Skip to content

Fix min_refresh_interval() side effect#6

Open
theogilbert wants to merge 2 commits into
kaegi:masterfrom
theogilbert:fix-min-refresh-interval-side-effect
Open

Fix min_refresh_interval() side effect#6
theogilbert wants to merge 2 commits into
kaegi:masterfrom
theogilbert:fix-min-refresh-interval-side-effect

Conversation

@theogilbert

@theogilbert theogilbert commented Dec 13, 2020

Copy link
Copy Markdown

When PacketMatcher cannot find a PID associated to a connection, it refreshes its mapping tables and then tries to find the connection's PID, which will be bound to the connection until the connection is dropped.

But there is a scenario which causes a connection's packets to never be assigned to a process:

  1. A min_refresh_interval is set, to let's say 20ms
  2. A packet is captured from a new connection:
    a. refresh() is called, updating the connection / inode / PID mapping tables
    b. These tables are used to retrieve the PID associated to the connection
  3. A second creation is created a few ms after the first one and a packet from this connection is captured
    a. refresh() is called, but because of the min_refresh_interval, the mapping tables are not updated
    b. The mapping tables only contains data known at the step 2.b, and do not include this new connection.
    c. The return value of self.tables.map_connection(), in this case None, is assigned to the connection

From now on, all captured packets from this connection will never be assigned to a process.

To fix this behavior, I propose to attempt a refresh() in find_pid_cached(), when no PID is assigned to the connection. refresh() will then call update_known_connection() which will try to assign a PID from the updated mapping tables.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant