The Tcpdump Group git mirrors - tcpdump/blob - print.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 #include <config.h>
  30 #endif
  31
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <setjmp.h>
  35
  36 #include "netdissect-stdinc.h"
  37
  38 #include "netdissect.h"
  39 #include "addrtoname.h"
  40 #include "print.h"
  41 #include "netdissect-alloc.h"
  42
  43 #include "pcap-missing.h"
  44
  45 struct printer {
  46         if_printer f;
  47         int type;
  48 };
  49
  50 static const struct printer printers[] = {
  51         { ether_if_print,       DLT_EN10MB },
  52 #ifdef DLT_IPNET
  53         { ipnet_if_print,       DLT_IPNET },
  54 #endif
  55 #ifdef DLT_IEEE802_15_4
  56         { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
  57 #endif
  58 #ifdef DLT_IEEE802_15_4_NOFCS
  59         { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
  60 #endif
  61 #ifdef DLT_IEEE802_15_4_TAP
  62         { ieee802_15_4_tap_if_print, DLT_IEEE802_15_4_TAP },
  63 #endif
  64 #ifdef DLT_PPI
  65         { ppi_if_print,         DLT_PPI },
  66 #endif
  67 #ifdef DLT_NETANALYZER
  68         { netanalyzer_if_print, DLT_NETANALYZER },
  69 #endif
  70 #ifdef DLT_NETANALYZER_TRANSPARENT
  71         { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
  72 #endif
  73 #ifdef DLT_NFLOG
  74         { nflog_if_print,       DLT_NFLOG},
  75 #endif
  76 #ifdef DLT_CIP
  77         { cip_if_print,         DLT_CIP },
  78 #endif
  79 #ifdef DLT_ATM_CLIP
  80         { cip_if_print,         DLT_ATM_CLIP },
  81 #endif
  82 #ifdef DLT_IP_OVER_FC
  83         { ipfc_if_print,        DLT_IP_OVER_FC },
  84 #endif
  85         { null_if_print,        DLT_NULL },
  86 #ifdef DLT_LOOP
  87         { null_if_print,        DLT_LOOP },
  88 #endif
  89 #ifdef DLT_APPLE_IP_OVER_IEEE1394
  90         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
  91 #endif
  92 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
  93         { bt_if_print,          DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
  94 #endif
  95 #ifdef DLT_LANE8023
  96         { lane_if_print,        DLT_LANE8023 },
  97 #endif
  98         { arcnet_if_print,      DLT_ARCNET },
  99 #ifdef DLT_ARCNET_LINUX
 100         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
 101 #endif
 102         { raw_if_print,         DLT_RAW },
 103 #ifdef DLT_IPV4
 104         { raw_if_print,         DLT_IPV4 },
 105 #endif
 106 #ifdef DLT_IPV6
 107         { raw_if_print,         DLT_IPV6 },
 108 #endif
 109 #ifdef DLT_IPOIB
 110         { ipoib_if_print,       DLT_IPOIB },
 111 #endif
 112 #ifdef DLT_USB_LINUX
 113         { usb_linux_48_byte_if_print, DLT_USB_LINUX},
 114 #endif /* DLT_USB_LINUX */
 115 #ifdef DLT_USB_LINUX_MMAPPED
 116         { usb_linux_64_byte_if_print, DLT_USB_LINUX_MMAPPED},
 117 #endif /* DLT_USB_LINUX_MMAPPED */
 118 #ifdef DLT_SYMANTEC_FIREWALL
 119         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 120 #endif
 121 #ifdef DLT_C_HDLC
 122         { chdlc_if_print,       DLT_C_HDLC },
 123 #endif
 124 #ifdef DLT_HDLC
 125         { chdlc_if_print,       DLT_HDLC },
 126 #endif
 127 #ifdef DLT_PPP_ETHER
 128         { pppoe_if_print,       DLT_PPP_ETHER },
 129 #endif
 130 #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
 131         { pflog_if_print,       DLT_PFLOG },
 132 #endif
 133         { token_if_print,       DLT_IEEE802 },
 134         { fddi_if_print,        DLT_FDDI },
 135 #ifdef DLT_LINUX_SLL
 136         { sll_if_print,         DLT_LINUX_SLL },
 137 #endif
 138 #ifdef DLT_LINUX_SLL2
 139         { sll2_if_print,        DLT_LINUX_SLL2 },
 140 #endif
 141 #ifdef DLT_FR
 142         { fr_if_print,          DLT_FR },
 143 #endif
 144 #ifdef DLT_FRELAY
 145         { fr_if_print,          DLT_FRELAY },
 146 #endif
 147 #ifdef DLT_MFR
 148         { mfr_if_print,         DLT_MFR },
 149 #endif
 150         { atm_if_print,         DLT_ATM_RFC1483 },
 151 #ifdef DLT_SUNATM
 152         { sunatm_if_print,      DLT_SUNATM },
 153 #endif
 154 #ifdef DLT_ENC
 155         { enc_if_print,         DLT_ENC },
 156 #endif
 157         { sl_if_print,          DLT_SLIP },
 158 #ifdef DLT_SLIP_BSDOS
 159         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 160 #endif
 161 #ifdef DLT_LTALK
 162         { ltalk_if_print,       DLT_LTALK },
 163 #endif
 164 #ifdef DLT_JUNIPER_ATM1
 165         { juniper_atm1_if_print, DLT_JUNIPER_ATM1 },
 166 #endif
 167 #ifdef DLT_JUNIPER_ATM2
 168         { juniper_atm2_if_print, DLT_JUNIPER_ATM2 },
 169 #endif
 170 #ifdef DLT_JUNIPER_MFR
 171         { juniper_mfr_if_print, DLT_JUNIPER_MFR },
 172 #endif
 173 #ifdef DLT_JUNIPER_MLFR
 174         { juniper_mlfr_if_print, DLT_JUNIPER_MLFR },
 175 #endif
 176 #ifdef DLT_JUNIPER_MLPPP
 177         { juniper_mlppp_if_print, DLT_JUNIPER_MLPPP },
 178 #endif
 179 #ifdef DLT_JUNIPER_PPPOE
 180         { juniper_pppoe_if_print, DLT_JUNIPER_PPPOE },
 181 #endif
 182 #ifdef DLT_JUNIPER_PPPOE_ATM
 183         { juniper_pppoe_atm_if_print, DLT_JUNIPER_PPPOE_ATM },
 184 #endif
 185 #ifdef DLT_JUNIPER_GGSN
 186         { juniper_ggsn_if_print, DLT_JUNIPER_GGSN },
 187 #endif
 188 #ifdef DLT_JUNIPER_ES
 189         { juniper_es_if_print,  DLT_JUNIPER_ES },
 190 #endif
 191 #ifdef DLT_JUNIPER_MONITOR
 192         { juniper_monitor_if_print, DLT_JUNIPER_MONITOR },
 193 #endif
 194 #ifdef DLT_JUNIPER_SERVICES
 195         { juniper_services_if_print, DLT_JUNIPER_SERVICES },
 196 #endif
 197 #ifdef DLT_JUNIPER_ETHER
 198         { juniper_ether_if_print,       DLT_JUNIPER_ETHER },
 199 #endif
 200 #ifdef DLT_JUNIPER_PPP
 201         { juniper_ppp_if_print, DLT_JUNIPER_PPP },
 202 #endif
 203 #ifdef DLT_JUNIPER_FRELAY
 204         { juniper_frelay_if_print,      DLT_JUNIPER_FRELAY },
 205 #endif
 206 #ifdef DLT_JUNIPER_CHDLC
 207         { juniper_chdlc_if_print,       DLT_JUNIPER_CHDLC },
 208 #endif
 209 #ifdef DLT_PKTAP
 210         { pktap_if_print,       DLT_PKTAP },
 211 #endif
 212 #ifdef DLT_IEEE802_11_RADIO
 213         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 214 #endif
 215 #ifdef DLT_IEEE802_11
 216         { ieee802_11_if_print,  DLT_IEEE802_11},
 217 #endif
 218 #ifdef DLT_IEEE802_11_RADIO_AVS
 219         { ieee802_11_radio_avs_if_print,        DLT_IEEE802_11_RADIO_AVS },
 220 #endif
 221 #ifdef DLT_PRISM_HEADER
 222         { prism_if_print,       DLT_PRISM_HEADER },
 223 #endif
 224         { ppp_if_print,         DLT_PPP },
 225 #ifdef DLT_PPP_WITHDIRECTION
 226         { ppp_if_print,         DLT_PPP_WITHDIRECTION },
 227 #endif
 228 #ifdef DLT_PPP_BSDOS
 229         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 230 #endif
 231 #ifdef DLT_PPP_SERIAL
 232         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 233 #endif
 234 #ifdef DLT_DSA_TAG_BRCM
 235         { brcm_tag_if_print,    DLT_DSA_TAG_BRCM },
 236 #endif
 237 #ifdef DLT_DSA_TAG_BRCM_PREPEND
 238         { brcm_tag_prepend_if_print, DLT_DSA_TAG_BRCM_PREPEND },
 239 #endif
 240 #ifdef DLT_VSOCK
 241         { vsock_if_print,       DLT_VSOCK },
 242 #endif
 243 #ifdef DLT_DSA_TAG_DSA
 244         { dsa_if_print, DLT_DSA_TAG_DSA },
 245 #endif
 246 #ifdef DLT_DSA_TAG_EDSA
 247         { edsa_if_print,        DLT_DSA_TAG_EDSA },
 248 #endif
 249         { NULL,                 0 },
 250 };
 251
 252 static void     ndo_default_print(netdissect_options *ndo, const u_char *bp,
 253                     u_int length);
 254
 255 static void NORETURN ndo_error(netdissect_options *ndo,
 256                      status_exit_codes_t status,
 257                      FORMAT_STRING(const char *fmt), ...)
 258                      PRINTFLIKE(3, 4);
 259 static void     ndo_warning(netdissect_options *ndo,
 260                     FORMAT_STRING(const char *fmt), ...)
 261                     PRINTFLIKE(2, 3);
 262
 263 static int      ndo_printf(netdissect_options *ndo,
 264                      FORMAT_STRING(const char *fmt), ...)
 265                      PRINTFLIKE(2, 3);
 266
 267 void
 268 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
 269 {
 270
 271         init_addrtoname(ndo, localnet, mask);
 272         init_checksum();
 273 }
 274
 275 if_printer
 276 lookup_printer(int type)
 277 {
 278         const struct printer *p;
 279
 280         for (p = printers; p->f; ++p)
 281                 if (type == p->type)
 282                         return p->f;
 283
 284 #if defined(DLT_USER2) && defined(DLT_PKTAP)
 285         /*
 286          * Apple incorrectly chose to use DLT_USER2 for their PKTAP
 287          * header.
 288          *
 289          * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
 290          * based OSes or the same value as LINKTYPE_PKTAP as it is on
 291          * other OSes, to LINKTYPE_PKTAP, so files written with
 292          * this version of libpcap for a DLT_PKTAP capture have a link-
 293          * layer header type of LINKTYPE_PKTAP.
 294          *
 295          * However, files written on OS X Mavericks for a DLT_PKTAP
 296          * capture have a link-layer header type of LINKTYPE_USER2.
 297          * If we don't have a printer for DLT_USER2, and type is
 298          * DLT_USER2, we look up the printer for DLT_PKTAP and use
 299          * that.
 300          */
 301         if (type == DLT_USER2) {
 302                 for (p = printers; p->f; ++p)
 303                         if (DLT_PKTAP == p->type)
 304                                 return p->f;
 305         }
 306 #endif
 307
 308         return NULL;
 309         /* NOTREACHED */
 310 }
 311
 312 int
 313 has_printer(int type)
 314 {
 315         return (lookup_printer(type) != NULL);
 316 }
 317
 318 if_printer
 319 get_if_printer(netdissect_options *ndo, int type)
 320 {
 321         const char *dltname;
 322         if_printer printer;
 323
 324         printer = lookup_printer(type);
 325         if (printer == NULL) {
 326                 dltname = pcap_datalink_val_to_name(type);
 327                 if (dltname != NULL)
 328                         (*ndo->ndo_error)(ndo, S_ERR_ND_NO_PRINTER,
 329                                           "packet printing is not supported for link type %s: use -w",
 330                                           dltname);
 331                 else
 332                         (*ndo->ndo_error)(ndo, S_ERR_ND_NO_PRINTER,
 333                                           "packet printing is not supported for link type %d: use -w", type);
 334         }
 335         return printer;
 336 }
 337
 338 void
 339 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
 340                     const u_char *sp, u_int packets_captured)
 341 {
 342         u_int hdrlen = 0;
 343         int invalid_header = 0;
 344
 345         if (ndo->ndo_packet_number)
 346                 ND_PRINT("%5u  ", packets_captured);
 347
 348         /* Sanity checks on packet length / capture length */
 349         if (h->caplen == 0) {
 350                 invalid_header = 1;
 351                 ND_PRINT("[Invalid header: caplen==0");
 352         }
 353         if (h->len == 0) {
 354                 if (!invalid_header) {
 355                         invalid_header = 1;
 356                         ND_PRINT("[Invalid header:");
 357                 } else
 358                         ND_PRINT(",");
 359                 ND_PRINT(" len==0");
 360         } else if (h->len < h->caplen) {
 361                 if (!invalid_header) {
 362                         invalid_header = 1;
 363                         ND_PRINT("[Invalid header:");
 364                 } else
 365                         ND_PRINT(",");
 366                 ND_PRINT(" len(%u) < caplen(%u)", h->len, h->caplen);
 367         }
 368         if (h->caplen > MAXIMUM_SNAPLEN) {
 369                 if (!invalid_header) {
 370                         invalid_header = 1;
 371                         ND_PRINT("[Invalid header:");
 372                 } else
 373                         ND_PRINT(",");
 374                 ND_PRINT(" caplen(%u) > %u", h->caplen, MAXIMUM_SNAPLEN);
 375         }
 376         if (h->len > MAXIMUM_SNAPLEN) {
 377                 if (!invalid_header) {
 378                         invalid_header = 1;
 379                         ND_PRINT("[Invalid header:");
 380                 } else
 381                         ND_PRINT(",");
 382                 ND_PRINT(" len(%u) > %u", h->len, MAXIMUM_SNAPLEN);
 383         }
 384         if (invalid_header) {
 385                 ND_PRINT("]\n");
 386                 return;
 387         }
 388
 389         /*
 390          * At this point:
 391          *   capture length != 0,
 392          *   packet length != 0,
 393          *   capture length <= MAXIMUM_SNAPLEN,
 394          *   packet length <= MAXIMUM_SNAPLEN,
 395          *   packet length >= capture length.
 396          *
 397          * Currently, there is no D-Bus printer, thus no need for
 398          * bigger lengths.
 399          */
 400
 401         ts_print(ndo, &h->ts);
 402
 403         /*
 404          * Printers must check that they're not walking off the end of
 405          * the packet.
 406          * Rather than pass it all the way down, we set this member
 407          * of the netdissect_options structure.
 408          */
 409         ndo->ndo_snapend = sp + h->caplen;
 410
 411         ndo->ndo_protocol = "";
 412         if (setjmp(ndo->ndo_truncated) == 0) {
 413                 /* Print the packet. */
 414                 hdrlen = (ndo->ndo_if_printer)(ndo, h, sp);
 415         } else {
 416                 /* A printer quit because the packet was truncated; report it */
 417                 ND_PRINT(" [|%s]", ndo->ndo_protocol);
 418         }
 419
 420         /*
 421          * Free all pushed buffers; if we got here by a printer quitting,
 422          * we need to release anything that didn't get released because
 423          * we longjmped out of the code before it popped a buffer.
 424          */
 425         nd_pop_all_buffers(ndo);
 426
 427         /*
 428          * Restore the original snapend, as a printer might have
 429          * changed it.
 430          */
 431         ndo->ndo_snapend = sp + h->caplen;
 432         if (ndo->ndo_Xflag) {
 433                 /*
 434                  * Print the raw packet data in hex and ASCII.
 435                  */
 436                 if (ndo->ndo_Xflag > 1) {
 437                         /*
 438                          * Include the link-layer header.
 439                          */
 440                         hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
 441                 } else {
 442                         /*
 443                          * Don't include the link-layer header - and if
 444                          * we have nothing past the link-layer header,
 445                          * print nothing.
 446                          */
 447                         if (h->caplen > hdrlen)
 448                                 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
 449                                                     h->caplen - hdrlen);
 450                 }
 451         } else if (ndo->ndo_xflag) {
 452                 /*
 453                  * Print the raw packet data in hex.
 454                  */
 455                 if (ndo->ndo_xflag > 1) {
 456                         /*
 457                          * Include the link-layer header.
 458                          */
 459                         hex_print(ndo, "\n\t", sp, h->caplen);
 460                 } else {
 461                         /*
 462                          * Don't include the link-layer header - and if
 463                          * we have nothing past the link-layer header,
 464                          * print nothing.
 465                          */
 466                         if (h->caplen > hdrlen)
 467                                 hex_print(ndo, "\n\t", sp + hdrlen,
 468                                           h->caplen - hdrlen);
 469                 }
 470         } else if (ndo->ndo_Aflag) {
 471                 /*
 472                  * Print the raw packet data in ASCII.
 473                  */
 474                 if (ndo->ndo_Aflag > 1) {
 475                         /*
 476                          * Include the link-layer header.
 477                          */
 478                         ascii_print(ndo, sp, h->caplen);
 479                 } else {
 480                         /*
 481                          * Don't include the link-layer header - and if
 482                          * we have nothing past the link-layer header,
 483                          * print nothing.
 484                          */
 485                         if (h->caplen > hdrlen)
 486                                 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
 487                 }
 488         }
 489
 490         ND_PRINT("\n");
 491         nd_free_all(ndo);
 492 }
 493
 494 /*
 495  * By default, print the specified data out in hex and ASCII.
 496  */
 497 static void
 498 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
 499 {
 500         hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
 501 }
 502
 503 /* VARARGS */
 504 static void
 505 ndo_error(netdissect_options *ndo, status_exit_codes_t status,
 506           const char *fmt, ...)
 507 {
 508         va_list ap;
 509
 510         if (ndo->program_name)
 511                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 512         va_start(ap, fmt);
 513         (void)vfprintf(stderr, fmt, ap);
 514         va_end(ap);
 515         if (*fmt) {
 516                 fmt += strlen(fmt);
 517                 if (fmt[-1] != '\n')
 518                         (void)fputc('\n', stderr);
 519         }
 520         nd_cleanup();
 521         exit(status);
 522         /* NOTREACHED */
 523 }
 524
 525 /* VARARGS */
 526 static void
 527 ndo_warning(netdissect_options *ndo, const char *fmt, ...)
 528 {
 529         va_list ap;
 530
 531         if (ndo->program_name)
 532                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 533         (void)fprintf(stderr, "WARNING: ");
 534         va_start(ap, fmt);
 535         (void)vfprintf(stderr, fmt, ap);
 536         va_end(ap);
 537         if (*fmt) {
 538                 fmt += strlen(fmt);
 539                 if (fmt[-1] != '\n')
 540                         (void)fputc('\n', stderr);
 541         }
 542 }
 543
 544 static int
 545 ndo_printf(netdissect_options *ndo, const char *fmt, ...)
 546 {
 547         va_list args;
 548         int ret;
 549
 550         va_start(args, fmt);
 551         ret = vfprintf(stdout, fmt, args);
 552         va_end(args);
 553
 554         if (ret < 0)
 555                 ndo_error(ndo, S_ERR_ND_WRITE_FILE,
 556                           "Unable to write output: %s", pcap_strerror(errno));
 557         return (ret);
 558 }
 559
 560 void
 561 ndo_set_function_pointers(netdissect_options *ndo)
 562 {
 563         ndo->ndo_default_print=ndo_default_print;
 564         ndo->ndo_printf=ndo_printf;
 565         ndo->ndo_error=ndo_error;
 566         ndo->ndo_warning=ndo_warning;
 567 }