pespin has uploaded this change for review.
WIP: Support generation and storing of pcapng format
TODO:
* client: timestamp in EPB
* server: detect pcap vs pcapng using magic field in link_hdr
** server: Do size checks based on pcap/pcapng knowledge
** server: Change saved file suffix based on pcap/pcapng knowledge.
Change-Id: I3c80518a1e53a1f77e1aca8dfa83f683f9516ad6
---
M include/osmo-pcap/osmo_pcap_client.h
M include/osmo-pcap/osmo_pcap_server.h
M src/Makefile.am
M src/osmo_client_core.c
M src/osmo_client_network.c
A src/osmo_client_pcap.c
M src/osmo_client_vty.c
M src/osmo_server_network.c
8 files changed, 704 insertions(+), 86 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-pcap refs/changes/65/39265/1
diff --git a/include/osmo-pcap/osmo_pcap_client.h b/include/osmo-pcap/osmo_pcap_client.h
index 250a41f..83621bc 100644
--- a/include/osmo-pcap/osmo_pcap_client.h
+++ b/include/osmo-pcap/osmo_pcap_client.h
@@ -61,6 +61,12 @@
PROTOCOL_IPIP,
};
+enum osmo_pcap_fmt {
+ OSMO_PCAP_FMT_PCAP = 0,
+ OSMO_PCAP_FMT_PCAPNG,
+};
+
+
struct osmo_pcap_client_conn {
struct llist_head entry;
const char *name;
@@ -114,6 +120,7 @@
int filter_itself;
int gprs_filtering;
int snaplen;
+ enum osmo_pcap_fmt pcap_fmt;
struct osmo_pcap_client_conn *conn;
struct llist_head conns;
@@ -138,7 +145,9 @@
struct osmo_pcap_client_conn *osmo_client_conn_alloc(struct osmo_pcap_client *client, const char *name);
void osmo_client_conn_free(struct osmo_pcap_client_conn *conn);
void osmo_client_conn_send_data(struct osmo_pcap_client_conn *conn,
- struct pcap_pkthdr *hdr, const uint8_t *data);
+ const struct osmo_pcap_handle *ph,
+ const struct pcap_pkthdr *pkthdr,
+ const uint8_t *data);
void osmo_client_conn_send_link(struct osmo_pcap_client_conn *conn);
void osmo_client_conn_connect(struct osmo_pcap_client_conn *conn);
void osmo_client_conn_disconnect(struct osmo_pcap_client_conn *conn);
@@ -149,6 +158,47 @@
void osmo_pcap_handle_free(struct osmo_pcap_handle *ph);
int osmo_pcap_handle_start_capture(struct osmo_pcap_handle *ph);
+unsigned int osmo_pcap_file_global_header_size(void);
+int osmo_pcap_file_msgb_append_global_header(struct msgb *msg, uint32_t snaplen, uint32_t linktype);
+unsigned int osmo_pcap_file_record_size(const struct pcap_pkthdr *in_hdr);
+int osmo_pcap_file_msgb_append_record(struct msgb *msg, const struct pcap_pkthdr *in_hdr, const uint8_t *data);
+
+struct osmo_pcapng_file_shb_pars {
+ const char *hardware;
+ const char *os;
+ const char *userappl;
+};
+unsigned int osmo_pcapng_file_shb_size(const struct osmo_pcapng_file_shb_pars *pars);
+int osmo_pcapng_file_msgb_append_shb(struct msgb *msg, const struct osmo_pcapng_file_shb_pars *pars);
+
+struct osmo_pcapng_file_idb_pars {
+ //char *comment;
+ const char *name;
+ //char *descr;
+ //char *filter;
+ //char *os;
+ //char *hardware;
+ int link_type;
+ int snap_len;
+ //uint64_t *bytes_written;
+ //uint64_t if_speed;
+ //uint8_t tsresol;
+};
+unsigned int osmo_pcapng_file_idb_size(const struct osmo_pcapng_file_idb_pars *pars);
+int osmo_pcapng_file_msgb_append_idb(struct msgb *msg, const struct osmo_pcapng_file_idb_pars *pars);
+
+struct osmo_pcapng_file_epb_pars {
+ uint32_t interface_id;
+ uint32_t timestamp_high;
+ uint32_t timestamp_low;
+ const uint8_t *captured_data;
+ uint32_t captured_len;
+ uint32_t packet_len;
+};
+unsigned int osmo_pcapng_file_epb_size(const struct osmo_pcapng_file_epb_pars *pars);
+int osmo_pcapng_file_msgb_append_epb(struct msgb *msg, const struct osmo_pcapng_file_epb_pars *pars);
+
+
#define LOGCONN(conn, lvl, fmt, args...) \
LOGP(DCLIENT, lvl, "CONN(%s,%s:%d) " fmt, (conn)->name, (conn)->srv_ip, (conn)->srv_port, ## args)
diff --git a/include/osmo-pcap/osmo_pcap_server.h b/include/osmo-pcap/osmo_pcap_server.h
index 614ceca..b3188a8 100644
--- a/include/osmo-pcap/osmo_pcap_server.h
+++ b/include/osmo-pcap/osmo_pcap_server.h
@@ -30,6 +30,7 @@
#include <osmocom/core/linuxlist.h>
#include <osmocom/core/write_queue.h>
+#include <stdint.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
@@ -91,7 +92,8 @@
char *curr_filename;
/* pcap stuff */
- struct pcap_file_header file_hdr;
+ uint8_t *file_hdr;
+ uint32_t file_hdr_len;
/* last time */
struct tm last_write;
diff --git a/src/Makefile.am b/src/Makefile.am
index b35227c..47f7795 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -17,9 +17,10 @@
osmo_client_main.c \
osmo_common.c \
osmo_client_core.c \
- osmo_client_vty.c \
+ osmo_client_pcap.c \
osmo_client_network.c \
osmo_client_stats.c \
+ osmo_client_vty.c \
osmo_tls.c \
$(NULL)
diff --git a/src/osmo_client_core.c b/src/osmo_client_core.c
index a2ab894..dd16878 100644
--- a/src/osmo_client_core.c
+++ b/src/osmo_client_core.c
@@ -172,7 +172,7 @@
return 0;
llist_for_each_entry(conn, &client->conns, entry)
- osmo_client_conn_send_data(conn, &hdr, data);
+ osmo_client_conn_send_data(conn, ph, &hdr, data);
return 0;
}
@@ -303,6 +303,7 @@
return NULL;
client->snaplen = DEFAULT_SNAPLEN;
+ client->pcap_fmt = OSMO_PCAP_FMT_PCAP;
INIT_LLIST_HEAD(&client->handles);
INIT_LLIST_HEAD(&client->conns);
diff --git a/src/osmo_client_network.c b/src/osmo_client_network.c
index 70fe740..a9282e4 100644
--- a/src/osmo_client_network.c
+++ b/src/osmo_client_network.c
@@ -1,6 +1,7 @@
/*
* osmo-pcap-client code
*
+ * (C) 2025 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
* (C) 2011-2016 by Holger Hans Peter Freyther <holger@moiji-mobile.com>
* (C) 2011 by On-Waves
* All Rights Reserved
@@ -24,6 +25,7 @@
#include <osmo-pcap/common.h>
#include <osmo-pcap/wireformat.h>
+#include <osmocom/core/utils.h>
#include <osmocom/core/msgb.h>
#include <osmocom/core/rate_ctr.h>
#include <osmocom/core/select.h>
@@ -160,112 +162,287 @@
}
}
-void osmo_client_conn_send_data(struct osmo_pcap_client_conn *conn,
- struct pcap_pkthdr *in_hdr, const uint8_t *data)
+static struct msgb *osmo_client_conn_prepare_msg_data_pcap(struct osmo_pcap_client_conn *conn,
+ const struct osmo_pcap_handle *ph,
+ const struct pcap_pkthdr *pkthdr,
+ const uint8_t *data)
{
struct osmo_pcap_data *om_hdr;
- struct osmo_pcap_pkthdr *hdr;
struct msgb *msg;
- int offset, ip_len;
- struct osmo_pcap_handle *ph;
+ unsigned int record_size = osmo_pcap_file_record_size(pkthdr);
- if (in_hdr->len > in_hdr->caplen) {
- LOGCONN(conn, LOGL_ERROR, "Recording truncated packet, len %zu > snaplen %zu\n",
- (size_t) in_hdr->len, (size_t) in_hdr->caplen);
- rate_ctr_inc2(conn->client->ctrg, CLIENT_CTR_2BIG);
- }
-
- msg = msgb_alloc(in_hdr->caplen + sizeof(*om_hdr) + sizeof(*hdr), "data-data");
+ msg = msgb_alloc(sizeof(*om_hdr) + record_size, "pcap-data");
if (!msg) {
LOGCONN(conn, LOGL_ERROR, "Failed to allocate\n");
rate_ctr_inc2(conn->client->ctrg, CLIENT_CTR_NOMEM);
- return;
+ return NULL;
+ }
+
+ om_hdr = (struct osmo_pcap_data *) msgb_put(msg, sizeof(*om_hdr));
+ om_hdr->type = PKT_LINK_DATA;
+ om_hdr->len = htons(record_size);
+ osmo_pcap_file_msgb_append_record(msg, pkthdr, data);
+
+ return msg;
+}
+
+static struct msgb *osmo_client_conn_prepare_msg_data_pcapng(struct osmo_pcap_client_conn *conn,
+ const struct osmo_pcap_handle *ph,
+ const struct pcap_pkthdr *pkthdr,
+ const uint8_t *data)
+{
+ struct osmo_pcap_data *om_hdr;
+ struct msgb *msg;
+ struct osmo_pcapng_file_epb_pars epb_pars;
+ unsigned int record_size;
+ int rc;
+
+ epb_pars = (struct osmo_pcapng_file_epb_pars){
+ .interface_id = ph->idx,
+ .timestamp_high = 0, /* TODO: fill this properly */
+ .timestamp_low = 0, /* TODO: fill this properly */
+ .captured_data = data,
+ .captured_len = pkthdr->caplen,
+ .packet_len = pkthdr->len,
+ };
+
+ record_size = osmo_pcapng_file_epb_size(&epb_pars);
+
+ msg = msgb_alloc(sizeof(*om_hdr) + record_size, "pcap-data");
+ if (!msg) {
+ LOGCONN(conn, LOGL_ERROR, "Failed to allocate\n");
+ rate_ctr_inc2(conn->client->ctrg, CLIENT_CTR_NOMEM);
+ return NULL;
+ }
+
+ om_hdr = (struct osmo_pcap_data *) msgb_put(msg, sizeof(*om_hdr));
+ om_hdr->type = PKT_LINK_DATA;
+ om_hdr->len = htons(record_size);
+ rc = osmo_pcapng_file_msgb_append_epb(msg, &epb_pars);
+ if (rc < 0) {
+ msgb_free(msg);
+ return NULL;
+ }
+
+ return msg;
+}
+
+static struct msgb *osmo_client_conn_prepare_msg_ipip(struct osmo_pcap_client_conn *conn,
+ const struct osmo_pcap_handle *ph,
+ const struct pcap_pkthdr *pkthdr,
+ const uint8_t *data)
+{
+ struct msgb *msg;
+ int offset, ip_len;
+
+ offset = get_iphdr_offset(pcap_datalink(ph->handle));
+ if (offset < 0)
+ return NULL;
+
+ ip_len = pkthdr->caplen - offset;
+ if (ip_len < 0)
+ return NULL;
+
+
+ msg = msgb_alloc(ip_len, "ipip_msg");
+ if (!msg) {
+ LOGP(DCLIENT, LOGL_ERROR, "Failed to allocate data.\n");
+ rate_ctr_inc2(conn->client->ctrg, CLIENT_CTR_NOMEM);
+ return NULL;
+ }
+ msg->l2h = msgb_put(msg, ip_len);
+ memcpy(msg->l2h, data+offset, ip_len);
+ return msg;
+}
+
+void osmo_client_conn_send_data(struct osmo_pcap_client_conn *conn,
+ const struct osmo_pcap_handle *ph,
+ const struct pcap_pkthdr *pkthdr,
+ const uint8_t *data)
+{
+ struct osmo_pcap_client *client = conn->client;
+ struct msgb *msg;
+
+ if (pkthdr->len > pkthdr->caplen) {
+ LOGCONN(conn, LOGL_ERROR, "Recording truncated packet, len %zu > snaplen %zu\n",
+ (size_t) pkthdr->len, (size_t) pkthdr->caplen);
+ rate_ctr_inc2(client->ctrg, CLIENT_CTR_2BIG);
}
switch (conn->protocol) {
case PROTOCOL_OSMOPCAP:
- om_hdr = (struct osmo_pcap_data *) msgb_put(msg, sizeof(*om_hdr));
- om_hdr->type = PKT_LINK_DATA;
+ switch (client->pcap_fmt) {
+ case OSMO_PCAP_FMT_PCAP:
+ msg = osmo_client_conn_prepare_msg_data_pcap(conn, ph, pkthdr, data);
+ break;
+ case OSMO_PCAP_FMT_PCAPNG:
+ msg = osmo_client_conn_prepare_msg_data_pcapng(conn, ph, pkthdr, data);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ }
- msg->l2h = msgb_put(msg, sizeof(*hdr));
- hdr = (struct osmo_pcap_pkthdr *) msg->l2h;
- hdr->ts_sec = in_hdr->ts.tv_sec;
- hdr->ts_usec = in_hdr->ts.tv_usec;
- hdr->caplen = in_hdr->caplen;
- hdr->len = in_hdr->len;
-
- msg->l3h = msgb_put(msg, in_hdr->caplen);
- memcpy(msg->l3h, data, in_hdr->caplen);
-
- om_hdr->len = htons(msgb_l2len(msg));
- rate_ctr_add2(conn->client->ctrg, CLIENT_CTR_BYTES, hdr->caplen);
- rate_ctr_inc2(conn->client->ctrg, CLIENT_CTR_PKTS);
break;
case PROTOCOL_IPIP:
- /* TODO: support capturing from multiple interfaces here: */
- ph = llist_first_entry_or_null(&conn->client->handles, struct osmo_pcap_handle, entry);
- if (!ph) {
- msgb_free(msg);
- return;
- }
- offset = get_iphdr_offset(pcap_datalink(ph->handle));
- if (offset < 0) {
- msgb_free(msg);
- return;
- }
- ip_len = in_hdr->caplen - offset;
- if (ip_len < 0) {
- msgb_free(msg);
- return;
- }
- msg->l2h = msgb_put(msg, ip_len);
- memcpy(msg->l2h, data+offset, ip_len);
+ msg = osmo_client_conn_prepare_msg_ipip(conn, ph, pkthdr, data);
break;
default:
OSMO_ASSERT(0);
}
+ if (!msg)
+ return;
+
+ rate_ctr_add2(conn->client->ctrg, CLIENT_CTR_BYTES, pkthdr->caplen);
+ rate_ctr_inc2(conn->client->ctrg, CLIENT_CTR_PKTS);
+
write_data(conn, msg);
}
+static struct msgb *osmo_client_conn_prepare_msg_link_pcap(struct osmo_pcap_client_conn *conn)
+{
+ struct osmo_pcap_data *om_hdr;
+ struct msgb *msg;
+ struct osmo_pcap_handle *ph;
+ int rc;
+ int linktype;
+
+ ph = llist_first_entry_or_null(&conn->client->handles, struct osmo_pcap_handle, entry);
+ if (!ph || !ph->handle) {
+ LOGCONN(conn, LOGL_ERROR, "No pcap_handle not sending link info\n");
+ return NULL;
+ }
+ linktype = pcap_datalink(ph->handle);
+
+ /* Make sure others have same linktype, .pcap doesn't support different
+ * linktypes since traffic from all ifaces goes mixed together. */
+ llist_for_each_entry(ph, &conn->client->handles, entry) {
+ if (linktype != pcap_datalink(ph->handle)) {
+ LOGCONN(conn, LOGL_ERROR,
+ "File format 'pcap' doesn't support recording from multiple ifaces "
+ "with different link types! Use VTY config 'pcap file-format pcapng'.\n");
+ return NULL;
+ }
+ }
+
+ msg = msgb_alloc(sizeof(*om_hdr) + osmo_pcap_file_global_header_size(), "link-data");
+ if (!msg) {
+ LOGP(DCLIENT, LOGL_ERROR, "Failed to allocate data.\n");
+ return NULL;
+ }
+
+
+ om_hdr = (struct osmo_pcap_data *)msgb_put(msg, sizeof(*om_hdr));
+ om_hdr->type = PKT_LINK_HDR;
+
+ rc = osmo_pcap_file_msgb_append_global_header(msg, conn->client->snaplen, pcap_datalink(ph->handle));
+ if (rc < 0) {
+ LOGP(DCLIENT, LOGL_ERROR, "Failed to create pcap file global header.\n");
+ msgb_free(msg);
+ return NULL;
+ }
+
+ /* Update payload length: */
+ om_hdr->len = htons(rc);
+ return msg;
+}
+
+struct osmo_pcapng_file_shb_pars shb_pars = {
+ .hardware = "osmo-pcap hw",
+ .os = "osmo-pcap os",
+ .userappl = "osmo-pcap userappl",
+};
+
+static int pcap_handle_prepare_pcapng_idb_pars(const struct osmo_pcap_handle *ph,
+ struct osmo_pcapng_file_idb_pars *pars)
+{
+ struct osmo_pcap_client *client = ph->client;
+ memset(pars, 0, sizeof(*pars));
+
+ pars->name = ph->devname;
+ //pars->filter = client->filter_string;
+ pars->link_type = pcap_datalink(ph->handle);
+ pars->snap_len = client->snaplen;
+ return 0;
+}
+
+static struct msgb *osmo_client_conn_prepare_msg_link_pcapng(struct osmo_pcap_client_conn *conn)
+{
+ struct osmo_pcap_data *om_hdr;
+ struct msgb *msg;
+ struct osmo_pcap_handle *ph;
+ int rc;
+ uint32_t file_hdr_size = osmo_pcapng_file_shb_size(&shb_pars);
+
+ /* Calculate size: */
+ llist_for_each_entry(ph, &conn->client->handles, entry) {
+ struct osmo_pcapng_file_idb_pars idb_pars;
+ if (pcap_handle_prepare_pcapng_idb_pars(ph, &idb_pars) < 0) {
+ LOGPH(ph, LOGL_ERROR, "Failed preparing pcapng IDB from handle\n");
+ return NULL;
+ }
+ file_hdr_size += osmo_pcapng_file_idb_size(&idb_pars);
+ }
+
+ msg = msgb_alloc(sizeof(*om_hdr) + file_hdr_size, "link-data");
+ if (!msg) {
+ LOGCONN(conn, LOGL_ERROR, "Failed to allocate data.\n");
+ return NULL;
+ }
+
+ om_hdr = (struct osmo_pcap_data *)msgb_put(msg, sizeof(*om_hdr));
+ om_hdr->type = PKT_LINK_HDR;
+
+ rc = osmo_pcapng_file_msgb_append_shb(msg, &shb_pars);
+ if (rc < 0) {
+ LOGCONN(conn, LOGL_ERROR, "Failed to create pcapng SHB\n");
+ msgb_free(msg);
+ return NULL;
+ }
+ om_hdr->len = rc;
+
+ llist_for_each_entry(ph, &conn->client->handles, entry) {
+ struct osmo_pcapng_file_idb_pars idb_pars;
+ if (pcap_handle_prepare_pcapng_idb_pars(ph, &idb_pars) < 0) {
+ LOGPH(ph, LOGL_ERROR, "Failed preparing pcapng IDB from handle\n");
+ msgb_free(msg);
+ return NULL;
+ }
+ rc = osmo_pcapng_file_msgb_append_idb(msg, &idb_pars);
+ if (rc < 0) {
+ LOGPH(ph, LOGL_ERROR, "Failed to append pcapng IDB to msgb\n");
+ msgb_free(msg);
+ return NULL;
+ }
+ om_hdr->len += rc;
+ }
+
+ OSMO_ASSERT(om_hdr->len == file_hdr_size);
+ om_hdr->len = htons(om_hdr->len);
+ return msg;
+}
+
void osmo_client_conn_send_link(struct osmo_pcap_client_conn *conn)
{
- struct osmo_pcap_handle *ph;
- struct pcap_file_header *hdr;
- struct osmo_pcap_data *om_hdr;
struct msgb *msg;
/* IPIP encapsulation has no linktype header */
if (conn->protocol == PROTOCOL_IPIP)
return;
- /* TODO: support capturing from multiple interfaces here: */
- ph = llist_first_entry_or_null(&conn->client->handles, struct osmo_pcap_handle, entry);
- if (!ph || !ph->handle) {
- LOGCONN(conn, LOGL_ERROR, "No pcap_handle not sending link info\n");
- return;
+ switch (conn->client->pcap_fmt) {
+ case OSMO_PCAP_FMT_PCAP:
+ msg = osmo_client_conn_prepare_msg_link_pcap(conn);
+ break;
+ case OSMO_PCAP_FMT_PCAPNG:
+ msg = osmo_client_conn_prepare_msg_link_pcapng(conn);
+ break;
+ default:
+ OSMO_ASSERT(0);
}
- msg = msgb_alloc(sizeof(*om_hdr) + sizeof(*hdr), "link-data");
- if (!msg) {
- LOGP(DCLIENT, LOGL_ERROR, "Failed to allocate data.\n");
+ if (!msg)
return;
- }
-
-
- om_hdr = (struct osmo_pcap_data *) msgb_put(msg, sizeof(*om_hdr));
- om_hdr->type = PKT_LINK_HDR;
- om_hdr->len = htons(sizeof(*hdr));
-
- hdr = (struct pcap_file_header *) msgb_put(msg, sizeof(*hdr));
- hdr->magic = 0xa1b2c3d4;
- hdr->version_major = 2;
- hdr->version_minor = 4;
- hdr->thiszone = 0;
- hdr->sigfigs = 0;
- hdr->snaplen = conn->client->snaplen;
- hdr->linktype = pcap_datalink(ph->handle);
-
write_data(conn, msg);
}
diff --git a/src/osmo_client_pcap.c b/src/osmo_client_pcap.c
new file mode 100644
index 0000000..e7b987e
--- /dev/null
+++ b/src/osmo_client_pcap.c
@@ -0,0 +1,355 @@
+/*
+ * osmo-pcap-client code
+ *
+ * (C) 2025 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * (C) 2011-2016 by Holger Hans Peter Freyther <holger@moiji-mobile.com>
+ * (C) 2011 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <pcap/pcap.h>
+
+#include <osmocom/core/msgb.h>
+
+#include <osmo-pcap/osmo_pcap_client.h>
+#include <osmo-pcap/common.h>
+#include <osmo-pcap/wireformat.h>
+
+/***********************************************************
+ * Libpcap File Format (.pcap)
+ * https://wiki.wireshark.org/Development/LibpcapFileFormat
+ ***********************************************************/
+
+/* Get required length to store a Global Header */
+unsigned int osmo_pcap_file_global_header_size(void)
+{
+ return sizeof(struct pcap_file_header);
+}
+
+/* Appends a Global Header to msg
+ * returns number of bytes appended on success, negative on error */
+int osmo_pcap_file_msgb_append_global_header(struct msgb *msg, uint32_t snaplen, uint32_t linktype)
+{
+ struct pcap_file_header *hdr;
+
+ hdr = (struct pcap_file_header *) msgb_put(msg, sizeof(*hdr));
+ hdr->magic = 0xa1b2c3d4;
+ hdr->version_major = 2;
+ hdr->version_minor = 4;
+ hdr->thiszone = 0;
+ hdr->sigfigs = 0;
+ hdr->snaplen = snaplen;
+ hdr->linktype = linktype;
+
+ return sizeof(*hdr);
+}
+
+/* Get required length to store a given record (packet) */
+unsigned int osmo_pcap_file_record_size(const struct pcap_pkthdr *in_hdr)
+{
+ return sizeof(struct osmo_pcap_pkthdr) + in_hdr->caplen;
+}
+
+/* Appends a Record (Packet) Header to msg
+ * returns number of bytes appended on success, negative on error */
+int osmo_pcap_file_msgb_append_record(struct msgb *msg, const struct pcap_pkthdr *in_hdr, const uint8_t *data)
+{
+ struct osmo_pcap_pkthdr *hdr;
+ uint8_t *pkt_payload;
+
+ hdr = (struct osmo_pcap_pkthdr *) msgb_put(msg, sizeof(*hdr));
+ hdr->ts_sec = in_hdr->ts.tv_sec;
+ hdr->ts_usec = in_hdr->ts.tv_usec;
+ hdr->caplen = in_hdr->caplen;
+ hdr->len = in_hdr->len;
+
+ pkt_payload = msgb_put(msg, in_hdr->caplen);
+ memcpy(pkt_payload, data, in_hdr->caplen);
+
+ return osmo_pcap_file_record_size(in_hdr);
+}
+
+
+/***********************************************************
+ * PCAP Next Generation (pcapng) Capture File Format
+ * https://wiki.wireshark.org/Development/PcapNg
+ * https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcapng.html
+ * wireshark.git: wiretap/pcapng.h, wiretap/pcapng.c, wiretap/pcapng_module.h
+ ***********************************************************/
+
+#define BLOCK_TYPE_SHB 0x0A0D0D0A /* Section Header Block */
+#define BLOCK_TYPE_IDB 0x00000001 /* Interface Description Block */
+#define BLOCK_TYPE_PB 0x00000002 /* Packet Block (obsolete) */
+#define BLOCK_TYPE_SPB 0x00000003 /* Simple Packet Block */
+#define BLOCK_TYPE_EPB 0x00000006 /* Enhanced Packet Block */
+
+/* Options for all blocks */
+#define OPT_EOFOPT 0
+#define OPT_COMMENT 1
+/* Section Header block (SHB) */
+#define OPT_SHB_HARDWARE 2
+#define OPT_SHB_OS 3
+#define OPT_SHB_USERAPPL 4
+
+/* Interface Description block (IDB) */
+#define OPT_IDB_NAME 2
+#define OPT_IDB_DESCRIPTION 3
+#define OPT_IDB_IP4ADDR 4
+#define OPT_IDB_IP6ADDR 5
+#define OPT_IDB_MACADDR 6
+#define OPT_IDB_FILTER 11
+
+/* pcapng: common block header file encoding for every block type */
+struct pcapng_block_header {
+ uint32_t block_type;
+ uint32_t block_total_length;
+ /* x bytes block_body */
+ /* uint32_t block_total_length */
+} __attribute__((packed));
+
+struct pcapng_option_header {
+ uint16_t type;
+ uint16_t value_length;
+} __attribute__((packed));
+
+/* pcapng: section header block file encoding */
+struct pcapng_section_header_block {
+ /* pcapng_block_header_t */
+ uint32_t magic;
+ uint16_t version_major;
+ uint16_t version_minor;
+ uint64_t section_length; /* might be -1 for unknown */
+ /* ... Options ... */
+} __attribute__((packed));
+
+/* pcapng: interface description block file encoding */
+struct pcapng_iface_descr_block {
+ uint16_t linktype;
+ uint16_t reserved;
+ uint32_t snaplen;
+ /* ... Options ... */
+} __attribute__((packed));
+
+/* pcapng: enhanced packet block file encoding */
+struct pcapng_enhanced_packet_block {
+ uint32_t interface_id;
+ uint32_t timestamp_high;
+ uint32_t timestamp_low;
+ uint32_t captured_len;
+ uint32_t packet_len;
+ /* ... Packet Data ... */
+ /* ... Padding ... */
+ /* ... Options ... */
+} __attribute__((packed));
+
+/*
+ * Minimum IDB size = minimum block size + size of fixed length portion of IDB.
+ */
+#define MIN_IDB_SIZE ((uint32_t)(MIN_BLOCK_SIZE + sizeof(pcapng_interface_description_block_t)))
+
+/* Get required length to store a given record (packet) */
+static unsigned int osmo_pcapng_file_opt_string_size(const char *str)
+{
+ size_t str_len = str ? strlen(str) : 0;
+ uint8_t pad = str_len % 4;
+ /* Each option is padded to 4 bytes: */
+ if (pad)
+ pad = 4 - pad;
+ return sizeof(struct pcapng_option_header) + str_len + pad;
+}
+
+static int osmo_pcapng_file_msgb_append_opt_string(struct msgb *msg, uint16_t type, const char *str)
+{
+ struct pcapng_option_header *opth;
+ size_t str_len = str ? strlen(str) : 0;
+
+ opth = (struct pcapng_option_header *)msgb_put(msg, sizeof(*opth));
+ opth->type = type;
+ opth->value_length = str_len;
+ if (str_len > 0)
+ memcpy(msgb_put(msg, str_len), str, str_len);
+
+ /* Each option is padded to 4 bytes: */
+ uint8_t pad = str_len % 4;
+ if (pad) {
+ pad = 4 - pad;
+ uint8_t *buf = (uint8_t *)msgb_put(msg, pad);
+ memset(buf, 0, pad);
+ }
+ return sizeof(*opth) + opth->value_length + pad;
+}
+
+/* Get required length to store a given record (packet) */
+static unsigned int osmo_pcapng_file_opt_eofopt_size(void)
+{
+ return sizeof(struct pcapng_option_header);
+}
+
+static int osmo_pcapng_file_msgb_append_opt_eofopt(struct msgb *msg)
+{
+ struct pcapng_option_header *opth;
+
+ opth = (struct pcapng_option_header *)msgb_put(msg, sizeof(*opth));
+ opth->type = OPT_EOFOPT;
+ opth->value_length = 0;
+
+ return sizeof(*opth);
+}
+
+/* Get required length to store a given record (packet) */
+unsigned int osmo_pcapng_file_shb_size(const struct osmo_pcapng_file_shb_pars *pars)
+{
+ uint32_t block_total_len = sizeof(struct pcapng_block_header) +
+ sizeof(struct pcapng_section_header_block) +
+ sizeof(uint32_t);
+ block_total_len += osmo_pcapng_file_opt_string_size(pars->hardware);
+ block_total_len += osmo_pcapng_file_opt_string_size(pars->os);
+ block_total_len += osmo_pcapng_file_opt_string_size(pars->userappl);
+ block_total_len += osmo_pcapng_file_opt_eofopt_size();
+ return block_total_len;
+}
+
+/* Appends a Section Header Block (SHB) to msg
+ * returns number of bytes appended on success, negative on error */
+int osmo_pcapng_file_msgb_append_shb(struct msgb *msg, const struct osmo_pcapng_file_shb_pars *pars)
+{
+ struct pcapng_block_header *bh;
+ struct pcapng_section_header_block *shb;
+ uint8_t *footer_len;
+ uint32_t block_total_len = osmo_pcapng_file_shb_size(pars);
+
+ bh = (struct pcapng_block_header *)msgb_put(msg, sizeof(*bh));
+ bh->block_type = BLOCK_TYPE_SHB;
+ bh->block_total_length = block_total_len;
+
+ /* write block fixed content */
+ shb = (struct pcapng_section_header_block *)msgb_put(msg, sizeof(*shb));
+ shb->magic = 0x1A2B3C4D;
+ shb->version_major = 1;
+ shb->version_minor = 0;
+ shb->section_length = -1;
+
+ /* Options (variable) */
+ osmo_pcapng_file_msgb_append_opt_string(msg, OPT_SHB_HARDWARE, pars->hardware);
+ osmo_pcapng_file_msgb_append_opt_string(msg, OPT_SHB_OS, pars->os);
+ osmo_pcapng_file_msgb_append_opt_string(msg, OPT_SHB_USERAPPL, pars->userappl);
+ osmo_pcapng_file_msgb_append_opt_eofopt(msg);
+
+ /* SHB Block Total Length */
+ footer_len = (uint8_t *)msgb_put(msg, sizeof(uint32_t));
+ memcpy(footer_len, &block_total_len, sizeof(uint32_t));
+
+ return block_total_len;
+}
+
+unsigned int osmo_pcapng_file_idb_size(const struct osmo_pcapng_file_idb_pars *pars)
+{
+ uint32_t block_total_len = sizeof(struct pcapng_block_header) +
+ sizeof(struct pcapng_iface_descr_block) +
+ sizeof(uint32_t);
+ block_total_len += osmo_pcapng_file_opt_string_size(pars->name);
+ //block_total_len += osmo_pcapng_file_opt_string_size(pars->filter);
+ block_total_len += osmo_pcapng_file_opt_eofopt_size();
+ return block_total_len;
+}
+
+int osmo_pcapng_file_msgb_append_idb(struct msgb *msg, const struct osmo_pcapng_file_idb_pars *pars)
+{
+ struct pcapng_block_header *bh;
+ struct pcapng_iface_descr_block *idb;
+ uint8_t *footer_len;
+ uint32_t block_total_len = osmo_pcapng_file_idb_size(pars);
+
+ bh = (struct pcapng_block_header *)msgb_put(msg, sizeof(*bh));
+ bh->block_type = BLOCK_TYPE_IDB;
+ bh->block_total_length = block_total_len;
+
+ /* write block fixed content */
+ idb = (struct pcapng_iface_descr_block *)msgb_put(msg, sizeof(*idb));
+ idb->linktype = pars->link_type;
+ idb->reserved = 0;
+ idb->snaplen = pars->snap_len;
+
+ /* Options (variable) */
+ osmo_pcapng_file_msgb_append_opt_string(msg, OPT_IDB_NAME, pars->name);
+ // TODO: filter is not a string opt, it has an extra prepended byte....
+ //osmo_pcapng_file_msgb_append_opt_string(msg, OPT_IDB_FILTER, pars->filter);
+ osmo_pcapng_file_msgb_append_opt_eofopt(msg);
+
+ /* IDB Block Total Length */
+ footer_len = (uint8_t *)msgb_put(msg, sizeof(uint32_t));
+ memcpy(footer_len, &block_total_len, sizeof(uint32_t));
+
+ return block_total_len;
+}
+
+unsigned int osmo_pcapng_file_epb_size(const struct osmo_pcapng_file_epb_pars *pars)
+{
+ uint32_t block_total_len = sizeof(struct pcapng_block_header) +
+ sizeof(struct pcapng_enhanced_packet_block) +
+ pars->captured_len +
+ sizeof(uint32_t);
+ /* Packet data is padded to 4 bytes: */
+ uint8_t pad = pars->captured_len % 4;
+ if (pad)
+ block_total_len += (4 - pad);
+
+ /* TODO: other Options */
+ block_total_len += osmo_pcapng_file_opt_eofopt_size();
+ return block_total_len;
+}
+
+int osmo_pcapng_file_msgb_append_epb(struct msgb *msg, const struct osmo_pcapng_file_epb_pars *pars)
+{
+ struct pcapng_block_header *bh;
+ struct pcapng_enhanced_packet_block *epb;
+ uint8_t *footer_len;
+ uint32_t block_total_len = osmo_pcapng_file_epb_size(pars);
+
+ bh = (struct pcapng_block_header *)msgb_put(msg, sizeof(*bh));
+ bh->block_type = BLOCK_TYPE_EPB;
+ bh->block_total_length = block_total_len;
+
+ /* write block fixed content */
+ epb = (struct pcapng_enhanced_packet_block *)msgb_put(msg, sizeof(*epb));
+ epb->interface_id = pars->interface_id;
+ epb->timestamp_high = 0; /* TODO: apply... */
+ epb->timestamp_low = 0; /* TODO: apply... */
+ epb->captured_len = pars->captured_len;
+ epb->packet_len = pars->packet_len;
+
+ /* Packet Data */
+ if (pars->captured_len > 0)
+ memcpy(msgb_put(msg, pars->captured_len), pars->captured_data, pars->captured_len);
+
+ /* Each option is padded to 4 bytes: */
+ uint8_t pad = pars->captured_len % 4;
+ if (pad) {
+ pad = 4 - pad;
+ uint8_t *buf = (uint8_t *)msgb_put(msg, pad);
+ memset(buf, 0, pad);
+ }
+
+ /* Options (variable) */
+ osmo_pcapng_file_msgb_append_opt_eofopt(msg);
+
+ /* EPB Block Total Length */
+ footer_len = (uint8_t *)msgb_put(msg, sizeof(uint32_t));
+ memcpy(footer_len, &block_total_len, sizeof(uint32_t));
+
+ return block_total_len;
+}
diff --git a/src/osmo_client_vty.c b/src/osmo_client_vty.c
index 009c735..1824324 100644
--- a/src/osmo_client_vty.c
+++ b/src/osmo_client_vty.c
@@ -1,6 +1,7 @@
/*
* osmo-pcap-client code
*
+ * (C) 2025 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
* (C) 2011-2016 by Holger Hans Peter Freyther <holger@moiji-mobile.com>
* (C) 2011 by On-Waves
* All Rights Reserved
@@ -130,6 +131,8 @@
vty_out(vty, "client%s", VTY_NEWLINE);
+ if (pcap_client->pcap_fmt != OSMO_PCAP_FMT_PCAP)
+ vty_out(vty, " pcap file-format pcapng%s", VTY_NEWLINE);
llist_for_each_entry(ph, &pcap_client->handles, entry) {
vty_out(vty, " pcap device %s%s",
ph->devname, VTY_NEWLINE);
@@ -150,6 +153,22 @@
return CMD_SUCCESS;
}
+DEFUN(cfg_client_pcap_file_format,
+ cfg_client_pcap_file_format_cmd,
+ "pcap file-format (pcap|pcapng)",
+ PCAP_STRING "The pcap file format to use\n"
+ "Libpcap Capture File Format (.pcap)\n"
+ "PCAP Next Generation Capture File Format (.pcapng)\n")
+{
+ if (strcmp(argv[0], "pcap") == 0)
+ pcap_client->pcap_fmt = OSMO_PCAP_FMT_PCAP;
+ else if (strcmp(argv[0], "pcapng") == 0)
+ pcap_client->pcap_fmt = OSMO_PCAP_FMT_PCAPNG;
+ else
+ return CMD_WARNING;
+ return CMD_SUCCESS;
+}
+
DEFUN(cfg_client_no_device,
cfg_client_no_device_cmd,
"no pcap device NAME",
@@ -559,6 +578,7 @@
install_node(&server_node, config_write_server);
+ install_element(CLIENT_NODE, &cfg_client_pcap_file_format_cmd);
install_element(CLIENT_NODE, &cfg_client_no_device_cmd);
install_element(CLIENT_NODE, &cfg_client_device_cmd);
install_element(CLIENT_NODE, &cfg_client_snaplen_cmd);
diff --git a/src/osmo_server_network.c b/src/osmo_server_network.c
index 9750170..86afc90 100644
--- a/src/osmo_server_network.c
+++ b/src/osmo_server_network.c
@@ -108,7 +108,7 @@
talloc_free(event_name);
pcap_zmq_send(conn->server->zmq_publ,
- &conn->file_hdr, sizeof(conn->file_hdr),
+ conn->file_hdr, conn->file_hdr_len,
ZMQ_SNDMORE);
pcap_zmq_send(conn->server->zmq_publ,
&data->data[0], data->len,
@@ -285,8 +285,8 @@
return;
}
- rc = write(conn->local_fd, &conn->file_hdr, sizeof(conn->file_hdr));
- if (rc != sizeof(conn->file_hdr)) {
+ rc = write(conn->local_fd, conn->file_hdr, conn->file_hdr_len);
+ if (rc != conn->file_hdr_len) {
LOGP(DSERVER, LOGL_ERROR, "Failed to write the header: %d\n", errno);
close(conn->local_fd);
conn->local_fd = -1;
@@ -298,6 +298,8 @@
static int link_data(struct osmo_pcap_conn *conn, struct osmo_pcap_data *data)
{
+#if 0
+ /* TODO: discover pcap vs pcapng based on "magic" field. Check minimum size. */
struct pcap_file_header *hdr;
hdr = (struct pcap_file_header *) &data->data[0];
@@ -308,12 +310,20 @@
(size_t) hdr->snaplen, (size_t) conn->server->max_snaplen);
return -1;
}
+#endif
if (!conn->no_store && conn->local_fd < 0) {
- conn->file_hdr = *hdr;
+ TALLOC_FREE(conn->file_hdr);
+ conn->file_hdr = talloc_size(conn, data->len);
+ memcpy(conn->file_hdr, data->data, data->len);
+ conn->file_hdr_len = data->len;
restart_pcap(conn);
- } else if (memcmp(&conn->file_hdr, hdr, sizeof(*hdr)) != 0) {
- conn->file_hdr = *hdr;
+ } else if (conn->file_hdr_len != data->len ||
+ memcmp(&conn->file_hdr, data->data, data->len) != 0) {
+ TALLOC_FREE(conn->file_hdr);
+ conn->file_hdr = talloc_size(conn, data->len);
+ memcpy(conn->file_hdr, data->data, data->len);
+ conn->file_hdr_len = data->len;
restart_pcap(conn);
}
@@ -583,9 +593,10 @@
unsigned int min_len, max_len;
switch ((enum OsmoPcapDataType) conn->data->type) {
case PKT_LINK_HDR:
- if (conn->data->len != sizeof(struct pcap_file_header)) {
+ /* TODO: discover pcap vs pcapng based on "magic" field. */
+ if (conn->data->len < sizeof(struct pcap_file_header)) {
LOGP(DSERVER, LOGL_ERROR,
- "Implausible llink_hdr length: %u != %zu\n",
+ "Implausible llink_hdr length: %u < %zu\n",
conn->data->len, sizeof(struct osmo_pcap_pkthdr));
return false;
}
@@ -747,7 +758,8 @@
{
close_connection(client);
- memset(&client->file_hdr, 0, sizeof(client->file_hdr));
+ TALLOC_FREE(client->file_hdr);
+ client->file_hdr_len = 0;
client->rem_wq.bfd.fd = new_fd;
if (osmo_fd_register(&client->rem_wq.bfd) != 0) {
LOGP(DSERVER, LOGL_ERROR, "Failed to register fd.\n");
To view, visit change 39265. To unsubscribe, or for help writing mail filters, visit settings.