The Tcpdump Group git mirrors - tcpdump/blob - print-pktap.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include "config.h"
  24 #endif
  25
  26 #include <tcpdump-stdinc.h>
  27
  28 #include "interface.h"
  29 #include "extract.h"
  30
  31 #ifdef DLT_PKTAP
  32
  33 /*
  34  * XXX - these are little-endian in the captures I've seen, but Apple
  35  * no longer make any big-endian machines (Macs use x86, iOS machines
  36  * use ARM and run it little-endian), so that might be by definition
  37  * or they might be host-endian.
  38  *
  39  * If a big-endian PKTAP file ever shows up, and it comes from a
  40  * big-endian machine, presumably these are host-endian, and we need
  41  * to just fetch the fields directly in tcpdump but byte-swap them
  42  * to host byte order in libpcap.
  43  */
  44 typedef struct pktap_header {
  45         uint32_t        pkt_len;        /* length of pktap header */
  46         uint32_t        pkt_rectype;    /* type of record */
  47         uint32_t        pkt_dlt;        /* DLT type of this packet */
  48         char            pkt_ifname[24]; /* interface name */
  49         uint32_t        pkt_flags;
  50         uint32_t        pkt_pfamily;    /* "protocol family" */
  51         uint32_t        pkt_llhdrlen;   /* link-layer header length? */
  52         uint32_t        pkt_lltrlrlen;  /* link-layer trailer length? */
  53         uint32_t        pkt_pid;        /* process ID */
  54         char            pkt_cmdname[20]; /* command name */
  55         uint32_t        pkt_svc_class;  /* "service class" */
  56         uint16_t        pkt_iftype;     /* "interface type" */
  57         uint16_t        pkt_ifunit;     /* unit number of interface? */
  58         uint32_t        pkt_epid;       /* "effective process ID" */
  59         char            pkt_ecmdname[20]; /* "effective command name" */
  60 } pktap_header_t;
  61
  62 /*
  63  * Record types.
  64  */
  65 #define PKT_REC_NONE    0       /* nothing follows the header */
  66 #define PKT_REC_PACKET  1       /* a packet follows the header */
  67
  68 static inline void
  69 pktap_header_print(netdissect_options *ndo, const u_char *bp, u_int length)
  70 {
  71         const pktap_header_t *hdr;
  72         uint32_t dlt, hdrlen;
  73
  74         hdr = (const pktap_header_t *)bp;
  75
  76         dlt = EXTRACT_LE_32BITS(&hdr->pkt_dlt);
  77         hdrlen = EXTRACT_LE_32BITS(&hdr->pkt_len);
  78         if (!ndo->ndo_qflag) {
  79                 ND_PRINT((ndo,", DLT %s (%d) len %d",
  80                           pcap_datalink_val_to_name(dlt), dlt, hdrlen));
  81         } else {
  82                 ND_PRINT((ndo,", %s", pcap_datalink_val_to_name(dlt)));
  83         }
  84
  85         ND_PRINT((ndo, ", length %u: ", length));
  86 }
  87
  88 /*
  89  * This is the top level routine of the printer.  'p' points
  90  * to the ether header of the packet, 'h->ts' is the timestamp,
  91  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
  92  * is the number of bytes actually captured.
  93  */
  94 u_int
  95 pktap_if_print(netdissect_options *ndo,
  96                const struct pcap_pkthdr *h, const u_char *p)
  97 {
  98         uint32_t dlt, hdrlen, rectype;
  99         u_int caplen = h->caplen;
 100         u_int length = h->len;
 101         if_printer printer;
 102         const pktap_header_t *hdr;
 103
 104         if (caplen < sizeof(pktap_header_t) || length < sizeof(pktap_header_t)) {
 105                 ND_PRINT((ndo, "[|pktap]"));
 106                 return (0);
 107         }
 108         hdr = (const pktap_header_t *)p;
 109         dlt = EXTRACT_LE_32BITS(&hdr->pkt_dlt);
 110         hdrlen = EXTRACT_LE_32BITS(&hdr->pkt_len);
 111         if (hdrlen < sizeof(pktap_header_t)) {
 112                 /*
 113                  * Claimed header length < structure length.
 114                  * XXX - does this just mean some fields aren't
 115                  * being supplied, or is it truly an error (i.e.,
 116                  * is the length supplied so that the header can
 117                  * be expanded in the future)?
 118                  */
 119                 ND_PRINT((ndo, "[|pktap]"));
 120                 return (0);
 121         }
 122         if (caplen < hdrlen || length < hdrlen) {
 123                 ND_PRINT((ndo, "[|pktap]"));
 124                 return (hdrlen);
 125         }
 126
 127         if (ndo->ndo_eflag)
 128                 pktap_header_print(ndo, p, length);
 129
 130         length -= hdrlen;
 131         caplen -= hdrlen;
 132         p += hdrlen;
 133
 134         rectype = EXTRACT_LE_32BITS(&hdr->pkt_rectype);
 135         switch (rectype) {
 136
 137         case PKT_REC_NONE:
 138                 ND_PRINT((ndo, "no data"));
 139                 break;
 140
 141         case PKT_REC_PACKET:
 142                 if ((printer = lookup_printer(dlt)) != NULL) {
 143                         hdrlen += printer(ndo, h, p);
 144                 } else {
 145                         if (!ndo->ndo_eflag)
 146                                 pktap_header_print(ndo, (const u_char *)hdr,
 147                                                 length + hdrlen);
 148
 149                         if (!ndo->ndo_suppress_default_print)
 150                                 ND_DEFAULTPRINT(p, caplen);
 151                 }
 152                 break;
 153         }
 154
 155         return (hdrlen);
 156 }
 157
 158 /*
 159  * Local Variables:
 160  * c-style: whitesmith
 161  * c-basic-offset: 8
 162  * End:
 163  */
 164
 165 #endif /* DLT_PKTAP */