nexmon – Blame information for rev 1

Subversion Repositories:
Rev:
Rev Author Line No. Line
1 office 1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21  
22 #define NETDISSECT_REWORKED
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26  
27 #include <tcpdump-stdinc.h>
28  
29 #include "interface.h"
30 #include "extract.h"
31  
32 #ifdef DLT_PKTAP
33  
34 /*
35 * XXX - these are little-endian in the captures I've seen, but Apple
36 * no longer make any big-endian machines (Macs use x86, iOS machines
37 * use ARM and run it little-endian), so that might be by definition
38 * or they might be host-endian.
39 *
40 * If a big-endian PKTAP file ever shows up, and it comes from a
41 * big-endian machine, presumably these are host-endian, and we need
42 * to just fetch the fields directly in tcpdump but byte-swap them
43 * to host byte order in libpcap.
44 */
45 typedef struct pktap_header {
46 uint32_t pkt_len; /* length of pktap header */
47 uint32_t pkt_rectype; /* type of record */
48 uint32_t pkt_dlt; /* DLT type of this packet */
49 char pkt_ifname[24]; /* interface name */
50 uint32_t pkt_flags;
51 uint32_t pkt_pfamily; /* "protocol family" */
52 uint32_t pkt_llhdrlen; /* link-layer header length? */
53 uint32_t pkt_lltrlrlen; /* link-layer trailer length? */
54 uint32_t pkt_pid; /* process ID */
55 char pkt_cmdname[20]; /* command name */
56 uint32_t pkt_svc_class; /* "service class" */
57 uint16_t pkt_iftype; /* "interface type" */
58 uint16_t pkt_ifunit; /* unit number of interface? */
59 uint32_t pkt_epid; /* "effective process ID" */
60 char pkt_ecmdname[20]; /* "effective command name" */
61 } pktap_header_t;
62  
63 /*
64 * Record types.
65 */
66 #define PKT_REC_NONE 0 /* nothing follows the header */
67 #define PKT_REC_PACKET 1 /* a packet follows the header */
68  
69 static inline void
70 pktap_header_print(netdissect_options *ndo, const u_char *bp, u_int length)
71 {
72 const pktap_header_t *hdr;
73 uint32_t dlt, hdrlen;
74  
75 hdr = (const pktap_header_t *)bp;
76  
77 dlt = EXTRACT_LE_32BITS(&hdr->pkt_dlt);
78 hdrlen = EXTRACT_LE_32BITS(&hdr->pkt_len);
79 if (!ndo->ndo_qflag) {
80 ND_PRINT((ndo,", DLT %s (%d) len %d",
81 pcap_datalink_val_to_name(dlt), dlt, hdrlen));
82 } else {
83 ND_PRINT((ndo,", %s", pcap_datalink_val_to_name(dlt)));
84 }
85  
86 ND_PRINT((ndo, ", length %u: ", length));
87 }
88  
89 /*
90 * This is the top level routine of the printer. 'p' points
91 * to the ether header of the packet, 'h->ts' is the timestamp,
92 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
93 * is the number of bytes actually captured.
94 */
95 u_int
96 pktap_if_print(netdissect_options *ndo,
97 const struct pcap_pkthdr *h, const u_char *p)
98 {
99 uint32_t dlt, hdrlen, rectype;
100 u_int caplen = h->caplen;
101 u_int length = h->len;
102 if_ndo_printer ndo_printer;
103 if_printer printer;
104 pktap_header_t *hdr;
105  
106 if (caplen < sizeof(pktap_header_t) || length < sizeof(pktap_header_t)) {
107 ND_PRINT((ndo, "[|pktap]"));
108 return (0);
109 }
110 hdr = (pktap_header_t *)p;
111 dlt = EXTRACT_LE_32BITS(&hdr->pkt_dlt);
112 hdrlen = EXTRACT_LE_32BITS(&hdr->pkt_len);
113 if (hdrlen < sizeof(pktap_header_t)) {
114 /*
115 * Claimed header length < structure length.
116 * XXX - does this just mean some fields aren't
117 * being supplied, or is it truly an error (i.e.,
118 * is the length supplied so that the header can
119 * be expanded in the future)?
120 */
121 ND_PRINT((ndo, "[|pktap]"));
122 return (0);
123 }
124 if (caplen < hdrlen || length < hdrlen) {
125 ND_PRINT((ndo, "[|pktap]"));
126 return (hdrlen);
127 }
128  
129 if (ndo->ndo_eflag)
130 pktap_header_print(ndo, p, length);
131  
132 length -= hdrlen;
133 caplen -= hdrlen;
134 p += hdrlen;
135  
136 rectype = EXTRACT_LE_32BITS(&hdr->pkt_rectype);
137 switch (rectype) {
138  
139 case PKT_REC_NONE:
140 ND_PRINT((ndo, "no data"));
141 break;
142  
143 case PKT_REC_PACKET:
144 if ((printer = lookup_printer(dlt)) != NULL) {
145 printer(h, p);
146 } else if ((ndo_printer = lookup_ndo_printer(dlt)) != NULL) {
147 ndo_printer(ndo, h, p);
148 } else {
149 if (!ndo->ndo_eflag)
150 pktap_header_print(ndo, (u_char *)hdr,
151 length + hdrlen);
152  
153 if (!ndo->ndo_suppress_default_print)
154 ND_DEFAULTPRINT(p, caplen);
155 }
156 break;
157 }
158  
159 return (hdrlen);
160 }
161  
162 /*
163 * Local Variables:
164 * c-style: whitesmith
165 * c-basic-offset: 8
166 * End:
167 */
168  
169 #endif /* DLT_PKTAP */