initial import

1 files changed, 582 insertions, 0 deletions

diff --git a/src/sniffer.c b/src/sniffer.c
new file mode 100644
index 0000000..8b71570
--- /dev/null
+++ b/src/sniffer.c
@@ -0,0 +1,582 @@
+#define _GNU_SOURCE
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <limits.h>
+#include <errno.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+#include <netinet/ip_icmp.h>
+
+#include <arpa/inet.h>
+#include <net/if.h>
+
+#include <linux/if_packet.h>
+#include <linux/if_ether.h>
+#include <linux/filter.h>
+
+// for mapping DNS query -> uid
+/* #define BUF_SIZE 8192 */
+/* #include <errno.h> */
+/* #include <linux/inet_diag.h> */
+/* #include <linux/netlink.h> */
+/* #include <linux/rtnetlink.h> */
+/* #include <linux/sock_diag.h> */
+/* static void dump_udp_sockets(); */
+
+
+#include "agent_context.h"
+#include "output.h"
+#include "sniffer.h"
+#include "error.h"
+#include "time_common.h"
+#include "net.h"
+#include "dns.h"
+
+// apply a BPF filter to the socket
+// TODO user-specified patterns
+void sniffer_apply_filter(sock_t s) {
+	// tcpdump -dd '(ip or ip6) and (udp port 53 or (tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0))'
+	struct sock_filter bpf[] = {
+		{ 0x28, 0, 0, 0x0000000c },
+		{ 0x15, 0, 15, 0x00000800 },
+		{ 0x30, 0, 0, 0x00000017 },
+		{ 0x15, 0, 7, 0x00000011 },
+		{ 0x28, 0, 0, 0x00000014 },
+		{ 0x45, 19, 0, 0x00001fff },
+		{ 0xb1, 0, 0, 0x0000000e },
+		{ 0x48, 0, 0, 0x0000000e },
+		{ 0x15, 15, 0, 0x00000035 },
+		{ 0x48, 0, 0, 0x00000010 },
+		{ 0x15, 13, 14, 0x00000035 },
+		{ 0x15, 0, 13, 0x00000006 },
+		{ 0x28, 0, 0, 0x00000014 },
+		{ 0x45, 11, 0, 0x00001fff },
+		{ 0xb1, 0, 0, 0x0000000e },
+		{ 0x50, 0, 0, 0x0000001b },
+		{ 0x45, 7, 8, 0x00000007 },
+		{ 0x15, 0, 7, 0x000086dd },
+		{ 0x30, 0, 0, 0x00000014 },
+		{ 0x15, 0, 5, 0x00000011 },
+		{ 0x28, 0, 0, 0x00000036 },
+		{ 0x15, 2, 0, 0x00000035 },
+		{ 0x28, 0, 0, 0x00000038 },
+		{ 0x15, 0, 1, 0x00000035 },
+		{ 0x6, 0, 0, 0x00040000 },
+		{ 0x6, 0, 0, 0x00000000 },
+	};
+
+	struct sock_fprog program = {
+		.len = sizeof(bpf) / sizeof(bpf[0]),
+		.filter = bpf,
+	};
+
+	if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &program, sizeof(program)) == -1) {
+		error_fatal("FATAL: setsockopt SO_ATTACH_FILTER: %s", strerror(errno));
+	}
+}
+
+sock_t sniffer_init_interface(const char *interface, bool promisc) {
+	if (!interface) {
+		error("setup_sniffer: NULL interface");
+		return -1;
+	}
+
+	sock_t sniffer = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
+	if (sniffer < 0) {
+		error("socket: %s", strerror(errno));
+		return -1;
+	}
+
+	// set non-blocking
+	int flags = fcntl(sniffer, F_GETFL, 0);
+	if (flags == -1) {
+		error("fcntl F_GETFL: %s", strerror(errno));
+		close(sniffer);
+		return -1;
+	}
+
+	if (fcntl(sniffer, F_SETFL, flags | O_NONBLOCK) == -1) {
+		error("fcntl F_SETFL: %s", strerror(errno));
+		close(sniffer);
+		return -1;
+	}
+
+	struct sockaddr_ll sll;
+	struct ifreq ifr;
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, interface, IFNAMSIZ - 1);
+	if (ioctl(sniffer, SIOCGIFINDEX, &ifr) == -1) {
+		error("ioctl SIOCGIFINDEX: %s", strerror(errno));
+		close(sniffer);
+		return -1;
+	}
+
+	memset(&sll, 0, sizeof(sll));
+	sll.sll_family = AF_PACKET;
+	sll.sll_ifindex = ifr.ifr_ifindex;
+	sll.sll_protocol = htons(ETH_P_ALL);
+	if (bind(sniffer, (struct sockaddr *)&sll, sizeof(sll)) == -1) {
+		error("bind: %s", strerror(errno));
+		close(sniffer);
+		return -1;
+	}
+
+	// TODO Enable promiscuous mode if desired
+	if (promisc) {
+		struct packet_mreq mreq;
+		memset(&mreq, 0, sizeof(mreq));
+		mreq.mr_ifindex = ifr.ifr_ifindex;
+		mreq.mr_type = PACKET_MR_PROMISC;
+		if (setsockopt(sniffer, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) == -1) {
+			error("setsockopt PACKET_ADD_MEMBERSHIP: %s", strerror(errno));
+			close(sniffer);
+			return -1;
+		}
+	}
+
+	sniffer_apply_filter(sniffer);
+
+	return sniffer;
+}
+
+static void json_add_tcp_flag_array(json_t *buf, uint8_t flags) {
+	json_add_int(buf, "flags_int", flags);
+	json_add_array_start(buf, "flags");
+
+	if (flags & TH_SYN)  json_array_add_string(buf, "SYN");
+	if (flags & TH_ACK)  json_array_add_string(buf, "ACK");
+	if (flags & TH_FIN)  json_array_add_string(buf, "FIN");
+	if (flags & TH_RST)  json_array_add_string(buf, "RST");
+	if (flags & TH_PUSH) json_array_add_string(buf, "PSH");
+	if (flags & TH_URG)  json_array_add_string(buf, "URG");
+	if (flags & TH_ECE)  json_array_add_string(buf, "ECE");
+	if (flags & TH_CWR)  json_array_add_string(buf, "CWR");
+
+	json_end_array(buf);
+}
+
+static void sniffer_log_tcp_event(agent_context_t *ctx,
+								  const char *ifname,
+								  const char *proto,
+								  const char *src_ip, uint16_t src_port,
+								  const char *dst_ip, uint16_t dst_port,
+								  int ttl_or_hop,
+								  uint8_t flags) {
+	json_t buf;
+	json_init(&buf);
+	json_start_object(&buf);
+
+	json_add_double(&buf, "timestamp", timestamp());
+	json_add_string(&buf, "hostname", ctx->hostname);
+	json_add_string(&buf, "event_type", "tcp");
+	json_add_string(&buf, "interface", ifname);
+	json_add_string(&buf, "protocol", proto);
+	json_add_string(&buf, "source_ip", src_ip);
+	json_add_int(&buf, "source_port", src_port);
+	json_add_string(&buf, "dest_ip", dst_ip);
+	json_add_int(&buf, "dest_port", dst_port);
+	json_add_int(&buf, (strcmp(proto, "ipv6") == 0) ? "hop_limit" : "ttl", ttl_or_hop);
+	json_add_tcp_flag_array(&buf, flags);
+
+	json_end_object(&buf);
+	output(json_get(&buf));
+	json_free(&buf);
+}
+
+static void sniffer_log_dns_event(agent_context_t *ctx, const char *ifname, const struct dns_question *q) {
+	json_t buf;
+	json_init(&buf);
+	json_start_object(&buf);
+	json_add_double(&buf, "timestamp", timestamp());
+	json_add_string(&buf, "hostname", ctx->hostname);
+	json_add_string(&buf, "event_type", "dns_query");
+	json_add_string(&buf, "interface", ifname);
+	json_add_string(&buf, "question", q->name);
+	json_add_int(&buf, "qtype", q->qtype);
+	json_add_string(&buf, "qtype_str", dns_type_to_string(q->qtype));
+	json_end_object(&buf);
+	output(json_get(&buf));
+	json_free(&buf);
+}
+
+static void sniffer_parse_ipv4(agent_context_t *ctx, const char *ifname, uint8_t *data, size_t len) {
+	if (len < sizeof(struct iphdr)) {
+		return;
+	}
+
+	struct iphdr *ip_header = (struct iphdr *)data;
+
+	// TODO handle fragmentation better.
+	if (ntohs(ip_header->frag_off) & 0x1FFF) {
+		//printf("Skipping fragmented IPv4 packet\n");
+		return;
+	}
+
+	struct sockaddr_in source, dest;
+	memset(&source, 0, sizeof(source));
+	source.sin_addr.s_addr = ip_header->saddr;
+	memset(&dest, 0, sizeof(dest));
+	dest.sin_addr.s_addr = ip_header->daddr;
+
+	char src_ip[INET_ADDRSTRLEN];
+	char dst_ip[INET_ADDRSTRLEN];
+	inet_ntop(AF_INET, &source.sin_addr, src_ip, sizeof(src_ip));
+	inet_ntop(AF_INET, &dest.sin_addr, dst_ip, sizeof(dst_ip));
+
+	uint8_t *transport = data + ip_header->ihl * 4;
+
+	switch (ip_header->protocol) {
+	case IPPROTO_TCP:
+		if (len < (transport - data) + sizeof(struct tcphdr)) {
+			// not big enough for TCP header
+			return;
+		}
+
+		struct tcphdr *tcp = (struct tcphdr *)transport;
+
+		size_t tcp_header_len = tcp->doff * 4;
+		if (len < (transport - data) + tcp_header_len) {
+			// incomplete TCP header
+			return;
+		}
+
+		uint16_t tcp_sport = ntohs(tcp->source);
+		uint16_t tcp_dport = ntohs(tcp->dest);
+
+		// TODO map socket to PID
+		sniffer_log_tcp_event(ctx, ifname, "ipv4", src_ip, tcp_sport, dst_ip, tcp_dport, ip_header->ttl, tcp->th_flags);
+		break;
+
+	case IPPROTO_UDP:
+		if (len < (transport - data) + sizeof(struct udphdr)) {
+			// not big enough for UDP header
+			return;
+		}
+
+		struct udphdr *udp = (struct udphdr *)transport;
+		uint16_t udp_sport = ntohs(udp->source);
+		uint16_t udp_dport = ntohs(udp->dest);
+
+		if (udp_sport == 53 || udp_dport == 53) { // DNS
+			size_t dns_len = len - (transport - data) - sizeof(struct udphdr);
+			const uint8_t *dns_payload = (const uint8_t *)(udp + 1);
+
+			//pid_t pid = match_udp_inode(ip_header->saddr, sport);
+			struct dns_question qs[MAX_DNS_QUESTIONS];
+			size_t count = parse_dns_udp(dns_payload, dns_len, qs, MAX_DNS_QUESTIONS);
+			for (int i = 0; i < count; i++) {
+				sniffer_log_dns_event(ctx, ifname, &qs[i]);
+			}
+		}
+		break;
+
+	case IPPROTO_ICMP:
+		//printf("ICMP: %s -> %s\n", src_ip, dst_ip);
+		break;
+
+	default:
+		// shouldn't get here due to bpf filter
+		//printf("Unknown IPv4 protocol: %d\n", ip_header->protocol);
+		break;
+	}
+}
+
+static void sniffer_parse_ipv6(agent_context_t *ctx, const char *ifname, uint8_t *data, size_t len) {
+	if (len < sizeof(struct ip6_hdr))
+		return;
+
+	struct ip6_hdr *ip6h = (struct ip6_hdr *)data;
+
+	char src_ip[INET6_ADDRSTRLEN];
+	char dst_ip[INET6_ADDRSTRLEN];
+	inet_ntop(AF_INET6, &ip6h->ip6_src, src_ip, sizeof(src_ip));
+	inet_ntop(AF_INET6, &ip6h->ip6_dst, dst_ip, sizeof(dst_ip));
+
+	uint8_t *transport = data + sizeof(struct ip6_hdr);
+	size_t transport_len = len - sizeof(struct ip6_hdr);
+
+	switch (ip6h->ip6_nxt) {
+	case IPPROTO_TCP:
+		if (transport_len < sizeof(struct tcphdr)) {
+			return;
+		}
+		struct tcphdr *tcp = (struct tcphdr *)transport;
+		uint16_t tcp_sport = ntohs(tcp->source);
+		uint16_t tcp_dport = ntohs(tcp->dest);
+
+		// TODO map socket to PID
+		sniffer_log_tcp_event(ctx, ifname, "ipv6", src_ip, tcp_sport, dst_ip, tcp_dport, ip6h->ip6_hlim, tcp->th_flags);
+		break;
+
+	case IPPROTO_UDP:
+		if (transport_len < sizeof(struct udphdr)) {
+			return;
+		}
+		struct udphdr *udp = (struct udphdr *)transport;
+		uint16_t udp_sport = ntohs(udp->source);
+		uint16_t udp_dport = ntohs(udp->dest);
+
+		if (udp_sport == 53 || udp_dport == 53) { // DNS
+			size_t dns_len = len - (transport - data) - sizeof(struct udphdr);
+			const uint8_t *dns_payload = (const uint8_t *)(udp + 1);
+
+			//pid_t pid = match_udp_inode(ip_header->saddr, sport);
+			struct dns_question qs[MAX_DNS_QUESTIONS];
+			int count = parse_dns_udp(dns_payload, dns_len, qs, MAX_DNS_QUESTIONS);
+			for (int i = 0; i < count; i++) {
+				sniffer_log_dns_event(ctx, ifname, &qs[i]);
+			}
+		}
+		break;
+
+	case IPPROTO_ICMPV6:
+		//printf("ICMPv6: %s -> %s\n", src_ip, dst_ip);
+		break;
+
+	default:
+		// shouldn't get here due to bpf filter
+		//printf("Unknown IPv6 NextHeader: %d\n", ip6h->nexthdr);
+		break;
+	}
+}
+
+static void sniffer_parse_ethernet(agent_context_t *ctx, const char *ifname, uint8_t *buffer, size_t len) {
+	if (len < sizeof(struct ethhdr)) {
+		return;
+	}
+
+	struct ethhdr *eth = (struct ethhdr *)buffer;
+	uint16_t       ethertype = ntohs(eth->h_proto);
+	size_t         offset = sizeof(struct ethhdr);
+
+	// TODO log vlan tags
+	while (ethertype == ETH_P_8021Q) {
+		if (len < offset + 4)
+			return;
+		ethertype = ntohs(*(uint16_t *)(buffer + offset + 2));
+		offset += 4;
+	}
+
+	switch(ethertype) {
+	case ETH_P_IP:
+		sniffer_parse_ipv4(ctx, ifname, buffer + offset, len - offset);
+		break;
+	case ETH_P_IPV6:
+		sniffer_parse_ipv6(ctx, ifname, buffer + offset, len - offset);
+		break;
+	default:
+		// unknown/unsupported Ethertype
+		break;
+	}
+}
+
+void sniffer_handle_packet(sock_t sniffer, agent_context_t *ctx) {
+	uint8_t buffer[2048];
+	struct sockaddr_ll sll;
+
+	struct iovec iov = {
+		.iov_base = buffer,
+		.iov_len = sizeof(buffer)
+	};
+
+	struct msghdr msg = {
+		.msg_name = &sll,
+		.msg_namelen = sizeof(sll),
+		.msg_iov = &iov,
+		.msg_iovlen = 1
+	};
+
+	ssize_t data_size = recvmsg(sniffer, &msg, 0);
+	if (data_size < 0) {
+		error("recvmsg: %s", strerror(errno));
+		return;
+	}
+
+	char ifname[IFNAMSIZ] = "unknown";
+	if_indextoname(sll.sll_ifindex, ifname);
+
+	sniffer_parse_ethernet(ctx, ifname, buffer, data_size);
+}
+
+// This attempts to parse /proc/net/udp to find the inode of the
+// socket, then walk /proc/PID/fd/* to correlate it to a process. this
+// is too slow to give meaningful results most of the time
+/* pid_t match_udp_inode(uint32_t ip_be, uint16_t port_be) { */
+/* 	FILE *fp = fopen("/proc/net/udp", "r"); */
+/* 	if (!fp) { */
+/* 		return 0; */
+/* 	} */
+
+/* 	char line[512]; */
+/* 	fgets(line, sizeof(line), fp); // skip header */
+
+/* 	char local_addr[64]; */
+/* 	uint32_t ip_hex; */
+/* 	uint32_t port_hex; */
+/* 	unsigned long inode = 0; */
+
+/* 	while (fgets(line, sizeof(line), fp)) { */
+/* 		sscanf(line, "%*d: %64[0-9A-Fa-f]:%x %*s %*s %*s %*s %*s %lu", */
+/* 			   local_addr, */
+/* 			   &port_hex, */
+/* 			   &inode); */
+
+/* 		sscanf(local_addr, "%x", &ip_hex); */
+
+/* 		if (ip_hex == ntohl(ip_be) && port_hex == ntohs(port_be)) { */
+/* 			break; */
+/* 		} else { */
+/* 			inode = 0; */
+/* 		} */
+/* 	} */
+
+/* 	fclose(fp); */
+/* 	if (!inode) { */
+/* 		return 0; */
+/* 	} */
+
+/* 	DIR *proc = opendir("/proc"); */
+/* 	if (!proc) { */
+/* 		return 0; */
+/* 	} */
+
+/* 	struct dirent *entry; */
+/* 	while ((entry = readdir(proc))) { */
+/* 		if (!isdigit(entry->d_name[0])) { */
+/* 			continue; */
+/* 		} */
+
+/* 		char fd_dir[PATH_MAX]; */
+/* 		snprintf(fd_dir, sizeof(fd_dir), "/proc/%s/fd", entry->d_name); */
+
+/* 		DIR *fd = opendir(fd_dir); */
+/* 		if (!fd) { */
+/* 			continue; */
+/* 		} */
+
+/* 		struct dirent *fd_entry; */
+/* 		while((fd_entry = readdir(fd))) { */
+/* 			char link_path[PATH_MAX + 1024]; */
+/* 			char target[PATH_MAX]; */
+
+/* 			snprintf(link_path, sizeof(link_path), "%s/%s", fd_dir, fd_entry->d_name); */
+/* 			ssize_t len = readlink(link_path, target, sizeof(target) - 1); */
+/* 			if (len == -1) { */
+/* 				continue; */
+/* 			} */
+/* 			target[len] = '\0'; */
+
+/* 			char socket_str[64] = {0}; */
+/* 			snprintf(socket_str, sizeof(socket_str), "socket:[%lu]", inode); */
+/* 			if (strcmp(target, socket_str) == 0) { */
+/* 				closedir(fd); */
+/* 				closedir(proc); */
+/* 				return atoi(entry->d_name); */
+/* 			} */
+/* 		} */
+
+/* 		closedir(fd); */
+/* 	} */
+
+/* 	closedir(proc); */
+
+/* 	return 0; */
+/* } */
+
+
+
+// TODO investigate this further. Would be nice to correlate DNS
+// requests to a process id, but this search method is too slow.
+
+// This is able to get the UID initiating the DNS query and inode, but
+// traversing /proc to match inode->PID is too slow.
+/* static void dump_udp_sockets() { */
+/*     int sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_INET_DIAG); */
+/*     if (sock < 0) { */
+/*         perror("socket"); */
+/*         exit(1); */
+/*     } */
+
+/*     char req_buf[BUF_SIZE]; */
+/*     memset(req_buf, 0, sizeof(req_buf)); */
+
+/*     struct nlmsghdr *nlh = (struct nlmsghdr *)req_buf; */
+/*     struct inet_diag_req_v2 *req = (struct inet_diag_req_v2 *)(nlh + 1); */
+
+/*     nlh->nlmsg_len = NLMSG_LENGTH(sizeof(*req)); */
+/*     nlh->nlmsg_type = SOCK_DIAG_BY_FAMILY; */
+/*     nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; */
+/*     nlh->nlmsg_seq = 123456; */
+
+/*     req->sdiag_family = AF_INET; */
+/*     req->sdiag_protocol = IPPROTO_UDP; */
+/*     req->idiag_ext = 0; */
+/*     req->idiag_states = -1; */
+
+/*     struct sockaddr_nl sa = {0}; */
+/*     sa.nl_family = AF_NETLINK; */
+
+/*     if (sendto(sock, req_buf, nlh->nlmsg_len, 0, (struct sockaddr *)&sa, sizeof(sa)) < 0) { */
+/*         perror("sendto"); */
+/*         close(sock); */
+/*         exit(1); */
+/*     } */
+
+/*     char buffer[BUF_SIZE]; */
+/*     while (1) { */
+/*         int len = recv(sock, buffer, sizeof(buffer), 0); */
+/*         if (len < 0) { */
+/*             perror("recv"); */
+/*             break; */
+/*         } */
+
+/*         struct nlmsghdr *nlh = (struct nlmsghdr *)buffer; */
+/*         for (; NLMSG_OK(nlh, len); nlh = NLMSG_NEXT(nlh, len)) { */
+/*             if (nlh->nlmsg_type == NLMSG_DONE) */
+/*                 return; */
+/*             if (nlh->nlmsg_type == NLMSG_ERROR) { */
+/*                 fprintf(stderr, "netlink error\n"); */
+/*                 return; */
+/*             } */
+
+/*             struct inet_diag_msg *diag = (struct inet_diag_msg *)NLMSG_DATA(nlh); */
+/*             struct sockaddr_in src = { */
+/*                 .sin_family = AF_INET, */
+/*                 .sin_port = diag->id.idiag_sport, */
+/*                 .sin_addr.s_addr = diag->id.idiag_src[0], */
+/*             }; */
+/*             struct sockaddr_in dst = { */
+/*                 .sin_family = AF_INET, */
+/*                 .sin_port = diag->id.idiag_dport, */
+/*                 .sin_addr.s_addr = diag->id.idiag_dst[0], */
+/*             }; */
+
+/*             char src_ip[INET_ADDRSTRLEN]; */
+/*             char dst_ip[INET_ADDRSTRLEN]; */
+/*             inet_ntop(AF_INET, &src.sin_addr, src_ip, sizeof(src_ip)); */
+/*             inet_ntop(AF_INET, &dst.sin_addr, dst_ip, sizeof(dst_ip)); */
+
+/*             printf("UDP %s:%d -> %s:%d  inode=%u uid=%u\n", */
+/*                    src_ip, ntohs(src.sin_port), */
+/*                    dst_ip, ntohs(dst.sin_port), */
+/*                    diag->idiag_inode, */
+/*                    diag->idiag_uid); */
+/*         } */
+/*     } */
+
+/*     close(sock); */
+/* } */