packetbeat: Enable setting promiscuous mode automatically

CHANGELOG.next.asciidoc

@@ -111,6 +111,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
   - `http.response.body` moves to `http.response.body.content`
 - Changed Packetbeat fields to align with ECS. {issue}7968[7968]
 - Removed trailing dot from domain names reported by the DNS protocol. {pull}9941[9941]
+- Enable setting promiscuous mode automatically. {pull}11366[11366]
 
 *Winlogbeat*
 

packetbeat/sniffer/afpacket_linux.go

@@ -20,22 +20,40 @@
 package sniffer
 
 import (
+	"fmt"
+	"syscall"
 	"time"
+	"unsafe"
+
+	"github.com/elastic/beats/libbeat/logp"
 
 	"github.com/tsg/gopacket"
 	"github.com/tsg/gopacket/afpacket"
 	"github.com/tsg/gopacket/layers"
 )
 
 type afpacketHandle struct {
-	TPacket *afpacket.TPacket
+	TPacket              *afpacket.TPacket
+	promicsPreviousState bool
+	device               string
 }
 
 func newAfpacketHandle(device string, snaplen int, block_size int, num_blocks int,
 	timeout time.Duration) (*afpacketHandle, error) {
 
-	h := &afpacketHandle{}
-	var err error
+	promiscEnabled, err := isPromiscEnabled(device)
+	if err != nil {
+		logp.Err("Failed to get promiscuous mode for device '%s': %v", device, err)
+	}
+
+	h := &afpacketHandle{
+		promicsPreviousState: promiscEnabled,
+		device:               device,
+	}
+
+	if err := setPromiscMode(device, true); err != nil {
+		logp.Err("Failed to set promiscuous mode for device '%s': %v", device, err)
+	}
 
 	if device == "any" {
 		h.TPacket, err = afpacket.NewTPacket(
@@ -69,4 +87,42 @@ func (h *afpacketHandle) LinkType() layers.LinkType {
 
 func (h *afpacketHandle) Close() {
 	h.TPacket.Close()
+	if err := setPromiscMode(h.device, h.promicsPreviousState); err != nil {
+		logp.Err("Failed to set promiscuous mode for device '%s': %v", h.device, err)
+	}
+}
+
+func isPromiscEnabled(device string) (bool, error) {
+	if device == "any" {
+		return false, nil
+	}
+
+	s, e := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
+	if e != nil {
+		return false, e
+	}
+
+	defer syscall.Close(s)
+
+	var ifl struct {
+		name  [syscall.IFNAMSIZ]byte
+		flags uint16
+	}
+
+	copy(ifl.name[:], []byte(device))
+	_, _, ep := syscall.Syscall(syscall.SYS_IOCTL, uintptr(s), syscall.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifl)))
+	if ep != 0 {
+		return false, fmt.Errorf("Syscall SIOCGIFFLAGS exited with %v", ep)
+	}
+
+	return ifl.flags&uint16(syscall.IFF_PROMISC) != 0, nil
+}
+
+func setPromiscMode(device string, enabled bool) error {
+	if device == "any" {
+		logp.Warn("Cannot set promiscuous mode to device 'any'")
+		return nil
+	}
+
+	return syscall.SetLsfPromisc(device, enabled)
 }