source: lib/format_pcapng.h @ 0af3a4e

develop
Last change on this file since 0af3a4e was d0f25d4, checked in by Jacob Van Walraven <jcv9@…>, 2 years ago

Add ERF and PCAPNG decoders to libpacketdump
  • Property mode set to 100644
File size: 7.3 KB
Line 
1#define PCAPNG_SECTION_TYPE 0x0A0D0D0A
2#define PCAPNG_INTERFACE_TYPE 0x00000001
3#define PCAPNG_OLD_PACKET_TYPE 0x00000002
4#define PCAPNG_SIMPLE_PACKET_TYPE 0x00000003
5#define PCAPNG_NAME_RESOLUTION_TYPE 0x00000004
6#define PCAPNG_INTERFACE_STATS_TYPE 0x00000005
7#define PCAPNG_ENHANCED_PACKET_TYPE 0x00000006
8#define PCAPNG_CUSTOM_TYPE 0x00000BAD
9#define PCAPNG_CUSTOM_NONCOPY_TYPE 0x40000BAD
10#define PCAPNG_DECRYPTION_SECRETS_TYPE 0x0000000A
11
12#define PCAPNG_NRB_RECORD_END 0x0000
13#define PCAPNG_NRB_RECORD_IP4 0x0001
14#define PCAPNG_NRB_RECORD_IP6 0x0002
15
16#define PCAPNG_CUSTOM_OPTION_UTF8 0xBAC
17#define PCAPNG_CUSTOM_OPTION_BIN 0xBAD
18#define PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY 0x4BAC
19#define PCAPNG_CUSTOM_OPTION_BIN_NONCOPY 0x4BAD
20
21
22#define PCAPNG_OPTION_END 0x0000
23#define PCAPNG_OPTION_COMMENT 1
24/* Custom option code containing a UTF-8 string */
25#define PCAPNG_OPTION_CUSTOM_1 2988
26/* Custom option code containing binary octets */
27#define PCAPNG_OPTION_CUSTOM_2 2989
28/* Custom option code containing a UTF-8 string
29 * Should not be copied to a new file if manipulated */
30#define PCAPNG_OPTION_CUSTOM_3 19372
31/* Custom option code containing binary octets
32 * Should not be copied to a new file if manipulated */
33#define PCAPNG_OPTION_CUSTOM_4 19373
34
35#define PACKET_IS_SECTION (pcapng_get_record_type(packet) == PCAPNG_SECTION_TYPE)
36#define PACKET_IS_INTERFACE (pcapng_get_record_type(packet) == PCAPNG_INTERFACE_TYPE)
37#define PACKET_IS_OLD (pcapng_get_record_type(packet) == PCAPNG_OLD_PACKET_TYPE)
38#define PACKET_IS_SIMPLE (pcapng_get_record_type(packet) == PCAPNG_SIMPLE_PACKET_TYPE)
39#define PACKET_IS_NAME_RESOLUTION (pcapng_get_record_type(packet) == PCAPNG_NAME_RESOLUTION_TYPE)
40#define PACKET_IS_INTERFACE_STATS (pcapng_get_record_type(packet) == PCAPNG_INTERFACE_STATS_TYPE)
41#define PACKET_IS_ENHANCED (pcapng_get_record_type(packet) == PCAPNG_ENHANCED_PACKET_TYPE)
42#define PACKET_IS_CUSTOM (pcapng_get_record_type(packet) == PCAPNG_CUSTOM_TYPE)
43#define PACKET_IS_CUSTOM_NONCOPY (pcapng_get_record_type(packet) == PCAPNG_CUSTOM_NONCOPY_TYPE)
44#define PACKET_IS_DECRYPTION_SECRETS (pcapng_get_record_type(packet) == PCAPNG_DECRYPTION_SECRETS_TYPE)
45
46#define PCAPNG_IFOPT_TSRESOL 9
47
48#define PCAPNG_PKTOPT_DROPCOUNT 4
49
50#define PCAPNG_STATOPT_START 2
51#define PCAPNG_STATOPT_END 3
52#define PCAPNG_STATOPT_IFRECV 4
53#define PCAPNG_STATOPT_IFDROP 5
54#define PCAPNG_STATOPT_FILTERACCEPT 6
55#define PCAPNG_STATOPT_OSDROP 7
56#define PCAPNG_STATOPT_USRDELIV 8
57
58/* PCAPNG meta tag type codes */
59/* SHB - Section header block */
60#define PCAPNG_META_SHB_HARDWARE 2
61#define PCAPNG_META_SHB_OS 3
62#define PCAPNG_META_SHB_USERAPPL 4
63/* Interface description block */
64#define PCAPNG_META_IF_NAME 2
65#define PCAPNG_META_IF_DESCR 3
66#define PCAPNG_META_IF_IP4 4
67#define PCAPNG_META_IF_IP6 5
68#define PCAPNG_META_IF_MAC 6
69#define PCAPNG_META_IF_EUI 7
70#define PCAPNG_META_IF_SPEED 8
71#define PCAPNG_META_IF_TSRESOL 9
72#define PCAPNG_META_IF_TZONE 10
73#define PCAPNG_META_IF_FILTER 11
74#define PCAPNG_META_IF_OS 12
75#define PCAPNG_META_IF_FCSLEN 13
76#define PCAPNG_META_IF_TSOFFSET 14
77#define PCAPNG_META_IF_HARDWARE 15
78/* Enhanced block */
79#define PCAPNG_META_EPB_FLAGS 2
80#define PCAPNG_META_EPB_HASH 3
81#define PCAPNG_META_EPB_DROPCOUNT 4
82/* Name Resolution block */
83#define PCAPNG_META_NRB_RECORD_END 0x0000
84#define PCAPNG_META_NRB_RECORD_IP4 0x0001
85#define PCAPNG_META_NRB_RECORD_IP6 0x0002
86#define PCAPNG_META_NS_DNSNAME 2
87#define PCAPNG_META_NS_DNS_IP4_ADDR 3
88#define PCAPNG_META_NS_DNS_IP6_ADDR 4
89/* Interface stats block */
90#define PCAPNG_META_ISB_STARTTIME 2
91#define PCAPNG_META_ISB_ENDTIME 3
92#define PCAPNG_META_ISB_IFRECV 4
93#define PCAPNG_META_ISB_IFDROP 5
94#define PCAPNG_META_ISB_FILTERACCEPT 6
95#define PCAPNG_META_ISB_OSDROP 7
96#define PCAPNG_META_ISB_USRDELIV 8
97/* Old packet type */
98#define PCAPNG_META_OLD_FLAGS 2
99#define PCAPNG_META_OLD_HASH 3
100
101#define DATA(x) ((struct pcapng_format_data_t *)((x)->format_data))
102#define DATAOUT(x) ((struct pcapng_format_data_out_t*)((x)->format_data))
103
104typedef struct pcagng_section_header_t {
105        uint32_t blocktype;
106        uint32_t blocklen;
107        uint32_t ordering;
108        uint16_t majorversion;
109        uint16_t minorversion;
110        uint64_t sectionlen;
111} pcapng_sec_t;
112
113typedef struct pcapng_interface_header_t {
114        uint32_t blocktype;
115        uint32_t blocklen;
116        uint16_t linktype;
117        uint16_t reserved;
118        uint32_t snaplen;
119} pcapng_int_t;
120
121typedef struct pcapng_nrb_header_t {
122        uint32_t blocktype;
123        uint32_t blocklen;
124} pcapng_nrb_t;
125
126typedef struct pcapng_enhanced_packet_t {
127        uint32_t blocktype;
128        uint32_t blocklen;
129        uint32_t interfaceid;
130        uint32_t timestamp_high;
131        uint32_t timestamp_low;
132        uint32_t caplen;
133        uint32_t wlen;
134} pcapng_epkt_t;
135
136typedef struct pcapng_simple_packet_t {
137        uint32_t blocktype;
138        uint32_t blocklen;
139        uint32_t wlen;
140} pcapng_spkt_t;
141
142typedef struct pcapng_old_packet_t {
143        uint32_t blocktype;
144        uint32_t blocklen;
145        uint16_t interfaceid;
146        uint16_t drops;
147        uint32_t timestamp_high;
148        uint32_t timestamp_low;
149        uint32_t caplen;
150        uint32_t wlen;
151} pcapng_opkt_t;
152
153typedef struct pcapng_stats_header_t {
154        uint32_t blocktype;
155        uint32_t blocklen;
156        uint32_t interfaceid;
157        uint32_t timestamp_high;
158        uint32_t timestamp_low;
159} pcapng_stats_t;
160
161typedef struct pcapng_decryption_secrets_header_t {
162        uint32_t blocktype;
163        uint32_t blocklen;
164        uint32_t secrets_type;
165        uint32_t secrets_len;
166} pcapng_secrets_t;
167
168typedef struct pcapng_custom_header_t {
169        uint32_t blocktype;
170        uint32_t blocklen;
171        uint32_t pen;
172} pcapng_custom_t;
173
174typedef struct pcapng_interface_t pcapng_interface_t;
175
176struct pcapng_timestamp {
177        uint32_t timehigh;
178        uint32_t timelow;
179};
180
181struct pcapng_interface_t {
182
183        uint16_t id;
184        libtrace_dlt_t linktype;
185        uint32_t snaplen;
186        uint32_t tsresol;
187
188        uint64_t received;
189        uint64_t dropped;       /* as reported by interface stats */
190        uint64_t dropcounter;   /* as reported by packet records */
191        uint64_t accepted;
192        uint64_t osdropped;
193        uint64_t laststats;
194
195};
196
197struct pcapng_format_data_t {
198        bool started;
199        bool realtime;
200        bool discard_meta;
201
202        /* Section data */
203        bool byteswapped;
204
205        /* Interface data */
206        pcapng_interface_t **interfaces;
207        uint16_t allocatedinterfaces;
208        uint16_t nextintid;
209
210};
211
212struct pcapng_format_data_out_t {
213        iow_t *file;
214        int compress_level;
215        int compress_type;
216        int flag;
217
218        /* Section data */
219        uint16_t sechdr_count;
220        bool byteswapped;
221
222        /* Interface data */
223        uint16_t nextintid;
224        libtrace_linktype_t lastdlt;
225};
226
227struct pcapng_optheader {
228        uint16_t optcode;
229        uint16_t optlen;
230};
231
232struct pcapng_custom_optheader {
233        uint16_t optcode;
234        uint16_t optlen;
235        uint32_t pen;
236};
237struct pcapng_nrb_record {
238        uint16_t recordtype;
239        uint16_t recordlen;
240};
241struct pcapng_peeker {
242        uint32_t blocktype;
243        uint32_t blocklen;
244};
245
246typedef struct pcapng_peeker pcapng_hdr_t;
247
248void *pcapng_get_meta_section(libtrace_packet_t *packet, uint32_t section);
249void *pcapng_get_meta_section_option(libtrace_packet_t *packet, uint32_t section,
250        uint16_t option);
Note: See TracBrowser for help on using the repository browser.