src/netsniff-ng.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2009-2011 Daniel Borkmann.
   5  * Copyright 2010 Emmanuel Roullit.
   6  * Subject to the GPL, version 2.
   7  *
   8  * The first sniffer that invoked both, the zero-copy RX_RING as well as
   9  * the zero-copy TX_RING for high-performance network I/O and scatter/gather
  10  * or mmaped PCAP I/O.
  11  *
  12  *   "I knew that danger lay ahead, of course; but I did not expect to
  13  *   meet it in our own Shire. Can't a hobbit walk from the Water to the
  14  *   River in peace?" "But it is not your own Shire," said Gildor. "Others
  15  *   dwelt here before hobbits were; and others will dwell here again when
  16  *   hobbits are no more. The wide world is all about you: you can fence
  17  *   yourselves in, but you cannot for ever fence it out."
  18  *
  19  *     -- The Lord of the Rings, Gildor to Frodo,
  20  *        Chapter 'Three is Company'.
  21  */
  22
  23 #define _GNU_SOURCE
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <signal.h>
  27 #include <getopt.h>
  28 #include <ctype.h>
  29 #include <time.h>
  30 #include <string.h>
  31 #include <sys/socket.h>
  32 #include <sys/types.h>
  33 #include <sys/stat.h>
  34 #include <sys/time.h>
  35 #include <unistd.h>
  36 #include <stdbool.h>
  37 #include <pthread.h>
  38 #include <fcntl.h>
  39
  40 #include "ring_rx.h"
  41 #include "ring_tx.h"
  42 #include "netdev.h"
  43 #include "compiler.h"
  44 #include "pcap.h"
  45 #include "poll.h"
  46 #include "bpf.h"
  47 #include "signals.h"
  48 #include "xio.h"
  49 #include "die.h"
  50 #include "tty.h"
  51 #include "opt_memcpy.h"
  52 #include "tprintf.h"
  53 #include "dissector.h"
  54 #include "xmalloc.h"
  55 #include "psched.h"
  56 #include "misc.h"
  57 #include "mtrand.h"
  58
  59 #define CPU_UNKNOWN     -1
  60 #define CPU_NOTOUCH     -2
  61 #define PACKET_ALL      -1
  62 #define DUMP_INTERVAL   60
  63
  64 struct mode {
  65         char *device_in;
  66         char *device_out;
  67         char *filter;
  68         int cpu;
  69         int dump;
  70         int link_type;
  71         int print_mode;
  72         unsigned int reserve_size;
  73         int packet_type;
  74         bool randomize;
  75         bool promiscuous;
  76         enum pcap_ops_groups pcap;
  77         unsigned long kpull;
  78         int jumbo_support;
  79         int dump_dir;
  80         unsigned long dump_interval;
  81 };
  82
  83 struct tx_stats {
  84         unsigned long tx_bytes;
  85         unsigned long tx_packets;
  86 };
  87
  88 sig_atomic_t sigint = 0;
  89
  90 static int tx_sock;
  91 static unsigned long frame_cnt_max = 0;
  92 static unsigned long interval = TX_KERNEL_PULL_INT;
  93 static struct itimerval itimer;
  94 static volatile bool next_dump = false;
  95
  96 static const char *short_options = "d:i:o:rf:MJt:S:k:n:b:B:HQmcsqlxCXNvhF:";
  97
  98 static struct option long_options[] = {
  99         {"dev", required_argument, 0, 'd'},
 100         {"in", required_argument, 0, 'i'},
 101         {"out", required_argument, 0, 'o'},
 102         {"rand", no_argument, 0, 'r'},
 103         {"mmap", no_argument, 0, 'm'},
 104         {"clrw", no_argument, 0, 'c'},
 105         {"jumbo-support", no_argument, 0, 'J'},
 106         {"filter", required_argument, 0, 'f'},
 107         {"no-promisc", no_argument, 0, 'M'},
 108         {"num", required_argument, 0, 'n'},
 109         {"type", required_argument, 0, 't'},
 110         {"interval", required_argument, 0, 'F'},
 111         {"ring-size", required_argument, 0, 'S'},
 112         {"kernel-pull", required_argument, 0, 'k'},
 113         {"bind-cpu", required_argument, 0, 'b'},
 114         {"unbind-cpu", required_argument, 0, 'B'},
 115         {"prio-high", no_argument, 0, 'H'},
 116         {"notouch-irq", no_argument, 0, 'Q'},
 117         {"silent", no_argument, 0, 's'},
 118         {"less", no_argument, 0, 'q'},
 119         {"payload", no_argument, 0, 'l'},
 120         {"payload-hex", no_argument, 0, 'x'},
 121         {"c-style", no_argument, 0, 'C'},
 122         {"all-hex", no_argument, 0, 'X'},
 123         {"no-payload", no_argument, 0, 'N'},
 124         {"version", no_argument, 0, 'v'},
 125         {"help", no_argument, 0, 'h'},
 126         {0, 0, 0, 0}
 127 };
 128
 129 static void signal_handler(int number)
 130 {
 131         switch (number) {
 132         case SIGINT:
 133                 sigint = 1;
 134                 break;
 135         case SIGHUP:
 136                 break;
 137         default:
 138                 break;
 139         }
 140 }
 141
 142 static void timer_elapsed(int number)
 143 {
 144         itimer.it_interval.tv_sec = 0;
 145         itimer.it_interval.tv_usec = interval;
 146         itimer.it_value.tv_sec = 0;
 147         itimer.it_value.tv_usec = interval;
 148
 149         pull_and_flush_tx_ring(tx_sock);
 150         setitimer(ITIMER_REAL, &itimer, NULL);
 151 }
 152
 153 static void timer_next_dump(int number)
 154 {
 155         itimer.it_interval.tv_sec = interval;
 156         itimer.it_interval.tv_usec = 0;
 157         itimer.it_value.tv_sec = interval;
 158         itimer.it_value.tv_usec = 0;
 159
 160         next_dump = true;
 161         setitimer(ITIMER_REAL, &itimer, NULL);
 162 }
 163
 164 static void enter_mode_pcap_to_tx(struct mode *mode)
 165 {
 166         int irq, ifindex, fd = 0, ret;
 167         unsigned int size, it = 0;
 168         struct ring tx_ring;
 169         struct frame_map *hdr;
 170         struct sock_fprog bpf_ops;
 171         struct tx_stats stats;
 172         uint8_t *out = NULL;
 173
 174         if (!device_up_and_running(mode->device_out))
 175                 panic("Device not up and running!\n");
 176
 177         set_memcpy();
 178         tx_sock = pf_socket();
 179
 180         if (!pcap_ops[mode->pcap])
 181                 panic("pcap group not supported!\n");
 182         fd = open_or_die(mode->device_in, O_RDONLY | O_LARGEFILE | O_NOATIME);
 183         ret = pcap_ops[mode->pcap]->pull_file_header(fd);
 184         if (ret)
 185                 panic("error reading pcap header!\n");
 186         if (pcap_ops[mode->pcap]->prepare_reading_pcap) {
 187                 ret = pcap_ops[mode->pcap]->prepare_reading_pcap(fd);
 188                 if (ret)
 189                         panic("error prepare reading pcap!\n");
 190         }
 191
 192         memset(&tx_ring, 0, sizeof(tx_ring));
 193         memset(&bpf_ops, 0, sizeof(bpf_ops));
 194         memset(&stats, 0, sizeof(stats));
 195
 196         ifindex = device_ifindex(mode->device_out);
 197         size = ring_size(mode->device_out, mode->reserve_size);
 198
 199         bpf_parse_rules(mode->filter, &bpf_ops);
 200
 201         set_packet_loss_discard(tx_sock);
 202         setup_tx_ring_layout(tx_sock, &tx_ring, size, mode->jumbo_support);
 203         create_tx_ring(tx_sock, &tx_ring);
 204         mmap_tx_ring(tx_sock, &tx_ring);
 205         alloc_tx_ring_frames(&tx_ring);
 206         bind_tx_ring(tx_sock, &tx_ring, ifindex);
 207
 208         dissector_init_all(mode->print_mode);
 209
 210         if (mode->cpu >= 0 && ifindex > 0) {
 211                 irq = device_irq_number(mode->device_out);
 212                 device_bind_irq_to_cpu(mode->cpu, irq);
 213                 printf("IRQ: %s:%d > CPU%d\n", mode->device_out, irq,
 214                        mode->cpu);
 215         }
 216
 217         if (mode->kpull)
 218                 interval = mode->kpull;
 219
 220         itimer.it_interval.tv_sec = 0;
 221         itimer.it_interval.tv_usec = interval;
 222         itimer.it_value.tv_sec = 0;
 223         itimer.it_value.tv_usec = interval;
 224         setitimer(ITIMER_REAL, &itimer, NULL);
 225
 226         printf("BPF:\n");
 227         bpf_dump_all(&bpf_ops);
 228         printf("MD: TX %luus %s\n\n", interval, pcap_ops[mode->pcap]->name);
 229
 230         while (likely(sigint == 0)) {
 231                 while (user_may_pull_from_tx(tx_ring.frames[it].iov_base)) {
 232                         struct pcap_pkthdr phdr;
 233                         hdr = tx_ring.frames[it].iov_base;
 234                         /* Kernel assumes: data = ph.raw + po->tp_hdrlen -
 235                          * sizeof(struct sockaddr_ll); */
 236                         out = ((uint8_t *) hdr) + TPACKET_HDRLEN -
 237                               sizeof(struct sockaddr_ll);
 238
 239                         do {
 240                                 ret = pcap_ops[mode->pcap]->read_pcap_pkt(fd, &phdr,
 241                                                 out, ring_frame_size(&tx_ring));
 242                                 if (unlikely(ret <= 0))
 243                                         goto out;
 244                         } while (mode->filter && !bpf_run_filter(&bpf_ops, out, phdr.len));
 245                         pcap_pkthdr_to_tpacket_hdr(&phdr, &hdr->tp_h);
 246
 247                         stats.tx_bytes += hdr->tp_h.tp_len;;
 248                         stats.tx_packets++;
 249
 250                         show_frame_hdr(hdr, mode->print_mode, RING_MODE_EGRESS);
 251                         dissector_entry_point(out, hdr->tp_h.tp_snaplen,
 252                                               mode->link_type);
 253
 254                         kernel_may_pull_from_tx(&hdr->tp_h);
 255                         next_slot(&it, &tx_ring);
 256
 257                         if (unlikely(sigint == 1))
 258                                 break;
 259                         if (frame_cnt_max != 0 &&
 260                             stats.tx_packets >= frame_cnt_max) {
 261                                 sigint = 1;
 262                                 break;
 263                         }
 264                 }
 265         }
 266 out:
 267         fflush(stdout);
 268         printf("\n");
 269         printf("\r%12lu frames outgoing\n", stats.tx_packets);
 270         printf("\r%12lu bytes outgoing\n", stats.tx_bytes);
 271
 272         dissector_cleanup_all();
 273         destroy_tx_ring(tx_sock, &tx_ring);
 274
 275         close(tx_sock);
 276         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 277                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_READ);
 278         close(fd);
 279 }
 280
 281 /* If netsniff-ngs in device is on a tap, it can efficiently filter out
 282  * some interesting packets and give them to the out device for testing
 283  * or debugging for instance. */
 284 static void enter_mode_rx_to_tx(struct mode *mode)
 285 {
 286         int rx_sock, ifindex_in, ifindex_out;
 287         unsigned int size_in, size_out, it_in = 0, it_out = 0;
 288         unsigned long fcnt = 0;
 289         uint8_t *in, *out;
 290         short ifflags = 0;
 291         struct frame_map *hdr_in, *hdr_out;
 292         struct ring tx_ring;
 293         struct ring rx_ring;
 294         struct pollfd rx_poll;
 295         struct sock_fprog bpf_ops;
 296
 297         if (!strncmp(mode->device_in, mode->device_out,
 298                      strlen(mode->device_in)))
 299                 panic("Ingress/egress devices must be different!\n");
 300         if (!device_up_and_running(mode->device_out))
 301                 panic("Egress device not up and running!\n");
 302         if (!device_up_and_running(mode->device_in))
 303                 panic("Ingress device not up and running!\n");
 304
 305         set_memcpy();
 306         rx_sock = pf_socket();
 307         tx_sock = pf_socket();
 308
 309         memset(&tx_ring, 0, sizeof(tx_ring));
 310         memset(&rx_ring, 0, sizeof(rx_ring));
 311         memset(&rx_poll, 0, sizeof(rx_poll));
 312         memset(&bpf_ops, 0, sizeof(bpf_ops));
 313
 314         ifindex_in = device_ifindex(mode->device_in);
 315         size_in = ring_size(mode->device_in, mode->reserve_size);
 316
 317         ifindex_out = device_ifindex(mode->device_out);
 318         size_out = ring_size(mode->device_out, mode->reserve_size);
 319
 320         enable_kernel_bpf_jit_compiler();
 321         bpf_parse_rules(mode->filter, &bpf_ops);
 322         bpf_attach_to_sock(rx_sock, &bpf_ops);
 323
 324         setup_rx_ring_layout(rx_sock, &rx_ring, size_in, mode->jumbo_support);
 325         create_rx_ring(rx_sock, &rx_ring);
 326         mmap_rx_ring(rx_sock, &rx_ring);
 327         alloc_rx_ring_frames(&rx_ring);
 328         bind_rx_ring(rx_sock, &rx_ring, ifindex_in);
 329         prepare_polling(rx_sock, &rx_poll);
 330
 331         set_packet_loss_discard(tx_sock);
 332         setup_tx_ring_layout(tx_sock, &tx_ring, size_out, mode->jumbo_support);
 333         create_tx_ring(tx_sock, &tx_ring);
 334         mmap_tx_ring(tx_sock, &tx_ring);
 335         alloc_tx_ring_frames(&tx_ring);
 336         bind_tx_ring(tx_sock, &tx_ring, ifindex_out);
 337
 338         mt_init_by_seed_time();
 339         dissector_init_all(mode->print_mode);
 340
 341          if (mode->promiscuous == true) {
 342                 ifflags = enter_promiscuous_mode(mode->device_in);
 343                 printf("PROMISC\n");
 344         }
 345
 346         if (mode->kpull)
 347                 interval = mode->kpull;
 348
 349         itimer.it_interval.tv_sec = 0;
 350         itimer.it_interval.tv_usec = interval;
 351         itimer.it_value.tv_sec = 0;
 352         itimer.it_value.tv_usec = interval;
 353         setitimer(ITIMER_REAL, &itimer, NULL);
 354
 355         printf("BPF:\n");
 356         bpf_dump_all(&bpf_ops);
 357         printf("MD: RXTX %luus\n\n", interval);
 358         printf("Running! Hang up with ^C!\n\n");
 359
 360         while (likely(sigint == 0)) {
 361                 while (user_may_pull_from_rx(rx_ring.frames[it_in].iov_base)) {
 362                         hdr_in = rx_ring.frames[it_in].iov_base;
 363                         in = ((uint8_t *) hdr_in) + hdr_in->tp_h.tp_mac;
 364                         fcnt++;
 365                         if (mode->packet_type != PACKET_ALL)
 366                                 if (mode->packet_type != hdr_in->s_ll.sll_pkttype)
 367                                         goto next;
 368
 369                         hdr_out = tx_ring.frames[it_out].iov_base;
 370                         out = ((uint8_t *) hdr_out) + TPACKET_HDRLEN -
 371                               sizeof(struct sockaddr_ll);
 372
 373                         /* If we cannot pull, look for a different slot. */
 374                         for (; !user_may_pull_from_tx(tx_ring.frames[it_out].iov_base) &&
 375                                likely(!sigint);) {
 376                                 if (mode->randomize)
 377                                         next_rnd_slot(&it_out, &tx_ring);
 378                                 else
 379                                         next_slot(&it_out, &tx_ring);
 380                                 hdr_out = tx_ring.frames[it_out].iov_base;
 381                                 out = ((uint8_t *) hdr_out) + TPACKET_HDRLEN -
 382                                       sizeof(struct sockaddr_ll);
 383                         }
 384
 385                         tpacket_hdr_clone(&hdr_out->tp_h, &hdr_in->tp_h);
 386                         __memcpy(out, in, hdr_in->tp_h.tp_len);
 387
 388                         kernel_may_pull_from_tx(&hdr_out->tp_h);
 389                         if (mode->randomize)
 390                                 next_rnd_slot(&it_out, &tx_ring);
 391                         else
 392                                 next_slot(&it_out, &tx_ring);
 393
 394                         /* Should actually be avoided ... */
 395                         show_frame_hdr(hdr_in, mode->print_mode, RING_MODE_INGRESS);
 396                         dissector_entry_point(in, hdr_in->tp_h.tp_snaplen,
 397                                               mode->link_type);
 398
 399                         if (frame_cnt_max != 0 && fcnt >= frame_cnt_max) {
 400                                 sigint = 1;
 401                                 break;
 402                         }
 403 next:
 404                         kernel_may_pull_from_rx(&hdr_in->tp_h);
 405                         next_slot(&it_in, &rx_ring);
 406
 407                         if (unlikely(sigint == 1))
 408                                 goto out;
 409                 }
 410
 411                 poll(&rx_poll, 1, -1);
 412                 poll_error_maybe_die(rx_sock, &rx_poll);
 413         }
 414 out:
 415         sock_print_net_stats(rx_sock);
 416
 417         dissector_cleanup_all();
 418         destroy_tx_ring(tx_sock, &tx_ring);
 419         destroy_rx_ring(rx_sock, &rx_ring);
 420
 421         if (mode->promiscuous == true)
 422                 leave_promiscuous_mode(mode->device_in, ifflags);
 423
 424         close(tx_sock);
 425         close(rx_sock);
 426 }
 427
 428 static void enter_mode_read_pcap(struct mode *mode)
 429 {
 430         int ret, fd;
 431         struct pcap_pkthdr phdr;
 432         struct sock_fprog bpf_ops;
 433         struct tx_stats stats;
 434         struct frame_map fm;
 435         uint8_t *out;
 436         size_t out_len;
 437
 438         if (!pcap_ops[mode->pcap])
 439                 panic("pcap group not supported!\n");
 440         fd = open_or_die(mode->device_in, O_RDONLY | O_LARGEFILE | O_NOATIME);
 441         ret = pcap_ops[mode->pcap]->pull_file_header(fd);
 442         if (ret)
 443                 panic("error reading pcap header!\n");
 444         if (pcap_ops[mode->pcap]->prepare_reading_pcap) {
 445                 ret = pcap_ops[mode->pcap]->prepare_reading_pcap(fd);
 446                 if (ret)
 447                         panic("error prepare reading pcap!\n");
 448         }
 449
 450         memset(&fm, 0, sizeof(fm));
 451         memset(&bpf_ops, 0, sizeof(bpf_ops));
 452         memset(&stats, 0, sizeof(stats));
 453
 454         bpf_parse_rules(mode->filter, &bpf_ops);
 455         dissector_init_all(mode->print_mode);
 456
 457         out_len = device_mtu("lo");
 458         out = xmalloc_aligned(out_len, 64);
 459
 460         printf("BPF:\n");
 461         bpf_dump_all(&bpf_ops);
 462         printf("MD: RD %s\n\n", pcap_ops[mode->pcap]->name);
 463
 464         while (likely(sigint == 0)) {
 465                 do {
 466                         ret = pcap_ops[mode->pcap]->read_pcap_pkt(fd, &phdr,
 467                                         out, out_len);
 468                         if (unlikely(ret <= 0))
 469                                 goto out;
 470                 } while (mode->filter && !bpf_run_filter(&bpf_ops, out, phdr.len));
 471                 pcap_pkthdr_to_tpacket_hdr(&phdr, &fm.tp_h);
 472
 473                 stats.tx_bytes += fm.tp_h.tp_len;;
 474                 stats.tx_packets++;
 475
 476                 show_frame_hdr(&fm, mode->print_mode, RING_MODE_EGRESS);
 477                 dissector_entry_point(out, fm.tp_h.tp_snaplen,
 478                                       mode->link_type);
 479
 480                 if (frame_cnt_max != 0 &&
 481                     stats.tx_packets >= frame_cnt_max) {
 482                         sigint = 1;
 483                         break;
 484                 }
 485         }
 486 out:
 487         fflush(stdout);
 488         printf("\n");
 489         printf("\r%12lu frames outgoing\n", stats.tx_packets);
 490         printf("\r%12lu bytes outgoing\n", stats.tx_bytes);
 491
 492         xfree(out);
 493         dissector_cleanup_all();
 494         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 495                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_READ);
 496         close(fd);
 497 }
 498
 499 static void finish_multi_pcap_file(struct mode *mode, int fd)
 500 {
 501         pcap_ops[mode->pcap]->fsync_pcap(fd);
 502         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 503                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_WRITE);
 504         close(fd);
 505
 506         memset(&itimer, 0, sizeof(itimer));
 507         setitimer(ITIMER_REAL, &itimer, NULL);
 508 }
 509
 510 static int next_multi_pcap_file(struct mode *mode, int fd)
 511 {
 512         int ret;
 513         char tmp[512];
 514
 515         pcap_ops[mode->pcap]->fsync_pcap(fd);
 516         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 517                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_WRITE);
 518         close(fd);
 519
 520         memset(&tmp, 0, sizeof(tmp));
 521         snprintf(tmp, sizeof(tmp), "%s/%lu.pcap", mode->device_out, time(0));
 522         tmp[sizeof(tmp) - 1] = 0;
 523
 524         fd = open_or_die_m(tmp, O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
 525                            S_IRUSR | S_IWUSR);
 526         ret = pcap_ops[mode->pcap]->push_file_header(fd);
 527         if (ret)
 528                 panic("error writing pcap header!\n");
 529         if (pcap_ops[mode->pcap]->prepare_writing_pcap) {
 530                 ret = pcap_ops[mode->pcap]->prepare_writing_pcap(fd);
 531                 if (ret)
 532                         panic("error prepare writing pcap!\n");
 533         }
 534
 535         return fd;
 536 }
 537
 538 static int begin_multi_pcap_file(struct mode *mode)
 539 {
 540         int fd, ret;
 541         char tmp[512];
 542
 543         if (!pcap_ops[mode->pcap])
 544                 panic("pcap group not supported!\n");
 545         if (mode->device_out[strlen(mode->device_out) - 1] == '/')
 546                 mode->device_out[strlen(mode->device_out) - 1] = 0;
 547
 548         memset(&tmp, 0, sizeof(tmp));
 549         snprintf(tmp, sizeof(tmp), "%s/%lu.pcap", mode->device_out, time(0));
 550         tmp[sizeof(tmp) - 1] = 0;
 551
 552         fd = open_or_die_m(tmp, O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
 553                            S_IRUSR | S_IWUSR);
 554         ret = pcap_ops[mode->pcap]->push_file_header(fd);
 555         if (ret)
 556                 panic("error writing pcap header!\n");
 557         if (pcap_ops[mode->pcap]->prepare_writing_pcap) {
 558                 ret = pcap_ops[mode->pcap]->prepare_writing_pcap(fd);
 559                 if (ret)
 560                         panic("error prepare writing pcap!\n");
 561         }
 562
 563         interval = mode->dump_interval;
 564         itimer.it_interval.tv_sec = interval;
 565         itimer.it_interval.tv_usec = 0;
 566         itimer.it_value.tv_sec = interval;
 567         itimer.it_value.tv_usec = 0;
 568         setitimer(ITIMER_REAL, &itimer, NULL);
 569
 570         return fd;
 571 }
 572
 573 static void finish_single_pcap_file(struct mode *mode, int fd)
 574 {
 575         pcap_ops[mode->pcap]->fsync_pcap(fd);
 576         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 577                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_WRITE);
 578         close(fd);
 579 }
 580
 581 static int begin_single_pcap_file(struct mode *mode)
 582 {
 583         int fd, ret;
 584
 585         if (!pcap_ops[mode->pcap])
 586                 panic("pcap group not supported!\n");
 587         fd = open_or_die_m(mode->device_out,
 588                            O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
 589                            S_IRUSR | S_IWUSR);
 590         ret = pcap_ops[mode->pcap]->push_file_header(fd);
 591         if (ret)
 592                 panic("error writing pcap header!\n");
 593         if (pcap_ops[mode->pcap]->prepare_writing_pcap) {
 594                 ret = pcap_ops[mode->pcap]->prepare_writing_pcap(fd);
 595                 if (ret)
 596                         panic("error prepare writing pcap!\n");
 597         }
 598
 599         return fd;
 600 }
 601
 602 static void enter_mode_rx_only_or_dump(struct mode *mode)
 603 {
 604         int sock, irq, ifindex, fd = 0, ret;
 605         unsigned int size, it = 0;
 606         unsigned long fcnt = 0;
 607         short ifflags = 0;
 608         uint8_t *packet;
 609         struct ring rx_ring;
 610         struct pollfd rx_poll;
 611         struct frame_map *hdr;
 612         struct sock_fprog bpf_ops;
 613
 614         if (!device_up_and_running(mode->device_in))
 615                 panic("Device not up and running!\n");
 616
 617         set_memcpy();
 618         sock = pf_socket();
 619
 620         if (mode->dump) {
 621                 struct stat tmp;
 622                 memset(&tmp, 0, sizeof(tmp));
 623                 ret = stat(mode->device_out, &tmp);
 624                 if (ret < 0) {
 625                         mode->dump_dir = 0;
 626                         goto try_file;
 627                 }
 628                 mode->dump_dir = !!S_ISDIR(tmp.st_mode);
 629                 if (mode->dump_dir) {
 630                         fd = begin_multi_pcap_file(mode);
 631                 } else {
 632 try_file:
 633                         fd = begin_single_pcap_file(mode);
 634                 }
 635         }
 636
 637         memset(&rx_ring, 0, sizeof(rx_ring));
 638         memset(&rx_poll, 0, sizeof(rx_poll));
 639         memset(&bpf_ops, 0, sizeof(bpf_ops));
 640
 641         ifindex = device_ifindex(mode->device_in);
 642         size = ring_size(mode->device_in, mode->reserve_size);
 643
 644         enable_kernel_bpf_jit_compiler();
 645         bpf_parse_rules(mode->filter, &bpf_ops);
 646         bpf_attach_to_sock(sock, &bpf_ops);
 647
 648         setup_rx_ring_layout(sock, &rx_ring, size, mode->jumbo_support);
 649         create_rx_ring(sock, &rx_ring);
 650         mmap_rx_ring(sock, &rx_ring);
 651         alloc_rx_ring_frames(&rx_ring);
 652         bind_rx_ring(sock, &rx_ring, ifindex);
 653
 654         prepare_polling(sock, &rx_poll);
 655         dissector_init_all(mode->print_mode);
 656
 657         if (mode->cpu >= 0 && ifindex > 0) {
 658                 irq = device_irq_number(mode->device_in);
 659                 device_bind_irq_to_cpu(mode->cpu, irq);
 660                 printf("IRQ: %s:%d > CPU%d\n", mode->device_in, irq,
 661                        mode->cpu);
 662         }
 663
 664         if (mode->promiscuous == true) {
 665                 ifflags = enter_promiscuous_mode(mode->device_in);
 666                 printf("PROMISC\n");
 667         }
 668
 669         printf("BPF:\n");
 670         bpf_dump_all(&bpf_ops);
 671         printf("MD: RX %s\n\n", mode->dump ? pcap_ops[mode->pcap]->name : "");
 672
 673         while (likely(sigint == 0)) {
 674                 while (user_may_pull_from_rx(rx_ring.frames[it].iov_base)) {
 675                         hdr = rx_ring.frames[it].iov_base;
 676                         packet = ((uint8_t *) hdr) + hdr->tp_h.tp_mac;
 677                         fcnt++;
 678
 679                         if (mode->packet_type != PACKET_ALL)
 680                                 if (mode->packet_type != hdr->s_ll.sll_pkttype)
 681                                         goto next;
 682                         if (unlikely(rx_ring.layout.tp_frame_size <
 683                                      hdr->tp_h.tp_snaplen)) {
 684                                 fprintf(stderr, "Skipping too large packet! "
 685                                         "No jumbo support selected?\n");
 686                                 fflush(stderr);
 687                                 goto next;
 688                         }
 689                         if (mode->dump) {
 690                                 struct pcap_pkthdr phdr;
 691                                 tpacket_hdr_to_pcap_pkthdr(&hdr->tp_h, &phdr);
 692                                 ret = pcap_ops[mode->pcap]->write_pcap_pkt(fd, &phdr,
 693                                                                            packet, phdr.len);
 694                                 if (unlikely(ret != sizeof(phdr) + phdr.len))
 695                                         panic("Write error to pcap!\n");
 696                         }
 697
 698                         show_frame_hdr(hdr, mode->print_mode, RING_MODE_INGRESS);
 699                         dissector_entry_point(packet, hdr->tp_h.tp_snaplen,
 700                                               mode->link_type);
 701
 702                         if (frame_cnt_max != 0 && fcnt >= frame_cnt_max) {
 703                                 sigint = 1;
 704                                 break;
 705                         }
 706 next:
 707                         kernel_may_pull_from_rx(&hdr->tp_h);
 708                         next_slot(&it, &rx_ring);
 709
 710                         if (unlikely(sigint == 1))
 711                                 break;
 712                         if (mode->dump && next_dump) {
 713                                 struct tpacket_stats kstats;
 714                                 socklen_t slen = sizeof(kstats);
 715                                 memset(&kstats, 0, sizeof(kstats));
 716                                 getsockopt(sock, SOL_PACKET, PACKET_STATISTICS,
 717                                            &kstats, &slen);
 718                                 fd = next_multi_pcap_file(mode, fd);
 719                                 next_dump = false;
 720                                 if (mode->print_mode == FNTTYPE_PRINT_NONE) {
 721                                         printf(".(+%u/-%u)", kstats.tp_packets - kstats.tp_drops,
 722                                                kstats.tp_drops);
 723                                         fflush(stdout);
 724                                 }
 725                         }
 726                 }
 727
 728                 poll(&rx_poll, 1, -1);
 729                 poll_error_maybe_die(sock, &rx_poll);
 730         }
 731
 732         if (!(mode->dump_dir && mode->print_mode == FNTTYPE_PRINT_NONE))
 733                 sock_print_net_stats(sock);
 734         else {
 735                 printf("\n\n");
 736                 fflush(stdout);
 737         }
 738         dissector_cleanup_all();
 739         destroy_rx_ring(sock, &rx_ring);
 740         if (mode->promiscuous == true)
 741                 leave_promiscuous_mode(mode->device_in, ifflags);
 742         close(sock);
 743         if (mode->dump) {
 744                 if (mode->dump_dir)
 745                         finish_multi_pcap_file(mode, fd);
 746                 else
 747                         finish_single_pcap_file(mode, fd);
 748         }
 749 }
 750
 751 static void help(void)
 752 {
 753         printf("\n%s %s, the packet sniffing beast\n", PROGNAME_STRING,
 754                VERSION_STRING);
 755         printf("http://www.netsniff-ng.org\n\n");
 756         printf("Usage: netsniff-ng [options]\n");
 757         printf("Options:\n");
 758         printf("  -i|-d|--dev|--in <dev|pcap> Input source as netdev or pcap\n");
 759         printf("  -o|--out <dev|pcap|dir>     Output sink as netdev or pcap or directory\n");
 760         printf("  -f|--filter <bpf-file>      Use BPF filter file from bpfc\n");
 761         printf("  -t|--type <type>            Only handle packets of defined type:\n");
 762         printf("                              host|broadcast|multicast|others|outgoing\n");
 763         printf("  -F|--interval <int>         Dump interval in sec if -o is a directory where\n");
 764         printf("                              pcap files should be stored (default: 60)\n");
 765         printf("  -s|--silent                 Do not print captured packets\n");
 766         printf("  -J|--jumbo-support          Support for 64KB Super Jumbo Frames\n");
 767         printf("                              Default RX/TX slot: 2048Byte\n");
 768         printf("  -n|--num <uint>             Number of packets until exit\n");
 769         printf("  `--     0                   Loop until interrupt (default)\n");
 770         printf("   `-     n                   Send n packets and done\n");
 771         printf("  -r|--rand                   Randomize packet forwarding order\n");
 772         printf("  -M|--no-promisc             No promiscuous mode for netdev\n");
 773         printf("  -m|--mmap                   Mmap pcap file i.e., for replaying\n");
 774         printf("                              Default: scatter/gather I/O\n");
 775         printf("  -c|--clrw                   Instead s/g I/O use slower read/write I/O\n");
 776         printf("  -S|--ring-size <size>       Manually set ring size to <size>:\n");
 777         printf("                              mmap space in KB/MB/GB, e.g. \'10MB\'\n");
 778         printf("  -k|--kernel-pull <int>      Kernel pull from user interval in us\n");
 779         printf("                              Default is 10us where the TX_RING\n");
 780         printf("                              is populated with payload from uspace\n");
 781         printf("  -b|--bind-cpu <cpu>         Bind to specific CPU (or CPU-range)\n");
 782         printf("  -B|--unbind-cpu <cpu>       Forbid to use specific CPU (or CPU-range)\n");
 783         printf("  -H|--prio-high              Make this high priority process\n");
 784         printf("  -Q|--notouch-irq            Do not touch IRQ CPU affinity of NIC\n");
 785         printf("  -q|--less                   Print less-verbose packet information\n");
 786         printf("  -l|--payload                Only print human-readable payload\n");
 787         printf("  -x|--payload-hex            Only print payload in hex format\n");
 788         printf("  -C|--c-style                Print full packet in trafgen/C style hex format\n");
 789         printf("  -X|--all-hex                Print packets in hex format\n");
 790         printf("  -N|--no-payload             Only print packet header\n");
 791         printf("  -v|--version                Show version\n");
 792         printf("  -h|--help                   Guess what?!\n");
 793         printf("\n");
 794         printf("Examples:\n");
 795         printf("  netsniff-ng --in eth0 --out dump.pcap --silent --bind-cpu 0\n");
 796         printf("  netsniff-ng --in dump.pcap --mmap --out eth0 --silent --bind-cpu 0\n");
 797         printf("  netsniff-ng --in any --filter icmp.bpf --all-hex\n");
 798         printf("  netsniff-ng --in eth0 --out eth1 --silent --bind-cpu 0 --type host --filter http.bpf\n");
 799         printf("  netsniff-ng --in any --filter http.bpf --payload\n");
 800         printf("  netsniff-ng --in wlan0 --out /opt/probe1/ --silent --interval 30 --bind-cpu 0 --jumbo-support\n");
 801         printf("\n");
 802         printf("Note:\n");
 803         printf("  This tool is targeted for network developers! You should\n");
 804         printf("  be aware of what you are doing and what these options above\n");
 805         printf("  mean! Use netsniff-ng's bpfc compiler for generating filter files.\n");
 806         printf("  Further, netsniff-ng automatically enables the kernel BPF JIT\n");
 807         printf("  if present.\n");
 808         printf("\n");
 809         printf("Please report bugs to <bugs@netsniff-ng.org>\n");
 810         printf("Copyright (C) 2009-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n");
 811         printf("Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n");
 812         printf("License: GNU GPL version 2\n");
 813         printf("This is free software: you are free to change and redistribute it.\n");
 814         printf("There is NO WARRANTY, to the extent permitted by law.\n\n");
 815         die();
 816 }
 817
 818 static void version(void)
 819 {
 820         printf("\n%s %s, the packet sniffing beast\n", PROGNAME_STRING,
 821                VERSION_STRING);
 822         printf("http://www.netsniff-ng.org\n\n");
 823         printf("Please report bugs to <bugs@netsniff-ng.org>\n");
 824         printf("Copyright (C) 2009-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n");
 825         printf("Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n");
 826         printf("License: GNU GPL version 2\n");
 827         printf("This is free software: you are free to change and redistribute it.\n");
 828         printf("There is NO WARRANTY, to the extent permitted by law.\n\n");
 829         die();
 830 }
 831
 832 static void header(void)
 833 {
 834         printf("%s%s%s\n", colorize_start(bold), PROGNAME_STRING " "
 835                VERSION_STRING, colorize_end());
 836 }
 837
 838 int main(int argc, char **argv)
 839 {
 840         int c, i, j, opt_index;
 841         char *ptr;
 842         bool prio_high = false;
 843         struct mode mode;
 844         void (*enter_mode)(struct mode *mode) = NULL;
 845
 846         check_for_root_maybe_die();
 847
 848         memset(&mode, 0, sizeof(mode));
 849         mode.link_type = LINKTYPE_EN10MB;
 850         mode.print_mode = FNTTYPE_PRINT_NORM;
 851         mode.cpu = CPU_UNKNOWN;
 852         mode.packet_type = PACKET_ALL;
 853         mode.promiscuous = true;
 854         mode.randomize = false;
 855         mode.pcap = PCAP_OPS_SG;
 856         mode.dump_interval = DUMP_INTERVAL;
 857
 858         while ((c = getopt_long(argc, argv, short_options, long_options,
 859                &opt_index)) != EOF) {
 860                 switch (c) {
 861                 case 'd':
 862                 case 'i':
 863                         mode.device_in = xstrdup(optarg);
 864                         break;
 865                 case 'o':
 866                         mode.device_out = xstrdup(optarg);
 867                         break;
 868                 case 'r':
 869                         mode.randomize = true;
 870                         break;
 871                 case 'J':
 872                         mode.jumbo_support = 1;
 873                         break;
 874                 case 'f':
 875                         mode.filter = xstrdup(optarg);
 876                         break;
 877                 case 'M':
 878                         mode.promiscuous = false;
 879                         break;
 880                 case 't':
 881                         if (!strncmp(optarg, "host", strlen("host")))
 882                                 mode.packet_type = PACKET_HOST;
 883                         else if (!strncmp(optarg, "broadcast", strlen("broadcast")))
 884                                 mode.packet_type = PACKET_BROADCAST;
 885                         else if (!strncmp(optarg, "multicast", strlen("multicast")))
 886                                 mode.packet_type = PACKET_MULTICAST;
 887                         else if (!strncmp(optarg, "others", strlen("others")))
 888                                 mode.packet_type = PACKET_OTHERHOST;
 889                         else if (!strncmp(optarg, "outgoing", strlen("outgoing")))
 890                                 mode.packet_type = PACKET_OUTGOING;
 891                         else
 892                                 mode.packet_type = PACKET_ALL;
 893                         break;
 894                 case 'S':
 895                         ptr = optarg;
 896                         mode.reserve_size = 0;
 897
 898                         for (j = i = strlen(optarg); i > 0; --i) {
 899                                 if (!isdigit(optarg[j - i]))
 900                                         break;
 901                                 ptr++;
 902                         }
 903
 904                         if (!strncmp(ptr, "KB", strlen("KB")))
 905                                 mode.reserve_size = 1 << 10;
 906                         else if (!strncmp(ptr, "MB", strlen("MB")))
 907                                 mode.reserve_size = 1 << 20;
 908                         else if (!strncmp(ptr, "GB", strlen("GB")))
 909                                 mode.reserve_size = 1 << 30;
 910                         else
 911                                 panic("Syntax error in ring size param!\n");
 912
 913                         *ptr = 0;
 914                         mode.reserve_size *= atoi(optarg);
 915                         break;
 916                 case 'b':
 917                         set_cpu_affinity(optarg, 0);
 918                         if (mode.cpu != CPU_NOTOUCH)
 919                                 mode.cpu = atoi(optarg);
 920                         break;
 921                 case 'B':
 922                         set_cpu_affinity(optarg, 1);
 923                         break;
 924                 case 'H':
 925                         prio_high = true;
 926                         break;
 927                 case 'c':
 928                         mode.pcap = PCAP_OPS_RW;
 929                         break;
 930                 case 'm':
 931                         mode.pcap = PCAP_OPS_MMAP;
 932                         break;
 933                 case 'Q':
 934                         mode.cpu = CPU_NOTOUCH;
 935                         break;
 936                 case 's':
 937                         mode.print_mode = FNTTYPE_PRINT_NONE;
 938                         break;
 939                 case 'q':
 940                         mode.print_mode = FNTTYPE_PRINT_LESS;
 941                         break;
 942                 case 'l':
 943                         mode.print_mode = FNTTYPE_PRINT_CHR1;
 944                         break;
 945                 case 'x':
 946                         mode.print_mode = FNTTYPE_PRINT_HEX1;
 947                         break;
 948                 case 'C':
 949                         mode.print_mode = FNTTYPE_PRINT_PAAC;
 950                         break;
 951                 case 'X':
 952                         mode.print_mode = FNTTYPE_PRINT_HEX2;
 953                         break;
 954                 case 'N':
 955                         mode.print_mode = FNTTYPE_PRINT_NOPA;
 956                         break;
 957                 case 'k':
 958                         mode.kpull = (unsigned long) atol(optarg);
 959                         break;
 960                 case 'n':
 961                         frame_cnt_max = (unsigned long) atol(optarg);
 962                         break;
 963                 case 'F':
 964                         mode.dump_interval = (unsigned long) atol(optarg);
 965                         break;
 966                 case 'v':
 967                         version();
 968                         break;
 969                 case 'h':
 970                         help();
 971                         break;
 972                 case '?':
 973                         switch (optopt) {
 974                         case 'd':
 975                         case 'i':
 976                         case 'o':
 977                         case 'f':
 978                         case 't':
 979                         case 'F':
 980                         case 'n':
 981                         case 'S':
 982                         case 'b':
 983                         case 'k':
 984                         case 'B':
 985                         case 'e':
 986                                 panic("Option -%c requires an argument!\n",
 987                                       optopt);
 988                         default:
 989                                 if (isprint(optopt))
 990                                         whine("Unknown option character "
 991                                               "`0x%X\'!\n", optopt);
 992                                 die();
 993                         }
 994                 default:
 995                         break;
 996                 }
 997         }
 998
 999         if (!mode.device_in)
1000                 mode.device_in = xstrdup("any");
1001
1002         register_signal(SIGINT, signal_handler);
1003         register_signal(SIGHUP, signal_handler);
1004
1005         init_pcap(mode.jumbo_support);
1006         tprintf_init();
1007         header();
1008
1009         if (prio_high == true) {
1010                 set_proc_prio(get_default_proc_prio());
1011                 set_sched_status(get_default_sched_policy(),
1012                                  get_default_sched_prio());
1013         }
1014
1015         if (mode.device_in && (device_mtu(mode.device_in) ||
1016             !strncmp("any", mode.device_in, strlen(mode.device_in)))) {
1017                 if (!mode.device_out) {
1018                         mode.dump = 0;
1019                         enter_mode = enter_mode_rx_only_or_dump;
1020                 } else if (device_mtu(mode.device_out)) {
1021                         register_signal_f(SIGALRM, timer_elapsed, SA_SIGINFO);
1022                         enter_mode = enter_mode_rx_to_tx;
1023                 } else {
1024                         mode.dump = 1;
1025                         register_signal_f(SIGALRM, timer_next_dump, SA_SIGINFO);
1026                         enter_mode = enter_mode_rx_only_or_dump;
1027                 }
1028         } else {
1029                 if (mode.device_out && device_mtu(mode.device_out)) {
1030                         register_signal_f(SIGALRM, timer_elapsed, SA_SIGINFO);
1031                         enter_mode = enter_mode_pcap_to_tx;
1032                 } else {
1033                         enter_mode = enter_mode_read_pcap;
1034                 }
1035         }
1036
1037         if (!enter_mode)
1038                 panic("Selection not supported!\n");
1039         enter_mode(&mode);
1040
1041         tprintf_cleanup();
1042         cleanup_pcap();
1043
1044         if (mode.device_in)
1045                 xfree(mode.device_in);
1046         if (mode.device_out)
1047                 xfree(mode.device_out);
1048         return 0;
1049 }
1050