netstat_unix

#!/usr/bin/perl
# netstat_unix
# https://github.com/lemonsqueeze/unix_sockets_peers
#
# Find socket peer from kernel data structures:
#    http://stackoverflow.com/questions/11897662/identify-other-end-of-a-unix-domain-socket-connection
#
# Note: can't use the inode +1/-1 hack:
#   - sometimes it fails, which is fine (can use other method then)
#   - when it succeeds it works most of the time but there are cases where it'll yield wrong socket.
#     -> no way to rely on it.
# 
# So use kernel address from lsof output, and get peer address from kernel with gdb.
# Then parse netstat output and add extra column.
#
# Run find_gdb_offset script to find $struct_unix_sock__peer_offset value.

use File::Temp qw/ tempfile /;
use POSIX;

sub usage
{    
    print "Usage: netstat_unix [--dump]\n";
    print "  Display which processes unix sockets are connected to.\n";
    print "  Output is same as 'netstat -na --unix -p' with an extra column showing peer pid/process name.\n";
    print "\n";
    print "  --dump: just dump mappings. Format is:\n";
    print "          \"name:pid:socket:peer_socket:peer_pid:peer_name\"\n";
    exit 1;
}

($ARGV[0] eq "--help") && usage();
(getuid() != 0) && die "must be root.";
my $want_dump = ($ARGV[0] eq "--dump");

#my $debug = 1;
#my $use_kernel_debug_symbols = 1;	# slooow
#my $show_warnings = 1;			# show failed lookup warnings (debug)

#######################################################################
# Use lsof to map pids/sockets/kernel addresses

my %inode_to_pid;
my %address_to_inode;
my %inode_to_address;

sub init_lsof
{
    my @lsof = split('\n', `lsof -U +c 0  2>/dev/null` || die "couldn't run lsof");
    shift @lsof;		# remove header
    
    # COMMAND    PID       USER   FD   TYPE     DEVICE SIZE/OFF  NODE NAME
    # Xorg       982       root   31u  unix 0xed0b4400      0t0  6820 /tmp/.X11-unix/X0
    foreach my $str (@lsof)
    {
	$str =~ s/  */ /g;
	my ($name, $pid, $z, $z, $z, $address, $z, $inode) = split(' ', $str);
	
	$inode_to_pid{$inode} = $pid;
	$address_to_inode{$address} = $inode;
	$inode_to_address{$inode} = $address;
	if ($debug) { print "inode $inode -> address $address ($pid $name)\n"; }
    }
}

#######################################################################
# Get peer addresses from kernel using gdb

# Slow but sure way, if you have the kernel's debug symbols (vmlinux)
my $vmlinux = "/usr/src/linux/vmlinux";
sub get_addresses_gdb_debug_symbols
{
    foreach my $inode (@_)
    {  
	my $address = $inode_to_address{$inode} || die "$inode: couldn't map inode to address";
	$gdb_cmd .= "p (void*)((struct unix_sock*)$address)->peer\n";	# void* cast to make parsing easier
    }
    my ($fh, $temp_file) = tempfile("/tmp/netstat_unix.XXXXXXXX", UNLINK => 1);
    print $fh $gdb_cmd;   close($fh);
    return split('\n', `gdb $vmlinux /proc/kcore  --batch -x $temp_file 2>/dev/null` || die "couldn't run gdb");
}

# Hack: find the right offset, then you don't need debugging symbols !
# (see find_gdb_offset script)
# This is a lot faster btw.
my $struct_unix_sock__peer_offset=104;
sub get_addresses_gdb_no_symbols
{
    foreach my $inode (@_)
    {  
	my $address = $inode_to_address{$inode} || die "$inode: couldn't map inode to address";
	$gdb_cmd .= "p ((void **)$address)[$struct_unix_sock__peer_offset]\n"; 
    }
    my ($fh, $temp_file) = tempfile("/tmp/netstat_unix.XXXXXXXX", UNLINK => 1);
    print $fh $gdb_cmd;   close($fh);
    return split('\n', `gdb /dev/null /proc/kcore  --batch -x $temp_file 2>/dev/null` || die "couldn't run gdb");
}

my %peer_inodes;	# maps inodes to peer inodes
my %connected_sockets;

# Find all peer addresses using gdb
sub get_peer_inodes
{ 
    my $gdb_cmd="";
    my @inodes = grep($connected_sockets{$_}, keys(%inode_to_address));

    my @gdb = ($use_kernel_debug_symbols ? get_addresses_gdb_debug_symbols(@inodes) :
	                                   get_addresses_gdb_no_symbols(@inodes) );

    my $i = -1;
    foreach my $str (@gdb)
    {
	if ($str =~ m|\(void \*\) (0x[0-9a-f]*)|)	# $1 = (void *) 0xed289000
	{
	    $i++;
	    my $peer_address = $1;
	    my $peer_inode = $address_to_inode{$peer_address};
	    if (!$peer_inode)
	    {   $show_warnings && warn "$peer_address: couldn't map address to inode";  next;    }
	    $peer_inodes{$inodes[$i]} = $peer_inode;
	    if ($debug)
	    {
		my $inode = $inodes[$i];   my $address = $inode_to_address{$inode};
		print "[ inode $inode -> kernel $address ] --> [ kernel $peer_address -> inode $peer_inode ]\n"; 
	    }
	}
    }
}


#######################################################################

# keep stats
my $total_requests = 0;
my $successful_requests = 0;

sub find_peer_pid
{
    my ($inode) = @_;    $total_requests++;
    $inode_to_pid{$inode} || die("$inode: No process owns this socket. bad number ?\n");
    
    my $peer_inode = $peer_inodes{$inode};
    if (!$peer_inode)
    { $show_warnings && warn "$inode: couldn't find peer inode.";  return ""; }    

    my $pp_inode   = $peer_inodes{$peer_inode};	# double check reverse path
    ($pp_inode == $inode) || die "inode $inode: peer's peer != original !";
    my $peer_pid = $inode_to_pid{$peer_inode} || die "couldn't map inode to pid, shouldn't happen.";
    $successful_requests++;   return $peer_pid;
}


#######################################################################

# insert new column $str in $line at position $pos
sub insert_column
{
    my ($line, $str, $pos) = @_;
    return sprintf("%s %-25s %s\n", substr($line, 0, $pos), $str, substr($line, $pos));
}

my %pid_to_name;
my @netstat;

# Use netstat output to resolve process names, lsof reports them differently.
#
# Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
# unix  3      [ ]         STREAM     CONNECTED     4229     839/avahi-daemon: r
sub init_netstat
{
    @netstat = split('\n', `netstat -na --unix -p` || die "couldn't run netstat");
    
    foreach my $str (@netstat)
    {
	next if (!($str =~ m/ CONNECTED /));

	my $tmp = $str;   $tmp =~ s/  */ /g;
	my ($z, $z, $z, $z, $z, $z, $inode, $pn) = split(' ', $tmp);
	my ($pid, $name) = split('/', $pn);
	$pid_to_name{$pid} = $name;
	$connected_sockets{$inode} = 1;		# can't know from lsof output
    }
}


# Add extra column to netstat output
sub format_netstat
{
    # add column before "Path"
    my $header = $netstat[1];
    my $pos = index($header, "Path");
    ($pos != -1) || die("error parsing netstat header.");

    foreach my $str (@netstat)
    {
	if ($str eq $header) 
	{  $str = insert_column($str, "Peer PID/Program name", $pos);  next;   }
	if (!($str =~ m/ CONNECTED /))
	{  $str = insert_column($str, "", $pos);  next;   }

	my $tmp = $str;   $tmp =~ s/  */ /g;
	my ($z, $z, $z, $z, $z, $z, $inode) = split(' ', $tmp);
	
	my $pid = find_peer_pid($inode);
	my $name = $pid_to_name{$pid};
	my $extra = "$pid/$name";
	if (!$pid)
	{   $show_warnings && warn "couldn't find peer pid for socket $inode.";  $extra = "";	}
	$str = insert_column($str, $extra, $pos);
    }
}


#######################################################################
# dump

my @dump_output;
sub dump_map
{
    foreach my $inode (grep($connected_sockets{$_}, keys(%inode_to_address)))
    {
	my $pid = $inode_to_pid{$inode};
	my $name = $pid_to_name{$pid};   $name =~ s|:||g;
	my $peer_pid = find_peer_pid($inode) || next;
	my $peer_inode = $peer_inodes{$inode};
	my $peer_name = $pid_to_name{$peer_pid};  $peer_name =~ s|:||g;
	push(@dump_output, "$name:$pid:$inode:$peer_inode:$peer_pid:$peer_name\n");
    }
}

#######################################################################

init_lsof();
init_netstat();
get_peer_inodes();
($want_dump ? dump_map() : format_netstat());

if ($successful_requests / $total_requests < 0.9)	# more than 10% failed ?
{  die "Looks like hardcoded gdb offset is wrong, run find_gdb_offset and fix it !";  }

print ($want_dump ? @dump_output : @netstat);

if ($successful_requests != $total_requests)
{  warn sprintf("Warning: couldn't map %s sockets.\n", $total_requests - $successful_requests);  }