1411677aeSAaron LI /*
2411677aeSAaron LI * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3411677aeSAaron LI * The Regents of the University of California. All rights reserved.
4411677aeSAaron LI *
5411677aeSAaron LI * Redistribution and use in source and binary forms, with or without
6411677aeSAaron LI * modification, are permitted provided that: (1) source code distributions
7411677aeSAaron LI * retain the above copyright notice and this paragraph in its entirety, (2)
8411677aeSAaron LI * distributions including binary code include the above copyright notice and
9411677aeSAaron LI * this paragraph in its entirety in the documentation or other materials
10411677aeSAaron LI * provided with the distribution, and (3) all advertising materials mentioning
11411677aeSAaron LI * features or use of this software display the following acknowledgement:
12411677aeSAaron LI * ``This product includes software developed by the University of California,
13411677aeSAaron LI * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14411677aeSAaron LI * the University nor the names of its contributors may be used to endorse
15411677aeSAaron LI * or promote products derived from this software without specific prior
16411677aeSAaron LI * written permission.
17411677aeSAaron LI * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18411677aeSAaron LI * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19411677aeSAaron LI * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20411677aeSAaron LI */
21411677aeSAaron LI
22411677aeSAaron LI /* \summary: Apple's DLT_PKTAP printer */
23411677aeSAaron LI
24411677aeSAaron LI #ifdef HAVE_CONFIG_H
25*ed775ee7SAntonio Huete Jimenez #include <config.h>
26411677aeSAaron LI #endif
27411677aeSAaron LI
28*ed775ee7SAntonio Huete Jimenez #include "netdissect-stdinc.h"
29411677aeSAaron LI
30*ed775ee7SAntonio Huete Jimenez #define ND_LONGJMP_FROM_TCHECK
31411677aeSAaron LI #include "netdissect.h"
32411677aeSAaron LI #include "extract.h"
33411677aeSAaron LI
34411677aeSAaron LI #ifdef DLT_PKTAP
35411677aeSAaron LI
36411677aeSAaron LI /*
37411677aeSAaron LI * XXX - these are little-endian in the captures I've seen, but Apple
38411677aeSAaron LI * no longer make any big-endian machines (Macs use x86, iOS machines
39411677aeSAaron LI * use ARM and run it little-endian), so that might be by definition
40411677aeSAaron LI * or they might be host-endian.
41411677aeSAaron LI *
42411677aeSAaron LI * If a big-endian PKTAP file ever shows up, and it comes from a
43411677aeSAaron LI * big-endian machine, presumably these are host-endian, and we need
44411677aeSAaron LI * to just fetch the fields directly in tcpdump but byte-swap them
45411677aeSAaron LI * to host byte order in libpcap.
46411677aeSAaron LI */
47411677aeSAaron LI typedef struct pktap_header {
48*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_len; /* length of pktap header */
49*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_rectype; /* type of record */
50*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_dlt; /* DLT type of this packet */
51411677aeSAaron LI char pkt_ifname[24]; /* interface name */
52*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_flags;
53*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_pfamily; /* "protocol family" */
54*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_llhdrlen; /* link-layer header length? */
55*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_lltrlrlen; /* link-layer trailer length? */
56*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_pid; /* process ID */
57411677aeSAaron LI char pkt_cmdname[20]; /* command name */
58*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_svc_class; /* "service class" */
59*ed775ee7SAntonio Huete Jimenez nd_uint16_t pkt_iftype; /* "interface type" */
60*ed775ee7SAntonio Huete Jimenez nd_uint16_t pkt_ifunit; /* unit number of interface? */
61*ed775ee7SAntonio Huete Jimenez nd_uint32_t pkt_epid; /* "effective process ID" */
62411677aeSAaron LI char pkt_ecmdname[20]; /* "effective command name" */
63411677aeSAaron LI } pktap_header_t;
64411677aeSAaron LI
65411677aeSAaron LI /*
66411677aeSAaron LI * Record types.
67411677aeSAaron LI */
68411677aeSAaron LI #define PKT_REC_NONE 0 /* nothing follows the header */
69411677aeSAaron LI #define PKT_REC_PACKET 1 /* a packet follows the header */
70411677aeSAaron LI
71*ed775ee7SAntonio Huete Jimenez static void
pktap_header_print(netdissect_options * ndo,const u_char * bp,u_int length)72411677aeSAaron LI pktap_header_print(netdissect_options *ndo, const u_char *bp, u_int length)
73411677aeSAaron LI {
74411677aeSAaron LI const pktap_header_t *hdr;
75411677aeSAaron LI uint32_t dlt, hdrlen;
76411677aeSAaron LI const char *dltname;
77411677aeSAaron LI
78411677aeSAaron LI hdr = (const pktap_header_t *)bp;
79411677aeSAaron LI
80*ed775ee7SAntonio Huete Jimenez dlt = GET_LE_U_4(hdr->pkt_dlt);
81*ed775ee7SAntonio Huete Jimenez hdrlen = GET_LE_U_4(hdr->pkt_len);
82411677aeSAaron LI dltname = pcap_datalink_val_to_name(dlt);
83411677aeSAaron LI if (!ndo->ndo_qflag) {
84*ed775ee7SAntonio Huete Jimenez ND_PRINT("DLT %s (%u) len %u",
85*ed775ee7SAntonio Huete Jimenez (dltname != NULL ? dltname : "UNKNOWN"), dlt, hdrlen);
86411677aeSAaron LI } else {
87*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s", (dltname != NULL ? dltname : "UNKNOWN"));
88411677aeSAaron LI }
89411677aeSAaron LI
90*ed775ee7SAntonio Huete Jimenez ND_PRINT(", length %u: ", length);
91411677aeSAaron LI }
92411677aeSAaron LI
93411677aeSAaron LI /*
94411677aeSAaron LI * This is the top level routine of the printer. 'p' points
95411677aeSAaron LI * to the ether header of the packet, 'h->ts' is the timestamp,
96411677aeSAaron LI * 'h->len' is the length of the packet off the wire, and 'h->caplen'
97411677aeSAaron LI * is the number of bytes actually captured.
98411677aeSAaron LI */
99*ed775ee7SAntonio Huete Jimenez void
pktap_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)100411677aeSAaron LI pktap_if_print(netdissect_options *ndo,
101411677aeSAaron LI const struct pcap_pkthdr *h, const u_char *p)
102411677aeSAaron LI {
103411677aeSAaron LI uint32_t dlt, hdrlen, rectype;
104411677aeSAaron LI u_int caplen = h->caplen;
105411677aeSAaron LI u_int length = h->len;
106411677aeSAaron LI if_printer printer;
107411677aeSAaron LI const pktap_header_t *hdr;
108411677aeSAaron LI struct pcap_pkthdr nhdr;
109411677aeSAaron LI
110*ed775ee7SAntonio Huete Jimenez ndo->ndo_protocol = "pktap";
111*ed775ee7SAntonio Huete Jimenez if (length < sizeof(pktap_header_t)) {
112*ed775ee7SAntonio Huete Jimenez ND_PRINT(" (packet too short, %u < %zu)",
113*ed775ee7SAntonio Huete Jimenez length, sizeof(pktap_header_t));
114*ed775ee7SAntonio Huete Jimenez goto invalid;
115411677aeSAaron LI }
116411677aeSAaron LI hdr = (const pktap_header_t *)p;
117*ed775ee7SAntonio Huete Jimenez dlt = GET_LE_U_4(hdr->pkt_dlt);
118*ed775ee7SAntonio Huete Jimenez hdrlen = GET_LE_U_4(hdr->pkt_len);
119411677aeSAaron LI if (hdrlen < sizeof(pktap_header_t)) {
120411677aeSAaron LI /*
121411677aeSAaron LI * Claimed header length < structure length.
122411677aeSAaron LI * XXX - does this just mean some fields aren't
123411677aeSAaron LI * being supplied, or is it truly an error (i.e.,
124411677aeSAaron LI * is the length supplied so that the header can
125411677aeSAaron LI * be expanded in the future)?
126411677aeSAaron LI */
127*ed775ee7SAntonio Huete Jimenez ND_PRINT(" (pkt_len too small, %u < %zu)",
128*ed775ee7SAntonio Huete Jimenez hdrlen, sizeof(pktap_header_t));
129*ed775ee7SAntonio Huete Jimenez goto invalid;
130411677aeSAaron LI }
131*ed775ee7SAntonio Huete Jimenez if (hdrlen > length) {
132*ed775ee7SAntonio Huete Jimenez ND_PRINT(" (pkt_len too big, %u > %u)",
133*ed775ee7SAntonio Huete Jimenez hdrlen, length);
134*ed775ee7SAntonio Huete Jimenez goto invalid;
135411677aeSAaron LI }
136*ed775ee7SAntonio Huete Jimenez ND_TCHECK_LEN(p, hdrlen);
137411677aeSAaron LI
138411677aeSAaron LI if (ndo->ndo_eflag)
139411677aeSAaron LI pktap_header_print(ndo, p, length);
140411677aeSAaron LI
141411677aeSAaron LI length -= hdrlen;
142411677aeSAaron LI caplen -= hdrlen;
143411677aeSAaron LI p += hdrlen;
144411677aeSAaron LI
145*ed775ee7SAntonio Huete Jimenez rectype = GET_LE_U_4(hdr->pkt_rectype);
146411677aeSAaron LI switch (rectype) {
147411677aeSAaron LI
148411677aeSAaron LI case PKT_REC_NONE:
149*ed775ee7SAntonio Huete Jimenez ND_PRINT("no data");
150411677aeSAaron LI break;
151411677aeSAaron LI
152411677aeSAaron LI case PKT_REC_PACKET:
153*ed775ee7SAntonio Huete Jimenez printer = lookup_printer(dlt);
154*ed775ee7SAntonio Huete Jimenez if (printer != NULL) {
155411677aeSAaron LI nhdr = *h;
156411677aeSAaron LI nhdr.caplen = caplen;
157411677aeSAaron LI nhdr.len = length;
158*ed775ee7SAntonio Huete Jimenez printer(ndo, &nhdr, p);
159*ed775ee7SAntonio Huete Jimenez hdrlen += ndo->ndo_ll_hdr_len;
160411677aeSAaron LI } else {
161411677aeSAaron LI if (!ndo->ndo_eflag)
162411677aeSAaron LI pktap_header_print(ndo, (const u_char *)hdr,
163411677aeSAaron LI length + hdrlen);
164411677aeSAaron LI
165411677aeSAaron LI if (!ndo->ndo_suppress_default_print)
166411677aeSAaron LI ND_DEFAULTPRINT(p, caplen);
167411677aeSAaron LI }
168411677aeSAaron LI break;
169411677aeSAaron LI }
170411677aeSAaron LI
171*ed775ee7SAntonio Huete Jimenez ndo->ndo_ll_hdr_len += hdrlen;
172*ed775ee7SAntonio Huete Jimenez return;
173*ed775ee7SAntonio Huete Jimenez
174*ed775ee7SAntonio Huete Jimenez invalid:
175*ed775ee7SAntonio Huete Jimenez nd_print_invalid(ndo);
176411677aeSAaron LI }
177411677aeSAaron LI #endif /* DLT_PKTAP */
178