2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 * Author : Boris Mikhailenko <stg34@stg.dp.ua>
27 $Date: 2009/03/24 11:20:15 $
31 #include "ether_cap.h"
33 #include "stg/common.h"
34 #include "stg/raw_ip_packet.h"
35 #include "stg/traffcounter.h"
43 #include <sys/types.h>
45 #include <sys/socket.h>
47 #include <sys/ioctl.h>
52 #include <netinet/in.h>
53 #include <arpa/inet.h>
59 extern "C" Plugin* GetPlugin()
61 static BPF_CAP plugin;
64 //-----------------------------------------------------------------------------
65 //-----------------------------------------------------------------------------
66 //-----------------------------------------------------------------------------
67 int BPF_CAP_SETTINGS::ParseSettings(const MODULE_SETTINGS & s)
69 iface.erase(iface.begin(), iface.end());
71 if (s.moduleParams.empty())
73 errorStr = "Parameter \'iface\' not found.";
74 printfd(__FILE__, "Parameter 'iface' not found\n");
78 for (unsigned i = 0; i < s.moduleParams.size(); i++)
80 if (s.moduleParams[i].param != "iface")
82 errorStr = "Parameter \'" + s.moduleParams[i].param + "\' unrecognized.";
83 printfd(__FILE__, "Invalid parameter: '%s'\n", s.moduleParams[i].param.c_str());
86 for (unsigned j = 0; j < s.moduleParams[i].value.size(); j++)
88 iface.push_back(s.moduleParams[i].value[j]);
94 //-----------------------------------------------------------------------------
95 std::string BPF_CAP_SETTINGS::GetIface(unsigned int num)
97 if (num >= iface.size())
103 //-----------------------------------------------------------------------------
104 //-----------------------------------------------------------------------------
105 //-----------------------------------------------------------------------------
106 std::string BPF_CAP::GetVersion() const
108 return "cap_bpf v.1.0";
110 //-----------------------------------------------------------------------------
116 logger(PluginLogger::get("cap_bpf"))
119 //-----------------------------------------------------------------------------
120 int BPF_CAP::ParseSettings()
122 int ret = capSettings.ParseSettings(settings);
125 errorStr = capSettings.GetStrError();
130 //-----------------------------------------------------------------------------
136 if (BPFCapOpen() < 0)
138 //errorStr = "Cannot open bpf device!";
144 if (pthread_create(&thread, NULL, Run, this))
146 errorStr = "Cannot create thread.";
147 logger("Cannot create thread.");
148 printfd(__FILE__, "Cannot create thread\n");
154 //-----------------------------------------------------------------------------
164 //5 seconds to thread stops itself
166 for (i = 0; i < 25; i++)
171 struct timespec ts = {0, 200000000};
172 nanosleep(&ts, NULL);
175 //after 5 seconds waiting thread still running. now killing it
178 //TODO pthread_cancel()
179 if (pthread_kill(thread, SIGINT))
181 errorStr = "Cannot kill thread.";
182 logger("Cannot send signal to thread.");
183 printfd(__FILE__, "Cannot kill thread\n");
190 //-----------------------------------------------------------------------------
191 void * BPF_CAP::Run(void * d)
194 sigfillset(&signalSet);
195 pthread_sigmask(SIG_BLOCK, &signalSet, NULL);
197 BPF_CAP * dc = static_cast<BPF_CAP *>(d);
198 dc->isRunning = true;
200 uint8_t hdr[96]; //68 + 14 + 4(size) + 9(SYS_IFACE) + 1(align to 4) = 96
202 RAW_PACKET * rpp = (RAW_PACKET *)&hdr[14];
203 memset(hdr, 0, sizeof(hdr));
210 if (dc->BPFCapRead((char*)&hdr, 68 + 14, &iface))
213 if (!(hdr[12] == 0x8 && hdr[13] == 0x0))
216 dc->traffCnt->Process(*rpp);
219 dc->isRunning = false;
222 //-----------------------------------------------------------------------------
223 int BPF_CAP::BPFCapOpen()
229 while ((bd.iface = capSettings.GetIface(i)) != "")
231 bpfData.push_back(bd);
232 if (BPFCapOpen(&bpfData[i]) < 0)
238 pd.fd = bpfData[i].fd;
245 //-----------------------------------------------------------------------------
246 int BPF_CAP::BPFCapOpen(BPF_DATA * bd)
256 sprintf(devbpf, "/dev/bpf%d", i);
258 bd->fd = open(devbpf, O_RDONLY);
259 } while(bd->fd < 0 && errno == EBUSY);
263 errorStr = "Can't capture packets. Open bpf device for " + bd->iface + " error.";
264 logger("Cannot open device for interface '%s': %s", bd->iface.c_str(), strerror(errno));
265 printfd(__FILE__, "Cannot open BPF device\n");
269 strncpy(ifr.ifr_name, bd->iface.c_str(), sizeof(ifr.ifr_name));
271 if (ioctl(bd->fd, BIOCSBLEN, (caddr_t)&l) < 0)
273 errorStr = bd->iface + " BIOCSBLEN " + std::string(strerror(errno));
274 logger("ioctl (BIOCSBLEN) error for interface '%s': %s", bd->iface.c_str(), strerror(errno));
275 printfd(__FILE__, "ioctl failed: '%s'\n", errorStr.c_str());
279 if (ioctl(bd->fd, BIOCSETIF, (caddr_t)&ifr) < 0)
281 errorStr = bd->iface + " BIOCSETIF " + std::string(strerror(errno));
282 logger("ioctl (BIOCSETIF) error for interface '%s': %s", bd->iface.c_str(), strerror(errno));
283 printfd(__FILE__, "ioctl failed: '%s'\n", errorStr.c_str());
287 if (ioctl(bd->fd, BIOCIMMEDIATE, &im) < 0)
289 errorStr = bd->iface + " BIOCIMMEDIATE " + std::string(strerror(errno));
290 logger("ioctl (BIOCIMMEDIATE) error for interface '%s': %s", bd->iface.c_str(), strerror(errno));
291 printfd(__FILE__, "ioctl failed: '%s'\n", errorStr.c_str());
297 //-----------------------------------------------------------------------------
298 int BPF_CAP::BPFCapClose()
300 for (unsigned int i = 0; i < bpfData.size(); i++)
301 close(bpfData[i].fd);
304 //-----------------------------------------------------------------------------
305 int BPF_CAP::BPFCapRead(char * buffer, int blen, char ** capIface)
307 poll(&polld[0], polld.size(), -1);
309 for (unsigned int i = 0; i < polld.size(); i++)
311 if (polld[i].revents & POLLIN)
313 if (BPFCapRead(buffer, blen, capIface, &bpfData[i]))
315 polld[i].revents = 0;
318 polld[i].revents = 0;
324 //-----------------------------------------------------------------------------
325 int BPF_CAP::BPFCapRead(char * buffer, int blen, char **, BPF_DATA * bd)
329 bd->r = read(bd->fd, bd->buffer, BUFF_LEN);
332 logger("read error: %s", strerror(errno));
333 struct timespec ts = {0, 20000000};
334 nanosleep(&ts, NULL);
339 bd->bh = (struct bpf_hdr*)bd->p;
345 memcpy(buffer, (char*)(bd->p) + bd->bh->bh_hdrlen, blen);
347 bd->sum += BPF_WORDALIGN(bd->bh->bh_hdrlen + bd->bh->bh_caplen);
348 bd->p = bd->p + BPF_WORDALIGN(bd->bh->bh_hdrlen + bd->bh->bh_caplen);
349 bd->bh = (struct bpf_hdr*)bd->p;
360 //-----------------------------------------------------------------------------