netdev - Re: Getting IP address and port of a file descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 18 Jul 2016 13:14:26 -0700
From:	Cong Wang <xiyou.wangcong@...il.com>
To:	Peter Chen <peter.feifan.chen@...il.com>
Cc:	Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: Getting IP address and port of a file descriptor

On Mon, Jul 18, 2016 at 12:09 PM, Peter Chen
<peter.feifan.chen@...il.com> wrote:
> Hi,
>
>    I was wondering, if I was in the kernel, and I intercepted a system
> call such as read(). Would I be able, from the fd, determine the
> whether the fd is (1) a network socket? (2) the IP address and port of
> this socket? What are the kernel data structures and functions that
> can get these information for me in the kernel? Thanks.

You can use sockfd_lookup() to read the sock structure from a given fd,
after than you can call, for example, sock->ops->getname() to read
local IP address etc.