Como posso farejar o soquete dgram do unix sem ter o caminho do arquivo?

Question

De artigo , percebi que:

a UNIX domain socket is bound to a file path.

Então, eu preciso sniffar o soquete do DGRAM Unix através do socat como mencionado aqui . Mas quando tento recuperar o caminho para esse propósito, descubro que o aplicativo de destino usa um soquete sem caminho de arquivo.

O comando ss -apex mostra resultados com e sem caminhos de arquivo, por exemplo:

u_dgr UNCONN 0 0 /var/lib/samba/private/msg.sock/32222   1345285 * 0   users:(("nmbd",pid=32222,fd=7))
u_dgr UNCONN 0 0 * 8567674   * 0   users:(("gnome-shell",pid=16368,fd=23))

Na página de manual ss não consigo descobrir, o que significa por exemplo * 8567674 sem caminho de arquivo.

Então, duas perguntas:

1. Por que não há caminho de arquivo para o soquete unix em alguns casos?
2. Como posso farejar o soquete DGRAM através de socat sem ter o caminho do arquivo?

Answer 1

Pergunta # 1

Q1: From the ss man page I can't find out, what does it mean e.g. * 8567674 without file path.

De os documentos, explica a coluna Endereço: Porta assim:

trecho

The format and semantics of ADDRESS_PATTERN depends on address family.

• inet - ADDRESS_PATTERN consists of IP prefix, optionally followed by colon and port. If prefix or port part is absent or replaced with *, this means wildcard match.
• inet6 - The same as inet, only prefix refers to an IPv6 address. Unlike inet colon becomes ambiguous, so that ss allows to use scheme, like used in URLs, where address is suppounded with [ ... ].
• unix - ADDRESS_PATTERN is shell-style wildcard.
• packet - format looks like inet, only interface index stays instead of port and link layer protocol id instead of address.
• netlink - format looks like inet, only socket pid stays instead of port and netlink channel instead of address.

PORT is syntactically ADDRESS_PATTERN with wildcard address part. Certainly, it is undefined for UNIX sockets.

A última sentença é sua resposta.

Pergunta # 2

Q2: Why there is no file path to unix socket for some cases?

Veja isto SO Q & A intitulado: Como usar o soquete do domínio unix sem criar um arquivo de soquete .

trecho

You can create a unix domain socket with an "abstract socket address". Simply make the first character of the sun_path string in the sockaddr_un you pass to bind be '

Q3: How can I sniff unix DGRAM socket through socat without having file path?

'. After this initial NUL, write a string to the remainder of sun_path and pad it out to UNIX_PATH_MAX with NULs (or anything else).

Sockets created this way will not have any filesystem entry, ....

Pergunta # 3

• ABSTRACT-LISTEN:
• ABSTRACT-SENDTO:
• ABSTRACT-RECVFROM:
• ABSTRACT-RECV:
• ABSTRACT-CLIENT: >

  The ABSTRACT addresses are almost identical to the related UNIX addresses except that they do not address file system based sockets but an alternate UNIX domain address space. To archive this the socket address strings are prefixed with "%bl0ck_qu0te%" internally. This feature is available (only?) on Linux. Option groups are the same as with the related UNIX addresses, except that the ABSTRACT addresses are not member of the NAMED group.

  Mais uma vez, googling, uma vez que você sabe o que as coisas são chamadas: documentos socat .

  trecho %bl0ck_qu0te%