packetbeat: Enable setting promiscuous mode automatically #11366

michalpristas · 2019-03-21T11:32:04Z

This PR tries to enable promiscuous mode when using af_packet.

Few things to mention

when it fails it does not panic just logs the failure, mostly because of and backward compatibility
on exit: it resets promisc mode to whatever it was before
when any is used it does not set the mode to promiscuous - following pcap

Fixes #700

Manual testing guide:

Basic check:

check promisc mode is disabled on your device (e.g. ip link show {device}) (look for PROMISC keyword)
enable promisc mode by including packetbeat.interfaces.auto_promisc_mode: true into packetbeat config
check promisc mode is enabled (e.g. ip link show {device})
stop packetbeat
check promisc mode is disabled (e.g. ip link show {device})

Already on promisc check:

enable promisc mode on your devide (e.g. ifconfig {device} promisc or ip link set {device} promisc on
enable promisc mode by including packetbeat.interfaces.auto_promisc_mode: true into packetbeat config
check promisc mode is enabled (e.g. ip link show {device})
stop packetbeat
check promisc mode is still enabled (e.g. ip link show {device})

andrewkroh · 2019-03-21T15:31:00Z

Thanks for looking into this issue.

I definitely don't want to disable the seccomp protections to get this feature. Is there a way to directly set the promisc mode? How does this ip command do it? Maybe run that command in strace to see what it does. It might be using ioctl with IFF_PROMISC. Or maybe it's some kind of netlink msg being sent to the kernel.

michalpristas · 2019-03-21T15:33:09Z

i believe it will definitely call ioctl. i will take a closer look at it and come with a possible workaround

michalpristas · 2019-03-21T16:23:23Z

@andrewkroh changed it to call SIOCGIFFLAGS syscall directly. tested with Ubuntu and seems to work

andrewkroh · 2019-03-21T16:38:51Z

packetbeat/sniffer/afpacket_linux.go


 	"github.com/tsg/gopacket"
 	"github.com/tsg/gopacket/afpacket"
 	"github.com/tsg/gopacket/layers"
 )

 type afpacketHandle struct {
-	TPacket *afpacket.TPacket
+	TPacket              *afpacket.TPacket
+	promicsPreviousState bool


Typo in promics.

andrewkroh · 2019-03-21T16:40:37Z

packetbeat/sniffer/afpacket_linux.go

-	var err error
+	promiscEnabled, err := isPromiscEnabled(device)
+	if err != nil {
+		logp.Err("Failed to get promiscuous mode for device '%s': %v", device, err)


If it fails here then when closing we don't really know what the previous state was so we should not try to restore it based on this value.

andrewkroh · 2019-03-21T16:43:13Z

packetbeat/sniffer/afpacket_linux.go

+	}
+
+	if err := setPromiscMode(device, true); err != nil {
+		logp.Err("Failed to set promiscuous mode for device '%s': %v", device, err)


I think it would be good to inform users what the impact is and what a possible workaround is.

If Packetbeat is going to continue operating then I'd probably go for the Warn level.

andrewkroh · 2019-03-21T16:52:50Z

packetbeat/sniffer/afpacket_linux.go

+
+	defer syscall.Close(s)
+
+	var ifl struct {


What's ifl stand for? I'm thinking using ifreq might make this more recognizable to some familiar with ioctl and network device programming. Or perhaps some comments here explaining that this is the ifreq structure from linux/if.h.

andrewkroh · 2019-03-21T16:57:44Z

packetbeat/sniffer/afpacket_linux.go

+	copy(ifl.name[:], []byte(device))
+	_, _, ep := syscall.Syscall(syscall.SYS_IOCTL, uintptr(s), syscall.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifl)))
+	if ep != 0 {
+		return false, fmt.Errorf("Syscall SIOCGIFFLAGS exited with %v", ep)


How about

fmt.Errorf("ioctl command SIOCGIFFLAGS failed to get device flags for %v: return code %d", device, ep)

andrewkroh · 2019-03-21T17:04:45Z

packetbeat/sniffer/afpacket_linux.go

+		return nil
+	}
+
+	return syscall.SetLsfPromisc(device, enabled)


This function says its deprecated. Have you checked out what it recommends to use?

it says x/net where I did not find anything useful. so, for now, I went with this with a possible rewrite to direct syscalls

Let's at least add a code comment here explaining the issue + follow up issue in repo.

andrewkroh

The code LGTM. Now my only concern is testing. Does Packetbeat have any tests that use af_packet (maybe something in the tests/system dir)?

I think ideally we'd have a test in place that externally checks the interface promisc flag with ip, then runs packetbeat using af_packet, verifies that it puts the interface into promisc mode, stops packetbeat, and checks the promisc flag a third time.

urso

Although it's nice to improve the out of the box experience, I think we should make this optional. We're changing a devices settings (a global resource) and there is no guarantee that we can do the change. For example if packetbeat crashes (e.g. OOM due to bad state after packet loss), then all state is lost and after restart we assume promisc mode was always set.

urso · 2019-04-08T06:42:08Z

packetbeat/sniffer/afpacket_linux.go

+		promiscPreviousStateDetected: err == nil,
+	}
+
+	if err := setPromiscMode(device, true); err != nil {


why change mode if it's already enabled?

urso · 2019-04-08T06:43:09Z

packetbeat/sniffer/afpacket_linux.go

+		return nil
+	}
+
+	return syscall.SetLsfPromisc(device, enabled)


Let's at least add a code comment here explaining the issue + follow up issue in repo.

michalpristas · 2019-04-08T08:06:06Z

👍 on doing this optional

andrewkroh · 2019-07-17T17:59:11Z

@michalpristas This feature is still on my wish list. 🙏 😄

urso · 2019-12-06T18:21:54Z

@michalpristas @andrewkroh We want to continue with this PR? What is missing?

michalpristas · 2020-02-05T13:26:22Z

@urso brought even with master and updated to answer your comments. do you think something is missing?

) packetbeat: Enable setting promiscuous mode automatically (elastic#11366) (cherry picked from commit 49b0eb9)

…16104) packetbeat: Enable setting promiscuous mode automatically (#11366) (cherry picked from commit 49b0eb9)

michalpristas added 4 commits March 20, 2019 15:07

Enable setting of promiscuous mode

ffd96e6

seccomp disabled

46db28a

Merge branch 'master' of https://github.com/elastic/beats into fix-700

1c2146a

update faq

637eaab

michalpristas requested a review from a team as a code owner March 21, 2019 11:32

michalpristas changed the title ~~Fix 700~~ packetbeat: enable setting promiscous mode automatically Mar 21, 2019

michalpristas added the Packetbeat label Mar 21, 2019

michalpristas changed the title ~~packetbeat: enable setting promiscous mode automatically~~ packetbeat: Enable setting promiscous mode automatically Mar 21, 2019

michalpristas changed the title ~~packetbeat: Enable setting promiscous mode automatically~~ packetbeat: Enable setting promiscuous mode automatically Mar 21, 2019

changelog

1ff4818

michalpristas requested a review from andrewkroh March 21, 2019 11:36

michalpristas added review and removed review labels Mar 21, 2019

michalpristas added 3 commits March 21, 2019 12:45

fix

7fc011e

mage update

4e140f3

Merge branch 'master' into fix-700

9ef3f56

michalpristas added the review label Mar 21, 2019

michalpristas removed the review label Mar 21, 2019

michalpristas added 3 commits March 21, 2019 17:06

syscall

70dc0cd

syscall

fbe7398

whitespaces

8c87687

michalpristas added the review label Mar 21, 2019

typo

c00eb6f

andrewkroh reviewed Mar 21, 2019

View reviewed changes

review round

24db049

andrewkroh reviewed Mar 21, 2019

View reviewed changes

not breaking

1d2f681

urso reviewed Apr 8, 2019

View reviewed changes

Merge branch 'master' into fix-700

93e48ac

michalpristas force-pushed the fix-700 branch from f75a0af to f11baa0 Compare April 8, 2019 09:12

configurable promisc mode

23d5948

michalpristas force-pushed the fix-700 branch from f11baa0 to 23d5948 Compare April 8, 2019 10:16

michalpristas added 3 commits April 8, 2019 13:59

meta reference

9111121

invalid condition, shame on me

52ce33e

Merge branch 'master' into fix-700

70d02b0

urso added the Team:Beats label Nov 14, 2019

urso added the [zube]: In Review label Feb 4, 2020

michalpristas added 5 commits February 5, 2020 12:11

Merge branch 'master' into fix-700

ef0ae7d

changelog merge fix

7bb2402

updated dockerfile for packetbeat

a00e370

added comment

941f534

updated config file

bbcc013

urso approved these changes Feb 5, 2020

View reviewed changes

urso added test-plan Add this PR to be manual test plan v7.7.0 labels Feb 5, 2020

michalpristas merged commit 49b0eb9 into elastic:master Feb 5, 2020

zube bot added [zube]: Done and removed [zube]: In Review labels Feb 5, 2020

michalpristas added a commit to michalpristas/beats that referenced this pull request Feb 5, 2020

packetbeat: Enable setting promiscuous mode automatically (elastic#11366

74b08fd

) packetbeat: Enable setting promiscuous mode automatically (elastic#11366) (cherry picked from commit 49b0eb9)

michalpristas mentioned this pull request Feb 5, 2020

Cherry-pick #11366 to 7.x: packetbeat: Enable setting promiscuous mode automatically #16104

Merged

michalpristas added a commit that referenced this pull request Feb 5, 2020

packetbeat: Enable setting promiscuous mode automatically (#11366) (#…

393e408

…16104) packetbeat: Enable setting promiscuous mode automatically (#11366) (cherry picked from commit 49b0eb9)

andresrc added the Team:Integrations Label for the Integrations team label Mar 6, 2020

andresrc removed the Team:Integrations Label for the Integrations team label Mar 21, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

packetbeat: Enable setting promiscuous mode automatically #11366

packetbeat: Enable setting promiscuous mode automatically #11366

michalpristas commented Mar 21, 2019 •

edited

Loading

andrewkroh commented Mar 21, 2019

michalpristas commented Mar 21, 2019

michalpristas commented Mar 21, 2019

andrewkroh Mar 21, 2019

andrewkroh Mar 21, 2019

andrewkroh Mar 21, 2019

andrewkroh Mar 21, 2019

andrewkroh Mar 21, 2019

andrewkroh Mar 21, 2019

michalpristas Mar 21, 2019 •

edited

Loading

urso Apr 8, 2019

andrewkroh left a comment •

edited

Loading

urso left a comment

urso Apr 8, 2019

urso Apr 8, 2019

michalpristas commented Apr 8, 2019

andrewkroh commented Jul 17, 2019

urso commented Dec 6, 2019

michalpristas commented Feb 5, 2020

packetbeat: Enable setting promiscuous mode automatically #11366

packetbeat: Enable setting promiscuous mode automatically #11366

Conversation

michalpristas commented Mar 21, 2019 • edited Loading

Manual testing guide:

Basic check:

Already on promisc check:

andrewkroh commented Mar 21, 2019

michalpristas commented Mar 21, 2019

michalpristas commented Mar 21, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

michalpristas Mar 21, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrewkroh left a comment • edited Loading

Choose a reason for hiding this comment

urso left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

michalpristas commented Apr 8, 2019

andrewkroh commented Jul 17, 2019

urso commented Dec 6, 2019

michalpristas commented Feb 5, 2020

michalpristas commented Mar 21, 2019 •

edited

Loading

michalpristas Mar 21, 2019 •

edited

Loading

andrewkroh left a comment •

edited

Loading