use sys package in BPF

[david415]

ouch... i do believe it is better to use the sys package rather than the syscall package... here we see the bpf header struct defined for OpenBSD on amd64:

https://github.com/golang/sys/blob/master/unix/ztypes_openbsd_amd64.go#L427

and another one for NetBSD: https://github.com/golang/sys/blob/master/unix/ztypes_netbsd_amd64.go#L369

these recent additions to sys look great... and we should use them. It seems to me that we can get rid of our own definition of BpfHdr and use the one in the syscall package... as long as the running system is a BSD.

the sys package is imported like this: import "golang.org/x/sys/unix"

[david415]

oh wow! apparently the syscal package exported functions i use to make this BPF sniffer have been frozen/deprecated... because in the new sys package they don't exist!

https://github.com/david415/HoneyBadger/blob/2db835f0591421896bba2c57c29f9fc95dfed7a1/bpf_sniffer/bsd_bpf_sniffer.go#L67-L79

we have to make a choice:

1. go on using deprecated/frozen syscall api and our own hand written BPF Header structs
2. use the sys package to write a BPF sniffer API using the ioctl functionality...
3. go on using deprecated/frozen syscall api AND also use the sys package's BPF Header structs

[david415]

fixed forever with option 3