Context Navigation

source: trunk/src/sh_port2proc.c@ 292

Last change on this file since 292 was 292, checked in by katerina, 14 years ago
Fix for compile problems on Solaris 10 (ticket #220).
File size: 25.8 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 2008 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24	#include <string.h>
25	#include <sys/types.h>
26	#include <netinet/in.h>
27	#include <arpa/inet.h>
28	#include <unistd.h>
29
30	#ifdef HAVE_DIRENT_H
31	#include <dirent.h>
32	#define NAMLEN(dirent) sl_strlen((dirent)->d_name)
33	#else
34	#define dirent direct
35	#define NAMLEN(dirent) (dirent)->d_namlen
36	#ifdef HAVE_SYS_NDIR_H
37	#include <sys/ndir.h>
38	#endif
39	#ifdef HAVE_SYS_DIR_H
40	#include <sys/dir.h>
41	#endif
42	#ifdef HAVE_NDIR_H
43	#include <ndir.h>
44	#endif
45	#endif
46	#define NEED_ADD_DIRENT
47
48	#if defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE))
49
50	/* #define DEBUG_P2P 1 */
51
52	#include "samhain.h"
53	#include "sh_utils.h"
54
55	/****************************************************************************
56	*
57	* >>> COMMON CODE <<<
58	*
59	****************************************************************************/
60	#if defined(__linux__) \|\| defined(__FreeBSD__)
61
62	#include "sh_error_min.h"
63	#include "sh_pthread.h"
64
65	#define FIL__ _("sh_port2proc.c")
66
67	struct sock_store {
68	unsigned long sock;
69	size_t pid;
70	char * path;
71	char * user;
72	struct sock_store * next;
73	};
74
75	/* /proc:
76	* linux: /proc/pid/exe
77	* freebsd: /proc/pid/file
78	* solaris10: /proc/pid/path/a.out
79	*/
80	static void get_user_and_path (struct sock_store * add)
81	{
82	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
83
84	char path[128];
85	char * buf;
86	struct stat sbuf;
87	int len;
88	char * tmp;
89
90	sl_snprintf (path, sizeof(path), "/proc/%ld/exe", (unsigned long) add->pid);
91
92	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
93	{
94	goto linkread;
95	}
96
97	sl_snprintf (path, sizeof(path), "/proc/%ld/file", (unsigned long) add->pid);
98
99	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
100	{
101	goto linkread;
102	}
103
104	sl_snprintf (path, sizeof(path), "/proc/%ld/path/a.out", (unsigned long) add->pid);
105
106	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
107	{
108	goto linkread;
109	}
110
111	return;
112
113	linkread:
114
115	buf = SH_ALLOC(PATH_MAX);
116	len = readlink(path, buf, PATH_MAX); /* flawfinder: ignore */
117	len = (len >= PATH_MAX) ? (PATH_MAX-1) : len;
118
119	if (len > 0)
120	{
121	buf[len] = '\0';
122	add->path = buf;
123	}
124	else
125	{
126	SH_FREE(buf);
127	}
128
129	add->user = SH_ALLOC(USER_MAX);
130	tmp = sh_unix_getUIDname (SH_ERR_ALL, sbuf.st_uid, add->user, USER_MAX);
131
132	if (!tmp)
133	sl_snprintf (add->user, USER_MAX, "%ld", (unsigned long) sbuf.st_uid);
134
135	return;
136	}
137
138	#endif
139
140	/****************************************************************************
141	*
142	* >>> LINUX CODE <<<
143	*
144	****************************************************************************/
145
146	#if defined(__linux__)
147
148	static size_t sh_minpid = 0x0001;
149	static size_t sh_maxpid = 0x8000;
150
151	#ifndef HAVE_LSTAT
152	#define lstat(x,y) stat(x,y)
153	#endif /* HAVE_LSTAT */
154
155	#if defined(S_IFLNK) && !defined(S_ISLNK)
156	# define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
157	#else
158	# if !defined(S_ISLNK)
159	# define S_ISLNK(mode) (0)
160	# endif
161	#endif
162
163	#if defined(__linux__)
164	#define PROC_PID_MAX _("/proc/sys/kernel/pid_max")
165
166	static int proc_max_pid (size_t * procpid)
167	{
168	char * ret;
169	unsigned long pid;
170	FILE * fd;
171	char str[128];
172	char * ptr;
173
174	SL_ENTER(_("proc_max_pid"));
175
176	if (0 == access(PROC_PID_MAX, R_OK)) /* flawfinder: ignore */
177	{
178	if (NULL != (fd = fopen(PROC_PID_MAX, "r")))
179	{
180	str[0] = '\0';
181	ret = fgets(str, 128, fd);
182	if (ret && *str != '\0')
183	{
184	pid = strtoul(str, &ptr, 0);
185	if (ptr == '\0' \|\| ptr == '\n')
186	{
187	sl_fclose(FIL__, __LINE__, fd);
188	*procpid = (size_t) pid;
189	SL_RETURN(0, _("proc_max_pid"));
190	}
191	}
192	sl_fclose(FIL__, __LINE__, fd);
193	}
194	}
195	SL_RETURN((-1), _("proc_max_pid"));
196	}
197	#else
198	static int proc_max_pid(size_t * procpid)
199	{
200	*procpid = sh_maxpid;
201	return 0;
202	}
203	#endif
204
205	static struct sock_store * socklist = NULL;
206
207	static void del_sock_all()
208	{
209	struct sock_store * del = socklist;
210
211	while (del)
212	{
213	socklist = del->next;
214	if (del->path)
215	SH_FREE(del->path);
216	if (del->user)
217	SH_FREE(del->user);
218	SH_FREE(del);
219	del = socklist;
220	}
221	socklist = NULL;
222	return;
223	}
224
225	static void add_sock(unsigned long sock, size_t pid)
226	{
227	struct sock_store * add = SH_ALLOC(sizeof(struct sock_store));
228
229	add->sock = sock;
230	add->pid = pid;
231	add->path = NULL;
232	add->user = NULL;
233	SH_MUTEX_LOCK(mutex_thread_nolog);
234	get_user_and_path(add);
235	SH_MUTEX_UNLOCK(mutex_thread_nolog);
236	add->next = socklist;
237	socklist = add;
238	return;
239	}
240
241	static void check_and_add_sock(char * fbuf, size_t pid)
242	{
243	if (0 == strncmp(_("socket:["), fbuf, 8))
244	{
245	char * end;
246	unsigned long sock;
247	size_t len = strlen(fbuf);
248	if (fbuf[len-1] == ']')
249	fbuf[len-1] = '\0';
250	sock = strtoul(&fbuf[8], &end, 0);
251	if (*end == '\0' && fbuf[8] != '\0')
252	{
253	add_sock(sock, pid);
254	}
255	}
256	}
257
258	static void fetch_socks(size_t pid)
259	{
260	char path[128];
261	DIR * dir;
262	sl_snprintf(path, sizeof(path), _("/proc/%lu/fd"), (unsigned long) pid);
263
264	dir = opendir(path);
265	if (dir)
266	{
267	struct dirent *entry;
268	while (NULL != (entry = readdir(dir)))
269	{
270	char fpath[384];
271	char fbuf[64];
272	int ret;
273	/* /proc/PID/fd/N-> socket:[15713] */
274	sl_snprintf(fpath, sizeof(fpath), _("%s/%s"), path, entry->d_name);
275	ret = readlink(fpath, fbuf, sizeof(fbuf)-1); /* flawfinder: ignore */
276	if (ret > 0)
277	{
278	fbuf[ret] = '\0';
279	check_and_add_sock(fbuf, pid);
280	}
281	}
282	closedir(dir);
283	}
284	}
285
286	int sh_port2proc_prepare()
287	{
288	size_t i;
289
290	if (0 != proc_max_pid(&sh_maxpid))
291	{
292	SH_MUTEX_LOCK(mutex_thread_nolog);
293	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
294	_("Failed to detect max_pid"),
295	_("sh_port2proc"));
296	SH_MUTEX_UNLOCK(mutex_thread_nolog);
297	SL_RETURN ((-1), _("sh_port2proc"));
298	}
299
300	/* Delete old socket list and re-create it
301	*/
302	del_sock_all();
303
304	for (i = sh_minpid; i < sh_maxpid; ++i)
305	{
306	fetch_socks(i);
307	}
308
309	return 0;
310	}
311
312	void sh_port2proc_finish()
313	{
314	/* Delete old socket list
315	*/
316	del_sock_all();
317	return;
318	}
319
320
321	#include <sys/socket.h>
322	#include <netinet/in.h>
323	#include <arpa/inet.h>
324
325	/* returns the command and fills the 'user' array
326	*/
327	static char * port2proc_query(char * file, int proto,
328	struct in_addr * saddr, int sport,
329	unsigned long * pid, char * user, size_t userlen)
330	{
331	FILE * fd;
332
333	fd = fopen(file, "r");
334
335	*pid = 0;
336
337	#ifdef DEBUG_P2P
338	{
339	char errmsg[256];
340	sl_snprintf(errmsg, sizeof(errmsg),
341	"query, file=%s, proto=%d, port=%d, iface=%s\n",
342	file, proto, sport, inet_ntoa(*saddr));
343	fprintf(stderr, "%s", errmsg);
344	}
345	#endif
346
347	if (fd)
348	{
349	unsigned int n, iface, port, inode, istatus;
350	char line[512];
351
352	while (NULL != fgets(line, sizeof(line), fd))
353	{
354
355	#ifdef DEBUG_P2P
356	{
357	fprintf(stderr, "%s", line);
358	}
359	#endif
360
361	if (5 == sscanf(line,
362	"%u: %X:%X %X:%X %X %X:%X %X:%X %X %d %d %u %s",
363	&n, &iface, &port, &istatus, &inode))
364	{
365	struct in_addr haddr;
366
367	haddr.s_addr = (unsigned long)iface;
368
369	#ifdef DEBUG_P2P
370	{
371	char a[32];
372	char b[32];
373
374	sl_strlcpy(a, inet_ntoa(haddr), sizeof(a));
375	sl_strlcpy(b, inet_ntoa(*saddr), sizeof(b));
376
377	fprintf(stderr, " -> inode %u, iface/port %s,%u, status %u, searching %s,%u, %u\n",
378	inode, a, port, istatus, b, sport,
379	proto == IPPROTO_TCP ? 0x0a : 0x07);
380	}
381	#endif
382
383	if (proto == IPPROTO_TCP && istatus != 0x0a)
384	continue;
385	if (proto == IPPROTO_UDP && istatus == 0x01)
386	continue;
387
388	#ifdef DEBUG_P2P
389	{
390	fprintf(stderr, "check iface %u..\n", iface);
391	}
392	#endif
393
394	if ((proto == IPPROTO_UDP \|\| iface == 0 \|\| haddr.s_addr == saddr->s_addr) && port == (unsigned int)sport)
395	{
396	struct sock_store * new = socklist;
397
398	#ifdef DEBUG_P2P
399	{
400	fprintf(stderr, "found it\n");
401	}
402	#endif
403
404	while (new)
405	{
406	#ifdef DEBUG_P2P
407	{
408	fprintf(stderr, "searching inode %u: %lu\n",
409	inode, new->sock);
410	}
411	#endif
412	if (inode == new->sock)
413	{
414	#ifdef DEBUG_P2P
415	{
416	fprintf(stderr, "found it: path=(%s), user=(%s)\n",
417	new->path == NULL ? "NULL" : new->path,
418	new->user == NULL ? "NULL" : new->user);
419	}
420	#endif
421	sl_fclose(FIL__, __LINE__, fd);
422	*pid = (unsigned long) new->pid;
423	if (new->path)
424	{
425	if (new->user)
426	sl_strlcpy(user, new->user, userlen);
427	else
428	sl_strlcpy(user, "-", userlen);
429	return sh_util_strdup(new->path);
430	}
431	goto err_out;
432	}
433	new = new->next;
434	}
435	}
436	}
437	}
438	sl_fclose(FIL__, __LINE__, fd);
439	}
440	err_out:
441	sl_strlcpy(user, "-", userlen);
442	return sh_util_strdup("-");
443	}
444
445	/* returns the command and fills the 'user' array
446	*/
447	char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
448	unsigned long * pid, char * user, size_t userlen)
449	{
450	char file[32];
451
452	if (proto == IPPROTO_TCP)
453	{
454	sl_strlcpy(file, _("/proc/net/tcp"), sizeof(file));
455	return port2proc_query(file, proto, saddr, sport, pid, user, userlen);
456	}
457	else
458	{
459	char * ret;
460	sl_strlcpy(file, _("/proc/net/udp"), sizeof(file));
461	ret = port2proc_query(file, proto, saddr, sport, pid, user, userlen);
462	if (ret[0] == '-' && ret[1] == '\0')
463	{
464	SH_FREE(ret);
465	sl_strlcpy(file, _("/proc/net/udp6"), sizeof(file));
466	ret = port2proc_query(file, proto, saddr, sport, pid, user, userlen);
467	}
468	return ret;
469	}
470	}
471
472
473	/****************************************************************************
474	*
475	* >>> FREEBSD CODE <<<
476	*
477	****************************************************************************/
478
479	#elif defined(__FreeBSD__)
480
481	/* Uses code from sockstat.c. Error and memory handling modified.
482	* Only required functions from sockstat.c are included.
483	*/
484
485	/*-
486	* Copyright (c) 2002 Dag-Erling Co<EF>dan Sm<F8>rgrav
487	* All rights reserved.
488	*
489	* Redistribution and use in source and binary forms, with or without
490	* modification, are permitted provided that the following conditions
491	* are met:
492	* 1. Redistributions of source code must retain the above copyright
493	* notice, this list of conditions and the following disclaimer
494	* in this position and unchanged.
495	* 2. Redistributions in binary form must reproduce the above copyright
496	* notice, this list of conditions and the following disclaimer in the
497	* documentation and/or other materials provided with the distribution.
498	* 3. The name of the author may not be used to endorse or promote products
499	* derived from this software without specific prior written permission.
500	*
501	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
502	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
503	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
504	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
505	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
506	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
507	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
508	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
509	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
510	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
511	*/
512	#include <sys/cdefs.h>
513	__FBSDID("$FreeBSD: src/usr.bin/sockstat/sockstat.c,v 1.13.2.1.4.1 2008/10/02 02:57:24 kensmith Exp $");
514
515	#include <sys/param.h>
516	#include <sys/socket.h>
517	#include <sys/socketvar.h>
518	#include <sys/sysctl.h>
519	#include <sys/file.h>
520	#include <sys/user.h>
521
522	#include <sys/un.h>
523	#include <sys/unpcb.h>
524
525	#include <net/route.h>
526
527	#include <netinet/in.h>
528	#include <netinet/in_pcb.h>
529	#include <netinet/tcp.h>
530	#include <netinet/tcp_seq.h>
531	#include <netinet/tcp_var.h>
532	#include <arpa/inet.h>
533
534	#include <ctype.h>
535	#include <errno.h>
536	#include <netdb.h>
537	#include <stdio.h>
538	#include <stdlib.h>
539
540	#include <unistd.h>
541
542	static int opt_4 = 1; /* Show IPv4 sockets */
543	static int opt_6 = 0; /* Show IPv6 sockets */
544	static int opt_c = 0; /* Show connected sockets */
545	static int opt_l = 1; /* Show listening sockets */
546	static int opt_v = 0; /* Verbose mode */
547
548	struct sock {
549	void *socket;
550	void *pcb;
551	int vflag;
552	int family;
553	int proto;
554
555	struct sockaddr_storage laddr;
556	struct sockaddr_storage faddr;
557	struct sock *next;
558	};
559
560	#define HASHSIZE 1009
561	static struct sock *sockhash[HASHSIZE];
562
563	static struct xfile *xfiles;
564	static int nxfiles;
565
566
567	static void * xrealloc(void * buf, size_t len0, size_t len)
568	{
569	if (len > 0)
570	{
571	void * xbuf = SH_ALLOC(len);
572	if (buf)
573	{
574	if (len0 <= len)
575	memcpy(xbuf, buf, len0);
576	else
577	memset(xbuf, '\0', len);
578	SH_FREE(buf);
579	}
580	return xbuf;
581	}
582	SH_FREE(buf);
583	return NULL;
584	}
585
586	/* Sets address and port in struct sockaddr_storage *sa
587	*/
588	static void
589	sockaddr(struct sockaddr_storage sa, int af, void addr, int port)
590	{
591	struct sockaddr_in *sin4;
592	struct sockaddr_in6 *sin6;
593
594	bzero(sa, sizeof *sa);
595	switch (af) {
596	case AF_INET:
597	sin4 = (struct sockaddr_in *)sa;
598	sin4->sin_len = sizeof *sin4;
599	sin4->sin_family = af;
600	sin4->sin_port = port;
601	sin4->sin_addr = (struct in_addr )addr;
602	break;
603	case AF_INET6:
604	sin6 = (struct sockaddr_in6 *)sa;
605	sin6->sin6_len = sizeof *sin6;
606	sin6->sin6_family = af;
607	sin6->sin6_port = port;
608	sin6->sin6_addr = (struct in6_addr )addr;
609	break;
610	default:
611	return;
612	}
613	}
614
615	/* Get socket information from the kernel.
616	*/
617	static void
618	gather_inet(int proto)
619	{
620	struct xinpgen xig, exig;
621	struct xinpcb *xip;
622	struct xtcpcb *xtp;
623	struct inpcb *inp;
624	struct xsocket *so;
625	struct sock *sock;
626	char varname[32];
627	size_t len, bufsize, bufsize0;
628	void *buf;
629	int hash, retry, vflag;
630
631	vflag = 0;
632	if (opt_4)
633	vflag \|= INP_IPV4;
634	if (opt_6)
635	vflag \|= INP_IPV6;
636
637	switch (proto) {
638	case IPPROTO_TCP:
639	sl_strlcpy(varname, _("net.inet.tcp.pcblist"), sizeof(varname));
640	break;
641	case IPPROTO_UDP:
642	sl_strlcpy(varname, _("net.inet.udp.pcblist"), sizeof(varname));
643	break;
644	case IPPROTO_DIVERT:
645	sl_strlcpy(varname, _("net.inet.divert.pcblist"), sizeof(varname));
646	break;
647	default:
648	return;
649	}
650
651	buf = NULL;
652	bufsize = 8192;
653	bufsize0 = bufsize;
654	retry = 5;
655	do {
656	for (;;) {
657	buf = xrealloc(buf, bufsize0, bufsize);
658	bufsize0 = bufsize;
659	len = bufsize;
660	if (sysctlbyname(varname, buf, &len, NULL, 0) == 0)
661	break;
662	if (errno == ENOENT)
663	goto out;
664	if (errno != ENOMEM)
665	{
666	SH_MUTEX_LOCK(mutex_thread_nolog);
667	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__,
668	0, MSG_E_SUBGEN,
669	_("sysctlbyname()"),
670	_("gather_inet"));
671	SH_MUTEX_UNLOCK(mutex_thread_nolog);
672	SH_FREE(buf);
673	return;
674	}
675	bufsize *= 2;
676	}
677	xig = (struct xinpgen *)buf;
678	exig = (struct xinpgen )(void )
679	((char )buf + len - sizeof exig);
680	if (xig->xig_len != sizeof *xig \|\|
681	exig->xig_len != sizeof *exig)
682	{
683	SH_MUTEX_LOCK(mutex_thread_nolog);
684	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
685	_("struct xinpgen size mismatch"),
686	_("gather_inet"));
687	SH_MUTEX_UNLOCK(mutex_thread_nolog);
688	goto out;
689	}
690
691	} while (xig->xig_gen != exig->xig_gen && retry--);
692
693	if (xig->xig_gen != exig->xig_gen && opt_v)
694	{
695	SH_MUTEX_LOCK(mutex_thread_nolog);
696	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
697	_("data may be inconsistent"),
698	_("gather_inet"));
699	SH_MUTEX_UNLOCK(mutex_thread_nolog);
700	}
701
702	for (;;) {
703	xig = (struct xinpgen )(void )((char *)xig + xig->xig_len);
704	if (xig >= exig)
705	break;
706	switch (proto) {
707	case IPPROTO_TCP:
708	xtp = (struct xtcpcb *)xig;
709	if (xtp->xt_len != sizeof *xtp) {
710	SH_MUTEX_LOCK(mutex_thread_nolog);
711	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
712	_("struct xtcpcb size mismatch"),
713	_("gather_inet"));
714	SH_MUTEX_UNLOCK(mutex_thread_nolog);
715	goto out;
716	}
717	inp = &xtp->xt_inp;
718	so = &xtp->xt_socket;
719	break;
720	case IPPROTO_UDP:
721	case IPPROTO_DIVERT:
722	xip = (struct xinpcb *)xig;
723	if (xip->xi_len != sizeof *xip) {
724	SH_MUTEX_LOCK(mutex_thread_nolog);
725	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
726	_("struct xinpcb size mismatch"),
727	_("gather_inet"));
728	SH_MUTEX_UNLOCK(mutex_thread_nolog);
729	goto out;
730	}
731	inp = &xip->xi_inp;
732	so = &xip->xi_socket;
733	break;
734	default:
735	return;
736	}
737	if ((inp->inp_vflag & vflag) == 0)
738	continue;
739	if (inp->inp_vflag & INP_IPV4) {
740	if ((inp->inp_fport == 0 && !opt_l) \|\|
741	(inp->inp_fport != 0 && !opt_c))
742	continue;
743	} else if (inp->inp_vflag & INP_IPV6) {
744	if ((inp->in6p_fport == 0 && !opt_l) \|\|
745	(inp->in6p_fport != 0 && !opt_c))
746	continue;
747	} else {
748	if (opt_v) {
749	char errmsg[64];
750	sl_snprintf(errmsg, sizeof(errmsg),
751	_("invalid vflag 0x%x"), inp->inp_vflag);
752	SH_MUTEX_LOCK(mutex_thread_nolog);
753	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
754	errmsg,
755	_("gather_inet"));
756	SH_MUTEX_UNLOCK(mutex_thread_nolog);
757	continue;
758	}
759	}
760
761	sock = SH_ALLOC(sizeof *sock);
762	memset(sock, '\0', sizeof (*sock));
763
764	sock->socket = so->xso_so;
765	sock->proto = proto;
766	if (inp->inp_vflag & INP_IPV4) {
767	sock->family = AF_INET;
768	sockaddr(&sock->laddr, sock->family,
769	&inp->inp_laddr, inp->inp_lport);
770	sockaddr(&sock->faddr, sock->family,
771	&inp->inp_faddr, inp->inp_fport);
772	} else if (inp->inp_vflag & INP_IPV6) {
773	sock->family = AF_INET6;
774	sockaddr(&sock->laddr, sock->family,
775	&inp->in6p_laddr, inp->in6p_lport);
776	sockaddr(&sock->faddr, sock->family,
777	&inp->in6p_faddr, inp->in6p_fport);
778	}
779	sock->vflag = inp->inp_vflag;
780
781	hash = (int)((uintptr_t)sock->socket % HASHSIZE);
782	sock->next = sockhash[hash];
783	sockhash[hash] = sock;
784	}
785	out:
786	if (buf)
787	SH_FREE(buf);
788	}
789
790	static void
791	getfiles(void)
792	{
793	size_t len;
794	size_t len0;
795
796	xfiles = SH_ALLOC(len = sizeof *xfiles);
797	len0 = len;
798
799	while (sysctlbyname(_("kern.file"), xfiles, &len, 0, 0) == -1) {
800	if (errno != ENOMEM)
801	{
802	volatile int status = errno;
803	SH_MUTEX_LOCK(mutex_thread_nolog);
804	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
805	_("sysctlbyname()"),
806	_("getfiles"));
807	SH_MUTEX_UNLOCK(mutex_thread_nolog);
808	}
809	len *= 2;
810	xfiles = xrealloc(xfiles, len0, len);
811	len0 = len;
812	}
813	if (len > 0 && xfiles->xf_size != sizeof *xfiles)
814	if (errno != ENOMEM)
815	{
816	volatile int status = errno;
817	SH_MUTEX_LOCK(mutex_thread_nolog);
818	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
819	_("struct xfile size mismatch"),
820	_("getfiles"));
821	SH_MUTEX_UNLOCK(mutex_thread_nolog);
822	}
823	nxfiles = len / sizeof *xfiles;
824	}
825
826	static const char *
827	getprocname(pid_t pid)
828	{
829	static struct kinfo_proc proc;
830	size_t len;
831	int mib[4];
832
833	mib[0] = CTL_KERN;
834	mib[1] = KERN_PROC;
835	mib[2] = KERN_PROC_PID;
836	mib[3] = (int)pid;
837	len = sizeof proc;
838	if (sysctl(mib, 4, &proc, &len, NULL, 0) == -1) {
839	/* Do not warn if the process exits before we get its name. */
840	if (errno != ESRCH)
841	{
842	volatile int status = errno;
843	SH_MUTEX_LOCK(mutex_thread_nolog);
844	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, status, MSG_E_SUBGEN,
845	_("sysctl()"),
846	_("getfiles"));
847	SH_MUTEX_UNLOCK(mutex_thread_nolog);
848	}
849	return ("-");
850	}
851	return (proc.ki_ocomm);
852	}
853
854	char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
855	unsigned long * pid, char * user, size_t userlen)
856	{
857	int n, hash;
858	struct xfile *xf;
859	struct in_addr * haddr;
860	struct sock * s;
861
862	*pid = 0;
863
864	for (xf = xfiles, n = 0; n < nxfiles; ++n, ++xf) {
865
866	if (xf->xf_data == NULL)
867	continue;
868
869	/* Find the socket in sockhash[] that corresponds to it
870	*/
871	hash = (int)((uintptr_t)xf->xf_data % HASHSIZE);
872	for (s = sockhash[hash]; s != NULL; s = s->next)
873	if ((void *)s->socket == xf->xf_data)
874	break;
875
876	if (!s)
877	continue;
878
879	/* fprintf(stderr, "FIXME: %d %d, %d %d, %d %d, %d, %d\n", s->proto, proto,
880	s->family, AF_INET,
881	sport, ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port),
882	(int) xf->xf_uid, (int)xf->xf_pid);
883	*/
884
885	if (s->proto != proto)
886	continue;
887
888	if (s->family != AF_INET /* && s->family != AF_INET6 */)
889	continue;
890
891	if (sport != ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port))
892	continue;
893
894	haddr = &((struct sockaddr_in *)(&s->laddr))->sin_addr;
895
896	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(haddr)); /
897	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(saddr)); /
898
899	if (haddr->s_addr == saddr->s_addr \|\| inet_lnaof(saddr) == INADDR_ANY \|\| inet_lnaof(haddr) == INADDR_ANY)
900	{
901	struct sock_store try;
902
903	*pid = xf->xf_pid;
904
905	try.pid = xf->xf_pid;
906	try.path = NULL;
907	try.user = NULL;
908	get_user_and_path (&try); /* Try to get info from /proc */
909
910	if (try.path == NULL)
911	{
912	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
913	char * tmp = sh_unix_getUIDname (SH_ERR_ALL, xf->xf_uid, user, userlen);
914	if (!tmp)
915	sl_snprintf (user, userlen, "%ld", (unsigned long) xf->xf_uid);
916	return sh_util_strdup(getprocname(xf->xf_pid));
917	}
918	else
919	{
920	sl_strlcpy(user, try.user, userlen);
921	SH_FREE(try.user);
922	return try.path;
923	}
924	}
925	}
926	sl_strlcpy(user, "-", userlen);
927	return sh_util_strdup("-");
928	}
929
930	static void sockdel(struct sock * sock)
931	{
932	if (sock)
933	{
934	if (sock->next)
935	sockdel(sock->next);
936	SH_FREE(sock);
937	}
938	return;
939	}
940
941	int sh_port2proc_prepare()
942	{
943	int i;
944
945	if (xfiles)
946	{
947	SH_FREE(xfiles);
948	xfiles = NULL;
949	}
950
951	for (i = 0; i < HASHSIZE; ++i)
952	{
953	sockdel(sockhash[i]);
954	sockhash[i] = NULL;
955	}
956
957	/* Inet connections
958	*/
959	gather_inet(IPPROTO_TCP);
960	gather_inet(IPPROTO_UDP);
961	gather_inet(IPPROTO_DIVERT);
962
963	getfiles();
964
965	return 0;
966	}
967
968	void sh_port2proc_finish()
969	{
970	return;
971	}
972
973	#else /* !defined(__linux__) && !defined(__FreeBSD__) */
974
975	#include "samhain.h"
976	#include "sh_utils.h"
977
978	char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
979	unsigned long * pid, char * user, size_t userlen)
980	{
981	(void) proto;
982	(void) saddr;
983	(void) sport;
984
985	*pid = 0;
986
987	sl_strlcpy(user, "-", userlen);
988	return sh_util_strdup("-");
989	}
990
991	int sh_port2proc_prepare()
992	{
993	return 0;
994	}
995
996	void sh_port2proc_finish()
997	{
998	return;
999	}
1000	#endif
1001
1002	#endif /* defined(SH_USE_PORTCHECK) */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: