Roman Divacky wrote:
> hi
>
> in update 3 the ip_fanout_tcp changed to (I think)
> ipst->ips_ipcl_conn_fanout. This makes pidentd and lsof non-function as those
> look up this symbol in /dev/kmem and map user names (uids) to socket
> connections using the ip_fanout_tcp list of tcp connections in CONNECTED
> state.
>
> so I'd like to know if there's any way I can hack pidentd to look this up in
> /dev/kmem now. or alternatively I think this (in-kernel) code snippet should
> work. so if there's no way I'll go in this direction
You can walk the netstack_t's from netstack_head. If all you care about
is the global zone (and any shared-IP zones) then those will always be
the first element in the list i.e. something like
netstack_head->netstack_ip->ips_ipcl_conn_fanout
But if you want to handle exlusive-IP zones running their own pidentd
then you need to move away from /dev/kmem and instead implement a kernel
function (and ioctl or syscall to get at it) which takes the zoneid into
account. Your function below is a start:
> get_ucred_for_connection(...) {
> netstack_handle_t nh;
> netstack_t *ns;
> connt_t conn;
>
> netstack_next_init(&nh);
> while ((ns = netstack_next(&nh)) != NULL) {
> conn = ipcl_lookup_listener_v4(LPORT, LADDR, PROTOCOL, getzoneid(),
> ns->netstat_tcp);
> netstack_rele(ns);
> if (conn != NULL) {
> netstack_next_fini(&nh);
> return conn;
> }
> }
> netstack_next_fini(&nh);
>
> return NULL;
> }
... but you don't want to walk all the netstacks (you can have different
netstacks all using 10.0.0.1 as a local address). Instead you'd look up
the netstack based on the cred.
If you have user context you'd do something like:
zoneid = getzoneid();
ns = netstack_find_by_cred(CRED());
/*
* For exclusive stacks we set the zoneid to zero
* to make TCP operate as if in the global zone.
*/
if (ns->netstack_stackid != GLOBAL_NETSTACKID)
zoneid = GLOBAL_ZONEID;
conn = ipcl_lookup...;
netstack_rele(ns);
Erik
> I hope you can comment on whether I can easily list connections by reading
> /dev/kmem in post update3 solaris or if my kernel-module approach (accessed
> via syscall I guess) is correct.
>
> thnx, Roman Divacky
>
>
> This message posted from opensolaris.org
> _______________________________________________
> networking-discuss mailing list
> [email protected]
_______________________________________________
networking-discuss mailing list
[email protected]
