1 /* $NetBSD: pcap-common.c,v 1.5 2017/01/24 22:29:28 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1993, 1994, 1995, 1996, 1997 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 * 23 * pcap-common.c - common code for pcap and pcap-ng files 24 */ 25 26 #include <sys/cdefs.h> 27 __RCSID("$NetBSD: pcap-common.c,v 1.5 2017/01/24 22:29:28 christos Exp $"); 28 29 #ifdef HAVE_CONFIG_H 30 #include "config.h" 31 #endif 32 33 #ifdef _WIN32 34 #include <pcap-stdinc.h> 35 #else /* _WIN32 */ 36 #if HAVE_INTTYPES_H 37 #include <inttypes.h> 38 #elif HAVE_STDINT_H 39 #include <stdint.h> 40 #endif 41 #ifdef HAVE_SYS_BITYPES_H 42 #include <sys/bitypes.h> 43 #endif 44 #include <sys/types.h> 45 #endif /* _WIN32 */ 46 47 #include "pcap-int.h" 48 #include "extract.h" 49 #include "pcap/sll.h" 50 #include "pcap/usb.h" 51 #include "pcap/nflog.h" 52 #include "pcap/can_socketcan.h" 53 54 #include "pcap-common.h" 55 56 /* 57 * We don't write DLT_* values to capture files, because they're not the 58 * same on all platforms. 59 * 60 * Unfortunately, the various flavors of BSD have not always used the same 61 * numerical values for the same data types, and various patches to 62 * libpcap for non-BSD OSes have added their own DLT_* codes for link 63 * layer encapsulation types seen on those OSes, and those codes have had, 64 * in some cases, values that were also used, on other platforms, for other 65 * link layer encapsulation types. 66 * 67 * This means that capture files of a type whose numerical DLT_* code 68 * means different things on different BSDs, or with different versions 69 * of libpcap, can't always be read on systems other than those like 70 * the one running on the machine on which the capture was made. 71 * 72 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes 73 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* 74 * codes to DLT_* codes when reading a savefile header. 75 * 76 * For those DLT_* codes that have, as far as we know, the same values on 77 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as 78 * DLT_xxx; that way, captures of those types can still be read by 79 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and 80 * captures of those types written by versions of libpcap that map DLT_ 81 * values to LINKTYPE_ values can still be read by older versions 82 * of libpcap. 83 * 84 * The other LINKTYPE_* codes are given values starting at 100, in the 85 * hopes that no DLT_* code will be given one of those values. 86 * 87 * In order to ensure that a given LINKTYPE_* code's value will refer to 88 * the same encapsulation type on all platforms, you should not allocate 89 * a new LINKTYPE_* value without consulting 90 * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will 91 * allocate a value for you, and will not subsequently allocate it to 92 * anybody else; that value will be added to the "pcap.h" in the 93 * tcpdump.org Git repository, so that a future libpcap release will 94 * include it. 95 * 96 * You should, if possible, also contribute patches to libpcap and tcpdump 97 * to handle the new encapsulation type, so that they can also be checked 98 * into the tcpdump.org Git repository and so that they will appear in 99 * future libpcap and tcpdump releases. 100 * 101 * Do *NOT* assume that any values after the largest value in this file 102 * are available; you might not have the most up-to-date version of this 103 * file, and new values after that one might have been assigned. Also, 104 * do *NOT* use any values below 100 - those might already have been 105 * taken by one (or more!) organizations. 106 * 107 * Any platform that defines additional DLT_* codes should: 108 * 109 * request a LINKTYPE_* code and value from tcpdump.org, 110 * as per the above; 111 * 112 * add, in their version of libpcap, an entry to map 113 * those DLT_* codes to the corresponding LINKTYPE_* 114 * code; 115 * 116 * redefine, in their "net/bpf.h", any DLT_* values 117 * that collide with the values used by their additional 118 * DLT_* codes, to remove those collisions (but without 119 * making them collide with any of the LINKTYPE_* 120 * values equal to 50 or above; they should also avoid 121 * defining DLT_* values that collide with those 122 * LINKTYPE_* values, either). 123 */ 124 #define LINKTYPE_NULL DLT_NULL 125 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ 126 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ 127 #define LINKTYPE_AX25 DLT_AX25 128 #define LINKTYPE_PRONET DLT_PRONET 129 #define LINKTYPE_CHAOS DLT_CHAOS 130 #define LINKTYPE_IEEE802_5 DLT_IEEE802 /* DLT_IEEE802 is used for 802.5 Token Ring */ 131 #define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */ 132 #define LINKTYPE_SLIP DLT_SLIP 133 #define LINKTYPE_PPP DLT_PPP 134 #define LINKTYPE_FDDI DLT_FDDI 135 136 /* 137 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 138 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol 139 * field) at the beginning of the packet. 140 * 141 * This is for use when there is always such a header; the address field 142 * might be 0xff, for regular PPP, or it might be an address field for Cisco 143 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco 144 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. 145 * 146 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that 147 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL 148 * captures will be written out with a link type that NetBSD's tcpdump 149 * can read. 150 */ 151 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ 152 153 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */ 154 155 #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */ 156 157 /* 158 * These correspond to DLT_s that have different values on different 159 * platforms; we map between these values in capture files and 160 * the DLT_ values as returned by pcap_datalink() and passed to 161 * pcap_open_dead(). 162 */ 163 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ 164 #define LINKTYPE_RAW 101 /* raw IP */ 165 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ 166 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ 167 168 /* 169 * Values starting with 104 are used for newly-assigned link-layer 170 * header type values; for those link-layer header types, the DLT_ 171 * value returned by pcap_datalink() and passed to pcap_open_dead(), 172 * and the LINKTYPE_ value that appears in capture files, are the 173 * same. 174 * 175 * LINKTYPE_MATCHING_MIN is the lowest such value; LINKTYPE_MATCHING_MAX 176 * is the highest such value. 177 */ 178 #define LINKTYPE_MATCHING_MIN 104 /* lowest value in the "matching" range */ 179 180 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ 181 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ 182 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ 183 #define LINKTYPE_FRELAY 107 /* Frame Relay */ 184 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */ 185 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ 186 187 /* 188 * These three types are reserved for future use. 189 */ 190 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ 191 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ 192 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ 193 194 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ 195 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */ 196 #define LINKTYPE_ECONET 115 /* Acorn Econet */ 197 198 /* 199 * Reserved for use with OpenBSD ipfilter. 200 */ 201 #define LINKTYPE_IPFILTER 116 202 203 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ 204 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */ 205 #define LINKTYPE_IEEE802_11_PRISM 119 /* 802.11 plus Prism II monitor mode radio metadata header */ 206 #define LINKTYPE_IEEE802_11_AIRONET 120 /* 802.11 plus FreeBSD Aironet driver radio metadata header */ 207 208 /* 209 * Reserved for Siemens HiPath HDLC. 210 */ 211 #define LINKTYPE_HHDLC 121 212 213 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */ 214 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */ 215 216 /* 217 * Reserved as per request from Kent Dahlgren <kent@praesum.com> 218 * for private use. 219 */ 220 #define LINKTYPE_RIO 124 /* RapidIO */ 221 #define LINKTYPE_PCI_EXP 125 /* PCI Express */ 222 #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */ 223 224 #define LINKTYPE_IEEE802_11_RADIOTAP 127 /* 802.11 plus radiotap radio metadata header */ 225 226 /* 227 * Reserved for the TZSP encapsulation, as per request from 228 * Chris Waters <chris.waters@networkchemistry.com> 229 * TZSP is a generic encapsulation for any other link type, 230 * which includes a means to include meta-information 231 * with the packet, e.g. signal strength and channel 232 * for 802.11 packets. 233 */ 234 #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */ 235 236 #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */ 237 238 /* 239 * Juniper-private data link types, as per request from 240 * Hannes Gredler <hannes@juniper.net>. The corresponding 241 * DLT_s are used for passing on chassis-internal 242 * metainformation such as QOS profiles, etc.. 243 */ 244 #define LINKTYPE_JUNIPER_MLPPP 130 245 #define LINKTYPE_JUNIPER_MLFR 131 246 #define LINKTYPE_JUNIPER_ES 132 247 #define LINKTYPE_JUNIPER_GGSN 133 248 #define LINKTYPE_JUNIPER_MFR 134 249 #define LINKTYPE_JUNIPER_ATM2 135 250 #define LINKTYPE_JUNIPER_SERVICES 136 251 #define LINKTYPE_JUNIPER_ATM1 137 252 253 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */ 254 255 #define LINKTYPE_MTP2_WITH_PHDR 139 256 #define LINKTYPE_MTP2 140 257 #define LINKTYPE_MTP3 141 258 #define LINKTYPE_SCCP 142 259 260 #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */ 261 262 #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */ 263 264 /* 265 * Reserved for IBM SP switch and IBM Next Federation switch. 266 */ 267 #define LINKTYPE_IBM_SP 145 268 #define LINKTYPE_IBM_SN 146 269 270 /* 271 * Reserved for private use. If you have some link-layer header type 272 * that you want to use within your organization, with the capture files 273 * using that link-layer header type not ever be sent outside your 274 * organization, you can use these values. 275 * 276 * No libpcap release will use these for any purpose, nor will any 277 * tcpdump release use them, either. 278 * 279 * Do *NOT* use these in capture files that you expect anybody not using 280 * your private versions of capture-file-reading tools to read; in 281 * particular, do *NOT* use them in products, otherwise you may find that 282 * people won't be able to use tcpdump, or snort, or Ethereal, or... to 283 * read capture files from your firewall/intrusion detection/traffic 284 * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value, 285 * and you may also find that the developers of those applications will 286 * not accept patches to let them read those files. 287 * 288 * Also, do not use them if somebody might send you a capture using them 289 * for *their* private type and tools using them for *your* private type 290 * would have to read them. 291 * 292 * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a 293 * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use 294 * the type you're given. 295 */ 296 #define LINKTYPE_USER0 147 297 #define LINKTYPE_USER1 148 298 #define LINKTYPE_USER2 149 299 #define LINKTYPE_USER3 150 300 #define LINKTYPE_USER4 151 301 #define LINKTYPE_USER5 152 302 #define LINKTYPE_USER6 153 303 #define LINKTYPE_USER7 154 304 #define LINKTYPE_USER8 155 305 #define LINKTYPE_USER9 156 306 #define LINKTYPE_USER10 157 307 #define LINKTYPE_USER11 158 308 #define LINKTYPE_USER12 159 309 #define LINKTYPE_USER13 160 310 #define LINKTYPE_USER14 161 311 #define LINKTYPE_USER15 162 312 313 /* 314 * For future use with 802.11 captures - defined by AbsoluteValue 315 * Systems to store a number of bits of link-layer information 316 * including radio information: 317 * 318 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 319 */ 320 #define LINKTYPE_IEEE802_11_AVS 163 /* 802.11 plus AVS radio metadata header */ 321 322 /* 323 * Juniper-private data link type, as per request from 324 * Hannes Gredler <hannes@juniper.net>. The corresponding 325 * DLT_s are used for passing on chassis-internal 326 * metainformation such as QOS profiles, etc.. 327 */ 328 #define LINKTYPE_JUNIPER_MONITOR 164 329 330 /* 331 * BACnet MS/TP frames. 332 */ 333 #define LINKTYPE_BACNET_MS_TP 165 334 335 /* 336 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. 337 * 338 * This is used in some OSes to allow a kernel socket filter to distinguish 339 * between incoming and outgoing packets, on a socket intended to 340 * supply pppd with outgoing packets so it can do dial-on-demand and 341 * hangup-on-lack-of-demand; incoming packets are filtered out so they 342 * don't cause pppd to hold the connection up (you don't want random 343 * input packets such as port scans, packets from old lost connections, 344 * etc. to force the connection to stay up). 345 * 346 * The first byte of the PPP header (0xff03) is modified to accomodate 347 * the direction - 0x00 = IN, 0x01 = OUT. 348 */ 349 #define LINKTYPE_PPP_PPPD 166 350 351 /* 352 * Juniper-private data link type, as per request from 353 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 354 * for passing on chassis-internal metainformation such as 355 * QOS profiles, cookies, etc.. 356 */ 357 #define LINKTYPE_JUNIPER_PPPOE 167 358 #define LINKTYPE_JUNIPER_PPPOE_ATM 168 359 360 #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */ 361 #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 362 #define LINKTYPE_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ 363 364 /* 365 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line 366 * monitoring equipment. 367 */ 368 #define LINKTYPE_GCOM_T1E1 172 369 #define LINKTYPE_GCOM_SERIAL 173 370 371 /* 372 * Juniper-private data link type, as per request from 373 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used 374 * for internal communication to Physical Interface Cards (PIC) 375 */ 376 #define LINKTYPE_JUNIPER_PIC_PEER 174 377 378 /* 379 * Link types requested by Gregor Maier <gregor@endace.com> of Endace 380 * Measurement Systems. They add an ERF header (see 381 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of 382 * the link-layer header. 383 */ 384 #define LINKTYPE_ERF_ETH 175 /* Ethernet */ 385 #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */ 386 387 /* 388 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD 389 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header 390 * includes additional information before the LAPD header, so it's 391 * not necessarily a generic LAPD header. 392 */ 393 #define LINKTYPE_LINUX_LAPD 177 394 395 /* 396 * Juniper-private data link type, as per request from 397 * Hannes Gredler <hannes@juniper.net>. 398 * The Link Types are used for prepending meta-information 399 * like interface index, interface name 400 * before standard Ethernet, PPP, Frelay & C-HDLC Frames 401 */ 402 #define LINKTYPE_JUNIPER_ETHER 178 403 #define LINKTYPE_JUNIPER_PPP 179 404 #define LINKTYPE_JUNIPER_FRELAY 180 405 #define LINKTYPE_JUNIPER_CHDLC 181 406 407 /* 408 * Multi Link Frame Relay (FRF.16) 409 */ 410 #define LINKTYPE_MFR 182 411 412 /* 413 * Juniper-private data link type, as per request from 414 * Hannes Gredler <hannes@juniper.net>. 415 * The DLT_ is used for internal communication with a 416 * voice Adapter Card (PIC) 417 */ 418 #define LINKTYPE_JUNIPER_VP 183 419 420 /* 421 * Arinc 429 frames. 422 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 423 * Every frame contains a 32bit A429 label. 424 * More documentation on Arinc 429 can be found at 425 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf 426 */ 427 #define LINKTYPE_A429 184 428 429 /* 430 * Arinc 653 Interpartition Communication messages. 431 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 432 * Please refer to the A653-1 standard for more information. 433 */ 434 #define LINKTYPE_A653_ICM 185 435 436 /* 437 * This used to be "USB packets, beginning with a USB setup header; 438 * requested by Paolo Abeni <paolo.abeni@email.it>." 439 * 440 * However, that header didn't work all that well - it left out some 441 * useful information - and was abandoned in favor of the DLT_USB_LINUX 442 * header. 443 * 444 * This is now used by FreeBSD for its BPF taps for USB; that has its 445 * own headers. So it is written, so it is done. 446 */ 447 #define LINKTYPE_USB_FREEBSD 186 448 449 /* 450 * Bluetooth HCI UART transport layer (part H:4); requested by 451 * Paolo Abeni. 452 */ 453 #define LINKTYPE_BLUETOOTH_HCI_H4 187 454 455 /* 456 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz 457 * <cruz_petagay@bah.com>. 458 */ 459 #define LINKTYPE_IEEE802_16_MAC_CPS 188 460 461 /* 462 * USB packets, beginning with a Linux USB header; requested by 463 * Paolo Abeni <paolo.abeni@email.it>. 464 */ 465 #define LINKTYPE_USB_LINUX 189 466 467 /* 468 * Controller Area Network (CAN) v. 2.0B packets. 469 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 470 * Used to dump CAN packets coming from a CAN Vector board. 471 * More documentation on the CAN v2.0B frames can be found at 472 * http://www.can-cia.org/downloads/?269 473 */ 474 #define LINKTYPE_CAN20B 190 475 476 /* 477 * IEEE 802.15.4, with address fields padded, as is done by Linux 478 * drivers; requested by Juergen Schimmer. 479 */ 480 #define LINKTYPE_IEEE802_15_4_LINUX 191 481 482 /* 483 * Per Packet Information encapsulated packets. 484 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 485 */ 486 #define LINKTYPE_PPI 192 487 488 /* 489 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; 490 * requested by Charles Clancy. 491 */ 492 #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193 493 494 /* 495 * Juniper-private data link type, as per request from 496 * Hannes Gredler <hannes@juniper.net>. 497 * The DLT_ is used for internal communication with a 498 * integrated service module (ISM). 499 */ 500 #define LINKTYPE_JUNIPER_ISM 194 501 502 /* 503 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 504 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>. 505 */ 506 #define LINKTYPE_IEEE802_15_4 195 507 508 /* 509 * Various link-layer types, with a pseudo-header, for SITA 510 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). 511 */ 512 #define LINKTYPE_SITA 196 513 514 /* 515 * Various link-layer types, with a pseudo-header, for Endace DAG cards; 516 * encapsulates Endace ERF records. Requested by Stephen Donnelly 517 * <stephen@endace.com>. 518 */ 519 #define LINKTYPE_ERF 197 520 521 /* 522 * Special header prepended to Ethernet packets when capturing from a 523 * u10 Networks board. Requested by Phil Mulholland 524 * <phil@u10networks.com>. 525 */ 526 #define LINKTYPE_RAIF1 198 527 528 /* 529 * IPMB packet for IPMI, beginning with the I2C slave address, followed 530 * by the netFn and LUN, etc.. Requested by Chanthy Toeung 531 * <chanthy.toeung@ca.kontron.com>. 532 */ 533 #define LINKTYPE_IPMB 199 534 535 /* 536 * Juniper-private data link type, as per request from 537 * Hannes Gredler <hannes@juniper.net>. 538 * The DLT_ is used for capturing data on a secure tunnel interface. 539 */ 540 #define LINKTYPE_JUNIPER_ST 200 541 542 /* 543 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header 544 * that includes direction information; requested by Paolo Abeni. 545 */ 546 #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201 547 548 /* 549 * AX.25 packet with a 1-byte KISS header; see 550 * 551 * http://www.ax25.net/kiss.htm 552 * 553 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. 554 */ 555 #define LINKTYPE_AX25_KISS 202 556 557 /* 558 * LAPD packets from an ISDN channel, starting with the address field, 559 * with no pseudo-header. 560 * Requested by Varuna De Silva <varunax@gmail.com>. 561 */ 562 #define LINKTYPE_LAPD 203 563 564 /* 565 * Variants of various link-layer headers, with a one-byte direction 566 * pseudo-header prepended - zero means "received by this host", 567 * non-zero (any non-zero value) means "sent by this host" - as per 568 * Will Barker <w.barker@zen.co.uk>. 569 */ 570 #define LINKTYPE_PPP_WITH_DIR 204 /* PPP */ 571 #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ 572 #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */ 573 #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */ 574 575 /* 576 * 208 is reserved for an as-yet-unspecified proprietary link-layer 577 * type, as requested by Will Barker. 578 */ 579 580 /* 581 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman 582 * <avn@pigeonpoint.com>. 583 */ 584 #define LINKTYPE_IPMB_LINUX 209 585 586 /* 587 * FlexRay automotive bus - http://www.flexray.com/ - as requested 588 * by Hannes Kaelber <hannes.kaelber@x2e.de>. 589 */ 590 #define LINKTYPE_FLEXRAY 210 591 592 /* 593 * Media Oriented Systems Transport (MOST) bus for multimedia 594 * transport - http://www.mostcooperation.com/ - as requested 595 * by Hannes Kaelber <hannes.kaelber@x2e.de>. 596 */ 597 #define LINKTYPE_MOST 211 598 599 /* 600 * Local Interconnect Network (LIN) bus for vehicle networks - 601 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber 602 * <hannes.kaelber@x2e.de>. 603 */ 604 #define LINKTYPE_LIN 212 605 606 /* 607 * X2E-private data link type used for serial line capture, 608 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 609 */ 610 #define LINKTYPE_X2E_SERIAL 213 611 612 /* 613 * X2E-private data link type used for the Xoraya data logger 614 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 615 */ 616 #define LINKTYPE_X2E_XORAYA 214 617 618 /* 619 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 620 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets 621 * of 0 as preamble, one octet of SFD, one octet of frame length+ 622 * reserved bit, and then the MAC-layer data, starting with the 623 * frame control field). 624 * 625 * Requested by Max Filippov <jcmvbkbc@gmail.com>. 626 */ 627 #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215 628 629 /* 630 * David Gibson <david@gibson.dropbear.id.au> requested this for 631 * captures from the Linux kernel /dev/input/eventN devices. This 632 * is used to communicate keystrokes and mouse movements from the 633 * Linux kernel to display systems, such as Xorg. 634 */ 635 #define LINKTYPE_LINUX_EVDEV 216 636 637 /* 638 * GSM Um and Abis interfaces, preceded by a "gsmtap" header. 639 * 640 * Requested by Harald Welte <laforge@gnumonks.org>. 641 */ 642 #define LINKTYPE_GSMTAP_UM 217 643 #define LINKTYPE_GSMTAP_ABIS 218 644 645 /* 646 * MPLS, with an MPLS label as the link-layer header. 647 * Requested by Michele Marchetto <michele@openbsd.org> on behalf 648 * of OpenBSD. 649 */ 650 #define LINKTYPE_MPLS 219 651 652 /* 653 * USB packets, beginning with a Linux USB header, with the USB header 654 * padded to 64 bytes; required for memory-mapped access. 655 */ 656 #define LINKTYPE_USB_LINUX_MMAPPED 220 657 658 /* 659 * DECT packets, with a pseudo-header; requested by 660 * Matthias Wenzel <tcpdump@mazzoo.de>. 661 */ 662 #define LINKTYPE_DECT 221 663 664 /* 665 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> 666 * Date: Mon, 11 May 2009 11:18:30 -0500 667 * 668 * DLT_AOS. We need it for AOS Space Data Link Protocol. 669 * I have already written dissectors for but need an OK from 670 * legal before I can submit a patch. 671 * 672 */ 673 #define LINKTYPE_AOS 222 674 675 /* 676 * Wireless HART (Highway Addressable Remote Transducer) 677 * From the HART Communication Foundation 678 * IES/PAS 62591 679 * 680 * Requested by Sam Roberts <vieuxtech@gmail.com>. 681 */ 682 #define LINKTYPE_WIHART 223 683 684 /* 685 * Fibre Channel FC-2 frames, beginning with a Frame_Header. 686 * Requested by Kahou Lei <kahou82@gmail.com>. 687 */ 688 #define LINKTYPE_FC_2 224 689 690 /* 691 * Fibre Channel FC-2 frames, beginning with an encoding of the 692 * SOF, and ending with an encoding of the EOF. 693 * 694 * The encodings represent the frame delimiters as 4-byte sequences 695 * representing the corresponding ordered sets, with K28.5 696 * represented as 0xBC, and the D symbols as the corresponding 697 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, 698 * is represented as 0xBC 0xB5 0x55 0x55. 699 * 700 * Requested by Kahou Lei <kahou82@gmail.com>. 701 */ 702 #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225 703 704 /* 705 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. 706 * 707 * The pseudo-header starts with a one-byte version number; for version 2, 708 * the pseudo-header is: 709 * 710 * struct dl_ipnetinfo { 711 * u_int8_t dli_version; 712 * u_int8_t dli_family; 713 * u_int16_t dli_htype; 714 * u_int32_t dli_pktlen; 715 * u_int32_t dli_ifindex; 716 * u_int32_t dli_grifindex; 717 * u_int32_t dli_zsrc; 718 * u_int32_t dli_zdst; 719 * }; 720 * 721 * dli_version is 2 for the current version of the pseudo-header. 722 * 723 * dli_family is a Solaris address family value, so it's 2 for IPv4 724 * and 26 for IPv6. 725 * 726 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing 727 * packets, and 2 for packets arriving from another zone on the same 728 * machine. 729 * 730 * dli_pktlen is the length of the packet data following the pseudo-header 731 * (so the captured length minus dli_pktlen is the length of the 732 * pseudo-header, assuming the entire pseudo-header was captured). 733 * 734 * dli_ifindex is the interface index of the interface on which the 735 * packet arrived. 736 * 737 * dli_grifindex is the group interface index number (for IPMP interfaces). 738 * 739 * dli_zsrc is the zone identifier for the source of the packet. 740 * 741 * dli_zdst is the zone identifier for the destination of the packet. 742 * 743 * A zone number of 0 is the global zone; a zone number of 0xffffffff 744 * means that the packet arrived from another host on the network, not 745 * from another zone on the same machine. 746 * 747 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates 748 * which of those it is. 749 */ 750 #define LINKTYPE_IPNET 226 751 752 /* 753 * CAN (Controller Area Network) frames, with a pseudo-header as supplied 754 * by Linux SocketCAN, and with multi-byte numerical fields in that header 755 * in big-endian byte order. 756 * 757 * See Documentation/networking/can.txt in the Linux source. 758 * 759 * Requested by Felix Obenhuber <felix@obenhuber.de>. 760 */ 761 #define LINKTYPE_CAN_SOCKETCAN 227 762 763 /* 764 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies 765 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. 766 */ 767 #define LINKTYPE_IPV4 228 768 #define LINKTYPE_IPV6 229 769 770 /* 771 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 772 * nothing), and with no FCS at the end of the frame; requested by 773 * Jon Smirl <jonsmirl@gmail.com>. 774 */ 775 #define LINKTYPE_IEEE802_15_4_NOFCS 230 776 777 /* 778 * Raw D-Bus: 779 * 780 * http://www.freedesktop.org/wiki/Software/dbus 781 * 782 * messages: 783 * 784 * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 785 * 786 * starting with the endianness flag, followed by the message type, etc., 787 * but without the authentication handshake before the message sequence: 788 * 789 * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol 790 * 791 * Requested by Martin Vidner <martin@vidner.net>. 792 */ 793 #define LINKTYPE_DBUS 231 794 795 /* 796 * Juniper-private data link type, as per request from 797 * Hannes Gredler <hannes@juniper.net>. 798 */ 799 #define LINKTYPE_JUNIPER_VS 232 800 #define LINKTYPE_JUNIPER_SRX_E2E 233 801 #define LINKTYPE_JUNIPER_FIBRECHANNEL 234 802 803 /* 804 * DVB-CI (DVB Common Interface for communication between a PC Card 805 * module and a DVB receiver). See 806 * 807 * http://www.kaiser.cx/pcap-dvbci.html 808 * 809 * for the specification. 810 * 811 * Requested by Martin Kaiser <martin@kaiser.cx>. 812 */ 813 #define LINKTYPE_DVB_CI 235 814 815 /* 816 * Variant of 3GPP TS 27.010 multiplexing protocol. Requested 817 * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>. 818 */ 819 #define LINKTYPE_MUX27010 236 820 821 /* 822 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray 823 * <barisdemiray@gmail.com>. 824 */ 825 #define LINKTYPE_STANAG_5066_D_PDU 237 826 827 /* 828 * Juniper-private data link type, as per request from 829 * Hannes Gredler <hannes@juniper.net>. 830 */ 831 #define LINKTYPE_JUNIPER_ATM_CEMIC 238 832 833 /* 834 * NetFilter LOG messages 835 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) 836 * 837 * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> 838 */ 839 #define LINKTYPE_NFLOG 239 840 841 /* 842 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 843 * for Ethernet packets with a 4-byte pseudo-header and always 844 * with the payload including the FCS, as supplied by their 845 * netANALYZER hardware and software. 846 * 847 * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 848 */ 849 #define LINKTYPE_NETANALYZER 240 850 851 /* 852 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 853 * for Ethernet packets with a 4-byte pseudo-header and FCS and 854 * 1 byte of SFD, as supplied by their netANALYZER hardware and 855 * software. 856 * 857 * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 858 */ 859 #define LINKTYPE_NETANALYZER_TRANSPARENT 241 860 861 /* 862 * IP-over-InfiniBand, as specified by RFC 4391. 863 * 864 * Requested by Petr Sumbera <petr.sumbera@oracle.com>. 865 */ 866 #define LINKTYPE_IPOIB 242 867 868 /* 869 * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). 870 * 871 * Requested by Guy Martin <gmsoft@tuxicoman.be>. 872 */ 873 #define LINKTYPE_MPEG_2_TS 243 874 875 /* 876 * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as 877 * used by their ng40 protocol tester. 878 * 879 * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. 880 */ 881 #define LINKTYPE_NG40 244 882 883 /* 884 * Pseudo-header giving adapter number and flags, followed by an NFC 885 * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, 886 * as specified by NFC Forum Logical Link Control Protocol Technical 887 * Specification LLCP 1.1. 888 * 889 * Requested by Mike Wakerly <mikey@google.com>. 890 */ 891 #define LINKTYPE_NFC_LLCP 245 892 893 /* 894 * pfsync output; DLT_PFSYNC is 18, which collides with DLT_CIP in 895 * SuSE 6.3, on OpenBSD, NetBSD, DragonFly BSD, and Mac OS X, and 896 * is 121, which collides with DLT_HHDLC, in FreeBSD. We pick a 897 * shiny new link-layer header type value that doesn't collide with 898 * anything, in the hopes that future pfsync savefiles, if any, 899 * won't require special hacks to distinguish from other savefiles. 900 * 901 */ 902 #define LINKTYPE_PFSYNC 246 903 904 /* 905 * Raw InfiniBand packets, starting with the Local Routing Header. 906 * 907 * Requested by Oren Kladnitsky <orenk@mellanox.com>. 908 */ 909 #define LINKTYPE_INFINIBAND 247 910 911 /* 912 * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). 913 * 914 * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>. 915 */ 916 #define LINKTYPE_SCTP 248 917 918 /* 919 * USB packets, beginning with a USBPcap header. 920 * 921 * Requested by Tomasz Mon <desowin@gmail.com> 922 */ 923 #define LINKTYPE_USBPCAP 249 924 925 /* 926 * Schweitzer Engineering Laboratories "RTAC" product serial-line 927 * packets. 928 * 929 * Requested by Chris Bontje <chris_bontje@selinc.com>. 930 */ 931 #define DLT_RTAC_SERIAL 250 932 933 /* 934 * Bluetooth Low Energy air interface link-layer packets. 935 * 936 * Requested by Mike Kershaw <dragorn@kismetwireless.net>. 937 */ 938 #define LINKTYPE_BLUETOOTH_LE_LL 251 939 940 /* 941 * Link-layer header type for upper-protocol layer PDU saves from wireshark. 942 * 943 * the actual contents are determined by two TAGs stored with each 944 * packet: 945 * EXP_PDU_TAG_LINKTYPE the link type (LINKTYPE_ value) of the 946 * original packet. 947 * 948 * EXP_PDU_TAG_PROTO_NAME the name of the wireshark dissector 949 * that can make sense of the data stored. 950 */ 951 #define LINKTYPE_WIRESHARK_UPPER_PDU 252 952 953 /* 954 * Link-layer header type for the netlink protocol (nlmon devices). 955 */ 956 #define LINKTYPE_NETLINK 253 957 958 /* 959 * Bluetooth Linux Monitor headers for the BlueZ stack. 960 */ 961 #define LINKTYPE_BLUETOOTH_LINUX_MONITOR 254 962 963 /* 964 * Bluetooth Basic Rate/Enhanced Data Rate baseband packets, as 965 * captured by Ubertooth. 966 */ 967 #define LINKTYPE_BLUETOOTH_BREDR_BB 255 968 969 /* 970 * Bluetooth Low Energy link layer packets, as captured by Ubertooth. 971 */ 972 #define LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR 256 973 974 /* 975 * PROFIBUS data link layer. 976 */ 977 #define LINKTYPE_PROFIBUS_DL 257 978 979 /* 980 * Apple's DLT_PKTAP headers. 981 * 982 * Sadly, the folks at Apple either had no clue that the DLT_USERn values 983 * are for internal use within an organization and partners only, and 984 * didn't know that the right way to get a link-layer header type is to 985 * ask tcpdump.org for one, or knew and didn't care, so they just 986 * used DLT_USER2, which causes problems for everything except for 987 * their version of tcpdump. 988 * 989 * So I'll just give them one; hopefully this will show up in a 990 * libpcap release in time for them to get this into 10.10 Big Sur 991 * or whatever Mavericks' successor is called. LINKTYPE_PKTAP 992 * will be 258 *even on OS X*; that is *intentional*, so that 993 * PKTAP files look the same on *all* OSes (different OSes can have 994 * different numerical values for a given DLT_, but *MUST NOT* have 995 * different values for what goes in a file, as files can be moved 996 * between OSes!). 997 */ 998 #define LINKTYPE_PKTAP 258 999 1000 /* 1001 * Ethernet packets preceded by a header giving the last 6 octets 1002 * of the preamble specified by 802.3-2012 Clause 65, section 1003 * 65.1.3.2 "Transmit". 1004 */ 1005 #define LINKTYPE_EPON 259 1006 1007 /* 1008 * IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" 1009 * in the PICMG HPM.2 specification. 1010 */ 1011 #define LINKTYPE_IPMI_HPM_2 260 1012 1013 /* 1014 * per Joshua Wright <jwright@hasborg.com>, formats for Zwave captures. 1015 */ 1016 #define LINKTYPE_ZWAVE_R1_R2 261 1017 #define LINKTYPE_ZWAVE_R3 262 1018 1019 /* 1020 * per Steve Karg <skarg@users.sourceforge.net>, formats for Wattstopper 1021 * Digital Lighting Management room bus serial protocol captures. 1022 */ 1023 #define LINKTYPE_WATTSTOPPER_DLM 263 1024 1025 /* 1026 * ISO 14443 contactless smart card messages. 1027 */ 1028 #define LINKTYPE_ISO_14443 264 1029 1030 /* 1031 * Radio data system (RDS) groups. IEC 62106. 1032 * Per Jonathan Brucker <jonathan.brucke@gmail.com>. 1033 */ 1034 #define LINKTYPE_RDS 265 1035 1036 #define LINKTYPE_MATCHING_MAX 265 /* highest value in the "matching" range */ 1037 1038 static struct linktype_map { 1039 int dlt; 1040 int linktype; 1041 } map[] = { 1042 /* 1043 * These DLT_* codes have LINKTYPE_* codes with values identical 1044 * to the values of the corresponding DLT_* code. 1045 */ 1046 { DLT_NULL, LINKTYPE_NULL }, 1047 { DLT_EN10MB, LINKTYPE_ETHERNET }, 1048 { DLT_EN3MB, LINKTYPE_EXP_ETHERNET }, 1049 { DLT_AX25, LINKTYPE_AX25 }, 1050 { DLT_PRONET, LINKTYPE_PRONET }, 1051 { DLT_CHAOS, LINKTYPE_CHAOS }, 1052 { DLT_IEEE802, LINKTYPE_IEEE802_5 }, 1053 { DLT_ARCNET, LINKTYPE_ARCNET_BSD }, 1054 { DLT_SLIP, LINKTYPE_SLIP }, 1055 { DLT_PPP, LINKTYPE_PPP }, 1056 { DLT_FDDI, LINKTYPE_FDDI }, 1057 { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL }, 1058 1059 /* 1060 * These DLT_* codes have different values on different 1061 * platforms; we map them to LINKTYPE_* codes that 1062 * have values that should never be equal to any DLT_* 1063 * code. 1064 */ 1065 #ifdef DLT_FR 1066 /* BSD/OS Frame Relay */ 1067 { DLT_FR, LINKTYPE_FRELAY }, 1068 #endif 1069 1070 { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 }, 1071 { DLT_RAW, LINKTYPE_RAW }, 1072 { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS }, 1073 { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS }, 1074 1075 /* BSD/OS Cisco HDLC */ 1076 { DLT_C_HDLC, LINKTYPE_C_HDLC }, 1077 1078 /* 1079 * These DLT_* codes are not on all platforms, but, so far, 1080 * there don't appear to be any platforms that define 1081 * other codes with those values; we map them to 1082 * different LINKTYPE_* values anyway, just in case. 1083 */ 1084 1085 /* Linux ATM Classical IP */ 1086 { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP }, 1087 1088 /* NetBSD sync/async serial PPP (or Cisco HDLC) */ 1089 { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC }, 1090 1091 /* NetBSD PPP over Ethernet */ 1092 { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER }, 1093 1094 /* 1095 * All LINKTYPE_ values between LINKTYPE_MATCHING_MIN 1096 * and LINKTYPE_MATCHING_MAX are mapped to identical 1097 * DLT_ values. 1098 */ 1099 1100 { -1, -1 } 1101 }; 1102 1103 int 1104 dlt_to_linktype(int dlt) 1105 { 1106 int i; 1107 1108 /* 1109 * DLTs that, on some platforms, have values in the matching range 1110 * but that *don't* have the same value as the corresponding 1111 * LINKTYPE because, for some reason, not all OSes have the 1112 * same value for that DLT (note that the DLT's value might be 1113 * outside the matching range on some of those OSes). 1114 */ 1115 if (dlt == DLT_PFSYNC) 1116 return (LINKTYPE_PFSYNC); 1117 if (dlt == DLT_PKTAP) 1118 return (LINKTYPE_PKTAP); 1119 1120 /* 1121 * For all other values in the matching range, the DLT 1122 * value is the same as the LINKTYPE value. 1123 */ 1124 if (dlt >= DLT_MATCHING_MIN && dlt <= DLT_MATCHING_MAX) 1125 return (dlt); 1126 1127 /* 1128 * Map the values outside that range. 1129 */ 1130 for (i = 0; map[i].dlt != -1; i++) { 1131 if (map[i].dlt == dlt) 1132 return (map[i].linktype); 1133 } 1134 1135 /* 1136 * If we don't have a mapping for this DLT, return an 1137 * error; that means that this is a value with no corresponding 1138 * LINKTYPE, and we need to assign one. 1139 */ 1140 return (-1); 1141 } 1142 1143 int 1144 linktype_to_dlt(int linktype) 1145 { 1146 int i; 1147 1148 /* 1149 * LINKTYPEs in the matching range that *don't* 1150 * have the same value as the corresponding DLTs 1151 * because, for some reason, not all OSes have the 1152 * same value for that DLT. 1153 */ 1154 if (linktype == LINKTYPE_PFSYNC) 1155 return (DLT_PFSYNC); 1156 if (linktype == LINKTYPE_PKTAP) 1157 return (DLT_PKTAP); 1158 1159 /* 1160 * For all other values in the matching range, the LINKTYPE 1161 * value is the same as the DLT value. 1162 */ 1163 if (linktype >= LINKTYPE_MATCHING_MIN && 1164 linktype <= LINKTYPE_MATCHING_MAX) 1165 return (linktype); 1166 1167 /* 1168 * Map the values outside that range. 1169 */ 1170 for (i = 0; map[i].linktype != -1; i++) { 1171 if (map[i].linktype == linktype) 1172 return (map[i].dlt); 1173 } 1174 1175 /* 1176 * If we don't have an entry for this LINKTYPE, return 1177 * the link type value; it may be a DLT from an older 1178 * version of libpcap. 1179 */ 1180 return linktype; 1181 } 1182 1183 #define EXTRACT_ 1184 1185 /* 1186 * DLT_LINUX_SLL packets with a protocol type of LINUX_SLL_P_CAN or 1187 * LINUX_SLL_P_CANFD have SocketCAN headers in front of the payload, 1188 * with the CAN ID being in host byte order. 1189 * 1190 * When reading a DLT_LINUX_SLL capture file, we need to check for those 1191 * packets and convert the CAN ID from the byte order of the host that 1192 * wrote the file to this host's byte order. 1193 */ 1194 static void 1195 swap_linux_sll_header(const struct pcap_pkthdr *hdr, u_char *buf) 1196 { 1197 u_int caplen = hdr->caplen; 1198 u_int length = hdr->len; 1199 struct sll_header *shdr = (struct sll_header *)buf; 1200 u_int16_t protocol; 1201 pcap_can_socketcan_hdr *chdr; 1202 1203 if (caplen < (u_int) sizeof(struct sll_header) || 1204 length < (u_int) sizeof(struct sll_header)) { 1205 /* Not enough data to have the protocol field */ 1206 return; 1207 } 1208 1209 protocol = EXTRACT_16BITS(&shdr->sll_protocol); 1210 if (protocol != LINUX_SLL_P_CAN && protocol != LINUX_SLL_P_CANFD) 1211 return; 1212 1213 /* 1214 * SocketCAN packet; fix up the packet's header. 1215 */ 1216 chdr = (pcap_can_socketcan_hdr *)(buf + sizeof(struct sll_header)); 1217 if (caplen < (u_int) sizeof(struct sll_header) + sizeof(chdr->can_id) || 1218 length < (u_int) sizeof(struct sll_header) + sizeof(chdr->can_id)) { 1219 /* Not enough data to have the CAN ID */ 1220 return; 1221 } 1222 chdr->can_id = SWAPLONG(chdr->can_id); 1223 } 1224 1225 /* 1226 * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host 1227 * byte order when capturing (it's supplied directly from a 1228 * memory-mapped buffer shared by the kernel). 1229 * 1230 * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file, 1231 * we need to convert it from the byte order of the host that wrote 1232 * the file to this host's byte order. 1233 */ 1234 static void 1235 swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf, 1236 int header_len_64_bytes) 1237 { 1238 pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; 1239 bpf_u_int32 offset = 0; 1240 1241 /* 1242 * "offset" is the offset *past* the field we're swapping; 1243 * we skip the field *before* checking to make sure 1244 * the captured data length includes the entire field. 1245 */ 1246 1247 /* 1248 * The URB id is a totally opaque value; do we really need to 1249 * convert it to the reading host's byte order??? 1250 */ 1251 offset += 8; /* skip past id */ 1252 if (hdr->caplen < offset) 1253 return; 1254 uhdr->id = SWAPLL(uhdr->id); 1255 1256 offset += 4; /* skip past various 1-byte fields */ 1257 1258 offset += 2; /* skip past bus_id */ 1259 if (hdr->caplen < offset) 1260 return; 1261 uhdr->bus_id = SWAPSHORT(uhdr->bus_id); 1262 1263 offset += 2; /* skip past various 1-byte fields */ 1264 1265 offset += 8; /* skip past ts_sec */ 1266 if (hdr->caplen < offset) 1267 return; 1268 uhdr->ts_sec = SWAPLL(uhdr->ts_sec); 1269 1270 offset += 4; /* skip past ts_usec */ 1271 if (hdr->caplen < offset) 1272 return; 1273 uhdr->ts_usec = SWAPLONG(uhdr->ts_usec); 1274 1275 offset += 4; /* skip past status */ 1276 if (hdr->caplen < offset) 1277 return; 1278 uhdr->status = SWAPLONG(uhdr->status); 1279 1280 offset += 4; /* skip past urb_len */ 1281 if (hdr->caplen < offset) 1282 return; 1283 uhdr->urb_len = SWAPLONG(uhdr->urb_len); 1284 1285 offset += 4; /* skip past data_len */ 1286 if (hdr->caplen < offset) 1287 return; 1288 uhdr->data_len = SWAPLONG(uhdr->data_len); 1289 1290 if (uhdr->transfer_type == URB_ISOCHRONOUS) { 1291 offset += 4; /* skip past s.iso.error_count */ 1292 if (hdr->caplen < offset) 1293 return; 1294 uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count); 1295 1296 offset += 4; /* skip past s.iso.numdesc */ 1297 if (hdr->caplen < offset) 1298 return; 1299 uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc); 1300 } else 1301 offset += 8; /* skip USB setup header */ 1302 1303 /* 1304 * With the old header, there are no isochronous descriptors 1305 * after the header. 1306 * 1307 * With the new header, the actual number of descriptors in 1308 * the header is not s.iso.numdesc, it's ndesc - only the 1309 * first N descriptors, for some value of N, are put into 1310 * the header, and ndesc is set to the actual number copied. 1311 * In addition, if s.iso.numdesc is negative, no descriptors 1312 * are captured, and ndesc is set to 0. 1313 */ 1314 if (header_len_64_bytes) { 1315 /* 1316 * This is either the "version 1" header, with 1317 * 16 bytes of additional fields at the end, or 1318 * a "version 0" header from a memory-mapped 1319 * capture, with 16 bytes of zeroed-out padding 1320 * at the end. Byte swap them as if this were 1321 * a "version 1" header. 1322 */ 1323 offset += 4; /* skip past interval */ 1324 if (hdr->caplen < offset) 1325 return; 1326 uhdr->interval = SWAPLONG(uhdr->interval); 1327 1328 offset += 4; /* skip past start_frame */ 1329 if (hdr->caplen < offset) 1330 return; 1331 uhdr->start_frame = SWAPLONG(uhdr->start_frame); 1332 1333 offset += 4; /* skip past xfer_flags */ 1334 if (hdr->caplen < offset) 1335 return; 1336 uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags); 1337 1338 offset += 4; /* skip past ndesc */ 1339 if (hdr->caplen < offset) 1340 return; 1341 uhdr->ndesc = SWAPLONG(uhdr->ndesc); 1342 1343 if (uhdr->transfer_type == URB_ISOCHRONOUS) { 1344 /* swap the values in struct linux_usb_isodesc */ 1345 usb_isodesc *pisodesc; 1346 u_int32_t i; 1347 1348 pisodesc = (usb_isodesc *)(void *)(buf+offset); 1349 for (i = 0; i < uhdr->ndesc; i++) { 1350 offset += 4; /* skip past status */ 1351 if (hdr->caplen < offset) 1352 return; 1353 pisodesc->status = SWAPLONG(pisodesc->status); 1354 1355 offset += 4; /* skip past offset */ 1356 if (hdr->caplen < offset) 1357 return; 1358 pisodesc->offset = SWAPLONG(pisodesc->offset); 1359 1360 offset += 4; /* skip past len */ 1361 if (hdr->caplen < offset) 1362 return; 1363 pisodesc->len = SWAPLONG(pisodesc->len); 1364 1365 offset += 4; /* skip past padding */ 1366 1367 pisodesc++; 1368 } 1369 } 1370 } 1371 } 1372 1373 /* 1374 * The DLT_NFLOG "packets" have a mixture of big-endian and host-byte-order 1375 * data. They begin with a fixed-length header with big-endian fields, 1376 * followed by a set of TLVs, where the type and length are in host 1377 * byte order but the values are either big-endian or are a raw byte 1378 * sequence that's the same regardless of the host's byte order. 1379 * 1380 * When reading a DLT_NFLOG capture file, we need to convert the type 1381 * and length values from the byte order of the host that wrote the 1382 * file to the byte order of this host. 1383 */ 1384 static void 1385 swap_nflog_header(const struct pcap_pkthdr *hdr, u_char *buf) 1386 { 1387 u_char *p = buf; 1388 nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf; 1389 nflog_tlv_t *tlv; 1390 u_int caplen = hdr->caplen; 1391 u_int length = hdr->len; 1392 u_int16_t size; 1393 1394 if (caplen < (u_int) sizeof(nflog_hdr_t) || 1395 length < (u_int) sizeof(nflog_hdr_t)) { 1396 /* Not enough data to have any TLVs. */ 1397 return; 1398 } 1399 1400 if (nfhdr->nflog_version != 0) { 1401 /* Unknown NFLOG version */ 1402 return; 1403 } 1404 1405 length -= sizeof(nflog_hdr_t); 1406 caplen -= sizeof(nflog_hdr_t); 1407 p += sizeof(nflog_hdr_t); 1408 1409 while (caplen >= sizeof(nflog_tlv_t)) { 1410 tlv = (nflog_tlv_t *) p; 1411 1412 /* Swap the type and length. */ 1413 tlv->tlv_type = SWAPSHORT(tlv->tlv_type); 1414 tlv->tlv_length = SWAPSHORT(tlv->tlv_length); 1415 1416 /* Get the length of the TLV. */ 1417 size = tlv->tlv_length; 1418 if (size % 4 != 0) 1419 size += 4 - size % 4; 1420 1421 /* Is the TLV's length less than the minimum? */ 1422 if (size < sizeof(nflog_tlv_t)) { 1423 /* Yes. Give up now. */ 1424 return; 1425 } 1426 1427 /* Do we have enough data for the full TLV? */ 1428 if (caplen < size || length < size) { 1429 /* No. */ 1430 return; 1431 } 1432 1433 /* Skip over the TLV. */ 1434 length -= size; 1435 caplen -= size; 1436 p += size; 1437 } 1438 } 1439 1440 void 1441 swap_pseudo_headers(int linktype, struct pcap_pkthdr *hdr, u_char *data) 1442 { 1443 /* 1444 * Convert pseudo-headers from the byte order of 1445 * the host on which the file was saved to our 1446 * byte order, as necessary. 1447 */ 1448 switch (linktype) { 1449 1450 case DLT_LINUX_SLL: 1451 swap_linux_sll_header(hdr, data); 1452 break; 1453 1454 case DLT_USB_LINUX: 1455 swap_linux_usb_header(hdr, data, 0); 1456 break; 1457 1458 case DLT_USB_LINUX_MMAPPED: 1459 swap_linux_usb_header(hdr, data, 1); 1460 break; 1461 1462 case DLT_NFLOG: 1463 swap_nflog_header(hdr, data); 1464 break; 1465 } 1466 } 1467