Main Page | Namespace List | Class Hierarchy | Alphabetical List | Class List | File List | Namespace Members | Class Members | File Members

Net.h File Reference

#include "net_util.h"
#include "BPF_Program.h"
#include "List.h"
#include "PktSrc.h"
#include "Func.h"
#include "RemoteSerializer.h"

Include dependency graph for Net.h:

Include dependency graph

This graph shows which files directly or indirectly include this file:

Included by dependency graph

Go to the source code of this file.

Functions

void net_init (name_list &interfaces, name_list &readfiles, const char *writefile, const char *transformed_writefile, const char *filter, const char *secondary_filter, int do_watchdog)
void net_run ()
void net_get_final_stats ()
void net_finish (int drain_events)
void net_delete ()
void net_packet_arrival (double t, const struct pcap_pkthdr *hdr, const u_char *pkt, int hdr_size, PktSrc *src_ps)
int net_packet_match (BPF_Program *fp, const u_char *pkt, u_int len, u_int caplen)
void termination_signal ()
void net_suspend_processing ()
void net_continue_processing ()
bool net_is_processing_suspended ()
 declare (PList, PktSrc)
 PList (PktSrc) pkt_srcs

Variables

int _processing_suspended
int reading_live
int reading_traces
int have_pending_timers
int pseudo_realtime
char * user_pcap_filter
double processing_start_time
double bro_start_time
bool terminating
bool using_communication
const struct pcap_pkthdr * current_hdr
const u_char * current_pkt
int current_dispatched
PktSrc * current_pktsrc
PktDumper * pkt_dumper
PktDumper * pkt_transformed_dumper
char * writefile

Function Documentation

declare (  PList  ,
PktSrc 
) 
 

void net_continue_processing (   ) 
 

Definition at line 571 of file Net.cc.

References _processing_suspended, bro_logger, and Logger::Log().

Referenced by RemoteSerializer::ProcessPhaseDone(). 

00572         {
00573         if ( _processing_suspended == 1 )
00574                 bro_logger->Log("processing continued");
00575         --_processing_suspended;
00576         }

void net_delete (   ) 
 

Definition at line 525 of file Net.cc.

References ip_anonymizer, NUM_ADDR_ANONYMIZATION_METHODS, packet_sorter, sessions, and transformed_pkt_dump.

Referenced by main(), and termination_signal(). 

00526         {
00527         delete sessions;
00528         delete packet_sorter;
00529 
00530         // Can't put this in net_finish() because packets might be
00531         // dumped when connections are deleted.
00532         if ( transformed_pkt_dump )
00533                 delete transformed_pkt_dump;
00534 
00535         for ( int i = 0; i < NUM_ADDR_ANONYMIZATION_METHODS; ++i )
00536                 delete ip_anonymizer[i];
00537         }

void net_finish (  int  drain_events  ) 
 

Definition at line 497 of file Net.cc.

References NetSessions::Done(), EventMgr::Drain(), NetSessions::Drain(), mgr, num_packets_cleaned, num_packets_held, pkt_dumper, pkt_transformed_dumper, and sessions.

Referenced by done_with_network(), and watchdog(). 

00498         {
00499         if ( drain_events )
00500                 {
00501                 if ( sessions )
00502                         sessions->Drain();
00503 
00504                 mgr.Drain();
00505 
00506                 if ( sessions )
00507                         sessions->Done();
00508                 }
00509 
00510         delete pkt_dumper;
00511         delete pkt_transformed_dumper;
00512 
00513         // fprintf(stderr, "uhash: %d/%d\n", hash_cnt_uhash, hash_cnt_all);
00514 
00515 #ifdef DEBUG
00516         extern int reassem_seen_bytes, reassem_copied_bytes;
00517         // DEBUG_MSG("Reassembly (TCP and IP/Frag): %d bytes seen, %d bytes copied\n",
00518                 reassem_seen_bytes, reassem_copied_bytes);
00519 
00520         extern int num_packets_held, num_packets_cleaned;
00521         // DEBUG_MSG("packets clean up: %d/%d\n", num_packets_cleaned, num_packets_held);
00522 #endif
00523         }

void net_get_final_stats (   ) 
 

Definition at line 481 of file Net.cc.

References PktSrc::Stats::dropped, PktSrc::Interface(), PktSrc::IsLive(), loop_over_list, PktSrc::Stats::received, and PktSrc::Statistics().

Referenced by net_run(), termination_signal(), and watchdog(). 

00482         {
00483         loop_over_list(pkt_srcs, i)
00484                 {
00485                 PktSrc* ps = pkt_srcs[i];
00486 
00487                 if ( ps->IsLive() )
00488                         {
00489                         struct PktSrc::Stats s;
00490                         ps->Statistics(&s);
00491                         fprintf(stderr, "%d packets received on interface %s, %d dropped\n",
00492                                         s.received, ps->Interface(), s.dropped);
00493                         }
00494                 }
00495         }

void net_init (  name_list &  interfaces,
name_list &  readfiles,
const char *  writefile,
const char *  transformed_writefile,
const char *  filter,
const char *  secondary_filter,
int  do_watchdog
) 
 

Definition at line 155 of file Net.cc.

References PktSrc::AddSecondaryTablePrograms(), PktDumper::ErrorMsg(), PktSrc::ErrorMsg(), init_ip_addr_anonymizers(), init_net_var(), io_sources, ip_anonymizer, PktDumper::IsError(), IOSource::IsOpen(), NUM_ADDR_ANONYMIZATION_METHODS, packet_sort_window, packet_sorter, PktDumper::PcapDumper(), pkt_dumper, pkt_transformed_dumper, prog, pseudo_realtime, reading_live, reading_traces, IOSourceRegistry::Register(), sessions, setsignal(), source_pkt_dump, transformed_pkt_dump, TYPE_FILTER_SECONDARY, watchdog(), watchdog_interval, and writefile.

Referenced by main(). 

00159         {
00160         init_net_var();
00161 
00162         if ( readfiles.length() > 0 )
00163                 {
00164                 reading_live = pseudo_realtime;
00165                 reading_traces = 1;
00166 
00167                 for ( int i = 0; i < readfiles.length(); ++i )
00168                         {
00169                         PktFileSrc* ps = new PktFileSrc(readfiles[i], filter);
00170 
00171                         if ( ! ps->IsOpen() )
00172                                 {
00173                                 fprintf(stderr, "%s: problem with trace file %s - %s\n",
00174                                         prog, readfiles[i], ps->ErrorMsg());
00175                                 exit(1);
00176                                 }
00177                         else
00178                                 {
00179                                 pkt_srcs.append(ps);
00180                                 io_sources.Register(ps);
00181                                 }
00182 
00183                         if ( secondary_filter )
00184                                 {
00185                                 // We use a second PktFileSrc for the
00186                                 // secondary path.
00187                                 PktFileSrc* ps = new PktFileSrc(readfiles[i],
00188                                                         secondary_filter,
00189                                                         TYPE_FILTER_SECONDARY);
00190 
00191                                 if ( ! ps->IsOpen() )
00192                                         {
00193                                         fprintf(stderr, "%s: problem with trace file %s - %s\n",
00194                                                 prog, readfiles[i],
00195                                                 ps->ErrorMsg());
00196                                         exit(1);
00197                                         }
00198                                 else
00199                                         {
00200                                         pkt_srcs.append(ps);
00201                                         io_sources.Register(ps);
00202                                         }
00203 
00204                                 ps->AddSecondaryTablePrograms();
00205                                 }
00206                         }
00207                 }
00208 
00209         else if ( interfaces.length() > 0 )
00210                 {
00211                 reading_live = 1;
00212                 reading_traces = 0;
00213 
00214                 for ( int i = 0; i < interfaces.length(); ++i )
00215                         {
00216                         PktInterfaceSrc* ps =
00217                                 new PktInterfaceSrc(interfaces[i], filter);
00218 
00219                         if ( ! ps->IsOpen() )
00220                                 {
00221                                 fprintf(stderr, "%s: problem with interface %s - %s\n",
00222                                         prog, interfaces[i], ps->ErrorMsg());
00223                                 exit(1);
00224                                 }
00225                         else
00226                                 {
00227                                 pkt_srcs.append(ps);
00228                                 io_sources.Register(ps);
00229                                 }
00230 
00231                         if ( secondary_filter )
00232                                 {
00233                                 PktInterfaceSrc* ps =
00234                                         new PktInterfaceSrc(interfaces[i],
00235                                                 filter, TYPE_FILTER_SECONDARY);
00236 
00237                                 if ( ! ps->IsOpen() )
00238                                         {
00239                                         fprintf(stderr, "%s: problem with interface %s - %s\n",
00240                                                 prog, interfaces[i],
00241                                                 ps->ErrorMsg());
00242                                         exit(1);
00243                                         }
00244                                 else
00245                                         {
00246                                         pkt_srcs.append(ps);
00247                                         io_sources.Register(ps);
00248                                         }
00249 
00250                                 ps->AddSecondaryTablePrograms();
00251                                 }
00252                         }
00253                 }
00254 
00255         else
00256                 // have_pending_timers = 1, possibly.  We don't set
00257                 // that here, though, because at this point we don't know
00258                 // whether the user's bro_init() event will indeed set
00259                 // a timer.
00260                 reading_traces = reading_live = 0;
00261 
00262         if ( writefile )
00263                 {
00264                 // ### This will fail horribly if there are multiple
00265                 // interfaces with different-lengthed media.
00266                 pkt_dumper = new PktDumper(writefile);
00267                 if ( pkt_dumper->IsError() )
00268                         {
00269                         fprintf(stderr, "%s: can't open write file \"%s\" - %s\n",
00270                                 prog, writefile, pkt_dumper->ErrorMsg());
00271                         exit(1);
00272                         }
00273                 }
00274 
00275         if ( transformed_writefile )
00276                 {
00277                 pkt_transformed_dumper = new PktDumper(transformed_writefile);
00278                 if ( pkt_transformed_dumper->IsError() )
00279                         {
00280                         fprintf(stderr, "%s: can't open trace transformation write file \"%s\" - %s\n",
00281                                 prog, writefile,
00282                                 pkt_transformed_dumper->ErrorMsg());
00283                         exit(1);
00284                         }
00285 
00286                 transformed_pkt_dump =
00287                         new PacketDumper(pkt_transformed_dumper->PcapDumper());
00288 
00289                 // If both -A and -w are specified, -A will be the transformed
00290                 // trace file and -w will be the source packet trace file.
00291                 // Otherwise the packets will go to the same file.
00292                 if ( pkt_dumper )
00293                         source_pkt_dump =
00294                                 new PacketDumper(pkt_dumper->PcapDumper());
00295                 }
00296 
00297         else if ( pkt_dumper )
00298                 transformed_pkt_dump =
00299                         new PacketDumper(pkt_dumper->PcapDumper());
00300 
00301         if ( anonymize_ip_addr )
00302                 init_ip_addr_anonymizers();
00303         else
00304                 for ( int i = 0; i < NUM_ADDR_ANONYMIZATION_METHODS; ++i )
00305                         ip_anonymizer[i] = 0;
00306 
00307         if ( packet_sort_window > 0 )
00308                 packet_sorter = new PacketSortGlobalPQ();
00309 
00310         sessions = new NetSessions();
00311 
00312         if ( do_watchdog )
00313                 {
00314                 // Set up the watchdog to make sure we don't wedge.
00315                 (void) setsignal(SIGALRM, watchdog);
00316                 (void) alarm(watchdog_interval);
00317                 }
00318         }

bool net_is_processing_suspended (   )  [inline]
 

Definition at line 53 of file Net.h.

References _processing_suspended.

Referenced by PktSrc::ExtractNextPacket(), and RemoteSerializer::ProcessSerialization(). 

00054         { return _processing_suspended > 0; }

void net_packet_arrival (  double  t,
const struct pcap_pkthdr *  hdr,
const u_char *  pkt,
int  hdr_size,
PktSrc *  src_ps
) 
 

Definition at line 373 of file Net.cc.

References PacketSortGlobalPQ::Add(), net_packet_dispatch(), packet_sorter, and process_packet_sorter().

Referenced by PktSrc::Process(). 

00376         {
00377         if ( packet_sorter )
00378                 {
00379                 // Note that when we enable packet sorter, there will
00380                 // be a small window between the time packet arrives
00381                 // to Bro and when it is processed ("dispatched").  We
00382                 // define network_time to be the latest timestamp for
00383                 // packets *dispatched* so far (usually that's the
00384                 // timestamp of the current packet).
00385 
00386                 // Add the packet to the packet_sorter.
00387                 packet_sorter->Add(
00388                         new PacketSortElement(src_ps, t, hdr, pkt, hdr_size));
00389 
00390                 // Do we have any packets to dispatch from packet_sorter?
00391                 process_packet_sorter(t);
00392                 }
00393         else
00394                 // Otherwise we dispatch the packet immediately
00395                 net_packet_dispatch(t, hdr, pkt, hdr_size, src_ps, 0);
00396         }

int net_packet_match (  BPF_Program *  fp,
const u_char *  pkt,
u_int  len,
u_int  caplen
) 
 

Definition at line 554 of file Net.cc.

References bpf_program::bf_insns, bpf_filter(), BPF_Program::GetProgram(), and len.

Referenced by NetSessions::NextPacketSecondary(). 

00556         {
00557         // NOTE: I don't like too much un-const'ing the pkt variable.
00558         return bpf_filter(fp->GetProgram()->bf_insns, (u_char*) pkt, len, caplen);
00559         }

void net_run (   ) 
 

Definition at line 398 of file Net.cc.

References TimerMgr::Advance(), current_dispatched, current_time(), EventMgr::Drain(), PacketSortGlobalPQ::Empty(), IOSourceRegistry::FindSoonest(), have_pending_timers, io_sources, max_timer_expires, mgr, net_get_final_stats(), network_time, packet_sort_window, packet_sorter, IOSource::Process(), process_packet_sorter(), processing_start_time, reading_live, reading_traces, signal_val, TimerMgr::Size(), IOSourceRegistry::Size(), termination_signal(), timer_mgr, and using_communication.

Referenced by main(). 

00399         {
00400         while ( io_sources.Size() || have_pending_timers )
00401                 {
00402                 double ts;
00403                 IOSource* src =
00404                         io_sources.Size() ? io_sources.FindSoonest(&ts) : 0;
00405 
00406                 if ( src )
00407                         src->Process(); // which will call net_packet_arrival()
00408 
00409                 else if ( reading_live )
00410                         {
00411                         double ct = current_time();
00412                         if ( packet_sorter && ! packet_sorter->Empty() )
00413                                 process_packet_sorter(ct);
00414                         else
00415                                 {
00416                                 // Take advantage of the lull to get up to
00417                                 // date on timers and events.
00418                                 network_time = ct;
00419                                 timer_mgr->Advance(network_time, max_timer_expires);
00420                                 }
00421                         }
00422 
00423                 else if ( have_pending_timers )
00424                         {
00425                         // Take advantage of the lull to get up to
00426                         // date on timers and events.  Because we only
00427                         // have timers as sources, going to sleep here
00428                         // doesn't risk blocking on other inputs.
00429                         network_time = current_time();
00430                         timer_mgr->Advance(network_time, max_timer_expires);
00431 
00432                         // Avoid busy-waiting - pause for 100 ms.
00433                         // We pick a sleep value of 100 msec that buys
00434                         // us a lot of idle time, but doesn't delay near-term
00435                         // timers too much.  (Delaying them somewhat is okay,
00436                         // since Bro timers are not high-precision anyway.)
00437                         if ( ! using_communication )
00438                                 usleep(100000);
00439 
00440                         // Flawfinder says about usleep:
00441                         //
00442                         // This C routine is considered obsolete (as opposed
00443                         // to the shell command by the same name).   The
00444                         // interaction of this function with SIGALRM and
00445                         // other timer functions such as sleep(), alarm(),
00446                         // setitimer(), and nanosleep() is unspecified.
00447                         // Use nanosleep(2) or setitimer(2) instead.
00448                         }
00449 
00450                 mgr.Drain();
00451 
00452                 processing_start_time = 0.0;    // = "we're not processing now"
00453                 current_dispatched = 0;
00454 
00455                 // Should we put the signal handling into an IOSource?
00456                 extern void termination_signal();
00457                 if ( signal_val == SIGTERM || signal_val == SIGINT )
00458                         // We received a signal while processing the
00459                         // current packet and its related events.
00460                         termination_signal();
00461 
00462                 if ( ! reading_traces )
00463                         // Check whether we have timers scheduled for
00464                         // the future on which we need to wait.
00465                         have_pending_timers = timer_mgr->Size() > 0;
00466                 }
00467 
00468         if ( packet_sorter )
00469                 {
00470                 // Drain packets remaining in the packet sorter.
00471                 process_packet_sorter(network_time + packet_sort_window + 100);
00472                 }
00473 
00474         // Get the final statistics now, and not when net_finish() is
00475         // called, since that might happen quite a bit in the future
00476         // due to expiring pending timers, and we don't want to ding
00477         // for any packets dropped beyond this point.
00478         net_get_final_stats();
00479         }

void net_suspend_processing (   ) 
 

Definition at line 564 of file Net.cc.

References _processing_suspended, bro_logger, and Logger::Log().

Referenced by RemoteSerializer::HandshakeDone(). 

00565         {
00566         if ( _processing_suspended == 0 )
00567                 bro_logger->Log("processing suspended");
00568         ++_processing_suspended;
00569         }

PList (  PktSrc   ) 
 

void termination_signal (   ) 
 

Definition at line 240 of file main.cc.

References BroFile::CloseCachedFiles(), done_with_network(), message(), net_delete(), net_get_final_stats(), rule_matcher, signal_val, terminate_bro(), and TYPE_COUNT.

Referenced by PktSrc::ExtractNextPacket(), net_run(), and sig_handler(). 

00241         {
00242         Val sval(signal_val, TYPE_COUNT);
00243         message("received termination signal");
00244         net_get_final_stats();
00245         done_with_network();
00246         terminate_bro();
00247         net_delete();
00248 
00249         // Close files after net_delete(), because net_delete()
00250         // might write to connection content files.
00251         BroFile::CloseCachedFiles();
00252 
00253         delete rule_matcher;
00254 
00255         exit(0);
00256         }

Variable Documentation

int _processing_suspended
 

Definition at line 52 of file Net.h.

Referenced by net_continue_processing(), net_is_processing_suspended(), and net_suspend_processing().

double bro_start_time
 

Definition at line 83 of file Net.h.

Referenced by main(), and RemoteSerializer::PeerConnected().

int current_dispatched
 

Definition at line 93 of file Net.h.

Referenced by net_packet_dispatch(), net_run(), and watchdog().

const struct pcap_pkthdr* current_hdr
 

Definition at line 91 of file Net.h.

Referenced by net_packet_dispatch(), and watchdog().

const u_char* current_pkt
 

Definition at line 92 of file Net.h.

Referenced by net_packet_dispatch(), and watchdog().

PktSrc* current_pktsrc
 

Definition at line 94 of file Net.h.

Referenced by net_packet_dispatch().

int have_pending_timers
 

Definition at line 69 of file Net.h.

Referenced by main(), and net_run().

PktDumper* pkt_dumper
 

Definition at line 99 of file Net.h.

Referenced by NetSessions::DumpPacket(), get_src_pkt_writer(), net_finish(), net_init(), and watchdog().

PktDumper* pkt_transformed_dumper
 

Definition at line 100 of file Net.h.

Referenced by net_finish(), and net_init().

double processing_start_time
 

Definition at line 80 of file Net.h.

Referenced by net_packet_dispatch(), net_run(), sig_handler(), and watchdog().

int pseudo_realtime
 

Definition at line 73 of file Net.h.

Referenced by PktSrc::ExtractNextPacket(), PktSrc::GetFds(), RemoteSerializer::Init(), main(), net_init(), NetSessions::NetSessions(), and PktSrc::NextTimestamp().

int reading_live
 

Definition at line 57 of file Net.h.

Referenced by TCP_Contents::AckReceived(), main(), net_init(), net_run(), and NetSessions::NetSessions().

int reading_traces
 

Definition at line 62 of file Net.h.

Referenced by RemoteSerializer::Init(), main(), net_init(), net_run(), and PktSrc::Statistics().

bool terminating
 

Definition at line 86 of file Net.h.

Referenced by IncrementalWriteTimer::Dispatch(), done_with_network(), UDP_DNS::ExpireTimer(), UDP_NetbiosSSN::ExpireTimer(), and terminate_bro().

char* user_pcap_filter
 

Definition at line 76 of file Net.h.

Referenced by main().

bool using_communication
 

Definition at line 89 of file Net.h.

Referenced by RemoteSerializer::Connect(), PktSrc::ExtractNextPacket(), RemoteSerializer::FatalError(), RemoteSerializer::Init(), RemoteSerializer::Listen(), main(), net_run(), NameExpr::ReferenceID(), RemoteSerializer::RequestEvents(), RemoteSerializer::RequestSync(), RemoteSerializer::SendCall(), RemoteSerializer::SendCaptureFilter(), RemoteSerializer::SendConnection(), RemoteSerializer::SendID(), RemoteSerializer::SendPacket(), and RemoteSerializer::SendPing().

char* writefile
 

Definition at line 102 of file Net.h.

Referenced by main(), and net_init().

Generated on Wed Sep 14 03:01:45 2005 for bro_docs by doxygen 1.3.5