netlocker fixes

3 files changed, 103 insertions, 6 deletions

diff --git a/src/fnettrace/fnettrace.h b/src/fnettrace/fnettrace.h
index 66b7378da..b30a9f10d 100644
--- a/src/fnettrace/fnettrace.h
+++ b/src/fnettrace/fnettrace.h
@@ -23,10 +23,15 @@
 #include "../include/common.h"
 #include <unistd.h>
 #include <sys/stat.h>
+#include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <time.h>
 #include <stdarg.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+
 //#define DEBUG 1
 
 #define NETLOCK_INTERVAL 60     // seconds
@@ -62,4 +67,7 @@ extern int geoip_calls;
 void load_hostnames(const char *fname);
 char* retrieve_hostname(uint32_t ip);
 
+// tail.c
+void tail(const char *logfile);
+
 #endif
\ No newline at end of file
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c
index e58cc79b3..31d49d839 100644
--- a/src/fnettrace/main.c
+++ b/src/fnettrace/main.c
@@ -23,6 +23,7 @@
 #define MAX_BUF_SIZE (64 * 1024)
 
 static int arg_netfilter = 0;
+static int arg_tail = 0;
 static char *arg_log = NULL;
 
 typedef struct hnode_t {
@@ -574,11 +575,16 @@ void logprintf(char* fmt, ...) {
 }
 
 static void usage(void) {
-        printf("Usage: fnetlock [OPTIONS]\n");
+        printf("Usage: fnettrace [OPTIONS]\n");
         printf("Options:\n");
         printf("   --help, -? - this help screen\n");
         printf("   --log=filename - netlocker logfile\n");
         printf("   --netfilter - build the firewall rules and commit them.\n");
+        printf("   --tail - \"tail -f\" functionality\n");
+        printf("Examples:\n");
+        printf("   # fnettrace                              - traffic trace\n");
+        printf("   # fnettrace --netfilter --log=logfile    - netlocker, dump output in logfile\n");
+        printf("   # fnettrace --tail --log=logifile        - similar to \"tail -f logfile\"\n");
         printf("\n");
 }
 
@@ -599,11 +605,6 @@ int main(int argc, char **argv) {
         printf("%s\n", name);
 #endif
 
-        if (getuid() != 0) {
-                fprintf(stderr, "Error: you need to be root to run this program\n");
-                return 1;
-        }
-
         for (i = 1; i < argc; i++) {
                 if (strcmp(argv[i], "--help") == 0 || strcmp(argv[i], "-?") == 0) {
                         usage();
@@ -611,6 +612,8 @@ int main(int argc, char **argv) {
                 }
                 else if (strcmp(argv[i], "--netfilter") == 0)
                         arg_netfilter = 1;
+                else if (strcmp(argv[i], "--tail") == 0)
+                        arg_tail = 1;
                 else if (strncmp(argv[i], "--log=", 6) == 0)
                         arg_log = argv[i] + 6;
                 else {
@@ -619,6 +622,24 @@ int main(int argc, char **argv) {
                 }
         }
 
+        // tail
+        if (arg_tail) {
+                if (!arg_log) {
+                        fprintf(stderr, "Error: no log file\n");
+                        usage();
+                        exit(1);
+                }
+
+                tail(arg_log);
+                sleep(5);
+                exit(0);
+        }
+
+        if (getuid() != 0) {
+                fprintf(stderr, "Error: you need to be root to run this program\n");
+                return 1;
+        }
+
         ansi_clrscr();
         if (arg_netfilter)
                 logprintf("starting network lockdown\n");
@@ -629,6 +650,11 @@ int main(int argc, char **argv) {
 
         run_trace();
         if (arg_netfilter) {
+                // TCP path MTU discovery will not work properly since the firewall drops all ICMP packets
+                // Instead, we use iPacketization Layer PMTUD (RFC 4821) support in Linux kernel
+                int rv = system("echo 1 > /proc/sys/net/ipv4/tcp_mtu_probing");
+                (void) rv;
+
                 deploy_netfilter();
                 sleep(3);
                 if (arg_log)
diff --git a/src/fnettrace/tail.c b/src/fnettrace/tail.c
new file mode 100644
index 000000000..a910788d6
--- /dev/null
+++ b/src/fnettrace/tail.c
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fnettrace.h"
+
+void tail(const char *logfile) {
+        assert(logfile);
+
+        // wait for no more than 5 seconds for the logfile to appear in the filesystem
+        int cnt = 5;
+        while (access(logfile, R_OK) && cnt > 0)
+                cnt--;
+        if (cnt == 0)
+                exit(1);
+
+        off_t last_size = 0;
+
+        while (1) {
+                int fd = open(logfile, O_RDONLY);
+                if (fd == -1)
+                        return;
+
+                off_t size = lseek(fd, 0, SEEK_END);
+                if (size < 0) {
+                        close(fd);
+                        return;
+                }
+
+                char *content = NULL;
+                int mmapped = 0;
+                if (size && size != last_size) {
+                        content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
+                        close(fd);
+                        if (content != MAP_FAILED)
+                                mmapped = 1;
+                }
+
+                if (mmapped) {
+                        printf("%.*s", (int) (size - last_size), content + last_size);
+                        fflush(0);
+                        munmap(content, size);
+                        last_size = size;
+                }
+
+                sleep(1);
+        }
+}