X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/yaid/blobdiff_plain/c3794524deb80d18c5b3be72a7572b34fad409a1..c372d20ef78322f5cd59ddbff44fa41156d851d5:/linux.c

diff --git a/linux.c b/linux.c
index d7d8475..571b179 100644
--- a/linux.c
+++ b/linux.c
@@ -34,6 +34,22 @@
 /*----- Static variables --------------------------------------------------*/
 
 static FILE *natfp;			/* File handle for NAT table */
+static int randfd;			/* File descriptor for random data */
+
+/*----- Miscellaneous system services -------------------------------------*/
+
+/* Fill the buffer at P with SZ random bytes.  The buffer will be moderately
+ * large: this is intended to be a low-level interface, not a general-purpose
+ * utility.
+ */
+void fill_random(void *p, size_t sz)
+{
+  ssize_t n;
+
+  n = read(randfd, p, sz);
+  if (n < 0) fatal("error reading `/dev/urandom': %s", strerror(errno));
+  else if (n < sz) fatal("unexpected short read from `/dev/urandom'");
+}
 
 /*----- Address-type operations -------------------------------------------*/
 
@@ -64,8 +80,8 @@ static int parseaddr_ipv6(char **pp, union addr *a)
     y = 0;
     for (j = 0; j < 8; j++) {
       if ('0' <= *p && *p <= '9') x = *p - '0';
-      else if ('a' <= *p && *p <= 'f') x = *p - 'a'+ 10;
-      else if ('A' <= *p && *p <= 'F') x = *p - 'A'+ 10;
+      else if ('a' <= *p && *p <= 'f') x = *p - 'a' + 10;
+      else if ('A' <= *p && *p <= 'F') x = *p - 'A' + 10;
       else return (-1);
       y = (y << 4) | x;
       p++;
@@ -97,12 +113,12 @@ static int get_default_gw(int af, union addr *a)
   const struct rtattr *rta;
   const struct rtmsg *rtm;
   ssize_t n, nn;
-  int rc = 0;
+  int rc = -1;
   static unsigned long seq = 0x48b4aec4;
 
   /* Open a netlink socket for interrogating the kernel. */
   if ((fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE)) < 0)
-    die(1, "failed to create netlink socket: %s", strerror(errno));
+    fatal("failed to create netlink socket: %s", strerror(errno));
 
   /* We want to read the routing table.  There doesn't seem to be a good way
    * to do this without just crawling through the whole thing.
@@ -119,14 +135,14 @@ static int get_default_gw(int af, union addr *a)
   rtgen->rtgen_family = af;
 
   if (write(fd, nlmsg, nlmsg->nlmsg_len) < 0)
-    die(1, "failed to send RTM_GETROUTE request: %s", strerror(errno));
+    fatal("failed to send RTM_GETROUTE request: %s", strerror(errno));
 
   /* Now we try to parse the answer. */
   for (;;) {
 
     /* Not finished yet, so read another chunk of answer. */
     if ((n = read(fd, buf, sizeof(buf))) < 0)
-      die(1, "failed to read RTM_GETROUTE response: %s", strerror(errno));
+      fatal("failed to read RTM_GETROUTE response: %s", strerror(errno));
 
     /* Start at the beginning of the response. */
     nlmsg = (struct nlmsghdr *)buf;
@@ -163,7 +179,7 @@ static int get_default_gw(int af, union addr *a)
 	if (rta->rta_type == RTA_GATEWAY) {
 	  assert(RTA_PAYLOAD(rta) <= sizeof(*a));
 	  memcpy(a, RTA_DATA(rta), RTA_PAYLOAD(rta));
-	  rc = 1;
+	  rc = 0;
 	}
       }
     }
@@ -201,7 +217,7 @@ void identify(struct query *q)
    * this may be a proxy connection from our NAT, so remember this, and don't
    * inspect the remote addresses in the TCP tables.
    */
-  if (get_default_gw(q->ao->af, &s[0].addr) &&
+  if (!get_default_gw(q->ao->af, &s[0].addr) &&
       q->ao->addreq(&s[0].addr, &q->s[R].addr))
     gwp = 1;
 
@@ -296,21 +312,23 @@ void identify(struct query *q)
        * query is our gateway then don't check the remote address in the
        * field (but do check the port number).
        */
-      if (q->ao->sys->parseaddr(&p, &s[0].addr)) goto next_row;
+      if (q->ao->sys->parseaddr(&p, &s[i].addr)) goto next_row;
       if (*p != ':') break; p++;
-      s[0].port = strtoul(p, 0, 16);
+      s[i].port = strtoul(p, 0, 16);
       if ((i == R && gwp) ?
-	    q->s[R].port != s[0].port :
-	    !sockeq(q->ao, &q->s[i], &s[0]))
+	    q->s[R].port != s[i].port :
+	    !sockeq(q->ao, &q->s[i], &s[i]))
 	goto next_row;
     }
 
     /* We got to the end, and everything matched.  If we found a UID then
-     * we're done.
+     * we're done.  If the apparent remote address is our gateway then copy
+     * the true one into the query structure.
      */
     if (uid != -1) {
       q->resp = R_UID;
       q->u.uid = uid;
+      if (gwp) q->s[R].addr = s[i].addr;
       goto done;
     }
   next_row:;
@@ -379,7 +397,7 @@ void identify(struct query *q)
 	}
       }
 
-#ifdef notdef
+#ifdef DEBUG
       {
 	/* Print the record we found. */
 	dstr dd = DSTR_INIT;
@@ -455,11 +473,18 @@ done:
 /* Initialize the system-specific code. */
 void init_sys(void)
 {
+  /* Open the NAT connection map. */
   if ((natfp = fopen("/proc/net/nf_conntrack", "r")) == 0 &&
       errno != ENOENT) {
     die(1, "failed to open `/proc/net/nf_conntrack' for reading: %s",
 	strerror(errno));
   }
+
+  /* Open the random data source. */
+  if ((randfd = open("/dev/urandom", O_RDONLY)) < 0) {
+    die(1, "failed to open `/dev/urandom' for reading: %s",
+	strerror(errno));
+  }
 }
 
 /*----- That's all, folks -------------------------------------------------*/