npfd_log.c revision 1.6.2.3
1 /* $NetBSD: npfd_log.c,v 1.6.2.3 2017/03/20 06:58:08 pgoyette Exp $ */ 2 3 /*- 4 * Copyright (c) 2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __RCSID("$NetBSD: npfd_log.c,v 1.6.2.3 2017/03/20 06:58:08 pgoyette Exp $"); 34 35 #include <sys/types.h> 36 #include <sys/param.h> 37 #include <sys/stat.h> 38 39 #include <net/if.h> 40 41 #include <stdio.h> 42 #include <err.h> 43 #include <inttypes.h> 44 #include <limits.h> 45 #include <stdlib.h> 46 #include <unistd.h> 47 #include <syslog.h> 48 #include <stdbool.h> 49 50 #include <pcap/pcap.h> 51 #include "npfd.h" 52 53 struct npfd_log { 54 char ifname[IFNAMSIZ]; 55 char path[MAXPATHLEN]; 56 pcap_t *pcap; 57 pcap_dumper_t *dumper; 58 }; 59 60 static void 61 npfd_log_setfilter(npfd_log_t *ctx, const char *filter) 62 { 63 struct bpf_program bprog; 64 65 if (pcap_compile(ctx->pcap, &bprog, filter, 1, 0) == -1) 66 errx(EXIT_FAILURE, "pcap_compile failed for `%s': %s", filter, 67 pcap_geterr(ctx->pcap)); 68 if (pcap_setfilter(ctx->pcap, &bprog) == -1) 69 errx(EXIT_FAILURE, "pcap_setfilter failed: %s", 70 pcap_geterr(ctx->pcap)); 71 pcap_freecode(&bprog); 72 } 73 74 static FILE * 75 npfd_log_gethdr(npfd_log_t *ctx, struct pcap_file_header*hdr) 76 { 77 FILE *fp = fopen(ctx->path, "r"); 78 79 hdr->magic = 0; 80 if (fp == NULL) 81 return NULL; 82 83 #define TCPDUMP_MAGIC 0xa1b2c3d4 84 85 switch (fread(hdr, sizeof(*hdr), 1, fp)) { 86 case 0: 87 hdr->magic = 0; 88 fclose(fp); 89 return NULL; 90 case 1: 91 if (hdr->magic != TCPDUMP_MAGIC || 92 hdr->version_major != PCAP_VERSION_MAJOR || 93 hdr->version_minor != PCAP_VERSION_MINOR || 94 hdr->linktype != (u_int)pcap_datalink(ctx->pcap) || 95 hdr->sigfigs != (u_int)pcap_get_tstamp_precision(ctx->pcap)) 96 goto out; 97 break; 98 default: 99 goto out; 100 } 101 102 return fp; 103 out: 104 fclose(fp); 105 hdr->magic = (uint32_t)-1; 106 return NULL; 107 } 108 109 static int 110 npfd_log_getsnaplen(npfd_log_t *ctx) 111 { 112 struct pcap_file_header hdr; 113 FILE *fp = npfd_log_gethdr(ctx, &hdr); 114 if (fp == NULL) 115 return hdr.magic == (uint32_t)-1 ? -1 : 0; 116 fclose(fp); 117 return hdr.snaplen; 118 } 119 120 static int 121 npfd_log_validate(npfd_log_t *ctx) 122 { 123 struct pcap_file_header hdr; 124 FILE *fp = npfd_log_gethdr(ctx, &hdr); 125 size_t o, no; 126 127 if (fp == NULL) { 128 if (hdr.magic == 0) 129 return 0; 130 goto rename; 131 } 132 133 struct stat st; 134 if (fstat(fileno(fp), &st) == -1) 135 goto rename; 136 137 size_t count = 0; 138 for (o = sizeof(hdr);; count++) { 139 struct { 140 uint32_t sec; 141 uint32_t usec; 142 uint32_t caplen; 143 uint32_t len; 144 } pkt; 145 switch (fread(&pkt, sizeof(pkt), 1, fp)) { 146 case 0: 147 syslog(LOG_INFO, "%zu packets read from `%s'", count, 148 ctx->path); 149 fclose(fp); 150 return hdr.snaplen; 151 case 1: 152 no = o + sizeof(pkt) + pkt.caplen; 153 if (pkt.caplen > hdr.snaplen) 154 goto fix; 155 if (no > (size_t)st.st_size) 156 goto fix; 157 if (fseeko(fp, pkt.caplen, SEEK_CUR) != 0) 158 goto fix; 159 o = no; 160 break; 161 default: 162 goto fix; 163 } 164 } 165 166 fix: 167 fclose(fp); 168 no = st.st_size - o; 169 syslog(LOG_INFO, "%zu packets read from `%s', %zu extra bytes", 170 count, ctx->path, no); 171 if (no < 10240) { 172 syslog(LOG_WARNING, 173 "Incomplete last packet in `%s', truncating", 174 ctx->path); 175 if (truncate(ctx->path, (off_t)o) == -1) { 176 syslog(LOG_ERR, "Cannot truncate `%s': %m", ctx->path); 177 goto rename; 178 } 179 } else { 180 syslog(LOG_ERR, "Corrupt file `%s'", ctx->path); 181 goto rename; 182 } 183 fclose(fp); 184 return hdr.snaplen; 185 rename: 186 fclose(fp); 187 char tmp[MAXPATHLEN]; 188 snprintf(tmp, sizeof(tmp), "%s.XXXXXX", ctx->path); 189 int fd; 190 if ((fd = mkstemp(tmp)) == -1) { 191 syslog(LOG_ERR, "Can't make temp file `%s': %m", tmp); 192 return -1; 193 } 194 close(fd); 195 if (rename(ctx->path, tmp) == -1) { 196 syslog(LOG_ERR, "Can't rename `%s' to `%s': %m", 197 ctx->path, tmp); 198 return -1; 199 } 200 syslog(LOG_ERR, "Renamed to `%s'", tmp); 201 return 0; 202 } 203 204 205 npfd_log_t * 206 npfd_log_create(const char *filename, const char *ifname, const char *filter, 207 int snaplen) 208 { 209 npfd_log_t *ctx; 210 char errbuf[PCAP_ERRBUF_SIZE]; 211 212 if ((ctx = calloc(1, sizeof(*ctx))) == NULL) 213 err(EXIT_FAILURE, "malloc failed"); 214 215 /* 216 * Open a live capture handle in non-blocking mode. 217 */ 218 snprintf(ctx->ifname, sizeof(ctx->ifname), "%s", ifname); 219 ctx->pcap = pcap_create(ctx->ifname, errbuf); 220 if (ctx->pcap == NULL) 221 errx(EXIT_FAILURE, "pcap_create failed: %s", errbuf); 222 223 if (pcap_setnonblock(ctx->pcap, 1, errbuf) == -1) 224 errx(EXIT_FAILURE, "pcap_setnonblock failed: %s", errbuf); 225 226 if (filename == NULL) 227 snprintf(ctx->path, sizeof(ctx->path), NPFD_LOG_PATH "/%s.pcap", 228 ctx->ifname); 229 else 230 snprintf(ctx->path, sizeof(ctx->path), "%s", filename); 231 232 int sl = npfd_log_getsnaplen(ctx); 233 if (sl == -1) 234 errx(EXIT_FAILURE, "corrupt log file `%s'", ctx->path); 235 236 if (sl != 0 && sl != snaplen) { 237 warnx("Overriding snaplen from %d to %d from `%s'", snaplen, 238 sl, filename); 239 snaplen = sl; 240 } 241 242 if (pcap_set_snaplen(ctx->pcap, snaplen) == -1) 243 errx(EXIT_FAILURE, "pcap_set_snaplen failed: %s", 244 pcap_geterr(ctx->pcap)); 245 246 if (pcap_set_timeout(ctx->pcap, 1000) == -1) 247 errx(EXIT_FAILURE, "pcap_set_timeout failed: %s", 248 pcap_geterr(ctx->pcap)); 249 250 if (pcap_activate(ctx->pcap) == -1) 251 errx(EXIT_FAILURE, "pcap_activate failed: %s", 252 pcap_geterr(ctx->pcap)); 253 254 if (filter) 255 npfd_log_setfilter(ctx, filter); 256 257 258 npfd_log_reopen(ctx, false); 259 return ctx; 260 } 261 262 bool 263 npfd_log_reopen(npfd_log_t *ctx, bool die) 264 { 265 mode_t omask = umask(077); 266 267 if (ctx->dumper) 268 pcap_dump_close(ctx->dumper); 269 /* 270 * Open a log file to write for a given interface and dump there. 271 */ 272 switch (npfd_log_validate(ctx)) { 273 case -1: 274 syslog(LOG_ERR, "Giving up"); 275 exit(EXIT_FAILURE); 276 /*NOTREACHED*/ 277 case 0: 278 ctx->dumper = pcap_dump_open(ctx->pcap, ctx->path); 279 break; 280 default: 281 ctx->dumper = pcap_dump_open_append(ctx->pcap, ctx->path); 282 break; 283 } 284 (void)umask(omask); 285 286 if (ctx->dumper == NULL) { 287 if (die) 288 errx(EXIT_FAILURE, "pcap_dump_open failed for `%s': %s", 289 ctx->path, pcap_geterr(ctx->pcap)); 290 syslog(LOG_ERR, "pcap_dump_open failed for `%s': %s", 291 ctx->path, pcap_geterr(ctx->pcap)); 292 return false; 293 } 294 return true; 295 } 296 297 void 298 npfd_log_destroy(npfd_log_t *ctx) 299 { 300 if (ctx->dumper) 301 pcap_dump_close(ctx->dumper); 302 if (ctx->pcap) 303 pcap_close(ctx->pcap); 304 free(ctx); 305 } 306 307 int 308 npfd_log_getsock(npfd_log_t *ctx) 309 { 310 return pcap_get_selectable_fd(ctx->pcap); 311 } 312 313 void 314 npfd_log_flush(npfd_log_t *ctx) 315 { 316 if (!ctx->dumper) 317 return; 318 if (pcap_dump_flush(ctx->dumper) == -1) 319 syslog(LOG_ERR, "pcap_dump_flush failed for `%s': %m", 320 ctx->path); 321 } 322 323 324 void 325 npfd_log(npfd_log_t *ctx) 326 { 327 pcap_dumper_t *dumper = ctx->dumper; 328 329 pcap_dispatch(ctx->pcap, PCAP_NPACKETS, pcap_dump, (void *)dumper); 330 } 331 332 void 333 npfd_log_stats(npfd_log_t *ctx) 334 { 335 pcap_t *pcap = ctx->pcap; 336 struct pcap_stat ps; 337 338 if (pcap_stats(pcap, &ps) == -1) { 339 syslog(LOG_ERR, "pcap_stats failed: %s", pcap_geterr(pcap)); 340 return; 341 } 342 syslog(LOG_INFO, "packet statistics: %s: %u received, %u dropped", 343 ctx->ifname, ps.ps_recv, ps.ps_drop); 344 } 345
Indexes created Wed Oct 22 13:09:56 GMT 2025