From: lantz moore <lmoore@debian.org>
Date: Sun, 27 Nov 2005 01:47:06 -0800
Subject: ifpromisc
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Improvements for ifpromisc:

1. Better output
     * if a 'packet sniffer' is detected, its pid is output as well as the name
	   (has_packet_socket returns a struct packet_info or NULL to enable this
	    include dirent.h and sys/stat.h, make packet_info->inode be an ino_t and add a pid
		in read_proc_net_packegt, make inode be a long not an int,
		in walk_prcess: do not call perror if we get ENOENT, and save the pid)
     * instead of PF_PACKET the output is "PACKET_SNIFFER"
     Author: lantz moore <lmoore@debian.org>
     Date:   Sun Nov 27 01:47:06 2005 -0800

2. Better return value (and reindent)
     * Add global variable retval, starting at 0: it is set to 2 on
       error, 1 if a sniffer is found (and so 0 is no sniffers)
	 * Also reindent
	 Author: Richard Lewis <richard.lewis.debian@googlemail.com>
     Date:   Sat Jun 8 20:24:30 2024 +0100
    
3. Minor compilation fixes
 a) Include stdint.h (Provided by an unknown contributor, Sun Jul 9 18:42:55 2017 +0200)

Other fixes from Christian Göttsche <cgzones@googlemail.com>, Fri Jul 24 15:30:57 2020 +0200:
 b) Always null-terminate interface names (in if_fetch, copy sizeof(ife->name) - 1 bytes and add a \0)
 c) Hide warning about not checking the result of fgets, check result of readlink (in walk_process)
 d) declare strings Release and Version as 'const'

Forwarded: yes
 (Forwarded by email: 21 Dec 2024)
---
 ifpromisc.c | 215 ++++++++++++++++++++++++++++++++----------------------------
 1 file changed, 115 insertions(+), 100 deletions(-)

diff --git a/ifpromisc.c b/ifpromisc.c
index e086087..85c3d01 100644
--- a/ifpromisc.c
+++ b/ifpromisc.c
@@ -6,26 +6,26 @@
                or
                xxx is not promisc
 
-   Version:	@(#)ifpromisc.c	0.8	2003/11/30
-   		@(#)ifpromisc.c	0.7	2003/06/07
+   Version:     @(#)ifpromisc.c     0.8     2003/11/30
+                @(#)ifpromisc.c     0.7     2003/06/07
    Last Changes: Better detection of promisc mode on newer Linux kernels
                  Lantz Moore <lmoore@tump.com>
                  Fix for newer linux kernels, minor fixes
-         	 Nelson Murilo, <nmurilo@gmail.com>
+                 Nelson Murilo, <nmurilo@gmail.com>
                  Ports for Solaris
                  Andre Gustavo <gustavo@anita.visualnet.com.br>
                  Port for OpenBSD
-         	 Nelson Murilo, <nmurilo@gmail.com>
-                 Fix wrong output (patched by Sean MacLennan) 
+                  Nelson Murilo, <nmurilo@gmail.com>
+                 Fix wrong output (patched by Sean MacLennan)
 
-   Author:	Nelson Murilo, <nmurilo@gmail.com>
-  		Copyright 1997-2021 (C) Pangeia Informatica
+   Author:  Nelson Murilo, <nmurilo@gmail.com>
+        Copyright 1997-2021 (C) Pangeia Informatica
 
-  		This program is free software; you can redistribute it
-  		and/or  modify it under  the terms of  the GNU General
-  		Public  License as  published  by  the  Free  Software
-  		Foundation;  either  version 2 of the License, or  (at
-  		your option) any later version.
+        This program is free software; you can redistribute it
+        and/or  modify it under  the terms of  the GNU General
+        Public  License as  published  by  the  Free  Software
+        Foundation;  either  version 2 of the License, or  (at
+        your option) any later version.
  */
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -39,6 +39,7 @@
 #else
 #include <net/if.h>
 #ifndef __OpenBSD__
+#include <stdint.h>
 #include <net/if_arp.h>
 #endif
 #endif
@@ -52,73 +53,77 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <dirent.h>
+#include <sys/stat.h>
 
 struct interface
 {
-  char			name[IFNAMSIZ];		/* interface name	*/
-  short			type;			/* if type		*/
-  short			flags;			/* various flags	*/
+  char          name[IFNAMSIZ]; /* interface name   */
+  short         type;           /* if type      */
+  short         flags;          /* various flags    */
 #ifdef __linux__
-  int			index;			/* interface index	*/
+  int           index;          /* interface index  */
 #endif
 };
 
-char *Release = "chkrootkit package",
-     *Version = "@(#) ifpromisc 0.9 (2007/06/15)";
-//     *Version = "@(#) ifpromisc 0.8 (2003/11/30)";
+const char *Release = "chkrootkit package",
+           *Version = "@(#) ifpromisc 0.9 (2007/06/15)";
 
-int skfd = -1;				/* AF_INET or AF_PACKET raw socket desc.	*/
-int q = 0;                              /* Quiet mode on or off				*/
+int skfd = -1;      /* AF_INET or AF_PACKET raw socket desc. */
+int q = 0;          /* Quiet mode on or off */
+int retval = 0;     /* return value (1 if we find a sniffer/promisc interface) */
 
 struct packet_info
 {
-    int index;
-    int type;
-    int proto;
-    int inode;
-    char *cmd;
-    struct packet_info *next;
+  int index;
+  int type;
+  int proto;
+  ino_t inode;
+  char *cmd;
+  char *pid;
+  struct packet_info *next;
 };
 
 #ifdef __linux__
 /*
- * the contents of /proc/net/packet
+    the contents of /proc/net/packet
  */
 static struct packet_info *proc_net_packet = 0;
 
 /*
- * read the entries from /proc/net/packet
+   read the entries from /proc/net/packet
  */
-static void read_proc_net_packet()
+static void read_proc_net_packet(void)
 {
-    FILE                *proc;
-    char                buf[80];
+  FILE *proc;
+  char buf[80];
 
-    proc = fopen("/proc/net/packet", "r");
-    if (!proc)
+  proc = fopen("/proc/net/packet", "r");
+  if (!proc)
     {
-        if (errno != ENOENT)
+      if (errno != ENOENT)
         {
-            perror("opening /proc/net/packet");
+          retval=2;
+          perror("opening /proc/net/packet");
         }
-        return;
+      return;
     }
 
-    /* skip the header */
-    fgets(buf, 80, proc);
-    while (fgets(buf, 80, proc))
+  /* skip the header */
+  (void) !fgets(buf, 80, proc);
+  while (fgets(buf, 80, proc))
     {
-        int             type = 0;
-        unsigned int    proto = 0;
-        int             index = 0;
-        unsigned int    inode = 0;
+      int             type = 0;
+      unsigned int    proto = 0;
+      int             index = 0;
+      unsigned long   inode = 0;
 
-        if (sscanf(buf, "%*p %*d %d %x   %d %*d %*u %*u %u",
-                  &type, &proto, &index, &inode) == 4)
+      if (sscanf(buf, "%*p %*d %d %x   %d %*d %*u %*u %lu",
+                 &type, &proto, &index, &inode) == 4)
         {
-            struct packet_info *pi;
+          struct packet_info *pi;
 
-            pi = (struct packet_info *)malloc(sizeof(struct packet_info));
+          pi = (struct packet_info *)malloc(sizeof(struct packet_info));
             pi->type = type;
             pi->proto = proto;
             pi->index = index;
@@ -130,6 +135,7 @@ static void read_proc_net_packet()
         }
         else
         {
+            retval=2;
             fprintf(stderr, "cannot grok /proc/net/packet: %s", buf);
         }
     }
@@ -138,7 +144,7 @@ static void read_proc_net_packet()
 }
 
 /* look up an entry from /proc/net/packet by inode */
-static struct packet_info *find_packet_info(int inode)
+static struct packet_info *find_packet_info(ino_t inode)
 {
     struct packet_info *p;
     for (p = proc_net_packet; p; p = p->next)
@@ -162,15 +168,16 @@ static void walk_process(char *process)
 
     if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
     {
+        retval=2;
         fprintf(stderr, "giant process name! %s\n", process);
         return;
     }
 
     if ((dir = opendir(path)) == NULL)
     {
-	if (errno != ENOENT)
-           perror(path);
-        return;
+      if (errno != ENOENT)
+        perror(path);
+      return;
     }
 
     while ((ent = readdir(dir)))
@@ -181,6 +188,7 @@ static void walk_process(char *process)
         if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
                      process, ent->d_name) == -1)
         {
+            retval=2;
             fprintf(stderr, "giant fd name /proc/%s/fd/%s\n",
                     process, ent->d_name);
             continue;
@@ -188,7 +196,11 @@ static void walk_process(char *process)
 
         if (stat(path, &statbuf) == -1)
         {
-            perror(path);
+            if (errno != ENOENT)
+            {
+                retval=2;
+                perror(path);
+            }
             continue;
         }
 
@@ -201,8 +213,14 @@ static void walk_process(char *process)
             /* no need to check rv since it has to be long enough,
              * otherwise, one of the ones above will have failed */
             snprintf(path, sizeof(path), "/proc/%s/exe", process);
-            readlink(path, link, sizeof(link) - 1);
+            if (readlink(path, link, sizeof(link) - 1) < 0) {
+                retval=2;
+                fprintf(stderr, "cannot readlink of '%s': %s\n",
+                        path, strerror(errno));
+                continue;
+        }
             info->cmd = strdup(link);
+            info->pid = strdup(process);
         }
     }
 
@@ -211,13 +229,14 @@ static void walk_process(char *process)
 
 /* walk the proc file system looking for processes, call walk_proc on each
  * process */
-static void walk_processes()
+static void walk_processes(void)
 {
-    DIR                 *dir;
-    struct dirent       *ent;
+    DIR           *dir;
+    struct dirent *ent;
 
     if ((dir = opendir("/proc")) == NULL)
     {
+        retval=2;
         perror("/proc");
         return;
     }
@@ -232,72 +251,67 @@ static void walk_processes()
     }
 
     closedir(dir);
-
 }
 
-/* return 1 if index is a member of pcap_session_list, 0 otherwise. */
-static int has_packet_socket(int index)
+/* return 1 if index is a member of proc_net_packet, 0 otherwise. */
+static struct packet_info *has_packet_socket(int index)
 {
     struct packet_info *p;
     for (p = proc_net_packet; p; p = p->next)
     {
         if (p->index == index)
         {
-            return 1;
+            return p;
         }
     }
-    return 0;
+    return NULL;
 }
 #endif /* __linux__ */
 
 static void ife_print(struct interface *ptr)
 {
 #ifdef __linux__
-    int promisc = ptr->flags & IFF_PROMISC;
-    int has_packet = has_packet_socket(ptr->index);
-
-    if (promisc || has_packet)
+  int                 promisc = ptr->flags & IFF_PROMISC;
+  struct packet_info *sniffer = has_packet_socket(ptr->index);
+  struct packet_info *p;
+  if (promisc || sniffer)
     {
-        printf("%s:", ptr->name);
-        if (promisc)
-            printf(" PROMISC");
-        if (has_packet)
+      retval=1;
+      printf("%s:", ptr->name);
+      if (promisc)
+        printf(" PROMISC");
+      if (sniffer)
         {
-            struct packet_info *p;
-	    int first_time = 1; 
-            printf(" PF_PACKET(");
-            for (p = proc_net_packet; p; p = p->next)
+          printf(" PACKET SNIFFER(");
+          printf("%s[%s]", sniffer->cmd, sniffer->pid);
+          for (p = sniffer->next; p; p = p->next)
             {
-               if (p->index == ptr->index)
-               {
-                  if (first_time) 
-                  { 
-                     first_time = 0; 
-                     printf("%s", p->cmd); 
-                  }
-                  else 
-                     printf(", %s", p->cmd);
+              if (p->index == ptr->index)
+                {
+                  printf(", %s[%s]", p->cmd, p->pid);
                 }
             }
-            printf(")");
+          printf(")");
         }
-        printf("\n");
+      printf("\n");
     }
-    else
+  else
     {
         if (!q)
-            printf("%s: not promisc and no PF_PACKET sockets\n",
+            printf("%s: not promisc and no packet sniffer sockets\n",
                    ptr->name);
     }
 #else
    if (ptr->flags & IFF_PROMISC)
-      printf("%s is %s", ptr->name, "PROMISC");
+   {
+      retval=1;
+      printf("%s is %s\n", ptr->name, "PROMISC");
+   }
    else
    {
       if (!q)
-         printf("%s is %s", ptr->name, "not promisc");
+         printf("%s is %s\n", ptr->name, "not promisc");
    }
-   putchar('\n');
 #endif
 }
 
@@ -307,9 +321,10 @@ static int if_fetch(char *ifname, struct interface *ife)
   struct ifreq ifr;
 
   memset((char *) ife, 0, sizeof(struct interface));
-  strncpy(ife->name, ifname, sizeof(ife->name));
+  strncpy(ife->name, ifname, sizeof(ife->name) - 1);
 
-  strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
+  strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name) - 1);
+  ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = '\0';
   if (ioctl(skfd, SIOCGIFFLAGS, &ifr) < 0)
       return(-1);
   ife->flags = ifr.ifr_flags;
@@ -324,7 +339,7 @@ static int if_fetch(char *ifname, struct interface *ife)
   return(0);
 }
 
-static void if_print()
+static void if_print(void)
 {
    char buff[1024];
    struct interface ife;
@@ -336,6 +351,7 @@ static void if_print()
    ifc.ifc_buf = buff;
    if (ioctl(skfd, SIOCGIFCONF, &ifc) < 0)
    {
+      retval=2;
       fprintf(stderr, "SIOCGIFCONF: %s\n", strerror(errno));
       return;
    }
@@ -346,12 +362,11 @@ static void if_print()
       if (if_fetch(ifr->ifr_name, &ife) < 0)
       {
 #ifdef __linux__
+         retval=2;
          fprintf(stderr, "%s: unknown interface.\n", ifr->ifr_name);
 #endif
-	 continue;
+     continue;
       }
-      if (!memcmp(ifr->ifr_name, "lo", 2))
-         continue;
       ife_print(&ife);
    }
 }
@@ -361,10 +376,10 @@ int main(int argc, char **argv)
   if (argc == 2 && !memcmp(argv[1], "-q", 2))
      q++;
 
-  /* Create a channel to the NET kernel. */
+   /* Create a channel to the NET kernel. */
    if ((skfd = socket(AF_INET, SOCK_DGRAM,0)) < 0) {
-	perror("socket");
-	exit(-1);
+    perror("socket");
+    exit(-1);
   }
 #ifdef __linux__
   read_proc_net_packet();
@@ -373,5 +388,5 @@ int main(int argc, char **argv)
 
   if_print();
   (void) close(skfd);
-  exit(0);
+  exit(retval);
 }