- Timestamp:
- 01/08/19 10:36:06 (2 years ago)
- Branches:
- develop
- Children:
- 93564ff
- Parents:
- 4ac48fa (diff), f47025d (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent. - Location:
- lib
- Files:
-
- 13 edited
Legend:
- Unmodified
- Added
- Removed
-
lib/format_dag25.c
r8c5c550 r9a6bdbc 174 174 * many times or close a device that we're still using */ 175 175 struct dag_dev_t *open_dags = NULL; 176 177 static bool dag_can_write(libtrace_packet_t *packet) { 178 /* Get the linktype */ 179 libtrace_linktype_t ltype = trace_get_link_type(packet); 180 181 if (ltype == TRACE_TYPE_ERF_META 182 || ltype == TRACE_TYPE_NONDATA) { 183 184 return false; 185 } 186 187 return true; 188 } 176 189 177 190 /* Returns the amount of padding between the ERF header and the start of the … … 1186 1199 static int dag_write_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) 1187 1200 { 1201 /* Check dag can write this type of packet */ 1202 if (!dag_can_write(packet)) { 1203 return 0; 1204 } 1205 1188 1206 /* This is heavily borrowed from erf_write_packet(). Yes, CnP 1189 1207 * coding sucks, sorry about that. … … 1200 1218 return -1; 1201 1219 } 1202 1203 if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)1204 return 0;1205 1220 1206 1221 pad = dag_get_padding(packet); -
lib/format_dpdk.c
r10fd24b r9a6bdbc 144 144 uint32_t cap_len; /* The size to say the capture is */ 145 145 }; 146 147 static bool dpdk_can_write(libtrace_packet_t *packet) { 148 return true; 149 } 146 150 147 151 /** … … 1557 1561 static int dpdk_write_packet(libtrace_out_t *trace, 1558 1562 libtrace_packet_t *packet){ 1563 1564 /* Check dpdk can write this type of packet */ 1565 if (!dpdk_can_write(packet)) { 1566 return 0; 1567 } 1568 1559 1569 struct rte_mbuf* m_buff[1]; 1560 1570 -
lib/format_erf.c
rd439067 r9a6bdbc 119 119 } erf_index_t; 120 120 121 static bool erf_can_write(libtrace_packet_t *packet) { 122 /* Get the linktype */ 123 libtrace_linktype_t ltype = trace_get_link_type(packet); 124 125 if (ltype == TRACE_TYPE_PCAPNG_META 126 || ltype == TRACE_TYPE_NONDATA) { 127 128 return false; 129 } 130 131 return true; 132 } 133 121 134 /* Ethernet packets have a 2 byte padding before the packet 122 135 * so that the IP header is aligned on a 32 bit boundary. … … 670 683 libtrace_packet_t *packet) 671 684 { 685 686 /* Check erf can write this type of packet */ 687 if (!erf_can_write(packet)) { 688 return 0; 689 } 690 672 691 int numbytes = 0; 673 692 dag_record_t *dag_hdr = (dag_record_t *)packet->header; … … 679 698 return -1; 680 699 } 681 682 if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)683 return 0;684 700 685 701 if (!packet->header) { -
lib/format_linux_int.c
rd439067 r9a6bdbc 56 56 #ifdef HAVE_NETPACKET_PACKET_H 57 57 58 static bool linuxnative_can_write(libtrace_packet_t *packet) { 59 /* Get the linktype */ 60 libtrace_linktype_t ltype = trace_get_link_type(packet); 61 62 if (ltype == TRACE_TYPE_NONDATA) { 63 return false; 64 } 65 66 return true; 67 } 58 68 59 69 static int linuxnative_start_input(libtrace_t *libtrace) … … 336 346 libtrace_packet_t *packet) 337 347 { 348 /* Check linuxnative can write this type of packet */ 349 if (!linuxnative_can_write(packet)) { 350 return 0; 351 } 352 338 353 struct sockaddr_ll hdr; 339 354 int ret = 0; 340 341 if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)342 return 0;343 355 344 356 hdr.sll_family = AF_PACKET; -
lib/format_linux_ring.c
r8df87c4 r32de4c7 71 71 static int pagesize = 0; 72 72 73 static bool linuxring_can_write(libtrace_packet_t *packet) { 74 /* Get the linktype */ 75 libtrace_linktype_t ltype = trace_get_link_type(packet); 76 77 if (ltype == TRACE_TYPE_NONDATA) { 78 return false; 79 } 80 81 return true; 82 } 73 83 74 84 /* … … 709 719 libtrace_packet_t *packet) 710 720 { 721 /* Check linuxring can write this type of packet */ 722 if (!linuxring_can_write(packet)) { 723 return 0; 724 } 725 711 726 struct tpacket2_hdr *header; 712 727 struct pollfd pollset; … … 715 730 unsigned max_size; 716 731 void * off; 717 718 if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)719 return 0;720 732 721 733 max_size = FORMAT_DATA_OUT->req.tp_frame_size - -
lib/format_pcap.c
rd439067 r9a6bdbc 97 97 } output; 98 98 }; 99 100 static bool pcap_can_write(libtrace_packet_t *packet) { 101 /* Get the linktype */ 102 libtrace_linktype_t ltype = trace_get_link_type(packet); 103 104 if (ltype == TRACE_TYPE_PCAPNG_META 105 || ltype == TRACE_TYPE_CONTENT_INVALID 106 || ltype == TRACE_TYPE_UNKNOWN 107 || ltype == TRACE_TYPE_ERF_META 108 || ltype == TRACE_TYPE_NONDATA) { 109 110 return false; 111 } 112 113 return true; 114 } 99 115 100 116 static int pcap_init_input(libtrace_t *libtrace) { … … 521 537 { 522 538 539 /* Check pcap can write this type of packet */ 540 if (!pcap_can_write(packet)) { 541 return 0; 542 } 543 523 544 if (!libtrace) { 524 545 fprintf(stderr, "NULL trace passed into pcap_write_packet()\n"); … … 536 557 537 558 link = trace_get_packet_buffer(packet,&linktype,&remaining); 538 539 /* Silently discard RT metadata packets and packets with an540 * unknown linktype. */541 if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_UNKNOWN || linktype == TRACE_TYPE_ERF_META || linktype == TRACE_TYPE_CONTENT_INVALID) {542 return 0;543 }544 559 545 560 /* We may have to convert this packet into a suitable PCAP packet */ -
lib/format_pcapfile.c
rd439067 r9a6bdbc 68 68 #define MAGIC2_REV 0x4d3cb2a1 69 69 70 static bool pcapfile_can_write(libtrace_packet_t *packet) { 71 /* Get the linktype */ 72 libtrace_linktype_t ltype = trace_get_link_type(packet); 73 74 if (ltype == TRACE_TYPE_PCAPNG_META 75 || ltype == TRACE_TYPE_CONTENT_INVALID 76 || ltype == TRACE_TYPE_UNKNOWN 77 || ltype == TRACE_TYPE_ERF_META 78 || ltype == TRACE_TYPE_NONDATA) { 79 80 return false; 81 } 82 83 return true; 84 } 85 70 86 static inline int header_is_backwards_magic(pcapfile_header_t *header) { 71 87 return (header->magic_number == MAGIC1_REV || header->magic_number == MAGIC2_REV); … … 175 191 if (!DATA(libtrace)) 176 192 return num; 177 193 178 194 /* We can use the PCAP magic number to determine the byte order */ 179 195 if (header_is_backwards_magic(&(DATA(libtrace)->header))) … … 371 387 packet->buffer, 372 388 sizeof(libtrace_pcapfile_pkt_hdr_t)); 389 373 390 if (err<0) { 374 391 trace_set_err(libtrace,TRACE_ERR_WANDIO_FAILED,"reading packet"); … … 432 449 libtrace_packet_t *packet) 433 450 { 451 452 /* Check pcapfile can write this type of packet */ 453 if (!pcapfile_can_write(packet)) { 454 return 0; 455 } 456 434 457 struct libtrace_pcapfile_pkt_hdr_t hdr; 435 458 struct timeval tv = trace_get_timeval(packet); … … 441 464 442 465 ptr = trace_get_packet_buffer(packet,&linktype,&remaining); 443 444 /* Silently discard RT metadata packets and packets with an445 * unknown linktype. */446 if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_UNKNOWN || linktype == TRACE_TYPE_ERF_META || linktype == TRACE_TYPE_CONTENT_INVALID) {447 return 0;448 }449 466 450 467 /* If this packet cannot be converted to a pcap linktype then -
lib/format_pcapng.c
rd439067 rf47025d 48 48 #define PCAPNG_CUSTOM_TYPE 0x00000BAD 49 49 #define PCAPNG_CUSTOM_NONCOPY_TYPE 0x40000BAD 50 #define PCAPNG_DECRYPTION_SECRETS_TYPE 0x0000000A 51 52 #define PCAPNG_NRB_RECORD_END 0x0000 53 #define PCAPNG_NRB_RECORD_IP4 0x0001 54 #define PCAPNG_NRB_RECORD_IP6 0x0002 55 56 #define PCAPNG_CUSTOM_OPTION_UTF8 0xBAC 57 #define PCAPNG_CUSTOM_OPTION_BIN 0xBAD 58 #define PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY 0x4BAC 59 #define PCAPNG_CUSTOM_OPTION_BIN_NONCOPY 0x4BAD 60 61 #define PCAPNG_OPTION_END 0x0000 50 62 51 63 #define PACKET_IS_ENHANCED (pcapng_get_record_type(packet) == PCAPNG_ENHANCED_PACKET_TYPE) … … 54 66 55 67 #define PACKET_IS_OLD (pcapng_get_record_type(packet) == PCAPNG_OLD_PACKET_TYPE) 56 57 68 58 69 #define PCAPNG_IFOPT_TSRESOL 9 … … 133 144 typedef struct pcapng_interface_t pcapng_interface_t; 134 145 146 struct pcapng_timestamp { 147 uint32_t timehigh; 148 uint32_t timelow; 149 }; 150 135 151 struct pcapng_interface_t { 136 152 … … 160 176 uint16_t allocatedinterfaces; 161 177 uint16_t nextintid; 178 179 }; 180 181 struct pcapng_format_data_out_t { 182 iow_t *file; 183 int compress_level; 184 int compress_type; 185 int flag; 186 187 /* Section data */ 188 uint16_t sechdr_count; 189 bool byteswapped; 190 191 /* Interface data */ 192 uint16_t nextintid; 193 libtrace_linktype_t lastdlt; 162 194 }; 163 195 … … 167 199 }; 168 200 201 struct pcapng_custom_optheader { 202 uint16_t optcode; 203 uint16_t optlen; 204 uint32_t pen; 205 }; 206 struct pcapng_nrb_record { 207 uint16_t recordtype; 208 uint16_t recordlen; 209 }; 169 210 struct pcapng_peeker { 170 211 uint32_t blocktype; … … 174 215 typedef struct pcapng_peeker pcapng_hdr_t; 175 216 176 177 217 #define DATA(x) ((struct pcapng_format_data_t *)((x)->format_data)) 218 #define DATAOUT(x) ((struct pcapng_format_data_out_t*)((x)->format_data)) 219 220 static char *pcapng_parse_next_option(libtrace_t *libtrace, char **pktbuf, 221 uint16_t *code, uint16_t *length, pcapng_hdr_t *blockhdr); 222 223 static bool pcapng_can_write(libtrace_packet_t *packet) { 224 /* Get the linktype */ 225 libtrace_linktype_t ltype = trace_get_link_type(packet); 226 227 if (ltype == TRACE_TYPE_CONTENT_INVALID 228 || ltype == TRACE_TYPE_UNKNOWN 229 || ltype == TRACE_TYPE_ERF_META 230 || ltype == TRACE_TYPE_NONDATA) { 231 232 return false; 233 } 234 235 return true; 236 } 178 237 179 238 static pcapng_interface_t *lookup_interface(libtrace_t *libtrace, 180 239 uint32_t intid) { 181 240 182 183 if (intid >= DATA(libtrace)->nextintid) { 184 return NULL; 185 } 186 187 return DATA(libtrace)->interfaces[intid]; 188 241 if (intid >= DATA(libtrace)->nextintid) { 242 return NULL; 243 } 244 245 return DATA(libtrace)->interfaces[intid]; 189 246 } 190 247 191 248 static inline uint32_t pcapng_get_record_type(const libtrace_packet_t *packet) { 192 193 249 uint32_t *btype = (uint32_t *)packet->header; 194 250 195 if (DATA(packet->trace)->byteswapped) 196 return byteswap32(*btype); 251 /* only check for byteswapped if input format is pcapng */ 252 if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) { 253 if (DATA(packet->trace)->byteswapped) 254 return byteswap32(*btype); 255 } 256 197 257 return *btype; 258 } 259 260 static inline uint32_t pcapng_swap32(libtrace_out_t *libtrace, uint32_t value) { 261 if (DATAOUT(libtrace)->byteswapped) { 262 return byteswap32(value); 263 } else { 264 return value; 265 } 266 } 267 static inline uint32_t pcapng_swap16(libtrace_out_t *libtrace, uint32_t value) { 268 if (DATAOUT(libtrace)->byteswapped) { 269 return byteswap16(value); 270 } else { 271 return value; 272 } 273 } 274 static inline uint32_t pcapng_get_blocklen(const libtrace_packet_t *packet) { 275 struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->buffer; 276 277 /* only check for byteswapped if input format is pcapng */ 278 if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) { 279 if (DATA(packet->trace)->byteswapped) 280 return byteswap32(hdr->blocklen); 281 } 282 283 return hdr->blocklen; 284 285 } 286 static inline uint16_t pcapng_get_customdata_len(libtrace_packet_t *packet, char *ptr) { 287 struct pcapng_custom_optheader *hdr = (struct pcapng_custom_optheader *)ptr; 288 289 if (DATA(packet->trace)->byteswapped) { 290 return byteswap16(hdr->optlen); 291 } else { 292 return hdr->optlen; 293 } 294 } 295 static inline uint16_t pcapng_get_customdata_optcode(libtrace_packet_t *packet, char *ptr) { 296 struct pcapng_custom_optheader *hdr = (struct pcapng_custom_optheader *)ptr; 297 298 if (DATA(packet->trace)->byteswapped) { 299 return byteswap16(hdr->optcode); 300 } else { 301 return hdr->optcode; 302 } 303 } 304 static inline uint16_t pcapng_get_nrb_record_type(libtrace_packet_t *packet, char *ptr) { 305 struct pcapng_nrb_record *hdr = (struct pcapng_nrb_record *)ptr; 306 if (DATA(packet->trace)->byteswapped) { 307 return byteswap16(hdr->recordtype); 308 } else { 309 return hdr->recordtype; 310 } 311 } 312 static inline uint16_t pcapng_get_nrb_record_len(libtrace_packet_t *packet, char *ptr) { 313 struct pcapng_nrb_record *hdr = (struct pcapng_nrb_record *)ptr; 314 if (DATA(packet->trace)->byteswapped) { 315 return byteswap16(hdr->recordlen); 316 } else { 317 return hdr->recordlen; 318 } 319 } 320 static uint32_t pcapng_output_options(libtrace_out_t *libtrace, libtrace_packet_t *packet, 321 char *ptr) { 322 323 struct pcapng_optheader opthdr; 324 uint16_t optcode, optlen; 325 char *optval = NULL; 326 char *bodyptr = NULL; 327 int padding; 328 void *padding_data; 329 uint32_t len = 0; 330 331 bodyptr = ptr; 332 333 while ((optval = pcapng_parse_next_option(packet->trace, &bodyptr, 334 &optcode, &optlen, (pcapng_hdr_t *) packet->buffer))) { 335 336 /* pcapng_parse_next_option byteswaps the opcode and len for us */ 337 opthdr.optcode = optcode; 338 opthdr.optlen = optlen; 339 340 /* output the header */ 341 wandio_wwrite(DATAOUT(libtrace)->file, &opthdr, sizeof(opthdr)); 342 343 /* If this is a custom option */ 344 if (optcode == PCAPNG_CUSTOM_OPTION_UTF8 || PCAPNG_CUSTOM_OPTION_BIN 345 || PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY || PCAPNG_CUSTOM_OPTION_BIN_NONCOPY) { 346 /* flip the pen and output the option value */ 347 //uint32_t pen = byteswap32((uint32_t)*optval); 348 wandio_wwrite(DATAOUT(libtrace)->file, optval, sizeof(uint32_t)); 349 350 /* the len for custom options include pen */ 351 optval += sizeof(uint32_t); 352 optlen -= sizeof(uint32_t); 353 } 354 355 /* output the rest of the data */ 356 wandio_wwrite(DATAOUT(libtrace)->file, &optval, optlen); 357 358 /* calculate any required padding */ 359 padding = optlen % 4; 360 if (padding) { padding = 4 - padding; } 361 padding_data = calloc(1, padding); 362 /* output the padding */ 363 wandio_wwrite(DATAOUT(libtrace)->file, padding_data, padding); 364 free(padding_data); 365 366 len += sizeof(opthdr) + optlen; 367 } 368 369 return len; 370 } 371 static uint32_t pcapng_output_interface_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 372 pcapng_int_t *cur = (pcapng_int_t *)packet->header; 373 pcapng_int_t hdr; 374 char *bodyptr = NULL; 375 376 /* If the input trace is not pcapng we have no way of finding the byteordering 377 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 378 * is in the correct byte ordering just output it */ 379 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 380 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 381 uint32_t len = pcapng_get_blocklen(packet); 382 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 383 return len; 384 } 385 386 /* Byteswap the headers */ 387 hdr.blocktype = byteswap32(cur->blocktype); 388 hdr.blocklen = byteswap32(cur->blocklen); 389 hdr.linktype = byteswap16(cur->linktype); 390 hdr.reserved = byteswap16(cur->reserved); 391 hdr.snaplen = byteswap32(cur->snaplen); 392 393 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 394 /* output any options */ 395 bodyptr = (char *)packet->buffer + sizeof(hdr); 396 pcapng_output_options(libtrace, packet, bodyptr); 397 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 398 399 return hdr.blocklen; 400 } 401 static uint32_t pcapng_output_simple_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 402 pcapng_spkt_t *cur = (pcapng_spkt_t *)packet->header; 403 pcapng_spkt_t hdr; 404 uint32_t len; 405 char *bodyptr = NULL; 406 407 /* If the input trace is not pcapng we have no way of finding the byteordering 408 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 409 * is in the correct byte ordering just output it */ 410 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 411 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 412 len = pcapng_get_blocklen(packet); 413 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 414 return len; 415 } 416 417 hdr.blocktype = byteswap32(cur->blocktype); 418 hdr.blocklen = byteswap32(cur->blocklen); 419 hdr.wlen = byteswap32(cur->wlen); 420 421 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 422 423 /* output the packet payload */ 424 bodyptr = (char *)packet->buffer + sizeof(hdr); 425 len = pcapng_get_blocklen(packet) - sizeof(hdr) - sizeof(hdr.blocklen); 426 wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, len); 427 428 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 429 430 return hdr.blocklen; 431 } 432 static uint32_t pcapng_output_old_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 433 pcapng_opkt_t *cur = (pcapng_opkt_t *)packet->header; 434 pcapng_opkt_t hdr; 435 uint32_t len; 436 char *bodyptr = NULL; 437 438 /* If the input trace is not pcapng we have no way of finding the byteordering 439 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 440 * is in the correct byte ordering just output it */ 441 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 442 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 443 len = pcapng_get_blocklen(packet); 444 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 445 return len; 446 } 447 448 hdr.blocktype = byteswap32(cur->blocktype); 449 hdr.blocklen = byteswap32(cur->blocklen); 450 hdr.interfaceid = byteswap16(cur->interfaceid); 451 hdr.drops = byteswap16(cur->drops); 452 hdr.timestamp_high = byteswap32(cur->timestamp_high); 453 hdr.timestamp_low = byteswap32(cur->timestamp_low); 454 hdr.caplen = byteswap32(cur->caplen); 455 hdr.wlen = byteswap32(cur->wlen); 456 457 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 458 459 /* output the packet payload */ 460 bodyptr = (char *)packet->buffer + sizeof(hdr); 461 len = pcapng_get_blocklen(packet) - sizeof(hdr) - sizeof(hdr.blocklen); 462 wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, len); 463 464 /* output any options if present */ 465 pcapng_output_options(libtrace, packet, bodyptr); 466 467 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 468 469 470 return hdr.blocklen; 471 } 472 static uint32_t pcapng_output_nameresolution_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 473 pcapng_nrb_t *cur = (pcapng_nrb_t *)packet->buffer; 474 pcapng_nrb_t hdr; 475 char *bodyptr = NULL; 476 int padding; 477 void *padding_data; 478 479 /* If the input trace is not pcapng we have no way of finding the byteordering 480 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 481 * is in the correct byte ordering just output it */ 482 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 483 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 484 uint32_t len = pcapng_get_blocklen(packet); 485 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 486 return len; 487 } 488 489 hdr.blocktype = byteswap32(cur->blocktype); 490 hdr.blocklen = byteswap32(cur->blocklen); 491 492 /* output the header */ 493 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 494 bodyptr = (char *)packet->buffer + sizeof(hdr); 495 496 struct pcapng_nrb_record *nrbr = (struct pcapng_nrb_record *)bodyptr; 497 498 uint16_t record_type = pcapng_get_nrb_record_type(packet, bodyptr); 499 while (record_type != PCAPNG_NRB_RECORD_END) { 500 501 struct pcapng_nrb_record nrb; 502 503 /* recordlen contains only the length of the record value without 504 * any padding */ 505 uint16_t recordlen = pcapng_get_nrb_record_len(packet, bodyptr); 506 507 nrb.recordtype = byteswap16(nrbr->recordtype); 508 nrb.recordlen = byteswap16(nrbr->recordlen); 509 510 /* output the record header */ 511 wandio_wwrite(DATAOUT(libtrace)->file, &nrb, sizeof(nrb)); 512 bodyptr += sizeof(nrb); 513 514 /* output the record data */ 515 wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, recordlen); 516 bodyptr += recordlen; 517 518 /* calculate any required padding. record also contains the 8 byte header 519 * but we dont need to subtract it because it will be removed with % 4 */ 520 padding = recordlen % 4; 521 if (padding) { padding = 4 - padding; } 522 padding_data = calloc(1, padding); 523 /* output the padding */ 524 wandio_wwrite(DATAOUT(libtrace)->file, padding_data, padding); 525 free(padding_data); 526 bodyptr += padding; 527 528 /* get the next record if it exists */ 529 nrbr = (struct pcapng_nrb_record *)bodyptr; 530 record_type = pcapng_get_nrb_record_type(packet, bodyptr); 531 } 532 533 /* output nrb record end block */ 534 struct pcapng_nrb_record nrbftr; 535 nrbftr.recordtype = PCAPNG_NRB_RECORD_END; 536 nrbftr.recordlen = 0; 537 wandio_wwrite(DATAOUT(libtrace)->file, &nrbftr, sizeof(nrbftr)); 538 bodyptr += sizeof(nrbftr); 539 540 /* output any options if present */ 541 pcapng_output_options(libtrace, packet, bodyptr); 542 543 /* and print out rest of the header */ 544 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 545 546 return hdr.blocklen; 547 } 548 static uint32_t pcapng_output_custom_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 549 pcapng_custom_t *cur = (pcapng_custom_t *)packet->buffer; 550 pcapng_custom_t hdr; 551 char *bodyptr = (char *)packet->buffer; 552 553 /* If the input trace is not pcapng we have no way of finding the byteordering 554 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 555 * is in the correct byte ordering just output it */ 556 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 557 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 558 uint32_t len = pcapng_get_blocklen(packet); 559 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 560 return len; 561 } 562 563 hdr.blocktype = byteswap32(cur->blocktype); 564 hdr.blocklen = byteswap32(cur->blocklen); 565 hdr.pen = byteswap32(cur->blocklen); 566 567 /* output the header */ 568 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 569 bodyptr += sizeof(hdr); 570 571 /* now print out any options */ 572 pcapng_output_options(libtrace, packet, bodyptr); 573 574 /* and print out rest of the header */ 575 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 576 577 return hdr.blocklen; 578 } 579 static uint32_t pcapng_output_enhanced_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 580 pcapng_epkt_t *cur = (pcapng_epkt_t *)packet->buffer; 581 pcapng_epkt_t hdr; 582 char *bodyptr = NULL; 583 uint32_t len; 584 585 /* If the input trace is not pcapng we have no way of finding the byteordering 586 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 587 * is in the correct byte ordering just output it */ 588 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 589 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 590 len = pcapng_get_blocklen(packet); 591 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 592 return len; 593 } 594 595 hdr.blocktype = byteswap32(cur->blocktype); 596 hdr.blocklen = byteswap32(cur->blocklen); 597 hdr.interfaceid = byteswap32(cur->interfaceid); 598 hdr.timestamp_high = byteswap32(cur->timestamp_high); 599 hdr.timestamp_low = byteswap32(cur->timestamp_low); 600 hdr.caplen = byteswap32(cur->caplen); 601 hdr.wlen = byteswap32(cur->wlen); 602 603 /* output beginning of header */ 604 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 605 606 /* output the packet payload */ 607 bodyptr = (char *)packet->buffer + sizeof(hdr); 608 len = pcapng_get_blocklen(packet) - sizeof(hdr) - sizeof(hdr.blocklen); 609 wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, len); 610 611 /* output any options */ 612 pcapng_output_options(libtrace, packet, bodyptr); 613 614 /* output end of header */ 615 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 616 617 return hdr.blocklen; 618 } 619 static uint32_t pcapng_output_interfacestats_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 620 pcapng_stats_t *cur = (pcapng_stats_t *)packet->header; 621 pcapng_stats_t hdr; 622 char *bodyptr = NULL; 623 624 /* If the input trace is not pcapng we have no way of finding the byteordering 625 * this can occur if a packet is reconstructed with a deadtrace. Or if the packet 626 * is in the correct byte ordering just output it */ 627 if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) || 628 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) { 629 uint32_t len = pcapng_get_blocklen(packet); 630 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len); 631 return len; 632 } 633 634 hdr.blocktype = byteswap32(cur->blocktype); 635 hdr.blocklen = byteswap32(cur->blocklen); 636 hdr.interfaceid = byteswap32(cur->interfaceid); 637 hdr.timestamp_high = byteswap32(cur->timestamp_high); 638 hdr.timestamp_low = byteswap32(cur->timestamp_low); 639 640 /* output interface stats header */ 641 wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr)); 642 /* output any options if present */ 643 bodyptr = (char *)packet->buffer + sizeof(hdr); 644 pcapng_output_options(libtrace, packet, bodyptr); 645 /* output rest of interface stats header */ 646 wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen)); 647 648 return hdr.blocklen; 198 649 } 199 650 … … 212 663 } 213 664 return 0; 665 } 666 667 static struct pcapng_timestamp pcapng_get_timestamp(libtrace_packet_t *packet) { 668 struct timeval tv = trace_get_timeval(packet); 669 uint64_t time = ((uint64_t)tv.tv_sec * (uint64_t)1000000) + tv.tv_usec; 670 671 struct pcapng_timestamp timestamp; 672 timestamp.timehigh = time >> 32; 673 timestamp.timelow = time & 0xFFFFFFFF; 674 675 return timestamp; 214 676 } 215 677 … … 232 694 233 695 return 0; 696 } 697 698 static int pcapng_config_output(libtrace_out_t *libtrace, trace_option_output_t option, 699 void *value) { 700 701 switch (option) { 702 case TRACE_OPTION_OUTPUT_COMPRESS: 703 DATAOUT(libtrace)->compress_level = *(int *)value; 704 return 0; 705 case TRACE_OPTION_OUTPUT_COMPRESSTYPE: 706 DATAOUT(libtrace)->compress_type = *(int *)value; 707 return 0; 708 case TRACE_OPTION_OUTPUT_FILEFLAGS: 709 DATAOUT(libtrace)->flag = *(int *)value; 710 return 0; 711 default: 712 trace_set_err_out(libtrace, TRACE_ERR_UNKNOWN_OPTION, 713 "Unknown option"); 714 return -1; 715 } 234 716 } 235 717 … … 272 754 } 273 755 756 static int pcapng_init_output(libtrace_out_t *libtrace) { 757 libtrace->format_data = malloc(sizeof(struct pcapng_format_data_out_t)); 758 759 DATAOUT(libtrace)->file = NULL; 760 DATAOUT(libtrace)->compress_level = 0; 761 DATAOUT(libtrace)->compress_type = TRACE_OPTION_COMPRESSTYPE_NONE; 762 DATAOUT(libtrace)->flag = O_CREAT|O_WRONLY; 763 764 DATAOUT(libtrace)->sechdr_count = 0; 765 DATAOUT(libtrace)->byteswapped = false; 766 767 DATAOUT(libtrace)->nextintid = 0; 768 DATAOUT(libtrace)->lastdlt = 0; 769 770 return 0; 771 } 772 274 773 static int pcapng_fin_input(libtrace_t *libtrace) { 275 774 … … 287 786 free(libtrace->format_data); 288 787 return 0; 788 } 789 790 static int pcapng_fin_output(libtrace_out_t *libtrace) { 791 if (DATAOUT(libtrace)->file) { 792 wandio_wdestroy(DATAOUT(libtrace)->file); 793 } 794 free(libtrace->format_data); 795 libtrace->format_data = NULL; 796 return 0; 289 797 } 290 798 … … 432 940 } 433 941 942 static int pcapng_write_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) { 943 944 if (!libtrace) { 945 fprintf(stderr, "NULL trace passed into pcapng_write_packet()\n"); 946 return TRACE_ERR_NULL_TRACE; 947 } 948 if (!packet) { 949 trace_set_err_out(libtrace, TRACE_ERR_NULL_PACKET, "NULL packet passed " 950 "into pcapng_write_packet()\n"); 951 return -1; 952 } 953 954 /* Check pcapng can write this type of packet */ 955 if (!pcapng_can_write(packet)) { 956 return 0; 957 } 958 959 libtrace_linktype_t linktype = trace_get_link_type(packet); 960 961 /* If the file is not open, open it */ 962 if (!DATAOUT(libtrace)->file) { 963 DATAOUT(libtrace)->file = trace_open_file_out(libtrace, 964 DATAOUT(libtrace)->compress_type, 965 DATAOUT(libtrace)->compress_level, 966 DATAOUT(libtrace)->flag); 967 } 968 969 /* If the packet is already encapsulated in a pcapng frame just output it */ 970 switch (pcapng_get_record_type(packet)) { 971 case PCAPNG_SECTION_TYPE: { 972 /* If the section header passed in is byteswapped, everything we output 973 * till the next section header needs to be byteswapped. The next header 974 * will determine if we need to continue swapping bytes */ 975 if (DATA(packet->trace)->byteswapped) { 976 DATAOUT(libtrace)->byteswapped = true; 977 } else { 978 DATAOUT(libtrace)->byteswapped = false; 979 } 980 981 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, 982 pcapng_get_blocklen(packet)); 983 984 DATAOUT(libtrace)->sechdr_count += 1; 985 986 return pcapng_get_blocklen(packet); 987 } 988 case PCAPNG_INTERFACE_TYPE: { 989 /* increment the interface id */ 990 DATAOUT(libtrace)->nextintid += 1; 991 992 return pcapng_output_interface_packet(libtrace, packet); 993 } 994 case PCAPNG_OLD_PACKET_TYPE: { 995 return pcapng_output_old_packet(libtrace, packet); 996 } 997 case PCAPNG_SIMPLE_PACKET_TYPE: { 998 if (DATAOUT(libtrace)->nextintid == 0) { 999 trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET, 1000 "Cannot output simple packet before a interface " 1001 "block has been output in pcapng_write_packet()\n"); 1002 return -1; 1003 } 1004 return pcapng_output_simple_packet(libtrace, packet); 1005 } 1006 case PCAPNG_NAME_RESOLUTION_TYPE: { 1007 return pcapng_output_nameresolution_packet(libtrace, packet); 1008 } 1009 case PCAPNG_INTERFACE_STATS_TYPE: { 1010 if (DATAOUT(libtrace)->nextintid == 0) { 1011 trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET, 1012 "Cannot output a interface statistics block before a " 1013 "interface block has been output in pcapng_write_packet()\n"); 1014 return -1; 1015 } 1016 return pcapng_output_interfacestats_packet(libtrace, packet); 1017 } 1018 case PCAPNG_ENHANCED_PACKET_TYPE: { 1019 if (DATAOUT(libtrace)->nextintid == 0) { 1020 trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET, 1021 "Cannot output enhanced packet before a interface " 1022 "block has been output in pcapng_write_packet()\n"); 1023 return -1; 1024 } 1025 return pcapng_output_enhanced_packet(libtrace, packet); 1026 } 1027 case PCAPNG_CUSTOM_TYPE: { 1028 return pcapng_output_custom_packet(libtrace, packet); 1029 } 1030 case PCAPNG_DECRYPTION_SECRETS_TYPE: { 1031 return 0; 1032 } 1033 case PCAPNG_CUSTOM_NONCOPY_TYPE: { 1034 /* This custom block type is not ment to be copied */ 1035 return 0; 1036 } 1037 default: { 1038 1039 /* create section header if not already */ 1040 if (DATAOUT(libtrace)->sechdr_count == 0) { 1041 /* Create section block */ 1042 pcapng_sec_t sechdr; 1043 sechdr.blocktype = pcapng_swap32(libtrace, PCAPNG_SECTION_TYPE); 1044 sechdr.blocklen = pcapng_swap32(libtrace, 28); 1045 sechdr.ordering = pcapng_swap32(libtrace, 0x1A2B3C4D); 1046 sechdr.majorversion = pcapng_swap16(libtrace, 1); 1047 sechdr.minorversion = 0; 1048 sechdr.sectionlen = 0xFFFFFFFFFFFFFFFF; 1049 1050 wandio_wwrite(DATAOUT(libtrace)->file, &sechdr, sizeof(sechdr)); 1051 wandio_wwrite(DATAOUT(libtrace)->file, &sechdr.blocklen, sizeof(sechdr.blocklen)); 1052 1053 DATAOUT(libtrace)->sechdr_count += 1; 1054 } 1055 1056 /* create interface header if not already or if the linktype has changed */ 1057 if (DATAOUT(libtrace)->nextintid == 0 1058 || DATAOUT(libtrace)->lastdlt != linktype) { 1059 /* Create interface block*/ 1060 pcapng_int_t inthdr; 1061 inthdr.blocktype = pcapng_swap32(libtrace, PCAPNG_INTERFACE_TYPE); 1062 inthdr.blocklen = pcapng_swap32(libtrace, 20); 1063 inthdr.linktype = pcapng_swap16(libtrace, libtrace_to_pcap_dlt(linktype)); 1064 inthdr.reserved = 0; 1065 inthdr.snaplen = 0; 1066 1067 wandio_wwrite(DATAOUT(libtrace)->file, &inthdr, sizeof(inthdr)); 1068 wandio_wwrite(DATAOUT(libtrace)->file, &inthdr.blocklen, sizeof(inthdr.blocklen)); 1069 1070 /* increment the interface counter */ 1071 DATAOUT(libtrace)->nextintid += 1; 1072 /* update the last linktype */ 1073 DATAOUT(libtrace)->lastdlt = linktype; 1074 } 1075 1076 break; 1077 } 1078 } 1079 1080 /* If we get this far the packet is not a pcapng type so we need to encapsulate it 1081 * within a enhanced pcapng packet */ 1082 uint32_t remaining; 1083 void *link; 1084 uint32_t blocklen; 1085 uint32_t padding; 1086 uint32_t caplen; 1087 uint32_t wirelen; 1088 void *padding_data; 1089 pcapng_epkt_t epkthdr; 1090 1091 link = trace_get_packet_buffer(packet, &linktype, &remaining); 1092 1093 wirelen = trace_get_wire_length(packet); 1094 caplen = trace_get_capture_length(packet); 1095 1096 /* trace_get_wirelength includes FCS, while pcapng doesn't */ 1097 if (trace_get_link_type(packet)==TRACE_TYPE_ETH) { 1098 if (wirelen >= 4) { 1099 wirelen -= 4; 1100 } else { 1101 wirelen = 0; 1102 } 1103 } 1104 /* capture length should always be less than the wirelength */ 1105 if (caplen > wirelen) { 1106 caplen = wirelen; 1107 } 1108 1109 /* calculate padding to 32bits */ 1110 padding = caplen % 4; 1111 if (padding) { padding = 4 - padding; } 1112 padding_data = calloc(1, padding); 1113 1114 /* get pcapng_timestamp */ 1115 struct pcapng_timestamp ts = pcapng_get_timestamp(packet); 1116 1117 /* calculate the block length */ 1118 blocklen = sizeof(epkthdr) + sizeof(epkthdr.blocklen) + caplen + padding; 1119 1120 /* construct the packet */ 1121 epkthdr.blocktype = pcapng_swap32(libtrace, PCAPNG_ENHANCED_PACKET_TYPE); 1122 epkthdr.blocklen = pcapng_swap32(libtrace, blocklen); 1123 epkthdr.interfaceid = pcapng_swap32(libtrace, DATAOUT(libtrace)->nextintid-1); 1124 epkthdr.timestamp_high = pcapng_swap32(libtrace, ts.timehigh); 1125 epkthdr.timestamp_low = pcapng_swap32(libtrace, ts.timelow); 1126 epkthdr.wlen = pcapng_swap32(libtrace, wirelen); 1127 epkthdr.caplen = pcapng_swap32(libtrace, caplen); 1128 1129 /* output enhanced packet header */ 1130 wandio_wwrite(DATAOUT(libtrace)->file, &epkthdr, sizeof(epkthdr)); 1131 /* output the packet */ 1132 wandio_wwrite(DATAOUT(libtrace)->file, link, (size_t)caplen); 1133 /* output padding */ 1134 wandio_wwrite(DATAOUT(libtrace)->file, padding_data, (size_t)padding); 1135 /* output rest of the enhanced packet */ 1136 wandio_wwrite(DATAOUT(libtrace)->file, &epkthdr.blocklen, sizeof(epkthdr.blocklen)); 1137 1138 /* release padding memory */ 1139 free(padding_data); 1140 1141 return blocklen; 1142 } 1143 1144 static int pcapng_flush_output(libtrace_out_t *libtrace) { 1145 return wandio_wflush(DATAOUT(libtrace)->file); 1146 } 1147 434 1148 static int pcapng_read_section(libtrace_t *libtrace, 435 1149 libtrace_packet_t *packet, uint32_t flags) { … … 1092 1806 } 1093 1807 1094 static libtrace_linktype_t pcapng_get_link_type(const libtrace_packet_t *packet) 1095 { 1808 static libtrace_linktype_t pcapng_get_link_type(const libtrace_packet_t *packet) { 1809 1810 if (packet->type == TRACE_RT_PCAPNG_META) { 1811 return TRACE_TYPE_PCAPNG_META; 1812 } 1096 1813 1097 1814 return pcap_linktype_to_libtrace(rt_to_pcap_linktype(packet->type)); 1098 1099 1815 } 1100 1816 … … 1436 2152 pcapng_start_input, /* start_input */ 1437 2153 NULL, /* pause_input */ 1438 NULL,/* init_output */1439 NULL,/* config_output */2154 pcapng_init_output, /* init_output */ 2155 pcapng_config_output, /* config_output */ 1440 2156 NULL, /* start_output */ 1441 2157 pcapng_fin_input, /* fin_input */ 1442 NULL,/* fin_output */2158 pcapng_fin_output, /* fin_output */ 1443 2159 pcapng_read_packet, /* read_packet */ 1444 2160 pcapng_prepare_packet, /* prepare_packet */ 1445 2161 NULL, /* fin_packet */ 1446 NULL,/* write_packet */1447 NULL,/* flush_output */2162 pcapng_write_packet, /* write_packet */ 2163 pcapng_flush_output, /* flush_output */ 1448 2164 pcapng_get_link_type, /* get_link_type */ 1449 2165 pcapng_get_direction, /* get_direction */ … … 1474 2190 register_format(&pcapng); 1475 2191 } 1476 -
lib/libtrace.h.in
rd439067 r49f8ceb 346 346 /** NULL passed misc **/ 347 347 TRACE_ERR_NULL = -31, 348 /** Err with trace output file **/ 349 TRACE_ERR_OUTPUT_FILE = -32, 348 350 }; 349 351 … … 410 412 TRACE_TYPE_OPENBSD_LOOP = 20, /**< OpenBSD loopback */ 411 413 TRACE_TYPE_ERF_META = 21, /**< ERF Provenance metadata record */ 412 TRACE_TYPE_ETSILI = 22 /**< ETSI Lawful Intercept */ 414 TRACE_TYPE_ETSILI = 22, /**< ETSI Lawful Intercept */ 415 TRACE_TYPE_PCAPNG_META = 23, /** PCAPNG meta packet */ 413 416 } libtrace_linktype_t; 414 417 -
lib/linktypes.c
r2193905 r49f8ceb 110 110 case TRACE_TYPE_ETSILI: 111 111 break; 112 case TRACE_TYPE_PCAPNG_META: 112 113 case TRACE_TYPE_UNKNOWN: 113 114 case TRACE_TYPE_CONTENT_INVALID: … … 212 213 case TRACE_TYPE_OPENBSD_LOOP: 213 214 case TRACE_TYPE_ETSILI: 215 case TRACE_TYPE_PCAPNG_META: 214 216 case TRACE_TYPE_UNKNOWN: 215 217 case TRACE_TYPE_CONTENT_INVALID: -
lib/protocols_l2.c
rd439067 r49f8ceb 495 495 case TRACE_TYPE_PFLOG: 496 496 case TRACE_TYPE_ERF_META: 497 case TRACE_TYPE_PCAPNG_META: 497 498 case TRACE_TYPE_ETSILI: 498 499 break; … … 533 534 case TRACE_TYPE_PFLOG: 534 535 case TRACE_TYPE_ERF_META: 536 case TRACE_TYPE_PCAPNG_META: 535 537 case TRACE_TYPE_ETSILI: 536 538 break; … … 603 605 case TRACE_TYPE_METADATA: 604 606 case TRACE_TYPE_NONDATA: 607 case TRACE_TYPE_PCAPNG_META: 605 608 case TRACE_TYPE_ERF_META: 606 609 case TRACE_TYPE_CONTENT_INVALID: … … 713 716 case TRACE_TYPE_OPENBSD_LOOP: 714 717 case TRACE_TYPE_ERF_META: 718 case TRACE_TYPE_PCAPNG_META: 715 719 case TRACE_TYPE_UNKNOWN: 716 720 case TRACE_TYPE_CONTENT_INVALID: … … 769 773 case TRACE_TYPE_OPENBSD_LOOP: 770 774 case TRACE_TYPE_ERF_META: 775 case TRACE_TYPE_PCAPNG_META: 771 776 case TRACE_TYPE_UNKNOWN: 772 777 case TRACE_TYPE_CONTENT_INVALID: -
lib/protocols_pktmeta.c
r2193905 r49f8ceb 191 191 case TRACE_TYPE_OPENBSD_LOOP: 192 192 case TRACE_TYPE_UNKNOWN: 193 case TRACE_TYPE_PCAPNG_META: 193 194 case TRACE_TYPE_CONTENT_INVALID: 194 195 return NULL; … … 249 250 return nexthdr; 250 251 252 case TRACE_TYPE_PCAPNG_META: 251 253 case TRACE_TYPE_HDLC_POS: 252 254 case TRACE_TYPE_ETH: -
lib/trace.c
r5fe998b r32de4c7 1718 1718 linktype = trace_get_link_type(packet); 1719 1719 1720 if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_ERF_META) 1720 if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_ERF_META 1721 || linktype == TRACE_TYPE_PCAPNG_META) 1721 1722 return 1; 1722 1723
Note: See TracChangeset
for help on using the changeset viewer.