1 | /* |
---|
2 | * This file is part of libtrace |
---|
3 | * |
---|
4 | * Copyright (c) 2004 The University of Waikato, Hamilton, New Zealand. |
---|
5 | * Authors: Daniel Lawson |
---|
6 | * Perry Lorier |
---|
7 | * |
---|
8 | * All rights reserved. |
---|
9 | * |
---|
10 | * This code has been developed by the University of Waikato WAND |
---|
11 | * research group. For further information please see http://www.wand.net.nz/ |
---|
12 | * |
---|
13 | * libtrace is free software; you can redistribute it and/or modify |
---|
14 | * it under the terms of the GNU General Public License as published by |
---|
15 | * the Free Software Foundation; either version 2 of the License, or |
---|
16 | * (at your option) any later version. |
---|
17 | * |
---|
18 | * libtrace is distributed in the hope that it will be useful, |
---|
19 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
20 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
21 | * GNU General Public License for more details. |
---|
22 | * |
---|
23 | * You should have received a copy of the GNU General Public License |
---|
24 | * along with libtrace; if not, write to the Free Software |
---|
25 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
---|
26 | * |
---|
27 | * $Id$ |
---|
28 | * |
---|
29 | */ |
---|
30 | |
---|
31 | #include "common.h" |
---|
32 | #include "config.h" |
---|
33 | #include "libtrace.h" |
---|
34 | #include "libtrace_int.h" |
---|
35 | #include "format_helper.h" |
---|
36 | |
---|
37 | #include <sys/stat.h> |
---|
38 | #include <assert.h> |
---|
39 | #include <stdio.h> |
---|
40 | #include <stdlib.h> |
---|
41 | #include <string.h> |
---|
42 | #include <errno.h> |
---|
43 | |
---|
44 | #if HAVE_PCAP_BPF_H |
---|
45 | # include <pcap-bpf.h> |
---|
46 | #else |
---|
47 | # ifdef HAVE_NET_BPF_H |
---|
48 | # include <net/bpf.h> |
---|
49 | # endif |
---|
50 | #endif |
---|
51 | |
---|
52 | #if HAVE_PCAP_H |
---|
53 | # include <pcap.h> |
---|
54 | # ifdef HAVE_PCAP_INT_H |
---|
55 | # include <pcap-int.h> |
---|
56 | # endif |
---|
57 | #endif |
---|
58 | |
---|
59 | #if HAVE_PCAP |
---|
60 | static struct libtrace_format_t pcap; |
---|
61 | static struct libtrace_format_t pcapint; |
---|
62 | |
---|
63 | #define DATA(x) ((struct pcap_format_data_t*)((x)->format_data)) |
---|
64 | #define DATAOUT(x) ((struct pcap_format_data_out_t*)((x)->format_data)) |
---|
65 | |
---|
66 | #define INPUT DATA(libtrace)->input |
---|
67 | #define OUTPUT DATAOUT(libtrace)->output |
---|
68 | struct pcap_format_data_t { |
---|
69 | union { |
---|
70 | char *path; /**< information for local sockets */ |
---|
71 | char *interface; /**< intormation for reading of network |
---|
72 | interfaces */ |
---|
73 | } conn_info; |
---|
74 | /** Information about the current state of the input device */ |
---|
75 | union { |
---|
76 | pcap_t *pcap; |
---|
77 | } input; |
---|
78 | int snaplen; |
---|
79 | libtrace_filter_t *filter; |
---|
80 | int promisc; |
---|
81 | }; |
---|
82 | |
---|
83 | struct pcap_format_data_out_t { |
---|
84 | union { |
---|
85 | char *path; |
---|
86 | char *interface; |
---|
87 | } conn_info; |
---|
88 | union { |
---|
89 | struct { |
---|
90 | pcap_t *pcap; |
---|
91 | pcap_dumper_t *dump; |
---|
92 | } trace; |
---|
93 | |
---|
94 | } output; |
---|
95 | }; |
---|
96 | |
---|
97 | static int pcap_init_input(struct libtrace_t *libtrace) { |
---|
98 | libtrace->format_data = malloc(sizeof(struct pcap_format_data_t)); |
---|
99 | |
---|
100 | INPUT.pcap = NULL; |
---|
101 | DATA(libtrace)->filter = NULL; |
---|
102 | DATA(libtrace)->snaplen = LIBTRACE_PACKET_BUFSIZE; |
---|
103 | DATA(libtrace)->promisc = 0; |
---|
104 | |
---|
105 | return 0; |
---|
106 | } |
---|
107 | |
---|
108 | static int pcap_start_input(struct libtrace_t *libtrace) { |
---|
109 | char errbuf[PCAP_ERRBUF_SIZE]; |
---|
110 | |
---|
111 | /* if the file is already open */ |
---|
112 | if (INPUT.pcap) |
---|
113 | return 0; /* success */ |
---|
114 | |
---|
115 | if ((INPUT.pcap = |
---|
116 | pcap_open_offline(libtrace->uridata, |
---|
117 | errbuf)) == NULL) { |
---|
118 | trace_set_err(libtrace,TRACE_ERR_INIT_FAILED,"%s", |
---|
119 | errbuf); |
---|
120 | return -1; |
---|
121 | } |
---|
122 | if (DATA(libtrace)->filter) { |
---|
123 | pcap_compile(INPUT.pcap, &DATA(libtrace)->filter->filter, |
---|
124 | DATA(libtrace)->filter->filterstring, 1, 0); |
---|
125 | if (pcap_setfilter(INPUT.pcap,&DATA(libtrace)->filter->filter) |
---|
126 | == -1) { |
---|
127 | trace_set_err(libtrace,TRACE_ERR_INIT_FAILED,"%s", |
---|
128 | pcap_geterr(INPUT.pcap)); |
---|
129 | return -1; |
---|
130 | } |
---|
131 | } |
---|
132 | return 0; |
---|
133 | } |
---|
134 | |
---|
135 | static int pcap_config_input(libtrace_t *libtrace, |
---|
136 | trace_option_t option, |
---|
137 | void *data) |
---|
138 | { |
---|
139 | switch(option) { |
---|
140 | case TRACE_OPTION_FILTER: |
---|
141 | DATA(libtrace)->filter=data; |
---|
142 | return 0; |
---|
143 | case TRACE_OPTION_SNAPLEN: |
---|
144 | /* Snapping isn't supported directly, so fall thru |
---|
145 | * and let libtrace deal with it |
---|
146 | */ |
---|
147 | case TRACE_OPTION_PROMISC: |
---|
148 | /* can't do promisc on a trace! fall thru */ |
---|
149 | default: |
---|
150 | trace_set_err(libtrace,TRACE_ERR_UNKNOWN_OPTION, |
---|
151 | "Unknown option %i", option); |
---|
152 | return -1; |
---|
153 | } |
---|
154 | assert(0); |
---|
155 | } |
---|
156 | |
---|
157 | static int pcap_init_output(libtrace_out_t *libtrace) { |
---|
158 | libtrace->format_data = malloc(sizeof(struct pcap_format_data_out_t)); |
---|
159 | OUTPUT.trace.pcap = NULL; |
---|
160 | OUTPUT.trace.dump = NULL; |
---|
161 | return 0; |
---|
162 | } |
---|
163 | |
---|
164 | static int pcapint_init_output(libtrace_out_t *libtrace) { |
---|
165 | #ifdef HAVE_PCAP_INJECT |
---|
166 | libtrace->format_data = malloc(sizeof(struct pcap_format_data_out_t)); |
---|
167 | OUTPUT.trace.pcap = NULL; |
---|
168 | OUTPUT.trace.dump = NULL; |
---|
169 | return 0; |
---|
170 | #else |
---|
171 | #ifdef HAVE_PCAP_SENDPACKET |
---|
172 | libtrace->format_data = malloc(sizeof(struct pcap_format_data_out_t)); |
---|
173 | OUTPUT.trace.pcap = NULL; |
---|
174 | OUTPUT.trace.dump = NULL; |
---|
175 | return 0; |
---|
176 | #else |
---|
177 | trace_set_err_out(libtrace,TRACE_ERR_NO_INIT_OUT, |
---|
178 | "writing not supported by this version of pcap"); |
---|
179 | return -1; |
---|
180 | #endif |
---|
181 | #endif |
---|
182 | } |
---|
183 | |
---|
184 | static int pcapint_init_input(struct libtrace_t *libtrace) { |
---|
185 | libtrace->format_data = malloc(sizeof(struct pcap_format_data_t)); |
---|
186 | DATA(libtrace)->filter = NULL; |
---|
187 | DATA(libtrace)->snaplen = LIBTRACE_PACKET_BUFSIZE; |
---|
188 | DATA(libtrace)->promisc = 0; |
---|
189 | return 0; /* success */ |
---|
190 | } |
---|
191 | |
---|
192 | static int pcapint_config_input(libtrace_t *libtrace, |
---|
193 | trace_option_t option, |
---|
194 | void *data) |
---|
195 | { |
---|
196 | switch(option) { |
---|
197 | case TRACE_OPTION_FILTER: |
---|
198 | DATA(libtrace)->filter=data; |
---|
199 | return 0; |
---|
200 | case TRACE_OPTION_SNAPLEN: |
---|
201 | DATA(libtrace)->snaplen=*(int*)data; |
---|
202 | return 0; |
---|
203 | case TRACE_OPTION_PROMISC: |
---|
204 | DATA(libtrace)->promisc=*(int*)data; |
---|
205 | return 0; |
---|
206 | default: |
---|
207 | trace_set_err(libtrace,TRACE_ERR_UNKNOWN_OPTION, |
---|
208 | "Unknown option %i", option); |
---|
209 | return -1; |
---|
210 | } |
---|
211 | assert(0); |
---|
212 | } |
---|
213 | |
---|
214 | static int pcapint_start_input(libtrace_t *libtrace) { |
---|
215 | char errbuf[PCAP_ERRBUF_SIZE]; |
---|
216 | if ((INPUT.pcap = |
---|
217 | pcap_open_live(libtrace->uridata, |
---|
218 | DATA(libtrace)->snaplen, |
---|
219 | DATA(libtrace)->promisc, |
---|
220 | 1, |
---|
221 | errbuf)) == NULL) { |
---|
222 | trace_set_err(libtrace,TRACE_ERR_INIT_FAILED,"%s",errbuf); |
---|
223 | return -1; /* failure */ |
---|
224 | } |
---|
225 | /* Set a filter if one is defined */ |
---|
226 | if (DATA(libtrace)->filter) { |
---|
227 | if (pcap_setfilter(INPUT.pcap,&DATA(libtrace)->filter->filter) |
---|
228 | == -1) { |
---|
229 | trace_set_err(libtrace,TRACE_ERR_INIT_FAILED,"%s", |
---|
230 | pcap_geterr(INPUT.pcap)); |
---|
231 | return -1; /* failure */ |
---|
232 | } |
---|
233 | } |
---|
234 | return 0; /* success */ |
---|
235 | } |
---|
236 | |
---|
237 | static int pcapint_pause_input(libtrace_t *libtrace) |
---|
238 | { |
---|
239 | pcap_close(INPUT.pcap); |
---|
240 | INPUT.pcap=NULL; |
---|
241 | return 0; /* success */ |
---|
242 | } |
---|
243 | |
---|
244 | static int pcap_fin_input(libtrace_t *libtrace) |
---|
245 | { |
---|
246 | free(libtrace->format_data); |
---|
247 | return 0; /* success */ |
---|
248 | } |
---|
249 | |
---|
250 | static int pcap_fin_output(libtrace_out_t *libtrace) |
---|
251 | { |
---|
252 | pcap_dump_flush(OUTPUT.trace.dump); |
---|
253 | pcap_dump_close(OUTPUT.trace.dump); |
---|
254 | pcap_close(OUTPUT.trace.pcap); |
---|
255 | free(libtrace->format_data); |
---|
256 | return 0; |
---|
257 | } |
---|
258 | |
---|
259 | static int pcapint_fin_output(libtrace_out_t *libtrace) |
---|
260 | { |
---|
261 | pcap_close(OUTPUT.trace.pcap); |
---|
262 | free(libtrace->format_data); |
---|
263 | return 0; |
---|
264 | } |
---|
265 | |
---|
266 | static void trace_pcap_handler(u_char *user, const struct pcap_pkthdr *pcaphdr, const u_char *pcappkt) { |
---|
267 | struct libtrace_packet_t *packet = (struct libtrace_packet_t *)user; |
---|
268 | /* |
---|
269 | // pcap provides us with the right bits, in it's own buffers. |
---|
270 | // We hijack them. |
---|
271 | */ |
---|
272 | |
---|
273 | if (!packet->buffer || packet->buf_control==TRACE_CTRL_EXTERNAL) { |
---|
274 | /* We only need struct pcap_pkthdr, but we have no way |
---|
275 | * to say how much we malloc'd so that formats can determine |
---|
276 | * if they need to malloc more, so at the moment we just |
---|
277 | * malloc 64k |
---|
278 | */ |
---|
279 | packet->buf_control = TRACE_CTRL_PACKET; |
---|
280 | packet->buffer=malloc(65536); |
---|
281 | } |
---|
282 | memcpy(packet->buffer,pcaphdr,sizeof(struct pcap_pkthdr)); |
---|
283 | packet->header = packet->buffer; |
---|
284 | packet->payload = (void *)pcappkt; |
---|
285 | |
---|
286 | assert(pcaphdr->caplen<=65536); |
---|
287 | } |
---|
288 | |
---|
289 | /* TODO: use pcap_next_ex() if available */ |
---|
290 | static int pcap_read_packet(struct libtrace_t *libtrace, struct libtrace_packet_t *packet) { |
---|
291 | int pcapbytes = 0; |
---|
292 | int linktype; |
---|
293 | |
---|
294 | assert(libtrace->format_data); |
---|
295 | linktype = pcap_datalink(DATA(libtrace)->input.pcap); |
---|
296 | packet->type = pcap_dlt_to_rt(linktype); |
---|
297 | |
---|
298 | pcapbytes = pcap_dispatch(INPUT.pcap, |
---|
299 | 1, /* number of packets */ |
---|
300 | &trace_pcap_handler, |
---|
301 | (u_char *)packet); |
---|
302 | |
---|
303 | if (pcapbytes <= 0) { |
---|
304 | return pcapbytes; |
---|
305 | } |
---|
306 | return ((struct pcap_pkthdr*)packet->header)->len+sizeof(struct pcap_pkthdr); |
---|
307 | } |
---|
308 | |
---|
309 | static int pcap_write_packet(libtrace_out_t *libtrace, const libtrace_packet_t *packet) { |
---|
310 | struct pcap_pkthdr pcap_pkt_hdr; |
---|
311 | |
---|
312 | if (!OUTPUT.trace.pcap) { |
---|
313 | OUTPUT.trace.pcap = (pcap_t *)pcap_open_dead( |
---|
314 | libtrace_to_pcap_dlt(trace_get_link_type(packet)), |
---|
315 | 65536); |
---|
316 | OUTPUT.trace.dump = pcap_dump_open(OUTPUT.trace.pcap, |
---|
317 | libtrace->uridata); |
---|
318 | fflush((FILE *)OUTPUT.trace.dump); |
---|
319 | } |
---|
320 | if (packet->trace->format == &pcap || |
---|
321 | packet->trace->format == &pcapint) { |
---|
322 | pcap_dump((u_char*)OUTPUT.trace.dump, |
---|
323 | (struct pcap_pkthdr *)packet->header, |
---|
324 | packet->payload); |
---|
325 | } else { |
---|
326 | /* Leave the manual copy as it is, as it gets around |
---|
327 | * some OS's having different structures in pcap_pkt_hdr |
---|
328 | */ |
---|
329 | struct timeval ts = trace_get_timeval(packet); |
---|
330 | pcap_pkt_hdr.ts.tv_sec = ts.tv_sec; |
---|
331 | pcap_pkt_hdr.ts.tv_usec = ts.tv_usec; |
---|
332 | pcap_pkt_hdr.caplen = trace_get_capture_length(packet); |
---|
333 | /* trace_get_wire_length includes FCS, while pcap doesn't */ |
---|
334 | if (trace_get_link_type(packet)==TRACE_TYPE_ETH) |
---|
335 | pcap_pkt_hdr.len = trace_get_wire_length(packet)-4; |
---|
336 | else |
---|
337 | pcap_pkt_hdr.len = trace_get_wire_length(packet); |
---|
338 | |
---|
339 | assert(pcap_pkt_hdr.caplen<65536); |
---|
340 | assert(pcap_pkt_hdr.len<65536); |
---|
341 | |
---|
342 | pcap_dump((u_char*)OUTPUT.trace.dump, &pcap_pkt_hdr, packet->payload); |
---|
343 | } |
---|
344 | return 0; |
---|
345 | } |
---|
346 | |
---|
347 | static int pcapint_write_packet(libtrace_out_t *libtrace, const libtrace_packet_t *packet) { |
---|
348 | int err; |
---|
349 | |
---|
350 | if (!OUTPUT.trace.pcap) { |
---|
351 | OUTPUT.trace.pcap = (pcap_t *)pcap_open_live( |
---|
352 | libtrace->uridata,65536,0,0,NULL); |
---|
353 | } |
---|
354 | #if HAVE_PCAP_INJECT |
---|
355 | err=pcap_inject(OUTPUT.trace.pcap, |
---|
356 | packet->payload, |
---|
357 | trace_get_capture_length(packet)); |
---|
358 | if (err!=trace_get_capture_length(packet)) |
---|
359 | err=-1; |
---|
360 | #else |
---|
361 | #if HAVE_PCAP_SENDPACKET |
---|
362 | err=pcap_sendpacket(OUTPUT.trace.pcap, |
---|
363 | packet->payload, |
---|
364 | trace_get_capture_length(packet)); |
---|
365 | #endif |
---|
366 | #endif |
---|
367 | return err; |
---|
368 | } |
---|
369 | |
---|
370 | static libtrace_linktype_t pcap_get_link_type(const libtrace_packet_t *packet) { |
---|
371 | struct pcap_pkthdr *pcapptr = 0; |
---|
372 | int linktype = 0; |
---|
373 | pcapptr = (struct pcap_pkthdr *)packet->header; |
---|
374 | |
---|
375 | /* pcap doesn't store dlt in the framing header so we need |
---|
376 | * rt to do it for us |
---|
377 | */ |
---|
378 | linktype = rt_to_pcap_dlt(packet->type); |
---|
379 | return pcap_dlt_to_libtrace(linktype); |
---|
380 | } |
---|
381 | |
---|
382 | static int8_t pcap_get_direction(const libtrace_packet_t *packet) { |
---|
383 | int8_t direction = -1; |
---|
384 | switch(pcap_get_link_type(packet)) { |
---|
385 | case TRACE_TYPE_LINUX_SLL: |
---|
386 | { |
---|
387 | libtrace_sll_header_t *sll; |
---|
388 | sll = trace_get_link(packet); |
---|
389 | if (!sll) { |
---|
390 | trace_set_err(packet->trace, |
---|
391 | TRACE_ERR_BAD_PACKET, |
---|
392 | "Bad or missing packet"); |
---|
393 | return -1; |
---|
394 | } |
---|
395 | /* 0 == LINUX_SLL_HOST */ |
---|
396 | /* the Waikato Capture point defines "packets |
---|
397 | * originating locally" (ie, outbound), with a |
---|
398 | * direction of 0, and "packets destined locally" |
---|
399 | * (ie, inbound), with a direction of 1. |
---|
400 | * This is kind-of-opposite to LINUX_SLL. |
---|
401 | * We return consistent values here, however |
---|
402 | * |
---|
403 | * Note that in recent versions of pcap, you can |
---|
404 | * use "inbound" and "outbound" on ppp in linux |
---|
405 | */ |
---|
406 | if (ntohs(sll->pkttype == 0)) { |
---|
407 | direction = 1; |
---|
408 | } else { |
---|
409 | direction = 0; |
---|
410 | } |
---|
411 | break; |
---|
412 | |
---|
413 | } |
---|
414 | case TRACE_TYPE_PFLOG: |
---|
415 | { |
---|
416 | libtrace_pflog_header_t *pflog; |
---|
417 | pflog = trace_get_link(packet); |
---|
418 | if (!pflog) { |
---|
419 | trace_set_err(packet->trace, |
---|
420 | TRACE_ERR_BAD_PACKET, |
---|
421 | "Bad or missing packet"); |
---|
422 | return -1; |
---|
423 | } |
---|
424 | /* enum { PF_IN=0, PF_OUT=1 }; */ |
---|
425 | if (ntohs(pflog->dir==0)) { |
---|
426 | |
---|
427 | direction = 1; |
---|
428 | } |
---|
429 | else { |
---|
430 | direction = 0; |
---|
431 | } |
---|
432 | break; |
---|
433 | } |
---|
434 | default: |
---|
435 | break; |
---|
436 | } |
---|
437 | return direction; |
---|
438 | } |
---|
439 | |
---|
440 | |
---|
441 | static struct timeval pcap_get_timeval(const struct libtrace_packet_t *packet) { |
---|
442 | struct pcap_pkthdr *pcapptr = (struct pcap_pkthdr *)packet->header; |
---|
443 | struct timeval ts; |
---|
444 | ts.tv_sec = pcapptr->ts.tv_sec; |
---|
445 | ts.tv_usec = pcapptr->ts.tv_usec; |
---|
446 | return ts; |
---|
447 | } |
---|
448 | |
---|
449 | |
---|
450 | static int pcap_get_capture_length(const libtrace_packet_t *packet) { |
---|
451 | struct pcap_pkthdr *pcapptr = 0; |
---|
452 | pcapptr = (struct pcap_pkthdr *)packet->header; |
---|
453 | assert(pcapptr->caplen<=65536); |
---|
454 | |
---|
455 | return pcapptr->caplen; |
---|
456 | } |
---|
457 | |
---|
458 | static int pcap_get_wire_length(const libtrace_packet_t *packet) { |
---|
459 | struct pcap_pkthdr *pcapptr = 0; |
---|
460 | pcapptr = (struct pcap_pkthdr *)packet->header; |
---|
461 | if (packet->type==pcap_dlt_to_rt(TRACE_DLT_EN10MB)) |
---|
462 | return pcapptr->len+4; /* Include the missing FCS */ |
---|
463 | else |
---|
464 | return pcapptr->len; |
---|
465 | } |
---|
466 | |
---|
467 | static int pcap_get_framing_length(const libtrace_packet_t *packet UNUSED) { |
---|
468 | return sizeof(struct pcap_pkthdr); |
---|
469 | } |
---|
470 | |
---|
471 | static size_t pcap_set_capture_length(libtrace_packet_t *packet,size_t size) { |
---|
472 | struct pcap_pkthdr *pcapptr = 0; |
---|
473 | assert(packet); |
---|
474 | if (size > trace_get_capture_length(packet)) { |
---|
475 | /* can't make a packet larger */ |
---|
476 | return trace_get_capture_length(packet); |
---|
477 | } |
---|
478 | pcapptr = (struct pcap_pkthdr *)packet->header; |
---|
479 | pcapptr->caplen = size; |
---|
480 | return trace_get_capture_length(packet); |
---|
481 | } |
---|
482 | |
---|
483 | static int pcap_get_fd(const libtrace_t *trace) { |
---|
484 | |
---|
485 | assert(trace->format_data); |
---|
486 | return pcap_fileno(DATA(trace)->input.pcap); |
---|
487 | } |
---|
488 | |
---|
489 | static void pcap_help() { |
---|
490 | printf("pcap format module: $Revision$\n"); |
---|
491 | printf("Supported input URIs:\n"); |
---|
492 | printf("\tpcap:/path/to/file\n"); |
---|
493 | printf("\n"); |
---|
494 | printf("\te.g.: pcap:/tmp/trace.pcap\n"); |
---|
495 | printf("\n"); |
---|
496 | printf("Supported output URIs:\n"); |
---|
497 | printf("\tnone\n"); |
---|
498 | printf("\n"); |
---|
499 | } |
---|
500 | |
---|
501 | static void pcapint_help() { |
---|
502 | printf("pcapint format module: $Revision$\n"); |
---|
503 | printf("Supported input URIs:\n"); |
---|
504 | printf("\tpcapint:interface\n"); |
---|
505 | printf("\n"); |
---|
506 | printf("\te.g.: pcapint:eth0\n"); |
---|
507 | printf("\n"); |
---|
508 | printf("Supported output URIs:\n"); |
---|
509 | printf("\tnone\n"); |
---|
510 | printf("\n"); |
---|
511 | } |
---|
512 | |
---|
513 | |
---|
514 | static struct libtrace_format_t pcap = { |
---|
515 | "pcap", |
---|
516 | "$Id$", |
---|
517 | TRACE_FORMAT_PCAP, |
---|
518 | pcap_init_input, /* init_input */ |
---|
519 | pcap_config_input, /* config_input */ |
---|
520 | pcap_start_input, /* start_input */ |
---|
521 | NULL, /* pause_input */ |
---|
522 | pcap_init_output, /* init_output */ |
---|
523 | NULL, /* config_output */ |
---|
524 | NULL, /* start_output */ |
---|
525 | pcap_fin_input, /* fin_input */ |
---|
526 | pcap_fin_output, /* fin_output */ |
---|
527 | pcap_read_packet, /* read_packet */ |
---|
528 | NULL, /* fin_packet */ |
---|
529 | pcap_write_packet, /* write_packet */ |
---|
530 | pcap_get_link_type, /* get_link_type */ |
---|
531 | pcap_get_direction, /* get_direction */ |
---|
532 | NULL, /* set_direction */ |
---|
533 | NULL, /* get_erf_timestamp */ |
---|
534 | pcap_get_timeval, /* get_timeval */ |
---|
535 | NULL, /* get_seconds */ |
---|
536 | NULL, /* seek_erf */ |
---|
537 | NULL, /* seek_timeval */ |
---|
538 | NULL, /* seek_seconds */ |
---|
539 | pcap_get_capture_length, /* get_capture_length */ |
---|
540 | pcap_get_wire_length, /* get_wire_length */ |
---|
541 | pcap_get_framing_length, /* get_framing_length */ |
---|
542 | pcap_set_capture_length, /* set_capture_length */ |
---|
543 | NULL, /* get_fd */ |
---|
544 | trace_event_trace, /* trace_event */ |
---|
545 | pcap_help, /* help */ |
---|
546 | NULL /* next pointer */ |
---|
547 | }; |
---|
548 | |
---|
549 | static struct libtrace_format_t pcapint = { |
---|
550 | "pcapint", |
---|
551 | "$Id$", |
---|
552 | TRACE_FORMAT_PCAP, |
---|
553 | pcapint_init_input, /* init_input */ |
---|
554 | pcapint_config_input, /* config_input */ |
---|
555 | pcapint_start_input, /* start_input */ |
---|
556 | pcapint_pause_input, /* pause_input */ |
---|
557 | pcapint_init_output, /* init_output */ |
---|
558 | NULL, /* config_output */ |
---|
559 | NULL, /* start_output */ |
---|
560 | pcap_fin_input, /* fin_input */ |
---|
561 | pcapint_fin_output, /* fin_output */ |
---|
562 | pcap_read_packet, /* read_packet */ |
---|
563 | NULL, /* fin_packet */ |
---|
564 | pcapint_write_packet, /* write_packet */ |
---|
565 | pcap_get_link_type, /* get_link_type */ |
---|
566 | pcap_get_direction, /* get_direction */ |
---|
567 | NULL, /* set_direction */ |
---|
568 | NULL, /* get_erf_timestamp */ |
---|
569 | pcap_get_timeval, /* get_timeval */ |
---|
570 | NULL, /* get_seconds */ |
---|
571 | NULL, /* seek_erf */ |
---|
572 | NULL, /* seek_timeval */ |
---|
573 | NULL, /* seek_seconds */ |
---|
574 | pcap_get_capture_length, /* get_capture_length */ |
---|
575 | pcap_get_wire_length, /* get_wire_length */ |
---|
576 | pcap_get_framing_length, /* get_framing_length */ |
---|
577 | pcap_set_capture_length, /* set_capture_length */ |
---|
578 | pcap_get_fd, /* get_fd */ |
---|
579 | trace_event_device, /* trace_event */ |
---|
580 | pcapint_help, /* help */ |
---|
581 | NULL /* next pointer */ |
---|
582 | }; |
---|
583 | |
---|
584 | void CONSTRUCTOR pcap_constructor() { |
---|
585 | register_format(&pcap); |
---|
586 | register_format(&pcapint); |
---|
587 | } |
---|
588 | |
---|
589 | |
---|
590 | #endif |
---|