((uint32_t)(*((const uint8_t *)(p) + 3)) << 0)))
#endif /* unaligned access checks */
+/*
+ * Extract numerical values in *host* byte order. (Some metadata
+ * headers are in the byte order of the host that wrote the file,
+ * and libpcap translate them to the byte order of the host
+ * reading the file. This means that if a program on that host
+ * reads with libpcap and writes to a new file, the new file will
+ * be written in the byte order of the host writing the file. Thus,
+ * the magic number in pcap files and byte-order magic in pcapng
+ * files can be used to determine the byte order in those metadata
+ * headers.)
+ *
+ * XXX - on platforms that can do unaligned accesses, just cast and
+ * dereference the pointer.
+ */
+static inline uint16_t
+EXTRACT_HE_U_2(const void *p)
+{
+ uint16_t val;
+
+ UNALIGNED_MEMCPY(&val, p, sizeof(uint16_t));
+ return val;
+}
+
+static inline uint16_t
+EXTRACT_HE_S_2(const void *p)
+{
+ int16_t val;
+
+ UNALIGNED_MEMCPY(&val, p, sizeof(int16_t));
+ return val;
+}
+
+static inline uint16_t
+EXTRACT_HE_U_4(const void *p)
+{
+ uint32_t val;
+
+ UNALIGNED_MEMCPY(&val, p, sizeof(uint32_t));
+ return val;
+}
+
+static inline uint16_t
+EXTRACT_HE_S_4(const void *p)
+{
+ int32_t val;
+
+ UNALIGNED_MEMCPY(&val, p, sizeof(int32_t));
+ return val;
+}
+
/*
* Extract an IPv4 address, which is in network byte order, and which
* is not necessarily aligned on a 4-byte boundary, and provide the
#include <netdissect-stdinc.h>
#include "netdissect.h"
+#include "extract.h"
+#ifdef DLT_USB_LINUX
+/*
+ * possible transfer mode
+ */
+#define URB_TRANSFER_IN 0x80
+#define URB_ISOCHRONOUS 0x0
+#define URB_INTERRUPT 0x1
+#define URB_CONTROL 0x2
+#define URB_BULK 0x3
+
+/*
+ * possible event type
+ */
+#define URB_SUBMIT 'S'
+#define URB_COMPLETE 'C'
+#define URB_ERROR 'E'
+
+/*
+ * USB setup header as defined in USB specification.
+ * Appears at the front of each Control S-type packet in DLT_USB captures.
+ */
+typedef struct _usb_setup {
+ nd_uint8_t bmRequestType;
+ nd_uint8_t bRequest;
+ nd_uint16_t wValue;
+ nd_uint16_t wIndex;
+ nd_uint16_t wLength;
+} pcap_usb_setup;
+
+/*
+ * Information from the URB for Isochronous transfers.
+ */
+typedef struct _iso_rec {
+ nd_int32_t error_count;
+ nd_int32_t numdesc;
+} iso_rec;
+
+/*
+ * Header prepended by linux kernel to each event.
+ * Appears at the front of each packet in DLT_USB_LINUX captures.
+ */
+typedef struct _usb_header {
+ nd_uint64_t id;
+ nd_uint8_t event_type;
+ nd_uint8_t transfer_type;
+ nd_uint8_t endpoint_number;
+ nd_uint8_t device_address;
+ nd_uint16_t bus_id;
+ nd_uint8_t setup_flag;/*if !=0 the urb setup header is not present*/
+ nd_uint8_t data_flag; /*if !=0 no urb data is present*/
+ nd_int64_t ts_sec;
+ nd_int32_t ts_usec;
+ nd_int32_t status;
+ nd_uint32_t urb_len;
+ nd_uint32_t data_len; /* amount of urb data really present in this event*/
+ pcap_usb_setup setup;
+} pcap_usb_header;
+
+/*
+ * Header prepended by linux kernel to each event for the 2.6.31
+ * and later kernels; for the 2.6.21 through 2.6.30 kernels, the
+ * "iso_rec" information, and the fields starting with "interval"
+ * are zeroed-out padding fields.
+ *
+ * Appears at the front of each packet in DLT_USB_LINUX_MMAPPED captures.
+ */
+typedef struct _usb_header_mmapped {
+ nd_uint64_t id;
+ nd_uint8_t event_type;
+ nd_uint8_t transfer_type;
+ nd_uint8_t endpoint_number;
+ nd_uint8_t device_address;
+ nd_uint16_t bus_id;
+ nd_uint8_t setup_flag;/*if !=0 the urb setup header is not present*/
+ nd_uint8_t data_flag; /*if !=0 no urb data is present*/
+ nd_int64_t ts_sec;
+ nd_int32_t ts_usec;
+ nd_int32_t status;
+ nd_uint32_t urb_len;
+ nd_uint32_t data_len; /* amount of urb data really present in this event*/
+ union {
+ pcap_usb_setup setup;
+ iso_rec iso;
+ } s;
+ nd_int32_t interval; /* for Interrupt and Isochronous events */
+ nd_int32_t start_frame; /* for Isochronous events */
+ nd_uint32_t xfer_flags; /* copy of URB's transfer flags */
+ nd_uint32_t ndesc; /* number of isochronous descriptors */
+} pcap_usb_header_mmapped;
-#if defined(HAVE_PCAP_USB_H) && defined(DLT_USB_LINUX)
-#include <pcap/usb.h>
+/*
+ * Isochronous descriptors; for isochronous transfers there might be
+ * one or more of these at the beginning of the packet data. The
+ * number of descriptors is given by the "ndesc" field in the header;
+ * as indicated, in older kernels that don't put the descriptors at
+ * the beginning of the packet, that field is zeroed out, so that field
+ * can be trusted even in captures from older kernels.
+ */
+typedef struct _usb_isodesc {
+ nd_int32_t status;
+ nd_uint32_t offset;
+ nd_uint32_t len;
+ nd_byte pad[4];
+} usb_isodesc;
static const char tstr[] = "[|usb]";
usb_header_print(netdissect_options *ndo, const pcap_usb_header *uh)
{
int direction;
+ uint8_t transfer_type, event_type;
- switch(uh->transfer_type)
+ transfer_type = EXTRACT_U_1(uh->transfer_type);
+ switch(transfer_type)
{
case URB_ISOCHRONOUS:
ND_PRINT("ISOCHRONOUS");
ND_PRINT(" ?");
}
- switch(uh->event_type)
+ event_type = EXTRACT_U_1(uh->event_type);
+ switch(event_type)
{
case URB_SUBMIT:
ND_PRINT(" SUBMIT");
ND_PRINT(" ?");
}
- direction = get_direction(uh->transfer_type, uh->event_type);
+ direction = get_direction(transfer_type, event_type);
if(direction == 1)
ND_PRINT(" from");
else if(direction == 2)
ND_PRINT(" to");
- ND_PRINT(" %d:%d:%d", uh->bus_id, uh->device_address, uh->endpoint_number & 0x7f);
+ ND_PRINT(" %u:%u:%u", EXTRACT_HE_U_2(uh->bus_id), EXTRACT_U_1(uh->device_address), EXTRACT_U_1(uh->endpoint_number) & 0x7f);
}
/*
}
#endif /* DLT_USB_LINUX_MMAPPED */
-#endif /* defined(HAVE_PCAP_USB_H) && defined(DLT_USB_LINUX) */
+#endif /* DLT_USB_LINUX */
projects / tcpdump / commitdiff
