* How to obtain process ID that created a packet
@ 2005-12-26 16:22 Mikado
2005-12-26 22:36 ` Jan Engelhardt
0 siblings, 1 reply; 6+ messages in thread
From: Mikado @ 2005-12-26 16:22 UTC (permalink / raw)
To: linux-kernel, linux-c-programming
Hi,
Is there any way to catch REAL pid that generated a packet from 'struct sk_buff', 'struct sock',
'struct socket',
'struct file' or etc... ? direct/indirect ways are accepted.
Thank you!
__________________________________
Yahoo! for Good - Make a difference this year.
http://brand.yahoo.com/cybergivingweek2005/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: How to obtain process ID that created a packet
2005-12-26 16:22 How to obtain process ID that created a packet Mikado
@ 2005-12-26 22:36 ` Jan Engelhardt
2005-12-27 1:47 ` Mikado
0 siblings, 1 reply; 6+ messages in thread
From: Jan Engelhardt @ 2005-12-26 22:36 UTC (permalink / raw)
To: Mikado; +Cc: linux-kernel, linux-c-programming
>Hi,
>
>Is there any way to catch REAL pid that generated a packet from 'struct sk_buff', 'struct sock',
>'struct socket',
>'struct file' or etc... ? direct/indirect ways are accepted.
The question is: when do you test for the PID? You would have to do it
within send(), because anywhere else, you do not know. A socket may be
shared among multiple processes (most simple way: fork()).
Jan Engelhardt
--
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: How to obtain process ID that created a packet
2005-12-26 22:36 ` Jan Engelhardt
@ 2005-12-27 1:47 ` Mikado
2005-12-27 8:26 ` Jan Engelhardt
0 siblings, 1 reply; 6+ messages in thread
From: Mikado @ 2005-12-27 1:47 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: linux-kernel, linux-c-programming
> >Hi,
> >
> >Is there any way to catch REAL pid that generated a packet from 'struct sk_buff', 'struct
sock', 'struct socket', 'struct file' or etc... ? direct/indirect ways are accepted.
>
> The question is: when do you test for the PID? You would have to do it
> within send(), because anywhere else, you do not know. A socket may be
> shared among multiple processes (most simple way: fork()).
I'm hooking in NF_IP_LOCAL_OUT of netfilter code using nf_register_hook() function.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: How to obtain process ID that created a packet
2005-12-27 1:47 ` Mikado
@ 2005-12-27 8:26 ` Jan Engelhardt
2005-12-27 10:55 ` Michael Tokarev
0 siblings, 1 reply; 6+ messages in thread
From: Jan Engelhardt @ 2005-12-27 8:26 UTC (permalink / raw)
To: Mikado; +Cc: linux-kernel, linux-c-programming
>> The question is: when do you test for the PID? You would have to do it
>> within send(), because anywhere else, you do not know. A socket may be
>> shared among multiple processes (most simple way: fork()).
>
>I'm hooking in NF_IP_LOCAL_OUT of netfilter code using nf_register_hook() function.
In sys_send(), I would have said you could use "current", but in netfilter
I can't tell exactly whether it is going to work on SMP.
Check net/ipv4/netfilter/ipt_owner.c, it provides a way to match packets vs
pids, but it's not easy to find out.
Jan Engelhardt
--
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: How to obtain process ID that created a packet
2005-12-27 8:26 ` Jan Engelhardt
@ 2005-12-27 10:55 ` Michael Tokarev
2005-12-27 18:03 ` Jan Engelhardt
0 siblings, 1 reply; 6+ messages in thread
From: Michael Tokarev @ 2005-12-27 10:55 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Mikado, linux-kernel, linux-c-programming
Jan Engelhardt wrote:
>>>The question is: when do you test for the PID? You would have to do it
>>>within send(), because anywhere else, you do not know. A socket may be
>>>shared among multiple processes (most simple way: fork()).
>>
>>I'm hooking in NF_IP_LOCAL_OUT of netfilter code using nf_register_hook() function.
>
>
> In sys_send(), I would have said you could use "current", but in netfilter
> I can't tell exactly whether it is going to work on SMP.
>
> Check net/ipv4/netfilter/ipt_owner.c, it provides a way to match packets vs
> pids, but it's not easy to find out.
In current 2.6 kernel, net/ipv4/netfilter/ipt_owner.c:checkentry() :
if (info->match & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
printk("ipt_owner: pid, sid and command matching "
"not supported anymore\n");
return 0;
}
So... even netfilter, breaking backward compatibility, does not support
pid match anymore...
/mjt
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2005-12-27 18:03 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-12-26 16:22 How to obtain process ID that created a packet Mikado
2005-12-26 22:36 ` Jan Engelhardt
2005-12-27 1:47 ` Mikado
2005-12-27 8:26 ` Jan Engelhardt
2005-12-27 10:55 ` Michael Tokarev
2005-12-27 18:03 ` Jan Engelhardt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).