lkml.org 
[lkml]   [2011]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [EXAMPLE CODE] Parasite thread injection and TCP connection hijacking
On 08/06/2011 08:12 AM, Tejun Heo wrote:
> Hello, guys.
>
> So, here's transparent TCP connection hijacking (ie. checkpointing in
> one process and restoring in another) which adds only relatively small
> pieces to the kernel. It's by no means complete but already works
> rather reliably in my test setup even with heavy delay induced with
> tc.
>
> I wrote a rather long README describing how it's working, what's
> missing which is appended at the end of this mail so if you're
> interested in the details please go ahead and read.

That's a little gross but quite cool.

I think you have an annoying corner case, though:

> 2. Decide where to inject the foreign code and save the original code
> with PTRACE_PEEKDATA. Tracer can poke any mapped area regardless
> of protection flags but it can't add execution permission to the
> code, so it needs to choose memory area which already has X flag
> set. The example code uses the page the %rip is in.

If the process is executing from the vsyscall page, then you'll probably
fail. (Admittedly, this is rather unlikely, given that the vsyscalls
are now exactly one instruction.) Presumably you also fail if executing
from a read-only MAP_SHARED mapping.

Windows has a facility to more-or-less call mmap on behalf of another
process, and another one to directly inject a thread into a remote
process. It's traditional to use them for this type of manipulation.
Perhaps Linux should get the same thing. (Although you could accomplish
much the same thing if you could create a task with your mm but the
tracee's fs.)

--Andy


\
 
 \ /
  Last update: 2011-08-06 14:49    [from the cache]
©2003-2011 Jasper Spaans