Use GNUtls because it is GPL compatible and instead of mbedTLS seems
to have a working non-blocking I/O integration. GNUtls has various
issues that could not be resolved easily:
* Pick spdy as sub protocol
* gmt_time not randomized
* private key loaded to RAM (but not verified)
This is the beginning and not the end. Client support might need more
work with actual tls verification. Maybe more manual x509 cert
verification is needed and maybe client certs don't work at all. I try
to ignore renegotiation as I threw away the key.
Reload x509 creds and keys as they might have changed from one
connection to another.
Change-Id: I9128e14084da1fc2705f858393f98b8133996172
Add the basics for getting a picture what a client and the server
is doing. We need to create unique descriptions as the code is
working with names and not numbers for clients.
Change-Id: I4a9be5bdd815d280cccf0199efc2ca79fc77d393
Add more counters and start counting them when reading from the
PCAP library and when trying to write to the socket.
Change-Id: I52d3064a265b402ac849d8578a14f718156c0805
Count certain events that can help to understand what is going on.
This includes OOM, failure to queues.
Change-Id: I4a2dad32afb577822c7181d2813ea5a7e693c704
To allow easily extracting or streaming the data to an external
analysis system, zeromq can be configured (and reconfigured). The
system works as fire and forget and no loss detection is present.
A simple go based client application is provided to subscribe to
the publisher.
Change-Id: I4f3e6d675023a81b7d2ee19bf1f44a2be0ca003c
We might only want to centralize the data streams but handle the
data differently. This will be combined with an upcoming ZeroMQ
publisher feature to broadcast all events out.
Change-Id: I12c6bf16310820d882fa28c6930931650475e0bb
We need to convert the 64bit timeval on a 64bit userspace (or on
OpenBSD) into a 32bit truncated value for being able to write the
file. This means we have 2038 issue here?
The 2000 as a number is too small. Modern networks can have a
higher MTU (up to 9000). Take this number and assume there is
a big header in front of it.
Allow to inspect UDP messages and check for GPRS, NS, BSSGP
and then filter LLC frames. Parsing the vL datastructure with
the libpcap syntax is a pain. It could be done using BPF but
we do not want to use bpf asm to specify the entire ruleset.
I looked into using libepan/libwireshark but this has memory
issues and is painful too. So let's parse UDP, NS, BSSGP using
the info we already have. I tried a bit of editcap to generate
a bit of broken data. The length check might still be bad.
I used my crash_20100602.pcap file to count the LLC frames we
detect and compare that to wireshark it ended with the right
number.
pcap add-filter gprs
can be used to enable the new filtering option after the OS
has received the packet.
Fixes: ONW#1314
Holger Hans Peter Freyther