pcap-lua/pcap.c at master · sam-github/pcap-lua · GitHub

History

727 lines (569 loc) · 17.5 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

1. Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND

ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE ARE DISCLAIMED.IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF

THE POSSIBILITY OF SUCH DAMAGE.

/*-

** pcap - a binding to libpcap

#include <assert.h>

#include <errno.h>

#include <stdlib.h>

#include <string.h>

#include <stdio.h>

#include <time.h>

#include <math.h>

#include <pcap.h>

#include "lua.h"

#include "lauxlib.h"

#include "lualib.h"

#ifdef WIN32

#include <wt-win-common.h>

#endif

#if LUA_VERSION_NUM > 501

#define luaL_reg luaL_Reg

#endif

static double tv2secs(struct timeval* tv)

{

double secs = tv->tv_sec;

secs += (double)tv->tv_usec / 1000000.0;

return secs;

}

static struct timeval* secs2tv(double secs, struct timeval* tv)

{

double ipart = 0.0;

double fpart = 0.0;

fpart = modf(secs, &ipart);

tv->tv_sec = (long) ipart;

fpart = modf(fpart * 1000000.0, &ipart);

tv->tv_usec = (long) ipart;

if(fpart > 0.5)

tv->tv_usec += 1;

return tv;

}

static struct timeval* opttimeval(lua_State* L, int argi, struct timeval* tv)

{

if(lua_isnoneornil(L, argi)) {

#ifndef NDEBUG

int e =

#endif

gettimeofday(tv, NULL);

#ifndef NDEBUG

assert(e == 0); /* can only fail due to argument errors */

#endif

} else {

double secs = luaL_checknumber(L, argi);

secs2tv(secs, tv);

}

return tv;

}

static void v_obj_metatable(lua_State* L, const char* regid, const struct luaL_reg methods[])

{

/* metatable = { ... methods ... } */

luaL_newmetatable(L, regid);

#if LUA_VERSION_NUM > 501

luaL_setfuncs(L, methods, 0);

#else

luaL_register(L, NULL, methods);

#endif

/* metatable["__index"] = metatable */

lua_pushvalue(L, -1);

lua_setfield(L, -2, "__index");

lua_pop(L, 1);

}

/* Registry IDs and helper functions */

#define L_PCAP_REGID "wt.pcap"

#define L_PCAP_DUMPER_REGID "wt.pcap_dumper"

static int pusherr(lua_State* L, pcap_t* cap)

{

lua_pushnil(L);

lua_pushstring(L, pcap_geterr(cap));

return 2;

}

static pcap_t* checkpcap(lua_State* L)

{

pcap_t** cap = luaL_checkudata(L, 1, L_PCAP_REGID);

luaL_argcheck(L, *cap, 1, "pcap has been closed");

return *cap;

}

static pcap_t** pushpcapopen(lua_State* L)

{

pcap_t** cap = lua_newuserdata(L, sizeof(*cap));

*cap = NULL;

luaL_getmetatable(L, L_PCAP_REGID);

lua_setmetatable(L, -2);

return cap;

}

static int checkpcapopen(lua_State* L, pcap_t** cap, const char* errbuf)

{

if (!*cap) {

lua_pushnil(L);

lua_pushstring(L, errbuf);

return 2;

}

return 1;

}

/* Wrap pcap_t */

/*-

-- pcap.DLT = { EN10MB=DLT_EN10MB, [DLT_EN10MB] = "EN10MB", ... }

DLT is a table of common DLT types. The DLT number and name are mapped to each other.

DLT.EN10MB is Ethernet (of all speeds, the name is historical).

DLT.LINUX_SLL can occur when capturing on Linux with a device of "any".

See <http://www.tcpdump.org/linktypes.html> for more information.

The numeric values are returned by cap:datalink() and accepted as linktype values

in pcap.open_dead().

/* In the table at the top of the stack, dlt, do:

* dlt[name] = number

* dlt[number] = name

static void pcap_dlt_set(lua_State* L, const char* name, int number)

{

lua_pushstring(L, name);

lua_pushinteger(L, number);

lua_settable(L, -3);

lua_pushinteger(L, number);

lua_pushstring(L, name);

lua_settable(L, -3);

}

/* TODO - add all the DLT values... */

static void pcap_make_dlt(lua_State* L)

{

lua_newtable(L);

#ifdef DLT_EN10MB

pcap_dlt_set(L, "EN10MB", DLT_EN10MB);

#endif

#ifdef DLT_RAW

pcap_dlt_set(L, "RAW", DLT_RAW);

#endif

#ifdef DLT_LINUX_SLL

pcap_dlt_set(L, "LINUX_SLL", DLT_LINUX_SLL);

#endif

#ifdef DLT_USER0

pcap_dlt_set(L, "USER0", DLT_USER0);

#endif

#ifdef DLT_USER1

pcap_dlt_set(L, "USER1", DLT_USER1);

#endif

#ifdef DLT_USER2

pcap_dlt_set(L, "USER2", DLT_USER2);

#endif

#ifdef DLT_USER3

pcap_dlt_set(L, "USER3", DLT_USER3);

#endif

}

/*-

-- cap = pcap.open_live(device, snaplen, promisc, timeout)

Open a source device to read packets from.

- device is the physical device (defaults to "any")

- snaplen is the size to capture, where 0 means max possible (defaults to 0)

- promisc is whether to set the device into promiscuous mode (default is false)

- timeout is the timeout for reads in seconds (default is 0, return if no packets available)

static int lpcap_open_live(lua_State *L)

{

const char *device = luaL_optstring(L, 1, "any");

int snaplen = luaL_optint(L, 2, 0);

int promisc = lua_toboolean(L, 3);

int to_ms = 1000 * luaL_optint(L, 4, 0); /* convert to milliseconds */

pcap_t** cap = pushpcapopen(L);

char errbuf[PCAP_ERRBUF_SIZE];

if(snaplen == 0)

snaplen = 0xffff;

*cap = pcap_open_live(device, snaplen, promisc, to_ms, errbuf);

return checkpcapopen(L, cap, errbuf);

}

/*-

-- cap = pcap.open_dead([linktype, [snaplen]])

- linktype is one of the DLT numbers, and defaults to pcap.DLT.EN10MB.

- snaplen is the maximum size of packet, and defaults to 65535 (also,

a value of 0 is changed into 65535 internally, as tcpdump does).

Open a pcap that doesn't read from either a live interface, or an offline pcap

file. It can be used with cap:dump_open() to write a pcap file, or to compile a

BPF program.

static int lpcap_open_dead(lua_State *L)

{

int linktype = luaL_optint(L, 1, DLT_EN10MB);

int snaplen = luaL_optint(L, 2, 0);

pcap_t** cap = pushpcapopen(L);

/* this is the value tcpdump uses, its way bigger than any known link size */

if(!snaplen)

snaplen = 0xffff;

*cap = pcap_open_dead(linktype, snaplen);

return checkpcapopen(L, cap, "open dead failed for unknown reason");

}

/*-

-- cap = pcap.open_offline(fname)

Open a savefile to read packets from.

An fname of "-" is a synonym for stdin.

static int lpcap_open_offline(lua_State *L)

{

const char *fname = luaL_checkstring(L, 1);

pcap_t** cap = pushpcapopen(L);

char errbuf[PCAP_ERRBUF_SIZE];

*cap = pcap_open_offline(fname, errbuf);

return checkpcapopen(L, cap, errbuf);

}

/*-

-- cap:close()

Manually close a cap object, freeing it's resources (this will happen on

garbage collection if not done explicitly).

static int lpcap_close (lua_State *L)

{

pcap_t** cap = luaL_checkudata(L, 1, L_PCAP_REGID);

if(*cap)

pcap_close(*cap);

*cap = NULL;

return 0;

}

/* Current libpcap says to use PCAP_NETMASK_UNKNOWN if you don't know the

netmask, older libpcaps says to use 0, so we do one or the other

depending on whether the macro exists.

#ifndef PCAP_NETMASK_UNKNOWN

# define PCAP_NETMASK_UNKNOWN 0

#endif

/*-

-- cap = cap:set_filter(filter, nooptimize)

- filter is the filter string, see tcpdump or pcap-filter man page.

- nooptimize can be true if you don't want the filter optimized during compile

(the default is to optimize).

static int lpcap_set_filter(lua_State* L)

{

pcap_t* cap = checkpcap(L);

const char* filter = luaL_checkstring(L, 2);

int optimize = !lua_toboolean(L, 3);

bpf_u_int32 netmask = PCAP_NETMASK_UNKNOWN; /* TODO get device from registry, and call pcap_lookup_net()*/

int ret = 0;

struct bpf_program program = { 0 };

ret = pcap_compile(cap, &program, filter, optimize, netmask);

if(ret < 0) {

return pusherr(L, cap);

}

ret = pcap_setfilter(cap, &program);

pcap_freecode(&program);

if(ret < 0) {

return pusherr(L, cap);

}

lua_settop(L, 1);

return 1;

}

/*-

-- num = cap:datalink()

Interpretation of the packet data requires knowing it's datalink type. This

function returns that as a number.

See pcap.DLT for more information.

static int lpcap_datalink(lua_State* L)

{

pcap_t* cap = checkpcap(L);

lua_pushnumber(L, pcap_datalink(cap));

return 1;

}

/*-

-- snaplen = cap:snapshot()

The snapshot length.

For a live capture, snapshot is the maximum amount of the packet that will be

captured, for writing of captures, it is the maximum size of a packet that can

be written.

static int lpcap_snapshot(lua_State* L)

{

pcap_t* cap = checkpcap(L);

lua_pushnumber(L, pcap_snapshot(cap));

return 1;

}

/*-

-- fd = cap:getfd()

Get a selectable file descriptor number which can be used to wait for packets.

Returns the descriptor number on success, or nil if no such descriptor is

available (see pcap_get_selectable_fd).

#ifndef WIN32

static int lpcap_getfd(lua_State* L)

{

pcap_t* cap = checkpcap(L);

int fd = pcap_get_selectable_fd(cap);

if(fd < 0) {

lua_pushnil(L);

lua_pushstring(L, "not selectable");

return 2;

}

lua_pushnumber(L, fd);

return 1;

}

#endif

/*-

-- capdata, timestamp, wirelen = cap:next()

Example:

for capdata, timestamp, wirelen in cap.next, cap do

print(timestamp, wirelen, #capdata)

end

Returns capdata, timestamp, wirelen on sucess:

- capdata is the captured data

- timestamp is in seconds, theoretically to microsecond accuracy

- wirelen is the packets original length, the capdata may be shorter

Returns nil,emsg on failure, where emsg is:

- "timeout", timeout on a live capture

- "closed", no more packets to be read from a file

- ... some other string returned from pcap_geterr() describing the error

/* TODO cap:loop() -> function(cap) return cap.next, cap end */

static int pushpkt(lua_State* L, struct pcap_pkthdr* pkt_header, const u_char* pkt_data)

{

lua_pushlstring(L, (const char*)pkt_data, pkt_header->caplen);

lua_pushnumber(L, tv2secs(&pkt_header->ts));

lua_pushinteger(L, pkt_header->len);

return 3;

}

static int lpcap_next(lua_State* L)

{

pcap_t* cap = checkpcap(L);

struct pcap_pkthdr* pkt_header = NULL;

const u_char* pkt_data = NULL;

int e = pcap_next_ex(cap, &pkt_header, &pkt_data);

/* Note: return values don't have names, they are documented numerically

in the man page. */

switch(e) {

case 1: /* success */

return pushpkt(L, pkt_header, pkt_data);

case 0: /* read live, and timeout occurred */

lua_pushnil(L);

lua_pushstring(L, "timeout");

return 2;

case -2: /* read from a savefile, and no more packets */

lua_pushnil(L);

lua_pushstring(L, "closed");

return 2;

case -1: /* an error occurred */

return pusherr(L, cap);

}

return luaL_error(L, "unreachable");

}

/*-

-- sent = cap:inject(packet)

Injects packet.

Return is bytes sent on success, or nil,emsg on failure.

#ifndef WIN32

static int lpcap_inject(lua_State* L)

{

pcap_t* cap = checkpcap(L);

size_t datasz = 0;

const char* data = luaL_checklstring(L, 2, &datasz);

int sent = pcap_inject(cap, data, datasz);

if (sent < 0) {

return pusherr(L, cap);

}

lua_pushinteger(L, sent);

return 1;

}

#endif

/* Wrap pcap_dumper_t */

static pcap_dumper_t* checkdumper(lua_State* L)

{

pcap_dumper_t** dumper = luaL_checkudata(L, 1, L_PCAP_DUMPER_REGID);

luaL_argcheck(L, *dumper, 1, "pcap dumper has been closed");

return *dumper;

}

/*-

-- dumper = cap:dump_open(fname)

Open a dump file to write packets to.

An fname of "-" is a synonym for stdout.

Note that the dumper object is independent of the cap object, once

it's created (so the cap object can be closed if its not going to

be used).

static int lpcap_dump_open(lua_State *L)

{

pcap_t* cap = checkpcap(L);

const char* fname = luaL_checkstring(L, 2);

pcap_dumper_t** dumper = lua_newuserdata(L, sizeof(*dumper));

*dumper = NULL;

luaL_getmetatable(L, L_PCAP_DUMPER_REGID);

lua_setmetatable(L, -2);

*dumper = pcap_dump_open(cap, fname);

if (!*dumper) {

return pusherr(L, cap);

}

return 1;

}

/*-

-- dumper:close()

Manually close a dumper object, freeing it's resources (this will happen on

garbage collection if not done explicitly).

static int lpcap_dump_close (lua_State *L)

{

pcap_dumper_t** dumper = luaL_checkudata(L, 1, L_PCAP_DUMPER_REGID);

if(*dumper)

pcap_dump_close(*dumper);

*dumper = NULL;

return 0;

}

/*-

-- dumper = dumper:dump(pkt, [timestamp, [wirelen]])

pkt is the packet to write to the dumpfile.

timestamp of packet, defaults to 0, meaning the current time.

wirelen was the original length of the packet before being truncated to header

(defaults to length of header, the correct value if it was not truncated).

If only the header of the packet is available, wirelen should be set to the

original packet length before it was truncated. Also, be very careful to not

write a header that is longer than the caplen (which will 65535 unless a

different value was specified in open_live or open_dead), the pcap file

will not be valid.

Returns self on sucess.

Returns nil and an error msg on failure.

Note that arguments are compatible with cap:next(), and that since

pcap_dump() doesn't return error indicators only the failure

values from cap:next() will ever be returned.

/* TODO store the snaplen in dumper's environment, so we can check it here */

static int lpcap_dump(lua_State* L)

{

pcap_dumper_t* dumper = checkdumper(L);

const char* pkt;

size_t caplen;

size_t wirelen;

struct pcap_pkthdr hdr;

/* first check if we are echoing the nil,emsg from cap:next()

* before checking our argument types

if(lua_isnil(L, 2) && lua_type(L, 3) == LUA_TSTRING) {

return 2;

}

pkt = luaL_checklstring(L, 2, &caplen);

opttimeval(L, 3, &hdr.ts);

wirelen = luaL_optint(L, 4, caplen);

luaL_argcheck(L, wirelen >= caplen, 4, "original wirelen cannot be less than current pkt length");

hdr.caplen = caplen;

hdr.len = wirelen;

/* Note odd type signature for dumper, its because pcap_dump() is

* designed to be called from a pcap_handler, where the dumper

* is received as the user data.

pcap_dump((u_char*) dumper, &hdr, (u_char*)pkt);

/* clear the stack above self, and return self */

lua_settop(L, 1);

return 1;

}

/*-

-- dumper = dumper:flush()

Flush all dumped packets to disk.

Returns self on sucess.

Returns nil and an error msg on failure.

static int lpcap_flush(lua_State* L)

{

pcap_dumper_t* dumper = checkdumper(L);

int e = pcap_dump_flush(dumper);

if(e == 0) {

return 1;

}

lua_pushnil(L);

lua_pushstring(L, strerror(errno));

return 2;

}

/* timeval to second conversions */

/* These don't need to be external, but are useful to test timeval conversion from lua. */

/*-

-- secs = pcap.tv2secs(seci, useci)

Combine seperate seconds and microseconds into one numeric seconds.

static int lpcap_tv2secs(lua_State* L)

{

struct timeval tv;

tv.tv_sec = (long)luaL_checknumber(L, 1);

tv.tv_usec = (long)luaL_checknumber(L, 2);

lua_pushnumber(L, tv2secs(&tv));

return 1;

}

/*-

-- seci, useci = pcap.secs2tv(secs)

Split one numeric seconds into seperate seconds and microseconds.

static int lpcap_secs2tv(lua_State* L)

{

struct timeval tv;

double secs = luaL_checknumber(L, 1);

secs2tv(secs, &tv);

lua_pushnumber(L, tv.tv_sec);

lua_pushnumber(L, tv.tv_usec);

return 2;

}

/*-

-- pcap._LIB_VERSION = ...

The libpcap version string, as returned from pcap_lib_version().

static const luaL_reg pcap_module[] =

{

{"open_live", lpcap_open_live},

{"open_offline", lpcap_open_offline},

{"open_dead", lpcap_open_dead},

{"tv2secs", lpcap_tv2secs},

{"secs2tv", lpcap_secs2tv},

{NULL, NULL}

};

static const luaL_reg pcap_methods[] =

{

{"__gc", lpcap_close},

{"close", lpcap_close},

{"dump_open", lpcap_dump_open},

{"set_filter", lpcap_set_filter},

{"datalink", lpcap_datalink},

{"snapshot", lpcap_snapshot},

#ifndef WIN32

{"getfd", lpcap_getfd},

#endif

{"next", lpcap_next},

/* TODO - wt_pcap.c also had a next_nonblocking(), I'm not sure why a setnonblocking() wasn't sufficient */

#ifndef WIN32

{"inject", lpcap_inject},

#endif

{NULL, NULL}

};

static const luaL_reg dumper_methods[] =

{

{"__gc", lpcap_dump_close},

{"close", lpcap_dump_close},

{"dump", lpcap_dump},

{"flush", lpcap_flush},

{NULL, NULL}

};

int luaopen_pcap (lua_State *L)

{

v_obj_metatable(L, L_PCAP_DUMPER_REGID, dumper_methods);

v_obj_metatable(L, L_PCAP_REGID, pcap_methods);

#if LUA_VERSION_NUM > 501

lua_newtable(L);

luaL_setfuncs (L,pcap_module,0); //leaving global namespace clean in 5.2

#else

luaL_register(L, "pcap", pcap_module);

#endif

lua_pushstring(L, pcap_lib_version());

lua_setfield(L, -2, "_LIB_VERSION");

pcap_make_dlt(L);

lua_setfield(L, -2, "DLT");

return 1;

}

pcap-lua/pcap.c at master · sam-github/pcap-lua · GitHub

Expand file tree

Breadcrumbs

pcap.c

Latest commit

History

Breadcrumbs

pcap.c

File metadata and controls