| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246 |
- /*-
- * Copyright (c) 2017 Michael Tuexen
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
- /*
- * Compile: cc -Wall -Werror -pedantic pcap2corpus.c -lpcap -o pcap2corpus
- *
- * Usage: pcap2corpus infile outfile_prefix [expression]
- * if no expression, a pcap filter, is provided, sctp is used.
- */
- #define _GNU_SOURCE
- #include <sys/types.h>
- #include <net/ethernet.h>
- #include <netinet/in.h>
- #include <netinet/ip.h>
- #include <netinet/ip6.h>
- #include <pcap/pcap.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- static unsigned long nr_read = 0;
- static unsigned long nr_decaps = 0;
- #define PRE_PADDING 1
- struct args {
- struct bpf_program bpf_prog;
- char *filename_prefix;
- int (*is_ipv4)(const void *);
- int (*is_ipv6)(const void *);
- int linktype;
- unsigned int offset;
- };
- /*
- * SCTP protocol - RFC4960.
- */
- struct sctphdr {
- uint16_t src_port; /* source port */
- uint16_t dest_port; /* destination port */
- uint32_t v_tag; /* verification tag of packet */
- uint32_t checksum; /* CRC32C checksum */
- /* chunks follow... */
- } __attribute__((packed));
- static int
- loopback_is_ipv4(const void *bytes)
- {
- uint32_t family;
- family = *(const uint32_t *)bytes;
- return (family == 2);
- }
- static int
- loopback_is_ipv6(const void *bytes)
- {
- uint32_t family;
- family = *(const uint32_t *)bytes;
- return (family == 24 || family == 28 || family == 30);
- }
- static int
- ethernet_is_ipv4(const void *bytes)
- {
- const struct ether_header *ether_hdr;
- ether_hdr = (const struct ether_header *)bytes;
- return (ntohs(ether_hdr->ether_type) == ETHERTYPE_IP);
- }
- static int
- ethernet_is_ipv6(const void *bytes)
- {
- const struct ether_header *ether_hdr;
- ether_hdr = (const struct ether_header *)bytes;
- return (ntohs(ether_hdr->ether_type) == ETHERTYPE_IPV6);
- }
- static void
- packet_handler(u_char *user, const struct pcap_pkthdr *pkthdr, const u_char *bytes_in)
- {
- struct args *args;
- const u_char *bytes_out;
- FILE *file;
- char *filename;
- const struct ip *ip4_hdr_in;
- const struct ip6_hdr *ip6_hdr_in;
- size_t offset, length;
- int null = 0;
- args = (struct args *)(void *)user;
- bytes_out = NULL;
- if (pcap_offline_filter(&args->bpf_prog, pkthdr, bytes_in) == 0) {
- goto out;
- }
- if (pkthdr->caplen < args->offset) {
- goto out;
- }
- if (args->is_ipv4(bytes_in)) {
- offset = args->offset + sizeof(struct ip) + sizeof(struct sctphdr);
- if (pkthdr->caplen < offset) {
- goto out;
- }
- ip4_hdr_in = (const struct ip *)(const void *)(bytes_in + args->offset);
- if (ip4_hdr_in->ip_p == IPPROTO_SCTP) {
- unsigned int ip4_hdr_len;
- ip4_hdr_len = ip4_hdr_in->ip_hl << 2;
- offset = args->offset + ip4_hdr_len + sizeof(struct sctphdr);
- if (pkthdr->caplen < offset) {
- goto out;
- }
- bytes_out = bytes_in + offset;
- length = pkthdr->caplen - offset;
- }
- }
- if (args->is_ipv6(bytes_in)) {
- offset = args->offset + sizeof(struct ip6_hdr) + sizeof(struct sctphdr);
- if (pkthdr->caplen < offset) {
- goto out;
- }
- ip6_hdr_in = (const struct ip6_hdr *)(bytes_in + args->offset);
- if (ip6_hdr_in->ip6_nxt == IPPROTO_SCTP) {
- bytes_out = bytes_in + offset;
- length = pkthdr->caplen - offset;
- }
- }
- out:
- nr_read++;
- if (bytes_out != NULL) {
- if (asprintf(&filename, "%s-%06lu", args->filename_prefix, nr_decaps) < 0) {
- return;
- }
- file = fopen(filename, "w");
- fwrite(&null, 1, PRE_PADDING, file);
- fwrite(bytes_out, length, 1, file);
- fclose(file);
- free(filename);
- nr_decaps++;
- }
- }
- static char *
- get_filter(int argc, char *argv[])
- {
- char *result, *c;
- size_t len;
- int i;
- if (argc == 3) {
- if (asprintf(&result, "%s", "sctp") < 0) {
- return (NULL);
- }
- } else {
- len = 0;
- for (i = 3; i < argc; i++) {
- len += strlen(argv[i]) + 1;
- }
- result = malloc(len);
- c = result;
- for (i = 3; i < argc; i++) {
- c = stpcpy(c, argv[i]);
- if (i < argc - 1) {
- *c++ = ' ';
- }
- }
- }
- return (result);
- }
- int
- main(int argc, char *argv[])
- {
- char errbuf[PCAP_ERRBUF_SIZE];
- pcap_t *pcap_reader;
- char *filter;
- struct args args;
- if (argc < 3) {
- fprintf(stderr, "Usage: %s infile outfile_prefix [expression]\n", argv[0]);
- return (-1);
- }
- args.filename_prefix = argv[2];
- pcap_reader = pcap_open_offline(argv[1], errbuf);
- if (pcap_reader == NULL) {
- fprintf(stderr, "Can't open input file %s: %s\n", argv[1], errbuf);
- return (-1);
- }
- args.linktype = pcap_datalink(pcap_reader);
- switch (args.linktype) {
- case DLT_NULL:
- args.is_ipv4 = loopback_is_ipv4;
- args.is_ipv6 = loopback_is_ipv6;
- args.offset = sizeof(uint32_t);
- break;
- case DLT_EN10MB:
- args.is_ipv4 = ethernet_is_ipv4;
- args.is_ipv6 = ethernet_is_ipv6;
- args.offset = sizeof(struct ether_header);
- break;
- default:
- fprintf(stderr, "Datalink type %d not supported\n", args.linktype);
- pcap_close(pcap_reader);
- return (-1);
- }
- filter = get_filter(argc, argv);
- if (pcap_compile(pcap_reader, &args.bpf_prog, filter, 1, PCAP_NETMASK_UNKNOWN) < 0) {
- fprintf(stderr, "Can't compile filter %s: %s\n", filter, pcap_geterr(pcap_reader));
- free(filter);
- pcap_close(pcap_reader);
- return (-1);
- }
- free(filter);
- pcap_dispatch(pcap_reader, 0, packet_handler, (u_char *)&args);
- pcap_close(pcap_reader);
- fprintf(stderr, "%lu packets processed\n", nr_read);
- fprintf(stderr, "%lu packets decapsulated\n", nr_decaps);
- return (0);
- }
|