Split unattributed connections into to Unidentified App and Network Noise
This commit is contained in:
@@ -317,7 +317,11 @@ func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
|
||||
proc, inbound, err := process.GetProcessByConnection(pkt.Ctx(), pkt.Info())
|
||||
if err != nil {
|
||||
log.Tracer(pkt.Ctx()).Debugf("network: failed to find process of packet %s: %s", pkt, err)
|
||||
proc = process.GetUnidentifiedProcess(pkt.Ctx())
|
||||
if inbound {
|
||||
proc = process.GetUnsolicitedProcess(pkt.Ctx())
|
||||
} else {
|
||||
proc = process.GetUnidentifiedProcess(pkt.Ctx())
|
||||
}
|
||||
}
|
||||
|
||||
// Create the (remote) entity.
|
||||
|
||||
@@ -23,7 +23,7 @@ func GetPID(socketInfo socket.Info) (pid int) {
|
||||
currentPid := socketInfo.GetPID()
|
||||
|
||||
// If the current PID already is valid (ie. not unidentified), return it immediately.
|
||||
if currentPid != socket.UnidentifiedProcessID {
|
||||
if currentPid != socket.UndefinedProcessID {
|
||||
return currentPid
|
||||
}
|
||||
|
||||
@@ -91,7 +91,7 @@ func findPID(uid, inode int) (pid int) {
|
||||
}
|
||||
}
|
||||
|
||||
return socket.UnidentifiedProcessID
|
||||
return socket.UndefinedProcessID
|
||||
}
|
||||
|
||||
func findSocketFromPid(pid int, socketName string) bool {
|
||||
|
||||
@@ -149,7 +149,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
|
||||
IP: localIP,
|
||||
Port: uint16(localPort),
|
||||
},
|
||||
PID: socket.UnidentifiedProcessID,
|
||||
PID: socket.UndefinedProcessID,
|
||||
UID: int(uid),
|
||||
Inode: int(inode),
|
||||
})
|
||||
@@ -164,7 +164,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
|
||||
IP: localIP,
|
||||
Port: uint16(localPort),
|
||||
},
|
||||
PID: socket.UnidentifiedProcessID,
|
||||
PID: socket.UndefinedProcessID,
|
||||
UID: int(uid),
|
||||
Inode: int(inode),
|
||||
})
|
||||
@@ -191,7 +191,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
|
||||
IP: remoteIP,
|
||||
Port: uint16(remotePort),
|
||||
},
|
||||
PID: socket.UnidentifiedProcessID,
|
||||
PID: socket.UndefinedProcessID,
|
||||
UID: int(uid),
|
||||
Inode: int(inode),
|
||||
})
|
||||
|
||||
@@ -6,8 +6,10 @@ import (
|
||||
)
|
||||
|
||||
const (
|
||||
// UnidentifiedProcessID is originally defined in the process pkg, but duplicated here because of import loops.
|
||||
UnidentifiedProcessID = -1
|
||||
// UndefinedProcessID signifies that the process ID is unknown.
|
||||
// It must match portmaster/process.UndefinedProcessID
|
||||
// It is duplicated here because of import loops.
|
||||
UndefinedProcessID = -1
|
||||
)
|
||||
|
||||
// ConnectionInfo holds socket information returned by the system.
|
||||
|
||||
@@ -60,7 +60,7 @@ func Lookup(pktInfo *packet.Info, fast bool) (pid int, inbound bool, err error)
|
||||
return udp6Table.lookup(pktInfo, fast)
|
||||
|
||||
default:
|
||||
return socket.UnidentifiedProcessID, false, errors.New("unsupported protocol for finding process")
|
||||
return socket.UndefinedProcessID, false, errors.New("unsupported protocol for finding process")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -108,7 +108,7 @@ func (table *tcpTable) lookup(pktInfo *packet.Info, fast bool) (
|
||||
}
|
||||
}
|
||||
|
||||
return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
|
||||
return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
|
||||
}
|
||||
|
||||
func (table *tcpTable) findSocket(pktInfo *packet.Info) (
|
||||
@@ -201,7 +201,7 @@ func (table *udpTable) lookup(pktInfo *packet.Info, fast bool) (
|
||||
}
|
||||
}
|
||||
|
||||
return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
|
||||
return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
|
||||
}
|
||||
|
||||
func (table *udpTable) findSocket(pktInfo *packet.Info, isInboundMulticast bool) (socketInfo *socket.BindInfo) {
|
||||
|
||||
@@ -18,7 +18,7 @@ func checkPID(socketInfo socket.Info, connInbound bool) (pid int, inbound bool,
|
||||
for i := 0; i <= lookupRetries; i++ {
|
||||
// look for PID
|
||||
pid = proc.GetPID(socketInfo)
|
||||
if pid != socket.UnidentifiedProcessID {
|
||||
if pid != socket.UndefinedProcessID {
|
||||
// if we found a PID, return
|
||||
break
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user