Context Navigation

source: lib/trace.c @ 20482800

4.0.1-hotfixescachetimestampsdevelopdpdk-ndagetsilivegetfragoffhelplibtrace4ndag_formatpfringrc-4.0.1rc-4.0.2rc-4.0.3rc-4.0.4ringdecrementfixringperformanceringtimestampfixes

Last change on this file since 20482800 was 20482800, checked in by Daniel Lawson <dlawson@…>, 18 years ago
freebsd fixes
Property mode set to `100644`
File size: 44.0 KB

Line
1	/*
2	* This file is part of libtrace
3	*
4	* Copyright (c) 2004 The University of Waikato, Hamilton, New Zealand.
5	* Authors: Daniel Lawson
6	* Perry Lorier
7	*
8	* All rights reserved.
9	*
10	* This code has been developed by the University of Waikato WAND
11	* research group. For further information please see http://www.wand.net.nz/
12	*
13	* libtrace is free software; you can redistribute it and/or modify
14	* it under the terms of the GNU General Public License as published by
15	* the Free Software Foundation; either version 2 of the License, or
16	* (at your option) any later version.
17	*
18	* libtrace is distributed in the hope that it will be useful,
19	* but WITHOUT ANY WARRANTY; without even the implied warranty of
20	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21	* GNU General Public License for more details.
22	*
23	* You should have received a copy of the GNU General Public License
24	* along with libtrace; if not, write to the Free Software
25	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26	*
27	* $Id$
28	*
29	*/
30
31
32	/** @file
33	*
34	* @brief Trace file processing library
35	*
36	* @author Daniel Lawson
37	* @author Perry Lorier
38	*
39	*/
40	#define _GNU_SOURCE
41	#include "common.h"
42	#include "config.h"
43	#include <assert.h>
44	#include <errno.h>
45	#include <fcntl.h>
46	#include <netdb.h>
47	#include <stdio.h>
48	#include <stdlib.h>
49	#include <string.h>
50	#include <sys/stat.h>
51	#include <sys/types.h>
52
53	#ifdef HAVE_LIMITS_H
54	# include <limits.h>
55	#endif
56
57	#ifdef HAVE_SYS_LIMITS_H
58	# include <sys/limits.h>
59	#endif
60
61	#include <sys/socket.h>
62	#include <sys/un.h>
63	#include <sys/mman.h>
64	#include <unistd.h>
65	#include <net/ethernet.h>
66	#include <time.h>
67	#include <sys/ioctl.h>
68
69	#ifdef HAVE_STDINT_H
70	# include <stdint.h>
71	#else
72	# error "Can't find stdint.h - you need to replace this"
73	#endif
74
75	#ifdef HAVE_STDDEF_H
76	# include <stddef.h>
77	#else
78	# error "Can't find stddef.h - do you define ptrdiff_t elsewhere?"
79	#endif
80
81	#include "libtrace.h"
82	#include "fifo.h"
83
84	#if HAVE_PCAP_BPF_H
85	# include <pcap-bpf.h>
86	# ifndef HAVE_BPF
87	# define HAVE_BPF 1
88	# endif
89	#else
90	# ifdef HAVE_NET_BPF_H
91	# include <net/bpf.h>
92	# ifndef HAVE_BPF
93	# define HAVE_BPF 1
94	# endif
95	# endif
96	#endif
97
98	#if HAVE_PCAP_H
99	# include <pcap.h>
100	# ifndef HAVE_PCAP
101	# define HAVE_PCAP 1
102	# endif
103	#endif
104
105	#ifdef HAVE_ZLIB_H
106	# include <zlib.h>
107	# ifndef HAVE_ZLIB
108	# define HAVE_ZLIB 1
109	# endif
110	#endif
111
112
113	#include "wag.h"
114
115	#ifdef HAVE_DAG_API
116	# include "dagnew.h"
117	# include "dagapi.h"
118	# ifndef DAGDEVICE
119	# define DAGDEVICE 1
120	# endif
121	#else
122	# include "dagformat.h"
123	#endif
124
125
126	typedef enum {SOCKET, TRACE, STDIN, DEVICE, INTERFACE, RT } source_t;
127
128	typedef enum {ERF, PCAP, PCAPINT, DAG, RTCLIENT, WAG, WAGINT } format_t;
129
130	#if HAVE_BPF
131	struct libtrace_filter_t {
132	struct bpf_insn *filter;
133	char * filterstring;
134	};
135	#endif
136
137	struct libtrace_t {
138	format_t format;
139	source_t sourcetype;
140	union {
141	struct {
142	char *hostname;
143	short port;
144	} rt;
145	char *path;
146	char *interface;
147	} conn_info;
148	union {
149	int fd;
150	#if HAVE_ZLIB
151	gzFile *file;
152	#else
153	FILE *file;
154	#endif
155	#if HAVE_PCAP
156	pcap_t *pcap;
157	#endif
158	} input;
159	struct fifo_t *fifo;
160	struct {
161	void *buf;
162	unsigned bottom;
163	unsigned top;
164	unsigned diff;
165	unsigned curr;
166	unsigned offset;
167	} dag;
168	struct {
169	void *buffer;
170	int size;
171	} packet;
172	double last_ts;
173	double start_ts;
174	};
175
176	#define RP_BUFSIZE 65536
177
178	#define URI_PROTO_LINE 16
179	static int init_trace(struct libtrace_t *libtrace, char uri) {
180	char *scan = calloc(sizeof(char),URI_PROTO_LINE);
181	char *uridata = 0;
182	struct stat buf;
183
184	// parse the URI to determine what sort of event we are dealing with
185
186	// want snippet before the : to get the uri base type.
187
188	if((uridata = strchr(uri,':')) == NULL) {
189	// badly formed URI - needs a :
190	return 0;
191	}
192
193	if ((uridata - uri) > URI_PROTO_LINE) {
194	// badly formed URI - uri type is too long
195	return 0;
196	}
197	strncpy(scan,uri, (uridata - uri));
198
199	if (!strncasecmp(scan,"erf",3)) {
200	(*libtrace)->format=ERF;
201	#if HAVE_PCAP
202	} else if (!strncasecmp(scan,"pcapint",7)) {
203	(*libtrace)->format=PCAPINT;
204	} else if (!strncasecmp(scan,"pcap",4)) {
205	(*libtrace)->format=PCAP;
206	#else
207	} else if (!strncasecmp(scan,"pcap",4)) { // also catches pcapint
208	fprintf(stderr,"This version of libtrace has been compiled without PCAP support\n");
209	return 0;
210	#endif
211
212	#ifdef DAGDEVICE
213	} else if (!strncasecmp(scan,"dag",3)) {
214	(*libtrace)->format=DAG;
215	#else
216	} else if (!strncasecmp(scan,"dag",3)) {
217	fprintf(stderr,"This version of libtrace has been compiled without DAG support\n");
218	return 0;
219	#endif
220	} else if (!strncasecmp(scan,"rtclient",7)) {
221	(*libtrace)->format=RTCLIENT;
222	} else if (!strncasecmp(scan,"wagint",6)) {
223	(*libtrace)->format=WAGINT;
224	} else if (!strncasecmp(scan,"wag",3)) {
225	(*libtrace)->format=WAG;
226	} else {
227	//badly formed URI
228	return 0;
229	}
230
231	// push uridata past the delimiter
232	uridata++;
233
234	// libtrace->format now contains the type of uri
235	// libtrace->uridata contains the appropriate data for this
236
237	switch((*libtrace)->format) {
238	#if HAVE_PCAP
239	case PCAPINT:
240	#endif
241	case WAGINT:
242	/* Can have uridata of the following format
243	* eth0
244	* etc
245	*/
246	// We basically assume this is correct.
247	(*libtrace)->sourcetype = INTERFACE;
248	(*libtrace)->conn_info.path = strdup(uridata);
249	break;
250	#if HAVE_PCAP
251	case PCAP:
252	#endif
253	case ERF:
254	case WAG:
255	/*
256	* Can have uridata of the following format
257	* /path/to/socket (probably not PCAP)
258	* /path/to/file
259	* /path/to/file.gz (not PCAP)
260	* /dev/device (use PCAPINT)
261	* -
262	*/
263	if (!strncmp(uridata,"-",1)) {
264	(*libtrace)->sourcetype = STDIN;
265	} else {
266	if (stat(uridata,&buf) == -1) {
267	perror("stat");
268	return 0;
269	}
270	if (S_ISSOCK(buf.st_mode)) {
271	(*libtrace)->sourcetype = SOCKET;
272	} else if (S_ISCHR(buf.st_mode)) {
273	(*libtrace)->sourcetype = DEVICE;
274	} else {
275	(*libtrace)->sourcetype = TRACE;
276	}
277	(*libtrace)->conn_info.path = strdup(uridata);
278	}
279	break;
280	case DAG:
281	#ifdef DAGDEVICE
282	/*
283	* Can have uridata of the following format:
284	* /dev/device
285	*/
286	if (stat(uridata,&buf) == -1) {
287	perror("stat");
288	return 0;
289	}
290	if (S_ISCHR(buf.st_mode)) {
291	(*libtrace)->sourcetype = DEVICE;
292	} else {
293	fprintf(stderr,"%s isn't a valid char device, exiting\n",uridata);
294	exit(1);
295	}
296	(*libtrace)->conn_info.path = strdup(uridata);
297	#endif
298	break;
299
300	case RTCLIENT:
301	/*
302	* Can have the uridata in the format
303	* hostname
304	* hostname:port
305	*/
306	(*libtrace)->sourcetype = RT;
307	if (strlen(uridata) == 0) {
308	(*libtrace)->conn_info.rt.hostname =
309	strdup("localhost");
310	(*libtrace)->conn_info.rt.port =
311	COLLECTOR_PORT;
312	break;
313	}
314	if ((scan = strchr(uridata,':')) == NULL) {
315	(*libtrace)->conn_info.rt.hostname =
316	strdup(uridata);
317	(*libtrace)->conn_info.rt.port =
318	COLLECTOR_PORT;
319	} else {
320	(*libtrace)->conn_info.rt.hostname =
321	(char *)strndup(uridata,(scan - uridata));
322
323	(*libtrace)->conn_info.rt.port =
324	atoi(++scan);
325	}
326	break;
327	}
328
329
330	(*libtrace)->fifo = create_fifo(1048576);
331	assert( (*libtrace)->fifo);
332	//(*libtrace)->packet.buffer = 0;
333	//(*libtrace)->packet.size = 0;
334
335	return 1;
336	}
337
338	/** Create a trace file from a URI
339	*
340	* @returns opaque pointer to a libtrace_t
341	*
342	* Valid URI's are:
343	* erf:/path/to/erf/file
344	* erf:/path/to/erf/file.gz
345	* erf:/path/to/rtclient/socket
346	* erf:- (stdin)
347	* pcapint:pcapinterface (eg: pcapint:eth0)
348	* pcap:/path/to/pcap/file
349	* pcap:-
350	* rtclient:hostname
351	* rtclient:hostname:port
352	* wag:-
353	* wag:/path/to/wag/file
354	* wag:/path/to/wag/file.gz
355	* wag:/path/to/wag/socket
356	* wagint:/dev/device
357	*
358	* URIs which have yet to be implemented are:
359	* dag:/dev/dagcard
360	* pcap:/path/to/pcap/socket
361	*
362	* If an error occured when attempting to open a trace, NULL is returned
363	* and an error is output to stdout.
364	*/
365	struct libtrace_t trace_create(char uri) {
366	struct libtrace_t *libtrace = malloc(sizeof(struct libtrace_t));
367	struct hostent *he;
368	struct sockaddr_in remote;
369	struct sockaddr_un unix_sock;
370	#if HAVE_PCAP
371	char errbuf[PCAP_ERRBUF_SIZE];
372	#endif
373
374	if(init_trace(&libtrace,uri) == 0) {
375	return 0;
376	}
377
378	switch(libtrace->sourcetype) {
379	case RT:
380	if ((he=gethostbyname(libtrace->conn_info.rt.hostname)) == NULL) {
381	perror("gethostbyname");
382	return 0;
383	}
384	if ((libtrace->input.fd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
385	perror("socket");
386	return 0;
387	}
388
389	remote.sin_family = AF_INET;
390	remote.sin_port = htons(libtrace->conn_info.rt.port);
391	remote.sin_addr = ((struct in_addr )he->h_addr);
392	bzero(&(remote.sin_zero), 8);
393
394	if (connect(libtrace->input.fd, (struct sockaddr *)&remote,
395	sizeof(struct sockaddr)) == -1) {
396	perror("connect (inet)");
397	return 0;
398	}
399	break;
400	case TRACE:
401	#if HAVE_PCAP
402	if (libtrace->format == PCAP) {
403	if ((libtrace->input.pcap = pcap_open_offline(libtrace->conn_info.path, errbuf)) == NULL) {
404	fprintf(stderr,"%s\n",errbuf);
405	return 0;
406	}
407	} else {
408	#else
409	{
410	#endif
411	#if HAVE_ZLIB
412	libtrace->input.file = gzopen(libtrace->conn_info.path, "r");
413	#else
414	libtrace->input.file = fopen(libtrace->conn_info.path, "r");
415	#endif
416	}
417	break;
418	case STDIN:
419	#if HAVE_PCAP
420	if (libtrace->format == PCAP) {
421	libtrace->input.pcap = pcap_open_offline("-",errbuf);
422	} else {
423	#else
424	{
425	#endif
426	#if HAVE_ZLIB
427	libtrace->input.file = gzdopen(STDIN, "r");
428	#else
429	libtrace->input.file = fdopen(STDIN, "r");
430	#endif
431	}
432	break;
433	case SOCKET:
434	/* Pcap doesn't work */
435	if (libtrace->format != PCAP) {
436	if ((libtrace->input.fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
437	perror("socket");
438	return 0;
439	}
440	unix_sock.sun_family = AF_UNIX;
441	bzero(unix_sock.sun_path,108);
442	snprintf(unix_sock.sun_path,108,"%s",libtrace->conn_info.path);
443
444	if (connect(libtrace->input.fd, (struct sockaddr *)&unix_sock,
445	sizeof(struct sockaddr)) == -1) {
446	perror("connect (unix)");
447	return 0;
448	}
449	}
450	break;
451	case DEVICE:
452	case INTERFACE:
453	switch (libtrace->format) {
454	#if HAVE_PCAP
455	case PCAPINT:
456	case PCAP:
457	libtrace->input.pcap = pcap_open_live(
458	libtrace->conn_info.path,
459	4096,
460	1,
461	0,
462	errbuf);
463	break;
464	#endif
465	case WAGINT:
466	case WAG:
467	libtrace->input.fd = open(
468	libtrace->conn_info.path,
469	O_RDONLY);
470	break;
471	#ifdef DAGDEVICE
472	case DAG:
473	if((libtrace->input.fd = dag_open(libtrace->conn_info.path)) < 0) {
474	fprintf(stderr,"Cannot open DAG %s: %m\n", libtrace->conn_info.path,errno);
475	exit(0);
476	}
477	if((libtrace->dag.buf = dag_mmap(libtrace->input.fd)) == MAP_FAILED) {
478	fprintf(stderr,"Cannot mmap DAG %s: %m\n", libtrace->conn_info.path,errno);
479	exit(0);
480	}
481	if(dag_start(libtrace->input.fd) < 0) {
482	fprintf(stderr,"Cannot start DAG %s: %m\n", libtrace->conn_info.path,errno);
483	exit(0);
484	}
485	break;
486	#endif
487	default:
488	fprintf(stderr,"Unknown format trace, hoping I can just read\n");
489	break;
490
491	}
492	break;
493	default:
494	fprintf(stderr,"Unsupported source type for libtrace, terminating (%i)\n",libtrace->sourcetype);
495	exit(0);
496
497	}
498	return libtrace;
499	}
500
501	/** Close a trace file, freeing up any resources it may have been using
502	*
503	*/
504	void trace_destroy(struct libtrace_t *libtrace) {
505	assert(libtrace);
506	#if HAVE_PCAP
507	if (libtrace->format == PCAP \|\| libtrace->format == PCAPINT) {
508	pcap_close(libtrace->input.pcap);
509	#else
510	if (0) {
511	#endif
512	} else if (libtrace->sourcetype == SOCKET \|\| libtrace->sourcetype == RT) {
513	close(libtrace->input.fd);
514	#ifdef DAGDEVICE
515	} else if (libtrace->format == DAG) {
516	dag_stop(libtrace->input.fd);
517	#endif
518	} else {
519	#if HAVE_ZLIB
520	gzclose(libtrace->input.file);
521	#else
522	fclose(libtrace->input.file);
523	#endif
524	}
525	// need to free things!
526	destroy_fifo(libtrace->fifo);
527	free(libtrace);
528	}
529
530	static int trace_read(struct libtrace_t libtrace, void buffer, size_t len) {
531	int numbytes;
532	static short lctr = 0;
533	struct dag_record_t *recptr = 0;
534	int rlen;
535	assert(libtrace);
536	assert(len >= 0);
537
538	if (buffer == 0)
539	buffer = malloc(len);
540
541	while(1) {
542	switch(libtrace->sourcetype) {
543	case SOCKET:
544	case RT:
545
546	#ifndef MSG_NOSIGNAL
547	#define MSG_NOSIGNAL 0
548	#endif
549	// read from the network
550	if ((numbytes=recv(libtrace->input.fd,
551	buffer,
552	len,
553	MSG_NOSIGNAL)) == -1) {
554	if (errno == EINTR) {
555	// ignore EINTR in case
556	// a caller is using signals
557	continue;
558	}
559	perror("recv");
560	return -1;
561	}
562	break;
563	case DEVICE:
564	switch(libtrace->format) {
565	#ifdef DAGDEVICE
566	case DAG:
567
568	libtrace->dag.bottom = libtrace->dag.top;
569	libtrace->dag.top = dag_offset(
570	libtrace->input.fd,
571	&(libtrace->dag.bottom),
572	0);
573	libtrace->dag.diff = libtrace->dag.top -
574	libtrace->dag.bottom;
575
576	numbytes=libtrace->dag.diff;
577	libtrace->dag.offset = 0;
578
579	break;
580	#endif
581	default:
582	if ((numbytes=read(libtrace->input.fd,
583	buffer,
584	len)) == -1) {
585	perror("read");
586	return -1;
587	}
588	}
589	break;
590	default:
591	#if HAVE_ZLIB
592	if ((numbytes=gzread(libtrace->input.file,
593	buffer,
594	len)) == -1) {
595	perror("gzread");
596	return -1;
597	}
598	#else
599	if ((numbytes=fread(buffer,len,1,libtrace->input.file)) == 0 ) {
600	if(feof(libtrace->input.file)) {
601	return 0;
602	}
603	if(ferror(libtrace->input.file)) {
604	perror("fread");
605	return -1;
606	}
607	return 0;
608	}
609	#endif
610	}
611	break;
612	}
613	return numbytes;
614
615	}
616
617	/** Read one packet from the trace into buffer
618	*
619	* @param libtrace the libtrace opaque pointer
620	* @param packet the packet opaque pointer
621	* @returns false if it failed to read a packet
622	*
623	*/
624	int trace_read_packet(struct libtrace_t libtrace, struct libtrace_packet_t packet) {
625	int numbytes;
626	int size;
627	char buf[RP_BUFSIZE];
628	#if HAVE_PCAP
629	struct pcap_pkthdr pcaphdr;
630	const u_char *pcappkt;
631	#endif
632	dag_record_t *erfptr;
633	int read_required = 0;
634
635	void *buffer = 0;
636	if (!libtrace) {
637	fprintf(stderr,"Oi! You called trace_read_packet() with a NULL libtrace parameter!\n");
638	}
639	assert(libtrace);
640	assert(packet);
641
642	/* Store the trace we are reading from into the packet opaque
643	* structure */
644	packet->trace = libtrace;
645
646	buffer = packet->buffer;
647	#if HAVE_PCAP
648	/* PCAP gives us it's own per-packet interface. Let's use it */
649	if (libtrace->format == PCAP \|\| libtrace->format == PCAPINT) {
650	if ((pcappkt = pcap_next(libtrace->input.pcap, &pcaphdr)) == NULL) {
651	return -1;
652	}
653	memcpy(buffer,&pcaphdr,sizeof(struct pcap_pkthdr));
654	memcpy(buffer + sizeof(struct pcap_pkthdr),pcappkt,pcaphdr.len);
655	numbytes = pcaphdr.len;
656
657	packet->size = numbytes + sizeof(struct pcap_pkthdr);
658	return numbytes;
659	}
660	#endif
661
662	/* If we're reading from an ERF input, it's an offline trace. We can make some assumptions */
663	if (libtrace->format == ERF) {
664	void *buffer2 = buffer;
665	// read in the trace header
666	if ((numbytes=gzread(libtrace->input.file,
667	buffer,
668	sizeof(dag_record_t))) == -1) {
669	perror("gzread");
670	return -1;
671	}
672	if (numbytes == 0) {
673	return 0;
674	}
675	size = ntohs(((dag_record_t *)buffer)->rlen) - sizeof(dag_record_t);
676	assert(size < LIBTRACE_PACKET_BUFSIZE);
677	buffer2 = buffer + sizeof(dag_record_t);
678
679	// read in the rest of the packet
680	if ((numbytes=gzread(libtrace->input.file,
681	buffer2,
682	size)) == -1) {
683	perror("gzread");
684	return -1;
685	}
686	packet->size = numbytes + sizeof(dag_record_t);
687	return sizeof(dag_record_t) + numbytes;
688	}
689
690	#ifdef DAGDEVICE
691	if (libtrace->format == DAG) {
692	if (libtrace->dag.diff == 0) {
693	if ((numbytes = trace_read(libtrace,buf,RP_BUFSIZE)) <= 0)
694	return numbytes;
695	}
696	// DAG always gives us whole packets.
697
698	erfptr = (dag_record_t ) ((void )libtrace->dag.buf + (libtrace->dag.bottom + libtrace->dag.offset));
699	size = ntohs(erfptr->rlen);
700
701	if ( size > LIBTRACE_PACKET_BUFSIZE) {
702	printf("%d\n",size);
703	assert( size < LIBTRACE_PACKET_BUFSIZE);
704	}
705
706	// have to copy it out of the memory hole at this stage:
707	memcpy(packet->buffer, erfptr, size);
708
709	packet->size = size;
710	libtrace->dag.offset += size;
711	libtrace->dag.diff -= size;
712
713	assert(libtrace->dag.diff >= 0);
714	//assert(libtrace->dag.offset <= libtrace->dag.top);
715	return (size);
716
717	}
718	#endif
719	do {
720	if (fifo_out_available(libtrace->fifo) == 0 \|\| read_required) {
721	if ((numbytes = trace_read(libtrace,buf,RP_BUFSIZE))<=0){
722	return numbytes;
723	}
724	assert(libtrace->fifo);
725	fifo_write(libtrace->fifo,buf,numbytes);
726
727	read_required = 0;
728	}
729
730	switch (libtrace->format) {
731	case RTCLIENT:
732	// only do this if we're reading from the RT interface
733	if (fifo_out_read(libtrace->fifo, &packet->status, sizeof(int)) == 0) {
734	read_required = 1;
735	continue;
736	}
737
738	fifo_out_update(libtrace->fifo,sizeof(int));
739
740	/* FALL THRU */
741	//case ERF:
742	//case DAG:
743	// read in the erf header
744	if ((numbytes = fifo_out_read(libtrace->fifo, buffer, sizeof(dag_record_t))) == 0) {
745	fifo_out_reset(libtrace->fifo);
746	read_required = 1;
747	continue;
748	}
749
750	size = ntohs(((dag_record_t *)buffer)->rlen);
751	break;
752	case WAG:
753	if ((numbytes = fifo_out_read(libtrace->fifo,
754	&size,
755	sizeof(size)))
756	== 0) {
757	fifo_out_reset(libtrace->fifo);
758	read_required = 1;
759	continue;
760	}
761	size*=4;
762	break;
763	default:
764	fprintf(stderr,"Unknown type in _read()\n");
765	assert(0);
766	}
767
768	assert(size < LIBTRACE_PACKET_BUFSIZE);
769
770	// read in the full packet
771	if ((numbytes = fifo_out_read(libtrace->fifo, buffer, size)) == 0) {
772	fifo_out_reset(libtrace->fifo);
773	read_required = 1;
774	continue;
775	}
776
777	// got in our whole packet, so...
778	fifo_out_update(libtrace->fifo,size);
779
780	if (libtrace->sourcetype == SOCKET \|\| libtrace->sourcetype == RT) {
781	fifo_ack_update(libtrace->fifo,size + sizeof(int));
782	} else {
783	fifo_ack_update(libtrace->fifo,size);
784	}
785
786	packet->size = numbytes;
787	return numbytes;
788
789	} while (1);
790	}
791
792
793	/** get a pointer to the link layer
794	* @param libtrace a pointer to the trace object returned from gettrace
795	* @param buffer a pointer to a filled in buffer
796	* @param buflen a pointer to the size of the buffer
797	*
798	* @returns a pointer to the link layer, or NULL if there is no link layer
799	* you should call trace_get_link_type() to find out what type of link layer this is
800	*/
801	void trace_get_link(struct libtrace_packet_t packet) {
802	void *ethptr = 0;
803
804	struct wag_event_t event = (struct wag_event_t )packet->buffer;
805	struct wag_data_event_t *data_event;
806
807
808	switch(packet->trace->format) {
809	case ERF:
810	case DAG:
811	case RTCLIENT:
812	if (trace_get_link_type(packet)==TRACE_TYPE_ETH)
813	ethptr = ((uint8_t *)packet->buffer +
814	dag_record_size + 2);
815	else
816	ethptr = ((uint8_t *)packet->buffer +
817	dag_record_size + 2);
818	break;
819	#if HAVE_PCAP
820	case PCAPINT:
821	case PCAP:
822	ethptr = (struct ether_header *)(packet->buffer + sizeof(struct pcap_pkthdr));
823	break;
824	#endif
825	case WAGINT:
826	case WAG:
827	switch (event->type) {
828	case 0x0:
829	data_event = (void*)&(event->payload);
830	return data_event->data;
831	default:
832	fprintf(stderr,"Unknown WAG Event (0x%08x)\n",event->type);
833	return NULL;
834	}
835
836	default:
837	fprintf(stderr,"Dunno this trace format\n");
838	assert(0);
839	}
840	return ethptr;
841	}
842
843	/** get a pointer to the IP header (if any)
844	* @param libtrace a pointer to the trace object returned from gettrace
845	* @param buffer a pointer to a filled in buffer
846	* @param buflen a pointer to the size of the buffer
847	*
848	* @returns a pointer to the IP header, or NULL if there is not an IP packet
849	*/
850	struct libtrace_ip trace_get_ip(struct libtrace_packet_t packet) {
851	struct libtrace_ip *ipptr = 0;
852
853	switch(trace_get_link_type(packet)) {
854	case TRACE_TYPE_80211:
855	{
856
857	struct ieee_802_11_header *wifi = trace_get_link(packet);
858
859	// Data packet?
860	if (wifi->type != 2) {
861	ipptr = NULL;
862	}
863	else {
864	struct ieee_802_11_payload eth = (void)wifi->data;
865	if (eth->type != 0x0008) {
866	ipptr=NULL;
867	} else {
868	ipptr=(void*)eth->data;
869	}
870	}
871	}
872	break;
873	case TRACE_TYPE_ETH:
874	{
875	struct ether_header *eth =
876	trace_get_link(packet);
877	if (ntohs(eth->ether_type)!=0x0800) {
878	ipptr = NULL;
879	}
880	else {
881	ipptr = ((void *)eth) + 14;
882	}
883	break;
884	}
885	case TRACE_TYPE_ATM:
886	{
887	struct atm_rec *atm =
888	trace_get_link(packet);
889	// TODO: Find out what ATM does, and return
890	// NULL for non IP data
891	// Presumably it uses the normal stuff
892	ipptr = (void*)&atm->pload;
893	break;
894	}
895	default:
896	fprintf(stderr,"Don't understand link layer type %i in trace_get_ip()\n",
897	trace_get_link_type(packet));
898	ipptr=NULL;
899	break;
900	}
901
902	return ipptr;
903	}
904
905
906	/** get a pointer to the TCP header (if any)
907	* @param libtrace a pointer to the trace object returned from gettrace
908	* @param buffer a pointer to a filled in buffer
909	* @param buflen a pointer to the size of the buffer
910	*
911	* @returns a pointer to the TCP header, or NULL if there is not a TCP packet
912	*/
913	struct libtrace_tcp trace_get_tcp(struct libtrace_packet_t packet) {
914	struct libtrace_tcp *tcpptr = 0;
915	struct libtrace_ip *ipptr = 0;
916
917	if(!(ipptr = trace_get_ip(packet))) {
918	return 0;
919	}
920	if (ipptr->ip_p == 6) {
921	tcpptr = (struct libtrace_tcp )((ptrdiff_t)ipptr + (ipptr->ip_hl 4));
922	}
923	return tcpptr;
924	}
925
926	/** get a pointer to the UDP header (if any)
927	* @param libtrace a pointer to the trace object returned from gettrace
928	* @param buffer a pointer to a filled in buffer
929	* @param buflen a pointer to the size of the buffer
930	*
931	* @returns a pointer to the UDP header, or NULL if this is not a UDP packet
932	*/
933	struct libtrace_udp trace_get_udp(struct libtrace_packet_t packet) {
934	struct libtrace_udp *udpptr = 0;
935	struct libtrace_ip *ipptr = 0;
936
937	if(!(ipptr = trace_get_ip(packet))) {
938	return 0;
939	}
940	if (ipptr->ip_p == 17) {
941	udpptr = (struct libtrace_udp )((ptrdiff_t)ipptr + (ipptr->ip_hl 4));
942	}
943	return udpptr;
944	}
945
946	/** get a pointer to the ICMP header (if any)
947	* @param libtrace a pointer to the trace object returned from gettrace
948	* @param buffer a pointer to a filled in buffer
949	* @param buflen a pointer to the size of the buffer
950	*
951	* @returns a pointer to the ICMP header, or NULL if this is not a ICMP packet
952	*/
953	struct libtrace_icmp trace_get_icmp(struct libtrace_packet_t packet) {
954	struct libtrace_icmp *icmpptr = 0;
955	struct libtrace_ip *ipptr = 0;
956
957	if(!(ipptr = trace_get_ip(packet))) {
958	return 0;
959	}
960	if (ipptr->ip_p == 1) {
961	icmpptr = (struct libtrace_icmp )((ptrdiff_t)ipptr + (ipptr->ip_hl 4));
962	}
963	return icmpptr;
964	}
965
966	/** Get the current time in DAG time format
967	* @param libtrace the libtrace opaque pointer
968	* @param buffer a pointer to a filled in buffer
969	* @param buflen the length of the buffer
970	* @returns a 64 bit timestamp in DAG ERF format (upper 32 bits are the seconds
971	* past 1970-01-01, the lower 32bits are partial seconds)
972	* @author Daniel Lawson
973	*/
974	uint64_t trace_get_erf_timestamp(struct libtrace_packet_t *packet) {
975	uint64_t timestamp = 0;
976	dag_record_t *erfptr = 0;
977	struct pcap_pkthdr *pcapptr = 0;
978	struct wag_event_t *wagptr = 0;
979	switch (packet->trace->format) {
980	case DAG:
981	case ERF:
982	case RTCLIENT:
983	erfptr = (dag_record_t *)packet->buffer;
984	timestamp = erfptr->ts;
985	break;
986	#if HAVE_PCAP
987	case PCAPINT:
988	case PCAP:
989	pcapptr = (struct pcap_pkthdr *)packet->buffer;
990	timestamp = ((((uint64_t)pcapptr->ts.tv_sec) << 32) + \
991	(pcapptr->ts.tv_usec*UINT_MAX/1000000));
992	break;
993	#endif
994	case WAGINT:
995	case WAG:
996	wagptr = (struct wag_event_t *)packet->buffer;
997	timestamp = wagptr->timestamp_lo;
998	timestamp \|= (uint64_t)wagptr->timestamp_hi<<32;
999	timestamp = ((timestamp%44000000)*(UINT_MAX/44000000))
1000	\| ((timestamp/44000000)<<32);
1001	break;
1002	default:
1003	fprintf(stderr,"Unknown format in trace_get_erf_timestamp\n");
1004	timestamp = 0;
1005	}
1006	return timestamp;
1007	}
1008
1009	/** Get the current time in struct timeval
1010	* @param libtrace the libtrace opaque pointer
1011	* @param buffer a pointer to a filled in buffer
1012	* @param buflen the length of the buffer
1013	* @returns time that this packet was seen in a struct timeval
1014	* @author Daniel Lawson
1015	* @author Perry Lorier
1016	*/
1017	struct timeval trace_get_timeval(struct libtrace_packet_t *packet) {
1018	struct timeval tv;
1019	#if HAVE_PCAP
1020	struct pcap_pkthdr *pcapptr = 0;
1021	#endif
1022	uint64_t ts;
1023	//uint32_t seconds;
1024	switch (packet->trace->format) {
1025	#if HAVE_PCAP
1026	case PCAPINT:
1027	case PCAP:
1028	pcapptr = (struct pcap_pkthdr *)packet->buffer;
1029	tv = pcapptr->ts;
1030	break;
1031	#endif
1032	case WAGINT:
1033	case WAG:
1034	case DAG:
1035	case ERF:
1036	case RTCLIENT:
1037	default:
1038	// FIXME: This isn't portable to big-endian machines
1039	ts = trace_get_erf_timestamp(packet);
1040	tv.tv_sec = ts >> 32;
1041	ts = (1000000 * (ts & 0xffffffffULL));
1042	ts += (ts & 0x80000000ULL) << 1;
1043	tv.tv_usec = ts >> 32;
1044	if (tv.tv_usec >= 1000000) {
1045	tv.tv_usec -= 1000000;
1046	tv.tv_sec += 1;
1047	}
1048	break;
1049	}
1050	return tv;
1051	}
1052
1053	/** Get the current time in floating point seconds
1054	* @param libtrace the libtrace opaque pointer
1055	* @param buffer a pointer to a filled in buffer
1056	* @param buflen the length of the buffer
1057	* @returns time that this packet was seen in 64bit floating point seconds
1058	* @author Perry Lorier
1059	*/
1060	double trace_get_seconds(struct libtrace_packet_t *packet) {
1061	uint64_t ts;
1062	ts = trace_get_erf_timestamp(packet);
1063	return (ts>>32) + ((ts & UINT_MAX)*1.0 / UINT_MAX);
1064	}
1065
1066	/** Get the size of the packet in the trace
1067	* @param packet the packet opaque pointer
1068	* @returns the size of the packet in the trace
1069	* @author Perry Lorier
1070	* @note Due to this being a header capture, or anonymisation, this may not
1071	* be the same size as the original packet. See trace_get_wire_length() for the
1072	* original size of the packet.
1073	* @note This can (and often is) different for different packets in a trace!
1074	* @par
1075	* This is sometimes called the "snaplen".
1076	*/
1077	int trace_get_capture_length(struct libtrace_packet_t *packet) {
1078	dag_record_t *erfptr = 0;
1079	#if HAVE_PCAP
1080	struct pcap_pkthdr *pcapptr = 0;
1081	#endif
1082	struct wag_event_t *wag_event;
1083	switch (packet->trace->format) {
1084	case DAG:
1085	case ERF:
1086	case RTCLIENT:
1087	erfptr = (dag_record_t *)packet->buffer;
1088	return ntohs(erfptr->rlen);
1089	#if HAVE_PCAP
1090	case PCAPINT:
1091	case PCAP:
1092	pcapptr = (struct pcap_pkthdr *)packet->buffer;
1093	//return ntohs(pcapptr->caplen);
1094	return pcapptr->caplen;
1095	#endif
1096	case WAGINT:
1097	case WAG:
1098	wag_event = (struct wag_event_t *)packet->buffer;
1099	switch(wag_event->type) {
1100	case 0:
1101	return wag_event->length*4-(
1102	sizeof(struct wag_event_t)+
1103	sizeof(struct wag_data_event_t)
1104	);
1105	default:
1106	assert(0);
1107	}
1108	default:
1109	assert(0);
1110	}
1111	return -1;
1112	}
1113
1114	/** Get the size of the packet as it was seen on the wire.
1115	* @param libtrace the libtrace opaque pointer
1116	* @param buffer a pointer to a filled in buffer
1117	* @param buflen the length of the buffer
1118	* @returns the size of the packet as it was on the wire.
1119	* @author Perry Lorier
1120	* @author Daniel Lawson
1121	* @note Due to the trace being a header capture, or anonymisation this may
1122	* not be the same as the Capture Len.
1123	*/
1124	int trace_get_wire_length(struct libtrace_packet_t *packet){
1125	dag_record_t *erfptr = 0;
1126	#if HAVE_PCAP
1127	struct pcap_pkthdr *pcapptr = 0;
1128	#endif
1129	struct wag_event_t *wag_event = 0;
1130	switch (packet->trace->format) {
1131	case DAG:
1132	case ERF:
1133	case RTCLIENT:
1134	erfptr = (dag_record_t *)packet->buffer;
1135	return ntohs(erfptr->wlen);
1136	break;
1137	#if HAVE_PCAP
1138	case PCAPINT:
1139	case PCAP:
1140	pcapptr = (struct pcap_pkthdr *)packet->buffer;
1141	return ntohs(pcapptr->len);
1142	break;
1143	#endif
1144	case WAGINT:
1145	case WAG:
1146	wag_event = (struct wag_event_t *)packet->buffer;
1147	switch(wag_event->type) {
1148	case 0:
1149	return ((struct wag_data_event_t *)(&wag_event->payload))->frame_length;
1150	default:
1151	assert(0);
1152	}
1153	}
1154	return -1;
1155
1156	}
1157
1158	/** Get the type of the link layer
1159	* @param libtrace the libtrace opaque pointer
1160	* @param buffer a pointer to a filled in buffer
1161	* @param buflen the length of the buffer
1162	* @returns libtrace_linktype_t
1163	* @author Perry Lorier
1164	* @author Daniel Lawson
1165	*/
1166	libtrace_linktype_t trace_get_link_type(struct libtrace_packet_t *packet ) {
1167	dag_record_t *erfptr = 0;
1168	#if HAVE_PCAP
1169	struct pcap_pkthdr *pcapptr = 0;
1170	#endif
1171	int linktype = 0;
1172	switch (packet->trace->format) {
1173	case DAG:
1174	case ERF:
1175	case RTCLIENT:
1176	erfptr = (dag_record_t *)packet->buffer;
1177	switch (erfptr->type) {
1178	case TYPE_ETH: return TRACE_TYPE_ETH;
1179	case TYPE_ATM: return TRACE_TYPE_ATM;
1180	default: assert(0);
1181	}
1182	return erfptr->type;
1183
1184	break;
1185	#if HAVE_PCAP
1186	case PCAPINT:
1187	case PCAP:
1188	pcapptr = (struct pcap_pkthdr *)packet->buffer;
1189	linktype = pcap_datalink(packet->trace->input.pcap);
1190	switch (linktype) {
1191	case 1:
1192	return TRACE_TYPE_ETH;
1193	case 11:
1194	return TRACE_TYPE_ATM;
1195	case DLT_IEEE802_11:
1196	return TRACE_TYPE_80211;
1197	}
1198	break;
1199	#endif
1200	case WAGINT:
1201	case WAG:
1202	return TRACE_TYPE_80211;
1203	}
1204	return -1;
1205	}
1206
1207	/** Get the source MAC addres
1208	* @param libtrace the libtrace opaque pointer
1209	* @param buffer a pointer to a filled in buffer
1210	* @param buflen the length of the buffer
1211	* @returns a pointer to the source mac, (or NULL if there is no source MAC)
1212	* @author Perry Lorier
1213	*/
1214	uint8_t trace_get_source_mac(struct libtrace_packet_t packet) {
1215	void *link = trace_get_link(packet);
1216	struct ieee_802_11_header *wifi = link;
1217	struct ether_header *ethptr = link;
1218	if (!link)
1219	return NULL;
1220	switch (trace_get_link_type(packet)) {
1221	case TRACE_TYPE_80211:
1222	return (uint8_t*)&wifi->mac2;
1223	case TRACE_TYPE_ETH:
1224	return (uint8_t*)&ethptr->ether_shost;
1225	default:
1226	fprintf(stderr,"Not implemented\n");
1227	assert(0);
1228	}
1229	}
1230
1231	/** Get the destination MAC addres
1232	* @param libtrace the libtrace opaque pointer
1233	* @param buffer a pointer to a filled in buffer
1234	* @param buflen the length of the buffer
1235	* @returns a pointer to the destination mac, (or NULL if there is no
1236	* destination MAC)
1237	* @author Perry Lorier
1238	*/
1239	uint8_t trace_get_destination_mac(struct libtrace_packet_t packet) {
1240	void *link = trace_get_link(packet);
1241	struct ieee_802_11_header *wifi = link;
1242	struct ether_header *ethptr = link;
1243	if (!link)
1244	return NULL;
1245	switch (trace_get_link_type(packet)) {
1246	case TRACE_TYPE_80211:
1247	return (uint8_t*)&wifi->mac1;
1248	case TRACE_TYPE_ETH:
1249	return (uint8_t*)&ethptr->ether_dhost;
1250	default:
1251	fprintf(stderr,"Not implemented\n");
1252	assert(0);
1253	}
1254	}
1255
1256
1257	/** process a libtrace event
1258	* @param trace the libtrace opaque pointer
1259	* @param packet the libtrace_packet opaque pointer
1260	* @param fd a pointer to a file descriptor to listen on
1261	* @param seconds a pointer the time in seconds since to the next event
1262	* @returns
1263	* TRACE_EVENT_IOWAIT Waiting on I/O on <fd>
1264	* TRACE_EVENT_SLEEP Next event in <seconds>
1265	* TRACE_EVENT_PACKET Packet arrived in <buffer> with size <size>
1266	* FIXME currently keeps a copy of the packet inside the trace pointer,
1267	* which in turn is stored inside the new packet object...
1268	* @author Perry Lorier
1269	*/
1270	struct libtrace_eventobj_t trace_event(struct libtrace_t *trace,
1271	struct libtrace_packet_t *packet) {
1272	struct libtrace_eventobj_t event;
1273
1274	if (!trace) {
1275	fprintf(stderr,"You called trace_event() with a NULL trace object!\n");
1276	}
1277	assert(trace);
1278	assert(packet);
1279
1280	/* Store the trace we are reading from into the packet opaque
1281	* structure */
1282	packet->trace = trace;
1283
1284	/* Is there a packet ready? */
1285	switch (trace->sourcetype) {
1286	#if HAVE_PCAP
1287	case INTERFACE:
1288	{
1289	int data;
1290	event.fd = pcap_fileno(trace->input.pcap);
1291	if(ioctl(event.fd,FIONREAD,&data)==-1){
1292	perror("ioctl(FIONREAD)");
1293	}
1294	if (data>0) {
1295	trace_read_packet(trace,packet);
1296	event.type = TRACE_EVENT_PACKET;
1297	return event;
1298	}
1299	event.type = TRACE_EVENT_IOWAIT;
1300	return event;
1301	}
1302	#endif
1303	case SOCKET:
1304	case DEVICE:
1305	case RT:
1306	{
1307	int data;
1308	event.fd = trace->input.fd;
1309	if(ioctl(event.fd,FIONREAD,&data)==-1){
1310	perror("ioctl(FIONREAD)");
1311	}
1312	if (data>0) {
1313	trace_read_packet(trace,packet);
1314	event.type = TRACE_EVENT_PACKET;
1315	return event;
1316	}
1317	event.type = TRACE_EVENT_IOWAIT;
1318	return event;
1319	}
1320	case STDIN:
1321	case TRACE:
1322	{
1323	double ts;
1324	/* "Prime" the pump */
1325	if (!trace->packet.buffer) {
1326	trace->packet.buffer = malloc(4096);
1327	trace->packet.size=
1328	trace_read_packet(trace,packet);
1329	}
1330	ts=trace_get_seconds(packet);
1331	if (trace->last_ts!=0) {
1332	event.seconds = ts - trace->last_ts;
1333	if (event.seconds>time(NULL)-trace->start_ts) {
1334	event.type = TRACE_EVENT_SLEEP;
1335	return event;
1336	}
1337
1338	}
1339	else {
1340	trace->start_ts = time(NULL);
1341	trace->last_ts = ts;
1342	}
1343
1344	packet->size = trace->packet.size;
1345	memcpy(packet->buffer,trace->packet.buffer,trace->packet.size);
1346
1347	free(trace->packet.buffer);
1348	trace->packet.buffer = 0;
1349	event.type = TRACE_EVENT_PACKET;
1350	return event;
1351	}
1352	default:
1353	assert(0);
1354	}
1355	assert(0);
1356	}
1357
1358	/** setup a BPF filter
1359	* @param filterstring a char * containing the bpf filter string
1360	* @returns opaque pointer pointer to a libtrace_filter_t object
1361	* @author Daniel Lawson
1362	*/
1363	struct libtrace_filter_t trace_bpf_setfilter(const char filterstring) {
1364	#if HAVE_BPF
1365	struct libtrace_filter_t *filter = malloc(sizeof(struct libtrace_filter_t));
1366	filter->filterstring = strdup(filterstring);
1367	filter->filter = 0;
1368	return filter;
1369	#else
1370	fprintf(stderr,"This version of libtrace does not have bpf filter support\n");
1371	return 0;
1372	#endif
1373	}
1374
1375	/** apply a BPF filter
1376	* @param libtrace the libtrace opaque pointer
1377	* @param filter the filter opaque pointer
1378	* @param buffer a pointer to a filled buffer
1379	* @param buflen the length of the buffer
1380	* @returns 0 if the filter fails, 1 if it succeeds
1381	* @author Daniel Lawson
1382	*/
1383	int trace_bpf_filter(struct libtrace_filter_t *filter,
1384	struct libtrace_packet_t *packet) {
1385	#if HAVE_BPF
1386	void *linkptr = 0;
1387	int clen = 0;
1388	assert(filter);
1389	assert(packet);
1390	linkptr = trace_get_link(packet);
1391	assert(linkptr);
1392	clen = trace_get_capture_length(packet);
1393
1394
1395	if (filter->filterstring && ! filter->filter) {
1396	pcap_t *pcap;
1397	struct bpf_program bpfprog;
1398
1399	switch (trace_get_link_type(packet)) {
1400	case TRACE_TYPE_ETH:
1401	pcap = pcap_open_dead(DLT_EN10MB, 1500);
1402	break;
1403	default:
1404	printf("only works for ETH at the moment\n");
1405	assert(0);
1406	}
1407
1408	// build filter
1409	if (pcap_compile( pcap, &bpfprog, filter->filterstring, 1, 0)) {
1410	printf("bpf compilation error: %s\n",
1411	pcap_geterr(pcap));
1412	assert(0);
1413	}
1414	pcap_close(pcap);
1415	filter->filter = bpfprog.bf_insns;
1416	}
1417
1418	assert(filter->filter);
1419	return bpf_filter(filter->filter, linkptr, clen, clen);
1420	#else
1421	fprintf(stderr,"This version of libtrace does not have bpf filter support\n");
1422	return 0;
1423	#endif
1424	}
1425
1426	/** Set the direction flag, if it has one
1427	* @param packet the packet opaque pointer
1428	* @param direction the new direction (0,1,2,3)
1429	* @returns a signed value containing the direction flag, or -1 if this is not supported
1430	* @author Daniel Lawson
1431	*/
1432	int8_t trace_set_direction(struct libtrace_packet_t *packet, int8_t direction) {
1433
1434	dag_record_t *erfptr = 0;
1435	assert(packet);
1436
1437	switch(packet->trace->format) {
1438	case DAG:
1439	case ERF:
1440	case RTCLIENT:
1441	erfptr = (dag_record_t *)packet->buffer;
1442	erfptr->flags.iface = direction;
1443	break;
1444	default:
1445	direction = -1;
1446	}
1447
1448	return direction;
1449
1450
1451	}
1452
1453	/** Get the direction flag, if it has one
1454	* @param libtrace the libtrace opaque pointer
1455	* @param buffer a point to a fille in buffer
1456	* @param buflen the length of the buffer
1457	* @returns a signed value containing the direction flag, or -1 if this is not supported
1458	* @author Daniel Lawson
1459	*/
1460	int8_t trace_get_direction(struct libtrace_packet_t *packet) {
1461
1462	int8_t direction;
1463	dag_record_t *erfptr = 0;
1464	assert(packet);
1465
1466	switch(packet->trace->format) {
1467	case DAG:
1468	case ERF:
1469	case RTCLIENT:
1470	erfptr = (dag_record_t *)packet->buffer;
1471	direction = erfptr->flags.iface;
1472	break;
1473	default:
1474	direction = -1;
1475	}
1476
1477	return direction;
1478
1479
1480	}
1481
1482
1483	/** Attempt to deduce the 'server' port
1484	* @param protocol the IP protocol (eg, 6 or 17 for TCP or UDP)
1485	* @param source the TCP or UDP source port
1486	* @param dest the TCP or UDP destination port
1487	* @returns a hint as to which port is the server port
1488	* @author Daniel Lawson
1489	*/
1490	#define ROOT_SERVER(x) ((x) < 512)
1491	#define ROOT_CLIENT(x) ((512 <= (x)) && ((x) < 1024))
1492	#define NONROOT_SERVER(x) ((x) >= 5000)
1493	#define NONROOT_CLIENT(x) ((1024 <= (x)) && ((x) < 5000))
1494	#define DYNAMIC(x) ((49152 < (x)) && ((x) < 65535))
1495	#define SERVER(x) ROOT_SERVER(x) \|\| NONROOT_SERVER(x)
1496	#define CLIENT(x) ROOT_CLIENT(x) \|\| NONROOT_CLIENT(x)
1497
1498	int8_t trace_get_server_port(uint8_t protocol, uint16_t source, uint16_t dest) {
1499	/*
1500	* * If the ports are equal, return DEST
1501	* * Check for well-known ports in the given protocol
1502	* * Root server ports: 0 - 511
1503	* * Root client ports: 512 - 1023
1504	* * non-root client ports: 1024 - 4999
1505	* * non-root server ports: 5000+
1506	* * Check for static ranges: 1024 - 49151
1507	* * Check for dynamic ranges: 49152 - 65535
1508	* * flip a coin.
1509	*/
1510
1511	uint16_t server, client;
1512
1513	/* equal */
1514	if (source == client)
1515	return USE_DEST;
1516
1517	/* root server port, 0 - 511 */
1518	if (ROOT_SERVER(source) && ROOT_SERVER(dest)) {
1519	if (source < dest)
1520	return USE_SOURCE;
1521	return USE_DEST;
1522	}
1523
1524	if (ROOT_SERVER(source) && !ROOT_SERVER(dest))
1525	return USE_SOURCE;
1526	if (!ROOT_SERVER(source) && ROOT_SERVER(dest))
1527	return USE_DEST;
1528
1529	/* non-root server */
1530	if (NONROOT_SERVER(source) && NONROOT_SERVER(dest)) {
1531	if (source < dest)
1532	return USE_SOURCE;
1533	return USE_DEST;
1534	}
1535	if (NONROOT_SERVER(source) && !NONROOT_SERVER(dest))
1536	return USE_SOURCE;
1537	if (!NONROOT_SERVER(source) && NONROOT_SERVER(dest))
1538	return USE_DEST;
1539
1540	/* root client */
1541	if (ROOT_CLIENT(source) && ROOT_CLIENT(dest)) {
1542	if (source < dest)
1543	return USE_SOURCE;
1544	return USE_DEST;
1545	}
1546	if (ROOT_CLIENT(source) && !ROOT_CLIENT(dest)) {
1547	/* prefer root-client over nonroot-client */
1548	if (NONROOT_CLIENT(dest))
1549	return USE_SOURCE;
1550	return USE_DEST;
1551	}
1552	if (!ROOT_CLIENT(source) && ROOT_CLIENT(dest)) {
1553	/* prefer root-client over nonroot-client */
1554	if (NONROOT_CLIENT(source))
1555	return USE_DEST;
1556	return USE_SOURCE;
1557	}
1558
1559	/* nonroot client */
1560	if (NONROOT_CLIENT(source) && NONROOT_CLIENT(dest)) {
1561	if (source < dest)
1562	return USE_SOURCE;
1563	return USE_DEST;
1564	}
1565	if (NONROOT_CLIENT(source) && !NONROOT_CLIENT(dest))
1566	return USE_DEST;
1567	if (!NONROOT_CLIENT(source) && NONROOT_CLIENT(dest))
1568	return USE_SOURCE;
1569
1570	/* dynamic range */
1571	if (DYNAMIC(source) && DYNAMIC(dest))
1572	if (source < dest)
1573	return USE_SOURCE;
1574	return USE_DEST;
1575	if (DYNAMIC(source) && !DYNAMIC(dest))
1576	return USE_DEST;
1577	if (!DYNAMIC(source) && DYNAMIC(dest))
1578	return USE_SOURCE;
1579	/*
1580	if (SERVER(source) && CLIENT(dest))
1581	return USE_SOURCE;
1582
1583	if (SERVER(dest) && CLIENT(source))
1584	return USE_DEST;
1585	if (ROOT_SERVER(source) && !ROOT_SERVER(dest))
1586	return USE_SOURCE;
1587	if (ROOT_SERVER(dest) && !ROOT_SERVER(source))
1588	return USE_DEST;
1589	*/
1590	// failing that test...
1591	if (source < dest) {
1592	return USE_SOURCE;
1593	}
1594	return USE_DEST;
1595
1596	}
1597
1598	/** Truncate the packet at the suggested length
1599	* @param packet the packet opaque pointer
1600	* @param len the new length of the packet
1601	* @returns the new length of the packet, or the original length of the
1602	* packet if unchanged
1603	* NOTE: len refers to the network-level payload of the packet, and not
1604	* any capture headers included as well. For example, to truncate a packet
1605	* after the IP header, set scan to sizeof(ethernet_header) + sizeof(ip_header)
1606	* @author Daniel Lawson
1607	*/
1608	size_t trace_truncate_packet(struct libtrace_packet_t *packet, size_t size) {
1609	dag_record_t *erfptr;
1610	#if HAVE_PCAP
1611	struct pcap_pkthdr *pcaphdr;
1612	#endif
1613
1614	assert(packet);
1615
1616	if (size > packet->size) {
1617	// can't make a packet larger
1618	return packet->size;
1619	}
1620	switch (packet->trace->format) {
1621	#if HAVE_PCAP
1622	case PCAPINT:
1623	case PCAP:
1624	pcaphdr = (struct pcap_pkthdr *)packet->buffer;
1625	pcaphdr->caplen = size + sizeof(struct pcap_pkthdr);
1626	packet->size = pcaphdr->caplen;
1627	break;
1628	#endif
1629	case ERF:
1630	case DAG:
1631	case RTCLIENT:
1632	erfptr = (dag_record_t *)packet->buffer;
1633	erfptr->rlen = ntohs(size + sizeof(dag_record_t));
1634	packet->size = size + sizeof(dag_record_t);
1635	break;
1636	case WAGINT:
1637	case WAG:
1638	// don't know how to do this?
1639	break;
1640	}
1641	return packet->size;
1642	}
1643

Note: See TracBrowser for help on using the repository browser.

Download in other formats: