The Tcpdump Group git mirrors - tcpdump/blob - print-pktap.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 /* \summary: Apple's DLT_PKTAP printer */
  23
  24 #ifdef HAVE_CONFIG_H
  25 #include <config.h>
  26 #endif
  27
  28 #include "netdissect-stdinc.h"
  29
  30 #define ND_LONGJMP_FROM_TCHECK
  31 #include "netdissect.h"
  32 #include "extract.h"
  33
  34 #ifdef DLT_PKTAP
  35
  36 /*
  37  * XXX - these are little-endian in the captures I've seen, but Apple
  38  * no longer make any big-endian machines (Macs use x86, iOS machines
  39  * use ARM and run it little-endian), so that might be by definition
  40  * or they might be host-endian.
  41  *
  42  * If a big-endian PKTAP file ever shows up, and it comes from a
  43  * big-endian machine, presumably these are host-endian, and we need
  44  * to just fetch the fields directly in tcpdump but byte-swap them
  45  * to host byte order in libpcap.
  46  */
  47 typedef struct pktap_header {
  48         nd_uint32_t     pkt_len;        /* length of pktap header */
  49         nd_uint32_t     pkt_rectype;    /* type of record */
  50         nd_uint32_t     pkt_dlt;        /* DLT type of this packet */
  51         char            pkt_ifname[24]; /* interface name */
  52         nd_uint32_t     pkt_flags;
  53         nd_uint32_t     pkt_pfamily;    /* "protocol family" */
  54         nd_uint32_t     pkt_llhdrlen;   /* link-layer header length? */
  55         nd_uint32_t     pkt_lltrlrlen;  /* link-layer trailer length? */
  56         nd_uint32_t     pkt_pid;        /* process ID */
  57         char            pkt_cmdname[20]; /* command name */
  58         nd_uint32_t     pkt_svc_class;  /* "service class" */
  59         nd_uint16_t     pkt_iftype;     /* "interface type" */
  60         nd_uint16_t     pkt_ifunit;     /* unit number of interface? */
  61         nd_uint32_t     pkt_epid;       /* "effective process ID" */
  62         char            pkt_ecmdname[20]; /* "effective command name" */
  63 } pktap_header_t;
  64
  65 /*
  66  * Record types.
  67  */
  68 #define PKT_REC_NONE    0       /* nothing follows the header */
  69 #define PKT_REC_PACKET  1       /* a packet follows the header */
  70
  71 static void
  72 pktap_header_print(netdissect_options *ndo, const u_char *bp, u_int length)
  73 {
  74         const pktap_header_t *hdr;
  75         uint32_t dlt, hdrlen;
  76         const char *dltname;
  77
  78         hdr = (const pktap_header_t *)bp;
  79
  80         dlt = GET_LE_U_4(hdr->pkt_dlt);
  81         hdrlen = GET_LE_U_4(hdr->pkt_len);
  82         dltname = pcap_datalink_val_to_name(dlt);
  83         if (!ndo->ndo_qflag) {
  84                 ND_PRINT("DLT %s (%u) len %u",
  85                           (dltname != NULL ? dltname : "UNKNOWN"), dlt, hdrlen);
  86         } else {
  87                 ND_PRINT("%s", (dltname != NULL ? dltname : "UNKNOWN"));
  88         }
  89
  90         ND_PRINT(", length %u: ", length);
  91 }
  92
  93 /*
  94  * This is the top level routine of the printer.  'p' points
  95  * to the ether header of the packet, 'h->ts' is the timestamp,
  96  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
  97  * is the number of bytes actually captured.
  98  */
  99 void
 100 pktap_if_print(netdissect_options *ndo,
 101                const struct pcap_pkthdr *h, const u_char *p)
 102 {
 103         uint32_t dlt, hdrlen, rectype;
 104         u_int caplen = h->caplen;
 105         u_int length = h->len;
 106         if_printer printer;
 107         const pktap_header_t *hdr;
 108         struct pcap_pkthdr nhdr;
 109
 110         ndo->ndo_protocol = "pktap";
 111         if (length < sizeof(pktap_header_t)) {
 112                 ND_PRINT(" (packet too short, %u < %zu)",
 113                          length, sizeof(pktap_header_t));
 114                 goto invalid;
 115         }
 116         hdr = (const pktap_header_t *)p;
 117         dlt = GET_LE_U_4(hdr->pkt_dlt);
 118         hdrlen = GET_LE_U_4(hdr->pkt_len);
 119         if (hdrlen < sizeof(pktap_header_t)) {
 120                 /*
 121                  * Claimed header length < structure length.
 122                  * XXX - does this just mean some fields aren't
 123                  * being supplied, or is it truly an error (i.e.,
 124                  * is the length supplied so that the header can
 125                  * be expanded in the future)?
 126                  */
 127                 ND_PRINT(" (pkt_len too small, %u < %zu)",
 128                          hdrlen, sizeof(pktap_header_t));
 129                 goto invalid;
 130         }
 131         if (hdrlen > length) {
 132                 ND_PRINT(" (pkt_len too big, %u > %u)",
 133                          hdrlen, length);
 134                 goto invalid;
 135         }
 136         ND_TCHECK_LEN(p, hdrlen);
 137
 138         if (ndo->ndo_eflag)
 139                 pktap_header_print(ndo, p, length);
 140
 141         length -= hdrlen;
 142         caplen -= hdrlen;
 143         p += hdrlen;
 144
 145         rectype = GET_LE_U_4(hdr->pkt_rectype);
 146         switch (rectype) {
 147
 148         case PKT_REC_NONE:
 149                 ND_PRINT("no data");
 150                 break;
 151
 152         case PKT_REC_PACKET:
 153                 printer = lookup_printer(dlt);
 154                 if (printer != NULL) {
 155                         nhdr = *h;
 156                         nhdr.caplen = caplen;
 157                         nhdr.len = length;
 158                         printer(ndo, &nhdr, p);
 159                         hdrlen += ndo->ndo_ll_hdr_len;
 160                 } else {
 161                         if (!ndo->ndo_eflag)
 162                                 pktap_header_print(ndo, (const u_char *)hdr,
 163                                                 length + hdrlen);
 164
 165                         if (!ndo->ndo_suppress_default_print)
 166                                 ND_DEFAULTPRINT(p, caplen);
 167                 }
 168                 break;
 169         }
 170
 171         ndo->ndo_ll_hdr_len += hdrlen;
 172         return;
 173
 174 invalid:
 175         nd_print_invalid(ndo);
 176 }
 177 #endif /* DLT_PKTAP */