src/netsniff-ng.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2009-2011 Daniel Borkmann.
   5  * Copyright 2010 Emmanuel Roullit.
   6  * Subject to the GPL, version 2.
   7  *
   8  * The first sniffer that invoked both, the zero-copy RX_RING as well as
   9  * the zero-copy TX_RING for high-performance network I/O and scatter/gather
  10  * or mmaped PCAP I/O.
  11  *
  12  *   "I knew that danger lay ahead, of course; but I did not expect to
  13  *   meet it in our own Shire. Can't a hobbit walk from the Water to the
  14  *   River in peace?" "But it is not your own Shire," said Gildor. "Others
  15  *   dwelt here before hobbits were; and others will dwell here again when
  16  *   hobbits are no more. The wide world is all about you: you can fence
  17  *   yourselves in, but you cannot for ever fence it out."
  18  *
  19  *     -- The Lord of the Rings, Gildor to Frodo,
  20  *        Chapter 'Three is Company'.
  21  */
  22
  23 #define _GNU_SOURCE
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <signal.h>
  27 #include <getopt.h>
  28 #include <ctype.h>
  29 #include <time.h>
  30 #include <string.h>
  31 #include <sys/socket.h>
  32 #include <sys/types.h>
  33 #include <sys/stat.h>
  34 #include <sys/time.h>
  35 #include <unistd.h>
  36 #include <stdbool.h>
  37 #include <pthread.h>
  38 #include <fcntl.h>
  39
  40 #include "ring_rx.h"
  41 #include "ring_tx.h"
  42 #include "xsys.h"
  43 #include "compiler.h"
  44 #include "pcap.h"
  45 #include "bpf.h"
  46 #include "xio.h"
  47 #include "die.h"
  48 #include "opt_memcpy.h"
  49 #include "tprintf.h"
  50 #include "dissector.h"
  51 #include "xmalloc.h"
  52 #include "psched.h"
  53 #include "mtrand.h"
  54
  55 #define CPU_UNKNOWN     -1
  56 #define CPU_NOTOUCH     -2
  57 #define PACKET_ALL      -1
  58 #define DUMP_INTERVAL   60
  59
  60 struct mode {
  61         char *device_in;
  62         char *device_out;
  63         char *filter;
  64         int cpu;
  65         int dump;
  66         int link_type;
  67         int print_mode;
  68         unsigned int reserve_size;
  69         int packet_type;
  70         bool randomize;
  71         bool promiscuous;
  72         enum pcap_ops_groups pcap;
  73         unsigned long kpull;
  74         int jumbo_support;
  75         int dump_dir;
  76         unsigned long dump_interval;
  77 };
  78
  79 struct tx_stats {
  80         unsigned long tx_bytes;
  81         unsigned long tx_packets;
  82 };
  83
  84 sig_atomic_t sigint = 0;
  85
  86 static int tx_sock;
  87 static unsigned long frame_cnt_max = 0;
  88 static unsigned long interval = TX_KERNEL_PULL_INT;
  89 static struct itimerval itimer;
  90 static volatile bool next_dump = false;
  91
  92 static const char *short_options = "d:i:o:rf:MJt:S:k:n:b:B:HQmcsqlxCXNvhF:";
  93
  94 static struct option long_options[] = {
  95         {"dev", required_argument, 0, 'd'},
  96         {"in", required_argument, 0, 'i'},
  97         {"out", required_argument, 0, 'o'},
  98         {"rand", no_argument, 0, 'r'},
  99         {"mmap", no_argument, 0, 'm'},
 100         {"clrw", no_argument, 0, 'c'},
 101         {"jumbo-support", no_argument, 0, 'J'},
 102         {"filter", required_argument, 0, 'f'},
 103         {"no-promisc", no_argument, 0, 'M'},
 104         {"num", required_argument, 0, 'n'},
 105         {"type", required_argument, 0, 't'},
 106         {"interval", required_argument, 0, 'F'},
 107         {"ring-size", required_argument, 0, 'S'},
 108         {"kernel-pull", required_argument, 0, 'k'},
 109         {"bind-cpu", required_argument, 0, 'b'},
 110         {"unbind-cpu", required_argument, 0, 'B'},
 111         {"prio-high", no_argument, 0, 'H'},
 112         {"notouch-irq", no_argument, 0, 'Q'},
 113         {"silent", no_argument, 0, 's'},
 114         {"less", no_argument, 0, 'q'},
 115         {"payload", no_argument, 0, 'l'},
 116         {"payload-hex", no_argument, 0, 'x'},
 117         {"c-style", no_argument, 0, 'C'},
 118         {"all-hex", no_argument, 0, 'X'},
 119         {"no-payload", no_argument, 0, 'N'},
 120         {"version", no_argument, 0, 'v'},
 121         {"help", no_argument, 0, 'h'},
 122         {0, 0, 0, 0}
 123 };
 124
 125 static void signal_handler(int number)
 126 {
 127         switch (number) {
 128         case SIGINT:
 129                 sigint = 1;
 130                 break;
 131         case SIGHUP:
 132                 break;
 133         default:
 134                 break;
 135         }
 136 }
 137
 138 static void timer_elapsed(int number)
 139 {
 140         itimer.it_interval.tv_sec = 0;
 141         itimer.it_interval.tv_usec = interval;
 142         itimer.it_value.tv_sec = 0;
 143         itimer.it_value.tv_usec = interval;
 144
 145         pull_and_flush_tx_ring(tx_sock);
 146         setitimer(ITIMER_REAL, &itimer, NULL);
 147 }
 148
 149 static void timer_next_dump(int number)
 150 {
 151         itimer.it_interval.tv_sec = interval;
 152         itimer.it_interval.tv_usec = 0;
 153         itimer.it_value.tv_sec = interval;
 154         itimer.it_value.tv_usec = 0;
 155
 156         next_dump = true;
 157         setitimer(ITIMER_REAL, &itimer, NULL);
 158 }
 159
 160 static void enter_mode_pcap_to_tx(struct mode *mode)
 161 {
 162         int irq, ifindex, fd = 0, ret;
 163         unsigned int size, it = 0;
 164         struct ring tx_ring;
 165         struct frame_map *hdr;
 166         struct sock_fprog bpf_ops;
 167         struct tx_stats stats;
 168         uint8_t *out = NULL;
 169
 170         if (!device_up_and_running(mode->device_out))
 171                 panic("Device not up and running!\n");
 172
 173         set_memcpy();
 174         tx_sock = pf_socket();
 175
 176         if (!pcap_ops[mode->pcap])
 177                 panic("pcap group not supported!\n");
 178         fd = open_or_die(mode->device_in, O_RDONLY | O_LARGEFILE | O_NOATIME);
 179         ret = pcap_ops[mode->pcap]->pull_file_header(fd);
 180         if (ret)
 181                 panic("error reading pcap header!\n");
 182         if (pcap_ops[mode->pcap]->prepare_reading_pcap) {
 183                 ret = pcap_ops[mode->pcap]->prepare_reading_pcap(fd);
 184                 if (ret)
 185                         panic("error prepare reading pcap!\n");
 186         }
 187
 188         memset(&tx_ring, 0, sizeof(tx_ring));
 189         memset(&bpf_ops, 0, sizeof(bpf_ops));
 190         memset(&stats, 0, sizeof(stats));
 191
 192         ifindex = device_ifindex(mode->device_out);
 193         size = ring_size(mode->device_out, mode->reserve_size);
 194
 195         bpf_parse_rules(mode->filter, &bpf_ops);
 196
 197         set_packet_loss_discard(tx_sock);
 198         setup_tx_ring_layout(tx_sock, &tx_ring, size, mode->jumbo_support);
 199         create_tx_ring(tx_sock, &tx_ring);
 200         mmap_tx_ring(tx_sock, &tx_ring);
 201         alloc_tx_ring_frames(&tx_ring);
 202         bind_tx_ring(tx_sock, &tx_ring, ifindex);
 203
 204         dissector_init_all(mode->print_mode);
 205
 206         if (mode->cpu >= 0 && ifindex > 0) {
 207                 irq = device_irq_number(mode->device_out);
 208                 device_bind_irq_to_cpu(mode->cpu, irq);
 209                 printf("IRQ: %s:%d > CPU%d\n", mode->device_out, irq,
 210                        mode->cpu);
 211         }
 212
 213         if (mode->kpull)
 214                 interval = mode->kpull;
 215
 216         itimer.it_interval.tv_sec = 0;
 217         itimer.it_interval.tv_usec = interval;
 218         itimer.it_value.tv_sec = 0;
 219         itimer.it_value.tv_usec = interval;
 220         setitimer(ITIMER_REAL, &itimer, NULL);
 221
 222         printf("BPF:\n");
 223         bpf_dump_all(&bpf_ops);
 224         printf("MD: TX %luus %s\n\n", interval, pcap_ops[mode->pcap]->name);
 225
 226         while (likely(sigint == 0)) {
 227                 while (user_may_pull_from_tx(tx_ring.frames[it].iov_base)) {
 228                         struct pcap_pkthdr phdr;
 229                         hdr = tx_ring.frames[it].iov_base;
 230                         /* Kernel assumes: data = ph.raw + po->tp_hdrlen -
 231                          * sizeof(struct sockaddr_ll); */
 232                         out = ((uint8_t *) hdr) + TPACKET_HDRLEN -
 233                               sizeof(struct sockaddr_ll);
 234
 235                         do {
 236                                 ret = pcap_ops[mode->pcap]->read_pcap_pkt(fd, &phdr,
 237                                                 out, ring_frame_size(&tx_ring));
 238                                 if (unlikely(ret <= 0))
 239                                         goto out;
 240                         } while (mode->filter && !bpf_run_filter(&bpf_ops, out, phdr.len));
 241                         pcap_pkthdr_to_tpacket_hdr(&phdr, &hdr->tp_h);
 242
 243                         stats.tx_bytes += hdr->tp_h.tp_len;;
 244                         stats.tx_packets++;
 245
 246                         show_frame_hdr(hdr, mode->print_mode, RING_MODE_EGRESS);
 247                         dissector_entry_point(out, hdr->tp_h.tp_snaplen,
 248                                               mode->link_type);
 249
 250                         kernel_may_pull_from_tx(&hdr->tp_h);
 251                         next_slot(&it, &tx_ring);
 252
 253                         if (unlikely(sigint == 1))
 254                                 break;
 255                         if (frame_cnt_max != 0 &&
 256                             stats.tx_packets >= frame_cnt_max) {
 257                                 sigint = 1;
 258                                 break;
 259                         }
 260                 }
 261         }
 262 out:
 263         fflush(stdout);
 264         printf("\n");
 265         printf("\r%12lu frames outgoing\n", stats.tx_packets);
 266         printf("\r%12lu bytes outgoing\n", stats.tx_bytes);
 267
 268         dissector_cleanup_all();
 269         destroy_tx_ring(tx_sock, &tx_ring);
 270
 271         close(tx_sock);
 272         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 273                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_READ);
 274         close(fd);
 275 }
 276
 277 /* If netsniff-ngs in device is on a tap, it can efficiently filter out
 278  * some interesting packets and give them to the out device for testing
 279  * or debugging for instance. */
 280 static void enter_mode_rx_to_tx(struct mode *mode)
 281 {
 282         int rx_sock, ifindex_in, ifindex_out;
 283         unsigned int size_in, size_out, it_in = 0, it_out = 0;
 284         unsigned long fcnt = 0;
 285         uint8_t *in, *out;
 286         short ifflags = 0;
 287         struct frame_map *hdr_in, *hdr_out;
 288         struct ring tx_ring;
 289         struct ring rx_ring;
 290         struct pollfd rx_poll;
 291         struct sock_fprog bpf_ops;
 292
 293         if (!strncmp(mode->device_in, mode->device_out,
 294                      strlen(mode->device_in)))
 295                 panic("Ingress/egress devices must be different!\n");
 296         if (!device_up_and_running(mode->device_out))
 297                 panic("Egress device not up and running!\n");
 298         if (!device_up_and_running(mode->device_in))
 299                 panic("Ingress device not up and running!\n");
 300
 301         set_memcpy();
 302         rx_sock = pf_socket();
 303         tx_sock = pf_socket();
 304
 305         memset(&tx_ring, 0, sizeof(tx_ring));
 306         memset(&rx_ring, 0, sizeof(rx_ring));
 307         memset(&rx_poll, 0, sizeof(rx_poll));
 308         memset(&bpf_ops, 0, sizeof(bpf_ops));
 309
 310         ifindex_in = device_ifindex(mode->device_in);
 311         size_in = ring_size(mode->device_in, mode->reserve_size);
 312
 313         ifindex_out = device_ifindex(mode->device_out);
 314         size_out = ring_size(mode->device_out, mode->reserve_size);
 315
 316         enable_kernel_bpf_jit_compiler();
 317         bpf_parse_rules(mode->filter, &bpf_ops);
 318         bpf_attach_to_sock(rx_sock, &bpf_ops);
 319
 320         setup_rx_ring_layout(rx_sock, &rx_ring, size_in, mode->jumbo_support);
 321         create_rx_ring(rx_sock, &rx_ring);
 322         mmap_rx_ring(rx_sock, &rx_ring);
 323         alloc_rx_ring_frames(&rx_ring);
 324         bind_rx_ring(rx_sock, &rx_ring, ifindex_in);
 325         prepare_polling(rx_sock, &rx_poll);
 326
 327         set_packet_loss_discard(tx_sock);
 328         setup_tx_ring_layout(tx_sock, &tx_ring, size_out, mode->jumbo_support);
 329         create_tx_ring(tx_sock, &tx_ring);
 330         mmap_tx_ring(tx_sock, &tx_ring);
 331         alloc_tx_ring_frames(&tx_ring);
 332         bind_tx_ring(tx_sock, &tx_ring, ifindex_out);
 333
 334         mt_init_by_seed_time();
 335         dissector_init_all(mode->print_mode);
 336
 337          if (mode->promiscuous == true) {
 338                 ifflags = enter_promiscuous_mode(mode->device_in);
 339                 printf("PROMISC\n");
 340         }
 341
 342         if (mode->kpull)
 343                 interval = mode->kpull;
 344
 345         itimer.it_interval.tv_sec = 0;
 346         itimer.it_interval.tv_usec = interval;
 347         itimer.it_value.tv_sec = 0;
 348         itimer.it_value.tv_usec = interval;
 349         setitimer(ITIMER_REAL, &itimer, NULL);
 350
 351         printf("BPF:\n");
 352         bpf_dump_all(&bpf_ops);
 353         printf("MD: RXTX %luus\n\n", interval);
 354         printf("Running! Hang up with ^C!\n\n");
 355
 356         while (likely(sigint == 0)) {
 357                 while (user_may_pull_from_rx(rx_ring.frames[it_in].iov_base)) {
 358                         hdr_in = rx_ring.frames[it_in].iov_base;
 359                         in = ((uint8_t *) hdr_in) + hdr_in->tp_h.tp_mac;
 360                         fcnt++;
 361                         if (mode->packet_type != PACKET_ALL)
 362                                 if (mode->packet_type != hdr_in->s_ll.sll_pkttype)
 363                                         goto next;
 364
 365                         hdr_out = tx_ring.frames[it_out].iov_base;
 366                         out = ((uint8_t *) hdr_out) + TPACKET_HDRLEN -
 367                               sizeof(struct sockaddr_ll);
 368
 369                         /* If we cannot pull, look for a different slot. */
 370                         for (; !user_may_pull_from_tx(tx_ring.frames[it_out].iov_base) &&
 371                                likely(!sigint);) {
 372                                 if (mode->randomize)
 373                                         next_rnd_slot(&it_out, &tx_ring);
 374                                 else
 375                                         next_slot(&it_out, &tx_ring);
 376                                 hdr_out = tx_ring.frames[it_out].iov_base;
 377                                 out = ((uint8_t *) hdr_out) + TPACKET_HDRLEN -
 378                                       sizeof(struct sockaddr_ll);
 379                         }
 380
 381                         tpacket_hdr_clone(&hdr_out->tp_h, &hdr_in->tp_h);
 382                         __memcpy(out, in, hdr_in->tp_h.tp_len);
 383
 384                         kernel_may_pull_from_tx(&hdr_out->tp_h);
 385                         if (mode->randomize)
 386                                 next_rnd_slot(&it_out, &tx_ring);
 387                         else
 388                                 next_slot(&it_out, &tx_ring);
 389
 390                         /* Should actually be avoided ... */
 391                         show_frame_hdr(hdr_in, mode->print_mode, RING_MODE_INGRESS);
 392                         dissector_entry_point(in, hdr_in->tp_h.tp_snaplen,
 393                                               mode->link_type);
 394
 395                         if (frame_cnt_max != 0 && fcnt >= frame_cnt_max) {
 396                                 sigint = 1;
 397                                 break;
 398                         }
 399 next:
 400                         kernel_may_pull_from_rx(&hdr_in->tp_h);
 401                         next_slot(&it_in, &rx_ring);
 402
 403                         if (unlikely(sigint == 1))
 404                                 goto out;
 405                 }
 406
 407                 poll(&rx_poll, 1, -1);
 408                 poll_error_maybe_die(rx_sock, &rx_poll);
 409         }
 410 out:
 411         sock_print_net_stats(rx_sock);
 412
 413         dissector_cleanup_all();
 414         destroy_tx_ring(tx_sock, &tx_ring);
 415         destroy_rx_ring(rx_sock, &rx_ring);
 416
 417         if (mode->promiscuous == true)
 418                 leave_promiscuous_mode(mode->device_in, ifflags);
 419
 420         close(tx_sock);
 421         close(rx_sock);
 422 }
 423
 424 static void enter_mode_read_pcap(struct mode *mode)
 425 {
 426         int ret, fd;
 427         struct pcap_pkthdr phdr;
 428         struct sock_fprog bpf_ops;
 429         struct tx_stats stats;
 430         struct frame_map fm;
 431         uint8_t *out;
 432         size_t out_len;
 433
 434         if (!pcap_ops[mode->pcap])
 435                 panic("pcap group not supported!\n");
 436         fd = open_or_die(mode->device_in, O_RDONLY | O_LARGEFILE | O_NOATIME);
 437         ret = pcap_ops[mode->pcap]->pull_file_header(fd);
 438         if (ret)
 439                 panic("error reading pcap header!\n");
 440         if (pcap_ops[mode->pcap]->prepare_reading_pcap) {
 441                 ret = pcap_ops[mode->pcap]->prepare_reading_pcap(fd);
 442                 if (ret)
 443                         panic("error prepare reading pcap!\n");
 444         }
 445
 446         memset(&fm, 0, sizeof(fm));
 447         memset(&bpf_ops, 0, sizeof(bpf_ops));
 448         memset(&stats, 0, sizeof(stats));
 449
 450         bpf_parse_rules(mode->filter, &bpf_ops);
 451         dissector_init_all(mode->print_mode);
 452
 453         out_len = device_mtu("lo");
 454         out = xmalloc_aligned(out_len, 64);
 455
 456         printf("BPF:\n");
 457         bpf_dump_all(&bpf_ops);
 458         printf("MD: RD %s\n\n", pcap_ops[mode->pcap]->name);
 459
 460         while (likely(sigint == 0)) {
 461                 do {
 462                         ret = pcap_ops[mode->pcap]->read_pcap_pkt(fd, &phdr,
 463                                         out, out_len);
 464                         if (unlikely(ret <= 0))
 465                                 goto out;
 466                 } while (mode->filter && !bpf_run_filter(&bpf_ops, out, phdr.len));
 467                 pcap_pkthdr_to_tpacket_hdr(&phdr, &fm.tp_h);
 468
 469                 stats.tx_bytes += fm.tp_h.tp_len;;
 470                 stats.tx_packets++;
 471
 472                 show_frame_hdr(&fm, mode->print_mode, RING_MODE_EGRESS);
 473                 dissector_entry_point(out, fm.tp_h.tp_snaplen,
 474                                       mode->link_type);
 475
 476                 if (frame_cnt_max != 0 &&
 477                     stats.tx_packets >= frame_cnt_max) {
 478                         sigint = 1;
 479                         break;
 480                 }
 481         }
 482 out:
 483         fflush(stdout);
 484         printf("\n");
 485         printf("\r%12lu frames outgoing\n", stats.tx_packets);
 486         printf("\r%12lu bytes outgoing\n", stats.tx_bytes);
 487
 488         xfree(out);
 489         dissector_cleanup_all();
 490         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 491                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_READ);
 492         close(fd);
 493 }
 494
 495 static void finish_multi_pcap_file(struct mode *mode, int fd)
 496 {
 497         pcap_ops[mode->pcap]->fsync_pcap(fd);
 498         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 499                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_WRITE);
 500         close(fd);
 501
 502         memset(&itimer, 0, sizeof(itimer));
 503         setitimer(ITIMER_REAL, &itimer, NULL);
 504 }
 505
 506 static int next_multi_pcap_file(struct mode *mode, int fd)
 507 {
 508         int ret;
 509         char tmp[512];
 510
 511         pcap_ops[mode->pcap]->fsync_pcap(fd);
 512         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 513                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_WRITE);
 514         close(fd);
 515
 516         memset(&tmp, 0, sizeof(tmp));
 517         snprintf(tmp, sizeof(tmp), "%s/%lu.pcap", mode->device_out, time(0));
 518         tmp[sizeof(tmp) - 1] = 0;
 519
 520         fd = open_or_die_m(tmp, O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
 521                            S_IRUSR | S_IWUSR);
 522         ret = pcap_ops[mode->pcap]->push_file_header(fd);
 523         if (ret)
 524                 panic("error writing pcap header!\n");
 525         if (pcap_ops[mode->pcap]->prepare_writing_pcap) {
 526                 ret = pcap_ops[mode->pcap]->prepare_writing_pcap(fd);
 527                 if (ret)
 528                         panic("error prepare writing pcap!\n");
 529         }
 530
 531         return fd;
 532 }
 533
 534 static int begin_multi_pcap_file(struct mode *mode)
 535 {
 536         int fd, ret;
 537         char tmp[512];
 538
 539         if (!pcap_ops[mode->pcap])
 540                 panic("pcap group not supported!\n");
 541         if (mode->device_out[strlen(mode->device_out) - 1] == '/')
 542                 mode->device_out[strlen(mode->device_out) - 1] = 0;
 543
 544         memset(&tmp, 0, sizeof(tmp));
 545         snprintf(tmp, sizeof(tmp), "%s/%lu.pcap", mode->device_out, time(0));
 546         tmp[sizeof(tmp) - 1] = 0;
 547
 548         fd = open_or_die_m(tmp, O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
 549                            S_IRUSR | S_IWUSR);
 550         ret = pcap_ops[mode->pcap]->push_file_header(fd);
 551         if (ret)
 552                 panic("error writing pcap header!\n");
 553         if (pcap_ops[mode->pcap]->prepare_writing_pcap) {
 554                 ret = pcap_ops[mode->pcap]->prepare_writing_pcap(fd);
 555                 if (ret)
 556                         panic("error prepare writing pcap!\n");
 557         }
 558
 559         interval = mode->dump_interval;
 560         itimer.it_interval.tv_sec = interval;
 561         itimer.it_interval.tv_usec = 0;
 562         itimer.it_value.tv_sec = interval;
 563         itimer.it_value.tv_usec = 0;
 564         setitimer(ITIMER_REAL, &itimer, NULL);
 565
 566         return fd;
 567 }
 568
 569 static void finish_single_pcap_file(struct mode *mode, int fd)
 570 {
 571         pcap_ops[mode->pcap]->fsync_pcap(fd);
 572         if (pcap_ops[mode->pcap]->prepare_close_pcap)
 573                 pcap_ops[mode->pcap]->prepare_close_pcap(fd, PCAP_MODE_WRITE);
 574         close(fd);
 575 }
 576
 577 static int begin_single_pcap_file(struct mode *mode)
 578 {
 579         int fd, ret;
 580
 581         if (!pcap_ops[mode->pcap])
 582                 panic("pcap group not supported!\n");
 583         fd = open_or_die_m(mode->device_out,
 584                            O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE,
 585                            S_IRUSR | S_IWUSR);
 586         ret = pcap_ops[mode->pcap]->push_file_header(fd);
 587         if (ret)
 588                 panic("error writing pcap header!\n");
 589         if (pcap_ops[mode->pcap]->prepare_writing_pcap) {
 590                 ret = pcap_ops[mode->pcap]->prepare_writing_pcap(fd);
 591                 if (ret)
 592                         panic("error prepare writing pcap!\n");
 593         }
 594
 595         return fd;
 596 }
 597
 598 static void enter_mode_rx_only_or_dump(struct mode *mode)
 599 {
 600         int sock, irq, ifindex, fd = 0, ret;
 601         unsigned int size, it = 0;
 602         unsigned long fcnt = 0;
 603         short ifflags = 0;
 604         uint8_t *packet;
 605         struct ring rx_ring;
 606         struct pollfd rx_poll;
 607         struct frame_map *hdr;
 608         struct sock_fprog bpf_ops;
 609
 610         if (!device_up_and_running(mode->device_in))
 611                 panic("Device not up and running!\n");
 612
 613         set_memcpy();
 614         sock = pf_socket();
 615
 616         if (mode->dump) {
 617                 struct stat tmp;
 618                 memset(&tmp, 0, sizeof(tmp));
 619                 ret = stat(mode->device_out, &tmp);
 620                 if (ret < 0) {
 621                         mode->dump_dir = 0;
 622                         goto try_file;
 623                 }
 624                 mode->dump_dir = !!S_ISDIR(tmp.st_mode);
 625                 if (mode->dump_dir) {
 626                         fd = begin_multi_pcap_file(mode);
 627                 } else {
 628 try_file:
 629                         fd = begin_single_pcap_file(mode);
 630                 }
 631         }
 632
 633         memset(&rx_ring, 0, sizeof(rx_ring));
 634         memset(&rx_poll, 0, sizeof(rx_poll));
 635         memset(&bpf_ops, 0, sizeof(bpf_ops));
 636
 637         ifindex = device_ifindex(mode->device_in);
 638         size = ring_size(mode->device_in, mode->reserve_size);
 639
 640         enable_kernel_bpf_jit_compiler();
 641         bpf_parse_rules(mode->filter, &bpf_ops);
 642         bpf_attach_to_sock(sock, &bpf_ops);
 643
 644         setup_rx_ring_layout(sock, &rx_ring, size, mode->jumbo_support);
 645         create_rx_ring(sock, &rx_ring);
 646         mmap_rx_ring(sock, &rx_ring);
 647         alloc_rx_ring_frames(&rx_ring);
 648         bind_rx_ring(sock, &rx_ring, ifindex);
 649
 650         prepare_polling(sock, &rx_poll);
 651         dissector_init_all(mode->print_mode);
 652
 653         if (mode->cpu >= 0 && ifindex > 0) {
 654                 irq = device_irq_number(mode->device_in);
 655                 device_bind_irq_to_cpu(mode->cpu, irq);
 656                 printf("IRQ: %s:%d > CPU%d\n", mode->device_in, irq,
 657                        mode->cpu);
 658         }
 659
 660         if (mode->promiscuous == true) {
 661                 ifflags = enter_promiscuous_mode(mode->device_in);
 662                 printf("PROMISC\n");
 663         }
 664
 665         printf("BPF:\n");
 666         bpf_dump_all(&bpf_ops);
 667         printf("MD: RX %s\n\n", mode->dump ? pcap_ops[mode->pcap]->name : "");
 668
 669         while (likely(sigint == 0)) {
 670                 while (user_may_pull_from_rx(rx_ring.frames[it].iov_base)) {
 671                         hdr = rx_ring.frames[it].iov_base;
 672                         packet = ((uint8_t *) hdr) + hdr->tp_h.tp_mac;
 673                         fcnt++;
 674
 675                         if (mode->packet_type != PACKET_ALL)
 676                                 if (mode->packet_type != hdr->s_ll.sll_pkttype)
 677                                         goto next;
 678                         if (unlikely(rx_ring.layout.tp_frame_size <
 679                                      hdr->tp_h.tp_snaplen)) {
 680                                 fprintf(stderr, "Skipping too large packet! "
 681                                         "No jumbo support selected?\n");
 682                                 fflush(stderr);
 683                                 goto next;
 684                         }
 685                         if (mode->dump) {
 686                                 struct pcap_pkthdr phdr;
 687                                 tpacket_hdr_to_pcap_pkthdr(&hdr->tp_h, &phdr);
 688                                 ret = pcap_ops[mode->pcap]->write_pcap_pkt(fd, &phdr,
 689                                                                            packet, phdr.len);
 690                                 if (unlikely(ret != sizeof(phdr) + phdr.len))
 691                                         panic("Write error to pcap!\n");
 692                         }
 693
 694                         show_frame_hdr(hdr, mode->print_mode, RING_MODE_INGRESS);
 695                         dissector_entry_point(packet, hdr->tp_h.tp_snaplen,
 696                                               mode->link_type);
 697
 698                         if (frame_cnt_max != 0 && fcnt >= frame_cnt_max) {
 699                                 sigint = 1;
 700                                 break;
 701                         }
 702 next:
 703                         kernel_may_pull_from_rx(&hdr->tp_h);
 704                         next_slot(&it, &rx_ring);
 705
 706                         if (unlikely(sigint == 1))
 707                                 break;
 708                         if (mode->dump && next_dump) {
 709                                 struct tpacket_stats kstats;
 710                                 socklen_t slen = sizeof(kstats);
 711                                 memset(&kstats, 0, sizeof(kstats));
 712                                 getsockopt(sock, SOL_PACKET, PACKET_STATISTICS,
 713                                            &kstats, &slen);
 714                                 fd = next_multi_pcap_file(mode, fd);
 715                                 next_dump = false;
 716                                 if (mode->print_mode == FNTTYPE_PRINT_NONE) {
 717                                         printf(".(+%u/-%u)", kstats.tp_packets - kstats.tp_drops,
 718                                                kstats.tp_drops);
 719                                         fflush(stdout);
 720                                 }
 721                         }
 722                 }
 723
 724                 poll(&rx_poll, 1, -1);
 725                 poll_error_maybe_die(sock, &rx_poll);
 726         }
 727
 728         if (!(mode->dump_dir && mode->print_mode == FNTTYPE_PRINT_NONE))
 729                 sock_print_net_stats(sock);
 730         else {
 731                 printf("\n\n");
 732                 fflush(stdout);
 733         }
 734         dissector_cleanup_all();
 735         destroy_rx_ring(sock, &rx_ring);
 736         if (mode->promiscuous == true)
 737                 leave_promiscuous_mode(mode->device_in, ifflags);
 738         close(sock);
 739         if (mode->dump) {
 740                 if (mode->dump_dir)
 741                         finish_multi_pcap_file(mode, fd);
 742                 else
 743                         finish_single_pcap_file(mode, fd);
 744         }
 745 }
 746
 747 static void help(void)
 748 {
 749         printf("\n%s %s, the packet sniffing beast\n", PROGNAME_STRING,
 750                VERSION_STRING);
 751         printf("http://www.netsniff-ng.org\n\n");
 752         printf("Usage: netsniff-ng [options]\n");
 753         printf("Options:\n");
 754         printf("  -i|-d|--dev|--in <dev|pcap> Input source as netdev or pcap\n");
 755         printf("  -o|--out <dev|pcap|dir>     Output sink as netdev or pcap or directory\n");
 756         printf("  -f|--filter <bpf-file>      Use BPF filter file from bpfc\n");
 757         printf("  -t|--type <type>            Only handle packets of defined type:\n");
 758         printf("                              host|broadcast|multicast|others|outgoing\n");
 759         printf("  -F|--interval <int>         Dump interval in sec if -o is a directory where\n");
 760         printf("                              pcap files should be stored (default: 60)\n");
 761         printf("  -s|--silent                 Do not print captured packets\n");
 762         printf("  -J|--jumbo-support          Support for 64KB Super Jumbo Frames\n");
 763         printf("                              Default RX/TX slot: 2048Byte\n");
 764         printf("  -n|--num <uint>             Number of packets until exit\n");
 765         printf("  `--     0                   Loop until interrupt (default)\n");
 766         printf("   `-     n                   Send n packets and done\n");
 767         printf("  -r|--rand                   Randomize packet forwarding order\n");
 768         printf("  -M|--no-promisc             No promiscuous mode for netdev\n");
 769         printf("  -m|--mmap                   Mmap pcap file i.e., for replaying\n");
 770         printf("                              Default: scatter/gather I/O\n");
 771         printf("  -c|--clrw                   Instead s/g I/O use slower read/write I/O\n");
 772         printf("  -S|--ring-size <size>       Manually set ring size to <size>:\n");
 773         printf("                              mmap space in KB/MB/GB, e.g. \'10MB\'\n");
 774         printf("  -k|--kernel-pull <int>      Kernel pull from user interval in us\n");
 775         printf("                              Default is 10us where the TX_RING\n");
 776         printf("                              is populated with payload from uspace\n");
 777         printf("  -b|--bind-cpu <cpu>         Bind to specific CPU (or CPU-range)\n");
 778         printf("  -B|--unbind-cpu <cpu>       Forbid to use specific CPU (or CPU-range)\n");
 779         printf("  -H|--prio-high              Make this high priority process\n");
 780         printf("  -Q|--notouch-irq            Do not touch IRQ CPU affinity of NIC\n");
 781         printf("  -q|--less                   Print less-verbose packet information\n");
 782         printf("  -l|--payload                Only print human-readable payload\n");
 783         printf("  -x|--payload-hex            Only print payload in hex format\n");
 784         printf("  -C|--c-style                Print full packet in trafgen/C style hex format\n");
 785         printf("  -X|--all-hex                Print packets in hex format\n");
 786         printf("  -N|--no-payload             Only print packet header\n");
 787         printf("  -v|--version                Show version\n");
 788         printf("  -h|--help                   Guess what?!\n");
 789         printf("\n");
 790         printf("Examples:\n");
 791         printf("  netsniff-ng --in eth0 --out dump.pcap --silent --bind-cpu 0\n");
 792         printf("  netsniff-ng --in dump.pcap --mmap --out eth0 --silent --bind-cpu 0\n");
 793         printf("  netsniff-ng --in any --filter icmp.bpf --all-hex\n");
 794         printf("  netsniff-ng --in eth0 --out eth1 --silent --bind-cpu 0 --type host --filter http.bpf\n");
 795         printf("  netsniff-ng --in any --filter http.bpf --payload\n");
 796         printf("  netsniff-ng --in wlan0 --out /opt/probe1/ --silent --interval 30 --bind-cpu 0 --jumbo-support\n");
 797         printf("\n");
 798         printf("Note:\n");
 799         printf("  This tool is targeted for network developers! You should\n");
 800         printf("  be aware of what you are doing and what these options above\n");
 801         printf("  mean! Use netsniff-ng's bpfc compiler for generating filter files.\n");
 802         printf("  Further, netsniff-ng automatically enables the kernel BPF JIT\n");
 803         printf("  if present.\n");
 804         printf("\n");
 805         printf("Please report bugs to <bugs@netsniff-ng.org>\n");
 806         printf("Copyright (C) 2009-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n");
 807         printf("Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n");
 808         printf("License: GNU GPL version 2\n");
 809         printf("This is free software: you are free to change and redistribute it.\n");
 810         printf("There is NO WARRANTY, to the extent permitted by law.\n\n");
 811         die();
 812 }
 813
 814 static void version(void)
 815 {
 816         printf("\n%s %s, the packet sniffing beast\n", PROGNAME_STRING,
 817                VERSION_STRING);
 818         printf("http://www.netsniff-ng.org\n\n");
 819         printf("Please report bugs to <bugs@netsniff-ng.org>\n");
 820         printf("Copyright (C) 2009-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n");
 821         printf("Copyright (C) 2009-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n");
 822         printf("License: GNU GPL version 2\n");
 823         printf("This is free software: you are free to change and redistribute it.\n");
 824         printf("There is NO WARRANTY, to the extent permitted by law.\n\n");
 825         die();
 826 }
 827
 828 static void header(void)
 829 {
 830         printf("%s%s%s\n", colorize_start(bold), PROGNAME_STRING " "
 831                VERSION_STRING, colorize_end());
 832 }
 833
 834 int main(int argc, char **argv)
 835 {
 836         int c, i, j, opt_index;
 837         char *ptr;
 838         bool prio_high = false;
 839         struct mode mode;
 840         void (*enter_mode)(struct mode *mode) = NULL;
 841
 842         check_for_root_maybe_die();
 843
 844         memset(&mode, 0, sizeof(mode));
 845         mode.link_type = LINKTYPE_EN10MB;
 846         mode.print_mode = FNTTYPE_PRINT_NORM;
 847         mode.cpu = CPU_UNKNOWN;
 848         mode.packet_type = PACKET_ALL;
 849         mode.promiscuous = true;
 850         mode.randomize = false;
 851         mode.pcap = PCAP_OPS_SG;
 852         mode.dump_interval = DUMP_INTERVAL;
 853
 854         while ((c = getopt_long(argc, argv, short_options, long_options,
 855                &opt_index)) != EOF) {
 856                 switch (c) {
 857                 case 'd':
 858                 case 'i':
 859                         mode.device_in = xstrdup(optarg);
 860                         break;
 861                 case 'o':
 862                         mode.device_out = xstrdup(optarg);
 863                         break;
 864                 case 'r':
 865                         mode.randomize = true;
 866                         break;
 867                 case 'J':
 868                         mode.jumbo_support = 1;
 869                         break;
 870                 case 'f':
 871                         mode.filter = xstrdup(optarg);
 872                         break;
 873                 case 'M':
 874                         mode.promiscuous = false;
 875                         break;
 876                 case 't':
 877                         if (!strncmp(optarg, "host", strlen("host")))
 878                                 mode.packet_type = PACKET_HOST;
 879                         else if (!strncmp(optarg, "broadcast", strlen("broadcast")))
 880                                 mode.packet_type = PACKET_BROADCAST;
 881                         else if (!strncmp(optarg, "multicast", strlen("multicast")))
 882                                 mode.packet_type = PACKET_MULTICAST;
 883                         else if (!strncmp(optarg, "others", strlen("others")))
 884                                 mode.packet_type = PACKET_OTHERHOST;
 885                         else if (!strncmp(optarg, "outgoing", strlen("outgoing")))
 886                                 mode.packet_type = PACKET_OUTGOING;
 887                         else
 888                                 mode.packet_type = PACKET_ALL;
 889                         break;
 890                 case 'S':
 891                         ptr = optarg;
 892                         mode.reserve_size = 0;
 893
 894                         for (j = i = strlen(optarg); i > 0; --i) {
 895                                 if (!isdigit(optarg[j - i]))
 896                                         break;
 897                                 ptr++;
 898                         }
 899
 900                         if (!strncmp(ptr, "KB", strlen("KB")))
 901                                 mode.reserve_size = 1 << 10;
 902                         else if (!strncmp(ptr, "MB", strlen("MB")))
 903                                 mode.reserve_size = 1 << 20;
 904                         else if (!strncmp(ptr, "GB", strlen("GB")))
 905                                 mode.reserve_size = 1 << 30;
 906                         else
 907                                 panic("Syntax error in ring size param!\n");
 908
 909                         *ptr = 0;
 910                         mode.reserve_size *= atoi(optarg);
 911                         break;
 912                 case 'b':
 913                         set_cpu_affinity(optarg, 0);
 914                         if (mode.cpu != CPU_NOTOUCH)
 915                                 mode.cpu = atoi(optarg);
 916                         break;
 917                 case 'B':
 918                         set_cpu_affinity(optarg, 1);
 919                         break;
 920                 case 'H':
 921                         prio_high = true;
 922                         break;
 923                 case 'c':
 924                         mode.pcap = PCAP_OPS_RW;
 925                         break;
 926                 case 'm':
 927                         mode.pcap = PCAP_OPS_MMAP;
 928                         break;
 929                 case 'Q':
 930                         mode.cpu = CPU_NOTOUCH;
 931                         break;
 932                 case 's':
 933                         mode.print_mode = FNTTYPE_PRINT_NONE;
 934                         break;
 935                 case 'q':
 936                         mode.print_mode = FNTTYPE_PRINT_LESS;
 937                         break;
 938                 case 'l':
 939                         mode.print_mode = FNTTYPE_PRINT_CHR1;
 940                         break;
 941                 case 'x':
 942                         mode.print_mode = FNTTYPE_PRINT_HEX1;
 943                         break;
 944                 case 'C':
 945                         mode.print_mode = FNTTYPE_PRINT_PAAC;
 946                         break;
 947                 case 'X':
 948                         mode.print_mode = FNTTYPE_PRINT_HEX2;
 949                         break;
 950                 case 'N':
 951                         mode.print_mode = FNTTYPE_PRINT_NOPA;
 952                         break;
 953                 case 'k':
 954                         mode.kpull = (unsigned long) atol(optarg);
 955                         break;
 956                 case 'n':
 957                         frame_cnt_max = (unsigned long) atol(optarg);
 958                         break;
 959                 case 'F':
 960                         mode.dump_interval = (unsigned long) atol(optarg);
 961                         break;
 962                 case 'v':
 963                         version();
 964                         break;
 965                 case 'h':
 966                         help();
 967                         break;
 968                 case '?':
 969                         switch (optopt) {
 970                         case 'd':
 971                         case 'i':
 972                         case 'o':
 973                         case 'f':
 974                         case 't':
 975                         case 'F':
 976                         case 'n':
 977                         case 'S':
 978                         case 'b':
 979                         case 'k':
 980                         case 'B':
 981                         case 'e':
 982                                 panic("Option -%c requires an argument!\n",
 983                                       optopt);
 984                         default:
 985                                 if (isprint(optopt))
 986                                         whine("Unknown option character "
 987                                               "`0x%X\'!\n", optopt);
 988                                 die();
 989                         }
 990                 default:
 991                         break;
 992                 }
 993         }
 994
 995         if (!mode.device_in)
 996                 mode.device_in = xstrdup("any");
 997
 998         register_signal(SIGINT, signal_handler);
 999         register_signal(SIGHUP, signal_handler);
1000
1001         init_pcap(mode.jumbo_support);
1002         tprintf_init();
1003         header();
1004
1005         if (prio_high == true) {
1006                 set_proc_prio(get_default_proc_prio());
1007                 set_sched_status(get_default_sched_policy(),
1008                                  get_default_sched_prio());
1009         }
1010
1011         if (mode.device_in && (device_mtu(mode.device_in) ||
1012             !strncmp("any", mode.device_in, strlen(mode.device_in)))) {
1013                 if (!mode.device_out) {
1014                         mode.dump = 0;
1015                         enter_mode = enter_mode_rx_only_or_dump;
1016                 } else if (device_mtu(mode.device_out)) {
1017                         register_signal_f(SIGALRM, timer_elapsed, SA_SIGINFO);
1018                         enter_mode = enter_mode_rx_to_tx;
1019                 } else {
1020                         mode.dump = 1;
1021                         register_signal_f(SIGALRM, timer_next_dump, SA_SIGINFO);
1022                         enter_mode = enter_mode_rx_only_or_dump;
1023                 }
1024         } else {
1025                 if (mode.device_out && device_mtu(mode.device_out)) {
1026                         register_signal_f(SIGALRM, timer_elapsed, SA_SIGINFO);
1027                         enter_mode = enter_mode_pcap_to_tx;
1028                 } else {
1029                         enter_mode = enter_mode_read_pcap;
1030                 }
1031         }
1032
1033         if (!enter_mode)
1034                 panic("Selection not supported!\n");
1035         enter_mode(&mode);
1036
1037         tprintf_cleanup();
1038         cleanup_pcap();
1039
1040         if (mode.device_in)
1041                 xfree(mode.device_in);
1042         if (mode.device_out)
1043                 xfree(mode.device_out);
1044         return 0;
1045 }
1046