source: lib/format_pktmeta.c @ 66ffac4

develop
Last change on this file since 66ffac4 was 66ffac4, checked in by Jacob Van Walraven <jcv9@…>, 22 months ago

Add more meta functions, cleanup function names, DLLEXPORT all meta-api prototypes

  • Property mode set to 100644
File size: 21.3 KB
Line 
1#include "libtrace_int.h"
2#include "libtrace.h"
3#include "format_erf.h"
4#include "format_pcapng.h"
5
6#include <stdio.h>
7#include <stdlib.h>
8#include <string.h>
9
10
11/* Internal Meta functions */
12static int trace_meta_check_input(libtrace_packet_t *packet, char *input_func) {
13        if (packet == NULL) {
14                fprintf(stderr, "NULL packet passed into %s\n", input_func);
15                return -1;
16        }
17        if (packet->trace == NULL) {
18                fprintf(stderr, "Packet contains NULL trace in %s\n", input_func);
19                return -1;
20        }
21        return 1;
22}
23
24/* API functions to retrieve interface related packet data */
25
26/* Destroy libtrace_meta_t structure
27 *
28 * @params libtrace_meta_t structure
29 * returns 1 on success, -1 on failure
30 */
31int trace_destroy_meta(libtrace_meta_t *result) {
32        int i;
33        if (!result) { return -1; }
34
35        for (i=0;i<result->num;i++) {
36                if(result->items[i].data) {
37                        free(result->items[i].data);
38                }
39        }
40        if (result->items) {
41                free(result->items);
42        }
43        if (result) {
44                free(result);
45        }
46
47        return 1;
48}
49
50/* Get the interface name/s for a meta packet.
51 * Must be destroyed with trace_destroy_meta().
52 *
53 * @params libtrace_packet_t meta packet.
54 * @returns Pointer to libtrace_meta_t structure containing all found interface names
55 * or NULL.
56 */
57libtrace_meta_t *trace_get_interface_name_meta(libtrace_packet_t *packet) {
58        if (trace_meta_check_input(packet, "trace_get_interface_name()")<0) {
59                return NULL;
60        }
61
62        /* get the result */
63        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
64                return packet->trace->format->get_meta_section_option(packet,
65                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_NAME);
66        }
67        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
68                return packet->trace->format->get_meta_section_option(packet,
69                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_NAME);
70        }
71
72        return NULL;
73}
74/* Get the interface name for a meta packet.
75 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
76 * specify the interface index.
77 *
78 * @params libtrace_packet_t meta packet to extract the interface name from.
79 * @params A pointer to a character buffer to store the interface name in.
80 * @params The size of the buffer passed in.
81 * @params The interface index within the meta packet.
82 * @returns Pointer to the character buffer containing the interface name or NULL.
83 */
84char *trace_get_interface_name(libtrace_packet_t *packet, char *space, int spacelen,
85        int index) {
86
87        libtrace_meta_t *r = trace_get_interface_name_meta(packet);
88        if (r == NULL) { return NULL; }
89        /* If there is not a result for the index return */
90        if (r->num <= index) { return NULL; }
91        /* Ensure the supplied memory allocation is enough, if not only fill
92         * what we can */
93        if (spacelen > r->items[index].len) {
94                memcpy(space, r->items[index].data, r->items[index].len);
95        } else {
96                memcpy(space, r->items[index].data, spacelen);
97        }
98        trace_destroy_meta(r);
99        return space;
100}
101/* Get the interface MAC address/s for a meta packet.
102 * Must be destroyed with trace_destroy_meta().
103 *
104 * @params libtrace_packet_t meta packet.
105 * @returns Pointer to libtrace_meta_t structure containing all found interface mac
106 * addresses or NULL.
107 */
108libtrace_meta_t *trace_get_interface_mac_meta(libtrace_packet_t *packet) {
109        if (trace_meta_check_input(packet, "trace_get_interface_mac()")<0) {
110                return NULL;
111        }
112
113        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
114                return packet->trace->format->get_meta_section_option(packet,
115                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_IF_MAC);
116        }
117        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
118                return packet->trace->format->get_meta_section_option(packet,
119                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_MAC);
120        }
121
122        return NULL;
123}
124/* Get the interface MAC address for a meta packet.
125 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
126 * specify the interface index.
127 *
128 * @params libtrace_packet_t meta packet to extract the MAC address from.
129 * @params A pointer to a character buffer to store the MAC address in.
130 * @params The size of the buffer passed in.
131 * @params The interface index within the meta packet.
132 * @returns Pointer to the character buffer containing the MAC address or NULL.
133 */
134char *trace_get_interface_mac(libtrace_packet_t *packet, char *space, int spacelen,
135        int index) {
136
137        libtrace_meta_t *r = trace_get_interface_mac_meta(packet);
138        if (r == NULL) { return NULL; }
139        if (index >= r->num) { return NULL; }
140        if (r->items[index].len > spacelen) {
141                memcpy(space, r->items[index].data, spacelen);
142        } else {
143                memcpy(space, r->items[index].data, r->items[index].len);
144        }
145        trace_destroy_meta(r);
146        return space;
147}
148
149/* Get the interface speed/s from a meta packet.
150 * Must be destroyed with trace_destroy_meta().
151 *
152 * @params libtrace_packet_t packet.
153 * @returns Pointer to libtrace_meta_t structure containing all found interface
154 * speeds or NULL.
155 */
156libtrace_meta_t *trace_get_interface_speed_meta(libtrace_packet_t *packet) {
157        if (trace_meta_check_input(packet, "trace_get_interface_speed()")<0) {
158                return NULL;
159        }
160
161        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
162                return packet->trace->format->get_meta_section_option(packet,
163                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_IF_SPEED);
164        }
165        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
166                return packet->trace->format->get_meta_section_option(packet,
167                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_SPEED);
168        }
169
170        return NULL;
171}
172/* Get the interface speed for a meta packet.
173 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
174 * specify the interface index.
175 *
176 * @params libtrace_packet_t meta packet to extract the interface speed from.
177 * @params The interface index within the meta packet.
178 * @returns uint64_t interface speed or NULL.
179 */
180uint64_t trace_get_interface_speed(libtrace_packet_t *packet, int index) {
181        libtrace_meta_t *r = trace_get_interface_speed_meta(packet);
182        if (r == NULL) { return 0; }
183        /* If the index wanted does not exist return 0 */
184        if (index >= r->num) { return 0; }
185        /* Need to check this more ERF reports this in network order */
186        uint64_t data = *(uint64_t *)r->items[index].data;
187        trace_destroy_meta(r);
188        return data;
189}
190
191/* Get the interface ipv4 address/s for a meta packet.
192 * Must be destroyed with trace_destroy_meta().
193 *
194 * @params libtrace_packet_t meta packet.
195 * @returns Pointer to libtrace_meta_t structure containing all found ipv4 addresses
196 * or NULL
197 */
198libtrace_meta_t *trace_get_interface_ipv4_meta(libtrace_packet_t *packet) {
199        if (trace_meta_check_input(packet, "trace_get_interface_ip4()")<0) {
200                return NULL;
201        }
202
203        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
204                return packet->trace->format->get_meta_section_option(packet,
205                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_IF_IPV4);
206        }
207        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
208                return packet->trace->format->get_meta_section_option(packet,
209                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_IP4);
210        }
211
212        return NULL;
213}
214/* Get the interface ipv4 address for a meta packet.
215 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
216 * specify the interface index.
217 *
218 * @params libtrace_packet_t meta packet to extract the ipv4 address from.
219 * @params The interface index within the meta packet.
220 * @returns uint32_t ipv4 address or 0.
221 */
222uint32_t trace_get_interface_ipv4(libtrace_packet_t *packet, int index) {
223        libtrace_meta_t *r = trace_get_interface_ipv4_meta(packet);
224        if (r == NULL) { return 0; }
225        if (index >= r->num) { return 0; }
226        uint32_t data = *(uint32_t *)r->items[index].data;
227        trace_destroy_meta(r);
228        return data;
229}
230/* Get the interface ipv4 address string for a meta packet.
231 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
232 * specify the interface index.
233 *
234 * @params libtrace_packet_t meta packet to extract the ipv4 address from.
235 * @params A pointer to a character buffer to store the ipv4 address string in.
236 * @params The size of the buffer passed in.
237 * @params The interface index within the meta packet.
238 * @returns Pointer to the character buffer containing the ipv4 address string or NULL.
239 */
240char *trace_get_interface_ipv4_string(libtrace_packet_t *packet, char *space, int spacelen,
241        int index) {
242
243        uint32_t addr = htonl(trace_get_interface_ipv4(packet, index));
244        if (addr == 0) { return NULL; }
245
246        char *addrstr = inet_ntoa(*(struct in_addr *)&addr);
247        memcpy(space, addrstr, strlen(addrstr));
248        return space;
249}
250
251/* Get the interface ipv6 address/s for a meta packet.
252 * Must be destroyed with trace_destroy_meta().
253 *
254 * @params libtrace_packet_t meta packet.
255 * @returns Pointer to libtrace_meta_t structure containing all found ipv6 addresses
256 * or NULL.
257 */
258libtrace_meta_t *trace_get_interface_ipv6_meta(libtrace_packet_t *packet) {
259        if (trace_meta_check_input(packet, "trace_get_interface_ip6()")<0) {
260                return NULL;
261        }
262
263        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
264                return packet->trace->format->get_meta_section_option(packet,
265                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_IF_IPV4);
266        }
267        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
268                return packet->trace->format->get_meta_section_option(packet,
269                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_IP4);
270        }
271
272        return NULL;
273}
274/* Get the interface ipv6 address for a meta packet.
275 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
276 * specify the interface index.
277 *
278 * @params libtrace_packet_t meta packet to extract the ipv6 address from.
279 * @params A pointer to a character buffer to store the ipv6 address in.
280 * @params The size of the buffer passed in.
281 * @params The interface index within the meta packet.
282 * @returns Pointer to the buffer containing the ipv6 address or NULL.
283 */
284void *trace_get_interface_ipv6(libtrace_packet_t *packet, void *space, int spacelen,
285        int index) {
286
287        libtrace_meta_t *r = trace_get_interface_ipv6_meta(packet);
288        if (r == NULL) { return NULL; }
289        if (r->num <= index) { return NULL; }
290        if (r->items[index].len > spacelen) {
291                memcpy(space, r->items[index].data, spacelen);
292        } else {
293                memcpy(space, r->items[index].data, r->items[index].len);
294        }
295        trace_destroy_meta(r);
296        return space;
297}
298/* Get the interface ipv6 address string for a meta packet.
299 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
300 * specify the interface index.
301 *
302 * @params libtrace_packet_t meta packet to extract the ipv6 address from.
303 * @params A pointer to a character buffer to store the ipv6 address in.
304 * @params The size of the buffer passed in.
305 * @params The interface index within the meta packet.
306 * @returns Pointer to the character buffer containing the ipv6 address string or NULL.
307 */
308char *trace_get_interface_ipv6_string(libtrace_packet_t *packet, char *space, int spacelen,
309        int index) {
310
311        return NULL;
312}
313
314
315/* Get the interface description/s for a meta packet.
316 * Must be destroyed with trace_destroy_meta().
317 *
318 * @params libtrace_packet_t meta packet.
319 * @returns Pointer to libtrace_meta_t structure containing all found interface
320 * descriptions or NULL.
321 */
322libtrace_meta_t *trace_get_interface_description_meta(libtrace_packet_t *packet) {
323        if (trace_meta_check_input(packet, "trace_get_interface_description()")<0) {
324                return NULL;
325        }
326
327        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
328                return packet->trace->format->get_meta_section_option(packet,
329                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_DESCR);
330        }
331        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
332                return packet->trace->format->get_meta_section_option(packet,
333                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_DESCR);
334        }
335
336        return NULL;
337}
338/* Get the interface description for a meta packet.
339 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
340 * specify the interface index.
341 *
342 * @params libtrace_packet_t meta packet to extract the interface description from.
343 * @params A pointer to a character buffer to store the interface description in.
344 * @params The size of the buffer passed in.
345 * @params The interface index within the meta packet.
346 * @returns Pointer to the character buffer containing the interface description or NULL.
347 */
348char *trace_get_interface_description(libtrace_packet_t *packet, char *space, int spacelen,
349        int index) {
350
351        libtrace_meta_t *r = trace_get_interface_description_meta(packet);
352        if (r == NULL) { return NULL; }
353        if (r->num <= index) { return NULL; }
354        if (r->items[index].len > spacelen) {
355                memcpy(space, r->items[index].data, spacelen);
356        } else {
357                memcpy(space, r->items[index].data, r->items[index].len);
358        }
359        trace_destroy_meta(r);
360        return space;
361}
362
363
364/* Get the host OS for a meta packet.
365 * Must be destroyed with trace_destroy_meta().
366 *
367 * @params libtrace_packet_t meta packet.
368 * @returns Pointer to libtrace_meta_t structure containing the host OS or NULL.
369 */
370libtrace_meta_t *trace_get_host_os_meta(libtrace_packet_t *packet) {
371        if (trace_meta_check_input(packet, "trace_get_host_os()")<0) {
372                return NULL;
373        }
374
375        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
376                return packet->trace->format->get_meta_section_option(packet,
377                        ERF_PROV_SECTION_HOST, ERF_PROV_OS);
378        }
379        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
380                return packet->trace->format->get_meta_section_option(packet,
381                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_OS);
382        }
383
384        return NULL;
385}
386/* Get the host OS for a meta packet.
387 *
388 * @params libtrace_packet_t meta packet to extract the host OS from.
389 * @params A pointer to a character buffer to store the host OS in.
390 * @params The size of the buffer passed in.
391 * @returns Pointer to the character buffer containing the host OS or NULL.
392 */
393char *trace_get_host_os(libtrace_packet_t *packet, char *space, int spacelen) {
394        libtrace_meta_t *r = trace_get_host_os_meta(packet);
395        if (r == NULL) { return NULL; }
396        if (r->items[0].len > spacelen) {
397                memcpy(space, r->items[0].data, spacelen);
398        } else {
399                memcpy(space, r->items[0].data, r->items[0].len);
400        }
401        trace_destroy_meta(r);
402        return space;
403}
404
405/* Get the interface frame check sequence length for a meta packet.
406 * Must be destroyed with trace_destroy_meta().
407 *
408 * @params libtrace_packet_t meta packet.
409 * @returns Pointer to libtrace_meta_t structure containing all found frame check
410 * sequence lengths or NULL.
411 */
412libtrace_meta_t *trace_get_interface_fcslen_meta(libtrace_packet_t *packet) {
413        if (trace_meta_check_input(packet, "trace_get_interface_frame_check_sequence_length()")<0) {
414                return NULL;
415        }
416
417        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
418                return packet->trace->format->get_meta_section_option(packet,
419                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_FCS_LEN);
420        }
421        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
422                return packet->trace->format->get_meta_section_option(packet,
423                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_FCSLEN);
424        }
425
426        return NULL;
427}
428/* Get the interface frame check sequence length for a meta packet.
429 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
430 * specify the interface index.
431 *
432 * @params libtrace_packet_t meta packet to extract the interface fcslen from.
433 * @params The interface index within the meta packet.
434 * @returns uint32_t frame check sequence length or 0.
435 */
436uint32_t trace_get_interface_fcslen(libtrace_packet_t *packet, int index) {
437        libtrace_meta_t *r = trace_get_interface_fcslen_meta(packet);
438        if (r == NULL) { return 0; }
439        if (r->num <= index) { return 0; }
440        uint32_t data = *(uint32_t *)r->items[index].data;
441        trace_destroy_meta(r);
442        return data;
443}
444
445/* Get the hardware description
446 * Must be destroyed with trace_destroy_meta()
447 *
448 * @params libtrace_packet_t meta packet
449 * @returns Pointer to libtrace_meta_t structure or NULL
450 */
451libtrace_meta_t *trace_get_interface_hardware_description_meta(libtrace_packet_t *packet) {
452        if (trace_meta_check_input(packet, "trace_get_interface_hardware_description()")<0) {
453                return NULL;
454        }
455
456        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
457                return packet->trace->format->get_meta_section_option(packet,
458                        PCAPNG_INTERFACE_TYPE, PCAPNG_META_IF_HARDWARE);
459        }
460        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
461                return packet->trace->format->get_meta_section_option(packet,
462                        ERF_PROV_SECTION_MODULE, ERF_PROV_MODEL);
463        }
464
465        return NULL;
466}
467/* Get the hardware description for a meta packet.
468 *
469 * @params libtrace_packet_t meta packet to extract the hardware description from.
470 * @params A pointer to a character buffer to store the hardware description in.
471 * @params The size of the buffer passed in.
472 * @returns Pointer to the character buffer containing the hardware description or NULL.
473 */
474char *trace_get_interface_hardware_description(libtrace_packet_t *packet, char *space,
475        int spacelen) {
476
477        libtrace_meta_t *r = trace_get_interface_hardware_description_meta(packet);
478        if (r == NULL) { return NULL; }
479        if (r->items[0].len > spacelen) {
480                memcpy(space, r->items[0].data, spacelen);
481        } else {
482                memcpy(space, r->items[0].data, r->items[0].len);
483        }
484        trace_destroy_meta(r);
485        return space;
486}
487
488/* Get any interface comments for a meta packet
489 * Must be destroyed with trace_destroy_meta()
490 *
491 * @params libtrace_packet_t packet
492 * @returns Pointer to libtrace_meta_t structure or NULL
493 */
494libtrace_meta_t *trace_get_interface_comment_meta(libtrace_packet_t *packet) {
495        if (trace_meta_check_input(packet, "trace_get_interface_comment()")<0) {
496                return NULL;
497        }
498
499        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
500                return packet->trace->format->get_meta_section_option(packet,
501                        ERF_PROV_SECTION_INTERFACE, ERF_PROV_COMMENT);
502        }
503        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
504                return packet->trace->format->get_meta_section_option(packet,
505                        PCAPNG_INTERFACE_TYPE, PCAPNG_OPTION_COMMENT);
506        }
507
508        return NULL;
509}
510/* Get the interface comment for a meta packet.
511 * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
512 * specify the interface ID.
513 *
514 * @params libtrace_packet_t meta packet to extract the interface comment from.
515 * @params A pointer to a character buffer to store the interface description in.
516 * @params The size of the buffer passed in.
517 * @params The interface number within the meta packet.
518 * @returns Pointer to the character buffer containing the hardware description or NULL.
519 */
520char *trace_get_interface_comment(libtrace_packet_t *packet, char *space, int spacelen,
521        int index) {
522
523        libtrace_meta_t *r = trace_get_interface_comment_meta(packet);
524        if (r == NULL) { return NULL; }
525        if (index > r->num) { return NULL; }
526        if (r->items[index].len > spacelen) {
527                memcpy(space, r->items[index].data, spacelen);
528        } else {
529                memcpy(space, r->items[index].data, r->items[index].len);
530        }
531        trace_destroy_meta(r);
532        return space;
533}
534
535/* Get the capture application for a meta packet
536 * Must be destroyed with trace_destroy_meta()
537 *
538 * @params libtrace_packet_t packet
539 * @returns Pointer to libtrace_meta_t structure or NULL
540 */
541libtrace_meta_t *trace_get_capture_application_meta(libtrace_packet_t *packet) {
542        if (trace_meta_check_input(packet, "trace_get_interface_comment()")<0) {
543                return NULL;
544        }
545
546        if (packet->trace->format->type == TRACE_FORMAT_ERF) {
547                return packet->trace->format->get_meta_section_option(packet,
548                        ERF_PROV_SECTION_CAPTURE, ERF_PROV_APP_NAME);
549        }
550        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
551                return packet->trace->format->get_meta_section_option(packet,
552                        PCAPNG_SECTION_TYPE, PCAPNG_META_SHB_USERAPPL);
553        }
554
555        return NULL;
556}
557/* Get the capture application for a meta packet.
558 *
559 * @params libtrace_packet_t meta packet to extract the application name from.
560 * @params A pointer to a character buffer to store the application name in.
561 * @params The size of the buffer passed in.
562 * @returns Pointer to the character buffer containing the application name or NULL.
563 */
564char *trace_get_capture_application(libtrace_packet_t *packet, char *space, int spacelen) {
565        libtrace_meta_t *r = trace_get_capture_application_meta(packet);
566        if (r == NULL) { return NULL; }
567        if (r->items[0].len > spacelen) {
568                memcpy(space, r->items[0].data, spacelen);
569        } else {
570                memcpy(space, r->items[0].data, r->items[0].len);
571        }
572        trace_destroy_meta(r);
573        return space;
574}
575
576/* Get a meta section option from a meta packet
577 * Must be destroyed with trace_destroy_meta()
578 *
579 * @params libtrace_packet_t packet
580 * @params Section code
581 * @params Option code
582 * @returns Pointer to libtrace_meta_t structure or NULL
583 */
584libtrace_meta_t *trace_get_section_option(libtrace_packet_t *packet, uint32_t section_code,
585        uint16_t option_code) {
586
587        if (trace_meta_check_input(packet, "trace_get_custom_meta()")<0) {
588                return NULL;
589        }
590
591        return packet->trace->format->get_meta_section_option(packet,
592                section_code, option_code);
593}
594
595/* Get a section from a meta packet
596 * Must be destroyed with trace_destroy_meta()
597 *
598 * @params libtrace_packet_t packet
599 * @params Section code
600 * @returns Pointer to libtrace_meta_t structure or NULL
601 */
602libtrace_meta_t *trace_get_section(libtrace_packet_t *packet, uint32_t section_code) {
603        if (trace_meta_check_input(packet, "trace_get_section()")<0) {
604                return NULL;
605        }
606
607        return packet->trace->format->get_meta_section(packet, section_code);
608}
Note: See TracBrowser for help on using the repository browser.