Hey there,

i am trying to modify the connect() syscall from the socket.c kernel file, so i can get information about the source port connected to a foreign address' port. I assume that the information I need must either be stored in "struct sockaddr __user* uservaddr" which the syscall takes as parameter or in "struct socket *sock" inside the syscall, but I am only able to find the destination port (e.g. port 80 when using wget).

But where can I access the variable storing the local port? As far as I know, a local port must be defined somewhere at this point.

Thanks in advance for your help!

That's a pretty 'meaty' question for Linux system programmers to field. I will drill
down in the code and see what I can see (and understand). What OS and kernel version
are you running? I run Fedora Release 26 in production and the kernel version is
4.10.13. I have some 4.12 kernels on my Debian machines. I will check back later
with my findings and get an update on your platform.

Google search birthed a couple of good links:

How to get ip address from sock structure in c?
http://tinyurl.com/y7e93d8h

Getting the source address of an incoming socket connection
http://tinyurl.com/y98rqlrh

hey sixerjman,

thank you for your reply. I am modifying an Openwrt embedded Linux with Kernel v3.18.

I want to clearify two things: First of all, I am not looking for the source address, but for the source port! The second thing is that both of your links refer to user space functions.

I did some research with an old book about kernel development and i found out that the socket.c file mainly deals with the OSI application layer and on this level, source and destination ports of sockets are not defined yet, so i have to go deeper to transport layer (tcp.c and udp.c in the Linux kernel). I am not sure if this is right, but i will do some further evaluation. I hope this will be the solution.

Nevertheless, if someone still has a way to get source ports from the connect() syscall, feel free to contribute!

Ah, yes! My apologies, I missed the detail about extracting the port number in the connect() call from your original post in my haste to reply. Thank you for the clarification about the Linux version and the openwrt platform. I will once again drill down and see what I can see. Thank you for the fascinating problem.

This article 'Bind before Connect' sheds light on the internals of source port allocation. Hopefully this may help targeting where to modify code to report the source code: https://idea.popcount.org/2014-04-03...efore-connect/