ringbuffer.c

   1 /* ringbuffer.c
   2  * Routines for packet capture windows
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 /*
  12  * <laurent.deniel@free.fr>
  13  *
  14  * Almost completely rewritten in order to:
  15  *
  16  * - be able to use a unlimited number of ringbuffer files
  17  * - close the current file and open (truncating) the next file at switch
  18  * - set the final file name once open (or reopen)
  19  * - avoid the deletion of files that could not be truncated (can't arise now)
  20  *   and do not erase empty files
  21  *
  22  * The idea behind that is to remove the limitation of the maximum # of
  23  * ringbuffer files being less than the maximum # of open fd per process
  24  * and to be able to reduce the amount of virtual memory usage (having only
  25  * one file open at most) or the amount of file system usage (by truncating
  26  * the files at switch and not the capture stop, and by closing them which
  27  * makes possible their move or deletion after a switch).
  28  *
  29  */
  30
  31 #include <config.h>
  32
  33 #ifdef HAVE_LIBPCAP
  34
  35 #include <stdio.h>
  36 #include <string.h>
  37 #include <time.h>
  38 #include <errno.h>
  39
  40 #include "wspcap.h"
  41
  42 #include <glib.h>
  43
  44 #include "ringbuffer.h"
  45 #include <wsutil/file_util.h>
  46
  47
  48 /* Ringbuffer file structure */
  49 typedef struct _rb_file {
  50   gchar         *name;
  51 } rb_file;
  52
  53 /** Ringbuffer data structure */
  54 typedef struct _ringbuf_data {
  55   rb_file      *files;
  56   guint         num_files;           /**< Number of ringbuffer files (1 to ...) */
  57   guint         curr_file_num;       /**< Number of the current file (ever increasing) */
  58   gchar        *fprefix;             /**< Filename prefix */
  59   gchar        *fsuffix;             /**< Filename suffix */
  60   gboolean      unlimited;           /**< TRUE if unlimited number of files */
  61
  62   int           fd;                  /**< Current ringbuffer file descriptor */
  63   FILE         *pdh;
  64   char         *io_buffer;              /**< The IO buffer used to write to the file */
  65   gboolean      group_read_access;   /**< TRUE if files need to be opened with group read access */
  66   FILE         *name_h;              /**< write names of completed files to this handle */
  67 } ringbuf_data;
  68
  69 static ringbuf_data rb_data;
  70
  71
  72 /*
  73  * create the next filename and open a new binary file with that name
  74  */
  75 static int ringbuf_open_file(rb_file *rfile, int *err)
  76 {
  77   char    filenum[5+1];
  78   char    timestr[14+1];
  79   time_t  current_time;
  80   struct tm *tm;
  81
  82   if (rfile->name != NULL) {
  83     if (rb_data.unlimited == FALSE) {
  84       /* remove old file (if any, so ignore error) */
  85       ws_unlink(rfile->name);
  86     }
  87     g_free(rfile->name);
  88   }
  89
  90 #ifdef _WIN32
  91   _tzset();
  92 #endif
  93   current_time = time(NULL);
  94
  95   g_snprintf(filenum, sizeof(filenum), "%05u", (rb_data.curr_file_num + 1) % RINGBUFFER_MAX_NUM_FILES);
  96   tm = localtime(&current_time);
  97   if (tm != NULL)
  98     strftime(timestr, sizeof(timestr), "%Y%m%d%H%M%S", tm);
  99   else
 100     g_strlcpy(timestr, "196912312359", sizeof(timestr)); /* second before the Epoch */
 101   rfile->name = g_strconcat(rb_data.fprefix, "_", filenum, "_", timestr,
 102                             rb_data.fsuffix, NULL);
 103
 104   if (rfile->name == NULL) {
 105     if (err != NULL)
 106       *err = ENOMEM;
 107     return -1;
 108   }
 109
 110   rb_data.fd = ws_open(rfile->name, O_RDWR|O_BINARY|O_TRUNC|O_CREAT,
 111                             rb_data.group_read_access ? 0640 : 0600);
 112
 113   if (rb_data.fd == -1 && err != NULL) {
 114     *err = errno;
 115   }
 116
 117   return rb_data.fd;
 118 }
 119
 120 /*
 121  * Initialize the ringbuffer data structures
 122  */
 123 int
 124 ringbuf_init(const char *capfile_name, guint num_files, gboolean group_read_access)
 125 {
 126   unsigned int i;
 127   char        *pfx, *last_pathsep;
 128   gchar       *save_file;
 129
 130   rb_data.files = NULL;
 131   rb_data.curr_file_num = 0;
 132   rb_data.fprefix = NULL;
 133   rb_data.fsuffix = NULL;
 134   rb_data.unlimited = FALSE;
 135   rb_data.fd = -1;
 136   rb_data.pdh = NULL;
 137   rb_data.io_buffer = NULL;
 138   rb_data.group_read_access = group_read_access;
 139   rb_data.name_h = NULL;
 140
 141   /* just to be sure ... */
 142   if (num_files <= RINGBUFFER_MAX_NUM_FILES) {
 143     rb_data.num_files = num_files;
 144   } else {
 145     rb_data.num_files = RINGBUFFER_MAX_NUM_FILES;
 146   }
 147
 148   /* Check file name */
 149   if (capfile_name == NULL) {
 150     /* ringbuffer does not work with temporary files! */
 151     return -1;
 152   }
 153
 154   /* set file name prefix/suffix */
 155
 156   save_file = g_strdup(capfile_name);
 157   last_pathsep = strrchr(save_file, G_DIR_SEPARATOR);
 158   pfx = strrchr(save_file,'.');
 159   if (pfx != NULL && (last_pathsep == NULL || pfx > last_pathsep)) {
 160     /* The pathname has a "." in it, and it's in the last component
 161        of the pathname (because there is either only one component,
 162        i.e. last_pathsep is null as there are no path separators,
 163        or the "." is after the path separator before the last
 164        component.
 165
 166        Treat it as a separator between the rest of the file name and
 167        the file name suffix, and arrange that the names given to the
 168        ring buffer files have the specified suffix, i.e. put the
 169        changing part of the name *before* the suffix. */
 170     pfx[0] = '\0';
 171     rb_data.fprefix = g_strdup(save_file);
 172     pfx[0] = '.'; /* restore capfile_name */
 173     rb_data.fsuffix = g_strdup(pfx);
 174   } else {
 175     /* Either there's no "." in the pathname, or it's in a directory
 176        component, so the last component has no suffix. */
 177     rb_data.fprefix = g_strdup(save_file);
 178     rb_data.fsuffix = NULL;
 179   }
 180   g_free(save_file);
 181   save_file = NULL;
 182
 183   /* allocate rb_file structures (only one if unlimited since there is no
 184      need to save all file names in that case) */
 185
 186   if (num_files == RINGBUFFER_UNLIMITED_FILES) {
 187     rb_data.unlimited = TRUE;
 188     rb_data.num_files = 1;
 189   }
 190
 191   rb_data.files = (rb_file *)g_malloc(rb_data.num_files * sizeof(rb_file));
 192   if (rb_data.files == NULL) {
 193     return -1;
 194   }
 195
 196   for (i=0; i < rb_data.num_files; i++) {
 197     rb_data.files[i].name = NULL;
 198   }
 199
 200   /* create the first file */
 201   if (ringbuf_open_file(&rb_data.files[0], NULL) == -1) {
 202     ringbuf_error_cleanup();
 203     return -1;
 204   }
 205
 206   return rb_data.fd;
 207 }
 208
 209 /*
 210  * Set name of file to which to print ringbuffer file names.
 211  */
 212 gboolean
 213 ringbuf_set_print_name(gchar *name, int *err)
 214 {
 215   if (rb_data.name_h != NULL) {
 216     if (EOF == fclose(rb_data.name_h)) {
 217       if (err != NULL) {
 218         *err = errno;
 219       }
 220       return FALSE;
 221     }
 222   }
 223   if (!strcmp(name, "-") || !strcmp(name, "stdout")) {
 224     rb_data.name_h = stdout;
 225   } else if (!strcmp(name, "stderr")) {
 226     rb_data.name_h = stderr;
 227   } else {
 228     if (NULL == (rb_data.name_h = ws_fopen(name, "wt"))) {
 229       if (err != NULL) {
 230         *err = errno;
 231       }
 232       return FALSE;
 233     }
 234   }
 235   return TRUE;
 236 }
 237
 238 /*
 239  * Whether the ringbuf filenames are ready.
 240  * (Whether ringbuf_init is called and ringbuf_free is not called.)
 241  */
 242 gboolean ringbuf_is_initialized(void)
 243 {
 244   return rb_data.files != NULL;
 245 }
 246
 247 const gchar *ringbuf_current_filename(void)
 248 {
 249   /* g_assert(ringbuf_is_initialized()); */
 250   return rb_data.files[rb_data.curr_file_num % rb_data.num_files].name;
 251 }
 252
 253 /*
 254  * Calls ws_fdopen() for the current ringbuffer file
 255  */
 256 FILE *
 257 ringbuf_init_libpcap_fdopen(int *err)
 258 {
 259   rb_data.pdh = ws_fdopen(rb_data.fd, "wb");
 260   if (rb_data.pdh == NULL) {
 261     if (err != NULL) {
 262       *err = errno;
 263     }
 264   } else {
 265     size_t buffsize = IO_BUF_SIZE;
 266 #ifdef HAVE_STRUCT_STAT_ST_BLKSIZE
 267     ws_statb64 statb;
 268
 269     if (ws_fstat64(rb_data.fd, &statb) == 0) {
 270       if (statb.st_blksize > IO_BUF_SIZE) {
 271         buffsize = statb.st_blksize;
 272       }
 273     }
 274 #endif
 275     /* Increase the size of the IO buffer */
 276     rb_data.io_buffer = (char *)g_realloc(rb_data.io_buffer, buffsize);
 277     setvbuf(rb_data.pdh, rb_data.io_buffer, _IOFBF, buffsize);
 278   }
 279
 280   return rb_data.pdh;
 281 }
 282
 283 /*
 284  * Switches to the next ringbuffer file
 285  */
 286 gboolean
 287 ringbuf_switch_file(FILE **pdh, gchar **save_file, int *save_file_fd, int *err)
 288 {
 289   int     next_file_index;
 290   rb_file *next_rfile = NULL;
 291
 292   /* close current file */
 293
 294   if (fclose(rb_data.pdh) == EOF) {
 295     if (err != NULL) {
 296       *err = errno;
 297     }
 298     ws_close(rb_data.fd);  /* XXX - the above should have closed this already */
 299     rb_data.pdh = NULL;    /* it's still closed, we just got an error while closing */
 300     rb_data.fd = -1;
 301     g_free(rb_data.io_buffer);
 302     rb_data.io_buffer = NULL;
 303     return FALSE;
 304   }
 305
 306   rb_data.pdh = NULL;
 307   rb_data.fd  = -1;
 308
 309   if (rb_data.name_h != NULL) {
 310     fprintf(rb_data.name_h, "%s\n", ringbuf_current_filename());
 311     fflush(rb_data.name_h);
 312   }
 313
 314   /* get the next file number and open it */
 315
 316   rb_data.curr_file_num++ /* = next_file_num*/;
 317   next_file_index = (rb_data.curr_file_num) % rb_data.num_files;
 318   next_rfile = &rb_data.files[next_file_index];
 319
 320   if (ringbuf_open_file(next_rfile, err) == -1) {
 321     return FALSE;
 322   }
 323
 324   if (ringbuf_init_libpcap_fdopen(err) == NULL) {
 325     return FALSE;
 326   }
 327
 328   /* switch to the new file */
 329   *save_file = next_rfile->name;
 330   *save_file_fd = rb_data.fd;
 331   (*pdh) = rb_data.pdh;
 332
 333   return TRUE;
 334 }
 335
 336 /*
 337  * Calls fclose() for the current ringbuffer file
 338  */
 339 gboolean
 340 ringbuf_libpcap_dump_close(gchar **save_file, int *err)
 341 {
 342   gboolean  ret_val = TRUE;
 343
 344   /* close current file, if it's open */
 345   if (rb_data.pdh != NULL) {
 346     if (fclose(rb_data.pdh) == EOF) {
 347       if (err != NULL) {
 348         *err = errno;
 349       }
 350       ws_close(rb_data.fd);
 351       ret_val = FALSE;
 352     }
 353     rb_data.pdh = NULL;
 354     rb_data.fd  = -1;
 355     g_free(rb_data.io_buffer);
 356     rb_data.io_buffer = NULL;
 357
 358   }
 359
 360   if (rb_data.name_h != NULL) {
 361     fprintf(rb_data.name_h, "%s\n", ringbuf_current_filename());
 362     fflush(rb_data.name_h);
 363
 364     if (EOF == fclose(rb_data.name_h)) {
 365       /* Can't really do much about this, can we? */
 366     }
 367   }
 368
 369   /* set the save file name to the current file */
 370   *save_file = rb_data.files[rb_data.curr_file_num % rb_data.num_files].name;
 371   return ret_val;
 372 }
 373
 374 /*
 375  * Frees all memory allocated by the ringbuffer
 376  */
 377 void
 378 ringbuf_free(void)
 379 {
 380   unsigned int i;
 381
 382   if (rb_data.files != NULL) {
 383     for (i=0; i < rb_data.num_files; i++) {
 384       if (rb_data.files[i].name != NULL) {
 385         g_free(rb_data.files[i].name);
 386         rb_data.files[i].name = NULL;
 387       }
 388     }
 389     g_free(rb_data.files);
 390     rb_data.files = NULL;
 391   }
 392   if (rb_data.fprefix != NULL) {
 393     g_free(rb_data.fprefix);
 394     rb_data.fprefix = NULL;
 395   }
 396   if (rb_data.fsuffix != NULL) {
 397     g_free(rb_data.fsuffix);
 398     rb_data.fsuffix = NULL;
 399   }
 400 }
 401
 402 /*
 403  * Frees all memory allocated by the ringbuffer
 404  */
 405 void
 406 ringbuf_error_cleanup(void)
 407 {
 408   unsigned int i;
 409
 410   /* try to close via wtap */
 411   if (rb_data.pdh != NULL) {
 412     if (fclose(rb_data.pdh) == 0) {
 413       rb_data.fd = -1;
 414     }
 415     rb_data.pdh = NULL;
 416   }
 417
 418   /* close directly if still open */
 419   if (rb_data.fd != -1) {
 420     ws_close(rb_data.fd);
 421     rb_data.fd = -1;
 422   }
 423
 424   if (rb_data.files != NULL) {
 425     for (i=0; i < rb_data.num_files; i++) {
 426       if (rb_data.files[i].name != NULL) {
 427         ws_unlink(rb_data.files[i].name);
 428       }
 429     }
 430   }
 431   g_free(rb_data.io_buffer);
 432   rb_data.io_buffer = NULL;
 433
 434   if (rb_data.name_h != NULL) {
 435     if (EOF == fclose(rb_data.name_h)) {
 436       /* Can't really do much about this, can we? */
 437     }
 438   }
 439
 440   /* free the memory */
 441   ringbuf_free();
 442 }
 443
 444 #endif /* HAVE_LIBPCAP */
 445
 446 /*
 447  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 448  *
 449  * Local Variables:
 450  * c-basic-offset: 2
 451  * tab-width: 8
 452  * indent-tabs-mode: nil
 453  * End:
 454  *
 455  * ex: set shiftwidth=2 tabstop=8 expandtab:
 456  * :indentSize=2:tabSize=8:noTabs=true:
 457  */