| -rw-r--r-- | libopie2/opienet/opcap.cpp | 48 | ||||
| -rw-r--r-- | libopie2/opienet/opcap.h | 64 |
2 files changed, 101 insertions, 11 deletions
diff --git a/libopie2/opienet/opcap.cpp b/libopie2/opienet/opcap.cpp index 6a3dc26..30f6208 100644 --- a/libopie2/opienet/opcap.cpp +++ b/libopie2/opienet/opcap.cpp @@ -783,125 +783,169 @@ void OPacketCapturer::close() _sn->disconnect( SIGNAL( activated(int) ), this, SLOT( readyToReceive() ) ); delete _sn; } pcap_close( _pch ); _open = false; } qDebug( "OPacketCapturer::close() --- dumping capturing statistics..." ); qDebug( "--------------------------------------------------" ); for( QMap<QString,int>::Iterator it = _stats.begin(); it != _stats.end(); ++it ) qDebug( "%s : %d", (const char*) it.key(), it.data() ); qDebug( "--------------------------------------------------" ); } int OPacketCapturer::dataLink() const { return pcap_datalink( _pch ); } int OPacketCapturer::fileno() const { if ( _open ) { return pcap_fileno( _pch ); } else { return -1; } } OPacket* OPacketCapturer::next() { packetheaderstruct header; qDebug( "==> OPacketCapturer::next()" ); const unsigned char* pdata = pcap_next( _pch, &header ); qDebug( "<== OPacketCapturer::next()" ); if ( header.len ) { OPacket* p = new OPacket( dataLink(), header, pdata, 0 ); // packets shouldn't be inserted in the QObject child-parent hierarchy, // because due to memory constraints they will be deleted as soon // as possible - that is right after they have been processed // by emit() [ see below ] - //TODO: make gathering statistics optional, because it takes time p->updateStats( _stats, const_cast<QObjectList*>( p->children() ) ); return p; } else { return 0; } } bool OPacketCapturer::open( const QString& name ) { if ( _open ) { if ( name == _name ) // ignore opening an already openend device { return true; } else // close the last opened device { close(); } } _name = name; pcap_t* handle = pcap_open_live( const_cast<char*>( (const char*) name ), 1024, 0, 0, &_errbuf[0] ); if ( handle ) { qDebug( "OPacketCapturer::open(): libpcap opened successfully." ); _pch = handle; _open = true; _stats.clear(); // in case we have an application object, create a socket notifier if ( qApp ) { _sn = new QSocketNotifier( fileno(), QSocketNotifier::Read ); connect( _sn, SIGNAL( activated(int) ), this, SLOT( readyToReceive() ) ); } return true; } else { - qDebug( "OPacketCapturer::open(): can't open libpcap: %s", _errbuf ); + qDebug( "OPacketCapturer::open(): can't open libpcap with '%s': %s", (const char*) name, _errbuf ); + return false; + } + +} + + +bool OPacketCapturer::open( const QFile& file ) +{ + QString name = file.name(); + + if ( _open ) + { + close(); + if ( name == _name ) // ignore opening an already openend device + { + return true; + } + else // close the last opened device + { + close(); + } + } + + _name = name; + + pcap_t* handle = pcap_open_offline( const_cast<char*>( (const char*) name ), &_errbuf[0] ); + + if ( handle ) + { + qDebug( "OPacketCapturer::open(): libpcap opened successfully." ); + _pch = handle; + _open = true; + + // in case we have an application object, create a socket notifier + if ( qApp ) + { + _sn = new QSocketNotifier( fileno(), QSocketNotifier::Read ); + connect( _sn, SIGNAL( activated(int) ), this, SLOT( readyToReceive() ) ); + } + + return true; + } + else + { + qDebug( "OPacketCapturer::open(): can't open libpcap with '%s': %s", (const char*) name, _errbuf ); return false; } } bool OPacketCapturer::isOpen() const { return _open; } void OPacketCapturer::readyToReceive() { qDebug( "OPacketCapturer::readyToReceive(): about to emit 'receivePacket(p)'" ); OPacket* p = next(); emit receivedPacket( p ); // emit is synchronous - packet has been dealt with, now it's safe to delete delete p; } const QMap<QString,int>& OPacketCapturer::statistics() const { return _stats; } diff --git a/libopie2/opienet/opcap.h b/libopie2/opienet/opcap.h index c9b0624..6c3ac6d 100644 --- a/libopie2/opienet/opcap.h +++ b/libopie2/opienet/opcap.h @@ -2,96 +2,97 @@ This file is part of the Opie Project Copyright (C) 2003 by the Wellenreiter team: Martin J. Muench <mjm@remote-exploit.org> Max Moser <mmo@remote-exploit.org Michael 'Mickey' Lauer <mickey@tm.informatik.uni-frankfurt.de> =. .=l. .>+-= _;:, .> :=|. This program is free software; you can .> <`_, > . <= redistribute it and/or modify it under :`=1 )Y*s>-.-- : the terms of the GNU Library General Public .="- .-=="i, .._ License as published by the Free Software - . .-<_> .<> Foundation; either version 2 of the License, ._= =} : or (at your option) any later version. .%`+i> _;_. .i_,=:_. -<s. This program is distributed in the hope that + . -:. = it will be useful, but WITHOUT ANY WARRANTY; : .. .:, . . . without even the implied warranty of =_ + =;=|` MERCHANTABILITY or FITNESS FOR A _.=:. : :=>`: PARTICULAR PURPOSE. See the GNU ..}^=.= = ; Library General Public License for more ++= -. .` .: details. : = ...= . :.=- -. .:....=;==+<; You should have received a copy of the GNU -_. . . )=. = Library General Public License along with -- :-=` this library; see the file COPYING.LIB. If not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ #ifndef OPCAP_H #define OPCAP_H /* LINUX */ extern "C" // work around a bpf/pcap conflict in recent headers { #include <pcap.h> } #include <netinet/ether.h> #include <netinet/ip.h> #include <netinet/udp.h> #include <netinet/tcp.h> #include <time.h> /* QT */ #include <qevent.h> +#include <qfile.h> #include <qhostaddress.h> #include <qobject.h> #include <qstring.h> #include <qmap.h> /* OPIE */ #include <opie2/onetutils.h> #include "802_11_user.h" /* TYPEDEFS */ typedef struct timeval timevalstruct; typedef struct pcap_pkthdr packetheaderstruct; /* FORWARDS */ class OPacketCapturer; class QSocketNotifier; /*====================================================================================== * OPacket - A frame on the wire *======================================================================================*/ class OPacket : public QObject { Q_OBJECT public: OPacket( int datalink, packetheaderstruct, const unsigned char*, QObject* parent ); virtual ~OPacket(); timevalstruct timeval() const; int caplen() const; int len() const; QString dump( int = 32 ) const; void updateStats( QMap<QString,int>&, QObjectList* ); private: const packetheaderstruct _hdr; // pcap packet header const unsigned char* _data; // pcap packet data const unsigned char* _end; // end of pcap packet data }; /*====================================================================================== * OEthernetPacket - DLT_EN10MB frame *======================================================================================*/ class OEthernetPacket : public QObject @@ -375,85 +376,130 @@ class OIPPacket : public QObject private: const struct iphdr* _iphdr; }; /*====================================================================================== * OUDPPacket *======================================================================================*/ class OUDPPacket : public QObject { Q_OBJECT public: OUDPPacket( const unsigned char*, const struct udphdr*, QObject* parent = 0 ); virtual ~OUDPPacket(); int fromPort() const; int toPort() const; private: const struct udphdr* _udphdr; }; /*====================================================================================== * OTCPPacket *======================================================================================*/ class OTCPPacket : public QObject { Q_OBJECT public: OTCPPacket( const unsigned char*, const struct tcphdr*, QObject* parent = 0 ); virtual ~OTCPPacket(); int fromPort() const; int toPort() const; private: const struct tcphdr* _tcphdr; }; /*====================================================================================== * OPacketCapturer *======================================================================================*/ +/** + * @brief A class based wrapper for network packet capturing. + * + * This class is the base of a high-level interface to the well known packet capturing + * library libpcap. ... + */ class OPacketCapturer : public QObject { Q_OBJECT public: + /** + * Constructor. + */ OPacketCapturer( QObject* parent = 0, const char* name = 0 ); + /** + * Destructor. + */ ~OPacketCapturer(); - + /** + * Setting the packet capturer to use blocking IO calls can be useful when + * not using the socket notifier, e.g. without an application object. + */ void setBlocking( bool ); + /** + * @returns true if the packet capturer uses blocking IO calls. + */ bool blocking() const; - + /** + * Closes the packet capturer. This is automatically done in the destructor. + */ void close(); + /** + * @returns the data link type. + * @see <pcap.h> for possible values. + */ int dataLink() const; + /** + * @returns the filedescriptor of the packet capturer. This is only useful, if + * not using the socket notifier, e.g. without an application object. + */ int fileno() const; + /** + * @returns the next @ref OPacket from the packet capturer. + * @note If blocking mode is true then this call might block. + */ OPacket* next(); - bool open( const QString& name ); + /** + * Open the packet capturer to capture packets in live-mode from @a interface. + */ + bool open( const QString& interface ); + /** + * Open the packet capturer to capture packets in offline-mode from @a file. + */ + bool open( const QFile& file ); + /** + * @returns true if the packet capturer is open + */ bool isOpen() const; const QMap<QString,int>& statistics() const; signals: + /** + * This signal is emitted, when a packet has been received. + */ void receivedPacket( OPacket* ); protected slots: void readyToReceive(); protected: - QString _name; // devicename - bool _open; // check this before doing pcap calls - pcap_t* _pch; // pcap library handle - QSocketNotifier* _sn; // socket notifier for main loop - mutable char _errbuf[PCAP_ERRBUF_SIZE]; - QMap<QString, int> _stats; // statistics; + QString _name; // devicename + bool _open; // check this before doing pcap calls + pcap_t* _pch; // pcap library handle + QSocketNotifier* _sn; // socket notifier for main loop + mutable char _errbuf[PCAP_ERRBUF_SIZE]; // holds error strings from libpcap + QMap<QString, int> _stats; // statistics; }; #endif // OPCAP_H |