1 | /* |
---|
2 | * This file is part of libtrace |
---|
3 | * |
---|
4 | * Copyright (c) 2007,2008,2009,2010 The University of Waikato, Hamilton, |
---|
5 | * New Zealand. |
---|
6 | * |
---|
7 | * Authors: Daniel Lawson |
---|
8 | * Perry Lorier |
---|
9 | * Shane Alcock |
---|
10 | * |
---|
11 | * All rights reserved. |
---|
12 | * |
---|
13 | * This code has been developed by the University of Waikato WAND |
---|
14 | * research group. For further information please see http://www.wand.net.nz/ |
---|
15 | * |
---|
16 | * libtrace is free software; you can redistribute it and/or modify |
---|
17 | * it under the terms of the GNU General Public License as published by |
---|
18 | * the Free Software Foundation; either version 2 of the License, or |
---|
19 | * (at your option) any later version. |
---|
20 | * |
---|
21 | * libtrace is distributed in the hope that it will be useful, |
---|
22 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
23 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
24 | * GNU General Public License for more details. |
---|
25 | * |
---|
26 | * You should have received a copy of the GNU General Public License |
---|
27 | * along with libtrace; if not, write to the Free Software |
---|
28 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
---|
29 | * |
---|
30 | * $Id$ |
---|
31 | * |
---|
32 | */ |
---|
33 | |
---|
34 | #include "config.h" |
---|
35 | #include "libtrace.h" |
---|
36 | |
---|
37 | #include "rt_protocol.h" |
---|
38 | #include <assert.h> |
---|
39 | #include "libtrace_int.h" |
---|
40 | #include <stdlib.h> |
---|
41 | #include <string.h> |
---|
42 | |
---|
43 | #include "arphrd.h" |
---|
44 | |
---|
45 | |
---|
46 | /* This file maps libtrace types to/from pcap DLT and erf types |
---|
47 | * |
---|
48 | * When adding a new linktype to libtrace, add the mapping(s) here, |
---|
49 | * and add the understanding of the type to get_ip(), and perhaps |
---|
50 | * get_{source,destination}_mac (if your linklayer has mac's) |
---|
51 | */ |
---|
52 | |
---|
53 | libtrace_linktype_t pcap_linktype_to_libtrace(libtrace_dlt_t linktype) |
---|
54 | { |
---|
55 | switch(linktype) { |
---|
56 | case TRACE_DLT_RAW: |
---|
57 | case TRACE_DLT_LINKTYPE_RAW: return TRACE_TYPE_NONE; |
---|
58 | case TRACE_DLT_EN10MB: return TRACE_TYPE_ETH; |
---|
59 | case TRACE_DLT_IEEE802_11: return TRACE_TYPE_80211; |
---|
60 | case TRACE_DLT_LINUX_SLL: return TRACE_TYPE_LINUX_SLL; |
---|
61 | case TRACE_DLT_PFLOG: return TRACE_TYPE_PFLOG; |
---|
62 | case TRACE_DLT_IEEE802_11_RADIO: return TRACE_TYPE_80211_RADIO; |
---|
63 | case TRACE_DLT_ATM_RFC1483: return TRACE_TYPE_LLCSNAP; |
---|
64 | case TRACE_DLT_PPP: return TRACE_TYPE_PPP; |
---|
65 | case TRACE_DLT_PPP_SERIAL: return TRACE_TYPE_POS; |
---|
66 | case TRACE_DLT_C_HDLC: return TRACE_TYPE_HDLC_POS; |
---|
67 | /* Unhandled */ |
---|
68 | case TRACE_DLT_NULL: /* Raw IP frame with a BSD specific |
---|
69 | * header If you want raw L3 headers |
---|
70 | * use TRACE_DLT_RAW |
---|
71 | */ |
---|
72 | break; |
---|
73 | } |
---|
74 | return ~0U; |
---|
75 | } |
---|
76 | |
---|
77 | libtrace_dlt_t libtrace_to_pcap_dlt(libtrace_linktype_t type) |
---|
78 | { |
---|
79 | /* If pcap doesn't have a DLT, you can either ask pcap to register |
---|
80 | * you a DLT, (and perhaps write a tcpdump decoder for it), or you |
---|
81 | * can add it to demote_packet |
---|
82 | */ |
---|
83 | switch(type) { |
---|
84 | case TRACE_TYPE_NONE: return TRACE_DLT_RAW; |
---|
85 | case TRACE_TYPE_ETH: return TRACE_DLT_EN10MB; |
---|
86 | case TRACE_TYPE_80211: return TRACE_DLT_IEEE802_11; |
---|
87 | case TRACE_TYPE_LINUX_SLL: return TRACE_DLT_LINUX_SLL; |
---|
88 | case TRACE_TYPE_PFLOG: return TRACE_DLT_PFLOG; |
---|
89 | case TRACE_TYPE_80211_RADIO: return TRACE_DLT_IEEE802_11_RADIO; |
---|
90 | case TRACE_TYPE_LLCSNAP: return TRACE_DLT_ATM_RFC1483; |
---|
91 | case TRACE_TYPE_PPP: return TRACE_DLT_PPP; |
---|
92 | case TRACE_TYPE_HDLC_POS: return TRACE_DLT_C_HDLC; |
---|
93 | /* Theres more than one type of PPP. Who knew? */ |
---|
94 | case TRACE_TYPE_POS: return TRACE_DLT_PPP_SERIAL; |
---|
95 | |
---|
96 | /* Below here are unsupported conversions */ |
---|
97 | /* Despite hints to the contrary, there is no DLT |
---|
98 | * for 'raw atm packets that happen to be missing |
---|
99 | * the HEC' or even 'raw atm packets that have a hec'. |
---|
100 | * |
---|
101 | * The closest are DLT_ATM_RFC1483 but that doesn't |
---|
102 | * include the ATM header, only the LLCSNAP header. |
---|
103 | */ |
---|
104 | case TRACE_TYPE_ATM: |
---|
105 | /* pcap has no DLT for DUCK */ |
---|
106 | case TRACE_TYPE_DUCK: |
---|
107 | /* Used for test traces within WAND */ |
---|
108 | case TRACE_TYPE_80211_PRISM: |
---|
109 | /* Probably == PPP */ |
---|
110 | /* TODO: We haven't researched these yet */ |
---|
111 | case TRACE_TYPE_AAL5: |
---|
112 | case TRACE_TYPE_METADATA: |
---|
113 | case TRACE_TYPE_NONDATA: |
---|
114 | break; |
---|
115 | } |
---|
116 | return ~0U; |
---|
117 | } |
---|
118 | |
---|
119 | static libtrace_dlt_t pcap_dlt_to_pcap_linktype(libtrace_dlt_t linktype) |
---|
120 | { |
---|
121 | switch (linktype) { |
---|
122 | case TRACE_DLT_RAW: return TRACE_DLT_LINKTYPE_RAW; |
---|
123 | default: |
---|
124 | return linktype; |
---|
125 | } |
---|
126 | } |
---|
127 | |
---|
128 | libtrace_dlt_t libtrace_to_pcap_linktype(libtrace_linktype_t type) |
---|
129 | { |
---|
130 | return pcap_dlt_to_pcap_linktype(libtrace_to_pcap_dlt(type)); |
---|
131 | } |
---|
132 | |
---|
133 | libtrace_rt_types_t pcap_linktype_to_rt(libtrace_dlt_t linktype) |
---|
134 | { |
---|
135 | /* For pcap the rt type is just the linktype + a fixed value */ |
---|
136 | return pcap_dlt_to_pcap_linktype(linktype) + TRACE_RT_DATA_DLT; |
---|
137 | } |
---|
138 | |
---|
139 | libtrace_dlt_t rt_to_pcap_linktype(libtrace_rt_types_t rt_type) |
---|
140 | { |
---|
141 | assert(rt_type >= TRACE_RT_DATA_DLT); |
---|
142 | return rt_type - TRACE_RT_DATA_DLT; |
---|
143 | } |
---|
144 | |
---|
145 | libtrace_linktype_t erf_type_to_libtrace(uint8_t erf) |
---|
146 | { |
---|
147 | switch (erf) { |
---|
148 | case TYPE_HDLC_POS: return TRACE_TYPE_HDLC_POS; |
---|
149 | case TYPE_ETH: return TRACE_TYPE_ETH; |
---|
150 | case TYPE_ATM: return TRACE_TYPE_ATM; |
---|
151 | case TYPE_AAL5: return TRACE_TYPE_AAL5; |
---|
152 | case TYPE_DSM_COLOR_ETH:return TRACE_TYPE_ETH; |
---|
153 | case TYPE_IPV4: return TRACE_TYPE_NONE; |
---|
154 | case TYPE_IPV6: return TRACE_TYPE_NONE; |
---|
155 | } |
---|
156 | return ~0U; |
---|
157 | } |
---|
158 | |
---|
159 | uint8_t libtrace_to_erf_type(libtrace_linktype_t linktype) |
---|
160 | { |
---|
161 | switch(linktype) { |
---|
162 | case TRACE_TYPE_HDLC_POS: return TYPE_HDLC_POS; |
---|
163 | case TRACE_TYPE_ETH: return TYPE_ETH; |
---|
164 | case TRACE_TYPE_ATM: return TYPE_ATM; |
---|
165 | case TRACE_TYPE_AAL5: return TYPE_AAL5; |
---|
166 | |
---|
167 | /* Not technically correct! Could be IPv6 packet |
---|
168 | * |
---|
169 | * TODO: Maybe we want TRACE_TYPE_RAW_IPV4 and |
---|
170 | * TRACE_TYPE_RAW_IPV6 to replace TRACE_TYPE_NONE. |
---|
171 | * Still need a good way to figure out how to convert |
---|
172 | * TRACE_DLT_LINKTYPE_RAW into the correct type for the |
---|
173 | * IP version though :( */ |
---|
174 | case TRACE_TYPE_NONE: return TYPE_IPV4; |
---|
175 | /* Unsupported conversions */ |
---|
176 | case TRACE_TYPE_LLCSNAP: |
---|
177 | case TRACE_TYPE_DUCK: |
---|
178 | case TRACE_TYPE_80211_RADIO: |
---|
179 | case TRACE_TYPE_80211_PRISM: |
---|
180 | case TRACE_TYPE_80211: |
---|
181 | case TRACE_TYPE_PFLOG: |
---|
182 | case TRACE_TYPE_LINUX_SLL: |
---|
183 | case TRACE_TYPE_PPP: |
---|
184 | case TRACE_TYPE_POS: |
---|
185 | case TRACE_TYPE_METADATA: |
---|
186 | case TRACE_TYPE_NONDATA: |
---|
187 | break; |
---|
188 | } |
---|
189 | return 255; |
---|
190 | } |
---|
191 | |
---|
192 | libtrace_linktype_t arphrd_type_to_libtrace(unsigned int arphrd) { |
---|
193 | switch(arphrd) { |
---|
194 | case ARPHRD_ETHER: return TRACE_TYPE_ETH; |
---|
195 | case ARPHRD_EETHER: return TRACE_TYPE_ETH; |
---|
196 | case ARPHRD_IEEE80211: return TRACE_TYPE_80211; |
---|
197 | case ARPHRD_80211_RADIOTAP: return TRACE_TYPE_80211_RADIO; |
---|
198 | case ARPHRD_PPP: return TRACE_TYPE_NONE; |
---|
199 | case ARPHRD_LOOPBACK: return TRACE_TYPE_ETH; |
---|
200 | case ARPHRD_NONE: return TRACE_TYPE_NONE; |
---|
201 | } |
---|
202 | printf("Unknown ARPHRD %08x\n",arphrd); |
---|
203 | return ~0U; |
---|
204 | } |
---|
205 | |
---|
206 | unsigned int libtrace_to_arphrd_type(libtrace_linktype_t linktype) { |
---|
207 | switch(linktype) { |
---|
208 | case TRACE_TYPE_ETH: return ARPHRD_ETHER; |
---|
209 | case TRACE_TYPE_80211: return ARPHRD_IEEE80211; |
---|
210 | case TRACE_TYPE_80211_RADIO: return ARPHRD_80211_RADIOTAP; |
---|
211 | default: break; |
---|
212 | } |
---|
213 | return ~0U; |
---|
214 | } |
---|
215 | |
---|
216 | /** Prepends a Linux SLL header to the packet. |
---|
217 | * |
---|
218 | * Packets that don't support direction tagging are annoying, especially |
---|
219 | * when we have direction tagging information! So this converts the packet |
---|
220 | * to TRACE_TYPE_LINUX_SLL which does support direction tagging. This is a |
---|
221 | * pcap style packet for the reason that it means it works with bpf filters. |
---|
222 | * |
---|
223 | * @note this will copy the packet, so use sparingly if possible. |
---|
224 | */ |
---|
225 | void promote_packet(libtrace_packet_t *packet) |
---|
226 | { |
---|
227 | if (packet->trace->format->type == TRACE_FORMAT_PCAP) { |
---|
228 | char *tmpbuffer; |
---|
229 | libtrace_sll_header_t *hdr; |
---|
230 | |
---|
231 | if (pcap_linktype_to_libtrace(rt_to_pcap_linktype(packet->type)) |
---|
232 | == TRACE_TYPE_LINUX_SLL) { |
---|
233 | /* This is already been promoted, so ignore it */ |
---|
234 | return; |
---|
235 | } |
---|
236 | |
---|
237 | /* This should be easy, just prepend the header */ |
---|
238 | tmpbuffer= (char*)malloc( |
---|
239 | sizeof(libtrace_sll_header_t) |
---|
240 | +trace_get_capture_length(packet) |
---|
241 | +trace_get_framing_length(packet) |
---|
242 | ); |
---|
243 | |
---|
244 | hdr=(libtrace_sll_header_t*)((char*)tmpbuffer |
---|
245 | +trace_get_framing_length(packet)); |
---|
246 | |
---|
247 | hdr->halen=htons(6); |
---|
248 | hdr->pkttype=TRACE_SLL_OUTGOING; |
---|
249 | |
---|
250 | switch(pcap_linktype_to_libtrace(rt_to_pcap_linktype(packet->type))) { |
---|
251 | case TRACE_TYPE_NONE: |
---|
252 | trace_get_layer3(packet, &hdr->protocol, NULL); |
---|
253 | hdr->hatype = htons(ARPHRD_PPP); |
---|
254 | hdr->protocol=htons(hdr->protocol); |
---|
255 | break; |
---|
256 | case TRACE_TYPE_ETH: |
---|
257 | hdr->hatype = htons(ARPHRD_ETHER); |
---|
258 | hdr->protocol=htons(0x0060); /* ETH_P_LOOP */ |
---|
259 | break; |
---|
260 | default: |
---|
261 | /* failed */ |
---|
262 | return; |
---|
263 | } |
---|
264 | memcpy(tmpbuffer,packet->header, |
---|
265 | trace_get_framing_length(packet)); |
---|
266 | memcpy(tmpbuffer |
---|
267 | +sizeof(libtrace_sll_header_t) |
---|
268 | +trace_get_framing_length(packet), |
---|
269 | packet->payload, |
---|
270 | trace_get_capture_length(packet)); |
---|
271 | if (packet->buf_control == TRACE_CTRL_EXTERNAL) { |
---|
272 | packet->buf_control=TRACE_CTRL_PACKET; |
---|
273 | } |
---|
274 | else { |
---|
275 | free(packet->buffer); |
---|
276 | } |
---|
277 | packet->buffer=tmpbuffer; |
---|
278 | packet->header=tmpbuffer; |
---|
279 | packet->payload=tmpbuffer+trace_get_framing_length(packet); |
---|
280 | packet->type=pcap_linktype_to_rt(TRACE_DLT_LINUX_SLL); |
---|
281 | ((struct libtrace_pcapfile_pkt_hdr_t*) packet->header)->caplen+= |
---|
282 | sizeof(libtrace_sll_header_t); |
---|
283 | ((struct libtrace_pcapfile_pkt_hdr_t*) packet->header)->wirelen+= |
---|
284 | sizeof(libtrace_sll_header_t); |
---|
285 | trace_clear_cache(packet); |
---|
286 | return; |
---|
287 | } |
---|
288 | } |
---|
289 | |
---|
290 | /* Try and remove any extraneous encapsulation that may have been added to |
---|
291 | * a packet. Effectively the opposite to promote_packet. |
---|
292 | * |
---|
293 | * Returns true if demotion was possible, false if not. |
---|
294 | */ |
---|
295 | bool demote_packet(libtrace_packet_t *packet) |
---|
296 | { |
---|
297 | uint8_t type; |
---|
298 | uint16_t ha_type, next_proto; |
---|
299 | libtrace_sll_header_t *sll = NULL; |
---|
300 | uint32_t remaining = 0; |
---|
301 | char *tmp; |
---|
302 | struct timeval tv; |
---|
303 | static libtrace_t *trace = NULL; |
---|
304 | switch(trace_get_link_type(packet)) { |
---|
305 | case TRACE_TYPE_ATM: |
---|
306 | remaining=trace_get_capture_length(packet); |
---|
307 | packet->payload=trace_get_payload_from_atm( |
---|
308 | packet->payload,&type,&remaining); |
---|
309 | if (!packet->payload) |
---|
310 | return false; |
---|
311 | tmp=(char*)malloc( |
---|
312 | trace_get_capture_length(packet) |
---|
313 | +sizeof(libtrace_pcapfile_pkt_hdr_t) |
---|
314 | ); |
---|
315 | |
---|
316 | tv=trace_get_timeval(packet); |
---|
317 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_sec=tv.tv_sec; |
---|
318 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_usec=tv.tv_usec; |
---|
319 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->wirelen |
---|
320 | = trace_get_wire_length(packet)-(trace_get_capture_length(packet)-remaining); |
---|
321 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->caplen |
---|
322 | = remaining; |
---|
323 | |
---|
324 | memcpy(tmp+sizeof(libtrace_pcapfile_pkt_hdr_t), |
---|
325 | packet->payload, |
---|
326 | (size_t)remaining); |
---|
327 | if (packet->buf_control == TRACE_CTRL_EXTERNAL) { |
---|
328 | packet->buf_control=TRACE_CTRL_PACKET; |
---|
329 | } |
---|
330 | else { |
---|
331 | free(packet->buffer); |
---|
332 | } |
---|
333 | packet->buffer=tmp; |
---|
334 | packet->header=tmp; |
---|
335 | packet->payload=tmp+sizeof(libtrace_pcapfile_pkt_hdr_t); |
---|
336 | packet->type=pcap_linktype_to_rt(TRACE_DLT_ATM_RFC1483); |
---|
337 | |
---|
338 | if (trace == NULL) { |
---|
339 | trace = trace_create_dead("pcapfile:-"); |
---|
340 | } |
---|
341 | |
---|
342 | packet->trace=trace; |
---|
343 | |
---|
344 | /* Invalidate caches */ |
---|
345 | trace_clear_cache(packet); |
---|
346 | return true; |
---|
347 | |
---|
348 | case TRACE_TYPE_LINUX_SLL: |
---|
349 | sll = (libtrace_sll_header_t *)(packet->payload); |
---|
350 | |
---|
351 | ha_type = ntohs(sll->hatype); |
---|
352 | next_proto = ntohs(sll->protocol); |
---|
353 | |
---|
354 | /* Preserved from older libtrace behaviour */ |
---|
355 | if (ha_type == ARPHRD_PPP) |
---|
356 | packet->type = pcap_linktype_to_rt(TRACE_DLT_RAW); |
---|
357 | /* Don't decide trace type based on ha_type, |
---|
358 | * decide based on the protocol header that is |
---|
359 | * coming up! |
---|
360 | */ |
---|
361 | else if (next_proto == TRACE_ETHERTYPE_LOOPBACK) |
---|
362 | packet->type = pcap_linktype_to_rt(TRACE_DLT_EN10MB); |
---|
363 | else if (next_proto == TRACE_ETHERTYPE_IP) |
---|
364 | packet->type = pcap_linktype_to_rt(TRACE_DLT_RAW); |
---|
365 | else if (next_proto == TRACE_ETHERTYPE_IPV6) |
---|
366 | packet->type = pcap_linktype_to_rt(TRACE_DLT_RAW); |
---|
367 | else |
---|
368 | return false; |
---|
369 | |
---|
370 | /* Skip the Linux SLL header */ |
---|
371 | packet->payload=(void*)((char*)packet->payload |
---|
372 | +sizeof(libtrace_sll_header_t)); |
---|
373 | trace_set_capture_length(packet, |
---|
374 | trace_get_capture_length(packet) |
---|
375 | -sizeof(libtrace_sll_header_t)); |
---|
376 | |
---|
377 | /* Invalidate caches */ |
---|
378 | trace_clear_cache(packet); |
---|
379 | break; |
---|
380 | default: |
---|
381 | return false; |
---|
382 | } |
---|
383 | |
---|
384 | /* Invalidate caches */ |
---|
385 | trace_clear_cache(packet); |
---|
386 | return true; |
---|
387 | } |
---|