LD_PRELOAD & Sockets

From: David Oxley (googlenews2_at_curzon-dax.co.uk)
Date: 01/25/04 

Date: Sun, 25 Jan 2004 17:23:20 +0000

Hi..

I am writing an interposer that [for the purposes of this post] logs
whenever an application calls socket() and/or close()

The interposing library is called rw.so, and I run with:

$LD_PRELOAD=./rw.so telnet foo.bar discard

The good news is that for the main 'conversation', the interposer correctly
catches the socket() call and the corresponding close() call.

The bad news is that somewhere along the line, telnet calls (I presume)
gethostbyname() to resolve foo.bar. By means of strace, I can see that the
socket created to query my DNS server is logged by the interposer, but the
corresponding close() is not, even though strace shows telnet calling a
close().

Note that the close() after the telnet session is correctly recorded.

How what do I need to do to correctly pick up this call?

Ideally/eventually, I was hoping to allocate some memory as part of the
interposed socket() call, and deallocate the memory after the close()
call such that I can work with individual connections. However, if it
turns out that I cannot intercept the close() call reliably, could anyone
suggest a safer way (wrt memory leaks etc.) that I can pick out the 'start' and
'end' of a connection?

Source:
int close(int fd)
{
  static int (*func)();
  func = (int (*)()) dlsym(RTLF_NEXT, "close");
  printf("close %d\n", fd);
  return func(fd);
}

int socket(int domain, int type, int protocol)
{
  static int (*func)(); int theSocket;
  func = (int (*)()) dlsym(RTLD_NEXT, "socket");
  theSocket = func(domain, type, protocol);
  printf("socket %d\n", theSocket);
  return theSocket;
}

Compile string:
cc rw.c -o rw.so -shared -ldl

(Code etc. 'borrowed' from:
http://developers.sun.com/solaris/articles/lib_interposers_code.html
)

Thanks,
David

Relevant Pages

  • Re: Linux 2.6.29.4
    ... static int is_efer_nx ... if (ret) ... struct ftdi_private { ... the specific security attributes of the socket ...
    (Linux-Kernel)
  • [PATCH] paccept, socket, socketpair w/flags
    ... there is a helper function to convert the new socket flags into ... socket() and socketpair. ... static int status; ... int fd1, fd2, err; ...
    (Linux-Kernel)
  • Re: reconnect tcp
    ... instance throws a fatal exception, ... to close the socket and reconnect. ... public ClientHandler(Socket client, int timeout) ... while (rxDataCounter < receiveBytes) ...
    (microsoft.public.dotnet.languages.csharp)
  • [PATCH] socket, socketpair w/flags, accept4
    ... helper function to convert socket flags into file flags. ... int status = 0; ... puts; ... int fd1, fd2, err; ...
    (Linux-Kernel)
  • [PATCH 11/23] Staging: USB/IP: add common functions needed
    ... new file mode 100644 ... * GNU General Public License for more details. ... +static void usbip_dump_pipe(unsigned int p) ... +int setquickack(struct socket *socket) ...
    (Linux-Kernel)