mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-23 18:14:29 +08:00
Code Issues Packages Projects Releases Wiki Activity
6a681e6a16
tcpdump/print.c

577 lines
14 KiB
C
Raw Normal View History

Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
/*
* Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
* Support for splitting captures into multiple files with a maximum
* file size:
*
* Copyright (c) 2001
* Seth Webster <swebster@sst.ll.mit.edu>
*/
#ifdef HAVE_CONFIG_H
Always include <config.h> rather than "config.h". This can prevent bizarre failures if, for example, you've done a configuration in the top-level source directory, leaving behind one config.h file, and then do an out-of-tree build in another directory, with different configuration options. This way, we always pick up the same config.h, in the build directory.
2018-01-22 04:27:08 +08:00
#include <config.h>
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
#endif
#include <stdlib.h>
#include <string.h>
Apply the first step of the new way to fetch data with bounds checking Add GET_{BE|HE|LE}_, GET_U_1, GET_S_1, GET_IPV4_TO_HOST_ORDER, GET_IPV4_TO_NETWORK_ORDER macros and get_{be|he|le}_, get_u_1, get_s_1, get_ipv4_to_host_order, get_ipv4_to_network_order inline functions, with setjmp/longjmp logic to do better and easier data fetch with bounds checking. Based on Guy Harris's idea and code.
2018-05-01 00:02:43 +08:00
#include <setjmp.h>
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Use quoted include netdissect-stdinc.h instead of angle-bracketed one
2018-01-20 22:59:49 +08:00
#include "netdissect-stdinc.h"
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
#include "netdissect.h"
#include "addrtoname.h"
#include "print.h"
Add a malloc/free process with garbage collector Use it in the PPP printer.
2018-03-14 20:41:33 +08:00
#include "netdissect-alloc.h"
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Include pcap-missing.h, to get the declaration of pcap_datalink_val_to_name(). If we're building with an old version of libpcap that doesn't include pcap_datalink_val_to_name(), we incorporate our own version, but we need to have it declared before we use it.
2018-07-30 06:08:16 +08:00
#include "pcap-missing.h"
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
struct printer {
if_printer f;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
int type;
};
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
static const struct printer printers[] = {
Apple IPoIEEE1394: Update the link-layer dissector to a void function
2020-02-03 03:42:52 +08:00
#ifdef DLT_APPLE_IP_OVER_IEEE1394
{ ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 },
ARCNET: Update the link-layer dissectors to void functions
2020-03-29 03:56:02 +08:00
#endif
{ arcnet_if_print, DLT_ARCNET },
#ifdef DLT_ARCNET_LINUX
{ arcnet_linux_if_print, DLT_ARCNET_LINUX },
Bluetooth: Update the link-layer dissector to a void function Moreover: Remove a useless ND_TCHECK_4 test (caplen tested before). Remove a no longer used 'trunc' label.
2020-02-07 03:27:06 +08:00
#endif
ATM: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-02 19:58:24 +08:00
{ atm_if_print, DLT_ATM_RFC1483 },
Update more link-layer dissectors to void functions brcm_tag_if_print() brcm_tag_prepend_if_print() dsa_if_print() edsa_if_print() ether_if_print() netanalyzer_if_print() netanalyzer_transparent_if_print() Update ether_print(), ether_common_print() and ether_switch_tag_print() to void functions. Add a flag parameter to ether_print(), ether_common_print() and ether_switch_tag_print() to increment the link-layer header length field of the netdissect_options when needed. The calls use TRUE when the return value of the funtions was used. The calls with FALSE avoid increments when the calls are nested. Moreover: Remove trailing "_if" from some protocol names.
2020-07-13 04:27:33 +08:00
#ifdef DLT_DSA_TAG_BRCM
{ brcm_tag_if_print, DLT_DSA_TAG_BRCM },
#endif
#ifdef DLT_DSA_TAG_BRCM_PREPEND
{ brcm_tag_prepend_if_print, DLT_DSA_TAG_BRCM_PREPEND },
#endif
Bluetooth: Update the link-layer dissector to a void function Moreover: Remove a useless ND_TCHECK_4 test (caplen tested before). Remove a no longer used 'trunc' label.
2020-02-07 03:27:06 +08:00
#ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
{ bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
ENC: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name. Remove a no longer used 'out' label.
2020-02-08 03:31:51 +08:00
#endif
CHDLC: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-06 22:08:23 +08:00
#ifdef DLT_C_HDLC
{ chdlc_if_print, DLT_C_HDLC },
#endif
#ifdef DLT_HDLC
{ chdlc_if_print, DLT_HDLC },
#endif
CIP: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-02 17:50:35 +08:00
#ifdef DLT_ATM_CLIP
{ cip_if_print, DLT_ATM_CLIP },
#endif
#ifdef DLT_CIP
{ cip_if_print, DLT_CIP },
#endif
Update more link-layer dissectors to void functions brcm_tag_if_print() brcm_tag_prepend_if_print() dsa_if_print() edsa_if_print() ether_if_print() netanalyzer_if_print() netanalyzer_transparent_if_print() Update ether_print(), ether_common_print() and ether_switch_tag_print() to void functions. Add a flag parameter to ether_print(), ether_common_print() and ether_switch_tag_print() to increment the link-layer header length field of the netdissect_options when needed. The calls use TRUE when the return value of the funtions was used. The calls with FALSE avoid increments when the calls are nested. Moreover: Remove trailing "_if" from some protocol names.
2020-07-13 04:27:33 +08:00
#ifdef DLT_DSA_TAG_DSA
{ dsa_if_print, DLT_DSA_TAG_DSA },
#endif
#ifdef DLT_DSA_TAG_EDSA
{ edsa_if_print, DLT_DSA_TAG_EDSA },
#endif
ENC: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name. Remove a no longer used 'out' label.
2020-02-08 03:31:51 +08:00
#ifdef DLT_ENC
{ enc_if_print, DLT_ENC },
IPNET: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name. Remove a useless ND_TCHECK_1 test (GET_U_1 is used). Remove a no longer used 'trunc' label.
2020-02-08 17:42:36 +08:00
#endif
Update more link-layer dissectors to void functions brcm_tag_if_print() brcm_tag_prepend_if_print() dsa_if_print() edsa_if_print() ether_if_print() netanalyzer_if_print() netanalyzer_transparent_if_print() Update ether_print(), ether_common_print() and ether_switch_tag_print() to void functions. Add a flag parameter to ether_print(), ether_common_print() and ether_switch_tag_print() to increment the link-layer header length field of the netdissect_options when needed. The calls use TRUE when the return value of the funtions was used. The calls with FALSE avoid increments when the calls are nested. Moreover: Remove trailing "_if" from some protocol names.
2020-07-13 04:27:33 +08:00
{ ether_if_print, DLT_EN10MB },
FDDI: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-02 18:03:19 +08:00
{ fddi_if_print, DLT_FDDI },
FR: Update the link-layer dissectors to void functions Moreover: Remove trailing "_if" from the protocol name. Add two comments.
2020-08-04 23:24:53 +08:00
#ifdef DLT_FR
{ fr_if_print, DLT_FR },
#endif
#ifdef DLT_FRELAY
{ fr_if_print, DLT_FRELAY },
#endif
IEEE 802.11: Update the link-layer dissectors to void functions
2020-08-02 15:46:30 +08:00
#ifdef DLT_IEEE802_11
{ ieee802_11_if_print, DLT_IEEE802_11},
#endif
#ifdef DLT_IEEE802_11_RADIO_AVS
{ ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS },
#endif
#ifdef DLT_IEEE802_11_RADIO
{ ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO },
#endif
IEEE 802.15.4: Update the link-layer dissectors to void functions
2020-08-02 17:24:45 +08:00
#ifdef DLT_IEEE802_15_4
{ ieee802_15_4_if_print, DLT_IEEE802_15_4 },
#endif
#ifdef DLT_IEEE802_15_4_NOFCS
{ ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
#endif
#ifdef DLT_IEEE802_15_4_TAP
{ ieee802_15_4_tap_if_print, DLT_IEEE802_15_4_TAP },
#endif
IPFC: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-02 19:46:55 +08:00
#ifdef DLT_IP_OVER_FC
{ ipfc_if_print, DLT_IP_OVER_FC },
#endif
IPNET: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name. Remove a useless ND_TCHECK_1 test (GET_U_1 is used). Remove a no longer used 'trunc' label.
2020-02-08 17:42:36 +08:00
#ifdef DLT_IPNET
{ ipnet_if_print, DLT_IPNET },
NFLOG: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name.
2020-05-04 22:14:14 +08:00
#endif
IPoIB: Update the link-layer dissector to a void function
2020-07-25 22:55:45 +08:00
#ifdef DLT_IPOIB
{ ipoib_if_print, DLT_IPOIB },
#endif
Juniper: Update the link-layer dissectors to void functions
2020-07-28 01:20:02 +08:00
#ifdef DLT_JUNIPER_ATM1
{ juniper_atm1_if_print, DLT_JUNIPER_ATM1 },
#endif
#ifdef DLT_JUNIPER_ATM2
{ juniper_atm2_if_print, DLT_JUNIPER_ATM2 },
#endif
#ifdef DLT_JUNIPER_CHDLC
{ juniper_chdlc_if_print, DLT_JUNIPER_CHDLC },
#endif
#ifdef DLT_JUNIPER_ES
{ juniper_es_if_print, DLT_JUNIPER_ES },
#endif
#ifdef DLT_JUNIPER_ETHER
{ juniper_ether_if_print, DLT_JUNIPER_ETHER },
#endif
#ifdef DLT_JUNIPER_FRELAY
{ juniper_frelay_if_print, DLT_JUNIPER_FRELAY },
#endif
#ifdef DLT_JUNIPER_GGSN
{ juniper_ggsn_if_print, DLT_JUNIPER_GGSN },
#endif
#ifdef DLT_JUNIPER_MFR
{ juniper_mfr_if_print, DLT_JUNIPER_MFR },
#endif
#ifdef DLT_JUNIPER_MLFR
{ juniper_mlfr_if_print, DLT_JUNIPER_MLFR },
#endif
#ifdef DLT_JUNIPER_MLPPP
{ juniper_mlppp_if_print, DLT_JUNIPER_MLPPP },
#endif
#ifdef DLT_JUNIPER_MONITOR
{ juniper_monitor_if_print, DLT_JUNIPER_MONITOR },
#endif
#ifdef DLT_JUNIPER_PPP
{ juniper_ppp_if_print, DLT_JUNIPER_PPP },
#endif
#ifdef DLT_JUNIPER_PPPOE_ATM
{ juniper_pppoe_atm_if_print, DLT_JUNIPER_PPPOE_ATM },
#endif
#ifdef DLT_JUNIPER_PPPOE
{ juniper_pppoe_if_print, DLT_JUNIPER_PPPOE },
#endif
#ifdef DLT_JUNIPER_SERVICES
{ juniper_services_if_print, DLT_JUNIPER_SERVICES },
#endif
AppleTalk: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-06 22:23:30 +08:00
#ifdef DLT_LTALK
{ ltalk_if_print, DLT_LTALK },
#endif
FR: Update the link-layer dissectors to void functions Moreover: Remove trailing "_if" from the protocol name. Add two comments.
2020-08-04 23:24:53 +08:00
#ifdef DLT_MFR
{ mfr_if_print, DLT_MFR },
#endif
Update more link-layer dissectors to void functions brcm_tag_if_print() brcm_tag_prepend_if_print() dsa_if_print() edsa_if_print() ether_if_print() netanalyzer_if_print() netanalyzer_transparent_if_print() Update ether_print(), ether_common_print() and ether_switch_tag_print() to void functions. Add a flag parameter to ether_print(), ether_common_print() and ether_switch_tag_print() to increment the link-layer header length field of the netdissect_options when needed. The calls use TRUE when the return value of the funtions was used. The calls with FALSE avoid increments when the calls are nested. Moreover: Remove trailing "_if" from some protocol names.
2020-07-13 04:27:33 +08:00
#ifdef DLT_NETANALYZER
{ netanalyzer_if_print, DLT_NETANALYZER },
#endif
#ifdef DLT_NETANALYZER_TRANSPARENT
{ netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
#endif
NFLOG: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name.
2020-05-04 22:14:14 +08:00
#ifdef DLT_NFLOG
{ nflog_if_print, DLT_NFLOG},
NULL/LOOP: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name. Remove a useless ND_TCHECK_4 test (GET_HE_U_4 used). Remove a no longer used 'trunc' label. Use uint32_t type for family in null_hdr_print().
2020-02-08 01:21:40 +08:00
#endif
{ null_if_print, DLT_NULL },
#ifdef DLT_LOOP
{ null_if_print, DLT_LOOP },
PPI: Update the link-layer dissector to a void function Moreover: Merge ppi_if_print() and ppi_print() in one function. Remove two useless ND_TCHECK_ tests (GET_ used). Remove a no longer used 'trunc' label.
2020-03-28 15:38:04 +08:00
#endif
Handle DLT_PFLOG on all OSes. Don't pad the pflog header with BPF_WORDALIGN(); round up to a multiple of 4, instead, as that's what all but FreeBSD do, and FreeBSD used to do that and should go back to doing so (kern/261566). Don't rely on the OS's pflog include files to define direction types, reason types, action types, or the layout of the header; instead, define them ourselves in a header of our own, with #ifs to select the ones that are only on some platforms. That way, it'll handle some fields and field values (the ones common to all OSes with pflog) on all OSes, even ones without pflog. That also expands the set of direction, reason, and action codes to what various *BSDs and Darwin support. Also, handle all the different AF_INET6 values in various *BSDs and Darwin.
2022-01-30 14:30:33 +08:00
#ifdef DLT_PFLOG
PFLOG: Update the link-layer dissector to a void function Moreover: Use GET_U_1() when needed. Remove trailing "_if" from the protocol name.
2020-08-06 23:22:34 +08:00
{ pflog_if_print, DLT_PFLOG },
#endif
PKTAP: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name. Update the output of a test accordingly.
2020-03-28 17:40:28 +08:00
#ifdef DLT_PKTAP
{ pktap_if_print, DLT_PKTAP },
#endif
PPI: Update the link-layer dissector to a void function Moreover: Merge ppi_if_print() and ppi_print() in one function. Remove two useless ND_TCHECK_ tests (GET_ used). Remove a no longer used 'trunc' label.
2020-03-28 15:38:04 +08:00
#ifdef DLT_PPI
{ ppi_if_print, DLT_PPI },
PPPoE: Update the link-layer dissector to a void function Moreover: Add a length check. Fix a return. Use nd_print_trunc(). Remove trailing "_if" from the protocol name. Style.
2020-08-01 02:36:17 +08:00
#endif
PPP: Update the link-layer dissectors to void functions Moreover: Remove trailing "_if" from some protocol names. Update the outputs of two tests accordingly.
2020-08-06 17:22:56 +08:00
#ifdef DLT_PPP_BSDOS
{ ppp_bsdos_if_print, DLT_PPP_BSDOS },
#endif
#ifdef DLT_PPP_SERIAL
{ ppp_hdlc_if_print, DLT_PPP_SERIAL },
#endif
{ ppp_if_print, DLT_PPP },
Rename DLT_PPP_WITHDIRECTION to DLT_PPP_PPPD In libpcap DLT_PPP_WITHDIRECTION was renamed to DLT_LINUX_PPP_WITHDIRECTION and after to DLT_PPP_PPPD. Rename other #defines to match.
2020-08-08 20:45:10 +08:00
#ifdef DLT_PPP_PPPD
{ ppp_if_print, DLT_PPP_PPPD },
PPP: Update the link-layer dissectors to void functions Moreover: Remove trailing "_if" from some protocol names. Update the outputs of two tests accordingly.
2020-08-06 17:22:56 +08:00
#endif
PPPoE: Update the link-layer dissector to a void function Moreover: Add a length check. Fix a return. Use nd_print_trunc(). Remove trailing "_if" from the protocol name. Style.
2020-08-01 02:36:17 +08:00
#ifdef DLT_PPP_ETHER
{ pppoe_if_print, DLT_PPP_ETHER },
IEEE 802.11: Update the link-layer dissectors to void functions
2020-08-02 15:46:30 +08:00
#endif
#ifdef DLT_PRISM_HEADER
{ prism_if_print, DLT_PRISM_HEADER },
Raw IP: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name.
2020-02-08 01:05:05 +08:00
#endif
{ raw_if_print, DLT_RAW },
#ifdef DLT_IPV4
{ raw_if_print, DLT_IPV4 },
#endif
#ifdef DLT_IPV6
{ raw_if_print, DLT_IPV6 },
Symantec: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name.
2020-02-07 21:40:39 +08:00
#endif
SLIP: Update the link-layer dissectors to void functions Moreover: Update the protocol names (sl_if -> slip and sl_bsdos_if -> slip_bsdos). Update the output of some tests accordingly.
2020-04-30 00:54:31 +08:00
#ifdef DLT_SLIP_BSDOS
{ sl_bsdos_if_print, DLT_SLIP_BSDOS },
#endif
{ sl_if_print, DLT_SLIP },
SLL: Update the link-layer dissectors to void functions Moreover: Fix two probably copy & paste errors (s/SLL_HDR_LEN/SLL2_HDR_LEN/). Remove trailing "_if" from the protocol name.
2020-08-02 18:51:01 +08:00
#ifdef DLT_LINUX_SLL
{ sll_if_print, DLT_LINUX_SLL },
#endif
#ifdef DLT_LINUX_SLL2
{ sll2_if_print, DLT_LINUX_SLL2 },
#endif
SunATM DLPI: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name.
2020-02-08 00:51:01 +08:00
#ifdef DLT_SUNATM
{ sunatm_if_print, DLT_SUNATM },
#endif
Symantec: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol name.
2020-02-07 21:40:39 +08:00
#ifdef DLT_SYMANTEC_FIREWALL
{ symantec_if_print, DLT_SYMANTEC_FIREWALL },
Apple IPoIEEE1394: Update the link-layer dissector to a void function
2020-02-03 03:42:52 +08:00
#endif
Token Ring: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from the protocol name.
2020-08-02 19:36:10 +08:00
{ token_if_print, DLT_IEEE802 },
USB: Update the link-layer dissector to a void function Moreover: Remove trailing "_if" from protocol names.
2020-02-07 22:39:55 +08:00
#ifdef DLT_USB_LINUX
{ usb_linux_48_byte_if_print, DLT_USB_LINUX},
#endif /* DLT_USB_LINUX */
#ifdef DLT_USB_LINUX_MMAPPED
{ usb_linux_64_byte_if_print, DLT_USB_LINUX_MMAPPED},
#endif /* DLT_USB_LINUX_MMAPPED */
vsock: Update the link-layer dissector to a void function Moreover: Rename some variables/parameters from 'len' to 'caplen' because they store the capture length.
2020-07-27 03:19:37 +08:00
#ifdef DLT_VSOCK
{ vsock_if_print, DLT_VSOCK },
#endif
Apply the first step of the new way to update the link-layer header length Currently the return value of link-layer dissectors is supposed to be the length of the link-layer header, so that it can be skipped for -x and -X. If a link-layer dissector or a called function throws an exception, it returns no value, so that length isn't available. The goal is to change all the link-layer dissectors to be void functions and dissectors should update a new field of the netdissect_options structure "link-layer header length" rather than returning it as a value. In this transition process, the link-layer dissectors will be moved, when updated, from the uint_printers[] array (named before printers[]) to the void_printers[] array. In this transition process, a new field of the netdissect_options structure, ndo_void_printer (TRUE/FALSE), set in the updated function lookup_printer(), will permit to choose between the old and new way to update the link-layer header length.
2019-12-27 05:08:03 +08:00
{ NULL, 0 },
};
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
void
Fix local time printing Using seconds offset from GMT to local time to compute local time give errors when printing times outside the same daylight saving time period. Use the localtime() function for default and -tttt cases. Use the gmtime() function for -ttt and -ttttt cases. Rename ts_hmsfrac_print() to ts_date_hmsfrac_print(). Remove some variables now useless. Update some comments.
2018-08-07 23:11:43 +08:00
init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
Pass an ndo to the print API rather than using gndo. Since gndo is only referenced in main() move it there.
2015-04-24 23:22:05 +08:00
init_addrtoname(ndo, localnet, mask);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
init_checksum();
}
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
if_printer
lookup_printer(int type)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
const struct printer *p;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
for (p = printers; p->f; ++p)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
if (type == p->type)
return p->f;
#if defined(DLT_USER2) && defined(DLT_PKTAP)
/*
* Apple incorrectly chose to use DLT_USER2 for their PKTAP
* header.
*
* We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
* based OSes or the same value as LINKTYPE_PKTAP as it is on
* other OSes, to LINKTYPE_PKTAP, so files written with
* this version of libpcap for a DLT_PKTAP capture have a link-
* layer header type of LINKTYPE_PKTAP.
*
* However, files written on OS X Mavericks for a DLT_PKTAP
* capture have a link-layer header type of LINKTYPE_USER2.
* If we don't have a printer for DLT_USER2, and type is
* DLT_USER2, we look up the printer for DLT_PKTAP and use
* that.
*/
if (type == DLT_USER2) {
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
for (p = printers; p->f; ++p)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
if (DLT_PKTAP == p->type)
return p->f;
}
#endif
return NULL;
/* NOTREACHED */
}
int
has_printer(int type)
{
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
return (lookup_printer(type) != NULL);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
}
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
if_printer
get_if_printer(int type)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
if_printer printer;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
printer = lookup_printer(type);
if (printer == NULL)
printer = unsupported_if_print;
Move if_printer to structure netdissect_options The structure 'netdissect_options' can hold if_printer. Thus the structure 'print_info' is useless now. Moreover: Delete useless blank lines Fix indent
2015-09-14 21:34:13 +08:00
return printer;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
}
autoconf: Add the option to print functions names (entry and exit) This should help some debugging processes. Usage: ./configure --enable-instrument-functions Generate instrumentation calls for entry and exit to functions. Just after function entry and just before function exit, these profiling functions are called and print the function names with indentation and call level. To instument a static function, remove temporarily the static specifier. In case of truncation, the indentation level is reset currently to 1 in pretty_print_packet(), main is level 0.
2022-01-10 23:37:07 +08:00
#ifdef ENABLE_INSTRUMENT_FUNCTIONS
extern int profile_func_level;
autoconf: Enhance the --enable-instrument-functions result output It prints now, by default, also the static functions names. To configure the printing of only the global functions names, as before: $ make instrument_global To go back to print all the functions names: $ make instrument_all In case of truncation, the indentation level is reset to its previous level in pretty_print_packet(). [skip ci]
2022-01-21 02:26:22 +08:00
static int pretty_print_packet_level = -1;
autoconf: Add the option to print functions names (entry and exit) This should help some debugging processes. Usage: ./configure --enable-instrument-functions Generate instrumentation calls for entry and exit to functions. Just after function entry and just before function exit, these profiling functions are called and print the function names with indentation and call level. To instument a static function, remove temporarily the static specifier. In case of truncation, the indentation level is reset currently to 1 in pretty_print_packet(), main is level 0.
2022-01-10 23:37:07 +08:00
#endif
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
void
Move if_printer to structure netdissect_options The structure 'netdissect_options' can hold if_printer. Thus the structure 'print_info' is useless now. Moreover: Delete useless blank lines Fix indent
2015-09-14 21:34:13 +08:00
pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
Add a sanity check on packet header capture length The capture length must be <= MAXIMUM_SNAPLEN. Now a pachet is valid if: packet length != 0, capture length != 0, capture length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix spaces, indentation.
2018-02-02 01:54:24 +08:00
const u_char *sp, u_int packets_captured)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
u_int hdrlen = 0;
No more need for ndo_invalid_header in struct netdissect_options Because we now stop decoding packet when header length(s) is/are invalid, there is no more need to keep the invalid header flag out of pretty_print_packet function.
2018-01-25 21:17:57 +08:00
int invalid_header = 0;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Add --print-sampling option to print every Nth packet New option `--print-sampling=NTH` will parse and print every NTH packet, with all other packets producing no output. This option enables `--print` and `-S` flags. Print sampling is useful for real-time inspection of an interface with a high packet rate, or initial inspection of large capture files.
2022-01-17 08:05:15 +08:00
if (ndo->ndo_print_sampling && packets_captured % ndo->ndo_print_sampling != 0)
return;
autoconf: Enhance the --enable-instrument-functions result output It prints now, by default, also the static functions names. To configure the printing of only the global functions names, as before: $ make instrument_global To go back to print all the functions names: $ make instrument_all In case of truncation, the indentation level is reset to its previous level in pretty_print_packet(). [skip ci]
2022-01-21 02:26:22 +08:00
#ifdef ENABLE_INSTRUMENT_FUNCTIONS
if (pretty_print_packet_level == -1)
pretty_print_packet_level = profile_func_level;
#endif
Fix style
2018-09-13 20:48:20 +08:00
if (ndo->ndo_packet_number)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%5u ", packets_captured);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Add sanity checks on packet header (packet length / capture length) For a valid packet: packet length != 0, capture length != 0, packet length >= capture length. Update the output of some tests accordingly.
2018-01-15 21:39:40 +08:00
/* Sanity checks on packet length / capture length */
Fix style
2018-09-13 20:48:20 +08:00
if (h->caplen == 0) {
No more need for ndo_invalid_header in struct netdissect_options Because we now stop decoding packet when header length(s) is/are invalid, there is no more need to keep the invalid header flag out of pretty_print_packet function.
2018-01-25 21:17:57 +08:00
invalid_header = 1;
Add sanity checks on packet header (packet length / capture length) For a valid packet: packet length != 0, capture length != 0, packet length >= capture length. Update the output of some tests accordingly.
2018-01-15 21:39:40 +08:00
ND_PRINT("[Invalid header: caplen==0");
}
if (h->len == 0) {
No more need for ndo_invalid_header in struct netdissect_options Because we now stop decoding packet when header length(s) is/are invalid, there is no more need to keep the invalid header flag out of pretty_print_packet function.
2018-01-25 21:17:57 +08:00
if (!invalid_header) {
invalid_header = 1;
Add sanity checks on packet header (packet length / capture length) For a valid packet: packet length != 0, capture length != 0, packet length >= capture length. Update the output of some tests accordingly.
2018-01-15 21:39:40 +08:00
ND_PRINT("[Invalid header:");
} else
ND_PRINT(",");
ND_PRINT(" len==0");
} else if (h->len < h->caplen) {
No more need for ndo_invalid_header in struct netdissect_options Because we now stop decoding packet when header length(s) is/are invalid, there is no more need to keep the invalid header flag out of pretty_print_packet function.
2018-01-25 21:17:57 +08:00
if (!invalid_header) {
invalid_header = 1;
Add sanity checks on packet header (packet length / capture length) For a valid packet: packet length != 0, capture length != 0, packet length >= capture length. Update the output of some tests accordingly.
2018-01-15 21:39:40 +08:00
ND_PRINT("[Invalid header:");
} else
ND_PRINT(",");
ND_PRINT(" len(%u) < caplen(%u)", h->len, h->caplen);
}
Add a sanity check on packet header capture length The capture length must be <= MAXIMUM_SNAPLEN. Now a pachet is valid if: packet length != 0, capture length != 0, capture length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix spaces, indentation.
2018-02-02 01:54:24 +08:00
if (h->caplen > MAXIMUM_SNAPLEN) {
if (!invalid_header) {
invalid_header = 1;
ND_PRINT("[Invalid header:");
} else
ND_PRINT(",");
ND_PRINT(" caplen(%u) > %u", h->caplen, MAXIMUM_SNAPLEN);
}
Add a sanity check on packet header length The packet length must be <= MAXIMUM_SNAPLEN. Currently, there is no D-Bus printer, thus no need for a bigger length. Now a pachet is valid if: capture length != 0, packet length != 0, capture length <= MAXIMUM_SNAPLEN, packet length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix the packet header lengths of some fuzzed pcap files: If the lengths are > MAXIMUM_SNAPLEN, set them to MAXIMUM_SNAPLEN. Thus they will be always usable with this new sanity check.
2018-01-26 03:36:16 +08:00
if (h->len > MAXIMUM_SNAPLEN) {
if (!invalid_header) {
invalid_header = 1;
ND_PRINT("[Invalid header:");
} else
ND_PRINT(",");
ND_PRINT(" len(%u) > %u", h->len, MAXIMUM_SNAPLEN);
}
No more need for ndo_invalid_header in struct netdissect_options Because we now stop decoding packet when header length(s) is/are invalid, there is no more need to keep the invalid header flag out of pretty_print_packet function.
2018-01-25 21:17:57 +08:00
if (invalid_header) {
Don't decode the packet when header length(s) is/are invalid
2018-01-25 05:10:51 +08:00
ND_PRINT("]\n");
return;
}
Add sanity checks on packet header (packet length / capture length) For a valid packet: packet length != 0, capture length != 0, packet length >= capture length. Update the output of some tests accordingly.
2018-01-15 21:39:40 +08:00
Add a comment about packet and capture lengths
2018-01-25 21:34:56 +08:00
/*
* At this point:
* capture length != 0,
* packet length != 0,
Add a sanity check on packet header capture length The capture length must be <= MAXIMUM_SNAPLEN. Now a pachet is valid if: packet length != 0, capture length != 0, capture length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix spaces, indentation.
2018-02-02 01:54:24 +08:00
* capture length <= MAXIMUM_SNAPLEN,
Add a sanity check on packet header length The packet length must be <= MAXIMUM_SNAPLEN. Currently, there is no D-Bus printer, thus no need for a bigger length. Now a pachet is valid if: capture length != 0, packet length != 0, capture length <= MAXIMUM_SNAPLEN, packet length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix the packet header lengths of some fuzzed pcap files: If the lengths are > MAXIMUM_SNAPLEN, set them to MAXIMUM_SNAPLEN. Thus they will be always usable with this new sanity check.
2018-01-26 03:36:16 +08:00
* packet length <= MAXIMUM_SNAPLEN,
Add a comment about packet and capture lengths
2018-01-25 21:34:56 +08:00
* packet length >= capture length.
Add a sanity check on packet header length The packet length must be <= MAXIMUM_SNAPLEN. Currently, there is no D-Bus printer, thus no need for a bigger length. Now a pachet is valid if: capture length != 0, packet length != 0, capture length <= MAXIMUM_SNAPLEN, packet length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix the packet header lengths of some fuzzed pcap files: If the lengths are > MAXIMUM_SNAPLEN, set them to MAXIMUM_SNAPLEN. Thus they will be always usable with this new sanity check.
2018-01-26 03:36:16 +08:00
*
* Currently, there is no D-Bus printer, thus no need for
* bigger lengths.
Add a comment about packet and capture lengths
2018-01-25 21:34:56 +08:00
*/
Squelch compiler warnings on OpenBSD. With these changes tcpdump passes "CFLAGS=-Werror make" on OpenBSD 6.8 AMD64, so build.sh has one less reason to fail. gcc (GCC) 4.2.1 20070719 (also from OpenBSD clang version 10.0.1 with different wording) ./addrtoname.c: In function 'etheraddr_string': ./addrtoname.c:605: warning: passing argument 2 of 'ether_ntohost' discards qualifiers from pointer target type ./addrtoname.c: In function 'init_etherarray': ./addrtoname.c:980: warning: passing argument 2 of 'ether_ntohost' discards qualifiers from pointer target type ./print.c: In function 'pretty_print_packet': ./print.c:389: warning: passing argument 2 of 'ts_print' from incompatible pointer type ./bpf_dump.c:34: warning: no previous prototype for 'bpf_dump'
2021-03-17 12:02:23 +08:00
/*
* The header /usr/include/pcap/pcap.h in OpenBSD declares h->ts as
* struct bpf_timeval, not struct timeval. The former comes from
* /usr/include/net/bpf.h and uses 32-bit unsigned types instead of
* the types used in struct timeval.
*/
struct timeval tvbuf;
tvbuf.tv_sec = h->ts.tv_sec;
tvbuf.tv_usec = h->ts.tv_usec;
ts_print(ndo, &tvbuf);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
/*
Printers MUST (not MAY or even SHOULD) check bounds.
2017-02-18 05:51:51 +08:00
* Printers must check that they're not walking off the end of
* the packet.
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
* Rather than pass it all the way down, we set this member
* of the netdissect_options structure.
*/
ndo->ndo_snapend = sp + h->caplen;
Assign ndo->ndo_packetp in pretty_print_packet() Thus it can be used for debugging.
2021-11-01 16:40:53 +08:00
ndo->ndo_packetp = sp;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Apply the first step of the new way to fetch data with bounds checking Add GET_{BE|HE|LE}_, GET_U_1, GET_S_1, GET_IPV4_TO_HOST_ORDER, GET_IPV4_TO_NETWORK_ORDER macros and get_{be|he|le}_, get_u_1, get_s_1, get_ipv4_to_host_order, get_ipv4_to_network_order inline functions, with setjmp/longjmp logic to do better and easier data fetch with bounds checking. Based on Guy Harris's idea and code.
2018-05-01 00:02:43 +08:00
ndo->ndo_protocol = "";
Rename a field of the netdissect_options structure
2020-07-14 23:32:55 +08:00
ndo->ndo_ll_hdr_len = 0;
Use a switch to manage the setjmp() return values Also rename 'ndo_truncated' to 'ndo_early_end'. The current case (truncated packet) uses ND_TRUNCATED value. Prepare to add other cases when the current packet cannot be processed any more ('Invalid' cases, etc.).
2020-09-18 19:17:39 +08:00
switch (setjmp(ndo->ndo_early_end)) {
case 0:
Apply the first step of the new way to fetch data with bounds checking Add GET_{BE|HE|LE}_, GET_U_1, GET_S_1, GET_IPV4_TO_HOST_ORDER, GET_IPV4_TO_NETWORK_ORDER macros and get_{be|he|le}_, get_u_1, get_s_1, get_ipv4_to_host_order, get_ipv4_to_network_order inline functions, with setjmp/longjmp logic to do better and easier data fetch with bounds checking. Based on Guy Harris's idea and code.
2018-05-01 00:02:43 +08:00
/* Print the packet. */
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
(ndo->ndo_if_printer)(ndo, h, sp);
Use a switch to manage the setjmp() return values Also rename 'ndo_truncated' to 'ndo_early_end'. The current case (truncated packet) uses ND_TRUNCATED value. Prepare to add other cases when the current packet cannot be processed any more ('Invalid' cases, etc.).
2020-09-18 19:17:39 +08:00
break;
case ND_TRUNCATED:
Apply the first step of the new way to fetch data with bounds checking Add GET_{BE|HE|LE}_, GET_U_1, GET_S_1, GET_IPV4_TO_HOST_ORDER, GET_IPV4_TO_NETWORK_ORDER macros and get_{be|he|le}_, get_u_1, get_s_1, get_ipv4_to_host_order, get_ipv4_to_network_order inline functions, with setjmp/longjmp logic to do better and easier data fetch with bounds checking. Based on Guy Harris's idea and code.
2018-05-01 00:02:43 +08:00
/* A printer quit because the packet was truncated; report it */
Use more the nd_print_trunc() function
2020-09-01 03:57:45 +08:00
nd_print_trunc(ndo);
Print the full packet with -x/-X options when truncated including the link layer header.
2020-10-14 22:41:43 +08:00
/* Print the full packet */
ndo->ndo_ll_hdr_len = 0;
autoconf: Add the option to print functions names (entry and exit) This should help some debugging processes. Usage: ./configure --enable-instrument-functions Generate instrumentation calls for entry and exit to functions. Just after function entry and just before function exit, these profiling functions are called and print the function names with indentation and call level. To instument a static function, remove temporarily the static specifier. In case of truncation, the indentation level is reset currently to 1 in pretty_print_packet(), main is level 0.
2022-01-10 23:37:07 +08:00
#ifdef ENABLE_INSTRUMENT_FUNCTIONS
autoconf: Enhance the --enable-instrument-functions result output It prints now, by default, also the static functions names. To configure the printing of only the global functions names, as before: $ make instrument_global To go back to print all the functions names: $ make instrument_all In case of truncation, the indentation level is reset to its previous level in pretty_print_packet(). [skip ci]
2022-01-21 02:26:22 +08:00
/* truncation => reassignment */
profile_func_level = pretty_print_packet_level;
autoconf: Add the option to print functions names (entry and exit) This should help some debugging processes. Usage: ./configure --enable-instrument-functions Generate instrumentation calls for entry and exit to functions. Just after function entry and just before function exit, these profiling functions are called and print the function names with indentation and call level. To instument a static function, remove temporarily the static specifier. In case of truncation, the indentation level is reset currently to 1 in pretty_print_packet(), main is level 0.
2022-01-10 23:37:07 +08:00
#endif
Use a switch to manage the setjmp() return values Also rename 'ndo_truncated' to 'ndo_early_end'. The current case (truncated packet) uses ND_TRUNCATED value. Prepare to add other cases when the current packet cannot be processed any more ('Invalid' cases, etc.).
2020-09-18 19:17:39 +08:00
break;
Apply the first step of the new way to fetch data with bounds checking Add GET_{BE|HE|LE}_, GET_U_1, GET_S_1, GET_IPV4_TO_HOST_ORDER, GET_IPV4_TO_NETWORK_ORDER macros and get_{be|he|le}_, get_u_1, get_s_1, get_ipv4_to_host_order, get_ipv4_to_network_order inline functions, with setjmp/longjmp logic to do better and easier data fetch with bounds checking. Based on Guy Harris's idea and code.
2018-05-01 00:02:43 +08:00
}
Apply the last step of the new way to update the link-layer header length All the link-layer dissectors are now void functions. All the functions were moved to the void_printers[] array. Rename this array to printers[]. Remove the uint_printers[] array, now empty. Remove the 'ndo_void_printer' flag field, now useless, from netdissect_options. Remove other transitional code.
2020-08-07 01:12:49 +08:00
hdrlen = ndo->ndo_ll_hdr_len;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
Introduce a buffer stack, and use it for ESP decryption. If a dissector has to process its input - decryption, decompression, etc. - rather than dissect the raw input, it should push the processed input onto the buffer stack. As soon as the dissection is done, the stack should be popped, to free the buffer into which the processing was done, and restore the "pointer to packet data" and "pointer to end of packet data" members of the netdissect_options structure, so the code can go back to dissecting the original data. The stack will get everything popped off it when dissection is done. Use this mechanism in the ESP decryption code rather than scribbling on top of the input packet data.
2019-03-31 10:26:06 +08:00
/*
Treat the length field in an Ethernet header as such. If we have an Ethernet packet where the last 2 octets of the header are a length rather than an Ethernet type, and it's less than the remaining length of the packet, shorten the length and captured length, update the snapshot end. Turn the buffer stack into a "packet information" stack, so that, if we *do* update the snapshot end, we push the old end onto the stack, and pop it off as soon as we're done dissecting the Ethernet packet, in case there's more data in the packet after the Ethernet packet. Use the stack when we use the IPv4 and IPv6 length fields as well.
2019-04-23 14:48:45 +08:00
* Empty the stack of packet information, freeing all pushed buffers;
* if we got here by a printer quitting, we need to release anything
* that didn't get released because we longjmped out of the code
* before it popped the packet information.
Introduce a buffer stack, and use it for ESP decryption. If a dissector has to process its input - decryption, decompression, etc. - rather than dissect the raw input, it should push the processed input onto the buffer stack. As soon as the dissection is done, the stack should be popped, to free the buffer into which the processing was done, and restore the "pointer to packet data" and "pointer to end of packet data" members of the netdissect_options structure, so the code can go back to dissecting the original data. The stack will get everything popped off it when dissection is done. Use this mechanism in the ESP decryption code rather than scribbling on top of the input packet data.
2019-03-31 10:26:06 +08:00
*/
Treat the length field in an Ethernet header as such. If we have an Ethernet packet where the last 2 octets of the header are a length rather than an Ethernet type, and it's less than the remaining length of the packet, shorten the length and captured length, update the snapshot end. Turn the buffer stack into a "packet information" stack, so that, if we *do* update the snapshot end, we push the old end onto the stack, and pop it off as soon as we're done dissecting the Ethernet packet, in case there's more data in the packet after the Ethernet packet. Use the stack when we use the IPv4 and IPv6 length fields as well.
2019-04-23 14:48:45 +08:00
nd_pop_all_packet_info(ndo);
Introduce a buffer stack, and use it for ESP decryption. If a dissector has to process its input - decryption, decompression, etc. - rather than dissect the raw input, it should push the processed input onto the buffer stack. As soon as the dissection is done, the stack should be popped, to free the buffer into which the processing was done, and restore the "pointer to packet data" and "pointer to end of packet data" members of the netdissect_options structure, so the code can go back to dissecting the original data. The stack will get everything popped off it when dissection is done. Use this mechanism in the ESP decryption code rather than scribbling on top of the input packet data.
2019-03-31 10:26:06 +08:00
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
/*
* Restore the original snapend, as a printer might have
* changed it.
*/
ndo->ndo_snapend = sp + h->caplen;
if (ndo->ndo_Xflag) {
/*
* Print the raw packet data in hex and ASCII.
*/
if (ndo->ndo_Xflag > 1) {
/*
* Include the link-layer header.
*/
hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
} else {
/*
* Don't include the link-layer header - and if
* we have nothing past the link-layer header,
* print nothing.
*/
if (h->caplen > hdrlen)
hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
Add a sanity check on packet header capture length The capture length must be <= MAXIMUM_SNAPLEN. Now a pachet is valid if: packet length != 0, capture length != 0, capture length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix spaces, indentation.
2018-02-02 01:54:24 +08:00
h->caplen - hdrlen);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
}
} else if (ndo->ndo_xflag) {
/*
* Print the raw packet data in hex.
*/
if (ndo->ndo_xflag > 1) {
/*
* Include the link-layer header.
*/
Add a sanity check on packet header capture length The capture length must be <= MAXIMUM_SNAPLEN. Now a pachet is valid if: packet length != 0, capture length != 0, capture length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix spaces, indentation.
2018-02-02 01:54:24 +08:00
hex_print(ndo, "\n\t", sp, h->caplen);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
} else {
/*
* Don't include the link-layer header - and if
* we have nothing past the link-layer header,
* print nothing.
*/
if (h->caplen > hdrlen)
hex_print(ndo, "\n\t", sp + hdrlen,
Add a sanity check on packet header capture length The capture length must be <= MAXIMUM_SNAPLEN. Now a pachet is valid if: packet length != 0, capture length != 0, capture length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix spaces, indentation.
2018-02-02 01:54:24 +08:00
h->caplen - hdrlen);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
}
} else if (ndo->ndo_Aflag) {
/*
* Print the raw packet data in ASCII.
*/
if (ndo->ndo_Aflag > 1) {
/*
* Include the link-layer header.
*/
ascii_print(ndo, sp, h->caplen);
} else {
/*
* Don't include the link-layer header - and if
* we have nothing past the link-layer header,
* print nothing.
*/
if (h->caplen > hdrlen)
ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
}
}
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("\n");
Add a malloc/free process with garbage collector Use it in the PPP printer.
2018-03-14 20:41:33 +08:00
nd_free_all(ndo);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
}
/*
* By default, print the specified data out in hex and ASCII.
*/
static void
ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
{
hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
}
Lose a few forward declarations in tcpdump.c. Reinstate a few comments in print.c for consistency.
2021-03-29 18:23:21 +08:00
/* VARARGS */
Lose a few forward declarations in print.c.
2021-03-28 20:22:48 +08:00
static void NORETURN PRINTFLIKE(3, 4)
Add a status exit code to the function ndo_error() The status are defined in an enum in status-exit-codes.h. Moreover: Use ndo_error() instead of ndo_warning() for malloc() errors in print-esp.c.
2018-02-25 18:04:39 +08:00
ndo_error(netdissect_options *ndo, status_exit_codes_t status,
Lose a few forward declarations in print.c.
2021-03-28 20:22:48 +08:00
FORMAT_STRING(const char *fmt), ...)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
va_list ap;
Fix style
2018-09-13 20:48:20 +08:00
if (ndo->program_name)
Add program_name field in the netdissect_options structure A program that use the library should set it. Done for tcpdump. ndo_error() and ndo_warning() print now 'ndo->program_name'. Moreover: Fix indent
2015-09-08 01:04:50 +08:00
(void)fprintf(stderr, "%s: ", ndo->program_name);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
va_start(ap, fmt);
(void)vfprintf(stderr, fmt, ap);
va_end(ap);
if (*fmt) {
fmt += strlen(fmt);
if (fmt[-1] != '\n')
(void)fputc('\n', stderr);
}
Move some code around. Move stuff to initialize and clean up libraries that are used by netdissect code into nd_init() and nd_cleanup() routines in libnetdissect; this includes Winsock (which is used on Windows by, for example, the code to get names for IP addresses) and libsmi. Call nd_init() when tcpdump starts up, and call nd_cleanup() when it exits. Move util.c routines to tcpdump.c, and make them static. Use ndo->ndo_error to report a failure to open a file in print-esp.c.
2016-08-05 04:19:57 +08:00
nd_cleanup();
Add a status exit code to the function ndo_error() The status are defined in an enum in status-exit-codes.h. Moreover: Use ndo_error() instead of ndo_warning() for malloc() errors in print-esp.c.
2018-02-25 18:04:39 +08:00
exit(status);
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
/* NOTREACHED */
}
Lose a few forward declarations in tcpdump.c. Reinstate a few comments in print.c for consistency.
2021-03-29 18:23:21 +08:00
/* VARARGS */
Lose a few forward declarations in print.c.
2021-03-28 20:22:48 +08:00
static void PRINTFLIKE(2, 3)
ndo_warning(netdissect_options *ndo, FORMAT_STRING(const char *fmt), ...)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
va_list ap;
Fix style
2018-09-13 20:48:20 +08:00
if (ndo->program_name)
Add program_name field in the netdissect_options structure A program that use the library should set it. Done for tcpdump. ndo_error() and ndo_warning() print now 'ndo->program_name'. Moreover: Fix indent
2015-09-08 01:04:50 +08:00
(void)fprintf(stderr, "%s: ", ndo->program_name);
(void)fprintf(stderr, "WARNING: ");
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
va_start(ap, fmt);
(void)vfprintf(stderr, fmt, ap);
va_end(ap);
if (*fmt) {
fmt += strlen(fmt);
if (fmt[-1] != '\n')
(void)fputc('\n', stderr);
}
}
Lose a few forward declarations in tcpdump.c. Reinstate a few comments in print.c for consistency.
2021-03-29 18:23:21 +08:00
/* VARARGS */
Lose a few forward declarations in print.c.
2021-03-28 20:22:48 +08:00
static int PRINTFLIKE(2, 3)
ndo_printf(netdissect_options *ndo, FORMAT_STRING(const char *fmt), ...)
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
{
va_list args;
int ret;
va_start(args, fmt);
ret = vfprintf(stdout, fmt, args);
va_end(args);
Fix the error handling in 'ndo_printf' function Moreover: Replace strerror() calls with pcap_strerror() calls, in case some platform lacks strerror().
2015-10-13 04:17:01 +08:00
if (ret < 0)
Add a status exit code to the function ndo_error() The status are defined in an enum in status-exit-codes.h. Moreover: Use ndo_error() instead of ndo_warning() for malloc() errors in print-esp.c.
2018-02-25 18:04:39 +08:00
ndo_error(ndo, S_ERR_ND_WRITE_FILE,
"Unable to write output: %s", pcap_strerror(errno));
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
return (ret);
}
void
ndo_set_function_pointers(netdissect_options *ndo)
{
ndo->ndo_default_print=ndo_default_print;
"tcpdump" should not be used in any libnetdissect code. Libnetdissect could be used by programs not named "tcpdump". Rename "tcpdump_printf()" to "ndo_printf()".
2015-09-08 15:53:38 +08:00
ndo->ndo_printf=ndo_printf;
Disentangle packet dissection functionally in tcpdump from the internal libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
2015-04-16 00:39:05 +08:00
ndo->ndo_error=ndo_error;
ndo->ndo_warning=ndo_warning;
}
Reference in New Issue Copy Permalink