packetbeat: Enable setting promiscuous mode automatically

CHANGELOG.next.asciidoc

@@ -111,6 +111,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
   - `http.response.body` moves to `http.response.body.content`
 - Changed Packetbeat fields to align with ECS. {issue}7968[7968]
 - Removed trailing dot from domain names reported by the DNS protocol. {pull}9941[9941]
+- Enable setting promiscuous mode automatically. {pull}11366[11366]
 
 *Winlogbeat*
 

packetbeat/sniffer/afpacket_linux.go

@@ -20,22 +20,42 @@
 package sniffer
 
 import (
+	"fmt"
+	"syscall"
 	"time"
+	"unsafe"
+
+	"github.com/elastic/beats/libbeat/logp"
 
 	"github.com/tsg/gopacket"
 	"github.com/tsg/gopacket/afpacket"
 	"github.com/tsg/gopacket/layers"
 )
 
 type afpacketHandle struct {
-	TPacket *afpacket.TPacket
+	TPacket                      *afpacket.TPacket
+	promiscPreviousState         bool
+	promiscPreviousStateDetected bool
+	device                       string
 }
 
 func newAfpacketHandle(device string, snaplen int, block_size int, num_blocks int,
 	timeout time.Duration) (*afpacketHandle, error) {
 
-	h := &afpacketHandle{}
-	var err error
+	promiscEnabled, err := isPromiscEnabled(device)
+	if err != nil {
+		logp.Err("Failed to get promiscuous mode for device '%s': %v", device, err)
+	}
+
+	h := &afpacketHandle{
+		promiscPreviousState:         promiscEnabled,
+		device:                       device,
+		promiscPreviousStateDetected: err == nil,
+	}
+
+	if err := setPromiscMode(device, true); err != nil {
+		logp.Warn("Failed to set promiscuous mode for device '%s'. Packetbeat may be unable to see any network traffic. Please follow packetbeat FAQ to learn about mitigation: Error: %v", device, err)
+	}
 
 	if device == "any" {
 		h.TPacket, err = afpacket.NewTPacket(
@@ -69,4 +89,44 @@ func (h *afpacketHandle) LinkType() layers.LinkType {
 
 func (h *afpacketHandle) Close() {
 	h.TPacket.Close()
+	if h.promiscPreviousStateDetected {
+		if err := setPromiscMode(h.device, h.promiscPreviousState); err != nil {
+			logp.Warn("Failed to reset promiscuous mode for device '%s'. Your device might be in promiscuous mode.: %v", h.device, err)
+		}
+	}
+}
+
+func isPromiscEnabled(device string) (bool, error) {
+	if device == "any" {
+		return false, nil
+	}
+
+	s, e := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
+	if e != nil {
+		return false, e
+	}
+
+	defer syscall.Close(s)
+
+	var ifreq struct {
+		name  [syscall.IFNAMSIZ]byte
+		flags uint16
+	}
+
+	copy(ifreq.name[:], []byte(device))
+	_, _, ep := syscall.Syscall(syscall.SYS_IOCTL, uintptr(s), syscall.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifreq)))
+	if ep != 0 {
+		return false, fmt.Errorf("ioctl command SIOCGIFFLAGS failed to get device flags for %v: return code %d", device, ep)
+	}
+
+	return ifreq.flags&uint16(syscall.IFF_PROMISC) != 0, nil
+}
+
+func setPromiscMode(device string, enabled bool) error {
+	if device == "any" {
+		logp.Warn("Cannot set promiscuous mode to device 'any'")
+		return nil
+	}
+
+	return syscall.SetLsfPromisc(device, enabled)
 }