Split unattributed connections into to Unidentified App and Network Noise

This commit is contained in:
Daniel
2022-03-09 15:44:54 +01:00
parent 014ac058ce
commit 7a9001b7de
11 changed files with 78 additions and 24 deletions

View File

@@ -317,7 +317,11 @@ func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
proc, inbound, err := process.GetProcessByConnection(pkt.Ctx(), pkt.Info())
if err != nil {
log.Tracer(pkt.Ctx()).Debugf("network: failed to find process of packet %s: %s", pkt, err)
proc = process.GetUnidentifiedProcess(pkt.Ctx())
if inbound {
proc = process.GetUnsolicitedProcess(pkt.Ctx())
} else {
proc = process.GetUnidentifiedProcess(pkt.Ctx())
}
}
// Create the (remote) entity.

View File

@@ -23,7 +23,7 @@ func GetPID(socketInfo socket.Info) (pid int) {
currentPid := socketInfo.GetPID()
// If the current PID already is valid (ie. not unidentified), return it immediately.
if currentPid != socket.UnidentifiedProcessID {
if currentPid != socket.UndefinedProcessID {
return currentPid
}
@@ -91,7 +91,7 @@ func findPID(uid, inode int) (pid int) {
}
}
return socket.UnidentifiedProcessID
return socket.UndefinedProcessID
}
func findSocketFromPid(pid int, socketName string) bool {

View File

@@ -149,7 +149,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
IP: localIP,
Port: uint16(localPort),
},
PID: socket.UnidentifiedProcessID,
PID: socket.UndefinedProcessID,
UID: int(uid),
Inode: int(inode),
})
@@ -164,7 +164,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
IP: localIP,
Port: uint16(localPort),
},
PID: socket.UnidentifiedProcessID,
PID: socket.UndefinedProcessID,
UID: int(uid),
Inode: int(inode),
})
@@ -191,7 +191,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
IP: remoteIP,
Port: uint16(remotePort),
},
PID: socket.UnidentifiedProcessID,
PID: socket.UndefinedProcessID,
UID: int(uid),
Inode: int(inode),
})

View File

@@ -6,8 +6,10 @@ import (
)
const (
// UnidentifiedProcessID is originally defined in the process pkg, but duplicated here because of import loops.
UnidentifiedProcessID = -1
// UndefinedProcessID signifies that the process ID is unknown.
// It must match portmaster/process.UndefinedProcessID
// It is duplicated here because of import loops.
UndefinedProcessID = -1
)
// ConnectionInfo holds socket information returned by the system.

View File

@@ -60,7 +60,7 @@ func Lookup(pktInfo *packet.Info, fast bool) (pid int, inbound bool, err error)
return udp6Table.lookup(pktInfo, fast)
default:
return socket.UnidentifiedProcessID, false, errors.New("unsupported protocol for finding process")
return socket.UndefinedProcessID, false, errors.New("unsupported protocol for finding process")
}
}
@@ -108,7 +108,7 @@ func (table *tcpTable) lookup(pktInfo *packet.Info, fast bool) (
}
}
return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
}
func (table *tcpTable) findSocket(pktInfo *packet.Info) (
@@ -201,7 +201,7 @@ func (table *udpTable) lookup(pktInfo *packet.Info, fast bool) (
}
}
return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
}
func (table *udpTable) findSocket(pktInfo *packet.Info, isInboundMulticast bool) (socketInfo *socket.BindInfo) {

View File

@@ -18,7 +18,7 @@ func checkPID(socketInfo socket.Info, connInbound bool) (pid int, inbound bool,
for i := 0; i <= lookupRetries; i++ {
// look for PID
pid = proc.GetPID(socketInfo)
if pid != socket.UnidentifiedProcessID {
if pid != socket.UndefinedProcessID {
// if we found a PID, return
break
}