X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/yaid/blobdiff_plain/77fb54ff2baf731d1431e0a9f187e4aacf52b2f7..c372d20ef78322f5cd59ddbff44fa41156d851d5:/linux.c diff --git a/linux.c b/linux.c index b0db5f1..571b179 100644 --- a/linux.c +++ b/linux.c @@ -28,23 +28,45 @@ #include "yaid.h" +#include +#include + /*----- Static variables --------------------------------------------------*/ -static FILE *natfp; +static FILE *natfp; /* File handle for NAT table */ +static int randfd; /* File descriptor for random data */ + +/*----- Miscellaneous system services -------------------------------------*/ + +/* Fill the buffer at P with SZ random bytes. The buffer will be moderately + * large: this is intended to be a low-level interface, not a general-purpose + * utility. + */ +void fill_random(void *p, size_t sz) +{ + ssize_t n; + + n = read(randfd, p, sz); + if (n < 0) fatal("error reading `/dev/urandom': %s", strerror(errno)); + else if (n < sz) fatal("unexpected short read from `/dev/urandom'"); +} /*----- Address-type operations -------------------------------------------*/ struct addrops_sys { const char *procfile; + const char *nfl3name; int (*parseaddr)(char **, union addr *); }; #define PROCFILE_IPV4 "/proc/net/tcp" +#define NFL3NAME_IPV4 "ipv4" static int parseaddr_ipv4(char **pp, union addr *a) { a->ipv4.s_addr = strtoul(*pp, pp, 16); return (0); } #define PROCFILE_IPV6 "/proc/net/tcp6" +#define NFL3NAME_IPV6 "ipv6" static int parseaddr_ipv6(char **pp, union addr *a) { @@ -53,12 +75,13 @@ static int parseaddr_ipv6(char **pp, union addr *a) char *p = *pp; unsigned x; + /* The format is byteswapped in a really annoying way. */ for (i = 0; i < 4; i++) { y = 0; for (j = 0; j < 8; j++) { if ('0' <= *p && *p <= '9') x = *p - '0'; - else if ('a' <= *p && *p <= 'f') x = *p - 'a'+ 10; - else if ('A' <= *p && *p <= 'F') x = *p - 'A'+ 10; + else if ('a' <= *p && *p <= 'f') x = *p - 'a' + 10; + else if ('A' <= *p && *p <= 'F') x = *p - 'A' + 10; else return (-1); y = (y << 4) | x; p++; @@ -71,13 +94,16 @@ static int parseaddr_ipv6(char **pp, union addr *a) #define DEFOPSYS(ty, TY) \ const struct addrops_sys addrops_sys_##ty = { \ - PROCFILE_##TY, parseaddr_##ty \ + PROCFILE_##TY, NFL3NAME_##TY, parseaddr_##ty \ }; ADDRTYPES(DEFOPSYS) #undef DEFOPSYS /*----- Main code ---------------------------------------------------------*/ +/* Store in A the default gateway address for the given address family. + * Return zero on success, or nonzero on error. + */ static int get_default_gw(int af, union addr *a) { int fd; @@ -87,12 +113,16 @@ static int get_default_gw(int af, union addr *a) const struct rtattr *rta; const struct rtmsg *rtm; ssize_t n, nn; - int rc = 0; + int rc = -1; static unsigned long seq = 0x48b4aec4; + /* Open a netlink socket for interrogating the kernel. */ if ((fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE)) < 0) - die(1, "failed to create netlink socket: %s", strerror(errno)); + fatal("failed to create netlink socket: %s", strerror(errno)); + /* We want to read the routing table. There doesn't seem to be a good way + * to do this without just crawling through the whole thing. + */ nlmsg = (struct nlmsghdr *)buf; assert(NLMSG_SPACE(sizeof(*rtgen)) < sizeof(buf)); nlmsg->nlmsg_len = NLMSG_LENGTH(sizeof(*rtgen)); @@ -105,34 +135,51 @@ static int get_default_gw(int af, union addr *a) rtgen->rtgen_family = af; if (write(fd, nlmsg, nlmsg->nlmsg_len) < 0) - die(1, "failed to send RTM_GETROUTE request: %s", strerror(errno)); + fatal("failed to send RTM_GETROUTE request: %s", strerror(errno)); + /* Now we try to parse the answer. */ for (;;) { + + /* Not finished yet, so read another chunk of answer. */ if ((n = read(fd, buf, sizeof(buf))) < 0) - die(1, "failed to read RTM_GETROUTE response: %s", strerror(errno)); + fatal("failed to read RTM_GETROUTE response: %s", strerror(errno)); + + /* Start at the beginning of the response. */ nlmsg = (struct nlmsghdr *)buf; + + /* Make sure this looks plausible. The precise rules don't appear to be + * documented, so it seems advisable to fail messily if my understanding + * is wrong. + */ if (nlmsg->nlmsg_seq != seq) continue; assert(nlmsg->nlmsg_flags & NLM_F_MULTI); + /* Work through all of the individual routes. */ for (; NLMSG_OK(nlmsg, n); nlmsg = NLMSG_NEXT(nlmsg, n)) { if (nlmsg->nlmsg_type == NLMSG_DONE) goto done; if (nlmsg->nlmsg_type != RTM_NEWROUTE) continue; rtm = (const struct rtmsg *)NLMSG_DATA(nlmsg); - if (rtm->rtm_family != af || - rtm->rtm_dst_len > 0 || - rtm->rtm_src_len > 0 || - rtm->rtm_type != RTN_UNICAST || - rtm->rtm_scope != RT_SCOPE_UNIVERSE || - rtm->rtm_tos != 0) + /* If this record doesn't look interesting then skip it. */ + if (rtm->rtm_family != af || /* wrong address family */ + rtm->rtm_dst_len > 0 || /* specific destination */ + rtm->rtm_src_len > 0 || /* specific source */ + rtm->rtm_type != RTN_UNICAST || /* not for unicast */ + rtm->rtm_scope != RT_SCOPE_UNIVERSE || /* wrong scope */ + rtm->rtm_tos != 0) /* specific type of service */ continue; + /* Trundle through the attributes and find the gateway address. */ for (rta = RTM_RTA(rtm), nn = RTM_PAYLOAD(nlmsg); RTA_OK(rta, nn); rta = RTA_NEXT(rta, nn)) { + + /* Got one. We're all done. Except that we should carry on reading + * to the end, or something bad will happen. + */ if (rta->rta_type == RTA_GATEWAY) { assert(RTA_PAYLOAD(rta) <= sizeof(*a)); memcpy(a, RTA_DATA(rta), RTA_PAYLOAD(rta)); - rc = 1; + rc = 0; } } } @@ -143,6 +190,10 @@ done: return (rc); } +/* Find out who is responsible for the connection described in the query Q. + * Write the answer to Q. Errors are logged and reported via the query + * structure. + */ void identify(struct query *q) { FILE *fp = 0; @@ -162,22 +213,32 @@ void identify(struct query *q) enum { LOC, REM, ST, UID, NFIELD }; int f, ff[NFIELD]; - if (get_default_gw(q->ao->af, &s[0].addr) && + /* If we have a default gateway, and it matches the remote address then + * this may be a proxy connection from our NAT, so remember this, and don't + * inspect the remote addresses in the TCP tables. + */ + if (!get_default_gw(q->ao->af, &s[0].addr) && q->ao->addreq(&s[0].addr, &q->s[R].addr)) gwp = 1; + /* Open the relevant TCP connection table. */ if ((fp = fopen(q->ao->sys->procfile, "r")) == 0) { logmsg(q, LOG_ERR, "failed to open `%s' for reading: %s", q->ao->sys->procfile, strerror(errno)); goto err_unk; } + /* Initially, PP points into a string containing whitespace-separated + * fields. Point P to the next field, null-terminate it, and advance PP + * so that we can read the next field in the next call. + */ #define NEXTFIELD do { \ for (p = pp; isspace((unsigned char)*p); p++); \ for (pp = p; *pp && !isspace((unsigned char)*pp); pp++); \ if (*pp) *pp++ = 0; \ } while (0) + /* Read the header line from the file. */ if (dstr_putline(&d, fp) == EOF) { logmsg(q, LOG_ERR, "failed to read header line from `%s': %s", q->ao->sys->procfile, @@ -185,6 +246,13 @@ void identify(struct query *q) goto err_unk; } + /* Now scan the header line to identify which columns the various + * interesting fields are in. Store these in the map `ff'. Problems: + * `tx_queue rx_queue' and `tr tm->when' are both really single columns in + * disguise; and the remote address column has a different heading + * depending on which address family we're using. Rather than dispatch, + * just recognize both of them. + */ for (i = 0; i < NFIELD; i++) ff[i] = -1; pp = d.buf; for (f = 0;; f++) { @@ -202,6 +270,8 @@ void identify(struct query *q) strcmp(p, "tm->when") == 0) f--; } + + /* Make sure that we found all of the fields we actually want. */ for (i = 0; i < NFIELD; i++) { if (ff[i] < 0) { logmsg(q, LOG_ERR, "failed to find required fields in `%s'", @@ -210,11 +280,20 @@ void identify(struct query *q) } } + /* Work through the lines in the file. */ for (;;) { + + /* Read a line, and prepare to scan the fields. */ DRESET(&d); if (dstr_putline(&d, fp) == EOF) break; pp = d.buf; uid = -1; + + /* Work through the fields. If an address field fails to match then we + * skip this record. If the state field isn't 1 (`ESTABLISHED') then + * skip the record. If it's the UID, then remember it: if we get all the + * way to the end then we've won. + */ for (f = 0;; f++) { NEXTFIELD; if (!*p) break; if (f == ff[LOC]) { i = L; goto compare; } @@ -226,36 +305,72 @@ void identify(struct query *q) continue; compare: - if (q->ao->sys->parseaddr(&p, &s[0].addr)) goto next_row; + /* Compare an address (in the current field) with the local or remote + * address in the query, as indicated by `i'. The address field looks + * like `ADDR:PORT', where the ADDR is in some mad format which + * `sys->parseaddr' knows how to unpick. If the remote address in the + * query is our gateway then don't check the remote address in the + * field (but do check the port number). + */ + if (q->ao->sys->parseaddr(&p, &s[i].addr)) goto next_row; if (*p != ':') break; p++; - s[0].port = strtoul(p, 0, 16); - if (!sockeq(q->ao, &q->s[i], &s[0]) && - (i != R || !gwp || q->s[R].port != s[0].port)) + s[i].port = strtoul(p, 0, 16); + if ((i == R && gwp) ? + q->s[R].port != s[i].port : + !sockeq(q->ao, &q->s[i], &s[i])) goto next_row; } + + /* We got to the end, and everything matched. If we found a UID then + * we're done. If the apparent remote address is our gateway then copy + * the true one into the query structure. + */ if (uid != -1) { q->resp = R_UID; q->u.uid = uid; + if (gwp) q->s[R].addr = s[i].addr; goto done; } next_row:; } + /* We got to the end of the file and didn't find anything. */ if (ferror(fp)) { logmsg(q, LOG_ERR, "failed to read connection table `%s': %s", q->ao->sys->procfile, strerror(errno)); goto err_unk; } - if (natfp && q->ao->af == AF_INET) { + /* If we opened the NAT table file, and we're using IPv4, then check to see + * whether we should proxy the connection. At least the addresses in this + * file aren't crazy. + */ + if (natfp) { + + /* Start again from the beginning. */ rewind(natfp); + /* Read a line at a time. */ for (;;) { + + /* Read the line. */ DRESET(&d); if (dstr_putline(&d, natfp) == EOF) break; pp = d.buf; + + /* Check that this is for the right protocol. */ + NEXTFIELD; if (!*p) break; + if (strcmp(p, q->ao->sys->nfl3name)) continue; + NEXTFIELD; if (!*p) break; NEXTFIELD; if (!*p) break; if (strcmp(p, "tcp") != 0) continue; + + /* Parse the other fields. Each line has two src/dst pairs, for the + * outgoing and incoming directions. Depending on exactly what kind of + * NAT is in use, either the outgoing source or the incoming + * destination might be the client we're after. Collect all of the + * addresses and sort out the mess later. + */ i = 0; fl = 0; for (;;) { @@ -263,10 +378,10 @@ void identify(struct query *q) if (strcmp(p, "ESTABLISHED") == 0) fl |= F_ESTAB; else if (strncmp(p, "src=", 4) == 0) { - inet_pton(AF_INET, p + 4, &s[i].addr); + inet_pton(q->ao->af, p + 4, &s[i].addr); fl |= F_SADDR; } else if (strncmp(p, "dst=", 4) == 0) { - inet_pton(AF_INET, p + 4, &s[i + 1].addr); + inet_pton(q->ao->af, p + 4, &s[i + 1].addr); fl |= F_DADDR; } else if (strncmp(p, "sport=", 6) == 0) { s[i].port = atoi(p + 6); @@ -282,8 +397,9 @@ void identify(struct query *q) } } -#ifdef notdef +#ifdef DEBUG { + /* Print the record we found. */ dstr dd = DSTR_INIT; dstr_putf(&dd, "%sestab ", (fl & F_ESTAB) ? " " : "!"); dputsock(&dd, q->ao, &s[0]); @@ -298,23 +414,36 @@ void identify(struct query *q) } #endif + /* If the connection isn't ESTABLISHED then skip it. */ if (!(fl & F_ESTAB)) continue; + /* Now we try to piece together what's going on. One of these + * addresses will be us. So let's just try to find it. + */ for (i = 0; i < 4; i++) if (sockeq(q->ao, &s[i], &q->s[L])) goto found_local; continue; - putchar('.'); + found_local: + /* So address `i' is us. In that case, we expect the other address in + * the same direction, and the same address in the opposite direction, + * to match each other and be the remote address in the query. + */ if (!sockeq(q->ao, &s[i^1], &s[i^2]) || !sockeq(q->ao, &s[i^1], &q->s[R])) continue; + + /* We win. The remaining address must be the client host. We should + * proxy this query. + */ q->resp = R_NAT; q->u.nat = s[i^3]; goto done; } + /* Reached the end of the NAT file. */ if (ferror(natfp)) { - logmsg(q, LOG_ERR, "failed to read `/proc/net/ip_conntrack': %s", + logmsg(q, LOG_ERR, "failed to read `/proc/net/nf_conntrack': %s", strerror(errno)); goto err_unk; } @@ -322,23 +451,38 @@ void identify(struct query *q) #undef NEXTFIELD + /* We didn't find a match anywhere. How unfortunate. */ logmsg(q, LOG_NOTICE, "connection not found"); q->resp = R_ERROR; q->u.error = E_NOUSER; goto done; + err_unk: + /* Something went wrong and the protocol can't express what. We should + * have logged what the problem actually was. + */ q->resp = R_ERROR; q->u.error = E_UNKNOWN; + done: + /* All done. */ dstr_destroy(&d); if (fp) fclose(fp); } +/* Initialize the system-specific code. */ void init_sys(void) { - if ((natfp = fopen("/proc/net/ip_conntrack", "r")) == 0 && + /* Open the NAT connection map. */ + if ((natfp = fopen("/proc/net/nf_conntrack", "r")) == 0 && errno != ENOENT) { - die(1, "failed to open `/proc/net/ip_conntrack' for reading: %s", + die(1, "failed to open `/proc/net/nf_conntrack' for reading: %s", + strerror(errno)); + } + + /* Open the random data source. */ + if ((randfd = open("/dev/urandom", O_RDONLY)) < 0) { + die(1, "failed to open `/dev/urandom' for reading: %s", strerror(errno)); } }