picnoir/nix-dissector
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
Wireshark dissector for the Nix daemon protocol.
11 commits 1 branch 0 tags 215 KiB
Lua 88.1%
Nix 10.7%
Shell 1.2%
Go to file
Félix Baylac Jacqué 05585f85fc read string: fix out of bound bug 
When the bytestring we were about to copy was at the end of the TVB,
we were outrunning the original buffer by trying to read "size + 1".

Stopping the read at size, then expending the newly created bytestring
instead.
2023-09-15 14:16:44 +02:00
doc/img Add brief readme. 2023-09-14 15:01:13 +02:00
.gitignore Gitignore 2023-09-14 14:05:44 +02:00
default.nix Add Nix build. 2023-09-13 20:08:15 +02:00
flake.lock Init: hello + op 2023-09-13 19:40:00 +02:00
flake.nix Add Nix build. 2023-09-13 20:08:15 +02:00
nix-packet.lua read string: fix out of bound bug 2023-09-15 14:16:44 +02:00
README.md Add brief readme. 2023-09-14 15:01:13 +02:00
run-test Nix: add shell and test script 2023-09-14 14:05:16 +02:00
shell.nix Nix: add shell and test script 2023-09-14 14:05:16 +02:00

README.md

Nix Daemon Wireshark Dissector

Wireshark lua dissector for the Nix daemon Unix domain socket. A useful tool to debug the Nix daemon protocol.

Screenshot showing a Wireshark window dissecting the Nix daemon protocol

Usage

With flakes:

nix run .#

Without flakes:

"$(nix-build)/bin/snoop-nix-daemon"

A Wireshark window appears and start to dissect the packets passing through /nix/var/nix/daemon-socket/socket, the Nix daemon socket.

Background

Wireshark cannot listen to Unix domain sockets out of the box. We leverage the sockdump tool to capture the daemon packets before sending them to Wireshark's stdin. Under the hood, sockdump uses BPF (through BCC) to intercept the Unix socket packets. We need the root privilege to load this BPF program to the kernel.

In this repository, you can also find a Lua wireshark dissector in charge of parsing the Nix daemon protocol.