Changeset a857389


Ignore:
Timestamp:
02/15/18 17:59:50 (3 years ago)
Author:
Shane Alcock <salcock@…>
Branches:
cachetimestamps, develop, etsilive, master, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance
Children:
5a70a80
Parents:
3004d6c
git-author:
Anthony Coddington <anthony.coddington@…> (02/14/18 16:03:04)
git-committer:
Shane Alcock <salcock@…> (02/15/18 17:59:50)
Message:

Initial support for ERF provenance records

Update erftypes.h with TYPE_META (27).
Check for ERF_TYPE_MAX rather than some arbitrary type in ERF sanity checks. In Wireshark we recently completely removed these checks as there are only a few types before TYPE_PAD/ERF_TYPE_MAX, but leave them in for now.
Add TRACE_TYPE_ERF_META for provenance record payload.
Continue to use TRACE_RT_DATA_ERF as provenance is a valid ERF record. Note: this means that LIBTRACE_IS_META_PACKET() will currently return FALSE which may confuse some tools. Other places in the code also tend to check for TRACE_TYPE_NONDATA which isn't true here either.
Return zero for wire length of provenance records.
Don't allow snapping them (just return the same value).
Skip provenance records in l2 parsers and trace_get_payload_from_meta().
Return provenance payload for trace_get_packet_meta().

Also add support for a couple of missing ERF_TYPE_ETH_COLOR variants.

Location:
lib
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • lib/erftypes.h

    ree6e802 ra857389  
    162162#endif
    163163
     164/** Provenance Metadata Record */
     165#ifndef ERF_TYPE_META
     166#define ERF_TYPE_META   27
     167#endif
     168/* TODO: Endace has deprecated TYPE_* in favour of ERF_TYPE_*. New types do not have TYPE_* aliases. */
     169#ifndef TYPE_META
     170#define TYPE_META       ERF_TYPE_META
     171#endif
     172
    164173/** Padding record */
    165174#ifndef TYPE_PAD
    … …  
    167176#endif
    168177
     178#ifndef ERF_TYPE_MAX
     179#define ERF_TYPE_MAX    TYPE_PAD
     180#endif
    169181
    170182#endif /* _ERFTYPES_H_ */

  • lib/format_dag25.c

    rfd1b63e ra857389  
    187187                switch(erfptr->type) {
    188188                        case TYPE_ETH:
     189                        case TYPE_COLOR_ETH:
    189190                        case TYPE_DSM_COLOR_ETH:
     191                        case TYPE_COLOR_HASH_ETH:
    190192                                return 2;
    191193                        default:                return 0;
    … …  
    10501052        /* No loss counter for DSM coloured records - have to use some
    10511053         * other API */
    1052         if (erfptr->type == TYPE_DSM_COLOR_ETH) {
     1054        if (erf_is_color_type(erfptr->type)) {
    10531055                /* TODO */
    10541056        } else {

  • lib/format_erf.c

    r7ff881a ra857389  
    120120} erf_index_t;
    121121
    122 
    123122/* Ethernet packets have a 2 byte padding before the packet
    124123 * so that the IP header is aligned on a 32 bit boundary.
    … …  
    132131                dag_record_t *erfptr = (dag_record_t *)packet->header;
    133132                switch((erfptr->type & 0x7f)) {
    134                         case TYPE_ETH:         
     133                        case TYPE_ETH:
     134                        case TYPE_COLOR_ETH:
    135135                        case TYPE_DSM_COLOR_ETH:
     136                        case TYPE_COLOR_HASH_ETH:
    136137                                return 2;
    137138                        default:                return 0;
    … …  
    144145                }
    145146        }
     147}
     148
     149int erf_is_color_type(uint8_t erf_type)
     150{
     151        switch(erf_type & 0x7f) {
     152                case TYPE_COLOR_HDLC_POS:
     153                case TYPE_DSM_COLOR_HDLC_POS:
     154                case TYPE_COLOR_ETH:
     155                case TYPE_DSM_COLOR_ETH:
     156                case TYPE_COLOR_HASH_POS:
     157                case TYPE_COLOR_HASH_ETH:
     158                        return 1;
     159        }
     160
     161        return 0;
    146162}
    147163
    … …  
    200216        }
    201217        /* Is this a proper typed packet */
    202         if ((erf->type & 0x7f) > TYPE_AAL2) {
     218        if ((erf->type & 0x7f) > ERF_TYPE_MAX) {
    203219                return 0;
    204220        }
    … …  
    464480
    465481        /* Check for loss */
    466         if ((erfptr->type & 0x7f) == TYPE_DSM_COLOR_ETH) {
     482        if (erf_is_color_type(erfptr->type)) {
    467483                /* No idea how we get this yet */
    468484
    … …  
    521537
    522538        /* Unknown/corrupt */
    523         if ((((dag_record_t *)packet->buffer)->type & 0x7f) >= TYPE_RAW_LINK) {
     539        if ((((dag_record_t *)packet->buffer)->type & 0x7f) > ERF_TYPE_MAX) {
    524540                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET,
    525541                                "Corrupt or Unknown ERF type");
    … …  
    758774        dag_record_t *erfptr = 0;
    759775        erfptr = (dag_record_t *)packet->header;
     776
     777        if ((erfptr->type & 0x7f) == TYPE_META)
     778                return 0;
     779
    760780        return ntohs(erfptr->wlen);
    761781}
    … …  
    764784        dag_record_t *erfptr = 0;
    765785        assert(packet);
    766         if(size  > trace_get_capture_length(packet)) {
     786        erfptr = (dag_record_t *)packet->header;
     787
     788        if(size > trace_get_capture_length(packet) || (erfptr->type & 0x7f) == TYPE_META) {
    767789                /* Can't make a packet larger */
    768790                return trace_get_capture_length(packet);
    769791        }
     792
    770793        /* Reset cached capture length - otherwise we will both return the
    771794         * wrong value here and subsequent get_capture_length() calls will
    772795         * return the wrong value. */
    773796        packet->capture_length = -1;
    774         erfptr = (dag_record_t *)packet->header;
    775797        erfptr->rlen = htons(size + erf_get_framing_length(packet));
    776798        return trace_get_capture_length(packet);

  • lib/format_erf.h

    ree6e802 ra857389  
    5353int erf_get_wire_length(const libtrace_packet_t *packet);
    5454size_t erf_set_capture_length(libtrace_packet_t *packet, size_t size);
     55int erf_is_color_type(uint8_t erf_type);
    5556
    5657#endif

  • lib/libtrace.h.in

    rc7e547e ra857389  
    369369       TRACE_TYPE_METADATA = 18,        /**< WDCAP-style meta-data */
    370370       TRACE_TYPE_NONDATA = 19,         /**< Not a data packet */
    371        TRACE_TYPE_OPENBSD_LOOP = 20     /**< OpenBSD loopback */
     371       TRACE_TYPE_OPENBSD_LOOP = 20,    /**< OpenBSD loopback */
     372       TRACE_TYPE_ERF_META = 21 /**< ERF Provenance metadata record */
    372373} libtrace_linktype_t;
    373374

  • lib/linktypes.c

    r4697684 ra857389  
    102102                /* Used for test traces within WAND */
    103103                case TRACE_TYPE_80211_PRISM:   
     104                /* Could use DLT_ERF, but would only really make sense with PCAP-NG */
     105                case TRACE_TYPE_ERF_META:
    104106                /* Probably == PPP */
    105107                /* TODO: We haven't researched these yet */
    … …  
    169171                case TYPE_ATM:          return TRACE_TYPE_ATM;
    170172                case TYPE_AAL5:         return TRACE_TYPE_AAL5;
     173                case TYPE_COLOR_ETH:return TRACE_TYPE_ETH;
    171174                case TYPE_DSM_COLOR_ETH:return TRACE_TYPE_ETH;
     175                case TYPE_COLOR_HASH_ETH:return TRACE_TYPE_ETH;
    172176                case TYPE_IPV4:         return TRACE_TYPE_NONE;
    173177                case TYPE_IPV6:         return TRACE_TYPE_NONE;
     178                case TYPE_META:         return TRACE_TYPE_ERF_META;
    174179        }
    175180        return ~0U;
    … …  
    183188                case TRACE_TYPE_ATM:    return TYPE_ATM;
    184189                case TRACE_TYPE_AAL5:   return TYPE_AAL5;
     190                case TRACE_TYPE_ERF_META: return TYPE_META;
    185191               
    186192                /* Not technically correct! Could be IPv6 packet

  • lib/protocols_l2.c

    r99351e3 ra857389  
    482482                case TRACE_TYPE_80211_PRISM:
    483483                case TRACE_TYPE_PFLOG:
     484                case TRACE_TYPE_ERF_META:
    484485                        break;
    485486                case TRACE_TYPE_UNKNOWN:
    … …  
    517518                                case TRACE_TYPE_80211_PRISM:
    518519                                case TRACE_TYPE_PFLOG:
     520                                case TRACE_TYPE_ERF_META:
    519521                                        break;
    520522                                case TRACE_TYPE_UNKNOWN:
    … …  
    583585                case TRACE_TYPE_METADATA:
    584586                case TRACE_TYPE_NONDATA:
     587                case TRACE_TYPE_ERF_META:
    585588                case TRACE_TYPE_UNKNOWN:
    586589                        return NULL;
    … …  
    685688                case TRACE_TYPE_NONDATA:
    686689                case TRACE_TYPE_OPENBSD_LOOP:
     690                case TRACE_TYPE_ERF_META:
    687691                case TRACE_TYPE_UNKNOWN:
    688692                        return NULL;
    … …  
    734738                case TRACE_TYPE_NONDATA:
    735739                case TRACE_TYPE_OPENBSD_LOOP:
     740                case TRACE_TYPE_ERF_META:
    736741                case TRACE_TYPE_UNKNOWN:
    737742                        /* No MAC address */

  • lib/protocols_pktmeta.c

    ree6e802 ra857389  
    138138                case TRACE_TYPE_80211_RADIO:
    139139                case TRACE_TYPE_80211_PRISM:
     140                case TRACE_TYPE_ERF_META:
    140141                        return pktbuf;
    141142                /* Non metadata packets */
    … …  
    211212                case TRACE_TYPE_NONDATA:
    212213                case TRACE_TYPE_OPENBSD_LOOP:
     214                case TRACE_TYPE_ERF_META:
    213215                case TRACE_TYPE_UNKNOWN:
    214216                        /* In this case, the pointer passed in does not point
Note: See TracChangeset for help on using the changeset viewer.