You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
fw-daemon/vendor/github.com/subgraph/go-procsnitch/proc.go

270 lines
7.0 KiB

package procsnitch
import (
"encoding/hex"
"errors"
"fmt"
"github.com/op/go-logging"
"io/ioutil"
"net"
"strconv"
"strings"
)
var log = logging.MustGetLogger("go-procsockets")
// SetLogger allows setting a custom go-logging instance
func SetLogger(logger *logging.Logger) {
log = logger
}
var pcache = &pidCache{}
// ProcInfo represents an api that can be used to query process information about
// the far side of a network connection
// Note: this can aid in the construction of unit tests.
type ProcInfo interface {
LookupTCPSocketProcess(srcPort uint16, dstAddr net.IP, dstPort uint16) *Info
LookupUNIXSocketProcess(socketFile string) *Info
LookupUDPSocketProcess(srcPort uint16) *Info
}
// SystemProcInfo represents our real system ProcInfo api.
type SystemProcInfo struct {
}
// LookupTCPSocketProcess returns the process information for a given TCP connection.
func (r SystemProcInfo) LookupTCPSocketProcess(srcPort uint16, dstAddr net.IP, dstPort uint16) *Info {
return LookupTCPSocketProcess(srcPort, dstAddr, dstPort)
}
// LookupUNIXSocketProcess returns the process information for a given UNIX socket connection.
func (r SystemProcInfo) LookupUNIXSocketProcess(socketFile string) *Info {
return LookupUNIXSocketProcess(socketFile)
}
// LookupUDPSocketProcess returns the process information for a given UDP socket connection.
func (r SystemProcInfo) LookupUDPSocketProcess(srcPort uint16) *Info {
return LookupUDPSocketProcess(srcPort)
}
// FindProcessForConnection returns the process information for a given connection.
// So far only TCP and UNIX domain socket connections are supported.
func FindProcessForConnection(conn net.Conn, procInfo ProcInfo) *Info {
var info *Info
if conn.LocalAddr().Network() == "tcp" {
fields := strings.Split(conn.RemoteAddr().String(), ":")
dstPortStr := fields[1]
fields = strings.Split(conn.LocalAddr().String(), ":")
dstIP := net.ParseIP(fields[0])
srcP, _ := strconv.ParseUint(dstPortStr, 10, 16)
dstP, _ := strconv.ParseUint(fields[1], 10, 16)
info = procInfo.LookupTCPSocketProcess(uint16(srcP), dstIP, uint16(dstP))
} else if conn.LocalAddr().Network() == "unix" {
info = procInfo.LookupUNIXSocketProcess(conn.LocalAddr().String())
}
return info
}
// LookupUDPSocketProcess searches for a UDP socket with a source port
func LookupUDPSocketProcess(srcPort uint16) *Info {
ss := findUDPSocket(srcPort)
if ss == nil {
return nil
}
return pcache.lookup(ss.inode)
}
// LookupTCPSocketProcessAll searches for a TCP socket a given source port, destination IP, and destination port - AND source destination
func LookupTCPSocketProcessAll(srcAddr net.IP, srcPort uint16, dstAddr net.IP, dstPort uint16, custdata []string) *Info {
ss := findTCPSocketAll(srcAddr, srcPort, dstAddr, dstPort, custdata)
if ss == nil {
return nil
}
return pcache.lookup(ss.inode)
}
// LookupTCPSocketProcess searches for a TCP socket with a given source port, destination IP, and destination port
func LookupTCPSocketProcess(srcPort uint16, dstAddr net.IP, dstPort uint16) *Info {
ss := findTCPSocket(srcPort, dstAddr, dstPort)
if ss == nil {
return nil
}
return pcache.lookup(ss.inode)
}
// LookupUNIXSocketProcess searches for a UNIX domain socket with a given filename
func LookupUNIXSocketProcess(socketFile string) *Info {
ss := findUNIXSocket(socketFile)
if ss == nil {
return nil
}
return pcache.lookup(ss.inode)
}
type connectionInfo struct {
pinfo *Info
local *socketAddr
remote *socketAddr
}
func (ci *connectionInfo) String() string {
return fmt.Sprintf("%v %s %s", ci.pinfo, ci.local, ci.remote)
}
func (sa *socketAddr) parse(s string) error {
ipPort := strings.Split(s, ":")
if len(ipPort) != 2 {
return fmt.Errorf("badly formatted socket address field: %s", s)
}
ip, err := ParseIP(ipPort[0])
if err != nil {
return fmt.Errorf("error parsing ip field [%s]: %v", ipPort[0], err)
}
port, err := ParsePort(ipPort[1])
if err != nil {
return fmt.Errorf("error parsing port field [%s]: %v", ipPort[1], err)
}
sa.ip = ip
sa.port = port
return nil
}
// ParseIP parses a string ip to a net.IP
func ParseIP(ip string) (net.IP, error) {
var result net.IP
dst, err := hex.DecodeString(ip)
if err != nil {
return result, fmt.Errorf("Error parsing IP: %s", err)
}
// Reverse byte order -- /proc/net/tcp etc. is little-endian
// TODO: Does this vary by architecture?
for i, j := 0, len(dst)-1; i < j; i, j = i+1, j-1 {
dst[i], dst[j] = dst[j], dst[i]
}
result = net.IP(dst)
return result, nil
}
// ParsePort parses a base16 port represented as a string to a uint16
func ParsePort(port string) (uint16, error) {
p64, err := strconv.ParseInt(port, 16, 32)
if err != nil {
return 0, fmt.Errorf("Error parsing port: %s", err)
}
return uint16(p64), nil
}
func getConnections() ([]*connectionInfo, error) {
conns, err := readConntrack()
if err != nil {
return nil, err
}
resolveProcinfo(conns)
return conns, nil
}
func resolveProcinfo(conns []*connectionInfo) {
var sockets []*socketStatus
for _, line := range getSocketLines("tcp") {
if len(strings.TrimSpace(line)) == 0 {
continue
}
ss := new(socketStatus)
if err := ss.parseLine(line); err != nil {
log.Warningf("Unable to parse line [%s]: %v", line, err)
} /* else {
/*
pid := findPidForInode(ss.inode)
if pid > 0 {
ss.pid = pid
fmt.Println("Socket", ss)
sockets = append(sockets, ss)
}
}*/
}
for _, ci := range conns {
ss := findContrackSocket(ci, sockets)
if ss == nil {
continue
}
pinfo := pcache.lookup(ss.inode)
if pinfo != nil {
ci.pinfo = pinfo
}
}
}
func findContrackSocket(ci *connectionInfo, sockets []*socketStatus) *socketStatus {
for _, ss := range sockets {
if ss.local.port == ci.local.port && ss.remote.ip.Equal(ci.remote.ip) && ss.remote.port == ci.remote.port {
return ss
}
}
return nil
}
func readConntrack() ([]*connectionInfo, error) {
path := fmt.Sprintf("/proc/net/ip_conntrack")
data, err := ioutil.ReadFile(path)
if err != nil {
return nil, err
}
var result []*connectionInfo
lines := strings.Split(string(data), "\n")
for _, line := range lines {
ci, err := parseConntrackLine(line)
if err != nil {
return nil, err
}
if ci != nil {
result = append(result, ci)
}
}
return result, nil
}
func parseConntrackLine(line string) (*connectionInfo, error) {
parts := strings.Fields(line)
if len(parts) < 8 || parts[0] != "tcp" || parts[3] != "ESTABLISHED" {
return nil, nil
}
local, err := conntrackAddr(parts[4], parts[6])
if err != nil {
return nil, err
}
remote, err := conntrackAddr(parts[5], parts[7])
if err != nil {
return nil, err
}
return &connectionInfo{
local: local,
remote: remote,
}, nil
}
func conntrackAddr(ipStr, portStr string) (*socketAddr, error) {
ip := net.ParseIP(stripLabel(ipStr))
if ip == nil {
return nil, errors.New("Could not parse IP: " + ipStr)
}
i64, err := strconv.Atoi(stripLabel(portStr))
if err != nil {
return nil, err
}
return &socketAddr{
ip: ip,
port: uint16(i64),
}, nil
}
func stripLabel(s string) string {
idx := strings.Index(s, "=")
if idx == -1 {
return s
}
return s[idx+1:]
}