Changeset 98

Timestamp:

24.11.2002 20:44:49 (6 years ago)

Author:

tibob

Message:

- read data from file
- documentation

Location:

trunk

Files:

• INSTALL (modified) (2 diffs)
• TODO (modified) (1 diff)
• doc/ipfm.man (modified) (3 diffs)
• source/init.c (modified) (7 diffs)
• source/init.h (modified) (1 diff)
• source/pcap.c (modified) (5 diffs)

trunk/INSTALL

@@ -23 +23 @@
 
         ./configure --prefix=/usr --mandir=/usr/share/man --sysconfdir=/etc
+
+Configure options
+-----------------
+--enable-debug-messages         For debug propose, enable debug messages.
+        This has a performance cost, so don't use it if not needed.
+--enable-ip-check               Check IP packets transmitted by libpcap for
+        validity : Version is 4, Length >= 5 and checksum is correct. This has
+        a performance cost and on some systems where IP packets are corrupt,
+        you may not want this option. When used with --enable-debug-messages,
+        ipfm will print a warning when dropping a packet.
+        Corrupt packets have been encountered on FreeBSD 4.4 + 3com or Intel
+        cards.
 
 Notes
@@ -51 +63 @@
 5. You must be root ...
   * to install ipfm packages (.rpm and .deb)
-  * to run ipfm
+  * to run ipfm (except when using a tcpdump raw log file)
 
 For any questions, remarks, requests, you can join us at ipfm@via.ecp.fr

trunk/TODO

@@ -2 +2 @@
 - RedHat pcap problem
 - CPU optimisations in lists (Filter and Data)
-- use a pcap filter to select IP packets (integrate patch from Brieuc and do a non regression test)
 - if no packets are received, ipfm does not dump its files.
 - ./configure lex and yacc checks do not work as expected (if no yacc or bison is present, does not stop ./configure)
-- add an ipfm.conf option to read packets from a file (to test IPFM without beeing root).
-- document ./configure options in INSTALL
 - indication of time of dump in the dump itself (add a comment)
 

trunk/doc/ipfm.man

@@ -31 +31 @@
 ] [-h][--help] [-n][--nodaemon] [\-p
 .I pid-file
-][--pid
+] [--pid
 .I pid-file
+] [-r
+.I file
+] [--readfrom
+.I file
 ]
 
@@ -45 +49 @@
 
 .B
-ipfm is developed under Linux libc6 (Debian sid).
+ipfm is developed under Linux libc6 (Debian woody and sid).
 
 It was reported to work under Linux libc5 (slackware) and libc6 (RedHat,
@@ -69 +73 @@
 .IR __PIDFILE
 is used.
+.IP "-r file, --readfrom file"
+.I file
+is a raw tcpdump log file (créated by using tcpdump -w). When using this option, IPFM will ignore the "device" keyword in the configuration file, read the packets from
+.I file
+, dump logs and exit.
 
 .SH SIGNALS

trunk/source/init.c

@@ -65 +65 @@
 extern int line;
 extern char *device;
-extern struct OptionsType Options;
 extern FILE *yyin;
 extern int yyfailed;
@@ -74 +73 @@
   printf("ipfm version %s\n\n", VERSION);
 #ifdef __OS_LINUX__
-  printf("\t-n, --nodaemon:\tdo not run as a daemon\n");
+  printf("\t-n, --nodaemon:\t\tdo not run as a daemon\n");
   printf("\t-c <file>, --config <file>:\tspecify an alternate configuration file\n");
-  printf("\t-h, --help:\tdisplay this help and exit\n");
+  printf("\t-h, --help:\t\tdisplay this help and exit\n");
   printf("\t-p <file>, --pid <file>:\tspecify an alternate pid file\n");
+  printf("\t-r <file>, --readfrom <file>:\tread packets from file (tcpdump raw format)\n");
 #else
   printf("\t-n:\tdo not run as a daemon\n");
@@ -83 +83 @@
   printf("\t-h:\tdisplay this help and exit\n");
   printf("\t-p <file>:\tspecify an alternate pid file\n");
+  printf("\t-r <file>:\tread packets from file (tcpdump raw format)\n");
 #endif /* __OS_LINUX__ */
   printf("\nPlease report bugs to ipfm@via.ecp.fr\n");
@@ -100 +101 @@
     { "nodaemon", 0, &run_as_daemon, 0 },
     { "pidfile", 1, NULL, 0 },
+    { "readfrom", 1, NULL, 0 },
     { NULL, 0, NULL, 0 }
   };
@@ -106 +108 @@
   Options.ConfigFile = NULL;
   Options.PidFile = NULL;
-
-#ifdef __OS_LINUX__
-  while (EOF != (ch = getopt_long(argc, argv, "hnc:p:", long_options,
+  Options.ReadFromFile = NULL;
+
+#ifdef __OS_LINUX__
+  while (EOF != (ch = getopt_long(argc, argv, "hnc:p:r:", long_options,
                                  &option_index))) {
 #else
-  while (EOF != (ch = getopt(argc, argv, "hnc:p:"))) {
+  while (EOF != (ch = getopt(argc, argv, "hnc:p:r:"))) {
 #endif /* __OS_LINUX__ */
     switch(ch) {          
@@ -129 +132 @@
       case 3:
         Options.PidFile = xstrdup(optarg);
+        break;
+      case 4:
+        Options.ReadFromFile = xstrdup(optarg);
         break;
       }
@@ -142 +148 @@
       Options.PidFile = xstrdup(optarg);
       break;
+    case 'r':
+      Options.ReadFromFile = xstrdup(optarg);
+      break;      
     case 'h':
     case '?':

trunk/source/init.h

@@ -28 +28 @@
   char *ConfigFile;
   char *PidFile;
+  char *ReadFromFile;
 };
 

trunk/source/pcap.c

@@ -49 +49 @@
 extern int promisc;
 extern char *device;
+extern struct OptionsType Options;
 
 /* Global variable. This forbids to open 2 pcap descriptors. */
@@ -108 +109 @@
   }
 
-  pcap_global_descriptor = pcap_open_live(device, SNAPLEN, promisc, 0, errbuf);
+  if (Options.ReadFromFile == NULL) {
+    pcap_global_descriptor = pcap_open_live(device, SNAPLEN, promisc,
+                                            0, errbuf);
+  } else {
+    pcap_global_descriptor = pcap_open_offline(Options.ReadFromFile, errbuf);
+  }
+
   if (NULL == pcap_global_descriptor) {
     fprintf(stderr, "[pcap] error opening pcap: %s\n", errbuf);
@@ -244 +251 @@
 
   if (NULL == pcap_global_descriptor) {
-    fprintf(stderr, "[pcap] Can't read non-opened pcap descriptor");
+    fprintf(stderr, "[pcap] Can't read non-opened pcap descriptor\n");
   }
 
@@ -252 +259 @@
     if (NULL == packet) {
       /* if pcap_next returns, there is an error on the link, so we close it and try to reopen it */
-      DEBUG_MSG("pcap_next returned a null pointer [%s]\n", pcap_geterr(pcap_global_descriptor));
+      DEBUG_MSG("pcap_next returned a null pointer [errormessage : %s]\n", pcap_geterr(pcap_global_descriptor));
+      if (Options.ReadFromFile != NULL) {
+        /* we reached the end of the file ; dump and exit. */
+        struct AllLogsType *pTempLog;
+
+        for (pTempLog = pAllLogs;
+             NULL != pTempLog;
+             pTempLog = pTempLog->Next) {
+          data_dump(pTempLog);
+          data_clear(pTempLog);
+        }
+        Exit(0);
+      }
       closepcap();
       sleep(2);
@@ -266 +285 @@
     if ( ((struct ip *) packet)->ip_hl < 5 || ((struct ip *) packet)->ip_v != 4 || iphdr_chksum(packet, ((struct ip *) packet)->ip_hl) != 0 ) {
       /* Not an IP packet */
-      DEBUG_MSG("getnextippkt : dropped a malformed IP packet");
+      DEBUG_MSG("getnextippkt : dropped a malformed IP packet\n");
       continue;
     }