aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/firejail/firejail.h2
-rw-r--r--src/firejail/main.c54
-rw-r--r--src/firejail/netfilter.c8
-rw-r--r--src/firejail/usage.c4
-rw-r--r--src/fnettrace-dns/main.c22
-rw-r--r--src/fnettrace-sni/main.c19
-rw-r--r--src/fnettrace/static-ip-map24
-rw-r--r--src/man/firejail.txt86
8 files changed, 194 insertions, 25 deletions
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 94f970eb8..65907e8ee 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -675,7 +675,7 @@ void check_output(int argc, char **argv);
675 675
676// netfilter.c 676// netfilter.c
677void netfilter_netlock(pid_t pid); 677void netfilter_netlock(pid_t pid);
678void netfilter_trace(pid_t pid); 678void netfilter_trace(pid_t pid, const char *cmd);
679void check_netfilter_file(const char *fname); 679void check_netfilter_file(const char *fname);
680void netfilter(const char *fname); 680void netfilter(const char *fname);
681void netfilter6(const char *fname); 681void netfilter6(const char *fname);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 12c2cf02b..b6e076dfc 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -419,7 +419,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
419 fprintf(stderr, "Error: --nettrace is only available to root user\n"); 419 fprintf(stderr, "Error: --nettrace is only available to root user\n");
420 exit(1); 420 exit(1);
421 } 421 }
422 netfilter_trace(0); 422 netfilter_trace(0, LIBDIR "/firejail/fnettrace");
423 } 423 }
424 else 424 else
425 exit_err_feature("networking"); 425 exit_err_feature("networking");
@@ -432,7 +432,57 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
432 exit(1); 432 exit(1);
433 } 433 }
434 pid_t pid = require_pid(argv[i] + 11); 434 pid_t pid = require_pid(argv[i] + 11);
435 netfilter_trace(pid); 435 netfilter_trace(pid, LIBDIR "/firejail/fnettrace");
436 }
437 else
438 exit_err_feature("networking");
439 exit(0);
440 }
441 else if (strcmp(argv[i], "--nettrace-dns") == 0) {
442 if (checkcfg(CFG_NETWORK)) {
443 if (getuid() != 0) {
444 fprintf(stderr, "Error: --nettrace-dns is only available to root user\n");
445 exit(1);
446 }
447 netfilter_trace(0, LIBDIR "/firejail/fnettrace-dns");
448 }
449 else
450 exit_err_feature("networking");
451 exit(0);
452 }
453 else if (strncmp(argv[i], "--nettrace-dns=", 15) == 0) {
454 if (checkcfg(CFG_NETWORK)) {
455 if (getuid() != 0) {
456 fprintf(stderr, "Error: --nettrace is only available to root user\n");
457 exit(1);
458 }
459 pid_t pid = require_pid(argv[i] + 15);
460 netfilter_trace(pid, LIBDIR "/firejail/fnettrace-dns");
461 }
462 else
463 exit_err_feature("networking");
464 exit(0);
465 }
466 else if (strcmp(argv[i], "--nettrace-sni") == 0) {
467 if (checkcfg(CFG_NETWORK)) {
468 if (getuid() != 0) {
469 fprintf(stderr, "Error: --nettrace is only available to root user\n");
470 exit(1);
471 }
472 netfilter_trace(0, LIBDIR "/firejail/fnettrace-sni");
473 }
474 else
475 exit_err_feature("networking");
476 exit(0);
477 }
478 else if (strncmp(argv[i], "--nettrace-sni=", 15) == 0) {
479 if (checkcfg(CFG_NETWORK)) {
480 if (getuid() != 0) {
481 fprintf(stderr, "Error: --nettrace is only available to root user\n");
482 exit(1);
483 }
484 pid_t pid = require_pid(argv[i] + 15);
485 netfilter_trace(pid, LIBDIR "/firejail/fnettrace-sni");
436 } 486 }
437 else 487 else
438 exit_err_feature("networking"); 488 exit_err_feature("networking");
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index 686efb6cb..aab03c796 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -91,24 +91,20 @@ void netfilter_netlock(pid_t pid) {
91 // it will never get here!! 91 // it will never get here!!
92} 92}
93 93
94void netfilter_trace(pid_t pid) { 94void netfilter_trace(pid_t pid, const char *cmd) {
95 EUID_ASSERT(); 95 EUID_ASSERT();
96 96
97 // a pid of 0 means the main system network namespace 97 // a pid of 0 means the main system network namespace
98 if (pid) 98 if (pid)
99 enter_network_namespace(pid); 99 enter_network_namespace(pid);
100 100
101 char *cmd;
102 if (asprintf(&cmd, "%s/firejail/fnettrace", LIBDIR) == -1)
103 errExit("asprintf");
104
105 //************************ 101 //************************
106 // build command 102 // build command
107 //************************ 103 //************************
108 char *arg[4]; 104 char *arg[4];
109 arg[0] = "/bin/sh"; 105 arg[0] = "/bin/sh";
110 arg[1] = "-c"; 106 arg[1] = "-c";
111 arg[2] = cmd; 107 arg[2] = (char *) cmd;
112 arg[3] = NULL; 108 arg[3] = NULL;
113 109
114 clearenv(); 110 clearenv();
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index e11081eed..17f5af434 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -153,7 +153,9 @@ static char *usage_str =
153 "\tparent interfaces.\n" 153 "\tparent interfaces.\n"
154 " --netns=name - Run the program in a named, persistent network namespace.\n" 154 " --netns=name - Run the program in a named, persistent network namespace.\n"
155 " --netstats - monitor network statistics.\n" 155 " --netstats - monitor network statistics.\n"
156 " --nettrace - monitor TCP and UDP traffic coming into the sandbox.\n" 156 " --nettrace - monitor received TCP, UDP and ICMP traffic.\n"
157 " --nettrace - monitor DNS queries.\n"
158 " --nettrace - monitor Server Name Indiication (TLS/SNI).\n"
157#endif 159#endif
158 " --nice=value - set nice value.\n" 160 " --nice=value - set nice value.\n"
159 " --no3d - disable 3D hardware acceleration.\n" 161 " --no3d - disable 3D hardware acceleration.\n"
diff --git a/src/fnettrace-dns/main.c b/src/fnettrace-dns/main.c
index 0281b5157..28c76a901 100644
--- a/src/fnettrace-dns/main.c
+++ b/src/fnettrace-dns/main.c
@@ -24,6 +24,8 @@
24#include <linux/if_ether.h> 24#include <linux/if_ether.h>
25#define MAX_BUF_SIZE (64 * 1024) 25#define MAX_BUF_SIZE (64 * 1024)
26 26
27static char last[512] = {'\0'};
28
27// pkt - start of DNS layer 29// pkt - start of DNS layer
28void print_dns(uint32_t ip_src, unsigned char *pkt) { 30void print_dns(uint32_t ip_src, unsigned char *pkt) {
29 assert(pkt); 31 assert(pkt);
@@ -33,6 +35,8 @@ void print_dns(uint32_t ip_src, unsigned char *pkt) {
33 time_t seconds = time(NULL); 35 time_t seconds = time(NULL);
34 struct tm *t = localtime(&seconds); 36 struct tm *t = localtime(&seconds);
35 37
38 int nxdomain = (*(pkt + 3) & 0x03 == 0x03)? 1: 0;
39
36 // expecting a single question count 40 // expecting a single question count
37 if (pkt[4] != 0 || pkt[5] != 1) 41 if (pkt[4] != 0 || pkt[5] != 1)
38 goto errout; 42 goto errout;
@@ -49,8 +53,24 @@ void print_dns(uint32_t ip_src, unsigned char *pkt) {
49 len += delta;; 53 len += delta;;
50 ptr += delta; 54 ptr += delta;
51 } 55 }
56 if (*ptr != 0)
57 goto errout;
58
59 ptr++;
60 uint16_t type;
61 memcpy(&type, ptr, 2);
62 type = ntohs(type);
63
64 // filter output
65 char tmp[sizeof(last)];
66 snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s %s (type %u)%s",
67 t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1,
68 type, (nxdomain)? " NXDOMAIN": "");
69 if (strcmp(tmp, last)) {
70 printf("%s\n", tmp);
71 strcpy(last, tmp);
72 }
52 73
53 printf("%02d:%02d:%02d %15s %s\n", t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1);
54 return; 74 return;
55 75
56errout: 76errout:
diff --git a/src/fnettrace-sni/main.c b/src/fnettrace-sni/main.c
index ea7a91548..571089e29 100644
--- a/src/fnettrace-sni/main.c
+++ b/src/fnettrace-sni/main.c
@@ -24,6 +24,8 @@
24#include <linux/if_ether.h> 24#include <linux/if_ether.h>
25#define MAX_BUF_SIZE (64 * 1024) 25#define MAX_BUF_SIZE (64 * 1024)
26 26
27static char last[512] = {'\0'};
28
27// pkt - start of TLS layer 29// pkt - start of TLS layer
28static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { 30static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) {
29 assert(pkt); 31 assert(pkt);
@@ -67,18 +69,25 @@ static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) {
67 i++; 69 i++;
68 } 70 }
69 71
70 if (name) 72 if (name) {
71 printf("%02d:%02d:%02d %15s %s\n", t->tm_hour, t->tm_min, t->tm_sec, ip, name); 73 // filter output
74 char tmp[sizeof(last)];
75 snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s %s", t->tm_hour, t->tm_min, t->tm_sec, ip, name);
76 if (strcmp(tmp, last)) {
77 printf("%s\n", tmp);
78 strcpy(last, tmp);
79 }
80 }
72 else 81 else
73 goto nosni; 82 goto nosni;
74 return; 83 return;
75 84
76errout: 85errout:
77 printf("%02d:%02d:%02d %15s Error: invalid TLS packet\n", t->tm_hour, t->tm_min, t->tm_sec, ip); 86 printf("%02d:%02d:%02d %-15s Error: invalid TLS packet\n", t->tm_hour, t->tm_min, t->tm_sec, ip);
78 return; 87 return;
79 88
80nosni: 89nosni:
81 printf("%02d:%02d:%02d %15s no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip); 90 printf("%02d:%02d:%02d %-15s no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip);
82 return; 91 return;
83} 92}
84 93
@@ -131,7 +140,7 @@ static void custom_bpf(int sock) {
131} 140}
132 141
133static void run_trace(void) { 142static void run_trace(void) {
134 // grab all Ethernet packets and use a custom BPF filter to get only UDP from source port 53 143 // grab all Ethernet packets and use a custom BPF filter to get TLS/SNI packets
135 int s = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); 144 int s = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
136 if (s < 0) 145 if (s < 0)
137 errExit("socket"); 146 errExit("socket");
diff --git a/src/fnettrace/static-ip-map b/src/fnettrace/static-ip-map
index 97e626526..f9cd907e5 100644
--- a/src/fnettrace/static-ip-map
+++ b/src/fnettrace/static-ip-map
@@ -78,6 +78,7 @@
7845.90.28.0/22 NextDNS 7845.90.28.0/22 NextDNS
79149.112.112.0/24 Quad9 DNS 79149.112.112.0/24 Quad9 DNS
80149.112.120.0/21 CIRA DNS Canada 80149.112.120.0/21 CIRA DNS Canada
81146.255.56.96/29 Applied Privacy
81176.103.128.0/19 Adguard DNS 82176.103.128.0/19 Adguard DNS
82185.228.168.0/24 Cleanbrowsing DNS 83185.228.168.0/24 Cleanbrowsing DNS
83208.67.216.0/21 OpenDNS 84208.67.216.0/21 OpenDNS
@@ -94,13 +95,14 @@
94 95
95# some popular websites 96# some popular websites
9623.160.0.0/24 Twitch 9723.160.0.0/24 Twitch
9723.246.0.0/18, Netflix 9823.246.0.0/18 Netflix
9831.13.24.0/21 Facebook 9931.13.24.0/21 Facebook
9931.13.64.0/18 Facebook 10031.13.64.0/18 Facebook
10037.77.184.0/21 Netflix 10137.77.184.0/21 Netflix
10145.57.0.0/17 Netflix 10245.57.0.0/17 Netflix
10245.58.64.0/20 Dropbox 10345.58.64.0/20 Dropbox
10345.113.128.0/22 Twitch 10445.113.128.0/22 Twitch
10547.88.0.0/14 Alibaba
10452.223.192.0/18 Twitch 10652.223.192.0/18 Twitch
10563.245.208.0/23 Mozilla 10763.245.208.0/23 Mozilla
10664.63.0.0/18 Twitter 10864.63.0.0/18 Twitter
@@ -122,12 +124,12 @@
12299.181.64.0/18 Twitch 12499.181.64.0/18 Twitch
123103.53.48.0/23 Twitch 125103.53.48.0/23 Twitch
124104.244.40.0/21 Twitter 126104.244.40.0/21 Twitter
125129.134.0.0/16 Facebook
126140.82.112.0/20 GitHub
127103.10.124.0/23 Steam 127103.10.124.0/23 Steam
128103.28.54.0/24 Steam 128103.28.54.0/24 Steam
129108.160.160.0/20 Dropbox 129108.160.160.0/20 Dropbox
130108.175.32.0/20 Netflix 130108.175.32.0/20 Netflix
131129.134.0.0/16 Facebook
132140.82.112.0/20 GitHub
131143.55.64.0/20 Github 133143.55.64.0/20 Github
132146.66.152.0/24 Steam 134146.66.152.0/24 Steam
133146.66.155.0/24 Steam 135146.66.155.0/24 Steam
@@ -146,6 +148,7 @@
146162.125.0.0/16 Dropbox 148162.125.0.0/16 Dropbox
147162.213.32.0/22 Ubuntu One 149162.213.32.0/22 Ubuntu One
148162.254.192.0/21 Steam 150162.254.192.0/21 Steam
151172.98.56.0/22 Rumble
149185.2.220.0/22 Netflix 152185.2.220.0/22 Netflix
150185.9.188.0/22 Netflix 153185.9.188.0/22 Netflix
151185.25.182.0/23 Steam 154185.25.182.0/23 Steam
@@ -156,6 +159,7 @@
156185.105.164.0/24 Dropbox 159185.105.164.0/24 Dropbox
157185.125.188.0/22 Ubuntu One 160185.125.188.0/22 Ubuntu One
158185.199.108.0/22 GitHub 161185.199.108.0/22 GitHub
162185.205.69.0/24 Tutanota
159188.64.224.0/21 Twitter 163188.64.224.0/21 Twitter
160190.217.33.0/24 Steam 164190.217.33.0/24 Steam
161192.0.64.0/18 Wordpress 165192.0.64.0/18 Wordpress
@@ -179,9 +183,23 @@
179208.78.164.0/22 Steam 183208.78.164.0/22 Steam
180208.80.152.0/22 Wikipedia 184208.80.152.0/22 Wikipedia
181 185
186# WholeSale Internet
18769.197.128.0/18 WholeSale Internet
188173.208.128.0/17 WholeSale Internet
189204.12.192.0/18 WholeSale Internet
190208.110.64.0/19 WholeSale Internet
191208.110.91.0/24 WholeSale Internet
192208.67.0.0/21 WholeSale Internet
193
182# StackPath 194# StackPath
19569.16.173.0/24 StackPath
19669.16.174.0/23 StackPath
19769.16.176.0/20 StackPath
183151.139.0.0/16 StackPath 198151.139.0.0/16 StackPath
184 199
200# Linode
201172.104.0.0/15 Linode
202
185# Akamai 203# Akamai
18623.0.0.0/12 Akamai 20423.0.0.0/12 Akamai
18723.32.0.0/11 Akamai 20523.32.0.0/11 Akamai
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 82eea3977..3b743386e 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1548,7 +1548,7 @@ PID User RX(KB/s) TX(KB/s) Command
15487383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission 15487383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission
1549.TP 1549.TP
1550\fB\-\-nettrace[=name|pid] 1550\fB\-\-nettrace[=name|pid]
1551Monitor TCP and UDP traffic coming into the sandbox specified by name or pid. Only networked sandboxes 1551Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
1552created with \-\-net are supported. This option is only available when running the sandbox as root. 1552created with \-\-net are supported. This option is only available when running the sandbox as root.
1553.br 1553.br
1554 1554
@@ -1557,9 +1557,7 @@ Without a name/pid, Firejail will monitor the main system network namespace.
1557.br 1557.br
1558 1558
1559.br 1559.br
1560 $ sudo firejail --nettrace=browser 1560$ sudo firejail --nettrace=browser
1561.br
1562
1563.br 1561.br
1564 95 KB/s geoip 457, IP database 4436 1562 95 KB/s geoip 457, IP database 4436
1565.br 1563.br
@@ -1576,10 +1574,86 @@ Without a name/pid, Firejail will monitor the main system network namespace.
1576 1574
1577.br 1575.br
1578If /usr/bin/geoiplookup is installed (geoip-bin package in Debian), 1576If /usr/bin/geoiplookup is installed (geoip-bin package in Debian),
1579the country the IP address originates from is added to the trace. 1577the country the traffic originates from is added to the trace.
1580We also use the static IP map in /etc/firejail/hostnames 1578We also use the static IP map in /usr/lib/firejail/static-ip-map
1581to print the domain names for some of the more common websites and cloud platforms. 1579to print the domain names for some of the more common websites and cloud platforms.
1582No external services are contacted for reverse IP lookup. 1580No external services are contacted for reverse IP lookup.
1581.TP
1582\fB\-\-nettrace-dns[=name|pid]
1583Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes
1584created with \-\-net are supported. This option is only available when running the sandbox as root.
1585.br
1586
1587.br
1588Without a name/pid, Firejail will monitor the main system network namespace.
1589.br
1590
1591.br
1592$ sudo firejail --nettrace-dns=browser
1593.br
159411:31:43 9.9.9.9 linux.com (type 1)
1595.br
159611:31:45 9.9.9.9 fonts.googleapis.com (type 1) NXDOMAIN
1597.br
159811:31:45 9.9.9.9 js.hs-scripts.com (type 1) NXDOMAIN
1599.br
160011:31:45 9.9.9.9 www.linux.com (type 1)
1601.br
160211:31:45 9.9.9.9 fonts.googleapis.com (type 1) NXDOMAIN
1603.br
160411:31:52 9.9.9.9 js.hs-scripts.com (type 1) NXDOMAIN
1605.br
160611:32:05 9.9.9.9 secure.gravatar.com (type 1)
1607.br
160811:32:06 9.9.9.9 secure.gravatar.com (type 1)
1609.br
161011:32:08 9.9.9.9 taikai.network (type 1)
1611.br
161211:32:08 9.9.9.9 cdn.jsdelivr.net (type 1)
1613.br
161411:32:08 9.9.9.9 taikai.azureedge.net (type 1)
1615.br
161611:32:08 9.9.9.9 www.youtube.com (type 1)
1617.br
1618.TP
1619\fB\-\-nettrace-sni[=name|pid]
1620Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes
1621created with \-\-net are supported. This option is only available when running the sandbox as root.
1622.br
1623
1624.br
1625Without a name/pid, Firejail will monitor the main system network namespace.
1626.br
1627
1628.br
1629$ sudo firejail --nettrace-sni=browser
1630.br
163107:49:51 23.185.0.3 linux.com
1632.br
163307:49:51 23.185.0.3 www.linux.com
1634.br
163507:50:05 192.0.73.2 secure.gravatar.com
1636.br
163707:52:35 172.67.68.93 www.howtoforge.com
1638.br
163907:52:37 13.225.103.59 sf.ezoiccdn.com
1640.br
164107:52:42 142.250.176.3 www.gstatic.com
1642.br
164307:53:03 173.236.250.32 www.linuxlinks.com
1644.br
164507:53:05 192.0.77.37 c0.wp.com
1646.br
164707:53:08 192.0.78.32 jetpack.wordpress.com
1648.br
164907:53:09 192.0.77.32 s0.wp.com
1650.br
165107:53:09 192.0.77.2 i0.wp.com
1652.br
165307:53:10 192.0.77.2 i0.wp.com
1654.br
165507:53:11 192.0.73.2 1.gravatar.com
1656.br
1583#endif 1657#endif
1584.TP 1658.TP
1585\fB\-\-nice=value 1659\fB\-\-nice=value
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-19 13:16:55 +0000