mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 00:24:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

netlink/ improvements

Browse source 
- Structs fields alignment fixed.
 - Dump more sockets via netlink, in order to display them with the
   SocketsMonitor task (netstat).
 - Fixed serializing netlink data:
d237ee16c3 (diff-f7f6108a60b107adfb0930f5f73a6ae229f9943bb01949d1f8f3e247f869b2abL59-L60)
This commit is contained in:
Gustavo Iñiguez Goia 2025-01-22 00:16:17 +01:00
parent 63a3b4e446
commit d54f8d4777
Failed to generate hash of commit
2 changed files with 20 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
daemon/netlink/socket.go
View file

@ -170,13 +170,18 @@ func KillSockets(fam, proto uint8, excludeLocal bool) error {
} }
for _, sock := range sockListTCP { for _, sock := range sockListTCP {
if sock == nil {
continue
}
if excludeLocal && (isPrivate(sock.ID.Destination) || if excludeLocal && (isPrivate(sock.ID.Destination) ||
sock.ID.Source.IsUnspecified() || sock.ID.Source.IsUnspecified() ||
sock.ID.Destination.IsUnspecified()) { sock.ID.Destination.IsUnspecified()) {
log.Trace("not killing socket: %+v", sock.ID)
continue continue
} }
log.Trace("killing socket: %+v", sock.ID)
if err := SocketKill(fam, proto, sock.ID); err != nil { if err := SocketKill(fam, proto, sock.ID); err != nil {
log.Debug("Unable to kill socket (%+v): %s", sock.ID, err) log.Trace("Unable to kill socket (%+v): %s", sock.ID, err)
} }
} }

30
daemon/netlink/socket_linux.go
View file

@ -41,7 +41,7 @@ const (
TCP_LAST_ACK TCP_LAST_ACK
TCP_LISTEN TCP_LISTEN
TCP_CLOSING TCP_CLOSING
TCP_NEW_SYN_REC TCP_NEW_SYN_RECV
TCP_MAX_STATES TCP_MAX_STATES
) )
@ -63,36 +63,36 @@ var TCPStatesMap = map[uint8]string{
// SocketID holds the socket information of a request/response to the kernel // SocketID holds the socket information of a request/response to the kernel
type SocketID struct { type SocketID struct {
SourcePort uint16
DestinationPort uint16
Source net.IP Source net.IP
Destination net.IP Destination net.IP
Interface uint32
Cookie [2]uint32 Cookie [2]uint32
Interface uint32
SourcePort uint16
DestinationPort uint16
} }
// Socket represents a netlink socket. // Socket represents a netlink socket.
type Socket struct { type Socket struct {
Family uint8
State uint8
Timer uint8
Retrans uint8
ID SocketID ID SocketID
Expires uint32 Expires uint32
RQueue uint32 RQueue uint32
WQueue uint32 WQueue uint32
UID uint32 UID uint32
INode uint32 INode uint32
Family uint8
State uint8
Timer uint8
Retrans uint8
} }
// SocketRequest holds the request/response of a connection to the kernel // SocketRequest holds the request/response of a connection to the kernel
type SocketRequest struct { type SocketRequest struct {
ID SocketID
States uint32
Family uint8 Family uint8
Protocol uint8 Protocol uint8
Ext uint8 Ext uint8
pad uint8 pad uint8
States uint32
ID SocketID
} }
type writeBuffer struct { type writeBuffer struct {
@ -244,7 +244,7 @@ func netlinkRequest(sockReq *SocketRequest, family uint8, proto uint8, srcPort,
if len(msgs) == 0 { if len(msgs) == 0 {
return nil, errors.New("Warning, no message nor error from netlink, or no connections found") return nil, errors.New("Warning, no message nor error from netlink, or no connections found")
} }
var sock []*Socket sock := make([]*Socket, len(msgs))
for n, m := range msgs { for n, m := range msgs {
s := &Socket{} s := &Socket{}
if err = s.deserialize(m); err != nil { if err = s.deserialize(m); err != nil {
@ -254,11 +254,9 @@ func netlinkRequest(sockReq *SocketRequest, family uint8, proto uint8, srcPort,
s.ID.SourcePort, s.ID.Source, s.ID.Destination, s.ID.DestinationPort) s.ID.SourcePort, s.ID.Source, s.ID.Destination, s.ID.DestinationPort)
continue continue
} }
if s.INode == 0 { // INode can be zero for some connections states, like TCP_FIN_WAT, TCP_TIME_WAIT, etc.
continue // so don't exclude those entries, in order to get all sockets.
} sock[n] = s
sock = append([]*Socket{s}, sock...)
} }
return sock, err return sock, err
} }