]>
git.proxmox.com Git - ovs.git/blob - lib/pcap-file.c
2 * Copyright (c) 2009, 2010, 2012, 2013, 2014 Nicira, Inc.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #include "pcap-file.h"
24 #include "byte-order.h"
26 #include "dp-packet.h"
31 #include "unaligned.h"
32 #include "openvswitch/vlog.h"
34 VLOG_DEFINE_THIS_MODULE(pcap
);
37 uint32_t magic_number
; /* magic number */
38 uint16_t version_major
; /* major version number */
39 uint16_t version_minor
; /* minor version number */
40 int32_t thiszone
; /* GMT to local correction */
41 uint32_t sigfigs
; /* accuracy of timestamps */
42 uint32_t snaplen
; /* max length of captured packets */
43 uint32_t network
; /* data link type */
45 BUILD_ASSERT_DECL(sizeof(struct pcap_hdr
) == 24);
48 uint32_t ts_sec
; /* timestamp seconds */
49 uint32_t ts_usec
; /* timestamp microseconds */
50 uint32_t incl_len
; /* number of octets of packet saved in file */
51 uint32_t orig_len
; /* actual length of packet */
53 BUILD_ASSERT_DECL(sizeof(struct pcaprec_hdr
) == 16);
56 ovs_pcap_open(const char *file_name
, const char *mode
)
62 ovs_assert(!strcmp(mode
, "rb") ||
63 !strcmp(mode
, "wb") ||
66 file
= fopen(file_name
, mode
);
68 VLOG_WARN("%s: failed to open pcap file for %s (%s)", file_name
,
69 (mode
[0] == 'r' ? "reading"
70 : mode
[0] == 'w' ? "writing"
78 error
= ovs_pcap_read_header(file
);
87 ovs_pcap_write_header(file
);
91 if (!fstat(fileno(file
), &s
) && !s
.st_size
) {
92 ovs_pcap_write_header(file
);
103 ovs_pcap_read_header(FILE *file
)
106 if (fread(&ph
, sizeof ph
, 1, file
) != 1) {
107 int error
= ferror(file
) ? errno
: EOF
;
108 VLOG_WARN("failed to read pcap header: %s", ovs_retval_to_string(error
));
111 if (ph
.magic_number
!= 0xa1b2c3d4 && ph
.magic_number
!= 0xd4c3b2a1) {
112 VLOG_WARN("bad magic 0x%08"PRIx32
" reading pcap file "
113 "(expected 0xa1b2c3d4 or 0xd4c3b2a1)", ph
.magic_number
);
120 ovs_pcap_write_header(FILE *file
)
122 /* The pcap reader is responsible for figuring out endianness based on the
123 * magic number, so the lack of htonX calls here is intentional. */
125 ph
.magic_number
= 0xa1b2c3d4;
126 ph
.version_major
= 2;
127 ph
.version_minor
= 4;
131 ph
.network
= 1; /* Ethernet */
132 ignore(fwrite(&ph
, sizeof ph
, 1, file
));
136 ovs_pcap_read(FILE *file
, struct dp_packet
**bufp
, long long int *when
)
138 struct pcaprec_hdr prh
;
139 struct dp_packet
*buf
;
147 if (fread(&prh
, sizeof prh
, 1, file
) != 1) {
150 VLOG_WARN("failed to read pcap record header: %s",
151 ovs_retval_to_string(error
));
158 /* Calculate length. */
162 len
= uint32_byteswap(len
);
164 VLOG_WARN("bad packet length %"PRIuSIZE
" or %"PRIu32
166 len
, uint32_byteswap(len
));
171 /* Calculate time. */
173 uint32_t ts_sec
= swap
? uint32_byteswap(prh
.ts_sec
) : prh
.ts_sec
;
174 uint32_t ts_usec
= swap
? uint32_byteswap(prh
.ts_usec
) : prh
.ts_usec
;
175 *when
= ts_sec
* 1000LL + ts_usec
/ 1000;
179 buf
= dp_packet_new(len
);
180 data
= dp_packet_put_uninit(buf
, len
);
181 if (fread(data
, len
, 1, file
) != 1) {
182 int error
= ferror(file
) ? errno
: EOF
;
183 VLOG_WARN("failed to read pcap packet: %s",
184 ovs_retval_to_string(error
));
185 dp_packet_delete(buf
);
193 ovs_pcap_write(FILE *file
, struct dp_packet
*buf
)
195 struct pcaprec_hdr prh
;
199 prh
.ts_sec
= tv
.tv_sec
;
200 prh
.ts_usec
= tv
.tv_usec
;
201 prh
.incl_len
= dp_packet_size(buf
);
202 prh
.orig_len
= dp_packet_size(buf
);
203 ignore(fwrite(&prh
, sizeof prh
, 1, file
));
204 ignore(fwrite(dp_packet_data(buf
), dp_packet_size(buf
), 1, file
));
208 ovs_be32 nw_src
, nw_dst
;
209 ovs_be16 tp_src
, tp_dst
;
213 struct hmap_node hmap_node
;
216 struct dp_packet payload
;
224 tcp_stream_destroy(struct tcp_reader
*r
, struct tcp_stream
*stream
)
226 hmap_remove(&r
->streams
, &stream
->hmap_node
);
227 dp_packet_uninit(&stream
->payload
);
231 /* Returns a new data structure for extracting TCP stream data from an
232 * Ethernet packet capture */
234 tcp_reader_open(void)
236 struct tcp_reader
*r
;
238 r
= xmalloc(sizeof *r
);
239 hmap_init(&r
->streams
);
243 /* Closes and frees 'r'. */
245 tcp_reader_close(struct tcp_reader
*r
)
247 struct tcp_stream
*stream
, *next_stream
;
249 HMAP_FOR_EACH_SAFE (stream
, next_stream
, hmap_node
, &r
->streams
) {
250 tcp_stream_destroy(r
, stream
);
252 hmap_destroy(&r
->streams
);
256 static struct tcp_stream
*
257 tcp_stream_lookup(struct tcp_reader
*r
,
258 const struct tcp_key
*key
, uint32_t hash
)
260 struct tcp_stream
*stream
;
262 HMAP_FOR_EACH_WITH_HASH (stream
, hmap_node
, hash
, &r
->streams
) {
263 if (!memcmp(&stream
->key
, key
, sizeof *key
)) {
270 static struct tcp_stream
*
271 tcp_stream_new(struct tcp_reader
*r
, const struct tcp_key
*key
, uint32_t hash
)
273 struct tcp_stream
*stream
;
275 stream
= xmalloc(sizeof *stream
);
276 hmap_insert(&r
->streams
, &stream
->hmap_node
, hash
);
277 memcpy(&stream
->key
, key
, sizeof *key
);
279 dp_packet_init(&stream
->payload
, 2048);
283 /* Processes 'packet' through TCP reader 'r'. The caller must have already
284 * extracted the packet's headers into 'flow', using flow_extract().
286 * If 'packet' is a TCP packet, then the reader attempts to reconstruct the
287 * data stream. If successful, it returns an dp_packet that represents the data
288 * stream so far. The caller may examine the data in the dp_packet and pull off
289 * any data that it has fully processed. The remaining data that the caller
290 * does not pull off will be presented again in future calls if more data
291 * arrives in the stream.
293 * Returns null if 'packet' doesn't add new data to a TCP stream. */
295 tcp_reader_run(struct tcp_reader
*r
, const struct flow
*flow
,
296 const struct dp_packet
*packet
)
298 struct tcp_stream
*stream
;
299 struct tcp_header
*tcp
;
300 struct dp_packet
*payload
;
301 unsigned int l7_length
;
306 const char *l7
= dp_packet_get_tcp_payload(packet
);
308 if (flow
->dl_type
!= htons(ETH_TYPE_IP
)
309 || flow
->nw_proto
!= IPPROTO_TCP
313 tcp
= dp_packet_l4(packet
);
314 flags
= TCP_FLAGS(tcp
->tcp_ctl
);
315 l7_length
= (char *) dp_packet_tail(packet
) - l7
;
316 seq
= ntohl(get_16aligned_be32(&tcp
->tcp_seq
));
319 memset(&key
, 0, sizeof key
);
320 key
.nw_src
= flow
->nw_src
;
321 key
.nw_dst
= flow
->nw_dst
;
322 key
.tp_src
= flow
->tp_src
;
323 key
.tp_dst
= flow
->tp_dst
;
324 hash
= hash_bytes(&key
, sizeof key
, 0);
326 /* Find existing stream or start a new one for a SYN or if there's data. */
327 stream
= tcp_stream_lookup(r
, &key
, hash
);
329 if (flags
& TCP_SYN
|| l7_length
) {
330 stream
= tcp_stream_new(r
, &key
, hash
);
331 stream
->seq_no
= flags
& TCP_SYN
? seq
+ 1 : seq
;
337 payload
= &stream
->payload
;
338 if (flags
& TCP_SYN
|| !stream
->seq_no
) {
339 dp_packet_clear(payload
);
340 stream
->seq_no
= seq
+ 1;
342 } else if (flags
& (TCP_FIN
| TCP_RST
)) {
343 tcp_stream_destroy(r
, stream
);
345 } else if (seq
== stream
->seq_no
) {
346 /* Shift all of the existing payload to the very beginning of the
347 * allocated space, so that we reuse allocated space instead of
348 * continually expanding it. */
349 dp_packet_shift(payload
, (char *) dp_packet_base(payload
) - (char *) dp_packet_data(payload
));
351 dp_packet_put(payload
, l7
, l7_length
);
352 stream
->seq_no
+= l7_length
;