Add support for unidentified/system processes/profiles

process/find.go

@@ -58,7 +58,7 @@ func GetPidByPacket(pkt packet.Packet) (pid int, direction bool, err error) {
 func GetProcessByPacket(pkt packet.Packet) (process *Process, direction bool, err error) {
 	if !enableProcessDetection() {
 		log.Tracer(pkt.Ctx()).Tracef("process: process detection disabled")
-		return UnknownProcess, direction, nil
+		return GetUnidentifiedProcess(pkt.Ctx()), pkt.Info().Direction, nil
 	}
 
 	log.Tracer(pkt.Ctx()).Tracef("process: getting process and profile by packet")
@@ -116,7 +116,7 @@ func GetPidByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remote
 func GetProcessByEndpoints(ctx context.Context, localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, protocol packet.IPProtocol) (process *Process, err error) {
 	if !enableProcessDetection() {
 		log.Tracer(ctx).Tracef("process: process detection disabled")
-		return UnknownProcess, nil
+		return GetUnidentifiedProcess(ctx), nil
 	}
 
 	log.Tracer(ctx).Tracef("process: getting process and profile by endpoints")

process/process.go

@@ -75,11 +75,11 @@ func (p *Process) String() string {
 func GetOrFindPrimaryProcess(ctx context.Context, pid int) (*Process, error) {
 	log.Tracer(ctx).Tracef("process: getting primary process for PID %d", pid)
 
-	if pid == -1 {
-		return UnknownProcess, nil
+	if pid <= -1 {
+		return GetUnidentifiedProcess(ctx), nil
 	}
 	if pid == 0 {
-		return OSProcess, nil
+		return GetSystemProcess(ctx), nil
 	}
 
 	process, err := loadProcess(ctx, pid)
@@ -88,8 +88,8 @@ func GetOrFindPrimaryProcess(ctx context.Context, pid int) (*Process, error) {
 	}
 
 	for {
-		if process.ParentPid == 0 {
-			return OSProcess, nil
+		if process.ParentPid <= 0 {
+			return process, nil
 		}
 		parentProcess, err := loadProcess(ctx, process.ParentPid)
 		if err != nil {
@@ -121,11 +121,11 @@ func GetOrFindPrimaryProcess(ctx context.Context, pid int) (*Process, error) {
 func GetOrFindProcess(ctx context.Context, pid int) (*Process, error) {
 	log.Tracer(ctx).Tracef("process: getting process for PID %d", pid)
 
-	if pid == -1 {
-		return UnknownProcess, nil
+	if pid <= -1 {
+		return GetUnidentifiedProcess(ctx), nil
 	}
 	if pid == 0 {
-		return OSProcess, nil
+		return GetSystemProcess(ctx), nil
 	}
 
 	p, err := loadProcess(ctx, pid)
@@ -184,11 +184,11 @@ func deduplicateRequest(ctx context.Context, pid int) (finishRequest func()) {
 }
 
 func loadProcess(ctx context.Context, pid int) (*Process, error) {
-	if pid == -1 {
-		return UnknownProcess, nil
+	if pid <= -1 {
+		return GetUnidentifiedProcess(ctx), nil
 	}
 	if pid == 0 {
-		return OSProcess, nil
+		return GetSystemProcess(ctx), nil
 	}
 
 	process, ok := GetProcessFromStorage(pid)

process/profile.go

@@ -15,6 +15,8 @@ func (p *Process) GetProfile(ctx context.Context) error {
 	// only find profiles if not already done.
 	if p.profile != nil {
 		log.Tracer(ctx).Trace("process: profile already loaded")
+		// mark profile as used
+		p.profile.MarkUsed()
 		return nil
 	}
 	log.Tracer(ctx).Trace("process: loading profile")
@@ -29,10 +31,8 @@ func (p *Process) GetProfile(ctx context.Context) error {
 		localProfile.Name = p.ExecName
 	}
 
-	// mark as used and save
-	if localProfile.MarkUsed() {
-		_ = localProfile.Save()
-	}
+	// mark profile as used
+	localProfile.MarkUsed()
 
 	p.LocalProfileKey = localProfile.Key()
 	p.profile = profile.NewLayeredProfile(localProfile)

process/special.go

@@ -0,0 +1,67 @@
+package process
+
+import (
+	"context"
+	"time"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/profile"
+)
+
+var (
+	// unidentifiedProcess is used when a process cannot be found.
+	unidentifiedProcess = &Process{
+		UserID:    -1,
+		UserName:  "Unknown",
+		Pid:       -1,
+		ParentPid: -1,
+		Name:      "Unidentified Processes",
+	}
+
+	// systemProcess is used to represent the Kernel.
+	systemProcess = &Process{
+		UserID:    0,
+		UserName:  "Kernel",
+		Pid:       0,
+		ParentPid: 0,
+		Name:      "Operating System",
+	}
+)
+
+func GetUnidentifiedProcess(ctx context.Context) *Process {
+	return getSpecialProcess(ctx, unidentifiedProcess, profile.GetUnidentifiedProfile)
+}
+
+func GetSystemProcess(ctx context.Context) *Process {
+	return getSpecialProcess(ctx, systemProcess, profile.GetSystemProfile)
+}
+
+func getSpecialProcess(ctx context.Context, p *Process, getProfile func() *profile.Profile) *Process {
+	p.Lock()
+	defer p.Unlock()
+
+	if p.FirstSeen == 0 {
+		p.FirstSeen = time.Now().Unix()
+	}
+
+	// only find profiles if not already done.
+	if p.profile != nil {
+		log.Tracer(ctx).Trace("process: special profile already loaded")
+		// mark profile as used
+		p.profile.MarkUsed()
+		return p
+	}
+	log.Tracer(ctx).Trace("process: loading special profile")
+
+	// get profile
+	localProfile := getProfile()
+
+	// mark profile as used
+	localProfile.MarkUsed()
+
+	p.LocalProfileKey = localProfile.Key()
+	p.profile = profile.NewLayeredProfile(localProfile)
+
+	go p.Save()
+	return p
+}

process/unknown.go

@@ -1,26 +0,0 @@
-package process
-
-var (
-	// UnknownProcess is used when a process cannot be found.
-	UnknownProcess = &Process{
-		UserID:    -1,
-		UserName:  "Unknown",
-		Pid:       -1,
-		ParentPid: -1,
-		Name:      "Unknown Processes",
-	}
-
-	// OSProcess is used to represent the Kernel.
-	OSProcess = &Process{
-		UserID:    0,
-		UserName:  "Kernel",
-		Pid:       0,
-		ParentPid: 0,
-		Name:      "Operating System",
-	}
-)
-
-func init() {
-	UnknownProcess.Save()
-	OSProcess.Save()
-}