src/pcap.h

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2009, 2010 Daniel Borkmann.
   5  * Copyright 2010 Emmanuel Roullit.
   6  * Subject to the GPL.
   7  */
   8
   9 #ifndef PCAP_H
  10 #define PCAP_H
  11
  12 #include <unistd.h>
  13 #include <stdint.h>
  14 #include <sys/time.h>
  15 #include <linux/if_packet.h>
  16
  17 #include "compiler.h"
  18 #include "die.h"
  19
  20 #define TCPDUMP_MAGIC              0xa1b2c3d4
  21 #define PCAP_VERSION_MAJOR         2
  22 #define PCAP_VERSION_MINOR         4
  23 #define PCAP_DEFAULT_SNAPSHOT_LEN  65535
  24
  25 #define LINKTYPE_NULL              0   /* BSD loopback encapsulation */
  26 #define LINKTYPE_EN10MB            1   /* Ethernet (10Mb) */
  27 #define LINKTYPE_EN3MB             2   /* Experimental Ethernet (3Mb) */
  28 #define LINKTYPE_AX25              3   /* Amateur Radio AX.25 */
  29 #define LINKTYPE_PRONET            4   /* Proteon ProNET Token Ring */
  30 #define LINKTYPE_CHAOS             5   /* Chaos */
  31 #define LINKTYPE_IEEE802           6   /* 802.5 Token Ring */
  32 #define LINKTYPE_ARCNET            7   /* ARCNET, with BSD-style header */
  33 #define LINKTYPE_SLIP              8   /* Serial Line IP */
  34 #define LINKTYPE_PPP               9   /* Point-to-point Protocol */
  35 #define LINKTYPE_FDDI              10  /* FDDI */
  36
  37 struct pcap_filehdr {
  38         uint32_t magic;
  39         uint16_t version_major;
  40         uint16_t version_minor;
  41         int32_t thiszone;
  42         uint32_t sigfigs;
  43         uint32_t snaplen;
  44         uint32_t linktype;
  45 };
  46
  47 struct pcap_timeval {
  48         int32_t tv_sec;
  49         int32_t tv_usec;
  50 };
  51
  52 struct pcap_nsf_pkthdr {
  53         struct timeval ts;
  54         uint32_t caplen;
  55         uint32_t len;
  56 };
  57
  58 struct pcap_pkthdr {
  59         struct pcap_timeval ts;
  60         uint32_t caplen;
  61         uint32_t len;
  62 };
  63
  64 static inline void tpacket_hdr_to_pcap_pkthdr(struct tpacket_hdr *thdr,
  65                                               struct pcap_pkthdr *phdr)
  66 {
  67         phdr->ts.tv_sec = thdr->tp_sec;
  68         phdr->ts.tv_usec = thdr->tp_usec;
  69         phdr->caplen = thdr->tp_snaplen;
  70         phdr->len = thdr->tp_len;
  71 }
  72
  73 static inline void pcap_pkthdr_to_tpacket_hdr(struct pcap_pkthdr *phdr,
  74                                               struct tpacket_hdr *thdr)
  75 {
  76         thdr->tp_sec = phdr->ts.tv_sec;
  77         thdr->tp_usec = phdr->ts.tv_usec;
  78         thdr->tp_snaplen = phdr->caplen;
  79         thdr->tp_len = phdr->len;
  80 }
  81
  82 struct pcap_file_ops {
  83         int (*pull_file_header)(int fd);
  84         int (*push_file_header)(int fd);
  85         ssize_t (*write_pcap_pkt)(int fd, struct pcap_pkthdr *hdr,
  86                                   uint8_t *packet);
  87         ssize_t (*read_pcap_pkt)(int fd, struct pcap_pkthdr *hdr,
  88                                  uint8_t *packet);
  89 };
  90
  91 static inline void pcap_prepare_header(struct pcap_filehdr *hdr,
  92                                        uint32_t linktype,
  93                                        int32_t thiszone, uint32_t snaplen)
  94 {
  95         hdr->magic = TCPDUMP_MAGIC;
  96         hdr->version_major = PCAP_VERSION_MAJOR;
  97         hdr->version_minor = PCAP_VERSION_MINOR;
  98         hdr->thiszone = thiszone;
  99         hdr->sigfigs = 0;
 100         hdr->snaplen = snaplen;
 101         hdr->linktype = linktype;
 102 }
 103
 104 static inline void pcap_validate_header_maybe_die(struct pcap_filehdr *hdr)
 105 {
 106         if (unlikely(hdr->magic != TCPDUMP_MAGIC ||
 107                      hdr->version_major != PCAP_VERSION_MAJOR ||
 108                      hdr->version_minor != PCAP_VERSION_MINOR ||
 109                      hdr->linktype != LINKTYPE_EN10MB))
 110                 panic("This file has not a valid pcap header!\n");
 111 }
 112
 113 #endif /* PCAP_H */