From 153a0964e2d1e7a6fccaf7cfd7d58bbec057c7e2 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Sun, 3 Jan 2010 04:37:37 +0000 Subject: [PATCH] Added --packet-limit to fwknopd so that the number of incoming candidate SPA packets can be limited from the command line. When this limit is reached (any packet that contains application layer data and passes the pcap filter is included in the count) then fwknopd exits. git-svn-id: file:///home/mbr/svn/fwknop/trunk@179 510a4753-2344-4c79-9c09-4d669213fbeb --- ChangeLog | 6 ++++++ server/config_init.c | 7 ++++++- server/config_init.h | 3 ++- server/fwknopd.c | 7 +++++++ server/fwknopd_common.h | 6 ++++++ server/pcap_capture.c | 11 +++++++++++ 6 files changed, 38 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c0921bd9..5f505d11 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2010-01-02 Michael Rash + * Added --packet-limit to fwknopd so that the number of incoming candidate + SPA packets can be limited from the command line. When this limit is + reached (any packet that contains application layer data and passes the + pcap filter is included in the count) then fwknopd exits. + 2009-11-01 Michael Rash * (Legacy code) Applied patch from Jonthan Bennett to support the usage of the http_proxy environmental variable for sending SPA packets through an diff --git a/server/config_init.c b/server/config_init.c index 91c963cc..170b6552 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -316,7 +316,7 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) * file. */ set_config_entry(opts, CONF_HOSTNAME, opts->hostname); - + /* In case this is a re-config. */ optind = 0; @@ -421,6 +421,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) case 'c': /* This was handled earlier */ break; + case 'C': + opts->packet_ctr_limit = atoi(optarg); + break; case 'D': opts->dump_config = 1; break; @@ -511,6 +514,8 @@ usage(void) "Usage: fwknopd [options]\n\n" " -h, --help - Print this usage message and exit.\n" " -c, --config-file - Specify an alternate configuration file.\n" + " -C, --packet-limit - Limit the number of candidate SPA packets to\n" + " process and exit when this limit is reached.\n" " -D, --dump-config - Dump the current fwknop configuration values.\n" " -f, --foreground - Run fwknopd in the foreground so that it never\n" " forks off into the background.\n" diff --git a/server/config_init.h b/server/config_init.h index 5771f7e4..c8485baa 100644 --- a/server/config_init.h +++ b/server/config_init.h @@ -63,13 +63,14 @@ enum { /* Our getopt_long options string. */ -#define GETOPTS_OPTION_STRING "c:Dfhi:KO:RSvV" +#define GETOPTS_OPTION_STRING "c:C:Dfhi:KO:RSvV" /* Our program command-line options... */ static struct option cmd_opts[] = { {"config-file", 1, NULL, 'c'}, + {"packet-limit", 1, NULL, 'C'}, {"dump-config", 0, NULL, 'D'}, {"foreground", 0, NULL, 'f'}, {"fw-list", 0, NULL, FIREWALL_LIST }, diff --git a/server/fwknopd.c b/server/fwknopd.c index 6e582d5d..30b11fd4 100644 --- a/server/fwknopd.c +++ b/server/fwknopd.c @@ -259,6 +259,13 @@ main(int argc, char **argv) break; } } + else if (opts.packet_ctr >= opts.packet_ctr_limit) + { + log_msg(LOG_INFO|LOG_STDERR, + "Packet count limit (%d) reached. Exiting...", + opts.packet_ctr_limit); + break; + } else /* got_signal was not set (should be if we are here) */ { log_msg(LOG_WARNING|LOG_STDERR, diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h index eb6e1e2e..9ce0bf86 100644 --- a/server/fwknopd_common.h +++ b/server/fwknopd_common.h @@ -287,6 +287,12 @@ typedef struct fko_srv_options spa_pkt_info_t spa_pkt; /* The current SPA packet */ + /* Counter set from the command line to exit after the specified + * number of SPA packets are processed. + */ + unsigned int packet_ctr_limit; + unsigned int packet_ctr; /* counts packets with >0 payload bytes */ + /* This array holds all of the config file entry values as strings * indexed by their tag name. */ diff --git a/server/pcap_capture.c b/server/pcap_capture.c index 6002ed79..6589e6a9 100644 --- a/server/pcap_capture.c +++ b/server/pcap_capture.c @@ -154,6 +154,17 @@ pcap_capture(fko_srv_options_t *opts) { incoming_spa(opts); + /* Count this packet since it has at least one byte of payload + * data - we use this as a comparison for --packet-limit regardless + * of SPA packet validity at this point. + */ + opts->packet_ctr++; + if (opts->packet_ctr >= opts->packet_ctr_limit) + { + pcap_breakloop(pcap); + pending_break = 1; + } + pcap_errcnt = 0; continue; }