|
@@ -76,6 +76,8 @@ func findProcessName(network string, ip netip.Addr, port int) (string, error) {
|
|
|
// rup8(sizeof(xtcpcb_n))
|
|
|
itemSize += 208
|
|
|
}
|
|
|
+
|
|
|
+ var fallbackUDPProcess string
|
|
|
// skip the first xinpgen(24 bytes) block
|
|
|
for i := 24; i+itemSize <= len(buf); i += itemSize {
|
|
|
// offset of xinpcb_n and xsocket_n
|
|
@@ -90,10 +92,12 @@ func findProcessName(network string, ip netip.Addr, port int) (string, error) {
|
|
|
flag := buf[inp+44]
|
|
|
|
|
|
var srcIP netip.Addr
|
|
|
+ srcIsIPv4 := false
|
|
|
switch {
|
|
|
case flag&0x1 > 0 && isIPv4:
|
|
|
// ipv4
|
|
|
srcIP = netip.AddrFrom4(*(*[4]byte)(buf[inp+76 : inp+80]))
|
|
|
+ srcIsIPv4 = true
|
|
|
case flag&0x2 > 0 && !isIPv4:
|
|
|
// ipv6
|
|
|
srcIP = netip.AddrFrom16(*(*[16]byte)(buf[inp+64 : inp+80]))
|
|
@@ -101,13 +105,21 @@ func findProcessName(network string, ip netip.Addr, port int) (string, error) {
|
|
|
continue
|
|
|
}
|
|
|
|
|
|
- if ip != srcIP {
|
|
|
- continue
|
|
|
+ if ip == srcIP {
|
|
|
+ // xsocket_n.so_last_pid
|
|
|
+ pid := readNativeUint32(buf[so+68 : so+72])
|
|
|
+ return getExecPathFromPID(pid)
|
|
|
}
|
|
|
|
|
|
- // xsocket_n.so_last_pid
|
|
|
- pid := readNativeUint32(buf[so+68 : so+72])
|
|
|
- return getExecPathFromPID(pid)
|
|
|
+ // udp packet connection may be not equal with srcIP
|
|
|
+ if network == N.NetworkUDP && srcIP.IsUnspecified() && isIPv4 == srcIsIPv4 {
|
|
|
+ pid := readNativeUint32(buf[so+68 : so+72])
|
|
|
+ fallbackUDPProcess, _ = getExecPathFromPID(pid)
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ if network == N.NetworkUDP && len(fallbackUDPProcess) > 0 {
|
|
|
+ return fallbackUDPProcess, nil
|
|
|
}
|
|
|
|
|
|
return "", ErrNotFound
|