The Tcpdump Group git mirrors - tcpdump/blob - print.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 #include <config.h>
  30 #endif
  31
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <setjmp.h>
  35
  36 #include "netdissect-stdinc.h"
  37
  38 #include "netdissect.h"
  39 #include "addrtoname.h"
  40 #include "print.h"
  41 #include "netdissect-alloc.h"
  42
  43 #include "pcap-missing.h"
  44
  45 struct printer {
  46         if_printer f;
  47         int type;
  48 };
  49
  50 static const struct printer printers[] = {
  51 #ifdef DLT_APPLE_IP_OVER_IEEE1394
  52         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
  53 #endif
  54         { arcnet_if_print,      DLT_ARCNET },
  55 #ifdef DLT_ARCNET_LINUX
  56         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
  57 #endif
  58         { atm_if_print,         DLT_ATM_RFC1483 },
  59 #ifdef DLT_DSA_TAG_BRCM
  60         { brcm_tag_if_print,    DLT_DSA_TAG_BRCM },
  61 #endif
  62 #ifdef DLT_DSA_TAG_BRCM_PREPEND
  63         { brcm_tag_prepend_if_print, DLT_DSA_TAG_BRCM_PREPEND },
  64 #endif
  65 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
  66         { bt_if_print,          DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
  67 #endif
  68 #ifdef DLT_C_HDLC
  69         { chdlc_if_print,       DLT_C_HDLC },
  70 #endif
  71 #ifdef DLT_HDLC
  72         { chdlc_if_print,       DLT_HDLC },
  73 #endif
  74 #ifdef DLT_ATM_CLIP
  75         { cip_if_print,         DLT_ATM_CLIP },
  76 #endif
  77 #ifdef DLT_CIP
  78         { cip_if_print,         DLT_CIP },
  79 #endif
  80 #ifdef DLT_DSA_TAG_DSA
  81         { dsa_if_print,         DLT_DSA_TAG_DSA },
  82 #endif
  83 #ifdef DLT_DSA_TAG_EDSA
  84         { edsa_if_print,        DLT_DSA_TAG_EDSA },
  85 #endif
  86 #ifdef DLT_ENC
  87         { enc_if_print,         DLT_ENC },
  88 #endif
  89         { ether_if_print,       DLT_EN10MB },
  90         { fddi_if_print,        DLT_FDDI },
  91 #ifdef DLT_FR
  92         { fr_if_print,          DLT_FR },
  93 #endif
  94 #ifdef DLT_FRELAY
  95         { fr_if_print,          DLT_FRELAY },
  96 #endif
  97 #ifdef DLT_IEEE802_11
  98         { ieee802_11_if_print,  DLT_IEEE802_11},
  99 #endif
 100 #ifdef DLT_IEEE802_11_RADIO_AVS
 101         { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS },
 102 #endif
 103 #ifdef DLT_IEEE802_11_RADIO
 104         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 105 #endif
 106 #ifdef DLT_IEEE802_15_4
 107         { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
 108 #endif
 109 #ifdef DLT_IEEE802_15_4_NOFCS
 110         { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
 111 #endif
 112 #ifdef DLT_IEEE802_15_4_TAP
 113         { ieee802_15_4_tap_if_print, DLT_IEEE802_15_4_TAP },
 114 #endif
 115 #ifdef DLT_IP_OVER_FC
 116         { ipfc_if_print,        DLT_IP_OVER_FC },
 117 #endif
 118 #ifdef DLT_IPNET
 119         { ipnet_if_print,       DLT_IPNET },
 120 #endif
 121 #ifdef DLT_IPOIB
 122         { ipoib_if_print,       DLT_IPOIB },
 123 #endif
 124 #ifdef DLT_JUNIPER_ATM1
 125         { juniper_atm1_if_print, DLT_JUNIPER_ATM1 },
 126 #endif
 127 #ifdef DLT_JUNIPER_ATM2
 128         { juniper_atm2_if_print, DLT_JUNIPER_ATM2 },
 129 #endif
 130 #ifdef DLT_JUNIPER_CHDLC
 131         { juniper_chdlc_if_print,       DLT_JUNIPER_CHDLC },
 132 #endif
 133 #ifdef DLT_JUNIPER_ES
 134         { juniper_es_if_print,  DLT_JUNIPER_ES },
 135 #endif
 136 #ifdef DLT_JUNIPER_ETHER
 137         { juniper_ether_if_print,       DLT_JUNIPER_ETHER },
 138 #endif
 139 #ifdef DLT_JUNIPER_FRELAY
 140         { juniper_frelay_if_print,      DLT_JUNIPER_FRELAY },
 141 #endif
 142 #ifdef DLT_JUNIPER_GGSN
 143         { juniper_ggsn_if_print, DLT_JUNIPER_GGSN },
 144 #endif
 145 #ifdef DLT_JUNIPER_MFR
 146         { juniper_mfr_if_print, DLT_JUNIPER_MFR },
 147 #endif
 148 #ifdef DLT_JUNIPER_MLFR
 149         { juniper_mlfr_if_print, DLT_JUNIPER_MLFR },
 150 #endif
 151 #ifdef DLT_JUNIPER_MLPPP
 152         { juniper_mlppp_if_print, DLT_JUNIPER_MLPPP },
 153 #endif
 154 #ifdef DLT_JUNIPER_MONITOR
 155         { juniper_monitor_if_print, DLT_JUNIPER_MONITOR },
 156 #endif
 157 #ifdef DLT_JUNIPER_PPP
 158         { juniper_ppp_if_print, DLT_JUNIPER_PPP },
 159 #endif
 160 #ifdef DLT_JUNIPER_PPPOE_ATM
 161         { juniper_pppoe_atm_if_print, DLT_JUNIPER_PPPOE_ATM },
 162 #endif
 163 #ifdef DLT_JUNIPER_PPPOE
 164         { juniper_pppoe_if_print, DLT_JUNIPER_PPPOE },
 165 #endif
 166 #ifdef DLT_JUNIPER_SERVICES
 167         { juniper_services_if_print, DLT_JUNIPER_SERVICES },
 168 #endif
 169 #ifdef DLT_LTALK
 170         { ltalk_if_print,       DLT_LTALK },
 171 #endif
 172 #ifdef DLT_MFR
 173         { mfr_if_print,         DLT_MFR },
 174 #endif
 175 #ifdef DLT_NETANALYZER
 176         { netanalyzer_if_print, DLT_NETANALYZER },
 177 #endif
 178 #ifdef DLT_NETANALYZER_TRANSPARENT
 179         { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
 180 #endif
 181 #ifdef DLT_NFLOG
 182         { nflog_if_print,       DLT_NFLOG},
 183 #endif
 184         { null_if_print,        DLT_NULL },
 185 #ifdef DLT_LOOP
 186         { null_if_print,        DLT_LOOP },
 187 #endif
 188 #ifdef DLT_PFLOG
 189         { pflog_if_print,       DLT_PFLOG },
 190 #endif
 191 #ifdef DLT_PKTAP
 192         { pktap_if_print,       DLT_PKTAP },
 193 #endif
 194 #ifdef DLT_PPI
 195         { ppi_if_print,         DLT_PPI },
 196 #endif
 197 #ifdef DLT_PPP_BSDOS
 198         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 199 #endif
 200 #ifdef DLT_PPP_SERIAL
 201         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 202 #endif
 203         { ppp_if_print,         DLT_PPP },
 204 #ifdef DLT_PPP_PPPD
 205         { ppp_if_print,         DLT_PPP_PPPD },
 206 #endif
 207 #ifdef DLT_PPP_ETHER
 208         { pppoe_if_print,       DLT_PPP_ETHER },
 209 #endif
 210 #ifdef DLT_PRISM_HEADER
 211         { prism_if_print,       DLT_PRISM_HEADER },
 212 #endif
 213         { raw_if_print,         DLT_RAW },
 214 #ifdef DLT_IPV4
 215         { raw_if_print,         DLT_IPV4 },
 216 #endif
 217 #ifdef DLT_IPV6
 218         { raw_if_print,         DLT_IPV6 },
 219 #endif
 220 #ifdef DLT_SLIP_BSDOS
 221         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 222 #endif
 223         { sl_if_print,          DLT_SLIP },
 224 #ifdef DLT_LINUX_SLL
 225         { sll_if_print,         DLT_LINUX_SLL },
 226 #endif
 227 #ifdef DLT_LINUX_SLL2
 228         { sll2_if_print,        DLT_LINUX_SLL2 },
 229 #endif
 230 #ifdef DLT_SUNATM
 231         { sunatm_if_print,      DLT_SUNATM },
 232 #endif
 233 #ifdef DLT_SYMANTEC_FIREWALL
 234         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 235 #endif
 236         { token_if_print,       DLT_IEEE802 },
 237 #ifdef DLT_USB_LINUX
 238         { usb_linux_48_byte_if_print, DLT_USB_LINUX},
 239 #endif /* DLT_USB_LINUX */
 240 #ifdef DLT_USB_LINUX_MMAPPED
 241         { usb_linux_64_byte_if_print, DLT_USB_LINUX_MMAPPED},
 242 #endif /* DLT_USB_LINUX_MMAPPED */
 243 #ifdef DLT_VSOCK
 244         { vsock_if_print,       DLT_VSOCK },
 245 #endif
 246         { NULL,                 0 },
 247 };
 248
 249 static void     ndo_default_print(netdissect_options *ndo, const u_char *bp,
 250                     u_int length);
 251
 252 static void NORETURN ndo_error(netdissect_options *ndo,
 253                      status_exit_codes_t status,
 254                      FORMAT_STRING(const char *fmt), ...)
 255                      PRINTFLIKE(3, 4);
 256 static void     ndo_warning(netdissect_options *ndo,
 257                     FORMAT_STRING(const char *fmt), ...)
 258                     PRINTFLIKE(2, 3);
 259
 260 static int      ndo_printf(netdissect_options *ndo,
 261                      FORMAT_STRING(const char *fmt), ...)
 262                      PRINTFLIKE(2, 3);
 263
 264 void
 265 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
 266 {
 267         init_addrtoname(ndo, localnet, mask);
 268 }
 269
 270 if_printer
 271 lookup_printer(int type)
 272 {
 273         const struct printer *p;
 274
 275         for (p = printers; p->f; ++p)
 276                 if (type == p->type)
 277                         return p->f;
 278
 279 #if defined(DLT_USER2) && defined(DLT_PKTAP)
 280         /*
 281          * Apple incorrectly chose to use DLT_USER2 for their PKTAP
 282          * header.
 283          *
 284          * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
 285          * based OSes or the same value as LINKTYPE_PKTAP as it is on
 286          * other OSes, to LINKTYPE_PKTAP, so files written with
 287          * this version of libpcap for a DLT_PKTAP capture have a link-
 288          * layer header type of LINKTYPE_PKTAP.
 289          *
 290          * However, files written on OS X Mavericks for a DLT_PKTAP
 291          * capture have a link-layer header type of LINKTYPE_USER2.
 292          * If we don't have a printer for DLT_USER2, and type is
 293          * DLT_USER2, we look up the printer for DLT_PKTAP and use
 294          * that.
 295          */
 296         if (type == DLT_USER2) {
 297                 for (p = printers; p->f; ++p)
 298                         if (DLT_PKTAP == p->type)
 299                                 return p->f;
 300         }
 301 #endif
 302
 303         return NULL;
 304         /* NOTREACHED */
 305 }
 306
 307 int
 308 has_printer(int type)
 309 {
 310         return (lookup_printer(type) != NULL);
 311 }
 312
 313 if_printer
 314 get_if_printer(int type)
 315 {
 316         if_printer printer;
 317
 318         printer = lookup_printer(type);
 319         if (printer == NULL)
 320                 printer = unsupported_if_print;
 321         return printer;
 322 }
 323
 324 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 325 extern int profile_func_level;
 326 static int pretty_print_packet_level = -1;
 327 #endif
 328
 329 void
 330 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
 331                     const u_char *sp, u_int packets_captured)
 332 {
 333         u_int hdrlen = 0;
 334         int invalid_header = 0;
 335
 336 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 337         if (pretty_print_packet_level == -1)
 338                 pretty_print_packet_level = profile_func_level;
 339 #endif
 340
 341         if (ndo->ndo_packet_number)
 342                 ND_PRINT("%5u  ", packets_captured);
 343
 344         /* Sanity checks on packet length / capture length */
 345         if (h->caplen == 0) {
 346                 invalid_header = 1;
 347                 ND_PRINT("[Invalid header: caplen==0");
 348         }
 349         if (h->len == 0) {
 350                 if (!invalid_header) {
 351                         invalid_header = 1;
 352                         ND_PRINT("[Invalid header:");
 353                 } else
 354                         ND_PRINT(",");
 355                 ND_PRINT(" len==0");
 356         } else if (h->len < h->caplen) {
 357                 if (!invalid_header) {
 358                         invalid_header = 1;
 359                         ND_PRINT("[Invalid header:");
 360                 } else
 361                         ND_PRINT(",");
 362                 ND_PRINT(" len(%u) < caplen(%u)", h->len, h->caplen);
 363         }
 364         if (h->caplen > MAXIMUM_SNAPLEN) {
 365                 if (!invalid_header) {
 366                         invalid_header = 1;
 367                         ND_PRINT("[Invalid header:");
 368                 } else
 369                         ND_PRINT(",");
 370                 ND_PRINT(" caplen(%u) > %u", h->caplen, MAXIMUM_SNAPLEN);
 371         }
 372         if (h->len > MAXIMUM_SNAPLEN) {
 373                 if (!invalid_header) {
 374                         invalid_header = 1;
 375                         ND_PRINT("[Invalid header:");
 376                 } else
 377                         ND_PRINT(",");
 378                 ND_PRINT(" len(%u) > %u", h->len, MAXIMUM_SNAPLEN);
 379         }
 380         if (invalid_header) {
 381                 ND_PRINT("]\n");
 382                 return;
 383         }
 384
 385         /*
 386          * At this point:
 387          *   capture length != 0,
 388          *   packet length != 0,
 389          *   capture length <= MAXIMUM_SNAPLEN,
 390          *   packet length <= MAXIMUM_SNAPLEN,
 391          *   packet length >= capture length.
 392          *
 393          * Currently, there is no D-Bus printer, thus no need for
 394          * bigger lengths.
 395          */
 396
 397         /*
 398          * The header /usr/include/pcap/pcap.h in OpenBSD declares h->ts as
 399          * struct bpf_timeval, not struct timeval. The former comes from
 400          * /usr/include/net/bpf.h and uses 32-bit unsigned types instead of
 401          * the types used in struct timeval.
 402          */
 403         struct timeval tvbuf;
 404         tvbuf.tv_sec = h->ts.tv_sec;
 405         tvbuf.tv_usec = h->ts.tv_usec;
 406         ts_print(ndo, &tvbuf);
 407
 408         /*
 409          * Printers must check that they're not walking off the end of
 410          * the packet.
 411          * Rather than pass it all the way down, we set this member
 412          * of the netdissect_options structure.
 413          */
 414         ndo->ndo_snapend = sp + h->caplen;
 415         ndo->ndo_packetp = sp;
 416
 417         ndo->ndo_protocol = "";
 418         ndo->ndo_ll_hdr_len = 0;
 419         switch (setjmp(ndo->ndo_early_end)) {
 420         case 0:
 421                 /* Print the packet. */
 422                 (ndo->ndo_if_printer)(ndo, h, sp);
 423                 break;
 424         case ND_TRUNCATED:
 425                 /* A printer quit because the packet was truncated; report it */
 426                 nd_print_trunc(ndo);
 427                 /* Print the full packet */
 428                 ndo->ndo_ll_hdr_len = 0;
 429 #ifdef ENABLE_INSTRUMENT_FUNCTIONS
 430                 /* truncation => reassignment */
 431                 profile_func_level = pretty_print_packet_level;
 432 #endif
 433                 break;
 434         }
 435         hdrlen = ndo->ndo_ll_hdr_len;
 436
 437         /*
 438          * Empty the stack of packet information, freeing all pushed buffers;
 439          * if we got here by a printer quitting, we need to release anything
 440          * that didn't get released because we longjmped out of the code
 441          * before it popped the packet information.
 442          */
 443         nd_pop_all_packet_info(ndo);
 444
 445         /*
 446          * Restore the originals snapend and packetp, as a printer
 447          * might have changed them.
 448          *
 449          * XXX - nd_pop_all_packet_info() should have restored the
 450          * original values, but, just in case....
 451          */
 452         ndo->ndo_snapend = sp + h->caplen;
 453         ndo->ndo_packetp = sp;
 454         if (ndo->ndo_Xflag) {
 455                 /*
 456                  * Print the raw packet data in hex and ASCII.
 457                  */
 458                 if (ndo->ndo_Xflag > 1) {
 459                         /*
 460                          * Include the link-layer header.
 461                          */
 462                         hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
 463                 } else {
 464                         /*
 465                          * Don't include the link-layer header - and if
 466                          * we have nothing past the link-layer header,
 467                          * print nothing.
 468                          */
 469                         if (h->caplen > hdrlen)
 470                                 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
 471                                                     h->caplen - hdrlen);
 472                 }
 473         } else if (ndo->ndo_xflag) {
 474                 /*
 475                  * Print the raw packet data in hex.
 476                  */
 477                 if (ndo->ndo_xflag > 1) {
 478                         /*
 479                          * Include the link-layer header.
 480                          */
 481                         hex_print(ndo, "\n\t", sp, h->caplen);
 482                 } else {
 483                         /*
 484                          * Don't include the link-layer header - and if
 485                          * we have nothing past the link-layer header,
 486                          * print nothing.
 487                          */
 488                         if (h->caplen > hdrlen)
 489                                 hex_print(ndo, "\n\t", sp + hdrlen,
 490                                           h->caplen - hdrlen);
 491                 }
 492         } else if (ndo->ndo_Aflag) {
 493                 /*
 494                  * Print the raw packet data in ASCII.
 495                  */
 496                 if (ndo->ndo_Aflag > 1) {
 497                         /*
 498                          * Include the link-layer header.
 499                          */
 500                         ascii_print(ndo, sp, h->caplen);
 501                 } else {
 502                         /*
 503                          * Don't include the link-layer header - and if
 504                          * we have nothing past the link-layer header,
 505                          * print nothing.
 506                          */
 507                         if (h->caplen > hdrlen)
 508                                 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
 509                 }
 510         }
 511
 512         ND_PRINT("\n");
 513         nd_free_all(ndo);
 514 }
 515
 516 /*
 517  * By default, print the specified data out in hex and ASCII.
 518  */
 519 static void
 520 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
 521 {
 522         hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
 523 }
 524
 525 /* VARARGS */
 526 static void
 527 ndo_error(netdissect_options *ndo, status_exit_codes_t status,
 528           const char *fmt, ...)
 529 {
 530         va_list ap;
 531
 532         if (ndo->program_name)
 533                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 534         va_start(ap, fmt);
 535         (void)vfprintf(stderr, fmt, ap);
 536         va_end(ap);
 537         if (*fmt) {
 538                 fmt += strlen(fmt);
 539                 if (fmt[-1] != '\n')
 540                         (void)fputc('\n', stderr);
 541         }
 542         nd_cleanup();
 543         exit(status);
 544         /* NOTREACHED */
 545 }
 546
 547 /* VARARGS */
 548 static void
 549 ndo_warning(netdissect_options *ndo, const char *fmt, ...)
 550 {
 551         va_list ap;
 552
 553         if (ndo->program_name)
 554                 (void)fprintf(stderr, "%s: ", ndo->program_name);
 555         (void)fprintf(stderr, "WARNING: ");
 556         va_start(ap, fmt);
 557         (void)vfprintf(stderr, fmt, ap);
 558         va_end(ap);
 559         if (*fmt) {
 560                 fmt += strlen(fmt);
 561                 if (fmt[-1] != '\n')
 562                         (void)fputc('\n', stderr);
 563         }
 564 }
 565
 566 static int
 567 ndo_printf(netdissect_options *ndo, const char *fmt, ...)
 568 {
 569         va_list args;
 570         int ret;
 571
 572         va_start(args, fmt);
 573         ret = vfprintf(stdout, fmt, args);
 574         va_end(args);
 575
 576         if (ret < 0)
 577                 ndo_error(ndo, S_ERR_ND_WRITE_FILE,
 578                           "Unable to write output: %s", pcap_strerror(errno));
 579         return (ret);
 580 }
 581
 582 void
 583 ndo_set_function_pointers(netdissect_options *ndo)
 584 {
 585         ndo->ndo_default_print=ndo_default_print;
 586         ndo->ndo_printf=ndo_printf;
 587         ndo->ndo_error=ndo_error;
 588         ndo->ndo_warning=ndo_warning;
 589 }