Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@
debug/
target/

pcap.pc

.cargo/

# These are backup files generated by rustfmt
**/*.rs.bk

Expand Down
10 changes: 9 additions & 1 deletion Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ path = "src/main.rs"
[dependencies]
anyhow = "1.0"
libc = "0.2"
arboard = { version = "3.6", features = ["wayland-data-control"] }
# arboard (clipboard) not available on Android - added in target-specific section below
crossterm = "0.29"
crossbeam = "0.8"
dashmap = "6.1"
Expand All @@ -45,12 +45,20 @@ flate2 = "1"
maxminddb = "0.28"
regex-lite = "0.1"

# Clipboard support for non-Android platforms
[target.'cfg(not(target_os = "android"))'.dependencies]
arboard = { version = "3.6", features = ["wayland-data-control"] }

[target.'cfg(target_os = "linux")'.dependencies]
procfs = "0.18"
libbpf-rs = { version = "0.26", optional = true }
landlock = { version = "0.4", optional = true }
caps = { version = "0.5", optional = true }

# Android uses Linux platform module but without eBPF/landlock
[target.'cfg(target_os = "android")'.dependencies]
procfs = "0.18"

[target.'cfg(windows)'.dependencies]
windows = { version = "0.62", features = [
"Win32_Foundation",
Expand Down
20 changes: 13 additions & 7 deletions src/app.rs
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ use crate::network::{
// Platform-specific interface stats provider
#[cfg(target_os = "freebsd")]
use crate::network::platform::FreeBSDStatsProvider as PlatformStatsProvider;
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
use crate::network::platform::LinuxStatsProvider as PlatformStatsProvider;
#[cfg(target_os = "macos")]
use crate::network::platform::MacOSStatsProvider as PlatformStatsProvider;
Expand All @@ -50,6 +50,7 @@ use std::sync::{LazyLock, Mutex};
/// Sandbox status information for UI display
#[cfg(any(
target_os = "linux",
target_os = "android",
target_os = "windows",
all(target_os = "macos", feature = "macos-sandbox")
))]
Expand All @@ -60,21 +61,22 @@ pub struct SandboxInfo {
/// Whether network connections are blocked
#[cfg(any(
target_os = "linux",
target_os = "android",
all(target_os = "macos", feature = "macos-sandbox")
))]
pub net_restricted: bool,
// Linux-specific fields (Landlock + capabilities)
/// Whether CAP_NET_RAW was dropped
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
pub cap_dropped: bool,
/// Whether CAP_BPF/CAP_PERFMON were dropped
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
pub ebpf_caps_dropped: bool,
/// Whether Landlock is available on this kernel
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
pub landlock_available: bool,
/// Whether Landlock filesystem restrictions are applied
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
pub fs_restricted: bool,
// macOS-specific fields (Seatbelt)
/// Whether Seatbelt sandbox was applied
Expand Down Expand Up @@ -478,6 +480,7 @@ pub struct App {
/// Sandbox status (Linux Landlock / macOS Seatbelt / Windows restricted token)
#[cfg(any(
target_os = "linux",
target_os = "android",
target_os = "windows",
all(target_os = "macos", feature = "macos-sandbox")
))]
Expand Down Expand Up @@ -584,6 +587,7 @@ impl App {
geoip_resolver,
#[cfg(any(
target_os = "linux",
target_os = "android",
target_os = "windows",
all(target_os = "macos", feature = "macos-sandbox")
))]
Expand Down Expand Up @@ -694,7 +698,7 @@ impl App {
*linktype_storage.write().unwrap() = Some(linktype);

// Drop CAP_NET_RAW now that the socket is open (Linux only)
#[cfg(all(target_os = "linux", feature = "landlock"))]
#[cfg(all(any(target_os = "linux", target_os = "android"), feature = "landlock"))]
{
if let Err(e) =
crate::network::platform::sandbox::capabilities::drop_cap_net_raw()
Expand Down Expand Up @@ -920,7 +924,7 @@ impl App {
info!("Packet processor {} started", id);

// Drop CAP_NET_RAW immediately as this thread doesn't need it (Linux only)
#[cfg(all(target_os = "linux", feature = "landlock"))]
#[cfg(all(any(target_os = "linux", target_os = "android"), feature = "landlock"))]
{
if let Err(e) =
crate::network::platform::sandbox::capabilities::drop_cap_net_raw()
Expand Down Expand Up @@ -1811,6 +1815,7 @@ impl App {
/// Get sandbox status information
#[cfg(any(
target_os = "linux",
target_os = "android",
target_os = "windows",
all(target_os = "macos", feature = "macos-sandbox")
))]
Expand All @@ -1824,6 +1829,7 @@ impl App {
/// Set sandbox status information
#[cfg(any(
target_os = "linux",
target_os = "android",
target_os = "windows",
all(target_os = "macos", feature = "macos-sandbox")
))]
Expand Down
4 changes: 2 additions & 2 deletions src/cli.rs
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
use clap::{Arg, Command};

#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
const INTERFACE_HELP: &str = "Network interface to monitor (use \"any\" to capture all interfaces)";

#[cfg(not(target_os = "linux"))]
#[cfg(not(any(target_os = "linux", target_os = "android")))]
const INTERFACE_HELP: &str = "Network interface to monitor";

#[cfg(target_os = "macos")]
Expand Down
12 changes: 12 additions & 0 deletions src/main.rs
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
use anyhow::Result;
#[cfg(not(target_os = "android"))]
use arboard::Clipboard;
use log::{LevelFilter, debug, error, info, warn};
use ratatui::prelude::CrosstermBackend;
Expand Down Expand Up @@ -518,6 +519,7 @@ fn sort_connections(
}

/// Copy text to the system clipboard and update UI state with feedback.
#[cfg(not(target_os = "android"))]
fn copy_to_clipboard(text: &str, display_msg: &str, ui_state: &mut ui::UIState, app: &app::App) {
// Used conditionally on Linux/FreeBSD for sandbox-aware error messages
let _ = app;
Expand Down Expand Up @@ -566,6 +568,16 @@ fn copy_to_clipboard(text: &str, display_msg: &str, ui_state: &mut ui::UIState,
}
}

/// Android clipboard stub - clipboard not available via arboard on Android
#[cfg(target_os = "android")]
fn copy_to_clipboard(_text: &str, display_msg: &str, ui_state: &mut ui::UIState, _app: &app::App) {
info!("Copy requested (Android): {}", display_msg);
ui_state.clipboard_message = Some((
format!("Copied (log only): {}", display_msg),
std::time::Instant::now(),
));
}

fn run_ui_loop<B: ratatui::prelude::Backend>(
terminal: &mut ui::Terminal<B>,
app: &app::App,
Expand Down
4 changes: 2 additions & 2 deletions src/network/capture.rs
Original file line number Diff line number Diff line change
Expand Up @@ -326,7 +326,7 @@ fn find_capture_device(interface_name: &Option<String>) -> Result<Device> {

// Special handling for 'any' interface
if name == "any" {
#[cfg(not(target_os = "linux"))]
#[cfg(not(any(target_os = "linux", target_os = "android")))]
{
return Err(anyhow!(
"The 'any' interface is only supported on Linux.\n\
Expand All @@ -335,7 +335,7 @@ fn find_capture_device(interface_name: &Option<String>) -> Result<Device> {
));
}

#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
{
log::info!("Using 'any' pseudo-interface to capture on all interfaces");
}
Expand Down
2 changes: 1 addition & 1 deletion src/network/platform/linux/interface_stats.rs
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ fn read_stat(base_path: &str, stat_name: &str) -> Result<u64, io::Error> {
}

#[cfg(test)]
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
mod tests {
use super::*;

Expand Down
30 changes: 15 additions & 15 deletions src/network/platform/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -18,19 +18,19 @@ pub enum DegradationReason {
None,
// Linux eBPF reasons
/// Missing CAP_BPF capability (Linux 5.8+)
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
MissingCapBpf,
/// Missing CAP_PERFMON capability (Linux 5.8+)
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
MissingCapPerfmon,
/// Missing both CAP_BPF and CAP_PERFMON (and no CAP_SYS_ADMIN fallback)
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
MissingBpfCapabilities,
/// eBPF feature not compiled in
#[cfg(all(target_os = "linux", not(feature = "ebpf")))]
#[cfg(all(any(target_os = "linux", target_os = "android"), not(feature = "ebpf")))]
EbpfFeatureDisabled,
/// Kernel doesn't support required eBPF features
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
KernelUnsupported,
// macOS PKTAP reasons
/// No root privileges for PKTAP
Expand All @@ -52,15 +52,15 @@ impl DegradationReason {
pub fn description(&self) -> &str {
match self {
Self::None => "",
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
Self::MissingCapBpf => "needs CAP_BPF",
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
Self::MissingCapPerfmon => "needs CAP_PERFMON",
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
Self::MissingBpfCapabilities => "needs CAP_BPF+CAP_PERFMON",
#[cfg(all(target_os = "linux", not(feature = "ebpf")))]
#[cfg(all(any(target_os = "linux", target_os = "android"), not(feature = "ebpf")))]
Self::EbpfFeatureDisabled => "eBPF feature disabled",
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
Self::KernelUnsupported => "kernel unsupported",
#[cfg(target_os = "macos")]
Self::MissingRootPrivileges => "needs root",
Expand All @@ -77,12 +77,12 @@ impl DegradationReason {
pub fn unavailable_feature(&self) -> Option<&str> {
match self {
Self::None => None,
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
Self::MissingCapBpf
| Self::MissingCapPerfmon
| Self::MissingBpfCapabilities
| Self::KernelUnsupported => Some("eBPF"),
#[cfg(all(target_os = "linux", not(feature = "ebpf")))]
#[cfg(all(any(target_os = "linux", target_os = "android"), not(feature = "ebpf")))]
Self::EbpfFeatureDisabled => Some("eBPF"),
#[cfg(target_os = "macos")]
Self::MissingRootPrivileges
Expand All @@ -96,7 +96,7 @@ impl DegradationReason {
// Platform-specific modules (one cfg per platform instead of many)
#[cfg(target_os = "freebsd")]
mod freebsd;
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
mod linux;
#[cfg(target_os = "macos")]
mod macos;
Expand All @@ -106,9 +106,9 @@ mod windows;
// Re-export factory functions and types from platform modules
#[cfg(target_os = "freebsd")]
pub use freebsd::{FreeBSDStatsProvider, create_process_lookup};
#[cfg(all(target_os = "linux", feature = "landlock"))]
#[cfg(all(any(target_os = "linux", target_os = "android"), feature = "landlock"))]
pub use linux::sandbox;
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
pub use linux::{LinuxStatsProvider, create_process_lookup};
#[cfg(all(target_os = "macos", feature = "macos-sandbox"))]
pub use macos::sandbox;
Expand Down
10 changes: 6 additions & 4 deletions src/network/privileges.rs
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
//! network packets on different platforms (Linux, macOS, Windows).

use anyhow::Result;
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
use anyhow::anyhow;
#[cfg(any(
not(any(
Expand Down Expand Up @@ -42,6 +42,7 @@ impl PrivilegeStatus {
/// Create a status indicating insufficient privileges
#[cfg(any(
target_os = "linux",
target_os = "android",
target_os = "macos",
target_os = "windows",
target_os = "freebsd",
Expand Down Expand Up @@ -84,7 +85,7 @@ impl PrivilegeStatus {

/// Check if the current process has sufficient privileges for packet capture
pub fn check_packet_capture_privileges() -> Result<PrivilegeStatus> {
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
{
check_linux_privileges()
}
Expand All @@ -106,6 +107,7 @@ pub fn check_packet_capture_privileges() -> Result<PrivilegeStatus> {

#[cfg(not(any(
target_os = "linux",
target_os = "android",
target_os = "macos",
target_os = "windows",
target_os = "freebsd"
Expand All @@ -117,7 +119,7 @@ pub fn check_packet_capture_privileges() -> Result<PrivilegeStatus> {
}
}

#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
fn check_linux_privileges() -> Result<PrivilegeStatus> {
use std::fs;

Expand Down Expand Up @@ -181,7 +183,7 @@ fn check_linux_privileges() -> Result<PrivilegeStatus> {
}

/// Detect if running inside a container
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
fn is_running_in_container() -> bool {
use std::fs;

Expand Down
2 changes: 1 addition & 1 deletion src/ui.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1974,7 +1974,7 @@ fn draw_stats_panel(

// Build the security/sandbox text up front so the chunk height can match
// its content. Otherwise long feature lists get clipped on narrow columns.
#[cfg(target_os = "linux")]
#[cfg(any(target_os = "linux", target_os = "android"))]
let security_text: Vec<Line> = {
let sandbox_info = app.get_sandbox_info();
let status_style = match sandbox_info.status.as_str() {
Expand Down