diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/fcopy/main.c | 4 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 108 | ||||
-rw-r--r-- | src/firejail/appimage.c | 13 | ||||
-rw-r--r-- | src/firejail/fs.c | 4 | ||||
-rw-r--r-- | src/firejail/fs_lib2.c | 6 | ||||
-rw-r--r-- | src/firejail/ls.c | 2 | ||||
-rw-r--r-- | src/firejail/main.c | 11 | ||||
-rw-r--r-- | src/firejail/paths.c | 18 | ||||
-rw-r--r-- | src/firejail/profile.c | 4 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 3 | ||||
-rw-r--r-- | src/firejail/util.c | 4 | ||||
-rw-r--r-- | src/firejail/x11.c | 30 | ||||
-rw-r--r-- | src/firemon/procevent.c | 2 | ||||
-rw-r--r-- | src/fnettrace-dns/main.c | 2 | ||||
-rw-r--r-- | src/fnettrace-sni/main.c | 16 | ||||
-rw-r--r-- | src/fnettrace/event.c | 105 | ||||
-rw-r--r-- | src/fnettrace/fnettrace.h | 28 | ||||
-rw-r--r-- | src/fnettrace/main.c | 246 | ||||
-rw-r--r-- | src/fnettrace/radix.c | 40 | ||||
-rw-r--r-- | src/fnettrace/radix.h | 3 | ||||
-rw-r--r-- | src/fnettrace/static-ip-map.txt | 539 | ||||
-rw-r--r-- | src/lib/syscall.c | 10 | ||||
-rw-r--r-- | src/man/firejail.1.in | 32 |
23 files changed, 977 insertions, 253 deletions
diff --git a/src/fcopy/main.c b/src/fcopy/main.c index a56e8a91b..84fe44d73 100644 --- a/src/fcopy/main.c +++ b/src/fcopy/main.c | |||
@@ -277,7 +277,7 @@ static int fs_copydir(const char *infname, const struct stat *st, int ftype, str | |||
277 | 277 | ||
278 | // don't copy it if we already have the file | 278 | // don't copy it if we already have the file |
279 | struct stat s; | 279 | struct stat s; |
280 | if (stat(outfname, &s) == 0) { | 280 | if (lstat(outfname, &s) == 0) { |
281 | if (first) | 281 | if (first) |
282 | first = 0; | 282 | first = 0; |
283 | else if (!arg_quiet) | 283 | else if (!arg_quiet) |
@@ -286,7 +286,7 @@ static int fs_copydir(const char *infname, const struct stat *st, int ftype, str | |||
286 | } | 286 | } |
287 | 287 | ||
288 | // extract mode and ownership | 288 | // extract mode and ownership |
289 | if (stat(infname, &s) != 0) | 289 | if (lstat(infname, &s) != 0) |
290 | goto out; | 290 | goto out; |
291 | 291 | ||
292 | uid_t uid = s.st_uid; | 292 | uid_t uid = s.st_uid; |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index a89add9d0..558fe51ed 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -1,6 +1,8 @@ | |||
1 | # /etc/firejail/firecfg.config - firecfg utility configuration file | 1 | # /etc/firejail/firecfg.config - firecfg utility configuration file |
2 | # This is the list of programs in alphabetical order handled by firecfg utility | 2 | # This is the list of programs in alphabetical order handled by firecfg utility |
3 | # | 3 | # |
4 | # Note: Normal comment lines should start with `# ` and commented code lines | ||
5 | # should start with just `#` (no spaces). | ||
4 | 0ad | 6 | 0ad |
5 | 1password | 7 | 1password |
6 | 2048-qt | 8 | 2048-qt |
@@ -51,7 +53,7 @@ ani-cli | |||
51 | anydesk | 53 | anydesk |
52 | apktool | 54 | apktool |
53 | apostrophe | 55 | apostrophe |
54 | # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 56 | #ar # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
55 | arch-audit | 57 | arch-audit |
56 | archaudit-report | 58 | archaudit-report |
57 | ardour4 | 59 | ardour4 |
@@ -63,9 +65,9 @@ arm | |||
63 | artha | 65 | artha |
64 | assogiate | 66 | assogiate |
65 | asunder | 67 | asunder |
66 | # atom | 68 | #atom |
67 | # atom-beta | 69 | #atom-beta |
68 | # atool - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 70 | #atool # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
69 | atril | 71 | atril |
70 | atril-previewer | 72 | atril-previewer |
71 | atril-thumbnailer | 73 | atril-thumbnailer |
@@ -99,6 +101,7 @@ bitwarden | |||
99 | bleachbit | 101 | bleachbit |
100 | blender | 102 | blender |
101 | blender-2.8 | 103 | blender-2.8 |
104 | blender-3.6 | ||
102 | bless | 105 | bless |
103 | blobby | 106 | blobby |
104 | blobwars | 107 | blobwars |
@@ -112,10 +115,10 @@ brave-browser-beta | |||
112 | brave-browser-dev | 115 | brave-browser-dev |
113 | brave-browser-nightly | 116 | brave-browser-nightly |
114 | brave-browser-stable | 117 | brave-browser-stable |
115 | # bunzip2 - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 118 | #bunzip2 # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
116 | # bzcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 119 | #bzcat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
117 | bzflag | 120 | bzflag |
118 | # bzip2 - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 121 | #bzip2 # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
119 | cachy-browser | 122 | cachy-browser |
120 | calibre | 123 | calibre |
121 | calligra | 124 | calligra |
@@ -145,12 +148,13 @@ chromium-freeworld | |||
145 | cin | 148 | cin |
146 | cinelerra | 149 | cinelerra |
147 | cinelerra-gg | 150 | cinelerra-gg |
151 | clac | ||
148 | clamdscan | 152 | clamdscan |
149 | clamdtop | 153 | clamdtop |
150 | clamscan | 154 | clamscan |
151 | clamtk | 155 | clamtk |
152 | clawsker | ||
153 | claws-mail | 156 | claws-mail |
157 | clawsker | ||
154 | clementine | 158 | clementine |
155 | clion | 159 | clion |
156 | clion-eap | 160 | clion-eap |
@@ -182,6 +186,7 @@ crow | |||
182 | cryptocat | 186 | cryptocat |
183 | cvlc | 187 | cvlc |
184 | cyberfox | 188 | cyberfox |
189 | d-feet | ||
185 | daisy | 190 | daisy |
186 | darktable | 191 | darktable |
187 | dconf-editor | 192 | dconf-editor |
@@ -192,7 +197,6 @@ deluge | |||
192 | desktopeditors | 197 | desktopeditors |
193 | devhelp | 198 | devhelp |
194 | dex2jar | 199 | dex2jar |
195 | d-feet | ||
196 | dia | 200 | dia |
197 | dig | 201 | dig |
198 | digikam | 202 | digikam |
@@ -236,14 +240,14 @@ enpass | |||
236 | eog | 240 | eog |
237 | eom | 241 | eom |
238 | ephemeral | 242 | ephemeral |
239 | #epiphany - see #2995 | 243 | #epiphany # see #2995 |
240 | equalx | 244 | equalx |
241 | et | 245 | et |
242 | etr | 246 | etr |
243 | evince | 247 | evince |
244 | evince-previewer | 248 | evince-previewer |
245 | evince-thumbnailer | 249 | evince-thumbnailer |
246 | #evolution - see #3647 | 250 | #evolution # see #3647 |
247 | exfalso | 251 | exfalso |
248 | exiftool | 252 | exiftool |
249 | falkon | 253 | falkon |
@@ -271,8 +275,9 @@ flacsplt | |||
271 | flameshot | 275 | flameshot |
272 | flashpeak-slimjet | 276 | flashpeak-slimjet |
273 | flowblade | 277 | flowblade |
274 | fontforge | 278 | fluffychat |
275 | font-manager | 279 | font-manager |
280 | fontforge | ||
276 | fossamail | 281 | fossamail |
277 | four-in-a-row | 282 | four-in-a-row |
278 | fractal | 283 | fractal |
@@ -319,7 +324,7 @@ git-cola | |||
319 | gitg | 324 | gitg |
320 | github-desktop | 325 | github-desktop |
321 | gitter | 326 | gitter |
322 | # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 | 327 | #gjs # https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 |
323 | gl-117 | 328 | gl-117 |
324 | glaxium | 329 | glaxium |
325 | globaltime | 330 | globaltime |
@@ -384,12 +389,12 @@ gradio | |||
384 | gramps | 389 | gramps |
385 | gravity-beams-and-evaporating-stars | 390 | gravity-beams-and-evaporating-stars |
386 | gthumb | 391 | gthumb |
387 | gtk2-youtube-viewer | ||
388 | gtk3-youtube-viewer | ||
389 | gtk-lbry-viewer | 392 | gtk-lbry-viewer |
390 | gtk-pipe-viewer | 393 | gtk-pipe-viewer |
391 | gtk-straw-viewer | 394 | gtk-straw-viewer |
392 | gtk-youtube-viewer | 395 | gtk-youtube-viewer |
396 | gtk2-youtube-viewer | ||
397 | gtk3-youtube-viewer | ||
393 | guayadeque | 398 | guayadeque |
394 | gucharmap | 399 | gucharmap |
395 | gummi | 400 | gummi |
@@ -410,8 +415,8 @@ icecat | |||
410 | icedove | 415 | icedove |
411 | iceweasel | 416 | iceweasel |
412 | idea | 417 | idea |
413 | ideaIC | ||
414 | idea.sh | 418 | idea.sh |
419 | ideaIC | ||
415 | imagej | 420 | imagej |
416 | img2txt | 421 | img2txt |
417 | impressive | 422 | impressive |
@@ -430,6 +435,7 @@ jdownloader | |||
430 | jerry | 435 | jerry |
431 | jitsi | 436 | jitsi |
432 | jitsi-meet-desktop | 437 | jitsi-meet-desktop |
438 | journal-viewer | ||
433 | jumpnbump | 439 | jumpnbump |
434 | jumpnbump-menu | 440 | jumpnbump-menu |
435 | k3b | 441 | k3b |
@@ -440,7 +446,7 @@ karbon | |||
440 | kate | 446 | kate |
441 | kazam | 447 | kazam |
442 | kcalc | 448 | kcalc |
443 | # kdeinit4 | 449 | #kdeinit4 |
444 | kdenlive | 450 | kdenlive |
445 | kdiff3 | 451 | kdiff3 |
446 | keepass | 452 | keepass |
@@ -450,7 +456,7 @@ keepassx2 | |||
450 | keepassxc | 456 | keepassxc |
451 | keepassxc-cli | 457 | keepassxc-cli |
452 | keepassxc-proxy | 458 | keepassxc-proxy |
453 | # kfind | 459 | #kfind |
454 | kget | 460 | kget |
455 | kid3 | 461 | kid3 |
456 | kid3-cli | 462 | kid3-cli |
@@ -467,15 +473,16 @@ kodi | |||
467 | konversation | 473 | konversation |
468 | kopete | 474 | kopete |
469 | krita | 475 | krita |
470 | # krunner | 476 | #krunner |
471 | ktorrent | 477 | ktorrent |
472 | ktouch | 478 | ktouch |
473 | kube | 479 | kube |
474 | # kwin_x11 | 480 | #kwin_x11 |
475 | kwrite | 481 | kwrite |
476 | lbry-viewer | 482 | lbry-viewer |
477 | leafpad | 483 | leafpad |
478 | # less - breaks man | 484 | #less # breaks man |
485 | lettura | ||
479 | librecad | 486 | librecad |
480 | libreoffice | 487 | libreoffice |
481 | librewolf | 488 | librewolf |
@@ -500,12 +507,12 @@ lollypop | |||
500 | lomath | 507 | lomath |
501 | loweb | 508 | loweb |
502 | lowriter | 509 | lowriter |
503 | # lrunzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 510 | #lrunzip # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
504 | # lrz - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 511 | #lrz # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
505 | # lrzcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 512 | #lrzcat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
506 | # lrzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 513 | #lrzip # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
507 | # lrztar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 514 | #lrztar # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
508 | # lrzuntar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 515 | #lrzuntar # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
509 | luminance-hdr | 516 | luminance-hdr |
510 | lximage-qt | 517 | lximage-qt |
511 | lxmusic | 518 | lxmusic |
@@ -559,7 +566,6 @@ mp3wrap | |||
559 | mpDris2 | 566 | mpDris2 |
560 | mpg123 | 567 | mpg123 |
561 | mpg123-alsa | 568 | mpg123-alsa |
562 | mpg123.bin | ||
563 | mpg123-id3dump | 569 | mpg123-id3dump |
564 | mpg123-jack | 570 | mpg123-jack |
565 | mpg123-nas | 571 | mpg123-nas |
@@ -568,6 +574,7 @@ mpg123-oss | |||
568 | mpg123-portaudio | 574 | mpg123-portaudio |
569 | mpg123-pulse | 575 | mpg123-pulse |
570 | mpg123-strip | 576 | mpg123-strip |
577 | mpg123.bin | ||
571 | mplayer | 578 | mplayer |
572 | mpsyt | 579 | mpsyt |
573 | mpv | 580 | mpv |
@@ -636,11 +643,11 @@ onionshare-cli | |||
636 | onionshare-gui | 643 | onionshare-gui |
637 | ooffice | 644 | ooffice |
638 | ooviewdoc | 645 | ooviewdoc |
646 | open-invaders | ||
639 | openarena | 647 | openarena |
640 | openarena_ded | 648 | openarena_ded |
641 | opencity | 649 | opencity |
642 | openclonk | 650 | openclonk |
643 | open-invaders | ||
644 | openmw | 651 | openmw |
645 | openmw-launcher | 652 | openmw-launcher |
646 | openoffice.org | 653 | openoffice.org |
@@ -697,9 +704,9 @@ profanity | |||
697 | psi | 704 | psi |
698 | psi-plus | 705 | psi-plus |
699 | pybitmessage | 706 | pybitmessage |
700 | # pycharm-community - FB note: may enable later | 707 | #pycharm-community # FB note: may enable later |
701 | # pycharm-professional | 708 | #pycharm-professional |
702 | # pzstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 709 | #pzstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
703 | qbittorrent | 710 | qbittorrent |
704 | qcomicbook | 711 | qcomicbook |
705 | qemu-launcher | 712 | qemu-launcher |
@@ -780,22 +787,22 @@ sniffnet | |||
780 | snox | 787 | snox |
781 | soffice | 788 | soffice |
782 | sol | 789 | sol |
783 | soundconverter | ||
784 | sound-juicer | 790 | sound-juicer |
791 | soundconverter | ||
785 | spectacle | 792 | spectacle |
786 | spectral | 793 | spectral |
787 | spotify | 794 | spotify |
788 | sqlitebrowser | 795 | sqlitebrowser |
789 | ssh | 796 | ssh |
790 | # ssh-agent - problems on Arch with Fish shell (#1568) | 797 | #ssh-agent # problems on Arch with Fish shell (#1568) |
791 | standardnotes-desktop | 798 | standardnotes-desktop |
792 | start-tor-browser | 799 | start-tor-browser |
793 | steam | 800 | steam |
794 | steam-native | 801 | steam-native |
795 | steam-runtime | 802 | steam-runtime |
796 | stellarium | 803 | stellarium |
797 | strawberry | ||
798 | straw-viewer | 804 | straw-viewer |
805 | strawberry | ||
799 | strings | 806 | strings |
800 | studio.sh | 807 | studio.sh |
801 | subdownloader | 808 | subdownloader |
@@ -818,15 +825,17 @@ telegram | |||
818 | telegram-desktop | 825 | telegram-desktop |
819 | telnet | 826 | telnet |
820 | terasology | 827 | terasology |
828 | termshark | ||
821 | tesseract | 829 | tesseract |
822 | textmaker18 | 830 | textmaker18 |
823 | textmaker18free | 831 | textmaker18free |
824 | thunderbird | 832 | thunderbird |
825 | thunderbird-beta | 833 | thunderbird-beta |
826 | thunderbird-wayland | 834 | thunderbird-wayland |
835 | tidal-hifi | ||
827 | tilp | 836 | tilp |
837 | tiny-rdm | ||
828 | tor-browser | 838 | tor-browser |
829 | torbrowser | ||
830 | tor-browser-ar | 839 | tor-browser-ar |
831 | tor-browser-ca | 840 | tor-browser-ca |
832 | tor-browser-cs | 841 | tor-browser-cs |
@@ -848,7 +857,6 @@ tor-browser-it | |||
848 | tor-browser-ja | 857 | tor-browser-ja |
849 | tor-browser-ka | 858 | tor-browser-ka |
850 | tor-browser-ko | 859 | tor-browser-ko |
851 | torbrowser-launcher | ||
852 | tor-browser-nb | 860 | tor-browser-nb |
853 | tor-browser-nl | 861 | tor-browser-nl |
854 | tor-browser-pl | 862 | tor-browser-pl |
@@ -859,6 +867,8 @@ tor-browser-tr | |||
859 | tor-browser-vi | 867 | tor-browser-vi |
860 | tor-browser-zh-cn | 868 | tor-browser-zh-cn |
861 | tor-browser-zh-tw | 869 | tor-browser-zh-tw |
870 | torbrowser | ||
871 | torbrowser-launcher | ||
862 | torcs | 872 | torcs |
863 | totem | 873 | totem |
864 | tracker | 874 | tracker |
@@ -888,7 +898,7 @@ uget-gtk | |||
888 | unbound | 898 | unbound |
889 | unf | 899 | unf |
890 | unknown-horizons | 900 | unknown-horizons |
891 | # unzstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 901 | #unzstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
892 | url-eater | 902 | url-eater |
893 | utox | 903 | utox |
894 | uudeview | 904 | uudeview |
@@ -901,10 +911,10 @@ vivaldi-beta | |||
901 | vivaldi-snapshot | 911 | vivaldi-snapshot |
902 | vivaldi-stable | 912 | vivaldi-stable |
903 | vlc | 913 | vlc |
904 | #vmplayer - unable to install kernel modules (see #5861) | 914 | #vmplayer # unable to install kernel modules (see #5861) |
905 | #vmware - unable to install kernel modules (see #5861) | 915 | #vmware # unable to install kernel modules (see #5861) |
906 | #vmware-player - unable to install kernel modules (see #5861) | 916 | #vmware-player # unable to install kernel modules (see #5861) |
907 | #vmware-workstation - unable to install kernel modules (see #5861) | 917 | #vmware-workstation # unable to install kernel modules (see #5861) |
908 | vscodium | 918 | vscodium |
909 | vulturesclaw | 919 | vulturesclaw |
910 | vultureseye | 920 | vultureseye |
@@ -968,8 +978,8 @@ yelp | |||
968 | youtube | 978 | youtube |
969 | youtube-dl | 979 | youtube-dl |
970 | youtube-dl-gui | 980 | youtube-dl-gui |
971 | youtubemusic-nativefier | ||
972 | youtube-viewer | 981 | youtube-viewer |
982 | youtubemusic-nativefier | ||
973 | yt-dlp | 983 | yt-dlp |
974 | ytmdesktop | 984 | ytmdesktop |
975 | zaproxy | 985 | zaproxy |
@@ -979,10 +989,10 @@ zeal | |||
979 | zim | 989 | zim |
980 | zlib-flate | 990 | zlib-flate |
981 | zoom | 991 | zoom |
982 | # zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 992 | #zpaq # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
983 | # zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 993 | #zstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
984 | # zstdcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 994 | #zstdcat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
985 | # zstdgrep - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 995 | #zstdgrep # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
986 | # zstdless - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 996 | #zstdless # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
987 | # zstdmt - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 997 | #zstdmt # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
988 | zulip | 998 | zulip |
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c index a4f727c0a..bb20a0da6 100644 --- a/src/firejail/appimage.c +++ b/src/firejail/appimage.c | |||
@@ -43,6 +43,16 @@ int appimage_find_profile(const char *archive) { | |||
43 | assert(archive); | 43 | assert(archive); |
44 | assert(strlen(archive)); | 44 | assert(strlen(archive)); |
45 | 45 | ||
46 | // extract the name of the appimage from a full path | ||
47 | // example: archive = /opt/kdenlive-20.12.2-x86_64.appimage | ||
48 | const char *arc = strrchr(archive, '/'); | ||
49 | if (arc) | ||
50 | arc++; | ||
51 | else | ||
52 | arc = archive; | ||
53 | if (arg_debug) | ||
54 | printf("Looking for a %s profile\n", arc); | ||
55 | |||
46 | // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config | 56 | // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config |
47 | FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r"); | 57 | FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r"); |
48 | if (!fp) { | 58 | if (!fp) { |
@@ -56,7 +66,8 @@ int appimage_find_profile(const char *archive) { | |||
56 | char *ptr = strchr(buf, '\n'); | 66 | char *ptr = strchr(buf, '\n'); |
57 | if (ptr) | 67 | if (ptr) |
58 | *ptr = '\0'; | 68 | *ptr = '\0'; |
59 | if (strcasestr(archive, buf)) { | 69 | char *found = strcasestr(arc, buf); |
70 | if (found == arc) { | ||
60 | fclose(fp); | 71 | fclose(fp); |
61 | return profile_find_firejail(buf, 1); | 72 | return profile_find_firejail(buf, 1); |
62 | } | 73 | } |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 182f26e53..28fecfb98 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -281,6 +281,8 @@ void fs_blacklist(void) { | |||
281 | if (!entry) | 281 | if (!entry) |
282 | return; | 282 | return; |
283 | 283 | ||
284 | timetrace_start(); | ||
285 | |||
284 | size_t noblacklist_c = 0; | 286 | size_t noblacklist_c = 0; |
285 | size_t noblacklist_m = 32; | 287 | size_t noblacklist_m = 32; |
286 | char **noblacklist = calloc(noblacklist_m, sizeof(*noblacklist)); | 288 | char **noblacklist = calloc(noblacklist_m, sizeof(*noblacklist)); |
@@ -463,6 +465,8 @@ void fs_blacklist(void) { | |||
463 | for (i = 0; i < noblacklist_c; i++) | 465 | for (i = 0; i < noblacklist_c; i++) |
464 | free(noblacklist[i]); | 466 | free(noblacklist[i]); |
465 | free(noblacklist); | 467 | free(noblacklist); |
468 | |||
469 | fmessage("Base filesystem installed in %0.2f ms\n", timetrace_end()); | ||
466 | } | 470 | } |
467 | 471 | ||
468 | //*********************************************** | 472 | //*********************************************** |
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c index 583888e0e..b43c36c1a 100644 --- a/src/firejail/fs_lib2.c +++ b/src/firejail/fs_lib2.c | |||
@@ -166,8 +166,12 @@ void fslib_install_firejail(void) { | |||
166 | fslib_mount_libs(RUN_MNT_DIR "/dhclient", 1); // parse as user | 166 | fslib_mount_libs(RUN_MNT_DIR "/dhclient", 1); // parse as user |
167 | 167 | ||
168 | // bring in xauth libraries | 168 | // bring in xauth libraries |
169 | |||
170 | char *xauth_bin = find_in_path("xauth"); | ||
169 | if (arg_x11_xorg) | 171 | if (arg_x11_xorg) |
170 | fslib_mount_libs("/usr/bin/xauth", 1); // parse as user | 172 | fslib_mount_libs(xauth_bin, 1); // parse as user |
173 | |||
174 | free(xauth_bin); | ||
171 | 175 | ||
172 | fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end()); | 176 | fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end()); |
173 | } | 177 | } |
diff --git a/src/firejail/ls.c b/src/firejail/ls.c index f2ab1c188..6dc4904fc 100644 --- a/src/firejail/ls.c +++ b/src/firejail/ls.c | |||
@@ -154,7 +154,7 @@ static void print_file_or_dir(const char *path, const char *fname) { | |||
154 | 154 | ||
155 | // file size | 155 | // file size |
156 | char *sz; | 156 | char *sz; |
157 | if (asprintf(&sz, "%d", (int) s.st_size) == -1) | 157 | if (asprintf(&sz, "%jd", (intmax_t) s.st_size) == -1) |
158 | errExit("asprintf"); | 158 | errExit("asprintf"); |
159 | 159 | ||
160 | // file name | 160 | // file name |
diff --git a/src/firejail/main.c b/src/firejail/main.c index b0d5dac17..0c9c80137 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -420,7 +420,6 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
420 | exit_err_feature("x11"); | 420 | exit_err_feature("x11"); |
421 | } | 421 | } |
422 | #endif | 422 | #endif |
423 | #ifdef HAVE_NETWORK | ||
424 | else if (strcmp(argv[i], "--nettrace") == 0) { | 423 | else if (strcmp(argv[i], "--nettrace") == 0) { |
425 | if (checkcfg(CFG_NETWORK)) { | 424 | if (checkcfg(CFG_NETWORK)) { |
426 | if (getuid() != 0) { | 425 | if (getuid() != 0) { |
@@ -524,8 +523,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
524 | exit(0); | 523 | exit(0); |
525 | } | 524 | } |
526 | 525 | ||
527 | 526 | #ifdef HAVE_NETWORK | |
528 | |||
529 | else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { | 527 | else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { |
530 | if (checkcfg(CFG_NETWORK)) { | 528 | if (checkcfg(CFG_NETWORK)) { |
531 | logargs(argc, argv); | 529 | logargs(argc, argv); |
@@ -3217,13 +3215,18 @@ int main(int argc, char **argv, char **envp) { | |||
3217 | 3215 | ||
3218 | gid_t g; | 3216 | gid_t g; |
3219 | if (!arg_nogroups || !check_can_drop_all_groups()) { | 3217 | if (!arg_nogroups || !check_can_drop_all_groups()) { |
3220 | // add audio group | 3218 | // add audio groups |
3221 | if (!arg_nosound) { | 3219 | if (!arg_nosound) { |
3222 | g = get_group_id("audio"); | 3220 | g = get_group_id("audio"); |
3223 | if (g) { | 3221 | if (g) { |
3224 | sprintf(ptr, "%d %d 1\n", g, g); | 3222 | sprintf(ptr, "%d %d 1\n", g, g); |
3225 | ptr += strlen(ptr); | 3223 | ptr += strlen(ptr); |
3226 | } | 3224 | } |
3225 | g = get_group_id("pipewire"); | ||
3226 | if (g) { | ||
3227 | sprintf(ptr, "%d %d 1\n", g, g); | ||
3228 | ptr += strlen(ptr); | ||
3229 | } | ||
3227 | } | 3230 | } |
3228 | 3231 | ||
3229 | // add video group | 3232 | // add video group |
diff --git a/src/firejail/paths.c b/src/firejail/paths.c index 6bc6230f0..fea842d93 100644 --- a/src/firejail/paths.c +++ b/src/firejail/paths.c | |||
@@ -47,6 +47,16 @@ static void init_paths(void) { | |||
47 | errExit("calloc"); | 47 | errExit("calloc"); |
48 | memset(paths, 0, path_cnt * sizeof(char *)); // get rid of false positive error from GCC static analyzer | 48 | memset(paths, 0, path_cnt * sizeof(char *)); // get rid of false positive error from GCC static analyzer |
49 | 49 | ||
50 | // lots of distros set /bin as a symlink to /usr/bin; | ||
51 | // we remove /bin form the path to speed up path-based operations such as blacklist | ||
52 | int bin_symlink = 0; | ||
53 | p = realpath("/bin", NULL); | ||
54 | if (p) { | ||
55 | if (strcmp(p, "/usr/bin") == 0) | ||
56 | bin_symlink = 1; | ||
57 | } | ||
58 | free(p); | ||
59 | |||
50 | // fill in 'paths' with pointers to elements of 'path' | 60 | // fill in 'paths' with pointers to elements of 'path' |
51 | unsigned int i = 0, j; | 61 | unsigned int i = 0, j; |
52 | unsigned int len; | 62 | unsigned int len; |
@@ -62,6 +72,14 @@ static void init_paths(void) { | |||
62 | if (len == 0) | 72 | if (len == 0) |
63 | goto skip; | 73 | goto skip; |
64 | 74 | ||
75 | //deal with /bin - /usr/bin symlink | ||
76 | if (bin_symlink > 0) { | ||
77 | if (strcmp(elt, "/bin") == 0 || strcmp(elt, "/usr/bin") == 0) | ||
78 | bin_symlink++; | ||
79 | if (bin_symlink == 3) | ||
80 | goto skip; | ||
81 | } | ||
82 | |||
65 | // filter out duplicate entries | 83 | // filter out duplicate entries |
66 | for (j = 0; j < i; j++) | 84 | for (j = 0; j < i; j++) |
67 | if (strcmp(elt, paths[j]) == 0) | 85 | if (strcmp(elt, paths[j]) == 0) |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index bdaaed433..8cc5c1166 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -484,7 +484,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
484 | #endif | 484 | #endif |
485 | return 0; | 485 | return 0; |
486 | } | 486 | } |
487 | else if (strncmp("dbus-user ", ptr, 10) == 0) { | 487 | else if (strncmp(ptr, "dbus-user ", 10) == 0) { |
488 | #ifdef HAVE_DBUSPROXY | 488 | #ifdef HAVE_DBUSPROXY |
489 | ptr += 10; | 489 | ptr += 10; |
490 | if (strcmp("filter", ptr) == 0) { | 490 | if (strcmp("filter", ptr) == 0) { |
@@ -551,7 +551,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
551 | #endif | 551 | #endif |
552 | return 1; | 552 | return 1; |
553 | } | 553 | } |
554 | else if (strncmp("dbus-system ", ptr, 12) == 0) { | 554 | else if (strncmp(ptr, "dbus-system ", 12) == 0) { |
555 | #ifdef HAVE_DBUSPROXY | 555 | #ifdef HAVE_DBUSPROXY |
556 | ptr += 12; | 556 | ptr += 12; |
557 | if (strcmp("filter", ptr) == 0) { | 557 | if (strcmp("filter", ptr) == 0) { |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 538f5be67..827be5d85 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -878,7 +878,8 @@ int sandbox(void* sandbox_arg) { | |||
878 | //**************************** | 878 | //**************************** |
879 | // appimage | 879 | // appimage |
880 | //**************************** | 880 | //**************************** |
881 | appimage_mount(); | 881 | if (arg_appimage) |
882 | appimage_mount(); | ||
882 | 883 | ||
883 | //**************************** | 884 | //**************************** |
884 | // private mode | 885 | // private mode |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 87b771867..bd32181b5 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -207,6 +207,8 @@ static void clean_supplementary_groups(gid_t gid) { | |||
207 | if (!arg_nosound) { | 207 | if (!arg_nosound) { |
208 | copy_group_ifcont("audio", groups, ngroups, | 208 | copy_group_ifcont("audio", groups, ngroups, |
209 | new_groups, &new_ngroups, MAX_GROUPS); | 209 | new_groups, &new_ngroups, MAX_GROUPS); |
210 | copy_group_ifcont("pipewire", groups, ngroups, | ||
211 | new_groups, &new_ngroups, MAX_GROUPS); | ||
210 | } | 212 | } |
211 | 213 | ||
212 | if (!arg_novideo) { | 214 | if (!arg_novideo) { |
@@ -1474,7 +1476,7 @@ int ascii_isxdigit(unsigned char c) { | |||
1474 | return ret; | 1476 | return ret; |
1475 | } | 1477 | } |
1476 | 1478 | ||
1477 | // Note: Keep this in sync with NAME VALIDATION in src/man/firejail.txt. | 1479 | // Note: Keep this in sync with NAME VALIDATION in src/man/firejail.1.in. |
1478 | // | 1480 | // |
1479 | // Allow only ASCII letters, digits and a few special characters; names with | 1481 | // Allow only ASCII letters, digits and a few special characters; names with |
1480 | // only numbers are rejected; spaces and control characters are rejected. | 1482 | // only numbers are rejected; spaces and control characters are rejected. |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 2eaa9bde5..3721a2c2c 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -1164,7 +1164,6 @@ void x11_start(int argc, char **argv) { | |||
1164 | } | 1164 | } |
1165 | #endif | 1165 | #endif |
1166 | 1166 | ||
1167 | |||
1168 | void x11_xorg(void) { | 1167 | void x11_xorg(void) { |
1169 | #ifdef HAVE_X11 | 1168 | #ifdef HAVE_X11 |
1170 | 1169 | ||
@@ -1175,31 +1174,38 @@ void x11_xorg(void) { | |||
1175 | exit(1); | 1174 | exit(1); |
1176 | } | 1175 | } |
1177 | 1176 | ||
1177 | char *xauth_bin = find_in_path("xauth"); | ||
1178 | |||
1178 | // check xauth utility is present in the system | 1179 | // check xauth utility is present in the system |
1179 | struct stat s; | 1180 | if (!xauth_bin) { |
1180 | if (stat("/usr/bin/xauth", &s) == -1) { | 1181 | fprintf(stderr, "Error: xauth utility not found in PATH. Please install it:\n"); |
1181 | fprintf(stderr, "Error: xauth utility not found in /usr/bin. Please install it:\n"); | ||
1182 | fprintf(stderr, " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); | 1182 | fprintf(stderr, " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); |
1183 | fprintf(stderr, " Arch: sudo pacman -S xorg-xauth\n"); | 1183 | fprintf(stderr, " Arch: sudo pacman -S xorg-xauth\n"); |
1184 | fprintf(stderr, " Fedora: sudo dnf install xorg-x11-xauth\n"); | 1184 | fprintf(stderr, " Fedora: sudo dnf install xorg-x11-xauth\n"); |
1185 | exit(1); | 1185 | exit(1); |
1186 | } | 1186 | } |
1187 | |||
1188 | struct stat s; | ||
1189 | if (stat(xauth_bin, &s) == -1) { | ||
1190 | fprintf(stderr, "Error: %s: %s\n", xauth_bin, strerror(errno)); | ||
1191 | exit(1); | ||
1192 | } | ||
1187 | if ((s.st_uid != 0 && s.st_gid != 0) || (s.st_mode & S_IWOTH)) { | 1193 | if ((s.st_uid != 0 && s.st_gid != 0) || (s.st_mode & S_IWOTH)) { |
1188 | fprintf(stderr, "Error: invalid /usr/bin/xauth executable\n"); | 1194 | fprintf(stderr, "Error: invalid %s executable\n", xauth_bin); |
1189 | exit(1); | 1195 | exit(1); |
1190 | } | 1196 | } |
1191 | if (s.st_size > 1024 * 1024) { | 1197 | if (s.st_size > 1024 * 1024) { |
1192 | fprintf(stderr, "Error: /usr/bin/xauth executable is too large\n"); | 1198 | fprintf(stderr, "Error: %s executable is too large\n", xauth_bin); |
1193 | exit(1); | 1199 | exit(1); |
1194 | } | 1200 | } |
1195 | // copy /usr/bin/xauth in the sandbox and set mode to 0711 | 1201 | // copy xauth in the sandbox and set mode to 0711 |
1196 | // users are not able to trace the running xauth this way | 1202 | // users are not able to trace the running xauth this way |
1197 | if (arg_debug) | 1203 | if (arg_debug) |
1198 | printf("Copying /usr/bin/xauth to %s\n", RUN_XAUTH_FILE); | 1204 | printf("Copying %s to %s\n", xauth_bin, RUN_XAUTH_FILE); |
1199 | if (copy_file("/usr/bin/xauth", RUN_XAUTH_FILE, 0, 0, 0711)) { | 1205 | |
1200 | fprintf(stderr, "Error: cannot copy /usr/bin/xauth executable\n"); | 1206 | copy_file_from_user_to_root(xauth_bin, RUN_XAUTH_FILE, 0, 0, 0711); |
1201 | exit(1); | 1207 | |
1202 | } | 1208 | free(xauth_bin); |
1203 | 1209 | ||
1204 | fmessage("Generating a new .Xauthority file\n"); | 1210 | fmessage("Generating a new .Xauthority file\n"); |
1205 | mkdir_attr(RUN_XAUTHORITY_SEC_DIR, 0700, getuid(), getgid()); | 1211 | mkdir_attr(RUN_XAUTHORITY_SEC_DIR, 0700, getuid(), getgid()); |
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c index 77739c1f3..63d69d1cd 100644 --- a/src/firemon/procevent.c +++ b/src/firemon/procevent.c | |||
@@ -185,7 +185,7 @@ static int procevent_netlink_setup(void) { | |||
185 | if (getsockopt(sock, SOL_SOCKET, SO_RCVBUF, &bsize, &blen) == -1) | 185 | if (getsockopt(sock, SOL_SOCKET, SO_RCVBUF, &bsize, &blen) == -1) |
186 | fprintf(stderr, "Error: cannot read rx buffer size\n"); | 186 | fprintf(stderr, "Error: cannot read rx buffer size\n"); |
187 | else | 187 | else |
188 | printf("rx buffer size %d\n", bsize / 2); // the value returned is duble the real one, see man 7 socket | 188 | printf("rx buffer size %d\n", bsize / 2); // the value returned is double the real one, see man 7 socket |
189 | } | 189 | } |
190 | 190 | ||
191 | // send monitoring message | 191 | // send monitoring message |
diff --git a/src/fnettrace-dns/main.c b/src/fnettrace-dns/main.c index 6324a17db..38222fe2e 100644 --- a/src/fnettrace-dns/main.c +++ b/src/fnettrace-dns/main.c | |||
@@ -66,7 +66,7 @@ void print_dns(uint32_t ip_src, unsigned char *pkt) { | |||
66 | 66 | ||
67 | // filter output | 67 | // filter output |
68 | char tmp[sizeof(last)]; | 68 | char tmp[sizeof(last)]; |
69 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s %s (type %u)%s", | 69 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s DNS %s (type %u)%s", |
70 | t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1, | 70 | t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1, |
71 | type, (nxdomain)? " NXDOMAIN": ""); | 71 | type, (nxdomain)? " NXDOMAIN": ""); |
72 | if (strcmp(tmp, last)) { | 72 | if (strcmp(tmp, last)) { |
diff --git a/src/fnettrace-sni/main.c b/src/fnettrace-sni/main.c index d4fbf703a..d0a4f115a 100644 --- a/src/fnettrace-sni/main.c +++ b/src/fnettrace-sni/main.c | |||
@@ -32,16 +32,15 @@ static char last[512] = {'\0'}; | |||
32 | static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { | 32 | static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { |
33 | assert(pkt); | 33 | assert(pkt); |
34 | 34 | ||
35 | // expecting a handshake packet and client hello | ||
36 | if (pkt[0] != 0x16 || pkt[5] != 0x01) | ||
37 | return; | ||
38 | |||
35 | char ip[30]; | 39 | char ip[30]; |
36 | sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_dest)); | 40 | sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_dest)); |
37 | time_t seconds = time(NULL); | 41 | time_t seconds = time(NULL); |
38 | struct tm *t = localtime(&seconds); | 42 | struct tm *t = localtime(&seconds); |
39 | 43 | ||
40 | // expecting a handshake packet and client hello | ||
41 | if (pkt[0] != 0x16 || pkt[5] != 0x01) | ||
42 | goto errout; | ||
43 | |||
44 | |||
45 | // look for server name indication | 44 | // look for server name indication |
46 | unsigned char *ptr = pkt; | 45 | unsigned char *ptr = pkt; |
47 | unsigned int i = 0; | 46 | unsigned int i = 0; |
@@ -74,7 +73,7 @@ static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { | |||
74 | if (name) { | 73 | if (name) { |
75 | // filter output | 74 | // filter output |
76 | char tmp[sizeof(last)]; | 75 | char tmp[sizeof(last)]; |
77 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s %s", t->tm_hour, t->tm_min, t->tm_sec, ip, name); | 76 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s SNI %s", t->tm_hour, t->tm_min, t->tm_sec, ip, name); |
78 | if (strcmp(tmp, last)) { | 77 | if (strcmp(tmp, last)) { |
79 | printf("%s\n", tmp); | 78 | printf("%s\n", tmp); |
80 | fflush(0); | 79 | fflush(0); |
@@ -85,11 +84,6 @@ static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { | |||
85 | goto nosni; | 84 | goto nosni; |
86 | return; | 85 | return; |
87 | 86 | ||
88 | errout: | ||
89 | printf("%02d:%02d:%02d %-15s Error: invalid TLS packet\n", t->tm_hour, t->tm_min, t->tm_sec, ip); | ||
90 | fflush(0); | ||
91 | return; | ||
92 | |||
93 | nosni: | 87 | nosni: |
94 | printf("%02d:%02d:%02d %-15s no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip); | 88 | printf("%02d:%02d:%02d %-15s no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip); |
95 | return; | 89 | return; |
diff --git a/src/fnettrace/event.c b/src/fnettrace/event.c new file mode 100644 index 000000000..f4ccf5360 --- /dev/null +++ b/src/fnettrace/event.c | |||
@@ -0,0 +1,105 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2023 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "fnettrace.h" | ||
21 | |||
22 | typedef struct event_t { | ||
23 | struct event_t *next; | ||
24 | char *record; | ||
25 | } Event; | ||
26 | |||
27 | static Event *event = NULL; | ||
28 | static Event *last_event = NULL; | ||
29 | int ev_cnt = 0; | ||
30 | |||
31 | void ev_clear(void) { | ||
32 | ev_cnt = 0; | ||
33 | Event *ev = event; | ||
34 | while (ev) { | ||
35 | Event *next = ev->next; | ||
36 | free(ev->record); | ||
37 | free(ev); | ||
38 | ev = next; | ||
39 | } | ||
40 | event = NULL; | ||
41 | } | ||
42 | |||
43 | void ev_add(char *record) { | ||
44 | assert(record); | ||
45 | |||
46 | // braking recursivity | ||
47 | if (*record == '\0') | ||
48 | return; | ||
49 | |||
50 | char *ptr = strchr(record, '\n'); | ||
51 | if (ptr) | ||
52 | *ptr = '\0'; | ||
53 | |||
54 | // filter out duplicates | ||
55 | if (event && strcmp(event->record, record) == 0) | ||
56 | return; | ||
57 | |||
58 | Event *ev = malloc(sizeof(Event)); | ||
59 | if (!ev) | ||
60 | errExit("malloc"); | ||
61 | memset(ev, 0, sizeof(Event)); | ||
62 | |||
63 | ev->record = strdup(record); | ||
64 | if (!ev->record) | ||
65 | errExit("strdup"); | ||
66 | |||
67 | if (event == NULL) { | ||
68 | event = ev; | ||
69 | last_event = ev; | ||
70 | } | ||
71 | else { | ||
72 | last_event->next = ev; | ||
73 | last_event = ev; | ||
74 | } | ||
75 | ev_cnt++; | ||
76 | |||
77 | // recursivity | ||
78 | if (ptr) | ||
79 | ev_add(++ptr); | ||
80 | } | ||
81 | |||
82 | void ev_print(FILE *fp) { | ||
83 | assert(fp); | ||
84 | |||
85 | Event *ev = event; | ||
86 | while (ev) { | ||
87 | fprintf(fp, " "); | ||
88 | if (strstr(ev->record, "NXDOMAIN")) { | ||
89 | if (fp == stdout) | ||
90 | ansi_red(ev->record); | ||
91 | else | ||
92 | fprintf(fp, "%s", ev->record); | ||
93 | } | ||
94 | else if (strstr(ev->record, "SSH connection")) { | ||
95 | if (fp == stdout) | ||
96 | ansi_red(ev->record); | ||
97 | else | ||
98 | fprintf(fp, "%s", ev->record); | ||
99 | } | ||
100 | else | ||
101 | fprintf(fp, "%s", ev->record); | ||
102 | fprintf(fp, "\n"); | ||
103 | ev = ev->next; | ||
104 | } | ||
105 | } | ||
diff --git a/src/fnettrace/fnettrace.h b/src/fnettrace/fnettrace.h index b4a8f26c7..9b4973235 100644 --- a/src/fnettrace/fnettrace.h +++ b/src/fnettrace/fnettrace.h | |||
@@ -53,6 +53,27 @@ static inline void ansi_clrscr(void) { | |||
53 | fflush(0); | 53 | fflush(0); |
54 | } | 54 | } |
55 | 55 | ||
56 | static inline void ansi_bold(const char *str) { | ||
57 | char str1[] = {0x1b, '[', '1', 'm', '\0'}; | ||
58 | char str2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
59 | printf("%s%s%s", str1, str, str2); | ||
60 | fflush(0); | ||
61 | } | ||
62 | |||
63 | static inline void ansi_faint(const char *str) { | ||
64 | char str1[] = {0x1b, '[', '2', 'm', '\0'}; | ||
65 | char str2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
66 | printf("%s%s%s", str1, str, str2); | ||
67 | fflush(0); | ||
68 | } | ||
69 | |||
70 | static inline void ansi_red(const char *str) { | ||
71 | char str1[] = {0x1b, '[', '9', '1', 'm', '\0'}; | ||
72 | char str2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
73 | printf("%s%s%s", str1, str, str2); | ||
74 | fflush(0); | ||
75 | } | ||
76 | |||
56 | static inline uint8_t hash(uint32_t ip) { | 77 | static inline uint8_t hash(uint32_t ip) { |
57 | uint8_t *ptr = (uint8_t *) &ip; | 78 | uint8_t *ptr = (uint8_t *) &ip; |
58 | // simple byte xor | 79 | // simple byte xor |
@@ -78,4 +99,11 @@ void terminal_restore(void); | |||
78 | // runprog.c | 99 | // runprog.c |
79 | int runprog(const char *program); | 100 | int runprog(const char *program); |
80 | 101 | ||
102 | // event.c | ||
103 | extern int ev_cnt; | ||
104 | void ev_clear(void); | ||
105 | void ev_add(char *record); | ||
106 | void ev_print(FILE *fp); | ||
107 | |||
108 | |||
81 | #endif | 109 | #endif |
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c index 3bafd9090..4db8e7478 100644 --- a/src/fnettrace/main.c +++ b/src/fnettrace/main.c | |||
@@ -27,6 +27,12 @@ | |||
27 | 27 | ||
28 | static char *arg_log = NULL; | 28 | static char *arg_log = NULL; |
29 | 29 | ||
30 | // only 0 or negative values; positive values as defined in RFC | ||
31 | #define PROTOCOL_ICMP 0 | ||
32 | #define PROTOCOL_SSH -1 | ||
33 | |||
34 | |||
35 | |||
30 | //***************************************************************** | 36 | //***************************************************************** |
31 | // packet stats | 37 | // packet stats |
32 | //***************************************************************** | 38 | //***************************************************************** |
@@ -42,41 +48,18 @@ uint32_t stats_tor = 0; | |||
42 | uint32_t stats_http = 0; | 48 | uint32_t stats_http = 0; |
43 | uint32_t stats_ssh = 0; | 49 | uint32_t stats_ssh = 0; |
44 | 50 | ||
45 | //***************************************************************** | 51 | static void clear_stats(void) { |
46 | // sni/dns log storage | 52 | stats_pkts = 0; |
47 | //***************************************************************** | 53 | stats_icmp_echo = 0; |
48 | typedef struct lognode_t { | 54 | stats_dns = 0; |
49 | #define LOG_RECORD_LEN 255 | 55 | stats_dns_dot = 0; |
50 | char record[LOG_RECORD_LEN + 1]; | 56 | stats_dns_doh = 0; |
51 | } LogNode; | 57 | stats_dns_doq = 0; |
52 | // circular list of SNI log records | 58 | stats_tls = 0; |
53 | #define SNIMAX 64 | 59 | stats_quic = 0; |
54 | LogNode sni_table[SNIMAX] = {0}; | 60 | stats_tor = 0; |
55 | int sni_index = 0; | 61 | stats_http = 0; |
56 | 62 | stats_ssh = 0; | |
57 | // circular list of SNI log records | ||
58 | #define DNSMAX 64 | ||
59 | LogNode dns_table[SNIMAX] = {0}; | ||
60 | int dns_index = 0; | ||
61 | |||
62 | static void print_sni(void) { | ||
63 | int i; | ||
64 | for (i = sni_index; i < SNIMAX; i++) | ||
65 | if (*sni_table[i].record) | ||
66 | printf(" %s", sni_table[i].record); | ||
67 | for (i = 0; i < sni_index; i++) | ||
68 | if (*sni_table[i].record) | ||
69 | printf(" %s", sni_table[i].record); | ||
70 | } | ||
71 | |||
72 | static void print_dns(void) { | ||
73 | int i; | ||
74 | for (i = dns_index; i < DNSMAX; i++) | ||
75 | if (*dns_table[i].record) | ||
76 | printf(" %s", dns_table[i].record); | ||
77 | for (i = 0; i < dns_index; i++) | ||
78 | if (*dns_table[i].record) | ||
79 | printf(" %s", dns_table[i].record); | ||
80 | } | 63 | } |
81 | 64 | ||
82 | //***************************************************************** | 65 | //***************************************************************** |
@@ -92,7 +75,7 @@ typedef struct hnode_t { | |||
92 | uint32_t bytes; // number of bytes received in the last display interval | 75 | uint32_t bytes; // number of bytes received in the last display interval |
93 | uint32_t pkts; // number of packets received in the last display interval | 76 | uint32_t pkts; // number of packets received in the last display interval |
94 | uint16_t port_src; | 77 | uint16_t port_src; |
95 | uint8_t protocol; | 78 | int protocol; |
96 | 79 | ||
97 | // the firewall is build based on source address, and in the linked list | 80 | // the firewall is build based on source address, and in the linked list |
98 | // we could have elements with the same address but different ports | 81 | // we could have elements with the same address but different ports |
@@ -135,7 +118,7 @@ void hfree(HNode *ptr) { | |||
135 | } | 118 | } |
136 | 119 | ||
137 | // using protocol 0 and port 0 for ICMP | 120 | // using protocol 0 and port 0 for ICMP |
138 | static void hnode_add(uint32_t ip_src, uint8_t protocol, uint16_t port_src, uint32_t bytes) { | 121 | static void hnode_add(uint32_t ip_src, int protocol, uint16_t port_src, uint32_t bytes) { |
139 | uint8_t h = hash(ip_src); | 122 | uint8_t h = hash(ip_src); |
140 | 123 | ||
141 | // find | 124 | // find |
@@ -325,6 +308,8 @@ static inline const char *common_port(uint16_t port) { | |||
325 | return "Tor"; | 308 | return "Tor"; |
326 | else if (port == 9030) | 309 | else if (port == 9030) |
327 | return "Tor"; | 310 | return "Tor"; |
311 | else if (port == 9040) | ||
312 | return "Tor"; | ||
328 | else if (port == 9050) | 313 | else if (port == 9050) |
329 | return "Tor"; | 314 | return "Tor"; |
330 | else if (port == 9051) | 315 | else if (port == 9051) |
@@ -383,7 +368,9 @@ static void hnode_print(unsigned bw) { | |||
383 | else | 368 | else |
384 | sprintf(stats, "%u KB/s ", bw / (1024 * DISPLAY_INTERVAL)); | 369 | sprintf(stats, "%u KB/s ", bw / (1024 * DISPLAY_INTERVAL)); |
385 | // int len = snprintf(line, LINE_MAX, "%32s geoip %d, IP database %d\n", stats, geoip_calls, radix_nodes); | 370 | // int len = snprintf(line, LINE_MAX, "%32s geoip %d, IP database %d\n", stats, geoip_calls, radix_nodes); |
386 | int len = snprintf(line, LINE_MAX, "%32s address:port (protocol) network\n", stats); | 371 | char faint1[] = {0x1b, '[', '2', 'm', '\0'}; |
372 | char faint2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
373 | int len = snprintf(line, LINE_MAX, "%32s %saddress:port (protocol) network%s\n", stats, faint1, faint2); | ||
387 | adjust_line(line, len, cols); | 374 | adjust_line(line, len, cols); |
388 | printf("%s", line); | 375 | printf("%s", line); |
389 | 376 | ||
@@ -461,10 +448,14 @@ static void hnode_print(unsigned bw) { | |||
461 | protocol = "UDP"; | 448 | protocol = "UDP"; |
462 | else if (ptr->protocol == 0x06) | 449 | else if (ptr->protocol == 0x06) |
463 | protocol = "TCP"; | 450 | protocol = "TCP"; |
451 | else if (ptr->protocol == PROTOCOL_SSH) { | ||
452 | protocol = "SSH"; | ||
453 | stats_ssh += ptr->pkts; | ||
454 | } | ||
464 | 455 | ||
465 | if (protocol == NULL) | 456 | if (protocol == NULL) |
466 | protocol = ""; | 457 | protocol = ""; |
467 | if (ptr->port_src == 0) | 458 | if (ptr->port_src == PROTOCOL_ICMP) |
468 | len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d (ICMP) %s\n", | 459 | len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d (ICMP) %s\n", |
469 | bytes, bwline, PRINT_IP(ptr->ip_src), ptr->rnode->name); | 460 | bytes, bwline, PRINT_IP(ptr->ip_src), ptr->rnode->name); |
470 | else | 461 | else |
@@ -490,7 +481,7 @@ static void hnode_print(unsigned bw) { | |||
490 | 481 | ||
491 | ptr = next; | 482 | ptr = next; |
492 | } | 483 | } |
493 | printf("press any key to access stats\n"); | 484 | ansi_faint("(D)isplay, (S)ave, (C)lear, e(X)it\n"); |
494 | 485 | ||
495 | #ifdef DEBUG | 486 | #ifdef DEBUG |
496 | { | 487 | { |
@@ -505,10 +496,34 @@ static void hnode_print(unsigned bw) { | |||
505 | #endif | 496 | #endif |
506 | } | 497 | } |
507 | 498 | ||
499 | static void print_stats(FILE *fp) { | ||
500 | assert(fp); | ||
501 | |||
502 | fprintf(fp, "Stats: %u packets\n", stats_pkts); | ||
503 | fprintf(fp, " encrypted: TLS %u, QUIC %u, Tor %u\n", | ||
504 | stats_tls, stats_quic, stats_tor); | ||
505 | fprintf(fp, " unencrypted: HTTP %u\n", stats_http); | ||
506 | fprintf(fp, " C&C backchannel: SSH %u, PING %u, DNS %u, DoH %u, DoT %u, DoQ %u\n", | ||
507 | stats_ssh, stats_icmp_echo, stats_dns, stats_dns_doh, stats_dns_dot, stats_dns_doq); | ||
508 | |||
509 | fprintf(fp, "\n\nIP map"); | ||
510 | if (fp == stdout) | ||
511 | ansi_faint(" - network (packets)\n"); | ||
512 | else | ||
513 | fprintf(fp, " - network (packets)\n"); | ||
514 | radix_print(fp, 1); | ||
515 | |||
516 | fprintf(fp, "\n\nEvents %d", ev_cnt); | ||
517 | if (fp == stdout) | ||
518 | ansi_faint(" - time address data\n"); | ||
519 | else | ||
520 | fprintf(fp, " - time address data\n"); | ||
521 | ev_print(fp); | ||
508 | 522 | ||
509 | void print_stats(void) { | ||
510 | } | 523 | } |
511 | 524 | ||
525 | |||
526 | |||
512 | // trace rx traffic coming in | 527 | // trace rx traffic coming in |
513 | static void run_trace(void) { | 528 | static void run_trace(void) { |
514 | // trace only rx ipv4 tcp and upd | 529 | // trace only rx ipv4 tcp and upd |
@@ -523,7 +538,7 @@ static void run_trace(void) { | |||
523 | if (p1 != -1) | 538 | if (p1 != -1) |
524 | printf("loading snitrace..."); | 539 | printf("loading snitrace..."); |
525 | 540 | ||
526 | int p2 = runprog(LIBDIR "/firejail/fnettrace-dns --nolocal"); | 541 | int p2 = runprog(LIBDIR "/firejail/fnettrace-dns"); |
527 | if (p2 != -1) | 542 | if (p2 != -1) |
528 | printf("loading dnstrace..."); | 543 | printf("loading dnstrace..."); |
529 | unsigned last_print_traces = 0; | 544 | unsigned last_print_traces = 0; |
@@ -575,40 +590,67 @@ static void run_trace(void) { | |||
575 | int icmp = 0; | 590 | int icmp = 0; |
576 | 591 | ||
577 | if (FD_ISSET(0, &rfds)) { | 592 | if (FD_ISSET(0, &rfds)) { |
578 | getchar(); | 593 | int c = getchar(); |
579 | printf("\n\nStats: %u packets\n", stats_pkts); | 594 | if (c == 'c' || c == 'C') { |
580 | printf(" encrypted: TLS %u, QUIC %u, SSH %u, Tor %u\n", | 595 | clear_stats(); |
581 | stats_tls, stats_quic, stats_ssh, stats_tor); | 596 | ev_clear(); |
582 | printf(" unencrypted: HTTP %u\n", stats_http); | 597 | radix_clear_data(); |
583 | printf(" C&C backchannel: PING %u, DNS %u, DoH %u, DoT %u, DoQ %u\n", | 598 | continue; |
584 | stats_icmp_echo, stats_dns, stats_dns_doh, stats_dns_dot, stats_dns_doq); | 599 | } |
585 | printf("press any key to continue..."); | 600 | else if (c == 'd' || c == 'D') { |
586 | fflush(0); | 601 | printf("\n\n"); |
587 | 602 | ansi_bold("__________________________________________________________________________\n"); | |
588 | getchar(); | 603 | print_stats(stdout); |
589 | printf("\n\nSNI log - time server-address SNI\n"); | 604 | ansi_bold("__________________________________________________________________________\n"); |
590 | print_sni(); | 605 | ansi_faint("press any key to continue..."); |
591 | printf("press any key to continue..."); | 606 | fflush(0); |
592 | fflush(0); | 607 | |
593 | 608 | getchar(); | |
594 | getchar(); | 609 | continue; |
595 | printf("\n\nDNS log - time server-address domain\n"); | 610 | } |
596 | print_dns(); | 611 | if (c == 's' || c == 'S') { |
597 | printf("press any key to continue..."); | 612 | printf("The file is saved in /tmp directory. Please enter the file name: "); |
598 | fflush(0); | 613 | fflush(0); |
599 | 614 | ||
600 | getchar(); | 615 | char buf[LINE_MAX + 5]; // eave some room to add /tmp/ |
601 | printf("\n\nIP table: %d addresses - server-address network (packets)\n", radix_nodes); | 616 | strcpy(buf, "/tmp/"); |
602 | radix_print(1); | 617 | terminal_restore(); |
603 | printf("press any key to continue..."); | 618 | if (fgets(buf + 5, LINE_MAX, stdin) == NULL) |
604 | fflush(0); | 619 | errExit("fgets"); |
605 | 620 | terminal_set(); | |
606 | getchar(); | 621 | |
622 | // remove '\n' and open the file | ||
623 | char *ptr = strchr(buf, '\n'); | ||
624 | if (!ptr) { // we should have a '\n' | ||
625 | printf("Error: invalid file name\n"); | ||
626 | sleep(5); | ||
627 | continue; | ||
628 | } | ||
629 | *ptr = '\0'; | ||
630 | |||
631 | FILE *fp = fopen(buf, "w"); | ||
632 | if (!fp) { | ||
633 | printf("Error: cannot open file %s\n", buf); | ||
634 | perror("fopen"); | ||
635 | sleep(5); | ||
636 | continue; | ||
637 | } | ||
638 | |||
639 | printf("Saving stats in %s file...\n", buf); | ||
640 | print_stats(fp); | ||
641 | fclose(fp); | ||
642 | int rv = chmod(buf, 0600); | ||
643 | (void) rv; | ||
644 | sleep(1); | ||
645 | continue; | ||
646 | } | ||
647 | else if (c == 'x' || c == 'X') | ||
648 | break; | ||
607 | continue; | 649 | continue; |
608 | } | 650 | } |
609 | else if (FD_ISSET(p1, &rfds)) { | 651 | else if (FD_ISSET(p1, &rfds)) { |
610 | char buf[1024]; | 652 | char buf[LINE_MAX]; |
611 | ssize_t sz = read(p1, buf, 1024 - 1); | 653 | ssize_t sz = read(p1, buf, LINE_MAX - 1); |
612 | if (sz == -1) | 654 | if (sz == -1) |
613 | errExit("error reading snitrace"); | 655 | errExit("error reading snitrace"); |
614 | if (sz == 0) { | 656 | if (sz == 0) { |
@@ -618,19 +660,13 @@ static void run_trace(void) { | |||
618 | if (strncmp(buf, "SNI trace", 9) == 0) | 660 | if (strncmp(buf, "SNI trace", 9) == 0) |
619 | continue; | 661 | continue; |
620 | 662 | ||
621 | if (sz > LOG_RECORD_LEN) | ||
622 | sz = LOG_RECORD_LEN; | ||
623 | buf[sz] = '\0'; | 663 | buf[sz] = '\0'; |
624 | strcpy(sni_table[sni_index].record, buf); | 664 | ev_add(buf); |
625 | if (++sni_index >= SNIMAX) { | ||
626 | sni_index = 0; | ||
627 | *sni_table[sni_index].record = '\0'; | ||
628 | } | ||
629 | continue; | 665 | continue; |
630 | } | 666 | } |
631 | else if (FD_ISSET(p2, &rfds)) { | 667 | else if (FD_ISSET(p2, &rfds)) { |
632 | char buf[1024]; | 668 | char buf[LINE_MAX]; |
633 | ssize_t sz = read(p2, buf, 1024 - 1); | 669 | ssize_t sz = read(p2, buf, LINE_MAX - 1); |
634 | if (sz == -1) | 670 | if (sz == -1) |
635 | errExit("error reading dnstrace"); | 671 | errExit("error reading dnstrace"); |
636 | if (sz == 0) { | 672 | if (sz == 0) { |
@@ -640,16 +676,11 @@ static void run_trace(void) { | |||
640 | if (strncmp(buf, "DNS trace", 9) == 0) | 676 | if (strncmp(buf, "DNS trace", 9) == 0) |
641 | continue; | 677 | continue; |
642 | 678 | ||
643 | if (sz > LOG_RECORD_LEN) | ||
644 | sz = LOG_RECORD_LEN; | ||
645 | buf[sz] = '\0'; | 679 | buf[sz] = '\0'; |
646 | strcpy(dns_table[dns_index].record, buf); | 680 | ev_add(buf); |
647 | if (++dns_index >= DNSMAX) { | ||
648 | dns_index = 0; | ||
649 | *dns_table[dns_index].record = '\0'; | ||
650 | } | ||
651 | continue; | 681 | continue; |
652 | } | 682 | } |
683 | // by default we assume TCP | ||
653 | else if (FD_ISSET(s2, &rfds)) | 684 | else if (FD_ISSET(s2, &rfds)) |
654 | sock = s2; | 685 | sock = s2; |
655 | else if (FD_ISSET(s3, &rfds)) { | 686 | else if (FD_ISSET(s3, &rfds)) { |
@@ -658,7 +689,7 @@ static void run_trace(void) { | |||
658 | } | 689 | } |
659 | 690 | ||
660 | unsigned bytes = recvfrom(sock, buf, MAX_BUF_SIZE, 0, NULL, NULL); | 691 | unsigned bytes = recvfrom(sock, buf, MAX_BUF_SIZE, 0, NULL, NULL); |
661 | if (bytes >= 20) { // size of IP header | 692 | if (bytes >= 20) { // minimum size of IP packet |
662 | #ifdef DEBUG | 693 | #ifdef DEBUG |
663 | { | 694 | { |
664 | uint32_t ip_src; | 695 | uint32_t ip_src; |
@@ -682,12 +713,30 @@ static void run_trace(void) { | |||
682 | uint8_t hlen = (buf[0] & 0x0f) * 4; | 713 | uint8_t hlen = (buf[0] & 0x0f) * 4; |
683 | uint16_t port_src = 0; | 714 | uint16_t port_src = 0; |
684 | if (icmp) | 715 | if (icmp) |
685 | hnode_add(ip_src, 0, 0, bytes + 14); | 716 | hnode_add(ip_src, PROTOCOL_ICMP, 0, bytes + 14); |
686 | else { | 717 | else { // itcp or udp |
687 | memcpy(&port_src, buf + hlen, 2); | 718 | memcpy(&port_src, buf + hlen, 2); |
688 | port_src = ntohs(port_src); | 719 | port_src = ntohs(port_src); |
689 | 720 | int protocol = (int) buf[9]; | |
690 | uint8_t protocol = buf[9]; | 721 | |
722 | // detect ssh on a standard or not so standard port (22) | ||
723 | if (protocol == 6) { // tcp | ||
724 | uint8_t dataoffset = *(buf + hlen + 12); | ||
725 | uint8_t tcphlen = (dataoffset >> 2); | ||
726 | if (memcmp(buf + hlen + tcphlen, "SSH-", 4) == 0) { | ||
727 | time_t seconds = time(NULL); | ||
728 | struct tm *t = localtime(&seconds); | ||
729 | char ip[30]; | ||
730 | sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_src)); | ||
731 | char *msg; | ||
732 | if (asprintf(&msg, "%02d:%02d:%02d %-15s SSH connection", | ||
733 | t->tm_hour, t->tm_min, t->tm_sec, ip) == -1) | ||
734 | errExit("asprintf"); | ||
735 | ev_add(msg); | ||
736 | free(msg); | ||
737 | protocol = PROTOCOL_SSH; | ||
738 | } | ||
739 | } | ||
691 | hnode_add(ip_src, protocol, port_src, bytes + 14); | 740 | hnode_add(ip_src, protocol, port_src, bytes + 14); |
692 | } | 741 | } |
693 | 742 | ||
@@ -705,7 +754,10 @@ static void run_trace(void) { | |||
705 | close(s1); | 754 | close(s1); |
706 | close(s2); | 755 | close(s2); |
707 | close(s3); | 756 | close(s3); |
708 | print_stats(); | 757 | if (p1 != -1) |
758 | close(p1); | ||
759 | if (p2 != -1) | ||
760 | close(p2); | ||
709 | } | 761 | } |
710 | 762 | ||
711 | 763 | ||
@@ -765,7 +817,7 @@ int main(int argc, char **argv) { | |||
765 | else if (strcmp(argv[i], "--print-map") == 0) { | 817 | else if (strcmp(argv[i], "--print-map") == 0) { |
766 | char *fname = "static-ip-map.txt"; | 818 | char *fname = "static-ip-map.txt"; |
767 | load_hostnames(fname); | 819 | load_hostnames(fname); |
768 | radix_print(0); | 820 | radix_print(stdout, 0); |
769 | return 0; | 821 | return 0; |
770 | } | 822 | } |
771 | else if (strncmp(argv[i], "--squash-map=", 13) == 0) { | 823 | else if (strncmp(argv[i], "--squash-map=", 13) == 0) { |
@@ -787,7 +839,7 @@ int main(int argc, char **argv) { | |||
787 | printf("# License GPLv2\n"); | 839 | printf("# License GPLv2\n"); |
788 | printf("#\n"); | 840 | printf("#\n"); |
789 | 841 | ||
790 | radix_print(0); | 842 | radix_print(stdout, 0); |
791 | printf("\n#\n#\n# input %d, output %d\n#\n#\n", in, radix_nodes); | 843 | printf("\n#\n#\n# input %d, output %d\n#\n#\n", in, radix_nodes); |
792 | fprintf(stderr, "static ip map: input %d, output %d\n", in, radix_nodes); | 844 | fprintf(stderr, "static ip map: input %d, output %d\n", in, radix_nodes); |
793 | return 0; | 845 | return 0; |
diff --git a/src/fnettrace/radix.c b/src/fnettrace/radix.c index 322ee2643..9dfa725a2 100644 --- a/src/fnettrace/radix.c +++ b/src/fnettrace/radix.c | |||
@@ -151,21 +151,22 @@ RNode *radix_longest_prefix_match(uint32_t ip) { | |||
151 | } | 151 | } |
152 | 152 | ||
153 | static uint32_t sum; | 153 | static uint32_t sum; |
154 | static void print(RNode *ptr, int level, int pkts) { | 154 | static void print(FILE *fp, RNode *ptr, int level, int pkts) { |
155 | assert(fp); | ||
155 | if (!ptr) | 156 | if (!ptr) |
156 | return; | 157 | return; |
157 | if (ptr->name) { | 158 | if (ptr->name) { |
158 | if (pkts) { | 159 | if (pkts) { |
159 | if (ptr->pkts) { | 160 | if (ptr->pkts) { |
160 | printf(" %d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); | 161 | fprintf(fp, " %d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); |
161 | printf("%s", ptr->name); | 162 | fprintf(fp, "%s", ptr->name); |
162 | printf(" (%u)\n", ptr->pkts); | 163 | fprintf(fp, " (%u)\n", ptr->pkts); |
163 | } | 164 | } |
164 | } | 165 | } |
165 | else { | 166 | else { |
166 | printf("%d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); | 167 | fprintf(fp, "%d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); |
167 | printf("%s", ptr->name); | 168 | fprintf(fp, "%s", ptr->name); |
168 | printf("\n"); | 169 | fprintf(fp, "\n"); |
169 | } | 170 | } |
170 | } | 171 | } |
171 | 172 | ||
@@ -174,21 +175,21 @@ static void print(RNode *ptr, int level, int pkts) { | |||
174 | 175 | ||
175 | level++; | 176 | level++; |
176 | sum <<= 1; | 177 | sum <<= 1; |
177 | print(ptr->zero, level, pkts); | 178 | print(fp, ptr->zero, level, pkts); |
178 | sum++; | 179 | sum++; |
179 | print(ptr->one, level, pkts); | 180 | print(fp, ptr->one, level, pkts); |
180 | sum--; | 181 | sum--; |
181 | sum >>= 1; | 182 | sum >>= 1; |
182 | } | 183 | } |
183 | 184 | ||
184 | void radix_print(int pkts) { | 185 | void radix_print(FILE *fp, int pkts) { |
185 | if (!head) | 186 | if (!head) |
186 | return; | 187 | return; |
187 | sum = 0; | 188 | sum = 0; |
188 | print(head->zero, 1, pkts); | 189 | print(fp, head->zero, 1, pkts); |
189 | assert(sum == 0); | 190 | assert(sum == 0); |
190 | sum = 1; | 191 | sum = 1; |
191 | print(head->one, 1, pkts); | 192 | print(fp, head->one, 1, pkts); |
192 | assert(sum == 1); | 193 | assert(sum == 1); |
193 | } | 194 | } |
194 | 195 | ||
@@ -241,3 +242,18 @@ void radix_squash(void) { | |||
241 | assert(sum == 1); | 242 | assert(sum == 1); |
242 | 243 | ||
243 | } | 244 | } |
245 | |||
246 | static void clear_data(RNode *ptr) { | ||
247 | if (!ptr) | ||
248 | return; | ||
249 | ptr->pkts = 0; | ||
250 | clear_data(ptr->zero); | ||
251 | clear_data(ptr->one); | ||
252 | } | ||
253 | |||
254 | void radix_clear_data(void) { | ||
255 | if (!head) | ||
256 | return; | ||
257 | clear_data(head->zero); | ||
258 | clear_data(head->one); | ||
259 | } | ||
diff --git a/src/fnettrace/radix.h b/src/fnettrace/radix.h index 358524723..686d60ace 100644 --- a/src/fnettrace/radix.h +++ b/src/fnettrace/radix.h | |||
@@ -30,7 +30,8 @@ typedef struct rnode_t { | |||
30 | extern int radix_nodes; | 30 | extern int radix_nodes; |
31 | RNode *radix_longest_prefix_match(uint32_t ip); | 31 | RNode *radix_longest_prefix_match(uint32_t ip); |
32 | RNode*radix_add(uint32_t ip, uint32_t mask, char *name); | 32 | RNode*radix_add(uint32_t ip, uint32_t mask, char *name); |
33 | void radix_print(int pkts); | 33 | void radix_print(FILE *fp, int pkts); |
34 | void radix_squash(void); | 34 | void radix_squash(void); |
35 | void radix_clear_data(void); | ||
35 | 36 | ||
36 | #endif | 37 | #endif |
diff --git a/src/fnettrace/static-ip-map.txt b/src/fnettrace/static-ip-map.txt index eb66df73f..830df058f 100644 --- a/src/fnettrace/static-ip-map.txt +++ b/src/fnettrace/static-ip-map.txt | |||
@@ -92,7 +92,7 @@ | |||
92 | 8.8.4.0/24 Google DNS | 92 | 8.8.4.0/24 Google DNS |
93 | 8.8.8.0/24 Google DNS | 93 | 8.8.8.0/24 Google DNS |
94 | 8.20.247.20/32 Comodo DNS | 94 | 8.20.247.20/32 Comodo DNS |
95 | 8.26.56.26/32 Comodo DNS | 95 | 8.26.56.0/24 Comodo DNS |
96 | 9.9.9.0/24 Quad9 DNS | 96 | 9.9.9.0/24 Quad9 DNS |
97 | 45.90.28.0/22 NextDNS | 97 | 45.90.28.0/22 NextDNS |
98 | 45.11.45.0/24 DNS-SB | 98 | 45.11.45.0/24 DNS-SB |
@@ -103,8 +103,7 @@ | |||
103 | 76.76.10.0/24 ControlD DNS | 103 | 76.76.10.0/24 ControlD DNS |
104 | 76.76.19.0/24 Alternate DNS | 104 | 76.76.19.0/24 Alternate DNS |
105 | 76.223.122.150/32 Alternate DNS | 105 | 76.223.122.150/32 Alternate DNS |
106 | 77.88.8.8/32 Yandex DNS | 106 | 77.88.8.0/24 Yandex DNS |
107 | 77.88.8.1/32 Yandex DNS | ||
108 | 80.80.80.0/24 Freenom DNS Cloud | 107 | 80.80.80.0/24 Freenom DNS Cloud |
109 | 80.80.81.0/24 Freenom DNS Cloud | 108 | 80.80.81.0/24 Freenom DNS Cloud |
110 | 84.200.69.80/32 DSN Watch | 109 | 84.200.69.80/32 DSN Watch |
@@ -123,8 +122,7 @@ | |||
123 | 205.171.3.66/32 CentyrLink DNS | 122 | 205.171.3.66/32 CentyrLink DNS |
124 | 205.171.202.166/32 CentyrLink DNS | 123 | 205.171.202.166/32 CentyrLink DNS |
125 | 208.67.216.0/21 OpenDNS | 124 | 208.67.216.0/21 OpenDNS |
126 | 216.146.35.35/32 Dyn DNS | 125 | 216.146.32.0/20 Dyn DNS |
127 | 216.146.36.36/32 Dyn DNS | ||
128 | 126 | ||
129 | # whois | 127 | # whois |
130 | 45.88.202.0/24 Anonymize Inc WHOIS Privacy Service | 128 | 45.88.202.0/24 Anonymize Inc WHOIS Privacy Service |
@@ -167,12 +165,9 @@ | |||
167 | 66.211.176.0/20 eBay | 165 | 66.211.176.0/20 eBay |
168 | 66.218.64.0/19 Yahoo | 166 | 66.218.64.0/19 Yahoo |
169 | 66.220.144.0/20 Facebook | 167 | 66.220.144.0/20 Facebook |
170 | 69.30.200.200/29 BitChute | ||
171 | 69.53.224.0/19 Netflix | 168 | 69.53.224.0/19 Netflix |
172 | 69.171.224.0/19 Facebook | 169 | 69.171.224.0/19 Facebook |
173 | 69.197.182.184/29 BitChute | ||
174 | 74.6.0.0/16 Yahoo | 170 | 74.6.0.0/16 Yahoo |
175 | 74.91.29.208/29 BitChute | ||
176 | 87.250.254.0/24 Yandex | 171 | 87.250.254.0/24 Yandex |
177 | 91.105.192.0/23 Telegram | 172 | 91.105.192.0/23 Telegram |
178 | 91.108.4.0/22 Telegram | 173 | 91.108.4.0/22 Telegram |
@@ -185,22 +180,16 @@ | |||
185 | 91.189.94.0/24 Ubuntu One | 180 | 91.189.94.0/24 Ubuntu One |
186 | 95.161.64.0/20 Telegram | 181 | 95.161.64.0/20 Telegram |
187 | 99.181.64.0/18 Twitch | 182 | 99.181.64.0/18 Twitch |
188 | 69.197.138.24/29 BitChute | ||
189 | 103.10.124.0/23 Steam | 183 | 103.10.124.0/23 Steam |
190 | 103.28.54.0/24 Steam | 184 | 103.28.54.0/24 Steam |
191 | 103.53.48.0/23 Twitch | 185 | 103.53.48.0/23 Twitch |
192 | 104.244.40.0/21 Twitter | 186 | 104.244.40.0/21 Twitter |
193 | 107.150.32.0/19 BitChute | ||
194 | 107.150.35.192/29 BitChute | ||
195 | 107.150.45.120/29 BitChute | ||
196 | 108.160.160.0/20 Dropbox | 187 | 108.160.160.0/20 Dropbox |
197 | 108.175.32.0/20 Netflix | 188 | 108.175.32.0/20 Netflix |
189 | 129.144.0.0/12 Oracle | ||
198 | 129.134.0.0/16 Facebook | 190 | 129.134.0.0/16 Facebook |
199 | 140.82.112.0/20 GitHub | 191 | 140.82.112.0/20 GitHub |
200 | 142.54.180.104/29 BitChute | 192 | 143.55.64.0/20 GitHub |
201 | 142.54.181.184/29 BitChute | ||
202 | 142.54.189.192/29 BitChute | ||
203 | 143.55.64.0/20 Github | ||
204 | 146.66.152.0/24 Steam | 193 | 146.66.152.0/24 Steam |
205 | 146.66.155.0/24 Steam | 194 | 146.66.155.0/24 Steam |
206 | 149.154.160.0/20 Telegram | 195 | 149.154.160.0/20 Telegram |
@@ -219,10 +208,6 @@ | |||
219 | 162.213.32.0/22 Ubuntu One | 208 | 162.213.32.0/22 Ubuntu One |
220 | 162.254.192.0/21 Steam | 209 | 162.254.192.0/21 Steam |
221 | 172.98.56.0/22 Rumble | 210 | 172.98.56.0/22 Rumble |
222 | 173.208.154.8/29 BitChute | ||
223 | 173.208.154.160/29 BitChute | ||
224 | 173.208.185.200/29 BitChute | ||
225 | 173.208.219.112/29 BitChute | ||
226 | 178.154.131.0/24 Yandex | 211 | 178.154.131.0/24 Yandex |
227 | 185.2.220.0/22 Netflix | 212 | 185.2.220.0/22 Netflix |
228 | 185.9.188.0/22 Netflix | 213 | 185.9.188.0/22 Netflix |
@@ -235,7 +220,6 @@ | |||
235 | 185.125.188.0/22 Ubuntu One | 220 | 185.125.188.0/22 Ubuntu One |
236 | 185.199.108.0/22 GitHub | 221 | 185.199.108.0/22 GitHub |
237 | 185.205.69.0/24 Tutanota | 222 | 185.205.69.0/24 Tutanota |
238 | 185.238.113.0/24 Bitchute | ||
239 | 188.64.224.0/21 Twitter | 223 | 188.64.224.0/21 Twitter |
240 | 190.217.33.0/24 Steam | 224 | 190.217.33.0/24 Steam |
241 | 192.0.64.0/18 Wordpress | 225 | 192.0.64.0/18 Wordpress |
@@ -243,24 +227,15 @@ | |||
243 | 192.30.252.0/22 GitHub | 227 | 192.30.252.0/22 GitHub |
244 | 192.69.96.0/22 Steam | 228 | 192.69.96.0/22 Steam |
245 | 192.108.239.0/24 Twitch | 229 | 192.108.239.0/24 Twitch |
246 | 192.151.158.136/29 BitChute | ||
247 | 192.173.64.0/18 Netflix | 230 | 192.173.64.0/18 Netflix |
248 | 192.187.97.88/29 BitChute | ||
249 | 192.187.114.96/29 BitChute | ||
250 | 192.187.123.112/29 BitChute | ||
251 | 192.187.126.0/29 BitChute | ||
252 | 192.189.200.0/23 Dropbox | 231 | 192.189.200.0/23 Dropbox |
253 | 194.169.254.0/24 Ubuntu One | 232 | 194.169.254.0/24 Ubuntu One |
254 | 198.38.96.0/19 Netflix | 233 | 198.38.96.0/19 Netflix |
255 | 198.45.48.0/20 Netflix | 234 | 198.45.48.0/20 Netflix |
256 | 198.204.226.120/29 BitChute | ||
257 | 198.204.245.88/29 BitChute | ||
258 | 198.252.206.0/24 Stack Exchange | 235 | 198.252.206.0/24 Stack Exchange |
259 | 199.9.248.0/21 Twitch | 236 | 199.9.248.0/21 Twitch |
260 | 199.16.156.0/22 Twitter | 237 | 199.16.156.0/22 Twitter |
261 | 199.59.148.0/22 Twitter | 238 | 199.59.148.0/22 Twitter |
262 | 199.168.96.24/29 BitChute | ||
263 | 204.12.194.176/29 BitChute | ||
264 | 205.185.194.0/24 Steam | 239 | 205.185.194.0/24 Steam |
265 | 205.196.6.0/24 Steam | 240 | 205.196.6.0/24 Steam |
266 | 207.45.72.0/22 Netflix | 241 | 207.45.72.0/22 Netflix |
@@ -270,9 +245,77 @@ | |||
270 | 208.75.76.0/22 Netflix | 245 | 208.75.76.0/22 Netflix |
271 | 208.78.164.0/22 Steam | 246 | 208.78.164.0/22 Steam |
272 | 208.80.152.0/22 Wikipedia | 247 | 208.80.152.0/22 Wikipedia |
273 | 208.110.68.56/29 BitChute | ||
274 | 209.140.128.0/18 eBay | 248 | 209.140.128.0/18 eBay |
275 | 249 | ||
250 | # BitChute | ||
251 | 63.141.247.168/29 BitChute | ||
252 | 63.141.247.240/29 BitChute | ||
253 | 69.30.200.200/29 BitChute | ||
254 | 69.30.230.64/29 BitChute | ||
255 | 69.30.241.40/29 BitChute | ||
256 | 69.30.241.48/29 BitChute | ||
257 | 69.30.243.168/29 BitChute | ||
258 | 69.30.245.232/29 BitChute | ||
259 | 69.30.253.16/29 BitChute | ||
260 | 69.197.182.184/29 BitChute | ||
261 | 74.91.28.208/29 BitChute | ||
262 | 74.91.29.208/29 BitChute | ||
263 | 69.197.138.24/29 BitChute | ||
264 | 107.150.32.0/19 BitChute | ||
265 | 107.150.35.192/29 BitChute | ||
266 | 107.150.45.120/29 BitChute | ||
267 | 142.54.180.104/29 BitChute | ||
268 | 142.54.181.184/29 BitChute | ||
269 | 142.54.188.112/29 BitChute | ||
270 | 142.54.189.192/29 BitChute | ||
271 | 173.208.154.8/29 BitChute | ||
272 | 173.208.154.160/29 BitChute | ||
273 | 173.208.176.128/29 BitChute | ||
274 | 173.208.185.200/29 BitChute | ||
275 | 173.208.203.224/29 BitChute | ||
276 | 173.208.203.248/29 BitChute | ||
277 | 173.208.211.224/29 BitChute | ||
278 | 173.208.216.40/29 BitChute | ||
279 | 173.208.219.112/29 BitChute | ||
280 | 173.208.246.160/29 BitChute | ||
281 | 185.238.113.0/24 BitChute | ||
282 | 192.151.147.16/29 BitChute | ||
283 | 192.151.158.136/29 BitChute | ||
284 | 192.187.97.88/29 BitChute | ||
285 | 192.187.114.16/29 BitChute | ||
286 | 192.187.114.96/29 BitChute | ||
287 | 192.187.118.168/29 BitChute | ||
288 | 192.187.121.208/29 BitChute | ||
289 | 192.187.122.72/29 BitChute | ||
290 | 192.187.123.112/29 BitChute | ||
291 | 192.187.126.0/29 BitChute | ||
292 | 198.204.226.120/29 BitChute | ||
293 | 198.204.228.48/29 BitChute | ||
294 | 198.204.235.88/29 BitChute | ||
295 | 198.204.235.216/29 BitChute | ||
296 | 198.204.245.32/29 BitChute | ||
297 | 198.204.245.88/29 BitChute | ||
298 | 198.204.250.208/29 BitChute | ||
299 | 198.204.253.64/29 BitChute | ||
300 | 198.204.253.184/29 BitChute | ||
301 | 199.168.96.24/29 BitChute | ||
302 | 199.168.96.64/29 BitChute | ||
303 | 204.12.220.136/29 BitChute | ||
304 | 204.12.194.176/29 BitChute | ||
305 | 204.12.194.248/29 BitChute | ||
306 | 204.12.220.232/29 BitChute | ||
307 | 208.110.68.56/29 BitChute | ||
308 | |||
309 | # WholeSale Internet | ||
310 | 69.30.192.0/18 WholeSale Internet | ||
311 | 69.197.128.0/18 WholeSale Internet | ||
312 | 142.54.160.0/19 WholeSale Internet | ||
313 | 173.208.128.0/17 WholeSale Internet | ||
314 | 204.12.192.0/18 WholeSale Internet | ||
315 | 208.67.0.0/21 WholeSale Internet | ||
316 | 208.110.64.0/19 WholeSale Internet | ||
317 | 208.110.91.0/24 WholeSale Internet | ||
318 | |||
276 | # Imperva | 319 | # Imperva |
277 | 199.83.128.0/21 Imperva | 320 | 199.83.128.0/21 Imperva |
278 | 198.143.32.0/19 Imperva | 321 | 198.143.32.0/19 Imperva |
@@ -297,6 +340,7 @@ | |||
297 | 66.243.0.0/17 Level 3 | 340 | 66.243.0.0/17 Level 3 |
298 | 66.243.128.0/18 Level 3 | 341 | 66.243.128.0/18 Level 3 |
299 | 66.251.192.0/19 Level 3 | 342 | 66.251.192.0/19 Level 3 |
343 | 74.202.0.0/15 Level 3 | ||
300 | 205.128.0.0/14 Level 3 | 344 | 205.128.0.0/14 Level 3 |
301 | 205.180.0.0/14 Level 3 | 345 | 205.180.0.0/14 Level 3 |
302 | 205.184.0.0/19 Level 3 | 346 | 205.184.0.0/19 Level 3 |
@@ -325,6 +369,7 @@ | |||
325 | 69.16.173.0/24 StackPath | 369 | 69.16.173.0/24 StackPath |
326 | 69.16.174.0/23 StackPath | 370 | 69.16.174.0/23 StackPath |
327 | 69.16.176.0/20 StackPath | 371 | 69.16.176.0/20 StackPath |
372 | 74.209.128.0/20 StackPath | ||
328 | 151.139.0.0/16 StackPath | 373 | 151.139.0.0/16 StackPath |
329 | 205.185.194.0/23 StackPath | 374 | 205.185.194.0/23 StackPath |
330 | 205.185.196.0/23 StackPath | 375 | 205.185.196.0/23 StackPath |
@@ -354,6 +399,7 @@ | |||
354 | 45.79.0.0/16 Linode | 399 | 45.79.0.0/16 Linode |
355 | 50.116.0.0/18 Linode | 400 | 50.116.0.0/18 Linode |
356 | 66.175.208.0/20 Linode | 401 | 66.175.208.0/20 Linode |
402 | 74.207.224.0/19 Linode | ||
357 | 103.29.68.0/22 Linode | 403 | 103.29.68.0/22 Linode |
358 | 104.200.16.0/21 Linode | 404 | 104.200.16.0/21 Linode |
359 | 104.200.24.0/22 Linode | 405 | 104.200.24.0/22 Linode |
@@ -461,6 +507,8 @@ | |||
461 | 23.72.0.0/13 Akamai | 507 | 23.72.0.0/13 Akamai |
462 | 23.192.0.0/11 Akamai | 508 | 23.192.0.0/11 Akamai |
463 | 72.246.0.0/15 Akamai | 509 | 72.246.0.0/15 Akamai |
510 | 74.121.124.0/22 Akamai | ||
511 | 92.122.160.0/20 Akamai | ||
464 | 96.6.0.0/15 Akamai | 512 | 96.6.0.0/15 Akamai |
465 | 96.16.0.0/15 Akamai | 513 | 96.16.0.0/15 Akamai |
466 | 104.64.0.0/10 Akamai | 514 | 104.64.0.0/10 Akamai |
@@ -533,6 +581,7 @@ | |||
533 | 20.48.0.0/12 Microsoft | 581 | 20.48.0.0/12 Microsoft |
534 | 20.128.0.0/16 Microsoft | 582 | 20.128.0.0/16 Microsoft |
535 | 20.192.0.0/10 Microsoft | 583 | 20.192.0.0/10 Microsoft |
584 | 23.96.0.0/13 Microsoft | ||
536 | 40.76.0.0/14 Microsoft | 585 | 40.76.0.0/14 Microsoft |
537 | 40.96.0.0/12 Microsoft | 586 | 40.96.0.0/12 Microsoft |
538 | 40.112.0.0/13 Microsoft | 587 | 40.112.0.0/13 Microsoft |
@@ -541,11 +590,38 @@ | |||
541 | 40.80.0.0/12 Microsoft | 590 | 40.80.0.0/12 Microsoft |
542 | 40.120.0.0/14 Microsoft | 591 | 40.120.0.0/14 Microsoft |
543 | 40.125.0.0/17 Microsoft | 592 | 40.125.0.0/17 Microsoft |
593 | 51.4.0.0/15 Microsoft | ||
594 | 51.8.0.0/16 Microsoft | ||
595 | 51.10.0.0/14 Microsoft | ||
596 | 51.51.0.0/16 Microsoft | ||
597 | 51.53.0.0/16 Microsoft | ||
598 | 51.103.0.0/16 Microsoft | ||
599 | 51.107.0.0/16 Microsoft | ||
600 | 51.116.0.0/16 Microsoft | ||
601 | 51.120.0.0/16 Microsoft | ||
602 | 51.124.0.0/16 Microsoft | ||
603 | 51.132.0.0/16 Microsoft | ||
604 | 51.136.0.0/16 Microsoft | ||
605 | 51.140.0.0/15 Microsoft | ||
606 | 52.96.0.0/12 Microsoft | ||
607 | 52.112.0.0/14 Microsoft | ||
608 | 52.120.0.0/14 Microsoft | ||
609 | 52.125.0.0/16 Microsoft | ||
610 | 52.126.0.0/15 Microsoft | ||
611 | 52.132.0.0/14 Microsoft | ||
612 | 52.136.0.0/13 Microsoft | ||
544 | 52.145.0.0/16 Microsoft | 613 | 52.145.0.0/16 Microsoft |
614 | 52.146.0.0/15 Microsoft | ||
545 | 52.148.0.0/14 Microsoft | 615 | 52.148.0.0/14 Microsoft |
546 | 52.152.0.0/13 Microsoft | 616 | 52.152.0.0/13 Microsoft |
547 | 52.146.0.0/15 Microsoft | ||
548 | 52.160.0.0/11 Microsoft | 617 | 52.160.0.0/11 Microsoft |
618 | 52.224.0.0/11 Microsoft | ||
619 | 74.160.0.0/14 Microsoft | ||
620 | 74.176.0.0/14 Microsoft | ||
621 | 74.224.0.0/14 Microsoft | ||
622 | 74.234.0.0/15 Microsoft | ||
623 | 74.240.0.0/14 Microsoft | ||
624 | 74.248.0.0/15 Microsoft | ||
549 | 168.61.0.0/16 Microsoft | 625 | 168.61.0.0/16 Microsoft |
550 | 168.62.0.0/15 Microsoft | 626 | 168.62.0.0/15 Microsoft |
551 | 627 | ||
@@ -561,6 +637,7 @@ | |||
561 | 206.190.32.0/19 Yahoo | 637 | 206.190.32.0/19 Yahoo |
562 | 209.73.160.0/19 Yahoo | 638 | 209.73.160.0/19 Yahoo |
563 | 209.191.64.0/18 Yahoo | 639 | 209.191.64.0/18 Yahoo |
640 | 212.82.100.0/22 Yahoo | ||
564 | 216.115.96.0/20 Yahoo | 641 | 216.115.96.0/20 Yahoo |
565 | 642 | ||
566 | 643 | ||
@@ -570,6 +647,18 @@ | |||
570 | 8.35.192.0/20 Google | 647 | 8.35.192.0/20 Google |
571 | 23.236.48.0/20 Google | 648 | 23.236.48.0/20 Google |
572 | 23.251.128.0/19 Google | 649 | 23.251.128.0/19 Google |
650 | 34.4.16.0/20 Google | ||
651 | 34.4.64.0/18 Google | ||
652 | 34.4.6.0/23 Google | ||
653 | 34.16.0.0/12 Google | ||
654 | 34.32.0.0/11 Google | ||
655 | 34.4.128.0/17 Google | ||
656 | 34.8.0.0/13 Google | ||
657 | 34.4.8.0/21 Google | ||
658 | 34.5.0.0/16 Google | ||
659 | 34.6.0.0/15 Google | ||
660 | 34.4.32.0/19 Google | ||
661 | 34.4.5.0/24 Google | ||
573 | 34.64.0.0/10 Google | 662 | 34.64.0.0/10 Google |
574 | 34.128.0.0/10 Google | 663 | 34.128.0.0/10 Google |
575 | 35.184.0.0/13 Google | 664 | 35.184.0.0/13 Google |
@@ -1820,6 +1909,7 @@ | |||
1820 | 34.192.0.0/12 Amazon | 1909 | 34.192.0.0/12 Amazon |
1821 | 34.208.0.0/12 Amazon | 1910 | 34.208.0.0/12 Amazon |
1822 | 34.224.0.0/12 Amazon | 1911 | 34.224.0.0/12 Amazon |
1912 | 34.225.127.72/10 Amazon | ||
1823 | 34.240.0.0/13 Amazon | 1913 | 34.240.0.0/13 Amazon |
1824 | 34.248.0.0/13 Amazon | 1914 | 34.248.0.0/13 Amazon |
1825 | 35.71.64.0/22 Amazon | 1915 | 35.71.64.0/22 Amazon |
@@ -3368,7 +3458,7 @@ | |||
3368 | 54.93.0.0/16 Amazon | 3458 | 54.93.0.0/16 Amazon |
3369 | 54.94.0.0/16 Amazon | 3459 | 54.94.0.0/16 Amazon |
3370 | 54.95.0.0/16 Amazon | 3460 | 54.95.0.0/16 Amazon |
3371 | 54.144.0.0/14 Amazon | 3461 | 54.144.0.0/12 Amazon |
3372 | 54.148.0.0/15 Amazon | 3462 | 54.148.0.0/15 Amazon |
3373 | 54.150.0.0/16 Amazon | 3463 | 54.150.0.0/16 Amazon |
3374 | 54.151.0.0/17 Amazon | 3464 | 54.151.0.0/17 Amazon |
@@ -3379,7 +3469,7 @@ | |||
3379 | 54.154.0.0/16 Amazon | 3469 | 54.154.0.0/16 Amazon |
3380 | 54.155.0.0/16 Amazon | 3470 | 54.155.0.0/16 Amazon |
3381 | 54.156.0.0/14 Amazon | 3471 | 54.156.0.0/14 Amazon |
3382 | 54.160.0.0/13 Amazon | 3472 | 54.160.0.0/11 Amazon |
3383 | 54.168.0.0/16 Amazon | 3473 | 54.168.0.0/16 Amazon |
3384 | 54.169.0.0/16 Amazon | 3474 | 54.169.0.0/16 Amazon |
3385 | 54.170.0.0/15 Amazon | 3475 | 54.170.0.0/15 Amazon |
@@ -3392,7 +3482,7 @@ | |||
3392 | 54.182.0.0/16 Amazon | 3482 | 54.182.0.0/16 Amazon |
3393 | 54.183.0.0/16 Amazon | 3483 | 54.183.0.0/16 Amazon |
3394 | 54.184.0.0/13 Amazon | 3484 | 54.184.0.0/13 Amazon |
3395 | 54.192.0.0/16 Amazon | 3485 | 54.192.0.0/12 Amazon |
3396 | 54.193.0.0/16 Amazon | 3486 | 54.193.0.0/16 Amazon |
3397 | 54.194.0.0/15 Amazon | 3487 | 54.194.0.0/15 Amazon |
3398 | 54.196.0.0/15 Amazon | 3488 | 54.196.0.0/15 Amazon |
@@ -3403,12 +3493,12 @@ | |||
3403 | 54.204.0.0/15 Amazon | 3493 | 54.204.0.0/15 Amazon |
3404 | 54.206.0.0/16 Amazon | 3494 | 54.206.0.0/16 Amazon |
3405 | 54.207.0.0/16 Amazon | 3495 | 54.207.0.0/16 Amazon |
3406 | 54.208.0.0/15 Amazon | 3496 | 54.208.0.0/13 Amazon |
3407 | 54.210.0.0/15 Amazon | 3497 | 54.210.0.0/15 Amazon |
3408 | 54.212.0.0/15 Amazon | 3498 | 54.212.0.0/15 Amazon |
3409 | 54.214.0.0/16 Amazon | 3499 | 54.214.0.0/16 Amazon |
3410 | 54.215.0.0/16 Amazon | 3500 | 54.215.0.0/16 Amazon |
3411 | 54.216.0.0/15 Amazon | 3501 | 54.216.0.0/14 Amazon |
3412 | 54.218.0.0/16 Amazon | 3502 | 54.218.0.0/16 Amazon |
3413 | 54.219.0.0/16 Amazon | 3503 | 54.219.0.0/16 Amazon |
3414 | 54.220.0.0/16 Amazon | 3504 | 54.220.0.0/16 Amazon |
@@ -3668,6 +3758,10 @@ | |||
3668 | 72.21.192.0/19 Amazon | 3758 | 72.21.192.0/19 Amazon |
3669 | 72.41.0.0/20 Amazon | 3759 | 72.41.0.0/20 Amazon |
3670 | 72.44.32.0/19 Amazon | 3760 | 72.44.32.0/19 Amazon |
3761 | 74.127.0.0/18 Amazon | ||
3762 | 74.190.0.0/16 Amazon | ||
3763 | 74.230.0.0/16 Amazon | ||
3764 | 74.250.0.0/16 Amazon | ||
3671 | 75.2.0.0/17 Amazon | 3765 | 75.2.0.0/17 Amazon |
3672 | 75.101.128.0/17 Amazon | 3766 | 75.101.128.0/17 Amazon |
3673 | 76.223.0.0/17 Amazon | 3767 | 76.223.0.0/17 Amazon |
@@ -5649,3 +5743,374 @@ | |||
5649 | 64.120.69.0/24 Leaseweb | 5743 | 64.120.69.0/24 Leaseweb |
5650 | 69.147.236.0/24 Leaseweb | 5744 | 69.147.236.0/24 Leaseweb |
5651 | 70.32.34.0/24 Leaseweb | 5745 | 70.32.34.0/24 Leaseweb |
5746 | |||
5747 | |||
5748 | |||
5749 | # GoDaddy | ||
5750 | 103.1.172.0/22 GoDaddy | ||
5751 | 103.1.172.0/24 GoDaddy | ||
5752 | 103.1.174.0/24 GoDaddy | ||
5753 | 103.1.175.0/24 GoDaddy | ||
5754 | 104.238.64.0/18 GoDaddy | ||
5755 | 104.238.64.0/19 GoDaddy | ||
5756 | 104.238.64.0/22 GoDaddy | ||
5757 | 104.238.64.0/24 GoDaddy | ||
5758 | 107.180.0.0/17 GoDaddy | ||
5759 | 107.180.0.0/18 GoDaddy | ||
5760 | 107.180.100.0/22 GoDaddy | ||
5761 | 107.180.104.0/22 GoDaddy | ||
5762 | 107.180.108.0/22 GoDaddy | ||
5763 | 107.180.120.0/22 GoDaddy | ||
5764 | 107.180.64.0/19 GoDaddy | ||
5765 | 118.139.160.0/19 GoDaddy | ||
5766 | 118.139.160.0/21 GoDaddy | ||
5767 | 132.148.0.0/16 GoDaddy | ||
5768 | 132.148.16.0/20 GoDaddy | ||
5769 | 132.148.16.0/22 GoDaddy | ||
5770 | 132.148.164.0/22 GoDaddy | ||
5771 | 132.148.184.0/21 GoDaddy | ||
5772 | 132.148.192.0/20 GoDaddy | ||
5773 | 132.148.20.0/22 GoDaddy | ||
5774 | 132.148.24.0/22 GoDaddy | ||
5775 | 132.148.32.0/21 GoDaddy | ||
5776 | 148.66.128.0/19 GoDaddy | ||
5777 | 148.66.128.0/22 GoDaddy | ||
5778 | 148.66.136.0/22 GoDaddy | ||
5779 | 148.66.140.0/22 GoDaddy | ||
5780 | 148.66.144.0/21 GoDaddy | ||
5781 | 148.72.0.0/17 GoDaddy | ||
5782 | 148.72.16.0/22 GoDaddy | ||
5783 | 148.72.204.0/22 GoDaddy | ||
5784 | 148.72.204.0/24 GoDaddy | ||
5785 | 148.72.206.0/23 GoDaddy | ||
5786 | 148.72.208.0/21 GoDaddy | ||
5787 | 148.72.220.0/22 GoDaddy | ||
5788 | 148.72.224.0/19 GoDaddy | ||
5789 | 148.72.224.0/20 GoDaddy | ||
5790 | 148.72.240.0/22 GoDaddy | ||
5791 | 148.72.244.0/22 GoDaddy | ||
5792 | 148.72.32.0/21 GoDaddy | ||
5793 | 148.72.32.0/23 GoDaddy | ||
5794 | 148.72.34.0/24 GoDaddy | ||
5795 | 148.72.36.0/24 GoDaddy | ||
5796 | 148.72.4.0/22 GoDaddy | ||
5797 | 148.72.44.0/22 GoDaddy | ||
5798 | 148.72.88.0/22 GoDaddy | ||
5799 | 160.153.32.0/19 GoDaddy | ||
5800 | 160.153.64.0/18 GoDaddy | ||
5801 | 160.153.64.0/19 GoDaddy | ||
5802 | 160.153.96.0/19 GoDaddy | ||
5803 | 166.62.0.0/19 GoDaddy | ||
5804 | 166.62.0.0/22 GoDaddy | ||
5805 | 166.62.0.0/24 GoDaddy | ||
5806 | 166.62.100.0/22 GoDaddy | ||
5807 | 166.62.10.0/23 GoDaddy | ||
5808 | 166.62.1.0/24 GoDaddy | ||
5809 | 166.62.112.0/20 GoDaddy | ||
5810 | 166.62.116.0/22 GoDaddy | ||
5811 | 166.62.120.0/22 GoDaddy | ||
5812 | 166.62.12.0/22 GoDaddy | ||
5813 | 166.62.12.0/24 GoDaddy | ||
5814 | 166.62.13.0/24 GoDaddy | ||
5815 | 166.62.15.0/24 GoDaddy | ||
5816 | 166.62.16.0/22 GoDaddy | ||
5817 | 166.62.17.0/24 GoDaddy | ||
5818 | 166.62.20.0/22 GoDaddy | ||
5819 | 166.62.2.0/24 GoDaddy | ||
5820 | 166.62.23.0/24 GoDaddy | ||
5821 | 166.62.24.0/22 GoDaddy | ||
5822 | 166.62.24.0/24 GoDaddy | ||
5823 | 166.62.25.0/24 GoDaddy | ||
5824 | 166.62.26.0/23 GoDaddy | ||
5825 | 166.62.28.0/22 GoDaddy | ||
5826 | 166.62.3.0/24 GoDaddy | ||
5827 | 166.62.32.0/19 GoDaddy | ||
5828 | 166.62.32.0/22 GoDaddy | ||
5829 | 166.62.36.0/22 GoDaddy | ||
5830 | 166.62.40.0/22 GoDaddy | ||
5831 | 166.62.4.0/22 GoDaddy | ||
5832 | 166.62.4.0/24 GoDaddy | ||
5833 | 166.62.44.0/22 GoDaddy | ||
5834 | 166.62.5.0/24 GoDaddy | ||
5835 | 166.62.52.0/22 GoDaddy | ||
5836 | 166.62.56.0/22 GoDaddy | ||
5837 | 166.62.60.0/22 GoDaddy | ||
5838 | 166.62.6.0/23 GoDaddy | ||
5839 | 166.62.64.0/18 GoDaddy | ||
5840 | 166.62.64.0/19 GoDaddy | ||
5841 | 166.62.80.0/22 GoDaddy | ||
5842 | 166.62.8.0/22 GoDaddy | ||
5843 | 166.62.8.0/24 GoDaddy | ||
5844 | 166.62.84.0/22 GoDaddy | ||
5845 | 166.62.88.0/22 GoDaddy | ||
5846 | 166.62.9.0/24 GoDaddy | ||
5847 | |||
5848 | # IBM cloud service | ||
5849 | # https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-ibm-cloud-ip-ranges | ||
5850 | # last update Aug 2023 | ||
5851 | 159.8.198.0/23 IBM | ||
5852 | 169.38.118.0/23 IBM | ||
5853 | 173.192.118.0/23 IBM | ||
5854 | 192.255.18.0/24 IBM | ||
5855 | 198.23.118.0/23 IBM | ||
5856 | 169.46.118.0/23 IBM | ||
5857 | 169.47.118.0/23 IBM | ||
5858 | 169.48.118.0/24 IBM | ||
5859 | 159.122.118.0/23 IBM | ||
5860 | 161.156.118.0/24 IBM | ||
5861 | 149.81.118.0/23 IBM | ||
5862 | 5.10.118.0/23 IBM | ||
5863 | 158.175.127.0/24 IBM | ||
5864 | 141.125.118.0/23 IBM | ||
5865 | 158.176.118.0/23 IBM | ||
5866 | 159.122.138.0/23 IBM | ||
5867 | 169.54.118.0/23 IBM | ||
5868 | 163.68.118.0/24 IBM | ||
5869 | 163.69.118.0/24 IBM | ||
5870 | 163.73.118.0/24 IBM | ||
5871 | 159.8.118.0/23 IBM | ||
5872 | 169.57.138.0/23 IBM | ||
5873 | 50.23.118.0/23 IBM | ||
5874 | 169.45.118.0/23 IBM | ||
5875 | 169.62.118.0/24 IBM | ||
5876 | 174.133.118.0/23 IBM | ||
5877 | 168.1.18.0/23 IBM | ||
5878 | 130.198.118.0/23 IBM | ||
5879 | 135.90.118.0/23 IBM | ||
5880 | 161.202.118.0/23 IBM | ||
5881 | 128.168.118.0/23 IBM | ||
5882 | 165.192.118.0/23 IBM | ||
5883 | 158.85.118.0/23 IBM | ||
5884 | 163.74.118.0/23 IBM | ||
5885 | 163.75.118.0/23 IBM | ||
5886 | 208.43.118.0/23 IBM | ||
5887 | 192.255.38.0/24 IBM | ||
5888 | 169.55.118.0/23 IBM | ||
5889 | 169.60.118.0/23 IBM | ||
5890 | 169.61.118.0/23 IBM | ||
5891 | 159.8.197.0/24 IBM | ||
5892 | 169.38.117.0/24 IBM | ||
5893 | 50.23.203.0/24 IBM | ||
5894 | 108.168.157.0/24 IBM | ||
5895 | 173.192.117.0/24 IBM | ||
5896 | 192.155.205.0/24 IBM | ||
5897 | 169.46.187.0/24 IBM | ||
5898 | 198.23.117.0/24 IBM | ||
5899 | 169.46.117.0/24 IBM | ||
5900 | 169.47.117.0/24 IBM | ||
5901 | 169.48.117.0/24 IBM | ||
5902 | 159.122.117.0/24 IBM | ||
5903 | 161.156.117.0/24 IBM | ||
5904 | 149.81.117.0/24 IBM | ||
5905 | 5.10.117.0/24 IBM | ||
5906 | 158.175.117.0/24 IBM | ||
5907 | 141.125.117.0/24 IBM | ||
5908 | 158.176.117.0/24 IBM | ||
5909 | 159.122.137.0/24 IBM | ||
5910 | 169.54.117.0/24 IBM | ||
5911 | 159.8.117.0/24 IBM | ||
5912 | 169.57.137.0/24 IBM | ||
5913 | 50.23.117.0/24 IBM | ||
5914 | 169.45.117.0/24 IBM | ||
5915 | 174.133.117.0/24 IBM | ||
5916 | 168.1.17.0/24 IBM | ||
5917 | 130.198.117.0/24 IBM | ||
5918 | 135.90.117.0/24 IBM | ||
5919 | 161.202.117.0/24 IBM | ||
5920 | 128.168.117.0/24 IBM | ||
5921 | 165.192.117.0/24 IBM | ||
5922 | 158.85.117.0/24 IBM | ||
5923 | 50.22.248.0/25 IBM | ||
5924 | 169.54.27.0/24 IBM | ||
5925 | 198.11.250.0/24 IBM | ||
5926 | 208.43.117.0/24 IBM | ||
5927 | 169.55.117.0/24 IBM | ||
5928 | 169.60.117.0/24 IBM | ||
5929 | 169.61.117.0/24 IBM | ||
5930 | 12.96.160.0/24 IBM | ||
5931 | 66.98.240.192/26 IBM | ||
5932 | 67.18.139.0/24 IBM | ||
5933 | 67.19.0.0/24 IBM | ||
5934 | 70.84.160.0/24 IBM | ||
5935 | 70.85.125.0/24 IBM | ||
5936 | 75.125.126.8/32 IBM | ||
5937 | 209.85.4.0/26 IBM | ||
5938 | 216.12.193.9/32 IBM | ||
5939 | 216.40.193.0/24 IBM | ||
5940 | 216.234.234.0/24 IBM | ||
5941 | |||
5942 | # Hetzner | ||
5943 | 116.202.0.0/16 Hetzner | ||
5944 | 116.203.0.0/16 Hetzner | ||
5945 | 128.140.0.0/17 Hetzner | ||
5946 | 135.181.0.0/16 Hetzner | ||
5947 | 142.132.128.0/17 Hetzner | ||
5948 | 157.90.0.0/16 Hetzner | ||
5949 | 159.69.0.0/16 Hetzner | ||
5950 | 162.55.0.0/16 Hetzner | ||
5951 | 167.233.0.0/16 Hetzner | ||
5952 | 167.235.0.0/16 Hetzner | ||
5953 | 168.119.0.0/16 Hetzner | ||
5954 | 176.9.0.0/16 Hetzner | ||
5955 | 178.63.0.0/16 Hetzner | ||
5956 | 188.34.128.0/17 Hetzner | ||
5957 | 188.40.0.0/16 Hetzner | ||
5958 | 195.201.0.0/16 Hetzner | ||
5959 | 213.239.192.0/18 Hetzner | ||
5960 | 23.88.0.0/17 Hetzner | ||
5961 | 37.27.0.0/16 Hetzner | ||
5962 | 46.4.0.0/16 Hetzner | ||
5963 | 49.12.0.0/16 Hetzner | ||
5964 | 49.13.0.0/16 Hetzner | ||
5965 | 5.75.128.0/17 Hetzner | ||
5966 | 5.9.0.0/16 Hetzner | ||
5967 | 65.108.0.0/16 Hetzner | ||
5968 | 65.109.0.0/16 Hetzner | ||
5969 | 65.21.0.0/16 Hetzner | ||
5970 | 78.46.0.0/15 Hetzner | ||
5971 | 85.10.192.0/18 Hetzner | ||
5972 | 88.198.0.0/16 Hetzner | ||
5973 | 88.99.0.0/16 Hetzner | ||
5974 | 91.107.128.0/17 Hetzner | ||
5975 | 94.130.0.0/16 Hetzner | ||
5976 | 95.216.0.0/16 Hetzner | ||
5977 | 95.217.0.0/16 Hetzner | ||
5978 | |||
5979 | # Liquid Web | ||
5980 | 159.135.48.0/20 Liquid Web | ||
5981 | 162.212.134.0/24 Liquid Web | ||
5982 | 162.252.104.0/22 Liquid Web | ||
5983 | 172.255.59.0/24 Liquid Web | ||
5984 | 173.199.128.0/18 Liquid Web | ||
5985 | 184.106.55.0/24 Liquid Web | ||
5986 | 192.126.88.0/22 Liquid Web | ||
5987 | 192.133.82.0/24 Liquid Web | ||
5988 | 192.138.16.0/21 Liquid Web | ||
5989 | 192.190.220.0/22 Liquid Web | ||
5990 | 192.251.32.0/24 Liquid Web | ||
5991 | 199.189.224.0/22 Liquid Web | ||
5992 | 199.195.118.0/24 Liquid Web | ||
5993 | 205.174.24.0/22 Liquid Web | ||
5994 | 207.246.248.0/21 Liquid Web | ||
5995 | 208.75.148.0/22 Liquid Web | ||
5996 | 208.79.232.0/21 Liquid Web | ||
5997 | 208.86.152.0/21 Liquid Web | ||
5998 | 209.124.89.0/24 Liquid Web | ||
5999 | 209.188.80.0/20 Liquid Web | ||
6000 | 209.59.128.0/18 Liquid Web | ||
6001 | 50.28.0.0/18 Liquid Web | ||
6002 | 50.28.5.0/24 Liquid Web | ||
6003 | 50.28.64.0/19 Liquid Web | ||
6004 | 50.57.240.0/20 Liquid Web | ||
6005 | 64.50.144.0/20 Liquid Web | ||
6006 | 64.50.144.0/23 Liquid Web | ||
6007 | 64.50.148.0/22 Liquid Web | ||
6008 | 64.50.152.0/21 Liquid Web | ||
6009 | 64.91.224.0/19 Liquid Web | ||
6010 | 67.225.128.0/17 Liquid Web | ||
6011 | 67.227.128.0/17 Liquid Web | ||
6012 | 67.43.0.0/20 Liquid Web | ||
6013 | 68.66.211.0/24 Liquid Web | ||
6014 | 69.160.56.0/24 Liquid Web | ||
6015 | 69.16.192.0/18 Liquid Web | ||
6016 | 69.16.222.0/23 Liquid Web | ||
6017 | 69.167.128.0/18 Liquid Web | ||
6018 | 72.52.128.0/17 Liquid Web | ||
6019 | 96.30.0.0/18 Liquid Web | ||
6020 | |||
6021 | # OVH | ||
6022 | 107.189.64.0/18 OVH | ||
6023 | 135.125.0.0/17 OVH | ||
6024 | 135.125.128.0/17 OVH | ||
6025 | 135.148.0.0/17 OVH | ||
6026 | 135.148.128.0/17 OVH | ||
6027 | 137.74.0.0/16 OVH | ||
6028 | 139.99.0.0/17 OVH | ||
6029 | 139.99.128.0/17 OVH | ||
6030 | 141.94.0.0/16 OVH | ||
6031 | 141.95.0.0/17 OVH | ||
6032 | 141.95.128.0/17 OVH | ||
6033 | 142.4.192.0/19 OVH | ||
6034 | 142.44.128.0/17 OVH | ||
6035 | 144.217.0.0/16 OVH | ||
6036 | 145.239.0.0/16 OVH | ||
6037 | 146.59.0.0/16 OVH | ||
6038 | 146.59.0.0/17 OVH | ||
6039 | 147.135.0.0/17 OVH | ||
6040 | 147.135.128.0/17 OVH | ||
6041 | 148.113.0.0/18 OVH | ||
6042 | 148.113.128.0/17 OVH | ||
6043 | 149.202.0.0/16 OVH | ||
6044 | 149.56.0.0/16 OVH | ||
6045 | 151.80.0.0/16 OVH | ||
6046 | 15.204.0.0/17 OVH | ||
6047 | 15.204.128.0/17 OVH | ||
6048 | 152.228.128.0/17 OVH | ||
6049 | 15.235.0.0/17 OVH | ||
6050 | 15.235.128.0/17 OVH | ||
6051 | 158.69.0.0/16 OVH | ||
6052 | 162.19.0.0/17 OVH | ||
6053 | 162.19.128.0/17 OVH | ||
6054 | 164.132.0.0/16 OVH | ||
6055 | 167.114.0.0/17 OVH | ||
6056 | 167.114.128.0/18 OVH | ||
6057 | 167.114.192.0/19 OVH | ||
6058 | 176.31.0.0/16 OVH | ||
6059 | 178.32.0.0/15 OVH | ||
6060 | 185.15.68.0/22 OVH | ||
6061 | 185.45.160.0/22 OVH | ||
6062 | 188.165.0.0/16 OVH | ||
6063 | 192.240.152.0/21 OVH | ||
6064 | 192.95.0.0/18 OVH | ||
6065 | 192.99.0.0/16 OVH | ||
6066 | 193.70.0.0/17 OVH | ||
6067 | 198.100.144.0/20 OVH | ||
6068 | 198.244.128.0/17 OVH | ||
6069 | 198.245.48.0/20 OVH | ||
6070 | 198.27.64.0/18 OVH | ||
6071 | 198.27.92.0/24 OVH | ||
6072 | 198.50.128.0/17 OVH | ||
6073 | 213.186.32.0/19 OVH | ||
6074 | 213.251.128.0/18 OVH | ||
6075 | 213.32.0.0/17 OVH | ||
6076 | 217.182.0.0/16 OVH | ||
6077 | 23.92.224.0/19 OVH | ||
6078 | 37.187.0.0/16 OVH | ||
6079 | 37.59.0.0/16 OVH | ||
6080 | 40.160.0.0/17 OVH | ||
6081 | 46.105.0.0/16 OVH | ||
6082 | 46.105.198.0/24 OVH | ||
6083 | 46.105.199.0/24 OVH | ||
6084 | 46.105.200.0/24 OVH | ||
6085 | 46.105.201.0/24 OVH | ||
6086 | 46.105.202.0/24 OVH | ||
6087 | 46.105.203.0/24 OVH | ||
6088 | 46.105.204.0/24 OVH | ||
6089 | 46.105.206.0/24 OVH | ||
6090 | 46.105.207.0/24 OVH | ||
6091 | 46.244.32.0/20 OVH | ||
6092 | 51.161.0.0/17 OVH | ||
6093 | 51.161.128.0/17 OVH | ||
6094 | |||
6095 | # Ionos | ||
6096 | 74.208.0.0/16 Ionos | ||
6097 | |||
6098 | # WPEngine | ||
6099 | 141.193.213.0/24 WPEngine | ||
6100 | |||
6101 | # Dreamhost | ||
6102 | 208.113.128.0/17 Dreamhost | ||
6103 | |||
6104 | # Shopify | ||
6105 | 23.227.32.0/19 Shopify | ||
6106 | |||
6107 | # Sucuri | ||
6108 | 66.248.200.0/22 Sucuri | ||
6109 | 185.93.228.0/22 Sucuri | ||
6110 | 192.88.134.0/23 Sucuri | ||
6111 | 192.124.249.0/24 Sucuri | ||
6112 | 192.161.0.0/24 Sucuri | ||
6113 | |||
6114 | # HostGator | ||
6115 | # Bluehost | ||
6116 | # Squarespace | ||
diff --git a/src/lib/syscall.c b/src/lib/syscall.c index ca7c61c8e..602f7218c 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c | |||
@@ -1104,13 +1104,13 @@ static const SyscallGroupList sysgroups[] = { | |||
1104 | #ifdef SYS_pciconfig_write | 1104 | #ifdef SYS_pciconfig_write |
1105 | "pciconfig_write," | 1105 | "pciconfig_write," |
1106 | #endif | 1106 | #endif |
1107 | #ifdef SYS_s390_mmio_read | 1107 | #ifdef SYS_s390_pci_mmio_read |
1108 | "s390_mmio_read," | 1108 | "s390_pci_mmio_read," |
1109 | #endif | 1109 | #endif |
1110 | #ifdef SYS_s390_mmio_write | 1110 | #ifdef SYS_s390_pci_mmio_write |
1111 | "s390_mmio_write" | 1111 | "s390_pci_mmio_write" |
1112 | #endif | 1112 | #endif |
1113 | #if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_mmio_read) && !defined(SYS_s390_mmio_write) | 1113 | #if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_pci_mmio_read) && !defined(SYS_s390_pci_mmio_write) |
1114 | "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed | 1114 | "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed |
1115 | #endif | 1115 | #endif |
1116 | }, | 1116 | }, |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index 19fc94ebd..06969e851 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -788,7 +788,6 @@ $ firejail \-\-list | |||
788 | .br | 788 | .br |
789 | $ firejail \-\-dns.print=3272 | 789 | $ firejail \-\-dns.print=3272 |
790 | 790 | ||
791 | #ifdef HAVE_NETWORK | ||
792 | .TP | 791 | .TP |
793 | \fB\-\-dnstrace[=name|pid] | 792 | \fB\-\-dnstrace[=name|pid] |
794 | Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes | 793 | Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -828,7 +827,6 @@ $ sudo firejail --dnstrace | |||
828 | .br | 827 | .br |
829 | 11:32:08 9.9.9.9 www.youtube.com (type 1) | 828 | 11:32:08 9.9.9.9 www.youtube.com (type 1) |
830 | .br | 829 | .br |
831 | #endif | ||
832 | 830 | ||
833 | .TP | 831 | .TP |
834 | \fB\-\-env=name=value | 832 | \fB\-\-env=name=value |
@@ -930,7 +928,6 @@ $ firejail --ignore=seccomp --ignore=caps firefox | |||
930 | $ firejail \-\-ignore="net eth0" firefox | 928 | $ firejail \-\-ignore="net eth0" firefox |
931 | #endif | 929 | #endif |
932 | 930 | ||
933 | #ifdef HAVE_NETWORK | ||
934 | .TP | 931 | .TP |
935 | \fB\-\-icmptrace[=name|pid] | 932 | \fB\-\-icmptrace[=name|pid] |
936 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | 933 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -956,7 +953,6 @@ $ sudo firejail --icmptrace | |||
956 | .br | 953 | .br |
957 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable | 954 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable |
958 | .br | 955 | .br |
959 | #endif | ||
960 | 956 | ||
961 | .TP | 957 | .TP |
962 | \fB\-\-\include=file.profile | 958 | \fB\-\-\include=file.profile |
@@ -1643,6 +1639,7 @@ PID User RX(KB/s) TX(KB/s) Command | |||
1643 | 1294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox | 1639 | 1294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox |
1644 | .br | 1640 | .br |
1645 | 7383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission | 1641 | 7383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission |
1642 | #endif | ||
1646 | .TP | 1643 | .TP |
1647 | \fB\-\-nettrace[=name|pid] | 1644 | \fB\-\-nettrace[=name|pid] |
1648 | Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | 1645 | Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -1658,17 +1655,15 @@ Example: | |||
1658 | .br | 1655 | .br |
1659 | $ sudo firejail --nettrace | 1656 | $ sudo firejail --nettrace |
1660 | .br | 1657 | .br |
1661 | 95 KB/s geoip 457, IP database 4436 | 1658 | 93 KB/s address:port (protocol) network |
1662 | .br | ||
1663 | 52 KB/s *********** 64.222.84.207:443 United States | ||
1664 | .br | 1659 | .br |
1665 | 33 KB/s ******* 89.147.74.105:63930 Hungary | 1660 | 14 B/s ** 104.24.8.4:443(QUIC) Cloudflare |
1666 | .br | 1661 | .br |
1667 | 0 B/s 45.90.28.0:443 NextDNS | 1662 | 80 KB/s ***************** 192.187.97.90:443(TLS) BitChute |
1668 | .br | 1663 | .br |
1669 | 0 B/s 94.70.122.176:52309(UDP) Greece | 1664 | 1 B/s 149.56.228.45:443(DoH) Canada |
1670 | .br | 1665 | .br |
1671 | 339 B/s 104.26.7.35:443 Cloudflare | 1666 | (D)isplay, (S)ave, (C)lear, e(X)it |
1672 | .br | 1667 | .br |
1673 | 1668 | ||
1674 | .br | 1669 | .br |
@@ -1677,7 +1672,6 @@ the country the traffic originates from is added to the trace. | |||
1677 | We also use the static IP map in /usr/lib/firejail/static-ip-map | 1672 | We also use the static IP map in /usr/lib/firejail/static-ip-map |
1678 | to print the domain names for some of the more common websites and cloud platforms. | 1673 | to print the domain names for some of the more common websites and cloud platforms. |
1679 | No external services are contacted for reverse IP lookup. | 1674 | No external services are contacted for reverse IP lookup. |
1680 | #endif | ||
1681 | .TP | 1675 | .TP |
1682 | \fB\-\-nice=value | 1676 | \fB\-\-nice=value |
1683 | Set nice value for all processes running inside the sandbox. | 1677 | Set nice value for all processes running inside the sandbox. |
@@ -2263,6 +2257,18 @@ All modifications are discarded when the sandbox is closed. | |||
2263 | Example: | 2257 | Example: |
2264 | .br | 2258 | .br |
2265 | $ firejail --private-opt=firefox /opt/firefox/firefox | 2259 | $ firejail --private-opt=firefox /opt/firefox/firefox |
2260 | .br | ||
2261 | |||
2262 | .br | ||
2263 | Note: Program installations in /opt tend to be relatively large and private-opt | ||
2264 | copies the entire path(s) into RAM, which may significantly increase RAM usage | ||
2265 | and break \fBfile-copy-limit\fR in firejail.config. | ||
2266 | Therefore, in general it is recommended to use "whitelist /opt/PATH" instead of | ||
2267 | "private-opt PATH". | ||
2268 | For details, see | ||
2269 | .UR https://github.com/netblue30/firejail/discussions/5307 | ||
2270 | #5307 | ||
2271 | .UE | ||
2266 | 2272 | ||
2267 | .TP | 2273 | .TP |
2268 | \fB\-\-private-srv=file,directory | 2274 | \fB\-\-private-srv=file,directory |
@@ -2850,7 +2856,6 @@ $ firejail \-\-list | |||
2850 | .br | 2856 | .br |
2851 | $ firejail \-\-shutdown=3272 | 2857 | $ firejail \-\-shutdown=3272 |
2852 | 2858 | ||
2853 | #ifdef HAVE_NETWORK | ||
2854 | .TP | 2859 | .TP |
2855 | \fB\-\-snitrace[=name|pid] | 2860 | \fB\-\-snitrace[=name|pid] |
2856 | Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes | 2861 | Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -2892,7 +2897,6 @@ $ sudo firejail --snitrace | |||
2892 | .br | 2897 | .br |
2893 | 07:53:11 192.0.73.2 1.gravatar.com | 2898 | 07:53:11 192.0.73.2 1.gravatar.com |
2894 | .br | 2899 | .br |
2895 | #endif | ||
2896 | 2900 | ||
2897 | .TP | 2901 | .TP |
2898 | \fB\-\-tab | 2902 | \fB\-\-tab |