Filter out outgoing packets on a raw socket

[changtimwu]

Reference neither Raw Socket promiscuous mode not sniffing what I write nor C raw socket receive or sniff incoming packets only gives decent solution.

[changtimwu]

• PACKET_OUTGOING: drop at user space...ugly
• socket filter:
  • when incoming packet are really alike outgoing packets, we have to way to distinguish them.
  • It makes pcap expression hard to write to avoid receiving outgoing packets.

[changtimwu]

kernel trace

• We won't receive self-sent packets on the same socket. It's because the source claims

    /* Never send packets back to the socket
         * they originated from - MvS (miquels@drinkel.ow.org) */

• Outgoing packets are labeled with PACKET_OUTGOING. src
• outgoing packets are routed back to protocol handler src. struct packet_type prototype
• packet_recv is AF_PACKET's protocol hook.

[changtimwu]

RECV_TYPE

Openwrt adds a new socket option called PACKET_RECV_TYPE. Here is the patch It's mainly for ead. example usage of PACKET_RECV_TYPE.

We make use of it.

int v=0;
v = PACKET_MASK_ANY & ~(1<<PACKET_OUTGOING) & ~(1 << PACKET_LOOPBACK);
setsockopt( raw_sock, SOL_PACKET, PACKET_RECV_TYPE, &v, sizeof(v));

Excellent! It works well.