1: /*
2: * Copyright (c) 2004 Rinet Corp., Novosibirsk, Russia
3: *
4: * Redistribution and use in source forms, with and without modification,
5: * are permitted provided that this entire comment appears intact.
6: *
7: * THIS SOURCE CODE IS PROVIDED ``AS IS'' WITHOUT ANY WARRANTIES OF ANY KIND.
8: */
9:
10: #ifdef HAVE_CONFIG_H
11: #include <config.h>
12: #endif
13:
14: #ifdef HAVE_SLCURSES
15: #include <slcurses.h>
16: #elif HAVE_NCURSES
17: #include <ncurses.h>
18: #else
19: #include <curses.h>
20: #endif
21: #include <sys/param.h>
22: #include <sys/types.h>
23: #include <sys/socket.h>
24: #include <sys/time.h>
25: #include <netinet/in.h>
26: #include <arpa/inet.h>
27: #include <stdio.h>
28: #include <stdlib.h>
29: #include <string.h>
30: #include <unistd.h>
31: #include <errno.h>
32: #include <pcap.h>
33: #include <pthread.h>
34: #include <time.h>
35: #include <ctype.h>
36:
37: #include "show_dump.h"
38: #include "show_stat.h" /* just for hdr2str() */
39: #include "parse_dl.h"
40: #include "trafshow.h"
41: #include "screen.h"
42: #include "netstat.h"
43: #include "getkey.h"
44: #include "addrtoname.h"
45: #include "util.h"
46:
47: NETSTAT *dump_match = 0;
48: const char *cisco_netflow_dump = 0;
49: const char *dump_file = 0;
50:
51: static char *build_filter_expr(char *dst, int size, const NETSTAT *ns);
52: static void *live_pcap_dump();
53: static void live_pcap_parse(u_char *a, const struct pcap_pkthdr *h, const u_char *p);
54: static void file_pcap_parse(u_char *a, const struct pcap_pkthdr *h, const u_char *p);
55: static void show_header_dump(PCAP_HANDLER *ph, const NETSTAT *ns);
56: static void show_ascii_dump(const u_char *p, int length);
57: static void show_hex_dump(const u_char *p, int length);
58:
59: static pcap_t *live_pcap = 0;
60: static pcap_dumper_t *live_dump = 0;
61: static pthread_t *live_pcap_thr = 0;
62: static pcap_t *file_pcap = 0;
63: static FILE *file_netflow = 0;
64: static int redraw_lines = 0;
65:
66: static void
67: print_mode(void)
68: {
69: const char *cp = cisco_netflow_dump;
70: char src_buf[100], dst_buf[100], proto_buf[20];
71:
72: /* sanity check */
73: if (!dump_match) return;
74:
75: hdr2str(&dump_match->ns_hdr,
76: src_buf, sizeof(src_buf),
77: dst_buf, sizeof(dst_buf),
78: proto_buf, sizeof(proto_buf));
79:
80: if (!cisco_netflow_dump) {
81: switch (show_stat_mode) {
82: case Size: cp = "HexData"; break;
83: case Data: cp = "AsciiData"; break;
84: case Packets: cp = "Packets"; break;
85: }
86: }
87:
88: attrset(A_STANDOUT);
89: printw("\n--- %s %s > %s %s flow ---",
90: proto_buf, src_buf, dst_buf, cp);
91: attrset(A_NORMAL);
92:
93: #ifdef HAVE_WREDRAWLN
94: wredrawln(stdscr, 0, LINES);
95: #endif
96: refresh();
97: }
98:
99: #ifndef HAVE_PCAP_DUMP_FLUSH
100: int
101: pcap_dump_flush(pcap_dumper_t *p)
102: {
103:
104: if (fflush((FILE *)p) == EOF)
105: return (-1);
106: else
107: return (0);
108: }
109: #endif
110:
111: int
112: show_dump_open(ph, ns)
113: const PCAP_HANDLER *ph;
114: const NETSTAT *ns;
115: {
116: int op;
117: struct bpf_program filter;
118: bpf_u_int32 net;
119: bpf_u_int32 mask;
120: char name[100], buf[256];
121:
122: /* sanity check */
123: if (!ph || !ns) return -1;
124:
125: show_dump_close();
126:
127: if (!dump_match && (dump_match = (NETSTAT *)malloc(sizeof(NETSTAT))) == 0) {
128: screen_status("%s: malloc: Out of memory?", ph->name);
129: show_dump_close();
130: return -1;
131: }
132: memcpy(dump_match, ns, sizeof(NETSTAT));
133:
134: if (ph->pcap) {
135: /* open live packet capture */
136: buf[0] = '\0';
137: live_pcap = pcap_open_live(strcpy(name, ph->name),
138: DUMP_SNAPLEN, promisc, 1, buf);
139: if (buf[0] != '\0')
140: screen_status("%s: %s", ph->name, buf);
141: if (!live_pcap) return -1;
142: #ifdef notdef
143: if (pcap_setnonblock(live_pcap, 1, buf) < 0) {
144: screen_status("%s: %s", ph->name, buf);
145: show_dump_close();
146: return -1;
147: }
148: #endif
149: /* setup filter expression */
150: if (pcap_lookupnet(strcpy(name, ph->name), &net, &mask, buf) < 0) {
151: /* ignore error */
152: net = 0;
153: mask = 0;
154: }
155: if (!build_filter_expr(buf, sizeof(buf), ns)) {
156: screen_status("%s: Can't build filter expression", ph->name);
157: show_dump_close();
158: return -1;
159: }
160: if (pcap_compile(live_pcap, &filter, buf, Oflag, mask) < 0) {
161: screen_status("%s: %s", ph->name, pcap_geterr(live_pcap));
162: show_dump_close();
163: return -1;
164: }
165: op = pcap_setfilter(live_pcap, &filter);
166: pcap_freecode(&filter);
167: if (op < 0) {
168: screen_status("%s: %s", ph->name, pcap_geterr(live_pcap));
169: show_dump_close();
170: return -1;
171: }
172: } else if ((cisco_netflow_dump = strdup(ph->name)) == 0) {
173: screen_status("%s: strdup: Out of memory?", ph->name);
174: show_dump_close();
175: return -1;
176: }
177:
178: /* open pcap dump file for writing */
179:
180: snprintf(buf, sizeof(buf), "%s/%s.XXXXXX", TEMP_DIR, progname);
181: if ((op = mkstemp(buf)) < 0) {
182: screen_status("%s: %s: %s",
183: ph->name, buf, strerror(errno));
184: show_dump_close();
185: return -1;
186: }
187: (void)close(op);
188: if ((dump_file = strdup(buf)) == 0) {
189: screen_status("%s: strdup: Out of memory?", ph->name);
190: show_dump_close();
191: return -1;
192: }
193:
194: if (!cisco_netflow_dump) {
195: if ((live_dump = pcap_dump_open(live_pcap, dump_file)) == 0) {
196: screen_status("%s: %s", ph->name, pcap_geterr(live_pcap));
197: show_dump_close();
198: return -1;
199: }
200: pcap_dump_flush(live_dump); /* write header right now */
201:
202: /* spawn thread to dump live packet capture into the file */
203: if ((live_pcap_thr = (pthread_t *)malloc(sizeof(pthread_t))) == 0) {
204: screen_status("%s: malloc: Out of memory?", ph->name);
205: show_dump_close();
206: return -1;
207: }
208: if (pthread_create(live_pcap_thr, 0, live_pcap_dump, 0)) {
209: screen_status("%s: pthread_create: Out of resources?", ph->name);
210: show_dump_close();
211: return -1;
212: }
213:
214: /* open pcap dump file for reading */
215: if ((file_pcap = pcap_open_offline(dump_file, buf)) == 0) {
216: screen_status("%s: %s", ph->name, buf);
217: show_dump_close();
218: return -1;
219: }
220: } else if ((file_netflow = fopen(dump_file, "r")) == 0) {
221: screen_status("%s: %s: %s",
222: ph->name, dump_file, strerror(errno));
223: show_dump_close();
224: return -1;
225: }
226:
227: scrollok(stdscr, 1);
228: screen_clear();
229: print_mode();
230: return 0;
231: }
232:
233: static void *
234: live_pcap_dump()
235: {
236: int op;
237:
238: while (live_pcap && live_dump) {
239: op = pcap_dispatch(live_pcap, -1, live_pcap_parse,
240: (u_char *)live_dump);
241: if (op == -2 || (op == -1 && errno != EAGAIN))
242: break;
243: if (op < 1) usleep(1000); /* 1ms idle to prevent deadloop */
244: }
245: return 0;
246: }
247:
248: static void
249: live_pcap_parse(a, h, p)
250: u_char *a;
251: const struct pcap_pkthdr *h;
252: const u_char *p;
253: {
254: NETSTAT ns;
255:
256: /* sanity check */
257: if (!a || !live_pcap) return;
258:
259: memset(&ns, 0, sizeof(NETSTAT));
260:
261: if (parse_dl(&ns, pcap_datalink(live_pcap), h->caplen, h->len, p) < 0)
262: return;
263:
264: if (!netstat_match(&ns, dump_match))
265: return;
266:
267: pcap_dump(a, h, p);
268: pcap_dump_flush((pcap_dumper_t *)a);
269: }
270:
271: void
272: show_dump_close()
273: {
274: if (cisco_netflow_dump) {
275: free((char *)cisco_netflow_dump);
276: cisco_netflow_dump = 0;
277: }
278: if (file_netflow) {
279: (void)fclose(file_netflow);
280: file_netflow = 0;
281: }
282:
283: if (live_pcap_thr) {
284: pthread_cancel(*live_pcap_thr);
285: free(live_pcap_thr);
286: live_pcap_thr = 0;
287: }
288: if (live_dump) {
289: pcap_dump_close(live_dump);
290: live_dump = 0;
291: }
292: if (live_pcap) {
293: pcap_close(live_pcap);
294: live_pcap = 0;
295: }
296: if (file_pcap) {
297: pcap_close(file_pcap);
298: file_pcap = 0;
299: }
300:
301: if (dump_file) {
302: (void)unlink(dump_file);
303: free((char *)dump_file);
304: dump_file = 0;
305: }
306: scrollok(stdscr, 0);
307: }
308:
309: void
310: show_dump_print(ph)
311: PCAP_HANDLER *ph;
312: {
313: if (!cisco_netflow_dump) {
314: int op;
315:
316: /* sanity check */
317: if (!file_pcap) return;
318:
319: clearerr(pcap_file(file_pcap)); /* tail file */
320: while ((op = pcap_dispatch(file_pcap, -1, file_pcap_parse,
321: (u_char *)ph)) > 0);
322: if (op < 0) {
323: if (op == -1)
324: screen_status(pcap_geterr(file_pcap));
325: return;
326: }
327: } else {
328: char *cp, buf[256];
329:
330: /* sanity check */
331: if (!file_netflow) return;
332:
333: clearerr(file_netflow); /* tail file */
334: while (fgets(buf, sizeof(buf), file_netflow) != 0) {
335: buf[sizeof(buf)-1] = '\0';
336: if ((cp = strpbrk(buf, "\r\n")) != '\0')
337: *cp = '\0';
338: printw("%s\n", buf);
339: redraw_lines++;
340: }
341: }
342: if (redraw_lines) {
343: #ifdef HAVE_WREDRAWLN
344: wredrawln(stdscr, 0, LINES);
345: #endif
346: refresh();
347: redraw_lines = 0;
348: }
349: }
350:
351: static void
352: file_pcap_parse(a, h, p)
353: u_char *a;
354: const struct pcap_pkthdr *h;
355: const u_char *p;
356: {
357: PCAP_HANDLER *ph = (PCAP_HANDLER *)a;
358: FILE *fp;
359: long sz;
360: int hdrlen;
361: NETSTAT ns;
362:
363: /* sanity check */
364: if (!file_pcap) return;
365:
366: /* prevent huge output */
367: if ((fp = pcap_file(file_pcap)) == 0 || (sz = fd_size(fileno(fp))) < 0)
368: return;
369: if (sz - ftell(fp) > DUMP_SNAPLEN * LINES)
370: return;
371:
372: memset(&ns, 0, sizeof(NETSTAT));
373:
374: hdrlen = parse_dl(&ns, pcap_datalink(file_pcap), h->caplen, h->len, p);
375: if (hdrlen < 0 || hdrlen > h->caplen)
376: return;
377:
378: if (!netstat_match(&ns, dump_match))
379: return;
380:
381: ns.mtime = h->ts;
382:
383: switch (show_stat_mode) {
384: case Size:
385: show_hex_dump(p + hdrlen, h->caplen - hdrlen);
386: break;
387: case Data:
388: show_ascii_dump(p + hdrlen, h->caplen - hdrlen);
389: break;
390: case Packets:
391: show_header_dump(ph, &ns);
392: break;
393: }
394: }
395:
396: void
397: show_dump_input(ch)
398: int ch;
399: {
400: if (ch == 'c' || ch == 'C' || ch == K_CTRL('R'))
401: screen_clear();
402: else if (show_stat_input(0, ch))
403: print_mode();
404: }
405:
406: static char *
407: build_filter_expr(dst, size, ns)
408: char *dst;
409: int size;
410: const NETSTAT *ns;
411: {
412: char src_addr[100], dst_addr[100];
413:
414: src_addr[0] = '\0';
415: dst_addr[0] = '\0';
416:
417: if (ns->ip_ver == 4) {
418: (void)strcpy(src_addr, intoa(ns->ip_src_addr.ip_addr.s_addr));
419: (void)strcpy(dst_addr, intoa(ns->ip_dst_addr.ip_addr.s_addr));
420: }
421: #ifdef INET6
422: else if (ns->ip_ver == 6) {
423: (void)inet_ntop(AF_INET6, &ns->ip_src_addr.ip6_addr, src_addr, sizeof(src_addr));
424: (void)inet_ntop(AF_INET6, &ns->ip_dst_addr.ip6_addr, dst_addr, sizeof(dst_addr));
425: }
426: #endif
427: else if (ns->eth_type) {
428: (void)strcpy(src_addr, etheraddr_string(ns->eth_src_addr));
429: (void)strcpy(dst_addr, etheraddr_string(ns->eth_dst_addr));
430: }
431:
432: if (src_addr[0] == '\0' || dst_addr[0] == '\0')
433: return 0; /* should not happen */
434:
435: if (ns->ip_ver) {
436: snprintf(dst, size,
437: "src %s and dst %s",
438: src_addr, dst_addr);
439: } else if (!strcmp(dst_addr, "broadcast") ||
440: !strcmp(dst_addr, "multicast")) {
441: snprintf(dst, size,
442: "ether src %s and ether %s",
443: src_addr, dst_addr);
444: } else {
445: snprintf(dst, size,
446: "ether src %s and ether dst %s",
447: src_addr, dst_addr);
448: }
449: return dst;
450: }
451:
452: static void
453: show_header_dump(ph, ns)
454: PCAP_HANDLER *ph;
455: const NETSTAT *ns;
456: {
457: char time_buf[100], src_buf[100], dst_buf[100], proto_buf[20];
458: #ifdef notdef
459: NETSTAT find = *ns;
460: if (netstat_find(ph, &find))
461: ns = &find;
462: #endif
463: (void)strftime(time_buf, sizeof(time_buf),
464: "%T", localtime((time_t *)&ns->mtime.tv_sec));
465: hdr2str(&ns->ns_hdr,
466: src_buf, sizeof(src_buf),
467: dst_buf, sizeof(dst_buf),
468: proto_buf, sizeof(proto_buf));
469:
470: printw("\n%s.%03d %s %s > %s %d/%d bytes",
471: time_buf, (int)(ns->mtime.tv_usec / 1000),
472: proto_buf, src_buf, dst_buf,
473: (int)ns->pkt_len, (int)ns->data_len);
474:
475: redraw_lines++;
476: }
477:
478: static void
479: show_ascii_dump(cp, length)
480: const u_char *cp;
481: int length;
482: {
483: /* sanity check */
484: if (!cp || length < 1)
485: return;
486:
487: if (!redraw_lines)
488: addch('\n');
489: while (--length >= 0) {
490: if (*cp != '\r' && *cp != '\b')
491: addch(*cp);
492: cp++;
493: }
494: redraw_lines++;
495: }
496:
497: #ifdef ACS_VLINE
498: #define VLINE ACS_VLINE
499: #else
500: #define VLINE '|'
501: #endif
502:
503: /* stolen from tcpdump's ascii-print() */
504:
505: #define HEXDUMP_BYTES_PER_LINE 16
506: #define HEXDUMP_SHORTS_PER_LINE (HEXDUMP_BYTES_PER_LINE / 2)
507: #define HEXDUMP_HEXSTUFF_PER_SHORT 5 /* 4 hex digits and a space */
508: #define HEXDUMP_HEXSTUFF_PER_LINE \
509: (HEXDUMP_HEXSTUFF_PER_SHORT * HEXDUMP_SHORTS_PER_LINE)
510:
511: static void
512: show_hex_dump(cp, length)
513: const u_char *cp;
514: int length;
515: {
516: int oset = 0;
517: register u_int i;
518: register int s1, s2;
519: register int nshorts;
520: char hexstuff[HEXDUMP_SHORTS_PER_LINE*HEXDUMP_HEXSTUFF_PER_SHORT+1], *hsp;
521: char asciistuff[100], *asp;
522: u_int maxlength = HEXDUMP_SHORTS_PER_LINE;
523:
524: /* sanity check */
525: if (!cp || length < 1)
526: return;
527:
528: nshorts = length / sizeof(u_short);
529: i = 0;
530: hsp = hexstuff;
531: asp = asciistuff;
532: while (--nshorts >= 0) {
533: s1 = *cp++;
534: s2 = *cp++;
535: (void)snprintf(hsp, sizeof(hexstuff) - (hsp - hexstuff),
536: " %02x%02x", s1, s2);
537: hsp += HEXDUMP_HEXSTUFF_PER_SHORT;
538: *(asp++) = (isgraph(s1) ? s1 : '.');
539: *(asp++) = (isgraph(s2) ? s2 : '.');
540: if (++i >= maxlength) {
541: i = 0;
542: *hsp = *asp = '\0';
543:
544: printw("\n0x%04X ", oset);
545: addch(VLINE);
546: printw("%-*s ", HEXDUMP_HEXSTUFF_PER_LINE, hexstuff);
547: addch(VLINE);
548: addch(' ');
549: addstr(asciistuff);
550:
551: hsp = hexstuff;
552: asp = asciistuff;
553: oset += HEXDUMP_BYTES_PER_LINE;
554:
555: redraw_lines++;
556: }
557: }
558: if (length & 1) {
559: s1 = *cp++;
560: (void)snprintf(hsp, sizeof(hexstuff) - (hsp - hexstuff),
561: " %02x", s1);
562: hsp += 3;
563: *(asp++) = (isgraph(s1) ? s1 : '.');
564: ++i;
565: }
566: if (i > 0) {
567: *hsp = *asp = '\0';
568:
569: printw("\n0x%04X ", oset);
570: addch(VLINE);
571: printw("%-*s ", HEXDUMP_HEXSTUFF_PER_LINE, hexstuff);
572: addch(VLINE);
573: addch(' ');
574: addstr(asciistuff);
575:
576: redraw_lines++;
577: }
578: }
579:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to show_dump.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / trafshow