Re: [netsniff-ng] trafgen cfg: automatically padding dynamic values to sizes larger than 1 octet

[Vadim Kochan]

On Thu, Oct 20, 2016 at 05:58:12AM -0700, Eddy G wrote:
> It does not seem like it is possible to do something like:
> 
> const16(dinc(1,1023))
> 
> because 1) dinc() and ddec() are limited to single octets, and 2) you can't 
> nest dinc() or ddec() inside the c* helpers.
> 
> The above would be useful to allow a dynamic trafgen cfg that iterates 
> through a range of source/destination ports (for example).
> 
> Is expanding dinc()/ddec() to allow values larger than an octet and 
> "nesting" of other helper functions inside the c*() helpers something that 
> has been discussed?
> 
> Or perhaps a plan to add dinc16() / ddec16(), dinc32()/ddec32(), etc.?
> 
> 
> Also, the new protocol header functions are terrific, but are limited by 
> their inability to prevent more complex / partial dynamic configuration 
> parameters as values. For example:
> 
> eth(da=00:53:00:dinc(0,1):drnd(2))
> ipv4(da=1.2.drnd(2))
> 
> Any possibility this is something that has been discussed? Such partial 
> constructs would be *very* useful in generating randomized traffic for 
> testing purposes.
> 
> 
> Thanks,
> Eddy
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "netsniff-ng" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to netsniff-ng+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.


Hi Eddy,

I added ability to specify proto function at specified field's offset:

[:]

 - starts from 0 byte in network order

 - length of value which will be used which might be 1,2 or 4
 bytes (default 1 byte).

Changes added already into master, I have sent separate patch for
trafgen's man page regarding these changes. The similar syntax is used
in pcap filter to match headers field by offset & length. Here are some
examples with trafgen and output from netsniff-ng for better understand
how it can be used:


1) trafgen -o lo --cpus 1 -n 1 '{ eth(da[0]=dinc(), da=11:22:33:44:55:66), 
tcp() }'

P lo 54 1482259546s.934331688ns #1 
 [ Eth MAC (00:00:00:00:00:00 => 00:22:33:44:55:66)


2) trafgen -o lo --cpus 1 -n 1 '{ eth(da=11:22:33:44:55:66, da[0]=dinc()), 
tcp() }'

M lo 54 1482259682s.24357875ns #2 
 [ Eth MAC (00:00:00:00:00:00 => 11:22:33:44:55:66)

3) trafgen -o lo --cpus 1 -n 3 '{ eth(da=11:22:33:44:55:66, da[0]=dinc()), 
tcp() }'

M lo 54 1482259851s.161018621ns #3 
 [ Eth MAC (00:00:00:00:00:00 => 11:22:33:44:55:66)

P lo 54 1482259851s.161032201ns #4 
 [ Eth MAC (00:00:00:00:00:00 => 12:22:33:44:55:66)

M lo 54 1482259851s.161033977ns #5 
 [ Eth MAC (00:00:00:00:00:00 => 13:22:33:44:55:66)

4) trafgen -o lo --cpus 1 -n 3 '{ ipv4(da=1.2.3.4, da[0]=dinc()), tcp() }'

< lo 54 1482265434s.453794790ns #1 
 [ IPv4 Addr (127.0.0.1 => 1.2.3.4)

< lo 54 1482265434s.453811528ns #2 
 [ IPv4 Addr (127.0.0.1 => 2.2.3.4)

< lo 54 1482265434s.453815331ns #3 
 [ IPv4 Addr (127.0.0.1 => 3.2.3.4)

5) trafgen -o lo --cpus 1 -n 3 '{ ipv4(da=192.168.1.1, da[1]=dinc()), tcp() }'

< lo 54 1482265603s.917104425ns #4 
 [ IPv4 Addr (127.0.0.1 => 192.168.1.1)

< lo 54 1482265603s.917122777ns #5 
 [ IPv4 Addr (127.0.0.1 => 192.169.1.1)

< lo 54 1482265603s.917127151ns #6 
 [ IPv4 Addr (127.0.0.1 => 192.170.1.1)


As you see you need to 1st set initial field value and then set this
field with dynamic function at specific offset, we will try to implement
some better short alternative syntax.

Let me know if you have some comments/suggestions.

Regards,
Vadim Kochan

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[netsniff-ng] [PATCH v3] man: trafgen: Add short description about field offset using

[Vadim Kochan]

Add short note about field offset syntax with an example.

Signed-off-by: Vadim Kochan 
---
v2:
Change commit messages and man file that field offset expression
is used with function expression, and added validation for it in trafgen 
parser.

v3:
Add some examples with new field offset syntax.
Mention syntax was used from pcap filter.

 trafgen.8 | 43 +++
 1 file changed, 43 insertions(+)

diff --git a/trafgen.8 b/trafgen.8
index 62716bb..c633398 100644
--- a/trafgen.8
+++ b/trafgen.8
@@ -329,6 +329,49 @@ Example of using dynamic functions:
 .in -4
 
 .sp
+Field might be set with a function at a specific offset within a field:
+.sp
+.in +4
+[] | [:]
+.sp
+.in +4
+ - relative field's offset with range 0.. - 1
+.sp
+ - length/size of the value which will be set - 1,2 or 4 bytes 
(default: 1).
+.in -4
+.sp
+The  starts from the 1st field's byte in the network order.
+.sp
+The syntax is similar which is used in pcap filter (man pcap-filter) for 
matching
+header field at a specified offset.
+.sp
+Examples of using field offset with a shortified output from netsniff-ng tool:
+.sp
+.in +4
+1) trafgen -o lo --cpus 1 -n 3 '{ eth(da=11:22:33:44:55:66, da[0]=dinc()), 
tcp() }'
+
+.in +4
+[ Eth MAC (00:00:00:00:00:00 => 11:22:33:44:55:66)
+
+[ Eth MAC (00:00:00:00:00:00 => 12:22:33:44:55:66)
+
+[ Eth MAC (00:00:00:00:00:00 => 13:22:33:44:55:66)
+.in -4
+
+2) trafgen -o lo --cpus 1 -n 3 '{ ipv4(da=1.2.3.4, da[0]=dinc()), tcp() }'
+
+.in +4
+[ IPv4 Addr (127.0.0.1 => 1.2.3.4)
+
+[ IPv4 Addr (127.0.0.1 => 2.2.3.4)
+
+[ IPv4 Addr (127.0.0.1 => 3.2.3.4)
+.in -4
+
+.in -4
+.in -4
+
+.sp
 All required lower layer headers will be filled automatically if they were not
 specified by the user. The headers will be filled in the order they were
 specified. Each header will be filled with some mimimum required set of fields.
-- 
2.10.2

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[netsniff-ng] Re: [PATCH v2 6/7] trafgen: parser: Allow to set function at field offset

[Tobias Klauser]

On 2016-12-21 at 10:13:03 +0100, Vadim Kochan  wrote:
> On Wed, Dec 21, 2016 at 10:17:17AM +0100, Tobias Klauser wrote:
> > On 2016-12-20 at 22:10:54 +0100, Vadim Kochan  wrote:
> > > On Tue, Dec 20, 2016 at 12:33:47PM +0100, Tobias Klauser wrote:
[...]
> > > > And third, it's not immediately intuitive to which item the index
> > > > refers, i.e. is the MAC address ab:bb:cc:dd:ee:ff afterwards or
> > > > aa:bb:cc:dd:ee:00?
> > > 
> > > Indexing starts from 0 byte in the network order, please see a below 
> > > examples of
> > > trafgen + netsniff-ng outputs:
> > 
> > Ok. Could you please mention this fact (that indices start from byte 0
> > in network order) in the man page?
> > 
> 
> Hm, actually I did it in the man patch, but may be too shortly ...

Oops, sorry. I obviously didn't read the patch careful enough. Maybe you
could add one of the examples to the man page as well to make it
immediately obvious what the result will be?

[...]
> > > > Let me think about this a bit more...
> > > 
> > > I think we can have 1 or 3 different solutions:
> > > 
> > >   1) Current
> > > 
> > >   2) Current + function param default value
> > > 
> > >   3) Array-like
> > 
> > I'll go ahead and apply your series except for the man page patch. Could
> > you please send an update for this one incorporating the changes
> > mentioned above?
> > 
> > From there on we could then think about implementing option 3 in
> > addition...
> > 
> > Thanks a lot!
> 
> Sure I will collect your comments and use them for man page update.

Great, thanks.

Tobias

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.