1 | /** |
---|
2 | * @file PCAPCapture.cpp |
---|
3 | * @author Tomas Urban |
---|
4 | * @version 0.4 |
---|
5 | * @date 23/07/2009 |
---|
6 | */ |
---|
7 | #include "PCAPCapture.h" |
---|
8 | #include <boost/thread/thread.hpp> |
---|
9 | #include <boost/tokenizer.hpp> |
---|
10 | #include "Logger/Logger.h" |
---|
11 | |
---|
12 | PCAPCapture::PCAPCapture() : |
---|
13 | m_fp(NULL), |
---|
14 | m_nHandleCount(0), |
---|
15 | m_bRunning(false), |
---|
16 | m_dumpFiles(0), |
---|
17 | m_threadRunning(0) |
---|
18 | { |
---|
19 | } |
---|
20 | |
---|
21 | PCAPCapture::~PCAPCapture() |
---|
22 | { |
---|
23 | CloseDevice(); |
---|
24 | } |
---|
25 | |
---|
26 | pcap_t * PCAPCapture::OpenPcapSource(const std::string sSource) |
---|
27 | { |
---|
28 | char errbuf[PCAP_ERRBUF_SIZE]; |
---|
29 | return pcap_open(sSource.c_str(), SNAP_LEN, PCAP_OPENFLAG_PROMISCUOUS, |
---|
30 | 1000, NULL, errbuf); |
---|
31 | } |
---|
32 | |
---|
33 | void PCAPCapture::CloseDevice() |
---|
34 | { |
---|
35 | if (m_fp != NULL) |
---|
36 | { |
---|
37 | StopCapture(); |
---|
38 | CloseCaptureFile(); |
---|
39 | for (int i = 0; i < m_nHandleCount; i++) |
---|
40 | pcap_close(m_fp[i]); |
---|
41 | delete m_fp; |
---|
42 | m_fp = NULL; |
---|
43 | m_threadRunning = NULL; |
---|
44 | m_nHandleCount = 0; |
---|
45 | } |
---|
46 | } |
---|
47 | void PCAPCapture::SetPcapHandles(pcap_t ** srcBuf, int nLen) |
---|
48 | { |
---|
49 | CloseDevice(); |
---|
50 | m_fp = new pcap_t*[nLen]; |
---|
51 | m_nHandleCount = nLen; |
---|
52 | memcpy(m_fp, srcBuf, nLen * sizeof(pcap_t*)); |
---|
53 | m_threadRunning = new bool[nLen]; |
---|
54 | memset(m_threadRunning, 0, nLen * sizeof(bool)); |
---|
55 | } |
---|
56 | |
---|
57 | void PCAPCapture::DispatcherHandler(u_char *temp1, |
---|
58 | const struct pcap_pkthdr *header, const u_char *pkt_data) |
---|
59 | { |
---|
60 | PCAPCapture::CapturingThread * pThread = reinterpret_cast<PCAPCapture::CapturingThread*>(temp1); |
---|
61 | PCAPCapture * pObj = pThread->m_pCapture; |
---|
62 | int nIndex = pThread->m_nHandleIndex; |
---|
63 | if (pObj->m_dumpFiles) |
---|
64 | { |
---|
65 | boost::mutex::scoped_lock lock(pObj->m_mutex); |
---|
66 | pcap_dump(reinterpret_cast <u_char*>(pObj->m_dumpFiles[nIndex]), header, pkt_data); |
---|
67 | } |
---|
68 | CapturedData cd; |
---|
69 | cd.SetData(header->caplen, reinterpret_cast <const char*> (pkt_data)); |
---|
70 | cd.SetTimestamp(header->ts); |
---|
71 | if (pObj->m_fp) |
---|
72 | pObj->ProcessCapturedData(&cd); |
---|
73 | } |
---|
74 | |
---|
75 | PCAPCapture::CapturingThread::CapturingThread(PCAPCapture * pCapture, int nHandleIndex) : |
---|
76 | m_pCapture(pCapture), |
---|
77 | m_nHandleIndex(nHandleIndex) |
---|
78 | { |
---|
79 | } |
---|
80 | |
---|
81 | void PCAPCapture::CapturingThread::operator()() |
---|
82 | { |
---|
83 | std::string s = "Packet capture started"; |
---|
84 | std::string s2 = ""; |
---|
85 | if (m_pCapture->m_nHandleCount > 1) |
---|
86 | { |
---|
87 | s2 = " (source #"; |
---|
88 | s2 += boost::lexical_cast<std::string>(m_nHandleIndex + 1); |
---|
89 | s2 += ")"; |
---|
90 | s += s2; |
---|
91 | } |
---|
92 | Logger::Instance().LogDebug(s); |
---|
93 | |
---|
94 | pcap_loop(m_pCapture->m_fp[m_nHandleIndex], 0, PCAPCapture::DispatcherHandler, |
---|
95 | reinterpret_cast <u_char*> (this)); |
---|
96 | |
---|
97 | s = "Packet capture ended"; |
---|
98 | s += s2; |
---|
99 | Logger::Instance().LogDebug(s); |
---|
100 | { |
---|
101 | boost::mutex::scoped_lock(m_pCapture->m_mutex); |
---|
102 | m_pCapture->m_threadRunning[m_nHandleIndex] = false; |
---|
103 | if (m_pCapture->m_bRunning) |
---|
104 | m_pCapture->m_threadClosed.notify_one(); |
---|
105 | } |
---|
106 | } |
---|
107 | |
---|
108 | bool PCAPCapture::StartCapture() |
---|
109 | { |
---|
110 | if (m_bRunning) |
---|
111 | return true; |
---|
112 | m_bRunning = true; |
---|
113 | if (m_fp) |
---|
114 | { |
---|
115 | for (int i = 0; i < m_nHandleCount; i++) |
---|
116 | { |
---|
117 | m_threadRunning[i] = true; |
---|
118 | boost::thread thread(CapturingThread(this, i)); |
---|
119 | } |
---|
120 | } |
---|
121 | return true; |
---|
122 | } |
---|
123 | |
---|
124 | bool PCAPCapture::StopCapture() |
---|
125 | { |
---|
126 | if (!m_bRunning) |
---|
127 | return true; |
---|
128 | m_bRunning = false; |
---|
129 | if (m_fp) |
---|
130 | { |
---|
131 | for (int i = 0; i < m_nHandleCount; i++) |
---|
132 | { |
---|
133 | boost::mutex::scoped_lock cond(m_mutex); |
---|
134 | if (m_threadRunning[i]) |
---|
135 | { |
---|
136 | pcap_breakloop(m_fp[i]); |
---|
137 | m_threadClosed.wait(cond); |
---|
138 | } |
---|
139 | } |
---|
140 | } |
---|
141 | return true; |
---|
142 | } |
---|
143 | |
---|
144 | bool PCAPCapture::SetFilter(const std::string sFilter) |
---|
145 | { |
---|
146 | if (!m_fp) |
---|
147 | { |
---|
148 | Logger::Instance().LogWarning("Cannot apply filter; the capture device is not open"); |
---|
149 | return false; |
---|
150 | } |
---|
151 | |
---|
152 | std::string sFormattedFilter = sFilter; |
---|
153 | |
---|
154 | // compile the filter |
---|
155 | struct bpf_program fcode; |
---|
156 | std::string s = "Setting PCAP filter ("; |
---|
157 | s += sFormattedFilter; |
---|
158 | s += ")..."; |
---|
159 | Logger::Instance().LogDebug(s); |
---|
160 | bool bRes = true; |
---|
161 | for (int i = 0; i < m_nHandleCount; i++) |
---|
162 | { |
---|
163 | if (m_nHandleCount > 1) |
---|
164 | { |
---|
165 | s = "Applying filter to source #"; |
---|
166 | s += boost::lexical_cast<std::string>(i + 1); |
---|
167 | s += "..."; |
---|
168 | Logger::Instance().LogDebug(s); |
---|
169 | } |
---|
170 | if (pcap_compile(m_fp[i], &fcode, sFormattedFilter.c_str(), 1, 0) < 0) |
---|
171 | { |
---|
172 | Logger::Instance().LogError("Error compiling packet filter"); |
---|
173 | bRes = false; |
---|
174 | continue; |
---|
175 | } |
---|
176 | |
---|
177 | //set the filter |
---|
178 | int nRes = pcap_setfilter(m_fp[i], &fcode); |
---|
179 | pcap_freecode(&fcode); |
---|
180 | if (nRes < 0) |
---|
181 | { |
---|
182 | Logger::Instance().LogError("Error setting packet filter"); |
---|
183 | bRes = false; |
---|
184 | continue; |
---|
185 | } |
---|
186 | Logger::Instance().LogInfo("Filter applied successfully"); |
---|
187 | } |
---|
188 | Logger::Instance().LogDebug("PCAP filter ready"); |
---|
189 | return bRes; |
---|
190 | } |
---|
191 | |
---|
192 | void PCAPCapture::CloseCaptureFile() |
---|
193 | { |
---|
194 | if (m_dumpFiles) |
---|
195 | { |
---|
196 | boost::mutex::scoped_lock lock(m_mutex); |
---|
197 | for (int i = 0; i < m_nHandleCount; i++) |
---|
198 | pcap_dump_close(m_dumpFiles[i]); |
---|
199 | delete m_dumpFiles; |
---|
200 | m_dumpFiles = 0; |
---|
201 | } |
---|
202 | } |
---|
203 | |
---|
204 | bool PCAPCapture::InitCaptureFile(const std::string sFile) |
---|
205 | { |
---|
206 | if (!m_nHandleCount) |
---|
207 | return false; |
---|
208 | CloseCaptureFile(); |
---|
209 | bool bRes = true; |
---|
210 | if (sFile.length() > 0) |
---|
211 | { |
---|
212 | boost::mutex::scoped_lock lock(m_mutex); |
---|
213 | m_dumpFiles = new pcap_dumper_t * [m_nHandleCount]; |
---|
214 | memset(m_dumpFiles, 0, sizeof(pcap_dumper_t*) * m_nHandleCount); |
---|
215 | |
---|
216 | std::string sName = sFile; |
---|
217 | std::string sExt = ""; |
---|
218 | if (m_nHandleCount > 1) |
---|
219 | { |
---|
220 | size_t nSize = sFile.find_last_of('.'); |
---|
221 | if (nSize < sFile.length()) |
---|
222 | { |
---|
223 | sName = sFile.substr(0, nSize); |
---|
224 | sExt = sFile.substr(nSize); |
---|
225 | } |
---|
226 | } |
---|
227 | |
---|
228 | for (int i = 0; i < m_nHandleCount; i++) |
---|
229 | { |
---|
230 | std::string sTmp = sFile; |
---|
231 | if (m_nHandleCount > 1) |
---|
232 | { |
---|
233 | sTmp = sName; |
---|
234 | sTmp += boost::lexical_cast<std::string>(i + 1); |
---|
235 | sTmp += sExt; |
---|
236 | } |
---|
237 | m_dumpFiles[i] = pcap_dump_open(m_fp[i], sTmp.c_str()); |
---|
238 | if (!m_dumpFiles[i]) |
---|
239 | { |
---|
240 | std::string s = "Failed to create dump file \""; |
---|
241 | s += sTmp; |
---|
242 | s += "\""; |
---|
243 | Logger::Instance().LogError(s); |
---|
244 | return false; |
---|
245 | } |
---|
246 | } |
---|
247 | Logger::Instance().LogDebug("PCAP dump file successfully initialized"); |
---|
248 | } |
---|
249 | else |
---|
250 | Logger::Instance().LogDebug("Dump file disabled"); |
---|
251 | return true;; |
---|
252 | } |
---|
253 | |
---|
254 | |
---|
255 | |
---|