1 /*
2 * Copyright (c) 2014 Zubin Mithra <zubin.mithra@gmail.com>
3 * Copyright (c) 2014-2016 Dmitry V. Levin <ldv@strace.io>
4 * Copyright (c) 2014-2021 The strace developers.
5 * All rights reserved.
6 *
7 * SPDX-License-Identifier: LGPL-2.1-or-later
8 */
9
10 #include "defs.h"
11 #include <netinet/in.h>
12 #include <sys/socket.h>
13 #include <arpa/inet.h>
14 #include "netlink.h"
15 #include <linux/sock_diag.h>
16 #include <linux/inet_diag.h>
17 #include <linux/unix_diag.h>
18 #include <linux/netlink_diag.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/genetlink.h>
21
22 #include <sys/un.h>
23 #ifndef UNIX_PATH_MAX
24 # define UNIX_PATH_MAX sizeof_field(struct sockaddr_un, sun_path)
25 #endif
26
27 #include "xstring.h"
28
29 #define XLAT_MACROS_ONLY
30 #include "xlat/inet_protocols.h"
31 #undef XLAT_MACROS_ONLY
32
33 typedef struct {
34 unsigned long inode;
35 char *details;
36 } cache_entry;
37
38 #define CACHE_SIZE 1024U
39 static cache_entry cache[CACHE_SIZE];
40 #define CACHE_MASK (CACHE_SIZE - 1)
41
42 static int
43 cache_inode_details(const unsigned long inode, char *const details)
44 {
45 cache_entry *e = &cache[inode & CACHE_MASK];
46 free(e->details);
47 e->inode = inode;
48 e->details = details;
49
50 return 1;
51 }
52
53 static const char *
54 get_sockaddr_by_inode_cached(const unsigned long inode)
55 {
56 const cache_entry *const e = &cache[inode & CACHE_MASK];
57 return (e && inode == e->inode) ? e->details : NULL;
58 }
59
60 static bool
61 send_query(struct tcb *tcp, const int fd, void *req, size_t req_size)
62 {
63 struct sockaddr_nl nladdr = {
64 .nl_family = AF_NETLINK
65 };
66 struct iovec iov = {
67 .iov_base = req,
68 .iov_len = req_size
69 };
70 const struct msghdr msg = {
71 .msg_name = &nladdr,
72 .msg_namelen = sizeof(nladdr),
73 .msg_iov = &iov,
74 .msg_iovlen = 1
75 };
76
77 for (;;) {
78 if (sendmsg(fd, &msg, 0) < 0) {
79 if (errno == EINTR)
80 continue;
81 return false;
82 }
83 return true;
84 }
85 }
86
87 static bool
88 inet_send_query(struct tcb *tcp, const int fd, const int family,
89 const int proto)
90 {
91 struct {
92 const struct nlmsghdr nlh;
93 const struct inet_diag_req_v2 idr;
94 } req = {
95 .nlh = {
96 .nlmsg_len = sizeof(req),
97 .nlmsg_type = SOCK_DIAG_BY_FAMILY,
98 .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST
99 },
100 .idr = {
101 .sdiag_family = family,
102 .sdiag_protocol = proto,
103 .idiag_states = -1
104 }
105 };
106 return send_query(tcp, fd, &req, sizeof(req));
107 }
108
109 static int
110 inet_parse_response(const void *const data, const int data_len,
111 const unsigned long inode, void *opaque_data)
112 {
113 const char *const proto_name = opaque_data;
114 const struct inet_diag_msg *const diag_msg = data;
115 static const char zero_addr[sizeof(struct in6_addr)];
116 socklen_t addr_size, text_size;
117
118 if (data_len < (int) NLMSG_LENGTH(sizeof(*diag_msg)))
119 return -1;
120 if (diag_msg->idiag_inode != inode)
121 return 0;
122
123 switch (diag_msg->idiag_family) {
124 case AF_INET:
125 addr_size = sizeof(struct in_addr);
126 text_size = INET_ADDRSTRLEN;
127 break;
128 case AF_INET6:
129 addr_size = sizeof(struct in6_addr);
130 text_size = INET6_ADDRSTRLEN;
131 break;
132 default:
133 return -1;
134 }
135
136 char src_buf[text_size];
137 char *details;
138
139 /* open/closing brackets for IPv6 addresses */
140 const char *ob = diag_msg->idiag_family == AF_INET6 ? "[" : "";
141 const char *cb = diag_msg->idiag_family == AF_INET6 ? "]" : "";
142
143 if (!inet_ntop(diag_msg->idiag_family, diag_msg->id.idiag_src,
144 src_buf, text_size))
145 return -1;
146
147 if (diag_msg->id.idiag_dport ||
148 memcmp(zero_addr, diag_msg->id.idiag_dst, addr_size)) {
149 char dst_buf[text_size];
150
151 if (!inet_ntop(diag_msg->idiag_family, diag_msg->id.idiag_dst,
152 dst_buf, text_size))
153 return -1;
154
155 if (asprintf(&details, "%s:[%s%s%s:%u->%s%s%s:%u]", proto_name,
156 ob, src_buf, cb, ntohs(diag_msg->id.idiag_sport),
157 ob, dst_buf, cb, ntohs(diag_msg->id.idiag_dport))
158 < 0)
159 return false;
160 } else {
161 if (asprintf(&details, "%s:[%s%s%s:%u]",
162 proto_name, ob, src_buf, cb,
163 ntohs(diag_msg->id.idiag_sport)) < 0)
164 return false;
165 }
166
167 return cache_inode_details(inode, details);
168 }
169
170 static bool
171 receive_responses(struct tcb *tcp, const int fd, const unsigned long inode,
172 const unsigned long expected_msg_type,
173 int (*parser)(const void *, int,
174 unsigned long, void *),
175 void *opaque_data)
176 {
177 static union {
178 struct nlmsghdr hdr;
179 long buf[8192 / sizeof(long)];
180 } hdr_buf;
181
182 struct sockaddr_nl nladdr = {
183 .nl_family = AF_NETLINK
184 };
185 struct iovec iov = {
186 .iov_base = hdr_buf.buf,
187 .iov_len = sizeof(hdr_buf.buf)
188 };
189 int flags = 0;
190
191 for (;;) {
192 struct msghdr msg = {
193 .msg_name = &nladdr,
194 .msg_namelen = sizeof(nladdr),
195 .msg_iov = &iov,
196 .msg_iovlen = 1
197 };
198
199 ssize_t ret = recvmsg(fd, &msg, flags);
200 if (ret < 0) {
201 if (errno == EINTR)
202 continue;
203 return false;
204 }
205
206 const struct nlmsghdr *h = &hdr_buf.hdr;
207 if (!is_nlmsg_ok(h, ret))
208 return false;
209 for (; is_nlmsg_ok(h, ret); h = NLMSG_NEXT(h, ret)) {
210 if (h->nlmsg_type != expected_msg_type)
211 return false;
212 const int rc = parser(NLMSG_DATA(h),
213 h->nlmsg_len, inode, opaque_data);
214 if (rc > 0)
215 return true;
216 if (rc < 0)
217 return false;
218 }
219 flags = MSG_DONTWAIT;
220 }
221 }
222
223 static bool
224 unix_send_query(struct tcb *tcp, const int fd, const unsigned long inode)
225 {
226 /*
227 * The kernel bug was fixed in mainline by commit v4.5-rc6~35^2~11
228 * and backported to stable/linux-4.4.y by commit v4.4.4~297.
229 */
230 const uint16_t dump_flag =
231 os_release < KERNEL_VERSION(4, 4, 4) ? NLM_F_DUMP : 0;
232
233 struct {
234 const struct nlmsghdr nlh;
235 const struct unix_diag_req udr;
236 } req = {
237 .nlh = {
238 .nlmsg_len = sizeof(req),
239 .nlmsg_type = SOCK_DIAG_BY_FAMILY,
240 .nlmsg_flags = NLM_F_REQUEST | dump_flag
241 },
242 .udr = {
243 .sdiag_family = AF_UNIX,
244 .udiag_ino = inode,
245 .udiag_states = -1,
246 .udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER,
247 .udiag_cookie = { ~0U, ~0U }
248 }
249 };
250 return send_query(tcp, fd, &req, sizeof(req));
251 }
252
253 static int
254 unix_parse_response(const void *data, const int data_len,
255 const unsigned long inode, void *opaque_data)
256 {
257 const char *proto_name = opaque_data;
258 const struct unix_diag_msg *diag_msg = data;
259 int rta_len = data_len - NLMSG_LENGTH(sizeof(*diag_msg));
260 uint32_t peer = 0;
261 size_t path_len = 0;
262 char path[UNIX_PATH_MAX + 1];
263
264 if (rta_len < 0)
265 return -1;
266 if (diag_msg->udiag_ino != inode)
267 return 0;
268 if (diag_msg->udiag_family != AF_UNIX)
269 return -1;
270
271 for (struct rtattr *attr = (struct rtattr *) (diag_msg + 1);
272 RTA_OK(attr, rta_len);
273 attr = RTA_NEXT(attr, rta_len)) {
274 switch (attr->rta_type) {
275 case UNIX_DIAG_NAME:
276 if (!path_len) {
277 path_len = RTA_PAYLOAD(attr);
278 if (path_len > UNIX_PATH_MAX)
279 path_len = UNIX_PATH_MAX;
280 memcpy(path, RTA_DATA(attr), path_len);
281 path[path_len] = '\0';
282 }
283 break;
284 case UNIX_DIAG_PEER:
285 if (RTA_PAYLOAD(attr) >= 4)
286 peer = *(uint32_t *) RTA_DATA(attr);
287 break;
288 }
289 }
290
291 /*
292 * print obtained information in the following format:
293 * "UNIX:[" SELF_INODE [ "->" PEER_INODE ][ "," SOCKET_FILE ] "]"
294 */
295 if (!peer && !path_len)
296 return -1;
297
298 char peer_str[3 + sizeof(peer) * 3];
299 if (peer)
300 xsprintf(peer_str, "->%u", peer);
301 else
302 peer_str[0] = '\0';
303
304 const char *path_str;
305 if (path_len) {
306 char *outstr = alloca(4 * path_len + 4);
307
308 outstr[0] = ',';
309 if (path[0] == '\0') {
310 outstr[1] = '@';
311 string_quote(path + 1, outstr + 2,
312 path_len - 1, QUOTE_0_TERMINATED, NULL);
313 } else {
314 string_quote(path, outstr + 1,
315 path_len, QUOTE_0_TERMINATED, NULL);
316 }
317 path_str = outstr;
318 } else {
319 path_str = "";
320 }
321
322 char *details;
323 if (asprintf(&details, "%s:[%lu%s%s]", proto_name, inode,
324 peer_str, path_str) < 0)
325 return -1;
326
327 return cache_inode_details(inode, details);
328 }
329
330 static bool
331 netlink_send_query(struct tcb *tcp, const int fd, const unsigned long inode)
332 {
333 struct {
334 const struct nlmsghdr nlh;
335 const struct netlink_diag_req ndr;
336 } req = {
337 .nlh = {
338 .nlmsg_len = sizeof(req),
339 .nlmsg_type = SOCK_DIAG_BY_FAMILY,
340 .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST
341 },
342 .ndr = {
343 .sdiag_family = AF_NETLINK,
344 .sdiag_protocol = NDIAG_PROTO_ALL
345 }
346 };
347 return send_query(tcp, fd, &req, sizeof(req));
348 }
349
350 static int
351 netlink_parse_response(const void *data, const int data_len,
352 const unsigned long inode, void *opaque_data)
353 {
354 const char *proto_name = opaque_data;
355 const struct netlink_diag_msg *const diag_msg = data;
356 const char *netlink_proto;
357 char *details;
358
359 if (data_len < (int) NLMSG_LENGTH(sizeof(*diag_msg)))
360 return -1;
361 if (diag_msg->ndiag_ino != inode)
362 return 0;
363
364 if (diag_msg->ndiag_family != AF_NETLINK)
365 return -1;
366
367 netlink_proto = xlookup(netlink_protocols,
368 diag_msg->ndiag_protocol);
369
370 if (netlink_proto) {
371 netlink_proto = STR_STRIP_PREFIX(netlink_proto, "NETLINK_");
372 if (asprintf(&details, "%s:[%s:%u]", proto_name,
373 netlink_proto, diag_msg->ndiag_portid) < 0)
374 return -1;
375 } else {
376 if (asprintf(&details, "%s:[%u]", proto_name,
377 (unsigned) diag_msg->ndiag_protocol) < 0)
378 return -1;
379 }
380
381 return cache_inode_details(inode, details);
382 }
383
384 static const char *
385 unix_get(struct tcb *tcp, const int fd, const int family, const int proto,
386 const unsigned long inode, const char *name)
387 {
388 return unix_send_query(tcp, fd, inode)
389 && receive_responses(tcp, fd, inode, SOCK_DIAG_BY_FAMILY,
390 unix_parse_response, (void *) name)
391 ? get_sockaddr_by_inode_cached(inode) : NULL;
392 }
393
394 static const char *
395 inet_get(struct tcb *tcp, const int fd, const int family, const int protocol,
396 const unsigned long inode, const char *proto_name)
397 {
398 return inet_send_query(tcp, fd, family, protocol)
399 && receive_responses(tcp, fd, inode, SOCK_DIAG_BY_FAMILY,
400 inet_parse_response, (void *) proto_name)
401 ? get_sockaddr_by_inode_cached(inode) : NULL;
402 }
403
404 static const char *
405 netlink_get(struct tcb *tcp, const int fd, const int family, const int protocol,
406 const unsigned long inode, const char *proto_name)
407 {
408 return netlink_send_query(tcp, fd, inode)
409 && receive_responses(tcp, fd, inode, SOCK_DIAG_BY_FAMILY,
410 netlink_parse_response,
411 (void *) proto_name)
412 ? get_sockaddr_by_inode_cached(inode) : NULL;
413 }
414
415 static const struct {
416 const char *const name;
417 const char * (*const get)(struct tcb *, int fd, int family,
418 int protocol, unsigned long inode,
419 const char *proto_name);
420 int family;
421 int proto;
422 } protocols[] = {
423 [SOCK_PROTO_UNIX] = { "UNIX", unix_get, AF_UNIX},
424 [SOCK_PROTO_UNIX_STREAM]= { "UNIX-STREAM", unix_get, AF_UNIX},
425 /*
426 * inet_diag handlers are currently implemented only for TCP,
427 * UDP(lite), SCTP, RAW, and DCCP, but we try to resolve it for all
428 * protocols anyway, just in case.
429 */
430 [SOCK_PROTO_TCP] =
431 { "TCP", inet_get, AF_INET, IPPROTO_TCP },
432 [SOCK_PROTO_UDP] =
433 { "UDP", inet_get, AF_INET, IPPROTO_UDP },
434 [SOCK_PROTO_UDPLITE] =
435 { "UDPLITE", inet_get, AF_INET, IPPROTO_UDPLITE },
436 [SOCK_PROTO_DCCP] =
437 { "DCCP", inet_get, AF_INET, IPPROTO_DCCP },
438 [SOCK_PROTO_SCTP] =
439 { "SCTP", inet_get, AF_INET, IPPROTO_SCTP },
440 [SOCK_PROTO_L2TP_IP] =
441 { "L2TP/IP", inet_get, AF_INET, IPPROTO_L2TP },
442 [SOCK_PROTO_PING] =
443 { "PING", inet_get, AF_INET, IPPROTO_ICMP },
444 [SOCK_PROTO_RAW] =
445 { "RAW", inet_get, AF_INET, IPPROTO_RAW },
446 [SOCK_PROTO_TCPv6] =
447 { "TCPv6", inet_get, AF_INET6, IPPROTO_TCP },
448 [SOCK_PROTO_UDPv6] =
449 { "UDPv6", inet_get, AF_INET6, IPPROTO_UDP },
450 [SOCK_PROTO_UDPLITEv6] =
451 { "UDPLITEv6", inet_get, AF_INET6, IPPROTO_UDPLITE },
452 [SOCK_PROTO_DCCPv6] =
453 { "DCCPv6", inet_get, AF_INET6, IPPROTO_DCCP },
454 [SOCK_PROTO_SCTPv6] =
455 { "SCTPv6", inet_get, AF_INET6, IPPROTO_SCTP },
456 [SOCK_PROTO_L2TP_IPv6] =
457 { "L2TP/IPv6", inet_get, AF_INET6, IPPROTO_L2TP },
458 [SOCK_PROTO_PINGv6] =
459 { "PINGv6", inet_get, AF_INET6, IPPROTO_ICMP },
460 [SOCK_PROTO_RAWv6] =
461 { "RAWv6", inet_get, AF_INET6, IPPROTO_RAW },
462 [SOCK_PROTO_NETLINK] = { "NETLINK", netlink_get, AF_NETLINK },
463 };
464
465 enum sock_proto
466 get_proto_by_name(const char *const name)
467 {
468 for (unsigned int i = (unsigned int) SOCK_PROTO_UNKNOWN + 1;
469 i < ARRAY_SIZE(protocols); ++i) {
470 if (protocols[i].name && !strcmp(name, protocols[i].name))
471 return (enum sock_proto) i;
472 }
473 return SOCK_PROTO_UNKNOWN;
474 }
475
476 int
477 get_family_by_proto(enum sock_proto proto)
478 {
479 if ((size_t) proto < ARRAY_SIZE(protocols))
480 return protocols[proto].family;
481
482 return AF_UNSPEC;
483 }
484
485 static const char *
486 get_sockaddr_by_inode_lookup(struct tcb *tcp, const unsigned long inode,
487 const enum sock_proto proto)
488 {
489 if ((unsigned int) proto >= ARRAY_SIZE(protocols) ||
490 (proto != SOCK_PROTO_UNKNOWN && !protocols[proto].get))
491 return NULL;
492
493 const int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG);
494 if (fd < 0)
495 return NULL;
496 const char *details = NULL;
497
498 if (proto != SOCK_PROTO_UNKNOWN) {
499 details = protocols[proto].get(tcp, fd, protocols[proto].family,
500 protocols[proto].proto, inode,
501 protocols[proto].name);
502 } else {
503 for (unsigned int i = (unsigned int) SOCK_PROTO_UNKNOWN + 1;
504 i < ARRAY_SIZE(protocols); ++i) {
505 if (!protocols[i].get)
506 continue;
507 details = protocols[i].get(tcp, fd,
508 protocols[i].family,
509 protocols[i].proto,
510 inode,
511 protocols[i].name);
512 if (details)
513 break;
514 }
515 }
516
517 close(fd);
518 return details;
519 }
520
521 static const char *
522 get_sockaddr_by_inode_uncached(struct tcb *tcp, const unsigned long inode,
523 const enum sock_proto proto)
524 {
525 const char *details = get_sockaddr_by_inode_lookup(tcp, inode, proto);
526
527 if (details)
528 return details;
529
530 if ((unsigned int) proto >= ARRAY_SIZE(protocols) ||
531 !protocols[proto].name)
532 return NULL;
533
534 static char *str;
535 free(str);
536 if (asprintf(&str, "%s:[%lu]", protocols[proto].name, inode) < 0)
537 return str = NULL;
538
539 return str;
540 }
541
542 /* Given an inode number of a socket, return its protocol details. */
543 const char *
544 get_sockaddr_by_inode(struct tcb *const tcp, const int fd,
545 const unsigned long inode)
546 {
547 const char *details = get_sockaddr_by_inode_cached(inode);
548 return details ? details :
549 get_sockaddr_by_inode_uncached(tcp, inode, getfdproto(tcp, fd));
550 }
551
552 /*
553 * Managing the cache for decoding communications of Netlink GENERIC protocol
554 *
555 * As name shown Netlink GENERIC protocol is generic protocol. The
556 * numbers of msg types used in the protocol are not defined
557 * statically. Kernel defines them on demand. So the xlat converted
558 * from header files doesn't help for decoding the protocol. Following
559 * codes are building xlat(dyxlat) at runtime.
560 */
561 static bool
562 genl_send_dump_families(struct tcb *tcp, const int fd)
563 {
564 struct {
565 const struct nlmsghdr nlh;
566 struct genlmsghdr gnlh;
567 } req = {
568 .nlh = {
569 .nlmsg_len = sizeof(req),
570 .nlmsg_type = GENL_ID_CTRL,
571 .nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
572 },
573 .gnlh = {
574 .cmd = CTRL_CMD_GETFAMILY,
575 }
576 };
577 return send_query(tcp, fd, &req, sizeof(req));
578 }
579
580 static int
581 genl_parse_families_response(const void *const data,
582 const int data_len, const unsigned long inode,
583 void *opaque_data)
584 {
585 struct dyxlat *const dyxlat = opaque_data;
586 const struct genlmsghdr *const gnlh = data;
587 int rta_len = data_len - NLMSG_LENGTH(sizeof(*gnlh));
588
589 char *name = NULL;
590 unsigned int name_len = 0;
591 uint16_t *id = NULL;
592
593 if (rta_len < 0)
594 return -1;
595 if (gnlh->cmd != CTRL_CMD_NEWFAMILY)
596 return -1;
597 if (gnlh->version != 2)
598 return -1;
599
600 for (struct rtattr *attr = (struct rtattr *) (gnlh + 1);
601 RTA_OK(attr, rta_len);
602 attr = RTA_NEXT(attr, rta_len)) {
603 switch (attr->rta_type) {
604 case CTRL_ATTR_FAMILY_NAME:
605 if (!name) {
606 name = RTA_DATA(attr);
607 name_len = RTA_PAYLOAD(attr);
608 }
609 break;
610 case CTRL_ATTR_FAMILY_ID:
611 if (!id && RTA_PAYLOAD(attr) == sizeof(*id))
612 id = RTA_DATA(attr);
613 break;
614 }
615
616 if (name && id) {
617 dyxlat_add_pair(dyxlat, *id, name, name_len);
618 name = NULL;
619 id = NULL;
620 }
621 }
622
623 return 0;
624 }
625
626 const struct xlat *
627 genl_families_xlat(struct tcb *tcp)
628 {
629 static struct dyxlat *dyxlat;
630
631 if (!dyxlat) {
632 dyxlat = dyxlat_alloc(32, XT_NORMAL);
633
634 int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
635 if (fd < 0)
636 goto out;
637
638 if (genl_send_dump_families(tcp, fd))
639 receive_responses(tcp, fd, 0, GENL_ID_CTRL,
640 genl_parse_families_response, dyxlat);
641 close(fd);
642 }
643
644 out:
645 return dyxlat_get(dyxlat);
646 }