droe/sslsplit — pull request #36 by landonf (2014-10-22 05:15:59+00:00)
Title: Local process info + Custom Log Specs

Howdy,

I'm sending this as a pull request — the code does work, but it's substantial enough that I wanted to review the direction with you before proceeding further. I still need to update the man page, etc.

This set of changes adds (along with Mac OS X support for all of the additions):

- A generic extension to the NAT API that provides (if available and supported) the pid_t of the process associated with a nat table entry.
- Additions to the sys APIs for looking up process info based on pid (name/path, uid, gid).
- Additions to the sys API for mapping UIDs and GIDs to the associated user and group names.
- A new logging mechanism ("log specs") that allows for specifying log paths based on format string specifiers; this is where the process info can actually be used.

Here's the usage documentation I wrote for the logspec behavior:

-F pathspec content log: full data to separate files with the given path spec (excludes -L/-S):
pathspec =
The following directives are supported.
%d - dest address:port
%s - source address:port
%x - base name of local process. if unavailable, will be skipped.
%X - full path to local process; . if unavailable, will be skipped.
%u - username or uid of local process. if unavailable, will be skipped
%g - group or gid of local process. if unavailable, will be skipped
%T - initial connection time as an ISO 8601 UTC timestamp
%% - literal '%'
e.g.
"/var/log/sslsplit/%X/%u-%A:%P-%a:%p-%T"

Cheers,
Landon