]>
git.proxmox.com Git - ovs.git/blob - lib/pcap-file.c
2 * Copyright (c) 2009, 2010, 2012, 2013, 2014, 2015 Nicira, Inc.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #include "pcap-file.h"
24 #include "byte-order.h"
26 #include "dp-packet.h"
28 #include "openvswitch/hmap.h"
31 #include "unaligned.h"
33 #include "openvswitch/vlog.h"
35 VLOG_DEFINE_THIS_MODULE(pcap
);
49 enum ts_resolution resolution
;
50 enum network_type network
;
54 uint32_t magic_number
; /* magic number */
55 uint16_t version_major
; /* major version number */
56 uint16_t version_minor
; /* minor version number */
57 int32_t thiszone
; /* GMT to local correction */
58 uint32_t sigfigs
; /* accuracy of timestamps */
59 uint32_t snaplen
; /* max length of captured packets */
60 uint32_t network
; /* data link type */
62 BUILD_ASSERT_DECL(sizeof(struct pcap_hdr
) == 24);
65 uint32_t ts_sec
; /* timestamp seconds */
66 uint32_t ts_subsec
; /* timestamp subseconds */
67 uint32_t incl_len
; /* number of octets of packet saved in file */
68 uint32_t orig_len
; /* actual length of packet */
70 BUILD_ASSERT_DECL(sizeof(struct pcaprec_hdr
) == 16);
73 ovs_pcap_open(const char *file_name
, const char *mode
)
76 struct pcap_file
*p_file
;
79 ovs_assert(!strcmp(mode
, "rb") ||
80 !strcmp(mode
, "wb") ||
83 p_file
= xmalloc(sizeof *p_file
);
84 p_file
->file
= fopen(file_name
, mode
);
85 p_file
->resolution
= PCAP_USEC
;
86 if (p_file
->file
== NULL
) {
87 VLOG_WARN("%s: failed to open pcap file for %s (%s)", file_name
,
88 (mode
[0] == 'r' ? "reading"
89 : mode
[0] == 'w' ? "writing"
97 error
= ovs_pcap_read_header(p_file
);
100 ovs_pcap_close(p_file
);
106 ovs_pcap_write_header(p_file
);
110 if (!fstat(fileno(p_file
->file
), &s
) && !s
.st_size
) {
111 ovs_pcap_write_header(p_file
);
123 ovs_pcap_stdout(void)
125 struct pcap_file
*p_file
= xmalloc(sizeof *p_file
);
126 p_file
->file
= stdout
;
131 ovs_pcap_read_header(struct pcap_file
*p_file
)
134 if (fread(&ph
, sizeof ph
, 1, p_file
->file
) != 1) {
135 int error
= ferror(p_file
->file
) ? errno
: EOF
;
136 VLOG_WARN("failed to read pcap header: %s", ovs_retval_to_string(error
));
140 if (ph
.magic_number
== 0xa1b2c3d4 || ph
.magic_number
== 0xd4c3b2a1) {
141 byte_swap
= ph
.magic_number
== 0xd4c3b2a1;
142 p_file
->resolution
= PCAP_USEC
;
143 } else if (ph
.magic_number
== 0xa1b23c4d ||
144 ph
.magic_number
== 0x4d3cb2a1) {
145 byte_swap
= ph
.magic_number
== 0x4d3cb2a1;
146 p_file
->resolution
= PCAP_NSEC
;
148 VLOG_WARN("bad magic 0x%08"PRIx32
" reading pcap file "
149 "(expected 0xa1b2c3d4, 0xa1b23c4d, 0xd4c3b2a1, "
150 "or 0x4d3cb2a1)", ph
.magic_number
);
153 p_file
->network
= byte_swap
? uint32_byteswap(ph
.network
) : ph
.network
;
154 if (p_file
->network
!= PCAP_ETHERNET
&&
155 p_file
->network
!= PCAP_LINUX_SLL
) {
156 VLOG_WARN("unknown network type %u reading pcap file",
157 (unsigned int) p_file
->network
);
164 ovs_pcap_write_header(struct pcap_file
*p_file
)
166 /* The pcap reader is responsible for figuring out endianness based on the
167 * magic number, so the lack of htonX calls here is intentional. */
169 ph
.magic_number
= 0xa1b2c3d4;
170 ph
.version_major
= 2;
171 ph
.version_minor
= 4;
175 ph
.network
= 1; /* Ethernet */
176 ignore(fwrite(&ph
, sizeof ph
, 1, p_file
->file
));
177 fflush(p_file
->file
);
181 ovs_pcap_read(struct pcap_file
*p_file
, struct dp_packet
**bufp
,
184 struct pcaprec_hdr prh
;
185 struct dp_packet
*buf
;
193 if (fread(&prh
, sizeof prh
, 1, p_file
->file
) != 1) {
194 if (ferror(p_file
->file
)) {
196 VLOG_WARN("failed to read pcap record header: %s",
197 ovs_retval_to_string(error
));
204 /* Calculate length. */
208 len
= uint32_byteswap(len
);
210 VLOG_WARN("bad packet length %"PRIuSIZE
" or %"PRIu32
" "
212 len
, uint32_byteswap(len
));
217 /* Calculate time. */
219 uint32_t ts_sec
= swap
? uint32_byteswap(prh
.ts_sec
) : prh
.ts_sec
;
220 uint32_t ts_subsec
= swap
? uint32_byteswap(prh
.ts_subsec
)
222 ts_subsec
= p_file
->resolution
== PCAP_USEC
? ts_subsec
/ 1000
223 : ts_subsec
/ 1000000;
224 *when
= ts_sec
* 1000LL + ts_subsec
;
227 /* Read packet. Packet type is Ethernet */
228 buf
= dp_packet_new(len
);
229 data
= dp_packet_put_uninit(buf
, len
);
230 if (fread(data
, len
, 1, p_file
->file
) != 1) {
231 int error
= ferror(p_file
->file
) ? errno
: EOF
;
232 VLOG_WARN("failed to read pcap packet: %s",
233 ovs_retval_to_string(error
));
234 dp_packet_delete(buf
);
238 if (p_file
->network
== PCAP_LINUX_SLL
) {
239 /* This format doesn't include the destination Ethernet address, which
243 ovs_be16 packet_type
;
246 struct eth_addr dl_src
;
250 const struct sll_header
*sll
;
251 if (len
< sizeof *sll
) {
252 VLOG_WARN("pcap packet too short for SLL header");
253 dp_packet_delete(buf
);
257 /* Pull Linux SLL header. */
258 sll
= dp_packet_pull(buf
, sizeof *sll
);
259 if (sll
->lla_len
!= htons(6)) {
260 ovs_hex_dump(stdout
, sll
, sizeof *sll
, 0, false);
261 VLOG_WARN("bad SLL header");
262 dp_packet_delete(buf
);
266 /* Push Ethernet header. */
267 struct eth_header eth
= {
268 /* eth_dst is all zeros because the format doesn't include it. */
269 .eth_src
= sll
->dl_src
,
270 .eth_type
= sll
->protocol
,
272 dp_packet_push(buf
, ð
, sizeof eth
);
280 ovs_pcap_write(struct pcap_file
*p_file
, struct dp_packet
*buf
)
282 struct pcaprec_hdr prh
;
285 ovs_assert(dp_packet_is_eth(buf
));
288 prh
.ts_sec
= tv
.tv_sec
;
289 prh
.ts_subsec
= tv
.tv_usec
;
290 prh
.incl_len
= dp_packet_size(buf
);
291 prh
.orig_len
= dp_packet_size(buf
);
292 ignore(fwrite(&prh
, sizeof prh
, 1, p_file
->file
));
293 ignore(fwrite(dp_packet_data(buf
), dp_packet_size(buf
), 1, p_file
->file
));
294 fflush(p_file
->file
);
298 ovs_pcap_close(struct pcap_file
*p_file
)
300 if (p_file
->file
!= stdout
) {
301 fclose(p_file
->file
);
307 ovs_be32 nw_src
, nw_dst
;
308 ovs_be16 tp_src
, tp_dst
;
312 struct hmap_node hmap_node
;
315 struct dp_packet payload
;
323 tcp_stream_destroy(struct tcp_reader
*r
, struct tcp_stream
*stream
)
325 hmap_remove(&r
->streams
, &stream
->hmap_node
);
326 dp_packet_uninit(&stream
->payload
);
330 /* Returns a new data structure for extracting TCP stream data from an
331 * Ethernet packet capture */
333 tcp_reader_open(void)
335 struct tcp_reader
*r
;
337 r
= xmalloc(sizeof *r
);
338 hmap_init(&r
->streams
);
342 /* Closes and frees 'r'. */
344 tcp_reader_close(struct tcp_reader
*r
)
346 struct tcp_stream
*stream
, *next_stream
;
348 HMAP_FOR_EACH_SAFE (stream
, next_stream
, hmap_node
, &r
->streams
) {
349 tcp_stream_destroy(r
, stream
);
351 hmap_destroy(&r
->streams
);
355 static struct tcp_stream
*
356 tcp_stream_lookup(struct tcp_reader
*r
,
357 const struct tcp_key
*key
, uint32_t hash
)
359 struct tcp_stream
*stream
;
361 HMAP_FOR_EACH_WITH_HASH (stream
, hmap_node
, hash
, &r
->streams
) {
362 if (!memcmp(&stream
->key
, key
, sizeof *key
)) {
369 static struct tcp_stream
*
370 tcp_stream_new(struct tcp_reader
*r
, const struct tcp_key
*key
, uint32_t hash
)
372 struct tcp_stream
*stream
;
374 stream
= xmalloc(sizeof *stream
);
375 hmap_insert(&r
->streams
, &stream
->hmap_node
, hash
);
376 memcpy(&stream
->key
, key
, sizeof *key
);
378 dp_packet_init(&stream
->payload
, 2048);
382 /* Processes 'packet' through TCP reader 'r'. The caller must have already
383 * extracted the packet's headers into 'flow', using flow_extract().
385 * If 'packet' is a TCP packet, then the reader attempts to reconstruct the
386 * data stream. If successful, it returns an dp_packet that represents the data
387 * stream so far. The caller may examine the data in the dp_packet and pull off
388 * any data that it has fully processed. The remaining data that the caller
389 * does not pull off will be presented again in future calls if more data
390 * arrives in the stream.
392 * Returns null if 'packet' doesn't add new data to a TCP stream. */
394 tcp_reader_run(struct tcp_reader
*r
, const struct flow
*flow
,
395 const struct dp_packet
*packet
)
397 struct tcp_stream
*stream
;
398 struct tcp_header
*tcp
;
399 struct dp_packet
*payload
;
400 unsigned int l7_length
;
405 const char *l7
= dp_packet_get_tcp_payload(packet
);
407 if (flow
->dl_type
!= htons(ETH_TYPE_IP
)
408 || flow
->nw_proto
!= IPPROTO_TCP
412 tcp
= dp_packet_l4(packet
);
413 flags
= TCP_FLAGS(tcp
->tcp_ctl
);
414 l7_length
= (char *) dp_packet_tail(packet
) - l7
;
415 seq
= ntohl(get_16aligned_be32(&tcp
->tcp_seq
));
418 memset(&key
, 0, sizeof key
);
419 key
.nw_src
= flow
->nw_src
;
420 key
.nw_dst
= flow
->nw_dst
;
421 key
.tp_src
= flow
->tp_src
;
422 key
.tp_dst
= flow
->tp_dst
;
423 hash
= hash_bytes(&key
, sizeof key
, 0);
425 /* Find existing stream or start a new one for a SYN or if there's data. */
426 stream
= tcp_stream_lookup(r
, &key
, hash
);
428 if (flags
& TCP_SYN
|| l7_length
) {
429 stream
= tcp_stream_new(r
, &key
, hash
);
430 stream
->seq_no
= flags
& TCP_SYN
? seq
+ 1 : seq
;
436 payload
= &stream
->payload
;
437 if (flags
& TCP_SYN
|| !stream
->seq_no
) {
438 dp_packet_clear(payload
);
439 stream
->seq_no
= seq
+ 1;
441 } else if (flags
& (TCP_FIN
| TCP_RST
)) {
442 tcp_stream_destroy(r
, stream
);
444 } else if (seq
== stream
->seq_no
) {
445 /* Shift all of the existing payload to the very beginning of the
446 * allocated space, so that we reuse allocated space instead of
447 * continually expanding it. */
448 dp_packet_shift(payload
, (char *) dp_packet_base(payload
) - (char *) dp_packet_data(payload
));
450 dp_packet_put(payload
, l7
, l7_length
);
451 stream
->seq_no
+= l7_length
;