/* If netsniff-ngs in device is on a tap, it can efficiently filter out
* some interesting packets and give them to the out device for testing
* or debugging for instance. */
static void enter_mode_rx_to_tx(struct mode *mode)
{
int rx_sock, ifindex_in, ifindex_out;
unsigned int size_in, size_out, it_in = 0, it_out = 0;
unsigned long fcnt = 0;
uint8_t *in, *out;
short ifflags = 0;
struct frame_map *hdr_in, *hdr_out;
struct ring tx_ring;
struct ring rx_ring;
struct pollfd rx_poll;
struct sock_fprog bpf_ops;
if (!strncmp(mode->device_in, mode->device_out,
strlen(mode->device_in)))
panic("Ingress/egress devices must be different!\n");
if (!device_up_and_running(mode->device_out))
panic("Egress device not up and running!\n");
if (!device_up_and_running(mode->device_in))
panic("Ingress device not up and running!\n");
set_memcpy();
rx_sock = pf_socket();
tx_sock = pf_socket();
memset(&tx_ring, 0, sizeof(tx_ring));
memset(&rx_ring, 0, sizeof(rx_ring));
memset(&rx_poll, 0, sizeof(rx_poll));
memset(&bpf_ops, 0, sizeof(bpf_ops));
ifindex_in = device_ifindex(mode->device_in);
size_in = ring_size(mode->device_in, mode->reserve_size);
ifindex_out = device_ifindex(mode->device_out);
size_out = ring_size(mode->device_out, mode->reserve_size);
enable_kernel_bpf_jit_compiler();
bpf_parse_rules(mode->filter, &bpf_ops);
bpf_attach_to_sock(rx_sock, &bpf_ops);
setup_rx_ring_layout(rx_sock, &rx_ring, size_in, mode->jumbo_support);
create_rx_ring(rx_sock, &rx_ring);
mmap_rx_ring(rx_sock, &rx_ring);
alloc_rx_ring_frames(&rx_ring);
bind_rx_ring(rx_sock, &rx_ring, ifindex_in);
prepare_polling(rx_sock, &rx_poll);
set_packet_loss_discard(tx_sock);
setup_tx_ring_layout(tx_sock, &tx_ring, size_out, mode->jumbo_support);
create_tx_ring(tx_sock, &tx_ring);
mmap_tx_ring(tx_sock, &tx_ring);
alloc_tx_ring_frames(&tx_ring);
bind_tx_ring(tx_sock, &tx_ring, ifindex_out);
mt_init_by_seed_time();
dissector_init_all(mode->print_mode);
if (mode->promiscuous == true) {
ifflags = enter_promiscuous_mode(mode->device_in);
printf("PROMISC\n");
}
if (mode->kpull)
interval = mode->kpull;
itimer.it_interval.tv_sec = 0;
itimer.it_interval.tv_usec = interval;
itimer.it_value.tv_sec = 0;
itimer.it_value.tv_usec = interval;
setitimer(ITIMER_REAL, &itimer, NULL);
printf("BPF:\n");
bpf_dump_all(&bpf_ops);
printf("MD: RXTX %luus\n\n", interval);
printf("Running! Hang up with ^C!\n\n");
while (likely(sigint == 0)) {
while (user_may_pull_from_rx(rx_ring.frames[it_in].iov_base)) {
hdr_in = rx_ring.frames[it_in].iov_base;
in = ((uint8_t *) hdr_in) + hdr_in->tp_h.tp_mac;
fcnt++;
if (mode->packet_type != PACKET_ALL)
if (mode->packet_type != hdr_in->s_ll.sll_pkttype)
goto next;
hdr_out = tx_ring.frames[it_out].iov_base;
out = ((uint8_t *) hdr_out) + TPACKET_HDRLEN -
sizeof(struct sockaddr_ll);
/* If we cannot pull, look for a different slot. */
for (; !user_may_pull_from_tx(tx_ring.frames[it_out].iov_base) &&
likely(!sigint);) {
if (mode->randomize)
next_rnd_slot(&it_out, &tx_ring);
else
next_slot(&it_out, &tx_ring);
hdr_out = tx_ring.frames[it_out].iov_base;
out = ((uint8_t *) hdr_out) + TPACKET_HDRLEN -
sizeof(struct sockaddr_ll);
}
tpacket_hdr_clone(&hdr_out->tp_h, &hdr_in->tp_h);
__memcpy(out, in, hdr_in->tp_h.tp_len);
kernel_may_pull_from_tx(&hdr_out->tp_h);
if (mode->randomize)
next_rnd_slot(&it_out, &tx_ring);
else
next_slot(&it_out, &tx_ring);
/* Should actually be avoided ... */
show_frame_hdr(hdr_in, mode->print_mode, RING_MODE_INGRESS);
dissector_entry_point(in, hdr_in->tp_h.tp_snaplen,
mode->link_type);
if (frame_cnt_max != 0 && fcnt >= frame_cnt_max) {
sigint = 1;
break;
}
next:
kernel_may_pull_from_rx(&hdr_in->tp_h);
next_slot(&it_in, &rx_ring);
if (unlikely(sigint == 1))
goto out;
}
poll(&rx_poll, 1, -1);
poll_error_maybe_die(rx_sock, &rx_poll);
}
out:
sock_print_net_stats(rx_sock);
dissector_cleanup_all();
destroy_tx_ring(tx_sock, &tx_ring);
destroy_rx_ring(rx_sock, &rx_ring);
if (mode->promiscuous == true)
leave_promiscuous_mode(mode->device_in, ifflags);
close(tx_sock);
close(rx_sock);
}
static void receive_to_xmit(struct ctx *ctx)
{
short ifflags = 0;
uint8_t *in, *out;
int rx_sock, ifindex_in, ifindex_out;
unsigned int size_in, size_out, it_in = 0, it_out = 0;
unsigned long frame_count = 0;
struct frame_map *hdr_in, *hdr_out;
struct ring tx_ring, rx_ring;
struct pollfd rx_poll;
struct sock_fprog bpf_ops;
if (!strncmp(ctx->device_in, ctx->device_out, IFNAMSIZ))
panic("Ingress/egress devices must be different!\n");
if (!device_up_and_running(ctx->device_out))
panic("Egress device not up and running!\n");
rx_sock = pf_socket();
tx_sock = pf_socket();
fmemset(&tx_ring, 0, sizeof(tx_ring));
fmemset(&rx_ring, 0, sizeof(rx_ring));
fmemset(&rx_poll, 0, sizeof(rx_poll));
fmemset(&bpf_ops, 0, sizeof(bpf_ops));
ifindex_in = device_ifindex(ctx->device_in);
ifindex_out = device_ifindex(ctx->device_out);
size_in = ring_size(ctx->device_in, ctx->reserve_size);
size_out = ring_size(ctx->device_out, ctx->reserve_size);
enable_kernel_bpf_jit_compiler();
bpf_parse_rules(ctx->filter, &bpf_ops, ctx->link_type);
if (ctx->dump_bpf)
bpf_dump_all(&bpf_ops);
bpf_attach_to_sock(rx_sock, &bpf_ops);
setup_rx_ring_layout(rx_sock, &rx_ring, size_in, ctx->jumbo, false);
create_rx_ring(rx_sock, &rx_ring, ctx->verbose);
mmap_rx_ring(rx_sock, &rx_ring);
alloc_rx_ring_frames(rx_sock, &rx_ring);
bind_rx_ring(rx_sock, &rx_ring, ifindex_in);
prepare_polling(rx_sock, &rx_poll);
set_packet_loss_discard(tx_sock);
setup_tx_ring_layout(tx_sock, &tx_ring, size_out, ctx->jumbo);
create_tx_ring(tx_sock, &tx_ring, ctx->verbose);
mmap_tx_ring(tx_sock, &tx_ring);
alloc_tx_ring_frames(tx_sock, &tx_ring);
bind_tx_ring(tx_sock, &tx_ring, ifindex_out);
dissector_init_all(ctx->print_mode);
if (ctx->promiscuous)
ifflags = enter_promiscuous_mode(ctx->device_in);
if (ctx->kpull)
interval = ctx->kpull;
set_itimer_interval_value(&itimer, 0, interval);
setitimer(ITIMER_REAL, &itimer, NULL);
drop_privileges(ctx->enforce, ctx->uid, ctx->gid);
printf("Running! Hang up with ^C!\n\n");
fflush(stdout);
while (likely(sigint == 0)) {
while (user_may_pull_from_rx(rx_ring.frames[it_in].iov_base)) {
__label__ next;
hdr_in = rx_ring.frames[it_in].iov_base;
in = ((uint8_t *) hdr_in) + hdr_in->tp_h.tp_mac;
frame_count++;
if (ctx->packet_type != -1)
if (ctx->packet_type != hdr_in->s_ll.sll_pkttype)
goto next;
hdr_out = tx_ring.frames[it_out].iov_base;
out = ((uint8_t *) hdr_out) + TPACKET2_HDRLEN - sizeof(struct sockaddr_ll);
for (; !user_may_pull_from_tx(tx_ring.frames[it_out].iov_base) &&
likely(!sigint);) {
if (ctx->randomize)
next_rnd_slot(&it_out, &tx_ring);
else {
it_out++;
if (it_out >= tx_ring.layout.tp_frame_nr)
it_out = 0;
}
hdr_out = tx_ring.frames[it_out].iov_base;
out = ((uint8_t *) hdr_out) + TPACKET2_HDRLEN - sizeof(struct sockaddr_ll);
}
tpacket_hdr_clone(&hdr_out->tp_h, &hdr_in->tp_h);
fmemcpy(out, in, hdr_in->tp_h.tp_len);
kernel_may_pull_from_tx(&hdr_out->tp_h);
if (ctx->randomize)
next_rnd_slot(&it_out, &tx_ring);
else {
it_out++;
if (it_out >= tx_ring.layout.tp_frame_nr)
it_out = 0;
}
show_frame_hdr(hdr_in, ctx->print_mode);
dissector_entry_point(in, hdr_in->tp_h.tp_snaplen,
ctx->link_type, ctx->print_mode);
if (frame_count_max != 0) {
if (frame_count >= frame_count_max) {
sigint = 1;
break;
}
}
next:
kernel_may_pull_from_rx(&hdr_in->tp_h);
it_in++;
if (it_in >= rx_ring.layout.tp_frame_nr)
it_in = 0;
if (unlikely(sigint == 1))
goto out;
}
poll(&rx_poll, 1, -1);
}
out:
timer_purge();
sock_rx_net_stats(rx_sock, 0);
bpf_release(&bpf_ops);
dissector_cleanup_all();
destroy_tx_ring(tx_sock, &tx_ring);
destroy_rx_ring(rx_sock, &rx_ring);
if (ctx->promiscuous)
leave_promiscuous_mode(ctx->device_in, ifflags);
close(tx_sock);
close(rx_sock);
}
