From e0f4c701028aa81026a17cf9ebfb36112184f4bc Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Fri, 17 May 2024 19:54:00 +0200 Subject: Add privilege dropping, AF_PACKET demo, ICMP, checksum validation, --help, and TCP reassembly Rounds out the build order in PLAN.md with six incremental additions: drop root privileges immediately after opening the capture handle; a standalone AF_PACKET/mmap ring-buffer demo (kept separate from CaptureSession, see its header comment for why); ICMPv4/ICMPv6 type and code decoding; opt-in IPv4/TCP/UDP checksum validation (-c); CLI --help; and opt-in, in-order-only TCP stream reassembly (-a) so HTTP requests/responses split across segments can be seen whole. Each addition is unit-tested and, where it touches live traffic behavior, verified against real captured packets - see PLAN.md's Decisions section for the verification notes on each. --- include/wireframe/capture_session.hpp | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include/wireframe/capture_session.hpp') diff --git a/include/wireframe/capture_session.hpp b/include/wireframe/capture_session.hpp index 50764a8..2e3b05a 100644 --- a/include/wireframe/capture_session.hpp +++ b/include/wireframe/capture_session.hpp @@ -14,6 +14,7 @@ #include "wireframe/filter.hpp" #include "wireframe/pcapng/reader.hpp" #include "wireframe/pcapng/writer.hpp" +#include "wireframe/privileges.hpp" // Device-open -> datalink-validate -> filter/pcapng-setup -> signal-hook // pipeline, shared by every frontend (CLI, TUI, GUI). Centralized so a @@ -99,6 +100,16 @@ public: return std::string("pcap_open_live failed: ") + errbuf; } + // Everything CAP_NET_RAW/root was needed for is done: the + // handle is open. Drop immediately, before the datalink check + // or -w's file is even created - the latter is also why this + // runs this early rather than at the very end of open(), since + // it means a -w output file gets created as the real user, not + // root, and doesn't need a manual chown to read back afterward. + if (auto err = drop_privileges_if_root()) { + return "failed to drop root privileges after opening the capture handle: " + *err; + } + datalink_ = pcap_datalink(handle_); if (!is_supported_datalink(datalink_)) { return std::string("unsupported datalink type on ") + device_ + ": " + -- cgit v1.2.3