Wireshark 4.5.0
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
pcapng_module.h
Go to the documentation of this file.
1
9#ifndef __PCAP_MODULE_H__
10#define __PCAP_MODULE_H__
11
12#include <wiretap/wtap-int.h>
13
14#include "ws_symbol_export.h"
15#include "pcapng.h"
16
17#ifdef __cplusplus
18extern "C" {
19#endif /* __cplusplus */
20
21/*
22 * These are the officially registered block types, from the pcapng
23 * specification.
24 *
25 * XXX - Dear Sysdig People: please add your blocks to the spec!
26 */
27#define BLOCK_TYPE_SHB 0x0A0D0D0A /* Section Header Block */
28#define BLOCK_TYPE_IDB 0x00000001 /* Interface Description Block */
29#define BLOCK_TYPE_PB 0x00000002 /* Packet Block (obsolete) */
30#define BLOCK_TYPE_SPB 0x00000003 /* Simple Packet Block */
31#define BLOCK_TYPE_NRB 0x00000004 /* Name Resolution Block */
32#define BLOCK_TYPE_ISB 0x00000005 /* Interface Statistics Block */
33#define BLOCK_TYPE_EPB 0x00000006 /* Enhanced Packet Block */
34#define BLOCK_TYPE_IRIG_TS 0x00000007 /* IRIG Timestamp Block */
35#define BLOCK_TYPE_ARINC_429 0x00000008 /* ARINC 429 in AFDX Encapsulation Information Block */
36#define BLOCK_TYPE_SYSTEMD_JOURNAL_EXPORT 0x00000009 /* systemd journal entry */
37#define BLOCK_TYPE_DSB 0x0000000A /* Decryption Secrets Block */
38#define BLOCK_TYPE_HP_MIB 0x00000101 /* Hone Project Machine Info Block */
39#define BLOCK_TYPE_HP_CEB 0x00000102 /* Hone Project Connection Event Block */
40#define BLOCK_TYPE_SYSDIG_MI 0x00000201 /* Sysdig Machine Info Block */
41#define BLOCK_TYPE_SYSDIG_PL_V1 0x00000202 /* Sysdig Process List Block */
42#define BLOCK_TYPE_SYSDIG_FDL_V1 0x00000203 /* Sysdig File Descriptor List Block */
43#define BLOCK_TYPE_SYSDIG_EVENT 0x00000204 /* Sysdig Event Block */
44#define BLOCK_TYPE_SYSDIG_IL_V1 0x00000205 /* Sysdig Interface List Block */
45#define BLOCK_TYPE_SYSDIG_UL_V1 0x00000206 /* Sysdig User List Block */
46#define BLOCK_TYPE_SYSDIG_PL_V2 0x00000207 /* Sysdig Process List Block version 2 */
47#define BLOCK_TYPE_SYSDIG_EVF 0x00000208 /* Sysdig Event Block with flags */
48#define BLOCK_TYPE_SYSDIG_PL_V3 0x00000209 /* Sysdig Process List Block version 3 */
49#define BLOCK_TYPE_SYSDIG_PL_V4 0x00000210 /* Sysdig Process List Block version 4 */
50#define BLOCK_TYPE_SYSDIG_PL_V5 0x00000211 /* Sysdig Process List Block version 5 */
51#define BLOCK_TYPE_SYSDIG_PL_V6 0x00000212 /* Sysdig Process List Block version 6 */
52#define BLOCK_TYPE_SYSDIG_PL_V7 0x00000213 /* Sysdig Process List Block version 7 */
53#define BLOCK_TYPE_SYSDIG_PL_V8 0x00000214 /* Sysdig Process List Block version 8 */
54#define BLOCK_TYPE_SYSDIG_PL_V9 0x00000215 /* Sysdig Process List Block version 9 */
55#define BLOCK_TYPE_SYSDIG_EVENT_V2 0x00000216 /* Sysdig Event Block version 2 */
56#define BLOCK_TYPE_SYSDIG_EVF_V2 0x00000217 /* Sysdig Event Block with flags version 2 */
57#define BLOCK_TYPE_SYSDIG_FDL_V2 0x00000218 /* Sysdig File Descriptor List Block */
58#define BLOCK_TYPE_SYSDIG_IL_V2 0x00000219 /* Sysdig Interface List Block version 2 */
59#define BLOCK_TYPE_SYSDIG_UL_V2 0x00000220 /* Sysdig User List Block version 2 */
60#define BLOCK_TYPE_SYSDIG_EVENT_V2_LARGE 0x00000221 /* Sysdig Event Block version 2 with large payload */
61#define BLOCK_TYPE_SYSDIG_EVF_V2_LARGE 0x00000222 /* Sysdig Event Block with flags version 2 with large payload */
62#define BLOCK_TYPE_CB_COPY 0x00000BAD /* Custom Block which can be copied */
63#define BLOCK_TYPE_CB_NO_COPY 0x40000BAD /* Custom Block which should not be copied */
64
65/* TODO: the following are not yet well defined in the draft spec,
66 * and do not yet have block type values assigned to them:
67 * Alternative Packet Blocks
68 * Compression Block
69 * Encryption Block
70 * Fixed Length Block
71 * Directory Block
72 * Traffic Statistics and Monitoring Blocks
73 * Event/Security Block
74 */
75
76/* Block data to be passed between functions during reading */
77typedef struct wtapng_block_s {
78 uint32_t type; /* block_type as defined by pcapng */
79 bool internal; /* true if this block type shouldn't be returned from pcapng_read() */
80 wtap_block_t block;
81 wtap_rec *rec;
83
84/* Section data in private struct */
85/*
86 * XXX - there needs to be a more general way to implement the Netflix
87 * BBLog blocks and options.
88 */
89typedef struct section_info_t {
91 uint16_t version_major;
92 uint16_t version_minor;
93 GArray *interfaces;
94 int64_t shb_off;
95 GHashTable *custom_block_data;
96 GHashTable *local_block_data;
98
99/*
100 * Block types indices in the table of tables of option handlers.
101 *
102 * Block types are not guaranteed to be sequential, so we map the
103 * block types we support to a sequential set. Furthermore, all
104 * packet block types have the same set of options.
105 */
106#define BT_INDEX_SHB 0
107#define BT_INDEX_IDB 1
108#define BT_INDEX_PBS 2 /* all packet blocks: PB/EPB/SPB */
109#define BT_INDEX_NRB 3
110#define BT_INDEX_ISB 4
111#define BT_INDEX_EVT 5
112#define BT_INDEX_DSB 6
113
114#define NUM_BT_INDICES 7
115
116/*
117 * Reader and writer routines for pcapng block types.
118 */
119typedef bool (*block_reader)(wtap* wth, FILE_T fh, uint32_t block_size,
120 uint32_t block_content_size,
121 section_info_t* section_info,
122 wtapng_block_t *wblock,
123 int *err, char **err_info);
124typedef bool (*block_writer)(wtap_dumper *wdh, const wtap_rec *rec,
125 int *err, char **err_info);
126typedef bool (*block_processor)(wtap* wth, wtapng_block_t* wblock);
127
128
130 unsigned type; /* block_type as defined by pcapng */
131 block_reader reader;
132 block_writer writer;
133 block_processor processor;
134 bool internal; /* true if this block type shouldn't be returned from pcapng_read() */
135 unsigned bt_index; /* Block type index */
137
138/*
139 * Register a handler for a pcapng block type.
140 */
141WS_DLL_PUBLIC
142void register_pcapng_block_type_handler(pcapng_block_type_handler_t* handler);
143
144/*
145 * Handler routines for pcapng option type.
146 */
147typedef bool (*option_parser)(wtap_block_t block, bool byte_swapped,
148 unsigned option_length,
149 const uint8_t *option_content,
150 int *err, char **err_info);
151typedef uint32_t (*option_sizer)(unsigned option_id, wtap_optval_t *optval);
152typedef bool (*option_writer)(wtap_dumper *wdh, unsigned option_id,
153 wtap_optval_t *optval, int *err);
154
155/*
156 * Register a handler for a pcapng option code for a particular block
157 * type.
158 */
159WS_DLL_PUBLIC
160void register_pcapng_option_handler(unsigned block_type, unsigned option_code,
161 option_parser parser,
162 option_sizer sizer,
163 option_writer writer);
164
165/*
166 * Byte order of the options within a block.
167 *
168 * This is usually the byte order of the section, but, for options
169 * within a Custom Block, it needs to be a specified byte order,
170 * or a byte order indicated by data in the Custom Data (stored in
171 * a fashion that doesn't require knowing the byte order of the
172 * Custom Data, as it's also the byte order of the Custom Data
173 * itself), so that programs ignorant of the format of a given
174 * type of Custom Block can still read a block from one file and
175 * write it to another, even if the host doing the writing has
176 * a byte order different from the host that previously wrote
177 * the file.
178 */
179typedef enum {
180 OPT_SECTION_BYTE_ORDER, /* byte order of this section */
181 OPT_BIG_ENDIAN, /* as it says */
182 OPT_LITTLE_ENDIAN /* ditto */
183} pcapng_opt_byte_order_e;
184
185/*
186 * Process the options section of a block. process_option points to
187 * a routine that processes all the block-specific options, i.e.
188 * options other than the end-of-options, comment, and custom
189 * options.
190 */
191WS_DLL_PUBLIC
192bool pcapng_process_options(FILE_T fh, wtapng_block_t *wblock,
193 section_info_t *section_info,
194 unsigned opt_cont_buf_len,
195 bool (*process_option)(wtapng_block_t *,
197 uint16_t, uint16_t,
198 const uint8_t *,
199 int *, char **),
200 pcapng_opt_byte_order_e byte_order,
201 int *err, char **err_info);
202
203/*
204 * Helper routines to process options with types used in more than one
205 * block type.
206 */
207WS_DLL_PUBLIC
208void pcapng_process_uint8_option(wtapng_block_t *wblock,
209 uint16_t option_code, uint16_t option_length,
210 const uint8_t *option_content);
211
212WS_DLL_PUBLIC
213void pcapng_process_uint32_option(wtapng_block_t *wblock,
214 section_info_t *section_info,
215 pcapng_opt_byte_order_e byte_order,
216 uint16_t option_code, uint16_t option_length,
217 const uint8_t *option_content);
218
219WS_DLL_PUBLIC
220void pcapng_process_timestamp_option(wtapng_block_t *wblock,
221 section_info_t *section_info,
222 pcapng_opt_byte_order_e byte_order,
223 uint16_t option_code, uint16_t option_length,
224 const uint8_t *option_content);
225
226WS_DLL_PUBLIC
227void pcapng_process_uint64_option(wtapng_block_t *wblock,
228 section_info_t *section_info,
229 pcapng_opt_byte_order_e byte_order,
230 uint16_t option_code, uint16_t option_length,
231 const uint8_t *option_content);
232
233WS_DLL_PUBLIC
234void pcapng_process_int64_option(wtapng_block_t *wblock,
235 section_info_t *section_info,
236 pcapng_opt_byte_order_e byte_order,
237 uint16_t option_code, uint16_t option_length,
238 const uint8_t *option_content);
239
240WS_DLL_PUBLIC
241void pcapng_process_string_option(wtapng_block_t *wblock, uint16_t option_code,
242 uint16_t option_length, const uint8_t *option_content);
243
244WS_DLL_PUBLIC
245void pcapng_process_bytes_option(wtapng_block_t *wblock, uint16_t option_code,
246 uint16_t option_length, const uint8_t *option_content);
247
248typedef uint32_t (*compute_option_size_func)(wtap_block_t, unsigned, wtap_opttype_e, wtap_optval_t*);
249
251{
252 uint32_t size;
253 compute_option_size_func compute_option_size;
255
256WS_DLL_PUBLIC
257uint32_t pcapng_compute_options_size(wtap_block_t block, compute_option_size_func compute_option_size);
258
259typedef bool (*write_option_func)(wtap_dumper *wdh, wtap_block_t block,
260 unsigned option_id,
261 wtap_opttype_e option_type,
262 wtap_optval_t *optval,
263 int *err, char **err_info);
264
265WS_DLL_PUBLIC
266bool pcapng_write_options(wtap_dumper *wdh, pcapng_opt_byte_order_e byte_order,
267 wtap_block_t block, write_option_func write_option,
268 int *err, char **err_info);
269
270/*
271 * Handler routines for pcapng custom blocks with an enterprise number.
272 */
273typedef bool (*custom_option_parser)(FILE_T fh, section_info_t* section_info,
274 wtapng_block_t* wblock,
275 int* err, char** err_info);
276typedef bool (*custom_option_processor)(wtapng_block_t* wblock,
277 section_info_t* section_info, uint16_t option_code,
278 const uint8_t* value, uint16_t length);
279
281{
282 custom_option_parser parser;
283 custom_option_processor processor;
284 block_writer writer;
286
287/*
288 * Register a handler for a pcapng custom block with an enterprise number.
289 */
290WS_DLL_PUBLIC
291void register_pcapng_custom_block_enterprise_handler(unsigned enterprise_number, pcapng_custom_block_enterprise_handler_t* handler);
292
293/*
294 * Helper routines for modules.
295 */
296
297/*
298 * Write block header.
299 */
300WS_DLL_PUBLIC
301bool pcapng_write_block_header(wtap_dumper *wdh, uint32_t block_type,
302 uint32_t block_content_length, int *err);
303
304/*
305 * Write padding after a chunk of data.
306 */
307static inline bool
308pcapng_write_padding(wtap_dumper *wdh, size_t pad, int *err)
309{
310 if (pad != 0) {
311 const uint32_t zero_pad = 0;
312 if (!wtap_dump_file_write(wdh, &zero_pad, pad, err))
313 return false;
314 }
315
316 return true;
317}
318
319/*
320 * Write block footer.
321 */
322WS_DLL_PUBLIC
323bool pcapng_write_block_footer(wtap_dumper *wdh, uint32_t block_content_length,
324 int *err);
325
326/*
327 * Structure holding allocation-and-initialization and free functions
328 * for section_info_t-associated custom or local block information.
329 */
330typedef struct {
331 void *(*new)(void);
332 GDestroyNotify free;
334
335/*
336 * Find custom block information from a section_info_t; add a
337 * newly-created one and return it if none is found.
338 */
339WS_DLL_PUBLIC
340void *pcapng_get_cb_section_info_data(section_info_t *section_info,
341 uint32_t pen,
342 const section_info_funcs_t *funcs);
343
344/*
345 * Find local block information from a section_info_t; add a
346 * newly-created one and return it if none is found.
347 */
348WS_DLL_PUBLIC
349void *pcapng_get_lb_section_info_data(section_info_t *section_info,
350 uint32_t block_type,
351 const section_info_funcs_t *funcs);
352
353#ifdef __cplusplus
354}
355#endif /* __cplusplus */
356
357#endif /* __PCAP_MODULE_H__ */
Definition pcapng_module.h:251
Definition pcapng_module.h:129
Definition pcapng_module.h:281
Definition pcapng_module.h:330
Definition pcapng_module.h:89
uint16_t version_major
Definition pcapng_module.h:91
int64_t shb_off
Definition pcapng_module.h:94
uint16_t version_minor
Definition pcapng_module.h:92
GHashTable * local_block_data
Definition pcapng_module.h:96
GHashTable * custom_block_data
Definition pcapng_module.h:95
GArray * interfaces
Definition pcapng_module.h:93
bool byte_swapped
Definition pcapng_module.h:90
Definition wtap_opttypes.h:228
Definition wtap-int.h:97
Definition file_wrappers.c:215
Definition wtap.h:1425
Definition wtap-int.h:37
Definition pcapng_module.h:77
Definition wtap_opttypes.h:458