Context Navigation

source: trunk/src/sh_port2proc.c@ 295

Last change on this file since 295 was 295, checked in by katerina, 14 years ago
Support for IPv6 (ticket #222).
File size: 27.9 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 2008 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24	#include <string.h>
25	#include <sys/types.h>
26	#include <netinet/in.h>
27	#include <arpa/inet.h>
28	#include <unistd.h>
29
30	#ifdef HAVE_DIRENT_H
31	#include <dirent.h>
32	#define NAMLEN(dirent) sl_strlen((dirent)->d_name)
33	#else
34	#define dirent direct
35	#define NAMLEN(dirent) (dirent)->d_namlen
36	#ifdef HAVE_SYS_NDIR_H
37	#include <sys/ndir.h>
38	#endif
39	#ifdef HAVE_SYS_DIR_H
40	#include <sys/dir.h>
41	#endif
42	#ifdef HAVE_NDIR_H
43	#include <ndir.h>
44	#endif
45	#endif
46	#define NEED_ADD_DIRENT
47
48	#if defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE))
49
50	/* #define DEBUG_P2P 1 */
51
52	#include "samhain.h"
53	#include "sh_utils.h"
54
55	/****************************************************************************
56	*
57	* >>> COMMON CODE <<<
58	*
59	****************************************************************************/
60	#if defined(__linux__) \|\| defined(__FreeBSD__)
61
62	#include "sh_error_min.h"
63	#include "sh_pthread.h"
64	#include "sh_ipvx.h"
65
66	#define FIL__ _("sh_port2proc.c")
67
68	struct sock_store {
69	unsigned long sock;
70	size_t pid;
71	char * path;
72	char * user;
73	struct sock_store * next;
74	};
75
76	/* /proc:
77	* linux: /proc/pid/exe
78	* freebsd: /proc/pid/file
79	* solaris10: /proc/pid/path/a.out
80	*/
81	static void get_user_and_path (struct sock_store * add)
82	{
83	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
84
85	char path[128];
86	char * buf;
87	struct stat sbuf;
88	int len;
89	char * tmp;
90
91	sl_snprintf (path, sizeof(path), "/proc/%ld/exe", (unsigned long) add->pid);
92
93	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
94	{
95	goto linkread;
96	}
97
98	sl_snprintf (path, sizeof(path), "/proc/%ld/file", (unsigned long) add->pid);
99
100	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
101	{
102	goto linkread;
103	}
104
105	sl_snprintf (path, sizeof(path), "/proc/%ld/path/a.out", (unsigned long) add->pid);
106
107	if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
108	{
109	goto linkread;
110	}
111
112	return;
113
114	linkread:
115
116	buf = SH_ALLOC(PATH_MAX);
117	len = readlink(path, buf, PATH_MAX); /* flawfinder: ignore */
118	len = (len >= PATH_MAX) ? (PATH_MAX-1) : len;
119
120	if (len > 0)
121	{
122	buf[len] = '\0';
123	add->path = buf;
124	}
125	else
126	{
127	SH_FREE(buf);
128	}
129
130	add->user = SH_ALLOC(USER_MAX);
131	tmp = sh_unix_getUIDname (SH_ERR_ALL, sbuf.st_uid, add->user, USER_MAX);
132
133	if (!tmp)
134	sl_snprintf (add->user, USER_MAX, "%ld", (unsigned long) sbuf.st_uid);
135
136	return;
137	}
138
139	#endif
140
141	/****************************************************************************
142	*
143	* >>> LINUX CODE <<<
144	*
145	****************************************************************************/
146
147	#if defined(__linux__)
148
149	static size_t sh_minpid = 0x0001;
150	static size_t sh_maxpid = 0x8000;
151
152	#ifndef HAVE_LSTAT
153	#define lstat(x,y) stat(x,y)
154	#endif /* HAVE_LSTAT */
155
156	#if defined(S_IFLNK) && !defined(S_ISLNK)
157	# define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
158	#else
159	# if !defined(S_ISLNK)
160	# define S_ISLNK(mode) (0)
161	# endif
162	#endif
163
164	#if defined(__linux__)
165	#define PROC_PID_MAX _("/proc/sys/kernel/pid_max")
166
167	static int proc_max_pid (size_t * procpid)
168	{
169	char * ret;
170	unsigned long pid;
171	FILE * fd;
172	char str[128];
173	char * ptr;
174
175	SL_ENTER(_("proc_max_pid"));
176
177	if (0 == access(PROC_PID_MAX, R_OK)) /* flawfinder: ignore */
178	{
179	if (NULL != (fd = fopen(PROC_PID_MAX, "r")))
180	{
181	str[0] = '\0';
182	ret = fgets(str, 128, fd);
183	if (ret && *str != '\0')
184	{
185	pid = strtoul(str, &ptr, 0);
186	if (ptr == '\0' \|\| ptr == '\n')
187	{
188	sl_fclose(FIL__, __LINE__, fd);
189	*procpid = (size_t) pid;
190	SL_RETURN(0, _("proc_max_pid"));
191	}
192	}
193	sl_fclose(FIL__, __LINE__, fd);
194	}
195	}
196	SL_RETURN((-1), _("proc_max_pid"));
197	}
198	#else
199	static int proc_max_pid(size_t * procpid)
200	{
201	*procpid = sh_maxpid;
202	return 0;
203	}
204	#endif
205
206	static struct sock_store * socklist = NULL;
207
208	static void del_sock_all()
209	{
210	struct sock_store * del = socklist;
211
212	while (del)
213	{
214	socklist = del->next;
215	if (del->path)
216	SH_FREE(del->path);
217	if (del->user)
218	SH_FREE(del->user);
219	SH_FREE(del);
220	del = socklist;
221	}
222	socklist = NULL;
223	return;
224	}
225
226	static void add_sock(unsigned long sock, size_t pid)
227	{
228	struct sock_store * add = SH_ALLOC(sizeof(struct sock_store));
229
230	add->sock = sock;
231	add->pid = pid;
232	add->path = NULL;
233	add->user = NULL;
234	SH_MUTEX_LOCK(mutex_thread_nolog);
235	get_user_and_path(add);
236	SH_MUTEX_UNLOCK(mutex_thread_nolog);
237	add->next = socklist;
238	socklist = add;
239	return;
240	}
241
242	static void check_and_add_sock(char * fbuf, size_t pid)
243	{
244	if (0 == strncmp(_("socket:["), fbuf, 8))
245	{
246	char * end;
247	unsigned long sock;
248	size_t len = strlen(fbuf);
249	if (fbuf[len-1] == ']')
250	fbuf[len-1] = '\0';
251	sock = strtoul(&fbuf[8], &end, 0);
252	if (*end == '\0' && fbuf[8] != '\0')
253	{
254	add_sock(sock, pid);
255	}
256	}
257	}
258
259	static void fetch_socks(size_t pid)
260	{
261	char path[128];
262	DIR * dir;
263	sl_snprintf(path, sizeof(path), _("/proc/%lu/fd"), (unsigned long) pid);
264
265	dir = opendir(path);
266	if (dir)
267	{
268	struct dirent *entry;
269	while (NULL != (entry = readdir(dir)))
270	{
271	char fpath[384];
272	char fbuf[64];
273	int ret;
274	/* /proc/PID/fd/N-> socket:[15713] */
275	sl_snprintf(fpath, sizeof(fpath), _("%s/%s"), path, entry->d_name);
276	ret = readlink(fpath, fbuf, sizeof(fbuf)-1); /* flawfinder: ignore */
277	if (ret > 0)
278	{
279	fbuf[ret] = '\0';
280	check_and_add_sock(fbuf, pid);
281	}
282	}
283	closedir(dir);
284	}
285	}
286
287	int sh_port2proc_prepare()
288	{
289	size_t i;
290
291	if (0 != proc_max_pid(&sh_maxpid))
292	{
293	SH_MUTEX_LOCK(mutex_thread_nolog);
294	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
295	_("Failed to detect max_pid"),
296	_("sh_port2proc"));
297	SH_MUTEX_UNLOCK(mutex_thread_nolog);
298	SL_RETURN ((-1), _("sh_port2proc"));
299	}
300
301	/* Delete old socket list and re-create it
302	*/
303	del_sock_all();
304
305	for (i = sh_minpid; i < sh_maxpid; ++i)
306	{
307	fetch_socks(i);
308	}
309
310	return 0;
311	}
312
313	void sh_port2proc_finish()
314	{
315	/* Delete old socket list
316	*/
317	del_sock_all();
318	return;
319	}
320
321
322	#include <sys/socket.h>
323	#include <netinet/in.h>
324	#include <arpa/inet.h>
325
326	/* returns the command and fills the 'user' array
327	*/
328	static char * port2proc_query(char * file, int proto, int domain,
329	struct sh_sockaddr * saddr, int sport,
330	unsigned long * pid, char * user, size_t userlen)
331	{
332	FILE * fd;
333
334	fd = fopen(file, "r");
335
336	*pid = 0;
337
338	#ifdef DEBUG_P2P
339	{
340	char errmsg[256];
341	char siface[SH_IP_BUF];
342	sh_ipvx_ntoa(siface, sizeof(siface), saddr);
343	sl_snprintf(errmsg, sizeof(errmsg),
344	"query, file=%s, proto=%d, port=%d, iface=%s\n",
345	file, proto, sport, siface);
346	fprintf(stderr, "%s", errmsg);
347	}
348	#endif
349
350	if (fd)
351	{
352	unsigned int n, i, port, niface, inode, istatus;
353	char line[512];
354	char iface[SH_IP_BUF];
355
356	while (NULL != fgets(line, sizeof(line), fd))
357	{
358
359	#ifdef DEBUG_P2P
360	{
361	fprintf(stderr, "%s", line);
362	}
363	#endif
364
365	if (5 == sscanf(line,
366	"%u: %s:%X %X:%X %X %X:%X %X:%X %X %d %d %u %s",
367	&n, iface, &port, &istatus, &inode))
368	{
369	struct sockaddr_in addr4;
370	struct sockaddr_in6 addr6;
371	struct sh_sockaddr ss;
372
373	niface = 0;
374
375	switch (domain)
376	{
377	case AF_INET:
378	addr4.sin_addr.s_addr = (int) strtol(iface, NULL, 16);
379	niface = (unsigned int) addr4.sin_addr.s_addr;
380	sh_ipvx_save(&ss, AF_INET, (struct sockaddr *)&addr4);
381	break;
382
383	case AF_INET6:
384	sscanf(iface,
385	"%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx",
386	&addr6.sin6_addr.s6_addr[3], &addr6.sin6_addr.s6_addr[2], &addr6.sin6_addr.s6_addr[1], &addr6.sin6_addr.s6_addr[0],
387	&addr6.sin6_addr.s6_addr[7], &addr6.sin6_addr.s6_addr[6], &addr6.sin6_addr.s6_addr[5], &addr6.sin6_addr.s6_addr[4],
388	&addr6.sin6_addr.s6_addr[11], &addr6.sin6_addr.s6_addr[10], &addr6.sin6_addr.s6_addr[9], &addr6.sin6_addr.s6_addr[8],
389	&addr6.sin6_addr.s6_addr[15], &addr6.sin6_addr.s6_addr[14], &addr6.sin6_addr.s6_addr[13], &addr6.sin6_addr.s6_addr[12]);
390
391	for (i = 0; i < 16; ++i)
392	{
393	if (0 != (unsigned int) addr6.sin6_addr.s6_addr[i])
394	++niface;
395	}
396	sh_ipvx_save(&ss, AF_INET6, (struct sockaddr *)&addr6);
397	break;
398	}
399
400	#ifdef DEBUG_P2P
401	{
402	char a[SH_IP_BUF];
403	char b[SH_IP_BUF];
404
405	sh_ipvx_ntoa(a, sizeof(a), &ss);
406	sh_ipvx_ntoa(b, sizeof(b), &ss);
407
408	fprintf(stderr, " -> inode %u, iface/port %s,%u, status %u, searching %s,%u, %u\n",
409	inode, a, port, istatus, b, sport,
410	proto == IPPROTO_TCP ? 0x0a : 0x07);
411	}
412	#endif
413
414	if (proto == IPPROTO_TCP && istatus != 0x0a)
415	continue;
416	if (proto == IPPROTO_UDP && istatus == 0x01)
417	continue;
418
419	#ifdef DEBUG_P2P
420	{
421	fprintf(stderr, "check iface %u..\n", iface);
422	}
423	#endif
424
425	if ((proto == IPPROTO_UDP \|\| niface == 0 \|\| 0 == sh_ipvx_cmp(&ss, saddr)) &&
426	port == (unsigned int)sport)
427	{
428	struct sock_store * new = socklist;
429
430	#ifdef DEBUG_P2P
431	{
432	fprintf(stderr, "found it\n");
433	}
434	#endif
435
436	while (new)
437	{
438	#ifdef DEBUG_P2P
439	{
440	fprintf(stderr, "searching inode %u: %lu\n",
441	inode, new->sock);
442	}
443	#endif
444	if (inode == new->sock)
445	{
446	#ifdef DEBUG_P2P
447	{
448	fprintf(stderr, "found it: path=(%s), user=(%s)\n",
449	new->path == NULL ? "NULL" : new->path,
450	new->user == NULL ? "NULL" : new->user);
451	}
452	#endif
453	sl_fclose(FIL__, __LINE__, fd);
454	*pid = (unsigned long) new->pid;
455	if (new->path)
456	{
457	if (new->user)
458	sl_strlcpy(user, new->user, userlen);
459	else
460	sl_strlcpy(user, "-", userlen);
461	return sh_util_strdup(new->path);
462	}
463	goto err_out;
464	}
465	new = new->next;
466	}
467	}
468	}
469	}
470	sl_fclose(FIL__, __LINE__, fd);
471	}
472	err_out:
473	sl_strlcpy(user, "-", userlen);
474	return sh_util_strdup("-");
475	}
476
477	/* returns the command and fills the 'user' array
478	*/
479	char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
480	unsigned long * pid, char * user, size_t userlen)
481	{
482	char file[32];
483	char * ret;
484
485	if (proto == IPPROTO_TCP)
486	{
487	sl_strlcpy(file, _("/proc/net/tcp"), sizeof(file));
488	ret = port2proc_query(file, proto, AF_INET, saddr, sport, pid, user, userlen);
489
490	if (ret[0] == '-' && ret[1] == '\0')
491	{
492	SH_FREE(ret);
493	sl_strlcpy(file, _("/proc/net/tcp6"), sizeof(file));
494	ret = port2proc_query(file, proto, AF_INET6, saddr, sport, pid, user, userlen);
495	}
496	return ret;
497	}
498	else
499	{
500	char * ret;
501	sl_strlcpy(file, _("/proc/net/udp"), sizeof(file));
502	ret = port2proc_query(file, proto, AF_INET, saddr, sport, pid, user, userlen);
503
504	if (ret[0] == '-' && ret[1] == '\0')
505	{
506	SH_FREE(ret);
507	sl_strlcpy(file, _("/proc/net/udp6"), sizeof(file));
508	ret = port2proc_query(file, proto, AF_INET6, saddr, sport, pid, user, userlen);
509	}
510	return ret;
511	}
512	}
513
514
515	/****************************************************************************
516	*
517	* >>> FREEBSD CODE <<<
518	*
519	****************************************************************************/
520
521	#elif defined(__FreeBSD__)
522
523	/* Uses code from sockstat.c. Error and memory handling modified.
524	* Only required functions from sockstat.c are included.
525	*/
526
527	/*-
528	* Copyright (c) 2002 Dag-Erling Co<EF>dan Sm<F8>rgrav
529	* All rights reserved.
530	*
531	* Redistribution and use in source and binary forms, with or without
532	* modification, are permitted provided that the following conditions
533	* are met:
534	* 1. Redistributions of source code must retain the above copyright
535	* notice, this list of conditions and the following disclaimer
536	* in this position and unchanged.
537	* 2. Redistributions in binary form must reproduce the above copyright
538	* notice, this list of conditions and the following disclaimer in the
539	* documentation and/or other materials provided with the distribution.
540	* 3. The name of the author may not be used to endorse or promote products
541	* derived from this software without specific prior written permission.
542	*
543	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
544	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
545	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
546	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
547	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
548	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
549	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
550	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
551	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
552	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
553	*/
554	#include <sys/cdefs.h>
555	__FBSDID("$FreeBSD: src/usr.bin/sockstat/sockstat.c,v 1.13.2.1.4.1 2008/10/02 02:57:24 kensmith Exp $");
556
557	#include <sys/param.h>
558	#include <sys/socket.h>
559	#include <sys/socketvar.h>
560	#include <sys/sysctl.h>
561	#include <sys/file.h>
562	#include <sys/user.h>
563
564	#include <sys/un.h>
565	#include <sys/unpcb.h>
566
567	#include <net/route.h>
568
569	#include <netinet/in.h>
570	#include <netinet/in_pcb.h>
571	#include <netinet/tcp.h>
572	#include <netinet/tcp_seq.h>
573	#include <netinet/tcp_var.h>
574	#include <arpa/inet.h>
575
576	#include <ctype.h>
577	#include <errno.h>
578	#include <netdb.h>
579	#include <stdio.h>
580	#include <stdlib.h>
581
582	#include <unistd.h>
583
584	static int opt_4 = 1; /* Show IPv4 sockets */
585	static int opt_6 = 1; /* Show IPv6 sockets */
586	static int opt_c = 0; /* Show connected sockets */
587	static int opt_l = 1; /* Show listening sockets */
588	static int opt_v = 0; /* Verbose mode */
589
590	struct sock {
591	void *socket;
592	void *pcb;
593	int vflag;
594	int family;
595	int proto;
596
597	struct sockaddr_storage laddr;
598	struct sockaddr_storage faddr;
599	struct sock *next;
600	};
601
602	#define HASHSIZE 1009
603	static struct sock *sockhash[HASHSIZE];
604
605	static struct xfile *xfiles;
606	static int nxfiles;
607
608
609	static void * xrealloc(void * buf, size_t len0, size_t len)
610	{
611	if (len > 0)
612	{
613	void * xbuf = SH_ALLOC(len);
614	if (buf)
615	{
616	if (len0 <= len)
617	memcpy(xbuf, buf, len0);
618	else
619	memset(xbuf, '\0', len);
620	SH_FREE(buf);
621	}
622	return xbuf;
623	}
624	SH_FREE(buf);
625	return NULL;
626	}
627
628	/* Sets address and port in struct sockaddr_storage *sa
629	*/
630	static void
631	sockaddr(struct sockaddr_storage sa, int af, void addr, int port)
632	{
633	struct sockaddr_in *sin4;
634	struct sockaddr_in6 *sin6;
635
636	bzero(sa, sizeof *sa);
637	switch (af) {
638	case AF_INET:
639	sin4 = (struct sockaddr_in *)sa;
640	sin4->sin_len = sizeof *sin4;
641	sin4->sin_family = af;
642	sin4->sin_port = port;
643	sin4->sin_addr = (struct in_addr )addr;
644	break;
645	case AF_INET6:
646	sin6 = (struct sockaddr_in6 *)sa;
647	sin6->sin6_len = sizeof *sin6;
648	sin6->sin6_family = af;
649	sin6->sin6_port = port;
650	sin6->sin6_addr = (struct in6_addr )addr;
651	break;
652	default:
653	return;
654	}
655	}
656
657	/* Get socket information from the kernel.
658	*/
659	static void
660	gather_inet(int proto)
661	{
662	struct xinpgen xig, exig;
663	struct xinpcb *xip;
664	struct xtcpcb *xtp;
665	struct inpcb *inp;
666	struct xsocket *so;
667	struct sock *sock;
668	char varname[32];
669	size_t len, bufsize, bufsize0;
670	void *buf;
671	int hash, retry, vflag;
672
673	vflag = 0;
674	if (opt_4)
675	vflag \|= INP_IPV4;
676	if (opt_6)
677	vflag \|= INP_IPV6;
678
679	switch (proto) {
680	case IPPROTO_TCP:
681	sl_strlcpy(varname, _("net.inet.tcp.pcblist"), sizeof(varname));
682	break;
683	case IPPROTO_UDP:
684	sl_strlcpy(varname, _("net.inet.udp.pcblist"), sizeof(varname));
685	break;
686	case IPPROTO_DIVERT:
687	sl_strlcpy(varname, _("net.inet.divert.pcblist"), sizeof(varname));
688	break;
689	default:
690	return;
691	}
692
693	buf = NULL;
694	bufsize = 8192;
695	bufsize0 = bufsize;
696	retry = 5;
697	do {
698	for (;;) {
699	buf = xrealloc(buf, bufsize0, bufsize);
700	bufsize0 = bufsize;
701	len = bufsize;
702	if (sysctlbyname(varname, buf, &len, NULL, 0) == 0)
703	break;
704	if (errno == ENOENT)
705	goto out;
706	if (errno != ENOMEM)
707	{
708	SH_MUTEX_LOCK(mutex_thread_nolog);
709	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__,
710	0, MSG_E_SUBGEN,
711	_("sysctlbyname()"),
712	_("gather_inet"));
713	SH_MUTEX_UNLOCK(mutex_thread_nolog);
714	SH_FREE(buf);
715	return;
716	}
717	bufsize *= 2;
718	}
719	xig = (struct xinpgen *)buf;
720	exig = (struct xinpgen )(void )
721	((char )buf + len - sizeof exig);
722	if (xig->xig_len != sizeof *xig \|\|
723	exig->xig_len != sizeof *exig)
724	{
725	SH_MUTEX_LOCK(mutex_thread_nolog);
726	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
727	_("struct xinpgen size mismatch"),
728	_("gather_inet"));
729	SH_MUTEX_UNLOCK(mutex_thread_nolog);
730	goto out;
731	}
732
733	} while (xig->xig_gen != exig->xig_gen && retry--);
734
735	if (xig->xig_gen != exig->xig_gen && opt_v)
736	{
737	SH_MUTEX_LOCK(mutex_thread_nolog);
738	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
739	_("data may be inconsistent"),
740	_("gather_inet"));
741	SH_MUTEX_UNLOCK(mutex_thread_nolog);
742	}
743
744	for (;;) {
745	xig = (struct xinpgen )(void )((char *)xig + xig->xig_len);
746	if (xig >= exig)
747	break;
748	switch (proto) {
749	case IPPROTO_TCP:
750	xtp = (struct xtcpcb *)xig;
751	if (xtp->xt_len != sizeof *xtp) {
752	SH_MUTEX_LOCK(mutex_thread_nolog);
753	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
754	_("struct xtcpcb size mismatch"),
755	_("gather_inet"));
756	SH_MUTEX_UNLOCK(mutex_thread_nolog);
757	goto out;
758	}
759	inp = &xtp->xt_inp;
760	so = &xtp->xt_socket;
761	break;
762	case IPPROTO_UDP:
763	case IPPROTO_DIVERT:
764	xip = (struct xinpcb *)xig;
765	if (xip->xi_len != sizeof *xip) {
766	SH_MUTEX_LOCK(mutex_thread_nolog);
767	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
768	_("struct xinpcb size mismatch"),
769	_("gather_inet"));
770	SH_MUTEX_UNLOCK(mutex_thread_nolog);
771	goto out;
772	}
773	inp = &xip->xi_inp;
774	so = &xip->xi_socket;
775	break;
776	default:
777	return;
778	}
779	if ((inp->inp_vflag & vflag) == 0)
780	continue;
781	if (inp->inp_vflag & INP_IPV4) {
782	if ((inp->inp_fport == 0 && !opt_l) \|\|
783	(inp->inp_fport != 0 && !opt_c))
784	continue;
785	} else if (inp->inp_vflag & INP_IPV6) {
786	if ((inp->in6p_fport == 0 && !opt_l) \|\|
787	(inp->in6p_fport != 0 && !opt_c))
788	continue;
789	} else {
790	if (opt_v) {
791	char errmsg[64];
792	sl_snprintf(errmsg, sizeof(errmsg),
793	_("invalid vflag 0x%x"), inp->inp_vflag);
794	SH_MUTEX_LOCK(mutex_thread_nolog);
795	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
796	errmsg,
797	_("gather_inet"));
798	SH_MUTEX_UNLOCK(mutex_thread_nolog);
799	continue;
800	}
801	}
802
803	sock = SH_ALLOC(sizeof *sock);
804	memset(sock, '\0', sizeof (*sock));
805
806	sock->socket = so->xso_so;
807	sock->proto = proto;
808	if (inp->inp_vflag & INP_IPV4) {
809	sock->family = AF_INET;
810	sockaddr(&sock->laddr, sock->family,
811	&inp->inp_laddr, inp->inp_lport);
812	sockaddr(&sock->faddr, sock->family,
813	&inp->inp_faddr, inp->inp_fport);
814	} else if (inp->inp_vflag & INP_IPV6) {
815	sock->family = AF_INET6;
816	sockaddr(&sock->laddr, sock->family,
817	&inp->in6p_laddr, inp->in6p_lport);
818	sockaddr(&sock->faddr, sock->family,
819	&inp->in6p_faddr, inp->in6p_fport);
820	}
821	sock->vflag = inp->inp_vflag;
822
823	hash = (int)((uintptr_t)sock->socket % HASHSIZE);
824	sock->next = sockhash[hash];
825	sockhash[hash] = sock;
826	}
827	out:
828	if (buf)
829	SH_FREE(buf);
830	}
831
832	static void
833	getfiles(void)
834	{
835	size_t len;
836	size_t len0;
837
838	xfiles = SH_ALLOC(len = sizeof *xfiles);
839	len0 = len;
840
841	while (sysctlbyname(_("kern.file"), xfiles, &len, 0, 0) == -1) {
842	if (errno != ENOMEM)
843	{
844	volatile int status = errno;
845	SH_MUTEX_LOCK(mutex_thread_nolog);
846	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
847	_("sysctlbyname()"),
848	_("getfiles"));
849	SH_MUTEX_UNLOCK(mutex_thread_nolog);
850	}
851	len *= 2;
852	xfiles = xrealloc(xfiles, len0, len);
853	len0 = len;
854	}
855	if (len > 0 && xfiles->xf_size != sizeof *xfiles)
856	if (errno != ENOMEM)
857	{
858	volatile int status = errno;
859	SH_MUTEX_LOCK(mutex_thread_nolog);
860	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
861	_("struct xfile size mismatch"),
862	_("getfiles"));
863	SH_MUTEX_UNLOCK(mutex_thread_nolog);
864	}
865	nxfiles = len / sizeof *xfiles;
866	}
867
868	static const char *
869	getprocname(pid_t pid)
870	{
871	static struct kinfo_proc proc;
872	size_t len;
873	int mib[4];
874
875	mib[0] = CTL_KERN;
876	mib[1] = KERN_PROC;
877	mib[2] = KERN_PROC_PID;
878	mib[3] = (int)pid;
879	len = sizeof proc;
880	if (sysctl(mib, 4, &proc, &len, NULL, 0) == -1) {
881	/* Do not warn if the process exits before we get its name. */
882	if (errno != ESRCH)
883	{
884	volatile int status = errno;
885	SH_MUTEX_LOCK(mutex_thread_nolog);
886	sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, status, MSG_E_SUBGEN,
887	_("sysctl()"),
888	_("getfiles"));
889	SH_MUTEX_UNLOCK(mutex_thread_nolog);
890	}
891	return ("-");
892	}
893	return (proc.ki_ocomm);
894	}
895
896	char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
897	unsigned long * pid, char * user, size_t userlen)
898	{
899	int n, hash;
900	struct xfile *xf;
901	struct in_addr * haddr;
902	struct in6_addr * haddr6;
903	struct sock * s;
904	struct in6_addr anyaddr = IN6ADDR_ANY_INIT;
905
906	*pid = 0;
907
908	for (xf = xfiles, n = 0; n < nxfiles; ++n, ++xf) {
909
910	if (xf->xf_data == NULL)
911	continue;
912
913	/* Find the socket in sockhash[] that corresponds to it
914	*/
915	hash = (int)((uintptr_t)xf->xf_data % HASHSIZE);
916	for (s = sockhash[hash]; s != NULL; s = s->next)
917	if ((void *)s->socket == xf->xf_data)
918	break;
919
920	if (!s)
921	continue;
922
923	/* fprintf(stderr, "FIXME: %d %d, %d %d, %d %d, %d, %d\n", s->proto, proto,
924	s->family, AF_INET,
925	sport, ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port),
926	(int) xf->xf_uid, (int)xf->xf_pid);
927	*/
928
929	if (s->proto != proto)
930	continue;
931
932	if (s->family != AF_INET && s->family != AF_INET6)
933	continue;
934
935	if (s->family == AF_INET &&
936	(sport != ntohs(((struct sockaddr_in *)(&s->laddr))->sin_port)))
937	continue;
938
939	if (s->family == AF_INET6 &&
940	(sport != ntohs(((struct sockaddr_in6 *)(&s->laddr))->sin6_port)))
941	continue;
942
943	if (s->family == AF_INET)
944	haddr = &((struct sockaddr_in *)(&s->laddr))->sin_addr;
945	if (s->family == AF_INET6)
946	haddr6 = &((struct sockaddr_in6 *)(&s->laddr))->sin6_addr;
947
948
949	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(haddr)); /
950	/* fprintf(stderr, "FIXME: %s\n", inet_ntoa(saddr)); /
951
952	if ( (s->family == AF_INET &&
953	(haddr->s_addr == (saddr->sin).sin_addr.s_addr \|\|
954	sh_ipvx_isany(saddr) \|\|
955	inet_lnaof(*haddr) == INADDR_ANY))
956	\|\|
957	(s->family == AF_INET6 &&
958	(0 == memcmp(haddr6->s6_addr, &((saddr->sin6).sin6_addr.s6_addr), 16) \|\|
959	0 == memcmp(haddr6->s6_addr, &(anyaddr.s6_addr), 16) \|\|
960	sh_ipvx_isany(saddr) ))
961	)
962	{
963	struct sock_store try;
964
965	*pid = xf->xf_pid;
966
967	try.pid = xf->xf_pid;
968	try.path = NULL;
969	try.user = NULL;
970	get_user_and_path (&try); /* Try to get info from /proc */
971
972	if (try.path == NULL)
973	{
974	extern char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
975	char * tmp = sh_unix_getUIDname (SH_ERR_ALL, xf->xf_uid, user, userlen);
976	if (!tmp)
977	sl_snprintf (user, userlen, "%ld", (unsigned long) xf->xf_uid);
978	return sh_util_strdup(getprocname(xf->xf_pid));
979	}
980	else
981	{
982	sl_strlcpy(user, try.user, userlen);
983	SH_FREE(try.user);
984	return try.path;
985	}
986	}
987	}
988	sl_strlcpy(user, "-", userlen);
989	return sh_util_strdup("-");
990	}
991
992	static void sockdel(struct sock * sock)
993	{
994	if (sock)
995	{
996	if (sock->next)
997	sockdel(sock->next);
998	SH_FREE(sock);
999	}
1000	return;
1001	}
1002
1003	int sh_port2proc_prepare()
1004	{
1005	int i;
1006
1007	if (xfiles)
1008	{
1009	SH_FREE(xfiles);
1010	xfiles = NULL;
1011	}
1012
1013	for (i = 0; i < HASHSIZE; ++i)
1014	{
1015	sockdel(sockhash[i]);
1016	sockhash[i] = NULL;
1017	}
1018
1019	/* Inet connections
1020	*/
1021	gather_inet(IPPROTO_TCP);
1022	gather_inet(IPPROTO_UDP);
1023	gather_inet(IPPROTO_DIVERT);
1024
1025	getfiles();
1026
1027	return 0;
1028	}
1029
1030	void sh_port2proc_finish()
1031	{
1032	return;
1033	}
1034
1035	#else /* !defined(__linux__) && !defined(__FreeBSD__) */
1036
1037	#include "samhain.h"
1038	#include "sh_utils.h"
1039	#include "sh_ipvx.h"
1040
1041	char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
1042	unsigned long * pid, char * user, size_t userlen)
1043	{
1044	(void) proto;
1045	(void) saddr;
1046	(void) sport;
1047
1048	*pid = 0;
1049
1050	sl_strlcpy(user, "-", userlen);
1051	return sh_util_strdup("-");
1052	}
1053
1054	int sh_port2proc_prepare()
1055	{
1056	return 0;
1057	}
1058
1059	void sh_port2proc_finish()
1060	{
1061	return;
1062	}
1063	#endif
1064
1065	#endif /* defined(SH_USE_PORTCHECK) */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: