?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netsniff-ng, trafgen: enorce policy if uid/gid set
[netsniff-ng.git] / src / netsniff-ng.c
blob0444fc871d57049431b1b5b66e4bae41cec0bb8a
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2009-2013 Daniel Borkmann.
5 * Copyright 2010 Emmanuel Roullit.
6 * Subject to the GPL, version 2.
7 *
8 * The first sniffer that invoked both, the zero-copy RX_RING as well as
9 * the zero-copy TX_RING for high-performance network I/O and scatter/gather
10 * or mmaped PCAP I/O.
11 *
12 * "I knew that danger lay ahead, of course; but I did not expect to
13 * meet it in our own Shire. Can't a hobbit walk from the Water to the
14 * River in peace?" "But it is not your own Shire," said Gildor. "Others
15 * dwelt here before hobbits were; and others will dwell here again when
16 * hobbits are no more. The wide world is all about you: you can fence
17 * yourselves in, but you cannot for ever fence it out."
18 *
19 * -- The Lord of the Rings, Gildor to Frodo,
20 * Chapter 'Three is Company'.
21 */
22
23 #define _GNU_SOURCE
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <signal.h>
27 #include <getopt.h>
28 #include <ctype.h>
29 #include <time.h>
30 #include <string.h>
31 #include <sys/socket.h>
32 #include <sys/types.h>
33 #include <sys/stat.h>
34 #include <sys/time.h>
35 #include <sys/fsuid.h>
36 #include <unistd.h>
37 #include <stdbool.h>
38 #include <pthread.h>
39 #include <fcntl.h>
40
41 #include "ring_rx.h"
42 #include "ring_tx.h"
43 #include "mac80211.h"
44 #include "xutils.h"
45 #include "built_in.h"
46 #include "pcap.h"
47 #include "bpf.h"
48 #include "xio.h"
49 #include "die.h"
50 #include "tprintf.h"
51 #include "dissector.h"
52 #include "xmalloc.h"
53
54 enum dump_mode {
55 DUMP_INTERVAL_TIME,
56 DUMP_INTERVAL_SIZE,
57 };
58
59 struct ctx {
60 char *device_in, *device_out, *device_trans, *filter, *prefix;
61 int cpu, rfraw, dump, print_mode, dump_dir, jumbo_support, packet_type, verbose;
62 unsigned long kpull, dump_interval, reserve_size, tx_bytes, tx_packets;
63 bool randomize, promiscuous;
64 enum pcap_ops_groups pcap;
65 enum dump_mode dump_mode;
66 uint32_t link_type;
67 };
68
69 volatile sig_atomic_t sigint = 0;
70
71 static volatile bool next_dump = false;
72
73 static const char *short_options = "d:i:o:rf:MJt:S:k:n:b:B:HQmcsqXlvhF:RGAP:Vu:g:";
74 static const struct option long_options[] = {
75 {"dev", required_argument, NULL, 'd'},
76 {"in", required_argument, NULL, 'i'},
77 {"out", required_argument, NULL, 'o'},
78 {"filter", required_argument, NULL, 'f'},
79 {"num", required_argument, NULL, 'n'},
80 {"type", required_argument, NULL, 't'},
81 {"interval", required_argument, NULL, 'F'},
82 {"ring-size", required_argument, NULL, 'S'},
83 {"kernel-pull", required_argument, NULL, 'k'},
84 {"bind-cpu", required_argument, NULL, 'b'},
85 {"unbind-cpu", required_argument, NULL, 'B'},
86 {"prefix", required_argument, NULL, 'P'},
87 {"user", required_argument, NULL, 'u'},
88 {"group", required_argument, NULL, 'g'},
89 {"rand", no_argument, NULL, 'r'},
90 {"rfraw", no_argument, NULL, 'R'},
91 {"mmap", no_argument, NULL, 'm'},
92 {"sg", no_argument, NULL, 'G'},
93 {"clrw", no_argument, NULL, 'c'},
94 {"jumbo-support", no_argument, NULL, 'J'},
95 {"no-promisc", no_argument, NULL, 'M'},
96 {"prio-high", no_argument, NULL, 'H'},
97 {"notouch-irq", no_argument, NULL, 'Q'},
98 {"silent", no_argument, NULL, 's'},
99 {"less", no_argument, NULL, 'q'},
100 {"hex", no_argument, NULL, 'X'},
101 {"ascii", no_argument, NULL, 'l'},
102 {"no-sock-mem", no_argument, NULL, 'A'},
103 {"verbose", no_argument, NULL, 'V'},
104 {"version", no_argument, NULL, 'v'},
105 {"help", no_argument, NULL, 'h'},
106 {NULL, 0, NULL, 0}
107 };
108
109 static int tx_sock;
110
111 static struct itimerval itimer;
112
113 static unsigned long frame_count_max = 0, interval = TX_KERNEL_PULL_INT;
114
115 #define set_system_socket_memory(vals) \
116 do { \
117 if ((vals[0] = get_system_socket_mem(sock_rmem_max)) < SMEM_SUG_MAX) \
118 set_system_socket_mem(sock_rmem_max, SMEM_SUG_MAX); \
119 if ((vals[1] = get_system_socket_mem(sock_rmem_def)) < SMEM_SUG_DEF) \
120 set_system_socket_mem(sock_rmem_def, SMEM_SUG_DEF); \
121 if ((vals[2] = get_system_socket_mem(sock_wmem_max)) < SMEM_SUG_MAX) \
122 set_system_socket_mem(sock_wmem_max, SMEM_SUG_MAX); \
123 if ((vals[3] = get_system_socket_mem(sock_wmem_def)) < SMEM_SUG_DEF) \
124 set_system_socket_mem(sock_wmem_def, SMEM_SUG_DEF); \
125 } while (0)
126
127 #define reset_system_socket_memory(vals) \
128 do { \
129 set_system_socket_mem(sock_rmem_max, vals[0]); \
130 set_system_socket_mem(sock_rmem_def, vals[1]); \
131 set_system_socket_mem(sock_wmem_max, vals[2]); \
132 set_system_socket_mem(sock_wmem_def, vals[3]); \
133 } while (0)
134
135 #define __pcap_io pcap_ops[ctx->pcap]
136
137 static void signal_handler(int number)
138 {
139 switch (number) {
140 case SIGINT:
141 sigint = 1;
142 case SIGHUP:
143 default:
144 break;
145 }
146 }
147
148 static void timer_elapsed(int unused)
149 {
150 itimer.it_interval.tv_sec = 0;
151 itimer.it_interval.tv_usec = interval;
152
153 itimer.it_value.tv_sec = 0;
154 itimer.it_value.tv_usec = interval;
155
156 pull_and_flush_tx_ring(tx_sock);
157 setitimer(ITIMER_REAL, &itimer, NULL);
158 }
159
160 static void timer_next_dump(int unused)
161 {
162 itimer.it_interval.tv_sec = interval;
163 itimer.it_interval.tv_usec = 0;
164
165 itimer.it_value.tv_sec = interval;
166 itimer.it_value.tv_usec = 0;
167
168 next_dump = true;
169 setitimer(ITIMER_REAL, &itimer, NULL);
170 }
171
172 static inline bool dump_to_pcap(struct ctx *ctx)
173 {
174 return ctx->dump;
175 }
176
177 static void pcap_to_xmit(struct ctx *ctx)
178 {
179 __label__ out;
180 uint8_t *out = NULL;
181 int irq, ifindex, fd = 0, ret;
182 unsigned int size, it = 0;
183 unsigned long trunced = 0;
184 struct ring tx_ring;
185 struct frame_map *hdr;
186 struct sock_fprog bpf_ops;
187 struct timeval start, end, diff;
188 struct pcap_pkthdr phdr;
189
190 if (!device_up_and_running(ctx->device_out) && !ctx->rfraw)
191 panic("Device not up and running!\n");
192
193 bug_on(!__pcap_io);
194
195 tx_sock = pf_socket();
196
197 fd = open_or_die(ctx->device_in, O_RDONLY | O_LARGEFILE | O_NOATIME);
198
199 ret = __pcap_io->pull_file_header(fd, &ctx->link_type);
200 if (ret)
201 panic("Error reading pcap header!\n");
202
203 if (__pcap_io->prepare_reading_pcap) {
204 ret = __pcap_io->prepare_reading_pcap(fd);
205 if (ret)
206 panic("Error prepare reading pcap!\n");
207 }
208
209 fmemset(&tx_ring, 0, sizeof(tx_ring));
210 fmemset(&bpf_ops, 0, sizeof(bpf_ops));
211
212 if (ctx->rfraw) {
213 ctx->device_trans = xstrdup(ctx->device_out);
214 xfree(ctx->device_out);
215
216 enter_rfmon_mac80211(ctx->device_trans, &ctx->device_out);
217 if (ctx->link_type != LINKTYPE_IEEE802_11)
218 panic("Wrong linktype of pcap!\n");
219 }
220
221 ifindex = device_ifindex(ctx->device_out);
222
223 size = ring_size(ctx->device_out, ctx->reserve_size);
224
225 bpf_parse_rules(ctx->filter, &bpf_ops);
226
227 set_packet_loss_discard(tx_sock);
228 set_sockopt_hwtimestamp(tx_sock, ctx->device_out);
229
230 setup_tx_ring_layout(tx_sock, &tx_ring, size, ctx->jumbo_support);
231 create_tx_ring(tx_sock, &tx_ring, ctx->verbose);
232 mmap_tx_ring(tx_sock, &tx_ring);
233 alloc_tx_ring_frames(&tx_ring);
234 bind_tx_ring(tx_sock, &tx_ring, ifindex);
235
236 dissector_init_all(ctx->print_mode);
237
238 if (ctx->cpu >= 0 && ifindex > 0) {
239 irq = device_irq_number(ctx->device_out);
240 device_bind_irq_to_cpu(irq, ctx->cpu);
241
242 if (ctx->verbose)
243 printf("IRQ: %s:%d > CPU%d\n",
244 ctx->device_out, irq, ctx->cpu);
245 }
246
247 if (ctx->kpull)
248 interval = ctx->kpull;
249
250 if (ctx->verbose) {
251 printf("BPF:\n");
252 bpf_dump_all(&bpf_ops);
253
254 printf("MD: TX %luus %s ", interval, pcap_ops[ctx->pcap]->name);
255 if (ctx->rfraw)
256 printf("802.11 raw via %s ", ctx->device_out);
257 #ifdef _LARGEFILE64_SOURCE
258 printf("lf64 ");
259 #endif
260 ioprio_print();
261 printf("\n");
262 }
263 printf("Running! Hang up with ^C!\n\n");
264 fflush(stdout);
265
266 itimer.it_interval.tv_sec = 0;
267 itimer.it_interval.tv_usec = interval;
268
269 itimer.it_value.tv_sec = 0;
270 itimer.it_value.tv_usec = interval;
271
272 setitimer(ITIMER_REAL, &itimer, NULL);
273
274 bug_on(gettimeofday(&start, NULL));
275
276 while (likely(sigint == 0)) {
277 while (user_may_pull_from_tx(tx_ring.frames[it].iov_base)) {
278 hdr = tx_ring.frames[it].iov_base;
279
280 /* Kernel assumes: data = ph.raw + po->tp_hdrlen -
281 * sizeof(struct sockaddr_ll); */
282 out = ((uint8_t *) hdr) + TPACKET2_HDRLEN - sizeof(struct sockaddr_ll);
283
284 do {
285 ret = __pcap_io->read_pcap_pkt(fd, &phdr, out,
286 ring_frame_size(&tx_ring));
287 if (unlikely(ret <= 0))
288 goto out;
289
290 if (ring_frame_size(&tx_ring) < phdr.len) {
291 phdr.len = ring_frame_size(&tx_ring);
292 trunced++;
293 }
294 } while (ctx->filter && !bpf_run_filter(&bpf_ops, out, phdr.len));
295
296 pcap_pkthdr_to_tpacket_hdr(&phdr, &hdr->tp_h);
297
298 ctx->tx_bytes += hdr->tp_h.tp_len;;
299 ctx->tx_packets++;
300
301 show_frame_hdr(hdr, ctx->print_mode, RING_MODE_EGRESS);
302
303 dissector_entry_point(out, hdr->tp_h.tp_snaplen,
304 ctx->link_type, ctx->print_mode);
305
306 kernel_may_pull_from_tx(&hdr->tp_h);
307
308 it++;
309 if (it >= tx_ring.layout.tp_frame_nr)
310 it = 0;
311
312 if (unlikely(sigint == 1))
313 break;
314
315 if (frame_count_max != 0) {
316 if (ctx->tx_packets >= frame_count_max) {
317 sigint = 1;
318 break;
319 }
320 }
321 }
322 }
323
324 out:
325
326 bug_on(gettimeofday(&end, NULL));
327 diff = tv_subtract(end, start);
328
329 bpf_release(&bpf_ops);
330
331 dissector_cleanup_all();
332 destroy_tx_ring(tx_sock, &tx_ring);
333
334 if (ctx->rfraw)
335 leave_rfmon_mac80211(ctx->device_trans, ctx->device_out);
336
337 if (__pcap_io->prepare_close_pcap)
338 __pcap_io->prepare_close_pcap(fd, PCAP_MODE_READ);
339
340 close(fd);
341 close(tx_sock);
342
343 fflush(stdout);
344 printf("\n");
345 printf("\r%12lu packets outgoing\n", ctx->tx_packets);
346 printf("\r%12lu packets truncated in file\n", trunced);
347 printf("\r%12lu bytes outgoing\n", ctx->tx_bytes);
348 printf("\r%12lu sec, %lu usec in total\n", diff.tv_sec, diff.tv_usec);
349 }
350
351 static void receive_to_xmit(struct ctx *ctx)
352 {
353 short ifflags = 0;
354 uint8_t *in, *out;
355 int rx_sock, ifindex_in, ifindex_out;
356 unsigned int size_in, size_out, it_in = 0, it_out = 0;
357 unsigned long frame_count = 0;
358 struct frame_map *hdr_in, *hdr_out;
359 struct ring tx_ring, rx_ring;
360 struct pollfd rx_poll;
361 struct sock_fprog bpf_ops;
362
363 if (!strncmp(ctx->device_in, ctx->device_out, IFNAMSIZ))
364 panic("Ingress/egress devices must be different!\n");
365 if (!device_up_and_running(ctx->device_out))
366 panic("Egress device not up and running!\n");
367 if (!device_up_and_running(ctx->device_in))
368 panic("Ingress device not up and running!\n");
369
370 rx_sock = pf_socket();
371 tx_sock = pf_socket();
372
373 fmemset(&tx_ring, 0, sizeof(tx_ring));
374 fmemset(&rx_ring, 0, sizeof(rx_ring));
375 fmemset(&rx_poll, 0, sizeof(rx_poll));
376 fmemset(&bpf_ops, 0, sizeof(bpf_ops));
377
378 ifindex_in = device_ifindex(ctx->device_in);
379 ifindex_out = device_ifindex(ctx->device_out);
380
381 size_in = ring_size(ctx->device_in, ctx->reserve_size);
382 size_out = ring_size(ctx->device_out, ctx->reserve_size);
383
384 enable_kernel_bpf_jit_compiler();
385
386 bpf_parse_rules(ctx->filter, &bpf_ops);
387 bpf_attach_to_sock(rx_sock, &bpf_ops);
388
389 setup_rx_ring_layout(rx_sock, &rx_ring, size_in, ctx->jumbo_support);
390 create_rx_ring(rx_sock, &rx_ring, ctx->verbose);
391 mmap_rx_ring(rx_sock, &rx_ring);
392 alloc_rx_ring_frames(&rx_ring);
393 bind_rx_ring(rx_sock, &rx_ring, ifindex_in);
394 prepare_polling(rx_sock, &rx_poll);
395
396 set_packet_loss_discard(tx_sock);
397 setup_tx_ring_layout(tx_sock, &tx_ring, size_out, ctx->jumbo_support);
398 create_tx_ring(tx_sock, &tx_ring, ctx->verbose);
399 mmap_tx_ring(tx_sock, &tx_ring);
400 alloc_tx_ring_frames(&tx_ring);
401 bind_tx_ring(tx_sock, &tx_ring, ifindex_out);
402
403 dissector_init_all(ctx->print_mode);
404
405 if (ctx->promiscuous)
406 ifflags = enter_promiscuous_mode(ctx->device_in);
407
408 if (ctx->kpull)
409 interval = ctx->kpull;
410
411 itimer.it_interval.tv_sec = 0;
412 itimer.it_interval.tv_usec = interval;
413
414 itimer.it_value.tv_sec = 0;
415 itimer.it_value.tv_usec = interval;
416
417 setitimer(ITIMER_REAL, &itimer, NULL);
418
419 if (ctx->verbose) {
420 printf("BPF:\n");
421 bpf_dump_all(&bpf_ops);
422
423 printf("MD: RXTX %luus\n\n", interval);
424 }
425 printf("Running! Hang up with ^C!\n\n");
426 fflush(stdout);
427
428 while (likely(sigint == 0)) {
429 while (user_may_pull_from_rx(rx_ring.frames[it_in].iov_base)) {
430 __label__ next;
431
432 hdr_in = rx_ring.frames[it_in].iov_base;
433 in = ((uint8_t *) hdr_in) + hdr_in->tp_h.tp_mac;
434
435 frame_count++;
436
437 if (ctx->packet_type != -1)
438 if (ctx->packet_type != hdr_in->s_ll.sll_pkttype)
439 goto next;
440
441 hdr_out = tx_ring.frames[it_out].iov_base;
442 out = ((uint8_t *) hdr_out) + TPACKET2_HDRLEN - sizeof(struct sockaddr_ll);
443
444 for (; !user_may_pull_from_tx(tx_ring.frames[it_out].iov_base) &&
445 likely(!sigint);) {
446 if (ctx->randomize)
447 next_rnd_slot(&it_out, &tx_ring);
448 else {
449 it_out++;
450 if (it_out >= tx_ring.layout.tp_frame_nr)
451 it_out = 0;
452 }
453
454 hdr_out = tx_ring.frames[it_out].iov_base;
455 out = ((uint8_t *) hdr_out) + TPACKET2_HDRLEN - sizeof(struct sockaddr_ll);
456 }
457
458 tpacket_hdr_clone(&hdr_out->tp_h, &hdr_in->tp_h);
459 fmemcpy(out, in, hdr_in->tp_h.tp_len);
460
461 kernel_may_pull_from_tx(&hdr_out->tp_h);
462 if (ctx->randomize)
463 next_rnd_slot(&it_out, &tx_ring);
464 else {
465 it_out++;
466 if (it_out >= tx_ring.layout.tp_frame_nr)
467 it_out = 0;
468 }
469
470 show_frame_hdr(hdr_in, ctx->print_mode, RING_MODE_INGRESS);
471
472 dissector_entry_point(in, hdr_in->tp_h.tp_snaplen,
473 ctx->link_type, ctx->print_mode);
474
475 if (frame_count_max != 0) {
476 if (frame_count >= frame_count_max) {
477 sigint = 1;
478 break;
479 }
480 }
481
482 next:
483
484 kernel_may_pull_from_rx(&hdr_in->tp_h);
485
486 it_in++;
487 if (it_in >= rx_ring.layout.tp_frame_nr)
488 it_in = 0;
489
490 if (unlikely(sigint == 1))
491 goto out;
492 }
493
494 poll(&rx_poll, 1, -1);
495 poll_error_maybe_die(rx_sock, &rx_poll);
496 }
497
498 out:
499
500 sock_print_net_stats(rx_sock, 0);
501
502 bpf_release(&bpf_ops);
503
504 dissector_cleanup_all();
505
506 destroy_tx_ring(tx_sock, &tx_ring);
507 destroy_rx_ring(rx_sock, &rx_ring);
508
509 if (ctx->promiscuous)
510 leave_promiscuous_mode(ctx->device_in, ifflags);
511
512 close(tx_sock);
513 close(rx_sock);
514 }
515
516 static void translate_pcap_to_txf(int fdo, uint8_t *out, size_t len)
517 {
518 size_t bytes_done = 0;
519 char bout[80];
520
521 slprintf(bout, sizeof(bout), "{\n ");
522 write_or_die(fdo, bout, strlen(bout));
523
524 while (bytes_done < len) {
525 slprintf(bout, sizeof(bout), "0x%02x, ", out[bytes_done]);
526 write_or_die(fdo, bout, strlen(bout));
527
528 bytes_done++;
529
530 if (bytes_done % 10 == 0) {
531 slprintf(bout, sizeof(bout), "\n");
532 write_or_die(fdo, bout, strlen(bout));
533
534 if (bytes_done < len) {
535 slprintf(bout, sizeof(bout), " ");
536 write_or_die(fdo, bout, strlen(bout));
537 }
538 }
539 }
540 if (bytes_done % 10 != 0) {
541 slprintf(bout, sizeof(bout), "\n");
542 write_or_die(fdo, bout, strlen(bout));
543 }
544
545 slprintf(bout, sizeof(bout), "}\n\n");
546 write_or_die(fdo, bout, strlen(bout));
547 }
548
549 static void read_pcap(struct ctx *ctx)
550 {
551 __label__ out;
552 uint8_t *out;
553 int ret, fd, fdo = 0;
554 unsigned long trunced = 0;
555 size_t out_len;
556 struct pcap_pkthdr phdr;
557 struct sock_fprog bpf_ops;
558 struct frame_map fm;
559 struct timeval start, end, diff;
560
561 bug_on(!__pcap_io);
562
563 fd = open_or_die(ctx->device_in, O_RDONLY | O_LARGEFILE | O_NOATIME);
564
565 ret = __pcap_io->pull_file_header(fd, &ctx->link_type);
566 if (ret)
567 panic("Error reading pcap header!\n");
568
569 if (__pcap_io->prepare_reading_pcap) {
570 ret = __pcap_io->prepare_reading_pcap(fd);
571 if (ret)
572 panic("Error prepare reading pcap!\n");
573 }
574
575 fmemset(&fm, 0, sizeof(fm));
576 fmemset(&bpf_ops, 0, sizeof(bpf_ops));
577
578 bpf_parse_rules(ctx->filter, &bpf_ops);
579
580 dissector_init_all(ctx->print_mode);
581
582 out_len = round_up(1024 * 1024, PAGE_SIZE);
583 out = xmalloc_aligned(out_len, CO_CACHE_LINE_SIZE);
584
585 if (ctx->verbose) {
586 printf("BPF:\n");
587 bpf_dump_all(&bpf_ops);
588
589 printf("MD: RD %s ", __pcap_io->name);
590 #ifdef _LARGEFILE64_SOURCE
591 printf("lf64 ");
592 #endif
593 ioprio_print();
594 printf("\n");
595 }
596 printf("Running! Hang up with ^C!\n\n");
597 fflush(stdout);
598
599 if (ctx->device_out)
600 fdo = open_or_die_m(ctx->device_out, O_RDWR | O_CREAT |
601 O_TRUNC | O_LARGEFILE, DEFFILEMODE);
602
603 bug_on(gettimeofday(&start, NULL));
604
605 while (likely(sigint == 0)) {
606 do {
607 ret = __pcap_io->read_pcap_pkt(fd, &phdr, out, out_len);
608 if (unlikely(ret < 0))
609 goto out;
610
611 if (unlikely(phdr.len == 0)) {
612 trunced++;
613 continue;
614 }
615
616 if (unlikely(phdr.len > out_len)) {
617 phdr.len = out_len;
618 trunced++;
619 }
620 } while (ctx->filter && !bpf_run_filter(&bpf_ops, out, phdr.len));
621
622 pcap_pkthdr_to_tpacket_hdr(&phdr, &fm.tp_h);
623
624 ctx->tx_bytes += fm.tp_h.tp_len;
625 ctx->tx_packets++;
626
627 show_frame_hdr(&fm, ctx->print_mode, RING_MODE_EGRESS);
628
629 dissector_entry_point(out, fm.tp_h.tp_snaplen,
630 ctx->link_type, ctx->print_mode);
631
632 if (ctx->device_out)
633 translate_pcap_to_txf(fdo, out, fm.tp_h.tp_snaplen);
634
635 if (frame_count_max != 0) {
636 if (ctx->tx_packets >= frame_count_max) {
637 sigint = 1;
638 break;
639 }
640 }
641 }
642
643 out:
644
645 bug_on(gettimeofday(&end, NULL));
646 diff = tv_subtract(end, start);
647
648 bpf_release(&bpf_ops);
649
650 dissector_cleanup_all();
651
652 if (__pcap_io->prepare_close_pcap)
653 __pcap_io->prepare_close_pcap(fd, PCAP_MODE_READ);
654
655 close(fd);
656 if (ctx->device_out)
657 close(fdo);
658
659 xfree(out);
660
661 fflush(stdout);
662 printf("\n");
663 printf("\r%12lu packets outgoing\n", ctx->tx_packets);
664 printf("\r%12lu packets truncated in file\n", trunced);
665 printf("\r%12lu bytes outgoing\n", ctx->tx_bytes);
666 printf("\r%12lu sec, %lu usec in total\n", diff.tv_sec, diff.tv_usec);
667 }
668
669 static void finish_multi_pcap_file(struct ctx *ctx, int fd)
670 {
671 __pcap_io->fsync_pcap(fd);
672
673 if (__pcap_io->prepare_close_pcap)
674 __pcap_io->prepare_close_pcap(fd, PCAP_MODE_WRITE);
675
676 close(fd);
677
678 fmemset(&itimer, 0, sizeof(itimer));
679 setitimer(ITIMER_REAL, &itimer, NULL);
680 }
681
682 static int next_multi_pcap_file(struct ctx *ctx, int fd)
683 {
684 int ret;
685 char fname[512];
686
687 __pcap_io->fsync_pcap(fd);
688
689 if (__pcap_io->prepare_close_pcap)
690 __pcap_io->prepare_close_pcap(fd, PCAP_MODE_WRITE);
691
692 close(fd);
693
694 slprintf(fname, sizeof(fname), "%s/%s%lu.pcap", ctx->device_out,
695 ctx->prefix ? : "dump-", time(0));
696
697 fd = open_or_die_m(fname, O_RDWR | O_CREAT | O_TRUNC |
698 O_LARGEFILE, DEFFILEMODE);
699
700 ret = __pcap_io->push_file_header(fd, ctx->link_type);
701 if (ret)
702 panic("Error writing pcap header!\n");
703
704 if (__pcap_io->prepare_writing_pcap) {
705 ret = __pcap_io->prepare_writing_pcap(fd);
706 if (ret)
707 panic("Error prepare writing pcap!\n");
708 }
709
710 return fd;
711 }
712
713 static int begin_multi_pcap_file(struct ctx *ctx)
714 {
715 int fd, ret;
716 char fname[256];
717
718 bug_on(!__pcap_io);
719
720 if (ctx->device_out[strlen(ctx->device_out) - 1] == '/')
721 ctx->device_out[strlen(ctx->device_out) - 1] = 0;
722
723 slprintf(fname, sizeof(fname), "%s/%s%lu.pcap", ctx->device_out,
724 ctx->prefix ? : "dump-", time(0));
725
726 fd = open_or_die_m(fname, O_RDWR | O_CREAT | O_TRUNC |
727 O_LARGEFILE, DEFFILEMODE);
728
729 ret = __pcap_io->push_file_header(fd, ctx->link_type);
730 if (ret)
731 panic("Error writing pcap header!\n");
732
733 if (__pcap_io->prepare_writing_pcap) {
734 ret = __pcap_io->prepare_writing_pcap(fd);
735 if (ret)
736 panic("Error prepare writing pcap!\n");
737 }
738
739 if (ctx->dump_mode == DUMP_INTERVAL_TIME) {
740 interval = ctx->dump_interval;
741
742 itimer.it_interval.tv_sec = interval;
743 itimer.it_interval.tv_usec = 0;
744
745 itimer.it_value.tv_sec = interval;
746 itimer.it_value.tv_usec = 0;
747
748 setitimer(ITIMER_REAL, &itimer, NULL);
749 } else {
750 interval = 0;
751 }
752
753 return fd;
754 }
755
756 static void finish_single_pcap_file(struct ctx *ctx, int fd)
757 {
758 __pcap_io->fsync_pcap(fd);
759
760 if (__pcap_io->prepare_close_pcap)
761 __pcap_io->prepare_close_pcap(fd, PCAP_MODE_WRITE);
762
763 close(fd);
764 }
765
766 static int begin_single_pcap_file(struct ctx *ctx)
767 {
768 int fd, ret;
769
770 bug_on(!__pcap_io);
771
772 fd = open_or_die_m(ctx->device_out, O_RDWR | O_CREAT | O_TRUNC |
773 O_LARGEFILE, DEFFILEMODE);
774
775 ret = __pcap_io->push_file_header(fd, ctx->link_type);
776 if (ret)
777 panic("Error writing pcap header!\n");
778
779 if (__pcap_io->prepare_writing_pcap) {
780 ret = __pcap_io->prepare_writing_pcap(fd);
781 if (ret)
782 panic("Error prepare writing pcap!\n");
783 }
784
785 return fd;
786 }
787
788 static void print_pcap_file_stats(int sock, struct ctx *ctx, unsigned long skipped)
789 {
790 unsigned long good, bad;
791 struct tpacket_stats kstats;
792 socklen_t slen = sizeof(kstats);
793
794 fmemset(&kstats, 0, sizeof(kstats));
795 getsockopt(sock, SOL_PACKET, PACKET_STATISTICS, &kstats, &slen);
796
797 if (ctx->print_mode == PRINT_NONE) {
798 good = kstats.tp_packets - kstats.tp_drops - skipped;
799 bad = kstats.tp_drops + skipped;
800
801 printf(".(+%lu/-%lu)", good, bad);
802 fflush(stdout);
803 }
804 }
805
806 static void recv_only_or_dump(struct ctx *ctx)
807 {
808 uint8_t *packet;
809 short ifflags = 0;
810 int sock, irq, ifindex, fd = 0, ret;
811 unsigned int size, it = 0;
812 unsigned long frame_count = 0, skipped = 0;
813 struct ring rx_ring;
814 struct pollfd rx_poll;
815 struct frame_map *hdr;
816 struct sock_fprog bpf_ops;
817 struct timeval start, end, diff;
818 struct pcap_pkthdr phdr;
819
820 if (!device_up_and_running(ctx->device_in) && !ctx->rfraw)
821 panic("Device not up and running!\n");
822
823 sock = pf_socket();
824
825 if (ctx->rfraw) {
826 ctx->device_trans = xstrdup(ctx->device_in);
827 xfree(ctx->device_in);
828
829 enter_rfmon_mac80211(ctx->device_trans, &ctx->device_in);
830 ctx->link_type = LINKTYPE_IEEE802_11;
831 }
832
833 if (dump_to_pcap(ctx)) {
834 __label__ try_file;
835 struct stat stats;
836
837 fmemset(&stats, 0, sizeof(stats));
838 ret = stat(ctx->device_out, &stats);
839 if (ret < 0) {
840 ctx->dump_dir = 0;
841 goto try_file;
842 }
843
844 ctx->dump_dir = S_ISDIR(stats.st_mode);
845 if (ctx->dump_dir) {
846 fd = begin_multi_pcap_file(ctx);
847 } else {
848 try_file:
849 fd = begin_single_pcap_file(ctx);
850 }
851 }
852
853 fmemset(&rx_ring, 0, sizeof(rx_ring));
854 fmemset(&rx_poll, 0, sizeof(rx_poll));
855 fmemset(&bpf_ops, 0, sizeof(bpf_ops));
856
857 ifindex = device_ifindex(ctx->device_in);
858
859 size = ring_size(ctx->device_in, ctx->reserve_size);
860
861 enable_kernel_bpf_jit_compiler();
862
863 bpf_parse_rules(ctx->filter, &bpf_ops);
864 bpf_attach_to_sock(sock, &bpf_ops);
865
866 set_sockopt_hwtimestamp(sock, ctx->device_in);
867
868 setup_rx_ring_layout(sock, &rx_ring, size, ctx->jumbo_support);
869 create_rx_ring(sock, &rx_ring, ctx->verbose);
870 mmap_rx_ring(sock, &rx_ring);
871 alloc_rx_ring_frames(&rx_ring);
872 bind_rx_ring(sock, &rx_ring, ifindex);
873
874 prepare_polling(sock, &rx_poll);
875 dissector_init_all(ctx->print_mode);
876
877 if (ctx->cpu >= 0 && ifindex > 0) {
878 irq = device_irq_number(ctx->device_in);
879 device_bind_irq_to_cpu(irq, ctx->cpu);
880
881 if (ctx->verbose)
882 printf("IRQ: %s:%d > CPU%d\n",
883 ctx->device_in, irq, ctx->cpu);
884 }
885
886 if (ctx->promiscuous)
887 ifflags = enter_promiscuous_mode(ctx->device_in);
888
889 if (ctx->verbose) {
890 printf("BPF:\n");
891 bpf_dump_all(&bpf_ops);
892
893 printf("MD: RX %s ", ctx->dump ? pcap_ops[ctx->pcap]->name : "");
894 if (ctx->rfraw)
895 printf("802.11 raw via %s ", ctx->device_in);
896 #ifdef _LARGEFILE64_SOURCE
897 printf("lf64 ");
898 #endif
899 ioprio_print();
900 printf("\n");
901 }
902 printf("Running! Hang up with ^C!\n\n");
903 fflush(stdout);
904
905 bug_on(gettimeofday(&start, NULL));
906
907 while (likely(sigint == 0)) {
908 while (user_may_pull_from_rx(rx_ring.frames[it].iov_base)) {
909 __label__ next;
910
911 hdr = rx_ring.frames[it].iov_base;
912 packet = ((uint8_t *) hdr) + hdr->tp_h.tp_mac;
913 frame_count++;
914
915 if (ctx->packet_type != -1)
916 if (ctx->packet_type != hdr->s_ll.sll_pkttype)
917 goto next;
918
919 if (unlikely(ring_frame_size(&rx_ring) < hdr->tp_h.tp_snaplen)) {
920 skipped++;
921 goto next;
922 }
923
924 if (dump_to_pcap(ctx)) {
925 tpacket_hdr_to_pcap_pkthdr(&hdr->tp_h, &phdr);
926
927 ret = __pcap_io->write_pcap_pkt(fd, &phdr, packet, phdr.len);
928 if (unlikely(ret != sizeof(phdr) + phdr.len))
929 panic("Write error to pcap!\n");
930 }
931
932 show_frame_hdr(hdr, ctx->print_mode, RING_MODE_INGRESS);
933
934 dissector_entry_point(packet, hdr->tp_h.tp_snaplen,
935 ctx->link_type, ctx->print_mode);
936
937 if (frame_count_max != 0) {
938 if (frame_count >= frame_count_max) {
939 sigint = 1;
940 break;
941 }
942 }
943
944 next:
945
946 kernel_may_pull_from_rx(&hdr->tp_h);
947
948 it++;
949 if (it >= rx_ring.layout.tp_frame_nr)
950 it = 0;
951
952 if (unlikely(sigint == 1))
953 break;
954
955 if (dump_to_pcap(ctx)) {
956 if (ctx->dump_mode == DUMP_INTERVAL_SIZE) {
957 interval += hdr->tp_h.tp_snaplen;
958
959 if (interval > ctx->dump_interval) {
960 next_dump = true;
961 interval = 0;
962 }
963 }
964
965 if (next_dump) {
966 fd = next_multi_pcap_file(ctx, fd);
967 next_dump = false;
968
969 if (ctx->verbose)
970 print_pcap_file_stats(sock, ctx, skipped);
971 }
972 }
973 }
974
975 poll(&rx_poll, 1, -1);
976 poll_error_maybe_die(sock, &rx_poll);
977 }
978
979 bug_on(gettimeofday(&end, NULL));
980 diff = tv_subtract(end, start);
981
982 if (!(ctx->dump_dir && ctx->print_mode == PRINT_NONE)) {
983 sock_print_net_stats(sock, skipped);
984
985 printf("\r%12lu sec, %lu usec in total\n",
986 diff.tv_sec, diff.tv_usec);
987 } else {
988 printf("\n\n");
989 fflush(stdout);
990 }
991
992 bpf_release(&bpf_ops);
993 dissector_cleanup_all();
994 destroy_rx_ring(sock, &rx_ring);
995
996 if (ctx->promiscuous)
997 leave_promiscuous_mode(ctx->device_in, ifflags);
998
999 if (ctx->rfraw)
1000 leave_rfmon_mac80211(ctx->device_trans, ctx->device_in);
1001
1002 close(sock);
1003
1004 if (dump_to_pcap(ctx)) {
1005 if (ctx->dump_dir)
1006 finish_multi_pcap_file(ctx, fd);
1007 else
1008 finish_single_pcap_file(ctx, fd);
1009 }
1010 }
1011
1012 static void help(void)
1013 {
1014 printf("\nnetsniff-ng %s, the packet sniffing beast\n", VERSION_STRING);
1015 puts("http://www.netsniff-ng.org\n\n"
1016 "Usage: netsniff-ng [options]\n"
1017 "Options:\n"
1018 " -i|-d|--dev|--in <dev|pcap> Input source as netdev or pcap\n"
1019 " -o|--out <dev|pcap|dir|txf> Output sink as netdev, pcap, directory, txf file\n"
1020 " -f|--filter <bpf-file> Use BPF filter file from bpfc\n"
1021 " -t|--type <type> Only handle packets of defined type:\n"
1022 " host|broadcast|multicast|others|outgoing\n"
1023 " -F|--interval <size/time> Dump interval in time or size if -o is a directory\n"
1024 " pcap swap spec: <num>KiB/MiB/GiB/s/sec/min/hrs\n"
1025 " -J|--jumbo-support Support for 64KB Super Jumbo Frames\n"
1026 " Default RX/TX slot: 2048Byte\n"
1027 " -R|--rfraw Capture or inject raw 802.11 frames\n"
1028 " -n|--num <uint> Number of packets until exit\n"
1029 " `-- 0 Loop until interrupted (default)\n"
1030 " `- n Send n packets and done\n"
1031 "Options for printing:\n"
1032 " -s|--silent Do not print captured packets\n"
1033 " -q|--less Print less-verbose packet information\n"
1034 " -X|--hex Print packet data in hex format\n"
1035 " -l|--ascii Print human-readable packet data\n"
1036 "Options, advanced:\n"
1037 " -P|--prefix <name> Prefix for pcaps stored in directory\n"
1038 " -r|--rand Randomize packet forwarding order\n"
1039 " -M|--no-promisc No promiscuous mode for netdev\n"
1040 " -A|--no-sock-mem Don't tune core socket memory\n"
1041 " -m|--mmap Mmap pcap file i.e., for replaying\n"
1042 " -G|--sg Scatter/gather pcap file I/O\n"
1043 " -c|--clrw Use slower read(2)/write(2) I/O\n"
1044 " -S|--ring-size <size> Manually set ring size to <size>:\n"
1045 " mmap space in KiB/MiB/GiB, e.g. \'10MiB\'\n"
1046 " -k|--kernel-pull <uint> Kernel pull from user interval in us\n"
1047 " Default is 10us where the TX_RING\n"
1048 " is populated with payload from uspace\n"
1049 " -b|--bind-cpu <cpu> Bind to specific CPU (or CPU-range)\n"
1050 " -B|--unbind-cpu <cpu> Forbid to use specific CPU (or CPU-range)\n"
1051 " -u|--user <userid> Drop privileges and change to userid\n"
1052 " -g|--group <groupid> Drop privileges and change to groupid\n"
1053 " -H|--prio-high Make this high priority process\n"
1054 " -Q|--notouch-irq Do not touch IRQ CPU affinity of NIC\n"
1055 " -V|--verbose Be more verbose\n"
1056 " -v|--version Show version\n"
1057 " -h|--help Guess what?!\n\n"
1058 "Examples:\n"
1059 " netsniff-ng --in eth0 --out dump.pcap --silent --bind-cpu 0\n"
1060 " netsniff-ng --in wlan0 --rfraw --out dump.pcap --silent --bind-cpu 0\n"
1061 " netsniff-ng --in dump.pcap --mmap --out eth0 -k1000 --silent --bind-cpu 0\n"
1062 " netsniff-ng --in dump.pcap --out dump.txf --silent --bind-cpu 0\n"
1063 " netsniff-ng --in eth0 --out eth1 --silent --bind-cpu 0 --type host\n"
1064 " netsniff-ng --in eth1 --out /opt/probe/ -s -m -J --interval 100MiB -b 0\n"
1065 " netsniff-ng --in vlan0 --out dump.pcap -c -u `id -u bob` -g `id -g bob`\n"
1066 " netsniff-ng --in any --filter http.bpf --jumbo-support --ascii -V\n\n"
1067 "Note:\n"
1068 " This tool is targeted for network developers! You should\n"
1069 " be aware of what you are doing and what these options above\n"
1070 " mean! Use netsniff-ng's bpfc compiler for generating filter files.\n"
1071 " Further, netsniff-ng automatically enables the kernel BPF JIT\n"
1072 " if present. Txf file output is only possible if the input source\n"
1073 " is a pcap file.\n\n"
1074 "Please report bugs to <bugs@netsniff-ng.org>\n"
1075 "Copyright (C) 2009-2013 Daniel Borkmann <daniel@netsniff-ng.org>\n"
1076 "Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
1077 "Copyright (C) 2012 Markus Amend <markus@netsniff-ng.org>\n"
1078 "License: GNU GPL version 2.0\n"
1079 "This is free software: you are free to change and redistribute it.\n"
1080 "There is NO WARRANTY, to the extent permitted by law.\n");
1081 die();
1082 }
1083
1084 static void version(void)
1085 {
1086 printf("\nnetsniff-ng %s, the packet sniffing beast\n", VERSION_STRING);
1087 puts("http://www.netsniff-ng.org\n\n"
1088 "Please report bugs to <bugs@netsniff-ng.org>\n"
1089 "Copyright (C) 2009-2013 Daniel Borkmann <daniel@netsniff-ng.org>\n"
1090 "Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
1091 "Copyright (C) 2012 Markus Amend <markus@netsniff-ng.org>\n"
1092 "License: GNU GPL version 2.0\n"
1093 "This is free software: you are free to change and redistribute it.\n"
1094 "There is NO WARRANTY, to the extent permitted by law.\n");
1095 die();
1096 }
1097
1098 static void header(void)
1099 {
1100 printf("%s%s%s\n", colorize_start(bold), "netsniff-ng " VERSION_STRING, colorize_end());
1101 }
1102
1103 int main(int argc, char **argv)
1104 {
1105 char *ptr;
1106 int c, i, j, opt_index, ops_touched = 0, vals[4] = {0};
1107 bool prio_high = false, setsockmem = true, enforce = false;
1108 void (*main_loop)(struct ctx *ctx) = NULL;
1109 uid_t uid = getuid();
1110 gid_t gid = getgid();
1111 struct ctx ctx = {
1112 .link_type = LINKTYPE_EN10MB,
1113 .print_mode = PRINT_NORM,
1114 .cpu = -1,
1115 .packet_type = -1,
1116 .promiscuous = true,
1117 .randomize = false,
1118 .pcap = PCAP_OPS_SG,
1119 .dump_interval = 60,
1120 .dump_mode = DUMP_INTERVAL_TIME,
1121 };
1122
1123 srand(time(NULL));
1124
1125 while ((c = getopt_long(argc, argv, short_options, long_options,
1126 &opt_index)) != EOF) {
1127 switch (c) {
1128 case 'd':
1129 case 'i':
1130 ctx.device_in = xstrdup(optarg);
1131 break;
1132 case 'o':
1133 ctx.device_out = xstrdup(optarg);
1134 break;
1135 case 'P':
1136 ctx.prefix = xstrdup(optarg);
1137 break;
1138 case 'R':
1139 ctx.link_type = LINKTYPE_IEEE802_11;
1140 ctx.rfraw = 1;
1141 break;
1142 case 'r':
1143 ctx.randomize = true;
1144 break;
1145 case 'J':
1146 ctx.jumbo_support = 1;
1147 break;
1148 case 'f':
1149 ctx.filter = xstrdup(optarg);
1150 break;
1151 case 'M':
1152 ctx.promiscuous = false;
1153 break;
1154 case 'A':
1155 setsockmem = false;
1156 break;
1157 case 'u':
1158 uid = strtoul(optarg, NULL, 0);
1159 enforce = true;
1160 break;
1161 case 'g':
1162 gid = strtoul(optarg, NULL, 0);
1163 enforce = true;
1164 break;
1165 case 't':
1166 if (!strncmp(optarg, "host", strlen("host")))
1167 ctx.packet_type = PACKET_HOST;
1168 else if (!strncmp(optarg, "broadcast", strlen("broadcast")))
1169 ctx.packet_type = PACKET_BROADCAST;
1170 else if (!strncmp(optarg, "multicast", strlen("multicast")))
1171 ctx.packet_type = PACKET_MULTICAST;
1172 else if (!strncmp(optarg, "others", strlen("others")))
1173 ctx.packet_type = PACKET_OTHERHOST;
1174 else if (!strncmp(optarg, "outgoing", strlen("outgoing")))
1175 ctx.packet_type = PACKET_OUTGOING;
1176 else
1177 ctx.packet_type = -1;
1178 break;
1179 case 'S':
1180 ptr = optarg;
1181 ctx.reserve_size = 0;
1182
1183 for (j = i = strlen(optarg); i > 0; --i) {
1184 if (!isdigit(optarg[j - i]))
1185 break;
1186 ptr++;
1187 }
1188
1189 if (!strncmp(ptr, "KiB", strlen("KiB")))
1190 ctx.reserve_size = 1 << 10;
1191 else if (!strncmp(ptr, "MiB", strlen("MiB")))
1192 ctx.reserve_size = 1 << 20;
1193 else if (!strncmp(ptr, "GiB", strlen("GiB")))
1194 ctx.reserve_size = 1 << 30;
1195 else
1196 panic("Syntax error in ring size param!\n");
1197 *ptr = 0;
1198
1199 ctx.reserve_size *= strtol(optarg, NULL, 0);
1200 break;
1201 case 'b':
1202 set_cpu_affinity(optarg, 0);
1203 /* Take the first CPU for rebinding the IRQ */
1204 if (ctx.cpu != -2)
1205 ctx.cpu = strtol(optarg, NULL, 0);
1206 break;
1207 case 'B':
1208 set_cpu_affinity(optarg, 1);
1209 break;
1210 case 'H':
1211 prio_high = true;
1212 break;
1213 case 'c':
1214 ctx.pcap = PCAP_OPS_RW;
1215 ops_touched = 1;
1216 break;
1217 case 'm':
1218 ctx.pcap = PCAP_OPS_MMAP;
1219 ops_touched = 1;
1220 break;
1221 case 'G':
1222 ctx.pcap = PCAP_OPS_SG;
1223 ops_touched = 1;
1224 break;
1225 case 'Q':
1226 ctx.cpu = -2;
1227 break;
1228 case 's':
1229 ctx.print_mode = PRINT_NONE;
1230 break;
1231 case 'q':
1232 ctx.print_mode = PRINT_LESS;
1233 break;
1234 case 'X':
1235 ctx.print_mode =
1236 (ctx.print_mode == PRINT_ASCII) ?
1237 PRINT_HEX_ASCII : PRINT_HEX;
1238 break;
1239 case 'l':
1240 ctx.print_mode =
1241 (ctx.print_mode == PRINT_HEX) ?
1242 PRINT_HEX_ASCII : PRINT_ASCII;
1243 break;
1244 case 'k':
1245 ctx.kpull = strtol(optarg, NULL, 0);
1246 break;
1247 case 'n':
1248 frame_count_max = strtol(optarg, NULL, 0);
1249 break;
1250 case 'F':
1251 ptr = optarg;
1252 ctx.dump_interval = 0;
1253
1254 for (j = i = strlen(optarg); i > 0; --i) {
1255 if (!isdigit(optarg[j - i]))
1256 break;
1257 ptr++;
1258 }
1259
1260 if (!strncmp(ptr, "KiB", strlen("KiB"))) {
1261 ctx.dump_interval = 1 << 10;
1262 ctx.dump_mode = DUMP_INTERVAL_SIZE;
1263 } else if (!strncmp(ptr, "MiB", strlen("MiB"))) {
1264 ctx.dump_interval = 1 << 20;
1265 ctx.dump_mode = DUMP_INTERVAL_SIZE;
1266 } else if (!strncmp(ptr, "GiB", strlen("GiB"))) {
1267 ctx.dump_interval = 1 << 30;
1268 ctx.dump_mode = DUMP_INTERVAL_SIZE;
1269 } else if (!strncmp(ptr, "sec", strlen("sec"))) {
1270 ctx.dump_interval = 1;
1271 ctx.dump_mode = DUMP_INTERVAL_TIME;
1272 } else if (!strncmp(ptr, "min", strlen("min"))) {
1273 ctx.dump_interval = 60;
1274 ctx.dump_mode = DUMP_INTERVAL_TIME;
1275 } else if (!strncmp(ptr, "hrs", strlen("hrs"))) {
1276 ctx.dump_interval = 60 * 60;
1277 ctx.dump_mode = DUMP_INTERVAL_TIME;
1278 } else if (!strncmp(ptr, "s", strlen("s"))) {
1279 ctx.dump_interval = 1;
1280 ctx.dump_mode = DUMP_INTERVAL_TIME;
1281 } else {
1282 panic("Syntax error in time/size param!\n");
1283 }
1284
1285 *ptr = 0;
1286 ctx.dump_interval *= strtol(optarg, NULL, 0);
1287 break;
1288 case 'V':
1289 ctx.verbose = 1;
1290 break;
1291 case 'v':
1292 version();
1293 break;
1294 case 'h':
1295 help();
1296 break;
1297 case '?':
1298 switch (optopt) {
1299 case 'd':
1300 case 'i':
1301 case 'o':
1302 case 'f':
1303 case 't':
1304 case 'P':
1305 case 'F':
1306 case 'n':
1307 case 'S':
1308 case 'b':
1309 case 'k':
1310 case 'u':
1311 case 'g':
1312 case 'B':
1313 case 'e':
1314 panic("Option -%c requires an argument!\n",
1315 optopt);
1316 default:
1317 if (isprint(optopt))
1318 whine("Unknown option character "
1319 "`0x%X\'!\n", optopt);
1320 die();
1321 }
1322 default:
1323 break;
1324 }
1325 }
1326
1327 if (enforce) {
1328 if (uid == getuid())
1329 panic("Uid cannot be the same as the current user!\n");
1330 if (gid == getgid())
1331 panic("Gid cannot be the same as the current user!\n");
1332 }
1333 if (setgid(gid) != 0)
1334 panic("Unable to drop group privileges: %s!\n", strerror(errno));
1335 if (setuid(uid) != 0)
1336 panic("Unable to drop user privileges: %s!\n", strerror(errno));
1337
1338 if (!ctx.device_in)
1339 ctx.device_in = xstrdup("any");
1340
1341 register_signal(SIGINT, signal_handler);
1342 register_signal(SIGHUP, signal_handler);
1343
1344 header();
1345
1346 init_pcap(ctx.jumbo_support);
1347 tprintf_init();
1348
1349 if (prio_high) {
1350 set_proc_prio(get_default_proc_prio());
1351 set_sched_status(get_default_sched_policy(), get_default_sched_prio());
1352 }
1353
1354 if (ctx.device_in && (device_mtu(ctx.device_in) ||
1355 !strncmp("any", ctx.device_in, strlen(ctx.device_in)))) {
1356 if (!ctx.device_out) {
1357 ctx.dump = 0;
1358 main_loop = recv_only_or_dump;
1359 } else if (device_mtu(ctx.device_out)) {
1360 register_signal_f(SIGALRM, timer_elapsed, SA_SIGINFO);
1361 main_loop = receive_to_xmit;
1362 } else {
1363 ctx.dump = 1;
1364 register_signal_f(SIGALRM, timer_next_dump, SA_SIGINFO);
1365 main_loop = recv_only_or_dump;
1366 if (!ops_touched)
1367 ctx.pcap = PCAP_OPS_SG;
1368 }
1369 } else {
1370 if (ctx.device_out && device_mtu(ctx.device_out)) {
1371 register_signal_f(SIGALRM, timer_elapsed, SA_SIGINFO);
1372 main_loop = pcap_to_xmit;
1373 if (!ops_touched)
1374 ctx.pcap = PCAP_OPS_MMAP;
1375 } else {
1376 main_loop = read_pcap;
1377 if (!ops_touched)
1378 ctx.pcap = PCAP_OPS_SG;
1379 }
1380 }
1381
1382 bug_on(!main_loop);
1383
1384 if (setsockmem)
1385 set_system_socket_memory(vals);
1386
1387 main_loop(&ctx);
1388
1389 if (setsockmem)
1390 reset_system_socket_memory(vals);
1391
1392 tprintf_cleanup();
1393 cleanup_pcap();
1394
1395 free(ctx.device_in);
1396 free(ctx.device_out);
1397 free(ctx.device_trans);
1398 free(ctx.prefix);
1399
1400 return 0;
1401 }
netsniff-ng toolkit, the packet sniffing beast, staging tree