luna - wolfssl/sslSniffer/sslSnifferTest/snifftest.c

   1/* snifftest.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22
  23#ifdef HAVE_CONFIG_H
  24    #include <config.h>
  25#endif
  26
  27#ifndef WOLFSSL_USER_SETTINGS
  28    #include <wolfssl/options.h>
  29#endif
  30#include <wolfssl/wolfcrypt/settings.h>
  31#include <wolfssl/wolfcrypt/types.h>
  32#include <wolfssl/wolfcrypt/logging.h>
  33#include <wolfssl/wolfcrypt/error-crypt.h>
  34#include <wolfssl/version.h>
  35
  36#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
  37    #include <wolfssl/wolfcrypt/memory.h>
  38#endif
  39
  40#ifdef THREADED_SNIFFTEST
  41    #include <pthread.h>
  42#endif
  43
  44
  45/* Build Options:
  46 * THREADED_SNIFFTEST: Enable threaded version of the sniffer test
  47 */
  48
  49
  50/* For windows tests force sniffer build option on */
  51#ifdef _WIN32
  52    #define WOLFSSL_SNIFFER
  53#endif
  54
  55
  56#ifndef WOLFSSL_SNIFFER
  57#ifndef NO_MAIN_DRIVER
  58/* blank build */
  59#include <stdio.h>
  60#include <stdlib.h>
  61int main(void)
  62{
  63    printf("do ./configure --enable-sniffer to enable build support\n");
  64    return EXIT_SUCCESS;
  65}
  66#endif /* !NO_MAIN_DRIVER */
  67#else
  68/* do a full build */
  69
  70#ifdef _MSC_VER
  71    /* builds on *nix too, for scanf device and port */
  72    #define _CRT_SECURE_NO_WARNINGS
  73#endif
  74
  75#include <pcap/pcap.h>     /* pcap stuff */
  76#include <stdio.h>         /* printf */
  77#include <stdlib.h>        /* EXIT_SUCCESS */
  78#include <string.h>        /* strcmp */
  79#include <signal.h>        /* signal */
  80#include <ctype.h>         /* isprint */
  81
  82#include <wolfssl/sniffer.h>
  83
  84
  85#ifndef _WIN32
  86    #include <sys/socket.h>    /* AF_INET */
  87    #include <arpa/inet.h>
  88    #include <netinet/in.h>
  89#endif
  90
  91typedef unsigned char byte;
  92
  93enum {
  94    ETHER_IF_FRAME_LEN = 14,   /* ethernet interface frame length */
  95    NULL_IF_FRAME_LEN =   4,   /* no link interface frame length  */
  96};
  97
  98
  99/* A TLS record can be 16k and change. The chain is broken up into 2K chunks.
 100 * This covers the TLS record, plus a chunk for TCP/IP headers. */
 101#ifndef CHAIN_INPUT_CHUNK_SIZE
 102    #define CHAIN_INPUT_CHUNK_SIZE 2048
 103#elif (CHAIN_INPUT_CHUNK_SIZE < 256)
 104    #undef CHAIN_INPUT_CHUNK_SIZE
 105    #define CHAIN_INPUT_CHUNK_SIZE 256
 106#elif (CHAIN_INPUT_CHUNK_SIZE > 16384)
 107    #undef CHAIN_INPUT_CHUNK_SIZE
 108    #define CHAIN_INPUT_CHUNK_SIZE 16384
 109#endif
 110#define CHAIN_INPUT_COUNT ((16384 / CHAIN_INPUT_CHUNK_SIZE) + 1)
 111
 112
 113#ifndef STORE_DATA_BLOCK_SZ
 114    #define STORE_DATA_BLOCK_SZ 1024
 115#endif
 116
 117#if defined(HAVE_ECC) && !defined(NO_ECC_SECP) && (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES))
 118    #define DEFAULT_SERVER_EPH_KEY_ECC "../../certs/statickeys/ecc-secp256r1.pem"
 119#else
 120    #define DEFAULT_SERVER_EPH_KEY_ECC ""
 121#endif
 122#ifndef NO_DH
 123    #define DEFAULT_SERVER_EPH_KEY_DH "../../certs/statickeys/dh-ffdhe2048.pem"
 124#else
 125    #define DEFAULT_SERVER_EPH_KEY_DH ""
 126#endif
 127#ifdef HAVE_CURVE25519
 128    #define DEFAULT_SERVER_EPH_KEY_X25519 "../../certs/statickeys/x25519.pem"
 129#else
 130    #define DEFAULT_SERVER_EPH_KEY_X25519 ""
 131#endif
 132
 133#ifndef DEFAULT_SERVER_EPH_KEY
 134    #define DEFAULT_SERVER_EPH_KEY \
 135                DEFAULT_SERVER_EPH_KEY_ECC "," \
 136                DEFAULT_SERVER_EPH_KEY_DH "," \
 137                DEFAULT_SERVER_EPH_KEY_X25519
 138#endif
 139
 140#define DEFAULT_SERVER_KEY_RSA "../../certs/server-key.pem"
 141#define DEFAULT_SERVER_KEY_ECC "../../certs/ecc-key.pem"
 142#ifndef DEFAULT_SERVER_KEY
 143    #ifndef NO_RSA
 144        #define DEFAULT_SERVER_KEY DEFAULT_SERVER_KEY_RSA
 145    #elif defined(HAVE_ECC)
 146        #define DEFAULT_SERVER_KEY DEFAULT_SERVER_KEY_ECC
 147    #endif
 148#endif
 149
 150#define DEFAULT_SERVER_IP   "127.0.0.1"
 151#define DEFAULT_SERVER_PORT (11111)
 152
 153#ifdef WOLFSSL_SNIFFER_WATCH
 154static const byte rsaHash[] = {
 155    0x3d, 0x4a, 0x60, 0xfc, 0xbf, 0xe5, 0x4d, 0x3e,
 156    0x85, 0x62, 0xf2, 0xfc, 0xdb, 0x0d, 0x51, 0xdd,
 157    0xcd, 0xc2, 0x53, 0x81, 0x1a, 0x67, 0x31, 0xa0,
 158    0x7f, 0xd2, 0x11, 0x74, 0xbf, 0xea, 0xc9, 0xc5
 159};
 160static const byte eccHash[] = {
 161    0x9e, 0x45, 0xb6, 0xf8, 0xc6, 0x5d, 0x60, 0x90,
 162    0x40, 0x8f, 0xd2, 0x0e, 0xb1, 0x59, 0xe7, 0xbd,
 163    0xb0, 0x9b, 0x3c, 0x7a, 0x3a, 0xbe, 0x13, 0x52,
 164    0x07, 0x4f, 0x1a, 0x64, 0x45, 0xe0, 0x13, 0x34
 165};
 166#endif
 167
 168
 169static pcap_t* pcap = NULL;
 170static pcap_if_t* alldevs = NULL;
 171static struct bpf_program pcap_fp;
 172static const char *traceFile = "./tracefile.txt";
 173
 174static void FreeAll(void)
 175{
 176    if (pcap) {
 177        pcap_freecode(&pcap_fp);
 178        pcap_close(pcap);
 179    }
 180    if (alldevs)
 181        pcap_freealldevs(alldevs);
 182#ifndef _WIN32
 183    ssl_FreeSniffer();
 184#endif
 185}
 186
 187
 188#ifdef WOLFSSL_SNIFFER_STATS
 189static void DumpStats(void)
 190{
 191    SSLStats sslStats;
 192    ssl_ReadStatistics(&sslStats);
 193
 194    printf("SSL Stats (sslStandardConns):%lu\n",
 195            sslStats.sslStandardConns);
 196    printf("SSL Stats (sslClientAuthConns):%lu\n",
 197            sslStats.sslClientAuthConns);
 198    printf("SSL Stats (sslResumedConns):%lu\n",
 199            sslStats.sslResumedConns);
 200    printf("SSL Stats (sslEphemeralMisses):%lu\n",
 201            sslStats.sslEphemeralMisses);
 202    printf("SSL Stats (sslResumptionInserts):%lu\n",
 203            sslStats.sslResumptionInserts);
 204    printf("SSL Stats (sslResumeMisses):%lu\n",
 205            sslStats.sslResumeMisses);
 206    printf("SSL Stats (sslCiphersUnsupported):%lu\n",
 207            sslStats.sslCiphersUnsupported);
 208    printf("SSL Stats (sslKeysUnmatched):%lu\n",
 209            sslStats.sslKeysUnmatched);
 210    printf("SSL Stats (sslKeyFails):%lu\n",
 211            sslStats.sslKeyFails);
 212    printf("SSL Stats (sslDecodeFails):%lu\n",
 213            sslStats.sslDecodeFails);
 214    printf("SSL Stats (sslAlerts):%lu\n",
 215            sslStats.sslAlerts);
 216    printf("SSL Stats (sslDecryptedBytes):%lu\n",
 217            sslStats.sslDecryptedBytes);
 218    printf("SSL Stats (sslEncryptedBytes):%lu\n",
 219            sslStats.sslEncryptedBytes);
 220    printf("SSL Stats (sslEncryptedPackets):%lu\n",
 221            sslStats.sslEncryptedPackets);
 222    printf("SSL Stats (sslDecryptedPackets):%lu\n",
 223            sslStats.sslDecryptedPackets);
 224    printf("SSL Stats (sslKeyMatches):%lu\n",
 225            sslStats.sslKeyMatches);
 226    printf("SSL Stats (sslEncryptedConns):%lu\n",
 227            sslStats.sslEncryptedConns);
 228}
 229#endif /* WOLFSSL_SNIFFER_STATS */
 230
 231
 232static void sig_handler(const int sig)
 233{
 234    printf("SIGINT handled = %d.\n", sig);
 235    FreeAll();
 236#ifdef WOLFSSL_SNIFFER_STATS
 237    DumpStats();
 238#endif
 239    if (sig)
 240        exit(EXIT_SUCCESS);
 241}
 242
 243
 244static void err_sys(const char* msg)
 245{
 246    fprintf(stderr, "%s\n", msg);
 247    if (msg)
 248        exit(EXIT_FAILURE);
 249}
 250
 251
 252#ifdef _WIN32
 253    #define SNPRINTF _snprintf
 254#else
 255    #define SNPRINTF snprintf
 256#endif
 257
 258
 259static char* iptos(const struct in_addr* addr)
 260{
 261    static char output[32];
 262    byte *p = (byte*)&addr->s_addr;
 263
 264    snprintf(output, sizeof(output), "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
 265
 266    return output;
 267}
 268
 269static const char* ip6tos(const struct in6_addr* addr)
 270{
 271    static char output[42];
 272    return inet_ntop(AF_INET6, addr, output, 42);
 273}
 274
 275
 276#if defined(WOLFSSL_SNIFFER_STORE_DATA_CB) || defined(WOLFSSL_SNIFFER_CHAIN_INPUT)
 277static inline unsigned int min(unsigned int a, unsigned int b)
 278{
 279    return a > b ? b : a;
 280}
 281#endif
 282
 283
 284#ifdef WOLFSSL_SNIFFER_WATCH
 285static int myWatchCb(void* vSniffer,
 286        const unsigned char* certHash, unsigned int certHashSz,
 287        const unsigned char* certChain, unsigned int certChainSz,
 288        void* ctx, char* error)
 289{
 290    const char* certName = NULL;
 291
 292    (void)certChain;
 293    (void)certChainSz;
 294    (void)ctx;
 295
 296    if (certHashSz == sizeof(rsaHash) &&
 297            XMEMCMP(certHash, rsaHash, certHashSz) == 0) {
 298        certName = DEFAULT_SERVER_KEY_RSA;
 299    }
 300    if (certHashSz == sizeof(eccHash) &&
 301            XMEMCMP(certHash, eccHash, certHashSz) == 0) {
 302        certName = DEFAULT_SERVER_KEY_ECC;
 303    }
 304
 305    if (certName == NULL) {
 306        /* don't return error if key is not loaded */
 307        printf("Warning: No matching key found for cert hash\n");
 308        return 0;
 309    }
 310
 311    return ssl_SetWatchKey_file(vSniffer, certName, FILETYPE_PEM, NULL, error);
 312}
 313#endif /* WOLFSSL_SNIFFER_WATCH */
 314
 315
 316#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
 317static int myStoreDataCb(const unsigned char* decryptBuf,
 318        unsigned int decryptBufSz, unsigned int decryptBufOffset, void* ctx)
 319{
 320    byte** data = (byte**)ctx;
 321    unsigned int qty;
 322
 323    if (data == NULL)
 324        return -1;
 325
 326    if (decryptBufSz < decryptBufOffset)
 327        return -1;
 328
 329    qty = min(decryptBufSz - decryptBufOffset, STORE_DATA_BLOCK_SZ);
 330
 331    if (*data == NULL) {
 332        byte* tmpData;
 333        tmpData = (byte*)XREALLOC(*data, decryptBufSz + 1,
 334                NULL, DYNAMIC_TYPE_TMP_BUFFER);
 335        if (tmpData == NULL) {
 336            XFREE(*data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 337            *data = NULL;
 338            return -1;
 339        }
 340        *data = tmpData;
 341    }
 342
 343    XMEMCPY(*data + decryptBufOffset, decryptBuf + decryptBufOffset, qty);
 344
 345    return qty;
 346}
 347#endif /* WOLFSSL_SNIFFER_STORE_DATA_CB */
 348
 349/* try and load as both static ephemeral and private key */
 350/* only fail if no key is loaded */
 351/* Allow comma separated list of files */
 352static int load_key(const char* name, const char* server, int port,
 353    const char* keyFiles, const char* passwd, char* err)
 354{
 355    int ret = -1;
 356    int loadCount = 0;
 357    char *keyFile, *ptr = NULL;
 358
 359    keyFile = XSTRTOK((char*)keyFiles, ",", &ptr);
 360    while (keyFile != NULL) {
 361#ifdef WOLFSSL_STATIC_EPHEMERAL
 362    #ifdef HAVE_SNI
 363        ret = ssl_SetNamedEphemeralKey(name, server, port, keyFile,
 364                            FILETYPE_PEM, passwd, err);
 365    #else
 366        ret = ssl_SetEphemeralKey(server, port, keyFile,
 367                            FILETYPE_PEM, passwd, err);
 368    #endif
 369        if (ret == 0)
 370            loadCount++;
 371#endif
 372    #ifdef HAVE_SNI
 373        ret = ssl_SetNamedPrivateKey(name, server, port, keyFile,
 374                            FILETYPE_PEM, passwd, err);
 375    #else
 376        ret = ssl_SetPrivateKey(server, port, keyFile,
 377                            FILETYPE_PEM, passwd, err);
 378    #endif
 379        if (ret == 0)
 380            loadCount++;
 381
 382        if (loadCount == 0) {
 383            printf("Failed loading private key %s: ret %d\n", keyFile, ret);
 384            ret = -1;
 385        }
 386        else {
 387            ret = 0;
 388        }
 389
 390        keyFile = XSTRTOK(NULL, ",", &ptr);
 391    }
 392
 393    (void)name;
 394    return ret;
 395}
 396
 397static void TrimNewLine(char* str)
 398{
 399    word32 strSz = 0;
 400    if (str)
 401        strSz = (word32)XSTRLEN(str);
 402    if (strSz > 0 && (str[strSz-1] == '\n' || str[strSz-1] == '\r'))
 403        str[strSz-1] = '\0';
 404}
 405
 406static void show_appinfo(void)
 407{
 408    printf("snifftest %s\n", LIBWOLFSSL_VERSION_STRING);
 409
 410    /* list enabled sniffer features */
 411    printf("sniffer features: "
 412    #ifdef WOLFSSL_SNIFFER_STATS
 413        "stats, "
 414    #endif
 415    #ifdef WOLFSSL_SNIFFER_WATCH
 416        "watch, "
 417    #endif
 418    #ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
 419        "store_data_cb "
 420    #endif
 421    #ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
 422        "chain_input "
 423    #endif
 424    #ifdef WOLFSSL_SNIFFER_KEY_CALLBACK
 425        "key_callback "
 426    #endif
 427    #ifdef DEBUG_SNIFFER
 428        "debug "
 429    #endif
 430    #ifdef WOLFSSL_TLS13
 431        "tls_v13 "
 432    #endif
 433    #ifndef WOLFSSL_NO_TLS12
 434        "tls_v12 "
 435    #endif
 436    #ifdef HAVE_SESSION_TICKET
 437        "session_ticket "
 438    #endif
 439    #ifdef WOLFSSL_STATIC_EPHEMERAL
 440        "static_ephemeral "
 441    #endif
 442    #ifdef WOLFSSL_ENCRYPTED_KEYS
 443        "encrypted_keys "
 444    #endif
 445    #ifdef HAVE_SNI
 446        "sni "
 447    #endif
 448    #ifdef HAVE_EXTENDED_MASTER
 449        "extended_master "
 450    #endif
 451    #ifdef HAVE_MAX_FRAGMENT
 452        "max fragment "
 453    #endif
 454    #ifdef WOLFSSL_ASYNC_CRYPT
 455        "async_crypt "
 456    #endif
 457    #ifndef NO_RSA
 458        "rsa "
 459    #endif
 460    #if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
 461        "dh "
 462    #endif
 463    #ifdef HAVE_ECC
 464        "ecc "
 465    #endif
 466    #ifdef HAVE_CURVE448
 467        "x448 "
 468    #endif
 469    #ifdef HAVE_CURVE25519
 470        "x22519 "
 471    #endif
 472    #ifdef WOLFSSL_STATIC_RSA
 473        "rsa_static "
 474    #endif
 475    #ifdef WOLFSSL_STATIC_DH
 476        "dh_static "
 477    #endif
 478    #ifdef WOLFSSL_SNIFFER_KEYLOGFILE
 479        "ssl_keylog_file "
 480    #endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
 481    "\n\n"
 482    );
 483}
 484
 485typedef struct SnifferPacket {
 486    byte* packet;
 487    int   length;
 488    int   lastRet;
 489    int   packetNumber;
 490#ifdef THREADED_SNIFFTEST
 491    struct SnifferPacket* next;
 492    struct SnifferPacket* prev;
 493    int    placeholder;
 494#endif
 495} SnifferPacket;
 496
 497#ifdef WOLFSSL_ASYNC_CRYPT
 498
 499static THREAD_LS_T SnifferPacket asyncQueue[WOLF_ASYNC_MAX_PENDING];
 500
 501/* returns index to queue */
 502static int SnifferAsyncQueueAdd(int lastRet, void* chain, int chainSz,
 503    int isChain, int packetNumber)
 504{
 505    int ret, i, length;
 506    byte* packet;
 507
 508#ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
 509    if (isChain) {
 510        struct iovec* vchain = (struct iovec*)chain;
 511        length = 0;
 512        for (i = 0; i < chainSz; i++)
 513            length += vchain[i].iov_len;
 514        packet = (byte*)vchain[0].iov_base;
 515    }
 516    else
 517#endif
 518    {
 519        packet = (byte*)chain;
 520        length = chainSz;
 521    }
 522
 523    /* find first free idx */
 524    ret = MEMORY_E;
 525    for (i=0; i<WOLF_ASYNC_MAX_PENDING; i++) {
 526        if (asyncQueue[i].packet == NULL) {
 527            if (ret == MEMORY_E) {
 528                ret = i;
 529                break;
 530            }
 531        }
 532    }
 533    if (ret != MEMORY_E) {
 534        asyncQueue[ret].packet = (byte*)XMALLOC(length, NULL,
 535                                                DYNAMIC_TYPE_TMP_BUFFER);
 536        if (asyncQueue[ret].packet == NULL) {
 537            return MEMORY_E;
 538        }
 539        XMEMCPY(asyncQueue[ret].packet, packet, length);
 540        asyncQueue[ret].length = length;
 541        asyncQueue[ret].lastRet = lastRet;
 542        asyncQueue[ret].packetNumber = packetNumber;
 543    }
 544    (void)isChain;
 545
 546    return ret;
 547}
 548
 549static int SnifferAsyncPollQueue(byte** data, char* err, SSLInfo* sslInfo,
 550    int* queueSz)
 551{
 552    int ret = 0, i;
 553    WOLF_EVENT* events[WOLF_ASYNC_MAX_PENDING];
 554    int eventCount = 0;
 555
 556    /* try to process existing items in queue */
 557    for (i=0; i<WOLF_ASYNC_MAX_PENDING; i++) {
 558        if (asyncQueue[i].packet != NULL) {
 559            (*queueSz)++;
 560
 561            /* do poll for events on hardware */
 562            ret = ssl_PollSniffer(events, WOLF_ASYNC_MAX_PENDING,
 563                WOLF_POLL_FLAG_CHECK_HW, &eventCount);
 564            if (ret == 0) {
 565                /* attempt to reprocess pending packet */
 566            #ifdef DEBUG_SNIFFER
 567                printf("Packet Number: %d (retry)\n", asyncQueue[i].packetNumber);
 568            #endif
 569                ret = ssl_DecodePacketAsync(asyncQueue[i].packet,
 570                    asyncQueue[i].length, 0, data, err, sslInfo, NULL);
 571                asyncQueue[i].lastRet = ret;
 572                if (ret != WC_PENDING_E) {
 573                    if (ret < 0) {
 574                        printf("ssl_Decode ret = %d, %s on packet number %d\n",
 575                                ret, err, asyncQueue[i].packetNumber);
 576                    }
 577                    /* done, so free and break to process below */
 578                    XFREE(asyncQueue[i].packet, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 579                    asyncQueue[i].packet = NULL;
 580                    if (ret != 0) {
 581                        /* decrypted some data or found error, so return */
 582                        break;
 583                    }
 584                }
 585            }
 586        }
 587    }
 588    if (ret == WC_PENDING_E) {
 589        ret = 0; /* nothing new */
 590    }
 591    return ret;
 592}
 593#endif /* WOLFSSL_ASYNC_CRYPT */
 594
 595#ifdef THREADED_SNIFFTEST
 596
 597typedef struct {
 598    volatile int lockCount;
 599    pthread_mutex_t mutex;
 600    pthread_cond_t cond;
 601} wm_Sem;
 602
 603 /* Posix style semaphore */
 604static int wm_SemInit(wm_Sem *s)
 605{
 606    s->lockCount = 0;
 607    pthread_mutex_init(&s->mutex, NULL);
 608    pthread_cond_init(&s->cond, NULL);
 609    return 0;
 610}
 611static int wm_SemFree(wm_Sem *s)
 612{
 613    pthread_mutex_destroy(&s->mutex);
 614    pthread_cond_destroy(&s->cond);
 615    return 0;
 616}
 617static int wm_SemLock(wm_Sem *s)
 618{
 619    pthread_mutex_lock(&s->mutex);
 620    while (s->lockCount > 0)
 621        pthread_cond_wait(&s->cond, &s->mutex);
 622    s->lockCount++;
 623    pthread_mutex_unlock(&s->mutex);
 624    return 0;
 625}
 626static int wm_SemUnlock(wm_Sem *s)
 627{
 628    pthread_mutex_lock(&s->mutex);
 629    s->lockCount--;
 630    pthread_cond_signal(&s->cond);
 631    pthread_mutex_unlock(&s->mutex);
 632    return 0;
 633}
 634
 635typedef struct SnifferWorker {
 636    SnifferPacket *head; /* head for doubly-linked list of sniffer packets */
 637    SnifferPacket *tail; /* tail for doubly-linked list of sniffer packets */
 638    wm_Sem         sem;
 639    pthread_t      tid;
 640    char *server;
 641    char *keyFilesSrc;
 642    char *passwd;
 643    int   port;
 644    int   hadBadPacket;  /* track if sniffer worker saw bad packet */
 645    int   unused;
 646    int   id;
 647    int   shutdown;
 648} SnifferWorker;
 649
 650static int ssl_Init_SnifferWorker(SnifferWorker* worker, int port,
 651        const char* server, const char* keyFilesSrc, const char* passwd, int id)
 652{
 653    wm_SemInit(&worker->sem);
 654    worker->server      = (char*)server;
 655    worker->keyFilesSrc = (char*)keyFilesSrc;
 656    worker->passwd      = (char*)passwd;
 657    worker->port           = port;
 658    worker->unused      = 0;
 659    worker->shutdown    = 0;
 660    worker ->id         = id;
 661
 662    worker->head = (SnifferPacket*)XMALLOC(sizeof(SnifferPacket), NULL,
 663                           DYNAMIC_TYPE_TMP_BUFFER);
 664    if (worker->head == NULL) {
 665        return MEMORY_E;
 666    }
 667
 668    XMEMSET(worker->head, 0, sizeof(SnifferPacket));
 669
 670    worker->tail = worker->head;
 671    worker->head->packet = NULL;
 672    worker->head->next = NULL;
 673    worker->head->prev = NULL;
 674    worker->head->placeholder  = 1;
 675
 676    return 0;
 677}
 678
 679static void ssl_Free_SnifferWorker(SnifferWorker* worker)
 680{
 681    wm_SemFree(&worker->sem);
 682
 683    XFREE(worker->head, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 684    worker->head = NULL;
 685}
 686
 687static int SnifferWorkerPacketAdd(SnifferWorker* worker, int lastRet,
 688        byte* packet, int length, int packetNumber)
 689{
 690    SnifferPacket* newEntry;
 691
 692    newEntry = (SnifferPacket*)XMALLOC(sizeof(SnifferPacket), NULL,
 693                                       DYNAMIC_TYPE_TMP_BUFFER);
 694    if (newEntry == NULL) {
 695        return MEMORY_E;
 696    }
 697    XMEMSET(newEntry, 0, sizeof(SnifferPacket));
 698    newEntry->packet = (byte*)XMALLOC(length, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 699    if (newEntry->packet == NULL) {
 700        XFREE(newEntry, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 701        return MEMORY_E;
 702    }
 703
 704    /* Set newEntry fields to input values */
 705    XMEMCPY(newEntry->packet, packet, length);
 706    newEntry->length = length;
 707    newEntry->lastRet = lastRet;
 708    newEntry->packetNumber = packetNumber;
 709    newEntry->placeholder = 0;
 710
 711    /* Create worker head if null */
 712    if (worker->head == NULL) {
 713        worker->head = (SnifferPacket*)XMALLOC(sizeof(SnifferPacket), NULL,
 714                           DYNAMIC_TYPE_TMP_BUFFER);
 715        XMEMSET(worker->head, 0, sizeof(SnifferPacket));
 716
 717        worker->tail = worker->head;
 718        worker->head->packet = NULL;
 719        worker->head->next = NULL;
 720        worker->head->prev = NULL;
 721        worker->head->placeholder = 1;
 722    }
 723
 724    if (worker->head->placeholder) {
 725        /* First packet added to be to SnifferWorker linked list,
 726         * set head and tail to the new packet */
 727        XFREE(worker->head, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 728        newEntry->next = NULL;
 729        newEntry->prev = NULL;
 730        worker->head = newEntry;
 731        worker->tail = newEntry;
 732    }
 733    else {
 734        /* Add packet to SnifferWorker linked list and move tail */
 735        newEntry->prev = worker->tail;
 736        newEntry->next = NULL;
 737        worker->tail->next = newEntry;
 738        worker->tail = newEntry;
 739    }
 740
 741    return 0;
 742
 743}
 744#endif /* THREADED_SNIFFTEST */
 745
 746static int DecodePacket(byte* packet, int length, int packetNumber, char err[])
 747{
 748    int     ret, j;
 749    int     hadBadPacket = 0;
 750    int     isChain      = 0;
 751    int     chainSz;
 752    void*   chain;
 753    byte*   data         = NULL; /* pointer to decrypted data */
 754    SSLInfo sslInfo;
 755#ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
 756    struct iovec chains[CHAIN_INPUT_COUNT];
 757    unsigned int remainder;
 758
 759    j         = 0;
 760    chainSz   = 0;
 761    isChain   = 1;
 762    remainder = length;
 763    do {
 764        unsigned int chunkSz = min(remainder, CHAIN_INPUT_CHUNK_SIZE);
 765        chains[chainSz].iov_base = (void*)(packet + j);
 766        chains[chainSz].iov_len = chunkSz;
 767        j += chunkSz;
 768        remainder -= chunkSz;
 769        chainSz++;
 770    } while (j < (int)length);
 771    chain = (void*)chains;
 772#else
 773    chain = (void*)packet;
 774    chainSz = length;
 775#endif
 776
 777#if defined(DEBUG_SNIFFER)
 778    printf("Packet Number: %d\n", packetNumber);
 779#endif
 780
 781    /* decode packet */
 782#ifdef WOLFSSL_ASYNC_CRYPT
 783    /* For async call the original API again with same data,
 784     * or call with different sessions for multiple concurrent
 785     * stream processing */
 786    ret = ssl_DecodePacketAsync(chain, chainSz, isChain, &data, err,
 787        &sslInfo, NULL);
 788
 789    /* WC_PENDING_E: Hardware is processing or stream is blocked
 790     *               (waiting on WC_PENDING_E) */
 791    if (ret == WC_PENDING_E) {
 792        /* add to queue, for later processing */
 793    #ifdef DEBUG_SNIFFER
 794        printf("Steam is pending, queue packet %d\n", packetNumber);
 795    #endif
 796        ret = SnifferAsyncQueueAdd(ret, chain, chainSz, isChain,
 797            packetNumber);
 798        if (ret >= 0) {
 799            ret = 0; /* mark event just added */
 800        }
 801    }
 802
 803#elif defined(WOLFSSL_SNIFFER_CHAIN_INPUT) && \
 804      defined(WOLFSSL_SNIFFER_STORE_DATA_CB)
 805    ret = ssl_DecodePacketWithChainSessionInfoStoreData(chain, chainSz,
 806            &data, &sslInfo, err);
 807#elif defined(WOLFSSL_SNIFFER_CHAIN_INPUT)
 808    (void)sslInfo;
 809    ret = ssl_DecodePacketWithChain(chain, chainSz, &data, err);
 810#elif defined(WOLFSSL_SNIFFER_STORE_DATA_CB)
 811    ret = ssl_DecodePacketWithSessionInfoStoreData(packet,
 812            length, &data, &sslInfo, err);
 813#else
 814    ret = ssl_DecodePacketWithSessionInfo(packet, length, &data,
 815                                            &sslInfo, err);
 816#endif
 817
 818    if (ret < 0) {
 819        printf("ssl_Decode ret = %d, %s on packet number %d\n", ret, err,
 820                packetNumber);
 821        hadBadPacket = 1;
 822    }
 823
 824    if (data != NULL && ret > 0) {
 825        /* Convert non-printable data to periods. */
 826        for (j = 0; j < ret; j++) {
 827            if (isprint(data[j]) || isspace(data[j])) continue;
 828            data[j] = '.';
 829        }
 830        data[ret] = 0;
 831        printf("SSL App Data(%d:%d):%s\n", packetNumber, ret, data);
 832        ssl_FreeZeroDecodeBuffer(&data, ret, err);
 833    }
 834
 835    (void)isChain;
 836    (void)chain;
 837    (void)chainSz;
 838
 839    return hadBadPacket;
 840}
 841
 842#ifdef THREADED_SNIFFTEST
 843static void* snifferWorker(void* arg)
 844{
 845    SnifferWorker* worker = (SnifferWorker*)arg;
 846    char err[PCAP_ERRBUF_SIZE];
 847
 848    ssl_InitSniffer_ex2(worker->id);
 849    ssl_Trace(traceFile, err);
 850    ssl_EnableRecovery(1, -1, err);
 851#ifdef WOLFSSL_SNIFFER_WATCH
 852    ssl_SetWatchKeyCallback(myWatchCb, err);
 853#endif
 854#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
 855    ssl_SetStoreDataCallback(myStoreDataCb);
 856#endif
 857
 858    load_key(NULL, worker->server, worker->port, worker->keyFilesSrc,
 859             worker->passwd, err);
 860
 861    /* continue processing the workers packets and keep expecting them
 862     * until the shutdown flag is set */
 863    while (!worker->shutdown) {
 864        while (worker->head) {
 865            int   ret = 0;
 866            byte* packet;
 867            int   length;
 868            int   packetNumber;
 869        #ifdef WOLFSSL_ASYNC_CRYPT
 870            SSLInfo sslInfo;
 871            byte*   data;
 872            int     queueSz = 0;
 873
 874            /* poll hardware and attempt to process items in queue. If
 875             * returns > 0 then data pointer has decrypted something */
 876            SnifferAsyncPollQueue(&data, err, &sslInfo, &queueSz);
 877            if (queueSz >= WOLF_ASYNC_MAX_PENDING) {
 878                /* queue full, poll again */
 879                continue;
 880            }
 881        #endif
 882
 883            /* Shutdown worker if it was not utilized */
 884            if (worker->unused) {
 885                XFREE(worker->head, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 886                worker->head = NULL;
 887                break;
 888            }
 889
 890            /* get lock */
 891            wm_SemLock(&worker->sem);
 892
 893            /* get packet for current worker head */
 894            packet       = worker->head->packet;
 895            length       = worker->head->length;
 896            packetNumber = worker->head->packetNumber;
 897
 898            wm_SemUnlock(&worker->sem);
 899
 900            if (packet == NULL) {
 901                continue;
 902            }
 903
 904            /* Decode Packet, ret value will indicate whether a
 905             * bad packet was encountered */
 906            ret = DecodePacket(packet, length, packetNumber, err);
 907            if (ret) {
 908                worker->hadBadPacket = 1;
 909            }
 910
 911            /* get lock */
 912            wm_SemLock(&worker->sem);
 913
 914            XFREE(worker->head->packet, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 915            worker->head->packet = NULL;
 916
 917            if (worker->head->next) {
 918                /* Move head and free */
 919                worker->head = worker->head->next;
 920                XFREE(worker->head->prev, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 921                worker->head->prev = NULL;
 922            }
 923            else {
 924                /* No other packets in list. Keep looping until more packets
 925                 * arrive or worker is shutdown. */
 926                XFREE(worker->head, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 927                worker->head = NULL;
 928            }
 929            wm_SemUnlock(&worker->sem);
 930
 931        } /* while (worker->head) */
 932
 933        if (worker->unused) {
 934                break;
 935        }
 936
 937    } /* while (worker->head) */
 938
 939    /* Thread cleanup */
 940    ssl_FreeSniffer();
 941#if defined(HAVE_ECC) && defined(FP_ECC)
 942    wc_ecc_fp_free();
 943#endif
 944    return NULL;
 945}
 946#endif /* THREADED_SNIFFTEST */
 947
 948int main(int argc, char** argv)
 949{
 950    int          ret = 0;
 951    int          hadBadPacket = 0;
 952    int          inum = 0;
 953    int          saveFile = 0;
 954    int          i = 0, defDev = 0;
 955    int          packetNumber = 0;
 956    int          frame = ETHER_IF_FRAME_LEN;
 957    char         cmdLineArg[128];
 958    char        *pcapFile = NULL;
 959    char        *deviceName = NULL;
 960    char         err[PCAP_ERRBUF_SIZE];
 961    char         filter[128];
 962    const char  *keyFilesSrc = NULL;
 963#ifdef WOLFSSL_SNIFFER_KEYLOGFILE
 964    const char  *sslKeyLogFile = NULL;
 965#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
 966    char         keyFilesBuf[MAX_FILENAME_SZ];
 967    char         keyFilesUser[MAX_FILENAME_SZ];
 968    const char  *server = NULL;
 969    int          port   = -1;
 970    const char  *sniName = NULL;
 971    const char  *passwd = NULL;
 972    pcap_if_t   *d;
 973    pcap_addr_t *a;
 974#ifdef THREADED_SNIFFTEST
 975    int workerThreadCount;
 976#endif
 977
 978#ifdef DEBUG_WOLFSSL
 979    wolfSSL_Debugging_ON();
 980#endif
 981
 982    show_appinfo();
 983
 984    signal(SIGINT, sig_handler);
 985
 986    for (i = 1; i < argc; i++) {
 987        if (strcmp(argv[i], "-pcap") == 0 && i + 1 < argc) {
 988            pcapFile = argv[++i];
 989        }
 990        else if (strcmp(argv[i], "-deviceName") == 0 && i + 1 < argc) {
 991            deviceName = argv[++i];
 992        }
 993        else if (strcmp(argv[i], "-key") == 0 && i + 1 < argc) {
 994            keyFilesSrc = argv[++i];
 995        }
 996        else if (strcmp(argv[i], "-server") == 0 && i + 1 < argc) {
 997            server = argv[++i];
 998        }
 999        else if (strcmp(argv[i], "-port") == 0 && i + 1 < argc) {
1000            port = XATOI(argv[++i]);
1001        }
1002        else if (strcmp(argv[i], "-password") == 0 && i + 1 < argc) {
1003            passwd = argv[++i];
1004        }
1005        else if (strcmp(argv[i], "-tracefile") == 0 && i + 1 < argc) {
1006            traceFile = argv[++i];
1007        }
1008#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
1009        else if (strcmp(argv[i], "-keylogfile") == 0 && i + 1 < argc) {
1010            sslKeyLogFile = argv[++i];
1011        }
1012#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
1013#if defined(THREADED_SNIFFTEST)
1014        else if (strcmp(argv[i], "-threads") == 0 && i + 1 < argc) {
1015            workerThreadCount = XATOI(argv[++i]);
1016        }
1017#endif /* THREADED_SNIFFTEST */
1018        else {
1019            fprintf(stderr, "Error parsing: %s\n", argv[i]);
1020            fprintf(stderr, "Usage: %s -pcap pcap_arg -key key_arg"
1021                    " [-deviceName deviceName_arg]"
1022                    " [-password password_arg] [-server server_arg]"
1023                    " [-port port_arg]"
1024                    " [-tracefile tracefile_arg]"
1025#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
1026                    " [-keylogfile keylogfile_arg]"
1027#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
1028#if defined(THREADED_SNIFFTEST)
1029                    " [-threads threads_arg]"
1030#endif /* THREADED_SNIFFTEST */
1031                    "\n", argv[0]);
1032            exit(EXIT_FAILURE);
1033        }
1034    }
1035
1036#ifndef THREADED_SNIFFTEST
1037    #ifndef _WIN32
1038    ssl_InitSniffer();   /* dll load on Windows */
1039    #endif
1040    ssl_Trace(traceFile, err);
1041    ssl_EnableRecovery(1, -1, err);
1042    #ifdef WOLFSSL_SNIFFER_WATCH
1043    ssl_SetWatchKeyCallback(myWatchCb, err);
1044    #endif
1045    #ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
1046    ssl_SetStoreDataCallback(myStoreDataCb);
1047    #endif
1048#else
1049#ifdef HAVE_SESSION_TICKET
1050    /* Multiple threads on resume not yet supported */
1051    workerThreadCount = 1;
1052#else
1053    workerThreadCount = 5;
1054#endif
1055#endif
1056    SNPRINTF(filter, sizeof(filter), "(ip6 or ip) and tcp");
1057
1058
1059    if (pcapFile == NULL) {
1060        /* normal case, user chooses device and port */
1061
1062        if (pcap_findalldevs(&alldevs, err) == -1)
1063            err_sys("Error in pcap_findalldevs");
1064
1065        if (deviceName == NULL) {
1066            for (d = alldevs, i = 0; d; d=d->next) {
1067                printf("%d. %s", ++i, d->name);
1068                if (strcmp(d->name, "lo0") == 0) {
1069                    defDev = i;
1070                }
1071                if (d->description)
1072                    printf(" (%s)\n", d->description);
1073                else
1074                    printf(" (No description available)\n");
1075            }
1076
1077            if (i == 0)
1078                err_sys("No interfaces found! Make sure pcap or WinPcap is"
1079                        " installed correctly and you have sufficient permissions");
1080
1081            printf("Enter the interface number (1-%d) [default: %d]: ", i, defDev);
1082            XMEMSET(cmdLineArg, 0, sizeof(cmdLineArg));
1083            if (XFGETS(cmdLineArg, sizeof(cmdLineArg), stdin))
1084                inum = XATOI(cmdLineArg);
1085            if (inum == 0)
1086                inum = defDev;
1087            else if (inum < 1 || inum > i)
1088                err_sys("Interface number out of range");
1089
1090            /* Jump to the selected adapter */
1091            for (d = alldevs, i = 0; i < inum - 1; d = d->next, i++);
1092        } else {
1093            int deviceNameSz = (int)XSTRLEN(deviceName);
1094            for (d = alldevs; d; d = d->next) {
1095                if (XSTRNCMP(d->name,deviceName,deviceNameSz) == 0) {
1096                    fprintf(stderr, "%s == %s\n", d->name, deviceName);
1097                    break;
1098                }
1099            }
1100            if (d == NULL) {
1101                err_sys("Can't find the device you're looking for");
1102            }
1103        }
1104
1105        printf("Selected %s\n", d->name);
1106        pcap = pcap_create(d->name, err);
1107        if (pcap == NULL) fprintf(stderr, "pcap_create failed %s\n", err);
1108
1109        if (server == NULL) {
1110            /* print out addresses for selected interface */
1111            for (a = d->addresses; a; a = a->next) {
1112                if (a->addr->sa_family == AF_INET) {
1113                    server =
1114                        iptos(&((struct sockaddr_in *)a->addr)->sin_addr);
1115                    printf("server = %s\n", server);
1116                }
1117                else if (a->addr->sa_family == AF_INET6) {
1118                    server =
1119                        ip6tos(&((struct sockaddr_in6 *)a->addr)->sin6_addr);
1120                    printf("server = %s\n", server);
1121                }
1122            }
1123        }
1124
1125        ret = pcap_set_snaplen(pcap, 65536);
1126        if (ret != 0)
1127            fprintf(stderr, "pcap_set_snaplen failed %s\n", pcap_geterr(pcap));
1128
1129        ret = pcap_set_timeout(pcap, 1000);
1130        if (ret != 0)
1131            fprintf(stderr, "pcap_set_timeout failed %s\n", pcap_geterr(pcap));
1132
1133        ret = pcap_set_buffer_size(pcap, 1000000);
1134        if (ret != 0)
1135            fprintf(stderr, "pcap_set_buffer_size failed %s\n",
1136                    pcap_geterr(pcap));
1137
1138        ret = pcap_set_promisc(pcap, 1);
1139        if (ret != 0)
1140            fprintf(stderr,"pcap_set_promisc failed %s\n", pcap_geterr(pcap));
1141
1142
1143        ret = pcap_activate(pcap);
1144        if (ret != 0)
1145            fprintf(stderr, "pcap_activate failed %s\n", pcap_geterr(pcap));
1146
1147    }
1148    else {
1149        saveFile = 1;
1150        pcap = pcap_open_offline(pcapFile , err);
1151        if (pcap == NULL) {
1152            fprintf(stderr, "pcap_open_offline failed %s\n", err);
1153            err_sys(err);
1154        }
1155    }
1156
1157    if (server == NULL) {
1158        server = DEFAULT_SERVER_IP;
1159    }
1160
1161    if (port < 0) {
1162        printf("Enter the port to scan [default: %d, '0' for all]: ",
1163                DEFAULT_SERVER_PORT);
1164        XMEMSET(cmdLineArg, 0, sizeof(cmdLineArg));
1165        if (XFGETS(cmdLineArg, sizeof(cmdLineArg), stdin)) {
1166            port = XATOI(cmdLineArg);
1167        }
1168        if ((port < 0) || (cmdLineArg[0] == '\n'))
1169            port = DEFAULT_SERVER_PORT;
1170
1171    }
1172    if (port > 0) {
1173        SNPRINTF(cmdLineArg, sizeof(filter), " and port %d", port);
1174        XSTRLCAT(filter, cmdLineArg, sizeof(filter));
1175    }
1176
1177#if defined(WOLFSSL_SNIFFER_KEYLOGFILE)
1178    /* If we offer keylog support, then user must provide EITHER a pubkey
1179     * OR a keylog file but NOT both */
1180    if (keyFilesSrc && sslKeyLogFile) {
1181        fprintf(stderr,
1182                "Error: either -key OR -keylogfile option but NOT both.\n");
1183        exit(EXIT_FAILURE);
1184    }
1185
1186    if (sslKeyLogFile != NULL) {
1187        ret = ssl_LoadSecretsFromKeyLogFile(sslKeyLogFile, err);
1188        if (ret != 0) {
1189            fprintf(stderr,
1190                    "ERROR=%d, unable to load secrets from keylog file\n",ret);
1191            err_sys(err);
1192        }
1193
1194        ret = ssl_CreateKeyLogSnifferServer(server, port, err);
1195        if (ret != 0) {
1196            fprintf(stderr,
1197                    "ERROR=%d, unable to create keylog sniffer server\n",ret);
1198            err_sys(err);
1199        }
1200    }
1201    else
1202#endif /* WOLFSSL_SNIFFER_KEYLOGFILE */
1203    if (keyFilesSrc) {
1204        ret = load_key(NULL, server, port, keyFilesSrc, passwd, err);
1205        if (ret != 0) {
1206            fprintf(stderr, "Failed to load key\n");
1207            err_sys(err);
1208        }
1209    }
1210    else {
1211        /* optionally enter the private key to use */
1212#if defined(WOLFSSL_STATIC_EPHEMERAL) && defined(DEFAULT_SERVER_EPH_KEY)
1213        keyFilesSrc = DEFAULT_SERVER_EPH_KEY;
1214#else
1215        keyFilesSrc = DEFAULT_SERVER_KEY;
1216#endif
1217        printf("Enter the server key [default: %s]: ", keyFilesSrc);
1218        XMEMSET(keyFilesBuf, 0, sizeof(keyFilesBuf));
1219        XMEMSET(keyFilesUser, 0, sizeof(keyFilesUser));
1220        if (XFGETS(keyFilesUser, sizeof(keyFilesUser), stdin)) {
1221            TrimNewLine(keyFilesUser);
1222            if (XSTRLEN(keyFilesUser) > 0) {
1223                keyFilesSrc = keyFilesUser;
1224            }
1225        }
1226        XSTRNCPY(keyFilesBuf, keyFilesSrc, sizeof(keyFilesBuf));
1227
1228        /* optionally enter a named key (SNI) */
1229    #if !defined(WOLFSSL_SNIFFER_WATCH) && defined(HAVE_SNI)
1230        printf("Enter alternate SNI [default: none]: ");
1231        XMEMSET(cmdLineArg, 0, sizeof(cmdLineArg));
1232        if (XFGETS(cmdLineArg, sizeof(cmdLineArg), stdin)) {
1233            TrimNewLine(cmdLineArg);
1234            if (XSTRLEN(cmdLineArg) > 0) {
1235                sniName = cmdLineArg;
1236            }
1237        }
1238    #endif /* !WOLFSSL_SNIFFER_WATCH && HAVE_SNI */
1239
1240        ret = load_key(sniName, server, port, keyFilesBuf, NULL, err);
1241        if (ret != 0) {
1242            exit(EXIT_FAILURE);
1243        }
1244    }
1245
1246    /* Only let through TCP/IP packets */
1247    printf("Using packet filter: %s\n", filter);
1248    ret = pcap_compile(pcap, &pcap_fp, filter, 0, 0);
1249    if (ret != 0) {
1250        fprintf(stderr, "pcap_compile failed %s\n", pcap_geterr(pcap));
1251        exit(EXIT_FAILURE);
1252    }
1253
1254    ret = pcap_setfilter(pcap, &pcap_fp);
1255    if (ret != 0) {
1256        fprintf(stderr, "pcap_setfilter failed %s\n", pcap_geterr(pcap));
1257        exit(EXIT_FAILURE);
1258    }
1259
1260    if (ret != 0)
1261        err_sys(err);
1262
1263    if (pcap_datalink(pcap) == DLT_NULL)
1264        frame = NULL_IF_FRAME_LEN;
1265
1266#ifdef THREADED_SNIFFTEST
1267    SnifferWorker workers[workerThreadCount];
1268    int           used[workerThreadCount];
1269
1270    XMEMSET(used, 0, sizeof(used));
1271    XMEMSET(&workers, 0, sizeof(workers));
1272
1273    for (i=0; i<workerThreadCount; i++) {
1274        ssl_Init_SnifferWorker(&workers[i], port, server, keyFilesSrc,
1275                               passwd, i);
1276        pthread_create(&workers[i].tid, NULL, snifferWorker, &workers[i]);
1277    }
1278#endif
1279
1280    while (1) {
1281        struct pcap_pkthdr *header;
1282        const unsigned char* packet = NULL;
1283        byte* data = NULL; /* pointer to decrypted data */
1284#ifdef THREADED_SNIFFTEST
1285        SnifferStreamInfo info;
1286        uint8_t  infoSum;
1287        uint8_t* infoPtr;
1288        int      threadNum;
1289#endif
1290#if defined(WOLFSSL_ASYNC_CRYPT)
1291        SSLInfo sslInfo;
1292        int     queueSz = 0;
1293
1294        XMEMSET(&sslInfo, 0, sizeof(sslInfo));
1295        /* poll hardware and attempt to process items in queue. If returns > 0
1296         * then data pointer has decrypted something */
1297        SnifferAsyncPollQueue(&data, err, &sslInfo, &queueSz);
1298        if (queueSz >= WOLF_ASYNC_MAX_PENDING) {
1299            /* queue full, poll again */
1300            continue;
1301        }
1302#endif
1303        ret = 0; /* reset status */
1304
1305        if (data == NULL) {
1306        /* grab next pcap packet */
1307            packetNumber++;
1308            if(pcap_next_ex(pcap, &header, &packet) < 0) {
1309                break;
1310            }
1311        }
1312
1313        if (packet) {
1314            if (header->caplen > 40)  { /* min ip(20) + min tcp(20) */
1315                packet        += frame;
1316                header->caplen -= frame;
1317            }
1318            else {
1319                /* packet doesn't contain minimum ip/tcp header */
1320                continue;
1321            }
1322            if (pcap_datalink(pcap) == DLT_LINUX_SLL) {
1323                packet += 2;
1324                header->caplen -= 2;
1325            }
1326#ifdef THREADED_SNIFFTEST
1327            XMEMSET(&info, 0, sizeof(SnifferStreamInfo));
1328
1329            ret = ssl_DecodePacket_GetStream(&info, packet, header->caplen, err);
1330
1331            /* calculate SnifferStreamInfo checksum */
1332            infoSum = 0;
1333            infoPtr = (uint8_t*)&info;
1334
1335            for (i=0; i<(int)sizeof(SnifferStreamInfo); i++) {
1336                infoSum += infoPtr[i];
1337            }
1338
1339            /* determine thread to handle stream */
1340            threadNum = infoSum % workerThreadCount;
1341            used[threadNum] = 1;
1342        #ifdef DEBUG_SNIFFER
1343            printf("Sending packet %d to thread number %d\n", packetNumber,
1344                    threadNum);
1345        #endif
1346
1347            /* get lock on thread mutex */
1348            wm_SemLock(&workers[threadNum].sem);
1349
1350            /* add the packet to the worker's linked list */
1351            if (SnifferWorkerPacketAdd(&workers[threadNum], ret, (byte*)packet,
1352                                   header->caplen, packetNumber)) {
1353                printf("Unable to add packet %d to worker", packetNumber);
1354                break;
1355            }
1356
1357            wm_SemUnlock(&workers[threadNum].sem);
1358#else
1359            /* Decode Packet, ret value will indicate whether a
1360             * bad packet was encountered */
1361            hadBadPacket = DecodePacket((byte*)packet, header->caplen,
1362                                        packetNumber,err);
1363#endif
1364        }
1365        /* check if we are done reading file */
1366        if (packet == NULL && data == NULL && saveFile) {
1367        #ifdef WOLFSSL_ASYNC_CRYPT
1368            /* if items pending still then keep processing */
1369            if (queueSz > 0)
1370                continue;
1371        #endif
1372            break;
1373        }
1374
1375    }
1376
1377#ifdef THREADED_SNIFFTEST
1378    for (i=0; i<workerThreadCount; i++) {
1379        workers[i].shutdown = 1;
1380        if (used[i] == 0)
1381            workers[i].unused = 1;
1382        pthread_join(workers[i].tid, NULL);
1383    }
1384
1385    for (i=0; i<workerThreadCount; i++) {
1386        if (workers[i].hadBadPacket) {
1387           hadBadPacket = 1;
1388        }
1389        ssl_Free_SnifferWorker(&workers[i]);
1390    }
1391#endif
1392
1393    FreeAll();
1394
1395    return hadBadPacket ? EXIT_FAILURE : EXIT_SUCCESS;
1396}
1397
1398#endif /* full build */