nbareil / net2pcap Goto Github PK

It would be convenient to support BPF filters in a minimal way, where the user provides directly the BPF opcodes.

Most of the work is already done by the tcpdump compiler, which can dump raw opcodes on stdout. We just need some glue (the following bpf2binary.py code) to import it into net2pcap through a setsockopt(s, SO_ATTACH_FILTER. ...)

#! /usr/bin/env python

import fileinput
import struct

out=[]
for line in fileinput.input():
    digits = map(int, line.split())
    if len(digits) != 4: # skip first line
        continue
    binary = struct.pack('=hbbI', *digits)
    out.append(binary)
print ''.join(out)

And then:

bpf_isn=$(tcpdump -i eth0 -ddd port 25 | ./bpf2binary.py)
net2pcap -i eth0 -F "$bpf_isn"

net2pcap shall use this ioctl instead of gettimeofday():

socket(7):

   SO_TIMESTAMP
          Enable or disable the receiving of the SO_TIMESTAMP control mes‐
          sage.    The  timestamp  control  message  is  sent  with  level
          SOL_SOCKET and the cmsg_data field is a struct timeval  indicat‐
          ing  the reception time of the last packet passed to the user in
          this call.  See cmsg(3) for details on control messages.

segoon@openwall reported that the promiscuous state was not restored on exit.

net2pcap should be able to listen on all interfaces at the same time.

On ^C, term_received is set to 1 in signal handler. SIGINT has the SA_RESTART flag enabled, that way, syscalls are automatically restarted. Which means that the termination will occured only at the next packet loop entry. On low-traffic network, next packet can arrive after several seconds.

Options available:

• Do not set SA_RESTART flag
• Replace the whole logic with signalfd()

The latter is the best option but will require a careful rewrite of the main loop.

UID and GID options should accept names.

If only UID is passed, net2pcap does not change GID, which could be misleading.

A good behavior would be change the GID to the primary group of the new UID.

(bugs found by segoon@openwall)