Changeset 265d6a5

Timestamp:

06/27/14 14:24:47 (6 years ago)

Author:

Shane Alcock <salcock@…>

Branches:

4.0.1-hotfixes, cachetimestamps, develop, dpdk-ndag, etsilive, libtrace4, master, ndag_format, pfring, rc-4.0.1, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance, ringtimestampfixes

Children:

5a15b2f

Parents:

a63a913 (diff), e0bea4e5 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'getfragoff' into develop

Files:

• lib/libtrace.h.in (modified) (1 diff)
• lib/protocols_l3.c (modified) (1 diff)
• lib/protocols_transport.c (modified) (4 diffs)
• libwandio/iow-lzo.c (modified) (2 diffs)
• test/Makefile (modified) (1 diff)
• test/do-tests.sh (modified) (1 diff)
• test/test-fragment.c (added)
• test/test-ports.c (added)

lib/libtrace.h.in

@@ -1779 +1779 @@
                 uint16_t *csum);
 
+/** Calculates the fragment offset in bytes for an IP packet
+ * @param packet        The libtrace packet to calculate the offset for
+ * @param[out] more     A boolean flag to indicate whether there are more
+ *                      fragments after the current packet.
+ * @return The fragment offset for the packet in bytes. If the packet is not
+ * an IP packet or the fragment offset is not present in packet, the return
+ * value will be 0.
+ *
+ * @note The value returned is in bytes, not 8-octet units as it is stored
+ * in the fragment offset field in the headers. In other words, libtrace
+ * automatically does the multiplication for you.
+ *
+ * The value passed in for 'more' does not matter; it will be overwritten
+ * with the value of the More Fragments flag from the IP header.
+ *
+ * New in libtrace 3.0.20
+ */
+DLLEXPORT uint16_t trace_get_fragment_offset(const libtrace_packet_t *packet,
+                uint8_t *more); 
+
 /** Gets a pointer to the transport layer header (if any)
  * @param packet   The libtrace packet to find the transport header for

lib/protocols_l3.c

@@ -724 +724 @@
 }
 
+DLLEXPORT uint16_t trace_get_fragment_offset(const libtrace_packet_t *packet, 
+                uint8_t *more) {
+
+        void *l3;
+        uint16_t ethertype;
+        uint32_t remaining;
+
+        *more = 0;
+
+        l3 = trace_get_layer3(packet, &ethertype, &remaining);
+        if (l3 == NULL)
+                return 0;
+
+        if (ethertype == TRACE_ETHERTYPE_IP) {
+                libtrace_ip_t *ip = (libtrace_ip_t *)l3;
+                uint16_t offset = 0;
+
+                /* Fragment offset appears in 7th and 8th bytes */
+                if (remaining < 8)
+                        return 0;
+                 
+                offset = ntohs(ip->ip_off);
+
+                if ((offset & 0x2000) != 0)
+                        *more = 1;
+                return (offset & 0x1FFF) * 8;
+        }
+
+        if (ethertype == TRACE_ETHERTYPE_IPV6) {
+                libtrace_ip6_t *ip6 = (libtrace_ip6_t *)l3;
+                void *payload = ip6++;
+                uint8_t nxt = ip6->nxt;
+                uint16_t len;
+                
+                /* First task, find a Fragment header if present */
+                if (remaining < sizeof(libtrace_ip6_t))
+                        return 0;
+                remaining -= sizeof(libtrace_ip6_t);
+
+                /* Adapted from trace_get_payload_from_ip6 */
+                while (1) {
+                        switch (nxt) {
+                        case 0:
+                        case TRACE_IPPROTO_ROUTING:
+                        case TRACE_IPPROTO_AH: 
+                        case TRACE_IPPROTO_DSTOPTS: 
+                        {
+
+                                /* Length does not include the first 8 bytes */
+                                len=((libtrace_ip6_ext_t*)payload)->len * 8;
+                                len += 8;
+
+                                if (remaining < len) {
+                                        /* Snap too short */
+                                        return 0;
+                                }
+                                remaining-=len;
+
+                                nxt=((libtrace_ip6_ext_t*)payload)->nxt;
+                                continue;
+                        }
+                        case TRACE_IPPROTO_FRAGMENT:
+                        {
+                                libtrace_ip6_frag_t *frag = (libtrace_ip6_frag_t *)payload;
+                                uint16_t offset;
+                                len = sizeof(libtrace_ip6_frag_t);
+                                if (remaining < len) {
+                                        /* Snap too short */
+                                        return 0;
+                                }
+                                remaining-=len;
+
+                                offset = ntohs(frag->frag_off);
+                                if ((offset & 0x0001) != 0) 
+                                        *more = 1;
+
+                                return ((offset & 0xFFF8) >> 3) * 8;
+                         }
+                         default:
+                                return 0;
+                         }
+                }
+
+        }
+        return 0;
+}

lib/protocols_transport.c

@@ -382 +382 @@
         uint32_t remaining;
         uint8_t proto;
-        const struct ports_t *port = 
-                (const struct ports_t*)trace_get_transport((libtrace_packet_t*)packet,
+        struct ports_t *port;
+        uint16_t fragoff;
+        uint8_t more;
+
+        fragoff = trace_get_fragment_offset(packet, &more);
+
+        /* If we're not the first fragment, we're unlikely to be able
+         * to get any useful port numbers from this packet.
+         */
+        if (fragoff != 0)
+                return 0;
+        
+        
+        port = (struct ports_t*)trace_get_transport(
+                        (libtrace_packet_t*)packet,
                         &proto, &remaining);
 
@@ -391 +404 @@
 
         /* ICMP *technically* doesn't have ports */
-        if (proto == TRACE_IPPROTO_ICMP)
+        if (proto == TRACE_IPPROTO_ICMP || proto == TRACE_IPPROTO_ICMPV6)
                 return 0;
 
@@ -405 +418 @@
         uint32_t remaining;
         uint8_t proto;
-        struct ports_t *port = 
-                (struct ports_t*)trace_get_transport((libtrace_packet_t*)packet,
+        struct ports_t *port;
+        uint16_t fragoff;
+        uint8_t more;
+
+        fragoff = trace_get_fragment_offset(packet, &more);
+
+        /* If we're not the first fragment, we're unlikely to be able
+         * to get any useful port numbers from this packet.
+         */
+        if (fragoff != 0)
+                return 0;
+        
+        
+        port = (struct ports_t*)trace_get_transport(
+                        (libtrace_packet_t*)packet,
                         &proto, &remaining);
         /* Snapped too early */
@@ -413 +439 @@
         
         /* ICMP *technically* doesn't have ports */
-        if (proto == TRACE_IPPROTO_ICMP)
+        if (proto == TRACE_IPPROTO_ICMP || proto == TRACE_IPPROTO_ICMPV6)
                 return 0;
 

libwandio/iow-lzo.c

@@ -274 +274 @@
 }
 
-iow_t *lzo_wopen(iow_t *child, int compress_level UNUSED)
+iow_t *lzo_wopen(iow_t *child, int compress_level)
 {
         const int opt_filter = 0;
@@ -290 +290 @@
                 return NULL;
         }
+
+        /* Compress level is useless for LZO, but getting UNUSED into here
+         * is more trouble than it is worth so this check will at least
+         * stop us from getting warnings about it.
+         */
+        if (compress_level < 0)
+                return NULL;
 
         iow = malloc(sizeof(iow_t));

test/Makefile

@@ -12 +12 @@
 
 BINS = test-pcap-bpf test-event test-time test-dir test-wireless test-errors \
-        test-plen test-autodetect 
+        test-plen test-autodetect test-ports test-fragment 
 
 .PHONY: all clean distclean install depend test

test/do-tests.sh

@@ -72 +72 @@
 echo \* Testing payload length
 do_test ./test-plen
+
+echo \* Testing port numbers
+do_test ./test-ports
+
+echo \* Testing fragment parsing
+do_test ./test-fragment
 
 echo \* Testing event framework