) && !defined(__FreeBSD__) */
	1036
[292]	1037	#include "samhain.h"
	1038	#include "sh_utils.h"
[295]	1039	#include "sh_ipvx.h"
[292]	1040
[295]	1041	char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
[206]	1042	unsigned long * pid, char * user, size_t userlen)
[193]	1043	{
[180]	1044	(void) proto;
	1045	(void) saddr;
	1046	(void) sport;
	1047
[206]	1048	*pid = 0;
	1049
[180]	1050	sl_strlcpy(user, "-", userlen);
	1051	return sh_util_strdup("-");
	1052	}
	1053
	1054	int sh_port2proc_prepare()
	1055	{
	1056	return 0;
	1057	}
	1058
[235]	1059	void sh_port2proc_finish()
	1060	{
	1061	return;
	1062	}
[180]	1063	#endif
	1064
	1065	#endif /* defined(SH_USE_PORTCHECK) */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: