Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
864 lines (803 sloc) 26.4 KB
// Copyright 2012 Google, Inc. All rights reserved.
//
// Use of this source code is governed by a BSD-style license
// that can be found in the LICENSE file in the root of the source
// tree.
package gopacket
import (
"bytes"
"encoding/hex"
"errors"
"fmt"
"io"
"net"
"os"
"reflect"
"runtime/debug"
"strings"
"syscall"
"time"
)
// CaptureInfo provides standardized information about a packet captured off
// the wire or read from a file.
type CaptureInfo struct {
// Timestamp is the time the packet was captured, if that is known.
Timestamp time.Time
// CaptureLength is the total number of bytes read off of the wire.
CaptureLength int
// Length is the size of the original packet. Should always be >=
// CaptureLength.
Length int
// InterfaceIndex
InterfaceIndex int
// The packet source can place ancillary data of various types here.
// For example, the afpacket source can report the VLAN of captured
// packets this way.
AncillaryData []interface{}
}
// PacketMetadata contains metadata for a packet.
type PacketMetadata struct {
CaptureInfo
// Truncated is true if packet decoding logic detects that there are fewer
// bytes in the packet than are detailed in various headers (for example, if
// the number of bytes in the IPv4 contents/payload is less than IPv4.Length).
// This is also set automatically for packets captured off the wire if
// CaptureInfo.CaptureLength < CaptureInfo.Length.
Truncated bool
}
// Packet is the primary object used by gopacket. Packets are created by a
// Decoder's Decode call. A packet is made up of a set of Data, which
// is broken into a number of Layers as it is decoded.
type Packet interface {
//// Functions for outputting the packet as a human-readable string:
//// ------------------------------------------------------------------
// String returns a human-readable string representation of the packet.
// It uses LayerString on each layer to output the layer.
String() string
// Dump returns a verbose human-readable string representation of the packet,
// including a hex dump of all layers. It uses LayerDump on each layer to
// output the layer.
Dump() string
//// Functions for accessing arbitrary packet layers:
//// ------------------------------------------------------------------
// Layers returns all layers in this packet, computing them as necessary
Layers() []Layer
// Layer returns the first layer in this packet of the given type, or nil
Layer(LayerType) Layer
// LayerClass returns the first layer in this packet of the given class,
// or nil.
LayerClass(LayerClass) Layer
//// Functions for accessing specific types of packet layers. These functions
//// return the first layer of each type found within the packet.
//// ------------------------------------------------------------------
// LinkLayer returns the first link layer in the packet
LinkLayer() LinkLayer
// NetworkLayer returns the first network layer in the packet
NetworkLayer() NetworkLayer
// TransportLayer returns the first transport layer in the packet
TransportLayer() TransportLayer
// ApplicationLayer returns the first application layer in the packet
ApplicationLayer() ApplicationLayer
// ErrorLayer is particularly useful, since it returns nil if the packet
// was fully decoded successfully, and non-nil if an error was encountered
// in decoding and the packet was only partially decoded. Thus, its output
// can be used to determine if the entire packet was able to be decoded.
ErrorLayer() ErrorLayer
//// Functions for accessing data specific to the packet:
//// ------------------------------------------------------------------
// Data returns the set of bytes that make up this entire packet.
Data() []byte
// Metadata returns packet metadata associated with this packet.
Metadata() *PacketMetadata
}
// packet contains all the information we need to fulfill the Packet interface,
// and its two "subclasses" (yes, no such thing in Go, bear with me),
// eagerPacket and lazyPacket, provide eager and lazy decoding logic around the
// various functions needed to access this information.
type packet struct {
// data contains the entire packet data for a packet
data []byte
// initialLayers is space for an initial set of layers already created inside
// the packet.
initialLayers [6]Layer
// layers contains each layer we've already decoded
layers []Layer
// last is the last layer added to the packet
last Layer
// metadata is the PacketMetadata for this packet
metadata PacketMetadata
decodeOptions DecodeOptions
// Pointers to the various important layers
link LinkLayer
network NetworkLayer
transport TransportLayer
application ApplicationLayer
failure ErrorLayer
}
func (p *packet) SetTruncated() {
p.metadata.Truncated = true
}
func (p *packet) SetLinkLayer(l LinkLayer) {
if p.link == nil {
p.link = l
}
}
func (p *packet) SetNetworkLayer(l NetworkLayer) {
if p.network == nil {
p.network = l
}
}
func (p *packet) SetTransportLayer(l TransportLayer) {
if p.transport == nil {
p.transport = l
}
}
func (p *packet) SetApplicationLayer(l ApplicationLayer) {
if p.application == nil {
p.application = l
}
}
func (p *packet) SetErrorLayer(l ErrorLayer) {
if p.failure == nil {
p.failure = l
}
}
func (p *packet) AddLayer(l Layer) {
p.layers = append(p.layers, l)
p.last = l
}
func (p *packet) DumpPacketData() {
fmt.Fprint(os.Stderr, p.packetDump())
os.Stderr.Sync()
}
func (p *packet) Metadata() *PacketMetadata {
return &p.metadata
}
func (p *packet) Data() []byte {
return p.data
}
func (p *packet) DecodeOptions() *DecodeOptions {
return &p.decodeOptions
}
func (p *packet) addFinalDecodeError(err error, stack []byte) {
fail := &DecodeFailure{err: err, stack: stack}
if p.last == nil {
fail.data = p.data
} else {
fail.data = p.last.LayerPayload()
}
p.AddLayer(fail)
p.SetErrorLayer(fail)
}
func (p *packet) recoverDecodeError() {
if !p.decodeOptions.SkipDecodeRecovery {
if r := recover(); r != nil {
p.addFinalDecodeError(fmt.Errorf("%v", r), debug.Stack())
}
}
}
// LayerString outputs an individual layer as a string. The layer is output
// in a single line, with no trailing newline. This function is specifically
// designed to do the right thing for most layers... it follows the following
// rules:
// * If the Layer has a String function, just output that.
// * Otherwise, output all exported fields in the layer, recursing into
// exported slices and structs.
// NOTE: This is NOT THE SAME AS fmt's "%#v". %#v will output both exported
// and unexported fields... many times packet layers contain unexported stuff
// that would just mess up the output of the layer, see for example the
// Payload layer and it's internal 'data' field, which contains a large byte
// array that would really mess up formatting.
func LayerString(l Layer) string {
return fmt.Sprintf("%v\t%s", l.LayerType(), layerString(reflect.ValueOf(l), false, false))
}
// Dumper dumps verbose information on a value. If a layer type implements
// Dumper, then its LayerDump() string will include the results in its output.
type Dumper interface {
Dump() string
}
// LayerDump outputs a very verbose string representation of a layer. Its
// output is a concatenation of LayerString(l) and hex.Dump(l.LayerContents()).
// It contains newlines and ends with a newline.
func LayerDump(l Layer) string {
var b bytes.Buffer
b.WriteString(LayerString(l))
b.WriteByte('\n')
if d, ok := l.(Dumper); ok {
dump := d.Dump()
if dump != "" {
b.WriteString(dump)
if dump[len(dump)-1] != '\n' {
b.WriteByte('\n')
}
}
}
b.WriteString(hex.Dump(l.LayerContents()))
return b.String()
}
// layerString outputs, recursively, a layer in a "smart" way. See docs for
// LayerString for more details.
//
// Params:
// i - value to write out
// anonymous: if we're currently recursing an anonymous member of a struct
// writeSpace: if we've already written a value in a struct, and need to
// write a space before writing more. This happens when we write various
// anonymous values, and need to keep writing more.
func layerString(v reflect.Value, anonymous bool, writeSpace bool) string {
// Let String() functions take precedence.
if v.CanInterface() {
if s, ok := v.Interface().(fmt.Stringer); ok {
return s.String()
}
}
// Reflect, and spit out all the exported fields as key=value.
switch v.Type().Kind() {
case reflect.Interface, reflect.Ptr:
if v.IsNil() {
return "nil"
}
r := v.Elem()
return layerString(r, anonymous, writeSpace)
case reflect.Struct:
var b bytes.Buffer
typ := v.Type()
if !anonymous {
b.WriteByte('{')
}
for i := 0; i < v.NumField(); i++ {
// Check if this is upper-case.
ftype := typ.Field(i)
f := v.Field(i)
if ftype.Anonymous {
anonStr := layerString(f, true, writeSpace)
writeSpace = writeSpace || anonStr != ""
b.WriteString(anonStr)
} else if ftype.PkgPath == "" { // exported
if writeSpace {
b.WriteByte(' ')
}
writeSpace = true
fmt.Fprintf(&b, "%s=%s", typ.Field(i).Name, layerString(f, false, writeSpace))
}
}
if !anonymous {
b.WriteByte('}')
}
return b.String()
case reflect.Slice:
var b bytes.Buffer
b.WriteByte('[')
if v.Len() > 4 {
fmt.Fprintf(&b, "..%d..", v.Len())
} else {
for j := 0; j < v.Len(); j++ {
if j != 0 {
b.WriteString(", ")
}
b.WriteString(layerString(v.Index(j), false, false))
}
}
b.WriteByte(']')
return b.String()
}
return fmt.Sprintf("%v", v.Interface())
}
const (
longBytesLength = 128
)
// LongBytesGoString returns a string representation of the byte slice shortened
// using the format '<type>{<truncated slice> ... (<n> bytes)}' if it
// exceeds a predetermined length. Can be used to avoid filling the display with
// very long byte strings.
func LongBytesGoString(buf []byte) string {
if len(buf) < longBytesLength {
return fmt.Sprintf("%#v", buf)
}
s := fmt.Sprintf("%#v", buf[:longBytesLength-1])
s = strings.TrimSuffix(s, "}")
return fmt.Sprintf("%s ... (%d bytes)}", s, len(buf))
}
func baseLayerString(value reflect.Value) string {
t := value.Type()
content := value.Field(0)
c := make([]byte, content.Len())
for i := range c {
c[i] = byte(content.Index(i).Uint())
}
payload := value.Field(1)
p := make([]byte, payload.Len())
for i := range p {
p[i] = byte(payload.Index(i).Uint())
}
return fmt.Sprintf("%s{Contents:%s, Payload:%s}", t.String(),
LongBytesGoString(c),
LongBytesGoString(p))
}
func layerGoString(i interface{}, b *bytes.Buffer) {
if s, ok := i.(fmt.GoStringer); ok {
b.WriteString(s.GoString())
return
}
var v reflect.Value
var ok bool
if v, ok = i.(reflect.Value); !ok {
v = reflect.ValueOf(i)
}
switch v.Kind() {
case reflect.Ptr, reflect.Interface:
if v.Kind() == reflect.Ptr {
b.WriteByte('&')
}
layerGoString(v.Elem().Interface(), b)
case reflect.Struct:
t := v.Type()
b.WriteString(t.String())
b.WriteByte('{')
for i := 0; i < v.NumField(); i++ {
if i > 0 {
b.WriteString(", ")
}
if t.Field(i).Name == "BaseLayer" {
fmt.Fprintf(b, "BaseLayer:%s", baseLayerString(v.Field(i)))
} else if v.Field(i).Kind() == reflect.Struct {
fmt.Fprintf(b, "%s:", t.Field(i).Name)
layerGoString(v.Field(i), b)
} else if v.Field(i).Kind() == reflect.Ptr {
b.WriteByte('&')
layerGoString(v.Field(i), b)
} else {
fmt.Fprintf(b, "%s:%#v", t.Field(i).Name, v.Field(i))
}
}
b.WriteByte('}')
default:
fmt.Fprintf(b, "%#v", i)
}
}
// LayerGoString returns a representation of the layer in Go syntax,
// taking care to shorten "very long" BaseLayer byte slices
func LayerGoString(l Layer) string {
b := new(bytes.Buffer)
layerGoString(l, b)
return b.String()
}
func (p *packet) packetString() string {
var b bytes.Buffer
fmt.Fprintf(&b, "PACKET: %d bytes", len(p.Data()))
if p.metadata.Truncated {
b.WriteString(", truncated")
}
if p.metadata.Length > 0 {
fmt.Fprintf(&b, ", wire length %d cap length %d", p.metadata.Length, p.metadata.CaptureLength)
}
if !p.metadata.Timestamp.IsZero() {
fmt.Fprintf(&b, " @ %v", p.metadata.Timestamp)
}
b.WriteByte('\n')
for i, l := range p.layers {
fmt.Fprintf(&b, "- Layer %d (%02d bytes) = %s\n", i+1, len(l.LayerContents()), LayerString(l))
}
return b.String()
}
func (p *packet) packetDump() string {
var b bytes.Buffer
fmt.Fprintf(&b, "-- FULL PACKET DATA (%d bytes) ------------------------------------\n%s", len(p.data), hex.Dump(p.data))
for i, l := range p.layers {
fmt.Fprintf(&b, "--- Layer %d ---\n%s", i+1, LayerDump(l))
}
return b.String()
}
// eagerPacket is a packet implementation that does eager decoding. Upon
// initial construction, it decodes all the layers it can from packet data.
// eagerPacket implements Packet and PacketBuilder.
type eagerPacket struct {
packet
}
var errNilDecoder = errors.New("NextDecoder passed nil decoder, probably an unsupported decode type")
func (p *eagerPacket) NextDecoder(next Decoder) error {
if next == nil {
return errNilDecoder
}
if p.last == nil {
return errors.New("NextDecoder called, but no layers added yet")
}
d := p.last.LayerPayload()
if len(d) == 0 {
return nil
}
// Since we're eager, immediately call the next decoder.
return next.Decode(d, p)
}
func (p *eagerPacket) initialDecode(dec Decoder) {
defer p.recoverDecodeError()
err := dec.Decode(p.data, p)
if err != nil {
p.addFinalDecodeError(err, nil)
}
}
func (p *eagerPacket) LinkLayer() LinkLayer {
return p.link
}
func (p *eagerPacket) NetworkLayer() NetworkLayer {
return p.network
}
func (p *eagerPacket) TransportLayer() TransportLayer {
return p.transport
}
func (p *eagerPacket) ApplicationLayer() ApplicationLayer {
return p.application
}
func (p *eagerPacket) ErrorLayer() ErrorLayer {
return p.failure
}
func (p *eagerPacket) Layers() []Layer {
return p.layers
}
func (p *eagerPacket) Layer(t LayerType) Layer {
for _, l := range p.layers {
if l.LayerType() == t {
return l
}
}
return nil
}
func (p *eagerPacket) LayerClass(lc LayerClass) Layer {
for _, l := range p.layers {
if lc.Contains(l.LayerType()) {
return l
}
}
return nil
}
func (p *eagerPacket) String() string { return p.packetString() }
func (p *eagerPacket) Dump() string { return p.packetDump() }
// lazyPacket does lazy decoding on its packet data. On construction it does
// no initial decoding. For each function call, it decodes only as many layers
// as are necessary to compute the return value for that function.
// lazyPacket implements Packet and PacketBuilder.
type lazyPacket struct {
packet
next Decoder
}
func (p *lazyPacket) NextDecoder(next Decoder) error {
if next == nil {
return errNilDecoder
}
p.next = next
return nil
}
func (p *lazyPacket) decodeNextLayer() {
if p.next == nil {
return
}
d := p.data
if p.last != nil {
d = p.last.LayerPayload()
}
next := p.next
p.next = nil
// We've just set p.next to nil, so if we see we have no data, this should be
// the final call we get to decodeNextLayer if we return here.
if len(d) == 0 {
return
}
defer p.recoverDecodeError()
err := next.Decode(d, p)
if err != nil {
p.addFinalDecodeError(err, nil)
}
}
func (p *lazyPacket) LinkLayer() LinkLayer {
for p.link == nil && p.next != nil {
p.decodeNextLayer()
}
return p.link
}
func (p *lazyPacket) NetworkLayer() NetworkLayer {
for p.network == nil && p.next != nil {
p.decodeNextLayer()
}
return p.network
}
func (p *lazyPacket) TransportLayer() TransportLayer {
for p.transport == nil && p.next != nil {
p.decodeNextLayer()
}
return p.transport
}
func (p *lazyPacket) ApplicationLayer() ApplicationLayer {
for p.application == nil && p.next != nil {
p.decodeNextLayer()
}
return p.application
}
func (p *lazyPacket) ErrorLayer() ErrorLayer {
for p.failure == nil && p.next != nil {
p.decodeNextLayer()
}
return p.failure
}
func (p *lazyPacket) Layers() []Layer {
for p.next != nil {
p.decodeNextLayer()
}
return p.layers
}
func (p *lazyPacket) Layer(t LayerType) Layer {
for _, l := range p.layers {
if l.LayerType() == t {
return l
}
}
numLayers := len(p.layers)
for p.next != nil {
p.decodeNextLayer()
for _, l := range p.layers[numLayers:] {
if l.LayerType() == t {
return l
}
}
numLayers = len(p.layers)
}
return nil
}
func (p *lazyPacket) LayerClass(lc LayerClass) Layer {
for _, l := range p.layers {
if lc.Contains(l.LayerType()) {
return l
}
}
numLayers := len(p.layers)
for p.next != nil {
p.decodeNextLayer()
for _, l := range p.layers[numLayers:] {
if lc.Contains(l.LayerType()) {
return l
}
}
numLayers = len(p.layers)
}
return nil
}
func (p *lazyPacket) String() string { p.Layers(); return p.packetString() }
func (p *lazyPacket) Dump() string { p.Layers(); return p.packetDump() }
// DecodeOptions tells gopacket how to decode a packet.
type DecodeOptions struct {
// Lazy decoding decodes the minimum number of layers needed to return data
// for a packet at each function call. Be careful using this with concurrent
// packet processors, as each call to packet.* could mutate the packet, and
// two concurrent function calls could interact poorly.
Lazy bool
// NoCopy decoding doesn't copy its input buffer into storage that's owned by
// the packet. If you can guarantee that the bytes underlying the slice
// passed into NewPacket aren't going to be modified, this can be faster. If
// there's any chance that those bytes WILL be changed, this will invalidate
// your packets.
NoCopy bool
// SkipDecodeRecovery skips over panic recovery during packet decoding.
// Normally, when packets decode, if a panic occurs, that panic is captured
// by a recover(), and a DecodeFailure layer is added to the packet detailing
// the issue. If this flag is set, panics are instead allowed to continue up
// the stack.
SkipDecodeRecovery bool
// DecodeStreamsAsDatagrams enables routing of application-level layers in the TCP
// decoder. If true, we should try to decode layers after TCP in single packets.
// This is disabled by default because the reassembly package drives the decoding
// of TCP payload data after reassembly.
DecodeStreamsAsDatagrams bool
}
// Default decoding provides the safest (but slowest) method for decoding
// packets. It eagerly processes all layers (so it's concurrency-safe) and it
// copies its input buffer upon creation of the packet (so the packet remains
// valid if the underlying slice is modified. Both of these take time,
// though, so beware. If you can guarantee that the packet will only be used
// by one goroutine at a time, set Lazy decoding. If you can guarantee that
// the underlying slice won't change, set NoCopy decoding.
var Default = DecodeOptions{}
// Lazy is a DecodeOptions with just Lazy set.
var Lazy = DecodeOptions{Lazy: true}
// NoCopy is a DecodeOptions with just NoCopy set.
var NoCopy = DecodeOptions{NoCopy: true}
// DecodeStreamsAsDatagrams is a DecodeOptions with just DecodeStreamsAsDatagrams set.
var DecodeStreamsAsDatagrams = DecodeOptions{DecodeStreamsAsDatagrams: true}
// NewPacket creates a new Packet object from a set of bytes. The
// firstLayerDecoder tells it how to interpret the first layer from the bytes,
// future layers will be generated from that first layer automatically.
func NewPacket(data []byte, firstLayerDecoder Decoder, options DecodeOptions) Packet {
if !options.NoCopy {
dataCopy := make([]byte, len(data))
copy(dataCopy, data)
data = dataCopy
}
if options.Lazy {
p := &lazyPacket{
packet: packet{data: data, decodeOptions: options},
next: firstLayerDecoder,
}
p.layers = p.initialLayers[:0]
// Crazy craziness:
// If the following return statemet is REMOVED, and Lazy is FALSE, then
// eager packet processing becomes 17% FASTER. No, there is no logical
// explanation for this. However, it's such a hacky micro-optimization that
// we really can't rely on it. It appears to have to do with the size the
// compiler guesses for this function's stack space, since one symptom is
// that with the return statement in place, we more than double calls to
// runtime.morestack/runtime.lessstack. We'll hope the compiler gets better
// over time and we get this optimization for free. Until then, we'll have
// to live with slower packet processing.
return p
}
p := &eagerPacket{
packet: packet{data: data, decodeOptions: options},
}
p.layers = p.initialLayers[:0]
p.initialDecode(firstLayerDecoder)
return p
}
// PacketDataSource is an interface for some source of packet data. Users may
// create their own implementations, or use the existing implementations in
// gopacket/pcap (libpcap, allows reading from live interfaces or from
// pcap files) or gopacket/pfring (PF_RING, allows reading from live
// interfaces).
type PacketDataSource interface {
// ReadPacketData returns the next packet available from this data source.
// It returns:
// data: The bytes of an individual packet.
// ci: Metadata about the capture
// err: An error encountered while reading packet data. If err != nil,
// then data/ci will be ignored.
ReadPacketData() (data []byte, ci CaptureInfo, err error)
}
// ConcatFinitePacketDataSources returns a PacketDataSource that wraps a set
// of internal PacketDataSources, each of which will stop with io.EOF after
// reading a finite number of packets. The returned PacketDataSource will
// return all packets from the first finite source, followed by all packets from
// the second, etc. Once all finite sources have returned io.EOF, the returned
// source will as well.
func ConcatFinitePacketDataSources(pds ...PacketDataSource) PacketDataSource {
c := concat(pds)
return &c
}
type concat []PacketDataSource
func (c *concat) ReadPacketData() (data []byte, ci CaptureInfo, err error) {
for len(*c) > 0 {
data, ci, err = (*c)[0].ReadPacketData()
if err == io.EOF {
*c = (*c)[1:]
continue
}
return
}
return nil, CaptureInfo{}, io.EOF
}
// ZeroCopyPacketDataSource is an interface to pull packet data from sources
// that allow data to be returned without copying to a user-controlled buffer.
// It's very similar to PacketDataSource, except that the caller must be more
// careful in how the returned buffer is handled.
type ZeroCopyPacketDataSource interface {
// ZeroCopyReadPacketData returns the next packet available from this data source.
// It returns:
// data: The bytes of an individual packet. Unlike with
// PacketDataSource's ReadPacketData, the slice returned here points
// to a buffer owned by the data source. In particular, the bytes in
// this buffer may be changed by future calls to
// ZeroCopyReadPacketData. Do not use the returned buffer after
// subsequent ZeroCopyReadPacketData calls.
// ci: Metadata about the capture
// err: An error encountered while reading packet data. If err != nil,
// then data/ci will be ignored.
ZeroCopyReadPacketData() (data []byte, ci CaptureInfo, err error)
}
// PacketSource reads in packets from a PacketDataSource, decodes them, and
// returns them.
//
// There are currently two different methods for reading packets in through
// a PacketSource:
//
// Reading With Packets Function
//
// This method is the most convenient and easiest to code, but lacks
// flexibility. Packets returns a 'chan Packet', then asynchronously writes
// packets into that channel. Packets uses a blocking channel, and closes
// it if an io.EOF is returned by the underlying PacketDataSource. All other
// PacketDataSource errors are ignored and discarded.
// for packet := range packetSource.Packets() {
// ...
// }
//
// Reading With NextPacket Function
//
// This method is the most flexible, and exposes errors that may be
// encountered by the underlying PacketDataSource. It's also the fastest
// in a tight loop, since it doesn't have the overhead of a channel
// read/write. However, it requires the user to handle errors, most
// importantly the io.EOF error in cases where packets are being read from
// a file.
// for {
// packet, err := packetSource.NextPacket()
// if err == io.EOF {
// break
// } else if err != nil {
// log.Println("Error:", err)
// continue
// }
// handlePacket(packet) // Do something with each packet.
// }
type PacketSource struct {
source PacketDataSource
decoder Decoder
// DecodeOptions is the set of options to use for decoding each piece
// of packet data. This can/should be changed by the user to reflect the
// way packets should be decoded.
DecodeOptions
c chan Packet
}
// NewPacketSource creates a packet data source.
func NewPacketSource(source PacketDataSource, decoder Decoder) *PacketSource {
return &PacketSource{
source: source,
decoder: decoder,
}
}
// NextPacket returns the next decoded packet from the PacketSource. On error,
// it returns a nil packet and a non-nil error.
func (p *PacketSource) NextPacket() (Packet, error) {
data, ci, err := p.source.ReadPacketData()
if err != nil {
return nil, err
}
packet := NewPacket(data, p.decoder, p.DecodeOptions)
m := packet.Metadata()
m.CaptureInfo = ci
m.Truncated = m.Truncated || ci.CaptureLength < ci.Length
return packet, nil
}
// packetsToChannel reads in all packets from the packet source and sends them
// to the given channel. This routine terminates when a non-temporary error
// is returned by NextPacket().
func (p *PacketSource) packetsToChannel() {
defer close(p.c)
for {
packet, err := p.NextPacket()
if err == nil {
p.c <- packet
continue
}
// Immediately retry for temporary network errors
if nerr, ok := err.(net.Error); ok && nerr.Temporary() {
continue
}
// Immediately retry for EAGAIN
if err == syscall.EAGAIN {
continue
}
// Immediately break for known unrecoverable errors
if err == io.EOF || err == io.ErrUnexpectedEOF ||
err == io.ErrNoProgress || err == io.ErrClosedPipe || err == io.ErrShortBuffer ||
err == syscall.EBADF ||
strings.Contains(err.Error(), "use of closed file") {
break
}
// Sleep briefly and try again
time.Sleep(time.Millisecond * time.Duration(5))
}
}
// Packets returns a channel of packets, allowing easy iterating over
// packets. Packets will be asynchronously read in from the underlying
// PacketDataSource and written to the returned channel. If the underlying
// PacketDataSource returns an io.EOF error, the channel will be closed.
// If any other error is encountered, it is ignored.
//
// for packet := range packetSource.Packets() {
// handlePacket(packet) // Do something with each packet.
// }
//
// If called more than once, returns the same channel.
func (p *PacketSource) Packets() chan Packet {
if p.c == nil {
p.c = make(chan Packet, 1000)
go p.packetsToChannel()
}
return p.c
}
You can’t perform that action at this time.