[PATCH 0/2] connector: Add proc_events for connect/accept

[PATCH 0/2] connector: Add proc_events for connect/accept

[Joe Damato]

Hi -

It would be extremely useful to have a simple way of mapping pids to network
connections without having to create piles of inotify watches in /proc/ and
/proc/<pid>/fd/ and then search for corresponding inode numbers in
/proc/net/{tcp, udp, ... }.

I've added two simple connector events so that monitoring processes using
connector can get a notification of successful calls to connect/accept. This
allows a monitoring process to be aware of network connections without having
to jump through the inotify+proc parsing hoops.

Thanks,
Joe

Joe Damato (2):
  Create a new connector proc_event for successful calls to connect.
  Create a new connector proc_event for successful calls to accept.

 drivers/connector/cn_proc.c |   70 +++++++++++++++++++++++++++++++++++++++++++
 include/linux/cn_proc.h     |   39 +++++++++++++++++++++++-
 net/socket.c                |    9 +++++
 3 files changed, 117 insertions(+), 1 deletions(-)

-- 
1.7.4.1

[PATCH 1/2] Create a new connector proc_event for successful calls to connect.

[Joe Damato]

Signed-off-by: Joe Damato <joe@boundary.com>
---
 drivers/connector/cn_proc.c |   34 ++++++++++++++++++++++++++++++++++
 include/linux/cn_proc.h     |   22 +++++++++++++++++++++-
 net/socket.c                |    6 ++++++
 3 files changed, 61 insertions(+), 1 deletions(-)

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 3ee1fdb..3e88d07 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -51,6 +51,40 @@ static inline void get_seq(__u32 *ts, int *cpu)
 	preempt_enable();
 }
 
+void proc_connect_connector(struct task_struct *task, struct socket *sock,
+			    struct sockaddr *addr, int addrlen)
+{
+	struct cn_msg *msg;
+	struct proc_event *ev;
+	__u8 buffer[CN_PROC_MSG_SIZE];
+	struct timespec ts;
+
+	if (atomic_read(&proc_event_num_listeners) < 1)
+		return;
+
+	msg = (struct cn_msg*)buffer;
+	ev = (struct proc_event*)msg->data;
+	get_seq(&msg->seq, &ev->cpu);
+	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+	ev->what = PROC_EVENT_CONNECT;
+	ev->event_data.connect.process_pid = task->pid;
+	ev->event_data.connect.process_tgid = task->tgid;
+	ev->event_data.connect.protocol = sock->sk->sk_protocol;
+	ev->event_data.connect.address_len = addrlen;
+	memcpy(&ev->event_data.connect.address, addr, addrlen);
+
+	ev->event_data.connect.local_address_len = sizeof(struct __kernel_sockaddr_storage);
+	kernel_getsockname(sock, (struct sockaddr *) &ev->event_data.connect.local_address,
+			  &ev->event_data.connect.local_address_len);
+
+	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
+	msg->ack = 0; /* not used */
+	msg->len = sizeof(*ev);
+	/*  If cn_netlink_send() failed, the data is not sent */
+	cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
+}
+
 void proc_fork_connector(struct task_struct *task)
 {
 	struct cn_msg *msg;
diff --git a/include/linux/cn_proc.h b/include/linux/cn_proc.h
index 12c517b..a49ed22 100644
--- a/include/linux/cn_proc.h
+++ b/include/linux/cn_proc.h
@@ -19,6 +19,7 @@
 #define CN_PROC_H
 
 #include <linux/types.h>
+#include <linux/socket.h>
 
 /*
  * Userspace sends this enum to register with the kernel that it is listening
@@ -54,7 +55,8 @@ struct proc_event {
 		PROC_EVENT_GID  = 0x00000040,
 		PROC_EVENT_SID  = 0x00000080,
 		PROC_EVENT_PTRACE = 0x00000100,
-		/* "next" should be 0x00000400 */
+		PROC_EVENT_CONNECT = 0x00000400,  
+		/* "next" should be 0x00000800 */
 		/* "last" is the last process event: exit */
 		PROC_EVENT_EXIT = 0x80000000
 	} what;
@@ -78,6 +80,16 @@ struct proc_event {
 			__kernel_pid_t process_tgid;
 		} exec;
 
+		struct connect_proc_event {
+			__kernel_pid_t process_pid;
+			__kernel_pid_t process_tgid;
+			struct __kernel_sockaddr_storage address;
+			int address_len;
+			struct __kernel_sockaddr_storage local_address;
+			int local_address_len;
+			int protocol;
+		} connect;
+
 		struct id_proc_event {
 			__kernel_pid_t process_pid;
 			__kernel_pid_t process_tgid;
@@ -119,6 +131,8 @@ void proc_id_connector(struct task_struct *task, int which_id);
 void proc_sid_connector(struct task_struct *task);
 void proc_ptrace_connector(struct task_struct *task, int which_id);
 void proc_exit_connector(struct task_struct *task);
+void proc_connect_connector(struct task_struct *task, struct socket *sock,
+			    struct sockaddr *addr, int addrlen);
 #else
 static inline void proc_fork_connector(struct task_struct *task)
 {}
@@ -139,6 +153,12 @@ static inline void proc_ptrace_connector(struct task_struct *task,
 
 static inline void proc_exit_connector(struct task_struct *task)
 {}
+
+static inline void proc_connect_connector(struct task_struct *task,
+					  struct socket *sock,
+					  struct sockaddr *addr, int addrlen)
+{}
+
 #endif	/* CONFIG_PROC_EVENTS */
 #endif	/* __KERNEL__ */
 #endif	/* CN_PROC_H */
diff --git a/net/socket.c b/net/socket.c
index b1cbbcd..b4f9a6c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -88,6 +88,8 @@
 #include <linux/nsproxy.h>
 #include <linux/magic.h>
 #include <linux/slab.h>
+#include <linux/connector.h>
+#include <linux/cn_proc.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -1596,6 +1598,10 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
 
 	err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
 				 sock->file->f_flags);
+
+	if (err == 0)
+	  proc_connect_connector(current, sock, (struct sockaddr *)&address, addrlen);
+
 out_put:
 	fput_light(sock->file, fput_needed);
 out:
-- 
1.7.4.1

[PATCH 2/2] Create a new connector proc_event for successful calls to accept.

[Joe Damato]

Signed-off-by: Joe Damato <joe@boundary.com>
---
 drivers/connector/cn_proc.c |   36 ++++++++++++++++++++++++++++++++++++
 include/linux/cn_proc.h     |   19 ++++++++++++++++++-
 net/socket.c                |    3 +++
 3 files changed, 57 insertions(+), 1 deletions(-)

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 3e88d07..1106014 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -85,6 +85,42 @@ void proc_connect_connector(struct task_struct *task, struct socket *sock,
 	cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
+void proc_accept_connector(struct task_struct *task, struct socket *sock,
+			   struct sockaddr *addr, int addrlen)
+{
+	struct cn_msg *msg;
+	struct proc_event *ev;
+	__u8 buffer[CN_PROC_MSG_SIZE];
+	struct timespec ts;
+
+	if (atomic_read(&proc_event_num_listeners) < 1)
+		return;
+
+	msg = (struct cn_msg*)buffer;
+	ev = (struct proc_event*)msg->data;
+	get_seq(&msg->seq, &ev->cpu);
+	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+	ev->what = PROC_EVENT_ACCEPT;
+	ev->event_data.accept.process_pid = task->pid;
+	ev->event_data.accept.process_tgid = task->tgid;
+	ev->event_data.accept.protocol = sock->sk->sk_protocol;
+	ev->event_data.accept.address_len = addrlen;
+	memcpy(&ev->event_data.accept.address, addr, addrlen);
+
+	ev->event_data.accept.local_address_len = sizeof(struct __kernel_sockaddr_storage);
+	kernel_getsockname(sock, (struct sockaddr *) &ev->event_data.accept.local_address,
+			  &ev->event_data.accept.local_address_len);
+
+	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
+	msg->ack = 0; /* not used */
+	msg->len = sizeof(*ev);
+	/*  If cn_netlink_send() failed, the data is not sent */
+	cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
+
+	return;
+}
+
 void proc_fork_connector(struct task_struct *task)
 {
 	struct cn_msg *msg;
diff --git a/include/linux/cn_proc.h b/include/linux/cn_proc.h
index a49ed22..d68a3de 100644
--- a/include/linux/cn_proc.h
+++ b/include/linux/cn_proc.h
@@ -56,7 +56,8 @@ struct proc_event {
 		PROC_EVENT_SID  = 0x00000080,
 		PROC_EVENT_PTRACE = 0x00000100,
 		PROC_EVENT_CONNECT = 0x00000400,  
-		/* "next" should be 0x00000800 */
+		PROC_EVENT_ACCEPT = 0x00000800,  
+		/* "next" should be 0x00001000 */
 		/* "last" is the last process event: exit */
 		PROC_EVENT_EXIT = 0x80000000
 	} what;
@@ -90,6 +91,16 @@ struct proc_event {
 			int protocol;
 		} connect;
 
+		struct accept_proc_event {
+			__kernel_pid_t process_pid;
+			__kernel_pid_t process_tgid;
+			struct sockaddr_storage address;
+			int address_len;
+			struct __kernel_sockaddr_storage local_address;
+			int local_address_len;
+			int protocol;
+		} accept;
+
 		struct id_proc_event {
 			__kernel_pid_t process_pid;
 			__kernel_pid_t process_tgid;
@@ -133,6 +144,8 @@ void proc_ptrace_connector(struct task_struct *task, int which_id);
 void proc_exit_connector(struct task_struct *task);
 void proc_connect_connector(struct task_struct *task, struct socket *sock,
 			    struct sockaddr *addr, int addrlen);
+void proc_accept_connector(struct task_struct *task, struct socket *sock,
+			   struct sockaddr *addr, int addrlen);
 #else
 static inline void proc_fork_connector(struct task_struct *task)
 {}
@@ -159,6 +172,10 @@ static inline void proc_connect_connector(struct task_struct *task,
 					  struct sockaddr *addr, int addrlen)
 {}
 
+static inline void proc_accept_connector(struct task_struct *task,
+					 struct socket *sock,
+					 struct sockaddr *addr, int addrlen)
+{}
 #endif	/* CONFIG_PROC_EVENTS */
 #endif	/* __KERNEL__ */
 #endif	/* CN_PROC_H */
diff --git a/net/socket.c b/net/socket.c
index b4f9a6c..d21a266 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1544,6 +1544,9 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
 			goto out_fd;
 	}
 
+	proc_accept_connector(current, newsock,
+			      (struct sockaddr *)&address, len);
+
 	/* File flags are not inherited via accept() unlike another OSes. */
 
 	fd_install(newfd, newfile);
-- 
1.7.4.1

Re: [PATCH 2/2] Create a new connector proc_event for successful calls to accept.

[Samir Bellabes]

Joe Damato <joe@boundary.com> writes:

> diff --git a/net/socket.c b/net/socket.c
> index b4f9a6c..d21a266 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -1544,6 +1544,9 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
>  			goto out_fd;
>  	}
>  
> +	proc_accept_connector(current, newsock,
> +			      (struct sockaddr *)&address, len);
> +
>  	/* File flags are not inherited via accept() unlike another OSes. */
>  
>  	fd_install(newfd, newfile);

Hi Joe,
adding a specific function here is not very suitable.
I have already proposed such a patch by adding my own hooks, then I
moved to the LSM hooks
http://www.mail-archive.com/netdev@vger.kernel.org/msg33814.html

I have rewrite the projet to directly use netlink socket (in fact
generic netlink socket) and move to a new protocol between userspace and
kernel
you can find patch here :
http://www.synack.fr/project/snet/snet.html

sam