1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
/*
* Oracle
*/
/* \summary: Per-Packet Information (DLT_PPI) printer */
/* Specification:
* Per-Packet Information Header Specification - Version 1.0.7
* https://web.archive.org/web/20160328114748/http://www.cacetech.com/documents/PPI%20Header%20format%201.0.7.pdf
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include "netdissect-stdinc.h"
#include "netdissect.h"
#include "extract.h"
typedef struct ppi_header {
nd_uint8_t ppi_ver; /* Version. Currently 0 */
nd_uint8_t ppi_flags; /* Flags. */
nd_uint16_t ppi_len; /* Length of entire message, including
* this header and TLV payload. */
nd_uint32_t ppi_dlt; /* Data Link Type of the captured
* packet data. */
} ppi_header_t;
#define PPI_HDRLEN 8
#ifdef DLT_PPI
static void
ppi_header_print(netdissect_options *ndo, const u_char *bp, u_int length)
{
const ppi_header_t *hdr;
uint16_t len;
uint32_t dlt;
const char *dltname;
hdr = (const ppi_header_t *)bp;
len = GET_LE_U_2(hdr->ppi_len);
dlt = GET_LE_U_4(hdr->ppi_dlt);
dltname = pcap_datalink_val_to_name(dlt);
if (!ndo->ndo_qflag) {
ND_PRINT("V.%u DLT %s (%u) len %u", GET_U_1(hdr->ppi_ver),
(dltname != NULL ? dltname : "UNKNOWN"), dlt,
len);
} else {
ND_PRINT("%s", (dltname != NULL ? dltname : "UNKNOWN"));
}
ND_PRINT(", length %u: ", length);
}
/*
* This is the top level routine of the printer. 'p' points
* to the ether header of the packet, 'h->ts' is the timestamp,
* 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
void
ppi_if_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, const u_char *p)
{
if_printer printer;
const ppi_header_t *hdr;
u_int caplen = h->caplen;
u_int length = h->len;
uint16_t len;
uint32_t dlt;
uint32_t hdrlen;
struct pcap_pkthdr nhdr;
ndo->ndo_protocol = "ppi";
if (caplen < sizeof(ppi_header_t)) {
nd_print_trunc(ndo);
ndo->ndo_ll_hdr_len += caplen;
return;
}
hdr = (const ppi_header_t *)p;
len = GET_LE_U_2(hdr->ppi_len);
if (len < sizeof(ppi_header_t) || len > 65532) {
/* It MUST be between 8 and 65,532 inclusive (spec 3.1.3) */
ND_PRINT(" [length %u < %zu or > 65532]", len,
sizeof(ppi_header_t));
nd_print_invalid(ndo);
ndo->ndo_ll_hdr_len += caplen;
return;
}
if (caplen < len) {
/*
* If we don't have the entire PPI header, don't
* bother.
*/
nd_print_trunc(ndo);
ndo->ndo_ll_hdr_len += caplen;
return;
}
dlt = GET_LE_U_4(hdr->ppi_dlt);
if (ndo->ndo_eflag)
ppi_header_print(ndo, p, length);
length -= len;
caplen -= len;
p += len;
printer = lookup_printer(dlt);
if (printer != NULL) {
nhdr = *h;
nhdr.caplen = caplen;
nhdr.len = length;
printer(ndo, &nhdr, p);
hdrlen = ndo->ndo_ll_hdr_len;
} else {
if (!ndo->ndo_eflag)
ppi_header_print(ndo, (const u_char *)hdr, length + len);
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
hdrlen = 0;
}
ndo->ndo_ll_hdr_len += len + hdrlen;
}
#endif /* DLT_PPI */
|
