X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/05ec05a87b3a7c6983a16b5ae62d0f1512c4ce89..a63600a1fc28dbc7ae7ce9f996829c49a25fb33c:/print-nflog.c diff --git a/print-nflog.c b/print-nflog.c index fdd21e69..bbe4ccfc 100644 --- a/print-nflog.c +++ b/print-nflog.c @@ -25,130 +25,217 @@ * DAMAGE. */ +/* \summary: DLT_NFLOG printer */ + #ifdef HAVE_CONFIG_H -#include "config.h" +#include #endif -#include - -#include -#include +#include "netdissect-stdinc.h" #include "netdissect.h" -#include "interface.h" - -#ifdef HAVE_LINUX_NETFILTER_NFNETLINK_LOG_H -#include -#include "nflog.h" +#include "extract.h" #ifdef DLT_NFLOG -const struct tok nflog_values[] = { - { AF_INET, "IPv4" }, - { AF_INET6, "IPv6" }, - { 0, NULL } +/* + * Structure of an NFLOG header and TLV parts, as described at + * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html + * + * The NFLOG header is big-endian. + * + * The TLV length and type are in host byte order. The value is either + * big-endian or is an array of bytes in some externally-specified byte + * order (text string, link-layer address, link-layer header, packet + * data, etc.). + */ +typedef struct nflog_hdr { + nd_uint8_t nflog_family; /* address family */ + nd_uint8_t nflog_version; /* version */ + nd_uint16_t nflog_rid; /* resource ID */ +} nflog_hdr_t; + +#define NFLOG_HDR_LEN sizeof(nflog_hdr_t) + +typedef struct nflog_tlv { + nd_uint16_t tlv_length; /* tlv length */ + nd_uint16_t tlv_type; /* tlv type */ + /* value follows this */ +} nflog_tlv_t; + +#define NFLOG_TLV_LEN sizeof(nflog_tlv_t) + +typedef struct nflog_packet_hdr { + nd_uint16_t hw_protocol; /* hw protocol */ + nd_uint8_t hook; /* netfilter hook */ + nd_byte pad[1]; /* padding to 32 bits */ +} nflog_packet_hdr_t; + +typedef struct nflog_hwaddr { + nd_uint16_t hw_addrlen; /* address length */ + nd_byte pad[2]; /* padding to 32-bit boundary */ + nd_byte hw_addr[8]; /* address, up to 8 bytes */ +} nflog_hwaddr_t; + +typedef struct nflog_timestamp { + nd_uint64_t sec; + nd_uint64_t usec; +} nflog_timestamp_t; + +/* + * TLV types. + */ +#define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */ +#define NFULA_MARK 2 /* packet mark from skbuff */ +#define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */ +#define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */ +#define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */ +#define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */ +#define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */ +#define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */ +#define NFULA_PAYLOAD 9 /* packet payload */ +#define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */ +#define NFULA_UID 11 /* UID owning socket on which packet was sent/received */ +#define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */ +#define NFULA_SEQ_GLOBAL 13 /* sequence number of pakets on all NFLOG sockets */ +#define NFULA_GID 14 /* GID owning socket on which packet was sent/received */ +#define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */ +#define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */ +#define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */ + +/* + * Define two constants specifically for the two AF code points from the + * LINKTYPE_NFLOG specification above and use these constants instead of + * AF_INET and AF_INET6. This is the only way to dissect the "wire" encoding + * correctly because some BSD systems define AF_INET6 differently from Linux + * (see af.h) and Haiku defines both AF_INET and AF_INET6 differently from + * Linux. + */ +#define NFLOG_AF_INET 2 +#define NFLOG_AF_INET6 10 +static const struct tok nflog_values[] = { + { NFLOG_AF_INET, "IPv4" }, + { NFLOG_AF_INET6, "IPv6" }, + { 0, NULL } }; -static inline void -nflog_hdr_print(struct netdissect_options *ndo, const u_char *bp, u_int length) +static void +nflog_hdr_print(netdissect_options *ndo, const nflog_hdr_t *hdr, u_int length) { - const nflog_hdr_t *hdr; - hdr = (const nflog_hdr_t *)bp; - - ND_PRINT((ndo, "version %d, resource ID %d", hdr->nflog_version, ntohs(hdr->nflog_rid))); + ND_PRINT("version %u, resource ID %u", + GET_U_1(hdr->nflog_version), GET_BE_U_2(hdr->nflog_rid)); if (!ndo->ndo_qflag) { - ND_PRINT((ndo,", family %s (%d)", - tok2str(nflog_values, "Unknown", - hdr->nflog_family), - hdr->nflog_family)); + ND_PRINT(", family %s (%u)", + tok2str(nflog_values, "Unknown", + GET_U_1(hdr->nflog_family)), + GET_U_1(hdr->nflog_family)); } else { - ND_PRINT((ndo,", %s", - tok2str(nflog_values, - "Unknown NFLOG (0x%02x)", - hdr->nflog_family))); + ND_PRINT(", %s", + tok2str(nflog_values, + "Unknown NFLOG (0x%02x)", + GET_U_1(hdr->nflog_family))); } - ND_PRINT((ndo, ", length %u: ", length)); + ND_PRINT(", length %u: ", length); } -static void -nflog_print(struct netdissect_options *ndo, const u_char *p, u_int length, u_int caplen) +void +nflog_if_print(netdissect_options *ndo, + const struct pcap_pkthdr *h, const u_char *p) { - const nflog_hdr_t *hdr; - const nflog_tlv_t *tlv; - u_int16_t size; + const nflog_hdr_t *hdr = (const nflog_hdr_t *)p; + uint16_t size; + uint16_t h_size = NFLOG_HDR_LEN; + u_int caplen = h->caplen; + u_int length = h->len; + + ndo->ndo_protocol = "nflog"; + if (caplen < NFLOG_HDR_LEN) { + nd_print_trunc(ndo); + ndo->ndo_ll_hdr_len += caplen; + return; + } + ndo->ndo_ll_hdr_len += NFLOG_HDR_LEN; - if (caplen < (int) sizeof(nflog_hdr_t)) { - ND_PRINT((ndo, "[|nflog]")); + ND_TCHECK_SIZE(hdr); + if (GET_U_1(hdr->nflog_version) != 0) { + ND_PRINT("version %u (unknown)", GET_U_1(hdr->nflog_version)); return; } if (ndo->ndo_eflag) - nflog_hdr_print(ndo, p, length); + nflog_hdr_print(ndo, hdr, length); - length -= sizeof(nflog_hdr_t); - caplen -= sizeof(nflog_hdr_t); - hdr = (const nflog_hdr_t *)p; - p += sizeof(nflog_hdr_t); + p += NFLOG_HDR_LEN; + length -= NFLOG_HDR_LEN; + caplen -= NFLOG_HDR_LEN; - do { - tlv = (const nflog_tlv_t *) p; - size = tlv->tlv_length; + while (length > 0) { + const nflog_tlv_t *tlv; - /* wrong size of the packet */ - if (size > length ) - return; - - /* wrong tlv type */ - if (tlv->tlv_type > NFULA_MAX) - return; + /* We have some data. Do we have enough for the TLV header? */ + if (caplen < NFLOG_TLV_LEN) + goto trunc; /* No. */ + tlv = (const nflog_tlv_t *) p; + ND_TCHECK_SIZE(tlv); + size = GET_HE_U_2(tlv->tlv_length); if (size % 4 != 0) size += 4 - size % 4; - p += size; - length = length - size; - caplen = caplen - size; - - } while (tlv->tlv_type != NFULA_PAYLOAD); + /* Is the TLV's length less than the minimum? */ + if (size < NFLOG_TLV_LEN) + goto trunc; /* Yes. Give up now. */ + + /* Do we have enough data for the full TLV? */ + if (caplen < size) + goto trunc; /* No. */ + + if (GET_HE_U_2(tlv->tlv_type) == NFULA_PAYLOAD) { + /* + * This TLV's data is the packet payload. + * Skip past the TLV header, and break out + * of the loop so we print the packet data. + */ + p += NFLOG_TLV_LEN; + h_size += NFLOG_TLV_LEN; + length -= NFLOG_TLV_LEN; + caplen -= NFLOG_TLV_LEN; + break; + } - /* dont skip payload just tlv length and type */ - p = p - size + 4; - length += size - 4; - caplen += size - 4; + p += size; + h_size += size; + length -= size; + caplen -= size; + } - switch (hdr->nflog_family) { + switch (GET_U_1(hdr->nflog_family)) { - case AF_INET: - ip_print(ndo, p, length); + case NFLOG_AF_INET: + ip_print(ndo, p, length); break; -#ifdef INET6 - case AF_INET6: + case NFLOG_AF_INET6: ip6_print(ndo, p, length); break; -#endif /*INET6*/ default: if (!ndo->ndo_eflag) - nflog_hdr_print(ndo, (u_char *)hdr, - length + sizeof(nflog_hdr_t)); + nflog_hdr_print(ndo, hdr, + length + NFLOG_HDR_LEN); if (!ndo->ndo_suppress_default_print) - ndo->ndo_default_print(ndo, p, caplen); + ND_DEFAULTPRINT(p, caplen); break; } -} - -u_int -nflog_if_print(struct netdissect_options *ndo, - const struct pcap_pkthdr *h, const u_char *p) -{ - nflog_print(ndo, p, h->len, h->caplen); - return (sizeof(nflog_hdr_t)); + ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN; + return; +trunc: + nd_print_trunc(ndo); + ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN; } -#endif /* HAVE_LINUX_NETFILTER_NFNETLINK_LOG_H */ #endif /* DLT_NFLOG */