1 | #include "libtrace.h" |
---|
2 | #include "config.h" |
---|
3 | |
---|
4 | #include "rt_protocol.h" |
---|
5 | #include <assert.h> |
---|
6 | #include "libtrace_int.h" |
---|
7 | #include <stdlib.h> |
---|
8 | #include <string.h> |
---|
9 | |
---|
10 | #ifndef WIN32 |
---|
11 | #include <net/if_arp.h> |
---|
12 | #endif |
---|
13 | |
---|
14 | #ifndef ARPHRD_ETHER |
---|
15 | #define ARPHRD_ETHER 1 /* Ethernet 10/100Mbps. */ |
---|
16 | #endif |
---|
17 | |
---|
18 | #ifndef ARPHRD_PPP |
---|
19 | #define ARPHRD_PPP 512 |
---|
20 | #endif |
---|
21 | |
---|
22 | #ifndef ARPHRD_IEEE80211 |
---|
23 | #define ARPHRD_IEEE80211 801 |
---|
24 | #endif |
---|
25 | |
---|
26 | |
---|
27 | /* This file maps libtrace types to/from pcap DLT and erf types |
---|
28 | * |
---|
29 | * When adding a new linktype to libtrace, add the mapping(s) here, |
---|
30 | * and add the understanding of the type to get_ip(), and perhaps |
---|
31 | * get_{source,destination}_mac (if your linklayer has mac's) |
---|
32 | */ |
---|
33 | |
---|
34 | libtrace_linktype_t pcap_dlt_to_libtrace(libtrace_dlt_t dlt) |
---|
35 | { |
---|
36 | switch(dlt) { |
---|
37 | case TRACE_DLT_RAW: return TRACE_TYPE_NONE; |
---|
38 | case TRACE_DLT_EN10MB: return TRACE_TYPE_ETH; |
---|
39 | case TRACE_DLT_IEEE802_11: return TRACE_TYPE_80211; |
---|
40 | case TRACE_DLT_LINUX_SLL: return TRACE_TYPE_LINUX_SLL; |
---|
41 | case TRACE_DLT_PFLOG: return TRACE_TYPE_PFLOG; |
---|
42 | case TRACE_DLT_IEEE802_11_RADIO: return TRACE_TYPE_80211_RADIO; |
---|
43 | case TRACE_DLT_ATM_RFC1483: return TRACE_TYPE_LLCSNAP; |
---|
44 | |
---|
45 | } |
---|
46 | return ~0; |
---|
47 | } |
---|
48 | |
---|
49 | |
---|
50 | libtrace_dlt_t libtrace_to_pcap_dlt(libtrace_linktype_t type) |
---|
51 | { |
---|
52 | /* If pcap doesn't have a DLT, you can either ask pcap to register |
---|
53 | * you a DLT, (and perhaps write a tcpdump decoder for it), or you |
---|
54 | * can add it to demote_packet |
---|
55 | */ |
---|
56 | switch(type) { |
---|
57 | case TRACE_TYPE_NONE: return TRACE_DLT_RAW; |
---|
58 | case TRACE_TYPE_ETH: return TRACE_DLT_EN10MB; |
---|
59 | case TRACE_TYPE_80211: return TRACE_DLT_IEEE802_11; |
---|
60 | case TRACE_TYPE_LINUX_SLL: return TRACE_DLT_LINUX_SLL; |
---|
61 | case TRACE_TYPE_PFLOG: return TRACE_DLT_PFLOG; |
---|
62 | case TRACE_TYPE_80211_RADIO: return TRACE_DLT_IEEE802_11_RADIO; |
---|
63 | case TRACE_TYPE_ATM: |
---|
64 | /* Dispite hints to the contrary, there is no DLT |
---|
65 | * for 'raw atm packets that happen to be missing |
---|
66 | * the HEC' or even 'raw atm packets that have a hec'. |
---|
67 | * |
---|
68 | * The closest are DLT_ATM_RFC1483 but that doesn't |
---|
69 | * include the ATM header, only the LLCSNAP header. |
---|
70 | */ |
---|
71 | return ~0; |
---|
72 | case TRACE_TYPE_LLCSNAP: return TRACE_DLT_ATM_RFC1483; |
---|
73 | } |
---|
74 | return ~0; |
---|
75 | } |
---|
76 | |
---|
77 | enum rt_field_t pcap_dlt_to_rt(libtrace_dlt_t dlt) |
---|
78 | { |
---|
79 | /* For pcap the rt type is just the dlt + a fixed value */ |
---|
80 | return dlt + RT_DATA_PCAP; |
---|
81 | } |
---|
82 | |
---|
83 | libtrace_dlt_t rt_to_pcap_dlt(enum rt_field_t rt_type) |
---|
84 | { |
---|
85 | assert(rt_type >= RT_DATA_PCAP); |
---|
86 | return rt_type - RT_DATA_PCAP; |
---|
87 | } |
---|
88 | |
---|
89 | libtrace_linktype_t erf_type_to_libtrace(char erf) |
---|
90 | { |
---|
91 | switch (erf) { |
---|
92 | case TYPE_HDLC_POS: return TRACE_TYPE_HDLC_POS; |
---|
93 | case TYPE_ETH: return TRACE_TYPE_ETH; |
---|
94 | case TYPE_ATM: return TRACE_TYPE_ATM; |
---|
95 | case TYPE_AAL5: return TRACE_TYPE_AAL5; |
---|
96 | } |
---|
97 | return ~0; |
---|
98 | } |
---|
99 | |
---|
100 | char libtrace_to_erf_type(libtrace_linktype_t linktype) |
---|
101 | { |
---|
102 | switch(linktype) { |
---|
103 | case TRACE_TYPE_HDLC_POS: return TYPE_HDLC_POS; |
---|
104 | case TRACE_TYPE_ETH: return TYPE_ETH; |
---|
105 | case TRACE_TYPE_ATM: return TYPE_ATM; |
---|
106 | case TRACE_TYPE_AAL5: return TYPE_AAL5; |
---|
107 | } |
---|
108 | return -1; |
---|
109 | } |
---|
110 | |
---|
111 | libtrace_linktype_t arphrd_type_to_libtrace(unsigned int arphrd) { |
---|
112 | switch(arphrd) { |
---|
113 | case ARPHRD_ETHER: return TRACE_TYPE_ETH; |
---|
114 | case ARPHRD_IEEE80211: return TRACE_TYPE_80211; |
---|
115 | case ARPHRD_80211_RADIOTAP: return TRACE_TYPE_80211_RADIO; |
---|
116 | } |
---|
117 | return ~0; |
---|
118 | } |
---|
119 | |
---|
120 | unsigned int libtrace_to_arphrd_type(libtrace_linktype_t linktype) { |
---|
121 | switch(linktype) { |
---|
122 | case TRACE_TYPE_ETH: return ARPHRD_ETHER; |
---|
123 | case TRACE_TYPE_80211: return ARPHRD_IEEE80211; |
---|
124 | case TRACE_TYPE_80211_RADIO: return ARPHRD_80211_RADIOTAP; |
---|
125 | } |
---|
126 | return -1; |
---|
127 | } |
---|
128 | |
---|
129 | /** Tinker with a packet |
---|
130 | * packets that don't support direction tagging are annoying, especially |
---|
131 | * when we have direction tagging information! So this converts the packet |
---|
132 | * to TRACE_TYPE_LINUX_SLL which does support direction tagging. This is a |
---|
133 | * pcap style packet for the reason that it means it works with bpf filters. |
---|
134 | * |
---|
135 | * @note this will copy the packet, so use sparingly if possible. |
---|
136 | */ |
---|
137 | void promote_packet(libtrace_packet_t *packet) |
---|
138 | { |
---|
139 | if (packet->trace->format->type == TRACE_FORMAT_PCAP) { |
---|
140 | char *tmpbuffer; |
---|
141 | libtrace_sll_header_t *hdr; |
---|
142 | |
---|
143 | if (pcap_dlt_to_libtrace(rt_to_pcap_dlt(packet->type)) |
---|
144 | == TRACE_TYPE_LINUX_SLL) { |
---|
145 | /* This is already been promoted, so ignore it */ |
---|
146 | return; |
---|
147 | } |
---|
148 | |
---|
149 | /* This should be easy, just prepend the header */ |
---|
150 | tmpbuffer= (char*)malloc( |
---|
151 | sizeof(libtrace_sll_header_t) |
---|
152 | +trace_get_capture_length(packet) |
---|
153 | +trace_get_framing_length(packet) |
---|
154 | ); |
---|
155 | |
---|
156 | hdr=(libtrace_sll_header_t*)((char*)tmpbuffer |
---|
157 | +trace_get_framing_length(packet)); |
---|
158 | |
---|
159 | hdr->halen=htons(6); |
---|
160 | hdr->pkttype=TRACE_SLL_OUTGOING; |
---|
161 | |
---|
162 | switch(pcap_dlt_to_libtrace(rt_to_pcap_dlt(packet->type))) { |
---|
163 | case TRACE_TYPE_NONE: |
---|
164 | trace_get_payload_from_link( |
---|
165 | trace_get_link(packet), |
---|
166 | trace_get_link_type(packet), |
---|
167 | &hdr->protocol, |
---|
168 | NULL); |
---|
169 | hdr->hatype = htons(ARPHRD_PPP); |
---|
170 | hdr->protocol=htons(hdr->protocol); |
---|
171 | break; |
---|
172 | case TRACE_TYPE_ETH: |
---|
173 | hdr->hatype = htons(ARPHRD_ETHER); |
---|
174 | hdr->protocol=htons(0x0060); /* ETH_P_LOOP */ |
---|
175 | break; |
---|
176 | default: |
---|
177 | /* failed */ |
---|
178 | return; |
---|
179 | } |
---|
180 | memcpy(tmpbuffer,packet->header, |
---|
181 | trace_get_framing_length(packet)); |
---|
182 | memcpy(tmpbuffer |
---|
183 | +sizeof(libtrace_sll_header_t) |
---|
184 | +trace_get_framing_length(packet), |
---|
185 | packet->payload, |
---|
186 | trace_get_capture_length(packet)); |
---|
187 | if (packet->buf_control == TRACE_CTRL_EXTERNAL) { |
---|
188 | packet->buf_control=TRACE_CTRL_PACKET; |
---|
189 | } |
---|
190 | else { |
---|
191 | free(packet->buffer); |
---|
192 | } |
---|
193 | packet->buffer=tmpbuffer; |
---|
194 | packet->header=tmpbuffer; |
---|
195 | packet->payload=tmpbuffer+trace_get_framing_length(packet); |
---|
196 | packet->type=pcap_dlt_to_rt(TRACE_DLT_LINUX_SLL); |
---|
197 | ((struct libtrace_pcapfile_pkt_hdr_t*) packet->header)->caplen+= |
---|
198 | sizeof(libtrace_sll_header_t); |
---|
199 | ((struct libtrace_pcapfile_pkt_hdr_t*) packet->header)->wirelen+= |
---|
200 | sizeof(libtrace_sll_header_t); |
---|
201 | return; |
---|
202 | } |
---|
203 | } |
---|
204 | |
---|
205 | /* Try and simplify the packet one step, kinda the opposite to promote_packet |
---|
206 | * |
---|
207 | * returns true if demotion was possible, false if not. |
---|
208 | */ |
---|
209 | bool demote_packet(libtrace_packet_t *packet) |
---|
210 | { |
---|
211 | uint8_t type; |
---|
212 | uint32_t remaining; |
---|
213 | char *tmp; |
---|
214 | struct timeval tv; |
---|
215 | static libtrace_t *trace = NULL; |
---|
216 | switch(trace_get_link_type(packet)) { |
---|
217 | case TRACE_TYPE_POS: |
---|
218 | remaining=trace_get_capture_length(packet); |
---|
219 | packet->payload=trace_get_payload_from_pos( |
---|
220 | packet->payload,NULL,&remaining); |
---|
221 | |
---|
222 | tmp=malloc( |
---|
223 | trace_get_capture_length(packet) |
---|
224 | +sizeof(libtrace_pcapfile_pkt_hdr_t) |
---|
225 | ); |
---|
226 | |
---|
227 | tv=trace_get_timeval(packet); |
---|
228 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_sec=tv.tv_sec; |
---|
229 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_usec=tv.tv_usec; |
---|
230 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->wirelen |
---|
231 | = trace_get_wire_length(packet)-(trace_get_capture_length(packet)-remaining); |
---|
232 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->caplen |
---|
233 | = remaining; |
---|
234 | |
---|
235 | memcpy(tmp+sizeof(libtrace_pcapfile_pkt_hdr_t), |
---|
236 | packet->payload, |
---|
237 | remaining); |
---|
238 | if (packet->buf_control == TRACE_CTRL_EXTERNAL) { |
---|
239 | packet->buf_control=TRACE_CTRL_PACKET; |
---|
240 | } |
---|
241 | else { |
---|
242 | free(packet->buffer); |
---|
243 | } |
---|
244 | packet->buffer=tmp; |
---|
245 | packet->header=tmp; |
---|
246 | packet->payload=tmp+sizeof(libtrace_pcapfile_pkt_hdr_t); |
---|
247 | packet->type=pcap_dlt_to_rt(TRACE_DLT_RAW); |
---|
248 | |
---|
249 | if (trace == NULL) { |
---|
250 | trace = trace_create_dead("pcap:-"); |
---|
251 | } |
---|
252 | |
---|
253 | packet->trace=trace; |
---|
254 | |
---|
255 | return true; |
---|
256 | case TRACE_TYPE_ATM: |
---|
257 | remaining=trace_get_capture_length(packet); |
---|
258 | packet->payload=trace_get_payload_from_atm( |
---|
259 | packet->payload,&type,&remaining); |
---|
260 | |
---|
261 | tmp=malloc( |
---|
262 | trace_get_capture_length(packet) |
---|
263 | +sizeof(libtrace_pcapfile_pkt_hdr_t) |
---|
264 | ); |
---|
265 | |
---|
266 | tv=trace_get_timeval(packet); |
---|
267 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_sec=tv.tv_sec; |
---|
268 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->ts_usec=tv.tv_usec; |
---|
269 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->wirelen |
---|
270 | = trace_get_wire_length(packet)-(trace_get_capture_length(packet)-remaining); |
---|
271 | ((libtrace_pcapfile_pkt_hdr_t*)tmp)->caplen |
---|
272 | = remaining; |
---|
273 | |
---|
274 | memcpy(tmp+sizeof(libtrace_pcapfile_pkt_hdr_t), |
---|
275 | packet->payload, |
---|
276 | remaining); |
---|
277 | if (packet->buf_control == TRACE_CTRL_EXTERNAL) { |
---|
278 | packet->buf_control=TRACE_CTRL_PACKET; |
---|
279 | } |
---|
280 | else { |
---|
281 | free(packet->buffer); |
---|
282 | } |
---|
283 | packet->buffer=tmp; |
---|
284 | packet->header=tmp; |
---|
285 | packet->payload=tmp+sizeof(libtrace_pcapfile_pkt_hdr_t); |
---|
286 | packet->type=pcap_dlt_to_rt(TRACE_DLT_ATM_RFC1483); |
---|
287 | |
---|
288 | if (trace == NULL) { |
---|
289 | trace = trace_create_dead("pcap:-"); |
---|
290 | } |
---|
291 | |
---|
292 | packet->trace=trace; |
---|
293 | |
---|
294 | return true; |
---|
295 | |
---|
296 | case TRACE_TYPE_LINUX_SLL: |
---|
297 | switch(ntohs(((libtrace_sll_header_t*)packet->payload) |
---|
298 | ->hatype)) { |
---|
299 | case ARPHRD_PPP: |
---|
300 | packet->type=pcap_dlt_to_rt(TRACE_DLT_RAW); |
---|
301 | break; |
---|
302 | case ARPHRD_ETHER: |
---|
303 | packet->type=pcap_dlt_to_rt(TRACE_DLT_EN10MB); |
---|
304 | break; |
---|
305 | default: |
---|
306 | /* Dunno how to demote this packet */ |
---|
307 | return false; |
---|
308 | } |
---|
309 | /* Skip the Linux SLL header */ |
---|
310 | packet->payload=(void*)((char*)packet->payload |
---|
311 | +sizeof(libtrace_sll_header_t)); |
---|
312 | trace_set_capture_length(packet, |
---|
313 | trace_get_capture_length(packet) |
---|
314 | -sizeof(libtrace_sll_header_t)); |
---|
315 | break; |
---|
316 | default: |
---|
317 | return false; |
---|
318 | } |
---|
319 | return true; |
---|
320 | } |
---|