From patchwork Wed Nov 27 17:33:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Prestwood X-Patchwork-Id: 13887260 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23499201034 for ; Wed, 27 Nov 2024 17:33:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728815; cv=none; b=goAh9qxq2w1py1BXq2jXXSzkWVEnHmleVvF2Rzc2XpeG25LXrdJeIKqEaBNy6UNMdGmca7cOt2en7CxgDioiybQMg/Af6bnNRFtkIAFAbMFArwcGbHVP++7wIbHvPSsUoIF7CBh2jdUIaPo9sbOKnIqae3xa5mUqTc3g31Op770= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728815; c=relaxed/simple; bh=Ovqf2R4e0euw9R94sLlGgPbixZCGDIO2VzhnMmUnFKw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=mh+5Zd1uMgnfvcr7d0zJE+a9Jmg3VsGbJ734E0UwZlpdeDi8vngR/ZKiCyW42PKCsxbk1yDtg2ImsmqXBS4bGjhkhe0PaDYkEglScX8TgLF5225iBHDmEYPd1zmXTn790aqN8eSTc5KB6J99c5YHFPtrJs7ko4blvHCPpkYW2VE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=m0E8u5aL; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="m0E8u5aL" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-724e14b90cfso27992b3a.2 for ; Wed, 27 Nov 2024 09:33:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1732728813; x=1733333613; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=IoYzFF7rkglPYpZNKrTTPMUnpGVVBVOcK1cmVknWkCg=; b=m0E8u5aLkBcEQHnL53BgRSCFGKGh06/INoio0SEtc70Tkd9P3W7pt5TOmuvEMkaFTd aA0SwD0+l61Q9+o5br3VQm/CEqf9SGdV39Q2gAJ0Y9ZftqyDz05n8De8v7cHP/osZjt9 BGpaBrEM5vgTfF3DWuDm29dm9t/ziI2EEjuXw+qoNDh0eqjZmRXMBlKPRp/zemkpP/Ra VHbdqVHuKDoXCYUFhwy1/SLBediwLo4wJWbazAy84MNo6QaGf1EExL+lJX/5PrWl8N7U UhANCLVuPUb9YWhvcwX+A322EtvwGJE/kFPy4tM4v7Plk5hdx2n0B/LKElxMeK6Q+XJ2 XUhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1732728813; x=1733333613; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=IoYzFF7rkglPYpZNKrTTPMUnpGVVBVOcK1cmVknWkCg=; b=E5dTpZ1KDdv9qmpXLOQ0PtHSMLe13SgJRBmqrpQJhp2cOrF6MMZQgqGuNnXm5i1AAp xgR2Y6Ug6/lWfplx9IpcE15xwTHk2jvOGhjgxe54j5xsU/pT4/WSgo9qNm9Rdp05PIPq elkAiJJHA0YlFali/JQ3T/tiEI8jOcQIVOrIsLXzkC/Fz8H0fAoeI/POFY9nCVmx7QLC WkOg0dvnC0vfaQTvHV4eUmmksSDvPah+Ifj9aedq1TzVtm+WrMF+hxTovlYfHfWdVfQ1 fBlT2l4vfxXC8zr7q70mLXzWacMBEVzh1+74kFRRkEh+4jbJFVcby0oHMc92IXMz/d2e tO7Q== X-Gm-Message-State: AOJu0YxsZlq8znVqHl84id9T27X37Nes3y3KO79ILQkrwF1rUhoZzIsC 7VQPLsghXvNPpNNlpAJcsNvjuBgrD/FfXWoR+Wi2uof8phm3IoIrszXn6g== X-Gm-Gg: ASbGncu+QWswQU0jy4gK79Midp4VSJ1k5dcRh7q7aOOx8I8/Ul0SnufbkB/j7cCV7nD fVD+ddRSXRe+tblwAqUpLZ08ewxMCYclkI0RjI5G1rVD9PbmfRU1RJ/sIKCcNAOZ3xeyrgSBzSW 6G0hOG9bcVpOwGdAhsefPP72c7AWjUl1bkz/iD2MG2o+TrvryUwnRyXDiLGykXSJX0cVXfi3fXG KsmzTqKHeZlscvooWIGv0RMxPGG4Z+h28D5E1br82xz8FXK/5t0vlhJWSp4 X-Google-Smtp-Source: AGHT+IF4l6duSph1RAtykPMuW6p8v3JkVgZgriN0ULbmqeSkslqHeo6j2JQCw0iv7Ib3Th1ohZIsHA== X-Received: by 2002:a17:902:ce89:b0:212:349f:8413 with SMTP id d9443c01a7336-21501095e67mr40886115ad.21.1732728812966; Wed, 27 Nov 2024 09:33:32 -0800 (PST) Received: from LOCLAP699.localdomain ([152.193.78.90]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2129dba3022sm105487305ad.65.2024.11.27.09.33.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Nov 2024 09:33:32 -0800 (PST) From: James Prestwood To: iwd@lists.linux.dev Cc: James Prestwood Subject: [PATCH 1/4] monitor: add --time-format,-t option Date: Wed, 27 Nov 2024 09:33:25 -0800 Message-Id: <20241127173328.158354-1-prestwoj@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: iwd@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 For syncing iwmon captures with other logging its useful to timestamp in some absolute format like UTC. This adds an option which allows the user to specify what time format to show. For now support: delta - (default) The time delta between the first packet and the current packet. utc - The packet time in UTC --- monitor/main.c | 56 ++++++++++++++++++++++++++++++------------------- monitor/nlmon.c | 40 +++++++++++++++++++++++++++++------ monitor/nlmon.h | 6 ++++++ 3 files changed, 75 insertions(+), 27 deletions(-) diff --git a/monitor/main.c b/monitor/main.c index fc22c777..fe40e301 100644 --- a/monitor/main.c +++ b/monitor/main.c @@ -718,29 +718,32 @@ static void usage(void) "Usage:\n"); printf("\tiwmon [options]\n"); printf("Options:\n" - "\t-r, --read Read netlink PCAP trace file\n" - "\t-w, --write Write netlink PCAP trace file\n" - "\t-a, --analyze Analyze netlink PCAP trace file\n" - "\t-i, --interface Use specified netlink monitor\n" - "\t-n, --nortnl Don't show RTNL output\n" - "\t-y, --nowiphy Don't show 'New Wiphy' output\n" - "\t-s, --noscan Don't show scan result output\n" - "\t-e, --noies Don't show IEs except SSID\n" - "\t-h, --help Show help options\n"); + "\t-r, --read Read netlink PCAP trace file\n" + "\t-w, --write Write netlink PCAP trace file\n" + "\t-a, --analyze Analyze netlink PCAP trace file\n" + "\t-i, --interface Use specified netlink monitor\n" + "\t-n, --nortnl Don't show RTNL output\n" + "\t-y, --nowiphy Don't show 'New Wiphy' output\n" + "\t-s, --noscan Don't show scan result output\n" + "\t-e, --noies Don't show IEs except SSID\n" + "\t-t, --time-format Time format to display. Either\n" + "\t\t\t\t 'delta' or 'utc'.\n" + "\t-h, --help Show help options\n"); } static const struct option main_options[] = { - { "read", required_argument, NULL, 'r' }, - { "write", required_argument, NULL, 'w' }, - { "analyze", required_argument, NULL, 'a' }, - { "nl80211", required_argument, NULL, 'F' }, - { "interface", required_argument, NULL, 'i' }, - { "nortnl", no_argument, NULL, 'n' }, - { "nowiphy", no_argument, NULL, 'y' }, - { "noscan", no_argument, NULL, 's' }, - { "noies", no_argument, NULL, 'e' }, - { "version", no_argument, NULL, 'v' }, - { "help", no_argument, NULL, 'h' }, + { "read", required_argument, NULL, 'r' }, + { "write", required_argument, NULL, 'w' }, + { "analyze", required_argument, NULL, 'a' }, + { "nl80211", required_argument, NULL, 'F' }, + { "interface", required_argument, NULL, 'i' }, + { "nortnl", no_argument, NULL, 'n' }, + { "nowiphy", no_argument, NULL, 'y' }, + { "noscan", no_argument, NULL, 's' }, + { "noies", no_argument, NULL, 'e' }, + { "time-format", required_argument, NULL, 't' }, + { "version", no_argument, NULL, 'v' }, + { "help", no_argument, NULL, 'h' }, { } }; @@ -754,7 +757,7 @@ int main(int argc, char *argv[]) for (;;) { int opt; - opt = getopt_long(argc, argv, "r:w:a:i:nvhyse", + opt = getopt_long(argc, argv, "r:w:a:i:t:nvhyse", main_options, NULL); if (opt < 0) break; @@ -784,6 +787,17 @@ int main(int argc, char *argv[]) break; case 'e': config.noies = true; + break; + case 't': + if (!strcmp(optarg, "delta")) + config.time_format = TIME_FORMAT_DELTA; + else if (!strcmp(optarg, "utc")) + config.time_format = TIME_FORMAT_UTC; + else { + printf("Invalid time format '%s'", optarg); + return EXIT_FAILURE; + } + break; case 'v': printf("%s\n", VERSION); diff --git a/monitor/nlmon.c b/monitor/nlmon.c index 60adddc5..4ecbc5f0 100644 --- a/monitor/nlmon.c +++ b/monitor/nlmon.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include #include @@ -113,6 +114,7 @@ struct nlmon { bool noscan; bool noies; bool read; + enum time_format time_format; }; struct nlmon_req { @@ -185,11 +187,15 @@ static void nlmon_req_free(void *data) } static time_t time_offset = ((time_t) -1); +static enum time_format time_format; -static inline void update_time_offset(const struct timeval *tv) +static inline void update_time_offset(const struct timeval *tv, + enum time_format tf) { - if (tv && time_offset == ((time_t) -1)) + if (tv && time_offset == ((time_t) -1)) { time_offset = tv->tv_sec; + time_format = tf; + } } #define print_indent(indent, color1, prefix, title, color2, fmt, args...) \ @@ -225,15 +231,33 @@ static void print_packet(const struct timeval *tv, char ident, int n, ts_len = 0, ts_pos = 0, len = 0, pos = 0; if (tv) { + struct tm *tm; + if (use_color()) { n = sprintf(ts_str + ts_pos, "%s", COLOR_TIMESTAMP); if (n > 0) ts_pos += n; } - n = sprintf(ts_str + ts_pos, " %" PRId64 ".%06" PRId64, + switch (time_format) { + case TIME_FORMAT_DELTA: + n = sprintf(ts_str + ts_pos, " %" PRId64 ".%06" PRId64, (int64_t)tv->tv_sec - time_offset, (int64_t)tv->tv_usec); + break; + case TIME_FORMAT_UTC: + tm = gmtime(&tv->tv_sec); + if (!tm) { + n = sprintf(ts_str + ts_pos, "%s", + "Time error"); + break; + } + + n = strftime(ts_str + ts_pos, sizeof(ts_str) - ts_pos, + "%b %d %H:%M:%S", tm); + break; + } + if (n > 0) { ts_pos += n; ts_len += n; @@ -7497,6 +7521,7 @@ struct nlmon *nlmon_create(uint16_t id, const struct nlmon_config *config) nlmon->noscan = config->noscan; nlmon->noies = config->noies; nlmon->read = config->read_only; + nlmon->time_format = config->time_format; return nlmon; } @@ -8333,7 +8358,10 @@ void nlmon_print_rtnl(struct nlmon *nlmon, const struct timeval *tv, int64_t aligned_size = NLMSG_ALIGN(size); const struct nlmsghdr *nlmsg; - update_time_offset(tv); + if (nlmon->nortnl) + return; + + update_time_offset(tv, nlmon->time_format); for (nlmsg = data; NLMSG_OK(nlmsg, aligned_size); nlmsg = NLMSG_NEXT(nlmsg, aligned_size)) { @@ -8371,7 +8399,7 @@ void nlmon_print_genl(struct nlmon *nlmon, const struct timeval *tv, { const struct nlmsghdr *nlmsg; - update_time_offset(tv); + update_time_offset(tv, nlmon->time_format); for (nlmsg = data; NLMSG_OK(nlmsg, size); nlmsg = NLMSG_NEXT(nlmsg, size)) { @@ -8394,7 +8422,7 @@ void nlmon_print_pae(struct nlmon *nlmon, const struct timeval *tv, { char extra_str[16]; - update_time_offset(tv); + update_time_offset(tv, nlmon->time_format); sprintf(extra_str, "len %u", size); diff --git a/monitor/nlmon.h b/monitor/nlmon.h index bb1a7c58..bbc5d250 100644 --- a/monitor/nlmon.h +++ b/monitor/nlmon.h @@ -25,12 +25,18 @@ struct nlmon; +enum time_format { + TIME_FORMAT_DELTA, + TIME_FORMAT_UTC, +}; + struct nlmon_config { bool nortnl; bool nowiphy; bool noscan; bool noies; bool read_only; + enum time_format time_format; }; struct nlmon *nlmon_open(uint16_t id, const char *pathname, From patchwork Wed Nov 27 17:33:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Prestwood X-Patchwork-Id: 13887261 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 694DE1E1041 for ; Wed, 27 Nov 2024 17:33:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728816; cv=none; b=kEXBcGY8eBngsJQ4OsL9aOFE0lSwdq37oTQn9fKxpSfJaqAdHQDvtfa620YUQgS0qzHJuYnb7TuN7MGjTPKRmNtrQl/eKVt0WosZ1QudcFXtChaHEYwIVStB3ALsmOveJzuqpbNcYulJ+YFKEhZG7wlbZiw9xF0a9NDWwkJsJJg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728816; c=relaxed/simple; bh=2Zi4/vqFtxByKs/3VxDoJnY99JyExLX1mp2WF7lSBr8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=RKRaGE2LS5QNtr2QwVdIOoqYn3dNFdKVLfbCTLEjztH+gr3oPX4zg0zr0+q+nQgJRp9FwJfHHQLrDmzHlTQGROvzLE7krzEbMPWL/lY67oJDjjLQ8TSmU8ik7gFPCRnzm1rjUTTKCk2HqrGuYragfBcZV+j6rsxR0xEZkyB/kKY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BCOOv19E; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BCOOv19E" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2126408cf31so51311595ad.0 for ; Wed, 27 Nov 2024 09:33:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1732728814; x=1733333614; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NTf38Av7Y42HfeDckzjvAA0AbIrAstHrD8Hg1EQv/xY=; b=BCOOv19EKmzALAUqJ1MLQK3fB2JDqi0EOXB4571ooKtoIPHYYMNFk7UEXvtUfyi3oA DR/Z7tIcNGs8vJ0oWj52+MwOmMlM2BsKgHaDsmx+IKUDHxUsHtCGO4VC3qDb9b7XFH3a DpCAbpggQQ4FQusn11uPNtj63K0VTjYrBaP3obV9M7USGvnefxKCJ5zt9tdB8n+WGTlT VWUyaj6UI4UrOEM3jOzM7/nJjMRjXiVszibRJ//H6y8vfaVyDudELZ+GqawzzeJie2BI +f37VSi+Kh6DImCaS7/3EgQBSHC6PwunVoafw7+hKoT9Q1ajqv7f7xIca6GEqKWaoNzY XngA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1732728814; x=1733333614; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NTf38Av7Y42HfeDckzjvAA0AbIrAstHrD8Hg1EQv/xY=; b=tSevsqcqZYOO+YHz/hCGbGBxWtYvg54I3iQQtf+T65S6WYxUGW+E+7Rj+r9gvX7O8w 1qY6MBcocRzoMpnIJ8XwaLiZGaMPoV2/CRY4DIGxQRHLaafZ6ANkGAsuvDsmIqQ4eV4J sPznbyRd12x0/3pncY87+x2U8yDy9ue9g3bRqf9hN5zDrUfzwLvxBN4Ok3Zg8nZMD3yX Kclgsm2PFaud3BRVzqmqUfdpFpYpP6GwCIQipqUa0Pmqf7rRb8u3vlbwE2TO6ld690wi 17OgTbSgHhxPWPHA8PiElMYZy3QbdmKaPr61+YG9ZVXnKYe2bFgl+T+RtgkUl2RqERAk fqtw== X-Gm-Message-State: AOJu0YxjvCsjcaTAMeteoaxwyCMA534liBkul8TGtcINUg7fwa/DHchG JK67Mr0Nz4eE0M9jG6l12E0QtTq0omxPi3l787DyrELq9Ns4goUumGNRvQ== X-Gm-Gg: ASbGncuh6+rujv9GG14jSPxJTraWAzK9xV9qnRK6Mg2Zgu+AvFWkDwh0DG/hHW+tS0N vm16hl0C2Fpn1VlKJFZIrwAshUjeEFFSYqA+IXGwwUeZFjW/+FeJ1P/pLU2CA4MS6LLwa9aDH1r yZss8/zqcTBHZ1Hdwg1Yjo8+5EVpw7iYaYf5EPVjKMjHbOTG8AuXYBCsEhL6ycAAI42lkYrdJ23 /Q671MHdURjBcclPD+5pb03sUSWQ7V9zs9oR6LqZ3/zcBPdW9HgUjWMSJdl X-Google-Smtp-Source: AGHT+IHkvGYa6Gd5O36r4wejFYGYsZm78OXyXoMqGPrPxhlq/D748qqp8nxMNcAQs+DnB5Uu6TKyuQ== X-Received: by 2002:a17:902:d501:b0:212:9b1:e56b with SMTP id d9443c01a7336-21501b5a270mr41895425ad.42.1732728814494; Wed, 27 Nov 2024 09:33:34 -0800 (PST) Received: from LOCLAP699.localdomain ([152.193.78.90]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2129dba3022sm105487305ad.65.2024.11.27.09.33.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Nov 2024 09:33:34 -0800 (PST) From: James Prestwood To: iwd@lists.linux.dev Cc: James Prestwood Subject: [PATCH 2/4] monitor: track current PCAP size Date: Wed, 27 Nov 2024 09:33:26 -0800 Message-Id: <20241127173328.158354-2-prestwoj@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20241127173328.158354-1-prestwoj@gmail.com> References: <20241127173328.158354-1-prestwoj@gmail.com> Precedence: bulk X-Mailing-List: iwd@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 This will come into play when support for rolling captures is added to iwmon. --- monitor/pcap.c | 10 ++++++++++ monitor/pcap.h | 1 + 2 files changed, 11 insertions(+) diff --git a/monitor/pcap.c b/monitor/pcap.c index fb29eea8..b13a29f3 100644 --- a/monitor/pcap.c +++ b/monitor/pcap.c @@ -60,6 +60,7 @@ struct pcap { bool closed; uint32_t type; uint32_t snaplen; + size_t size; }; struct pcap *pcap_open(const char *pathname) @@ -152,6 +153,8 @@ struct pcap *pcap_create(const char *pathname) goto failed; } + pcap->size += len; + return pcap; failed: @@ -188,6 +191,11 @@ uint32_t pcap_get_snaplen(struct pcap *pcap) return pcap->snaplen; } +size_t pcap_get_size(struct pcap *pcap) +{ + return pcap->size; +} + bool pcap_read(struct pcap *pcap, struct timeval *tv, void *data, uint32_t size, uint32_t *len, uint32_t *real_len) { @@ -279,5 +287,7 @@ bool pcap_write(struct pcap *pcap, const struct timeval *tv, return false; } + pcap->size += written; + return true; } diff --git a/monitor/pcap.h b/monitor/pcap.h index 1705b33d..5b797cf3 100644 --- a/monitor/pcap.h +++ b/monitor/pcap.h @@ -36,6 +36,7 @@ void pcap_close(struct pcap *pcap); uint32_t pcap_get_type(struct pcap *pcap); uint32_t pcap_get_snaplen(struct pcap *pcap); +size_t pcap_get_size(struct pcap *pcap); bool pcap_read(struct pcap *pcap, struct timeval *tv, void *data, uint32_t size, uint32_t *len, uint32_t *real_len); From patchwork Wed Nov 27 17:33:27 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Prestwood X-Patchwork-Id: 13887262 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12891201037 for ; Wed, 27 Nov 2024 17:33:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728818; cv=none; b=KvED4W+ij3jg55nU/GPhPBuZtmRordMXjt03v12hSUBI3p6XzvcZFAW4Tcr2/Jr3URJIoMFRSjzI5zzYVdgmDeJZ9HDIaZCvTeAlvr1MHtlaCPxtSWETqY/zFMfHgXWasI5n9QKfh4UvPPGlz6PgWZMmZlTmqOSuZYiL/IWA7vA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728818; c=relaxed/simple; bh=sgHJqk2K0PbFz0AYqC5yqWXOqGHbBqv9Cjrl/te2as8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=F+CztsNI0zATeeBBngBpfScwKOwfws11RExwuvuxPCHY28MD90YNbU9zSlZubosoCMCJV78BCtDyPxeNUaQmATrzbulgYWBYZM5wbcsAp7LSKPLnfzLvs8KYjvyQwT2pBkKD2rEflTjIdnEkx3dbmZgyowWArRR6y+/VZmZdL04= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TGsTZin7; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TGsTZin7" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-212874cd62cso47912525ad.3 for ; Wed, 27 Nov 2024 09:33:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1732728816; x=1733333616; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=s5krJwb9f6bvgnmf4pJNPCk0tRIJeDHDucoiutJFm1I=; b=TGsTZin7M7jdBIxBa8dSqOWErHpCsyPqsa93lSnO7Yly/MalInFpDhPW+FZ7YVXupz 3XqxX/eTQFNKkTMxGVdnaTM3zxXwyh3DyFEy0Co89nrORjKrwPPQ6ykf+5VNY/gCBumk G+p3fTANJZIXHlMVkTwGBtvU0lmRZ3NGqvN6Zx9kzfD29pUtgyEjVz3p71FtXXx2FNiv Bw5C+vrJQXIabypS1hcYpjLVtCRoJHHv0cmnFXtNr2kYyrgvivXlZNbr57GqMFdDVQ0P gmithMys4+tM/cZsanlGi+d+dqqzPDMQZywMKTDBXwkjDehpgShH4YJirUFB3xMeGDli B9tw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1732728816; x=1733333616; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=s5krJwb9f6bvgnmf4pJNPCk0tRIJeDHDucoiutJFm1I=; b=wvGAAZlixmNW6HlnN8j/ojvY5jRwjbuTXKx2QD+7FFPg0czEslxXrv3QcaxBotzw4U F2HXOGti3joaGh9i7Ov/PEDmwy7OgaAsNoXoKbkNap6pn0KPlXqFjnU8vy9cqWoIdxSD WCzcgVU3h3X5FN3L58kOgi8zGRwcf+jMEvlC4LlRx++HM6WxSjF6+DIlfndYYNFxbSkq WjayZy9O3C9XNx3SVimdNlCztL6EuW6E/l4gfpLR5iZ57i/mzwHM/dlOEi6HNqOWDqtz vCnTI5Fj9d+jV8NO/1iwpN3oizEjEfwtupDEVEpUjP+ikHvXTF/b6oXeGy2HELgwJ63D lFlw== X-Gm-Message-State: AOJu0YzwFz3fll2lmOzHcUlDUfsIpcRg9gchkYCPQNDeQWEIzBTbkhfc yikQPctdQjW0yzV5DEewCeyhjvZMNXCIN04fwi+ZhMYUphb/HK34BwFdxg== X-Gm-Gg: ASbGncuoAzFC08tmhMrqmv4mpg/aLkCViRiZTkV5tODK3H6AUx/JQh2mqtZCEiBzdGu BYLz7qj7lGzz/S6Utx9+6UKnHu4Duova+wkpq13GkGacpnIy3kSMnjEAhklMNt6Y9mdOpxDkKMi UjoAw9lw+PEkwBLm0jNm09HE4/zwxN5kDOtmjYNJwopI0kwLXWpUgQFRDXFZc+hW/+PIIMo0rij Dl+NX8t+FDSX3zaon5xcJ0FzVXaNHkb7WIED9+mWqBSSF9O+NAzzVIDD3Mr X-Google-Smtp-Source: AGHT+IGQbk+Jw7rdBFq8Tilvc+xWTBhvW9PgkYzdP1GhSMtOZYkmEU6yme/ny2Hn+8NFJ2BCzH9S3A== X-Received: by 2002:a17:902:d4cb:b0:20f:ab4a:db2e with SMTP id d9443c01a7336-2150175cbe9mr59071485ad.29.1732728816039; Wed, 27 Nov 2024 09:33:36 -0800 (PST) Received: from LOCLAP699.localdomain ([152.193.78.90]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2129dba3022sm105487305ad.65.2024.11.27.09.33.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Nov 2024 09:33:35 -0800 (PST) From: James Prestwood To: iwd@lists.linux.dev Cc: James Prestwood Subject: [PATCH 3/4] monitor: add support for limiting PCAP size/count Date: Wed, 27 Nov 2024 09:33:27 -0800 Message-Id: <20241127173328.158354-3-prestwoj@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20241127173328.158354-1-prestwoj@gmail.com> References: <20241127173328.158354-1-prestwoj@gmail.com> Precedence: bulk X-Mailing-List: iwd@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 This implements support for "rolling captures" by allowing iwmon to limit the PCAP file size and number of PCAP's that are created. This is a useful feature when long term monitoring is needed. If there is some rare behavior requiring iwmon to run for days, months, or longer the resulting PCAP file would become quite large and fill up disk space. When enabled (command line arguments in subsequent patch) the PCAP file size is checked on each write. If it exceeds the limit a new PCAP file will be created. Once the number of old PCAP files reaches the set limit the oldest PCAP will be removed from disk. --- monitor/nlmon.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++-- monitor/nlmon.h | 4 +++ 2 files changed, 85 insertions(+), 2 deletions(-) diff --git a/monitor/nlmon.c b/monitor/nlmon.c index 4ecbc5f0..d5f8634e 100644 --- a/monitor/nlmon.c +++ b/monitor/nlmon.c @@ -43,6 +43,7 @@ #include #include #include +#include #include #ifndef ARPHRD_NETLINK @@ -94,6 +95,8 @@ #define BSS_CAPABILITY_APSD (1<<11) #define BSS_CAPABILITY_DSSS_OFDM (1<<13) +#define BYTES_PER_MB 1000000 + struct nlmon *cur_nlmon; enum msg_type { @@ -115,6 +118,11 @@ struct nlmon { bool noies; bool read; enum time_format time_format; + + char *file_prefix; + unsigned int file_idx; + unsigned int max_files; + unsigned int max_size; }; struct nlmon_req { @@ -7388,6 +7396,64 @@ static bool nlmon_req_match(const void *a, const void *b) return (req->seq == match->seq && req->pid == match->pid); } +/* + * Ensures that PCAP names are zero padded when needed. This makes the files + * sort correctly. + */ +static void next_pcap_name(char *buf, size_t size, const char *prefix, + unsigned int idx, unsigned int max) +{ + unsigned int ndigits = 1; + + while (max > 9) { + max /= 10; + ndigits++; + } + + snprintf(buf, size, "%s%.*u", prefix, ndigits, idx); +} + +static bool check_pcap(struct nlmon *nlmon, size_t next_size) +{ + char path[PATH_MAX]; + + if (!nlmon->pcap) + return false; + + if (!nlmon->max_size) + return true; + + if (pcap_get_size(nlmon->pcap) + next_size <= nlmon->max_size) + return true; + + pcap_close(nlmon->pcap); + + /* Exausted the single PCAP file */ + if (nlmon->max_files < 2) { + printf("Reached maximum size of PCAP, exiting\n"); + nlmon->pcap = NULL; + l_main_quit(); + return false; + } + + next_pcap_name(path, sizeof(path), nlmon->file_prefix, + ++nlmon->file_idx, nlmon->max_files); + + nlmon->pcap = pcap_create(path); + + if (nlmon->max_files > nlmon->file_idx) + return true; + + /* Remove oldest PCAP file */ + next_pcap_name(path, sizeof(path), nlmon->file_prefix, + nlmon->file_idx - nlmon->max_files, nlmon->max_files); + + if (remove(path) < 0) + printf("Failed to remove old PCAP file %s\n", path); + + return true; +} + static void store_packet(struct nlmon *nlmon, const struct timeval *tv, uint16_t pkt_type, uint16_t arphrd_type, @@ -7396,7 +7462,7 @@ static void store_packet(struct nlmon *nlmon, const struct timeval *tv, { uint8_t sll_hdr[16], *buf = sll_hdr; - if (!nlmon->pcap) + if (!check_pcap(nlmon, sizeof(sll_hdr) + size)) return; memset(sll_hdr, 0, sizeof(sll_hdr)); @@ -7522,6 +7588,9 @@ struct nlmon *nlmon_create(uint16_t id, const struct nlmon_config *config) nlmon->noies = config->noies; nlmon->read = config->read_only; nlmon->time_format = config->time_format; + nlmon->max_files = config->pcap_file_count; + /* Command line expects MB, but use bytes internally */ + nlmon->max_size = config->pcap_file_size * BYTES_PER_MB; return nlmon; } @@ -8549,13 +8618,20 @@ struct nlmon *nlmon_open(uint16_t id, const char *pathname, struct nlmon *nlmon; struct l_io *pae_io; struct pcap *pcap; + char path[PATH_MAX]; pae_io = open_pae(); if (!pae_io) return NULL; if (pathname) { - pcap = pcap_create(pathname); + if (config->pcap_file_count > 1) + next_pcap_name(path, sizeof(path), pathname, + 0, config->pcap_file_count); + else + snprintf(path, sizeof(path), "%s", pathname); + + pcap = pcap_create(path); if (!pcap) { l_io_destroy(pae_io); return NULL; @@ -8568,6 +8644,7 @@ struct nlmon *nlmon_open(uint16_t id, const char *pathname, nlmon->pae_io = pae_io; nlmon->pcap = pcap; + nlmon->file_prefix = l_strdup(pathname); l_io_set_read_handler(nlmon->pae_io, pae_receive, nlmon, NULL); @@ -8590,5 +8667,7 @@ void nlmon_close(struct nlmon *nlmon) if (nlmon->pcap) pcap_close(nlmon->pcap); + l_free(nlmon->file_prefix); + l_free(nlmon); } diff --git a/monitor/nlmon.h b/monitor/nlmon.h index bbc5d250..fa027021 100644 --- a/monitor/nlmon.h +++ b/monitor/nlmon.h @@ -37,6 +37,10 @@ struct nlmon_config { bool noies; bool read_only; enum time_format time_format; + + /* File size in MB */ + uint32_t pcap_file_size; + uint32_t pcap_file_count; }; struct nlmon *nlmon_open(uint16_t id, const char *pathname, From patchwork Wed Nov 27 17:33:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Prestwood X-Patchwork-Id: 13887263 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7059201019 for ; Wed, 27 Nov 2024 17:33:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728820; cv=none; b=djJgjmArJjKU1AwpeX+mJhaOZoucYUWx8xehvbFOEnAsTN77UmS/pkI7O2UAF5RfQ8Vy67H0MGezu5bwPQqrDTUUQcH3eaWO6P0sss98XJr+H3GFidbKnWNwk0XEZv0xF7ku8af6XiZUSZHxsl+F3jXxFdex9ycONnR7DWwb7Bs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732728820; c=relaxed/simple; bh=G63noPF0CmFLEGQEvGhXroPWXXsDVAPupvvbH1Aslh0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=pb3dSvx4mEIHINDeSuhMbctPfhZfiOuAr6qONN1roj+LAScA8sgn7Jb2OSg5kk6CO8W4/dEyFVC9was7Tlj8BjWTJOF5v2wtDozNZxNZSPXmDSv8g+CKNzqr2AGURbgD85KcSXG9p5uLwlkThC8oKF3VZynLJGWxD++5nwtjz9E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=b33QHgUc; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="b33QHgUc" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-214f6ed9f17so16578375ad.1 for ; Wed, 27 Nov 2024 09:33:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1732728818; x=1733333618; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=sqQbg3z767lkylc4fof21EsyCBDqgw3MsPqrXDPxyBU=; b=b33QHgUcfCFODAOaxUoZJja+FRvBccmyn5+3y7sakbt+7DCAI8Xa1zDn7y3aD0rj7I ySs75s19X/0d9iqLjt8HWVFjs4ZZ8i1SC/XVHdX7wPKZsvq3kXxEsPYd0IuznWXF2G11 w1uzlvNB2XpI40zQ+7jBem0MGD6MsAoHTDcAHl0NHPstR/Q0hKLOt6quexgW1Y3dV5FB 6u14zHACg0r709Pkhc1KG5Q6mOT4HDd/MAo1qR0FGZfjyPljCFMQPucRNlTY2J+gtWz8 LUIrQXFEW3aljuSgr6bB4bduABcZsEJYP1eoqvI79lKX+7gkEKOuEsnnMcTI/pSXstfB 23pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1732728818; x=1733333618; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=sqQbg3z767lkylc4fof21EsyCBDqgw3MsPqrXDPxyBU=; b=fRglIIpBuOIe+7zA0SdHbHfmfTSihJikUGdu3Wwv/uwrGvYs/t1AnmlTBqGC6VqNMh qAdiLR0FbyY3uzCSmhmm2tVrG6TR4uaCpwOQlBb3Ud9ItBa/3BLe6+XmIJLlifXv7M2D ybP5VlOrQQSIWj8rv3srH95+DjB7XFXtKWL3FQ6BsIlhriQabo9UbGvrwMd07KjyMZha 5UN79kZ92pdaIcgwASLeZpLrF7Wme1K/5fqpBzsYunuIvsFaAUVWuyw+7/wzD8Ytz9gH soHcuXCp05r4D7sVDWletKL5tLo4Fdw5KGIG4LMsi5mLJToTtW7rQ3HbEcIH8yHZZob7 6ClA== X-Gm-Message-State: AOJu0YxFpFXqwYqCRvoWB8gJd3nePNGpZELDP94ScYo5OLU+nsj+f8c0 kI84cbHEZfPeEtN2r2bzmIJk/j1A4QU2FchqXGBPhbFEE4NYUj36ryrbEQ== X-Gm-Gg: ASbGncstsj7z8AhevprskrllkJzxwHDsHJLvrhlLYouHvVho0oeAPpYFEnj5uK+n/Zg SMXaZF+AoKYcy7+zj8msM6kh1wgj9ZrTN/q+GHI/OEiYF2kgz2VZ9jTR2D2x2fknmOep/mo/MZg pDLU4ztSfZy7EA8bK8vOXp/QSDGQJh7r3Yz8XxXmnqx1S+AU5cwU/wFo+7MM1qt15RrPh/fSInY KOgdO15CTPHUakBxsA9J8FJiLzuETEjPVZTvPvbtTBzSpEa0i5h/3IdRjtF X-Google-Smtp-Source: AGHT+IFCTlLlh/svRIy4b3zGnNhjz49LjtOiKGmYiE7IbBqxC8xp1jAw7AUNN/hAdjXwMYSO7iVx8w== X-Received: by 2002:a17:902:e801:b0:212:67a5:ab2d with SMTP id d9443c01a7336-21501d5df9amr53723545ad.44.1732728817608; Wed, 27 Nov 2024 09:33:37 -0800 (PST) Received: from LOCLAP699.localdomain ([152.193.78.90]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2129dba3022sm105487305ad.65.2024.11.27.09.33.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Nov 2024 09:33:37 -0800 (PST) From: James Prestwood To: iwd@lists.linux.dev Cc: James Prestwood Subject: [PATCH 4/4] monitor: add --pcap-size,--pcap-count Date: Wed, 27 Nov 2024 09:33:28 -0800 Message-Id: <20241127173328.158354-4-prestwoj@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20241127173328.158354-1-prestwoj@gmail.com> References: <20241127173328.158354-1-prestwoj@gmail.com> Precedence: bulk X-Mailing-List: iwd@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The user can now limit the size and count of PCAP files iwmon will create. This allows iwmon to run for long periods of time without filling up disk space. --- monitor/main.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/monitor/main.c b/monitor/main.c index fe40e301..11077cee 100644 --- a/monitor/main.c +++ b/monitor/main.c @@ -728,6 +728,8 @@ static void usage(void) "\t-e, --noies Don't show IEs except SSID\n" "\t-t, --time-format Time format to display. Either\n" "\t\t\t\t 'delta' or 'utc'.\n" + "\t-W,--pcap-count Maximum number of PCAP files\n" + "\t-C,--pcap-size Maximum size (MB) of PCAP files\n" "\t-h, --help Show help options\n"); } @@ -742,6 +744,8 @@ static const struct option main_options[] = { { "noscan", no_argument, NULL, 's' }, { "noies", no_argument, NULL, 'e' }, { "time-format", required_argument, NULL, 't' }, + { "pcap-count", required_argument, NULL, 'W' }, + { "pcap-size", required_argument, NULL, 'C' }, { "version", no_argument, NULL, 'v' }, { "help", no_argument, NULL, 'h' }, { } @@ -757,7 +761,7 @@ int main(int argc, char *argv[]) for (;;) { int opt; - opt = getopt_long(argc, argv, "r:w:a:i:t:nvhyse", + opt = getopt_long(argc, argv, "r:w:a:i:t:W:C:nvhyse", main_options, NULL); if (opt < 0) break; @@ -798,6 +802,24 @@ int main(int argc, char *argv[]) return EXIT_FAILURE; } + break; + case 'W': + if (l_safe_atou32(optarg, + &config.pcap_file_count) < 0 || + config.pcap_file_count == 0) { + printf("Invalid file count '%s'\n", optarg); + return EXIT_FAILURE; + } + + break; + case 'C': + if (l_safe_atou32(optarg, + &config.pcap_file_size) < 0 || + config.pcap_file_size == 0) { + printf("Invalid file size '%s'\n", optarg); + return EXIT_FAILURE; + } + break; case 'v': printf("%s\n", VERSION);