Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

more exact bpf filter #941

Merged
merged 2 commits into from
Jun 9, 2021
Merged

more exact bpf filter #941

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9a2187f
more exact bpf filter for only incoming traffic
DimaGolomozy Jun 9, 2021
061a02e
evaluate filters for each nic
DimaGolomozy Jun 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 58 additions & 34 deletions capture/capture.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"net"
"os"
"runtime"
"strings"
"sync"
"time"

Expand Down Expand Up @@ -170,21 +171,31 @@ func (l *Listener) ListenBackground(ctx context.Context, handler PacketHandler)
func (l *Listener) Filter(ifi net.Interface) (filter string) {
// https://www.tcpdump.org/manpages/pcap-filter.7.html

port := fmt.Sprintf("portrange 0-%d", 1<<16-1)
if l.port != 0 {
port = fmt.Sprintf("port %d", l.port)
hosts := []string{l.host}
if listenAll(l.host) || isDevice(l.host, ifi) {
hosts = interfaceAddresses(ifi)
}
filter = fmt.Sprintf("%s dst %s", l.Transport, port)
if l.trackResponse {
filter = fmt.Sprintf("%s %s", l.Transport, port)

filter = portsFilter(l.Transport, "dst", l.port)

if len(hosts) != 0 {
filter = fmt.Sprintf("((%s) and (%s))", filter, hostsFilter("dst", hosts))
} else {
filter = fmt.Sprintf("(%s)", filter)
}

if listenAll(l.host) || isDevice(l.host, ifi) {
return "(" + filter + ")"
if l.trackResponse {
responseFilter := portsFilter(l.Transport, "src", l.port)

if len(hosts) != 0 {
responseFilter = fmt.Sprintf("((%s) and (%s))", responseFilter, hostsFilter("src", hosts))
} else {
responseFilter = fmt.Sprintf("(%s)", responseFilter)
}

filter = fmt.Sprintf("%s or %s", filter, responseFilter)
}
filter = fmt.Sprintf("(host %s and (%s))", l.host, filter)

log.Println("BPF filter: " + filter)
return
}

Expand Down Expand Up @@ -259,13 +270,7 @@ func (l *Listener) PcapHandle(ifi net.Interface) (handle *pcap.Handle, err error
if err != nil {
return nil, fmt.Errorf("PCAP Activate device error: %q, interface: %q", err, ifi.Name)
}
if l.BPFFilter != "" {
if l.BPFFilter[0] != '(' || l.BPFFilter[len(l.BPFFilter)-1] != ')' {
l.BPFFilter = "(" + l.BPFFilter + ")"
}
} else {
l.BPFFilter = l.Filter(ifi)
}
l.BPFFilter = l.Filter(ifi)
fmt.Println("Interface:", ifi.Name, ". BPF Filter:", l.BPFFilter)
err = handle.SetBPFFilter(l.BPFFilter)
if err != nil {
Expand All @@ -284,13 +289,7 @@ func (l *Listener) SocketHandle(ifi net.Interface) (handle Socket, err error) {
if err = handle.SetPromiscuous(l.Promiscuous || l.Monitor); err != nil {
return nil, fmt.Errorf("promiscuous mode error: %q, interface: %q", err, ifi.Name)
}
if l.BPFFilter != "" {
if l.BPFFilter[0] != '(' || l.BPFFilter[len(l.BPFFilter)-1] != ')' {
l.BPFFilter = "(" + l.BPFFilter + ")"
}
} else {
l.BPFFilter = l.Filter(ifi)
}
l.BPFFilter = l.Filter(ifi)
fmt.Println("BPF Filter: ", l.BPFFilter)
if err = handle.SetBPFFilter(l.BPFFilter); err != nil {
handle.Close()
Expand Down Expand Up @@ -416,16 +415,12 @@ func (l *Listener) activatePcapFile() (err error) {
if handle, e = pcap.OpenOffline(l.host); e != nil {
return fmt.Errorf("open pcap file error: %q", e)
}
if l.BPFFilter != "" {
if l.BPFFilter[0] != '(' || l.BPFFilter[len(l.BPFFilter)-1] != ')' {
l.BPFFilter = "(" + l.BPFFilter + ")"
}
} else {
addr := l.host
l.host = ""
l.BPFFilter = l.Filter(net.Interface{})
l.host = addr
}

tmp := l.host
l.host = ""
l.BPFFilter = l.Filter(net.Interface{})
l.host = tmp

if e = handle.SetBPFFilter(l.BPFFilter); e != nil {
handle.Close()
return fmt.Errorf("BPF filter error: %q, filter: %s", e, l.BPFFilter)
Expand Down Expand Up @@ -481,6 +476,18 @@ func isDevice(addr string, ifi net.Interface) bool {
return addr == ifi.Name || addr == fmt.Sprintf("%d", ifi.Index) || (addr != "" && addr == ifi.HardwareAddr.String())
}

func interfaceAddresses(ifi net.Interface) []string {
var hosts []string
if addrs, err := ifi.Addrs(); err == nil {
for _, addr := range addrs {
if ip := addr.(*net.IPNet).IP.To16(); ip != nil {
hosts = append(hosts, ip.String())
}
}
}
return hosts
}

func listenAll(addr string) bool {
switch addr {
case "", "0.0.0.0", "[::]", "::":
Expand All @@ -489,6 +496,23 @@ func listenAll(addr string) bool {
return false
}

func portsFilter(transport string, direction string, port uint16) string {
if port == 0 {
return fmt.Sprintf("%s %s portrange 0-%d", transport, direction, 1<<16-1)
}

return fmt.Sprintf("%s %s port %d", transport, direction, port)
}

func hostsFilter(direction string, hosts []string) string {
var hostsFilters []string
for _, host := range hosts {
hostsFilters = append(hostsFilters, fmt.Sprintf("%s host %s", direction, host))
}

return strings.Join(hostsFilters, " or ")
}

func pcapLinkTypeLength(lType int) (int, bool) {
switch layers.LinkType(lType) {
case layers.LinkTypeEthernet:
Expand Down