Split unattributed connections into to Unidentified App and Network Noise

process/find.go

@@ -31,6 +31,15 @@ func GetProcessByConnection(ctx context.Context, pktInfo *packet.Info) (process
 		return nil, pktInfo.Inbound, err
 	}
 
+	// Fallback to special profiles if PID could not be found.
+	if pid == UndefinedProcessID {
+		if connInbound {
+			pid = UnsolicitedProcessID
+		} else {
+			pid = UnidentifiedProcessID
+		}
+	}
+
 	process, err = GetOrFindProcess(ctx, pid)
 	if err != nil {
 		log.Tracer(ctx).Debugf("process: failed to find (primary) process with PID: %s", err)

process/process.go

@@ -131,6 +131,8 @@ func loadProcess(ctx context.Context, pid int) (*Process, error) {
 	switch pid {
 	case UnidentifiedProcessID:
 		return GetUnidentifiedProcess(ctx), nil
+	case UnsolicitedProcessID:
+		return GetUnsolicitedProcess(ctx), nil
 	case SystemProcessID:
 		return GetSystemProcess(ctx), nil
 	}

process/profile.go

@@ -34,6 +34,8 @@ func (p *Process) GetProfile(ctx context.Context) (changed bool, err error) {
 	switch p.Pid {
 	case UnidentifiedProcessID:
 		profileID = profile.UnidentifiedProfileID
+	case UnsolicitedProcessID:
+		profileID = profile.UnsolicitedProfileID
 	case SystemProcessID:
 		profileID = profile.SystemProfileID
 	case ownPID:

process/special.go

@@ -8,29 +8,43 @@ import (
 	"golang.org/x/sync/singleflight"
 
 	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/profile"
 )
 
 const (
-	// UnidentifiedProcessID is the PID used for anything that could not be
-	// attributed to a PID for any reason.
-	UnidentifiedProcessID = -1
-
 	// UndefinedProcessID is not used by any (virtual) process and signifies that
 	// the PID is unset.
-	UndefinedProcessID = -2
+	UndefinedProcessID = -1
+
+	// UnidentifiedProcessID is the PID used for outgoing connections that could
+	// not be attributed to a PID for any reason.
+	UnidentifiedProcessID = -2
+
+	// UnsolicitedProcessID is the PID used for incoming connections that could
+	// not be attributed to a PID for any reason.
+	UnsolicitedProcessID = -3
 
 	// NetworkHostProcessID is the PID used for requests served to the network.
 	NetworkHostProcessID = -255
 )
 
 var (
-	// unidentifiedProcess is used when a process cannot be found.
+	// unidentifiedProcess is used for non-attributed outgoing connections.
 	unidentifiedProcess = &Process{
 		UserID:    UnidentifiedProcessID,
 		UserName:  "Unknown",
 		Pid:       UnidentifiedProcessID,
 		ParentPid: UnidentifiedProcessID,
-		Name:      "Unidentified Processes",
+		Name:      profile.UnidentifiedProfileName,
+	}
+
+	// unsolicitedProcess is used for non-attributed incoming connections.
+	unsolicitedProcess = &Process{
+		UserID:    UnsolicitedProcessID,
+		UserName:  "Unknown",
+		Pid:       UnsolicitedProcessID,
+		ParentPid: UnsolicitedProcessID,
+		Name:      profile.UnsolicitedProfileName,
 	}
 
 	// systemProcess is used to represent the Kernel.
@@ -39,17 +53,22 @@ var (
 		UserName:  "Kernel",
 		Pid:       SystemProcessID,
 		ParentPid: SystemProcessID,
-		Name:      "Operating System",
+		Name:      profile.SystemProfileName,
 	}
 
 	getSpecialProcessSingleInflight singleflight.Group
 )
 
-// GetUnidentifiedProcess returns the special process assigned to unidentified processes.
+// GetUnidentifiedProcess returns the special process assigned to non-attributed outgoing connections.
 func GetUnidentifiedProcess(ctx context.Context) *Process {
 	return getSpecialProcess(ctx, unidentifiedProcess)
 }
 
+// GetUnsolicitedProcess returns the special process assigned to non-attributed incoming connections.
+func GetUnsolicitedProcess(ctx context.Context) *Process {
+	return getSpecialProcess(ctx, unsolicitedProcess)
+}
+
 // GetSystemProcess returns the special process used for the Kernel.
 func GetSystemProcess(ctx context.Context) *Process {
 	return getSpecialProcess(ctx, systemProcess)