Override read function, but i have problems when the file descripot is 3 or 4

Question

I want to override the read function of netstat -tunap, when am running the strace for netstat -tunap the part that i am interested on overriding is this part right here,

openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3
read(3, "  sl  local_address rem_address "..., 4096) = 300
write(1, "tcp        0      0 192.168.32.1"..., 101tcp        0      0 192.168.32.128:59904    192.168.32.129:9001     ESTABLISHED 17186/python ) = 101
read(3, "", 4096)                       = 0
close(3)

What i want is to see the contents of the buffer of this line here

read(3, "  sl  local_address rem_address "..., 4096) = 300

But the read librbary that am LD_PREALOADING is only prints me the buffers of reads with file descriptors of 5, This is how the read looks with file descriptor 5

read(5, "unconfined\n", 4095)           = 11

how can i fix it to get it to print the buffers with file descriptor of 3 as well?

This is the program I used for the library,

#define _GNU_SOURCE
#include <stdio.h>
#include <dlfcn.h>
#include <unistd.h>

static ssize_t (*read_original)(int fd, void *buf, size_t count) = NULL;

ssize_t read(int fd, void *buf, size_t count) {
    ssize_t result;

    // Initialize the original read function if it hasn't been already
    if (!read_original) {
        read_original = dlsym(RTLD_NEXT, "read");
        if (!read_original) {
            fprintf(stderr, "Error: Unable to load the original read function\n");
            return -1;
        }
    }

    // Call the original read function
    result = read_original(fd, buf, count);

    // Print the buffer's contents for non-zero reads
    if (result > 0 && (fd == 3 || fd == 4 || fd == 5)) {
        printf("Read from fd %d, %zd bytes: ", fd, result);
        for (ssize_t i = 0; i < result; ++i) {
            printf("%02x ", ((unsigned char *)buf)[i]);
        }
        printf("\n");
    }

    return result;
}

I create the library like this

gcc -shared -fPIC -o hider.so hide_read4.c -ldl

and i run it like this

LD_PRELOAD=/path/to/lib/hider.so netstat -tunap

And this is the output when I run this command

Read from fd 5, 11 bytes: 75 6e 63 6f 6e 66 69 6e 65 64 0a 
Read from fd 5, 11 bytes: 75 6e 63 6f 6e 66 69 6e 65 64 0a 
Read from fd 5, 11 bytes: 75 6e 63 6f 6e 66 69 6e 65 64 0a 
(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 ip1:59904    ip2:9001     ESTABLISHED 17186/python        
udp        0      0 ip1:68       ip3:67       ESTABLISHED -

Answer 1

netstat uses fgets() in this case to read lines from /proc/net/tcp. Using ltrace netstat -tunap tool, these calls in the strace output:

openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3
read(3, "  sl  local_address rem_address "..., 4096) = 300
write(1, "tcp        0      0 192.168.32.1"..., 101tcp        0      0 192.168.32.128:59904    192.168.32.129:9001     ESTABLISHED 17186/python ) = 101
read(3, "", 4096)                       = 0
close(3)

map to the following library calls:

fopen64("/proc/net/tcp", "r")                                                               = 0x564c3a8172a0
setvbuf(0x564c3a8172a0, 0x564c3a81a8a0, 0, 4096)                                            = 0
fgets("  sl  local_address rem_address "..., 8192, 0x564c3a8172a0)                          = 0x7fff68214ac0
feof(0x564c3a8172a0)                                                                        = 0
  .
  .
  .
fgets("  28: 9801A8C0:A6D4 6310FB8E:01B"..., 8192, 0x564c3a8172a0)                          = 0
feof(0x564c3a8172a0)                                                                        = 1
fclose(0x564c3a8172a0)                                                                      = 0