Запись pid процесса в логах iptables

-A OUTPUT -j LOG  -m owner --pid-owner 0:65535 --log-prefix "CHAIN=WALL-OUTPUT-REJECT "

owner
       This module attempts to match various characteristics of the packet creator, for locally generated packets. This match is only valid in the OUTPUT and POSTROUTING chains. Forwarded packets do not have  any  socket  associated
       with them. Packets from kernel threads do have a socket, but usually no owner.

       [!] --uid-owner username

       [!] --uid-owner userid[-userid]
              Matches if the packet socket's file structure (if it has one) is owned by the given user. You may also specify a numerical UID, or an UID range.

       [!] --gid-owner groupname

       [!] --gid-owner groupid[-groupid]
              Matches if the packet socket's file structure is owned by the given group.  You may also specify a numerical GID, or a GID range.

       [!] --socket-exists
              Matches if the packet is associated with a socket.

sk               Eth Pid        Groups   Rmem     Wmem     Dump  Locks    Drops    Inode
ffff8bb571d99000 0   736        00000111 0        0        0     2        0        19997   
ffff8bb5fb6b0800 0   725        00000001 0        0        0     2        0        29882   
ffff8bb5efc65000 0   24624      00000001 0        0        0     2        0        295865  
ffff8bb5f937e800 0   3711       00000440 0        0        0     2        0        37054   
ffff8bb5fcb08000 0   0          00000000 0        0        0     2        0        16      
ffff8bb5fa4c7000 0   784        00000110 0        0        0     2        0        21468   
ffff8bb5fabd4000 0   1610613451 00000559 0        0        0     2        0        19351   
ffff8bb5fa43c800 0   820        00000440 0        0        0     2        0        23001   
ffff8bb5f6c88000 0   18004      00000440 0        0        0     2        0        267566  
ffff8bb5f7ba7800 0   29663      00000555 0        0        0     2        0        321564  
ffff8bb5fb593000 0   600        00000111 0        0        0     2        0        17855   
ffff8bb573af1000 4   0          00000000 0        0        0     2        0        14793   
ffff8bb5fc1cb800 7   0          00000000 0        0        0     2        0        14309   
ffff8bb5fcbb9800 9   1          00000001 0        0        0     2        0        594     
ffff8bb5735a7000 9   2962479525 00000000 0        0        0     2        0        15570   
ffff8bb5fb6b1000 9   715        00000000 0        0        0     2        0        29924   
ffff8bb5fcb0d800 9   0          00000000 0        0        0     2        0        17      
ffff8bb5fc1cb000 10  0          00000000 0        0        0     2        0        11352   
ffff8bb5fcb9d800 11  0          00000000 0        0        0     2        0        1031    
ffff8bb5f937e000 12  0          00000000 0        0        0     2        0        47789   
ffff8bb5efc65800 12  24624      00000000 0        0        0     2        0        295856  
ffff8bb5f7616000 15  3836794873 00000002 0        0        0     2        0        20824   
ffff8bb571d99800 15  723        00000002 0        0        0     2        0        20005   
ffff8bb5f7606800 15  1511       00000002 0        0        0     2        0        26005   
ffff8bb5fabd4800 15  2636889160 00000002 0        0        0     2        0        18758   
ffff8bb5fcbba000 15  2291138884 00000001 0        0        0     2        0        602     
ffff8bb5fcaae800 15  0          00000000 0        0        0     2        0        1025    
ffff8bb5f7601000 15  1594       00000002 0        0        0     2        0        26454   
ffff8bb5fa43c000 15  1191       00000002 0        0        0     2        0        25012   
ffff8bb5fa43e000 15  1535       00000002 0        0        0     2        0        26721   
ffff8bb5f7613800 15  5082       00000002 0        0        0     2        0        40617   
ffff8bb5fa4c3800 15  774        00000002 0        0        0     2        0        23727   
ffff8bb5f7614800 15  2191364862 00000002 0        0        0     2        0        20853   
ffff8bb5fabd6000 15  719        00000002 0        0        0     2        0        18757   
ffff8bb5fabd3800 15  3233224358 00000002 0        0        0     2        0        18759   
ffff8bb5fa4c2000 15  1442       00000002 0        0        0     2        0        25812   
ffff8bb571d9d800 15  738        00000002 0        0        0     2        0        20013   
ffff8bb5fa4c1000 15  1173       00000002 0        0        0     2        0        24165   
ffff8bb571d9e800 15  2726952585 00000002 0        0        0     2        0        20068   
ffff8bb5fabd1000 15  715        00000002 0        0        0     2        0        19350   
ffff8bb5fa4c4800 15  2516813335 00000002 0        0        0     2        0        24176   
ffff8bb5fabd0000 15  3603749704 00000002 0        0        0     2        0        18760   
ffff8bb5fa4c1800 15  1465       00000002 0        0        0     2        0        25821   

opensnitch-master\daemon\procmon\ 

opensnitch-master\daemon\conman\

func newConnectionImpl(nfp *netfilter.Packet, c *Connection) (cr *Connection, err error) {
	// no errors but not enough info neither
	if c.parseDirection() == false {
		return nil, nil
	}

	// 1. lookup uid and inode using /proc/net/(udp|tcp)
	// 2. lookup pid by inode
	// 3. if this is coming from us, just accept
	// 4. lookup process info by pid
	if c.Entry = netstat.FindEntry(c.Protocol, c.SrcIP, c.SrcPort, c.DstIP, c.DstPort); c.Entry == nil {
		return nil, fmt.Errorf("Could not find netstat entry for: %s", c)
	} else if pid := procmon.GetPIDFromINode(c.Entry.INode); pid == -1 {
		return nil, fmt.Errorf("Could not find process id for: %s", c)
	} else if pid == os.Getpid() {
		return nil, nil
	} else if c.Process = procmon.FindProcess(pid); c.Process == nil {
		return nil, fmt.Errorf("Could not find process by its pid %d for: %s", pid, c)
	}
	return c, nil

}

func GetPIDFromINode(inode int) int {
	expect := fmt.Sprintf("socket:[%d]", inode)
	found := -1

	forEachProcess(func(pid int, path string, args []string) bool {
		// for every descriptor
		fdPath := fmt.Sprintf("/proc/%d/fd/", pid)
		if descriptors, err := ioutil.ReadDir(fdPath); err == nil {
			for _, desc := range descriptors {
				descLink := fmt.Sprintf("%s%s", fdPath, desc.Name())
				// resolve the symlink and compare to what we expect
				if link, err := os.Readlink(descLink); err == nil && link == expect {
					found = pid
					return true
				}
			}
		}
		// keep looping
		return false
	})

	return found
} 

func FindProcess(pid int) *Process {
	linkName := fmt.Sprintf("/proc/%d/exe", pid)
	if core.Exists(linkName) == false {
		return nil
	}

	if link, err := os.Readlink(linkName); err == nil && core.Exists(link) == true {
		proc := NewProcess(pid, link)

		parseCmdLine(proc)
		parseEnv(proc)

		return proc
	}
	return nil
}

How Does It Work

OpenSnitch is an application level firewall, meaning then while running, it will detect and alert the user for every outgoing connection applications he's running are creating. This can be extremely effective to detect and block unwanted connections on your system that might be caused by a security breach, causing data exfiltration to be much harder for an attacker. In order to do that, OpenSnitch relies on NFQUEUE, an iptables target/extension which allows an userland software to intercept IP packets and either ALLOW or DROP them, once started it'll install the following iptables rules:

OUTPUT -t mangle -m conntrack --ctstate NEW -j NFQUEUE --queue-num 0 --queue-bypass

This will use conntrack iptables extension to pass all newly created connection packets to NFQUEUE number 0 (the one OpenSnitch is listening on), and then:

INPUT --protocol udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass

This will also redirect DNS queries to OpenSnitch, allowing the software to perform and IP -> hostname resolution without performing active DNS queries itself.

Once a new connection is detected, the software relies on the ftrace kernel extension in order to track which PID (therefore which process) is creating the connection.

If ftrace is not available for your kernel, OpenSnitch will fallback using the /proc filesystem, even if this method will also work, it's vulnerable to application path manipulation as described in this issue, therefore it's highly suggested to run OpenSnitch on a ftrace enabled kernel.

https://habr.com/en/company/itsumma/blog/441258/

https://github.com/iovisor/bpftrace