The Tcpdump Group git mirrors - tcpdump/blob - print.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 #include <config.h>
  30 #endif
  31
  32 #include <stdlib.h>
  33 #include <string.h>
  34
  35 #include "netdissect-stdinc.h"
  36
  37 #include "netdissect.h"
  38 #include "addrtoname.h"
  39 #include "print.h"
  40 #include "netdissect-alloc.h"
  41
  42 #include "pcap-missing.h"
  43
  44 struct printer {
  45         if_printer f;
  46         int type;
  47 };
  48
  49 static const struct printer printers[] = {
  50         { ether_if_print,       DLT_EN10MB },
  51 #ifdef DLT_IPNET
  52         { ipnet_if_print,       DLT_IPNET },
  53 #endif
  54 #ifdef DLT_IEEE802_15_4
  55         { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
  56 #endif
  57 #ifdef DLT_IEEE802_15_4_NOFCS
  58         { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
  59 #endif
  60 #ifdef DLT_IEEE802_15_4_TAP
  61         { ieee802_15_4_tap_if_print, DLT_IEEE802_15_4_TAP },
  62 #endif
  63 #ifdef DLT_PPI
  64         { ppi_if_print,         DLT_PPI },
  65 #endif
  66 #ifdef DLT_NETANALYZER
  67         { netanalyzer_if_print, DLT_NETANALYZER },
  68 #endif
  69 #ifdef DLT_NETANALYZER_TRANSPARENT
  70         { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
  71 #endif
  72 #ifdef DLT_NFLOG
  73         { nflog_if_print,       DLT_NFLOG},
  74 #endif
  75 #ifdef DLT_CIP
  76         { cip_if_print,         DLT_CIP },
  77 #endif
  78 #ifdef DLT_ATM_CLIP
  79         { cip_if_print,         DLT_ATM_CLIP },
  80 #endif
  81 #ifdef DLT_IP_OVER_FC
  82         { ipfc_if_print,        DLT_IP_OVER_FC },
  83 #endif
  84         { null_if_print,        DLT_NULL },
  85 #ifdef DLT_LOOP
  86         { null_if_print,        DLT_LOOP },
  87 #endif
  88 #ifdef DLT_APPLE_IP_OVER_IEEE1394
  89         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
  90 #endif
  91 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
  92         { bt_if_print,          DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
  93 #endif
  94 #ifdef DLT_LANE8023
  95         { lane_if_print,        DLT_LANE8023 },
  96 #endif
  97         { arcnet_if_print,      DLT_ARCNET },
  98 #ifdef DLT_ARCNET_LINUX
  99         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
 100 #endif
 101         { raw_if_print,         DLT_RAW },
 102 #ifdef DLT_IPV4
 103         { raw_if_print,         DLT_IPV4 },
 104 #endif
 105 #ifdef DLT_IPV6
 106         { raw_if_print,         DLT_IPV6 },
 107 #endif
 108 #ifdef DLT_USB_LINUX
 109         { usb_linux_48_byte_if_print, DLT_USB_LINUX},
 110 #endif /* DLT_USB_LINUX */
 111 #ifdef DLT_USB_LINUX_MMAPPED
 112         { usb_linux_64_byte_if_print, DLT_USB_LINUX_MMAPPED},
 113 #endif /* DLT_USB_LINUX_MMAPPED */
 114 #ifdef DLT_SYMANTEC_FIREWALL
 115         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 116 #endif
 117 #ifdef DLT_C_HDLC
 118         { chdlc_if_print,       DLT_C_HDLC },
 119 #endif
 120 #ifdef DLT_HDLC
 121         { chdlc_if_print,       DLT_HDLC },
 122 #endif
 123 #ifdef DLT_PPP_ETHER
 124         { pppoe_if_print,       DLT_PPP_ETHER },
 125 #endif
 126 #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
 127         { pflog_if_print,       DLT_PFLOG },
 128 #endif
 129         { token_if_print,       DLT_IEEE802 },
 130         { fddi_if_print,        DLT_FDDI },
 131 #ifdef DLT_LINUX_SLL
 132         { sll_if_print,         DLT_LINUX_SLL },
 133 #endif
 134 #ifdef DLT_LINUX_SLL2
 135         { sll2_if_print,        DLT_LINUX_SLL2 },
 136 #endif
 137 #ifdef DLT_FR
 138         { fr_if_print,          DLT_FR },
 139 #endif
 140 #ifdef DLT_FRELAY
 141         { fr_if_print,          DLT_FRELAY },
 142 #endif
 143 #ifdef DLT_MFR
 144         { mfr_if_print,         DLT_MFR },
 145 #endif
 146         { atm_if_print,         DLT_ATM_RFC1483 },
 147 #ifdef DLT_SUNATM
 148         { sunatm_if_print,      DLT_SUNATM },
 149 #endif
 150 #ifdef DLT_ENC
 151         { enc_if_print,         DLT_ENC },
 152 #endif
 153         { sl_if_print,          DLT_SLIP },
 154 #ifdef DLT_SLIP_BSDOS
 155         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 156 #endif
 157 #ifdef DLT_LTALK
 158         { ltalk_if_print,       DLT_LTALK },
 159 #endif
 160 #ifdef DLT_JUNIPER_ATM1
 161         { juniper_atm1_if_print, DLT_JUNIPER_ATM1 },
 162 #endif
 163 #ifdef DLT_JUNIPER_ATM2
 164         { juniper_atm2_if_print, DLT_JUNIPER_ATM2 },
 165 #endif
 166 #ifdef DLT_JUNIPER_MFR
 167         { juniper_mfr_if_print, DLT_JUNIPER_MFR },
 168 #endif
 169 #ifdef DLT_JUNIPER_MLFR
 170         { juniper_mlfr_if_print, DLT_JUNIPER_MLFR },
 171 #endif
 172 #ifdef DLT_JUNIPER_MLPPP
 173         { juniper_mlppp_if_print, DLT_JUNIPER_MLPPP },
 174 #endif
 175 #ifdef DLT_JUNIPER_PPPOE
 176         { juniper_pppoe_if_print, DLT_JUNIPER_PPPOE },
 177 #endif
 178 #ifdef DLT_JUNIPER_PPPOE_ATM
 179         { juniper_pppoe_atm_if_print, DLT_JUNIPER_PPPOE_ATM },
 180 #endif
 181 #ifdef DLT_JUNIPER_GGSN
 182         { juniper_ggsn_if_print, DLT_JUNIPER_GGSN },
 183 #endif
 184 #ifdef DLT_JUNIPER_ES
 185         { juniper_es_if_print,  DLT_JUNIPER_ES },
 186 #endif
 187 #ifdef DLT_JUNIPER_MONITOR
 188         { juniper_monitor_if_print, DLT_JUNIPER_MONITOR },
 189 #endif
 190 #ifdef DLT_JUNIPER_SERVICES
 191         { juniper_services_if_print, DLT_JUNIPER_SERVICES },
 192 #endif
 193 #ifdef DLT_JUNIPER_ETHER
 194         { juniper_ether_if_print,       DLT_JUNIPER_ETHER },
 195 #endif
 196 #ifdef DLT_JUNIPER_PPP
 197         { juniper_ppp_if_print, DLT_JUNIPER_PPP },
 198 #endif
 199 #ifdef DLT_JUNIPER_FRELAY
 200         { juniper_frelay_if_print,      DLT_JUNIPER_FRELAY },
 201 #endif
 202 #ifdef DLT_JUNIPER_CHDLC
 203         { juniper_chdlc_if_print,       DLT_JUNIPER_CHDLC },
 204 #endif
 205 #ifdef DLT_PKTAP
 206         { pktap_if_print,       DLT_PKTAP },
 207 #endif
 208 #ifdef DLT_IEEE802_11_RADIO
 209         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 210 #endif
 211 #ifdef DLT_IEEE802_11
 212         { ieee802_11_if_print,  DLT_IEEE802_11},
 213 #endif
 214 #ifdef DLT_IEEE802_11_RADIO_AVS
 215         { ieee802_11_radio_avs_if_print,        DLT_IEEE802_11_RADIO_AVS },
 216 #endif
 217 #ifdef DLT_PRISM_HEADER
 218         { prism_if_print,       DLT_PRISM_HEADER },
 219 #endif
 220         { ppp_if_print,         DLT_PPP },
 221 #ifdef DLT_PPP_WITHDIRECTION
 222         { ppp_if_print,         DLT_PPP_WITHDIRECTION },
 223 #endif
 224 #ifdef DLT_PPP_BSDOS
 225         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 226 #endif
 227 #ifdef DLT_PPP_SERIAL
 228         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 229 #endif
 230 #ifdef DLT_DSA_TAG_BRCM
 231         { brcm_tag_if_print,    DLT_DSA_TAG_BRCM },
 232 #endif
 233 #ifdef DLT_DSA_TAG_BRCM_PREPEND
 234         { brcm_tag_prepend_if_print, DLT_DSA_TAG_BRCM_PREPEND },
 235 #endif
 236         { NULL,                 0 },
 237 };
 238
 239 static void     ndo_default_print(netdissect_options *ndo, const u_char *bp,
 240                     u_int length);
 241
 242 static void NORETURN ndo_error(netdissect_options *ndo,
 243                      status_exit_codes_t status,
 244                      FORMAT_STRING(const char *fmt), ...)
 245                      PRINTFLIKE(3, 4);
 246 static void     ndo_warning(netdissect_options *ndo,
 247                     FORMAT_STRING(const char *fmt), ...)
 248                     PRINTFLIKE(2, 3);
 249
 250 static int      ndo_printf(netdissect_options *ndo,
 251                      FORMAT_STRING(const char *fmt), ...)
 252                      PRINTFLIKE(2, 3);
 253
 254 void
 255 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
 256 {
 257
 258         init_addrtoname(ndo, localnet, mask);
 259         init_checksum();
 260 }
 261
 262 if_printer
 263 lookup_printer(int type)
 264 {
 265         const struct printer *p;
 266
 267         for (p = printers; p->f; ++p)
 268                 if (type == p->type)
 269                         return p->f;
 270
 271 #if defined(DLT_USER2) && defined(DLT_PKTAP)
 272         /*
 273          * Apple incorrectly chose to use DLT_USER2 for their PKTAP
 274          * header.
 275          *
 276          * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
 277          * based OSes or the same value as LINKTYPE_PKTAP as it is on
 278          * other OSes, to LINKTYPE_PKTAP, so files written with
 279          * this version of libpcap for a DLT_PKTAP capture have a link-
 280          * layer header type of LINKTYPE_PKTAP.
 281          *
 282          * However, files written on OS X Mavericks for a DLT_PKTAP
 283          * capture have a link-layer header type of LINKTYPE_USER2.
 284          * If we don't have a printer for DLT_USER2, and type is
 285          * DLT_USER2, we look up the printer for DLT_PKTAP and use
 286          * that.
 287          */
 288         if (type == DLT_USER2) {
 289                 for (p = printers; p->f; ++p)
 290                         if (DLT_PKTAP == p->type)
 291                                 return p->f;
 292         }
 293 #endif
 294
 295         return NULL;
 296         /* NOTREACHED */
 297 }
 298
 299 int
 300 has_printer(int type)
 301 {
 302         return (lookup_printer(type) != NULL);
 303 }
 304
 305 if_printer
 306 get_if_printer(netdissect_options *ndo, int type)
 307 {
 308         const char *dltname;
 309         if_printer printer;
 310
 311         printer = lookup_printer(type);
 312         if (printer == NULL) {
 313                 dltname = pcap_datalink_val_to_name(type);
 314                 if (dltname != NULL)
 315                         (*ndo->ndo_error)(ndo, S_ERR_ND_NO_PRINTER,
 316                                           "packet printing is not supported for link type %s: use -w",
 317                                           dltname);
 318                 else
 319                         (*ndo->ndo_error)(ndo, S_ERR_ND_NO_PRINTER,
 320                                           "packet printing is not supported for link type %d: use -w", type);
 321         }
 322         return printer;
 323 }
 324
 325 void
 326 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
 327                     const u_char *sp, u_int packets_captured)
 328 {
 329         u_int hdrlen;
 330         int invalid_header = 0;
 331
 332         if (ndo->ndo_packet_number)
 333                 ND_PRINT("%5u  ", packets_captured);
 334
 335         /* Sanity checks on packet length / capture length */
 336         if (h->caplen == 0) {
 337                 invalid_header = 1;
 338                 ND_PRINT("[Invalid header: caplen==0");
 339         }
 340         if (h->len == 0) {
 341                 if (!invalid_header) {
 342                         invalid_header = 1;
 343                         ND_PRINT("[Invalid header:");
 344                 } else
 345                         ND_PRINT(",");
 346                 ND_PRINT(" len==0");
 347         } else if (h->len < h->caplen) {
 348                 if (!invalid_header) {
 349                         invalid_header = 1;
 350                         ND_PRINT("[Invalid header:");
 351                 } else
 352                         ND_PRINT(",");
 353                 ND_PRINT(" len(%u) < caplen(%u)", h->len, h->caplen);
 354         }
 355         if (h->caplen > MAXIMUM_SNAPLEN) {
 356                 if (!invalid_header) {
 357                         invalid_header = 1;
 358                         ND_PRINT("[Invalid header:");
 359                 } else
 360                         ND_PRINT(",");
 361                 ND_PRINT(" caplen(%u) > %u", h->caplen, MAXIMUM_SNAPLEN);
 362         }
 363         if (h->len > MAXIMUM_SNAPLEN) {
 364                 if (!invalid_header) {
 365                         invalid_header = 1;
 366                         ND_PRINT("[Invalid header:");
 367                 } else
 368                         ND_PRINT(",");
 369                 ND_PRINT(" len(%u) > %u", h->len, MAXIMUM_SNAPLEN);
 370         }
 371         if (invalid_header) {
 372                 ND_PRINT("]\n");
 373                 return;
 374         }
 375
 376         /*
 377          * At this point:
 378          *   capture length != 0,
 379          *   packet length != 0,
 380          *   capture length <= MAXIMUM_SNAPLEN,
 381          *   packet length <= MAXIMUM_SNAPLEN,
 382          *   packet length >= capture length.
 383          *
 384          * Currently, there is no D-Bus printer, thus no need for
 385          * bigger lengths.
 386          */
 387
 388         ts_print(ndo, &h->ts);
 389
 390         /*
 391          * Printers must check that they're not walking off the end of
 392          * the packet.
 393          * Rather than pass it all the way down, we set this member
 394          * of the netdissect_options structure.
 395          */
 396         ndo->ndo_snapend = sp + h->caplen;
 397
 398         hdrlen = (ndo->ndo_if_printer)(ndo, h, sp);
 399
 400         /*
 401          * Restore the original snapend, as a printer might have
 402          * changed it.
 403          */
 404         ndo->ndo_snapend = sp + h->caplen;
 405         if (ndo->ndo_Xflag) {
 406                 /*
 407                  * Print the raw packet data in hex and ASCII.
 408                  */
 409                 if (ndo->ndo_Xflag > 1) {
 410                         /*
 411                          * Include the link-layer header.
 412                          */
 413                         hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
 414                 } else {
 415                         /*
 416                          * Don't include the link-layer header - and if
 417                          * we have nothing past the link-layer header,
 418                          * print nothing.
 419                          */
 420                         if (h->caplen > hdrlen)
 421                                 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
 422                                                     h->caplen - hdrlen);
 423                 }
 424         } else if (ndo->ndo_xflag) {
 425                 /*
 426                  * Print the raw packet data in hex.
 427                  */
 428                 if (ndo->ndo_xflag > 1) {
 429                         /*
 430                          * Include the link-layer header.
 431                          */
 432                         hex_print(ndo, "\n\t", sp, h->caplen);
 433                 } else {
 434                         /*
 435                          * Don't include the link-layer header - and if
 436                          * we have nothing past the link-layer header,
 437                          * print nothing.
 438                          */
 439                         if (h->caplen > hdrlen)
 440                                 hex_print(ndo, "\n\t", sp + hdrlen,
 441                                           h->caplen - hdrlen);
 442                 }
 443         } else if (ndo->ndo_Aflag) {
 444                 /*
 445                  * Print the raw packet data in ASCII.
 446                  */
 447                 if (ndo->ndo_Aflag > 1) {
 448                         /*
 449                          * Include the link-layer header.
 450                          */
 451                         ascii_print(ndo, sp, h->caplen);
 452                 } else {
 453                         /*
 454                          * Don't include the link-layer header - and if
 455                          * we have nothing past the link-layer header,
 456                          * print nothing.
 457                          */
 458                         if (h->caplen > hdrlen)
 459                                 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
 460                 }
 461         }
 462
 463         ND_PRINT("\n");
 464         nd_free_all(ndo);
 465 }
 466
 467 /*
 468  * By default, print the specified data out in hex and ASCII.
 469  */
 470 static void
 471 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
 472 {
 473         hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
 474 }
 475
 476 /* VARARGS */
 477 static void
 478 ndo_error(netdissect_options *ndo, status_exit_codes_t status,
 479           const char *fmt, ...)
 480 {
 481         va_list ap;
 482
 483         if (ndo->program_name)
 484                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 485         va_start(ap, fmt);
 486         (void)vfprintf(stderr, fmt, ap);
 487         va_end(ap);
 488         if (*fmt) {
 489                 fmt += strlen(fmt);
 490                 if (fmt[-1] != '\n')
 491                         (void)fputc('\n', stderr);
 492         }
 493         nd_cleanup();
 494         exit(status);
 495         /* NOTREACHED */
 496 }
 497
 498 /* VARARGS */
 499 static void
 500 ndo_warning(netdissect_options *ndo, const char *fmt, ...)
 501 {
 502         va_list ap;
 503
 504         if (ndo->program_name)
 505                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 506         (void)fprintf(stderr, "WARNING: ");
 507         va_start(ap, fmt);
 508         (void)vfprintf(stderr, fmt, ap);
 509         va_end(ap);
 510         if (*fmt) {
 511                 fmt += strlen(fmt);
 512                 if (fmt[-1] != '\n')
 513                         (void)fputc('\n', stderr);
 514         }
 515 }
 516
 517 static int
 518 ndo_printf(netdissect_options *ndo, const char *fmt, ...)
 519 {
 520         va_list args;
 521         int ret;
 522
 523         va_start(args, fmt);
 524         ret = vfprintf(stdout, fmt, args);
 525         va_end(args);
 526
 527         if (ret < 0)
 528                 ndo_error(ndo, S_ERR_ND_WRITE_FILE,
 529                           "Unable to write output: %s", pcap_strerror(errno));
 530         return (ret);
 531 }
 532
 533 void
 534 ndo_set_function_pointers(netdissect_options *ndo)
 535 {
 536         ndo->ndo_default_print=ndo_default_print;
 537         ndo->ndo_printf=ndo_printf;
 538         ndo->ndo_error=ndo_error;
 539         ndo->ndo_warning=ndo_warning;
 540 }