mondoohq / cnquery

open source, cloud-native, graph-based asset inventory
https://cnquery.io
Other
320 stars 21 forks source link

port resource does not show process information for each port #549

Closed czunker closed 1 year ago

czunker commented 1 year ago

Describe the bug Querying an Ubuntu 22.04 box, the results looks like this:

ports.list: [
  port port=53 protocol="tcp" address="127.0.0.53" process.executable=no data available
  port port=22 protocol="tcp" address="0.0.0.0" process.executable="sshd:"
  port port=22 protocol="tcp" address="10.0.2.15" process.executable="sshd:"
  port port=22 protocol="tcp" address="10.0.2.15" process.executable="sshd:"
  port port=53 protocol="udp" address="127.0.0.53" process.executable="/lib/systemd/systemd-resolved"
  port port=68 protocol="udp" address="10.0.2.15" process.executable="/lib/systemd/systemd-networkd"
]

The first row is missing process information. But it should be the same as the other line for port 53 near the end.

To Reproduce Steps to reproduce the behavior:

  1. Start up Ubuntu 22.04
  2. Query: e.g. cnquery run --sudo ssh -i /home/christian/workspace/mondoo/examples/.vagrant/machines/default/virtualbox/private_key vagrant@127.0.0.1:2222 -c "ports"
  3. See output like above

Expected behavior The first line should include the same information as the other line for port 53.

Screenshots or CLI Output

Desktop (please complete the following information):

Additional context

czunker commented 1 year ago

To obtain the information, lsof is used.

Having a look at the output, lsof combines udp and tcp for the process:

vagrant@ubuntu-jammy:~$ sudo lsof -a -i -p 568 -F
p568
g568
R1
csystemd-resolve
u101
Lsystemd-resolve
f13
au
l 
tIPv4
G0x80802;0x0
d15357
o0t0
PUDP
nlocalhost:domain
TQR=0
TQS=0
f14
au
l 
tIPv4
G0x80802;0x0
d15358
o0t0
PTCP
nlocalhost:domain
TST=LISTEN
TQR=0
TQS=0
czunker commented 1 year ago

Fixed by https://github.com/mondoohq/cnquery/pull/531