google / google/gvisor

Add promiscuous mode capture support w/ tcpdump

Open
#3,333 1 comment 0 reactions 0 assignees View on GitHub
area: compatibility area: networking type: enhancement
Dominant language
Go
Stars
19.3k
Forks
2k
Avg merge
3d 5h
Merged PRs (30d)
264

Description

https://github.com/google/gvisor/issues/173 is now fixed and tcpdump mostly works except when using it with gVisor in promiscuous mode. This requires supporting a few missing AF_PACKET features namely

https://man7.org/linux/man-pages/man7/packet.7.html

PACKET_ADD_MEMBERSHIP
PACKET_DROP_MEMBERSHIP
Packet sockets can be used to configure physical-layer multi‐
casting and promiscuous mode. PACKET_ADD_MEMBERSHIP adds a
binding and PACKET_DROP_MEMBERSHIP drops it. They both expect
a packet_mreq structure as argument:

struct packet_mreq {
int mr_ifindex; /* interface index */
unsigned short mr_type; /* action */
unsigned short mr_alen; /* address length */
unsigned char mr_address[8]; /* physical-layer address */
};

mr_ifindex contains the interface index for the interface
whose status should be changed. The mr_type field specifies
which action to perform. PACKET_MR_PROMISC enables receiving
all packets on a shared medium (often known as "promiscuous
mode"), PACKET_MR_MULTICAST binds the socket to the physical-
layer multicast group specified in mr_address and mr_alen, and
PACKET_MR_ALLMULTI sets the socket up to receive all multicast
packets arriving at the interface.

In addition, the traditional ioctls SIOCSIFFLAGS, SIOCADD‐
MULTI, SIOCDELMULTI can be used for the same purpose.

tcpdump also seems to use

PACKET_AUXDATA (since Linux 2.6.21)
If this binary option is enabled, the packet socket passes a
metadata structure along with each packet in the recvmsg(2)
control field. The structure can be read with cmsg(3). It is
defined as

struct tpacket_auxdata {
__u32 tp_status;
__u32 tp_len; /* packet length */
__u32 tp_snaplen; /* captured length */
__u16 tp_mac;
__u16 tp_net;
__u16 tp_vlan_tci;
__u16 tp_vlan_tpid; /* Since Linux 3.14; earlier, these
were unused padding bytes */
};

Separately we may at some point need to add support for PACKET_RX_RING etc for high speed packet capture but that is a very low priority.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.