From 28498c5a5dfeb51f49bd9c9b8ea917d2284bdbd9 Mon Sep 17 00:00:00 2001
From: Leonid Bugaev <leonsbox@gmail.com>
Date: Mon, 31 Jan 2022 21:10:40 +0300
Subject: [PATCH] Added `--input-raw-ignore-interface` option to skip network
 interfaces

In k8 environment, when listening as daemonset, k8s creates a bunch of virtual interfaccess for your traffic with random names, but in addition it has a classical eth0, or NAT ones like cbr0, which you do not want to listen.

With this option you now can listen traffic on all virtual interfaces and ignore internal k8s traffic. Example:
`--input-raw-ignore-interface cbr0 --input-raw-ignore-interface eth0 --input-raw-ignore-interface localhost`
---
 capture/capture.go | 13 +++++++++++++
 input_raw.go       |  6 ++----
 plugins_test.go    |  8 ++++----
 settings.go        |  1 +
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/capture/capture.go b/capture/capture.go
index 98623d5..e1cf988 100644
--- a/capture/capture.go
+++ b/capture/capture.go
@@ -59,6 +59,7 @@ type PcapOptions struct {
 	RealIPHeader    string          `json:"input-raw-realip-header"`
 	Stats           bool            `json:"input-raw-stats"`
 	AllowIncomplete bool            `json:"input-raw-allow-incomplete"`
+	IgnoreInterface []string        `json:"input-raw-ignore-interface"`
 	Transport       string
 }
 
@@ -598,6 +599,18 @@ func (l *Listener) setInterfaces() (err error) {
 	}
 
 	for _, pi := range pifis {
+		ignore := false
+		for _, ig := range l.config.IgnoreInterface {
+			if pi.Name == ig {
+				ignore = true
+				break
+			}
+		}
+
+		if ignore {
+			continue
+		}
+
 		if isDevice(l.host, pi) {
 			l.Interfaces = []pcap.Interface{pi}
 			return
diff --git a/input_raw.go b/input_raw.go
index b3dd831..4c6297a 100644
--- a/input_raw.go
+++ b/input_raw.go
@@ -15,9 +15,7 @@ import (
 )
 
 // RAWInputConfig represents configuration that can be applied on raw input
-type RAWInputConfig struct {
-	capture.PcapOptions
-}
+type RAWInputConfig = capture.PcapOptions
 
 // RAWInput used for intercepting traffic for given address
 type RAWInput struct {
@@ -116,7 +114,7 @@ func (i *RAWInput) PluginRead() (*Message, error) {
 
 func (i *RAWInput) listen(address string) {
 	var err error
-	i.listener, err = capture.NewListener(i.host, i.ports, i.config.PcapOptions)
+	i.listener, err = capture.NewListener(i.host, i.ports, i.config)
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/plugins_test.go b/plugins_test.go
index 3df13b2..e4b0c33 100644
--- a/plugins_test.go
+++ b/plugins_test.go
@@ -5,10 +5,10 @@ import (
 )
 
 func TestPluginsRegistration(t *testing.T) {
-	Settings.InputDummy = MultiOption{"[]"}
-	Settings.OutputDummy = MultiOption{"[]"}
-	Settings.OutputHTTP = MultiOption{"www.example.com|10"}
-	Settings.InputFile = MultiOption{"/dev/null"}
+	Settings.InputDummy = []string{"[]"}
+	Settings.OutputDummy = []string{"[]"}
+	Settings.OutputHTTP = []string{"www.example.com|10"}
+	Settings.InputFile = []string{"/dev/null"}
 
 	plugins := NewPlugins()
 
diff --git a/settings.go b/settings.go
index a60eee0..d49451b 100644
--- a/settings.go
+++ b/settings.go
@@ -191,6 +191,7 @@ func init() {
 	flag.BoolVar(&Settings.InputRAWConfig.Monitor, "input-raw-monitor", false, "enable RF monitor mode")
 	flag.BoolVar(&Settings.InputRAWConfig.Stats, "input-raw-stats", false, "enable stats generator on raw TCP messages")
 	flag.BoolVar(&Settings.InputRAWConfig.AllowIncomplete, "input-raw-allow-incomplete", false, "If turned on Gor will record HTTP messages with missing packets")
+	flag.Var(&MultiOption{&Settings.InputRAWConfig.IgnoreInterface}, "input-raw-ignore-interface", "In case if you want listen for all interfaces except a few ones. Can be used in k8s environment. Example: --input-raw-ignore-interface cbr0 --input-raw-ignore-interface eth0 --input-raw-ignore-interface localhost")
 
 	flag.StringVar(&Settings.Middleware, "middleware", "", "Used for modifying traffic using external command")