Wireshark 4.5.0
The Wireshark network protocol analyzer
All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Modules Pages
pcapng_module.h
Go to the documentation of this file.
1
9#ifndef __PCAP_MODULE_H__
10#define __PCAP_MODULE_H__
11
12/*
13 * These are the officially registered block types, from the pcapng
14 * specification.
15 *
16 * XXX - Dear Sysdig People: please add your blocks to the spec!
17 */
18#define BLOCK_TYPE_SHB 0x0A0D0D0A /* Section Header Block */
19#define BLOCK_TYPE_IDB 0x00000001 /* Interface Description Block */
20#define BLOCK_TYPE_PB 0x00000002 /* Packet Block (obsolete) */
21#define BLOCK_TYPE_SPB 0x00000003 /* Simple Packet Block */
22#define BLOCK_TYPE_NRB 0x00000004 /* Name Resolution Block */
23#define BLOCK_TYPE_ISB 0x00000005 /* Interface Statistics Block */
24#define BLOCK_TYPE_EPB 0x00000006 /* Enhanced Packet Block */
25#define BLOCK_TYPE_IRIG_TS 0x00000007 /* IRIG Timestamp Block */
26#define BLOCK_TYPE_ARINC_429 0x00000008 /* ARINC 429 in AFDX Encapsulation Information Block */
27#define BLOCK_TYPE_SYSTEMD_JOURNAL_EXPORT 0x00000009 /* systemd journal entry */
28#define BLOCK_TYPE_DSB 0x0000000A /* Decryption Secrets Block */
29#define BLOCK_TYPE_SYSDIG_MI 0x00000201 /* Sysdig Machine Info Block */
30#define BLOCK_TYPE_SYSDIG_PL_V1 0x00000202 /* Sysdig Process List Block */
31#define BLOCK_TYPE_SYSDIG_FDL_V1 0x00000203 /* Sysdig File Descriptor List Block */
32#define BLOCK_TYPE_SYSDIG_EVENT 0x00000204 /* Sysdig Event Block */
33#define BLOCK_TYPE_SYSDIG_IL_V1 0x00000205 /* Sysdig Interface List Block */
34#define BLOCK_TYPE_SYSDIG_UL_V1 0x00000206 /* Sysdig User List Block */
35#define BLOCK_TYPE_SYSDIG_PL_V2 0x00000207 /* Sysdig Process List Block version 2 */
36#define BLOCK_TYPE_SYSDIG_EVF 0x00000208 /* Sysdig Event Block with flags */
37#define BLOCK_TYPE_SYSDIG_PL_V3 0x00000209 /* Sysdig Process List Block version 3 */
38#define BLOCK_TYPE_SYSDIG_PL_V4 0x00000210 /* Sysdig Process List Block version 4 */
39#define BLOCK_TYPE_SYSDIG_PL_V5 0x00000211 /* Sysdig Process List Block version 5 */
40#define BLOCK_TYPE_SYSDIG_PL_V6 0x00000212 /* Sysdig Process List Block version 6 */
41#define BLOCK_TYPE_SYSDIG_PL_V7 0x00000213 /* Sysdig Process List Block version 7 */
42#define BLOCK_TYPE_SYSDIG_PL_V8 0x00000214 /* Sysdig Process List Block version 8 */
43#define BLOCK_TYPE_SYSDIG_PL_V9 0x00000215 /* Sysdig Process List Block version 9 */
44#define BLOCK_TYPE_SYSDIG_EVENT_V2 0x00000216 /* Sysdig Event Block version 2 */
45#define BLOCK_TYPE_SYSDIG_EVF_V2 0x00000217 /* Sysdig Event Block with flags version 2 */
46#define BLOCK_TYPE_SYSDIG_FDL_V2 0x00000218 /* Sysdig File Descriptor List Block */
47#define BLOCK_TYPE_SYSDIG_IL_V2 0x00000219 /* Sysdig Interface List Block version 2 */
48#define BLOCK_TYPE_SYSDIG_UL_V2 0x00000220 /* Sysdig User List Block version 2 */
49#define BLOCK_TYPE_SYSDIG_EVENT_V2_LARGE 0x00000221 /* Sysdig Event Block version 2 with large payload */
50#define BLOCK_TYPE_SYSDIG_EVF_V2_LARGE 0x00000222 /* Sysdig Event Block with flags version 2 with large payload */
51#define BLOCK_TYPE_CB_COPY 0x00000BAD /* Custom Block which can be copied */
52#define BLOCK_TYPE_CB_NO_COPY 0x40000BAD /* Custom Block which should not be copied */
53
54/* TODO: the following are not yet well defined in the draft spec,
55 * and do not yet have block type values assigned to them:
56 * Compression Block
57 * Encryption Block
58 * Fixed Length Block
59 * Directory Block
60 * Traffic Statistics and Monitoring Blocks
61 * Event/Security Block
62 */
63
64/* Block data to be passed between functions during reading */
65typedef struct wtapng_block_s {
66 uint32_t type; /* block_type as defined by pcapng */
67 bool internal; /* true if this block type shouldn't be returned from pcapng_read() */
68 wtap_block_t block;
69 wtap_rec *rec;
71
72/* Section data in private struct */
73/*
74 * XXX - there needs to be a more general way to implement the Netflix
75 * BBLog blocks and options.
76 */
77typedef struct section_info_t {
79 uint16_t version_major;
80 uint16_t version_minor;
81 GArray *interfaces;
82 int64_t shb_off;
83 uint32_t bblog_version;
85 uint64_t bblog_offset_tv_usec;
87
88/*
89 * Reader and writer routines for pcapng block types.
90 */
91typedef bool (*block_reader)(FILE_T fh, uint32_t block_read,
92 bool byte_swapped, wtapng_block_t *wblock,
93 int *err, char **err_info);
94typedef bool (*block_writer)(wtap_dumper *wdh, const wtap_rec *rec,
95 const uint8_t *pd, int *err);
96
97/*
98 * Register a handler for a pcapng block type.
99 */
100WS_DLL_PUBLIC
101void register_pcapng_block_type_handler(unsigned block_type, block_reader reader,
102 block_writer writer);
103
104/*
105 * Handler routines for pcapng option type.
106 */
107typedef bool (*option_parser)(wtap_block_t block, bool byte_swapped,
108 unsigned option_length,
109 const uint8_t *option_content,
110 int *err, char **err_info);
111typedef uint32_t (*option_sizer)(unsigned option_id, wtap_optval_t *optval);
112typedef bool (*option_writer)(wtap_dumper *wdh, unsigned option_id,
113 wtap_optval_t *optval, int *err);
114
115/*
116 * Register a handler for a pcapng option code for a particular block
117 * type.
118 */
119WS_DLL_PUBLIC
120void register_pcapng_option_handler(unsigned block_type, unsigned option_code,
121 option_parser parser,
122 option_sizer sizer,
123 option_writer writer);
124
125/*
126 * Byte order of the options within a block.
127 *
128 * This is usually the byte order of the section, but, for options
129 * within a Custom Block, it needs to be a specified byte order,
130 * or a byte order indicated by data in the Custom Data (stored in
131 * a fashion that doesn't require knowing the byte order of the
132 * Custom Data, as it's also the byte order of the Custom Data
133 * itself), so that programs ignorant of the format of a given
134 * type of Custom Block can still read a block from one file and
135 * write it to another, even if the host doing the writing has
136 * a byte order different from the host that previously wrote
137 * the file.
138 */
139typedef enum {
140 OPT_SECTION_BYTE_ORDER, /* byte order of this section */
141 OPT_BIG_ENDIAN, /* as it says */
142 OPT_LITTLE_ENDIAN /* ditto */
143} pcapng_opt_byte_order_e;
144
145/*
146 * Process the options section of a block. process_option points to
147 * a routine that processes all the block-specific options, i.e.
148 * options other than the end-of-options, comment, and custom
149 * options.
150 */
151WS_DLL_PUBLIC
152bool pcapng_process_options(FILE_T fh, wtapng_block_t *wblock,
153 section_info_t *section_info,
154 unsigned opt_cont_buf_len,
155 bool (*process_option)(wtapng_block_t *,
156 const section_info_t *,
157 uint16_t, uint16_t,
158 const uint8_t *,
159 int *, char **),
160 pcapng_opt_byte_order_e byte_order,
161 int *err, char **err_info);
162
163/*
164 * Helper routines to process options with types used in more than one
165 * block type.
166 */
167WS_DLL_PUBLIC
168void pcapng_process_uint8_option(wtapng_block_t *wblock,
169 uint16_t option_code, uint16_t option_length,
170 const uint8_t *option_content);
171
172WS_DLL_PUBLIC
173void pcapng_process_uint32_option(wtapng_block_t *wblock,
174 const section_info_t *section_info,
175 pcapng_opt_byte_order_e byte_order,
176 uint16_t option_code, uint16_t option_length,
177 const uint8_t *option_content);
178
179WS_DLL_PUBLIC
180void pcapng_process_timestamp_option(wtapng_block_t *wblock,
181 const section_info_t *section_info,
182 pcapng_opt_byte_order_e byte_order,
183 uint16_t option_code, uint16_t option_length,
184 const uint8_t *option_content);
185
186WS_DLL_PUBLIC
187void pcapng_process_uint64_option(wtapng_block_t *wblock,
188 const section_info_t *section_info,
189 pcapng_opt_byte_order_e byte_order,
190 uint16_t option_code, uint16_t option_length,
191 const uint8_t *option_content);
192
193WS_DLL_PUBLIC
194void pcapng_process_int64_option(wtapng_block_t *wblock,
195 const section_info_t *section_info,
196 pcapng_opt_byte_order_e byte_order,
197 uint16_t option_code, uint16_t option_length,
198 const uint8_t *option_content);
199
200WS_DLL_PUBLIC
201void pcapng_process_string_option(wtapng_block_t *wblock, uint16_t option_code,
202 uint16_t option_length, const uint8_t *option_content);
203
204WS_DLL_PUBLIC
205void pcapng_process_bytes_option(wtapng_block_t *wblock, uint16_t option_code,
206 uint16_t option_length, const uint8_t *option_content);
207
208#endif /* __PCAP_MODULE_H__ */
Definition pcapng_module.h:77
uint16_t version_major
Definition pcapng_module.h:79
int64_t shb_off
Definition pcapng_module.h:82
uint32_t bblog_version
Definition pcapng_module.h:83
uint16_t version_minor
Definition pcapng_module.h:80
uint64_t bblog_offset_tv_sec
Definition pcapng_module.h:84
GArray * interfaces
Definition pcapng_module.h:81
bool byte_swapped
Definition pcapng_module.h:78
Definition wtap_opttypes.c:85
Definition wtap-int.h:97
Definition file_wrappers.c:215
Definition wtap.h:1432
Definition pcapng_module.h:65
Definition wtap_opttypes.h:423