1 /* 2 * Copyright (c) 2009-2015 by Farsight Security, Inc. 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NMSG_IPDG_H 18 #define NMSG_IPDG_H 19 20 /*! \file nmsg/ipdg.h 21 * \brief IP datagram parsing functions. 22 * 23 * These functions parse network packets or ethernet frames and return 24 * IP datagrams, performing reassembly if requested. Non-IP packets are 25 * discarded. 26 */ 27 28 /** 29 * Parsed IP datagram. 30 */ 31 struct nmsg_ipdg { 32 int proto_network; /*%< PF_* value */ 33 int proto_transport; /*%< transport protocol */ 34 unsigned len_network; /*%< length starting from network */ 35 unsigned len_transport; /*%< length starting from transport */ 36 unsigned len_payload; /*%< length starting from payload */ 37 const u_char *network; /*%< pointer to network header */ 38 const u_char *transport; /*%< pointer to transport header */ 39 const u_char *payload; /*%< pointer to application payload */ 40 }; 41 42 /** 43 * Parse IP packets from the network layer, discarding fragments. 44 * 45 * Populate a struct nmsg_ipdg indicating where the network, transport, and 46 * payload sections of the packet are and the length of the remaining packet at 47 * each of those sections. 48 * 49 * This function operates on datagrams from the network layer. 50 * 51 * Broken and fragmented datagrams are discarded. 52 * 53 * \param[out] dg caller-allocated struct nmsg_ipdg which will be populated 54 * after a successful call. 55 * 56 * \param[in] etype ETHERTYPE_* value. The only supported values are 57 * ETHERTYPE_IP and ETHERTYPE_IPV6. 58 * 59 * \param[in] len length of the packet. 60 * 61 * \param[in] pkt pointer to the packet. 62 * 63 * \return #nmsg_res_success 64 * \return #nmsg_res_again 65 */ 66 nmsg_res 67 nmsg_ipdg_parse(struct nmsg_ipdg *dg, unsigned etype, size_t len, 68 const u_char *pkt); 69 70 /** 71 * Parse IP datagrams from the data link layer, performing reassembly if 72 * necessary. 73 * 74 * Populate a struct nmsg_ipdg indicating where the network, transport, and 75 * payload sections of the datagram are and the length of the remaining packet 76 * at each of those sections. 77 * 78 * This function operates on raw frames returned by libpcap from the data 79 * link layer. The packet beginning at 'pkt' must match the datalink type 80 * associated with 'pcap' and must be pkt_hdr->caplen octets long. 81 * 82 * libpcap data link types DLT_EN10MB, DLT_RAW, and DLT_LINUX_SLL are supported. 83 * 84 * Broken packets are discarded. All but the final fragment of a fragmented 85 * datagram are stored internally and #nmsg_res_again is returned. 86 * 87 * \param[out] dg caller-allocated struct nmsg_ipdg which will be populated 88 * after a successful call. 89 * 90 * \param[in] pcap caller-initialized nmsg_pcap object from whose pcap handle 91 * the packet 'pkt' was received. 92 * 93 * \param[in] pkt_hdr pointer to the pcap packet header corresponding to 'pkt'. 94 * 95 * \param[in] pkt pointer to the packet. 96 * 97 * \return #nmsg_res_success 98 * \return #nmsg_res_again 99 */ 100 nmsg_res 101 nmsg_ipdg_parse_pcap(struct nmsg_ipdg *dg, nmsg_pcap_t pcap, 102 struct pcap_pkthdr *pkt_hdr, const u_char *pkt); 103 104 /** 105 * Like nmsg_ipdg_parse_pcap(), but performs no fragment handling. 106 * 107 * \param[out] dg caller-allocated struct nmsg_ipdg which will be populated 108 * after a successful call. 109 * 110 * \param[in] datalink libpcap data link type. 111 * 112 * \param[in] pkt pointer to the packet. 113 * 114 * \param[in] len length of the packet. 115 */ 116 nmsg_res 117 nmsg_ipdg_parse_pcap_raw(struct nmsg_ipdg *dg, int datalink, const uint8_t *pkt, size_t len); 118 119 #endif /* NMSG_IPDG_H */ 120