Network Events Connector

Idea

The main idea is to capture events coming from userspace, whenever a processus is doing some network syscall (sys_listen, sys_bind, ..). For that, it's seems that LSM structure is the most simple, as far as we just have to connect on LSM hooks with struct security_operations {}

This project is no longer supported. See project snet for update

goal of the network events connector
Fig 0. goal of the network events connector

Tools

The Network Events Connector can be extended in order to be fully useful, and for that, the cn_net_daemon is using D-Bus, as a abstract layer, then all tools can use data coming from kernel. For exemple, the application cn_net_sql is able to listen for DATA messages coming from kernel, and to send its content to a sql database, in order to log or to analyse it.
global architecture
Fig 1. global architecture

Protocol

Here is the kernel to userspace protocol.
userspace <-> kernel protocol
Fig 2. userspace <-> kernel protocol

Architecture

So there is the connector callback cn_net_ctl() which is receiving messages from userspace and is dealing with the msg_type. There is also the struct security_operations {} which is catching the network events, and then we dealing with user configuration.
Internal architecture
Fig 3. internal architecture

gcn_net : Gtk-frontend to cn_net

Now, there is also a gtk status icon for managing cn_net.
Here are screenshoots
notifying user
Fig 4. notifying user
If user clicks on 'Process' from the above notification, the next dialog is displayed
'Create a rule' dialog
Fig 5. 'Create a rule' dialog
There is also a 'security console' for managing rules
'Security console' dialog
Fig 6. 'Security console' dialog
Others screenshoots

Futur / todo

First version - no update for it Second version

Patchs

First version - you are strongly recommended to not use this version. It's more a proof of concept than a software.

Links

Thanks

Evgeniy Polyakov
Arnaldo Carvalho de Melo <acme at redhat dot com>
Luiz Capitulino <lcapitulino at mandriva dot com>
Frédéric Crozat <fcrozat at mandriva dot com> on DBus

Contact

Samir Bellabes <sam at synack dot fr>

Last modified: Mon Jan 19 04:13:14 CET 2009