vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-01 18:19:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Split unattributed connections into to Unidentified App and Network Noise

Browse source
This commit is contained in:
Daniel 2022-03-09 15:44:54 +01:00
parent 014ac058ce
commit 7a9001b7de
11 changed files with 78 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
network/connection.go
View file

@ -317,7 +317,11 @@ func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
proc, inbound, err := process.GetProcessByConnection(pkt.Ctx(), pkt.Info())
if err != nil {
log.Tracer(pkt.Ctx()).Debugf("network: failed to find process of packet %s: %s", pkt, err)
proc = process.GetUnidentifiedProcess(pkt.Ctx())
if inbound {
proc = process.GetUnsolicitedProcess(pkt.Ctx())
} else {
proc = process.GetUnidentifiedProcess(pkt.Ctx())
}
}
// Create the (remote) entity.

4
network/proc/findpid.go
View file

@ -23,7 +23,7 @@ func GetPID(socketInfo socket.Info) (pid int) {
currentPid := socketInfo.GetPID()
// If the current PID already is valid (ie. not unidentified), return it immediately.
if currentPid != socket.UnidentifiedProcessID {
if currentPid != socket.UndefinedProcessID {
return currentPid
}
@ -91,7 +91,7 @@ func findPID(uid, inode int) (pid int) {
}
}
return socket.UnidentifiedProcessID
return socket.UndefinedProcessID
}
func findSocketFromPid(pid int, socketName string) bool {

6
network/proc/tables.go
View file

@ -149,7 +149,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
IP: localIP,
Port: uint16(localPort),
},
PID: socket.UnidentifiedProcessID,
PID: socket.UndefinedProcessID,
UID: int(uid),
Inode: int(inode),
})
@ -164,7 +164,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
IP: localIP,
Port: uint16(localPort),
},
PID: socket.UnidentifiedProcessID,
PID: socket.UndefinedProcessID,
UID: int(uid),
Inode: int(inode),
})
@ -191,7 +191,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
IP: remoteIP,
Port: uint16(remotePort),
},
PID: socket.UnidentifiedProcessID,
PID: socket.UndefinedProcessID,
UID: int(uid),
Inode: int(inode),
})

6
network/socket/socket.go
View file

@ -6,8 +6,10 @@ import (
)
const (
// UnidentifiedProcessID is originally defined in the process pkg, but duplicated here because of import loops.
UnidentifiedProcessID = -1
// UndefinedProcessID signifies that the process ID is unknown.
// It must match portmaster/process.UndefinedProcessID
// It is duplicated here because of import loops.
UndefinedProcessID = -1
)
// ConnectionInfo holds socket information returned by the system.

6
network/state/lookup.go
View file

@ -60,7 +60,7 @@ func Lookup(pktInfo *packet.Info, fast bool) (pid int, inbound bool, err error)
return udp6Table.lookup(pktInfo, fast)
default:
return socket.UnidentifiedProcessID, false, errors.New("unsupported protocol for finding process")
return socket.UndefinedProcessID, false, errors.New("unsupported protocol for finding process")
}
}
@ -108,7 +108,7 @@ func (table *tcpTable) lookup(pktInfo *packet.Info, fast bool) (
}
}
return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
}
func (table *tcpTable) findSocket(pktInfo *packet.Info) (
@ -201,7 +201,7 @@ func (table *udpTable) lookup(pktInfo *packet.Info, fast bool) (
}
}
return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
}
func (table *udpTable) findSocket(pktInfo *packet.Info, isInboundMulticast bool) (socketInfo *socket.BindInfo) {

2
network/state/system_linux.go
View file

@ -18,7 +18,7 @@ func checkPID(socketInfo socket.Info, connInbound bool) (pid int, inbound bool,
for i := 0; i <= lookupRetries; i++ {
// look for PID
pid = proc.GetPID(socketInfo)
if pid != socket.UnidentifiedProcessID {
if pid != socket.UndefinedProcessID {
// if we found a PID, return
break
}

9
process/find.go
View file

@ -31,6 +31,15 @@ func GetProcessByConnection(ctx context.Context, pktInfo *packet.Info) (process
return nil, pktInfo.Inbound, err
}
// Fallback to special profiles if PID could not be found.
if pid == UndefinedProcessID {
if connInbound {
pid = UnsolicitedProcessID
} else {
pid = UnidentifiedProcessID
}
}
process, err = GetOrFindProcess(ctx, pid)
if err != nil {
log.Tracer(ctx).Debugf("process: failed to find (primary) process with PID: %s", err)

2
process/process.go
View file

@ -131,6 +131,8 @@ func loadProcess(ctx context.Context, pid int) (*Process, error) {
switch pid {
case UnidentifiedProcessID:
return GetUnidentifiedProcess(ctx), nil
case UnsolicitedProcessID:
return GetUnsolicitedProcess(ctx), nil
case SystemProcessID:
return GetSystemProcess(ctx), nil
}

2
process/profile.go
View file

@ -34,6 +34,8 @@ func (p *Process) GetProfile(ctx context.Context) (changed bool, err error) {
switch p.Pid {
case UnidentifiedProcessID:
profileID = profile.UnidentifiedProfileID
case UnsolicitedProcessID:
profileID = profile.UnsolicitedProfileID
case SystemProcessID:
profileID = profile.SystemProfileID
case ownPID:

37
process/special.go
View file

@ -8,29 +8,43 @@ import (
"golang.org/x/sync/singleflight"
"github.com/safing/portbase/log"
"github.com/safing/portmaster/profile"
)
const (
// UnidentifiedProcessID is the PID used for anything that could not be
// attributed to a PID for any reason.
UnidentifiedProcessID = -1
// UndefinedProcessID is not used by any (virtual) process and signifies that
// the PID is unset.
UndefinedProcessID = -2
UndefinedProcessID = -1
// UnidentifiedProcessID is the PID used for outgoing connections that could
// not be attributed to a PID for any reason.
UnidentifiedProcessID = -2
// UnsolicitedProcessID is the PID used for incoming connections that could
// not be attributed to a PID for any reason.
UnsolicitedProcessID = -3
// NetworkHostProcessID is the PID used for requests served to the network.
NetworkHostProcessID = -255
)
var (
// unidentifiedProcess is used when a process cannot be found.
// unidentifiedProcess is used for non-attributed outgoing connections.
unidentifiedProcess = &Process{
UserID: UnidentifiedProcessID,
UserName: "Unknown",
Pid: UnidentifiedProcessID,
ParentPid: UnidentifiedProcessID,
Name: "Unidentified Processes",
Name: profile.UnidentifiedProfileName,
}
// unsolicitedProcess is used for non-attributed incoming connections.
unsolicitedProcess = &Process{
UserID: UnsolicitedProcessID,
UserName: "Unknown",
Pid: UnsolicitedProcessID,
ParentPid: UnsolicitedProcessID,
Name: profile.UnsolicitedProfileName,
}
// systemProcess is used to represent the Kernel.
@ -39,17 +53,22 @@ var (
UserName: "Kernel",
Pid: SystemProcessID,
ParentPid: SystemProcessID,
Name: "Operating System",
Name: profile.SystemProfileName,
}
getSpecialProcessSingleInflight singleflight.Group
)
// GetUnidentifiedProcess returns the special process assigned to unidentified processes.
// GetUnidentifiedProcess returns the special process assigned to non-attributed outgoing connections.
func GetUnidentifiedProcess(ctx context.Context) *Process {
return getSpecialProcess(ctx, unidentifiedProcess)
}
// GetUnsolicitedProcess returns the special process assigned to non-attributed incoming connections.
func GetUnsolicitedProcess(ctx context.Context) *Process {
return getSpecialProcess(ctx, unsolicitedProcess)
}
// GetSystemProcess returns the special process used for the Kernel.
func GetSystemProcess(ctx context.Context) *Process {
return getSpecialProcess(ctx, systemProcess)

22
profile/special.go
View file

@ -10,13 +10,26 @@ const (
// UnidentifiedProfileID is the profile ID used for unidentified processes.
UnidentifiedProfileID = "_unidentified"
// UnidentifiedProfileName is the name used for unidentified processes.
UnidentifiedProfileName = "Unidentified Processes"
UnidentifiedProfileName = "Unidentified App"
// UnidentifiedProfileDescription is the description used for unidentified processes.
UnidentifiedProfileDescription = `This is not a real application, but a collection of connections that could not be attributed to a process. This could be because the Portmaster failed to identify the process, or simply because there is no process waiting for an incoming connection.
UnidentifiedProfileDescription = `Connections that could not be attributed to a specific app.
Seeing a lot of incoming connections here is normal, as this resembles the network chatter of other devices.
The Portmaster attributes connections (only TCP/UDP) to specific apps. When attribution for a connection fails, it ends up here.
Connections from unsupported protocols (like ICMP/"ping") are always collected here.
`
// UnsolicitedProfileID is the profile ID used for unsolicited connections.
UnsolicitedProfileID = "_unsolicited"
// UnsolicitedProfileName is the name used for unsolicited connections.
UnsolicitedProfileName = "Network Noise"
// UnsolicitedProfileDescription is the description used for unsolicited connections.
UnsolicitedProfileDescription = `Common connections coming from your Local Area Network.
Local Area Networks usually have quite a lot of traffic from applications that are trying to find things on the network. This might be a computer trying to find a printer, or a file sharing application searching for local peers. These network packets will automatically arrive at your device.
These connections - the "network noise" - can be found in this app.`
// SystemProfileID is the profile ID used for the system/kernel.
SystemProfileID = "_system"
// SystemProfileName is the name used for the system/kernel.
@ -68,6 +81,9 @@ func updateSpecialProfileMetadata(profile *Profile, binaryPath string) (ok, chan
case UnidentifiedProfileID:
newProfileName = UnidentifiedProfileName
newDescription = UnidentifiedProfileDescription
case UnsolicitedProfileID:
newProfileName = UnsolicitedProfileName
newDescription = UnsolicitedProfileDescription
case SystemProfileID:
newProfileName = SystemProfileName
newDescription = SystemProfileDescription