tcprewrite.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339
  1. /* $Id$ */
  2. /*
  3. * Copyright (c) 2001-2010 Aaron Turner <aturner at synfin dot net>
  4. * Copyright (c) 2013-2018 Fred Klassen <tcpreplay at appneta dot com> - AppNeta
  5. *
  6. * The Tcpreplay Suite of tools is free software: you can redistribute it
  7. * and/or modify it under the terms of the GNU General Public License as
  8. * published by the Free Software Foundation, either version 3 of the
  9. * License, or with the authors permission any later version.
  10. *
  11. * The Tcpreplay Suite is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with the Tcpreplay Suite. If not, see <http://www.gnu.org/licenses/>.
  18. */
  19. /*
  20. * Purpose: Modify packets in a pcap file based on rules provided by the
  21. * user to offload work from tcpreplay and provide a easier means of
  22. * reproducing traffic for testing purposes.
  23. */
  24. #include "config.h"
  25. #include "defines.h"
  26. #include "common.h"
  27. #include <ctype.h>
  28. #include <fcntl.h>
  29. #include <stdio.h>
  30. #include <stdlib.h>
  31. #include <string.h>
  32. #include <sys/types.h>
  33. #include <unistd.h>
  34. #include <errno.h>
  35. #include "tcprewrite.h"
  36. #include "tcprewrite_opts.h"
  37. #include "tcpedit/tcpedit.h"
  38. #include "tcpedit/fuzzing.h"
  39. #ifdef DEBUG
  40. int debug;
  41. #endif
  42. #ifdef ENABLE_VERBOSE
  43. /* tcpdump handle */
  44. tcpdump_t tcpdump;
  45. #endif
  46. tcprewrite_opt_t options;
  47. tcpedit_t *tcpedit;
  48. /* local functions */
  49. void tcprewrite_init(void);
  50. void post_args(int argc, char *argv[]);
  51. int rewrite_packets(tcpedit_t *tcpedit, pcap_t *pin, pcap_dumper_t *pout);
  52. int
  53. main(int argc, char *argv[])
  54. {
  55. int optct, rcode;
  56. pcap_t *dlt_pcap;
  57. #ifdef ENABLE_FRAGROUTE
  58. char ebuf[FRAGROUTE_ERRBUF_LEN];
  59. #endif
  60. tcprewrite_init();
  61. /* call autoopts to process arguments */
  62. optct = optionProcess(&tcprewriteOptions, argc, argv);
  63. argc -= optct;
  64. argv += optct;
  65. /* parse the tcprewrite args */
  66. post_args(argc, argv);
  67. /* init tcpedit context */
  68. if (tcpedit_init(&tcpedit, pcap_datalink(options.pin)) < 0) {
  69. errx(-1, "Error initializing tcpedit: %s", tcpedit_geterr(tcpedit));
  70. }
  71. /* parse the tcpedit args */
  72. rcode = tcpedit_post_args(tcpedit);
  73. if (rcode < 0) {
  74. errx(-1, "Unable to parse args: %s", tcpedit_geterr(tcpedit));
  75. } else if (rcode == 1) {
  76. warnx("%s", tcpedit_geterr(tcpedit));
  77. }
  78. if (tcpedit_validate(tcpedit) < 0) {
  79. errx(-1, "Unable to edit packets given options:\n%s",
  80. tcpedit_geterr(tcpedit));
  81. }
  82. /* fuzzing init */
  83. fuzzing_init(tcpedit->fuzz_seed, tcpedit->fuzz_factor);
  84. /* open up the output file */
  85. options.outfile = safe_strdup(OPT_ARG(OUTFILE));
  86. dbgx(1, "Rewriting DLT to %s",
  87. pcap_datalink_val_to_name(tcpedit_get_output_dlt(tcpedit)));
  88. if ((dlt_pcap = pcap_open_dead(tcpedit_get_output_dlt(tcpedit), 65535)) == NULL)
  89. err(-1, "Unable to open dead pcap handle.");
  90. dbgx(1, "DLT of dlt_pcap is %s",
  91. pcap_datalink_val_to_name(pcap_datalink(dlt_pcap)));
  92. #ifdef ENABLE_FRAGROUTE
  93. if (options.fragroute_args) {
  94. if ((options.frag_ctx = fragroute_init(65535, pcap_datalink(dlt_pcap), options.fragroute_args, ebuf)) == NULL)
  95. errx(-1, "%s", ebuf);
  96. }
  97. #endif
  98. #ifdef ENABLE_VERBOSE
  99. if (options.verbose) {
  100. tcpdump_open(&tcpdump, dlt_pcap);
  101. }
  102. #endif
  103. if ((options.pout = pcap_dump_open(dlt_pcap, options.outfile)) == NULL)
  104. errx(-1, "Unable to open output pcap file: %s", pcap_geterr(dlt_pcap));
  105. pcap_close(dlt_pcap);
  106. /* rewrite packets */
  107. if (rewrite_packets(tcpedit, options.pin, options.pout) != 0)
  108. errx(-1, "Error rewriting packets: %s", tcpedit_geterr(tcpedit));
  109. /* clean up after ourselves */
  110. pcap_dump_close(options.pout);
  111. pcap_close(options.pin);
  112. #ifdef ENABLE_VERBOSE
  113. tcpdump_close(&tcpdump);
  114. #endif
  115. #ifdef ENABLE_FRAGROUTE
  116. if (options.frag_ctx) {
  117. fragroute_close(options.frag_ctx);
  118. }
  119. #endif
  120. #ifdef ENABLE_DMALLOC
  121. dmalloc_shutdown();
  122. #endif
  123. restore_stdin();
  124. return 0;
  125. }
  126. void
  127. tcprewrite_init(void)
  128. {
  129. memset(&options, 0, sizeof(options));
  130. #ifdef ENABLE_VERBOSE
  131. /* clear out tcpdump struct */
  132. memset(&tcpdump, '\0', sizeof(tcpdump_t));
  133. #endif
  134. if (fcntl(STDERR_FILENO, F_SETFL, O_NONBLOCK) < 0)
  135. warnx("Unable to set STDERR to non-blocking: %s", strerror(errno));
  136. }
  137. /**
  138. * post AutoGen argument processing
  139. */
  140. void
  141. post_args(_U_ int argc, _U_ char *argv[])
  142. {
  143. char ebuf[PCAP_ERRBUF_SIZE];
  144. #ifdef DEBUG
  145. if (HAVE_OPT(DBUG))
  146. debug = OPT_VALUE_DBUG;
  147. #else
  148. if (HAVE_OPT(DBUG))
  149. warn("not configured with --enable-debug. Debugging disabled.");
  150. #endif
  151. #ifdef ENABLE_VERBOSE
  152. if (HAVE_OPT(VERBOSE))
  153. options.verbose = 1;
  154. if (HAVE_OPT(DECODE))
  155. tcpdump.args = safe_strdup(OPT_ARG(DECODE));
  156. #endif
  157. #ifdef ENABLE_FRAGROUTE
  158. if (HAVE_OPT(FRAGROUTE))
  159. options.fragroute_args = safe_strdup(OPT_ARG(FRAGROUTE));
  160. options.fragroute_dir = FRAGROUTE_DIR_BOTH;
  161. if (HAVE_OPT(FRAGDIR)) {
  162. if (strcmp(OPT_ARG(FRAGDIR), "c2s") == 0) {
  163. options.fragroute_dir = FRAGROUTE_DIR_C2S;
  164. } else if (strcmp(OPT_ARG(FRAGDIR), "s2c") == 0) {
  165. options.fragroute_dir = FRAGROUTE_DIR_S2C;
  166. } else if (strcmp(OPT_ARG(FRAGDIR), "both") == 0) {
  167. options.fragroute_dir = FRAGROUTE_DIR_BOTH;
  168. } else {
  169. errx(-1, "Unknown --fragdir value: %s", OPT_ARG(FRAGDIR));
  170. }
  171. }
  172. #endif
  173. /* open up the input file */
  174. options.infile = safe_strdup(OPT_ARG(INFILE));
  175. if ((options.pin = pcap_open_offline(options.infile, ebuf)) == NULL)
  176. errx(-1, "Unable to open input pcap file: %s", ebuf);
  177. #ifdef HAVE_PCAP_SNAPSHOT
  178. if (pcap_snapshot(options.pin) < 65535)
  179. warnx("%s was captured using a snaplen of %d bytes. This may mean you have truncated packets.",
  180. options.infile, pcap_snapshot(options.pin));
  181. #endif
  182. }
  183. /**
  184. * Main loop to rewrite packets
  185. */
  186. int
  187. rewrite_packets(tcpedit_t *tcpedit, pcap_t *pin, pcap_dumper_t *pout)
  188. {
  189. tcpr_dir_t cache_result = TCPR_DIR_C2S; /* default to primary */
  190. struct pcap_pkthdr pkthdr, *pkthdr_ptr; /* packet header */
  191. const u_char *pktconst = NULL; /* packet from libpcap */
  192. u_char **pktdata = NULL;
  193. static u_char *pktdata_buff;
  194. static char *frag = NULL;
  195. COUNTER packetnum = 0;
  196. int rcode;
  197. #ifdef ENABLE_FRAGROUTE
  198. int frag_len, proto;
  199. #endif
  200. pkthdr_ptr = &pkthdr;
  201. if (pktdata_buff == NULL)
  202. pktdata_buff = (u_char *)safe_malloc(MAXPACKET);
  203. pktdata = &pktdata_buff;
  204. if (frag == NULL)
  205. frag = (char *)safe_malloc(MAXPACKET);
  206. /* MAIN LOOP
  207. * Keep sending while we have packets or until
  208. * we've sent enough packets
  209. */
  210. while ((pktconst = safe_pcap_next(pin, pkthdr_ptr)) != NULL) {
  211. packetnum++;
  212. dbgx(2, "packet " COUNTER_SPEC " caplen %d", packetnum, pkthdr.caplen);
  213. if (pkthdr.caplen > MAXPACKET)
  214. errx(-1, "Frame too big, caplen %d exceeds %d", pkthdr.caplen, MAXPACKET);
  215. /*
  216. * copy over the packet so we can pad it out if necessary and
  217. * because pcap_next() returns a const ptr
  218. */
  219. memcpy(*pktdata, pktconst, pkthdr.caplen);
  220. #ifdef ENABLE_VERBOSE
  221. if (options.verbose)
  222. tcpdump_print(&tcpdump, pkthdr_ptr, *pktdata);
  223. #endif
  224. /* Dual nic processing? */
  225. if (options.cachedata != NULL) {
  226. cache_result = check_cache(options.cachedata, packetnum);
  227. }
  228. /* sometimes we should not send the packet, in such cases
  229. * no point in editing this packet at all, just write it to the
  230. * output file (note, we can't just remove it, or the tcpprep cache
  231. * file will loose it's indexing
  232. */
  233. if (cache_result == TCPR_DIR_NOSEND)
  234. goto WRITE_PACKET; /* still need to write it so cache stays in sync */
  235. if ((rcode = tcpedit_packet(tcpedit, &pkthdr_ptr, pktdata, cache_result)) == TCPEDIT_ERROR) {
  236. return -1;
  237. } else if ((rcode == TCPEDIT_SOFT_ERROR) && HAVE_OPT(SKIP_SOFT_ERRORS)) {
  238. /* don't write packet */
  239. dbgx(1, "Packet " COUNTER_SPEC " is suppressed from being written due to soft errors", packetnum);
  240. continue;
  241. }
  242. WRITE_PACKET:
  243. #ifdef ENABLE_FRAGROUTE
  244. if (options.frag_ctx == NULL) {
  245. /* write the packet when there's no fragrouting to be done */
  246. pcap_dump((u_char *)pout, pkthdr_ptr, *pktdata);
  247. } else {
  248. /* get the L3 protocol of the packet */
  249. proto = tcpedit_l3proto(tcpedit, AFTER_PROCESS, *pktdata, pkthdr_ptr->caplen);
  250. /* packet is IPv4/IPv6 AND needs to be fragmented */
  251. if ((proto == ETHERTYPE_IP || proto == ETHERTYPE_IP6) &&
  252. ((options.fragroute_dir == FRAGROUTE_DIR_BOTH) ||
  253. (cache_result == TCPR_DIR_C2S && options.fragroute_dir == FRAGROUTE_DIR_C2S) ||
  254. (cache_result == TCPR_DIR_S2C && options.fragroute_dir == FRAGROUTE_DIR_S2C))) {
  255. #ifdef DEBUG
  256. int i = 0;
  257. #endif
  258. if (fragroute_process(options.frag_ctx, *pktdata, pkthdr_ptr->caplen) < 0)
  259. errx(-1, "Error processing packet via fragroute: %s", options.frag_ctx->errbuf);
  260. while ((frag_len = fragroute_getfragment(options.frag_ctx, &frag)) > 0) {
  261. /* frags get the same timestamp as the original packet */
  262. dbgx(1, "processing packet " COUNTER_SPEC " frag: %u (%d)", packetnum, i++, frag_len);
  263. pkthdr_ptr->caplen = frag_len;
  264. pkthdr_ptr->len = frag_len;
  265. pcap_dump((u_char *)pout, pkthdr_ptr, (u_char *)frag);
  266. }
  267. } else {
  268. /* write the packet without fragroute */
  269. pcap_dump((u_char *)pout, pkthdr_ptr, *pktdata);
  270. }
  271. }
  272. #else
  273. /* write the packet when there's no fragrouting to be done */
  274. pcap_dump((u_char *)pout, pkthdr_ptr, *pktdata);
  275. #endif
  276. } /* while() */
  277. return 0;
  278. }