add execsnoop in c++

src/CMakeLists.txt

@@ -7,7 +7,7 @@ add_executable(main main.cpp
                     common.cpp config.cpp cgroup_attach.cpp 
                     socket_client.cpp socket_server.cpp)
  
-target_link_libraries(main nlohmann_json::nlohmann_json Threads::Threads)
+target_link_libraries(main nlohmann_json::nlohmann_json Threads::Threads bcc)
 set_target_properties(main PROPERTIES LINKER_LANGUAGE CXX)
 set_target_properties(main PROPERTIES OUTPUT_NAME cgproxy)
 

src/cgproxyd.hpp

@@ -4,10 +4,14 @@
 #include "cgroup_attach.h"
 #include "common.h"
 #include "config.h"
+#include "execsnoop.hpp"
 #include "socket_server.h"
+#include <algorithm>
 #include <csignal>
+#include <cstdlib>
 #include <fstream>
 #include <nlohmann/json.hpp>
+#include <pthread.h>
 #include <sched.h>
 #include <sys/file.h>
 #include <unistd.h>
@@ -17,17 +21,22 @@ using json = nlohmann::json;
 using namespace ::CGPROXY::SOCKET;
 using namespace ::CGPROXY::CONFIG;
 using namespace ::CGPROXY::CGROUP;
+using namespace ::CGPROXY::EXESNOOP;
 
 namespace CGPROXY::CGPROXYD {
 
 bool print_help = false;
+bool enable_socketserver = true;
 bool enable_execsnoop = false;
 
 class cgproxyd {
-  thread_arg arg_t;
-  Config config;
+  SOCKET::thread_arg socketserver_thread_arg;
   pthread_t socket_thread_id = -1;
-  pid_t exec_snoop_pid = -1;
+
+  EXESNOOP::thread_arg execsnoop_thread_arg;
+  pthread_t execsnoop_thread_id = -1;
+
+  Config config;
 
   static cgproxyd *instance;
   static int handle_msg_static(char *msg) {
@@ -38,6 +47,40 @@ class cgproxyd {
     return instance->handle_msg(msg);
   }
 
+  static int handle_pid_static(int pid) {
+    if (!instance) {
+      error("no cgproxyd instance assigned");
+      return ERROR;
+    }
+    return instance->handle_pid(pid);
+  }
+
+  int handle_pid(int pid) {
+    auto path=realpath(to_str("/proc/",pid,"/exe").c_str(), NULL);
+    if (path==NULL) {
+      debug("pid %d live life too short", pid);
+      return 0;
+    }
+    debug("execsnoop: %d %s", pid, path);
+
+    vector<string> v;
+
+    v = config.program_noproxy;
+    if (find(v.begin(), v.end(), path) != v.end()) {
+      info("exesnoop noproxy: %d %s", pid, path);
+      free(path);
+      return attach(pid, config.cgroup_noproxy_preserved);
+    }
+    v = config.program_proxy;
+    if (find(v.begin(), v.end(), path) != v.end()) {
+      info("exesnoop proxied: %d %s", pid, path);
+      free(path);
+      return attach(pid, config.cgroup_proxy_preserved);
+    }
+    free(path);
+    return 0;
+  }
+
   static void signalHandler(int signum) {
     debug("Signal %d received.", signum);
     if (!instance) {
@@ -85,12 +128,12 @@ class cgproxyd {
       switch (type) {
       case MSG_TYPE_CONFIG_JSON:
         status = config.loadFromJsonStr(j.at("data").dump());
-        if (status == SUCCESS) status = applyConfig(&config);
+        if (status == SUCCESS) status = applyConfig();
         return status;
         break;
       case MSG_TYPE_CONFIG_PATH:
         status = config.loadFromFile(j.at("data").get<string>());
-        if (status == SUCCESS) status = applyConfig(&config);
+        if (status == SUCCESS) status = applyConfig();
         return status;
         break;
       case MSG_TYPE_PROXY_PID:
@@ -111,27 +154,35 @@ class cgproxyd {
   }
 
   pthread_t startSocketListeningThread() {
-    arg_t.handle_msg = &handle_msg_static;
+    socketserver_thread_arg.handle_msg = &handle_msg_static;
     pthread_t thread_id;
-    int status = pthread_create(&thread_id, NULL, &SocketServer::startThread, &arg_t);
+    int status =
+        pthread_create(&thread_id, NULL, &SOCKET::startThread, &socketserver_thread_arg);
     if (status != 0) error("socket thread create failed");
     return thread_id;
   }
 
-  void startExecSnoopProc() {
-    if (exec_snoop_pid != -1){ 
-      kill(exec_snoop_pid, SIGINT);
-      exec_snoop_pid=-1;
-    }
-    pid_t pid = fork();
-    if (pid == 0) {
-      execl(BPF_EXEC_SNOOP_START, (char *) NULL);
-      exit(0);
-    } else if (pid<0){
-      error("fork precess failed");
-    }else {
-      exec_snoop_pid = pid;
-    }
+  pthread_t startExecSnoopThread() {
+    execsnoop_thread_arg.handle_pid = &handle_pid_static;
+    pthread_t thread_id;
+    int status =
+        pthread_create(&thread_id, NULL, &EXESNOOP::startThread, &execsnoop_thread_arg);
+    if (status != 0) error("execsnoop thread create failed");
+    return thread_id;
+  }
+
+  void processRunningProgram(){
+    debug("process running program")
+    for (auto &path:config.program_noproxy)
+      for (auto &pid:bash_pidof(path)){
+        int status=attach(pid, config.cgroup_noproxy_preserved);
+        if (status==0) info("noproxy running process %d %s",pid, path.c_str());
+      }
+    for (auto &path:config.program_proxy)
+      for (auto &pid:bash_pidof(path)){
+        int status=attach(pid, config.cgroup_proxy_preserved);
+        if (status==0) info("proxied running process %d %s",pid, path.c_str());
+      }
   }
 
   void assignStaticInstance() { instance = this; }
@@ -143,19 +194,26 @@ public:
     signal(SIGTERM, &signalHandler);
     signal(SIGHUP, &signalHandler);
 
-    config.loadFromFile(DEFAULT_CONFIG_FILE);
-    applyConfig(&config);
-
     assignStaticInstance();
-    socket_thread_id = startSocketListeningThread();
+
+    config.loadFromFile(DEFAULT_CONFIG_FILE);
+    applyConfig();
+    processRunningProgram();
+
+    if (enable_socketserver) { socket_thread_id = startSocketListeningThread(); }
+    if (enable_execsnoop) { execsnoop_thread_id = startExecSnoopThread(); }
+
+    cout<<flush;
+    
     pthread_join(socket_thread_id, NULL);
+    pthread_join(execsnoop_thread_id, NULL);
     return 0;
   }
-  int applyConfig(Config *c) {
+  int applyConfig() {
     system(TPROXY_IPTABLS_CLEAN);
-    c->toEnv();
+    config.print_summary();
+    config.toEnv();
     system(TPROXY_IPTABLS_START);
-    if (enable_execsnoop) startExecSnoopProc();
     // no need to track running status
     return 0;
   }

src/cgroup_attach.cpp

@@ -13,48 +13,46 @@
 
 namespace CGPROXY::CGROUP {
 
+string cgroup2_mount_point = get_cgroup2_mount_point();
+
 bool exist(string path) {
   struct stat st;
   if (stat(path.c_str(), &st) != -1) { return S_ISDIR(st.st_mode); }
   return false;
 }
 
+string get_cgroup2_mount_point() {
+  stringstream buffer;
+  FILE *fp = popen("findmnt -t cgroup2 -n -o TARGET", "r");
+  if (!fp) return "";
+  char buf[64]; while (fgets(buf,64,fp)!=NULL) { buffer<<buf; }
+  pclose(fp);
+  string s=buffer.str();
+  s.pop_back(); // remove newline character
+  return s;
+}
+
 bool validate(string pid, string cgroup) {
   bool pid_v = validPid(pid);
   bool cg_v = validCgroup(cgroup);
   if (pid_v && cg_v) return true;
 
   error("attach paramater validate error");
-  return_error
-}
-
-string get_cgroup2_mount_point(int &status) {
-  char cgroup2_mount_point[100] = "";
-  FILE *fp = popen("findmnt -t cgroup2 -n -o TARGET", "r");
-  int count = fscanf(fp, "%s", cgroup2_mount_point);
-  fclose(fp);
-  if (count == 0) {
-    error("cgroup2 not supported");
-    status = -1;
-    return NULL;
-  }
-  status = 0;
-  return cgroup2_mount_point;
+  return_error;
 }
 
 int attach(const string pid, const string cgroup_target) {
   if (getuid() != 0) {
     error("need root to attach cgroup");
-    return_error
+    return_error;
   }
 
   debug("attaching %s to %s", pid.c_str(), cgroup_target.c_str());
 
   int status;
-  if (!validate(pid, cgroup_target))
-    return_error string cgroup_mount_point = get_cgroup2_mount_point(status);
-  if (status != 0)
-    return_error string cgroup_target_path = cgroup_mount_point + cgroup_target;
+  if (!validate(pid, cgroup_target)) return_error;
+  if (cgroup2_mount_point.empty()) return_error;
+  string cgroup_target_path = cgroup2_mount_point + cgroup_target;
   string cgroup_target_procs = cgroup_target_path + "/cgroup.procs";
 
   // check if exist, we will create it if not exist
@@ -64,7 +62,7 @@ int attach(const string pid, const string cgroup_target) {
       debug("created cgroup %s success", cgroup_target.c_str());
     } else {
       error("created cgroup %s failed, errno %d", cgroup_target.c_str(), errno);
-      return_error
+      return_error;
     }
     // error("cgroup %s not exist",cgroup_target.c_str());
     // return_error
@@ -74,7 +72,7 @@ int attach(const string pid, const string cgroup_target) {
   ofstream procs(cgroup_target_procs, ofstream::app);
   if (!procs.is_open()) {
     error("open file %s failed", cgroup_target_procs.c_str());
-    return_error
+    return_error;
   }
   procs << pid.c_str() << endl;
   procs.close();
@@ -83,9 +81,9 @@ int attach(const string pid, const string cgroup_target) {
   if (!procs) {
     error("write %s to %s failed, maybe process %s not exist", pid.c_str(),
           cgroup_target_procs.c_str(), pid.c_str());
-    return_error
+    return_error;
   }
-  return_success
+  return_success;
 }
 
 int attach(const int pid, const string cgroup_target) {

src/cgroup_attach.h

@@ -6,10 +6,10 @@
 using namespace std;
 
 namespace CGPROXY::CGROUP {
-
+extern string cgroup2_mount_point;
 bool exist(string path);
 bool validate(string pid, string cgroup);
-string get_cgroup2_mount_point(int &status);
+string get_cgroup2_mount_point();
 int attach(const string pid, const string cgroup_target);
 int attach(const int pid, const string cgroup_target);
 

src/common.cpp

@@ -1,7 +1,13 @@
 #include "common.h"
+#include <fstream>
+#include <linux/limits.h>
 #include <regex>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <limits.h>
 
 bool enable_debug = false;
+bool enable_info = true;
 
 string join2str(const vector<string> t, const char delm) {
   string s;
@@ -32,3 +38,55 @@ bool validCgroup(const vector<string> cgroup) {
 bool validPid(const string pid) { return regex_match(pid, regex("^[0-9]+$")); }
 
 bool validPort(const int port) { return port > 0; }
+
+bool fileExist(const string &path) {
+  struct stat st;
+  return (stat(path.c_str(), &st) == 0 && S_ISREG(st.st_mode));
+}
+
+bool dirExist(const string &path) {
+  struct stat st;
+  return (stat(path.c_str(), &st) == 0 && S_ISDIR(st.st_mode));
+}
+
+vector<int> bash_pidof(const string &path){
+  vector<int> pids;
+  FILE *fp = popen(to_str("pidof ", path).c_str(), "r");
+  if (!fp) return pids;
+  int pid;
+  char buf[64]; while (fscanf(fp,"%d",&pid)!=EOF) { pids.push_back(pid); }
+  pclose(fp);
+  return pids;
+}
+
+string bash_which(const string &name) {
+  stringstream buffer;
+  FILE *fp = popen(to_str("which ", name).c_str(), "r");
+  if (!fp) return "";
+  char buf[64]; while (fgets(buf,64,fp)!=NULL) { buffer<<buf; }
+  pclose(fp);
+  string s=buffer.str();
+  s.pop_back(); // remove newline character
+  return s;
+}
+
+string bash_readlink(const string &path) {
+  stringstream buffer;
+  FILE *fp = popen(to_str("readlink -e ", path).c_str(), "r");
+  if (!fp) return "";
+  char buf[64]; while (fgets(buf,64,fp)!=NULL) { buffer<<buf; }
+  pclose(fp);
+  string s=buffer.str();
+  s.pop_back(); // remove newline character
+  return s;
+}
+
+string getRealExistPath(const string &name) {
+  if (name[0] == '/' && fileExist(name)) return name;
+  string path;
+  path = bash_which(name);
+  if (path.empty()) return "";
+  path = bash_readlink(path);
+  if (!fileExist(path)) return "";
+  return path;
+}

src/common.h

@@ -9,7 +9,6 @@ using namespace std;
 
 #define TPROXY_IPTABLS_START "/usr/share/cgproxy/scripts/cgroup-tproxy.sh"
 #define TPROXY_IPTABLS_CLEAN "/usr/share/cgproxy/scripts/cgroup-tproxy.sh stop"
-#define BPF_EXEC_SNOOP_START "/usr/share/cgproxy/scripts/execsnoop.py"
 
 #define PID_LOCK_FILE "/var/run/cgproxyd.pid"
 #define SOCKET_PATH "/tmp/cgproxy_unix_socket"
@@ -36,6 +35,7 @@ using namespace std;
 #define FILE_ERROR 7
 
 extern bool enable_debug;
+extern bool enable_info;
 
 #define error(...)                                                                       \
   {                                                                                      \
@@ -46,13 +46,20 @@ extern bool enable_debug;
 
 #define debug(...)                                                                       \
   if (enable_debug) {                                                                    \
-    fprintf(stderr, "debug: ");                                                          \
+    fprintf(stdout, "debug: ");                                                          \
     fprintf(stdout, __VA_ARGS__);                                                        \
     fprintf(stdout, "\n");                                                               \
   }
 
-#define return_error return -1;
-#define return_success return 0;
+#define info(...)                                                                        \
+  if (enable_info) {                                                                     \
+    fprintf(stdout, "info: ");                                                           \
+    fprintf(stdout, __VA_ARGS__);                                                        \
+    fprintf(stdout, "\n");                                                               \
+  }
+
+#define return_error return -1
+#define return_success return 0
 
 template <typename... T> string to_str(T... args) {
   stringstream ss;
@@ -70,4 +77,11 @@ bool validCgroup(const vector<string> cgroup);
 bool validPid(const string pid);
 bool validPort(const int port);
 
+bool fileExist(const string &path);
+bool dirExist(const string &path);
+vector<int> bash_pidof(const string &path);
+string bash_which(const string &name);
+string bash_readlink(const string &path);
+string getRealExistPath(const string &name);
+
 #endif

src/config.cpp

@@ -4,6 +4,7 @@
 #include <iomanip>
 #include <nlohmann/json.hpp>
 #include <set>
+#include <vector>
 using json = nlohmann::json;
 
 #define add2json(v) j[#v] = v;
@@ -89,6 +90,11 @@ int Config::loadFromJsonStr(const string js) {
   tryassign(enable_udp);
   tryassign(enable_ipv4);
   tryassign(enable_ipv6);
+
+  // e.g. v2ray -> /usr/bin/v2ray -> /usr/lib/v2ray/v2ray
+  toRealProgramPath(program_noproxy);
+  toRealProgramPath(program_proxy);
+
   return 0;
 }
 
@@ -127,4 +133,21 @@ bool Config::validateJsonStr(const string js) {
   return true;
 }
 
+void Config::print_summary() {
+  info("noproxy program: %s", join2str(program_noproxy).c_str());
+  info("proxied program: %s", join2str(program_proxy).c_str());
+  info("noproxy cgroup: %s", join2str(cgroup_noproxy).c_str());
+  info("proxied cgroup: %s", join2str(cgroup_proxy).c_str());
+}
+
+void Config::toRealProgramPath(vector<string> &v) {
+  vector<string> tmp;
+  for (auto &p : v) {
+    auto rpath = getRealExistPath(p);
+    if (!rpath.empty()) tmp.push_back(rpath);
+    else error("%s not exist or broken link", p.c_str());
+  }
+  v=tmp;
+}
+
 } // namespace CGPROXY::CONFIG

src/config.h

@@ -30,10 +30,12 @@ public:
   string toJsonStr();
   int loadFromFile(const string f);
   int loadFromJsonStr(const string js);
+  void print_summary();
 
 private:
   void mergeReserved();
   bool validateJsonStr(const string js);
+  void toRealProgramPath(vector<string> &v);
 };
 
 } // namespace CGPROXY::CONFIG

src/execsnoop.hpp

@@ -0,0 +1,111 @@
+#ifndef EXECSNOOP_HPP
+#define EXECSNOOP_HPP 1
+
+#include <exception>
+#include "bcc/BPF.h"
+#include "common.h"
+#include <bcc/libbpf.h>
+#include <fstream>
+#include <functional>
+#include <iostream>
+#include <string>
+#include <unistd.h>
+using namespace std;
+
+namespace CGPROXY::EXESNOOP {
+
+const string BPF_PROGRAM = R"(
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <uapi/linux/ptrace.h>
+
+struct data_t {
+    int pid;
+};
+
+BPF_PERF_OUTPUT(events);
+
+int syscall_execve(struct pt_regs *ctx,
+    const char __user *filename,
+    const char __user *const __user *__argv,
+    const char __user *const __user *__envp)
+{
+    struct data_t data = {};
+    data.pid = bpf_get_current_pid_tgid();
+    events.perf_submit(ctx, &data, sizeof(struct data_t));
+    return 0;
+}
+
+int ret_syscall_execve(struct pt_regs *ctx){
+    struct data_t data = {};
+    data.pid = bpf_get_current_pid_tgid();
+    int retval = PT_REGS_RC(ctx);
+    if (retval==0)
+      events.perf_submit(ctx, &data, sizeof(struct data_t));
+    return 0;
+}
+)";
+
+struct data_t {
+  int pid;
+};
+
+function<int(int)> callback = NULL;
+
+void handle_events(void *cb_cookie, void *data, int data_size) {
+  auto event = static_cast<data_t *>(data);
+  int pid = event->pid;
+
+  if (callback) callback(pid);
+}
+
+int execsnoop() {
+  debug("starting execsnoop");
+  ebpf::BPF bpf;
+  auto init_res = bpf.init(BPF_PROGRAM);
+  if (init_res.code() != 0) {
+    std::cerr << init_res.msg() << std::endl;
+    return 1;
+  }
+
+  string execve_fnname = bpf.get_syscall_fnname("execve");
+  // auto attach_res = bpf.attach_kprobe(execve_fnname, "syscall_execve");
+  auto attach_res =
+      bpf.attach_kprobe(execve_fnname, "ret_syscall_execve", 0, BPF_PROBE_RETURN);
+  if (attach_res.code() != 0) {
+    std::cerr << attach_res.msg() << std::endl;
+    return 1;
+  }
+
+  auto open_res = bpf.open_perf_buffer("events", &handle_events);
+  if (open_res.code() != 0) {
+    std::cerr << open_res.msg() << std::endl;
+    return 1;
+  }
+
+  if (bpf.free_bcc_memory()) {
+    std::cerr << "Failed to free llvm/clang memory" << std::endl;
+    return 1;
+  }
+
+  while (true) bpf.poll_perf_buffer("events");
+
+  return 0;
+}
+
+struct thread_arg {
+  function<int(int)> handle_pid;
+};
+
+void *startThread(void *arg) {
+  thread_arg *p = (thread_arg *)arg;
+  callback = p->handle_pid;
+  try {
+    execsnoop();
+  } catch (exception &e) {
+    error("bcc may not be installed, %s",e.what());
+  }
+  return (void *)0;
+}
+} // namespace CGPROXY::EXESNOOP
+#endif

src/socket_server.cpp

@@ -49,7 +49,7 @@ void SocketServer::socketListening(function<int(char *)> callback) {
   }
 }
 
-void *SocketServer::startThread(void *arg) {
+void *startThread(void *arg) {
   thread_arg *p = (thread_arg *)arg;
   SocketServer server;
   server.socketListening(p->handle_msg);

src/socket_server.h

@@ -17,6 +17,7 @@ namespace CGPROXY::SOCKET {
 struct thread_arg {
   function<int(char *)> handle_msg;
 };
+void *startThread(void *arg);
 
 class SocketServer {
 public:
@@ -25,7 +26,6 @@ public:
 
   void socketListening(function<int(char *)> callback);
   ~SocketServer();
-  static void *startThread(void *arg);
 };
 
 } // namespace CGPROXY::SOCKET