linux-kernel - How to find origin PID of a sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200809040832.m848WKHh016586@burp.tkv.asdf.org>
Date:	Thu, 4 Sep 2008 11:32:20 +0300
From:	Markku Savela <msa@...h.iki.fi>
To:	linux-kernel@...r.kernel.org
Subject: How to find origin PID of a sk_buff in iptables match?

Again playing with ubuntu kernel 2.6.24.

I'm trying to write a match rule for iptables, in this case for OUTPUT
direction, and need to know the PID of the process that originates the
packet (or something).

It seems that "skb->sk->sk_peercred.pid" is always zero.

Also, I noticed that in my match code in OUTPUT chain, the current
task seemed to the originator I want (ping test). However, I'm not
quite sure whether this is always true?

If I truly wanted to associate each packet with some specific process,
what are my options?

- I expect the solution is easier for outbound packets originating
  from this host (e.g. possibly the OUTPUT chain is always executed in
  the context of the sending process?)

- for INPUT the problem is probably pretty hard to solve. I would need
  some IPTABLES rule to be run after the packet has been assinged to a
  receiving user socket and get the PID of the receiving process,
  which may be fuzzy as socket can have multiple reading processes?

ps. I did notice the iptables xt_owner match, and the comment there
saying that support for PID and SID match is not there.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/