Re: [EXAMPLE CODE] Parasite thread injection and TCP connection hijacking

On 08/06/2011 08:12 AM, Tejun Heo wrote:

Hello, guys.

So, here's transparent TCP connection hijacking (ie. checkpointing in
one process and restoring in another) which adds only relatively small
pieces to the kernel.  It's by no means complete but already works
rather reliably in my test setup even with heavy delay induced with
tc.

I wrote a rather long README describing how it's working, what's
missing which is appended at the end of this mail so if you're
interested in the details please go ahead and read.

That's a little gross but quite cool.

I think you have an annoying corner case, though:

2. Decide where to inject the foreign code and save the original code
   with PTRACE_PEEKDATA.  Tracer can poke any mapped area regardless
   of protection flags but it can't add execution permission to the
   code, so it needs to choose memory area which already has X flag
   set.  The example code uses the page the %rip is in.

If the process is executing from the vsyscall page, then you'll probably fail.  (Admittedly, this is rather unlikely, given that the vsyscalls are now exactly one instruction.)  Presumably you also fail if executing from a read-only MAP_SHARED mapping.

Windows has a facility to more-or-less call mmap on behalf of another process, and another one to directly inject a thread into a remote process.  It's traditional to use them for this type of manipulation. Perhaps Linux should get the same thing.  (Although you could accomplish much the same thing if you could create a task with your mm but the tracee's fs.)

--Andy