2 * Copyright (c) 2009, 2010, 2012, 2013, 2014, 2015 Nicira, Inc.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #include "pcap-file.h"
24 #include "byte-order.h"
26 #include "dp-packet.h"
31 #include "unaligned.h"
32 #include "openvswitch/vlog.h"
34 VLOG_DEFINE_THIS_MODULE(pcap);
37 uint32_t magic_number; /* magic number */
38 uint16_t version_major; /* major version number */
39 uint16_t version_minor; /* minor version number */
40 int32_t thiszone; /* GMT to local correction */
41 uint32_t sigfigs; /* accuracy of timestamps */
42 uint32_t snaplen; /* max length of captured packets */
43 uint32_t network; /* data link type */
45 BUILD_ASSERT_DECL(sizeof(struct pcap_hdr) == 24);
48 uint32_t ts_sec; /* timestamp seconds */
49 uint32_t ts_usec; /* timestamp microseconds */
50 uint32_t incl_len; /* number of octets of packet saved in file */
51 uint32_t orig_len; /* actual length of packet */
53 BUILD_ASSERT_DECL(sizeof(struct pcaprec_hdr) == 16);
56 ovs_pcap_open(const char *file_name, const char *mode)
62 ovs_assert(!strcmp(mode, "rb") ||
63 !strcmp(mode, "wb") ||
66 file = fopen(file_name, mode);
68 VLOG_WARN("%s: failed to open pcap file for %s (%s)", file_name,
69 (mode[0] == 'r' ? "reading"
70 : mode[0] == 'w' ? "writing"
78 error = ovs_pcap_read_header(file);
87 ovs_pcap_write_header(file);
91 if (!fstat(fileno(file), &s) && !s.st_size) {
92 ovs_pcap_write_header(file);
103 ovs_pcap_read_header(FILE *file)
106 if (fread(&ph, sizeof ph, 1, file) != 1) {
107 int error = ferror(file) ? errno : EOF;
108 VLOG_WARN("failed to read pcap header: %s", ovs_retval_to_string(error));
111 if (ph.magic_number != 0xa1b2c3d4 && ph.magic_number != 0xd4c3b2a1) {
112 VLOG_WARN("bad magic 0x%08"PRIx32" reading pcap file "
113 "(expected 0xa1b2c3d4 or 0xd4c3b2a1)", ph.magic_number);
120 ovs_pcap_write_header(FILE *file)
122 /* The pcap reader is responsible for figuring out endianness based on the
123 * magic number, so the lack of htonX calls here is intentional. */
125 ph.magic_number = 0xa1b2c3d4;
126 ph.version_major = 2;
127 ph.version_minor = 4;
131 ph.network = 1; /* Ethernet */
132 ignore(fwrite(&ph, sizeof ph, 1, file));
137 ovs_pcap_read(FILE *file, struct dp_packet **bufp, long long int *when)
139 struct pcaprec_hdr prh;
140 struct dp_packet *buf;
148 if (fread(&prh, sizeof prh, 1, file) != 1) {
151 VLOG_WARN("failed to read pcap record header: %s",
152 ovs_retval_to_string(error));
159 /* Calculate length. */
163 len = uint32_byteswap(len);
165 VLOG_WARN("bad packet length %"PRIuSIZE" or %"PRIu32
167 len, uint32_byteswap(len));
172 /* Calculate time. */
174 uint32_t ts_sec = swap ? uint32_byteswap(prh.ts_sec) : prh.ts_sec;
175 uint32_t ts_usec = swap ? uint32_byteswap(prh.ts_usec) : prh.ts_usec;
176 *when = ts_sec * 1000LL + ts_usec / 1000;
180 buf = dp_packet_new(len);
181 data = dp_packet_put_uninit(buf, len);
182 if (fread(data, len, 1, file) != 1) {
183 int error = ferror(file) ? errno : EOF;
184 VLOG_WARN("failed to read pcap packet: %s",
185 ovs_retval_to_string(error));
186 dp_packet_delete(buf);
194 ovs_pcap_write(FILE *file, struct dp_packet *buf)
196 struct pcaprec_hdr prh;
200 prh.ts_sec = tv.tv_sec;
201 prh.ts_usec = tv.tv_usec;
202 prh.incl_len = dp_packet_size(buf);
203 prh.orig_len = dp_packet_size(buf);
204 ignore(fwrite(&prh, sizeof prh, 1, file));
205 ignore(fwrite(dp_packet_data(buf), dp_packet_size(buf), 1, file));
210 ovs_be32 nw_src, nw_dst;
211 ovs_be16 tp_src, tp_dst;
215 struct hmap_node hmap_node;
218 struct dp_packet payload;
226 tcp_stream_destroy(struct tcp_reader *r, struct tcp_stream *stream)
228 hmap_remove(&r->streams, &stream->hmap_node);
229 dp_packet_uninit(&stream->payload);
233 /* Returns a new data structure for extracting TCP stream data from an
234 * Ethernet packet capture */
236 tcp_reader_open(void)
238 struct tcp_reader *r;
240 r = xmalloc(sizeof *r);
241 hmap_init(&r->streams);
245 /* Closes and frees 'r'. */
247 tcp_reader_close(struct tcp_reader *r)
249 struct tcp_stream *stream, *next_stream;
251 HMAP_FOR_EACH_SAFE (stream, next_stream, hmap_node, &r->streams) {
252 tcp_stream_destroy(r, stream);
254 hmap_destroy(&r->streams);
258 static struct tcp_stream *
259 tcp_stream_lookup(struct tcp_reader *r,
260 const struct tcp_key *key, uint32_t hash)
262 struct tcp_stream *stream;
264 HMAP_FOR_EACH_WITH_HASH (stream, hmap_node, hash, &r->streams) {
265 if (!memcmp(&stream->key, key, sizeof *key)) {
272 static struct tcp_stream *
273 tcp_stream_new(struct tcp_reader *r, const struct tcp_key *key, uint32_t hash)
275 struct tcp_stream *stream;
277 stream = xmalloc(sizeof *stream);
278 hmap_insert(&r->streams, &stream->hmap_node, hash);
279 memcpy(&stream->key, key, sizeof *key);
281 dp_packet_init(&stream->payload, 2048);
285 /* Processes 'packet' through TCP reader 'r'. The caller must have already
286 * extracted the packet's headers into 'flow', using flow_extract().
288 * If 'packet' is a TCP packet, then the reader attempts to reconstruct the
289 * data stream. If successful, it returns an dp_packet that represents the data
290 * stream so far. The caller may examine the data in the dp_packet and pull off
291 * any data that it has fully processed. The remaining data that the caller
292 * does not pull off will be presented again in future calls if more data
293 * arrives in the stream.
295 * Returns null if 'packet' doesn't add new data to a TCP stream. */
297 tcp_reader_run(struct tcp_reader *r, const struct flow *flow,
298 const struct dp_packet *packet)
300 struct tcp_stream *stream;
301 struct tcp_header *tcp;
302 struct dp_packet *payload;
303 unsigned int l7_length;
308 const char *l7 = dp_packet_get_tcp_payload(packet);
310 if (flow->dl_type != htons(ETH_TYPE_IP)
311 || flow->nw_proto != IPPROTO_TCP
315 tcp = dp_packet_l4(packet);
316 flags = TCP_FLAGS(tcp->tcp_ctl);
317 l7_length = (char *) dp_packet_tail(packet) - l7;
318 seq = ntohl(get_16aligned_be32(&tcp->tcp_seq));
321 memset(&key, 0, sizeof key);
322 key.nw_src = flow->nw_src;
323 key.nw_dst = flow->nw_dst;
324 key.tp_src = flow->tp_src;
325 key.tp_dst = flow->tp_dst;
326 hash = hash_bytes(&key, sizeof key, 0);
328 /* Find existing stream or start a new one for a SYN or if there's data. */
329 stream = tcp_stream_lookup(r, &key, hash);
331 if (flags & TCP_SYN || l7_length) {
332 stream = tcp_stream_new(r, &key, hash);
333 stream->seq_no = flags & TCP_SYN ? seq + 1 : seq;
339 payload = &stream->payload;
340 if (flags & TCP_SYN || !stream->seq_no) {
341 dp_packet_clear(payload);
342 stream->seq_no = seq + 1;
344 } else if (flags & (TCP_FIN | TCP_RST)) {
345 tcp_stream_destroy(r, stream);
347 } else if (seq == stream->seq_no) {
348 /* Shift all of the existing payload to the very beginning of the
349 * allocated space, so that we reuse allocated space instead of
350 * continually expanding it. */
351 dp_packet_shift(payload, (char *) dp_packet_base(payload) - (char *) dp_packet_data(payload));
353 dp_packet_put(payload, l7, l7_length);
354 stream->seq_no += l7_length;