netdev - Re: AF_UNIX Monitor Device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200422162546.GJ47385@stefanha-x1.localdomain>
Date:   Wed, 22 Apr 2020 17:25:46 +0100
From:   Stefan Hajnoczi <stefanha@...il.com>
To:     Joshua Abraham <j.abraham1776@...il.com>
Cc:     qemu-devel@...gnu.org, "David S. Miller" <davem@...emloft.net>,
        netdev@...r.kernel.org
Subject: Re: AF_UNIX Monitor Device

On Tue, Apr 14, 2020 at 09:46:00PM -0400, Joshua Abraham wrote:
> Hello Stefan,
> 
> This blog post [0] talks about the AF_VSOCK monitoring device
> (vsockmon) Stefan upstreamed into Linux a few years ago. It seems to
> me the same rationale for enabling packet captures for AF_VSOCK
> traffic applies to UNIX domain sockets as well. What do you think? I
> have a proof of concept patch for Linux for a unixmon capture device
> if you think this is a good idea.
> 
> [0] https://blog.vmsplice.net/2017/07/packet-capture-coming-to-afvsock.html

Sorry, I didn't see your email until now.

Unlike AF_VSOCK, AF_UNIX has no control packets so the capture would
only consist of the data which you can already see using strace(1).
So while you really need this feature in order to inspect AF_VSOCK
traffic you don't strictly need it for AF_UNIX.  Maybe that is why this
feature has never been implemented.

I suggest asking the Linux AF_UNIX and networking maintainers if this
feature could be merged.  I've CCed them.

Stefan

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)