Skip to content

sock_hc: only report releases for listening TCP sockets #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
lacraig2 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

sock_hc: only report releases for listening TCP sockets #75

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions src/hooks/sock_hc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
#include <linux/socket.h>
#include <linux/ipv6.h>
#include <net/inet_sock.h>
#include <net/tcp_states.h>
#include "igloo.h"
#include <linux/kallsyms.h>
#include <linux/version.h>
Expand Down Expand Up @@ -91,26 +92,32 @@ void igloo_sock_release(struct socket *sock){
if (sk->sk_family == AF_INET) {
char buffer[23];
struct inet_sock *inet = inet_sk(sk);
port = ntohs(inet->inet_sport);
if (port != 0){
__be32 ip = inet->inet_saddr;
short is_stream = (sk->sk_type == SOCK_STREAM);
short is_stream = (sk->sk_type == SOCK_STREAM);
port = ntohs(inet->inet_sport);
// For TCP, only report listening sockets closing. Accepted and
// connected sockets share the listener's local port, so reporting
// their teardown would emit spurious release events for a service
// that is still listening.
if (port != 0 && (!is_stream || sk->sk_state == TCP_LISTEN)){
__be32 ip = inet->inet_saddr;
snprintf(buffer, sizeof(buffer), "%pI4:%u", &ip, port);
e = igloo_hypercall2(IGLOO_IPV4_RELEASE, (unsigned long)&buffer, (unsigned long)is_stream);
e = igloo_hypercall2(IGLOO_IPV4_RELEASE, (unsigned long)&buffer, (unsigned long)is_stream);
}
}
else if (sk->sk_family == AF_INET6) {
char buffer[49];
struct inet_sock *inet = inet_sk(sk);
struct ipv6_pinfo *ipv6_s = inet6_sk(sk);
short is_stream = (sk->sk_type == SOCK_STREAM);
port = ntohs(inet->inet_sport);

if (port != 0){
// As above: for TCP only report listeners, not accepted/connected
// sockets that share the listener's local port.
if (port != 0 && (!is_stream || sk->sk_state == TCP_LISTEN)){
struct in6_addr *ip6 = &ipv6_s->saddr;
short is_stream = (sk->sk_type == SOCK_STREAM);

snprintf(buffer, sizeof(buffer), "[%pI6c]:%u", ip6, port);

e = igloo_hypercall2(IGLOO_IPV6_RELEASE, (unsigned long)&buffer, (unsigned long)is_stream);
}
}
Expand Down
Loading