Context Navigation

source: trunk/src/sh_port2proc.c@ 280

Last change on this file since 280 was 279, checked in by katerina, 15 years ago
Fix for tickets #200 to #206 (kernel check, login checks, bugfixes).
File size: 25.7 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 2008 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24	#include <string.h>
25	#include <sys/types.h>
26	#include <unistd.h>
27
28	#ifdef HAVE_DIRENT_H
29	#include <dirent.h>
30	#define NAMLEN(dirent) sl_strlen((dirent)->d_name)
31	#else
32	#define dirent direct
33	#define NAMLEN(dirent) (dirent)->d_namlen
34	#ifdef HAVE_SYS_NDIR_H
35	#include <sys/ndir.h>
36	#endif
37	#ifdef HAVE_SYS_DIR_H
38	#include <sys/dir.h>
39	#endif
40	#ifdef HAVE_NDIR_H
41	#include <ndir.h>
42	#endif
43	#endif
44	#define NEED_ADD_DIRENT
45
46	#if defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE))
47
48	/* #define DEBUG_P2P 1 */
49
50	/****************************************************************************
51	*
52	* >>> COMMON CODE <<<
53	*
54	****************************************************************************/
55	#if defined(__linux__) \|\| defined(__FreeBSD__)
56
57	#include "samhain.h"
58	#include "sh_error_min.h"
59	#include "sh_utils.h"
60	#include "sh_pthread.h"
61
62	#define FIL__ _("sh_port2proc.c")
63
64	struct sock_store {
65	unsigned long sock;
66	size_t pid;
67	char * path;
68	char * user;
69	struct sock_store * next;
70	};
71
72	/* /proc:
73	* linux: /proc/pid/exe
74	* freebsd: /proc/pid/file
75	* solaris10: /proc/pid/path/a.out
76	*/
77	static void get_user_and_path (struct sock_store * add)
78	{
79	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
80
81	char path[128];
82	char * buf;
83	struct stat sbuf;
84	int len;
85	char * tmp;
86
87	sl_snprintf (path, sizeof(path), "/proc/%ld/exe", (unsigned long) add->pid);
88
89	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
90	{
91	goto linkread;
92	}
93
94	sl_snprintf (path, sizeof(path), "/proc/%ld/file", (unsigned long) add->pid);
95
96	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
97	{
98	goto linkread;
99	}
100
101	sl_snprintf (path, sizeof(path), "/proc/%ld/path/a.out", (unsigned long) add->pid);
102
103	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
104	{
105	goto linkread;
106	}
107
108	return;
109
110	linkread:
111
112	buf = SH_ALLOC(PATH_MAX);
113	len = readlink(path, buf, PATH_MAX); /* flawfinder: ignore */
114	len = (len >= PATH_MAX) ? (PATH_MAX-1) : len;
115
116	if (len > 0)
117	{
118	buf[len] = '\0';
119	add->path = buf;
120	}
121	else
122	{
123	SH_FREE(buf);
124	}
125
126	add->user = SH_ALLOC(USER_MAX);
127	tmp = sh_unix_getUIDname (SH_ERR_ALL, sbuf.st_uid, add->user, USER_MAX);
128
129	if (!tmp)
130	sl_snprintf (add->user, USER_MAX, "%ld", (unsigned long) sbuf.st_uid);
131
132	return;
133	}
134
135	#endif
136
137	/****************************************************************************
138	*
139	* >>> LINUX CODE <<<
140	*
141	****************************************************************************/
142
143	#if defined(__linux__)
144
145	static size_t sh_minpid = 0x0001;
146	static size_t sh_maxpid = 0x8000;
147
148	#ifndef HAVE_LSTAT
149	#define lstat(x,y) stat(x,y)
150	#endif /* HAVE_LSTAT */
151
152	#if defined(S_IFLNK) && !defined(S_ISLNK)
153	# define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
154	#else
155	# if !defined(S_ISLNK)
156	# define S_ISLNK(mode) (0)
157	# endif
158	#endif
159
160	#if defined(__linux__)
161	#define PROC_PID_MAX _("/proc/sys/kernel/pid_max")
162
163	static int proc_max_pid (size_t * procpid)
164	{
165	char * ret;
166	unsigned long pid;
167	FILE * fd;
168	char str[128];
169	char * ptr;
170
171	SL_ENTER(_("proc_max_pid"));
172
173	if (0 == access(PROC_PID_MAX, R_OK)) /* flawfinder: ignore */
174	{
175	if (NULL != (fd = fopen(PROC_PID_MAX, "r")))
176	{
177	str[0] = '\0';
178	ret = fgets(str, 128, fd);
179	if (ret && *str != '\0')
180	{
181	pid = strtoul(str, &ptr, 0);
182	if (ptr == '\0' \|\| ptr == '\n')
183	{
184	sl_fclose(FIL__, __LINE__, fd);
185	*procpid = (size_t) pid;
186	SL_RETURN(0, _("proc_max_pid"));
187	}
188	}
189	sl_fclose(FIL__, __LINE__, fd);
190	}
191	}
192	SL_RETURN((-1), _("proc_max_pid"));
193	}
194	#else
195	static int proc_max_pid(size_t * procpid)
196	{
197	*procpid = sh_maxpid;
198	return 0;
199	}
200	#endif
201
202	static struct sock_store * socklist = NULL;
203
204	static void del_sock_all()
205	{
206	struct sock_store * del = socklist;
207
208	while (del)
209	{
210	socklist = del->next;
211	if (del->path)
212	SH_FREE(del->path);
213	if (del->user)
214	SH_FREE(del->user);
215	SH_FREE(del);
216	del = socklist;
217	}
218	socklist = NULL;
219	return;
220	}
221
222	static void add_sock(unsigned long sock, size_t pid)
223	{
224	struct sock_store * add = SH_ALLOC(sizeof(struct sock_store));
225
226	add->sock = sock;
227	add->pid = pid;
228	add->path = NULL;
229	add->user = NULL;
230	SH_MUTEX_LOCK(mutex_thread_nolog);
231	get_user_and_path(add);
232	SH_MUTEX_UNLOCK(mutex_thread_nolog);
233	add->next = socklist;
234	socklist = add;
235	return;
236	}
237
238	static void check_and_add_sock(char * fbuf, size_t pid)
239	{
240	if (0 == strncmp(_("socket:["), fbuf, 8))
241	{
242	char * end;
243	unsigned long sock;
244	size_t len = strlen(fbuf);
245	if (fbuf[len-1] == ']')
246	fbuf[len-1] = '\0';
247	sock = strtoul(&fbuf[8], &end, 0);
248	if (*end == '\0' && fbuf[8] != '\0')
249	{
250	add_sock(sock, pid);
251	}
252	}
253	}
254
255	static void fetch_socks(size_t pid)
256	{
257	char path[128];
258	DIR * dir;
259	sl_snprintf(path, sizeof(path), _("/proc/%lu/fd"), (unsigned long) pid);
260
261	dir = opendir(path);
262	if (dir)
263	{
264	struct dirent *entry;
265	while (NULL != (entry = readdir(dir)))
266	{
267	char fpath[384];
268	char fbuf[64];
269	int ret;
270	/* /proc/PID/fd/N-> socket:[15713] */
271	sl_snprintf(fpath, sizeof(fpath), _("%s/%s"), path, entry->d_name);
272	ret = readlink(fpath, fbuf, sizeof(fbuf)-1); /* flawfinder: ignore */
273	if (ret > 0)
274	{
275	fbuf[ret] = '\0';
276	check_and_add_sock(fbuf, pid);
277	}
278	}
279	closedir(dir);
280	}
281	}
282
283	int sh_port2proc_prepare()
284	{
285	size_t i;
286
287	if (0 != proc_max_pid(&sh_maxpid))
288	{
289	SH_MUTEX_LOCK(mutex_thread_nolog);
290	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
291	_("Failed to detect max_pid"),
292	_("sh_port2proc"));
293	SH_MUTEX_UNLOCK(mutex_thread_nolog);
294	SL_RETURN ((-1), _("sh_port2proc"));
295	}
296
297	/* Delete old socket list and re-create it
298	*/
299	del_sock_all();
300
301	for (i = sh_minpid; i < sh_maxpid; ++i)
302	{
303	fetch_socks(i);
304	}
305
306	return 0;
307	}
308
309	void sh_port2proc_finish()
310	{
311	/* Delete old socket list
312	*/
313	del_sock_all();
314	return;
315	}
316
317
318	#include <sys/socket.h>
319	#include <netinet/in.h>
320	#include <arpa/inet.h>
321
322	/* returns the command and fills the 'user' array
323	*/
324	static char * port2proc_query(char * file, int proto,
325	struct in_addr * saddr, int sport,
326	unsigned long * pid, char * user, size_t userlen)
327	{
328	FILE * fd;
329
330	fd = fopen(file, "r");
331
332	*pid = 0;
333
334	#ifdef DEBUG_P2P
335	{
336	char errmsg[256];
337	sl_snprintf(errmsg, sizeof(errmsg),
338	"query, file=%s, proto=%d, port=%d, iface=%s\n",
339	file, proto, sport, inet_ntoa(*saddr));
340	fprintf(stderr, "%s", errmsg);
341	}
342	#endif
343
344	if (fd)
345	{
346	unsigned int n, iface, port, inode, istatus;
347	char line[512];
348
349	while (NULL != fgets(line, sizeof(line), fd))
350	{
351
352	#ifdef DEBUG_P2P
353	{
354	fprintf(stderr, "%s", line);
355	}
356	#endif
357
358	if (5 == sscanf(line,
359	"%u: %X:%X %X:%X %X %X:%X %X:%X %X %d %d %u %s",
360	&n, &iface, &port, &istatus, &inode))
361	{
362	struct in_addr haddr;
363
364	haddr.s_addr = (unsigned long)iface;
365
366	#ifdef DEBUG_P2P
367	{
368	char a[32];
369	char b[32];
370
371	sl_strlcpy(a, inet_ntoa(haddr), sizeof(a));
372	sl_strlcpy(b, inet_ntoa(*saddr), sizeof(b));
373
374	fprintf(stderr, " -> inode %u, iface/port %s,%u, status %u, searching %s,%u, %u\n",
375	inode, a, port, istatus, b, sport,
376	proto == IPPROTO_TCP ? 0x0a : 0x07);
377	}
378	#endif
379
380	if (proto == IPPROTO_TCP && istatus != 0x0a)
381	continue;
382	if (proto == IPPROTO_UDP && istatus == 0x01)
383	continue;
384
385	#ifdef DEBUG_P2P
386	{
387	fprintf(stderr, "check iface %u..\n", iface);
388	}
389	#endif
390
391	if ((proto == IPPROTO_UDP \|\| iface == 0 \|\| haddr.s_addr == saddr->s_addr) && port == (unsigned int)sport)
392	{
393	struct sock_store * new = socklist;
394
395	#ifdef DEBUG_P2P
396	{
397	fprintf(stderr, "found it\n");
398	}
399	#endif
400
401	while (new)
402	{
403	#ifdef DEBUG_P2P
404	{
405	fprintf(stderr, "searching inode %u: %lu\n",
406	inode, new->sock);
407	}
408	#endif
409	if (inode == new->sock)
410	{
411	#ifdef DEBUG_P2P
412	{
413	fprintf(stderr, "found it: path=(%s), user=(%s)\n",
414	new->path == NULL ? "NULL" : new->path,
415	new->user == NULL ? "NULL" : new->user);
416	}
417	#endif
418	sl_fclose(FIL__, __LINE__, fd);
419	*pid = (unsigned long) new->pid;
420	if (new->path)
421	{
422	if (new->user)
423	sl_strlcpy(user, new->user, userlen);
424	else
425	sl_strlcpy(user, "-", userlen);
426	return sh_util_strdup(new->path);
427	}
428	goto err_out;
429	}
430	new = new->next;
431	}
432	}
433	}
434	}
435	sl_fclose(FIL__, __LINE__, fd);
436	}
437	err_out:
438	sl_strlcpy(user, "-", userlen);
439	return sh_util_strdup("-");
440	}
441
442	/* returns the command and fills the 'user' array
443	*/
444	char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
445	unsigned long * pid, char * user, size_t userlen)
446	{
447	char file[32];
448
449	if (proto == IPPROTO_TCP)
450	{
451	sl_strlcpy(file, _("/proc/net/tcp"), sizeof(file));
452	return port2proc_query(file, proto, saddr, sport, pid, user, userlen);
453	}
454	else
455	{
456	char * ret;
457	sl_strlcpy(file, _("/proc/net/udp"), sizeof(file));
458	ret = port2proc_query(file, proto, saddr, sport, pid, user, userlen);
459	if (ret[0] == '-' && ret[1] == '\0')
460	{
461	SH_FREE(ret);
462	sl_strlcpy(file, _("/proc/net/udp6"), sizeof(file));
463	ret = port2proc_query(file, proto, saddr, sport, pid, user, userlen);
464	}
465	return ret;
466	}
467	}
468
469
470	/****************************************************************************
471	*
472	* >>> FREEBSD CODE <<<
473	*
474	****************************************************************************/
475
476	#elif defined(__FreeBSD__)
477
478	/* Uses code from sockstat.c. Error and memory handling modified.
479	* Only required functions from sockstat.c are included.
480	*/
481
482	/*-
483	* Copyright (c) 2002 Dag-Erling Co<EF>dan Sm<F8>rgrav
484	* All rights reserved.
485	*
486	* Redistribution and use in source and binary forms, with or without
487	* modification, are permitted provided that the following conditions
488	* are met:
489	* 1. Redistributions of source code must retain the above copyright
490	* notice, this list of conditions and the following disclaimer
491	* in this position and unchanged.
492	* 2. Redistributions in binary form must reproduce the above copyright
493	* notice, this list of conditions and the following disclaimer in the
494	* documentation and/or other materials provided with the distribution.
495	* 3. The name of the author may not be used to endorse or promote products
496	* derived from this software without specific prior written permission.
497	*
498	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
499	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
500	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
501	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
502	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
503	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
504	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
505	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
506	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
507	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
508	*/
509	#include <sys/cdefs.h>
510	__FBSDID("$FreeBSD: src/usr.bin/sockstat/sockstat.c,v 1.13.2.1.4.1 2008/10/02 02:57:24 kensmith Exp $");
511
512	#include <sys/param.h>
513	#include <sys/socket.h>
514	#include <sys/socketvar.h>
515	#include <sys/sysctl.h>
516	#include <sys/file.h>
517	#include <sys/user.h>
518
519	#include <sys/un.h>
520	#include <sys/unpcb.h>
521
522	#include <net/route.h>
523
524	#include <netinet/in.h>
525	#include <netinet/in_pcb.h>
526	#include <netinet/tcp.h>
527	#include <netinet/tcp_seq.h>
528	#include <netinet/tcp_var.h>
529	#include <arpa/inet.h>
530
531	#include <ctype.h>
532	#include <errno.h>
533	#include <netdb.h>
534	#include <stdio.h>
535	#include <stdlib.h>
536
537	#include <unistd.h>
538
539	static int opt_4 = 1; /* Show IPv4 sockets */
540	static int opt_6 = 0; /* Show IPv6 sockets */
541	static int opt_c = 0; /* Show connected sockets */
542	static int opt_l = 1; /* Show listening sockets */
543	static int opt_v = 0; /* Verbose mode */
544
545	struct sock {
546	void *socket;
547	void *pcb;
548	int vflag;
549	int family;
550	int proto;
551
552	struct sockaddr_storage laddr;
553	struct sockaddr_storage faddr;
554	struct sock *next;
555	};
556
557	#define HASHSIZE 1009
558	static struct sock *sockhash[HASHSIZE];
559
560	static struct xfile *xfiles;
561	static int nxfiles;
562
563
564	static void * xrealloc(void * buf, size_t len0, size_t len)
565	{
566	if (len > 0)
567	{
568	void * xbuf = SH_ALLOC(len);
569	if (buf)
570	{
571	if (len0 <= len)
572	memcpy(xbuf, buf, len0);
573	else
574	memset(xbuf, '\0', len);
575	SH_FREE(buf);
576	}
577	return xbuf;
578	}
579	SH_FREE(buf);
580	return NULL;
581	}
582
583	/* Sets address and port in struct sockaddr_storage *sa
584	*/
585	static void
586	sockaddr(struct sockaddr_storage sa, int af, void addr, int port)
587	{
588	struct sockaddr_in *sin4;
589	struct sockaddr_in6 *sin6;
590
591	bzero(sa, sizeof *sa);
592	switch (af) {
593	case AF_INET:
594	sin4 = (struct sockaddr_in *)sa;
595	sin4->sin_len = sizeof *sin4;
596	sin4->sin_family = af;
597	sin4->sin_port = port;
598	sin4->sin_addr = (struct in_addr )addr;
599	break;
600	case AF_INET6:
601	sin6 = (struct sockaddr_in6 *)sa;
602	sin6->sin6_len = sizeof *sin6;
603	sin6->sin6_family = af;
604	sin6->sin6_port = port;
605	sin6->sin6_addr = (struct in6_addr )addr;
606	break;
607	default:
608	return;
609	}
610	}
611
612	/* Get socket information from the kernel.
613	*/
614	static void
615	gather_inet(int proto)
616	{
617	struct xinpgen xig, exig;
618	struct xinpcb *xip;
619	struct xtcpcb *xtp;
620	struct inpcb *inp;
621	struct xsocket *so;
622	struct sock *sock;
623	char varname[32];
624	size_t len, bufsize, bufsize0;
625	void *buf;
626	int hash, retry, vflag;
627
628	vflag = 0;
629	if (opt_4)
630	vflag \|= INP_IPV4;
631	if (opt_6)
632	vflag \|= INP_IPV6;
633
634	switch (proto) {
635	case IPPROTO_TCP:
636	sl_strlcpy(varname, _("net.inet.tcp.pcblist"), sizeof(varname));
637	break;
638	case IPPROTO_UDP:
639	sl_strlcpy(varname, _("net.inet.udp.pcblist"), sizeof(varname));
640	break;
641	case IPPROTO_DIVERT:
642	sl_strlcpy(varname, _("net.inet.divert.pcblist"), sizeof(varname));
643	break;
644	default:
645	return;
646	}
647
648	buf = NULL;
649	bufsize = 8192;
650	bufsize0 = bufsize;
651	retry = 5;
652	do {
653	for (;;) {
654	buf = xrealloc(buf, bufsize0, bufsize);
655	bufsize0 = bufsize;
656	len = bufsize;
657	if (sysctlbyname(varname, buf, &len, NULL, 0) == 0)
658	break;
659	if (errno == ENOENT)
660	goto out;
661	if (errno != ENOMEM)
662	{
663	SH_MUTEX_LOCK(mutex_thread_nolog);
664	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__,
665	0, MSG_E_SUBGEN,
666	_("sysctlbyname()"),
667	_("gather_inet"));
668	SH_MUTEX_UNLOCK(mutex_thread_nolog);
669	SH_FREE(buf);
670	return;
671	}
672	bufsize *= 2;
673	}
674	xig = (struct xinpgen *)buf;
675	exig = (struct xinpgen )(void )
676	((char )buf + len - sizeof exig);
677	if (xig->xig_len != sizeof *xig \|\|
678	exig->xig_len != sizeof *exig)
679	{
680	SH_MUTEX_LOCK(mutex_thread_nolog);
681	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
682	_("struct xinpgen size mismatch"),
683	_("gather_inet"));
684	SH_MUTEX_UNLOCK(mutex_thread_nolog);
685	goto out;
686	}
687
688	} while (xig->xig_gen != exig->xig_gen && retry--);
689
690	if (xig->xig_gen != exig->xig_gen && opt_v)
691	{
692	SH_MUTEX_LOCK(mutex_thread_nolog);
693	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
694	_("data may be inconsistent"),
695	_("gather_inet"));
696	SH_MUTEX_UNLOCK(mutex_thread_nolog);
697	}
698
699	for (;;) {
700	xig = (struct xinpgen )(void )((char *)xig + xig->xig_len);
701	if (xig >= exig)
702	break;
703	switch (proto) {
704	case IPPROTO_TCP:
705	xtp = (struct xtcpcb *)xig;
706	if (xtp->xt_len != sizeof *xtp) {
707	SH_MUTEX_LOCK(mutex_thread_nolog);
708	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
709	_("struct xtcpcb size mismatch"),
710	_("gather_inet"));
711	SH_MUTEX_UNLOCK(mutex_thread_nolog);
712	goto out;
713	}
714	inp = &xtp->xt_inp;
715	so = &xtp->xt_socket;
716	break;
717	case IPPROTO_UDP:
718	case IPPROTO_DIVERT:
719	xip = (struct xinpcb *)xig;
720	if (xip->xi_len != sizeof *xip) {
721	SH_MUTEX_LOCK(mutex_thread_nolog);
722	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
723	_("struct xinpcb size mismatch"),
724	_("gather_inet"));
725	SH_MUTEX_UNLOCK(mutex_thread_nolog);
726	goto out;
727	}
728	inp = &xip->xi_inp;
729	so = &xip->xi_socket;
730	break;
731	default:
732	return;
733	}
734	if ((inp->inp_vflag & vflag) == 0)
735	continue;
736	if (inp->inp_vflag & INP_IPV4) {
737	if ((inp->inp_fport == 0 && !opt_l) \|\|
738	(inp->inp_fport != 0 && !opt_c))
739	continue;
740	} else if (inp->inp_vflag & INP_IPV6) {
741	if ((inp->in6p_fport == 0 && !opt_l) \|\|
742	(inp->in6p_fport != 0 && !opt_c))
743	continue;
744	} else {
745	if (opt_v) {
746	char errmsg[64];
747	sl_snprintf(errmsg, sizeof(errmsg),
748	_("invalid vflag 0x%x"), inp->inp_vflag);
749	SH_MUTEX_LOCK(mutex_thread_nolog);
750	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
751	errmsg,
752	_("gather_inet"));
753	SH_MUTEX_UNLOCK(mutex_thread_nolog);
754	continue;
755	}
756	}
757
758	sock = SH_ALLOC(sizeof *sock);
759	memset(sock, '\0', sizeof (*sock));
760
761	sock->socket = so->xso_so;
762	sock->proto = proto;
763	if (inp->inp_vflag & INP_IPV4) {
764	sock->family = AF_INET;
765	sockaddr(&sock->laddr, sock->family,
766	&inp->inp_laddr, inp->inp_lport);
767	sockaddr(&sock->faddr, sock->family,
768	&inp->inp_faddr, inp->inp_fport);
769	} else if (inp->inp_vflag & INP_IPV6) {
770	sock->family = AF_INET6;
771	sockaddr(&sock->laddr, sock->family,
772	&inp->in6p_laddr, inp->in6p_lport);
773	sockaddr(&sock->faddr, sock->family,
774	&inp->in6p_faddr, inp->in6p_fport);
775	}
776	sock->vflag = inp->inp_vflag;
777
778	hash = (int)((uintptr_t)sock->socket % HASHSIZE);
779	sock->next = sockhash[hash];
780	sockhash[hash] = sock;
781	}
782	out:
783	if (buf)
784	SH_FREE(buf);
785	}
786
787	static void
788	getfiles(void)
789	{
790	size_t len;
791	size_t len0;
792
793	xfiles = SH_ALLOC(len = sizeof *xfiles);
794	len0 = len;
795
796	while (sysctlbyname(_("kern.file"), xfiles, &len, 0, 0) == -1) {
797	if (errno != ENOMEM)
798	{
799	volatile int status = errno;
800	SH_MUTEX_LOCK(mutex_thread_nolog);
801	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
802	_("sysctlbyname()"),
803	_("getfiles"));
804	SH_MUTEX_UNLOCK(mutex_thread_nolog);
805	}
806	len *= 2;
807	xfiles = xrealloc(xfiles, len0, len);
808	len0 = len;
809	}
810	if (len > 0 && xfiles->xf_size != sizeof *xfiles)
811	if (errno != ENOMEM)
812	{
813	volatile int status = errno;
814	SH_MUTEX_LOCK(mutex_thread_nolog);
815	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
816	_("struct xfile size mismatch"),
817	_("getfiles"));
818	SH_MUTEX_UNLOCK(mutex_thread_nolog);
819	}
820	nxfiles = len / sizeof *xfiles;
821	}
822
823	static const char *
824	getprocname(pid_t pid)
825	{
826	static struct kinfo_proc proc;
827	size_t len;
828	int mib[4];
829
830	mib[0] = CTL_KERN;
831	mib[1] = KERN_PROC;
832	mib[2] = KERN_PROC_PID;
833	mib[3] = (int)pid;
834	len = sizeof proc;
835	if (sysctl(mib, 4, &proc, &len, NULL, 0) == -1) {
836	/* Do not warn if the process exits before we get its name. */
837	if (errno != ESRCH)
838	{
839	volatile int status = errno;
840	SH_MUTEX_LOCK(mutex_thread_nolog);
841	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, status, MSG_E_SUBGEN,
842	_("sysctl()"),
843	_("getfiles"));
844	SH_MUTEX_UNLOCK(mutex_thread_nolog);
845	}
846	return ("-");
847	}
848	return (proc.ki_ocomm);
849	}
850
851	char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
852	unsigned long * pid, char * user, size_t userlen)
853	{
854	int n, hash;
855	struct xfile *xf;
856	struct in_addr * haddr;
857	struct sock * s;
858
859	*pid = 0;
860
861	for (xf = xfiles, n = 0; n < nxfiles; ++n, ++xf) {
862
863	if (xf->xf_data == NULL)
864	continue;
865
866	/* Find the socket in sockhash[] that corresponds to it
867	*/
868	hash = (int)((uintptr_t)xf->xf_data % HASHSIZE);
869	for (s = sockhash[hash]; s != NULL; s = s->next)
870	if ((void *)s->socket == xf->xf_data)
871	break;
872
873	if (!s)
874	continue;
875
876	/* fprintf(stderr, "FIXME: %d %d, %d %d, %d %d, %d, %d\n", s->proto, proto,
877	s->family, AF_INET,
878	sport, ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port),
879	(int) xf->xf_uid, (int)xf->xf_pid);
880	*/
881
882	if (s->proto != proto)
883	continue;
884
885	if (s->family != AF_INET /* && s->family != AF_INET6 */)
886	continue;
887
888	if (sport != ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port))
889	continue;
890
891	haddr = &((struct sockaddr_in *)(&s->laddr))->sin_addr;
892
893	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(haddr)); /
894	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(saddr)); /
895
896	if (haddr->s_addr == saddr->s_addr \|\| inet_lnaof(saddr) == INADDR_ANY \|\| inet_lnaof(haddr) == INADDR_ANY)
897	{
898	struct sock_store try;
899
900	*pid = xf->xf_pid;
901
902	try.pid = xf->xf_pid;
903	try.path = NULL;
904	try.user = NULL;
905	get_user_and_path (&try); /* Try to get info from /proc */
906
907	if (try.path == NULL)
908	{
909	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
910	char * tmp = sh_unix_getUIDname (SH_ERR_ALL, xf->xf_uid, user, userlen);
911	if (!tmp)
912	sl_snprintf (user, userlen, "%ld", (unsigned long) xf->xf_uid);
913	return sh_util_strdup(getprocname(xf->xf_pid));
914	}
915	else
916	{
917	sl_strlcpy(user, try.user, userlen);
918	SH_FREE(try.user);
919	return try.path;
920	}
921	}
922	}
923	sl_strlcpy(user, "-", userlen);
924	return sh_util_strdup("-");
925	}
926
927	static void sockdel(struct sock * sock)
928	{
929	if (sock)
930	{
931	if (sock->next)
932	sockdel(sock->next);
933	SH_FREE(sock);
934	}
935	return;
936	}
937
938	int sh_port2proc_prepare()
939	{
940	int i;
941
942	if (xfiles)
943	{
944	SH_FREE(xfiles);
945	xfiles = NULL;
946	}
947
948	for (i = 0; i < HASHSIZE; ++i)
949	{
950	sockdel(sockhash[i]);
951	sockhash[i] = NULL;
952	}
953
954	/* Inet connections
955	*/
956	gather_inet(IPPROTO_TCP);
957	gather_inet(IPPROTO_UDP);
958	gather_inet(IPPROTO_DIVERT);
959
960	getfiles();
961
962	return 0;
963	}
964
965	void sh_port2proc_finish()
966	{
967	return;
968	}
969
970	#else /* !defined(__linux__) && !defined(__FreeBSD__) */
971
972	char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
973	unsigned long * pid, char * user, size_t userlen)
974	{
975	(void) proto;
976	(void) saddr;
977	(void) sport;
978
979	*pid = 0;
980
981	sl_strlcpy(user, "-", userlen);
982	return sh_util_strdup("-");
983	}
984
985	int sh_port2proc_prepare()
986	{
987	return 0;
988	}
989
990	void sh_port2proc_finish()
991	{
992	return;
993	}
994	#endif
995
996	#endif /* defined(SH_USE_PORTCHECK) */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: