X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/68707bd200fc99f2454ad89ace0d8ba1700b1732..refs/heads/master:/print-nflog.c diff --git a/print-nflog.c b/print-nflog.c index 522d212c..0f5b8b8d 100644 --- a/print-nflog.c +++ b/print-nflog.c @@ -27,103 +27,174 @@ /* \summary: DLT_NFLOG printer */ -#ifdef HAVE_CONFIG_H #include -#endif #include "netdissect-stdinc.h" +#define ND_LONGJMP_FROM_TCHECK #include "netdissect.h" -static const char tstr[] = " [|nflog]"; +#include "extract.h" -#if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H) -#include +#ifdef DLT_NFLOG +/* + * Structure of an NFLOG header and TLV parts, as described at + * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html + * + * The NFLOG header is big-endian. + * + * The TLV length and type are in host byte order. The value is either + * big-endian or is an array of bytes in some externally-specified byte + * order (text string, link-layer address, link-layer header, packet + * data, etc.). + */ +typedef struct nflog_hdr { + nd_uint8_t nflog_family; /* address family */ + nd_uint8_t nflog_version; /* version */ + nd_uint16_t nflog_rid; /* resource ID */ +} nflog_hdr_t; + +#define NFLOG_HDR_LEN sizeof(nflog_hdr_t) + +typedef struct nflog_tlv { + nd_uint16_t tlv_length; /* tlv length */ + nd_uint16_t tlv_type; /* tlv type */ + /* value follows this */ +} nflog_tlv_t; + +#define NFLOG_TLV_LEN sizeof(nflog_tlv_t) + +typedef struct nflog_packet_hdr { + nd_uint16_t hw_protocol; /* hw protocol */ + nd_uint8_t hook; /* netfilter hook */ + nd_byte pad[1]; /* padding to 32 bits */ +} nflog_packet_hdr_t; + +typedef struct nflog_hwaddr { + nd_uint16_t hw_addrlen; /* address length */ + nd_byte pad[2]; /* padding to 32-bit boundary */ + nd_byte hw_addr[8]; /* address, up to 8 bytes */ +} nflog_hwaddr_t; + +typedef struct nflog_timestamp { + nd_uint64_t sec; + nd_uint64_t usec; +} nflog_timestamp_t; + +/* + * TLV types. + */ +#define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */ +#define NFULA_MARK 2 /* packet mark from skbuff */ +#define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */ +#define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */ +#define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */ +#define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */ +#define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */ +#define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */ +#define NFULA_PAYLOAD 9 /* packet payload */ +#define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */ +#define NFULA_UID 11 /* UID owning socket on which packet was sent/received */ +#define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */ +#define NFULA_SEQ_GLOBAL 13 /* sequence number of packets on all NFLOG sockets */ +#define NFULA_GID 14 /* GID owning socket on which packet was sent/received */ +#define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */ +#define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */ +#define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */ + +/* + * Define two constants specifically for the two AF code points from the + * LINKTYPE_NFLOG specification above and use these constants instead of + * AF_INET and AF_INET6. This is the only way to dissect the "wire" encoding + * correctly because some BSD systems define AF_INET6 differently from Linux + * (see af.h) and Haiku defines both AF_INET and AF_INET6 differently from + * Linux. + */ +#define NFLOG_AF_INET 2 +#define NFLOG_AF_INET6 10 static const struct tok nflog_values[] = { - { AF_INET, "IPv4" }, -#ifdef AF_INET6 - { AF_INET6, "IPv6" }, -#endif /*AF_INET6*/ + { NFLOG_AF_INET, "IPv4" }, + { NFLOG_AF_INET6, "IPv6" }, { 0, NULL } }; static void nflog_hdr_print(netdissect_options *ndo, const nflog_hdr_t *hdr, u_int length) { - ND_PRINT("version %d, resource ID %d", hdr->nflog_version, ntohs(hdr->nflog_rid)); + ND_PRINT("version %u, resource ID %u", + GET_U_1(hdr->nflog_version), GET_BE_U_2(hdr->nflog_rid)); if (!ndo->ndo_qflag) { - ND_PRINT(", family %s (%d)", + ND_PRINT(", family %s (%u)", tok2str(nflog_values, "Unknown", - hdr->nflog_family), - hdr->nflog_family); + GET_U_1(hdr->nflog_family)), + GET_U_1(hdr->nflog_family)); } else { ND_PRINT(", %s", tok2str(nflog_values, "Unknown NFLOG (0x%02x)", - hdr->nflog_family)); + GET_U_1(hdr->nflog_family))); } ND_PRINT(", length %u: ", length); } -u_int +void nflog_if_print(netdissect_options *ndo, - const struct pcap_pkthdr *h, const u_char *p) + const struct pcap_pkthdr *h, const u_char *p) { const nflog_hdr_t *hdr = (const nflog_hdr_t *)p; uint16_t size; - uint16_t h_size = sizeof(nflog_hdr_t); + uint16_t h_size = NFLOG_HDR_LEN; u_int caplen = h->caplen; u_int length = h->len; - if (caplen < sizeof(nflog_hdr_t) || length < sizeof(nflog_hdr_t)) - goto trunc; + ndo->ndo_protocol = "nflog"; + ND_ICHECK_ZU(length, <, NFLOG_HDR_LEN); ND_TCHECK_SIZE(hdr); - if (hdr->nflog_version != 0) { - ND_PRINT("version %u (unknown)", hdr->nflog_version); - return h_size; + ndo->ndo_ll_hdr_len += NFLOG_HDR_LEN; + + if (GET_U_1(hdr->nflog_version) != 0) { + ND_PRINT("version %u (unknown)", GET_U_1(hdr->nflog_version)); + return; } if (ndo->ndo_eflag) nflog_hdr_print(ndo, hdr, length); - p += sizeof(nflog_hdr_t); - length -= sizeof(nflog_hdr_t); - caplen -= sizeof(nflog_hdr_t); + p += NFLOG_HDR_LEN; + length -= NFLOG_HDR_LEN; + caplen -= NFLOG_HDR_LEN; - while (length > 0) { + while (length != 0) { const nflog_tlv_t *tlv; - /* We have some data. Do we have enough for the TLV header? */ - if (caplen < sizeof(nflog_tlv_t) || length < sizeof(nflog_tlv_t)) - goto trunc; /* No. */ - + ND_ICHECK_ZU(length, <, NFLOG_TLV_LEN); tlv = (const nflog_tlv_t *) p; + /* Do we have enough data for the TLV header? */ ND_TCHECK_SIZE(tlv); - size = tlv->tlv_length; + size = GET_HE_U_2(tlv->tlv_length); if (size % 4 != 0) size += 4 - size % 4; /* Is the TLV's length less than the minimum? */ - if (size < sizeof(nflog_tlv_t)) - goto trunc; /* Yes. Give up now. */ + ND_ICHECK_ZU(size, <, NFLOG_TLV_LEN); + ND_ICHECK_U(length, <, size); /* Do we have enough data for the full TLV? */ - if (caplen < size || length < size) - goto trunc; /* No. */ + ND_TCHECK_LEN(tlv, size); - if (tlv->tlv_type == NFULA_PAYLOAD) { + if (GET_HE_U_2(tlv->tlv_type) == NFULA_PAYLOAD) { /* * This TLV's data is the packet payload. * Skip past the TLV header, and break out * of the loop so we print the packet data. */ - p += sizeof(nflog_tlv_t); - h_size += sizeof(nflog_tlv_t); - length -= sizeof(nflog_tlv_t); - caplen -= sizeof(nflog_tlv_t); + p += NFLOG_TLV_LEN; + h_size += NFLOG_TLV_LEN; + length -= NFLOG_TLV_LEN; + caplen -= NFLOG_TLV_LEN; break; } @@ -133,32 +204,31 @@ nflog_if_print(netdissect_options *ndo, caplen -= size; } - switch (hdr->nflog_family) { + switch (GET_U_1(hdr->nflog_family)) { - case AF_INET: + case NFLOG_AF_INET: ip_print(ndo, p, length); break; -#ifdef AF_INET6 - case AF_INET6: + case NFLOG_AF_INET6: ip6_print(ndo, p, length); break; -#endif /* AF_INET6 */ default: if (!ndo->ndo_eflag) nflog_hdr_print(ndo, hdr, - length + sizeof(nflog_hdr_t)); + length + NFLOG_HDR_LEN); if (!ndo->ndo_suppress_default_print) ND_DEFAULTPRINT(p, caplen); break; } - return h_size; -trunc: - ND_PRINT("%s", tstr); - return h_size; + ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN; + return; + +invalid: + nd_print_invalid(ndo); } -#endif /* defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H) */ +#endif /* DLT_NFLOG */