mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fixed and improved netlink communications

Browse source 
Fixed invalid uid.
Fixed/improved netlink sockets querying.
This commit is contained in:
Gustavo Iñiguez Goia 2020-02-12 22:52:24 +01:00
parent a6ff8d2c4f
commit 54bb5dcca5
2 changed files with 26 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
daemon/netlink/socket.go
View file

@ -25,15 +25,21 @@ func GetSocketInfo(proto string, srcIP net.IP, srcPort uint, dstIP net.IP, dstPo
srcAddr := &net.UDPAddr{ IP: srcIP, Port: int(srcPort), }
dstAddr := &net.UDPAddr{ IP: dstIP, Port: int(dstPort), }
s, err = SocketGet(family, ipproto, srcAddr, dstAddr)
} else {
} else if proto[:3] == "tcp" {
srcAddr := &net.TCPAddr{ IP: srcIP, Port: int(srcPort), }
dstAddr := &net.TCPAddr{ IP: dstIP, Port: int(dstPort), }
s, err = SocketGet(family, ipproto, srcAddr, dstAddr)
} else {
log.Debug("Unknown protocol, not implemented", proto)
return -1, -1
}
if err == nil && s.INode != 0xffffffff {
if err == nil && s.INode > 0 && s.INode != 0xffffffff {
if s.UID == 0xffffffff {
return -1, int(s.INode)
}
return int(s.UID), int(s.INode)
} else if err != nil {
log.Error("SOCKET ERROR", err)
log.Debug("Netlink socket error", err)
}
return -1, -1

43
daemon/netlink/socket_linux.go
View file

@ -4,7 +4,8 @@ import (
"errors"
"fmt"
"net"
"encoding/binary"
"encoding/binary"
"syscall"
"github.com/vishvananda/netlink/nl"
"golang.org/x/sys/unix"
@ -20,8 +21,8 @@ const (
)
var (
ErrNotImplemented = errors.New("not implemented")
native = nl.NativeEndian()
ErrNotImplemented = errors.New("not implemented")
native = nl.NativeEndian()
networkOrder = binary.BigEndian
)
@ -44,11 +45,11 @@ type Socket struct {
Expires uint32
RQueue uint32
WQueue uint32
UID uint32
UID uint32
INode uint32
}
type socketRequest struct {
type SocketRequest struct {
Family uint8
Protocol uint8
Ext uint8
@ -73,7 +74,7 @@ func (b *writeBuffer) Next(n int) []byte {
return s
}
func (r *socketRequest) Serialize() []byte {
func (r *SocketRequest) Serialize() []byte {
b := writeBuffer{Bytes: make([]byte, sizeofSocketRequest)}
b.Write(r.Family)
b.Write(r.Protocol)
@ -92,7 +93,7 @@ func (r *socketRequest) Serialize() []byte {
return b.Bytes
}
func (r *socketRequest) Len() int { return sizeofSocketRequest }
func (r *SocketRequest) Len() int { return sizeofSocketRequest }
type readBuffer struct {
Bytes []byte
@ -183,31 +184,21 @@ func SocketGet(family uint8, proto uint8, local, remote net.Addr) (*Socket, erro
dPort = uint16(remoteTCP.Port)
}
s, err := nl.Subscribe(unix.NETLINK_INET_DIAG)
if err != nil {
return nil, err
}
defer s.Close()
_Id = SocketID{
SourcePort: sPort,
DestinationPort: dPort,
Source: localIP,
Destination: remoteIP,
Cookie: [2]uint32{nl.TCPDIAG_NOCOOKIE, nl.TCPDIAG_NOCOOKIE},
SourcePort: sPort,
DestinationPort: dPort,
Source: localIP,
Destination: remoteIP,
Cookie: [2]uint32{nl.TCPDIAG_NOCOOKIE, nl.TCPDIAG_NOCOOKIE},
}
req := nl.NewNetlinkRequest(nl.SOCK_DIAG_BY_FAMILY, 0)
req.AddData(&socketRequest{
req.AddData(&SocketRequest{
Family: family,
Protocol: proto,
States: TCP_ALL,
ID: _Id,
})
s.Send(req)
msgs, from, err := s.Receive()
if from.Pid != nl.PidKernel {
return nil, fmt.Errorf("Wrong sender portid %d, expected %d", from.Pid, nl.PidKernel)
}
msgs, err := req.Execute(syscall.NETLINK_INET_DIAG, 0)
if err != nil {
return nil, err
}
@ -218,7 +209,7 @@ func SocketGet(family uint8, proto uint8, local, remote net.Addr) (*Socket, erro
return nil, fmt.Errorf("multiple (%d) matching sockets", len(msgs))
}
sock := &Socket{}
if err := sock.deserialize(msgs[0].Data); err != nil {
if err := sock.deserialize(msgs[0]); err != nil {
return nil, err
}
return sock, nil