lib/pcap-file.c

   1 /*
   2  * Copyright (c) 2009, 2010, 2012, 2013, 2014, 2015 Nicira, Inc.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at:
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 #include <config.h>
  18 #include "pcap-file.h"
  19 #include <errno.h>
  20 #include <inttypes.h>
  21 #include <stdlib.h>
  22 #include <string.h>
  23 #include <sys/stat.h>
  24 #include "byte-order.h"
  25 #include "compiler.h"
  26 #include "dp-packet.h"
  27 #include "flow.h"
  28 #include "openvswitch/hmap.h"
  29 #include "packets.h"
  30 #include "timeval.h"
  31 #include "unaligned.h"
  32 #include "util.h"
  33 #include "openvswitch/vlog.h"
  34
  35 VLOG_DEFINE_THIS_MODULE(pcap);
  36
  37 struct pcap_hdr {
  38     uint32_t magic_number;   /* magic number */
  39     uint16_t version_major;  /* major version number */
  40     uint16_t version_minor;  /* minor version number */
  41     int32_t thiszone;        /* GMT to local correction */
  42     uint32_t sigfigs;        /* accuracy of timestamps */
  43     uint32_t snaplen;        /* max length of captured packets */
  44     uint32_t network;        /* data link type */
  45 };
  46 BUILD_ASSERT_DECL(sizeof(struct pcap_hdr) == 24);
  47
  48 struct pcaprec_hdr {
  49     uint32_t ts_sec;         /* timestamp seconds */
  50     uint32_t ts_usec;        /* timestamp microseconds */
  51     uint32_t incl_len;       /* number of octets of packet saved in file */
  52     uint32_t orig_len;       /* actual length of packet */
  53 };
  54 BUILD_ASSERT_DECL(sizeof(struct pcaprec_hdr) == 16);
  55
  56 FILE *
  57 ovs_pcap_open(const char *file_name, const char *mode)
  58 {
  59     struct stat s;
  60     FILE *file;
  61     int error;
  62
  63     ovs_assert(!strcmp(mode, "rb") ||
  64                !strcmp(mode, "wb") ||
  65                !strcmp(mode, "ab"));
  66
  67     file = fopen(file_name, mode);
  68     if (file == NULL) {
  69         VLOG_WARN("%s: failed to open pcap file for %s (%s)", file_name,
  70                   (mode[0] == 'r' ? "reading"
  71                    : mode[0] == 'w' ? "writing"
  72                    : "appending"),
  73                   ovs_strerror(errno));
  74         return NULL;
  75     }
  76
  77     switch (mode[0]) {
  78     case 'r':
  79         error = ovs_pcap_read_header(file);
  80         if (error) {
  81             errno = error;
  82             fclose(file);
  83             return NULL;
  84         }
  85         break;
  86
  87     case 'w':
  88         ovs_pcap_write_header(file);
  89         break;
  90
  91     case 'a':
  92         if (!fstat(fileno(file), &s) && !s.st_size) {
  93             ovs_pcap_write_header(file);
  94         }
  95         break;
  96
  97     default:
  98         OVS_NOT_REACHED();
  99     }
 100     return file;
 101 }
 102
 103 int
 104 ovs_pcap_read_header(FILE *file)
 105 {
 106     struct pcap_hdr ph;
 107     if (fread(&ph, sizeof ph, 1, file) != 1) {
 108         int error = ferror(file) ? errno : EOF;
 109         VLOG_WARN("failed to read pcap header: %s", ovs_retval_to_string(error));
 110         return error;
 111     }
 112     if (ph.magic_number != 0xa1b2c3d4 && ph.magic_number != 0xd4c3b2a1) {
 113         VLOG_WARN("bad magic 0x%08"PRIx32" reading pcap file "
 114                   "(expected 0xa1b2c3d4 or 0xd4c3b2a1)", ph.magic_number);
 115         return EPROTO;
 116     }
 117     return 0;
 118 }
 119
 120 void
 121 ovs_pcap_write_header(FILE *file)
 122 {
 123     /* The pcap reader is responsible for figuring out endianness based on the
 124      * magic number, so the lack of htonX calls here is intentional. */
 125     struct pcap_hdr ph;
 126     ph.magic_number = 0xa1b2c3d4;
 127     ph.version_major = 2;
 128     ph.version_minor = 4;
 129     ph.thiszone = 0;
 130     ph.sigfigs = 0;
 131     ph.snaplen = 1518;
 132     ph.network = 1;             /* Ethernet */
 133     ignore(fwrite(&ph, sizeof ph, 1, file));
 134     fflush(file);
 135 }
 136
 137 int
 138 ovs_pcap_read(FILE *file, struct dp_packet **bufp, long long int *when)
 139 {
 140     struct pcaprec_hdr prh;
 141     struct dp_packet *buf;
 142     void *data;
 143     size_t len;
 144     bool swap;
 145
 146     *bufp = NULL;
 147
 148     /* Read header. */
 149     if (fread(&prh, sizeof prh, 1, file) != 1) {
 150         if (ferror(file)) {
 151             int error = errno;
 152             VLOG_WARN("failed to read pcap record header: %s",
 153                       ovs_retval_to_string(error));
 154             return error;
 155         } else {
 156             return EOF;
 157         }
 158     }
 159
 160     /* Calculate length. */
 161     len = prh.incl_len;
 162     swap = len > 0xffff;
 163     if (swap) {
 164         len = uint32_byteswap(len);
 165         if (len > 0xffff) {
 166             VLOG_WARN("bad packet length %"PRIuSIZE" or %"PRIu32" "
 167                       "reading pcap file",
 168                       len, uint32_byteswap(len));
 169             return EPROTO;
 170         }
 171     }
 172
 173     /* Calculate time. */
 174     if (when) {
 175         uint32_t ts_sec = swap ? uint32_byteswap(prh.ts_sec) : prh.ts_sec;
 176         uint32_t ts_usec = swap ? uint32_byteswap(prh.ts_usec) : prh.ts_usec;
 177         *when = ts_sec * 1000LL + ts_usec / 1000;
 178     }
 179
 180     /* Read packet. Packet type is Ethernet */
 181     buf = dp_packet_new(len);
 182     data = dp_packet_put_uninit(buf, len);
 183     if (fread(data, len, 1, file) != 1) {
 184         int error = ferror(file) ? errno : EOF;
 185         VLOG_WARN("failed to read pcap packet: %s",
 186                   ovs_retval_to_string(error));
 187         dp_packet_delete(buf);
 188         return error;
 189     }
 190     *bufp = buf;
 191     return 0;
 192 }
 193
 194 void
 195 ovs_pcap_write(FILE *file, struct dp_packet *buf)
 196 {
 197     struct pcaprec_hdr prh;
 198     struct timeval tv;
 199
 200     ovs_assert(buf->packet_type == htonl(PT_ETH));
 201
 202     xgettimeofday(&tv);
 203     prh.ts_sec = tv.tv_sec;
 204     prh.ts_usec = tv.tv_usec;
 205     prh.incl_len = dp_packet_size(buf);
 206     prh.orig_len = dp_packet_size(buf);
 207     ignore(fwrite(&prh, sizeof prh, 1, file));
 208     ignore(fwrite(dp_packet_data(buf), dp_packet_size(buf), 1, file));
 209     fflush(file);
 210 }
 211 \f
 212 struct tcp_key {
 213     ovs_be32 nw_src, nw_dst;
 214     ovs_be16 tp_src, tp_dst;
 215 };
 216
 217 struct tcp_stream {
 218     struct hmap_node hmap_node;
 219     struct tcp_key key;
 220     uint32_t seq_no;
 221     struct dp_packet payload;
 222 };
 223
 224 struct tcp_reader {
 225     struct hmap streams;
 226 };
 227
 228 static void
 229 tcp_stream_destroy(struct tcp_reader *r, struct tcp_stream *stream)
 230 {
 231     hmap_remove(&r->streams, &stream->hmap_node);
 232     dp_packet_uninit(&stream->payload);
 233     free(stream);
 234 }
 235
 236 /* Returns a new data structure for extracting TCP stream data from an
 237  * Ethernet packet capture */
 238 struct tcp_reader *
 239 tcp_reader_open(void)
 240 {
 241     struct tcp_reader *r;
 242
 243     r = xmalloc(sizeof *r);
 244     hmap_init(&r->streams);
 245     return r;
 246 }
 247
 248 /* Closes and frees 'r'. */
 249 void
 250 tcp_reader_close(struct tcp_reader *r)
 251 {
 252     struct tcp_stream *stream, *next_stream;
 253
 254     HMAP_FOR_EACH_SAFE (stream, next_stream, hmap_node, &r->streams) {
 255         tcp_stream_destroy(r, stream);
 256     }
 257     hmap_destroy(&r->streams);
 258     free(r);
 259 }
 260
 261 static struct tcp_stream *
 262 tcp_stream_lookup(struct tcp_reader *r,
 263                   const struct tcp_key *key, uint32_t hash)
 264 {
 265     struct tcp_stream *stream;
 266
 267     HMAP_FOR_EACH_WITH_HASH (stream, hmap_node, hash, &r->streams) {
 268         if (!memcmp(&stream->key, key, sizeof *key)) {
 269             return stream;
 270         }
 271     }
 272     return NULL;
 273 }
 274
 275 static struct tcp_stream *
 276 tcp_stream_new(struct tcp_reader *r, const struct tcp_key *key, uint32_t hash)
 277 {
 278     struct tcp_stream *stream;
 279
 280     stream = xmalloc(sizeof *stream);
 281     hmap_insert(&r->streams, &stream->hmap_node, hash);
 282     memcpy(&stream->key, key, sizeof *key);
 283     stream->seq_no = 0;
 284     dp_packet_init(&stream->payload, 2048);
 285     return stream;
 286 }
 287
 288 /* Processes 'packet' through TCP reader 'r'.  The caller must have already
 289  * extracted the packet's headers into 'flow', using flow_extract().
 290  *
 291  * If 'packet' is a TCP packet, then the reader attempts to reconstruct the
 292  * data stream.  If successful, it returns an dp_packet that represents the data
 293  * stream so far.  The caller may examine the data in the dp_packet and pull off
 294  * any data that it has fully processed.  The remaining data that the caller
 295  * does not pull off will be presented again in future calls if more data
 296  * arrives in the stream.
 297  *
 298  * Returns null if 'packet' doesn't add new data to a TCP stream. */
 299 struct dp_packet *
 300 tcp_reader_run(struct tcp_reader *r, const struct flow *flow,
 301                const struct dp_packet *packet)
 302 {
 303     struct tcp_stream *stream;
 304     struct tcp_header *tcp;
 305     struct dp_packet *payload;
 306     unsigned int l7_length;
 307     struct tcp_key key;
 308     uint32_t hash;
 309     uint32_t seq;
 310     uint8_t flags;
 311     const char *l7 = dp_packet_get_tcp_payload(packet);
 312
 313     if (flow->dl_type != htons(ETH_TYPE_IP)
 314         || flow->nw_proto != IPPROTO_TCP
 315         || !l7) {
 316         return NULL;
 317     }
 318     tcp = dp_packet_l4(packet);
 319     flags = TCP_FLAGS(tcp->tcp_ctl);
 320     l7_length = (char *) dp_packet_tail(packet) - l7;
 321     seq = ntohl(get_16aligned_be32(&tcp->tcp_seq));
 322
 323     /* Construct key. */
 324     memset(&key, 0, sizeof key);
 325     key.nw_src = flow->nw_src;
 326     key.nw_dst = flow->nw_dst;
 327     key.tp_src = flow->tp_src;
 328     key.tp_dst = flow->tp_dst;
 329     hash = hash_bytes(&key, sizeof key, 0);
 330
 331     /* Find existing stream or start a new one for a SYN or if there's data. */
 332     stream = tcp_stream_lookup(r, &key, hash);
 333     if (!stream) {
 334         if (flags & TCP_SYN || l7_length) {
 335             stream = tcp_stream_new(r, &key, hash);
 336             stream->seq_no = flags & TCP_SYN ? seq + 1 : seq;
 337         } else {
 338             return NULL;
 339         }
 340     }
 341
 342     payload = &stream->payload;
 343     if (flags & TCP_SYN || !stream->seq_no) {
 344         dp_packet_clear(payload);
 345         stream->seq_no = seq + 1;
 346         return NULL;
 347     } else if (flags & (TCP_FIN | TCP_RST)) {
 348         tcp_stream_destroy(r, stream);
 349         return NULL;
 350     } else if (seq == stream->seq_no) {
 351         /* Shift all of the existing payload to the very beginning of the
 352          * allocated space, so that we reuse allocated space instead of
 353          * continually expanding it. */
 354         dp_packet_shift(payload, (char *) dp_packet_base(payload) - (char *) dp_packet_data(payload));
 355
 356         dp_packet_put(payload, l7, l7_length);
 357         stream->seq_no += l7_length;
 358         return payload;
 359     } else {
 360         return NULL;
 361     }
 362 }