1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  * Support for splitting captures into multiple files with a maximum
22  * file size:
23  *
24  * Copyright (c) 2001
25  *	Seth Webster <swebster@sst.ll.mit.edu>
26  */
27 
28 #ifdef HAVE_CONFIG_H
29 #include "config.h"
30 #endif
31 
32 #include <stdlib.h>
33 #include <string.h>
34 
35 #include <netdissect-stdinc.h>
36 
37 #include "netdissect.h"
38 #include "addrtoname.h"
39 #include "print.h"
40 
41 struct printer {
42 	if_printer f;
43 	int type;
44 };
45 
46 static const struct printer printers[] = {
47 	{ ether_if_print,	DLT_EN10MB },
48 #ifdef DLT_IPNET
49 	{ ipnet_if_print,	DLT_IPNET },
50 #endif
51 #ifdef DLT_IEEE802_15_4
52 	{ ieee802_15_4_if_print, DLT_IEEE802_15_4 },
53 #endif
54 #ifdef DLT_IEEE802_15_4_NOFCS
55 	{ ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
56 #endif
57 #ifdef DLT_PPI
58 	{ ppi_if_print,		DLT_PPI },
59 #endif
60 #ifdef DLT_NETANALYZER
61 	{ netanalyzer_if_print, DLT_NETANALYZER },
62 #endif
63 #ifdef DLT_NETANALYZER_TRANSPARENT
64 	{ netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
65 #endif
66 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H)
67 	{ nflog_if_print,	DLT_NFLOG},
68 #endif
69 #ifdef DLT_CIP
70 	{ cip_if_print,         DLT_CIP },
71 #endif
72 #ifdef DLT_ATM_CLIP
73 	{ cip_if_print,		DLT_ATM_CLIP },
74 #endif
75 #ifdef DLT_IP_OVER_FC
76 	{ ipfc_if_print,	DLT_IP_OVER_FC },
77 #endif
78 	{ null_if_print,	DLT_NULL },
79 #ifdef DLT_LOOP
80 	{ null_if_print,	DLT_LOOP },
81 #endif
82 #ifdef DLT_APPLE_IP_OVER_IEEE1394
83 	{ ap1394_if_print,	DLT_APPLE_IP_OVER_IEEE1394 },
84 #endif
85 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H)
86 	{ bt_if_print,		DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
87 #endif
88 #ifdef DLT_LANE8023
89 	{ lane_if_print,        DLT_LANE8023 },
90 #endif
91 	{ arcnet_if_print,	DLT_ARCNET },
92 #ifdef DLT_ARCNET_LINUX
93 	{ arcnet_linux_if_print, DLT_ARCNET_LINUX },
94 #endif
95 	{ raw_if_print,		DLT_RAW },
96 #ifdef DLT_IPV4
97 	{ raw_if_print,		DLT_IPV4 },
98 #endif
99 #ifdef DLT_IPV6
100 	{ raw_if_print,		DLT_IPV6 },
101 #endif
102 #ifdef HAVE_PCAP_USB_H
103 #ifdef DLT_USB_LINUX
104 	{ usb_linux_48_byte_print, DLT_USB_LINUX},
105 #endif /* DLT_USB_LINUX */
106 #ifdef DLT_USB_LINUX_MMAPPED
107 	{ usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED},
108 #endif /* DLT_USB_LINUX_MMAPPED */
109 #endif /* HAVE_PCAP_USB_H */
110 #ifdef DLT_SYMANTEC_FIREWALL
111 	{ symantec_if_print,	DLT_SYMANTEC_FIREWALL },
112 #endif
113 #ifdef DLT_C_HDLC
114 	{ chdlc_if_print,	DLT_C_HDLC },
115 #endif
116 #ifdef DLT_HDLC
117 	{ chdlc_if_print,	DLT_HDLC },
118 #endif
119 #ifdef DLT_PPP_ETHER
120 	{ pppoe_if_print,	DLT_PPP_ETHER },
121 #endif
122 #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
123 	{ pflog_if_print,	DLT_PFLOG },
124 #endif
125 	{ token_if_print,	DLT_IEEE802 },
126 	{ fddi_if_print,	DLT_FDDI },
127 #ifdef DLT_LINUX_SLL
128 	{ sll_if_print,		DLT_LINUX_SLL },
129 #endif
130 #ifdef DLT_FR
131 	{ fr_if_print,		DLT_FR },
132 #endif
133 #ifdef DLT_FRELAY
134 	{ fr_if_print,		DLT_FRELAY },
135 #endif
136 #ifdef DLT_MFR
137 	{ mfr_if_print,		DLT_MFR },
138 #endif
139 	{ atm_if_print,		DLT_ATM_RFC1483 },
140 #ifdef DLT_SUNATM
141 	{ sunatm_if_print,	DLT_SUNATM },
142 #endif
143 #ifdef DLT_ENC
144 	{ enc_if_print,		DLT_ENC },
145 #endif
146 	{ sl_if_print,		DLT_SLIP },
147 #ifdef DLT_SLIP_BSDOS
148 	{ sl_bsdos_if_print,	DLT_SLIP_BSDOS },
149 #endif
150 #ifdef DLT_LTALK
151 	{ ltalk_if_print,	DLT_LTALK },
152 #endif
153 #ifdef DLT_JUNIPER_ATM1
154 	{ juniper_atm1_print,	DLT_JUNIPER_ATM1 },
155 #endif
156 #ifdef DLT_JUNIPER_ATM2
157 	{ juniper_atm2_print,	DLT_JUNIPER_ATM2 },
158 #endif
159 #ifdef DLT_JUNIPER_MFR
160 	{ juniper_mfr_print,	DLT_JUNIPER_MFR },
161 #endif
162 #ifdef DLT_JUNIPER_MLFR
163 	{ juniper_mlfr_print,	DLT_JUNIPER_MLFR },
164 #endif
165 #ifdef DLT_JUNIPER_MLPPP
166 	{ juniper_mlppp_print,	DLT_JUNIPER_MLPPP },
167 #endif
168 #ifdef DLT_JUNIPER_PPPOE
169 	{ juniper_pppoe_print,	DLT_JUNIPER_PPPOE },
170 #endif
171 #ifdef DLT_JUNIPER_PPPOE_ATM
172 	{ juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
173 #endif
174 #ifdef DLT_JUNIPER_GGSN
175 	{ juniper_ggsn_print,	DLT_JUNIPER_GGSN },
176 #endif
177 #ifdef DLT_JUNIPER_ES
178 	{ juniper_es_print,	DLT_JUNIPER_ES },
179 #endif
180 #ifdef DLT_JUNIPER_MONITOR
181 	{ juniper_monitor_print, DLT_JUNIPER_MONITOR },
182 #endif
183 #ifdef DLT_JUNIPER_SERVICES
184 	{ juniper_services_print, DLT_JUNIPER_SERVICES },
185 #endif
186 #ifdef DLT_JUNIPER_ETHER
187 	{ juniper_ether_print,	DLT_JUNIPER_ETHER },
188 #endif
189 #ifdef DLT_JUNIPER_PPP
190 	{ juniper_ppp_print,	DLT_JUNIPER_PPP },
191 #endif
192 #ifdef DLT_JUNIPER_FRELAY
193 	{ juniper_frelay_print,	DLT_JUNIPER_FRELAY },
194 #endif
195 #ifdef DLT_JUNIPER_CHDLC
196 	{ juniper_chdlc_print,	DLT_JUNIPER_CHDLC },
197 #endif
198 #ifdef DLT_PKTAP
199 	{ pktap_if_print,	DLT_PKTAP },
200 #endif
201 #ifdef DLT_IEEE802_11_RADIO
202 	{ ieee802_11_radio_if_print,	DLT_IEEE802_11_RADIO },
203 #endif
204 #ifdef DLT_IEEE802_11
205 	{ ieee802_11_if_print,	DLT_IEEE802_11},
206 #endif
207 #ifdef DLT_IEEE802_11_RADIO_AVS
208 	{ ieee802_11_radio_avs_if_print,	DLT_IEEE802_11_RADIO_AVS },
209 #endif
210 #ifdef DLT_PRISM_HEADER
211 	{ prism_if_print,	DLT_PRISM_HEADER },
212 #endif
213 	{ ppp_if_print,		DLT_PPP },
214 #ifdef DLT_PPP_WITHDIRECTION
215 	{ ppp_if_print,		DLT_PPP_WITHDIRECTION },
216 #endif
217 #ifdef DLT_PPP_BSDOS
218 	{ ppp_bsdos_if_print,	DLT_PPP_BSDOS },
219 #endif
220 #ifdef DLT_PPP_SERIAL
221 	{ ppp_hdlc_if_print,	DLT_PPP_SERIAL },
222 #endif
223 	{ NULL,			0 },
224 };
225 
226 static void	ndo_default_print(netdissect_options *ndo, const u_char *bp,
227 		    u_int length);
228 
229 static void	ndo_error(netdissect_options *ndo,
230 		    FORMAT_STRING(const char *fmt), ...)
231 		    NORETURN PRINTFLIKE(2, 3);
232 static void	ndo_warning(netdissect_options *ndo,
233 		    FORMAT_STRING(const char *fmt), ...)
234 		    PRINTFLIKE(2, 3);
235 
236 static int	ndo_printf(netdissect_options *ndo,
237 		     FORMAT_STRING(const char *fmt), ...)
238 		     PRINTFLIKE(2, 3);
239 
240 void
init_print(netdissect_options * ndo,uint32_t localnet,uint32_t mask,uint32_t timezone_offset)241 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask,
242     uint32_t timezone_offset)
243 {
244 
245 	thiszone = timezone_offset;
246 	init_addrtoname(ndo, localnet, mask);
247 	init_checksum();
248 }
249 
250 if_printer
lookup_printer(int type)251 lookup_printer(int type)
252 {
253 	const struct printer *p;
254 
255 	for (p = printers; p->f; ++p)
256 		if (type == p->type)
257 			return p->f;
258 
259 #if defined(DLT_USER2) && defined(DLT_PKTAP)
260 	/*
261 	 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
262 	 * header.
263 	 *
264 	 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
265 	 * based OSes or the same value as LINKTYPE_PKTAP as it is on
266 	 * other OSes, to LINKTYPE_PKTAP, so files written with
267 	 * this version of libpcap for a DLT_PKTAP capture have a link-
268 	 * layer header type of LINKTYPE_PKTAP.
269 	 *
270 	 * However, files written on OS X Mavericks for a DLT_PKTAP
271 	 * capture have a link-layer header type of LINKTYPE_USER2.
272 	 * If we don't have a printer for DLT_USER2, and type is
273 	 * DLT_USER2, we look up the printer for DLT_PKTAP and use
274 	 * that.
275 	 */
276 	if (type == DLT_USER2) {
277 		for (p = printers; p->f; ++p)
278 			if (DLT_PKTAP == p->type)
279 				return p->f;
280 	}
281 #endif
282 
283 	return NULL;
284 	/* NOTREACHED */
285 }
286 
287 int
has_printer(int type)288 has_printer(int type)
289 {
290 	return (lookup_printer(type) != NULL);
291 }
292 
293 if_printer
get_if_printer(netdissect_options * ndo,int type)294 get_if_printer(netdissect_options *ndo, int type)
295 {
296 	const char *dltname;
297 	if_printer printer;
298 
299 	printer = lookup_printer(type);
300 	if (printer == NULL) {
301 		dltname = pcap_datalink_val_to_name(type);
302 		if (dltname != NULL)
303 			(*ndo->ndo_error)(ndo,
304 					  "packet printing is not supported for link type %s: use -w",
305 					  dltname);
306 		else
307 			(*ndo->ndo_error)(ndo,
308 					  "packet printing is not supported for link type %d: use -w", type);
309 	}
310 	return printer;
311 }
312 
313 void
pretty_print_packet(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * sp,u_int packets_captured)314 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
315     const u_char *sp, u_int packets_captured)
316 {
317 	u_int hdrlen;
318 
319 	if(ndo->ndo_packet_number)
320 		ND_PRINT((ndo, "%5u  ", packets_captured));
321 
322 	ts_print(ndo, &h->ts);
323 
324 	/*
325 	 * Some printers want to check that they're not walking off the
326 	 * end of the packet.
327 	 * Rather than pass it all the way down, we set this member
328 	 * of the netdissect_options structure.
329 	 */
330 	ndo->ndo_snapend = sp + h->caplen;
331 
332         hdrlen = (ndo->ndo_if_printer)(ndo, h, sp);
333 
334 	/*
335 	 * Restore the original snapend, as a printer might have
336 	 * changed it.
337 	 */
338 	ndo->ndo_snapend = sp + h->caplen;
339 	if (ndo->ndo_Xflag) {
340 		/*
341 		 * Print the raw packet data in hex and ASCII.
342 		 */
343 		if (ndo->ndo_Xflag > 1) {
344 			/*
345 			 * Include the link-layer header.
346 			 */
347 			hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
348 		} else {
349 			/*
350 			 * Don't include the link-layer header - and if
351 			 * we have nothing past the link-layer header,
352 			 * print nothing.
353 			 */
354 			if (h->caplen > hdrlen)
355 				hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
356 				    h->caplen - hdrlen);
357 		}
358 	} else if (ndo->ndo_xflag) {
359 		/*
360 		 * Print the raw packet data in hex.
361 		 */
362 		if (ndo->ndo_xflag > 1) {
363 			/*
364 			 * Include the link-layer header.
365 			 */
366                         hex_print(ndo, "\n\t", sp, h->caplen);
367 		} else {
368 			/*
369 			 * Don't include the link-layer header - and if
370 			 * we have nothing past the link-layer header,
371 			 * print nothing.
372 			 */
373 			if (h->caplen > hdrlen)
374 				hex_print(ndo, "\n\t", sp + hdrlen,
375                                           h->caplen - hdrlen);
376 		}
377 	} else if (ndo->ndo_Aflag) {
378 		/*
379 		 * Print the raw packet data in ASCII.
380 		 */
381 		if (ndo->ndo_Aflag > 1) {
382 			/*
383 			 * Include the link-layer header.
384 			 */
385 			ascii_print(ndo, sp, h->caplen);
386 		} else {
387 			/*
388 			 * Don't include the link-layer header - and if
389 			 * we have nothing past the link-layer header,
390 			 * print nothing.
391 			 */
392 			if (h->caplen > hdrlen)
393 				ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
394 		}
395 	}
396 
397 	ND_PRINT((ndo, "\n"));
398 }
399 
400 /*
401  * By default, print the specified data out in hex and ASCII.
402  */
403 static void
ndo_default_print(netdissect_options * ndo,const u_char * bp,u_int length)404 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
405 {
406 	hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
407 }
408 
409 /* VARARGS */
410 static void
ndo_error(netdissect_options * ndo,const char * fmt,...)411 ndo_error(netdissect_options *ndo, const char *fmt, ...)
412 {
413 	va_list ap;
414 
415 	if(ndo->program_name)
416 		(void)fprintf(stderr, "%s: ", ndo->program_name);
417 	va_start(ap, fmt);
418 	(void)vfprintf(stderr, fmt, ap);
419 	va_end(ap);
420 	if (*fmt) {
421 		fmt += strlen(fmt);
422 		if (fmt[-1] != '\n')
423 			(void)fputc('\n', stderr);
424 	}
425 	nd_cleanup();
426 	exit(1);
427 	/* NOTREACHED */
428 }
429 
430 /* VARARGS */
431 static void
ndo_warning(netdissect_options * ndo,const char * fmt,...)432 ndo_warning(netdissect_options *ndo, const char *fmt, ...)
433 {
434 	va_list ap;
435 
436 	if(ndo->program_name)
437 		(void)fprintf(stderr, "%s: ", ndo->program_name);
438 	(void)fprintf(stderr, "WARNING: ");
439 	va_start(ap, fmt);
440 	(void)vfprintf(stderr, fmt, ap);
441 	va_end(ap);
442 	if (*fmt) {
443 		fmt += strlen(fmt);
444 		if (fmt[-1] != '\n')
445 			(void)fputc('\n', stderr);
446 	}
447 }
448 
449 static int
ndo_printf(netdissect_options * ndo,const char * fmt,...)450 ndo_printf(netdissect_options *ndo, const char *fmt, ...)
451 {
452 	va_list args;
453 	int ret;
454 
455 	va_start(args, fmt);
456 	ret = vfprintf(stdout, fmt, args);
457 	va_end(args);
458 
459 	if (ret < 0)
460 		ndo_error(ndo, "Unable to write output: %s", pcap_strerror(errno));
461 	return (ret);
462 }
463 
464 void
ndo_set_function_pointers(netdissect_options * ndo)465 ndo_set_function_pointers(netdissect_options *ndo)
466 {
467 	ndo->ndo_default_print=ndo_default_print;
468 	ndo->ndo_printf=ndo_printf;
469 	ndo->ndo_error=ndo_error;
470 	ndo->ndo_warning=ndo_warning;
471 }
472 /*
473  * Local Variables:
474  * c-style: whitesmith
475  * c-basic-offset: 8
476  * End:
477  */
478