Changeset b39eaee
- Timestamp:
- 01/07/19 10:35:41 (2 years ago)
- Branches:
- develop
- Children:
- 89ed4a0
- Parents:
- 51276bd
- git-author:
- Jacob Van Walraven <jcv9@…> (12/14/18 11:54:41)
- git-committer:
- Jacob Van Walraven <jcv9@…> (01/07/19 10:35:41)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
lib/format_pcapng.c
r9a6bdbc rb39eaee 234 234 } 235 235 236 static inline uint32_t pcapng_get_header_type(const libtrace_packet_t *packet) { 237 uint32_t *type = (uint32_t *)packet->buffer; 238 239 /* Section blocks, interface blocks, name resolution blocks, stats blocks and 240 * Custom blocks are all of type trace_type_pcapng_meta */ 241 if (packet->type == TRACE_RT_PCAPNG_META) { 242 return *type; 243 } 244 245 if (packet->type == 0x00000006 || packet->type == 0x00000003) { 246 return *type; 247 } 248 /* not a pcapng header type */ 249 return 0; 236 static inline uint32_t pcapng_swap32(libtrace_packet_t *packet, uint32_t value) { 237 if (DATAOUT(packet->trace)->byteswapped) { 238 return byteswap32(value); 239 } else { 240 return value; 241 } 242 } 243 static inline uint32_t pcapng_swap16(libtrace_packet_t *packet, uint32_t value) { 244 if (DATAOUT(packet->trace)->byteswapped) { 245 return byteswap16(value); 246 } else { 247 return value; 248 } 250 249 } 251 250 static inline uint32_t pcapng_get_blocklen(const libtrace_packet_t *packet) { 252 251 struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->buffer; 253 252 254 if (DATA OUT(packet->trace)->byteswapped) {253 if (DATA(packet->trace)->byteswapped) { 255 254 return byteswap32(hdr->blocklen); 256 255 } else { … … 578 577 579 578 /* If the packet is already encapsulated in a pcapng frame just output it */ 580 switch (pcapng_get_ header_type(packet)) {579 switch (pcapng_get_record_type(packet)) { 581 580 case PCAPNG_SECTION_TYPE: { 582 /* If we get a section header we need to calculate the 583 * the byte ordering */ 584 pcapng_sec_t *sechdr = (pcapng_sec_t *)packet->buffer; 585 if (sechdr->ordering == 0x1A2B3C4D) { 581 /* If the section header passed in is byteswapped, everything we output 582 * till the next section header needs to be byteswapped. The next header 583 * will determine if we need to continue swapping bytes */ 584 if (DATA(libtrace)->byteswapped) { 585 DATAOUT(libtrace)->byteswapped = true; 586 } else { 586 587 DATAOUT(libtrace)->byteswapped = false; 587 } else if (sechdr->ordering == 0x4D3C2B1A) {588 DATAOUT(libtrace)->byteswapped = true;589 588 } 590 589 … … 618 617 return -1; 619 618 } 619 620 620 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, 621 621 pcapng_get_blocklen(packet)); 622 622 623 623 return pcapng_get_blocklen(packet); … … 636 636 return -1; 637 637 } 638 638 639 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, 639 640 pcapng_get_blocklen(packet)); 640 641 641 642 return pcapng_get_blocklen(packet); … … 648 649 return -1; 649 650 } 651 650 652 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, 651 653 pcapng_get_blocklen(packet)); … … 654 656 } 655 657 case PCAPNG_CUSTOM_TYPE: { 656 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, 657 pcapng_get_blocklen(packet)); 658 if (DATA(libtrace)->byteswapped == DATAOUT(libtrace)->byteswapped) { 659 wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, 660 pcapng_get_blocklen(packet)); 661 } else { 662 663 } 658 664 659 665 return pcapng_get_blocklen(packet); … … 665 671 /* Create section block */ 666 672 pcapng_sec_t sechdr; 667 sechdr.blocktype = PCAPNG_SECTION_TYPE;668 sechdr.blocklen = 28;669 sechdr.ordering = 0x1A2B3C4D;670 sechdr.majorversion = 1;673 sechdr.blocktype = pcapng_swap32(packet, PCAPNG_SECTION_TYPE); 674 sechdr.blocklen = pcapng_swap32(packet, 28); 675 sechdr.ordering = pcapng_swap32(packet, 0x1A2B3C4D); 676 sechdr.majorversion = pcapng_swap16(packet, 1); 671 677 sechdr.minorversion = 0; 672 678 sechdr.sectionlen = 0xFFFFFFFFFFFFFFFF; … … 683 689 /* Create interface block*/ 684 690 pcapng_int_t inthdr; 685 inthdr.blocktype = PCAPNG_INTERFACE_TYPE;686 inthdr.blocklen = 20;687 inthdr.linktype = libtrace_to_pcap_dlt(linktype);691 inthdr.blocktype = pcapng_swap32(packet, PCAPNG_INTERFACE_TYPE); 692 inthdr.blocklen = pcapng_swap32(packet, 20); 693 inthdr.linktype = pcapng_swap16(packet, libtrace_to_pcap_dlt(linktype)); 688 694 inthdr.reserved = 0; 689 695 inthdr.snaplen = 0; … … 708 714 uint32_t blocklen; 709 715 uint32_t padding; 716 uint32_t caplen; 717 uint32_t wirelen; 710 718 void *padding_data; 711 719 pcapng_epkt_t epkthdr; … … 713 721 link = trace_get_packet_buffer(packet, &linktype, &remaining); 714 722 715 epkthdr.wlen = trace_get_wire_length(packet);716 epkthdr.caplen = trace_get_capture_length(packet);723 wirelen = trace_get_wire_length(packet); 724 caplen = trace_get_capture_length(packet); 717 725 718 726 /* trace_get_wirelength includes FCS, while pcapng doesn't */ 719 727 if (trace_get_link_type(packet)==TRACE_TYPE_ETH) { 720 if ( epkthdr.wlen >= 4) {721 epkthdr.wlen -= 4;728 if (wirelen >= 4) { 729 wirelen -= 4; 722 730 } else { 723 epkthdr.wlen = 0;731 wirelen = 0; 724 732 } 725 733 } 726 734 /* capture length should always be less than the wirelength */ 727 if ( epkthdr.caplen > epkthdr.wlen) {728 epkthdr.caplen = epkthdr.wlen;735 if (caplen > wirelen) { 736 caplen = wirelen; 729 737 } 730 738 731 739 /* calculate padding to 32bits */ 732 padding = epkthdr.caplen % 4;740 padding = caplen % 4; 733 741 if (padding) { padding = 4 - padding; } 734 742 padding_data = calloc(1, padding); 735 743 744 /* get pcapng_timestamp */ 745 struct pcapng_timestamp ts = pcapng_get_timestamp(packet); 746 736 747 /* calculate the block length */ 737 blocklen = sizeof(epkthdr) + sizeof(epkthdr.blocklen) + epkthdr.caplen + padding;738 739 epkthdr.blocktype = PCAPNG_ENHANCED_PACKET_TYPE;740 epkthdr.block len = blocklen;741 epkthdr. interfaceid = DATAOUT(libtrace)->nextintid-1;742 743 /* get pcapng_timestamp */744 struct pcapng_timestamp ts = pcapng_get_timestamp(packet);745 epkthdr. timestamp_high = ts.timehigh;746 epkthdr.timestamp_low = ts.timelow;748 blocklen = sizeof(epkthdr) + sizeof(epkthdr.blocklen) + caplen + padding; 749 750 /* construct the packet */ 751 epkthdr.blocktype = pcapng_swap32(packet, PCAPNG_ENHANCED_PACKET_TYPE); 752 epkthdr.blocklen = pcapng_swap32(packet, blocklen); 753 epkthdr.interfaceid = pcapng_swap32(packet, DATAOUT(libtrace)->nextintid-1); 754 epkthdr.timestamp_high = pcapng_swap32(packet, ts.timehigh); 755 epkthdr.timestamp_low = pcapng_swap32(packet, ts.timelow); 756 epkthdr.wlen = pcapng_swap32(packet, wirelen); 757 epkthdr.caplen = pcapng_swap32(packet, caplen); 747 758 748 759 /* output enhanced packet header */ 749 760 wandio_wwrite(DATAOUT(libtrace)->file, &epkthdr, sizeof(epkthdr)); 750 761 /* output the packet */ 751 wandio_wwrite(DATAOUT(libtrace)->file, link, (size_t) epkthdr.caplen);762 wandio_wwrite(DATAOUT(libtrace)->file, link, (size_t)caplen); 752 763 /* output padding */ 753 764 wandio_wwrite(DATAOUT(libtrace)->file, padding_data, (size_t)padding);
Note: See TracChangeset
for help on using the changeset viewer.