18 files changed, 546 insertions, 21 deletions

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e1d972d04..d58e0abd8 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -47,7 +47,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@883476649888a9e8e219d5b2e6b789dc024f690c
+      uses: github/codeql-action/init@28eead240834b314f7def40f6fcba65d100d99b1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@883476649888a9e8e219d5b2e6b789dc024f690c
+      uses: github/codeql-action/autobuild@28eead240834b314f7def40f6fcba65d100d99b1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -72,4 +72,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@883476649888a9e8e219d5b2e6b789dc024f690c
+      uses: github/codeql-action/analyze@28eead240834b314f7def40f6fcba65d100d99b1
diff --git a/.gitignore b/.gitignore
index 29e0b63d6..e172d1af3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,8 @@ firemon.1
 firecfg.1
 jailcheck.1
 mkdeb.sh
+src/fnettrace-dns/fnettrace-dns
+src/fnettrace-sni/fnettrace-sni
 src/firejail/firejail
 src/firemon/firemon
 src/firecfg/firecfg
diff --git a/Makefile.in b/Makefile.in
index f38191880..9b1ecc4ad 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -29,7 +29,7 @@ APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profsta
 SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee src/fids/fids
 SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter
 SBOX_APPS_NON_DUMPABLE += src/fsec-optimize/fsec-optimize src/fsec-print/fsec-print src/fseccomp/fseccomp
-SBOX_APPS_NON_DUMPABLE += src/fnettrace/fnettrace
+SBOX_APPS_NON_DUMPABLE += src/fnettrace/fnettrace src/fnettrace-dns/fnettrace-dns src/fnettrace-sni/fnettrace-sni
 MYDIRS = src/lib $(MAN_SRC) $(COMPLETIONDIRS)
 MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so
 COMPLETIONS = src/zsh_completion/_firejail src/bash_completion/firejail.bash_completion
diff --git a/configure b/configure
index 6611a8817..f0a678473 100755
--- a/configure
+++ b/configure
@@ -4288,7 +4288,7 @@ fi
 
 ac_config_files="$ac_config_files mkdeb.sh"
 
-ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile"
+ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -5024,6 +5024,8 @@ do
     "src/jailcheck/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailcheck/Makefile" ;;
     "src/fids/Makefile") CONFIG_FILES="$CONFIG_FILES src/fids/Makefile" ;;
     "src/fnettrace/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace/Makefile" ;;
+    "src/fnettrace-dns/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace-dns/Makefile" ;;
+    "src/fnettrace-sni/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace-sni/Makefile" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
   esac
diff --git a/configure.ac b/configure.ac
index 4ca30e6d7..071dea228 100644
--- a/configure.ac
+++ b/configure.ac
@@ -280,7 +280,7 @@ AC_CONFIG_FILES([Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/
 src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \
 src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \
 src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \
-src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile])
+src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile])
 AC_OUTPUT
 
 cat <<EOF
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 2a0fec3c5..93679b472 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -599,7 +599,14 @@ noblacklist /var/lib/flatpak/exports
 blacklist /var/lib/flatpak/*
 
 # snap
+blacklist ${HOME}/snap
+blacklist ${PATH}/snap
+blacklist ${PATH}/snapctl
 blacklist ${RUNUSER}/snapd-session-agent.socket
+blacklist /snap
+blacklist /usr/lib/snapd
+blacklist /var/lib/snapd
+blacklist /var/snap
 
 # mail directories used by mutt
 blacklist ${HOME}/.Mail
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 558ae2446..e2e550368 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -815,6 +815,7 @@ blacklist ${HOME}/.local/share/Empathy
 blacklist ${HOME}/.local/share/Enpass
 blacklist ${HOME}/.local/share/FasterThanLight
 blacklist ${HOME}/.local/share/Flavio Tordini
+blacklist ${HOME}/.local/share/HotlineMiami
 blacklist ${HOME}/.local/share/IntoTheBreach
 blacklist ${HOME}/.local/share/JetBrains
 blacklist ${HOME}/.local/share/KDE/neochat
diff --git a/etc/profile-a-l/dnsmasq.profile b/etc/profile-a-l/dnsmasq.profile
index 2db1548a4..13efd2fa8 100644
--- a/etc/profile-a-l/dnsmasq.profile
+++ b/etc/profile-a-l/dnsmasq.profile
@@ -9,9 +9,10 @@ include globals.local
 
 noblacklist /sbin
 noblacklist /usr/sbin
+noblacklist /var/lib/libvirt
 
 blacklist /tmp/.X11-unix
-blacklist ${RUNUSER}/wayland-*
+blacklist ${RUNUSER}
 
 include disable-common.inc
 include disable-devel.inc
@@ -19,6 +20,9 @@ include disable-interpreters.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /var/lib/libvirt/dnsmasq
+whitelist /var/run
+
 caps.keep net_admin,net_bind_service,net_raw,setgid,setuid
 no3d
 nodvd
@@ -33,5 +37,6 @@ seccomp
 
 disable-mnt
 private
-private-cache
 private-dev
+private-tmp
+writable-var
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile
index 4137839f8..d6bc226a4 100644
--- a/etc/profile-m-z/steam.profile
+++ b/etc/profile-m-z/steam.profile
@@ -21,6 +21,7 @@ noblacklist ${HOME}/.local/share/cdprojektred
 noblacklist ${HOME}/.local/share/Dredmor
 noblacklist ${HOME}/.local/share/FasterThanLight
 noblacklist ${HOME}/.local/share/feral-interactive
+noblacklist ${HOME}/.local/share/HotlineMiami
 noblacklist ${HOME}/.local/share/IntoTheBreach
 noblacklist ${HOME}/.local/share/Paradox Interactive
 noblacklist ${HOME}/.local/share/PillarsOfEternity
@@ -70,6 +71,7 @@ mkdir ${HOME}/.local/share/cdprojektred
 mkdir ${HOME}/.local/share/Dredmor
 mkdir ${HOME}/.local/share/FasterThanLight
 mkdir ${HOME}/.local/share/feral-interactive
+mkdir ${HOME}/.local/share/HotlineMiami
 mkdir ${HOME}/.local/share/IntoTheBreach
 mkdir ${HOME}/.local/share/Paradox Interactive
 mkdir ${HOME}/.local/share/PillarsOfEternity
@@ -103,6 +105,7 @@ whitelist ${HOME}/.local/share/cdprojektred
 whitelist ${HOME}/.local/share/Dredmor
 whitelist ${HOME}/.local/share/FasterThanLight
 whitelist ${HOME}/.local/share/feral-interactive
+whitelist ${HOME}/.local/share/HotlineMiami
 whitelist ${HOME}/.local/share/IntoTheBreach
 whitelist ${HOME}/.local/share/Paradox Interactive
 whitelist ${HOME}/.local/share/PillarsOfEternity
diff --git a/etc/profile-m-z/unbound.profile b/etc/profile-m-z/unbound.profile
index e8424cd7d..ef43ee822 100644
--- a/etc/profile-m-z/unbound.profile
+++ b/etc/profile-m-z/unbound.profile
@@ -10,7 +10,7 @@ noblacklist /sbin
 noblacklist /usr/sbin
 
 blacklist /tmp/.X11-unix
-blacklist ${RUNUSER}/wayland-*
+blacklist ${RUNUSER}
 
 include disable-common.inc
 include disable-devel.inc
@@ -19,8 +19,11 @@ include disable-interpreters.inc
 include disable-programs.inc
 include disable-xdg.inc
 
+whitelist /usr/share/dns
 include whitelist-usr-share-common.inc
 
+whitelist /var/lib/ca-certificates
+read-only /var/lib/ca-certificates
 whitelist /var/lib/unbound
 whitelist /var/run
 
@@ -48,5 +51,4 @@ writable-var
 dbus-user none
 dbus-system none
 
-# mdwe can break modules/plugins
 memory-deny-write-execute
diff --git a/src/fnettrace-dns/Makefile.in b/src/fnettrace-dns/Makefile.in
new file mode 100644
index 000000000..6c11e5bc8
--- /dev/null
+++ b/src/fnettrace-dns/Makefile.in
@@ -0,0 +1,17 @@
+.PHONY: all
+all: fnettrace-dns
+
+include ../common.mk
+
+%.o : %.c $(H_FILE_LIST)
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+
+fnettrace-dns: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+
+.PHONY: clean
+clean:; rm -fr *.o fnettrace-dns *.gcov *.gcda *.gcno *.plist
+
+.PHONY: distclean
+distclean: clean
+        rm -fr Makefile
diff --git a/src/fnettrace-dns/fnettrace_dns.h b/src/fnettrace-dns/fnettrace_dns.h
new file mode 100644
index 000000000..db2e1a668
--- /dev/null
+++ b/src/fnettrace-dns/fnettrace_dns.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef FNETTRACE_DNS_H
+#define FNETTRACE_DNS_H
+
+#include "../include/common.h"
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <time.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+#endif
\ No newline at end of file
diff --git a/src/fnettrace-dns/main.c b/src/fnettrace-dns/main.c
new file mode 100644
index 000000000..0281b5157
--- /dev/null
+++ b/src/fnettrace-dns/main.c
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fnettrace_dns.h"
+#include <sys/ioctl.h>
+#include <time.h>
+#include <linux/filter.h>
+#include <linux/if_ether.h>
+#define MAX_BUF_SIZE (64 * 1024)
+
+// pkt - start of DNS layer
+void print_dns(uint32_t ip_src, unsigned char *pkt) {
+        assert(pkt);
+
+        char ip[30];
+        sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_src));
+        time_t seconds = time(NULL);
+        struct tm *t = localtime(&seconds);
+
+        // expecting a single question count
+        if (pkt[4] != 0 || pkt[5] != 1)
+                goto errout;
+
+        // check cname
+        unsigned char *ptr = pkt + 12;
+        int len = 0;
+        while (*ptr != 0 && len < 255) {        // 255 is the maximum length of a domain name including multiple '.'
+                if (*ptr > 63)  // the name left of a '.' is 63 length maximum
+                        goto errout;
+
+                int delta = *ptr + 1;
+                *ptr = '.';
+                len += delta;;
+                ptr += delta;
+        }
+
+        printf("%02d:%02d:%02d  %15s  %s\n", t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1);
+        return;
+
+errout:
+        printf("%02d:%02d:%02d  %15s  Error: invalid DNS packet\n", t->tm_hour, t->tm_min, t->tm_sec, ip);
+}
+
+// https://www.kernel.org/doc/html/latest/networking/filter.html
+static void custom_bpf(int sock) {
+        struct sock_filter code[] = {
+                //  sudo tcpdump ip and udp and src port 53 -dd
+                { 0x28, 0, 0, 0x0000000c },
+                { 0x15, 0, 8, 0x00000800 },
+                { 0x30, 0, 0, 0x00000017 },
+                { 0x15, 0, 6, 0x00000011 },
+                { 0x28, 0, 0, 0x00000014 },
+                { 0x45, 4, 0, 0x00001fff },
+                { 0xb1, 0, 0, 0x0000000e },
+                { 0x48, 0, 0, 0x0000000e },
+                { 0x15, 0, 1, 0x00000035 },
+                { 0x6, 0, 0, 0x00040000 },
+                { 0x6, 0, 0, 0x00000000 },
+        };
+
+        struct sock_fprog bpf = {
+                .len = (unsigned short) sizeof(code) / sizeof(code[0]),
+                .filter = code,
+        };
+
+        int rv = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf));
+        if (rv < 0) {
+                fprintf(stderr, "Error: cannot attach BPF filter\n");
+                exit(1);
+        }
+}
+
+static void run_trace(void) {
+        // grab all Ethernet packets and use a custom BPF filter to get only UDP from source port 53
+        int s = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
+        if (s < 0)
+                errExit("socket");
+        custom_bpf(s);
+
+        unsigned char buf[MAX_BUF_SIZE];
+        while (1) {
+                fd_set rfds;
+                FD_ZERO(&rfds);
+                FD_SET(s, &rfds);
+                struct timeval tv;
+                tv.tv_sec = 1;
+                tv.tv_usec = 0;
+                int rv = select(s + 1, &rfds, NULL, NULL, &tv);
+                if (rv < 0)
+                        errExit("select");
+                else if (rv == 0)
+                        continue;
+                unsigned bytes = recvfrom(s, buf, MAX_BUF_SIZE, 0, NULL, NULL);
+
+                if (bytes >= (14 + 20 + 8)) { // size of  MAC + IP + UDP headers
+                        uint8_t ip_hlen = (buf[14] & 0x0f) * 4;
+                        uint16_t port_src;
+                        memcpy(&port_src, buf + 14 + ip_hlen, 2);
+                        port_src = ntohs(port_src);
+                        uint8_t protocol = buf[14 + 9];
+                        uint32_t ip_src;
+                        memcpy(&ip_src, buf + 14 + 12, 4);
+                        ip_src = ntohl(ip_src);
+
+                        // if DNS packet, extract the query
+                        if (port_src == 53 && protocol == 0x11) // UDP protocol
+                                print_dns(ip_src, buf + 14 + ip_hlen + 8); // IP and UDP header len
+                }
+        }
+
+        close(s);
+}
+
+
+static void usage(void) {
+        printf("Usage: fnettrace-dns [OPTIONS]\n");
+        printf("Options:\n");
+        printf("   --help, -? - this help screen\n");
+        printf("\n");
+}
+
+int main(int argc, char **argv) {
+        int i;
+
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], "--help") == 0 || strcmp(argv[i], "-?") == 0) {
+                        usage();
+                        return 0;
+                }
+                else {
+                        fprintf(stderr, "Error: invalid argument\n");
+                        return 1;
+                }
+        }
+
+        if (getuid() != 0) {
+                fprintf(stderr, "Error: you need to be root to run this program\n");
+                return 1;
+        }
+
+        time_t now = time(NULL);
+        printf("DNS trace for %s\n", ctime(&now));
+        run_trace();
+
+        return 0;
+}
diff --git a/src/fnettrace-sni/Makefile.in b/src/fnettrace-sni/Makefile.in
new file mode 100644
index 000000000..9fe954874
--- /dev/null
+++ b/src/fnettrace-sni/Makefile.in
@@ -0,0 +1,17 @@
+.PHONY: all
+all: fnettrace-sni
+
+include ../common.mk
+
+%.o : %.c $(H_FILE_LIST)
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+
+fnettrace-sni: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+
+.PHONY: clean
+clean:; rm -fr *.o fnettrace-sni *.gcov *.gcda *.gcno *.plist
+
+.PHONY: distclean
+distclean: clean
+        rm -fr Makefile
diff --git a/src/fnettrace-sni/fnettrace_sni.h b/src/fnettrace-sni/fnettrace_sni.h
new file mode 100644
index 000000000..790a3ce7f
--- /dev/null
+++ b/src/fnettrace-sni/fnettrace_sni.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef FNETTRACE_SNI_H
+#define FNETTRACE_SNI_H
+
+#include "../include/common.h"
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <time.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+#endif
\ No newline at end of file
diff --git a/src/fnettrace-sni/main.c b/src/fnettrace-sni/main.c
new file mode 100644
index 000000000..ea7a91548
--- /dev/null
+++ b/src/fnettrace-sni/main.c
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fnettrace_sni.h"
+#include <sys/ioctl.h>
+#include <time.h>
+#include <linux/filter.h>
+#include <linux/if_ether.h>
+#define MAX_BUF_SIZE (64 * 1024)
+
+// pkt - start of TLS layer
+static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) {
+        assert(pkt);
+
+        char ip[30];
+        sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_dest));
+        time_t seconds = time(NULL);
+        struct tm *t = localtime(&seconds);
+
+        // expecting a handshake packet and client hello
+        if (pkt[0] != 0x16 || pkt[5] != 0x01)
+                goto errout;
+
+
+        // look for server name indication
+        unsigned char *ptr = pkt;
+        unsigned int i = 0;
+        char *name = NULL;
+        while (i < (len - 20)) {
+                // 3 zeros and 3 matching length fields
+                if (*ptr == 0 && *(ptr + 1) == 0 && (*(ptr + 2) == 0 || *(ptr + 2) == 1) && *(ptr + 6) == 0) {
+                        uint16_t len1;
+                        memcpy(&len1, ptr + 2, 2);
+                        len1 = ntohs(len1);
+
+                        uint16_t len2;
+                        memcpy(&len2, ptr + 4, 2);
+                        len2 = ntohs(len2);
+
+                        uint16_t len3;
+                        memcpy(&len3, ptr + 7, 2);
+                        len3 = ntohs(len3);
+
+                        if (len1 == (len2 + 2) && len1 == (len3 + 5)) {
+                                *(ptr + 9 + len3) = 0;
+                                name = (char *) (ptr + 9);
+                                break;
+                        }
+                }
+                ptr++;
+                i++;
+        }
+
+        if (name)
+                printf("%02d:%02d:%02d  %15s  %s\n", t->tm_hour, t->tm_min, t->tm_sec, ip, name);
+        else
+                goto nosni;
+        return;
+
+errout:
+        printf("%02d:%02d:%02d  %15s  Error: invalid TLS packet\n", t->tm_hour, t->tm_min, t->tm_sec, ip);
+        return;
+
+nosni:
+        printf("%02d:%02d:%02d  %15s  no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip);
+        return;
+}
+
+// https://www.kernel.org/doc/html/latest/networking/filter.html
+static void custom_bpf(int sock) {
+        struct sock_filter code[] = {
+                // sudo tcpdump "tcp port 443 and (tcp[((tcp[12] & 0xf0) >>2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >>2)+5] = 0x01)" -dd
+                { 0x28, 0, 0, 0x0000000c },
+                { 0x15, 27, 0, 0x000086dd },
+                { 0x15, 0, 26, 0x00000800 },
+                { 0x30, 0, 0, 0x00000017 },
+                { 0x15, 0, 24, 0x00000006 },
+                { 0x28, 0, 0, 0x00000014 },
+                { 0x45, 22, 0, 0x00001fff },
+                { 0xb1, 0, 0, 0x0000000e },
+                { 0x48, 0, 0, 0x0000000e },
+                { 0x15, 2, 0, 0x000001bb },
+                { 0x48, 0, 0, 0x00000010 },
+                { 0x15, 0, 17, 0x000001bb },
+                { 0x50, 0, 0, 0x0000001a },
+                { 0x54, 0, 0, 0x000000f0 },
+                { 0x74, 0, 0, 0x00000002 },
+                { 0xc, 0, 0, 0x00000000 },
+                { 0x7, 0, 0, 0x00000000 },
+                { 0x50, 0, 0, 0x0000000e },
+                { 0x15, 0, 10, 0x00000016 },
+                { 0xb1, 0, 0, 0x0000000e },
+                { 0x50, 0, 0, 0x0000001a },
+                { 0x54, 0, 0, 0x000000f0 },
+                { 0x74, 0, 0, 0x00000002 },
+                { 0x4, 0, 0, 0x00000005 },
+                { 0xc, 0, 0, 0x00000000 },
+                { 0x7, 0, 0, 0x00000000 },
+                { 0x50, 0, 0, 0x0000000e },
+                { 0x15, 0, 1, 0x00000001 },
+                { 0x6, 0, 0, 0x00040000 },
+                { 0x6, 0, 0, 0x00000000 },
+        };
+
+        struct sock_fprog bpf = {
+                .len = (unsigned short) sizeof(code) / sizeof(code[0]),
+                .filter = code,
+        };
+
+        int rv = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf));
+        if (rv < 0) {
+                fprintf(stderr, "Error: cannot attach BPF filter\n");
+                exit(1);
+        }
+}
+
+static void run_trace(void) {
+        // grab all Ethernet packets and use a custom BPF filter to get only UDP from source port 53
+        int s = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
+        if (s < 0)
+                errExit("socket");
+        custom_bpf(s);
+
+        unsigned char buf[MAX_BUF_SIZE];
+        while (1) {
+                fd_set rfds;
+                FD_ZERO(&rfds);
+                FD_SET(s, &rfds);
+                struct timeval tv;
+                tv.tv_sec = 1;
+                tv.tv_usec = 0;
+                int rv = select(s + 1, &rfds, NULL, NULL, &tv);
+                if (rv < 0)
+                        errExit("select");
+                else if (rv == 0)
+                        continue;
+                unsigned bytes = recvfrom(s, buf, MAX_BUF_SIZE, 0, NULL, NULL);
+
+                if (bytes >= (14 + 20 + 20)) { // size of  MAC + IP + TCP headers
+                        uint8_t ip_hlen = (buf[14] & 0x0f) * 4;
+                        uint16_t port_dest;
+                        memcpy(&port_dest, buf + 14 + ip_hlen + 2, 2);
+                        port_dest = ntohs(port_dest);
+                        uint8_t protocol = buf[14 + 9];
+                        uint32_t ip_dest;
+                        memcpy(&ip_dest, buf + 14 + 16, 4);
+                        ip_dest = ntohl(ip_dest);
+                        uint8_t tcp_hlen = (buf[14 + ip_hlen + 12] & 0xf0) >> 2;
+
+                        // if TLS packet, extract SNI
+                        if (port_dest == 443 && protocol == 6) // TCP protocol
+                                print_tls(ip_dest, buf + 14 + ip_hlen + tcp_hlen, bytes - 14 - ip_hlen - tcp_hlen); // IP and TCP header len
+                }
+        }
+
+        close(s);
+}
+
+
+static void usage(void) {
+        printf("Usage: fnettrace-sni [OPTIONS]\n");
+        printf("Options:\n");
+        printf("   --help, -? - this help screen\n");
+        printf("\n");
+}
+
+int main(int argc, char **argv) {
+        int i;
+
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], "--help") == 0 || strcmp(argv[i], "-?") == 0) {
+                        usage();
+                        return 0;
+                }
+                else {
+                        fprintf(stderr, "Error: invalid argument\n");
+                        return 1;
+                }
+        }
+
+        if (getuid() != 0) {
+                fprintf(stderr, "Error: you need to be root to run this program\n");
+                return 1;
+        }
+
+        time_t now = time(NULL);
+        printf("SNI trace for %s\n", ctime(&now));
+        run_trace();
+
+        return 0;
+}
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c
index 31d49d839..fd3cd5016 100644
--- a/src/fnettrace/main.c
+++ b/src/fnettrace/main.c
@@ -28,7 +28,7 @@ static char *arg_log = NULL;
 
 typedef struct hnode_t {
         struct hnode_t *hnext;  // used for hash table and unused linked list
-        struct hnode_t *dnext;  // used to display stremas on the screen
+        struct hnode_t *dnext;  // used to display streams on the screen
         uint32_t ip_src;
         uint32_t  bytes;        // number of bytes received in the last display interval
         uint16_t port_src;
@@ -221,6 +221,35 @@ static unsigned adjust_bandwidth(unsigned bw) {
         return (max < (sum / 2))? sum: max;
 }
 
+static inline const char *common_port(uint16_t port) {
+        if (port > 123)
+                return NULL;
+
+        if (port == 20 || port == 21)
+                return "(FTP)";
+        else if (port == 22)
+                return "(SSH)";
+        else if (port == 23)
+                return "(telnet)";
+        else if (port == 25)
+                return "(SMTP)";
+        else if (port == 67)
+                return "(DHCP)";
+        else if (port == 69)
+                return "(TFTP)";
+        else if (port == 80)
+                return "(HTTP)";
+        else if (port == 109)
+                return "(POP2)";
+        else if (port == 110)
+                return "(POP3)";
+        else if (port == 123)
+                return "(NTP)";
+
+        return NULL;
+}
+
+
 static void hnode_print(unsigned bw) {
         assert(!arg_netfilter);
         bw = (bw < 1024 * DISPLAY_INTERVAL)? 1024 * DISPLAY_INTERVAL: bw;
@@ -285,19 +314,19 @@ static void hnode_print(unsigned bw) {
                         else
                                 bwline = print_bw(ptr->bytes / bwunit);
 
-                        char *protocol = "";
-                        if (ptr->port_src == 80)
-                                protocol = "(HTTP)";
+                        const char *protocol = NULL;
+                        if (ptr->port_src == 443)
+                                protocol = "(TLS)";
+                        else if (ptr->port_src == 53)
+                                protocol = "(DNS)";
                         else if (ptr->port_src == 853)
                                 protocol = "(DoT)";
+                        else if ((protocol = common_port(ptr->port_src)) != NULL)
+                                ;
                         else if (ptr->protocol == 0x11)
                                 protocol = "(UDP)";
-/*
-                        else (ptr->port_src == 443)
-                                protocol = "TLS";
-                        else if (ptr->port_src == 53)
-                                protocol = "DNS";
-*/
+                        if (protocol == NULL)
+                                protocol = "";
 
                         len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d:%u%s %s\n",
                                 bytes, bwline, PRINT_IP(ptr->ip_src), ptr->port_src, protocol, ptr->hostname);
@@ -409,7 +438,8 @@ static void run_trace(void) {
                                 memcpy(&port_src, buf + hlen, 2);
                                 port_src = ntohs(port_src);
 
-                                hnode_add(ip_src, buf[9], port_src, bytes + 14);
+                                uint8_t protocol = buf[9];
+                                hnode_add(ip_src, protocol, port_src, bytes + 14);
                         }
                 }
         }
diff --git a/src/fnettrace/static-ip-map b/src/fnettrace/static-ip-map
index e24ecf218..17ffe7f82 100644
--- a/src/fnettrace/static-ip-map
+++ b/src/fnettrace/static-ip-map
@@ -37,8 +37,10 @@
 192.168.0.0/16 local network
 10.0.0.0/8 local network
 172.16.0.0/16 local network
+169.254.0.0/16 local link
 
 #  huge address ranges
+4.0.0.0/9 Level 3
 6.0.0.0/8 US Army
 7.0.0.0/8 US Army
 9.0.0.0/8 IBM