Fix process identification key

This commit is contained in:
Vladimir Stoilov
2023-03-30 14:43:38 +02:00
parent b9488c1a8f
commit 834282cb0e
8 changed files with 107 additions and 73 deletions

View File

@@ -26,7 +26,7 @@ import (
type FirewallHandler func(conn *Connection, pkt packet.Packet)
// ProcessContext holds additional information about the process
// that iniated a connection.
// that initiated a connection.
type ProcessContext struct {
// ProcessName is the name of the process.
ProcessName string
@@ -38,6 +38,8 @@ type ProcessContext struct {
CmdLine string
// PID is the process identifier.
PID int
// CreatedAt the time when the process was created.
CreatedAt int64
// Profile is the ID of the main profile that
// is applied to the process.
Profile string
@@ -223,6 +225,7 @@ func getProcessContext(ctx context.Context, proc *process.Process) ProcessContex
BinaryPath: proc.Path,
CmdLine: proc.CmdLine,
PID: proc.Pid,
CreatedAt: proc.CreatedAt,
}
// Get local profile.

View File

@@ -45,7 +45,7 @@ func makeKey(pid int, scope, id string) string {
return fmt.Sprintf("network:tree/%d/%s/%s", pid, scope, id)
}
func parseDBKey(key string) (pid int, scope, id string, ok bool) {
func parseDBKey(key string) (processKey string, scope, id string, ok bool) {
// Split into segments.
segments := strings.Split(key, "/")
@@ -65,27 +65,18 @@ func parseDBKey(key string) (pid int, scope, id string, ok bool) {
// TODO: For queries, also prefixes of these values are valid.
default:
// Unknown scope.
return 0, "", "", false
return "", "", "", false
}
fallthrough
case 2:
var err error
if segments[1] == "" {
pid = process.UndefinedProcessID
} else {
pid, err = strconv.Atoi(segments[1])
if err != nil {
return 0, "", "", false
}
}
return pid, scope, id, true
processKey = segments[1]
return processKey, scope, id, true
case 1:
// This is a valid query prefix, but not process ID was given.
return process.UndefinedProcessID, "", "", true
return "", "", "", true
default:
return 0, "", "", false
return "", "", "", false
}
}
@@ -93,7 +84,7 @@ func parseDBKey(key string) (pid int, scope, id string, ok bool) {
func (s *StorageInterface) Get(key string) (record.Record, error) {
// Parse key and check if valid.
pid, scope, id, ok := parseDBKey(strings.TrimPrefix(key, "network:"))
if !ok || pid == process.UndefinedProcessID {
if !ok || pid == "" {
return nil, storage.ErrNotFound
}
@@ -135,7 +126,7 @@ func (s *StorageInterface) processQuery(q *query.Query, it *iterator.Iterator) {
return
}
if pid == process.UndefinedProcessID {
if pid == "" {
// processes
for _, proc := range process.All() {
func() {

View File

@@ -11,7 +11,7 @@ import (
)
var (
errInvalid = errors.New("IPHelper not initialzed or broken")
errInvalid = errors.New("IPHelper not initialized or broken")
)
// IPHelper represents a subset of the Windows iphlpapi.dll.