🌈 Sync 2026-07-25 08:33:42

luci-app-packet-capture/root/usr/libexec/packet_capture

@@ -11,17 +11,68 @@ end
 
 local args = "-n"
 local duration = ""
+local workdir = "/var/run/packet_capture"
+local filterfile = workdir .. "/tcpdump_filter"
+local pcapbase = workdir .. "/capture.pcap"
+local outputfile = "/tmp/capture.pcap"
+
+local function validate_args(value)
+	if type(value) ~= "string" or value == "" then
+		return false
+	end
+	local tokens = {}
+	for token in value:gmatch("%S+") do
+		tokens[#tokens + 1] = token
+	end
+	local i = 1
+	while i <= #tokens do
+		local token = tokens[i]
+		if token == "-n" or token == "-e" then
+			i = i + 1
+		elseif token == "-i" then
+			if not tokens[i + 1] or not tokens[i + 1]:match("^[%w_.:-]+$") then return false end
+			i = i + 2
+		elseif token == "-c" then
+			if not tokens[i + 1] or not tokens[i + 1]:match("^%d+$") then return false end
+			i = i + 2
+		elseif token == "-W" then
+			if tokens[i + 1] ~= "2" then return false end
+			i = i + 2
+		elseif token == "-C" then
+			if not tokens[i + 1] or not tokens[i + 1]:match("^%d+$") then return false end
+			i = i + 2
+		elseif token == "-w" then
+			if tokens[i + 1] ~= pcapbase then return false end
+			i = i + 2
+		elseif token == "-z" then
+			if tokens[i + 1] ~= "/usr/libexec/packet_capture_stop" then return false end
+			i = i + 2
+		elseif token == "-F" then
+			if tokens[i + 1] ~= filterfile then return false end
+			i = i + 2
+		else
+			return false
+		end
+	end
+	return true
+end
 
 if arg[1] ~= nil then
 	args = arg[1]
-	if arg[2] ~= "" then
+	if not validate_args(args) then
+		error("Invalid tcpdump arguments")
+	end
+	if arg[2] ~= nil and arg[2] ~= "" then
 		duration = arg[2]
+		if not duration:match("^%d+$") then
+			error("Invalid duration")
+		end
 	end
 end
 
-local filter = fs.stat("/tmp/tcpdump_filter")
+local filter = fs.stat(filterfile)
 if filter then
-	args = args .. " -F /tmp/tcpdump_filter"
+	args = args .. " -F " .. filterfile
 end
 
 local ubus_objects = {
@@ -48,14 +99,14 @@ for line in pipe:lines() do
 		conn:notify(ubus_objects.tcpdump.__ubusobj, "tcpdump.data", params)
 end
 
-local pcap = fs.stat("/tmp/capture.pcap0")
+local pcap = fs.stat(pcapbase .. "0")
 if pcap then
-	fs.move("/tmp/capture.pcap0","/tmp/capture.pcap")
-	fs.remove("/tmp/capture.pcap1")
+	fs.move(pcapbase .. "0", outputfile)
+	fs.remove(pcapbase .. "1")
 end
 
 if filter then
-	fs.remove("/tmp/tcpdump_filter")
+	fs.remove(filterfile)
 end
 
 conn:close()

luci-app-packet-capture/root/usr/libexec/packet_capture_start

@@ -3,12 +3,18 @@
 . /usr/share/libubox/jshn.sh
 
 PIDFILE="/var/run/packet_capture.pid"
+WORKDIR="/var/run/packet_capture"
+FILTERFILE="$WORKDIR/tcpdump_filter"
+PCAPFILE="$WORKDIR/capture.pcap"
 
-if [ -f "$PIDFILE"];then
+if [ -f "$PIDFILE" ]; then
     echo "error: Packet capture is running"
     exit 1
 fi
 
+mkdir -p "$WORKDIR"
+chmod 0700 "$WORKDIR"
+
 json_load "$1"
 json_get_var interface interface
 json_get_var filter filter
@@ -20,13 +26,19 @@ json_get_var file file
 
 args="-n"
 
-if [ "$domains" == "1" ];then
+if [ "$domains" = "1" ];then
 	args=""
 fi
 
 if  [ -n "$interface" ];then
+	case "$interface" in
+		*[!A-Za-z0-9_.:-]*)
+			echo "error: Incorrect format of an interface"
+			exit 1
+		;;
+	esac
 	ip a show "$interface" > /dev/null 2>&1
-	if [ "$?" == "1" ]; then
+	if [ "$?" -ne 0 ]; then
         echo "error: Incorrect format of an interface"
         exit 1
     fi
@@ -35,7 +47,7 @@ if  [ -n "$interface" ];then
 fi
 
 if [ -n "$packets" ];then
-    echo "$packets" | egrep  '^[0-9]*$'
+    echo "$packets" | egrep '^[0-9]+$' >/dev/null
     if [ "$?" -eq 0 ];then
         args="$args -c $packets"
     else
@@ -44,13 +56,21 @@ if [ -n "$packets" ];then
     fi
 fi
 
-if [ "$verbose" == "1"  ];then
+if [ -n "$duration" ];then
+	echo "$duration" | egrep '^[0-9]+$' >/dev/null
+	if [ "$?" -ne 0 ];then
+		echo "error: Incorrect duration argument"
+		exit 1
+	fi
+fi
+
+if [ "$verbose" = "1"  ];then
 	args="$args  -e"
 fi
 
-if [ "$file" == "1" ];then
+if [ "$file" = "1" ];then
 	mem=$(awk '/MemTotal/ {print $2}' /proc/meminfo)
-	args="$args -W 2 -C $((mem/(1024 * 10))) -w /tmp/capture.pcap -z /usr/libexec/packet_capture_stop"
+	args="$args -W 2 -C $((mem/(1024 * 10))) -w $PCAPFILE -z /usr/libexec/packet_capture_stop"
 fi
 
 if [ -n "$filter" ];then
@@ -59,7 +79,7 @@ if [ -n "$filter" ];then
 		echo "error: Incorrect filter argument"
 		exit 1
 	fi
-	echo "$filter" > /tmp/tcpdump_filter
+	( umask 077; printf '%s\n' "$filter" > "$FILTERFILE" )
 fi
 
 (/usr/libexec/packet_capture "$args" "$duration")&