/* * Copyright (c) 2014 Zubin Mithra <zubin.mithra@gmail.com> * Copyright (c) 2014-2016 Dmitry V. Levin <ldv@altlinux.org> * Copyright (c) 2014-2018 The strace developers. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "defs.h" #include <netinet/in.h> #include <sys/socket.h> #include <arpa/inet.h> #include "netlink.h" #include <linux/sock_diag.h> #include <linux/inet_diag.h> #include <linux/unix_diag.h> #include <linux/netlink_diag.h> #include <linux/rtnetlink.h> #if HAVE_LINUX_GENETLINK_H #include <linux/genetlink.h> #endif #include <sys/un.h> #ifndef UNIX_PATH_MAX # define UNIX_PATH_MAX sizeof(((struct sockaddr_un *) 0)->sun_path) #endif #include "xstring.h" typedef struct { unsigned long inode; char *details; } cache_entry; #define CACHE_SIZE 1024U static cache_entry cache[CACHE_SIZE]; #define CACHE_MASK (CACHE_SIZE - 1) static int cache_inode_details(const unsigned long inode, char *const details) { cache_entry *e = &cache[inode & CACHE_MASK]; free(e->details); e->inode = inode; e->details = details; return 1; } static const char * get_sockaddr_by_inode_cached(const unsigned long inode) { const cache_entry *const e = &cache[inode & CACHE_MASK]; return (e && inode == e->inode) ? e->details : NULL; } static bool print_sockaddr_by_inode_cached(const unsigned long inode) { const char *const details = get_sockaddr_by_inode_cached(inode); if (details) { tprints(details); return true; } return false; } static bool send_query(struct tcb *tcp, const int fd, void *req, size_t req_size) { struct sockaddr_nl nladdr = { .nl_family = AF_NETLINK }; struct iovec iov = { .iov_base = req, .iov_len = req_size }; const struct msghdr msg = { .msg_name = &nladdr, .msg_namelen = sizeof(nladdr), .msg_iov = &iov, .msg_iovlen = 1 }; for (;;) { if (sendmsg(fd, &msg, 0) < 0) { if (errno == EINTR) continue; return false; } return true; } } static bool inet_send_query(struct tcb *tcp, const int fd, const int family, const int proto) { struct { const struct nlmsghdr nlh; const struct inet_diag_req_v2 idr; } req = { .nlh = { .nlmsg_len = sizeof(req), .nlmsg_type = SOCK_DIAG_BY_FAMILY, .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST }, .idr = { .sdiag_family = family, .sdiag_protocol = proto, .idiag_states = -1 } }; return send_query(tcp, fd, &req, sizeof(req)); } static int inet_parse_response(const void *const data, const int data_len, const unsigned long inode, void *opaque_data) { const char *const proto_name = opaque_data; const struct inet_diag_msg *const diag_msg = data; static const char zero_addr[sizeof(struct in6_addr)]; socklen_t addr_size, text_size; if (data_len < (int) NLMSG_LENGTH(sizeof(*diag_msg))) return -1; if (diag_msg->idiag_inode != inode) return 0; switch (diag_msg->idiag_family) { case AF_INET: addr_size = sizeof(struct in_addr); text_size = INET_ADDRSTRLEN; break; case AF_INET6: addr_size = sizeof(struct in6_addr); text_size = INET6_ADDRSTRLEN; break; default: return -1; } char src_buf[text_size]; char *details; if (!inet_ntop(diag_msg->idiag_family, diag_msg->id.idiag_src, src_buf, text_size)) return -1; if (diag_msg->id.idiag_dport || memcmp(zero_addr, diag_msg->id.idiag_dst, addr_size)) { char dst_buf[text_size]; if (!inet_ntop(diag_msg->idiag_family, diag_msg->id.idiag_dst, dst_buf, text_size)) return -1; if (asprintf(&details, "%s:[%s:%u->%s:%u]", proto_name, src_buf, ntohs(diag_msg->id.idiag_sport), dst_buf, ntohs(diag_msg->id.idiag_dport)) < 0) return false; } else { if (asprintf(&details, "%s:[%s:%u]", proto_name, src_buf, ntohs(diag_msg->id.idiag_sport)) < 0) return false; } return cache_inode_details(inode, details); } static bool receive_responses(struct tcb *tcp, const int fd, const unsigned long inode, const unsigned long expected_msg_type, int (*parser)(const void *, int, unsigned long, void *), void *opaque_data) { static union { struct nlmsghdr hdr; long buf[8192 / sizeof(long)]; } hdr_buf; struct sockaddr_nl nladdr = { .nl_family = AF_NETLINK }; struct iovec iov = { .iov_base = hdr_buf.buf, .iov_len = sizeof(hdr_buf.buf) }; int flags = 0; for (;;) { struct msghdr msg = { .msg_name = &nladdr, .msg_namelen = sizeof(nladdr), .msg_iov = &iov, .msg_iovlen = 1 }; ssize_t ret = recvmsg(fd, &msg, flags); if (ret < 0) { if (errno == EINTR) continue; return false; } const struct nlmsghdr *h = &hdr_buf.hdr; if (!NLMSG_OK(h, ret)) return false; for (; NLMSG_OK(h, ret); h = NLMSG_NEXT(h, ret)) { if (h->nlmsg_type != expected_msg_type) return false; const int rc = parser(NLMSG_DATA(h), h->nlmsg_len, inode, opaque_data); if (rc > 0) return true; if (rc < 0) return false; } flags = MSG_DONTWAIT; } } static bool unix_send_query(struct tcb *tcp, const int fd, const unsigned long inode) { struct { const struct nlmsghdr nlh; const struct unix_diag_req udr; } req = { .nlh = { .nlmsg_len = sizeof(req), .nlmsg_type = SOCK_DIAG_BY_FAMILY, .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST }, .udr = { .sdiag_family = AF_UNIX, .udiag_ino = inode, .udiag_states = -1, .udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER } }; return send_query(tcp, fd, &req, sizeof(req)); } static int unix_parse_response(const void *data, const int data_len, const unsigned long inode, void *opaque_data) { const char *proto_name = opaque_data; const struct unix_diag_msg *diag_msg = data; struct rtattr *attr; int rta_len = data_len - NLMSG_LENGTH(sizeof(*diag_msg)); uint32_t peer = 0; size_t path_len = 0; char path[UNIX_PATH_MAX + 1]; if (rta_len < 0) return -1; if (diag_msg->udiag_ino != inode) return 0; if (diag_msg->udiag_family != AF_UNIX) return -1; for (attr = (struct rtattr *) (diag_msg + 1); RTA_OK(attr, rta_len); attr = RTA_NEXT(attr, rta_len)) { switch (attr->rta_type) { case UNIX_DIAG_NAME: if (!path_len) { path_len = RTA_PAYLOAD(attr); if (path_len > UNIX_PATH_MAX) path_len = UNIX_PATH_MAX; memcpy(path, RTA_DATA(attr), path_len); path[path_len] = '\0'; } break; case UNIX_DIAG_PEER: if (RTA_PAYLOAD(attr) >= 4) peer = *(uint32_t *) RTA_DATA(attr); break; } } /* * print obtained information in the following format: * "UNIX:[" SELF_INODE [ "->" PEER_INODE ][ "," SOCKET_FILE ] "]" */ if (!peer && !path_len) return -1; char peer_str[3 + sizeof(peer) * 3]; if (peer) xsprintf(peer_str, "->%u", peer); else peer_str[0] = '\0'; const char *path_str; if (path_len) { char *outstr = alloca(4 * path_len + 4); outstr[0] = ','; if (path[0] == '\0') { outstr[1] = '@'; string_quote(path + 1, outstr + 2, path_len - 1, QUOTE_0_TERMINATED); } else { string_quote(path, outstr + 1, path_len, QUOTE_0_TERMINATED); } path_str = outstr; } else { path_str = ""; } char *details; if (asprintf(&details, "%s:[%lu%s%s]", proto_name, inode, peer_str, path_str) < 0) return -1; return cache_inode_details(inode, details); } static bool netlink_send_query(struct tcb *tcp, const int fd, const unsigned long inode) { struct { const struct nlmsghdr nlh; const struct netlink_diag_req ndr; } req = { .nlh = { .nlmsg_len = sizeof(req), .nlmsg_type = SOCK_DIAG_BY_FAMILY, .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST }, .ndr = { .sdiag_family = AF_NETLINK, .sdiag_protocol = NDIAG_PROTO_ALL, .ndiag_show = NDIAG_SHOW_MEMINFO } }; return send_query(tcp, fd, &req, sizeof(req)); } static int netlink_parse_response(const void *data, const int data_len, const unsigned long inode, void *opaque_data) { const char *proto_name = opaque_data; const struct netlink_diag_msg *const diag_msg = data; const char *netlink_proto; char *details; if (data_len < (int) NLMSG_LENGTH(sizeof(*diag_msg))) return -1; if (diag_msg->ndiag_ino != inode) return 0; if (diag_msg->ndiag_family != AF_NETLINK) return -1; netlink_proto = xlookup(netlink_protocols, diag_msg->ndiag_protocol); if (netlink_proto) { netlink_proto = STR_STRIP_PREFIX(netlink_proto, "NETLINK_"); if (asprintf(&details, "%s:[%s:%u]", proto_name, netlink_proto, diag_msg->ndiag_portid) < 0) return -1; } else { if (asprintf(&details, "%s:[%u]", proto_name, (unsigned) diag_msg->ndiag_protocol) < 0) return -1; } return cache_inode_details(inode, details); } static const char * unix_get(struct tcb *tcp, const int fd, const unsigned long inode) { return unix_send_query(tcp, fd, inode) && receive_responses(tcp, fd, inode, SOCK_DIAG_BY_FAMILY, unix_parse_response, (void *) "UNIX") ? get_sockaddr_by_inode_cached(inode) : NULL; } static const char * inet_get(struct tcb *tcp, const int fd, const int family, const int protocol, const unsigned long inode, const char *proto_name) { return inet_send_query(tcp, fd, family, protocol) && receive_responses(tcp, fd, inode, SOCK_DIAG_BY_FAMILY, inet_parse_response, (void *) proto_name) ? get_sockaddr_by_inode_cached(inode) : NULL; } static const char * tcp_v4_get(struct tcb *tcp, const int fd, const unsigned long inode) { return inet_get(tcp, fd, AF_INET, IPPROTO_TCP, inode, "TCP"); } static const char * udp_v4_get(struct tcb *tcp, const int fd, const unsigned long inode) { return inet_get(tcp, fd, AF_INET, IPPROTO_UDP, inode, "UDP"); } static const char * tcp_v6_get(struct tcb *tcp, const int fd, const unsigned long inode) { return inet_get(tcp, fd, AF_INET6, IPPROTO_TCP, inode, "TCPv6"); } static const char * udp_v6_get(struct tcb *tcp, const int fd, const unsigned long inode) { return inet_get(tcp, fd, AF_INET6, IPPROTO_UDP, inode, "UDPv6"); } static const char * netlink_get(struct tcb *tcp, const int fd, const unsigned long inode) { return netlink_send_query(tcp, fd, inode) && receive_responses(tcp, fd, inode, SOCK_DIAG_BY_FAMILY, netlink_parse_response, (void *) "NETLINK") ? get_sockaddr_by_inode_cached(inode) : NULL; } static const struct { const char *const name; const char * (*const get)(struct tcb *, int, unsigned long); } protocols[] = { [SOCK_PROTO_UNIX] = { "UNIX", unix_get }, [SOCK_PROTO_TCP] = { "TCP", tcp_v4_get }, [SOCK_PROTO_UDP] = { "UDP", udp_v4_get }, [SOCK_PROTO_TCPv6] = { "TCPv6", tcp_v6_get }, [SOCK_PROTO_UDPv6] = { "UDPv6", udp_v6_get }, [SOCK_PROTO_NETLINK] = { "NETLINK", netlink_get } }; enum sock_proto get_proto_by_name(const char *const name) { unsigned int i; for (i = (unsigned int) SOCK_PROTO_UNKNOWN + 1; i < ARRAY_SIZE(protocols); ++i) { if (protocols[i].name && !strcmp(name, protocols[i].name)) return (enum sock_proto) i; } return SOCK_PROTO_UNKNOWN; } static const char * get_sockaddr_by_inode_uncached(struct tcb *tcp, const unsigned long inode, const enum sock_proto proto) { if ((unsigned int) proto >= ARRAY_SIZE(protocols) || (proto != SOCK_PROTO_UNKNOWN && !protocols[proto].get)) return NULL; const int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG); if (fd < 0) return NULL; const char *details = NULL; if (proto != SOCK_PROTO_UNKNOWN) { details = protocols[proto].get(tcp, fd, inode); } else { unsigned int i; for (i = (unsigned int) SOCK_PROTO_UNKNOWN + 1; i < ARRAY_SIZE(protocols); ++i) { if (!protocols[i].get) continue; details = protocols[i].get(tcp, fd, inode); if (details) break; } } close(fd); return details; } static bool print_sockaddr_by_inode_uncached(struct tcb *tcp, const unsigned long inode, const enum sock_proto proto) { const char *details = get_sockaddr_by_inode_uncached(tcp, inode, proto); if (details) { tprints(details); return true; } if ((unsigned int) proto < ARRAY_SIZE(protocols) && protocols[proto].name) { tprintf("%s:[%lu]", protocols[proto].name, inode); return true; } return false; } /* Given an inode number of a socket, return its protocol details. */ const char * get_sockaddr_by_inode(struct tcb *const tcp, const int fd, const unsigned long inode) { const char *details = get_sockaddr_by_inode_cached(inode); return details ? details : get_sockaddr_by_inode_uncached(tcp, inode, getfdproto(tcp, fd)); } /* Given an inode number of a socket, print out its protocol details. */ bool print_sockaddr_by_inode(struct tcb *const tcp, const int fd, const unsigned long inode) { return print_sockaddr_by_inode_cached(inode) ? true : print_sockaddr_by_inode_uncached(tcp, inode, getfdproto(tcp, fd)); } #ifdef HAVE_LINUX_GENETLINK_H /* * Managing the cache for decoding communications of Netlink GENERIC protocol * * As name shown Netlink GENERIC protocol is generic protocol. The * numbers of msg types used in the protocol are not defined * statically. Kernel defines them on demand. So the xlat converted * from header files doesn't help for decoding the protocol. Following * codes are building xlat(dyxlat) at runtime. */ static bool genl_send_dump_families(struct tcb *tcp, const int fd) { struct { const struct nlmsghdr nlh; struct genlmsghdr gnlh; } req = { .nlh = { .nlmsg_len = sizeof(req), .nlmsg_type = GENL_ID_CTRL, .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST, }, .gnlh = { .cmd = CTRL_CMD_GETFAMILY, } }; return send_query(tcp, fd, &req, sizeof(req)); } static int genl_parse_families_response(const void *const data, const int data_len, const unsigned long inode, void *opaque_data) { struct dyxlat *const dyxlat = opaque_data; const struct genlmsghdr *const gnlh = data; struct rtattr *attr; int rta_len = data_len - NLMSG_LENGTH(sizeof(*gnlh)); char *name = NULL; unsigned int name_len = 0; uint16_t *id = NULL; if (rta_len < 0) return -1; if (gnlh->cmd != CTRL_CMD_NEWFAMILY) return -1; if (gnlh->version != 2) return -1; for (attr = (struct rtattr *) (gnlh + 1); RTA_OK(attr, rta_len); attr = RTA_NEXT(attr, rta_len)) { switch (attr->rta_type) { case CTRL_ATTR_FAMILY_NAME: if (!name) { name = RTA_DATA(attr); name_len = RTA_PAYLOAD(attr); } break; case CTRL_ATTR_FAMILY_ID: if (!id && RTA_PAYLOAD(attr) == sizeof(*id)) id = RTA_DATA(attr); break; } if (name && id) { dyxlat_add_pair(dyxlat, *id, name, name_len); name = NULL; id = NULL; } } return 0; } const struct xlat * genl_families_xlat(struct tcb *tcp) { static struct dyxlat *dyxlat; if (!dyxlat) { dyxlat = dyxlat_alloc(32); int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (fd < 0) goto out; if (genl_send_dump_families(tcp, fd)) receive_responses(tcp, fd, 0, GENL_ID_CTRL, genl_parse_families_response, dyxlat); close(fd); } out: return dyxlat_get(dyxlat); } #else /* !HAVE_LINUX_GENETLINK_H */ const struct xlat * genl_families_xlat(struct tcb *tcp) { return NULL; } #endif