packet.go 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864
  1. // Copyright 2012 Google, Inc. All rights reserved.
  2. //
  3. // Use of this source code is governed by a BSD-style license
  4. // that can be found in the LICENSE file in the root of the source
  5. // tree.
  6. package gopacket
  7. import (
  8. "bytes"
  9. "encoding/hex"
  10. "errors"
  11. "fmt"
  12. "io"
  13. "net"
  14. "os"
  15. "reflect"
  16. "runtime/debug"
  17. "strings"
  18. "syscall"
  19. "time"
  20. )
  21. // CaptureInfo provides standardized information about a packet captured off
  22. // the wire or read from a file.
  23. type CaptureInfo struct {
  24. // Timestamp is the time the packet was captured, if that is known.
  25. Timestamp time.Time
  26. // CaptureLength is the total number of bytes read off of the wire.
  27. CaptureLength int
  28. // Length is the size of the original packet. Should always be >=
  29. // CaptureLength.
  30. Length int
  31. // InterfaceIndex
  32. InterfaceIndex int
  33. // The packet source can place ancillary data of various types here.
  34. // For example, the afpacket source can report the VLAN of captured
  35. // packets this way.
  36. AncillaryData []interface{}
  37. }
  38. // PacketMetadata contains metadata for a packet.
  39. type PacketMetadata struct {
  40. CaptureInfo
  41. // Truncated is true if packet decoding logic detects that there are fewer
  42. // bytes in the packet than are detailed in various headers (for example, if
  43. // the number of bytes in the IPv4 contents/payload is less than IPv4.Length).
  44. // This is also set automatically for packets captured off the wire if
  45. // CaptureInfo.CaptureLength < CaptureInfo.Length.
  46. Truncated bool
  47. }
  48. // Packet is the primary object used by gopacket. Packets are created by a
  49. // Decoder's Decode call. A packet is made up of a set of Data, which
  50. // is broken into a number of Layers as it is decoded.
  51. type Packet interface {
  52. //// Functions for outputting the packet as a human-readable string:
  53. //// ------------------------------------------------------------------
  54. // String returns a human-readable string representation of the packet.
  55. // It uses LayerString on each layer to output the layer.
  56. String() string
  57. // Dump returns a verbose human-readable string representation of the packet,
  58. // including a hex dump of all layers. It uses LayerDump on each layer to
  59. // output the layer.
  60. Dump() string
  61. //// Functions for accessing arbitrary packet layers:
  62. //// ------------------------------------------------------------------
  63. // Layers returns all layers in this packet, computing them as necessary
  64. Layers() []Layer
  65. // Layer returns the first layer in this packet of the given type, or nil
  66. Layer(LayerType) Layer
  67. // LayerClass returns the first layer in this packet of the given class,
  68. // or nil.
  69. LayerClass(LayerClass) Layer
  70. //// Functions for accessing specific types of packet layers. These functions
  71. //// return the first layer of each type found within the packet.
  72. //// ------------------------------------------------------------------
  73. // LinkLayer returns the first link layer in the packet
  74. LinkLayer() LinkLayer
  75. // NetworkLayer returns the first network layer in the packet
  76. NetworkLayer() NetworkLayer
  77. // TransportLayer returns the first transport layer in the packet
  78. TransportLayer() TransportLayer
  79. // ApplicationLayer returns the first application layer in the packet
  80. ApplicationLayer() ApplicationLayer
  81. // ErrorLayer is particularly useful, since it returns nil if the packet
  82. // was fully decoded successfully, and non-nil if an error was encountered
  83. // in decoding and the packet was only partially decoded. Thus, its output
  84. // can be used to determine if the entire packet was able to be decoded.
  85. ErrorLayer() ErrorLayer
  86. //// Functions for accessing data specific to the packet:
  87. //// ------------------------------------------------------------------
  88. // Data returns the set of bytes that make up this entire packet.
  89. Data() []byte
  90. // Metadata returns packet metadata associated with this packet.
  91. Metadata() *PacketMetadata
  92. }
  93. // packet contains all the information we need to fulfill the Packet interface,
  94. // and its two "subclasses" (yes, no such thing in Go, bear with me),
  95. // eagerPacket and lazyPacket, provide eager and lazy decoding logic around the
  96. // various functions needed to access this information.
  97. type packet struct {
  98. // data contains the entire packet data for a packet
  99. data []byte
  100. // initialLayers is space for an initial set of layers already created inside
  101. // the packet.
  102. initialLayers [6]Layer
  103. // layers contains each layer we've already decoded
  104. layers []Layer
  105. // last is the last layer added to the packet
  106. last Layer
  107. // metadata is the PacketMetadata for this packet
  108. metadata PacketMetadata
  109. decodeOptions DecodeOptions
  110. // Pointers to the various important layers
  111. link LinkLayer
  112. network NetworkLayer
  113. transport TransportLayer
  114. application ApplicationLayer
  115. failure ErrorLayer
  116. }
  117. func (p *packet) SetTruncated() {
  118. p.metadata.Truncated = true
  119. }
  120. func (p *packet) SetLinkLayer(l LinkLayer) {
  121. if p.link == nil {
  122. p.link = l
  123. }
  124. }
  125. func (p *packet) SetNetworkLayer(l NetworkLayer) {
  126. if p.network == nil {
  127. p.network = l
  128. }
  129. }
  130. func (p *packet) SetTransportLayer(l TransportLayer) {
  131. if p.transport == nil {
  132. p.transport = l
  133. }
  134. }
  135. func (p *packet) SetApplicationLayer(l ApplicationLayer) {
  136. if p.application == nil {
  137. p.application = l
  138. }
  139. }
  140. func (p *packet) SetErrorLayer(l ErrorLayer) {
  141. if p.failure == nil {
  142. p.failure = l
  143. }
  144. }
  145. func (p *packet) AddLayer(l Layer) {
  146. p.layers = append(p.layers, l)
  147. p.last = l
  148. }
  149. func (p *packet) DumpPacketData() {
  150. fmt.Fprint(os.Stderr, p.packetDump())
  151. os.Stderr.Sync()
  152. }
  153. func (p *packet) Metadata() *PacketMetadata {
  154. return &p.metadata
  155. }
  156. func (p *packet) Data() []byte {
  157. return p.data
  158. }
  159. func (p *packet) DecodeOptions() *DecodeOptions {
  160. return &p.decodeOptions
  161. }
  162. func (p *packet) addFinalDecodeError(err error, stack []byte) {
  163. fail := &DecodeFailure{err: err, stack: stack}
  164. if p.last == nil {
  165. fail.data = p.data
  166. } else {
  167. fail.data = p.last.LayerPayload()
  168. }
  169. p.AddLayer(fail)
  170. p.SetErrorLayer(fail)
  171. }
  172. func (p *packet) recoverDecodeError() {
  173. if !p.decodeOptions.SkipDecodeRecovery {
  174. if r := recover(); r != nil {
  175. p.addFinalDecodeError(fmt.Errorf("%v", r), debug.Stack())
  176. }
  177. }
  178. }
  179. // LayerString outputs an individual layer as a string. The layer is output
  180. // in a single line, with no trailing newline. This function is specifically
  181. // designed to do the right thing for most layers... it follows the following
  182. // rules:
  183. // * If the Layer has a String function, just output that.
  184. // * Otherwise, output all exported fields in the layer, recursing into
  185. // exported slices and structs.
  186. // NOTE: This is NOT THE SAME AS fmt's "%#v". %#v will output both exported
  187. // and unexported fields... many times packet layers contain unexported stuff
  188. // that would just mess up the output of the layer, see for example the
  189. // Payload layer and it's internal 'data' field, which contains a large byte
  190. // array that would really mess up formatting.
  191. func LayerString(l Layer) string {
  192. return fmt.Sprintf("%v\t%s", l.LayerType(), layerString(reflect.ValueOf(l), false, false))
  193. }
  194. // Dumper dumps verbose information on a value. If a layer type implements
  195. // Dumper, then its LayerDump() string will include the results in its output.
  196. type Dumper interface {
  197. Dump() string
  198. }
  199. // LayerDump outputs a very verbose string representation of a layer. Its
  200. // output is a concatenation of LayerString(l) and hex.Dump(l.LayerContents()).
  201. // It contains newlines and ends with a newline.
  202. func LayerDump(l Layer) string {
  203. var b bytes.Buffer
  204. b.WriteString(LayerString(l))
  205. b.WriteByte('\n')
  206. if d, ok := l.(Dumper); ok {
  207. dump := d.Dump()
  208. if dump != "" {
  209. b.WriteString(dump)
  210. if dump[len(dump)-1] != '\n' {
  211. b.WriteByte('\n')
  212. }
  213. }
  214. }
  215. b.WriteString(hex.Dump(l.LayerContents()))
  216. return b.String()
  217. }
  218. // layerString outputs, recursively, a layer in a "smart" way. See docs for
  219. // LayerString for more details.
  220. //
  221. // Params:
  222. // i - value to write out
  223. // anonymous: if we're currently recursing an anonymous member of a struct
  224. // writeSpace: if we've already written a value in a struct, and need to
  225. // write a space before writing more. This happens when we write various
  226. // anonymous values, and need to keep writing more.
  227. func layerString(v reflect.Value, anonymous bool, writeSpace bool) string {
  228. // Let String() functions take precedence.
  229. if v.CanInterface() {
  230. if s, ok := v.Interface().(fmt.Stringer); ok {
  231. return s.String()
  232. }
  233. }
  234. // Reflect, and spit out all the exported fields as key=value.
  235. switch v.Type().Kind() {
  236. case reflect.Interface, reflect.Ptr:
  237. if v.IsNil() {
  238. return "nil"
  239. }
  240. r := v.Elem()
  241. return layerString(r, anonymous, writeSpace)
  242. case reflect.Struct:
  243. var b bytes.Buffer
  244. typ := v.Type()
  245. if !anonymous {
  246. b.WriteByte('{')
  247. }
  248. for i := 0; i < v.NumField(); i++ {
  249. // Check if this is upper-case.
  250. ftype := typ.Field(i)
  251. f := v.Field(i)
  252. if ftype.Anonymous {
  253. anonStr := layerString(f, true, writeSpace)
  254. writeSpace = writeSpace || anonStr != ""
  255. b.WriteString(anonStr)
  256. } else if ftype.PkgPath == "" { // exported
  257. if writeSpace {
  258. b.WriteByte(' ')
  259. }
  260. writeSpace = true
  261. fmt.Fprintf(&b, "%s=%s", typ.Field(i).Name, layerString(f, false, writeSpace))
  262. }
  263. }
  264. if !anonymous {
  265. b.WriteByte('}')
  266. }
  267. return b.String()
  268. case reflect.Slice:
  269. var b bytes.Buffer
  270. b.WriteByte('[')
  271. if v.Len() > 4 {
  272. fmt.Fprintf(&b, "..%d..", v.Len())
  273. } else {
  274. for j := 0; j < v.Len(); j++ {
  275. if j != 0 {
  276. b.WriteString(", ")
  277. }
  278. b.WriteString(layerString(v.Index(j), false, false))
  279. }
  280. }
  281. b.WriteByte(']')
  282. return b.String()
  283. }
  284. return fmt.Sprintf("%v", v.Interface())
  285. }
  286. const (
  287. longBytesLength = 128
  288. )
  289. // LongBytesGoString returns a string representation of the byte slice shortened
  290. // using the format '<type>{<truncated slice> ... (<n> bytes)}' if it
  291. // exceeds a predetermined length. Can be used to avoid filling the display with
  292. // very long byte strings.
  293. func LongBytesGoString(buf []byte) string {
  294. if len(buf) < longBytesLength {
  295. return fmt.Sprintf("%#v", buf)
  296. }
  297. s := fmt.Sprintf("%#v", buf[:longBytesLength-1])
  298. s = strings.TrimSuffix(s, "}")
  299. return fmt.Sprintf("%s ... (%d bytes)}", s, len(buf))
  300. }
  301. func baseLayerString(value reflect.Value) string {
  302. t := value.Type()
  303. content := value.Field(0)
  304. c := make([]byte, content.Len())
  305. for i := range c {
  306. c[i] = byte(content.Index(i).Uint())
  307. }
  308. payload := value.Field(1)
  309. p := make([]byte, payload.Len())
  310. for i := range p {
  311. p[i] = byte(payload.Index(i).Uint())
  312. }
  313. return fmt.Sprintf("%s{Contents:%s, Payload:%s}", t.String(),
  314. LongBytesGoString(c),
  315. LongBytesGoString(p))
  316. }
  317. func layerGoString(i interface{}, b *bytes.Buffer) {
  318. if s, ok := i.(fmt.GoStringer); ok {
  319. b.WriteString(s.GoString())
  320. return
  321. }
  322. var v reflect.Value
  323. var ok bool
  324. if v, ok = i.(reflect.Value); !ok {
  325. v = reflect.ValueOf(i)
  326. }
  327. switch v.Kind() {
  328. case reflect.Ptr, reflect.Interface:
  329. if v.Kind() == reflect.Ptr {
  330. b.WriteByte('&')
  331. }
  332. layerGoString(v.Elem().Interface(), b)
  333. case reflect.Struct:
  334. t := v.Type()
  335. b.WriteString(t.String())
  336. b.WriteByte('{')
  337. for i := 0; i < v.NumField(); i++ {
  338. if i > 0 {
  339. b.WriteString(", ")
  340. }
  341. if t.Field(i).Name == "BaseLayer" {
  342. fmt.Fprintf(b, "BaseLayer:%s", baseLayerString(v.Field(i)))
  343. } else if v.Field(i).Kind() == reflect.Struct {
  344. fmt.Fprintf(b, "%s:", t.Field(i).Name)
  345. layerGoString(v.Field(i), b)
  346. } else if v.Field(i).Kind() == reflect.Ptr {
  347. b.WriteByte('&')
  348. layerGoString(v.Field(i), b)
  349. } else {
  350. fmt.Fprintf(b, "%s:%#v", t.Field(i).Name, v.Field(i))
  351. }
  352. }
  353. b.WriteByte('}')
  354. default:
  355. fmt.Fprintf(b, "%#v", i)
  356. }
  357. }
  358. // LayerGoString returns a representation of the layer in Go syntax,
  359. // taking care to shorten "very long" BaseLayer byte slices
  360. func LayerGoString(l Layer) string {
  361. b := new(bytes.Buffer)
  362. layerGoString(l, b)
  363. return b.String()
  364. }
  365. func (p *packet) packetString() string {
  366. var b bytes.Buffer
  367. fmt.Fprintf(&b, "PACKET: %d bytes", len(p.Data()))
  368. if p.metadata.Truncated {
  369. b.WriteString(", truncated")
  370. }
  371. if p.metadata.Length > 0 {
  372. fmt.Fprintf(&b, ", wire length %d cap length %d", p.metadata.Length, p.metadata.CaptureLength)
  373. }
  374. if !p.metadata.Timestamp.IsZero() {
  375. fmt.Fprintf(&b, " @ %v", p.metadata.Timestamp)
  376. }
  377. b.WriteByte('\n')
  378. for i, l := range p.layers {
  379. fmt.Fprintf(&b, "- Layer %d (%02d bytes) = %s\n", i+1, len(l.LayerContents()), LayerString(l))
  380. }
  381. return b.String()
  382. }
  383. func (p *packet) packetDump() string {
  384. var b bytes.Buffer
  385. fmt.Fprintf(&b, "-- FULL PACKET DATA (%d bytes) ------------------------------------\n%s", len(p.data), hex.Dump(p.data))
  386. for i, l := range p.layers {
  387. fmt.Fprintf(&b, "--- Layer %d ---\n%s", i+1, LayerDump(l))
  388. }
  389. return b.String()
  390. }
  391. // eagerPacket is a packet implementation that does eager decoding. Upon
  392. // initial construction, it decodes all the layers it can from packet data.
  393. // eagerPacket implements Packet and PacketBuilder.
  394. type eagerPacket struct {
  395. packet
  396. }
  397. var errNilDecoder = errors.New("NextDecoder passed nil decoder, probably an unsupported decode type")
  398. func (p *eagerPacket) NextDecoder(next Decoder) error {
  399. if next == nil {
  400. return errNilDecoder
  401. }
  402. if p.last == nil {
  403. return errors.New("NextDecoder called, but no layers added yet")
  404. }
  405. d := p.last.LayerPayload()
  406. if len(d) == 0 {
  407. return nil
  408. }
  409. // Since we're eager, immediately call the next decoder.
  410. return next.Decode(d, p)
  411. }
  412. func (p *eagerPacket) initialDecode(dec Decoder) {
  413. defer p.recoverDecodeError()
  414. err := dec.Decode(p.data, p)
  415. if err != nil {
  416. p.addFinalDecodeError(err, nil)
  417. }
  418. }
  419. func (p *eagerPacket) LinkLayer() LinkLayer {
  420. return p.link
  421. }
  422. func (p *eagerPacket) NetworkLayer() NetworkLayer {
  423. return p.network
  424. }
  425. func (p *eagerPacket) TransportLayer() TransportLayer {
  426. return p.transport
  427. }
  428. func (p *eagerPacket) ApplicationLayer() ApplicationLayer {
  429. return p.application
  430. }
  431. func (p *eagerPacket) ErrorLayer() ErrorLayer {
  432. return p.failure
  433. }
  434. func (p *eagerPacket) Layers() []Layer {
  435. return p.layers
  436. }
  437. func (p *eagerPacket) Layer(t LayerType) Layer {
  438. for _, l := range p.layers {
  439. if l.LayerType() == t {
  440. return l
  441. }
  442. }
  443. return nil
  444. }
  445. func (p *eagerPacket) LayerClass(lc LayerClass) Layer {
  446. for _, l := range p.layers {
  447. if lc.Contains(l.LayerType()) {
  448. return l
  449. }
  450. }
  451. return nil
  452. }
  453. func (p *eagerPacket) String() string { return p.packetString() }
  454. func (p *eagerPacket) Dump() string { return p.packetDump() }
  455. // lazyPacket does lazy decoding on its packet data. On construction it does
  456. // no initial decoding. For each function call, it decodes only as many layers
  457. // as are necessary to compute the return value for that function.
  458. // lazyPacket implements Packet and PacketBuilder.
  459. type lazyPacket struct {
  460. packet
  461. next Decoder
  462. }
  463. func (p *lazyPacket) NextDecoder(next Decoder) error {
  464. if next == nil {
  465. return errNilDecoder
  466. }
  467. p.next = next
  468. return nil
  469. }
  470. func (p *lazyPacket) decodeNextLayer() {
  471. if p.next == nil {
  472. return
  473. }
  474. d := p.data
  475. if p.last != nil {
  476. d = p.last.LayerPayload()
  477. }
  478. next := p.next
  479. p.next = nil
  480. // We've just set p.next to nil, so if we see we have no data, this should be
  481. // the final call we get to decodeNextLayer if we return here.
  482. if len(d) == 0 {
  483. return
  484. }
  485. defer p.recoverDecodeError()
  486. err := next.Decode(d, p)
  487. if err != nil {
  488. p.addFinalDecodeError(err, nil)
  489. }
  490. }
  491. func (p *lazyPacket) LinkLayer() LinkLayer {
  492. for p.link == nil && p.next != nil {
  493. p.decodeNextLayer()
  494. }
  495. return p.link
  496. }
  497. func (p *lazyPacket) NetworkLayer() NetworkLayer {
  498. for p.network == nil && p.next != nil {
  499. p.decodeNextLayer()
  500. }
  501. return p.network
  502. }
  503. func (p *lazyPacket) TransportLayer() TransportLayer {
  504. for p.transport == nil && p.next != nil {
  505. p.decodeNextLayer()
  506. }
  507. return p.transport
  508. }
  509. func (p *lazyPacket) ApplicationLayer() ApplicationLayer {
  510. for p.application == nil && p.next != nil {
  511. p.decodeNextLayer()
  512. }
  513. return p.application
  514. }
  515. func (p *lazyPacket) ErrorLayer() ErrorLayer {
  516. for p.failure == nil && p.next != nil {
  517. p.decodeNextLayer()
  518. }
  519. return p.failure
  520. }
  521. func (p *lazyPacket) Layers() []Layer {
  522. for p.next != nil {
  523. p.decodeNextLayer()
  524. }
  525. return p.layers
  526. }
  527. func (p *lazyPacket) Layer(t LayerType) Layer {
  528. for _, l := range p.layers {
  529. if l.LayerType() == t {
  530. return l
  531. }
  532. }
  533. numLayers := len(p.layers)
  534. for p.next != nil {
  535. p.decodeNextLayer()
  536. for _, l := range p.layers[numLayers:] {
  537. if l.LayerType() == t {
  538. return l
  539. }
  540. }
  541. numLayers = len(p.layers)
  542. }
  543. return nil
  544. }
  545. func (p *lazyPacket) LayerClass(lc LayerClass) Layer {
  546. for _, l := range p.layers {
  547. if lc.Contains(l.LayerType()) {
  548. return l
  549. }
  550. }
  551. numLayers := len(p.layers)
  552. for p.next != nil {
  553. p.decodeNextLayer()
  554. for _, l := range p.layers[numLayers:] {
  555. if lc.Contains(l.LayerType()) {
  556. return l
  557. }
  558. }
  559. numLayers = len(p.layers)
  560. }
  561. return nil
  562. }
  563. func (p *lazyPacket) String() string { p.Layers(); return p.packetString() }
  564. func (p *lazyPacket) Dump() string { p.Layers(); return p.packetDump() }
  565. // DecodeOptions tells gopacket how to decode a packet.
  566. type DecodeOptions struct {
  567. // Lazy decoding decodes the minimum number of layers needed to return data
  568. // for a packet at each function call. Be careful using this with concurrent
  569. // packet processors, as each call to packet.* could mutate the packet, and
  570. // two concurrent function calls could interact poorly.
  571. Lazy bool
  572. // NoCopy decoding doesn't copy its input buffer into storage that's owned by
  573. // the packet. If you can guarantee that the bytes underlying the slice
  574. // passed into NewPacket aren't going to be modified, this can be faster. If
  575. // there's any chance that those bytes WILL be changed, this will invalidate
  576. // your packets.
  577. NoCopy bool
  578. // SkipDecodeRecovery skips over panic recovery during packet decoding.
  579. // Normally, when packets decode, if a panic occurs, that panic is captured
  580. // by a recover(), and a DecodeFailure layer is added to the packet detailing
  581. // the issue. If this flag is set, panics are instead allowed to continue up
  582. // the stack.
  583. SkipDecodeRecovery bool
  584. // DecodeStreamsAsDatagrams enables routing of application-level layers in the TCP
  585. // decoder. If true, we should try to decode layers after TCP in single packets.
  586. // This is disabled by default because the reassembly package drives the decoding
  587. // of TCP payload data after reassembly.
  588. DecodeStreamsAsDatagrams bool
  589. }
  590. // Default decoding provides the safest (but slowest) method for decoding
  591. // packets. It eagerly processes all layers (so it's concurrency-safe) and it
  592. // copies its input buffer upon creation of the packet (so the packet remains
  593. // valid if the underlying slice is modified. Both of these take time,
  594. // though, so beware. If you can guarantee that the packet will only be used
  595. // by one goroutine at a time, set Lazy decoding. If you can guarantee that
  596. // the underlying slice won't change, set NoCopy decoding.
  597. var Default = DecodeOptions{}
  598. // Lazy is a DecodeOptions with just Lazy set.
  599. var Lazy = DecodeOptions{Lazy: true}
  600. // NoCopy is a DecodeOptions with just NoCopy set.
  601. var NoCopy = DecodeOptions{NoCopy: true}
  602. // DecodeStreamsAsDatagrams is a DecodeOptions with just DecodeStreamsAsDatagrams set.
  603. var DecodeStreamsAsDatagrams = DecodeOptions{DecodeStreamsAsDatagrams: true}
  604. // NewPacket creates a new Packet object from a set of bytes. The
  605. // firstLayerDecoder tells it how to interpret the first layer from the bytes,
  606. // future layers will be generated from that first layer automatically.
  607. func NewPacket(data []byte, firstLayerDecoder Decoder, options DecodeOptions) Packet {
  608. if !options.NoCopy {
  609. dataCopy := make([]byte, len(data))
  610. copy(dataCopy, data)
  611. data = dataCopy
  612. }
  613. if options.Lazy {
  614. p := &lazyPacket{
  615. packet: packet{data: data, decodeOptions: options},
  616. next: firstLayerDecoder,
  617. }
  618. p.layers = p.initialLayers[:0]
  619. // Crazy craziness:
  620. // If the following return statemet is REMOVED, and Lazy is FALSE, then
  621. // eager packet processing becomes 17% FASTER. No, there is no logical
  622. // explanation for this. However, it's such a hacky micro-optimization that
  623. // we really can't rely on it. It appears to have to do with the size the
  624. // compiler guesses for this function's stack space, since one symptom is
  625. // that with the return statement in place, we more than double calls to
  626. // runtime.morestack/runtime.lessstack. We'll hope the compiler gets better
  627. // over time and we get this optimization for free. Until then, we'll have
  628. // to live with slower packet processing.
  629. return p
  630. }
  631. p := &eagerPacket{
  632. packet: packet{data: data, decodeOptions: options},
  633. }
  634. p.layers = p.initialLayers[:0]
  635. p.initialDecode(firstLayerDecoder)
  636. return p
  637. }
  638. // PacketDataSource is an interface for some source of packet data. Users may
  639. // create their own implementations, or use the existing implementations in
  640. // gopacket/pcap (libpcap, allows reading from live interfaces or from
  641. // pcap files) or gopacket/pfring (PF_RING, allows reading from live
  642. // interfaces).
  643. type PacketDataSource interface {
  644. // ReadPacketData returns the next packet available from this data source.
  645. // It returns:
  646. // data: The bytes of an individual packet.
  647. // ci: Metadata about the capture
  648. // err: An error encountered while reading packet data. If err != nil,
  649. // then data/ci will be ignored.
  650. ReadPacketData() (data []byte, ci CaptureInfo, err error)
  651. }
  652. // ConcatFinitePacketDataSources returns a PacketDataSource that wraps a set
  653. // of internal PacketDataSources, each of which will stop with io.EOF after
  654. // reading a finite number of packets. The returned PacketDataSource will
  655. // return all packets from the first finite source, followed by all packets from
  656. // the second, etc. Once all finite sources have returned io.EOF, the returned
  657. // source will as well.
  658. func ConcatFinitePacketDataSources(pds ...PacketDataSource) PacketDataSource {
  659. c := concat(pds)
  660. return &c
  661. }
  662. type concat []PacketDataSource
  663. func (c *concat) ReadPacketData() (data []byte, ci CaptureInfo, err error) {
  664. for len(*c) > 0 {
  665. data, ci, err = (*c)[0].ReadPacketData()
  666. if err == io.EOF {
  667. *c = (*c)[1:]
  668. continue
  669. }
  670. return
  671. }
  672. return nil, CaptureInfo{}, io.EOF
  673. }
  674. // ZeroCopyPacketDataSource is an interface to pull packet data from sources
  675. // that allow data to be returned without copying to a user-controlled buffer.
  676. // It's very similar to PacketDataSource, except that the caller must be more
  677. // careful in how the returned buffer is handled.
  678. type ZeroCopyPacketDataSource interface {
  679. // ZeroCopyReadPacketData returns the next packet available from this data source.
  680. // It returns:
  681. // data: The bytes of an individual packet. Unlike with
  682. // PacketDataSource's ReadPacketData, the slice returned here points
  683. // to a buffer owned by the data source. In particular, the bytes in
  684. // this buffer may be changed by future calls to
  685. // ZeroCopyReadPacketData. Do not use the returned buffer after
  686. // subsequent ZeroCopyReadPacketData calls.
  687. // ci: Metadata about the capture
  688. // err: An error encountered while reading packet data. If err != nil,
  689. // then data/ci will be ignored.
  690. ZeroCopyReadPacketData() (data []byte, ci CaptureInfo, err error)
  691. }
  692. // PacketSource reads in packets from a PacketDataSource, decodes them, and
  693. // returns them.
  694. //
  695. // There are currently two different methods for reading packets in through
  696. // a PacketSource:
  697. //
  698. // Reading With Packets Function
  699. //
  700. // This method is the most convenient and easiest to code, but lacks
  701. // flexibility. Packets returns a 'chan Packet', then asynchronously writes
  702. // packets into that channel. Packets uses a blocking channel, and closes
  703. // it if an io.EOF is returned by the underlying PacketDataSource. All other
  704. // PacketDataSource errors are ignored and discarded.
  705. // for packet := range packetSource.Packets() {
  706. // ...
  707. // }
  708. //
  709. // Reading With NextPacket Function
  710. //
  711. // This method is the most flexible, and exposes errors that may be
  712. // encountered by the underlying PacketDataSource. It's also the fastest
  713. // in a tight loop, since it doesn't have the overhead of a channel
  714. // read/write. However, it requires the user to handle errors, most
  715. // importantly the io.EOF error in cases where packets are being read from
  716. // a file.
  717. // for {
  718. // packet, err := packetSource.NextPacket()
  719. // if err == io.EOF {
  720. // break
  721. // } else if err != nil {
  722. // log.Println("Error:", err)
  723. // continue
  724. // }
  725. // handlePacket(packet) // Do something with each packet.
  726. // }
  727. type PacketSource struct {
  728. source PacketDataSource
  729. decoder Decoder
  730. // DecodeOptions is the set of options to use for decoding each piece
  731. // of packet data. This can/should be changed by the user to reflect the
  732. // way packets should be decoded.
  733. DecodeOptions
  734. c chan Packet
  735. }
  736. // NewPacketSource creates a packet data source.
  737. func NewPacketSource(source PacketDataSource, decoder Decoder) *PacketSource {
  738. return &PacketSource{
  739. source: source,
  740. decoder: decoder,
  741. }
  742. }
  743. // NextPacket returns the next decoded packet from the PacketSource. On error,
  744. // it returns a nil packet and a non-nil error.
  745. func (p *PacketSource) NextPacket() (Packet, error) {
  746. data, ci, err := p.source.ReadPacketData()
  747. if err != nil {
  748. return nil, err
  749. }
  750. packet := NewPacket(data, p.decoder, p.DecodeOptions)
  751. m := packet.Metadata()
  752. m.CaptureInfo = ci
  753. m.Truncated = m.Truncated || ci.CaptureLength < ci.Length
  754. return packet, nil
  755. }
  756. // packetsToChannel reads in all packets from the packet source and sends them
  757. // to the given channel. This routine terminates when a non-temporary error
  758. // is returned by NextPacket().
  759. func (p *PacketSource) packetsToChannel() {
  760. defer close(p.c)
  761. for {
  762. packet, err := p.NextPacket()
  763. if err == nil {
  764. p.c <- packet
  765. continue
  766. }
  767. // Immediately retry for temporary network errors
  768. if nerr, ok := err.(net.Error); ok && nerr.Temporary() {
  769. continue
  770. }
  771. // Immediately retry for EAGAIN
  772. if err == syscall.EAGAIN {
  773. continue
  774. }
  775. // Immediately break for known unrecoverable errors
  776. if err == io.EOF || err == io.ErrUnexpectedEOF ||
  777. err == io.ErrNoProgress || err == io.ErrClosedPipe || err == io.ErrShortBuffer ||
  778. err == syscall.EBADF ||
  779. strings.Contains(err.Error(), "use of closed file") {
  780. break
  781. }
  782. // Sleep briefly and try again
  783. time.Sleep(time.Millisecond * time.Duration(5))
  784. }
  785. }
  786. // Packets returns a channel of packets, allowing easy iterating over
  787. // packets. Packets will be asynchronously read in from the underlying
  788. // PacketDataSource and written to the returned channel. If the underlying
  789. // PacketDataSource returns an io.EOF error, the channel will be closed.
  790. // If any other error is encountered, it is ignored.
  791. //
  792. // for packet := range packetSource.Packets() {
  793. // handlePacket(packet) // Do something with each packet.
  794. // }
  795. //
  796. // If called more than once, returns the same channel.
  797. func (p *PacketSource) Packets() chan Packet {
  798. if p.c == nil {
  799. p.c = make(chan Packet, 1000)
  800. go p.packetsToChannel()
  801. }
  802. return p.c
  803. }