ringbuffer.c

   1 /* ringbuffer.c
   2  * Routines for packet capture windows
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23  */
  24
  25 /*
  26  * <laurent.deniel@free.fr>
  27  *
  28  * Almost completely rewritten in order to:
  29  *
  30  * - be able to use a unlimited number of ringbuffer files
  31  * - close the current file and open (truncating) the next file at switch
  32  * - set the final file name once open (or reopen)
  33  * - avoid the deletion of files that could not be truncated (can't arise now)
  34  *   and do not erase empty files
  35  *
  36  * The idea behind that is to remove the limitation of the maximum # of
  37  * ringbuffer files being less than the maximum # of open fd per process
  38  * and to be able to reduce the amount of virtual memory usage (having only
  39  * one file open at most) or the amount of file system usage (by truncating
  40  * the files at switch and not the capture stop, and by closing them which
  41  * makes possible their move or deletion after a switch).
  42  *
  43  */
  44
  45 #include "config.h"
  46
  47 #ifdef HAVE_LIBPCAP
  48
  49 #ifdef HAVE_FCNTL_H
  50 #include <fcntl.h>
  51 #endif
  52
  53 #ifdef HAVE_UNISTD_H
  54 #include <unistd.h>
  55 #endif
  56
  57 #include <stdio.h>
  58 #include <string.h>
  59 #include <time.h>
  60 #include <errno.h>
  61
  62 #include <pcap.h>
  63
  64 #include <glib.h>
  65
  66 #include "ringbuffer.h"
  67 #include <wsutil/file_util.h>
  68
  69
  70 /* Ringbuffer file structure */
  71 typedef struct _rb_file {
  72   gchar         *name;
  73 } rb_file;
  74
  75 /* Ringbuffer data structure */
  76 typedef struct _ringbuf_data {
  77   rb_file      *files;
  78   guint         num_files;           /* Number of ringbuffer files (1 to ...) */
  79   guint         curr_file_num;       /* Number of the current file (ever increasing) */
  80   gchar        *fprefix;             /* Filename prefix */
  81   gchar        *fsuffix;             /* Filename suffix */
  82   gboolean      unlimited;           /* TRUE if unlimited number of files */
  83
  84   int           fd;                  /* Current ringbuffer file descriptor */
  85   FILE         *pdh;
  86   gboolean      group_read_access;   /* TRUE if files need to be opened with group read access */
  87 } ringbuf_data;
  88
  89 static ringbuf_data rb_data;
  90
  91
  92 /*
  93  * create the next filename and open a new binary file with that name
  94  */
  95 static int ringbuf_open_file(rb_file *rfile, int *err)
  96 {
  97   char    filenum[5+1];
  98   char    timestr[14+1];
  99   time_t  current_time;
 100
 101   if (rfile->name != NULL) {
 102     if (rb_data.unlimited == FALSE) {
 103       /* remove old file (if any, so ignore error) */
 104       ws_unlink(rfile->name);
 105     }
 106     g_free(rfile->name);
 107   }
 108
 109 #ifdef _WIN32
 110   _tzset();
 111 #endif
 112   current_time = time(NULL);
 113
 114   g_snprintf(filenum, sizeof(filenum), "%05u", (rb_data.curr_file_num + 1) % RINGBUFFER_MAX_NUM_FILES);
 115   strftime(timestr, sizeof(timestr), "%Y%m%d%H%M%S", localtime(&current_time));
 116   rfile->name = g_strconcat(rb_data.fprefix, "_", filenum, "_", timestr,
 117                             rb_data.fsuffix, NULL);
 118
 119   if (rfile->name == NULL) {
 120     if (err != NULL)
 121       *err = ENOMEM;
 122     return -1;
 123   }
 124
 125   rb_data.fd = ws_open(rfile->name, O_RDWR|O_BINARY|O_TRUNC|O_CREAT,
 126                             rb_data.group_read_access ? 0640 : 0600);
 127
 128   if (rb_data.fd == -1 && err != NULL) {
 129     *err = errno;
 130   }
 131
 132   return rb_data.fd;
 133 }
 134
 135 /*
 136  * Initialize the ringbuffer data structures
 137  */
 138 int
 139 ringbuf_init(const char *capfile_name, guint num_files, gboolean group_read_access)
 140 {
 141   unsigned int i;
 142   char        *pfx, *last_pathsep;
 143   gchar       *save_file;
 144
 145   rb_data.files = NULL;
 146   rb_data.curr_file_num = 0;
 147   rb_data.fprefix = NULL;
 148   rb_data.fsuffix = NULL;
 149   rb_data.unlimited = FALSE;
 150   rb_data.fd = -1;
 151   rb_data.pdh = NULL;
 152   rb_data.group_read_access = group_read_access;
 153
 154   /* just to be sure ... */
 155   if (num_files <= RINGBUFFER_MAX_NUM_FILES) {
 156     rb_data.num_files = num_files;
 157   } else {
 158     rb_data.num_files = RINGBUFFER_MAX_NUM_FILES;
 159   }
 160
 161   /* Check file name */
 162   if (capfile_name == NULL) {
 163     /* ringbuffer does not work with temporary files! */
 164     return -1;
 165   }
 166
 167   /* set file name prefix/suffix */
 168
 169   save_file = g_strdup(capfile_name);
 170   last_pathsep = strrchr(save_file, G_DIR_SEPARATOR);
 171   pfx = strrchr(save_file,'.');
 172   if (pfx != NULL && (last_pathsep == NULL || pfx > last_pathsep)) {
 173     /* The pathname has a "." in it, and it's in the last component
 174        of the pathname (because there is either only one component,
 175        i.e. last_pathsep is null as there are no path separators,
 176        or the "." is after the path separator before the last
 177        component.
 178
 179        Treat it as a separator between the rest of the file name and
 180        the file name suffix, and arrange that the names given to the
 181        ring buffer files have the specified suffix, i.e. put the
 182        changing part of the name *before* the suffix. */
 183     pfx[0] = '\0';
 184     rb_data.fprefix = g_strdup(save_file);
 185     pfx[0] = '.'; /* restore capfile_name */
 186     rb_data.fsuffix = g_strdup(pfx);
 187   } else {
 188     /* Either there's no "." in the pathname, or it's in a directory
 189        component, so the last component has no suffix. */
 190     rb_data.fprefix = g_strdup(save_file);
 191     rb_data.fsuffix = NULL;
 192   }
 193   g_free(save_file);
 194   save_file = NULL;
 195
 196   /* allocate rb_file structures (only one if unlimited since there is no
 197      need to save all file names in that case) */
 198
 199   if (num_files == RINGBUFFER_UNLIMITED_FILES) {
 200     rb_data.unlimited = TRUE;
 201     rb_data.num_files = 1;
 202   }
 203
 204   rb_data.files = (rb_file *)g_malloc(rb_data.num_files * sizeof(rb_file));
 205   if (rb_data.files == NULL) {
 206     return -1;
 207   }
 208
 209   for (i=0; i < rb_data.num_files; i++) {
 210     rb_data.files[i].name = NULL;
 211   }
 212
 213   /* create the first file */
 214   if (ringbuf_open_file(&rb_data.files[0], NULL) == -1) {
 215     ringbuf_error_cleanup();
 216     return -1;
 217   }
 218
 219   return rb_data.fd;
 220 }
 221
 222
 223 const gchar *ringbuf_current_filename(void)
 224 {
 225   return rb_data.files[rb_data.curr_file_num % rb_data.num_files].name;
 226 }
 227
 228 /*
 229  * Calls ws_fdopen() for the current ringbuffer file
 230  */
 231 FILE *
 232 ringbuf_init_libpcap_fdopen(int *err)
 233 {
 234   rb_data.pdh = ws_fdopen(rb_data.fd, "wb");
 235   if (rb_data.pdh == NULL) {
 236     if (err != NULL) {
 237       *err = errno;
 238     }
 239   }
 240   return rb_data.pdh;
 241 }
 242
 243 /*
 244  * Switches to the next ringbuffer file
 245  */
 246 gboolean
 247 ringbuf_switch_file(FILE **pdh, gchar **save_file, int *save_file_fd, int *err)
 248 {
 249   int     next_file_index;
 250   rb_file *next_rfile = NULL;
 251
 252   /* close current file */
 253
 254   if (fclose(rb_data.pdh) == EOF) {
 255     if (err != NULL) {
 256       *err = errno;
 257     }
 258     ws_close(rb_data.fd);       /* XXX - the above should have closed this already */
 259     rb_data.pdh = NULL; /* it's still closed, we just got an error while closing */
 260     rb_data.fd = -1;
 261     return FALSE;
 262   }
 263
 264   rb_data.pdh = NULL;
 265   rb_data.fd  = -1;
 266
 267   /* get the next file number and open it */
 268
 269   rb_data.curr_file_num++ /* = next_file_num*/;
 270   next_file_index = (rb_data.curr_file_num) % rb_data.num_files;
 271   next_rfile = &rb_data.files[next_file_index];
 272
 273   if (ringbuf_open_file(next_rfile, err) == -1) {
 274     return FALSE;
 275   }
 276
 277   if (ringbuf_init_libpcap_fdopen(err) == NULL) {
 278     return FALSE;
 279   }
 280
 281   /* switch to the new file */
 282   *save_file = next_rfile->name;
 283   *save_file_fd = rb_data.fd;
 284   (*pdh) = rb_data.pdh;
 285
 286   return TRUE;
 287 }
 288
 289 /*
 290  * Calls fclose() for the current ringbuffer file
 291  */
 292 gboolean
 293 ringbuf_libpcap_dump_close(gchar **save_file, int *err)
 294 {
 295   gboolean  ret_val = TRUE;
 296
 297   /* close current file, if it's open */
 298   if (rb_data.pdh != NULL) {
 299     if (fclose(rb_data.pdh) == EOF) {
 300       if (err != NULL) {
 301         *err = errno;
 302       }
 303       ws_close(rb_data.fd);
 304       ret_val = FALSE;
 305     }
 306     rb_data.pdh = NULL;
 307     rb_data.fd  = -1;
 308   }
 309
 310   /* set the save file name to the current file */
 311   *save_file = rb_data.files[rb_data.curr_file_num % rb_data.num_files].name;
 312   return ret_val;
 313 }
 314
 315 /*
 316  * Frees all memory allocated by the ringbuffer
 317  */
 318 void
 319 ringbuf_free(void)
 320 {
 321   unsigned int i;
 322
 323   if (rb_data.files != NULL) {
 324     for (i=0; i < rb_data.num_files; i++) {
 325       if (rb_data.files[i].name != NULL) {
 326         g_free(rb_data.files[i].name);
 327         rb_data.files[i].name = NULL;
 328       }
 329     }
 330     g_free(rb_data.files);
 331     rb_data.files = NULL;
 332   }
 333   if (rb_data.fprefix != NULL) {
 334     g_free(rb_data.fprefix);
 335     rb_data.fprefix = NULL;
 336   }
 337   if (rb_data.fsuffix != NULL) {
 338     g_free(rb_data.fsuffix);
 339     rb_data.fsuffix = NULL;
 340   }
 341 }
 342
 343 /*
 344  * Frees all memory allocated by the ringbuffer
 345  */
 346 void
 347 ringbuf_error_cleanup(void)
 348 {
 349   unsigned int i;
 350
 351   /* try to close via wtap */
 352   if (rb_data.pdh != NULL) {
 353     if (fclose(rb_data.pdh) == 0) {
 354       rb_data.fd = -1;
 355     }
 356     rb_data.pdh = NULL;
 357   }
 358
 359   /* close directly if still open */
 360   if (rb_data.fd != -1) {
 361     ws_close(rb_data.fd);
 362     rb_data.fd = -1;
 363   }
 364
 365   if (rb_data.files != NULL) {
 366     for (i=0; i < rb_data.num_files; i++) {
 367       if (rb_data.files[i].name != NULL) {
 368         ws_unlink(rb_data.files[i].name);
 369       }
 370     }
 371   }
 372   /* free the memory */
 373   ringbuf_free();
 374 }
 375
 376 #endif /* HAVE_LIBPCAP */