Home | History | Annotate | Download | only in tcpdump 
      1 /*
      2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
      3  *	The Regents of the University of California.  All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that: (1) source code distributions
      7  * retain the above copyright notice and this paragraph in its entirety, (2)
      8  * distributions including binary code include the above copyright notice and
      9  * this paragraph in its entirety in the documentation or other materials
     10  * provided with the distribution, and (3) all advertising materials mentioning
     11  * features or use of this software display the following acknowledgement:
     12  * ``This product includes software developed by the University of California,
     13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
     14  * the University nor the names of its contributors may be used to endorse
     15  * or promote products derived from this software without specific prior
     16  * written permission.
     17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
     18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
     19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
     20  */
     21 
     22 #define NETDISSECT_REWORKED
     23 #ifdef HAVE_CONFIG_H
     24 #include "config.h"
     25 #endif
     26 
     27 #include <tcpdump-stdinc.h>
     28 
     29 #include "interface.h"
     30 #include "extract.h"
     31 
     32 #ifdef DLT_PKTAP
     33 
     34 /*
     35  * XXX - these are little-endian in the captures I've seen, but Apple
     36  * no longer make any big-endian machines (Macs use x86, iOS machines
     37  * use ARM and run it little-endian), so that might be by definition
     38  * or they might be host-endian.
     39  *
     40  * If a big-endian PKTAP file ever shows up, and it comes from a
     41  * big-endian machine, presumably these are host-endian, and we need
     42  * to just fetch the fields directly in tcpdump but byte-swap them
     43  * to host byte order in libpcap.
     44  */
     45 typedef struct pktap_header {
     46 	uint32_t	pkt_len;	/* length of pktap header */
     47 	uint32_t	pkt_rectype;	/* type of record */
     48 	uint32_t	pkt_dlt;	/* DLT type of this packet */
     49 	char		pkt_ifname[24];	/* interface name */
     50 	uint32_t	pkt_flags;
     51 	uint32_t	pkt_pfamily;	/* "protocol family" */
     52 	uint32_t	pkt_llhdrlen;	/* link-layer header length? */
     53 	uint32_t	pkt_lltrlrlen;	/* link-layer trailer length? */
     54 	uint32_t	pkt_pid;	/* process ID */
     55 	char		pkt_cmdname[20]; /* command name */
     56 	uint32_t	pkt_svc_class;	/* "service class" */
     57 	uint16_t	pkt_iftype;	/* "interface type" */
     58 	uint16_t	pkt_ifunit;	/* unit number of interface? */
     59 	uint32_t	pkt_epid;	/* "effective process ID" */
     60 	char		pkt_ecmdname[20]; /* "effective command name" */
     61 } pktap_header_t;
     62 
     63 /*
     64  * Record types.
     65  */
     66 #define PKT_REC_NONE	0	/* nothing follows the header */
     67 #define PKT_REC_PACKET	1	/* a packet follows the header */
     68 
     69 static inline void
     70 pktap_header_print(netdissect_options *ndo, const u_char *bp, u_int length)
     71 {
     72 	const pktap_header_t *hdr;
     73 	uint32_t dlt, hdrlen;
     74 
     75 	hdr = (const pktap_header_t *)bp;
     76 
     77 	dlt = EXTRACT_LE_32BITS(&hdr->pkt_dlt);
     78 	hdrlen = EXTRACT_LE_32BITS(&hdr->pkt_len);
     79 	if (!ndo->ndo_qflag) {
     80 		ND_PRINT((ndo,", DLT %s (%d) len %d",
     81 			  pcap_datalink_val_to_name(dlt), dlt, hdrlen));
     82         } else {
     83 		ND_PRINT((ndo,", %s", pcap_datalink_val_to_name(dlt)));
     84         }
     85 
     86 	ND_PRINT((ndo, ", length %u: ", length));
     87 }
     88 
     89 /*
     90  * This is the top level routine of the printer.  'p' points
     91  * to the ether header of the packet, 'h->ts' is the timestamp,
     92  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
     93  * is the number of bytes actually captured.
     94  */
     95 u_int
     96 pktap_if_print(netdissect_options *ndo,
     97                const struct pcap_pkthdr *h, const u_char *p)
     98 {
     99 	uint32_t dlt, hdrlen, rectype;
    100 	u_int caplen = h->caplen;
    101 	u_int length = h->len;
    102 	if_ndo_printer ndo_printer;
    103         if_printer printer;
    104 	pktap_header_t *hdr;
    105 
    106 	if (caplen < sizeof(pktap_header_t) || length < sizeof(pktap_header_t)) {
    107 		ND_PRINT((ndo, "[|pktap]"));
    108 		return (0);
    109 	}
    110 	hdr = (pktap_header_t *)p;
    111 	dlt = EXTRACT_LE_32BITS(&hdr->pkt_dlt);
    112 	hdrlen = EXTRACT_LE_32BITS(&hdr->pkt_len);
    113 	if (hdrlen < sizeof(pktap_header_t)) {
    114 		/*
    115 		 * Claimed header length < structure length.
    116 		 * XXX - does this just mean some fields aren't
    117 		 * being supplied, or is it truly an error (i.e.,
    118 		 * is the length supplied so that the header can
    119 		 * be expanded in the future)?
    120 		 */
    121 		ND_PRINT((ndo, "[|pktap]"));
    122 		return (0);
    123 	}
    124 	if (caplen < hdrlen || length < hdrlen) {
    125 		ND_PRINT((ndo, "[|pktap]"));
    126 		return (hdrlen);
    127 	}
    128 
    129 	if (ndo->ndo_eflag)
    130 		pktap_header_print(ndo, p, length);
    131 
    132 	length -= hdrlen;
    133 	caplen -= hdrlen;
    134 	p += hdrlen;
    135 
    136 	rectype = EXTRACT_LE_32BITS(&hdr->pkt_rectype);
    137 	switch (rectype) {
    138 
    139 	case PKT_REC_NONE:
    140 		ND_PRINT((ndo, "no data"));
    141 		break;
    142 
    143 	case PKT_REC_PACKET:
    144 		if ((printer = lookup_printer(dlt)) != NULL) {
    145 			printer(h, p);
    146 		} else if ((ndo_printer = lookup_ndo_printer(dlt)) != NULL) {
    147 			ndo_printer(ndo, h, p);
    148 		} else {
    149 			if (!ndo->ndo_eflag)
    150 				pktap_header_print(ndo, (u_char *)hdr,
    151 						length + hdrlen);
    152 
    153 			if (!ndo->ndo_suppress_default_print)
    154 				ND_DEFAULTPRINT(p, caplen);
    155 		}
    156 		break;
    157 	}
    158 
    159 	return (hdrlen);
    160 }
    161 
    162 /*
    163  * Local Variables:
    164  * c-style: whitesmith
    165  * c-basic-offset: 8
    166  * End:
    167  */
    168 
    169 #endif /* DLT_PKTAP */
    170