Initial commit after restructure

2018-08-13 14:14:27 +02:00
commit bdeddc41f9
177 changed files with 26108 additions and 0 deletions
--- a/process/proc/gather.go
+++ b/process/proc/gather.go
@@ -0,0 +1,56 @@
+// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+
+package proc
+
+import (
+	"net"
+	"time"
+)
+
+const (
+	Success uint8 = iota
+	NoSocket
+	NoProcess
+)
+
+func GetPidOfConnection(localIP *net.IP, localPort uint16, protocol uint8) (pid int, status uint8) {
+	uid, inode, ok := getConnectionSocket(localIP, localPort, protocol)
+	if !ok {
+		uid, inode, ok = getListeningSocket(localIP, localPort, protocol)
+		for i := 0; i < 3 && !ok; i++ {
+			// give kernel some time, then try again
+			// log.Tracef("process: giving kernel some time to think")
+			time.Sleep(15 * time.Millisecond)
+			uid, inode, ok = getConnectionSocket(localIP, localPort, protocol)
+			if !ok {
+				uid, inode, ok = getListeningSocket(localIP, localPort, protocol)
+			}
+		}
+		if !ok {
+			return -1, NoSocket
+		}
+	}
+	pid, ok = GetPidOfInode(uid, inode)
+	for i := 0; i < 3 && !ok; i++ {
+		// give kernel some time, then try again
+		// log.Tracef("process: giving kernel some time to think")
+		time.Sleep(15 * time.Millisecond)
+		pid, ok = GetPidOfInode(uid, inode)
+	}
+	if !ok {
+		return -1, NoProcess
+	}
+	return
+}
+
+func GetPidOfIncomingConnection(localIP *net.IP, localPort uint16, protocol uint8) (pid int, status uint8) {
+	uid, inode, ok := getListeningSocket(localIP, localPort, protocol)
+	if !ok {
+		return -1, NoSocket
+	}
+	pid, ok = GetPidOfInode(uid, inode)
+	if !ok {
+		return -1, NoProcess
+	}
+	return
+}
--- a/process/proc/get.go
+++ b/process/proc/get.go
@@ -0,0 +1,56 @@
+package proc
+
+import (
+	"errors"
+	"net"
+)
+
+func GetTCP4PacketInfo(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, pktDirection bool) (pid int, direction bool, err error) {
+	return search(TCP4, localIP, localPort, direction)
+}
+
+func GetTCP6PacketInfo(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, pktDirection bool) (pid int, direction bool, err error) {
+	return search(TCP6, localIP, localPort, direction)
+}
+
+func GetUDP4PacketInfo(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, pktDirection bool) (pid int, direction bool, err error) {
+	return search(UDP4, localIP, localPort, direction)
+}
+
+func GetUDP6PacketInfo(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, pktDirection bool) (pid int, direction bool, err error) {
+	return search(UDP6, localIP, localPort, direction)
+}
+
+func search(protocol uint8, localIP net.IP, localPort uint16, pktDirection bool) (pid int, direction bool, err error) {
+
+	var status uint8
+	if pktDirection {
+		pid, status = GetPidOfIncomingConnection(&localIP, localPort, protocol)
+		if pid >= 0 {
+			return pid, true, nil
+		}
+		// pid, status = GetPidOfConnection(&localIP, localPort, protocol)
+		// if pid >= 0 {
+		// 	return pid, false, nil
+		// }
+	} else {
+		pid, status = GetPidOfConnection(&localIP, localPort, protocol)
+		if pid >= 0 {
+			return pid, false, nil
+		}
+		// pid, status = GetPidOfIncomingConnection(&localIP, localPort, protocol)
+		// if pid >= 0 {
+		// 	return pid, true, nil
+		// }
+	}
+
+	switch status {
+	case NoSocket:
+		return -1, direction, errors.New("could not find socket")
+	case NoProcess:
+		return -1, direction, errors.New("could not find PID")
+	default:
+		return -1, direction, nil
+	}
+
+}
--- a/process/proc/processfinder.go
+++ b/process/proc/processfinder.go
@@ -0,0 +1,163 @@
+// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+
+package proc
+
+import (
+	"fmt"
+	"os"
+	"sort"
+	"strconv"
+	"sync"
+	"syscall"
+
+	"github.com/Safing/safing-core/log"
+)
+
+var (
+	pidsByUserLock sync.Mutex
+	pidsByUser     = make(map[int][]int)
+)
+
+func GetPidOfInode(uid, inode int) (int, bool) {
+	pidsByUserLock.Lock()
+	defer pidsByUserLock.Unlock()
+
+	pidsUpdated := false
+
+	// get pids of user, update if missing
+	pids, ok := pidsByUser[uid]
+	if !ok {
+		// log.Trace("process: no processes of user, updating table")
+		updatePids()
+		pidsUpdated = true
+		pids, ok = pidsByUser[uid]
+	}
+	if ok {
+		// if user has pids, start checking them first
+		var checkedUserPids []int
+		for _, possiblePID := range pids {
+			if findSocketFromPid(possiblePID, inode) {
+				return possiblePID, true
+			}
+			checkedUserPids = append(checkedUserPids, possiblePID)
+		}
+		// if we fail on the first run and have not updated, update and check the ones we haven't tried so far.
+		if !pidsUpdated {
+			// log.Trace("process: socket not found in any process of user, updating table")
+			// update
+			updatePids()
+			// sort for faster search
+			for i, j := 0, len(checkedUserPids)-1; i < j; i, j = i+1, j-1 {
+				checkedUserPids[i], checkedUserPids[j] = checkedUserPids[j], checkedUserPids[i]
+			}
+			len := len(checkedUserPids)
+			// check unchecked pids
+			for _, possiblePID := range pids {
+				// only check if not already checked
+				if sort.SearchInts(checkedUserPids, possiblePID) == len {
+					if findSocketFromPid(possiblePID, inode) {
+						return possiblePID, true
+					}
+				}
+			}
+		}
+	}
+
+	// check all other pids
+	// log.Trace("process: socket not found in any process of user, checking all pids")
+	// TODO: find best order for pidsByUser for best performance
+	for possibleUID, pids := range pidsByUser {
+		if possibleUID != uid {
+			for _, possiblePID := range pids {
+				if findSocketFromPid(possiblePID, inode) {
+					return possiblePID, true
+				}
+			}
+		}
+	}
+
+	return -1, false
+}
+
+func findSocketFromPid(pid, inode int) bool {
+	socketName := fmt.Sprintf("socket:[%d]", inode)
+	entries := readDirNames(fmt.Sprintf("/proc/%d/fd", pid))
+	if len(entries) == 0 {
+		return false
+	}
+
+	for _, entry := range entries {
+		link, err := os.Readlink(fmt.Sprintf("/proc/%d/fd/%s", pid, entry))
+		if err != nil {
+			if !os.IsNotExist(err) {
+				log.Warningf("process: failed to read link /proc/%d/fd/%s: %s", pid, entry, err)
+			}
+			continue
+		}
+		if link == socketName {
+			return true
+		}
+	}
+
+	return false
+}
+
+func updatePids() {
+	pidsByUser = make(map[int][]int)
+
+	entries := readDirNames("/proc")
+	if len(entries) == 0 {
+		return
+	}
+
+entryLoop:
+	for _, entry := range entries {
+		pid, err := strconv.ParseInt(entry, 10, 32)
+		if err != nil {
+			continue entryLoop
+		}
+
+		statData, err := os.Stat(fmt.Sprintf("/proc/%d", pid))
+		if err != nil {
+			log.Warningf("process: could not stat /proc/%d: %s", pid, err)
+			continue entryLoop
+		}
+		sys, ok := statData.Sys().(*syscall.Stat_t)
+		if !ok {
+			log.Warningf("process: unable to parse /proc/%d: wrong type", pid)
+			continue entryLoop
+		}
+
+		pids, ok := pidsByUser[int(sys.Uid)]
+		if ok {
+			pidsByUser[int(sys.Uid)] = append(pids, int(pid))
+		} else {
+			pidsByUser[int(sys.Uid)] = []int{int(pid)}
+		}
+
+	}
+
+	for _, slice := range pidsByUser {
+		for i, j := 0, len(slice)-1; i < j; i, j = i+1, j-1 {
+			slice[i], slice[j] = slice[j], slice[i]
+		}
+	}
+
+}
+
+func readDirNames(dir string) (names []string) {
+	file, err := os.Open(dir)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			log.Warningf("process: could not open directory %s: %s", dir, err)
+		}
+		return
+	}
+	defer file.Close()
+	names, err = file.Readdirnames(0)
+	if err != nil {
+		log.Warningf("process: could not get entries from direcotry %s: %s", dir, err)
+		return []string{}
+	}
+	return
+}
--- a/process/proc/processfinder_test.go
+++ b/process/proc/processfinder_test.go
@@ -0,0 +1,18 @@
+// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+
+package proc
+
+import (
+	"log"
+	"testing"
+)
+
+func TestProcessFinder(t *testing.T) {
+
+	updatePids()
+	log.Printf("pidsByUser: %v", pidsByUser)
+
+	pid, _ := GetPidOfInode(1000, 112588)
+	log.Printf("pid: %d", pid)
+
+}
--- a/process/proc/sockets.go
+++ b/process/proc/sockets.go
@@ -0,0 +1,381 @@
+// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+
+package proc
+
+import (
+	"bufio"
+	"encoding/hex"
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"unicode"
+
+	"github.com/Safing/safing-core/log"
+)
+
+/*
+
+1. find socket inode
+  - by incoming (listenting sockets) or outgoing (local port + external IP + port) - also local IP?
+  - /proc/net/{tcp|udp}[6]
+
+2. get list of processes of uid
+
+3. find socket inode in process fds
+	- if not found, refresh map of uid->pids
+	- if not found, check ALL pids: maybe euid != uid
+
+4. gather process info
+
+Cache every step!
+
+*/
+
+const (
+	TCP4 uint8 = iota
+	UDP4
+	TCP6
+	UDP6
+	ICMP4
+	ICMP6
+
+	TCP4Data  = "/proc/net/tcp"
+	UDP4Data  = "/proc/net/udp"
+	TCP6Data  = "/proc/net/tcp6"
+	UDP6Data  = "/proc/net/udp6"
+	ICMP4Data = "/proc/net/icmp"
+	ICMP6Data = "/proc/net/icmp6"
+
+	TCP_ESTABLISHED = iota + 1
+	TCP_SYN_SENT
+	TCP_SYN_RECV
+	TCP_FIN_WAIT1
+	TCP_FIN_WAIT2
+	TCP_TIME_WAIT
+	TCP_CLOSE
+	TCP_CLOSE_WAIT
+	TCP_LAST_ACK
+	TCP_LISTEN
+	TCP_CLOSING
+	TCP_NEW_SYN_RECV
+)
+
+var (
+	// connectionSocketsLock sync.Mutex
+	// connectionTCP4 = make(map[string][]int)
+	// connectionUDP4 = make(map[string][]int)
+	// connectionTCP6 = make(map[string][]int)
+	// connectionUDP6 = make(map[string][]int)
+
+	listeningSocketsLock sync.Mutex
+	addressListeningTCP4 = make(map[string][]int)
+	addressListeningUDP4 = make(map[string][]int)
+	addressListeningTCP6 = make(map[string][]int)
+	addressListeningUDP6 = make(map[string][]int)
+	globalListeningTCP4  = make(map[uint16][]int)
+	globalListeningUDP4  = make(map[uint16][]int)
+	globalListeningTCP6  = make(map[uint16][]int)
+	globalListeningUDP6  = make(map[uint16][]int)
+)
+
+func getConnectionSocket(localIP *net.IP, localPort uint16, protocol uint8) (int, int, bool) {
+	// listeningSocketsLock.Lock()
+	// defer listeningSocketsLock.Unlock()
+
+	var procFile string
+	var localIPHex string
+	switch protocol {
+	case TCP4:
+		procFile = TCP4Data
+		localIPBytes := []byte(localIP.To4())
+		localIPHex = strings.ToUpper(hex.EncodeToString([]byte{localIPBytes[3], localIPBytes[2], localIPBytes[1], localIPBytes[0]}))
+	case UDP4:
+		procFile = UDP4Data
+		localIPBytes := []byte(localIP.To4())
+		localIPHex = strings.ToUpper(hex.EncodeToString([]byte{localIPBytes[3], localIPBytes[2], localIPBytes[1], localIPBytes[0]}))
+	case TCP6:
+		procFile = TCP6Data
+		localIPHex = hex.EncodeToString([]byte(*localIP))
+	case UDP6:
+		procFile = UDP6Data
+		localIPHex = hex.EncodeToString([]byte(*localIP))
+	}
+
+	localPortHex := fmt.Sprintf("%04X", localPort)
+
+	// log.Tracef("process/proc: searching for PID of: %s:%d (%s:%s)", localIP, localPort, localIPHex, localPortHex)
+
+	// open file
+	socketData, err := os.Open(procFile)
+	if err != nil {
+		log.Warningf("process/proc: could not read %s: %s", procFile, err)
+		return -1, -1, false
+	}
+	defer socketData.Close()
+
+	// file scanner
+	scanner := bufio.NewScanner(socketData)
+	scanner.Split(bufio.ScanLines)
+
+	// parse
+	scanner.Scan() // skip first line
+	for scanner.Scan() {
+		line := strings.FieldsFunc(scanner.Text(), procDelimiter)
+		// log.Tracef("line: %s", line)
+		if len(line) < 14 {
+			// log.Tracef("process: too short: %s", line)
+			continue
+		}
+
+		if line[1] != localIPHex {
+			continue
+		}
+		if line[2] != localPortHex {
+			continue
+		}
+
+		ok := true
+
+		uid, err := strconv.ParseInt(line[11], 10, 32)
+		if err != nil {
+			log.Warningf("process: could not parse uid %s: %s", line[11], err)
+			uid = -1
+			ok = false
+		}
+
+		inode, err := strconv.ParseInt(line[13], 10, 32)
+		if err != nil {
+			log.Warningf("process: could not parse inode %s: %s", line[13], err)
+			inode = -1
+			ok = false
+		}
+
+		// log.Tracef("process/proc: identified process of %s:%d: socket=%d uid=%d", localIP, localPort, int(inode), int(uid))
+		return int(uid), int(inode), ok
+
+	}
+
+	return -1, -1, false
+
+}
+
+func getListeningSocket(localIP *net.IP, localPort uint16, protocol uint8) (uid, inode int, ok bool) {
+	listeningSocketsLock.Lock()
+	defer listeningSocketsLock.Unlock()
+
+	var addressListening *map[string][]int
+	var globalListening *map[uint16][]int
+	switch protocol {
+	case TCP4:
+		addressListening = &addressListeningTCP4
+		globalListening = &globalListeningTCP4
+	case UDP4:
+		addressListening = &addressListeningUDP4
+		globalListening = &globalListeningUDP4
+	case TCP6:
+		addressListening = &addressListeningTCP6
+		globalListening = &globalListeningTCP6
+	case UDP6:
+		addressListening = &addressListeningUDP6
+		globalListening = &globalListeningUDP6
+	}
+
+	data, ok := (*addressListening)[fmt.Sprintf("%s:%d", localIP, localPort)]
+	if !ok {
+		data, ok = (*globalListening)[localPort]
+	}
+	if ok {
+		return data[0], data[1], true
+	}
+	updateListeners(protocol)
+	data, ok = (*addressListening)[fmt.Sprintf("%s:%d", localIP, localPort)]
+	if !ok {
+		data, ok = (*globalListening)[localPort]
+	}
+	if ok {
+		return data[0], data[1], true
+	}
+
+	return 0, 0, false
+}
+
+func procDelimiter(c rune) bool {
+	return unicode.IsSpace(c) || c == ':'
+}
+
+func convertIPv4(data string) *net.IP {
+	decoded, err := hex.DecodeString(data)
+	if err != nil {
+		log.Warningf("process: could not parse IPv4 %s: %s", data, err)
+		return nil
+	}
+	if len(decoded) != 4 {
+		log.Warningf("process: decoded IPv4 %s has wrong length")
+		return nil
+	}
+	ip := net.IPv4(decoded[3], decoded[2], decoded[1], decoded[0])
+	return &ip
+}
+
+func convertIPv6(data string) *net.IP {
+	decoded, err := hex.DecodeString(data)
+	if err != nil {
+		log.Warningf("process: could not parse IPv6 %s: %s", data, err)
+		return nil
+	}
+	if len(decoded) != 16 {
+		log.Warningf("process: decoded IPv6 %s has wrong length")
+		return nil
+	}
+	ip := net.IP(decoded)
+	return &ip
+}
+
+func updateListeners(protocol uint8) {
+	switch protocol {
+	case TCP4:
+		addressListeningTCP4, globalListeningTCP4 = getListenerMaps(TCP4Data, "00000000", "0A", convertIPv4)
+	case UDP4:
+		addressListeningUDP4, globalListeningUDP4 = getListenerMaps(UDP4Data, "00000000", "07", convertIPv4)
+	case TCP6:
+		addressListeningTCP6, globalListeningTCP6 = getListenerMaps(TCP6Data, "00000000000000000000000000000000", "0A", convertIPv6)
+	case UDP6:
+		addressListeningUDP6, globalListeningUDP6 = getListenerMaps(UDP6Data, "00000000000000000000000000000000", "07", convertIPv6)
+	}
+}
+
+func getListenerMaps(procFile, zeroIP, socketStatusListening string, ipConverter func(string) *net.IP) (map[string][]int, map[uint16][]int) {
+	addressListening := make(map[string][]int)
+	globalListening := make(map[uint16][]int)
+
+	// open file
+	socketData, err := os.Open(procFile)
+	if err != nil {
+		log.Warningf("process: could not read %s: %s", procFile, err)
+		return addressListening, globalListening
+	}
+	defer socketData.Close()
+
+	// file scanner
+	scanner := bufio.NewScanner(socketData)
+	scanner.Split(bufio.ScanLines)
+
+	// parse
+	scanner.Scan() // skip first line
+	for scanner.Scan() {
+		line := strings.FieldsFunc(scanner.Text(), procDelimiter)
+		if len(line) < 14 {
+			// log.Tracef("process: too short: %s", line)
+			continue
+		}
+		if line[5] != socketStatusListening {
+			// skip if not listening
+			// log.Tracef("process: not listening %s: %s", line, line[5])
+			continue
+		}
+
+		port, err := strconv.ParseUint(line[2], 16, 16)
+		// log.Tracef("port: %s", line[2])
+		if err != nil {
+			log.Warningf("process: could not parse port %s: %s", line[2], err)
+			continue
+		}
+
+		uid, err := strconv.ParseInt(line[11], 10, 32)
+		// log.Tracef("uid: %s", line[11])
+		if err != nil {
+			log.Warningf("process: could not parse uid %s: %s", line[11], err)
+			continue
+		}
+
+		inode, err := strconv.ParseInt(line[13], 10, 32)
+		// log.Tracef("inode: %s", line[13])
+		if err != nil {
+			log.Warningf("process: could not parse inode %s: %s", line[13], err)
+			continue
+		}
+
+		if line[1] == zeroIP {
+			globalListening[uint16(port)] = []int{int(uid), int(inode)}
+		} else {
+			address := ipConverter(line[1])
+			if address != nil {
+				addressListening[fmt.Sprintf("%s:%d", address, port)] = []int{int(uid), int(inode)}
+			}
+		}
+
+	}
+
+	return addressListening, globalListening
+}
+
+func GetActiveConnectionIDs() []string {
+	var connections []string
+
+	connections = append(connections, getConnectionIDsFromSource(TCP4Data, 6, convertIPv4)...)
+	connections = append(connections, getConnectionIDsFromSource(UDP4Data, 17, convertIPv4)...)
+	connections = append(connections, getConnectionIDsFromSource(TCP6Data, 6, convertIPv6)...)
+	connections = append(connections, getConnectionIDsFromSource(UDP6Data, 17, convertIPv6)...)
+
+	return connections
+}
+
+func getConnectionIDsFromSource(source string, protocol uint16, ipConverter func(string) *net.IP) []string {
+	var connections []string
+
+	// open file
+	socketData, err := os.Open(source)
+	if err != nil {
+		log.Warningf("process: could not read %s: %s", source, err)
+		return connections
+	}
+	defer socketData.Close()
+
+	// file scanner
+	scanner := bufio.NewScanner(socketData)
+	scanner.Split(bufio.ScanLines)
+
+	// parse
+	scanner.Scan() // skip first line
+	for scanner.Scan() {
+		line := strings.FieldsFunc(scanner.Text(), procDelimiter)
+		if len(line) < 14 {
+			// log.Tracef("process: too short: %s", line)
+			continue
+		}
+
+		// skip listeners and closed connections
+		if line[5] == "0A" || line[5] == "07" {
+			continue
+		}
+
+		localIP := ipConverter(line[1])
+		if localIP == nil {
+			continue
+		}
+
+		localPort, err := strconv.ParseUint(line[2], 16, 16)
+		if err != nil {
+			log.Warningf("process: could not parse port: %s", err)
+			continue
+		}
+
+		remoteIP := ipConverter(line[3])
+		if remoteIP == nil {
+			continue
+		}
+
+		remotePort, err := strconv.ParseUint(line[4], 16, 16)
+		if err != nil {
+			log.Warningf("process: could not parse port: %s", err)
+			continue
+		}
+
+		connections = append(connections, fmt.Sprintf("%d-%s-%d-%s-%d", protocol, localIP, localPort, remoteIP, remotePort))
+	}
+
+	return connections
+}
--- a/process/proc/sockets_test.go
+++ b/process/proc/sockets_test.go
@@ -0,0 +1,40 @@
+// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+
+package proc
+
+import (
+	"net"
+	"testing"
+)
+
+func TestSockets(t *testing.T) {
+
+	updateListeners(TCP4)
+	updateListeners(UDP4)
+	updateListeners(TCP6)
+	updateListeners(UDP6)
+	t.Logf("addressListeningTCP4: %v", addressListeningTCP4)
+	t.Logf("globalListeningTCP4: %v", globalListeningTCP4)
+	t.Logf("addressListeningUDP4: %v", addressListeningUDP4)
+	t.Logf("globalListeningUDP4: %v", globalListeningUDP4)
+	t.Logf("addressListeningTCP6: %v", addressListeningTCP6)
+	t.Logf("globalListeningTCP6: %v", globalListeningTCP6)
+	t.Logf("addressListeningUDP6: %v", addressListeningUDP6)
+	t.Logf("globalListeningUDP6: %v", globalListeningUDP6)
+
+	getListeningSocket(&net.IPv4zero, 53, TCP4)
+	getListeningSocket(&net.IPv4zero, 53, UDP4)
+	getListeningSocket(&net.IPv6zero, 53, TCP6)
+	getListeningSocket(&net.IPv6zero, 53, UDP6)
+
+	// spotify: 192.168.0.102:5353     192.121.140.65:80
+	localIP := net.IPv4(192, 168, 127, 10)
+	uid, inode, ok := getConnectionSocket(&localIP, 46634, TCP4)
+	t.Logf("getConnectionSocket: %d %d %v", uid, inode, ok)
+
+	activeConnectionIDs := GetActiveConnectionIDs()
+	for _, connID := range activeConnectionIDs {
+		t.Logf("active: %s", connID)
+	}
+
+}