Commit 387ec4672be35c938898683f910a18b5d38b9738

Dustin Sallings
Thu Apr 16 15:39:46 GMT 2009

Tree SHA1: 787a8dc
Parent SHA1: d91114c (Clear shouldCleanup when cleaning up)
raw diff | raw patch

Reformatted code.

Diff rendering mode:
inline
side by side


50	50	#ifdef MYMALLOC
51	51	_mdebug_dump();
52	52	#endif /* MYMALLOC */
53		exit(0);
	53	exit(0);
54	54	}
55	55
56	56	static void
57	57	setupSignals(int refreshTime)
58	58	{
59		sigset_t sigBlockSet;
60		struct sigaction saShutdown, saCleanup, saExpunge;
61		struct itimerval ival;
	59	sigset_t sigBlockSet;
	60	struct sigaction saShutdown, saCleanup, saExpunge;
	61	struct itimerval ival;
62	62
63		sigemptyset(&sigBlockSet);
64		sigaddset(&sigBlockSet, SIGHUP);
65		if(sigprocmask(SIG_BLOCK, &sigBlockSet, NULL) < 0) {
66		perror("sigprocmask");
67		exit(1);
68		}
	63	sigemptyset(&sigBlockSet);
	64	sigaddset(&sigBlockSet, SIGHUP);
	65	if(sigprocmask(SIG_BLOCK, &sigBlockSet, NULL) < 0) {
	66	perror("sigprocmask");
	67	exit(1);
	68	}
69	69
70		saShutdown.sa_handler=signalShutdown;
71		saShutdown.sa_flags=0;
72		sigemptyset(&saShutdown.sa_mask);
	70	saShutdown.sa_handler=signalShutdown;
	71	saShutdown.sa_flags=0;
	72	sigemptyset(&saShutdown.sa_mask);
73	73
74		if(sigaction(SIGINT, &saShutdown, NULL) < 0) {
75		perror("sigaction(INT)");
76		exit(1);
77		}
78		if(sigaction(SIGTERM, &saShutdown, NULL) < 0) {
79		perror("sigaction(TERM)");
80		exit(1);
81		}
	74	if(sigaction(SIGINT, &saShutdown, NULL) < 0) {
	75	perror("sigaction(INT)");
	76	exit(1);
	77	}
	78	if(sigaction(SIGTERM, &saShutdown, NULL) < 0) {
	79	perror("sigaction(TERM)");
	80	exit(1);
	81	}
82	82
83		saCleanup.sa_handler=signalCleanup;
84		saCleanup.sa_flags=0;
85		sigemptyset(&saCleanup.sa_mask);
	83	saCleanup.sa_handler=signalCleanup;
	84	saCleanup.sa_flags=0;
	85	sigemptyset(&saCleanup.sa_mask);
86	86
87		if(sigaction(SIGALRM,&saCleanup, NULL) < 0) {
88		perror("sigaction(QUIT)");
89		exit(1);
90		}
	87	if(sigaction(SIGALRM,&saCleanup, NULL) < 0) {
	88	perror("sigaction(QUIT)");
	89	exit(1);
	90	}
91	91
92		saExpunge.sa_handler=signalExpunge;
93		saExpunge.sa_flags=0;
94		sigemptyset(&saExpunge.sa_mask);
	92	saExpunge.sa_handler=signalExpunge;
	93	saExpunge.sa_flags=0;
	94	sigemptyset(&saExpunge.sa_mask);
95	95
96		if(sigaction(SIGQUIT, &saExpunge, NULL) < 0) {
97		perror("sigaction(QUIT)");
98		exit(1);
99		}
	96	if(sigaction(SIGQUIT, &saExpunge, NULL) < 0) {
	97	perror("sigaction(QUIT)");
	98	exit(1);
	99	}
100	100
101		ival.it_interval.tv_usec=0;
102		ival.it_value.tv_usec=0;
103		ival.it_interval.tv_sec=refreshTime;
104		ival.it_value.tv_sec=refreshTime;
105		if(setitimer(ITIMER_REAL, &ival, NULL) < 0) {
106		perror("setitimer");
107		exit(1);
108		}
	101	ival.it_interval.tv_usec=0;
	102	ival.it_value.tv_usec=0;
	103	ival.it_interval.tv_sec=refreshTime;
	104	ival.it_value.tv_sec=refreshTime;
	105	if(setitimer(ITIMER_REAL, &ival, NULL) < 0) {
	106	perror("setitimer");
	107	exit(1);
	108	}
109	109	}
110	110
111	111	static void
112	112	openMisc()
113		{
114		char misc_filename[FILENAME_MAXLEN];
115		time_t now=0;
	113	{
	114	char misc_filename[FILENAME_MAXLEN];
	115	time_t now=0;
116	116
117		now=time(NULL);
118		if(strftime(misc_filename, sizeof(misc_filename),
119		"%Y%m%d-%H%M%S_misc.pcap", localtime(&now)) >= sizeof(misc_filename)) {
120		fprintf(stderr,
121		"Warning: not enough space for full filename, using %s\n",
122		misc_filename);
123		}
	117	now=time(NULL);
	118	if(strftime(misc_filename, sizeof(misc_filename),
	119	"%Y%m%d-%H%M%S_misc.pcap", localtime(&now)) >= sizeof(misc_filename)) {
	120	fprintf(stderr,
	121	"Warning: not enough space for full filename, using %s\n",
	122	misc_filename);
	123	}
124	124
125		assert(misc_packets == NULL);
126		misc_packets=pcap_dump_open(pcap_socket, misc_filename);
	125	assert(misc_packets == NULL);
	126	misc_packets=pcap_dump_open(pcap_socket, misc_filename);
127	127
128		if(misc_packets == NULL) {
129		fprintf(stderr, "Error opening dump file %s: %s\n",
130		misc_filename, pcap_geterr(pcap_socket));
131		exit(1);
132		} else {
133		printf("+ Created %s\n", misc_filename);
134		}
	128	if(misc_packets == NULL) {
	129	fprintf(stderr, "Error opening dump file %s: %s\n",
	130	misc_filename, pcap_geterr(pcap_socket));
	131	exit(1);
	132	} else {
	133	printf("+ Created %s\n", misc_filename);
	134	}
135	135	}
136	136
137	137	static void
138	138	expunge()
139	139	{
140		printf("# Cleaning up open pcap files\n");
141		hash_destroy(hash);
142		hash=hash_init(HASH_SIZE);
143		if(misc_packets != NULL) {
144		printf("# Closing misc_packets\n");
145		pcap_dump_close(misc_packets);
146		misc_packets=NULL;
147		}
148		shouldExpunge=0;
	140	printf("# Cleaning up open pcap files\n");
	141	hash_destroy(hash);
	142	hash=hash_init(HASH_SIZE);
	143	if(misc_packets != NULL) {
	144	printf("# Closing misc_packets\n");
	145	pcap_dump_close(misc_packets);
	146	misc_packets=NULL;
	147	}
	148	shouldExpunge=0;
149	149	}
150	150
151	151	void
152	152	process(int flags, const char *intf, struct cleanupConfig conf,
153		const char outdir, char filter)
	153	const char outdir, char filter)
154	154	{
155		char errbuf[PCAP_ERRBUF_SIZE];
156		struct bpf_program prog;
157		bpf_u_int32 netmask=0;
158		int flagdef;
	155	char errbuf[PCAP_ERRBUF_SIZE];
	156	struct bpf_program prog;
	157	bpf_u_int32 netmask=0;
	158	int flagdef;
159	159
160		setupSignals(conf.refreshTime);
	160	setupSignals(conf.refreshTime);
161	161
162		if (flags & FLAG_BIT(FLAG_PROMISC)) {
163		flagdef = 1;
164		} else {
165		flagdef = 0;
166		}
	162	if (flags & FLAG_BIT(FLAG_PROMISC)) {
	163	flagdef = 1;
	164	} else {
	165	flagdef = 0;
	166	}
167	167
168	168	if (intf[0] == '/') {
169	169	pcap_socket = pcap_open_offline(intf, errbuf);
…	…
171	171	pcap_socket = pcap_open_live(intf, 65535, flagdef, 1000, errbuf);
172	172	}
173	173
174		if (pcap_socket == NULL) {
175		fprintf(stderr, "pcap_open_live: %s\n", errbuf);
176		exit(-1);
177		}
178		switch (pcap_datalink(pcap_socket)) {
179		case DLT_EN10MB:
180		dlt_len = 14;
181		break;
182		case DLT_SLIP:
183		dlt_len = 16;
184		break;
185		case DLT_PPP:
186		dlt_len = 4;
187		break;
188		case DLT_FDDI:
189		fprintf(stderr, "Sorry, can't do FDDI\n");
190		exit(1);
191		break;
192		default:
193		dlt_len = 4;
194		}
	174	if (pcap_socket == NULL) {
	175	fprintf(stderr, "pcap_open_live: %s\n", errbuf);
	176	exit(-1);
	177	}
	178	switch (pcap_datalink(pcap_socket)) {
	179	case DLT_EN10MB:
	180	dlt_len = 14;
	181	break;
	182	case DLT_SLIP:
	183	dlt_len = 16;
	184	break;
	185	case DLT_PPP:
	186	dlt_len = 4;
	187	break;
	188	case DLT_FDDI:
	189	fprintf(stderr, "Sorry, can't do FDDI\n");
	190	exit(1);
	191	break;
	192	default:
	193	dlt_len = 4;
	194	}
195	195
196		if (pcap_compile(pcap_socket, &prog, filter, 1, netmask) < 0) {
197		fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(pcap_socket));
198		exit(1);
199		}
200		if (pcap_setfilter(pcap_socket, &prog) < 0) {
201		fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(pcap_socket));
202		exit(1);
203		}
	196	if (pcap_compile(pcap_socket, &prog, filter, 1, netmask) < 0) {
	197	fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(pcap_socket));
	198	exit(1);
	199	}
	200	if (pcap_setfilter(pcap_socket, &prog) < 0) {
	201	fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(pcap_socket));
	202	exit(1);
	203	}
204	204
205		hash=hash_init(HASH_SIZE);
	205	hash=hash_init(HASH_SIZE);
206	206
207		fprintf(stderr,
208		"interface: %s, filter: ``%s'', %spromiscuous\n",
209		intf, filter, (flags & FLAG_BIT(FLAG_PROMISC)) ? "" : "NOT ");
210		fflush(stderr);
	207	fprintf(stderr,
	208	"interface: %s, filter: ``%s'', %spromiscuous\n",
	209	intf, filter, (flags & FLAG_BIT(FLAG_PROMISC)) ? "" : "NOT ");
	210	fflush(stderr);
211	211
212		if(chdir(outdir) < 0) {
213		perror("chdir");
214		exit(1);
215		}
	212	if(chdir(outdir) < 0) {
	213	perror("chdir");
	214	exit(1);
	215	}
216	216
217		while (!shuttingDown) {
218		int r = pcap_dispatch(pcap_socket, -1, (pcap_handler)filter_packet, NULL);
	217	while (!shuttingDown) {
	218	int r = pcap_dispatch(pcap_socket, -1, (pcap_handler)filter_packet, NULL);
219	219	if (r < 1) {
220	220	shuttingDown = 1;
221	221	}
222		if(shouldExpunge) {
223		expunge();
224		}
225		if(shouldCleanup) {
226		cleanup(flags & FLAG_BIT(FLAG_FLUSH), conf.maxAge);
227		}
228		}
	222	if(shouldExpunge) {
	223	expunge();
	224	}
	225	if(shouldCleanup) {
	226	cleanup(flags & FLAG_BIT(FLAG_FLUSH), conf.maxAge);
	227	}
	228	}
229	229
230		exitCleanup();
	230	exitCleanup();
231	231	}
232	232
233	233	static void
234	234	cleanup(int shouldFlush, int maxAge)
235	235	{
236		static unsigned int last_pcount=0, last_dropcount=0, relative_counts=0;
237		struct pcap_stat stats;
238		struct hash_container *p;
239		int i=0, watched=0, cleaned=0, maxDepth=0, empty=0;
240		struct timeval now;
	236	static unsigned int last_pcount=0, last_dropcount=0, relative_counts=0;
	237	struct pcap_stat stats;
	238	struct hash_container *p;
	239	int i=0, watched=0, cleaned=0, maxDepth=0, empty=0;
	240	struct timeval now;
241	241
242	242	shouldCleanup = 0;
243	243
244		if(gettimeofday(&now, NULL) < 0) {
245		perror("gettimeofday");
246		exit(1);
247		}
	244	if(gettimeofday(&now, NULL) < 0) {
	245	perror("gettimeofday");
	246	exit(1);
	247	}
248	248
249		/* Look for anything old enough to get cleaned up */
250		for(i=0; i<hash->hashsize; i++) {
251		p=hash->buckets[i];
252		if(p) {
253		int ci=0, depth=0;
254		int toClose[1024];
255		int closeOffset=0;
	249	/* Look for anything old enough to get cleaned up */
	250	for(i=0; i<hash->hashsize; i++) {
	251	p=hash->buckets[i];
	252	if(p) {
	253	int ci=0, depth=0;
	254	int toClose[1024];
	255	int closeOffset=0;
256	256
257		for(; p; p=p->next) {
258		depth++;
259		maxDepth=depth > maxDepth ? depth : maxDepth;
260		#ifdef HAVE_PCAP_DUMP_FLUSH
261		if(shouldFlush) {
262		pcap_dump_flush(p->pcap_dumper);
263		}
264		#endif
265		watched++;
266		if(p->last_addition.tv_sec + maxAge < now.tv_sec) {
267		toClose[closeOffset++]=p->key;
268		assert(closeOffset < sizeof(toClose));
269		}
270		}
	257	for(; p; p=p->next) {
	258	depth++;
	259	maxDepth=depth > maxDepth ? depth : maxDepth;
	260	#ifdef HAVE_PCAP_DUMP_FLUSH
	261	if(shouldFlush) {
	262	pcap_dump_flush(p->pcap_dumper);
	263	}
	264	#endif
	265	watched++;
	266	if(p->last_addition.tv_sec + maxAge < now.tv_sec) {
	267	toClose[closeOffset++]=p->key;
	268	assert(closeOffset < sizeof(toClose));
	269	}
	270	}
271	271
272		for(ci=0; ci<closeOffset; ci++) {
273		p=hash_find(hash, toClose[ci]);
274		assert(p != NULL);
275		printf("- Closing %s (too old)\n", p->filename);
276		p=NULL; /* Can't use this anymore */
277		hash_delete(hash, toClose[ci]);
278		cleaned++;
279		}
280		} else {
281		empty++;
282		}
283		}
	272	for(ci=0; ci<closeOffset; ci++) {
	273	p=hash_find(hash, toClose[ci]);
	274	assert(p != NULL);
	275	printf("- Closing %s (too old)\n", p->filename);
	276	p=NULL; /* Can't use this anymore */
	277	hash_delete(hash, toClose[ci]);
	278	cleaned++;
	279	}
	280	} else {
	281	empty++;
	282	}
	283	}
284	284
285		#ifdef HAVE_PCAP_DUMP_FLUSH
286		if(shouldFlush && misc_packets != NULL) {
287		pcap_dump_flush(misc_packets);
288		}
289		#endif
	285	#ifdef HAVE_PCAP_DUMP_FLUSH
	286	if(shouldFlush && misc_packets != NULL) {
	287	pcap_dump_flush(misc_packets);
	288	}
	289	#endif
290	290
291		if (pcap_stats(pcap_socket, &stats) == 0) {
292		int processed=stats.ps_recv-last_pcount;
293		int dropped=stats.ps_drop-last_dropcount;
294		if(relative_counts == 0 && (processed < 0 \|\| dropped < 0)) {
295		printf("! pcap bug, counts went negative. Compensating\n");
296		relative_counts=1;
297		}
298		if(relative_counts) {
299		processed=stats.ps_recv;
300		dropped=stats.ps_drop;
301		}
302		printf("# Processed %d pkts, dropped %d, watched %d, cleaned %d,"
303		" max depth %d, empty %d\n",
304		processed, dropped, watched, cleaned, maxDepth, empty);
305		last_pcount=stats.ps_recv;
306		last_dropcount=stats.ps_drop;
307		} else {
308		printf("# Error getting pcap statistics: %s. watched=%d, cleaned=%d\n",
309		pcap_geterr(pcap_socket), watched, cleaned);
310		}
	291	if (pcap_stats(pcap_socket, &stats) == 0) {
	292	int processed=stats.ps_recv-last_pcount;
	293	int dropped=stats.ps_drop-last_dropcount;
	294	if(relative_counts == 0 && (processed < 0 \|\| dropped < 0)) {
	295	printf("! pcap bug, counts went negative. Compensating\n");
	296	relative_counts=1;
	297	}
	298	if(relative_counts) {
	299	processed=stats.ps_recv;
	300	dropped=stats.ps_drop;
	301	}
	302	printf("# Processed %d pkts, dropped %d, watched %d, cleaned %d,"
	303	" max depth %d, empty %d\n",
	304	processed, dropped, watched, cleaned, maxDepth, empty);
	305	last_pcount=stats.ps_recv;
	306	last_dropcount=stats.ps_drop;
	307	} else {
	308	printf("# Error getting pcap statistics: %s. watched=%d, cleaned=%d\n",
	309	pcap_geterr(pcap_socket), watched, cleaned);
	310	}
311	311	}
312	312
313	313	/* this is the function that's called when pcap reads a packet */
…	…
317	317	#define IP_SIZE 20
318	318	#define TCP_SIZE 20
319	319
320		struct ip *ip;
321		struct ether_header *eth;
	320	struct ip *ip;
	321	struct ether_header *eth;
322	322
323		eth=(struct ether_header *)packet;
	323	eth=(struct ether_header *)packet;
324	324
325		if(ntohs(eth->ether_type) == ETHERTYPE_IP) {
326		/* p->len should never be smaller than the smallest possible packet */
327		if (p->len < (dlt_len + IP_SIZE + TCP_SIZE)) {
328		fprintf(stderr, "! Skipping packet that's too small.\n");
329		return;
330		}
	325	if(ntohs(eth->ether_type) == ETHERTYPE_IP) {
	326	/* p->len should never be smaller than the smallest possible packet */
	327	if (p->len < (dlt_len + IP_SIZE + TCP_SIZE)) {
	328	fprintf(stderr, "! Skipping packet that's too small.\n");
	329	return;
	330	}
331	331
332		/* cast an ip pointer */
333		ip = (struct ip *) (packet + dlt_len);
	332	/* cast an ip pointer */
	333	ip = (struct ip *) (packet + dlt_len);
334	334
335		hash_add(hash, pcap_socket, ntohl(ip->ip_src.s_addr), p, packet);
336		hash_add(hash, pcap_socket, ntohl(ip->ip_dst.s_addr), p, packet);
337		} else {
338		/*
339		printf("! Non-IP packet received (ether type 0x%x)\n",
340		ntohs(eth->ether_type));
341		*/
342		if(misc_packets == NULL) {
343		openMisc();
344		}
345		pcap_dump((u_char *)misc_packets, p, packet);
346		}
	335	hash_add(hash, pcap_socket, ntohl(ip->ip_src.s_addr), p, packet);
	336	hash_add(hash, pcap_socket, ntohl(ip->ip_dst.s_addr), p, packet);
	337	} else {
	338	/*
	339	printf("! Non-IP packet received (ether type 0x%x)\n",
	340	ntohs(eth->ether_type));
	341	*/
	342	if(misc_packets == NULL) {
	343	openMisc();
	344	}
	345	pcap_dump((u_char *)misc_packets, p, packet);
	346	}
347	347	}
348	348
349	349	char *
350	350	ntoa(int a)
351	351	{
352		static char ret[40];
353		int written=0;
	352	static char ret[40];
	353	int written=0;
354	354
355		written=snprintf(ret, sizeof(ret)-1, "%d.%d.%d.%d",
356		((a & 0xff000000) >> 24), ((a & 0x00ff0000) >> 16),
357		((a & 0x0000ff00) >> 8), (a & 0x000000ff));
	355	written=snprintf(ret, sizeof(ret)-1, "%d.%d.%d.%d",
	356	((a & 0xff000000) >> 24), ((a & 0x00ff0000) >> 16),
	357	((a & 0x0000ff00) >> 8), (a & 0x000000ff));
358	358
359		assert(written < sizeof(ret));
	359	assert(written < sizeof(ret));
360	360
361		return(ret);
	361	return(ret);
362	362	}
363	363
364	364	/* shut down in a controlled way, close log file, close socket, and exit */
365	365	static void
366	366	signalShutdown(int s)
367	367	{
368		shuttingDown=1;
	368	shuttingDown=1;
369	369	}
370	370
371	371	static void
372	372	signalExpunge(int s)
373	373	{
374		shouldExpunge=1;
	374	shouldExpunge=1;
375	375	}
376	376
377	377	static void
378	378	signalCleanup(int s)
379	379	{
380		shouldCleanup=1;
	380	shouldCleanup=1;
381	381	}


23	23	assert(size > 0);
24	24
25	25	hash = calloc(1, sizeof(struct hashtable)
26		+ (size * sizeof(struct hash_container *)));
	26	+ (size * sizeof(struct hash_container *)));
27	27	assert(hash);
28	28
29	29	hash->hashsize = size;
…	…
50	50	c->filename=calloc(1, FILENAME_MAXLEN);
51	51	strftime(time_buf, sizeof(time_buf), "%Y%m%d-%H%M%S", localtime(&now));
52	52	if(snprintf(c->filename, FILENAME_MAXLEN, "%s_%s.pcap",
53		time_buf, ntoa(key)) >= FILENAME_MAXLEN) {
	53	time_buf, ntoa(key)) >= FILENAME_MAXLEN) {
54	54	fprintf(stderr,
55		"Warning: Not enough space for full filename, using %s\n",
56		c->filename);
	55	"Warning: Not enough space for full filename, using %s\n",
	56	c->filename);
57	57	}
58	58	assert(strlen(c->filename) < FILENAME_MAXLEN);
59	59
60	60	c->pcap_dumper = pcap_dump_open(pcap_thing, c->filename);
61	61	if(c->pcap_dumper == NULL) {
62	62	fprintf(stderr, "Error opening dump file %s: %s\n", c->filename,
63		pcap_geterr(pcap_thing));
	63	pcap_geterr(pcap_thing));
64	64	exit(1);
65	65	}
66	66	if(gettimeofday(&c->last_addition, NULL) < 0) {
…	…
79	79	}
80	80
81	81	struct hash_container hash_add(struct hashtable hash, pcap_t *pcap_thing,
82		unsigned int key, struct pcap_pkthdr h, u_char sp)
	82	unsigned int key, struct pcap_pkthdr h, u_char sp)
83	83	{
84	84	struct hash_container *c;
85	85
…	…
179	179	list.entries= (int ) malloc(size sizeof(int));
180	180	assert(list.entries);
181	181
182		#define LAPPEND(a) if(list.nentries == size-1) { \
	182	#define LAPPEND(a) if(list.nentries == size-1) { \
183	183	list.entries=realloc(list.entries, (size<<=1)*sizeof(int)); \
184		assert(list.entries); \
185		} \
	184	assert(list.entries); \
	185	} \
186	186	list.entries[list.nentries++]=a;
187	187
188		for (i = 0; i < hash->hashsize; i++) {
189		p = hash->buckets[i];
190		if (p) {
191		for (; p; p = p->next) {
192		LAPPEND(p->key);
193		}
194		}
195		}
196		return (list);
	188	for (i = 0; i < hash->hashsize; i++) {
	189	p = hash->buckets[i];
	190	if (p) {
	191	for (; p; p = p->next) {
	192	LAPPEND(p->key);
	193	}
	194	}
	195	}
	196	return (list);
197	197	}
198	198
199	199	/* debug stuff, dump the hash */
200	200	void
201	201	_hash_dump(struct hashtable *hash)
202	202	{
203		struct hash_container *p;
204		int i;
	203	struct hash_container *p;
	204	int i;
205	205
206		printf("Hash dump for hash at %p, size is %d:\n", hash, hash->hashsize);
	206	printf("Hash dump for hash at %p, size is %d:\n", hash, hash->hashsize);
207	207
208		for (i = 0; i < hash->hashsize; i++) {
209		p = hash->buckets[i];
210		if (p) {
211		printf("\tMatches at %d\n", i);
212		for (; p; p = p->next) {
	208	for (i = 0; i < hash->hashsize; i++) {
	209	p = hash->buckets[i];
	210	if (p) {
	211	printf("\tMatches at %d\n", i);
	212	for (; p; p = p->next) {
213	213	#ifdef MYMALLOC
214		if (_lookup_mem(p) == NULL) {
215		printf("MEMORY IS INVALID!!! (%p)\n", p);
216		_mdebug_dump();
217		}
	214	if (_lookup_mem(p) == NULL) {
	215	printf("MEMORY IS INVALID!!! (%p)\n", p);
	216	_mdebug_dump();
	217	}
218	218	#endif
219		printf("\t\t%s -> d=%p\n", ntoa(p->key), p->pcap_dumper);
220		}
221		}
222		}
	219	printf("\t\t%s -> d=%p\n", ntoa(p->key), p->pcap_dumper);
	220	}
	221	}
	222	}
223	223	}


11	11	#include <pcap.h>
12	12
13	13	struct hash_container {
14		unsigned int key;
15		char *filename;
16		struct timeval last_addition;
17		pcap_dumper_t *pcap_dumper;
18		struct hash_container *next;
	14	unsigned int key;
	15	char *filename;
	16	struct timeval last_addition;
	17	pcap_dumper_t *pcap_dumper;
	18	struct hash_container *next;
19	19	};
20	20
21	21	struct hash_keylist {
22		int nentries;
23		int *entries;
	22	int nentries;
	23	int *entries;
24	24	};
25	25
26	26	struct hashtable {
27		int hashsize;
28		struct hash_container *buckets[0];
	27	int hashsize;
	28	struct hash_container *buckets[0];
29	29	};
30	30
31	31	struct hashtable *hash_init(int size);
32	32	struct hash_container hash_store(struct hashtable hash,
33		pcap_t *pcap_thing, unsigned int key);
	33	pcap_t *pcap_thing, unsigned int key);
34	34	struct hash_container hash_add(struct hashtable hash, pcap_t *pcap_thing,
35		unsigned int key, struct pcap_pkthdr h, u_char sp);
	35	unsigned int key, struct pcap_pkthdr h, u_char sp);
36	36	struct hash_container hash_find(struct hashtable hash, unsigned int key);
37	37	void hash_delete(struct hashtable *hash, unsigned int key);
38	38	void hash_destroy(struct hashtable *hash);


9	9	#include <ctype.h>
10	10	#include <assert.h>
11	11	/*
12		#include <getopt.h>
	12	#include <getopt.h>
13	13	*/
14	14	#include "mymalloc.h"
15	15	#include "multisniff.h"
…	…
18	18	usage(char *name)
19	19	{
20	20	fprintf(stderr, "Usage: %s -i <intf> "
21		#ifdef HAVE_PCAP_DUMP_FLUSH
22		"[-f] "
23		#endif
24		"[-p] [-d <outdir>] "
25		"[-m seconds] [-c seconds] [-F <filterfile>] [<filter>]\n",
26		name);
	21	#ifdef HAVE_PCAP_DUMP_FLUSH
	22	"[-f] "
	23	#endif
	24	"[-p] [-d <outdir>] "
	25	"[-m seconds] [-c seconds] [-F <filterfile>] [<filter>]\n",
	26	name);
27	27	fprintf(stderr, " -i specifies the interface to sniff (required).\n");
28	28	fprintf(stderr, " -d specifies the output directory.\n");
29		#ifdef HAVE_PCAP_DUMP_FLUSH
30		fprintf(stderr, " -F get a filter from a file.\n");
31		#endif
	29	#ifdef HAVE_PCAP_DUMP_FLUSH
	30	fprintf(stderr, " -F get a filter from a file.\n");
	31	#endif
32	32	fprintf(stderr, " -f flush pcap files on each cleanup run.\n");
33	33	fprintf(stderr, " -p turns on promiscious sniffing.\n");
34	34	fprintf(stderr, " -m maximum age before closing file [60s].\n");
…	…
112	112	}
113	113	}
114	114
115		if (optind >= argc) {
116		if(filter == NULL) {
117		filter = "";
118		}
119		} else {
120		int i=0;
121		int size=0;
122		for(i=optind; i<argc; i++) {
123		size+=strlen(argv[i]);
124		size+=1;
125		}
126		size+=1;
127		filter=calloc(1, size);
128		assert(filter);
129		for(i=optind; i<argc; i++) {
130		strcat(filter, argv[i]);
131		strcat(filter, " ");
132		assert(strlen(filter) < size);
133		}
134		/* Trim the trailing space */
135		assert(filter[strlen(filter)-1] == ' ');
136		filter[strlen(filter)-1]=0x00;
137		}
	115	if (optind >= argc) {
	116	if(filter == NULL) {
	117	filter = "";
	118	}
	119	} else {
	120	int i=0;
	121	int size=0;
	122	for(i=optind; i<argc; i++) {
	123	size+=strlen(argv[i]);
	124	size+=1;
	125	}
	126	size+=1;
	127	filter=calloc(1, size);
	128	assert(filter);
	129	for(i=optind; i<argc; i++) {
	130	strcat(filter, argv[i]);
	131	strcat(filter, " ");
	132	assert(strlen(filter) < size);
	133	}
	134	/* Trim the trailing space */
	135	assert(filter[strlen(filter)-1] == ' ');
	136	filter[strlen(filter)-1]=0x00;
	137	}
138	138
139		if (intf == NULL) {
140		fprintf(stderr, "Must supply an interface\n");
141		usage(argv[0]);
142		}
143		process(flags, intf, conf, outdir, filter);
144		return (0);
	139	if (intf == NULL) {
	140	fprintf(stderr, "Must supply an interface\n");
	141	usage(argv[0]);
	142	}
	143	process(flags, intf, conf, outdir, filter);
	144	return (0);
145	145	}


5	5	#ifndef MULTISNIFF_H
6	6	#define MULTISNIFF_H 1
7	7
8		#define FLAG_BIT(a) (1<<a)
	8	#define FLAG_BIT(a) (1<<a)
9	9	#define FLAG_PROMISC 0
10	10	#define FLAG_FLUSH 1
11	11
…	…
19	19	#define HASH_SIZE 637
20	20
21	21	struct cleanupConfig {
22		int maxAge;
23		int refreshTime;
	22	int maxAge;
	23	int refreshTime;
24	24	};
25	25
26	26	void process(int flags, const char *intf,
27		struct cleanupConfig conf, const char outdir, char filter);
	27	struct cleanupConfig conf, const char outdir, char filter);
28	28	char *ntoa(int);
29	29
30	30	/* This stuff was basically stolen from tcpdump */
31	31	#define ETHER_ADDR_LEN 6
32	32	struct ether_header {
33		u_int8_t ether_dhost[ETHER_ADDR_LEN];
34		u_int8_t ether_shost[ETHER_ADDR_LEN];
35		u_int16_t ether_type;
	33	u_int8_t ether_dhost[ETHER_ADDR_LEN];
	34	u_int8_t ether_shost[ETHER_ADDR_LEN];
	35	u_int16_t ether_type;
36	36	};
37	37
38	38	/* We primarily care about IP. Everything else goes into a common bucket */


15	15
16	16	#ifdef MYMALLOC
17	17	static struct memories {
18		char *p;
19		size_t size;
20		struct memories *next;
21		char *file;
22		int line;
	18	char *p;
	19	size_t size;
	20	struct memories *next;
	21	char *file;
	22	int line;
23	23	} **memories = NULL;
24	24
25	25	static int *_mem_stats = NULL;
26	26
27	27	void _mdebug_dump(void);
28	28
29		static int
	29	static int
30	30	_getmemindex(void *p)
31	31	{
32		return ((int) p % NUM_MEMBUCKETS);
	32	return ((int) p % NUM_MEMBUCKETS);
33	33	}
34	34
35		static void
	35	static void
36	36	_register_mem(void p, size_t size, char file, int line)
37	37	{
38		struct memories m, c;
39		int index;
	38	struct memories m, c;
	39	int index;
40	40
41		assert(p);
42		m = malloc(sizeof(struct memories));
43		assert(m);
44		m->p = p;
45		m->size = size;
46		m->next = NULL;
47		m->file = file;
48		m->line = line;
	41	assert(p);
	42	m = malloc(sizeof(struct memories));
	43	assert(m);
	44	m->p = p;
	45	m->size = size;
	46	m->next = NULL;
	47	m->file = file;
	48	m->line = line;
49	49
50		if (memories == NULL) {
51		memories = calloc(NUM_MEMBUCKETS, sizeof(struct memories *));
52		assert(memories);
53		_mem_stats = calloc(NUM_MEMBUCKETS, sizeof(int));
54		assert(_mem_stats);
55		}
56		index = _getmemindex(p);
	50	if (memories == NULL) {
	51	memories = calloc(NUM_MEMBUCKETS, sizeof(struct memories *));
	52	assert(memories);
	53	_mem_stats = calloc(NUM_MEMBUCKETS, sizeof(int));
	54	assert(_mem_stats);
	55	}
	56	index = _getmemindex(p);
57	57
58		/* Gather statistics */
59		_mem_stats[index]++;
	58	/* Gather statistics */
	59	_mem_stats[index]++;
60	60
61		c = memories[index];
	61	c = memories[index];
62	62
63		if (c == NULL) {
64		memories[index] = m;
65		} else {
66		for (; c->next != NULL; c = c->next);
67		c->next = m;
68		}
	63	if (c == NULL) {
	64	memories[index] = m;
	65	} else {
	66	for (; c->next != NULL; c = c->next);
	67	c->next = m;
	68	}
69	69	}
70	70
71	71	void *
72	72	_lookup_mem(void *p)
73	73	{
74		struct memories *c;
75		int index;
76		index = _getmemindex(p);
77		for (c = memories[index]; c && c->p != p; c = c->next);
78		return (c);
	74	struct memories *c;
	75	int index;
	76	index = _getmemindex(p);
	77	for (c = memories[index]; c && c->p != p; c = c->next);
	78	return (c);
79	79	}
80	80
81		static void
	81	static void
82	82	_unregister_mem(void *p)
83	83	{
84		struct memories c, tmp;
85		int index;
	84	struct memories c, tmp;
	85	int index;
86	86
87		index = _getmemindex(p);
	87	index = _getmemindex(p);
88	88
89		/* Special case for first thingy */
90		if (memories[index]->p == p) {
91		if (memories[index]->next) {
92		tmp = memories[index]->next;
93		free(memories[index]);
94		memories[index] = tmp;
95		} else {
96		free(memories[index]);
97		memories[index] = NULL;
98		}
99		} else {
100		for (c = memories[index]; c && c->next->p != p; c = c->next);
101		assert(c);
102		tmp = c->next;
103		c->next = c->next->next;
104		free(tmp);
105		}
	89	/* Special case for first thingy */
	90	if (memories[index]->p == p) {
	91	if (memories[index]->next) {
	92	tmp = memories[index]->next;
	93	free(memories[index]);
	94	memories[index] = tmp;
	95	} else {
	96	free(memories[index]);
	97	memories[index] = NULL;
	98	}
	99	} else {
	100	for (c = memories[index]; c && c->next->p != p; c = c->next);
	101	assert(c);
	102	tmp = c->next;
	103	c->next = c->next->next;
	104	free(tmp);
	105	}
106	106	}
107	107
108		void
	108	void
109	109	_mdebug_dump(void)
110	110	{
111		struct memories *c;
112		int i, count = 0, min, max, avg, empty;
	111	struct memories *c;
	112	int i, count = 0, min, max, avg, empty;
113	113
114		for (i = 0; i < NUM_MEMBUCKETS; i++) {
115		for (c = memories[i]; c; c = c->next) {
116		printf("Found memory at %d (%p)\n", i, (void *) c);
117		count++;
118		printf("MEM: %p is %d bytes (%p)\n", (void *) c->p, (int)c->size,
119		(void *) c->p);
120		printf("\t%s line %d\n", c->file, c->line);
121		}
122		}
	114	for (i = 0; i < NUM_MEMBUCKETS; i++) {
	115	for (c = memories[i]; c; c = c->next) {
	116	printf("Found memory at %d (%p)\n", i, (void *) c);
	117	count++;
	118	printf("MEM: %p is %d bytes (%p)\n", (void *) c->p, (int)c->size,
	119	(void *) c->p);
	120	printf("\t%s line %d\n", c->file, c->line);
	121	}
	122	}
123	123
124		if (count == 0)
125		printf("No registered memory\n");
	124	if (count == 0)
	125	printf("No registered memory\n");
126	126
127		max = 0;
128		min = INT_MAX;
129		avg = 0;
130		empty = 0;
131		for (i = 0; i < NUM_MEMBUCKETS; i++) {
132		if (_mem_stats[i] == 0)
133		empty++;
134		if (_mem_stats[i] > max)
135		max = _mem_stats[i];
136		if (_mem_stats[i] < min)
137		min = _mem_stats[i];
138		avg += _mem_stats[i];
139		}
	127	max = 0;
	128	min = INT_MAX;
	129	avg = 0;
	130	empty = 0;
	131	for (i = 0; i < NUM_MEMBUCKETS; i++) {
	132	if (_mem_stats[i] == 0)
	133	empty++;
	134	if (_mem_stats[i] > max)
	135	max = _mem_stats[i];
	136	if (_mem_stats[i] < min)
	137	min = _mem_stats[i];
	138	avg += _mem_stats[i];
	139	}
140	140
141		printf("Hash size was %d buckets\n"
142		"Highest: %d\n"
143		"Lowest: %d\n"
144		"Average: %d\n"
145		"Empty: %d\n",
146		NUM_MEMBUCKETS, max, min, avg / NUM_MEMBUCKETS, empty);
	141	printf("Hash size was %d buckets\n"
	142	"Highest: %d\n"
	143	"Lowest: %d\n"
	144	"Average: %d\n"
	145	"Empty: %d\n",
	146	NUM_MEMBUCKETS, max, min, avg / NUM_MEMBUCKETS, empty);
147	147	}
148	148
149		void
	149	void
150	150	_mdebug_long_stats(void)
151	151	{
152		int i;
153		for (i = 0; i < NUM_MEMBUCKETS; i++) {
154		if (_mem_stats[i] > 0)
155		printf("MEM: %d got %d hits\n", i, _mem_stats[i]);
156		}
	152	int i;
	153	for (i = 0; i < NUM_MEMBUCKETS; i++) {
	154	if (_mem_stats[i] > 0)
	155	printf("MEM: %d got %d hits\n", i, _mem_stats[i]);
	156	}
157	157	}
158	158
159	159	void *
160	160	_my_malloc(size_t size, char *file, int line)
161	161	{
162		void *p;
163		p = malloc(size);
164		assert(p);
165		_register_mem(p, size, file, line);
166		return (p);
	162	void *p;
	163	p = malloc(size);
	164	assert(p);
	165	_register_mem(p, size, file, line);
	166	return (p);
167	167	}
168	168
169	169	void *
170	170	_my_calloc(size_t n, size_t size, char *file, int line)
171	171	{
172		void *p;
173		p = calloc(n, size);
174		assert(p);
175		_register_mem(p, size * n, file, line);
176		return (p);
	172	void *p;
	173	p = calloc(n, size);
	174	assert(p);
	175	_register_mem(p, size * n, file, line);
	176	return (p);
177	177	}
178	178
179	179	char *
180	180	_my_strdup(char str, char file, int line)
181	181	{
182		char *p;
183		p = strdup(str);
184		_register_mem(p, strlen(p), file, line);
185		return (p);
	182	char *p;
	183	p = strdup(str);
	184	_register_mem(p, strlen(p), file, line);
	185	return (p);
186	186	}
187	187
188	188	void *
189	189	_my_realloc(void p, size_t size, char file, int line)
190	190	{
191		void *ret;
192		assert(_lookup_mem(p));
193		_unregister_mem(p);
194		ret = realloc(p, size);
195		assert(ret);
196		_register_mem(ret, size, file, line);
197		return (ret);
	191	void *ret;
	192	assert(_lookup_mem(p));
	193	_unregister_mem(p);
	194	ret = realloc(p, size);
	195	assert(ret);
	196	_register_mem(ret, size, file, line);
	197	return (ret);
198	198	}
199	199
200		void
	200	void
201	201	_my_free(void p, char file, int line)
202	202	{
203		void *tmp;
204		tmp = _lookup_mem(p);
205		if (tmp == NULL) {
206		printf("Trying to free something that isn't mine: %p (%s) (%s:%d)\n",
207		p, (char *) p,
208		file, line);
209		_mdebug_dump();
210		abort();
211		}
212		_unregister_mem(p);
213		free(p);
	203	void *tmp;
	204	tmp = _lookup_mem(p);
	205	if (tmp == NULL) {
	206	printf("Trying to free something that isn't mine: %p (%s) (%s:%d)\n",
	207	p, (char *) p,
	208	file, line);
	209	_mdebug_dump();
	210	abort();
	211	}
	212	_unregister_mem(p);
	213	free(p);
214	214	}
215	215
216	216	#endif /* MYMALLOC */

Commit 387ec4672be35c938898683f910a18b5d38b9738

Comments

Add a new comment:

Add your comment