SockDiag.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ Secure Connection
 * Copyright (C) 2025–2026 Calogero Scarnà
 * GPL-3.0
 */
 
#include "bsc/net/SockDiag.hpp"
 
#include <arpa/inet.h>
#include <cstring>
#include <errno.h>
#include <linux/inet_diag.h>
#include <linux/netlink.h>
#include <linux/sock_diag.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <unistd.h>
 
namespace bsc::net {
 
namespace {
 
// Query a NETLINK_SOCK_DIAG per TCP o UDP su IPv4 o IPv6 con filtro esatto
// sulla 4-tupla. Ritorna inode+uid del socket trovato, o nullopt.
std::optional<SockInfo> sockdiag_query(int family, int protocol,
                                       const std::string& src_ip, std::uint16_t src_port,
                                       const std::string& dst_ip, std::uint16_t dst_port)
{
    int fd = ::socket(AF_NETLINK, SOCK_DGRAM | SOCK_CLOEXEC, NETLINK_SOCK_DIAG);
    if (fd < 0) return std::nullopt;
 
    // Timeout 100ms sulla ricezione: non dobbiamo mai bloccare NFQUEUE
    // per tempi lunghi. Il kernel risponde in microsecondi quando trova.
    struct timeval tv{};
    tv.tv_sec  = 0;
    tv.tv_usec = 100 * 1000;
    ::setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
 
    // Prepara la richiesta inet_diag con filtro esatto sulla 4-tupla.
    struct {
        struct nlmsghdr nlh;
        struct inet_diag_req_v2 req;
    } msg{};
 
    msg.nlh.nlmsg_len   = NLMSG_LENGTH(sizeof(msg.req));
    msg.nlh.nlmsg_type  = SOCK_DIAG_BY_FAMILY;
    msg.nlh.nlmsg_flags = NLM_F_REQUEST;
    msg.nlh.nlmsg_seq   = 1;
 
    msg.req.sdiag_family   = static_cast<std::uint8_t>(family);
    msg.req.sdiag_protocol = static_cast<std::uint8_t>(protocol);
    // Stati TCP di interesse: tutti per UDP (che non ha stati).
    // Per TCP accettiamo anche SYN_SENT (3) perche' NFQUEUE ci consegna il
    // SYN prima che la connessione sia stabilita. Bitmask completa per
    // coprire tutti i casi utili.
    msg.req.idiag_states   = 0xFFFFFFFFu;
    msg.req.idiag_ext      = 0;
 
    // Popola la 4-tupla nel filtro. Attenzione: saddr/daddr sono in
    // network-byte-order; porte idem.
    msg.req.id.idiag_sport = htons(src_port);
    msg.req.id.idiag_dport = htons(dst_port);
    msg.req.id.idiag_if    = 0;
    msg.req.id.idiag_cookie[0] = INET_DIAG_NOCOOKIE;
    msg.req.id.idiag_cookie[1] = INET_DIAG_NOCOOKIE;
 
    if (family == AF_INET) {
        in_addr sa{}, da{};
        if (inet_pton(AF_INET, src_ip.c_str(), &sa) != 1 ||
            inet_pton(AF_INET, dst_ip.c_str(), &da) != 1) {
            ::close(fd); return std::nullopt;
        }
        std::memcpy(msg.req.id.idiag_src, &sa.s_addr, 4);
        std::memcpy(msg.req.id.idiag_dst, &da.s_addr, 4);
    } else {
        in6_addr sa{}, da{};
        if (inet_pton(AF_INET6, src_ip.c_str(), &sa) != 1 ||
            inet_pton(AF_INET6, dst_ip.c_str(), &da) != 1) {
            ::close(fd); return std::nullopt;
        }
        std::memcpy(msg.req.id.idiag_src, &sa.s6_addr, 16);
        std::memcpy(msg.req.id.idiag_dst, &da.s6_addr, 16);
    }
 
    // Invia al kernel (dest: kernel = pid 0)
    struct sockaddr_nl dest{};
    dest.nl_family = AF_NETLINK;
    const auto sent = ::sendto(fd, &msg, msg.nlh.nlmsg_len, 0,
                               reinterpret_cast<struct sockaddr*>(&dest), sizeof(dest));
    if (sent < 0) { ::close(fd); return std::nullopt; }
 
    // Ricevi la risposta
    char buf[8192];
    const auto rcv = ::recv(fd, buf, sizeof(buf), 0);
    ::close(fd);
    if (rcv <= 0) return std::nullopt;
    // NLMSG_NEXT decrementa in-place il contatore, quindi n non puo'
    // essere const.
    auto n = static_cast<unsigned int>(rcv);
 
    struct nlmsghdr* nh = reinterpret_cast<struct nlmsghdr*>(buf);
    for (; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n)) {
        if (nh->nlmsg_type == NLMSG_DONE) break;
        if (nh->nlmsg_type == NLMSG_ERROR) return std::nullopt;
        if (nh->nlmsg_type != SOCK_DIAG_BY_FAMILY) continue;
 
        auto* diag = reinterpret_cast<struct inet_diag_msg*>(NLMSG_DATA(nh));
        SockInfo info;
        info.inode = diag->idiag_inode;
        info.uid   = diag->idiag_uid;
        if (info.inode != 0) return info;
    }
    return std::nullopt;
}
 
} // namespace
 
std::optional<SockInfo> sockdiag_lookup_tcp(const std::string& src_ip,
                                            std::uint16_t       src_port,
                                            const std::string& dst_ip,
                                            std::uint16_t       dst_port)
{
    if (src_ip.empty() || dst_ip.empty()) return std::nullopt;
    const bool is_v6 = src_ip.find(':') != std::string::npos ||
                       dst_ip.find(':') != std::string::npos;
    return sockdiag_query(is_v6 ? AF_INET6 : AF_INET, IPPROTO_TCP,
                          src_ip, src_port, dst_ip, dst_port);
}
 
std::optional<SockInfo> sockdiag_lookup_udp(const std::string& src_ip,
                                            std::uint16_t       src_port,
                                            const std::string& dst_ip,
                                            std::uint16_t       dst_port)
{
    if (src_ip.empty() || dst_ip.empty()) return std::nullopt;
    const bool is_v6 = src_ip.find(':') != std::string::npos ||
                       dst_ip.find(':') != std::string::npos;
    return sockdiag_query(is_v6 ? AF_INET6 : AF_INET, IPPROTO_UDP,
                          src_ip, src_port, dst_ip, dst_port);
}
 
} // namespace bsc::net