test/suite-capture.sh

   1 #!/bin/bash
   2 #
   3 # Test the capture engine of the Wireshark tools
   4 #
   5 # $Id$
   6 #
   7 # Wireshark - Network traffic analyzer
   8 # By Gerald Combs <gerald@wireshark.org>
   9 # Copyright 2005 Ulf Lamping
  10 #
  11 # This program is free software; you can redistribute it and/or
  12 # modify it under the terms of the GNU General Public License
  13 # as published by the Free Software Foundation; either version 2
  14 # of the License, or (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program; if not, writeto the Free Software
  23 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24 #
  25
  26
  27 # common exit status values
  28 EXIT_OK=0
  29 EXIT_COMMAND_LINE=1
  30 EXIT_ERROR=2
  31
  32 capture_test_output_print() {
  33         wait
  34         for f in "$@"; do
  35                 if [[ -f "$f" ]]; then
  36                 printf " --> $f\n"
  37                 cat "$f"
  38                 printf "\n"
  39                 fi
  40         done
  41 }
  42
  43 traffic_gen_ping() {
  44         # Generate some traffic for quiet networks.
  45         # This will have to be adjusted for non-Windows systems.
  46
  47         # the following will run in the background and return immediately
  48         {
  49         date
  50         for (( x=28; x<=58; x++ )) # in effect: number the packets
  51         do
  52                 # How does ping _not_ have a standard set of arguments?
  53                 case $WS_SYSTEM in
  54                         Windows)
  55                                 ping -n 1 -l $x www.wireshark.org       ;;
  56                         SunOS)
  57                                 /usr/sbin/ping www.wireshark.org $x 1           ;;
  58                         *) # *BSD, Linux
  59                                 ping -c 1 -s $x www.wireshark.org       ;;
  60                 esac
  61                 sleep 1
  62         done
  63         date
  64         } > ./testout_ping.txt 2>&1 &
  65 }
  66
  67 ping_cleanup() {
  68         wait
  69         rm -f ./testout_ping.txt
  70 }
  71
  72 # capture exactly 10 packets
  73 capture_step_10packets() {
  74         if [ $SKIP_CAPTURE -ne 0 ] ; then
  75                 test_step_skipped
  76                 return
  77         fi
  78
  79         traffic_gen_ping
  80
  81         date > ./testout.txt
  82         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
  83                 -w ./testout.pcap \
  84                 -c 10  \
  85                 -a duration:$TRAFFIC_CAPTURE_DURATION \
  86                 -f icmp \
  87                 >> ./testout.txt 2>&1
  88         RETURNVALUE=$?
  89         date >> ./testout.txt
  90         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
  91                 echo
  92                 capture_test_output_print ./testout.txt
  93                 # part of the Prerequisite checks
  94                 # wrong interface ? output the possible interfaces
  95                 $TSHARK -D
  96                 test_step_failed "exit status of $DUT: $RETURNVALUE"
  97                 return
  98         fi
  99
 100         # we should have an output file now
 101         if [ ! -f "./testout.pcap" ]; then
 102                 capture_test_output ./testout.txt
 103                 test_step_failed "No output file!"
 104                 return
 105         fi
 106
 107         # ok, we got a capture file, does it contain exactly 10 packets?
 108         $CAPINFOS ./testout.pcap > ./testout2.txt
 109         grep -Ei 'Number of packets:[[:blank:]]+10' ./testout2.txt > /dev/null
 110         if [ $? -eq 0 ]; then
 111                 test_step_ok
 112         else
 113                 echo
 114                 $TSHARK -ta -r ./testout.pcap >> ./testout2.txt
 115                 capture_test_output_print ./testout_ping.txt ./testout.txt ./testout2.txt
 116                 # part of the Prerequisite checks
 117                 # probably wrong interface, output the possible interfaces
 118                 $TSHARK -D
 119                 test_step_failed "No or not enough traffic captured. Probably the wrong interface: $TRAFFIC_CAPTURE_IFACE!"
 120         fi
 121 }
 122
 123 # capture exactly 10 packets using "-w -" (piping to stdout)
 124 capture_step_10packets_stdout() {
 125         if [ $SKIP_CAPTURE -ne 0 ] ; then
 126                 test_step_skipped
 127                 return
 128         fi
 129
 130         traffic_gen_ping
 131
 132         date > ./testout.txt
 133         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 134                 -c 10 \
 135                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 136                 -w - \
 137                 -f icmp \
 138                 > ./testout.pcap 2>>./testout.txt
 139         RETURNVALUE=$?
 140         date >> ./testout.txt
 141         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 142                 echo
 143                 cat ./testout.txt
 144                 $TSHARK -D
 145                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 146                 return
 147         fi
 148
 149         # we should have an output file now
 150         if [ ! -f "./testout.pcap" ]; then
 151                 test_step_failed "No output file!"
 152                 return
 153         fi
 154
 155         # ok, we got a capture file, does it contain exactly 10 packets?
 156         $CAPINFOS ./testout.pcap > ./testout2.txt 2>&1
 157         grep -Ei 'Number of packets:[[:blank:]]+10' ./testout2.txt > /dev/null
 158         if [ $? -eq 0 ]; then
 159                 test_step_ok
 160         else
 161                 echo
 162                 cat ./testout.txt
 163                 cat ./testout2.txt
 164                 $TSHARK -D
 165                 test_step_failed "No or not enough traffic captured. Probably the wrong interface: $TRAFFIC_CAPTURE_IFACE!"
 166         fi
 167 }
 168
 169 # capture packets via a fifo
 170 capture_step_fifo() {
 171         mkfifo 'fifo'
 172         (cat $CAPFILE; sleep 1; tail -c +25 $CAPFILE) > fifo &
 173         $DUT -i fifo $TRAFFIC_CAPTURE_PROMISC \
 174                 -w ./testout.pcap \
 175                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 176                 > ./testout.txt 2>&1
 177         RETURNVALUE=$?
 178         rm 'fifo'
 179         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 180                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 181                 return
 182         fi
 183
 184         # we should have an output file now
 185         if [ ! -f "./testout.pcap" ]; then
 186                 test_step_failed "No output file!"
 187                 return
 188         fi
 189
 190         # ok, we got a capture file, does it contain exactly 8 packets?
 191         $CAPINFOS ./testout.pcap > ./testout.txt
 192         grep -Ei 'Number of packets:[[:blank:]]+8' ./testout.txt > /dev/null
 193         if [ $? -eq 0 ]; then
 194                 test_step_ok
 195         else
 196                 echo
 197                 cat ./testout.txt
 198                 test_step_failed "No or not enough traffic captured."
 199         fi
 200 }
 201
 202 # capture exactly 2 times 10 packets (multiple files)
 203 capture_step_2multi_10packets() {
 204         if [ $SKIP_CAPTURE -ne 0 ] ; then
 205                 test_step_skipped
 206                 return
 207         fi
 208
 209         traffic_gen_ping
 210
 211         date > ./testout.txt
 212         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 213                 -w ./testout.pcap \
 214                 -c 10 \
 215                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 216                 -f icmp \
 217                 >> ./testout.txt 2>&1
 218
 219         RETURNVALUE=$?
 220         date >> ./testout.txt
 221         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 222                 echo
 223                 cat ./testout.txt
 224                 # part of the Prerequisite checks
 225                 # probably wrong interface, output the possible interfaces
 226                 $TSHARK -D
 227                 test_step_failed "exit status of $DUT: $RETURNVALUE"
 228                 return
 229         fi
 230
 231         # we should have an output file now
 232         if [ ! -f "./testout.pcap" ]; then
 233                 test_step_failed "No output file!"
 234                 return
 235         fi
 236
 237         # ok, we got a capture file, does it contain exactly 10 packets?
 238         $CAPINFOS ./testout.pcap > ./testout.txt
 239         grep -Ei 'Number of packets:[[:blank:]]+10' ./testout.txt > /dev/null
 240         if [ $? -eq 0 ]; then
 241                 test_step_ok
 242         else
 243                 echo
 244                 cat ./testout.txt
 245                 test_step_failed "Probably the wrong interface (no traffic captured)!"
 246         fi
 247 }
 248
 249 # capture with a very unlikely read filter, packets must be zero afterwards
 250 capture_step_read_filter() {
 251         if [ $SKIP_CAPTURE -ne 0 ] ; then
 252                 test_step_skipped
 253                 return
 254         fi
 255
 256         traffic_gen_ping
 257
 258         # valid, but very unlikely filter
 259         date > ./testout.txt
 260         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 261                 -w ./testout.pcap \
 262                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 263                 -R 'dcerpc.cn_call_id==123456' \
 264                 -c 10 \
 265                 -f icmp \
 266                 >> ./testout.txt 2>&1
 267         RETURNVALUE=$?
 268         date >> ./testout.txt
 269         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 270                 echo
 271                 cat ./testout.txt
 272                 # part of the Prerequisite checks
 273                 # wrong interface ? output the possible interfaces
 274                 $TSHARK -D
 275                 test_step_failed "exit status: $RETURNVALUE"
 276                 return
 277         fi
 278
 279         # we should have an output file now
 280         if [ ! -f "./testout.pcap" ]; then
 281                 test_step_failed "No output file!"
 282                 return
 283         fi
 284
 285         # ok, we got a capture file, does it contain exactly 0 packets?
 286         $CAPINFOS ./testout.pcap > ./testout.txt
 287         grep -Ei 'Number of packets:[[:blank:]]+0' ./testout.txt > /dev/null
 288         if [ $? -eq 0 ]; then
 289                 test_step_ok
 290         else
 291                 echo
 292                 cat ./testout.txt
 293                 test_step_failed "Capture file should contain zero packets!"
 294         fi
 295 }
 296
 297
 298 # capture with a snapshot length
 299 capture_step_snapshot() {
 300         if [ $SKIP_CAPTURE -ne 0 ] ; then
 301                 test_step_skipped
 302                 return
 303         fi
 304
 305         traffic_gen_ping
 306
 307         # capture with a snapshot length of 68 bytes for $TRAFFIC_CAPTURE_DURATION seconds
 308         # this should result in no packets greater than 68 bytes
 309         date > ./testout.txt
 310         $DUT -i $TRAFFIC_CAPTURE_IFACE $TRAFFIC_CAPTURE_PROMISC \
 311                 -w ./testout.pcap \
 312                 -s 68 \
 313                 -a duration:$TRAFFIC_CAPTURE_DURATION \
 314                 -f icmp \
 315                 >> ./testout.txt 2>&1
 316         RETURNVALUE=$?
 317         date >> ./testout.txt
 318         if [ ! $RETURNVALUE -eq $EXIT_OK ]; then
 319                 echo
 320                 cat ./testout.txt
 321                 # part of the Prerequisite checks
 322                 # wrong interface ? output the possible interfaces
 323                 $TSHARK -D
 324                 test_step_failed "exit status: $RETURNVALUE"
 325                 return
 326         fi
 327
 328         # we should have an output file now
 329         if [ ! -f "./testout.pcap" ]; then
 330                 test_step_failed "No output file!"
 331                 return
 332         fi
 333
 334         # use tshark to filter out all packets, which are larger than 68 bytes
 335         $TSHARK -r ./testout.pcap -w ./testout2.pcap -R 'frame.cap_len>68' > ./testout.txt 2>&1
 336
 337         # ok, we got a capture file, does it contain exactly 0 packets?
 338         $CAPINFOS ./testout2.pcap > ./testout.txt
 339         grep -Ei 'Number of packets:[[:blank:]]+0' ./testout.txt > /dev/null
 340         if [ $? -eq 0 ]; then
 341                 test_step_ok
 342         else
 343                 echo
 344                 cat ./testout.txt
 345                 test_step_failed "Capture file should contain zero packets!"
 346                 return
 347         fi
 348 }
 349
 350 wireshark_capture_suite() {
 351         # Q: quit after cap, k: start capture immediately
 352         DUT="$WIRESHARK -Q -k"
 353         test_step_add "Capture 10 packets" capture_step_10packets
 354         # piping to stdout doesn't work with Wireshark and capturing!
 355         #test_step_add "Capture 10 packets using stdout: -w -" capture_step_10packets_stdout
 356         # read filter doesn't work with Wireshark and capturing!
 357         #test_step_add "Capture read filter (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_read_filter
 358         test_step_add "Capture snapshot length 68 bytes (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_snapshot
 359 }
 360
 361 tshark_capture_suite() {
 362         DUT=$TSHARK
 363         test_step_add "Capture 10 packets" capture_step_10packets
 364         test_step_add "Capture 10 packets using stdout: -w -" capture_step_10packets_stdout
 365         if [ $TEST_FIFO ]; then
 366                 test_step_add "Capture via fifo" capture_step_fifo
 367         fi
 368         # tshark now using dumpcap for capturing, read filters won't work by definition
 369         #test_step_add "Capture read filter (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_read_filter
 370         test_step_add "Capture snapshot length 68 bytes (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_snapshot
 371 }
 372
 373 dumpcap_capture_suite() {
 374         #DUT="$DUMPCAP -Q"
 375         DUT=$DUMPCAP
 376         test_step_add "Capture 10 packets" capture_step_10packets
 377         test_step_add "Capture 10 packets using stdout: -w -" capture_step_10packets_stdout
 378         if [ $TEST_FIFO ]; then
 379                 test_step_add "Capture via fifo" capture_step_fifo
 380         fi
 381         # read (display) filters intentionally doesn't work with dumpcap!
 382         #test_step_add "Capture read filter (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_read_filter
 383         test_step_add "Capture snapshot length 68 bytes (${TRAFFIC_CAPTURE_DURATION}s)" capture_step_snapshot
 384 }
 385
 386 capture_cleanup_step() {
 387         ping_cleanup
 388         rm -f ./testout.txt
 389         rm -f ./testout2.txt
 390         rm -f ./testout.pcap
 391         rm -f ./testout2.pcap
 392 }
 393
 394 capture_suite() {
 395         test_step_set_pre capture_cleanup_step
 396         test_step_set_post capture_cleanup_step
 397         test_remark_add "Capture - need some traffic on interface: \"$TRAFFIC_CAPTURE_IFACE\""
 398         test_suite_add "Dumpcap capture" dumpcap_capture_suite
 399         test_suite_add "TShark capture" tshark_capture_suite
 400         test_suite_add "Wireshark capture" wireshark_capture_suite
 401 }