1 /* 2 * Copyright (c) 2013, Petar Alilovic, 3 * Faculty of Electrical Engineering and Computing, University of Zagreb 4 * All rights reserved 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * * Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * * Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY 16 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY 19 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 20 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 22 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 25 * DAMAGE. 26 */ 27 28 /* \summary: DLT_NFLOG printer */ 29 30 #include <config.h> 31 32 #include "netdissect-stdinc.h" 33 34 #include "netdissect.h" 35 #include "extract.h" 36 37 #ifdef DLT_NFLOG 38 39 /* 40 * Structure of an NFLOG header and TLV parts, as described at 41 * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html 42 * 43 * The NFLOG header is big-endian. 44 * 45 * The TLV length and type are in host byte order. The value is either 46 * big-endian or is an array of bytes in some externally-specified byte 47 * order (text string, link-layer address, link-layer header, packet 48 * data, etc.). 49 */ 50 typedef struct nflog_hdr { 51 nd_uint8_t nflog_family; /* address family */ 52 nd_uint8_t nflog_version; /* version */ 53 nd_uint16_t nflog_rid; /* resource ID */ 54 } nflog_hdr_t; 55 56 #define NFLOG_HDR_LEN sizeof(nflog_hdr_t) 57 58 typedef struct nflog_tlv { 59 nd_uint16_t tlv_length; /* tlv length */ 60 nd_uint16_t tlv_type; /* tlv type */ 61 /* value follows this */ 62 } nflog_tlv_t; 63 64 #define NFLOG_TLV_LEN sizeof(nflog_tlv_t) 65 66 typedef struct nflog_packet_hdr { 67 nd_uint16_t hw_protocol; /* hw protocol */ 68 nd_uint8_t hook; /* netfilter hook */ 69 nd_byte pad[1]; /* padding to 32 bits */ 70 } nflog_packet_hdr_t; 71 72 typedef struct nflog_hwaddr { 73 nd_uint16_t hw_addrlen; /* address length */ 74 nd_byte pad[2]; /* padding to 32-bit boundary */ 75 nd_byte hw_addr[8]; /* address, up to 8 bytes */ 76 } nflog_hwaddr_t; 77 78 typedef struct nflog_timestamp { 79 nd_uint64_t sec; 80 nd_uint64_t usec; 81 } nflog_timestamp_t; 82 83 /* 84 * TLV types. 85 */ 86 #define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */ 87 #define NFULA_MARK 2 /* packet mark from skbuff */ 88 #define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */ 89 #define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */ 90 #define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */ 91 #define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */ 92 #define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */ 93 #define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */ 94 #define NFULA_PAYLOAD 9 /* packet payload */ 95 #define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */ 96 #define NFULA_UID 11 /* UID owning socket on which packet was sent/received */ 97 #define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */ 98 #define NFULA_SEQ_GLOBAL 13 /* sequence number of packets on all NFLOG sockets */ 99 #define NFULA_GID 14 /* GID owning socket on which packet was sent/received */ 100 #define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */ 101 #define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */ 102 #define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */ 103 104 /* 105 * Define two constants specifically for the two AF code points from the 106 * LINKTYPE_NFLOG specification above and use these constants instead of 107 * AF_INET and AF_INET6. This is the only way to dissect the "wire" encoding 108 * correctly because some BSD systems define AF_INET6 differently from Linux 109 * (see af.h) and Haiku defines both AF_INET and AF_INET6 differently from 110 * Linux. 111 */ 112 #define NFLOG_AF_INET 2 113 #define NFLOG_AF_INET6 10 114 static const struct tok nflog_values[] = { 115 { NFLOG_AF_INET, "IPv4" }, 116 { NFLOG_AF_INET6, "IPv6" }, 117 { 0, NULL } 118 }; 119 120 static void 121 nflog_hdr_print(netdissect_options *ndo, const nflog_hdr_t *hdr, u_int length) 122 { 123 ND_PRINT("version %u, resource ID %u", 124 GET_U_1(hdr->nflog_version), GET_BE_U_2(hdr->nflog_rid)); 125 126 if (!ndo->ndo_qflag) { 127 ND_PRINT(", family %s (%u)", 128 tok2str(nflog_values, "Unknown", 129 GET_U_1(hdr->nflog_family)), 130 GET_U_1(hdr->nflog_family)); 131 } else { 132 ND_PRINT(", %s", 133 tok2str(nflog_values, 134 "Unknown NFLOG (0x%02x)", 135 GET_U_1(hdr->nflog_family))); 136 } 137 138 ND_PRINT(", length %u: ", length); 139 } 140 141 void 142 nflog_if_print(netdissect_options *ndo, 143 const struct pcap_pkthdr *h, const u_char *p) 144 { 145 const nflog_hdr_t *hdr = (const nflog_hdr_t *)p; 146 uint16_t size; 147 uint16_t h_size = NFLOG_HDR_LEN; 148 u_int caplen = h->caplen; 149 u_int length = h->len; 150 151 ndo->ndo_protocol = "nflog"; 152 if (caplen < NFLOG_HDR_LEN) { 153 nd_print_trunc(ndo); 154 ndo->ndo_ll_hdr_len += caplen; 155 return; 156 } 157 ndo->ndo_ll_hdr_len += NFLOG_HDR_LEN; 158 159 ND_TCHECK_SIZE(hdr); 160 if (GET_U_1(hdr->nflog_version) != 0) { 161 ND_PRINT("version %u (unknown)", GET_U_1(hdr->nflog_version)); 162 return; 163 } 164 165 if (ndo->ndo_eflag) 166 nflog_hdr_print(ndo, hdr, length); 167 168 p += NFLOG_HDR_LEN; 169 length -= NFLOG_HDR_LEN; 170 caplen -= NFLOG_HDR_LEN; 171 172 while (length > 0) { 173 const nflog_tlv_t *tlv; 174 175 /* We have some data. Do we have enough for the TLV header? */ 176 if (caplen < NFLOG_TLV_LEN) 177 goto trunc; /* No. */ 178 179 tlv = (const nflog_tlv_t *) p; 180 ND_TCHECK_SIZE(tlv); 181 size = GET_HE_U_2(tlv->tlv_length); 182 if (size % 4 != 0) 183 size += 4 - size % 4; 184 185 /* Is the TLV's length less than the minimum? */ 186 if (size < NFLOG_TLV_LEN) 187 goto trunc; /* Yes. Give up now. */ 188 189 /* Do we have enough data for the full TLV? */ 190 if (caplen < size) 191 goto trunc; /* No. */ 192 193 if (GET_HE_U_2(tlv->tlv_type) == NFULA_PAYLOAD) { 194 /* 195 * This TLV's data is the packet payload. 196 * Skip past the TLV header, and break out 197 * of the loop so we print the packet data. 198 */ 199 p += NFLOG_TLV_LEN; 200 h_size += NFLOG_TLV_LEN; 201 length -= NFLOG_TLV_LEN; 202 caplen -= NFLOG_TLV_LEN; 203 break; 204 } 205 206 p += size; 207 h_size += size; 208 length -= size; 209 caplen -= size; 210 } 211 212 switch (GET_U_1(hdr->nflog_family)) { 213 214 case NFLOG_AF_INET: 215 ip_print(ndo, p, length); 216 break; 217 218 case NFLOG_AF_INET6: 219 ip6_print(ndo, p, length); 220 break; 221 222 default: 223 if (!ndo->ndo_eflag) 224 nflog_hdr_print(ndo, hdr, 225 length + NFLOG_HDR_LEN); 226 227 if (!ndo->ndo_suppress_default_print) 228 ND_DEFAULTPRINT(p, caplen); 229 break; 230 } 231 232 ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN; 233 return; 234 trunc: 235 nd_print_trunc(ndo); 236 ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN; 237 } 238 239 #endif /* DLT_NFLOG */ 240