test/suite-capture.sh

   1 #!/bin/bash
   2 #
   3 # Test the capture engine of the Wireshark tools
   4 #
   5 # $Id$
   6 #
   7 # Wireshark - Network traffic analyzer
   8 # By Gerald Combs <gerald@wireshark.org>
   9 # Copyright 2005 Ulf Lamping
  10 #
  11 # This program is free software; you can redistribute it and/or
  12 # modify it under the terms of the GNU General Public License
  13 # as published by the Free Software Foundation; either version 2
  14 # of the License, or (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program; if not, writeto the Free Software
  23 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24 #
  25
  26
  27 # common exit status values
  28 EXIT_OK=0
  29 EXIT_COMMAND_LINE=1
  30 EXIT_ERROR=2
  31
  32 capture_test_output_print() {
  33         wait
  34         for f in "$@"; do
  35                 if [[ -f "$f" ]]; then
  36                 printf " --> $f\n"
  37                 cat "$f"
  38                 printf "\n"
  39                 fi
  40         done
  41 }
  42
  43 traffic_gen_ping() {
  44         # Generate some traffic for quiet networks.
  45         # This will have to be adjusted for non-Windows systems.
  46
  47         # the following will run in the background and return immediately
  48         {
  49         date
  50         for (( x=28; x<=58; x++ )) # in effect: number the packets
  51         do
  52                 # How does ping _not_ have a standard set of arguments?
  53                 case $WS_SYSTEM in
  54                         Windows)
  55                                 ping -n 1 -l $x www.wireshark.org       ;;
  56                         SunOS)
  57                                 /usr/sbin/ping www.wireshark.org $x 1           ;;
  58                         *) # *BSD, Linux
  59                                 ping -c 1 -s $x www.wireshark.org       ;;
  60                 esac
  61                 sleep 1
  62         done
  63         date
  64         } > ./testout_ping.txt 2>&1 &
  65 }
  66
  67 ping_cleanup() {
  68         wait
  69         rm -f ./testout_ping.txt
  70 }
  71
  72 # capture exactly 10 packets
  73 capture_step_10packets() {
  74         if [ $SKIP_CAPTURE -ne 0 ] ; then
  75                 test_step_skipped
  76                 return
  77         fi
  78
  79         traffic_gen_ping
  80
  81         date > ./testout.txt
  82         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
  83                 -w ./testout.pcap \
  84                 -c 10  \
  85                 -a duration:$TRAFFIC_CAPTURE_DURATION \
  86                 -f icmp \
  87                 >> ./testout.txt 2>&1
  88         RETURNVALUE=$?
  89         date >> ./testout.txt
  90         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  91                 echo
  92                 capture_test_output_print ./testout.txt
  93                 # part of the Prerequisite checks
  94                 # wrong interface ? output the possible interfaces
  95                 $TSHARK -D
  96                 test_step_failed "exit status of $DUT: $RETURNVALUE"
  97                 return
  98         fi
  99
 100         # we should have an output file now
 101         if [ ! -f "./testout.pcap" ]; then
 102                 capture_test_output ./testout.txt
 103                 test_step_failed "No output file!"
 104                 return
 105         fi
 106
 107         # ok, we got a capture file, does it contain exactly 10 packets?
 108         $CAPINFOS ./testout.pcap > ./testout2.txt
 109         grep -Ei 'Number of packets:[[:blank:]]+10' ./testout2.txt > /dev/null
 110         if [ $? -eq 0 ]; then
 111                 test_step_ok
 112         else
 113                 echo
 114                 $TSHARK -ta -r ./testout.pcap >> ./testout2.txt
 115                 capture_test_output_print ./testout_ping.txt ./testout.txt ./testout2.txt
 116                 # part of the Prerequisite checks
 117                 # probably wrong interface, output the possible interfaces
 118                 $TSHARK -D
 119                 test_step_failed "No or not enough traffic captured. Probably the wrong interface: $TRAFFIC_CAPTURE_IFACE!"
 120         fi
 121 }
 122
 123 # capture exactly 10 packets using "-w -" (piping to stdout)
 124 capture_step_10packets_stdout() {
 125         if [ $SKIP_CAPTURE -ne 0 ] ; then
 126                 test_step_skipped
 127                 return
 128         fi
 129
 130         traffic_gen_ping
 131
 132         date > ./testout.txt
 133         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 134                 -c 10 \
 135                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 136                 -w - \
 137                 -f icmp \
 138                 > ./testout.pcap 2>>./testout.txt
 139         RETURNVALUE=$?
 140         date >> ./testout.txt
 141         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 142                 echo
 143                 cat ./testout.txt
 144                 $TSHARK -D
 145                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 146                 return
 147         fi
 148
 149         # we should have an output file now
 150         if [ ! -f "./testout.pcap" ]; then
 151                 test_step_failed "No output file!"
 152                 return
 153         fi
 154
 155         # ok, we got a capture file, does it contain exactly 10 packets?
 156         $CAPINFOS ./testout.pcap > ./testout2.txt 2>&1
 157         grep -Ei 'Number of packets:[[:blank:]]+10' ./testout2.txt > /dev/null
 158         if [ $? -eq 0 ]; then
 159                 test_step_ok
 160         else
 161                 echo
 162                 cat ./testout.txt
 163                 cat ./testout2.txt
 164                 $TSHARK -D
 165                 test_step_failed "No or not enough traffic captured. Probably the wrong interface: $TRAFFIC_CAPTURE_IFACE!"
 166         fi
 167 }
 168
 169 # capture packets via a fifo
 170 capture_step_fifo() {
 171         mkfifo 'fifo'
 172         (cat $CAPFILE; sleep 1; tail -c +25 $CAPFILE) > fifo &
 173         $DUT -i fifo $TRAFFIC_CAPTURE_PROMISC \
 174                 -w ./testout.pcap \
 175                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 176                 > ./testout.txt 2>&1
 177         RETURNVALUE=$?
 178         rm 'fifo'
 179         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 180                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 181                 return
 182         fi
 183
 184         # we should have an output file now
 185         if [ ! -f "./testout.pcap" ]; then
 186                 test_step_failed "No output file!"
 187                 return
 188         fi
 189
 190         # ok, we got a capture file, does it contain exactly 8 packets?
 191         $CAPINFOS ./testout.pcap > ./testout.txt
 192         grep -Ei 'Number of packets:[[:blank:]]+8' ./testout.txt > /dev/null
 193         if [ $? -eq 0 ]; then
 194                 test_step_ok
 195         else
 196                 echo
 197                 cat ./testout.txt
 198                 test_step_failed "No or not enough traffic captured."
 199         fi
 200 }
 201
 202 # capture packets via a fifo
 203 capture_step_stdin() {
 204         (cat $CAPFILE; sleep 1; tail -c +25 $CAPFILE) | \
 205         $DUT -i - $TRAFFIC_CAPTURE_PROMISC \
 206                 -w ./testout.pcap \
 207                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 208                 > ./testout.txt 2>&1
 209         RETURNVALUE=$?
 210         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 211                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 212                 return
 213         fi
 214
 215         # we should have an output file now
 216         if [ ! -f "./testout.pcap" ]; then
 217                 test_step_failed "No output file!"
 218                 return
 219         fi
 220
 221         # ok, we got a capture file, does it contain exactly 8 packets?
 222         $CAPINFOS ./testout.pcap > ./testout.txt
 223         grep -Ei 'Number of packets:[[:blank:]]+8' ./testout.txt > /dev/null
 224         if [ $? -eq 0 ]; then
 225                 test_step_ok
 226         else
 227                 echo
 228                 cat ./testout.txt
 229                 test_step_failed "No or not enough traffic captured."
 230         fi
 231 }
 232
 233 # capture exactly 2 times 10 packets (multiple files)
 234 capture_step_2multi_10packets() {
 235         if [ $SKIP_CAPTURE -ne 0 ] ; then
 236                 test_step_skipped
 237                 return
 238         fi
 239
 240         traffic_gen_ping
 241
 242         date > ./testout.txt
 243         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 244                 -w ./testout.pcap \
 245                 -c 10 \
 246                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 247                 -f icmp \
 248                 >> ./testout.txt 2>&1
 249
 250         RETURNVALUE=$?
 251         date >> ./testout.txt
 252         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 253                 echo
 254                 cat ./testout.txt
 255                 # part of the Prerequisite checks
 256                 # probably wrong interface, output the possible interfaces
 257                 $TSHARK -D
 258                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 259                 return
 260         fi
 261
 262         # we should have an output file now
 263         if [ ! -f "./testout.pcap" ]; then
 264                 test_step_failed "No output file!"
 265                 return
 266         fi
 267
 268         # ok, we got a capture file, does it contain exactly 10 packets?
 269         $CAPINFOS ./testout.pcap > ./testout.txt
 270         grep -Ei 'Number of packets:[[:blank:]]+10' ./testout.txt > /dev/null
 271         if [ $? -eq 0 ]; then
 272                 test_step_ok
 273         else
 274                 echo
 275                 cat ./testout.txt
 276                 test_step_failed "Probably the wrong interface (no traffic captured)!"
 277         fi
 278 }
 279
 280 # capture with a very unlikely read filter, packets must be zero afterwards
 281 capture_step_read_filter() {
 282         if [ $SKIP_CAPTURE -ne 0 ] ; then
 283                 test_step_skipped
 284                 return
 285         fi
 286
 287         traffic_gen_ping
 288
 289         # valid, but very unlikely filter
 290         date > ./testout.txt
 291         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 292                 -w ./testout.pcap \
 293                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 294                 -R 'dcerpc.cn_call_id==123456' \
 295                 -c 10 \
 296                 -f icmp \
 297                 >> ./testout.txt 2>&1
 298         RETURNVALUE=$?
 299         date >> ./testout.txt
 300         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 301                 echo
 302                 cat ./testout.txt
 303                 # part of the Prerequisite checks
 304                 # wrong interface ? output the possible interfaces
 305                 $TSHARK -D
 306                 test_step_failed "exit status: $RETURNVALUE"
 307                 return
 308         fi
 309
 310         # we should have an output file now
 311         if [ ! -f "./testout.pcap" ]; then
 312                 test_step_failed "No output file!"
 313                 return
 314         fi
 315
 316         # ok, we got a capture file, does it contain exactly 0 packets?
 317         $CAPINFOS ./testout.pcap > ./testout.txt
 318         grep -Ei 'Number of packets:[[:blank:]]+0' ./testout.txt > /dev/null
 319         if [ $? -eq 0 ]; then
 320                 test_step_ok
 321         else
 322                 echo
 323                 cat ./testout.txt
 324                 test_step_failed "Capture file should contain zero packets!"
 325         fi
 326 }
 327
 328
 329 # capture with a snapshot length
 330 capture_step_snapshot() {
 331         if [ $SKIP_CAPTURE -ne 0 ] ; then
 332                 test_step_skipped
 333                 return
 334         fi
 335
 336         traffic_gen_ping
 337
 338         # capture with a snapshot length of 68 bytes for $TRAFFIC_CAPTURE_DURATION seconds
 339         # this should result in no packets greater than 68 bytes
 340         date > ./testout.txt
 341         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 342                 -w ./testout.pcap \
 343                 -s 68 \
 344                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 345                 -f icmp \
 346                 >> ./testout.txt 2>&1
 347         RETURNVALUE=$?
 348         date >> ./testout.txt
 349         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 350                 echo
 351                 cat ./testout.txt
 352                 # part of the Prerequisite checks
 353                 # wrong interface ? output the possible interfaces
 354                 $TSHARK -D
 355                 test_step_failed "exit status: $RETURNVALUE"
 356                 return
 357         fi
 358
 359         # we should have an output file now
 360         if [ ! -f "./testout.pcap" ]; then
 361                 test_step_failed "No output file!"
 362                 return
 363         fi
 364
 365         # use tshark to filter out all packets, which are larger than 68 bytes
 366         $TSHARK -r ./testout.pcap -w ./testout2.pcap -R 'frame.cap_len>68' > ./testout.txt 2>&1
 367
 368         # ok, we got a capture file, does it contain exactly 0 packets?
 369         $CAPINFOS ./testout2.pcap > ./testout.txt
 370         grep -Ei 'Number of packets:[[:blank:]]+0' ./testout.txt > /dev/null
 371         if [ $? -eq 0 ]; then
 372                 test_step_ok
 373         else
 374                 echo
 375                 cat ./testout.txt
 376                 test_step_failed "Capture file should contain zero packets!"
 377                 return
 378         fi
 379 }
 380
 381 wireshark_capture_suite() {
 382         # Q: quit after cap, k: start capture immediately
 383         DUT="$WIRESHARK -Q -k"
 384         test_step_add "Capture 10 packets" capture_step_10packets
 385         # piping to stdout doesn't work with Wireshark and capturing!
 386         #test_step_add "Capture 10 packets using stdout: -w -" capture_step_10packets_stdout
 387         if [ $TEST_FIFO ]; then
 388                 test_step_add "Capture via fifo" capture_step_fifo
 389         fi
 390         test_step_add "Capture via stdin" capture_step_stdin
 391         # read filter doesn't work with Wireshark and capturing!
 392         #test_step_add "Capture read filter (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_read_filter
 393         test_step_add "Capture snapshot length 68 bytes (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_snapshot
 394 }
 395
 396 tshark_capture_suite() {
 397         DUT=$TSHARK
 398         test_step_add "Capture 10 packets" capture_step_10packets
 399         test_step_add "Capture 10 packets using stdout: -w -" capture_step_10packets_stdout
 400         if [ $TEST_FIFO ]; then
 401                 test_step_add "Capture via fifo" capture_step_fifo
 402         fi
 403         test_step_add "Capture via stdin" capture_step_stdin
 404         # tshark now using dumpcap for capturing, read filters won't work by definition
 405         #test_step_add "Capture read filter (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_read_filter
 406         test_step_add "Capture snapshot length 68 bytes (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_snapshot
 407 }
 408
 409 dumpcap_capture_suite() {
 410         #DUT="$DUMPCAP -Q"
 411         DUT=$DUMPCAP
 412         test_step_add "Capture 10 packets" capture_step_10packets
 413         test_step_add "Capture 10 packets using stdout: -w -" capture_step_10packets_stdout
 414         if [ $TEST_FIFO ]; then
 415                 test_step_add "Capture via fifo" capture_step_fifo
 416         fi
 417         test_step_add "Capture via stdin" capture_step_stdin
 418         # read (display) filters intentionally doesn't work with dumpcap!
 419         #test_step_add "Capture read filter (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_read_filter
 420         test_step_add "Capture snapshot length 68 bytes (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_snapshot
 421 }
 422
 423 capture_cleanup_step() {
 424         ping_cleanup
 425         rm -f ./testout.txt
 426         rm -f ./testout2.txt
 427         rm -f ./testout.pcap
 428         rm -f ./testout2.pcap
 429 }
 430
 431 capture_suite() {
 432         test_step_set_pre capture_cleanup_step
 433         test_step_set_post capture_cleanup_step
 434         test_remark_add "Capture - need some traffic on interface: \"$TRAFFIC_CAPTURE_IFACE\""
 435         test_suite_add "Dumpcap capture" dumpcap_capture_suite
 436         test_suite_add "TShark capture" tshark_capture_suite
 437         test_suite_add "Wireshark capture" wireshark_capture_suite
 438 }