- Timestamp:
- 01/11/19 16:58:26 (2 years ago)
- Branches:
- develop
- Children:
- e7132d6
- Parents:
- 3c828b8
- Location:
- lib
- Files:
-
- 1 added
- 24 edited
Legend:
- Unmodified
- Added
- Removed
-
lib/Makefile.am
r1668208 r977e0db 63 63 64 64 libtrace_la_SOURCES = trace.c trace_parallel.c common.h \ 65 format_ erf.c format_pcap.c format_legacy.c \65 format_pktmeta.c format_erf.c format_pcap.c format_legacy.c \ 66 66 format_rt.c format_helper.c format_helper.h format_pcapfile.c \ 67 67 format_duck.c format_tsh.c $(NATIVEFORMATS) $(BPFFORMATS) \ -
lib/dagformat.h
ree6e802 r977e0db 104 104 } PACKED dag_record_t; 105 105 106 typedef struct dag_section_header { 107 uint16_t type; 108 uint16_t len; 109 } dag_sec_t; 110 106 111 #ifdef WIN32 107 112 #pragma pack(pop) -
lib/format_atmhdr.c
r2193905 r977e0db 209 209 NULL, /* get_timespec */ 210 210 NULL, /* get_seconds */ 211 NULL, /* get_meta_data */ 211 212 NULL, /* seek_erf */ 212 213 NULL, /* seek_timeval */ -
lib/format_bpf.c
r418c78d r977e0db 632 632 NULL, /* get_timespec */ 633 633 NULL, /* get_seconds */ 634 NULL, /* get_meta_data */ 634 635 NULL, /* seek_erf */ 635 636 NULL, /* seek_timeval */ … … 683 684 NULL, /* get_timespec */ 684 685 NULL, /* get_seconds */ 686 NULL, /* get_meta_data */ 685 687 NULL, /* seek_erf */ 686 688 NULL, /* seek_timeval */ -
lib/format_dag24.c
r418c78d r977e0db 542 542 NULL, /* seek_timeval */ 543 543 NULL, /* seek_seconds */ 544 NULL, /* get_meta_data */ 544 545 erf_get_capture_length, /* get_capture_length */ 545 546 erf_get_wire_length, /* get_wire_length */ -
lib/format_dag25.c
r9a6bdbc r977e0db 1625 1625 NULL, /* get_seconds */ 1626 1626 NULL, /* get_timespec */ 1627 NULL, /* get_meta_data */ 1627 1628 NULL, /* seek_erf */ 1628 1629 NULL, /* seek_timeval */ -
lib/format_dpdk.c
r9a6bdbc r977e0db 2253 2253 NULL, /* seek_timeval */ 2254 2254 NULL, /* seek_seconds */ 2255 NULL, /* get_meta_data */ 2255 2256 dpdk_get_capture_length, /* get_capture_length */ 2256 2257 dpdk_get_wire_length, /* get_wire_length */ -
lib/format_dpdkndag.c
rfdf23b8 r977e0db 749 749 NULL, /* seek_timeval */ 750 750 NULL, /* seek_seconds */ 751 NULL, /* get_meta_data */ 751 752 erf_get_capture_length, /* get_capture_length */ 752 753 erf_get_wire_length, /* get_wire_length */ -
lib/format_duck.c
r2193905 r977e0db 363 363 NULL, /* get_timespec */ 364 364 NULL, /* get_seconds */ 365 NULL, /* get_meta_data */ 365 366 NULL, /* seek_erf */ 366 367 NULL, /* seek_timeval */ -
lib/format_erf.c
r3c828b8 r977e0db 914 914 } 915 915 916 /* Returns a pointer to the beginning of the section or NULL if not found */ 917 void *erf_get_meta_data(libtrace_packet_t *packet, uint32_t section_type, uint16_t section) { 918 919 uint32_t remaining; 920 void *bodyptr; 921 dag_sec_t *sec; 922 dag_record_t *hdr; 923 uint16_t curr_sec; 924 925 hdr = (dag_record_t *)packet->header; 926 bodyptr = (char *)packet->payload; 927 remaining = ntohs(hdr->rlen) - 24; 928 929 /* ensure this is a meta packet */ 930 /* the type only uses bits 0-6 */ 931 if ((hdr->type & 127) != 27) { return NULL; } 932 933 sec = (dag_sec_t *)bodyptr; 934 /* loop till we find the correct section within the correct section type 935 * and enough payload is remaining */ 936 while (((ntohs(sec->type) != section) || (section_type != curr_sec)) 937 && (remaining > sizeof(dag_sec_t))) { 938 939 if (ntohs(sec->type) == ERF_PROV_SECTION_CAPTURE 940 || ntohs(sec->type) == ERF_PROV_SECTION_HOST 941 || ntohs(sec->type) == ERF_PROV_SECTION_MODULE 942 || ntohs(sec->type) == ERF_PROV_SECTION_INTERFACE) { 943 944 curr_sec = ntohs(sec->type); 945 } 946 947 /* jump over any padding (padded to 32bits/4bytes) */ 948 if ((ntohs(sec->len) % 4) != 0) { 949 remaining -= ntohs(sec->len) + (4 - (ntohs(sec->len) % 4)); 950 bodyptr += ntohs(sec->len) + (4 - (ntohs(sec->len) % 4)); 951 } else { 952 remaining -= ntohs(sec->len); 953 bodyptr += ntohs(sec->len); 954 } 955 remaining -= sizeof(dag_sec_t); 956 bodyptr += sizeof(dag_sec_t); 957 958 sec = (dag_sec_t *)bodyptr; 959 } 960 /* if found return pointer to the beginning of the section */ 961 if (ntohs(sec->type) == section && curr_sec == section_type) { 962 return (void *)bodyptr; 963 } else { 964 return NULL; 965 } 966 } 967 916 968 static void erf_help(void) { 917 969 printf("erf format module: $Revision: 1752 $\n"); … … 932 984 printf("\n"); 933 985 934 986 935 987 } 936 988 … … 962 1014 NULL, /* get_timespec */ 963 1015 NULL, /* get_seconds */ 1016 erf_get_meta_data, /* get_meta_data */ 964 1017 erf_seek_erf, /* seek_erf */ 965 1018 NULL, /* seek_timeval */ … … 1007 1060 NULL, /* get_timespec */ 1008 1061 NULL, /* get_seconds */ 1062 erf_get_meta_data, /* get_meta_data */ 1009 1063 erf_seek_erf, /* seek_erf */ 1010 1064 NULL, /* seek_timeval */ -
lib/format_erf.h
ra857389 r977e0db 29 29 #include "libtrace.h" 30 30 31 /* ERF Section codes */ 32 #define ERF_PROV_SECTION_CAPTURE 0xFF00 33 #define ERF_PROV_SECTION_HOST 0xFF01 34 #define ERF_PROV_SECTION_MODULE 0xFF02 35 #define ERF_PROV_SECTION_INTERFACE 0xFF03 36 37 /* ERF Provenance record tag type codes */ 38 #define ERF_PROV_COMMENT 1 39 #define ERF_PROV_FCS_LEN 8 40 #define ERF_PROV_MASK_CIDR 10 41 #define ERF_PROV_NAME 12 42 #define ERF_PROV_DESCR 13 43 #define ERF_PROV_HOSTNAME 18 44 #define ERF_PROV_OS 17 45 #define ERF_PROV_MODEL 20 46 #define ERF_PROV_FW_VERSION 21 47 #define ERF_PROV_SERIAL_NO 22 48 #define ERF_PROV_ORG_NAME 11 49 #define ERF_PROV_CARD_NUM 30 50 #define ERF_PROV_MODULE_NUM 31 51 #define ERF_PROV_LOC_NAME 34 52 #define ERF_PROV_FLOW_HASH_MODE 37 53 #define ERF_PROV_TUNNELING_MODE 38 54 #define ERF_PROV_LOC_DESCR 46 55 #define ERF_PROV_MEM 40 56 #define ERF_PROV_DEV_NAME 44 57 #define ERF_PROV_DEV_PATH 45 58 #define ERF_PROV_CPU 49 59 #define ERF_PROV_CPU_PHYS_CORES 50 60 #define ERF_PROV_CPU_NUMA_NODES 51 61 #define ERF_PROV_DAG_VERSION 53 62 #define ERF_PROV_IF_NUM 64 63 #define ERF_PROV_IF_SPEED 66 64 #define ERF_PROV_IF_IPV4 67 65 #define ERF_PROV_IF_IPV6 68 66 #define ERF_PROV_IF_MAC 69 67 #define ERF_PROV_IF_SFP_TYPE 78 68 #define ERF_PROV_IF_LINK_STATUS 81 69 #define ERF_PROV_IF_PHY_MODE 82 70 #define ERF_PROV_IF_PORT_TYPE 83 71 #define ERF_PROV_IF_RX_LATENCY 84 72 #define ERF_PROV_IF_RX_POWER 79 73 #define ERF_PROV_IF_TX_POWER 80 74 #define ERF_PROV_CLK_SOURCE 384 75 #define ERF_PROV_CLK_STATE 385 76 #define ERF_PROV_CLK_THRESHOLD 386 77 #define ERF_PROV_CLK_CORRECTION 387 78 #define ERF_PROV_CLK_FAILURES 388 79 #define ERF_PROV_CLK_RESYNCS 389 80 #define ERF_PROV_CLK_PHASE_ERROR 390 81 #define ERF_PROV_CLK_INPUT_PULSES 391 82 #define ERF_PROV_CLK_REJECTED_PULSES 392 83 #define ERF_PROV_CLK_PHC_INDEX 393 84 #define ERF_PROV_CLK_PHC_OFFSET 394 85 #define ERF_PROV_CLK_TIMEBASE 395 86 #define ERF_PROV_CLK_DESCR 396 87 #define ERF_PROV_CLK_OUT_SOURCE 397 88 #define ERF_PROV_CLK_LINK_MODE 398 89 #define ERF_PROV_PTP_DOMAIN_NUM 399 90 #define ERF_PROV_PTP_STEPS_REMOVED 400 91 #define ERF_PROV_CLK_PORT_PROTO 414 92 31 93 /** @file 32 94 * … … 55 117 int erf_is_color_type(uint8_t erf_type); 56 118 119 void *erf_get_meta_data(libtrace_packet_t *packet, uint32_t section_type, 120 uint16_t section); 121 57 122 #endif -
lib/format_etsilive.c
rccabd47 r977e0db 686 686 NULL, /* get_timespec */ 687 687 NULL, /* get_seconds */ 688 NULL, /* get_meta_data */ 688 689 NULL, /* seek_erf */ 689 690 NULL, /* seek_timeval */ -
lib/format_legacy.c
r2193905 r977e0db 536 536 NULL, /* get_timespec */ 537 537 NULL, /* get_seconds */ 538 NULL, /* get_meta_data */ 538 539 NULL, /* seek_erf */ 539 540 NULL, /* seek_timeval */ … … 581 582 NULL, /* get_timespec */ 582 583 NULL, /* get_seconds */ 584 NULL, /* get_meta_data */ 583 585 NULL, /* seek_erf */ 584 586 NULL, /* seek_timeval */ … … 626 628 NULL, /* get_timespec */ 627 629 NULL, /* get_seconds */ 630 NULL, /* get_meta_data */ 628 631 NULL, /* seek_erf */ 629 632 NULL, /* seek_timeval */ … … 671 674 NULL, /* get_timespec */ 672 675 NULL, /* get_seconds */ 676 NULL, /* get_meta_data */ 673 677 NULL, /* seek_erf */ 674 678 NULL, /* seek_timeval */ -
lib/format_linux_int.c
r9a6bdbc r977e0db 519 519 linuxnative_get_timespec, /* get_timespec */ 520 520 NULL, /* get_seconds */ 521 NULL, /* get_meta_data */ 521 522 NULL, /* seek_erf */ 522 523 NULL, /* seek_timeval */ … … 580 581 linuxnative_get_timespec, /* get_timespec */ 581 582 NULL, /* get_seconds */ 583 NULL, /* get_meta_data */ 582 584 NULL, /* seek_erf */ 583 585 NULL, /* seek_timeval */ -
lib/format_linux_ring.c
r9a6bdbc r977e0db 840 840 linuxring_get_timespec, /* get_timespec */ 841 841 NULL, /* get_seconds */ 842 NULL, /* get_meta_data */ 842 843 NULL, /* seek_erf */ 843 844 NULL, /* seek_timeval */ … … 903 904 linuxring_get_timespec, /* get_timespec */ 904 905 NULL, /* get_seconds */ 906 NULL, /* get_meta_data */ 905 907 NULL, /* seek_erf */ 906 908 NULL, /* seek_timeval */ -
lib/format_ndag.c
r509ee47 r977e0db 1523 1523 NULL, /* get_seconds */ 1524 1524 NULL, /* get_timespec */ 1525 NULL, /* get_meta_data */ 1525 1526 NULL, /* seek_erf */ 1526 1527 NULL, /* seek_timeval */ -
lib/format_pcap.c
r9a6bdbc r977e0db 869 869 NULL, /* get_seconds */ 870 870 NULL, /* get_timespec */ 871 NULL, /* get_meta_data */ 871 872 NULL, /* seek_erf */ 872 873 NULL, /* seek_timeval */ … … 914 915 NULL, /* get_seconds */ 915 916 NULL, /* get_timespec */ 917 NULL, /* get_meta_data */ 916 918 NULL, /* seek_erf */ 917 919 NULL, /* seek_timeval */ -
lib/format_pcapfile.c
r9a6bdbc r977e0db 791 791 pcapfile_get_timespec, /* get_timespec */ 792 792 NULL, /* get_seconds */ 793 NULL, /* get_meta_data */ 793 794 NULL, /* seek_erf */ 794 795 NULL, /* seek_timeval */ -
lib/format_pcapng.c
rf47025d r977e0db 29 29 #include "libtrace_int.h" 30 30 #include "format_helper.h" 31 #include "format_pcapng.h" 31 32 32 33 #include <sys/stat.h> … … 38 39 #include <stdbool.h> 39 40 #include <math.h> 40 41 #define PCAPNG_SECTION_TYPE 0x0A0D0D0A42 #define PCAPNG_INTERFACE_TYPE 0x0000000143 #define PCAPNG_OLD_PACKET_TYPE 0x0000000244 #define PCAPNG_SIMPLE_PACKET_TYPE 0x0000000345 #define PCAPNG_NAME_RESOLUTION_TYPE 0x0000000446 #define PCAPNG_INTERFACE_STATS_TYPE 0x0000000547 #define PCAPNG_ENHANCED_PACKET_TYPE 0x0000000648 #define PCAPNG_CUSTOM_TYPE 0x00000BAD49 #define PCAPNG_CUSTOM_NONCOPY_TYPE 0x40000BAD50 #define PCAPNG_DECRYPTION_SECRETS_TYPE 0x0000000A51 52 #define PCAPNG_NRB_RECORD_END 0x000053 #define PCAPNG_NRB_RECORD_IP4 0x000154 #define PCAPNG_NRB_RECORD_IP6 0x000255 56 #define PCAPNG_CUSTOM_OPTION_UTF8 0xBAC57 #define PCAPNG_CUSTOM_OPTION_BIN 0xBAD58 #define PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY 0x4BAC59 #define PCAPNG_CUSTOM_OPTION_BIN_NONCOPY 0x4BAD60 61 #define PCAPNG_OPTION_END 0x000062 63 #define PACKET_IS_ENHANCED (pcapng_get_record_type(packet) == PCAPNG_ENHANCED_PACKET_TYPE)64 65 #define PACKET_IS_SIMPLE (pcapng_get_record_type(packet) == PCAPNG_SIMPLE_PACKET_TYPE)66 67 #define PACKET_IS_OLD (pcapng_get_record_type(packet) == PCAPNG_OLD_PACKET_TYPE)68 69 #define PCAPNG_IFOPT_TSRESOL 970 71 #define PCAPNG_PKTOPT_DROPCOUNT 472 73 #define PCAPNG_STATOPT_START 274 #define PCAPNG_STATOPT_END 375 #define PCAPNG_STATOPT_IFRECV 476 #define PCAPNG_STATOPT_IFDROP 577 #define PCAPNG_STATOPT_FILTERACCEPT 678 #define PCAPNG_STATOPT_OSDROP 779 #define PCAPNG_STATOPT_USRDELIV 880 41 81 42 typedef struct pcagng_section_header_t { … … 2130 2091 2131 2092 2093 } 2094 2095 void *pcapng_get_meta_data(libtrace_packet_t *packet, uint32_t section_type, 2096 uint16_t section) { 2097 2098 struct pcapng_peeker *hdr; 2099 void *ptr; 2100 uint32_t blocktype; 2101 uint16_t optcode; 2102 2103 hdr = (struct pcapng_peeker *)packet->header; 2104 ptr = packet->header; 2105 2106 if (DATA(packet->trace)->byteswapped) { 2107 blocktype = byteswap32(hdr->blocktype); 2108 } else { 2109 blocktype = hdr->blocktype; 2110 } 2111 2112 /* Just return if data we want is not in this block */ 2113 if (blocktype != section_type) { 2114 return NULL; 2115 } 2116 2117 /* Skip x bytes to the options depending on what kind of packet this is */ 2118 if (section_type == PCAPNG_SECTION_TYPE) { ptr += sizeof(pcapng_sec_t); } 2119 if (section_type == PCAPNG_INTERFACE_TYPE) { ptr += sizeof(pcapng_int_t); } 2120 if (section_type == PCAPNG_OLD_PACKET_TYPE) { ptr += sizeof(pcapng_opkt_t); } 2121 if (section_type == PCAPNG_SIMPLE_PACKET_TYPE) { ptr += sizeof(pcapng_spkt_t); } 2122 if (section_type == PCAPNG_NAME_RESOLUTION_TYPE) { 2123 /* look into this more */ 2124 return NULL; 2125 } 2126 if (section_type == PCAPNG_INTERFACE_STATS_TYPE) { ptr += sizeof(pcapng_stats_t); } 2127 if (section_type == PCAPNG_ENHANCED_PACKET_TYPE) { ptr += sizeof(pcapng_epkt_t); } 2128 2129 /* Skip over the options till a match is found or they run out */ 2130 struct pcapng_optheader *opthdr = ptr; 2131 if (DATA(packet->trace)->byteswapped) { 2132 optcode = byteswap16(opthdr->optcode); 2133 } else { 2134 optcode = opthdr->optcode; 2135 } 2136 while ((optcode != section) && (optcode != PCAPNG_OPTION_END)) { 2137 uint16_t len; 2138 2139 if (DATA(packet->trace)->byteswapped) { 2140 len = byteswap16(opthdr->optlen); 2141 } else { 2142 len = opthdr->optlen; 2143 } 2144 2145 /* work out any padding */ 2146 if ((len % 4) != 0) { 2147 ptr += len + (4 - (len % 4)) + sizeof(struct pcapng_optheader); 2148 } else { 2149 ptr += len + sizeof(struct pcapng_optheader); 2150 } 2151 2152 /* get the next option */ 2153 opthdr = (struct pcapng_optheader *)ptr; 2154 if (DATA(packet->trace)->byteswapped) { 2155 optcode = byteswap16(opthdr->optcode); 2156 } else { 2157 optcode = opthdr->optcode; 2158 } 2159 } 2160 2161 /* either a option was found or they ran out */ 2162 if (opthdr->optcode == section) { 2163 return ptr; 2164 } else { 2165 return NULL; 2166 } 2132 2167 } 2133 2168 … … 2169 2204 pcapng_get_timespec, /* get_timespec */ 2170 2205 NULL, /* get_seconds */ 2206 pcapng_get_meta_data, /* get_meta_data */ 2171 2207 NULL, /* seek_erf */ 2172 2208 NULL, /* seek_timeval */ -
lib/format_rt.c
r2193905 r977e0db 863 863 NULL, /* get_timespec */ 864 864 NULL, /* get_seconds */ 865 NULL, /* get_meta_data */ 865 866 NULL, /* seek_erf */ 866 867 NULL, /* seek_timeval */ -
lib/format_tsh.c
r2193905 r977e0db 252 252 NULL, /* get_timespec */ 253 253 NULL, /* get_seconds */ 254 NULL, /* get_meta_data */ 254 255 NULL, /* seek_erf */ 255 256 NULL, /* seek_timeval */ … … 302 303 NULL, /* get_timespec */ 303 304 NULL, /* get_seconds */ 305 NULL, /* get_meta_data */ 304 306 NULL, /* seek_erf */ 305 307 NULL, /* seek_timeval */ -
lib/libtrace.h.in
r3c828b8 r977e0db 581 581 } libtrace_ethertype_t; 582 582 583 typedef struct libtrace_meta_result { 584 uint16_t type; 585 uint16_t len; 586 } libtrace_meta_result_t; 587 588 typedef struct libtrace_meta { 589 char *interface_name; /**< Interface name packet was captured on */ 590 char *interface_mac; /**< Interface MAC address packet was captured on */ 591 uint64_t interface_speed; /**< Interface speed packet was captured on */ 592 uint32_t interface_ipv4; /**< Interface IP4 address packet was captured on */ 593 char *interface_ipv6; /**< Interface IP6 address packet was captured on */ 594 char *interface_description; /**< Interface description */ 595 } libtrace_meta_t; 596 583 597 typedef struct libtrace_packet_cache { 584 598 int capture_length; /**< Cached capture length */ … … 618 632 int which_trace_start; /**< Used to match packet to a started instance of the parent trace */ 619 633 634 libtrace_meta_t meta; /**< Meta data for the packet */ 620 635 } libtrace_packet_t; 621 636 … … 3698 3713 } /* extern "C" */ 3699 3714 #endif /* #ifdef __cplusplus */ 3715 3716 char *trace_get_interface_name(libtrace_packet_t *packet); 3717 char *trace_get_interface_mac(libtrace_packet_t *packet); 3718 uint64_t trace_get_interface_speed(libtrace_packet_t *packet); 3719 uint32_t trace_get_interface_ip4(libtrace_packet_t *packet); 3720 uint32_t trace_get_interface_ipv4(libtrace_packet_t *packet); 3721 char *trace_get_interface_ip6(libtrace_packet_t *packet); 3722 char *trace_get_interface_ipv6(libtrace_packet_t *packet); 3723 char *trace_get_interface_description(libtrace_packet_t *packet); 3724 libtrace_meta_result_t *trace_get_interface_num(libtrace_packet_t *packet); 3725 libtrace_meta_result_t *trace_get_host_os(libtrace_packet_t *packet); 3726 libtrace_meta_result_t *trace_get_tzone(libtrace_packet_t *packet); 3727 libtrace_meta_result_t *trace_get_app_name(libtrace_packet_t *packet); 3728 3700 3729 #endif /* LIBTRACE_H_ */ -
lib/libtrace_int.h
r62b2d97 r977e0db 723 723 double (*get_seconds)(const libtrace_packet_t *packet); 724 724 725 /** 726 */ 727 void *(*get_meta_data)(libtrace_packet_t *packet, uint32_t section_type, 728 uint16_t section); 729 725 730 /** Moves the read pointer to a certain ERF timestamp within an input 726 731 * trace file. … … 1201 1206 DLLEXPORT void *trace_get_payload_from_atm(void *link, uint8_t *type, 1202 1207 uint32_t *remaining); 1203 1204 1208 1205 1209 #ifdef HAVE_BPF -
lib/trace.c
r9a6bdbc r977e0db 947 947 * if this packet is ever reused 948 948 */ 949 /* free meta fields */ 950 if (packet->meta.interface_name != NULL) 951 free(packet->meta.interface_name); 952 if (packet->meta.interface_mac != NULL) 953 free(packet->meta.interface_mac); 954 if (packet->meta.interface_ipv6 != NULL) 955 free(packet->meta.interface_ipv6); 956 if (packet->meta.interface_description != NULL) 957 free(packet->meta.interface_description); 958 949 959 free(packet); 950 960 }
Note: See TracChangeset
for help on using the changeset viewer.