tcpdump.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438
  1. /* $Id: tcpdump.c 1222 2005-03-30 18:26:33Z aturner $ */
  2. /*
  3. * Copyright (c) 2001-2004 Aaron Turner.
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions
  8. * are met:
  9. *
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions and the following disclaimer.
  12. * 2. Redistributions in binary form must reproduce the above copyright
  13. * notice, this list of conditions and the following disclaimer in the
  14. * documentation and/or other materials provided with the distribution.
  15. * 3. Neither the names of the copyright owners nor the names of its
  16. * contributors may be used to endorse or promote products derived from
  17. * this software without specific prior written permission.
  18. *
  19. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  20. * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  21. * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  22. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
  23. * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  25. * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  26. * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  27. * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  28. * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  29. * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30. */
  31. /*
  32. * This code allows us to use tcpdump to print packet decodes.
  33. * Basically, we create a local AF_UNIX socketpair, fork a copy
  34. * of ourselves, link 1/2 of the pair to STDIN of the child and
  35. * replace the child with tcpdump. We then send a "pcap" file
  36. * over the socket so that tcpdump can print it's decode to STDOUT.
  37. *
  38. * Idea and a lot of code stolen from Christain Kreibich's
  39. * <christian@whoop.org> libnetdude 0.4 code. Any bugs are mine. :)
  40. *
  41. * This product includes software developed by the University of California,
  42. * Lawrence Berkeley Laboratory and its contributors
  43. */
  44. #include "config.h"
  45. #include "defines.h"
  46. #include "common.h"
  47. #include <sys/types.h>
  48. #include <unistd.h>
  49. #include <sys/socket.h>
  50. #include <sys/wait.h>
  51. #include "tcpdump.h"
  52. #include "lib/strlcpy.h"
  53. #ifdef DEBUG
  54. extern int debug;
  55. #endif
  56. char *options_vec[OPTIONS_VEC_SIZE];
  57. void tcpdump_send_file_header(tcpdump_t *tcpdump);
  58. int tcpdump_fill_in_options(char *opt);
  59. int can_exec(const char *filename);
  60. int
  61. tcpdump_print(tcpdump_t *tcpdump, struct pcap_pkthdr *pkthdr, const u_char *data)
  62. {
  63. struct pollfd poller[1];
  64. int result;
  65. char decode[TCPDUMP_DECODE_LEN];
  66. poller[0].fd = tcpdump->infd;
  67. poller[0].events = POLLOUT;
  68. poller[0].revents = 0;
  69. /* wait until we can write to the tcpdump socket */
  70. result = poll(poller, 1, TCPDUMP_POLL_TIMEOUT);
  71. if (result < 0)
  72. errx(1, "Error during poll() to write to tcpdump\n%s", strerror(errno));
  73. if (result == 0)
  74. err(1, "poll() timeout... tcpdump seems to be having a problem keeping up\n"
  75. "Try increasing TCPDUMP_POLL_TIMEOUT");
  76. /* result > 0 if we get here */
  77. if (write(tcpdump->infd, (char *)pkthdr, sizeof(struct pcap_pkthdr))
  78. != sizeof(struct pcap_pkthdr))
  79. errx(1, "Error writing pcap file header to tcpdump\n%s", strerror(errno));
  80. #ifdef DEBUG
  81. if (debug >= 5) {
  82. if (write(tcpdump->debugfd, (char *)pkthdr, sizeof(struct pcap_pkthdr))
  83. != sizeof(struct pcap_pkthdr))
  84. errx(1, "Error writing pcap file header to tcpdump debug\n%s", strerror(errno));
  85. }
  86. #endif
  87. if (write(tcpdump->infd, data, pkthdr->caplen)
  88. != pkthdr->caplen)
  89. errx(1, "Error writing packet data to tcpdump\n%s", strerror(errno));
  90. #ifdef DEBUG
  91. if (debug >= 5) {
  92. if (write(tcpdump->debugfd, data, pkthdr->caplen)
  93. != pkthdr->caplen)
  94. errx(1, "Error writing packet data to tcpdump debug\n%s", strerror(errno));
  95. }
  96. #endif
  97. /* Wait for output from tcpdump */
  98. poller[0].fd = tcpdump->outfd;
  99. poller[0].events = POLLIN;
  100. poller[0].revents = 0;
  101. result = poll(poller, 1, TCPDUMP_POLL_TIMEOUT);
  102. if (result < 0)
  103. errx(1, "Error during poll() to write to tcpdump\n%s", strerror(errno));
  104. if (result == 0)
  105. err(1, "poll() timeout... tcpdump seems to be having a problem keeping up\n"
  106. "Try increasing TCPDUMP_POLL_TIMEOUT");
  107. /* result > 0 if we get here */
  108. if (read(tcpdump->outfd, &decode, TCPDUMP_DECODE_LEN) < 0)
  109. errx(1, "Error reading tcpdump decode: %s", strerror(errno));
  110. printf("%s", decode);
  111. return TRUE;
  112. }
  113. /*
  114. * swaps the pcap header bytes. Ripped right out of libpcap's file.c
  115. */
  116. static void
  117. swap_hdr(struct pcap_file_header *hp)
  118. {
  119. hp->version_major = SWAPSHORT(hp->version_major);
  120. hp->version_minor = SWAPSHORT(hp->version_minor);
  121. hp->thiszone = SWAPLONG(hp->thiszone);
  122. hp->sigfigs = SWAPLONG(hp->sigfigs);
  123. hp->snaplen = SWAPLONG(hp->snaplen);
  124. hp->linktype = SWAPLONG(hp->linktype);
  125. }
  126. int
  127. tcpdump_init(tcpdump_t *tcpdump)
  128. {
  129. FILE *f;
  130. struct pcap_file_header *pfh;
  131. u_int32_t magic;
  132. dbg(2, "tcpdump_init(): preping the pcap file header for tcpdump");
  133. if (!tcpdump || !tcpdump->filename)
  134. return FALSE; /* nothing to init */
  135. /* is tcpdump executable? */
  136. if (! can_exec(TCPDUMP_BINARY)) {
  137. errx(1, "Unable to execute tcpdump binary: %s", TCPDUMP_BINARY);
  138. }
  139. /* Check if we can read the tracefile */
  140. if ( (f = fopen(tcpdump->filename, "r")) == NULL)
  141. errx(1, "Unable to open %s\n", tcpdump->filename);
  142. pfh = &(tcpdump->pfh);
  143. /* Read trace file header */
  144. if (fread(pfh, sizeof(struct pcap_file_header), 1, f) != 1)
  145. errx(1, "Unable to read pcap_file_header: %s", strerror(errno));
  146. if (pfh->magic != TCPDUMP_MAGIC && pfh->magic != PATCHED_TCPDUMP_MAGIC) {
  147. magic = SWAPLONG(pfh->magic);
  148. if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC)
  149. err(1, "Invalid pcap file magic number");
  150. swap_hdr(pfh);
  151. }
  152. fclose(f);
  153. /* force to standard pcap format (non-patched) */
  154. pfh->magic = TCPDUMP_MAGIC;
  155. #ifdef DEBUG
  156. if (debug >= 5)
  157. strlcpy(tcpdump->debugfile, TCPDUMP_DEBUG, sizeof(tcpdump->debugfile));
  158. #endif
  159. return TRUE;
  160. }
  161. int
  162. tcpdump_open(tcpdump_t *tcpdump)
  163. {
  164. int infd[2], outfd[2];
  165. if (! tcpdump)
  166. return FALSE;
  167. if (! tcpdump_init(tcpdump))
  168. return FALSE;
  169. /* copy over the args */
  170. dbg(2, "[child] Prepping tcpdump options...");
  171. tcpdump_fill_in_options(tcpdump->args);
  172. #ifdef DEBUG
  173. dbg(5, "Opening tcpdump debug file: %s", tcpdump->debugfile);
  174. if (debug >= 5) {
  175. if ((tcpdump->debugfd = open(tcpdump->debugfile, O_WRONLY|O_CREAT|O_TRUNC,
  176. S_IREAD|S_IWRITE|S_IRGRP|S_IROTH)) == -1)
  177. errx(1, "Error opening tcpdump debug file: %s\n%s",
  178. tcpdump->debugfile, strerror(errno));
  179. }
  180. #endif
  181. dbg(2, "Starting tcpdump...");
  182. /* create our socket pair to send packet data to tcpdump via */
  183. if (socketpair(AF_UNIX, SOCK_STREAM, 0, infd) < 0)
  184. errx(1, "Unable to create stdin socket pair: %s", strerror(errno));
  185. /* create our socket pair to read packet decode from tcpdump */
  186. if (socketpair(AF_UNIX, SOCK_STREAM, 0, outfd) < 0)
  187. errx(1, "Unable to create stdout socket pair: %s", strerror(errno));
  188. if ((tcpdump->pid = fork() ) < 0)
  189. errx(1, "Fork failed: %s", strerror(errno));
  190. dbg(2, "tcpdump pid: %d", tcpdump->pid);
  191. if (tcpdump->pid > 0) {
  192. /* we're still in tcpreplay */
  193. dbg(2, "[parent] closing input fd %d", infd[1]);
  194. dbg(2, "[parent] closing output fd %d", outfd[1]);
  195. close(infd[1]); /* close the tcpdump side */
  196. close(outfd[1]);
  197. tcpdump->infd = infd[0];
  198. tcpdump->outfd = outfd[0];
  199. if (fcntl(tcpdump->infd, F_SETFL, O_NONBLOCK) < 0)
  200. errx(1, "[parent] Unable to fcntl tcpreplay socket:\n%s", strerror(errno));
  201. if (fcntl(tcpdump->outfd, F_SETFL, O_NONBLOCK) < 0)
  202. errx(1, "[parent] Unable to fnctl stdout socket:\n%s", strerror(errno));
  203. /* send the pcap file header to tcpdump */
  204. tcpdump_send_file_header(tcpdump);
  205. }
  206. else {
  207. dbg(2, "[child] started the kid");
  208. /* we're in the child process */
  209. dbg(2, "[child] closing in fd %d", infd[0]);
  210. dbg(2, "[child] closing out fd %d", outfd[0]);
  211. close(infd[0]); /* close the tcpreplay side */
  212. close(outfd[0]);
  213. /* copy our side of the socketpair to our stdin */
  214. if (infd[1] != STDIN_FILENO) {
  215. if (dup2(infd[1], STDIN_FILENO) != STDIN_FILENO)
  216. errx(1, "[child] Unable to copy socket to stdin: %s",
  217. strerror(errno));
  218. }
  219. /* copy our side of the socketpair to our stdout */
  220. if (outfd[1] != STDOUT_FILENO) {
  221. if (dup2(outfd[1], STDOUT_FILENO) != STDOUT_FILENO)
  222. errx(1, "[child] Unable to copy socket to stdout: %s",
  223. strerror(errno));
  224. }
  225. /* exec tcpdump */
  226. dbg(2, "[child] Exec'ing tcpdump...");
  227. if (execv(TCPDUMP_BINARY, options_vec) < 0)
  228. errx(1, "Unable to exec tcpdump: %s", strerror(errno));
  229. }
  230. return TRUE;
  231. }
  232. /* write the pcap header to the tcpdump child process */
  233. void
  234. tcpdump_send_file_header(tcpdump_t *tcpdump)
  235. {
  236. dbg(2, "[parent] Sending pcap file header out fd %d...", tcpdump->infd);
  237. if (! tcpdump->infd)
  238. err(1, "[parent] tcpdump filehandle is zero.");
  239. if (write(tcpdump->infd, (void *)&(tcpdump->pfh), sizeof(struct pcap_file_header))
  240. != sizeof(struct pcap_file_header)) {
  241. errx(1, "[parent] tcpdump_send_file_header() error writing file header:\n%s",
  242. strerror(errno));
  243. }
  244. #ifdef DEBUG
  245. if (debug >= 5) {
  246. if (write(tcpdump->debugfd, (void *)&(tcpdump->pfh),
  247. sizeof(struct pcap_file_header))
  248. != sizeof(struct pcap_file_header)) {
  249. errx(1, "[parent] tcpdump_send_file_header() error writing file debug header:\n%s",
  250. strerror(errno));
  251. }
  252. }
  253. #endif
  254. }
  255. /* copy the string of args (*opt) to the vector (**opt_vec)
  256. * for a max of opt_len. Returns the number of options
  257. * in the vector
  258. */
  259. int
  260. tcpdump_fill_in_options(char *opt)
  261. {
  262. char options[256];
  263. char *arg, *newarg;
  264. int i = 1, arglen;
  265. char *token = NULL;
  266. /* zero out our options_vec for execv() */
  267. memset(options_vec, '\0', OPTIONS_VEC_SIZE);
  268. /* first arg should be the binary (by convention) */
  269. options_vec[0] = TCPDUMP_BINARY;
  270. /* prep args */
  271. memset(options, '\0', 256);
  272. if (opt != NULL) {
  273. strlcat(options, opt, sizeof(options));
  274. }
  275. strlcat(options, TCPDUMP_ARGS, sizeof(options));
  276. dbg(2, "[child] Will execute: tcpdump %s", options);
  277. /* process args */
  278. /* process the first argument */
  279. arg = strtok_r(options, OPT_DELIM, &token);
  280. arglen = strlen(arg) + 2; /* -{arg}\0 */
  281. newarg = (char *)safe_malloc(arglen);
  282. strlcat(newarg, "-", arglen);
  283. strlcat(newarg, arg, arglen);
  284. options_vec[i++] = newarg;
  285. /* process the remaining args
  286. note that i < OPTIONS_VEC_SIZE - 1
  287. because: a) we need to add '-' as an option to the end
  288. b) because the array has to be null terminated
  289. */
  290. while (((arg = strtok_r(NULL, OPT_DELIM, &token)) != NULL) &&
  291. (i < OPTIONS_VEC_SIZE - 1)) {
  292. arglen = strlen(arg) + 2;
  293. newarg = (char *)safe_malloc(arglen);
  294. strlcat(newarg, "-", arglen);
  295. strlcat(newarg, arg, arglen);
  296. options_vec[i++] = newarg;
  297. }
  298. /* tell -r to read from stdin */
  299. options_vec[i] = "-";
  300. return(i);
  301. }
  302. void
  303. tcpdump_close(tcpdump_t *tcpdump)
  304. {
  305. if (! tcpdump)
  306. return;
  307. if (tcpdump->pid <= 0)
  308. return;
  309. dbg(2, "[parent] killing tcpdump pid: %d", tcpdump->pid);
  310. kill(tcpdump->pid, SIGKILL);
  311. close(tcpdump->infd);
  312. close(tcpdump->outfd);
  313. if (waitpid(tcpdump->pid, NULL, 0) != tcpdump->pid)
  314. errx(1, "[parent] Error in waitpid: %s", strerror(errno));
  315. tcpdump->pid = 0;
  316. tcpdump->infd = 0;
  317. tcpdump->outfd = 0;
  318. }
  319. int
  320. can_exec(const char *filename)
  321. {
  322. struct stat st;
  323. if (!filename || filename[0] == '\0')
  324. return FALSE;
  325. /* Stat the file to see if it's executable and
  326. if the user may run it.
  327. */
  328. if (lstat(filename, &st) < 0)
  329. return FALSE;
  330. if ((st.st_mode & S_IXUSR) ||
  331. (st.st_mode & S_IXGRP) ||
  332. (st.st_mode & S_IXOTH))
  333. return TRUE;
  334. return FALSE;
  335. }
  336. /*
  337. Local Variables:
  338. mode:c
  339. indent-tabs-mode:nil
  340. c-basic-offset:4
  341. End:
  342. */