The Tcpdump Group git mirrors - tcpdump/blob - print.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #include <config.h>
  29
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <setjmp.h>
  33
  34 #include "netdissect-stdinc.h"
  35
  36 #include "netdissect.h"
  37 #include "addrtoname.h"
  38 #include "print.h"
  39 #include "netdissect-alloc.h"
  40
  41 #include "pcap-missing.h"
  42
  43 struct printer {
  44         if_printer f;
  45         int type;
  46 };
  47
  48 static const struct printer printers[] = {
  49 #ifdef DLT_APPLE_IP_OVER_IEEE1394
  50         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
  51 #endif
  52         { arcnet_if_print,      DLT_ARCNET },
  53 #ifdef DLT_ARCNET_LINUX
  54         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
  55 #endif
  56         { atm_if_print,         DLT_ATM_RFC1483 },
  57 #ifdef DLT_DSA_TAG_BRCM
  58         { brcm_tag_if_print,    DLT_DSA_TAG_BRCM },
  59 #endif
  60 #ifdef DLT_DSA_TAG_BRCM_PREPEND
  61         { brcm_tag_prepend_if_print, DLT_DSA_TAG_BRCM_PREPEND },
  62 #endif
  63 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
  64         { bt_if_print,          DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
  65 #endif
  66 #ifdef DLT_C_HDLC
  67         { chdlc_if_print,       DLT_C_HDLC },
  68 #endif
  69 #ifdef DLT_HDLC
  70         { chdlc_if_print,       DLT_HDLC },
  71 #endif
  72 #ifdef DLT_ATM_CLIP
  73         { cip_if_print,         DLT_ATM_CLIP },
  74 #endif
  75 #ifdef DLT_CIP
  76         { cip_if_print,         DLT_CIP },
  77 #endif
  78 #ifdef DLT_DSA_TAG_DSA
  79         { dsa_if_print,         DLT_DSA_TAG_DSA },
  80 #endif
  81 #ifdef DLT_DSA_TAG_EDSA
  82         { edsa_if_print,        DLT_DSA_TAG_EDSA },
  83 #endif
  84 #ifdef DLT_ENC
  85         { enc_if_print,         DLT_ENC },
  86 #endif
  87         { ether_if_print,       DLT_EN10MB },
  88         { fddi_if_print,        DLT_FDDI },
  89 #ifdef DLT_FR
  90         { fr_if_print,          DLT_FR },
  91 #endif
  92 #ifdef DLT_FRELAY
  93         { fr_if_print,          DLT_FRELAY },
  94 #endif
  95 #ifdef DLT_IEEE802_11
  96         { ieee802_11_if_print,  DLT_IEEE802_11},
  97 #endif
  98 #ifdef DLT_IEEE802_11_RADIO_AVS
  99         { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS },
 100 #endif
 101 #ifdef DLT_IEEE802_11_RADIO
 102         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 103 #endif
 104 #ifdef DLT_IEEE802_15_4
 105         { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
 106 #endif
 107 #ifdef DLT_IEEE802_15_4_NOFCS
 108         { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
 109 #endif
 110 #ifdef DLT_IEEE802_15_4_TAP
 111         { ieee802_15_4_tap_if_print, DLT_IEEE802_15_4_TAP },
 112 #endif
 113 #ifdef DLT_IP_OVER_FC
 114         { ipfc_if_print,        DLT_IP_OVER_FC },
 115 #endif
 116 #ifdef DLT_IPNET
 117         { ipnet_if_print,       DLT_IPNET },
 118 #endif
 119 #ifdef DLT_IPOIB
 120         { ipoib_if_print,       DLT_IPOIB },
 121 #endif
 122 #ifdef DLT_JUNIPER_ATM1
 123         { juniper_atm1_if_print, DLT_JUNIPER_ATM1 },
 124 #endif
 125 #ifdef DLT_JUNIPER_ATM2
 126         { juniper_atm2_if_print, DLT_JUNIPER_ATM2 },
 127 #endif
 128 #ifdef DLT_JUNIPER_CHDLC
 129         { juniper_chdlc_if_print,       DLT_JUNIPER_CHDLC },
 130 #endif
 131 #ifdef DLT_JUNIPER_ES
 132         { juniper_es_if_print,  DLT_JUNIPER_ES },
 133 #endif
 134 #ifdef DLT_JUNIPER_ETHER
 135         { juniper_ether_if_print,       DLT_JUNIPER_ETHER },
 136 #endif
 137 #ifdef DLT_JUNIPER_FRELAY
 138         { juniper_frelay_if_print,      DLT_JUNIPER_FRELAY },
 139 #endif
 140 #ifdef DLT_JUNIPER_GGSN
 141         { juniper_ggsn_if_print, DLT_JUNIPER_GGSN },
 142 #endif
 143 #ifdef DLT_JUNIPER_MFR
 144         { juniper_mfr_if_print, DLT_JUNIPER_MFR },
 145 #endif
 146 #ifdef DLT_JUNIPER_MLFR
 147         { juniper_mlfr_if_print, DLT_JUNIPER_MLFR },
 148 #endif
 149 #ifdef DLT_JUNIPER_MLPPP
 150         { juniper_mlppp_if_print, DLT_JUNIPER_MLPPP },
 151 #endif
 152 #ifdef DLT_JUNIPER_MONITOR
 153         { juniper_monitor_if_print, DLT_JUNIPER_MONITOR },
 154 #endif
 155 #ifdef DLT_JUNIPER_PPP
 156         { juniper_ppp_if_print, DLT_JUNIPER_PPP },
 157 #endif
 158 #ifdef DLT_JUNIPER_PPPOE_ATM
 159         { juniper_pppoe_atm_if_print, DLT_JUNIPER_PPPOE_ATM },
 160 #endif
 161 #ifdef DLT_JUNIPER_PPPOE
 162         { juniper_pppoe_if_print, DLT_JUNIPER_PPPOE },
 163 #endif
 164 #ifdef DLT_JUNIPER_SERVICES
 165         { juniper_services_if_print, DLT_JUNIPER_SERVICES },
 166 #endif
 167 #ifdef DLT_LTALK
 168         { ltalk_if_print,       DLT_LTALK },
 169 #endif
 170 #ifdef DLT_MFR
 171         { mfr_if_print,         DLT_MFR },
 172 #endif
 173 #ifdef DLT_NETANALYZER
 174         { netanalyzer_if_print, DLT_NETANALYZER },
 175 #endif
 176 #ifdef DLT_NETANALYZER_TRANSPARENT
 177         { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
 178 #endif
 179 #ifdef DLT_NFLOG
 180         { nflog_if_print,       DLT_NFLOG},
 181 #endif
 182         { null_if_print,        DLT_NULL },
 183 #ifdef DLT_LOOP
 184         { null_if_print,        DLT_LOOP },
 185 #endif
 186 #ifdef DLT_PFLOG
 187         { pflog_if_print,       DLT_PFLOG },
 188 #endif
 189 #ifdef DLT_PKTAP
 190         { pktap_if_print,       DLT_PKTAP },
 191 #endif
 192 #ifdef DLT_PPI
 193         { ppi_if_print,         DLT_PPI },
 194 #endif
 195 #ifdef DLT_PPP_BSDOS
 196         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 197 #endif
 198 #ifdef DLT_PPP_SERIAL
 199         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 200 #endif
 201         { ppp_if_print,         DLT_PPP },
 202 #ifdef DLT_PPP_PPPD
 203         { ppp_if_print,         DLT_PPP_PPPD },
 204 #endif
 205 #ifdef DLT_PPP_ETHER
 206         { pppoe_if_print,       DLT_PPP_ETHER },
 207 #endif
 208 #ifdef DLT_PRISM_HEADER
 209         { prism_if_print,       DLT_PRISM_HEADER },
 210 #endif
 211         { raw_if_print,         DLT_RAW },
 212 #ifdef DLT_IPV4
 213         { raw_if_print,         DLT_IPV4 },
 214 #endif
 215 #ifdef DLT_IPV6
 216         { raw_if_print,         DLT_IPV6 },
 217 #endif
 218 #ifdef DLT_SLIP_BSDOS
 219         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 220 #endif
 221         { sl_if_print,          DLT_SLIP },
 222 #ifdef DLT_LINUX_SLL
 223         { sll_if_print,         DLT_LINUX_SLL },
 224 #endif
 225 #ifdef DLT_LINUX_SLL2
 226         { sll2_if_print,        DLT_LINUX_SLL2 },
 227 #endif
 228 #ifdef DLT_SUNATM
 229         { sunatm_if_print,      DLT_SUNATM },
 230 #endif
 231 #ifdef DLT_SYMANTEC_FIREWALL
 232         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 233 #endif
 234         { token_if_print,       DLT_IEEE802 },
 235 #ifdef DLT_USB_LINUX
 236         { usb_linux_48_byte_if_print, DLT_USB_LINUX},
 237 #endif /* DLT_USB_LINUX */
 238 #ifdef DLT_USB_LINUX_MMAPPED
 239         { usb_linux_64_byte_if_print, DLT_USB_LINUX_MMAPPED},
 240 #endif /* DLT_USB_LINUX_MMAPPED */
 241 #ifdef DLT_VSOCK
 242         { vsock_if_print,       DLT_VSOCK },
 243 #endif
 244         { NULL,                 0 },
 245 };
 246
 247 static void     ndo_default_print(netdissect_options *ndo, const u_char *bp,
 248                     u_int length);
 249
 250 static void NORETURN ndo_error(netdissect_options *ndo,
 251                      status_exit_codes_t status,
 252                      FORMAT_STRING(const char *fmt), ...)
 253                      PRINTFLIKE(3, 4);
 254 static void     ndo_warning(netdissect_options *ndo,
 255                     FORMAT_STRING(const char *fmt), ...)
 256                     PRINTFLIKE(2, 3);
 257
 258 static int      ndo_printf(netdissect_options *ndo,
 259                      FORMAT_STRING(const char *fmt), ...)
 260                      PRINTFLIKE(2, 3);
 261
 262 void
 263 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
 264 {
 265         init_addrtoname(ndo, localnet, mask);
 266 }
 267
 268 if_printer
 269 lookup_printer(int type)
 270 {
 271         const struct printer *p;
 272
 273         for (p = printers; p->f; ++p)
 274                 if (type == p->type)
 275                         return p->f;
 276
 277 #if defined(DLT_USER2) && defined(DLT_PKTAP)
 278         /*
 279          * Apple incorrectly chose to use DLT_USER2 for their PKTAP
 280          * header.
 281          *
 282          * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
 283          * based OSes or the same value as LINKTYPE_PKTAP as it is on
 284          * other OSes, to LINKTYPE_PKTAP, so files written with
 285          * this version of libpcap for a DLT_PKTAP capture have a link-
 286          * layer header type of LINKTYPE_PKTAP.
 287          *
 288          * However, files written on OS X Mavericks for a DLT_PKTAP
 289          * capture have a link-layer header type of LINKTYPE_USER2.
 290          * If we don't have a printer for DLT_USER2, and type is
 291          * DLT_USER2, we look up the printer for DLT_PKTAP and use
 292          * that.
 293          */
 294         if (type == DLT_USER2) {
 295                 for (p = printers; p->f; ++p)
 296                         if (DLT_PKTAP == p->type)
 297                                 return p->f;
 298         }
 299 #endif
 300
 301         return NULL;
 302         /* NOTREACHED */
 303 }
 304
 305 int
 306 has_printer(int type)
 307 {
 308         return (lookup_printer(type) != NULL);
 309 }
 310
 311 if_printer
 312 get_if_printer(int type)
 313 {
 314         if_printer printer;
 315
 316         printer = lookup_printer(type);
 317         if (printer == NULL)
 318                 printer = unsupported_if_print;
 319         return printer;
 320 }
 321
 322 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 323 extern int profile_func_level;
 324 static int pretty_print_packet_level = -1;
 325 #endif
 326
 327 void
 328 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
 329                     const u_char *sp, u_int packets_captured)
 330 {
 331         u_int hdrlen = 0;
 332         int invalid_header = 0;
 333
 334 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 335         if (pretty_print_packet_level == -1)
 336                 pretty_print_packet_level = profile_func_level;
 337 #endif
 338
 339         if (ndo->ndo_packet_number)
 340                 ND_PRINT("%5u  ", packets_captured);
 341
 342         /* Sanity checks on packet length / capture length */
 343         if (h->caplen == 0) {
 344                 invalid_header = 1;
 345                 ND_PRINT("[Invalid header: caplen==0");
 346         }
 347         if (h->len == 0) {
 348                 if (!invalid_header) {
 349                         invalid_header = 1;
 350                         ND_PRINT("[Invalid header:");
 351                 } else
 352                         ND_PRINT(",");
 353                 ND_PRINT(" len==0");
 354         } else if (h->len < h->caplen) {
 355                 if (!invalid_header) {
 356                         invalid_header = 1;
 357                         ND_PRINT("[Invalid header:");
 358                 } else
 359                         ND_PRINT(",");
 360                 ND_PRINT(" len(%u) < caplen(%u)", h->len, h->caplen);
 361         }
 362         if (h->caplen > MAXIMUM_SNAPLEN) {
 363                 if (!invalid_header) {
 364                         invalid_header = 1;
 365                         ND_PRINT("[Invalid header:");
 366                 } else
 367                         ND_PRINT(",");
 368                 ND_PRINT(" caplen(%u) > %u", h->caplen, MAXIMUM_SNAPLEN);
 369         }
 370         if (h->len > MAXIMUM_SNAPLEN) {
 371                 if (!invalid_header) {
 372                         invalid_header = 1;
 373                         ND_PRINT("[Invalid header:");
 374                 } else
 375                         ND_PRINT(",");
 376                 ND_PRINT(" len(%u) > %u", h->len, MAXIMUM_SNAPLEN);
 377         }
 378         if (invalid_header) {
 379                 ND_PRINT("]\n");
 380                 return;
 381         }
 382
 383         /*
 384          * At this point:
 385          *   capture length != 0,
 386          *   packet length != 0,
 387          *   capture length <= MAXIMUM_SNAPLEN,
 388          *   packet length <= MAXIMUM_SNAPLEN,
 389          *   packet length >= capture length.
 390          *
 391          * Currently, there is no D-Bus printer, thus no need for
 392          * bigger lengths.
 393          */
 394
 395         /*
 396          * The header /usr/include/pcap/pcap.h in OpenBSD declares h->ts as
 397          * struct bpf_timeval, not struct timeval. The former comes from
 398          * /usr/include/net/bpf.h and uses 32-bit unsigned types instead of
 399          * the types used in struct timeval.
 400          */
 401         struct timeval tvbuf;
 402         tvbuf.tv_sec = h->ts.tv_sec;
 403         tvbuf.tv_usec = h->ts.tv_usec;
 404         ts_print(ndo, &tvbuf);
 405
 406         /*
 407          * Printers must check that they're not walking off the end of
 408          * the packet.
 409          * Rather than pass it all the way down, we set this member
 410          * of the netdissect_options structure.
 411          */
 412         ndo->ndo_snapend = sp + h->caplen;
 413         ndo->ndo_packetp = sp;
 414
 415         ndo->ndo_protocol = "";
 416         ndo->ndo_ll_hdr_len = 0;
 417         switch (setjmp(ndo->ndo_early_end)) {
 418         case 0:
 419                 /* Print the packet. */
 420                 (ndo->ndo_if_printer)(ndo, h, sp);
 421                 break;
 422         case ND_TRUNCATED:
 423                 /* A printer quit because the packet was truncated; report it */
 424                 nd_print_trunc(ndo);
 425                 /* Print the full packet */
 426                 ndo->ndo_ll_hdr_len = 0;
 427 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 428                 /* truncation => reassignment */
 429                 profile_func_level = pretty_print_packet_level;
 430 #endif
 431                 break;
 432         }
 433         hdrlen = ndo->ndo_ll_hdr_len;
 434
 435         /*
 436          * Empty the stack of packet information, freeing all pushed buffers;
 437          * if we got here by a printer quitting, we need to release anything
 438          * that didn't get released because we longjmped out of the code
 439          * before it popped the packet information.
 440          */
 441         nd_pop_all_packet_info(ndo);
 442
 443         /*
 444          * Restore the originals snapend and packetp, as a printer
 445          * might have changed them.
 446          *
 447          * XXX - nd_pop_all_packet_info() should have restored the
 448          * original values, but, just in case....
 449          */
 450         ndo->ndo_snapend = sp + h->caplen;
 451         ndo->ndo_packetp = sp;
 452         if (ndo->ndo_Xflag) {
 453                 /*
 454                  * Print the raw packet data in hex and ASCII.
 455                  */
 456                 if (ndo->ndo_Xflag > 1) {
 457                         /*
 458                          * Include the link-layer header.
 459                          */
 460                         hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
 461                 } else {
 462                         /*
 463                          * Don't include the link-layer header - and if
 464                          * we have nothing past the link-layer header,
 465                          * print nothing.
 466                          */
 467                         if (h->caplen > hdrlen)
 468                                 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
 469                                                     h->caplen - hdrlen);
 470                 }
 471         } else if (ndo->ndo_xflag) {
 472                 /*
 473                  * Print the raw packet data in hex.
 474                  */
 475                 if (ndo->ndo_xflag > 1) {
 476                         /*
 477                          * Include the link-layer header.
 478                          */
 479                         hex_print(ndo, "\n\t", sp, h->caplen);
 480                 } else {
 481                         /*
 482                          * Don't include the link-layer header - and if
 483                          * we have nothing past the link-layer header,
 484                          * print nothing.
 485                          */
 486                         if (h->caplen > hdrlen)
 487                                 hex_print(ndo, "\n\t", sp + hdrlen,
 488                                           h->caplen - hdrlen);
 489                 }
 490         } else if (ndo->ndo_Aflag) {
 491                 /*
 492                  * Print the raw packet data in ASCII.
 493                  */
 494                 if (ndo->ndo_Aflag > 1) {
 495                         /*
 496                          * Include the link-layer header.
 497                          */
 498                         ascii_print(ndo, sp, h->caplen);
 499                 } else {
 500                         /*
 501                          * Don't include the link-layer header - and if
 502                          * we have nothing past the link-layer header,
 503                          * print nothing.
 504                          */
 505                         if (h->caplen > hdrlen)
 506                                 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
 507                 }
 508         }
 509
 510         ND_PRINT("\n");
 511         nd_free_all(ndo);
 512 }
 513
 514 /*
 515  * By default, print the specified data out in hex and ASCII.
 516  */
 517 static void
 518 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
 519 {
 520         hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
 521 }
 522
 523 /* VARARGS */
 524 static void
 525 ndo_error(netdissect_options *ndo, status_exit_codes_t status,
 526           const char *fmt, ...)
 527 {
 528         va_list ap;
 529
 530         if (ndo->program_name)
 531                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 532         va_start(ap, fmt);
 533         (void)vfprintf(stderr, fmt, ap);
 534         va_end(ap);
 535         if (*fmt) {
 536                 fmt += strlen(fmt);
 537                 if (fmt[-1] != '\n')
 538                         (void)fputc('\n', stderr);
 539         }
 540         nd_cleanup();
 541         exit(status);
 542         /* NOTREACHED */
 543 }
 544
 545 /* VARARGS */
 546 static void
 547 ndo_warning(netdissect_options *ndo, const char *fmt, ...)
 548 {
 549         va_list ap;
 550
 551         if (ndo->program_name)
 552                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 553         (void)fprintf(stderr, "WARNING: ");
 554         va_start(ap, fmt);
 555         (void)vfprintf(stderr, fmt, ap);
 556         va_end(ap);
 557         if (*fmt) {
 558                 fmt += strlen(fmt);
 559                 if (fmt[-1] != '\n')
 560                         (void)fputc('\n', stderr);
 561         }
 562 }
 563
 564 static int
 565 ndo_printf(netdissect_options *ndo, const char *fmt, ...)
 566 {
 567         va_list args;
 568         int ret;
 569
 570         va_start(args, fmt);
 571         ret = vfprintf(stdout, fmt, args);
 572         va_end(args);
 573
 574         if (ret < 0)
 575                 ndo_error(ndo, S_ERR_ND_WRITE_FILE,
 576                           "Unable to write output: %s", pcap_strerror(errno));
 577         return (ret);
 578 }
 579
 580 void
 581 ndo_set_function_pointers(netdissect_options *ndo)
 582 {
 583         ndo->ndo_default_print=ndo_default_print;
 584         ndo->ndo_printf=ndo_printf;
 585         ndo->ndo_error=ndo_error;
 586         ndo->ndo_warning=ndo_warning;
 587 }