forked from themighty1/lpfw
-
Notifications
You must be signed in to change notification settings - Fork 0
/
lpfw.cpp
executable file
·2839 lines (2590 loc) · 97.3 KB
/
lpfw.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#include <algorithm>
#include <arpa/inet.h> //for ntohl()
#include <assert.h>
#include <ctype.h> // for toupper
#include <errno.h>
#include <fcntl.h>
#include <fstream>
#include <grp.h>
#include <dirent.h>
#include <iomanip>
#include <ios>
#include <iostream>
#include <libnetfilter_queue/libnetfilter_queue.h>
#include <libnfnetlink/libnfnetlink.h>
#include <linux/netfilter.h> //for NF_ACCEPT, NF_DROP etc
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <pthread.h>
#include <queue>
#include <signal.h>
#include <sstream>
#include <stdio.h>
#include <stdlib.h> //for malloc
#include <string>
#include <string.h>
#include <sys/capability.h>
#include <sys/ipc.h>
#include <sys/mman.h> //for mmap
#include <sys/msg.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h> //required for netfilter.h
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h> //for print_trace
#include <syslog.h>
#include <time.h> /* time */
#include <unistd.h>
#include <vector>
#include "argtable/argtable2.h"
#include "common/defines.h"
#include "common/includes.h"
#include "lpfw.h"
#include "common/syscall_wrappers.h"
#include "conntrack.h"
#include "sha256/sha256.h"
#include "base64.h"
using namespace std;
queue<string> rulesListQueue;
queue<string> requestQueue;
//should be available globally to call nfq_close from sigterm handler
struct nfq_handle *globalh_out, *globalh_in;
//command line arguments available globally
struct arg_str *logging_facility;
struct arg_file *rules_file, *pid_file, *log_file, *allow_rule;
struct arg_int *log_info, *log_traffic, *log_debug;
struct arg_lit *test;
//Paths of various frontends kept track of in order to chown&chmod them
struct arg_file *cli_path, *gui_path, *pygui_path;
FILE *fileloginfo_stream, *filelogtraffic_stream, *filelogdebug_stream;
vector<rule> rules; //each rule contains path,permission,hash
//pointer to the actual logging function
int ( *m_printf ) ( const int loglevel, const char *logstring );
//mutex to protect ruleslist
pthread_mutex_t rules_mutex = PTHREAD_MUTEX_INITIALIZER;
pthread_t refresh_thr, nfq_out_thr, nfq_in_thr, cache_build_thr, tcp_server_thr, test_thr;
//flag which shows whether frontend is running
bool bFrontendActive = false;
pthread_mutex_t fe_active_flag_mutex = PTHREAD_MUTEX_INITIALIZER;
//mutexed string which threads use for logging
pthread_mutex_t logstring_mutex = PTHREAD_MUTEX_INITIALIZER;
char logstring[PATHSIZE];
FILE *tcpinfo, *tcp6info, *udpinfo, *udp6info;
int tcpinfo_fd, tcp6info_fd, udpinfo_fd, udp6info_fd, procnetrawfd;
//track time when last packet was seen to put to sleep some threads when there is no traffic
struct timeval lastpacket = {0};
pthread_mutex_t lastpacket_mutex = PTHREAD_MUTEX_INITIALIZER;
pthread_mutex_t tcp_port_and_socket_cache_mutex = PTHREAD_MUTEX_INITIALIZER;
pthread_mutex_t udp_port_and_socket_cache_mutex = PTHREAD_MUTEX_INITIALIZER;
//for debug purposed - how many times read() was called
int tcp_stats, udp_stats;
//cache that holds correlation of ports<-->sockets from various /proc/net/* files
int tcp_port_and_socket_cache[MEMBUF_SIZE], udp_port_and_socket_cache[MEMBUF_SIZE],
tcp6_port_and_socket_cache[MEMBUF_SIZE], udp6_port_and_socket_cache[MEMBUF_SIZE];
bool awaiting_reply_from_fe = false; //true when expecting a reply from frontend
bool bTestingMode = false;
int ctmark_to_set;
extern struct nfct_handle *setmark_handle;
bool conntrack_send_anyway = false; //used to tell ct thread to send stats even if there
//was no recent update. Useful when frontend started mid-way and needs ct stats
//fwd delarations
int send_rules();
void set_awaiting_reply_from_fe(bool toggle){
if (bTestingMode && toggle == false){
ofstream ff("/tmp/lpfwtest/awaiting_reply.false");
ff.close();
}
awaiting_reply_from_fe = toggle;
}
//split on a delimiter and return chunks
vector<string> split_string(string input, string delimiter=" "){
vector<string> output;
int pos = 0;
string token;
while (true){
pos = input.find(delimiter);
if (pos == string::npos){ //last element
token = input.substr(0, input.length());
output.push_back(token);
break;
}
token = input.substr(0, pos);
output.push_back(token);
input.erase(0, pos + 1);
}
return output;
}
void print_trace() {
char pid_buf[30];
sprintf(pid_buf, "%d", getpid());
char name_buf[512];
name_buf[readlink("/proc/self/exe", name_buf, 511)]=0;
int child_pid = fork();
if (!child_pid) {
dup2(2,1); // redirect output to stderr
fprintf(stdout,"stack trace for %s pid=%s\n",name_buf,pid_buf);
execlp("gdb", "gdb", "--batch", "-n", "-ex", "thread", "-ex", "bt", name_buf, pid_buf, NULL);
abort(); /* If gdb failed to start */
} else {
waitpid(child_pid,NULL,0);
}
}
void die(string message = ""){
if (message != "") cout << message << "\n";
cout << "dumping core \n";
abort();
//print_trace();
}
//return 2 conntrack marks: input and output
vector<u_int32_t> get_ctmarks(){
//conntrack mark number for the packet (to be summed with CT_MARK_BASE)
static u_int32_t ctmark_count = 0;
static pthread_mutex_t ctmark_mutex = PTHREAD_MUTEX_INITIALIZER;
_pthread_mutex_lock ( &ctmark_mutex );
++ctmark_count;
vector<u_int32_t>ctmarks;
ctmarks.push_back(CTMARKIN_BASE + ctmark_count);
ctmarks.push_back(CTMARKOUT_BASE + ctmark_count);
_pthread_mutex_unlock ( &ctmark_mutex );
return ctmarks;
}
void fe_active_flag_set ( const unsigned char boolean )
{
_pthread_mutex_lock ( &fe_active_flag_mutex );
bFrontendActive = boolean;
_pthread_mutex_unlock ( &fe_active_flag_mutex );
}
void capabilities_modify(const int capability, const int set, const int action)
{
cap_t cap_current;
const cap_value_t caps_list[] = {capability};
cap_current = _cap_get_proc();
_cap_set_flag(cap_current, (cap_flag_t)set, 1, caps_list, (cap_flag_value_t)action);
_cap_set_proc(cap_current);
}
//called when a port could not be found in previous cache
//so we build a new cache while at the same time looking for the port
//Note that Linux allows multiple sockets to share the same local port using SO_REUSEPORT
//This is primarily intended for servers
//So in the case where 2 processes are bound to the same local port and simultaneously
//are trying to establish a new connection to the same host:port,
//there will be no way for this function to distinguish which of them sent the packet.
//For now this function picks the first matching socket
int build_port_and_socket_cache(unsigned long &socket_out, const string localaddr, const int localport,
const string remoteaddr, const int remoteport, const string proto,
const int direction) {
char rawbuf[4096];
char laddr[INET6_ADDRSTRLEN] = {0}; //IP4 will comfortably fit there
char raddr[INET6_ADDRSTRLEN] = {0};
char lport[5] = {0};
char rport[5] = {0};
char state[3] = {0};
string ip6loopback = "00000000000000000000000000000001";
int bytesread, i, procnet_fd, *cache;
bool bSocketFound = false;
long socket;
FILE *procnet_file;
pthread_mutex_t mutex;
if (proto == "TCP") {
procnet_file = tcpinfo;
procnet_fd = tcpinfo_fd;
cache = tcp_port_and_socket_cache;
mutex = tcp_port_and_socket_cache_mutex;
}
else if (proto == "TCP6") {
procnet_file = tcp6info;
procnet_fd = tcp6info_fd;
cache = tcp6_port_and_socket_cache;
}
else if (proto == "UDP") {
procnet_file = udpinfo;
procnet_fd = udpinfo_fd;
cache = udp_port_and_socket_cache;
mutex = udp_port_and_socket_cache_mutex;
}
else if (proto == "UDP6") {
procnet_file = udp6info;
procnet_fd = udp6info_fd;
cache = udp6_port_and_socket_cache;
}
i = 0;
_fseek(procnet_file,0,SEEK_SET);
//convert *_in args into procnet* format e.g. 127.0.0.1:21787 looks 0100007F:551B
vector<string>saddr_parts = split_string(localaddr, ".");
std::stringstream saddr_ss;
for (int p = saddr_parts.size()-1 ; p >= 0; --p){
saddr_ss << std::uppercase << std::hex << std::setfill('0') <<
std::setw(2) << stoi(saddr_parts[p]);
}
string saddr_in_procnet(saddr_ss.str());
vector<string>daddr_parts = split_string(remoteaddr, ".");
std::stringstream daddr_ss;
for (int q = daddr_parts.size()-1 ; q >= 0; --q){
daddr_ss << std::uppercase << std::hex << std::setfill('0') <<
std::setw(2) << stoi(daddr_parts[q]);
}
string daddr_in_procnet(daddr_ss.str());
std::stringstream sport_ss;
sport_ss << std::uppercase << std::hex << std::setfill('0') <<
std::setw(4) << localport;
string sport_in_procnet(sport_ss.str());
std::stringstream dport_ss;
dport_ss << std::uppercase << std::hex << std::setfill('0') <<
std::setw(4) << remoteport;
string dport_in_procnet(dport_ss.str());
string debugdata;
string debugfilename;
//no matter how much we put here, a read() from proc always gets 4050 bytes
//per one read operation. Moreover /proc/net/* is smart enough to feed the line
//up to /r/n and not give you part of the line, so each read will end with /r/n
_pthread_mutex_lock(&mutex);
bool bFirstLine = true;
while ((bytesread = read(procnet_fd, rawbuf, 4096)) > 0) {
rawbuf[bytesread] = 0; //terminating 0 just in case
debugdata += string(rawbuf);
if (proto == "TCP") {debugfilename = "/tmp/procnettcp";}
else if (proto == "TCP6") {debugfilename = "/tmp/procnettcp6";}
else if (proto == "UDP") {debugfilename = "/tmp/procnetudp";}
else if (proto == "UDP6") {debugfilename = "/tmp/procnetudp6";}
string input(rawbuf);
vector<string> lines = split_string(input, "\n");
int j;
//ignore the last line which is "" due to \n at the end of input
for (j=0; j < lines.size()-1; ++j){
if (bFirstLine) { bFirstLine = false; continue;}
sscanf(lines[j].c_str(),
"%*s %[0123456789ABCDEF]:%4c %[0123456789ABCDEF]:%4c %2c %*s %*s %*s %*s %*s %ld \n",
laddr, lport, raddr, rport, state, &socket);
if (proto == "TCP" || proto == "TCP6"){
if( (direction == DIRECTION_OUT && !(state[0] == '0' && state[1] == '2')) ||
(direction == DIRECTION_IN && !(state[0] == '0' && state[1] == 'A')) ){
//state 02: SYN_SENT for TCP
//state 0A: listening
continue;}
}
if (proto == "UDP" || proto == "UDP6"){
if( (direction == DIRECTION_OUT && !(state[0] == '0' && (state[1] == '7' || state[1] == '1'))) ||
(direction == DIRECTION_IN && !(state[0] == '0' && state[1] == '7')) ){
//Note: I couldnt find any docu on UDP state 01, but observing /proc/net/udp
//this seems like a legit state of the sending socket
//state 07: listening for UDP
continue;}
}
if (socket == 0){
cout << "socket == 0 \n";
goto dump_debug;}
if( ((proto == "TCP" || proto == "UDP") && (raddr[6] == '7' && raddr[7] == 'F')) ||
((proto == "TCP6" || proto == "UDP6") && (string(raddr) == ip6loopback))){
//0x7F == 127, for IP6 ::1 is loopback
//we're not interested in destinations within localhost IP range
continue;}
std::stringstream ss;
ss << lport;
ss << std::hex;
int sport_int;
ss >> sport_int;
cache[i*2] = (unsigned long) sport_int;
cache[i*2+1] = socket;
if (lport == sport_in_procnet){
//TODO: assert here that raddr:rport = 0 because this is a listening socket
//it must not know it's peer at this point
if (bSocketFound){
cout << "Duplicate connection detected \n";
//goto dump_debug;
}
socket_out = socket;
cout << "socket found with state:" << string(state) << "\n";
bSocketFound = true;
}
}
i += j;
}
if (bytesread == -1) { die(strerror(errno)); }
cache[i*2] = (unsigned long)MAGIC_NO;
_pthread_mutex_unlock(&mutex);
if (!bSocketFound) {
//writing debug data only when socket not found
ofstream debugfile(debugfilename, ios::out | ios::binary);
debugfile << debugdata;
debugfile << "\n";
debugfile << "processed " << i << "lines\n";
debugfile.close();
return 0;
}
else { return 1; }
dump_debug:
;
ofstream debugfile(debugfilename, ios::out | ios::binary);
debugfile << debugdata;
debugfile << "\n";
debugfile << "processed " << i << "lines\n";
debugfile.close();
abort();
}
int fe_active_flag_get()
{
_pthread_mutex_lock ( &fe_active_flag_mutex );
bool temp = bFrontendActive;
_pthread_mutex_unlock ( &fe_active_flag_mutex );
return temp;
}
int m_printf_stdout ( const int loglevel, const char * logstring )
{
switch ( loglevel )
{
case MLOG_INFO:
// check if INFO logging enabled
if ( !* ( log_info->ival ) ) return 0;
printf ( "%s", logstring );
return 0;
case MLOG_TRAFFIC:
if ( !* ( log_traffic->ival ) ) return 0;
printf ( "%s", logstring );
return 0;
case MLOG_DEBUG:
if ( !* ( log_debug->ival ) ) return 0;
printf ( "%s", logstring );
return 0;
case MLOG_DEBUG2:
#ifdef DEBUG2
if ( !* ( log_debug->ival ) ) return 0;
printf ( "%s", logstring );
#endif
return 0;
case MLOG_DEBUG3:
#ifdef DEBUG3
if ( !* ( log_debug->ival ) ) return 0;
printf ( "%s", logstring );
#endif
return 0;
case MLOG_ALERT: //Alerts get logged unconditionally to all log channels
printf ( "ALERT: " );
printf ( "%s", logstring );
return 0;
}
}
//technically vfprintf followed by fsync should be enough, but for some reason on my system it can take more than 1 minute before data gets actually written to disk. So until the mystery of such a huge delay is solved, we use write() so data gets written to dist immediately
int m_printf_file ( const int loglevel, const char * logstring )
{
switch ( loglevel )
{
case MLOG_INFO:
// check if INFO logging enabled
if ( !* ( log_info->ival ) ) return 0;
write ( fileno ( fileloginfo_stream ), logstring, strlen ( logstring ) );
return 0;
case MLOG_TRAFFIC:
if ( !* ( log_traffic->ival ) ) return 0;
write ( fileno ( filelogtraffic_stream ), logstring, strlen ( logstring ) );
return 0;
case MLOG_DEBUG:
if ( !* ( log_debug->ival ) ) return 0;
write ( fileno ( filelogdebug_stream ), logstring, strlen ( logstring ) );
return 0;
case MLOG_ALERT: //Alerts get logged unconditionally to all log channels
write ( fileno ( filelogdebug_stream ), "ALERT: ", strlen ( logstring ) );
return 0;
}
}
#ifndef WITHOUT_SYSLOG
int m_printf_syslog (const int loglevel, const char * logstring)
{
switch ( loglevel )
{
case MLOG_INFO:
// check if INFO logging enabled
if ( !* ( log_info->ival ) ) return 0;
syslog ( LOG_INFO, "%s", logstring );
return 0;
case MLOG_TRAFFIC:
if ( !* ( log_traffic->ival ) ) return 0;
syslog ( LOG_INFO, "%s", logstring );
return 0;
case MLOG_DEBUG:
if ( !* ( log_debug->ival ) ) return 0;
syslog ( LOG_INFO, "%s", logstring );
return 0;
case MLOG_ALERT: //Alerts get logget unconditionally to all log channels
syslog ( LOG_INFO, "ALERT: " );
syslog ( LOG_INFO, "%s", logstring );
return 0;
}
}
#endif
unsigned long long starttimeGet ( const int mypid ) {
unsigned long long starttime;
FILE *stream;
string path = "/proc/" + to_string(mypid) + "/stat";
stream = fopen (path.c_str(), "r" );
if (stream == NULL) {
cout << "***********************************PROCPIDSTAT no found for " << mypid << "\n";
return -1; }
fscanf ( stream, "%*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s"
"%*s %*s %*s %*s %*s %*s %*s %llu", &starttime );
_fclose ( stream );
return starttime;
}
int ruleslist_add( const string path, const string pid, const string perms,
const bool active, const string sha, const unsigned long long stime,
const int ctmark, const bool first_instance){
int retctmark;
int i;
_pthread_mutex_lock ( &rules_mutex );
if (path == KERNEL_PROCESS) {
//make sure it is not a duplicate KERNEL_PROCESS
for(i=0; i < rules.size(); i++){
if (rules[i].path != KERNEL_PROCESS) continue;
if (rules[i].pid == pid) { //same IP, quit
die();
_pthread_mutex_unlock ( &rules_mutex );
return 0;
}
}
}
else {
//make sure it's not a duplicate of a regular (i.e. non-kernel) rule
for(i=0; i < rules.size(); i++){
if (rules[i].path == path && rules[i].pid == pid){
cout << "path " << path << " pid " << pid << "\n";
die("duplicate rule");
//_pthread_mutex_unlock ( &rules_mutex );
//return 0;
}
}
}
rule newrule;
newrule.path = path;
newrule.pid = pid;
newrule.perms = perms;
newrule.is_active = active;
newrule.stime = stime;
//rules added by frontend dont have their sha
if (sha == "") { newrule.sha = get_sha256_hexdigest(path); }
else { newrule.sha = sha; }
if (ctmark == 0) {
vector<u_int32_t>ctmarks = get_ctmarks();
newrule.ctmark_in = ctmarks[0];
retctmark = newrule.ctmark_out = ctmarks[1];
}
else { // ctmark > 0 => assign parent's ctmark
//either ctmark is for in or out traffic
if (ctmark >= CTMARKIN_BASE){
newrule.ctmark_in = ctmark;
retctmark = newrule.ctmark_out = ctmark - CTMARK_DELTA;
}
else {
retctmark = newrule.ctmark_out = ctmark;
newrule.ctmark_in = ctmark + CTMARK_DELTA;
}
}
newrule.first_instance = first_instance;
if (newrule.is_active && newrule.path != KERNEL_PROCESS){
newrule.pidfdpath = "/proc/" + newrule.pid + "/fd/";
newrule.dirstream = _opendir (newrule.pidfdpath.c_str());
// try {
// newrule.dirstream = _opendir (newrule.pidfdpath.c_str());
// } catch(...) {
// //TODO investigate this scenario:
// //An app forks to send a packet. When we add the rule, the forked pid already
// //terminated
// printf("CAUGHT EXCEEEEEEEEEEEEEEEEPTION");
// newrule.dirstream = NULL;
// }
}
rules.push_back(newrule);
_pthread_mutex_unlock ( &rules_mutex );
if (perms == ALLOW_ALWAYS || perms == DENY_ALWAYS) {
rules_write();
}
return retctmark;
}
void ruleslist_delete_all ( const string path) {
bool bRulesChanged = false;
bool bNeedToWriteRulesfile = false;
_pthread_mutex_lock ( &rules_mutex );
for(int i=0; i < rules.size(); i++){
if (rules[i].path != path) continue;
if (rules[i].is_active) {
_closedir (rules[i].dirstream);
ctmark_to_delete_in = rules[i].ctmark_in;
ctmark_to_delete_out = rules[i].ctmark_out;
}
bool was_active = rules[i].is_active;
if (rules[i].perms == ALLOW_ALWAYS || rules[i].perms == DENY_ALWAYS){
bNeedToWriteRulesfile = true;
}
rules.erase(rules.begin()+i);
--i; //revisit the same index again
bRulesChanged = true;
//remove tracking for this app's active connection only if this app was active
if (was_active) {
_pthread_mutex_lock(&condvar_mutex);
predicate = TRUE;
_pthread_mutex_unlock(&condvar_mutex);
_pthread_cond_signal(&condvar);
}
}
_pthread_mutex_unlock ( &rules_mutex );
if (! bRulesChanged) die(); //couldnt find the rule
if (bNeedToWriteRulesfile){
rules_write();}
if (bFrontendActive) {
send_rules();}
}
//Find and delete one entry in rules
//the calling thread holds the rules mutex
void ruleslist_delete_one ( const string path, const string pid ) {
for(int i=0; i < rules.size(); i++){
if (rules[i].path != path || rules[i].pid != pid) continue;
//else found
_closedir (rules[i].dirstream);
ctmark_to_delete_in = rules[i].ctmark_in;
ctmark_to_delete_out = rules[i].ctmark_out;
bool was_active = rules[i].is_active;
rules.erase(rules.begin()+i);
//remove tracking for this process's active connection only if this process was active
if (was_active) {
_pthread_mutex_lock(&condvar_mutex);
predicate = TRUE;
_pthread_mutex_unlock(&condvar_mutex);
_pthread_cond_signal(&condvar);
}
return; // and return
}
die(); //Fatal: couldnt find the rule to delete
}
//Search cache which thread_build_pid_and_socket_cache built
int search_pid_and_socket_cache(const long socket_in, string &path_out,
string &pid_out, int &ctmark_out){
_pthread_mutex_lock ( &rules_mutex );
vector<rule> rulescopy = rules;
_pthread_mutex_unlock ( &rules_mutex );
int i,j,retval;
for(i = 0; i < rulescopy.size(); i++){
if (! rulescopy[i].is_active) continue;
for(j=0; j < rulescopy[i].sockets.size(); ++j){
if (rulescopy[i].sockets[j] != socket_in) {continue;}
if (rulescopy[i].perms == ALLOW_ONCE || rulescopy[i].perms == ALLOW_ALWAYS) {
retval = CACHE_TRIGGERED_ALLOW;}
else {retval = CACHE_TRIGGERED_DENY;}
path_out = rulescopy[i].path;
pid_out = rulescopy[i].pid;
int stime = starttimeGet(atoi (rulescopy[i].pid.c_str()));
if (stime == -1){
return SOCKET_IN_CACHE_NOT_FOUND;}
if (rulescopy[i].stime != stime) {
return SPOOFED_PID;}
ctmark_out = rulescopy[i].ctmark_out;
return retval;
}
}
return SOCKET_IN_CACHE_NOT_FOUND;
}
//Build the cache of proc/PID/fd sockets for all running processes which
//lpfw keeps track of. The likelihood is very high that a new connection
//request will be made by a process which lpfw already keeps track of.
//Thus we can save some CPU, whereas otherwise we'd have to scan each
// <PID>/fd in the whole /proc/ tree
void* thread_build_pid_and_socket_cache ( void *ptr ){
char proc_pid_exe[32];
string proc_pid_fd_path;
struct timespec refresh_timer;
refresh_timer.tv_sec=0;
refresh_timer.tv_nsec=1000000000/4;
struct dirent *m_dirent;
struct timeval time;
int delta;
while (true) {
while(nanosleep(&refresh_timer, &refresh_timer));
gettimeofday(&time, NULL);
_pthread_mutex_lock(&lastpacket_mutex);
delta = time.tv_sec - lastpacket.tv_sec;
_pthread_mutex_unlock(&lastpacket_mutex);
//preserve CPU cycles and don't build the cache if it's
//been more than 1 second since the last new connection was detected
if (delta > 1) continue;
_pthread_mutex_lock ( &rules_mutex );
for(int i = 0; i < rules.size(); i++){
if (! rules[i].is_active || rules[i].path == KERNEL_PROCESS) continue;
rules[i].sockets.clear();
rewinddir(rules[i].dirstream);
errno=0;
int j = 0;
while (m_dirent = readdir ( rules[i].dirstream )){
proc_pid_fd_path = rules[i].pidfdpath + m_dirent->d_name;
memset (proc_pid_exe, 0 , sizeof(proc_pid_exe));
if (readlink ( proc_pid_fd_path.c_str(), proc_pid_exe, SOCKETBUFSIZE ) == -1) { //not a symlink but . or ..
errno=0;
continue;
}
if (proc_pid_exe[7] != '[') continue; //not a socket
char *end;
end = strrchr(&proc_pid_exe[8],']'); //put 0 instead of ]
*end = 0;
rules[i].sockets.push_back(atol(&proc_pid_exe[8]));
j++;
} //while (m_dirent = readdir ( rule->dirstream ))
if (errno==0) continue; //readdir reached EOF, thus errno hasn't changed from 0
else die();
}
_pthread_mutex_unlock ( &rules_mutex );
} // while(true)
}
//packets from here will end up in nfq_handle
void* thread_nfq_in ( void *nfqfd )
{
int nfqfd_in = *((int *)(nfqfd));
//endless loop of receiving packets and calling a handler on each packet
int rv;
char buf[4096] __attribute__ ( ( aligned ) );
while ( ( rv = recv ( nfqfd_in, buf, sizeof ( buf ), 0 ) ) && rv >= 0 ){
nfq_handle_packet ( globalh_in, buf, rv );
}
}
void* thread_nfq_out ( void *nfqfd )
{
int nfqfd_out = *((int *)(nfqfd));
//endless loop of receiving packets and calling a handler on each packet
int rv;
char buf[4096] __attribute__ ( ( aligned ) );
while ( ( rv = recv ( nfqfd_out, buf, sizeof ( buf ), 0 ) ) && rv >= 0 ){
nfq_handle_packet ( globalh_out, buf, rv );
}
}
string get_sha256_hexdigest(string exe_path){
unsigned char sha_bytearray[DIGEST_SIZE];
memset(sha_bytearray, 0, DIGEST_SIZE);
FILE *stream = fopen(exe_path.c_str(), "r");
if (!stream) return "CANT_READ_EXE"; //TODO handle this error in the caller
sha256_stream(stream, (void *)sha_bytearray);
_fclose(stream);
//convert binary sha to hexlified string
char sha_cstring [DIGEST_SIZE*2+1];
sha_cstring[DIGEST_SIZE*2] = 0;
for(int j = 0; j < DIGEST_SIZE; j++)
sprintf(&sha_cstring[2*j], "%02X", sha_bytearray[j]);
return sha_cstring;
}
void error(const char *msg){
perror(msg);
exit(1);
}
void tcp_server_process_messages(int newsockfd) {
int i,n;
char buffer[256];
string send_msg; //request that was dispatched to the frontend
string sent_path;
string sent_pid;
string sent_stime;
bool bDataAvailable;
while (true) {
sleep(1);
bDataAvailable = false;
if (!requestQueue.empty()) {
assert(requestQueue.size() == 1);
vector<string> split_msg = split_string(requestQueue.front());
send_msg = requestQueue.front();
requestQueue.pop();
sent_path= split_msg[1];
sent_pid = split_msg[2];
sent_stime = split_msg[3];
bDataAvailable = true;
}
else if (!rulesListQueue.empty()) {
send_msg = rulesListQueue.front();
rulesListQueue.pop();
bDataAvailable = true;
}
if (bDataAvailable){
if (send(newsockfd, send_msg.c_str(), send_msg.length(), MSG_NOSIGNAL) < 0) {
cout << "ERROR writing to socket. UNREGISTERing \n";
set_awaiting_reply_from_fe(false);
_close(newsockfd);
return;
}
}
bzero(buffer,256);
n = read(newsockfd,buffer,255);
if (n < 0) continue; //no data
if (n == 0){
//usually because the frontend abruptly closed the socket
set_awaiting_reply_from_fe(false);
_close(newsockfd);
return;
}
vector<string> string_parts = split_string(string(buffer));
string comm = string_parts[0];
if (comm == "LIST"){
cout << "in LIST \n";
//We could send right from here, however calling a special function is cleaner
send_rules();
//Tell conntrack to send stats even if there was no recent update
//conntrack will toggle it back to false
conntrack_send_anyway = true;
}
else if (comm == "DELETE"){ // comm path
string path = base64_decode(string_parts[1]);
cout << "backend deleting " << path << "\n";
ruleslist_delete_all(path);
}
else if (comm == "WRITE"){ //Not in use
rules_write();
}
else if (comm == "ADD"){ //ADD path pid perms
cout << "ADDing a rule \n";
if (!awaiting_reply_from_fe) die();
string path = base64_decode(string_parts[1]);
string pid = string_parts[2];
string perms = string_parts[3];
if (sent_path != string_parts[1] || sent_pid != pid){
die("Expected " + sent_path + " but got " + path);}
if (perms == "IGNORED") set_awaiting_reply_from_fe(false);
else if (path == "KERNEL_PROCESS"){
ruleslist_add(KERNEL_PROCESS, pid, perms, TRUE, "", 0, 0 ,TRUE);
}
else {
string procpath = "/proc/" + pid + "/exe";
char exepathbuf[PATHSIZE];
string sha;
memset ( exepathbuf, 0, PATHSIZE );
readlink (procpath.c_str(), exepathbuf, PATHSIZE-1 );
if (exepathbuf != path){
cout << "Frontend asked to add a process that is no longer running \n";
set_awaiting_reply_from_fe(false);
continue;
}
//TODO should move stime check to ruleslist_add
// unsigned long long stime;
// stime = starttimeGet(atoi(pid));
// if ( sent_to_fe_struct.stime != stime ){
// cout << "Red alert!!!Start times don't match";
// throw "Red alert!!!Start times don't match";
// awaiting_reply_from_fe = FALSE;
// }
//TODO SECURITY.Check that /proc/PID inode wasn't changed while we were shasumming and exesizing
ruleslist_add(path, pid, perms, true, "", atoi(sent_stime.c_str()), 0 ,TRUE);
set_awaiting_reply_from_fe(false);
requestQueue = queue<string>(); //clear the queue
send_rules();
}
}
else if (comm == "UNREGISTER"){
_close(newsockfd);
set_awaiting_reply_from_fe(false);
return;
}
else {cout << "unknown command: " << comm << "size:" << n << "\n";}
} //while (true)
}
//wait for the frontend to connect
void* thread_tcp_server ( void *data ) {
prctl(PR_SET_NAME,"daemon_server",0,0,0);
int sockfd, newsockfd;
struct sockaddr_in serv_addr, cli_addr;
socklen_t clilen;
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0) error("ERROR opening socket");
bzero((char *) &serv_addr, sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_addr.s_addr = INADDR_ANY;
serv_addr.sin_port = htons(0);
if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) perror("ERROR on binding");
//get local port
int local_port;
struct sockaddr_in sin;
socklen_t addrlen = sizeof(sin);
if(getsockname(sockfd, (struct sockaddr *)&sin, &addrlen) == 0 &&
sin.sin_family == AF_INET && addrlen == sizeof(sin)) {
local_port = ntohs(sin.sin_port);
}
cout << "Daemon tcp port:" << local_port << "\n";
ofstream myfile("/tmp/lpfwcommport");
myfile << to_string(local_port);
myfile.close();
while (true) {
listen(sockfd,1);
clilen = sizeof(cli_addr);
newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen);
if (newsockfd < 0) {
error("ERROR on accept");
die();
}
if(fcntl(newsockfd, F_SETFL, fcntl(sockfd, F_GETFL) | O_NONBLOCK) < 0) {
printf ("Couldn't set socket to non-blocking");
die();
}
bFrontendActive = true;
tcp_server_process_messages(newsockfd);
bFrontendActive = false;
//tcp_server_process_messages returns when frontend unregisters
//we can listen for a new frontend connection
}
}
//scan procfs and remove/mark inactive those processes that are no longer running
void* thread_refresh ( void* ptr ){
prctl(PR_SET_NAME,"refresh",0,0,0);
ptr = 0; //to prevent gcc warnings of unused variable
char exe_path[PATHSIZE] = {'\0'};
bool prevIterationHadAnUpdate = false;
bool thisIterationHadAnUpdate = false;
while (true){
thisIterationHadAnUpdate = false;
_pthread_mutex_lock ( &rules_mutex );
for(int i=0; i < rules.size(); i++){
//only interested in processes which produced some traffic already
if (!rules[i].is_active || rules[i].path == KERNEL_PROCESS) continue;
string proc_pid_exe = "/proc/" + rules[i].pid + "/exe";
memset ( exe_path, 0, PATHSIZE );
//readlink doesn't fail if PID is running
if ( readlink ( proc_pid_exe.c_str(), exe_path, PATHSIZE ) != -1 ) continue;
//else the PID is not running anymore
if (rules[i].perms == ALLOW_ONCE || rules[i].perms == DENY_ONCE){
ruleslist_delete_one ( rules[i].path, rules[i].pid );
//To keep this function's logic simple we dont iterate anymore
//(although we could) but break the for loop
thisIterationHadAnUpdate = true;
break;
}
//Only delete *ALWAYS rule if there is at least one more rule in rules with the same PATH
//and with the same *ALWAYS permissions
//If the rule is the only one in rules with such PATH, simply toggle off is_active flag
//(because we want an *ALWAYS rule always to be present in the rules)
if (rules[i].perms == ALLOW_ALWAYS || rules[i].perms == DENY_ALWAYS){
bool bFoundAnotherOne = false;
for(int j=0; j < rules.size(); j++){ //scan all rules again
if (j == i) continue; //Make sure we don't find our own rule
if (rules[j].path != rules[i].path) continue;
if (rules[j].perms != rules[i].perms) continue;
bFoundAnotherOne = true;
ruleslist_delete_one ( rules[i].path, rules[i].pid );
rules_write(true);
thisIterationHadAnUpdate = true;
break;
}
if (bFoundAnotherOne){break;} //out of rules iteration
//else this is the only *ALWAYS rule with such PATH
rules[i].pid = "0";
rules[i].is_active = false;
//conntrack marks will be used by the next instance of app
vector<u_int32_t>ctmarks = get_ctmarks();
rules[i].ctmark_in = ctmarks[0];
rules[i].ctmark_out = ctmarks[1];
thisIterationHadAnUpdate = true;
break; //out of rules iteration
}
} //for(int i=0; i < rules.size(); i++)
_pthread_mutex_unlock ( &rules_mutex );
if (thisIterationHadAnUpdate){
prevIterationHadAnUpdate = true;
continue; //to while (true)
}
else if (prevIterationHadAnUpdate){
if (bFrontendActive) {
send_rules();}
prevIterationHadAnUpdate = false;
}
else {
//no updates in previous or this iteration
sleep ( REFRESH_INTERVAL );
}
} //while (true)
}
//Load rules from rulesfile at startup
void rules_load(){
ifstream inputFile(rules_file->filename[0]);
string line;
int pos;
bool is_full_path_found = false;
bool is_permission_found = false;
bool is_sha256_hexdigest_found = false;
bool is_conntrack_mark_found = false;
string full_path = "";
string permission = "";
string sha256_hexdigest = "";
int conntrack_mark = 0;
while (getline(inputFile, line))
{
if (line[0] == '#') continue;
if (line == ""){
if (is_full_path_found && is_permission_found && is_sha256_hexdigest_found){