- updated to 1.3.1

[packages/dhcp_probe.git] / dhcp_probe-virta-02-keep-pcap.patch

##dhcp-probe-02-keep-pcap.patch - add option to keep pcap open all the time
--- src/dhcp_probe.c.orig	2021-01-18 20:17:29.000000000 +0100
+++ src/dhcp_probe.c	2024-04-20 21:59:22.184598775 +0200
@@ -49,6 +49,7 @@ char *capture_file = NULL;
 */
 int snaplen = CAPTURE_BUFSIZE;
 int socket_receive_timeout_feature = 0;
+int keep_pcap = 0;
 
 char *prog = NULL;
 char *logfile_name = NULL;
@@ -75,6 +76,113 @@ struct ether_addr my_eaddr;
 int use_8021q = 0;
 int vlan_id = 0;
 
+int need_promiscuous(void)
+{
+	/* If we're going to claim a chaddr different than my_eaddr, some of the responses
+	   may come back to chaddr (as opposed to my_eaddr or broadcast), so we'll need to
+	   listen promiscuously.
+	   If we're going to claim an ether_src different than my_eaddr, in theory that should
+	   make no difference; bootp/dhcp servers should rely on chaddr, not ether_src.  Still,
+	   it's possible there's a server out there that does it wrong, and might therefore mistakenly
+	   send responses to ether_src.  So lets also listen promiscuously if ether_src != my_eaddr.
+	*/
+	int promiscuous = 0;
+	if (bcmp(GetChaddr(), &my_eaddr, sizeof(struct ether_addr)) ||
+	    bcmp(GetEther_src(), &my_eaddr, sizeof(struct ether_addr)))
+		promiscuous = 1;
+	return promiscuous;
+}
+
+int init_pcap(int promiscuous)
+{
+	/* open packet capture descriptor */
+	/* XXX On Solaris 7, sometimes pcap_open_live() fails with a message like:
+			pcap_open_live qfe0: recv_ack: info unexpected primitive ack 0x8
+	   It's not clear what causes this, or what the 0x8 code indicates.
+	   The error appears to be transient; retrying sometimes will work, so I've wrapped the call in a retry loop.
+	   I've also added a delay after each failure; perhaps the failure has something to do with the fact that
+	   we call pcap_open_live() so soon after pcap_close() (for the second and succeeding packets in each cycle);
+	   adding a delay might help in that case.
+			*/
+	struct bpf_program bpf_code;
+	char pcap_errbuf[PCAP_ERRBUF_SIZE];
+	int linktype;
+	int pcap_open_retries = PCAP_OPEN_LIVE_RETRY_MAX;
+
+	do {
+		pcap_errbuf[0] = '\0'; /* so we can tell if a warning was produced on success */
+		if ((pd = pcap_open_live(ifname, snaplen, promiscuous, GetResponse_wait_time(), pcap_errbuf)) != NULL) {
+			break; /* success */
+		} else { /* failure */
+			if (pcap_open_retries == 0) {
+				report(LOG_DEBUG, "pcap_open_live(%s): %s; retry count (%d) exceeded, giving up", ifname, pcap_errbuf, PCAP_OPEN_LIVE_RETRY_MAX);
+				my_exit(1, 1, 1);
+			} else {
+				if (debug > 1)
+					report(LOG_DEBUG, "pcap_open_live(%s): %s; will retry", ifname, pcap_errbuf);
+				sleep(PCAP_OPEN_LIVE_RETRY_DELAY); /* before next retry */
+			}
+		} /* failure */
+	} while (pcap_open_retries--);
+	
+	if (pcap_errbuf[0] != '\0')
+		/* even on success, a warning may be produced */
+		report(LOG_WARNING, "pcap_open_live(%s): succeeded but with warning: %s", ifname, pcap_errbuf);
+		
+	/* make sure this interface is ethernet */
+	linktype = pcap_datalink(pd);
+	if (linktype != DLT_EN10MB) {
+		/* In libpcap 0.9.8 on Solaris 9 SPARC, this only happened if you pointed us to an interface
+		   that truly had the wrong datalink type.  
+		   It was not a transient error, so we exited.
+		   However, by libpcap version 1.1.1 on Solaris 9 SPARC, this happens from time to time;
+		   pcap_datalink() returns 0, indicating DLT_NULL.  
+		   Perhaps that's a bug introduced after libpcap 0.9.8.
+		   As this seems to be a transient error, we no longer exit, but instead just log the error,
+		   and skip the rest of the current cycle.
+		   A side effect of this change is that when you DO mistakenly point dhcp_probe to
+		   a non-Ethernet interface (the error is not transient), we keep trying instead
+		   of exiting.  If a future libpcap change returns to the old behavior (where the
+		   interface type remains consistent), we should go back to the old behavior of exiting.
+		*/
+		/*
+		report(LOG_ERR, "interface %s link layer type %d not ethernet", ifname, linktype);
+		my_exit(1, 1, 1);
+		*/
+		report(LOG_ERR, "interface %s link layer type %d not ethernet, skipping rest of this probe cycle", ifname, linktype);
+		return -1; /* break for (l) ... */
+	}
+	/* compile bpf filter to select just udp/ip traffic to udp port bootpc  */
+	/* Although one would expect frames on an untagged logical network interface to arrive without any 802.1Q tag,
+	   some Ethernet drivers will deliver some frames with an 802.1Q tag in which vlan==0.
+	   This may be because the frame arrived with an 802.1Q tag in which the 802.1p priority was non-zero.
+	   To preserve that priority field, they retain the 802.1Q tag and set the vlan field to 0.
+	   As per spec, a frame received with 802.1Q tag in which vlan == 0 should be treated as an untagged frame. 
+	   So our bpf filter needs to include both untagged and tagged frames.
+	*/
+	if (pcap_compile(pd, &bpf_code, "udp dst port bootpc or (vlan and udp dst port bootpc)", 1, PCAP_NETMASK_UNKNOWN) < 0) {
+		report(LOG_ERR, "pcap_compile: %s", pcap_geterr(pd));
+		my_exit(1, 1, 1);
+	}
+	/* install compiled filter */
+	if (pcap_setfilter(pd, &bpf_code) < 0) {
+		report(LOG_ERR, "pcap_setfilter: %s", pcap_geterr(pd));
+		my_exit(1, 1, 1);
+	}
+	if (socket_receive_timeout_feature)
+		set_pcap_timeout(pd);
+
+	return 0;
+}
+
+void 
+reset_pcap() 
+{
+	/* close packet capture descriptor */
+	pcap_close(pd);
+	pd = NULL;
+}
+
 int 
 main(int argc, char **argv)
 {
@@ -93,8 +201,6 @@ main(int argc, char **argv)
 	int receive_and_process_responses_rc;
 
 	/* for libpcap */
-	struct bpf_program bpf_code;
-	int linktype;
 	char pcap_errbuf[PCAP_ERRBUF_SIZE], pcap_errbuf2[PCAP_ERRBUF_SIZE];
 
 	/* get progname = last component of argv[0] */
@@ -104,7 +210,7 @@ main(int argc, char **argv)
 	else 
 		prog = argv[0];
 
-	while ((c = getopt(argc, argv, "c:d:fhl:o:p:Q:s:Tvw:")) != EOF) {
+	while ((c = getopt(argc, argv, "c:d:fhkl:o:p:Q:s:Tvw:")) != EOF) {
 		switch (c) {
 			case 'c':
 				if (optarg[0] != '/') {
@@ -129,6 +235,9 @@ main(int argc, char **argv)
 			case 'h':
 				usage();
 				my_exit(0, 0, 0);
+			case 'k':
+				keep_pcap = 1;
+				break;
 			case 'l':
 				if (optarg[0] != '/') {
 					fprintf(stderr, "%s: invalid log file '%s', must be an absolute pathname\n", prog, optarg);
@@ -435,8 +544,10 @@ main(int argc, char **argv)
 		}
 	}
 
+	if (keep_pcap)
+		init_pcap(need_promiscuous());
+
 	while (1) { /* MAIN EVENT LOOP */
-		int promiscuous;
 		libnet_t *l;						/* to iterate through libnet context queue */
 		/* struct pcap_stat ps;	*/			/* to hold pcap stats */
 
@@ -477,25 +588,9 @@ main(int argc, char **argv)
 		   interface in promiscuous mode as little as possible, since that can affect the host's performance.
 		*/
 
-		/* If we're going to claim a chaddr different than my_eaddr, some of the responses
-		   may come back to chaddr (as opposed to my_eaddr or broadcast), so we'll need to
-		   listen promiscuously.
-		   If we're going to claim an ether_src different than my_eaddr, in theory that should
-		   make no difference; bootp/dhcp servers should rely on chaddr, not ether_src.  Still,
-		   it's possible there's a server out there that does it wrong, and might therefore mistakenly
-		   send responses to ether_src.  So lets also listen promiscuously if ether_src != my_eaddr.
-		*/
-		if (bcmp(GetChaddr(), &my_eaddr, sizeof(struct ether_addr)) ||
-		    bcmp(GetEther_src(), &my_eaddr, sizeof(struct ether_addr)))
-			promiscuous = 1;
-		else
-			promiscuous = 0;
-
-
 		for (l = libnet_cq_head(); libnet_cq_last(); l = libnet_cq_next()) { /* write one flavor packet and listen for answers */
 
 			int packets_recv;
-			int pcap_open_retries;
 
 			/* We set up for packet capture BEFORE writing our packet, to minimize the delay
 			   between our writing and when we are able to start capturing.  (I cannot tell from
@@ -505,78 +600,10 @@ main(int argc, char **argv)
 			   we wanted!
 			*/
 
-			/* open packet capture descriptor */
-			/* XXX On Solaris 7, sometimes pcap_open_live() fails with a message like:
-					pcap_open_live qfe0: recv_ack: info unexpected primitive ack 0x8
-			   It's not clear what causes this, or what the 0x8 code indicates.
-			   The error appears to be transient; retrying sometimes will work, so I've wrapped the call in a retry loop.
-			   I've also added a delay after each failure; perhaps the failure has something to do with the fact that
-			   we call pcap_open_live() so soon after pcap_close() (for the second and succeeding packets in each cycle);
-			   adding a delay might help in that case.
-			*/
-			pcap_open_retries = PCAP_OPEN_LIVE_RETRY_MAX;
-			while (pcap_open_retries--) {
-				pcap_errbuf[0] = '\0'; /* so we can tell if a warning was produced on success */
-				if ((pd = pcap_open_live(ifname, snaplen, promiscuous, GetResponse_wait_time(), pcap_errbuf)) != NULL) {
-					break; /* success */
-				} else { /* failure */
-					if (pcap_open_retries == 0) {
-						report(LOG_DEBUG, "pcap_open_live(%s): %s; retry count (%d) exceeded, giving up", ifname, pcap_errbuf, PCAP_OPEN_LIVE_RETRY_MAX);
-						my_exit(1, 1, 1);
-					} else {
-						if (debug > 1)
-							report(LOG_DEBUG, "pcap_open_live(%s): %s; will retry", ifname, pcap_errbuf);
-						sleep(PCAP_OPEN_LIVE_RETRY_DELAY); /* before next retry */
-					}
-				} /* failure */
+			if (! keep_pcap) {
+				if (init_pcap(need_promiscuous()))
+					break; /* for l... */
 			}
-			if (pcap_errbuf[0] != '\0')
-				/* even on success, a warning may be produced */
-				report(LOG_WARNING, "pcap_open_live(%s): succeeded but with warning: %s", ifname, pcap_errbuf);
-
-			/* make sure this interface is ethernet */
-			linktype = pcap_datalink(pd);
-			if (linktype != DLT_EN10MB) {
-				/* In libpcap 0.9.8 on Solaris 9 SPARC, this only happened if you pointed us to an interface
-				   that truly had the wrong datalink type.  
-				   It was not a transient error, so we exited.
-				   However, by libpcap version 1.1.1 on Solaris 9 SPARC, this happens from time to time;
-				   pcap_datalink() returns 0, indicating DLT_NULL.  
-				   Perhaps that's a bug introduced after libpcap 0.9.8.
-				   As this seems to be a transient error, we no longer exit, but instead just log the error,
-				   and skip the rest of the current cycle.
-				   A side effect of this change is that when you DO mistakenly point dhcp_probe to
-				   a non-Ethernet interface (the error is not transient), we keep trying instead
-				   of exiting.  If a future libpcap change returns to the old behavior (where the
-				   interface type remains consistent), we should go back to the old behavior of exiting.
-				*/
-				/*
-				report(LOG_ERR, "interface %s link layer type %d not ethernet", ifname, linktype);
-				my_exit(1, 1, 1);
-				*/
-				report(LOG_ERR, "interface %s link layer type %d not ethernet, skipping rest of this probe cycle", ifname, linktype);
-				break; /* for (l) ... */
-			}
-
-			/* compile bpf filter to select just udp/ip traffic to udp port bootpc  */
-			/* Although one would expect frames on an untagged logical network interface to arrive without any 802.1Q tag,
-			   some Ethernet drivers will deliver some frames with an 802.1Q tag in which vlan==0.
-			   This may be because the frame arrived with an 802.1Q tag in which the 802.1p priority was non-zero.
-			   To preserve that priority field, they retain the 802.1Q tag and set the vlan field to 0.
-			   As per spec, a frame received with 802.1Q tag in which vlan == 0 should be treated as an untagged frame. 
-			   So our bpf filter needs to include both untagged and tagged frames.
-			*/
-			if (pcap_compile(pd, &bpf_code, "udp dst port bootpc or (vlan and udp dst port bootpc)", 1, PCAP_NETMASK_UNKNOWN) < 0) {
-				report(LOG_ERR, "pcap_compile: %s", pcap_geterr(pd));
-				my_exit(1, 1, 1);
-			}
-			/* install compiled filter */
-			if (pcap_setfilter(pd, &bpf_code) < 0) {
-				report(LOG_ERR, "pcap_setfilter: %s", pcap_geterr(pd));
-				my_exit(1, 1, 1);
-			}
-			if (socket_receive_timeout_feature)
-				set_pcap_timeout(pd);
 
 			/* write one packet */
 
@@ -630,8 +657,8 @@ main(int argc, char **argv)
 			 */
 
 			/* close packet capture descriptor */
-			pcap_close(pd); 
-			pd = NULL;
+			if (! keep_pcap)
+				reset_pcap();
 
 			/* check for 'quit' request after sending each packet, since waiting until end of probe cycle
 			   would impose a substantial delay. */
@@ -679,7 +706,7 @@ main(int argc, char **argv)
 			reconfigure(write_packet_len);
 			reread_config_file = 0;
 		}
-
+		
 		/* We allow must signals that come in during our sleep() to interrupt us.  E.g. we want to cut short
 		   our sleep when we're signalled to exit.  But we must block SIGCHLD during our sleep.  That's because
 		   if we forked an alert_program or alert_program2 child above, its termination will likely happen while we're sleeping;
@@ -694,7 +721,21 @@ main(int argc, char **argv)
 		sigaddset(&new_sigset, SIGCHLD);
 		sigprocmask(SIG_BLOCK, &new_sigset, &old_sigset);  /* block SIGCHLD */
 
-		sleep(time_to_sleep);
+		if (keep_pcap) {
+			/* If we're going to keep the packet capture running,
+			   we might as well read off all the packets received while
+			   waiting. We shouldn't get any since we don't send any requests
+			   but this should prevent any buffers from accidentally filling
+			   with unhandled packets. */
+			int packets_recv = 0, receive_and_process_responses_rc;
+			if ((receive_and_process_responses_rc = receive_and_process_responses(time_to_sleep)) >= 0)
+				packets_recv = receive_and_process_responses_rc;
+
+			if (packets_recv && debug > 10)
+				report(LOG_DEBUG, "captured %d packets while sleeping", packets_recv);
+		} else {
+			sleep(time_to_sleep);
+		}
 
 		sigprocmask(SIG_SETMASK, &old_sigset, NULL);  /* unblock SIGCHLD */
 
@@ -702,8 +743,10 @@ main(int argc, char **argv)
 
 	} /* MAIN EVENT LOOP */
 
-
 	/* we only reach here after receiving a signal requesting we quit */
+	
+	if (keep_pcap)
+		reset_pcap();
 
 	if (pd_template) /* only used if a capture file requested */
 		pcap_close(pd_template); 
@@ -1284,6 +1327,7 @@ usage(void)
 	fprintf(stderr, "   -d debuglevel                  enable debugging at specified level\n");
 	fprintf(stderr, "   -f                             don't fork (only use for debugging)\n");
 	fprintf(stderr, "   -h                             display this help message then exit\n");
+	fprintf(stderr, "   -k                             keep pcap open constantly (don't recreate on each cycle)\n");
 	fprintf(stderr, "   -l log_file                    log to file instead of syslog\n");
 	fprintf(stderr, "   -o capture_file                enable capturing of unexpected answers\n");
 	fprintf(stderr, "   -p pid_file                    override default pid file [%s]\n", PID_FILE);