Revert "Use lsof instead of pfctl to find target host on OSX in transparent mode."

This reverts commit ffeede9b39.
This commit is contained in:
Aldo Cortesi 2013-06-16 16:23:36 +12:00
parent c1a60a1f6b
commit 886970040b
2 changed files with 8 additions and 9 deletions

View File

@ -1,16 +1,16 @@
import subprocess import subprocess
import lsof import pf
""" """
Doing this the "right" way by using DIOCNATLOOK on the pf device turns out Doing this the "right" way by using DIOCNATLOOK on the pf device turns out
to be a pain. Apple has made a number of modifications to the data to be a pain. Apple has made a number of modifications to the data
structures returned, and compiling userspace tools to test and work with structures returned, and compiling userspace tools to test and work with
this turns out to be a pain in the ass. Parsing lsof output is short, this turns out to be a pain in the ass. Parsing pfctl output is short,
simple, and works. simple, and works.
""" """
class Resolver: class Resolver:
STATECMD = ("sudo", "-n", "/usr/sbin/lsof", "-n", "-P", "-i", "TCP") STATECMD = ("sudo", "-n", "/sbin/pfctl", "-s", "state")
def __init__(self): def __init__(self):
pass pass
@ -20,4 +20,4 @@ class Resolver:
stxt = subprocess.check_output(self.STATECMD, stderr=subprocess.STDOUT) stxt = subprocess.check_output(self.STATECMD, stderr=subprocess.STDOUT)
except subprocess.CalledProcessError: except subprocess.CalledProcessError:
return None return None
return lsof.lookup(peer[0], peer[1], stxt) return pf.lookup(peer[0], peer[1], stxt)

View File

@ -1,4 +1,3 @@
import re
def lookup(address, port, s): def lookup(address, port, s):
""" """
@ -9,9 +8,9 @@ def lookup(address, port, s):
""" """
spec = "%s:%s"%(address, port) spec = "%s:%s"%(address, port)
for i in s.split("\n"): for i in s.split("\n"):
if "ESTABLISHED" in i and spec in i: if "ESTABLISHED:ESTABLISHED" in i and spec in i:
m = re.match(".* (\S*)->%s" % spec, i) s = i.split()
if m: if len(s) > 4:
s = m.group(1).split(":") s = s[4].split(":")
if len(s) == 2: if len(s) == 2:
return s[0], int(s[1]) return s[0], int(s[1])