Re: Test if a socket accept is from external network

2021-05-04 Thread jim . cromie
On Sun, Apr 25, 2021 at 6:02 AM Jeffrey Walton wrote: > > On Sun, Apr 25, 2021 at 7:09 AM John Wood wrote: > > > > I'm working in a LSM to detect and mitigate fork brute force attacks > > against vulnerable userspace applications. Now, to fine tuning the > > detection I want to detect a network

Re: Test if a socket accept is from external network

2021-04-25 Thread John Wood
Hi, On Sun, Apr 25, 2021 at 08:01:55AM -0400, Jeffrey Walton wrote: > On Sun, Apr 25, 2021 at 7:09 AM John Wood wrote: > > > > I'm working in a LSM to detect and mitigate fork brute force attacks > > against vulnerable userspace applications. Now, to fine tuning the > > detection I want to

Re: Test if a socket accept is from external network

2021-04-25 Thread Jeffrey Walton
On Sun, Apr 25, 2021 at 7:09 AM John Wood wrote: > > I'm working in a LSM to detect and mitigate fork brute force attacks > against vulnerable userspace applications. Now, to fine tuning the > detection I want to detect a network activity. ... > How can I detect that an external connection

Test if a socket accept is from external network

2021-04-25 Thread John Wood
Hi, I'm working in a LSM to detect and mitigate fork brute force attacks against vulnerable userspace applications. Now, to fine tuning the detection I want to detect a network activity. To do so, I can use the following code in the "socket_sock_rcv_skb" hook: static int