Wireshark 4.5.0
The Wireshark network protocol analyzer
All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Modules Pages
pcapng_module.h
Go to the documentation of this file.
1
9#ifndef __PCAP_MODULE_H__
10#define __PCAP_MODULE_H__
11
12#include <wiretap/wtap-int.h>
13
14#include "ws_symbol_export.h"
15#include "pcapng.h"
16
17#ifdef __cplusplus
18extern "C" {
19#endif /* __cplusplus */
20
21/*
22 * These are the officially registered block types, from the pcapng
23 * specification.
24 *
25 * XXX - Dear Sysdig People: please add your blocks to the spec!
26 */
27#define BLOCK_TYPE_SHB 0x0A0D0D0A /* Section Header Block */
28#define BLOCK_TYPE_IDB 0x00000001 /* Interface Description Block */
29#define BLOCK_TYPE_PB 0x00000002 /* Packet Block (obsolete) */
30#define BLOCK_TYPE_SPB 0x00000003 /* Simple Packet Block */
31#define BLOCK_TYPE_NRB 0x00000004 /* Name Resolution Block */
32#define BLOCK_TYPE_ISB 0x00000005 /* Interface Statistics Block */
33#define BLOCK_TYPE_EPB 0x00000006 /* Enhanced Packet Block */
34#define BLOCK_TYPE_IRIG_TS 0x00000007 /* IRIG Timestamp Block */
35#define BLOCK_TYPE_ARINC_429 0x00000008 /* ARINC 429 in AFDX Encapsulation Information Block */
36#define BLOCK_TYPE_SYSTEMD_JOURNAL_EXPORT 0x00000009 /* systemd journal entry */
37#define BLOCK_TYPE_DSB 0x0000000A /* Decryption Secrets Block */
38#define BLOCK_TYPE_HP_MIB 0x00000101 /* Hone Project Machine Info Block */
39#define BLOCK_TYPE_HP_CEB 0x00000102 /* Hone Project Connection Event Block */
40#define BLOCK_TYPE_SYSDIG_MI 0x00000201 /* Sysdig Machine Info Block */
41#define BLOCK_TYPE_SYSDIG_PL_V1 0x00000202 /* Sysdig Process List Block */
42#define BLOCK_TYPE_SYSDIG_FDL_V1 0x00000203 /* Sysdig File Descriptor List Block */
43#define BLOCK_TYPE_SYSDIG_EVENT 0x00000204 /* Sysdig Event Block */
44#define BLOCK_TYPE_SYSDIG_IL_V1 0x00000205 /* Sysdig Interface List Block */
45#define BLOCK_TYPE_SYSDIG_UL_V1 0x00000206 /* Sysdig User List Block */
46#define BLOCK_TYPE_SYSDIG_PL_V2 0x00000207 /* Sysdig Process List Block version 2 */
47#define BLOCK_TYPE_SYSDIG_EVF 0x00000208 /* Sysdig Event Block with flags */
48#define BLOCK_TYPE_SYSDIG_PL_V3 0x00000209 /* Sysdig Process List Block version 3 */
49#define BLOCK_TYPE_SYSDIG_PL_V4 0x00000210 /* Sysdig Process List Block version 4 */
50#define BLOCK_TYPE_SYSDIG_PL_V5 0x00000211 /* Sysdig Process List Block version 5 */
51#define BLOCK_TYPE_SYSDIG_PL_V6 0x00000212 /* Sysdig Process List Block version 6 */
52#define BLOCK_TYPE_SYSDIG_PL_V7 0x00000213 /* Sysdig Process List Block version 7 */
53#define BLOCK_TYPE_SYSDIG_PL_V8 0x00000214 /* Sysdig Process List Block version 8 */
54#define BLOCK_TYPE_SYSDIG_PL_V9 0x00000215 /* Sysdig Process List Block version 9 */
55#define BLOCK_TYPE_SYSDIG_EVENT_V2 0x00000216 /* Sysdig Event Block version 2 */
56#define BLOCK_TYPE_SYSDIG_EVF_V2 0x00000217 /* Sysdig Event Block with flags version 2 */
57#define BLOCK_TYPE_SYSDIG_FDL_V2 0x00000218 /* Sysdig File Descriptor List Block */
58#define BLOCK_TYPE_SYSDIG_IL_V2 0x00000219 /* Sysdig Interface List Block version 2 */
59#define BLOCK_TYPE_SYSDIG_UL_V2 0x00000220 /* Sysdig User List Block version 2 */
60#define BLOCK_TYPE_SYSDIG_EVENT_V2_LARGE 0x00000221 /* Sysdig Event Block version 2 with large payload */
61#define BLOCK_TYPE_SYSDIG_EVF_V2_LARGE 0x00000222 /* Sysdig Event Block with flags version 2 with large payload */
62#define BLOCK_TYPE_CB_COPY 0x00000BAD /* Custom Block which can be copied */
63#define BLOCK_TYPE_CB_NO_COPY 0x40000BAD /* Custom Block which should not be copied */
64
65/* TODO: the following are not yet well defined in the draft spec,
66 * and do not yet have block type values assigned to them:
67 * Alternative Packet Blocks
68 * Compression Block
69 * Encryption Block
70 * Fixed Length Block
71 * Directory Block
72 * Traffic Statistics and Monitoring Blocks
73 * Event/Security Block
74 */
75
76/* Block data to be passed between functions during reading */
77typedef struct wtapng_block_s {
78 uint32_t type; /* block_type as defined by pcapng */
79 bool internal; /* true if this block type shouldn't be returned from pcapng_read() */
80 wtap_block_t block;
81 wtap_rec *rec;
83
84/* Section data in private struct */
85/*
86 * XXX - there needs to be a more general way to implement the Netflix
87 * BBLog blocks and options.
88 */
89typedef struct section_info_t {
91 uint16_t version_major;
92 uint16_t version_minor;
93 GArray *interfaces;
94 int64_t shb_off;
95 GHashTable *custom_block_data;
96 GHashTable *local_block_data;
98
99/*
100 * Reader and writer routines for pcapng block types.
101 */
102typedef bool (*block_reader)(wtap* wth, FILE_T fh, uint32_t block_type,
103 uint32_t block_content_length,
104 section_info_t* section_info,
105 wtapng_block_t *wblock,
106 int *err, char **err_info);
107typedef bool (*block_writer)(wtap_dumper *wdh, const wtap_rec *rec,
108 int *err, char **err_info);
109typedef bool (*block_processor)(wtap* wth, section_info_t* section_info _U_,
110 wtapng_block_t* wblock);
111
112
114 unsigned type; /* block_type as defined by pcapng */
115 block_reader reader;
116 block_processor processor;
117 block_writer writer;
118 bool internal; /* true if this block type shouldn't be returned from pcapng_read() */
119 GHashTable *option_handlers; /* Hash table of option handlers */
121
122/*
123 * Register a handler for a pcapng block type.
124 */
125WS_DLL_PUBLIC
126void register_pcapng_block_type_information(pcapng_block_type_information_t* handler);
127
128/*
129 * Handler routines for pcapng option type.
130 */
131typedef bool (*option_parser)(wtap_block_t block, bool byte_swapped,
132 unsigned option_length,
133 const uint8_t *option_content,
134 int *err, char **err_info);
135typedef uint32_t (*option_sizer)(unsigned option_id, wtap_optval_t *optval);
136typedef bool (*option_writer)(wtap_dumper *wdh, unsigned option_id,
137 wtap_optval_t *optval, int *err);
138
139/*
140 * Create a table of handlers for pcapng option codes.
141 */
142WS_DLL_PUBLIC
143GHashTable *pcapng_create_option_handler_table(void);
144
145/*
146 * Register a handler for a pcapng option code for a particular block
147 * type.
148 */
149WS_DLL_PUBLIC
150void register_pcapng_option_handler(unsigned block_type, unsigned option_code,
151 option_parser parser,
152 option_sizer sizer,
153 option_writer writer);
154
155/*
156 * Byte order of the options within a block.
157 *
158 * This is usually the byte order of the section, but, for options
159 * within a Custom Block, it needs to be a specified byte order,
160 * or a byte order indicated by data in the Custom Data (stored in
161 * a fashion that doesn't require knowing the byte order of the
162 * Custom Data, as it's also the byte order of the Custom Data
163 * itself), so that programs ignorant of the format of a given
164 * type of Custom Block can still read a block from one file and
165 * write it to another, even if the host doing the writing has
166 * a byte order different from the host that previously wrote
167 * the file.
168 */
169typedef enum {
170 OPT_SECTION_BYTE_ORDER, /* byte order of this section */
171 OPT_BIG_ENDIAN, /* as it says */
172 OPT_LITTLE_ENDIAN /* ditto */
173} pcapng_opt_byte_order_e;
174
175/*
176 * Process the options section of a block. process_option points to
177 * a routine that processes all the block-specific options, i.e.
178 * options other than the end-of-options, comment, and custom
179 * options.
180 */
181WS_DLL_PUBLIC
182bool pcapng_process_options(FILE_T fh, wtapng_block_t *wblock,
183 section_info_t *section_info,
184 unsigned opt_cont_buf_len,
185 bool (*process_option)(wtapng_block_t *,
187 uint16_t, uint16_t,
188 const uint8_t *,
189 int *, char **),
190 pcapng_opt_byte_order_e byte_order,
191 int *err, char **err_info);
192
193/*
194 * Helper routines to process options with types used in more than one
195 * block type.
196 */
197WS_DLL_PUBLIC
198void pcapng_process_uint8_option(wtapng_block_t *wblock,
199 uint16_t option_code, uint16_t option_length,
200 const uint8_t *option_content);
201
202WS_DLL_PUBLIC
203void pcapng_process_uint32_option(wtapng_block_t *wblock,
204 section_info_t *section_info,
205 pcapng_opt_byte_order_e byte_order,
206 uint16_t option_code, uint16_t option_length,
207 const uint8_t *option_content);
208
209WS_DLL_PUBLIC
210void pcapng_process_timestamp_option(wtapng_block_t *wblock,
211 section_info_t *section_info,
212 pcapng_opt_byte_order_e byte_order,
213 uint16_t option_code, uint16_t option_length,
214 const uint8_t *option_content);
215
216WS_DLL_PUBLIC
217void pcapng_process_uint64_option(wtapng_block_t *wblock,
218 section_info_t *section_info,
219 pcapng_opt_byte_order_e byte_order,
220 uint16_t option_code, uint16_t option_length,
221 const uint8_t *option_content);
222
223WS_DLL_PUBLIC
224void pcapng_process_int64_option(wtapng_block_t *wblock,
225 section_info_t *section_info,
226 pcapng_opt_byte_order_e byte_order,
227 uint16_t option_code, uint16_t option_length,
228 const uint8_t *option_content);
229
230WS_DLL_PUBLIC
231void pcapng_process_string_option(wtapng_block_t *wblock, uint16_t option_code,
232 uint16_t option_length, const uint8_t *option_content);
233
234WS_DLL_PUBLIC
235void pcapng_process_bytes_option(wtapng_block_t *wblock, uint16_t option_code,
236 uint16_t option_length, const uint8_t *option_content);
237
238typedef uint32_t (*compute_option_size_func)(wtap_block_t, unsigned, wtap_opttype_e, wtap_optval_t*);
239
241{
242 uint32_t size;
243 compute_option_size_func compute_option_size;
245
246WS_DLL_PUBLIC
247uint32_t pcapng_compute_options_size(wtap_block_t block, compute_option_size_func compute_option_size);
248
249typedef bool (*write_option_func)(wtap_dumper *wdh, wtap_block_t block,
250 unsigned option_id,
251 wtap_opttype_e option_type,
252 wtap_optval_t *optval,
253 int *err, char **err_info);
254
255WS_DLL_PUBLIC
256bool pcapng_write_options(wtap_dumper *wdh, pcapng_opt_byte_order_e byte_order,
257 wtap_block_t block, write_option_func write_option,
258 int *err, char **err_info);
259
260/*
261 * Handler routines for pcapng custom blocks with an enterprise number.
262 */
263typedef bool (*custom_option_parser)(FILE_T fh, section_info_t* section_info,
264 wtapng_block_t* wblock,
265 int* err, char** err_info);
266typedef bool (*custom_option_processor)(wtapng_block_t* wblock,
267 section_info_t* section_info, uint16_t option_code,
268 const uint8_t* value, uint16_t length);
269
271{
272 custom_option_parser parser;
273 custom_option_processor processor;
274 block_writer writer;
276
277/*
278 * Register a handler for a pcapng custom block with an enterprise number.
279 */
280WS_DLL_PUBLIC
281void register_pcapng_custom_block_enterprise_handler(unsigned enterprise_number, pcapng_custom_block_enterprise_handler_t* handler);
282
283/*
284 * Helper routines for modules.
285 */
286
287/*
288 * Write block header.
289 */
290WS_DLL_PUBLIC
291bool pcapng_write_block_header(wtap_dumper *wdh, uint32_t block_type,
292 uint32_t block_content_length, int *err);
293
294/*
295 * Write padding after a chunk of data.
296 */
297static inline bool
298pcapng_write_padding(wtap_dumper *wdh, size_t pad, int *err)
299{
300 if (pad != 0) {
301 const uint32_t zero_pad = 0;
302 if (!wtap_dump_file_write(wdh, &zero_pad, pad, err))
303 return false;
304 }
305
306 return true;
307}
308
309/*
310 * Write block footer.
311 */
312WS_DLL_PUBLIC
313bool pcapng_write_block_footer(wtap_dumper *wdh, uint32_t block_content_length,
314 int *err);
315
316/*
317 * Structure holding allocation-and-initialization and free functions
318 * for section_info_t-associated custom or local block information.
319 */
320typedef struct {
321 void *(*new)(void);
322 GDestroyNotify free;
324
325/*
326 * Find custom block information from a section_info_t; add a
327 * newly-created one and return it if none is found.
328 */
329WS_DLL_PUBLIC
330void *pcapng_get_cb_section_info_data(section_info_t *section_info,
331 uint32_t pen,
332 const section_info_funcs_t *funcs);
333
334/*
335 * Find local block information from a section_info_t; add a
336 * newly-created one and return it if none is found.
337 */
338WS_DLL_PUBLIC
339void *pcapng_get_lb_section_info_data(section_info_t *section_info,
340 uint32_t block_type,
341 const section_info_funcs_t *funcs);
342
343#ifdef __cplusplus
344}
345#endif /* __cplusplus */
346
347#endif /* __PCAP_MODULE_H__ */
Definition pcapng_module.h:241
Definition pcapng_module.h:113
Definition pcapng_module.h:271
Definition pcapng_module.h:320
Definition pcapng_module.h:89
uint16_t version_major
Definition pcapng_module.h:91
int64_t shb_off
Definition pcapng_module.h:94
uint16_t version_minor
Definition pcapng_module.h:92
GHashTable * local_block_data
Definition pcapng_module.h:96
GHashTable * custom_block_data
Definition pcapng_module.h:95
GArray * interfaces
Definition pcapng_module.h:93
bool byte_swapped
Definition pcapng_module.h:90
Definition wtap_opttypes.h:229
Definition wtap-int.h:97
Definition file_wrappers.c:215
Definition wtap.h:1425
Definition wtap-int.h:37
Definition pcapng_module.h:77
Definition wtap_opttypes.h:459