summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-09-15netsniff-ng: nlmsg: mmaped packet checkKen-ichirou MATSUZAWA1-2/+13
The size of mmaped netlink packet is equals to its frame size, so may be different from actual size. It can be checked by the next nlmsg len is 0 or not, and trim it in that case. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-15netsniff-ng: nlmsg: update pull sizeKen-ichirou MATSUZAWA1-4/+4
It would be better to use NLMSG_HDRLEN instead of sizeof(*hdr) and not to use NLMSG_PAYLOAD to get payload length, I think. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-10dissector: make netlink directions a bit more readableDaniel Borkmann1-2/+2
Display them as K->U resp. U->K. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-09-07curvetun: Don't attempt to close negative file descriptorTobias Klauser1-1/+1
Complete fix for Coverity issue CID 991822, commit 047d69c4e ("curvetun: Fix issues detected by the Coverity scanner") only fixed one instance of this issue. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-07curvetun: Fix issues detected by the Coverity scannerTobias Klauser2-5/+12
Fix two issues detected by the Coverity scanner (CID 991819 & CID 991822) Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-07flowtop: Don't attempt to set sysctl values if initial read failsTobias Klauser1-0/+2
Bail out early if we fail to read the current sysctl variable values for net/netfilter/nf_conntrack_acct and net/netfilter/nf_conntrack_timestamp Otherwise we'll not be able restore the previous value on exit/panic. Moreover, if we fail to read the sysctl file, we usually also lack the permissions to write it. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-04flowtop: man: Fix small typo of timestampinfVadim Kochan1-1/+1
Fix typo timestampinf -> timestamping Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-03flowtop: man: Add notes about flow duration timeVadim Kochan1-0/+11
Add short info about timestamping enabling & connection duration time feature. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Minor rewordings] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-03flowtop: Enable flow timestamp on startVadim Kochan1-9/+36
Allow setting start/stop timestamp for new flows by enabling: /proc/sys/net/netfilter/nf_conntrack_timestamp on start and resetting it on exit or panic. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Remove unnecessary cast of void pointer] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-03flowtop: Show flow time durationTobias Klauser1-0/+33
Show flow time duration in human readable form. Originally submitted by Vadim in a slightly different form. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-25doc: Rename BUILD to README.devel and add information about CoverityTobias Klauser2-4/+12
Don't spread the information over too many documents, this is a first step to consolidate them a bit. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-25netsniff-ng: Show total rx stats for multi pcap modeVadim Kochan3-66/+77
Allow to collect rx stats for multiple pcap mode, by storing them in separated variables before switch to the next pcap file. It allows to have the one approach when dump for single or multiple pcap(s) mode. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-24netsniff-ng: Use correct flag to check tpacket uhdr validityTobias Klauser1-4/+3
When fixing up a build error introduced by commit 579e8524 ("netsniff-ng: vlan: Show vlan info from tpacket v3"), the used definitions got mixed up and TP_STATUS_VLAN_TPID_VALID ended up not being checked at all. Fix this up and make the code a bit easier to read Fixes: 3384ee71 ("netsniff-ng: ring: Fix build if tp_vlan_tpid is not available in kernel header") Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-19build: Only use tput if $TERM is definedTobias Klauser1-2/+7
Otherwise we clutter the build log with warnings such as: tput: No value for $TERM and no -T specified on head-less CI/build systems (e.g. Debian's buildd). Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-19build: Don't strip generated binariesTobias Klauser3-17/+0
Except for some minor saving in disk space, stripping the binaries doesn't bring any benefits and it might prevent us from getting usable debugging information even from binaries build with DEBUG not set. Most distributions will strip the binaries as part of their packaging process anyhow. If someone really wants stripped binaries as a result of the netsniff-ng build, they could still add '-s' to CFLAGS or call strip manually. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-19netsniff-ng: proto_ipv4: Fix typo in commentTobias Klauser1-1/+1
s/coul/could/ Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-19build: configure: Prepend $SYSROOT to NACL_{INC,LIB}_DIRTobias Klauser1-2/+2
Otherwise nacl will not get picked up when cross-compiling. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-19build: configure: Properly encapsulate stringsTobias Klauser1-3/+3
This fixes the following errors when running configure e.g. inside the OpenEmbedded environment: ./configure: line 23: [: too many arguments ./configure: line 24: [: i586-oe-linux-ld: binary operator expected Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-17netsniff-ng: ring: Fix build if tp_vlan_tpid is not available in kernel headerTobias Klauser1-2/+8
The tp_vlan_tpid member of struct tpacket_auxdata was only added in kernel commit a0cdfcf39362 ("packet: deliver VLAN TPID to userspace"). Support building netsniff-ng also against kernel headers from earlier versions. Fixes: 579e8524 ("netsniff-ng: vlan: Show vlan info from tpacket v3") Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-17netsniff-ng: vlan: Show vlan info from tpacket v3Vadim Kochan2-0/+36
Show vlan info (vid, prio & proto) from tpacket struct, in separated line. It might be useful to sniff it in case if vlan reordering is on (which is by default) and physical (vlan underlying) device supports vlan offloading. Meanwhile it uses only v3 tpacket info as location of vlan fields are different between v2 & v3 (v1 does not have it at all), but current code only has possibility to check if v3 is used which is not enough. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [ tk: make print format consistent with VLAN dissector ] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-17netsniff-ng: vlan: Use helpers when parse vlan headerVadim Kochan2-3/+31
Add proto_vlan.h with helpers to parse VLAN fields. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-10AUTHORS: Update contributor list and sort it alphabeticallyTobias Klauser1-17/+22
Add some people to the minor contributors list who were previously missing. Also sort the list alphabetically to make it easier to keep the list up to date. Also move Vadim one position up in the major contributors list according to the current commit count. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-07flowtop: Simplify nfct_is_dns()Tobias Klauser1-13/+8
Instead of creating an additional struct flow_entry on the stack just to use the CP_NFCT macros, call nfct_get_attr_u16() directly. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-07flowtop: Remove tprintf.o from object dependenciesTobias Klauser1-1/+0
The tprintf module isn't used in flowtop, no need to link it in. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-06zsh: netsniff-ng: Add completetion for --cookedTobias Klauser1-0/+1
Commit da8fcdd7 ("netsniff-ng: Add cooked cmdline option.") added the -w/--cooked command line option but didn't add it to the zsh completition. Do so now. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-06flowtop: Show counters in same color as their directionVadim Kochan1-20/+22
Show byte/packet counters in the same colors as their direction: - src in red - dst in blue so it will be easiser to identify them by direction. Also unifed counters printing in one function and changed counters naming similar to other *_src members of flow_entry struct. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Reverted to using parentheses in printed message] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-06build: travis: Switch from legacy to container based travis buildsTobias Klauser1-3/+13
We should get faster builds by using their new infrastructure. Reference: http://docs.travis-ci.com/user/migrating-from-legacy/ Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-05build: curvetun: link against sysctl.oTobias Geerinckx-Rice1-0/+1
Fixes curvetun build failure due to undefined reference to sysctl_get_int in sock.o. [...] LD curvetun curvetun/sock.o: In function `set_system_socket_mem.part.0': sock.c:(.text+0xc0): undefined reference to `sysctl_set_int' curvetun/sock.o: In function `set_system_socket_memory': sock.c:(.text+0x4dd): undefined reference to `sysctl_get_int' sock.c:(.text+0x505): undefined reference to `sysctl_get_int' sock.c:(.text+0x52e): undefined reference to `sysctl_get_int' sock.c:(.text+0x54f): undefined reference to `sysctl_get_int' collect2: error: ld returned 1 exit status Signed-off-by: Tobias Geerinckx-Rice <tobias.geerinckx.rice@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-04flowtop: Do not insert DNS flows into listVadim Kochan1-9/+20
Just ignore DNS flows instead of insert it and then filter it out by presenter. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-04flowtop: Resolve src host if '-s' option specifiedVadim Kochan1-2/+4
Do not do reverse DNS for src hostname if '-s' option is not specified. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-04flowtop: Don't hide status bar while dumping flowsVadim Kochan1-15/+12
Don't hide status bar line when dumping flows but print "[Collecting flows ...]" on the same line. Really there is no sense to hide this status bar line. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03netsniff-ng: Do not tune socket memory in pcap read-only modeVadim Kochan1-0/+1
If a non-privileged user opens a pcap file then netsniff-ng tries to setup socket memory which causes warnings about failing because of permissions. So don't tune socket memory in pcap-read-only mode. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03man: flowtop: Add notes about enabling traffic accountingVadim Kochan1-2/+18
Add some explanation about traffic counters enabling via sysctl and its limitation. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Reword some sentences] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Show counters by directionVadim Kochan1-15/+25
Show bytes/pkts counters per src/dst direction. By default counters originated from dst are showed. Src counters are showed only if '-s' is specified. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Get rid of flushing flows by dumping ipv4/ipv6 tablesVadim Kochan1-30/+122
Get rid of flushing connections which resets all counters. Use dump whole ipv4/ipv6 connection tables to fullfill the existing flows, but this needs to use hand-made flow filtering because nfct_filter does not work when we do NFCT_Q_DUMP. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Rename collector_cb -> flow_event_cbVadim Kochan1-3/+3
Rename collector_cb to reflect behaviour such as catching flow events. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Rename ct_dump -> ct_update, dump_cb -> flow_update_cbVadim Kochan1-8/+8
Rename ct_dump variable & update_cb function so they reflect 'updating' of a particular flow at runtime. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Move filter creating to separate functionVadim Kochan1-16/+18
Move creating nfct filter to separate function to make collector() less messy. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-30sock: Avoid setting negative socket memory valuesTobias Klauser1-1/+1
When getting of the initial values fails in set_system_socket_memory(), we store -1 for the values. Avoid writing these back (and causing an error message) when calling reset_system_socket_memory(). Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-30sock: Don't panic() when sysctl_set_int failsTobias Klauser1-1/+2
Instead print an error message including some more details. netsniff-ng should still remain funcional without the socket sysctl values being set. Suggested-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-30sysctl: Export procfs base path in sysctl.hTobias Klauser2-6/+7
Rename SYS_PATH to SYSCTL_PROC_PATH and make it available in sysctl.h such that it can be used e.g. in error messages. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-30sysctl: Include limits.h instead of linux/limits.hTobias Klauser1-1/+1
Avoid including linux specific headers if possible. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-27flowtop: Fix missing new connections after flushVadim Kochan1-2/+2
There might be new fast connection between flush & handling new events which can be not handled, so put flushing connections before loop. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-27flowtop: Make struct flow_entry member size checks build_bug_on()Tobias Klauser1-3/+3
The city_{src,dst}, country_{src,dst} and rev_dns_{src,dst} members of struct flow_entry have their size defined at compile time, so perform the equal size checks at compile time as well. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-26flowtop: Fix collector stuck while flush IPv6 flowsVadim Kochan1-5/+17
Seems it was caused by specifying all netfilter groups when flushing connections. Used separated nfct instance w/o netfilter groups to flush ipv4/ipv6 connections. More info can be fetched from the issue item on github: https://github.com/netsniff-ng/netsniff-ng/issues/145 Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26ifpps: Cleanup screen on panicVadim Kochan1-0/+8
Clean up ncurses screen when panic was caused. There will be limitation that error message will be printed on stderr after ncurses cleanup, so it will be needed now to use redirect to error file ... ifpps -d <dev> 2> /tmp/err ... to see error message. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26ifpps: Fix panic when dev name contains "_"Vadim Kochan1-1/+1
Add match device name with "_" in /proc/net/dev. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Fix bytes counter print for gigabyteVadim Kochan1-1/+1
'G' should be printed when bytes > 1000000000 but it was printed with 'M' prefix which was caused by missing 'else'. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Use prev & next vars in flow_list_find_prev_id(...)Vadim Kochan1-6/+6
Replace n & tmp variables to more understandable prev & next. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Change tcp param to 'bool is_tcp' in presenter_get_port(..)Vadim Kochan1-5/+5
Rename tcp -> is_tcp param and change it to bool. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-05 05:50:22 +0000