google / google/gopacket

Allow configuration of SEESENT in bsdbpf BPF sniffer

Open
#1,053 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
6.8k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Right now, there is no way to set the `SEESENT` parameter of the BPF packet capturing system in bsdbpf.

Since I use the system for creating a VPN interface (best way to create a TAP-type VPN on macOS known so far afaik), I have no interest in the sent packets at all. In fact, I explicitly do not want to handle them.

BPF does offer the `SEESENT` ioctl for this. Sadly, while the BPF sniffer allows configuring almost all other options I need, this one is not supported.

Right now, the way I work around this problem is with some quite hacky reflection, like (for full context refer to: https://github.com/Doridian/water/blob/main/syscalls_darwin.go#L237-L262 ):
```go
bpfCapture, err := bsdbpf.NewBPFSniffer(.....)

[...]

bpfFd := getPrivateField(bpfCapture, "fd").(int)
var enable int = 0
_, _, errno = syscall.Syscall(syscall.SYS_IOCTL, uintptr(bpfFd), uintptr(syscall.BIOCSSEESENT), uintptr(unsafe.Pointer(&enable)))
if errno != 0 {
bpfCapture.Close()
closer.Close()
return nil, fmt.Errorf("bpf ioctl error = %d", errno)
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.