X-Git-Url: https://git.stg.codes/stg.git/blobdiff_plain/8c6fa3fbaccc22127280bf77a48fab5a3ee0716e..46b0747592074017ff0ea4b33d4a7194235886e5:/stargazer/plugins/capture/ether_freebsd/ether_cap.cpp diff --git a/stargazer/plugins/capture/ether_freebsd/ether_cap.cpp b/stargazer/plugins/capture/ether_freebsd/ether_cap.cpp new file mode 100644 index 00000000..36159fed --- /dev/null +++ b/stargazer/plugins/capture/ether_freebsd/ether_cap.cpp @@ -0,0 +1,372 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* +Date: 18.09.2002 +*/ + +/* +* Author : Boris Mikhailenko +*/ + +/* +$Revision: 1.19 $ +$Date: 2009/03/24 11:20:15 $ +$Author: faust $ +*/ + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include + +#include "stg/common.h" +#include "stg/raw_ip_packet.h" +#include "stg/traffcounter.h" +#include "stg/plugin_creator.h" + +#include "ether_cap.h" + +//#define CAP_DEBUG 1 + +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +namespace +{ +PLUGIN_CREATOR bcc; +} + +extern "C" PLUGIN * GetPlugin(); +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +PLUGIN * GetPlugin() +{ +return bcc.GetPlugin(); +} +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +int BPF_CAP_SETTINGS::ParseSettings(const MODULE_SETTINGS & s) +{ +iface.erase(iface.begin(), iface.end()); + +if (s.moduleParams.empty()) + { + errorStr = "Parameter \'iface\' not found."; + printfd(__FILE__, "Parameter 'iface' not found\n"); + return -1; + } + +for (unsigned i = 0; i < s.moduleParams.size(); i++) + { + if (s.moduleParams[i].param != "iface") + { + errorStr = "Parameter \'" + s.moduleParams[i].param + "\' unrecognized."; + printfd(__FILE__, "Invalid parameter: '%s'\n", s.moduleParams[i].param.c_str()); + return -1; + } + for (unsigned j = 0; j < s.moduleParams[i].value.size(); j++) + { + iface.push_back(s.moduleParams[i].value[j]); + } + } + +return 0; +} +//----------------------------------------------------------------------------- +std::string BPF_CAP_SETTINGS::GetIface(unsigned int num) +{ +if (num >= iface.size()) + { + return ""; + } +return iface[num]; +} +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +//----------------------------------------------------------------------------- +std::string BPF_CAP::GetVersion() const +{ +return "cap_bpf v.1.0"; +} +//----------------------------------------------------------------------------- +BPF_CAP::BPF_CAP() + : nonstop(false), + isRunning(false), + capSock(-1), + traffCnt(NULL), + logger(GetPluginLogger(GetStgLogger(), "cap_bpf")) +{ +} +//----------------------------------------------------------------------------- +int BPF_CAP::ParseSettings() +{ +int ret = capSettings.ParseSettings(settings); +if (ret) + { + errorStr = capSettings.GetStrError(); + return ret; + } +return 0; +} +//----------------------------------------------------------------------------- +int BPF_CAP::Start() +{ +if (isRunning) + return 0; + +if (BPFCapOpen() < 0) + { + //errorStr = "Cannot open bpf device!"; + return -1; + } + +nonstop = true; + +if (pthread_create(&thread, NULL, Run, this)) + { + errorStr = "Cannot create thread."; + logger("Cannot create thread."); + printfd(__FILE__, "Cannot create thread\n"); + return -1; + } + +return 0; +} +//----------------------------------------------------------------------------- +int BPF_CAP::Stop() +{ +if (!isRunning) + return 0; + +BPFCapClose(); + +nonstop = false; + +//5 seconds to thread stops itself +int i; +for (i = 0; i < 25; i++) + { + if (!isRunning) + break; + + struct timespec ts = {0, 200000000}; + nanosleep(&ts, NULL); + } + +//after 5 seconds waiting thread still running. now killing it +if (isRunning) + { + //TODO pthread_cancel() + if (pthread_kill(thread, SIGINT)) + { + errorStr = "Cannot kill thread."; + logger("Cannot send signal to thread."); + printfd(__FILE__, "Cannot kill thread\n"); + return -1; + } + } + +return 0; +} +//----------------------------------------------------------------------------- +void * BPF_CAP::Run(void * d) +{ +sigset_t signalSet; +sigfillset(&signalSet); +pthread_sigmask(SIG_BLOCK, &signalSet, NULL); + +BPF_CAP * dc = static_cast(d); +dc->isRunning = true; + +uint8_t hdr[96]; //68 + 14 + 4(size) + 9(SYS_IFACE) + 1(align to 4) = 96 + +RAW_PACKET * rpp = (RAW_PACKET *)&hdr[14]; +memset(hdr, 0, sizeof(hdr)); + +rpp->dataLen = -1; +char * iface; + +while (dc->nonstop) + { + if (dc->BPFCapRead((char*)&hdr, 68 + 14, &iface)) + continue; + + if (!(hdr[12] == 0x8 && hdr[13] == 0x0)) + continue; + + dc->traffCnt->Process(*rpp); + } + +dc->isRunning = false; +return NULL; +} +//----------------------------------------------------------------------------- +int BPF_CAP::BPFCapOpen() +{ +int i = 0; +BPF_DATA bd; +pollfd pd; + +while ((bd.iface = capSettings.GetIface(i)) != "") + { + bpfData.push_back(bd); + if (BPFCapOpen(&bpfData[i]) < 0) + { + return -1; + } + + pd.events = POLLIN; + pd.fd = bpfData[i].fd; + polld.push_back(pd); + i++; + } + +return 0; +} +//----------------------------------------------------------------------------- +int BPF_CAP::BPFCapOpen(BPF_DATA * bd) +{ +char devbpf[20]; +int i = 0; +int l = BUFF_LEN; +int im = 1; +struct ifreq ifr; + +do + { + sprintf(devbpf, "/dev/bpf%d", i); + i++; + bd->fd = open(devbpf, O_RDONLY); + } while(bd->fd < 0 && errno == EBUSY); + +if (bd->fd < 0) + { + errorStr = "Can't capture packets. Open bpf device for " + bd->iface + " error."; + logger("Cannot open device for interface '%s': %s", bd->iface.c_str(), strerror(errno)); + printfd(__FILE__, "Cannot open BPF device\n"); + return -1; + } + +strncpy(ifr.ifr_name, bd->iface.c_str(), sizeof(ifr.ifr_name)); + +if (ioctl(bd->fd, BIOCSBLEN, (caddr_t)&l) < 0) + { + errorStr = bd->iface + " BIOCSBLEN " + std::string(strerror(errno)); + logger("ioctl (BIOCSBLEN) error for interface '%s': %s", bd->iface.c_str(), strerror(errno)); + printfd(__FILE__, "ioctl failed: '%s'\n", errorStr.c_str()); + return -1; + } + +if (ioctl(bd->fd, BIOCSETIF, (caddr_t)&ifr) < 0) + { + errorStr = bd->iface + " BIOCSETIF " + std::string(strerror(errno)); + logger("ioctl (BIOCSETIF) error for interface '%s': %s", bd->iface.c_str(), strerror(errno)); + printfd(__FILE__, "ioctl failed: '%s'\n", errorStr.c_str()); + return -1; + } + +if (ioctl(bd->fd, BIOCIMMEDIATE, &im) < 0) + { + errorStr = bd->iface + " BIOCIMMEDIATE " + std::string(strerror(errno)); + logger("ioctl (BIOCIMMEDIATE) error for interface '%s': %s", bd->iface.c_str(), strerror(errno)); + printfd(__FILE__, "ioctl failed: '%s'\n", errorStr.c_str()); + return -1; + } + +return bd->fd; +} +//----------------------------------------------------------------------------- +int BPF_CAP::BPFCapClose() +{ +for (unsigned int i = 0; i < bpfData.size(); i++) + close(bpfData[i].fd); +return 0; +} +//----------------------------------------------------------------------------- +int BPF_CAP::BPFCapRead(char * buffer, int blen, char ** capIface) +{ +poll(&polld[0], polld.size(), -1); + +for (unsigned int i = 0; i < polld.size(); i++) + { + if (polld[i].revents & POLLIN) + { + if (BPFCapRead(buffer, blen, capIface, &bpfData[i])) + { + polld[i].revents = 0; + continue; + } + polld[i].revents = 0; + return 0; + } + } +return -1; +} +//----------------------------------------------------------------------------- +int BPF_CAP::BPFCapRead(char * buffer, int blen, char **, BPF_DATA * bd) +{ +if (bd->canRead) + { + bd->r = read(bd->fd, bd->buffer, BUFF_LEN); + if (bd->r < 0) + { + logger("read error: %s", strerror(errno)); + struct timespec ts = {0, 20000000}; + nanosleep(&ts, NULL); + return -1; + } + + bd->p = bd->buffer; + bd->bh = (struct bpf_hdr*)bd->p; + bd->canRead = 0; + } + +if(bd->r > bd->sum) + { + memcpy(buffer, (char*)(bd->p) + bd->bh->bh_hdrlen, blen); + + bd->sum += BPF_WORDALIGN(bd->bh->bh_hdrlen + bd->bh->bh_caplen); + bd->p = bd->p + BPF_WORDALIGN(bd->bh->bh_hdrlen + bd->bh->bh_caplen); + bd->bh = (struct bpf_hdr*)bd->p; + } + +if(bd->r <= bd->sum) + { + bd->canRead = 1; + bd->sum = 0; + } + +return 0; +} +//-----------------------------------------------------------------------------