Adding upstream version 2.0.0+debian.
Signed-off-by: Daniel Baumann <daniel@debian.org>
This commit is contained in:
parent
65eb8bc08a
commit
1cf0d30d41
GPG key ID:
FBB4F0E80A80222F
191 changed files with 48816 additions and 0 deletions
22
plugins/pcapdump/Makefile.am
Normal file
22
plugins/pcapdump/Makefile.am
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
|
||||
CLEANFILES = *.gcda *.gcno *.gcov
|
||||
|
||||
AM_CFLAGS = -I$(srcdir) \
|
||||
-I$(top_srcdir)/src \
|
||||
-I$(top_srcdir)/isc \
|
||||
$(SECCOMPFLAGS)
|
||||
|
||||
pkglib_LTLIBRARIES = pcapdump.la
|
||||
pcapdump_la_SOURCES = pcapdump.c
|
||||
pcapdump_la_LDFLAGS = -module -avoid-version
|
||||
|
||||
TESTS = test1.sh
|
||||
EXTRA_DIST = $(TESTS)
|
||||
CLEANFILES += test1.out* *.pcap-dist
|
||||
|
||||
if ENABLE_GCOV
|
||||
gcov-local:
|
||||
for src in $(pcapdump_la_SOURCES); do \
|
||||
gcov -o .libs -l -r -s "$(srcdir)" "$$src"; \
|
||||
done
|
||||
endif
|
||||
262
plugins/pcapdump/pcapdump.c
Normal file
262
plugins/pcapdump/pcapdump.c
Normal file
|
|
@ -0,0 +1,262 @@
|
|||
/*
|
||||
* Copyright (c) 2016-2021, OARC, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. Neither the name of the copyright holder nor the names of its
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#define _GNU_SOURCE
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
#include <pcap.h>
|
||||
#include <stdarg.h>
|
||||
#include <errno.h>
|
||||
#include <assert.h>
|
||||
#include <sys/wait.h>
|
||||
#include <netinet/in.h>
|
||||
#include <arpa/inet.h>
|
||||
#include <arpa/nameser.h>
|
||||
|
||||
#if HAVE_ARPA_NAMESER_COMPAT_H
|
||||
#include <arpa/nameser_compat.h>
|
||||
#endif
|
||||
|
||||
#include "dnscap_common.h"
|
||||
|
||||
#define SNAPLEN 65536
|
||||
#define THOUSAND 1000
|
||||
#define MILLION (THOUSAND * THOUSAND)
|
||||
|
||||
output_t pcapdump_output;
|
||||
|
||||
static logerr_t* logerr = 0;
|
||||
char* dump_base = 0;
|
||||
static int to_stdout = 0;
|
||||
static int dbg_lvl = 0;
|
||||
static char* dumpname = 0;
|
||||
static char* dumpnamepart = 0;
|
||||
static pcap_t* pcap_dead = 0;
|
||||
static pcap_dumper_t* dumper = 0;
|
||||
static char* kick_cmd = 0;
|
||||
static int flush = 0;
|
||||
static int dir_wanted = DIR_INITIATE | DIR_RESPONSE;
|
||||
|
||||
void pcapdump_usage()
|
||||
{
|
||||
fprintf(stderr,
|
||||
"\npcapdump.so options:\n"
|
||||
"\t-? print these instructions and exit\n"
|
||||
"\t-d increase debugging\n"
|
||||
"\t-f flush output on every packet\n"
|
||||
"\t-k <cmd> kick off <cmd> when each dump closes\n"
|
||||
"\t-s [ir] select sides: initiations, responses\n"
|
||||
"\t-w <base> dump to <base>.<timesec>.<timeusec>\n");
|
||||
}
|
||||
|
||||
void pcapdump_getopt(int* argc, char** argv[])
|
||||
{
|
||||
int c;
|
||||
int u;
|
||||
const char* p;
|
||||
while ((c = getopt(*argc, *argv, "?dfk:s:w:")) != EOF) {
|
||||
switch (c) {
|
||||
case 'd':
|
||||
dbg_lvl++;
|
||||
break;
|
||||
case 'f':
|
||||
flush = 1;
|
||||
break;
|
||||
case 'k':
|
||||
if (kick_cmd)
|
||||
free(kick_cmd);
|
||||
kick_cmd = strdup(optarg);
|
||||
break;
|
||||
case 's':
|
||||
u = 0;
|
||||
for (p = optarg; *p; p++)
|
||||
switch (*p) {
|
||||
case 'i':
|
||||
u |= DIR_INITIATE;
|
||||
break;
|
||||
case 'r':
|
||||
u |= DIR_RESPONSE;
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "-s takes only [ir]\n");
|
||||
pcapdump_usage();
|
||||
break;
|
||||
}
|
||||
dir_wanted = u;
|
||||
break;
|
||||
case 'w':
|
||||
if (!strcmp(optarg, "-"))
|
||||
to_stdout = 1;
|
||||
else {
|
||||
if (dump_base)
|
||||
free(dump_base);
|
||||
dump_base = strdup(optarg);
|
||||
}
|
||||
break;
|
||||
case '?':
|
||||
pcapdump_usage();
|
||||
if (!optopt || optopt == '?') {
|
||||
exit(0);
|
||||
}
|
||||
// fallthrough
|
||||
default:
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
if (!to_stdout && !dump_base) {
|
||||
fprintf(stderr, "-w basename argument is required\n");
|
||||
pcapdump_usage();
|
||||
exit(1);
|
||||
}
|
||||
if (to_stdout && kick_cmd) {
|
||||
fprintf(stderr, "Can't use -k when dumping to stdout\n");
|
||||
pcapdump_usage();
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
int pcapdump_start(logerr_t* a_logerr)
|
||||
{
|
||||
logerr = a_logerr;
|
||||
pcap_dead = pcap_open_dead(DLT_RAW, SNAPLEN);
|
||||
return 0;
|
||||
}
|
||||
|
||||
void pcapdump_stop()
|
||||
{
|
||||
pcap_close(pcap_dead);
|
||||
pcap_dead = 0;
|
||||
}
|
||||
|
||||
int pcapdump_open(my_bpftimeval ts)
|
||||
{
|
||||
const char* t = NULL;
|
||||
if (to_stdout) {
|
||||
t = "-";
|
||||
} else {
|
||||
char sbuf[64];
|
||||
struct tm tm;
|
||||
while (ts.tv_usec >= MILLION) {
|
||||
ts.tv_sec++;
|
||||
ts.tv_usec -= MILLION;
|
||||
}
|
||||
gmtime_r((time_t*)&ts.tv_sec, &tm);
|
||||
strftime(sbuf, 64, "%Y%m%d.%H%M%S", &tm);
|
||||
if (asprintf(&dumpname, "%s.%s.%06lu",
|
||||
dump_base, sbuf, (u_long)ts.tv_usec)
|
||||
< 0
|
||||
|| asprintf(&dumpnamepart, "%s.part", dumpname) < 0) {
|
||||
logerr("asprintf: %s", strerror(errno));
|
||||
return 1;
|
||||
}
|
||||
t = dumpnamepart;
|
||||
}
|
||||
dumper = pcap_dump_open(pcap_dead, t);
|
||||
if (dumper == NULL) {
|
||||
logerr("pcap dump open: %s", pcap_geterr(pcap_dead));
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int pcapdump_close(my_bpftimeval ts)
|
||||
{
|
||||
int ret = 0;
|
||||
#if 0
|
||||
if (print_pcap_stats)
|
||||
do_pcap_stats();
|
||||
#endif
|
||||
pcap_dump_close(dumper);
|
||||
dumper = 0;
|
||||
if (to_stdout) {
|
||||
assert(dumpname == 0);
|
||||
assert(dumpnamepart == 0);
|
||||
if (dbg_lvl >= 1)
|
||||
logerr("breaking");
|
||||
ret = 0;
|
||||
} else {
|
||||
char* cmd = NULL;
|
||||
if (dbg_lvl >= 1)
|
||||
logerr("closing %s", dumpname);
|
||||
if (rename(dumpnamepart, dumpname)) {
|
||||
logerr("rename: %s", strerror(errno));
|
||||
return 1;
|
||||
}
|
||||
if (kick_cmd != NULL)
|
||||
if (asprintf(&cmd, "%s %s &", kick_cmd, dumpname) < 0) {
|
||||
logerr("asprintf: %s", strerror(errno));
|
||||
cmd = NULL;
|
||||
}
|
||||
free(dumpnamepart);
|
||||
dumpnamepart = NULL;
|
||||
free(dumpname);
|
||||
dumpname = NULL;
|
||||
if (cmd != NULL) {
|
||||
int x = system(cmd);
|
||||
if (x) {
|
||||
logerr("system %s returned %d", cmd, x);
|
||||
}
|
||||
free(cmd);
|
||||
}
|
||||
if (kick_cmd == NULL)
|
||||
ret = 0;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
void pcapdump_output(const char* descr, iaddr from, iaddr to, uint8_t proto, unsigned flags,
|
||||
unsigned sport, unsigned dport, my_bpftimeval ts,
|
||||
const u_char* pkt_copy, const unsigned olen, const u_char* payload, const unsigned payloadlen)
|
||||
{
|
||||
struct pcap_pkthdr h;
|
||||
if (flags & DNSCAP_OUTPUT_ISLAYER)
|
||||
return;
|
||||
if (flags & DNSCAP_OUTPUT_ISDNS) {
|
||||
HEADER* dns = (HEADER*)payload;
|
||||
if (0 == dns->qr && 0 == (dir_wanted & DIR_INITIATE))
|
||||
return;
|
||||
if (1 == dns->qr && 0 == (dir_wanted & DIR_RESPONSE))
|
||||
return;
|
||||
}
|
||||
memset(&h, 0, sizeof h);
|
||||
h.ts = ts;
|
||||
h.len = h.caplen = olen;
|
||||
pcap_dump((u_char*)dumper, &h, pkt_copy);
|
||||
if (flush)
|
||||
pcap_dump_flush(dumper);
|
||||
}
|
||||
16
plugins/pcapdump/test1.sh
Executable file
16
plugins/pcapdump/test1.sh
Executable file
|
|
@ -0,0 +1,16 @@
|
|||
#!/bin/sh -xe
|
||||
|
||||
plugin=`find . -name 'pcapdump.so' | head -n 1`
|
||||
if [ -z "$plugin" ]; then
|
||||
echo "Unable to find the pcapdump plugin"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ln -fs "$srcdir/../../src/test/dns.pcap" dns.pcap-dist
|
||||
|
||||
../../src/dnscap -r dns.pcap-dist -g -P "$plugin" -?
|
||||
../../src/dnscap -r dns.pcap-dist -g -P "$plugin" -dddd -w test1.out
|
||||
../../src/dnscap -r dns.pcap-dist -g -P "$plugin" -dddd -f -w test1.out
|
||||
../../src/dnscap -r dns.pcap-dist -g -P "$plugin" -dddd -s r -w test1.out
|
||||
../../src/dnscap -r dns.pcap-dist -g -P "$plugin" -dddd -s i -w test1.out
|
||||
! ../../src/dnscap -r dns.pcap-dist -g -P "$plugin" -X
|
||||
Loading…
Add table
Add a link
Reference in a new issue