The Tcpdump Group git mirrors - tcpdump/blob - print.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #include <config.h>
  29
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <setjmp.h>
  33
  34 #include "netdissect-stdinc.h"
  35
  36 #include "netdissect.h"
  37 #include "addrtoname.h"
  38 #include "print.h"
  39 #include "netdissect-alloc.h"
  40
  41 struct printer {
  42         if_printer f;
  43         int type;
  44 };
  45
  46 static const struct printer printers[] = {
  47 #ifdef DLT_APPLE_IP_OVER_IEEE1394
  48         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
  49 #endif
  50         { arcnet_if_print,      DLT_ARCNET },
  51 #ifdef DLT_ARCNET_LINUX
  52         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
  53 #endif
  54         { atm_if_print,         DLT_ATM_RFC1483 },
  55 #ifdef DLT_DSA_TAG_BRCM
  56         { brcm_tag_if_print,    DLT_DSA_TAG_BRCM },
  57 #endif
  58 #ifdef DLT_DSA_TAG_BRCM_PREPEND
  59         { brcm_tag_prepend_if_print, DLT_DSA_TAG_BRCM_PREPEND },
  60 #endif
  61 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
  62         { bt_if_print,          DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
  63 #endif
  64 #ifdef DLT_C_HDLC
  65         { chdlc_if_print,       DLT_C_HDLC },
  66 #endif
  67 #ifdef DLT_HDLC
  68         { chdlc_if_print,       DLT_HDLC },
  69 #endif
  70 #ifdef DLT_ATM_CLIP
  71         { cip_if_print,         DLT_ATM_CLIP },
  72 #endif
  73 #ifdef DLT_CIP
  74         { cip_if_print,         DLT_CIP },
  75 #endif
  76 #ifdef DLT_DSA_TAG_DSA
  77         { dsa_if_print,         DLT_DSA_TAG_DSA },
  78 #endif
  79 #ifdef DLT_DSA_TAG_EDSA
  80         { edsa_if_print,        DLT_DSA_TAG_EDSA },
  81 #endif
  82 #ifdef DLT_ENC
  83         { enc_if_print,         DLT_ENC },
  84 #endif
  85         { ether_if_print,       DLT_EN10MB },
  86         { fddi_if_print,        DLT_FDDI },
  87 #ifdef DLT_FR
  88         { fr_if_print,          DLT_FR },
  89 #endif
  90 #ifdef DLT_FRELAY
  91         { fr_if_print,          DLT_FRELAY },
  92 #endif
  93 #ifdef DLT_IEEE802_11
  94         { ieee802_11_if_print,  DLT_IEEE802_11},
  95 #endif
  96 #ifdef DLT_IEEE802_11_RADIO_AVS
  97         { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS },
  98 #endif
  99 #ifdef DLT_IEEE802_11_RADIO
 100         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 101 #endif
 102 #ifdef DLT_IEEE802_15_4
 103         { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
 104 #endif
 105 #ifdef DLT_IEEE802_15_4_NOFCS
 106         { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
 107 #endif
 108 #ifdef DLT_IEEE802_15_4_TAP
 109         { ieee802_15_4_tap_if_print, DLT_IEEE802_15_4_TAP },
 110 #endif
 111 #ifdef DLT_IP_OVER_FC
 112         { ipfc_if_print,        DLT_IP_OVER_FC },
 113 #endif
 114 #ifdef DLT_IPNET
 115         { ipnet_if_print,       DLT_IPNET },
 116 #endif
 117 #ifdef DLT_IPOIB
 118         { ipoib_if_print,       DLT_IPOIB },
 119 #endif
 120 #ifdef DLT_JUNIPER_ATM1
 121         { juniper_atm1_if_print, DLT_JUNIPER_ATM1 },
 122 #endif
 123 #ifdef DLT_JUNIPER_ATM2
 124         { juniper_atm2_if_print, DLT_JUNIPER_ATM2 },
 125 #endif
 126 #ifdef DLT_JUNIPER_CHDLC
 127         { juniper_chdlc_if_print,       DLT_JUNIPER_CHDLC },
 128 #endif
 129 #ifdef DLT_JUNIPER_ES
 130         { juniper_es_if_print,  DLT_JUNIPER_ES },
 131 #endif
 132 #ifdef DLT_JUNIPER_ETHER
 133         { juniper_ether_if_print,       DLT_JUNIPER_ETHER },
 134 #endif
 135 #ifdef DLT_JUNIPER_FRELAY
 136         { juniper_frelay_if_print,      DLT_JUNIPER_FRELAY },
 137 #endif
 138 #ifdef DLT_JUNIPER_GGSN
 139         { juniper_ggsn_if_print, DLT_JUNIPER_GGSN },
 140 #endif
 141 #ifdef DLT_JUNIPER_MFR
 142         { juniper_mfr_if_print, DLT_JUNIPER_MFR },
 143 #endif
 144 #ifdef DLT_JUNIPER_MLFR
 145         { juniper_mlfr_if_print, DLT_JUNIPER_MLFR },
 146 #endif
 147 #ifdef DLT_JUNIPER_MLPPP
 148         { juniper_mlppp_if_print, DLT_JUNIPER_MLPPP },
 149 #endif
 150 #ifdef DLT_JUNIPER_MONITOR
 151         { juniper_monitor_if_print, DLT_JUNIPER_MONITOR },
 152 #endif
 153 #ifdef DLT_JUNIPER_PPP
 154         { juniper_ppp_if_print, DLT_JUNIPER_PPP },
 155 #endif
 156 #ifdef DLT_JUNIPER_PPPOE_ATM
 157         { juniper_pppoe_atm_if_print, DLT_JUNIPER_PPPOE_ATM },
 158 #endif
 159 #ifdef DLT_JUNIPER_PPPOE
 160         { juniper_pppoe_if_print, DLT_JUNIPER_PPPOE },
 161 #endif
 162 #ifdef DLT_JUNIPER_SERVICES
 163         { juniper_services_if_print, DLT_JUNIPER_SERVICES },
 164 #endif
 165 #ifdef DLT_LTALK
 166         { ltalk_if_print,       DLT_LTALK },
 167 #endif
 168 #ifdef DLT_MFR
 169         { mfr_if_print,         DLT_MFR },
 170 #endif
 171 #ifdef DLT_NETANALYZER
 172         { netanalyzer_if_print, DLT_NETANALYZER },
 173 #endif
 174 #ifdef DLT_NETANALYZER_TRANSPARENT
 175         { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
 176 #endif
 177 #ifdef DLT_NFLOG
 178         { nflog_if_print,       DLT_NFLOG},
 179 #endif
 180         { null_if_print,        DLT_NULL },
 181 #ifdef DLT_LOOP
 182         { null_if_print,        DLT_LOOP },
 183 #endif
 184 #ifdef DLT_PFLOG
 185         { pflog_if_print,       DLT_PFLOG },
 186 #endif
 187 #ifdef DLT_PKTAP
 188         { pktap_if_print,       DLT_PKTAP },
 189 #endif
 190 #ifdef DLT_PPI
 191         { ppi_if_print,         DLT_PPI },
 192 #endif
 193 #ifdef DLT_PPP_SERIAL
 194         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 195 #endif
 196         { ppp_if_print,         DLT_PPP },
 197 #ifdef DLT_PPP_PPPD
 198         { ppp_if_print,         DLT_PPP_PPPD },
 199 #endif
 200 #ifdef DLT_PPP_ETHER
 201         { pppoe_if_print,       DLT_PPP_ETHER },
 202 #endif
 203 #ifdef DLT_PRISM_HEADER
 204         { prism_if_print,       DLT_PRISM_HEADER },
 205 #endif
 206         { raw_if_print,         DLT_RAW },
 207 #ifdef DLT_IPV4
 208         { raw_if_print,         DLT_IPV4 },
 209 #endif
 210 #ifdef DLT_IPV6
 211         { raw_if_print,         DLT_IPV6 },
 212 #endif
 213 #ifdef DLT_SLIP_BSDOS
 214         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 215 #endif
 216         { sl_if_print,          DLT_SLIP },
 217 #ifdef DLT_LINUX_SLL
 218         { sll_if_print,         DLT_LINUX_SLL },
 219 #endif
 220 #ifdef DLT_LINUX_SLL2
 221         { sll2_if_print,        DLT_LINUX_SLL2 },
 222 #endif
 223 #ifdef DLT_SUNATM
 224         { sunatm_if_print,      DLT_SUNATM },
 225 #endif
 226 #ifdef DLT_SYMANTEC_FIREWALL
 227         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 228 #endif
 229         { token_if_print,       DLT_IEEE802 },
 230 #ifdef DLT_USB_LINUX
 231         { usb_linux_48_byte_if_print, DLT_USB_LINUX},
 232 #endif /* DLT_USB_LINUX */
 233 #ifdef DLT_USB_LINUX_MMAPPED
 234         { usb_linux_64_byte_if_print, DLT_USB_LINUX_MMAPPED},
 235 #endif /* DLT_USB_LINUX_MMAPPED */
 236 #ifdef DLT_VSOCK
 237         { vsock_if_print,       DLT_VSOCK },
 238 #endif
 239         { NULL,                 0 },
 240 };
 241
 242 // Both localnet and mask are in network byte order.
 243 void
 244 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
 245 {
 246         init_addrtoname(ndo, localnet, mask);
 247 }
 248
 249 if_printer
 250 lookup_printer(int type)
 251 {
 252         const struct printer *p;
 253
 254         for (p = printers; p->f; ++p)
 255                 if (type == p->type)
 256                         return p->f;
 257
 258 #if defined(DLT_USER2) && defined(DLT_PKTAP)
 259         /*
 260          * Apple incorrectly chose to use DLT_USER2 for their PKTAP
 261          * header.
 262          *
 263          * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
 264          * based OSes or the same value as LINKTYPE_PKTAP as it is on
 265          * other OSes, to LINKTYPE_PKTAP, so files written with
 266          * this version of libpcap for a DLT_PKTAP capture have a link-
 267          * layer header type of LINKTYPE_PKTAP.
 268          *
 269          * However, files written on OS X Mavericks for a DLT_PKTAP
 270          * capture have a link-layer header type of LINKTYPE_USER2.
 271          * If we don't have a printer for DLT_USER2, and type is
 272          * DLT_USER2, we look up the printer for DLT_PKTAP and use
 273          * that.
 274          */
 275         if (type == DLT_USER2) {
 276                 for (p = printers; p->f; ++p)
 277                         if (DLT_PKTAP == p->type)
 278                                 return p->f;
 279         }
 280 #endif
 281
 282         return NULL;
 283         /* NOTREACHED */
 284 }
 285
 286 int
 287 has_printer(int type)
 288 {
 289         return (lookup_printer(type) != NULL);
 290 }
 291
 292 if_printer
 293 get_if_printer(int type)
 294 {
 295         if_printer printer;
 296
 297         printer = lookup_printer(type);
 298         if (printer == NULL)
 299                 printer = unsupported_if_print;
 300         return printer;
 301 }
 302
 303 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 304 extern int profile_func_level;
 305 static int pretty_print_packet_level = -1;
 306 #endif
 307
 308 void
 309 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
 310                     const u_char *sp, u_int packets_captured)
 311 {
 312         u_int hdrlen = 0;
 313         int invalid_header = 0;
 314
 315         if (ndo->ndo_print_sampling && packets_captured % ndo->ndo_print_sampling != 0)
 316                 return;
 317
 318 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 319         if (pretty_print_packet_level == -1)
 320                 pretty_print_packet_level = profile_func_level;
 321 #endif
 322
 323         if (ndo->ndo_packet_number)
 324                 ND_PRINT("%5u  ", packets_captured);
 325
 326         if (ndo->ndo_lengths)
 327                 ND_PRINT("caplen %u len %u ", h->caplen, h->len);
 328
 329         /* Sanity checks on packet length / capture length */
 330         if (h->caplen == 0) {
 331                 invalid_header = 1;
 332                 ND_PRINT("[Invalid header: caplen==0");
 333         }
 334         if (h->len == 0) {
 335                 if (!invalid_header) {
 336                         invalid_header = 1;
 337                         ND_PRINT("[Invalid header:");
 338                 } else
 339                         ND_PRINT(",");
 340                 ND_PRINT(" len==0");
 341         } else if (h->len < h->caplen) {
 342                 if (!invalid_header) {
 343                         invalid_header = 1;
 344                         ND_PRINT("[Invalid header:");
 345                 } else
 346                         ND_PRINT(",");
 347                 ND_PRINT(" len(%u) < caplen(%u)", h->len, h->caplen);
 348         }
 349         if (h->caplen > MAXIMUM_SNAPLEN) {
 350                 if (!invalid_header) {
 351                         invalid_header = 1;
 352                         ND_PRINT("[Invalid header:");
 353                 } else
 354                         ND_PRINT(",");
 355                 ND_PRINT(" caplen(%u) > %u", h->caplen, MAXIMUM_SNAPLEN);
 356         }
 357         if (h->len > MAXIMUM_SNAPLEN) {
 358                 if (!invalid_header) {
 359                         invalid_header = 1;
 360                         ND_PRINT("[Invalid header:");
 361                 } else
 362                         ND_PRINT(",");
 363                 ND_PRINT(" len(%u) > %u", h->len, MAXIMUM_SNAPLEN);
 364         }
 365         if (invalid_header) {
 366                 ND_PRINT("]\n");
 367                 return;
 368         }
 369
 370         /*
 371          * At this point:
 372          *   capture length != 0,
 373          *   packet length != 0,
 374          *   capture length <= MAXIMUM_SNAPLEN,
 375          *   packet length <= MAXIMUM_SNAPLEN,
 376          *   packet length >= capture length.
 377          *
 378          * Currently, there is no D-Bus printer, thus no need for
 379          * bigger lengths.
 380          */
 381
 382         /*
 383          * The header /usr/include/pcap/pcap.h in OpenBSD declares h->ts as
 384          * struct bpf_timeval, not struct timeval. The former comes from
 385          * /usr/include/net/bpf.h and uses 32-bit unsigned types instead of
 386          * the types used in struct timeval.
 387          */
 388         struct timeval tvbuf;
 389         tvbuf.tv_sec = h->ts.tv_sec;
 390         tvbuf.tv_usec = h->ts.tv_usec;
 391         ts_print(ndo, &tvbuf);
 392
 393         /*
 394          * Printers must check that they're not walking off the end of
 395          * the packet.
 396          * Rather than pass it all the way down, we set this member
 397          * of the netdissect_options structure.
 398          */
 399         ndo->ndo_snapend = sp + h->caplen;
 400         ndo->ndo_packetp = sp;
 401
 402         ndo->ndo_protocol = "";
 403         ndo->ndo_ll_hdr_len = 0;
 404         switch (setjmp(ndo->ndo_early_end)) {
 405         case 0:
 406                 /* Print the packet. */
 407                 (ndo->ndo_if_printer)(ndo, h, sp);
 408                 break;
 409         case ND_TRUNCATED:
 410                 /* A printer quit because the packet was truncated; report it */
 411                 nd_print_trunc(ndo);
 412                 /* Print the full packet */
 413                 ndo->ndo_ll_hdr_len = 0;
 414 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 415                 /* truncation => reassignment */
 416                 profile_func_level = pretty_print_packet_level;
 417 #endif
 418                 break;
 419         }
 420         hdrlen = ndo->ndo_ll_hdr_len;
 421
 422         /*
 423          * Empty the stack of packet information, freeing all pushed buffers;
 424          * if we got here by a printer quitting, we need to release anything
 425          * that didn't get released because we longjmped out of the code
 426          * before it popped the packet information.
 427          */
 428         nd_pop_all_packet_info(ndo);
 429
 430         /*
 431          * Restore the originals snapend and packetp, as a printer
 432          * might have changed them.
 433          *
 434          * XXX - nd_pop_all_packet_info() should have restored the
 435          * original values, but, just in case....
 436          */
 437         ndo->ndo_snapend = sp + h->caplen;
 438         ndo->ndo_packetp = sp;
 439         if (ndo->ndo_Xflag) {
 440                 /*
 441                  * Print the raw packet data in hex and ASCII.
 442                  */
 443                 if (ndo->ndo_Xflag > 1) {
 444                         /*
 445                          * Include the link-layer header.
 446                          */
 447                         hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
 448                 } else {
 449                         /*
 450                          * Don't include the link-layer header - and if
 451                          * we have nothing past the link-layer header,
 452                          * print nothing.
 453                          */
 454                         if (h->caplen > hdrlen)
 455                                 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
 456                                                     h->caplen - hdrlen);
 457                 }
 458         } else if (ndo->ndo_xflag) {
 459                 /*
 460                  * Print the raw packet data in hex.
 461                  */
 462                 if (ndo->ndo_xflag > 1) {
 463                         /*
 464                          * Include the link-layer header.
 465                          */
 466                         hex_print(ndo, "\n\t", sp, h->caplen);
 467                 } else {
 468                         /*
 469                          * Don't include the link-layer header - and if
 470                          * we have nothing past the link-layer header,
 471                          * print nothing.
 472                          */
 473                         if (h->caplen > hdrlen)
 474                                 hex_print(ndo, "\n\t", sp + hdrlen,
 475                                           h->caplen - hdrlen);
 476                 }
 477         } else if (ndo->ndo_Aflag) {
 478                 /*
 479                  * Print the raw packet data in ASCII.
 480                  */
 481                 if (ndo->ndo_Aflag > 1) {
 482                         /*
 483                          * Include the link-layer header.
 484                          */
 485                         ascii_print(ndo, sp, h->caplen);
 486                 } else {
 487                         /*
 488                          * Don't include the link-layer header - and if
 489                          * we have nothing past the link-layer header,
 490                          * print nothing.
 491                          */
 492                         if (h->caplen > hdrlen)
 493                                 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
 494                 }
 495         }
 496
 497         ND_PRINT("\n");
 498         nd_free_all(ndo);
 499 }
 500
 501 /*
 502  * By default, print the specified data out in hex and ASCII.
 503  */
 504 static void
 505 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
 506 {
 507         hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
 508 }
 509
 510 /* VARARGS */
 511 static void NORETURN PRINTFLIKE(3, 4)
 512 ndo_error(netdissect_options *ndo, status_exit_codes_t status,
 513           FORMAT_STRING(const char *fmt), ...)
 514 {
 515         va_list ap;
 516
 517         if (ndo->program_name)
 518                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 519         va_start(ap, fmt);
 520         (void)vfprintf(stderr, fmt, ap);
 521         va_end(ap);
 522         if (*fmt) {
 523                 fmt += strlen(fmt);
 524                 if (fmt[-1] != '\n')
 525                         (void)fputc('\n', stderr);
 526         }
 527         nd_cleanup();
 528         exit(status);
 529         /* NOTREACHED */
 530 }
 531
 532 /* VARARGS */
 533 static void PRINTFLIKE(2, 3)
 534 ndo_warning(netdissect_options *ndo, FORMAT_STRING(const char *fmt), ...)
 535 {
 536         va_list ap;
 537
 538         if (ndo->program_name)
 539                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 540         (void)fprintf(stderr, "WARNING: ");
 541         va_start(ap, fmt);
 542         (void)vfprintf(stderr, fmt, ap);
 543         va_end(ap);
 544         if (*fmt) {
 545                 fmt += strlen(fmt);
 546                 if (fmt[-1] != '\n')
 547                         (void)fputc('\n', stderr);
 548         }
 549 }
 550
 551 /* VARARGS */
 552 static int PRINTFLIKE(2, 3)
 553 ndo_printf(netdissect_options *ndo, FORMAT_STRING(const char *fmt), ...)
 554 {
 555         va_list args;
 556         int ret;
 557
 558         va_start(args, fmt);
 559         ret = vfprintf(stdout, fmt, args);
 560         va_end(args);
 561
 562         if (ret < 0)
 563                 ndo_error(ndo, S_ERR_ND_WRITE_FILE,
 564                           "Unable to write output: %s", pcap_strerror(errno));
 565         return (ret);
 566 }
 567
 568 void
 569 ndo_set_function_pointers(netdissect_options *ndo)
 570 {
 571         ndo->ndo_default_print=ndo_default_print;
 572         ndo->ndo_printf=ndo_printf;
 573         ndo->ndo_error=ndo_error;
 574         ndo->ndo_warning=ndo_warning;
 575 }