forked from appneta/tcpreplay
-
Notifications
You must be signed in to change notification settings - Fork 0
/
jnpr_ether.c
425 lines (349 loc) · 13.3 KB
/
jnpr_ether.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
/* $Id$ */
/*
* Copyright (c) 2006-2007 Aaron Turner.
* Copyright (c) 2013-2022 Fred Klassen <tcpreplay at appneta dot com> - AppNeta
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the names of the copyright owners nor the names of its
* contributors may be used to endorse or promote products derived from
* this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "jnpr_ether.h"
#include "dlt_utils.h"
#include "jnpr_ether_types.h"
#include "tcpedit.h"
#include "tcpedit_stub.h"
#include <dlt_en10mb/en10mb.h>
#include <stdlib.h>
#include <string.h>
static char dlt_name[] = "jnpr_eth";
static uint16_t dlt_value = DLT_JUNIPER_ETHER;
/*
* Function to register ourselves. This function is always called, regardless
* of what DLT types are being used, so it shouldn't be allocating extra buffers
* or anything like that (use the dlt_jnpr_ether_init() function below for that).
* Tasks:
* - Create a new plugin struct
* - Fill out the provides/requires bit masks. Note: Only specify which fields are
* actually in the header.
* - Add the plugin to the context's plugin chain
* Returns: TCPEDIT_ERROR | TCPEDIT_OK | TCPEDIT_WARN
*/
int
dlt_jnpr_ether_register(tcpeditdlt_t *ctx)
{
tcpeditdlt_plugin_t *plugin;
assert(ctx);
/* create a new plugin structure */
plugin = tcpedit_dlt_newplugin();
plugin->provides += PLUGIN_MASK_PROTO + PLUGIN_MASK_SRCADDR + PLUGIN_MASK_DSTADDR;
plugin->
requires
= 0;
/* what is our DLT value? */
plugin->dlt = dlt_value;
/* set the prefix name of our plugin. This is also used as the prefix for our options */
plugin->name = safe_strdup(dlt_name);
/*
* Point to our functions, note, you need a function for EVERY method.
* Even if it is only an empty stub returning success.
*/
plugin->plugin_init = dlt_jnpr_ether_init;
plugin->plugin_post_init = dlt_jnpr_ether_post_init;
plugin->plugin_cleanup = dlt_jnpr_ether_cleanup;
plugin->plugin_parse_opts = dlt_jnpr_ether_parse_opts;
plugin->plugin_decode = dlt_jnpr_ether_decode;
plugin->plugin_encode = dlt_jnpr_ether_encode;
plugin->plugin_proto = dlt_jnpr_ether_proto;
plugin->plugin_l2addr_type = dlt_jnpr_ether_l2addr_type;
plugin->plugin_l2len = dlt_jnpr_ether_l2len;
plugin->plugin_get_layer3 = dlt_jnpr_ether_get_layer3;
plugin->plugin_merge_layer3 = dlt_jnpr_ether_merge_layer3;
plugin->plugin_get_mac = dlt_jnpr_ether_get_mac;
/* add it to the available plugin list */
return tcpedit_dlt_addplugin(ctx, plugin);
}
/*
* Initializer function. This function is called only once, if and only if
* this plugin will be utilized. Remember, if you need to keep track of any state,
* store it in your plugin->config, not a global!
* Returns: TCPEDIT_ERROR | TCPEDIT_OK | TCPEDIT_WARN
*/
int
dlt_jnpr_ether_init(tcpeditdlt_t *ctx)
{
tcpeditdlt_plugin_t *plugin;
assert(ctx);
if ((plugin = tcpedit_dlt_getplugin(ctx, dlt_value)) == NULL) {
tcpedit_seterr(ctx->tcpedit, "Unable to initialize unregistered plugin %s", dlt_name);
return TCPEDIT_ERROR;
}
/* allocate memory for our config data */
plugin->config_size = sizeof(jnpr_ether_config_t);
plugin->config = safe_malloc(plugin->config_size);
return TCPEDIT_OK; /* success */
}
/**
* Post init function. This function is called only once after init() and parse_opts()
* It basically allows decoders to properly initialize sub-plugins.
*/
int
dlt_jnpr_ether_post_init(tcpeditdlt_t *ctx)
{
jnpr_ether_config_t *config;
/* do nothing if we're not the decoder */
if (ctx->decoder->dlt != dlt_value)
return TCPEDIT_OK;
/* init our subcontext & decoder of en10mb */
config = (jnpr_ether_config_t *)ctx->encoder->config;
if (config->subctx == NULL)
config->subctx = tcpedit_dlt_init(ctx->tcpedit, DLT_EN10MB);
return TCPEDIT_OK;
}
/*
* Since this is used in a library, we should manually clean up after ourselves
* Unless you allocated some memory in dlt_jnpr_ether_init(), this is just an stub.
* Returns: TCPEDIT_ERROR | TCPEDIT_OK | TCPEDIT_WARN
*/
int
dlt_jnpr_ether_cleanup(tcpeditdlt_t *ctx)
{
tcpeditdlt_plugin_t *plugin;
assert(ctx);
if ((plugin = tcpedit_dlt_getplugin(ctx, dlt_value)) == NULL) {
tcpedit_seterr(ctx->tcpedit, "Unable to cleanup unregistered plugin %s", dlt_name);
return TCPEDIT_ERROR;
}
safe_free(plugin->name);
plugin->name = NULL;
if (plugin->config != NULL) {
/* clean up the en10mb plugin */
jnpr_ether_config_t *config;
config = (jnpr_ether_config_t *)ctx->encoder->config;
if (config->subctx != NULL) {
ctx->decoded_extra = NULL;
tcpedit_dlt_cleanup(config->subctx);
}
safe_free(plugin->config);
plugin->config = NULL;
plugin->config_size = 0;
}
return TCPEDIT_OK; /* success */
}
/*
* This is where you should define all your AutoGen AutoOpts option parsing.
* Any user specified option should have it's bit turned on in the 'provides'
* bit mask.
* Returns: TCPEDIT_ERROR | TCPEDIT_OK | TCPEDIT_WARN
*/
int
dlt_jnpr_ether_parse_opts(tcpeditdlt_t *ctx)
{
assert(ctx);
return TCPEDIT_OK; /* success */
}
/*
* Function to decode the layer 2 header in the packet.
* You need to fill out:
* - ctx->l2len
* - ctx->srcaddr
* - ctx->dstaddr
* - ctx->proto
* - ctx->decoded_extra
* Returns: TCPEDIT_ERROR | TCPEDIT_OK | TCPEDIT_WARN
*/
int
dlt_jnpr_ether_decode(tcpeditdlt_t *ctx, const u_char *packet, int pktlen)
{
int jnpr_header_len = 0;
const u_char *ethernet = NULL;
jnpr_ether_config_t *config;
assert(ctx);
assert(packet);
/* MAGIC + Static fields + Extension Length */
if (pktlen < JUNIPER_ETHER_HEADER_LEN)
return TCPEDIT_ERROR;
config = (jnpr_ether_config_t *)ctx->encoder->config;
/* first, verify magic */
if (memcmp(packet, JUNIPER_ETHER_MAGIC, JUNIPER_ETHER_MAGIC_LEN) != 0) {
tcpedit_seterr(ctx->tcpedit, "Invalid magic 0x%02X%02X%02X", packet[0], packet[1], packet[2]);
return TCPEDIT_ERROR;
}
/* next make sure the L2 header is present */
if ((packet[JUNIPER_ETHER_OPTIONS_OFFSET] & JUNIPER_ETHER_L2PRESENT) != JUNIPER_ETHER_L2PRESENT) {
tcpedit_seterr(ctx->tcpedit, "Frame is missing L2 Header: %x", packet[JUNIPER_ETHER_OPTIONS_OFFSET]);
return TCPEDIT_ERROR;
}
/* then get the Juniper header length */
memcpy(&jnpr_header_len, &packet[JUNIPER_ETHER_EXTLEN_OFFSET], 2);
jnpr_header_len = ntohs(jnpr_header_len) + JUNIPER_ETHER_HEADER_LEN;
dbgx(1, "jnpr header len: %d", jnpr_header_len);
/* make sure the packet is big enough to find the Ethernet Header */
if (pktlen < jnpr_header_len + TCPR_ETH_H) {
tcpedit_seterr(ctx->tcpedit, "Frame is too short! %d < %d", pktlen, (jnpr_header_len + TCPR_ETH_H));
return TCPEDIT_ERROR;
}
ctx->l2len = jnpr_header_len;
/* jump to the appropriate offset */
ethernet = packet + jnpr_header_len;
/* let the en10mb plugin decode the rest */
if (tcpedit_dlt_decode(config->subctx, ethernet, (pktlen - jnpr_header_len)) == TCPEDIT_ERROR)
return TCPEDIT_ERROR;
/* copy the subdecoder state to our encoder state */
if (tcpedit_dlt_copy_decoder_state(ctx, config->subctx) == TCPEDIT_ERROR)
return TCPEDIT_ERROR;
return TCPEDIT_OK;
}
/*
* Function to encode the layer 2 header back into the packet.
* Returns: total packet len or TCPEDIT_ERROR
*/
int
dlt_jnpr_ether_encode(tcpeditdlt_t *ctx, u_char *packet, int pktlen, _U_ tcpr_dir_t dir)
{
assert(ctx);
assert(packet);
/* MAGIC + Static fields + Extension Length */
if (pktlen < JUNIPER_ETHER_HEADER_LEN)
return TCPEDIT_ERROR;
tcpedit_seterr(ctx->tcpedit, "%s", "DLT_JUNIPER_ETHER plugin does not support packet encoding");
return TCPEDIT_ERROR;
}
/*
* Function returns the Layer 3 protocol type of the given packet, or TCPEDIT_ERROR on error
* Make sure you return this value in NETWORK byte order!
*/
int
dlt_jnpr_ether_proto(tcpeditdlt_t *ctx, const u_char *packet, int pktlen)
{
int jnpr_hdr_len;
const u_char *ethernet;
jnpr_ether_config_t *config;
assert(ctx);
assert(packet);
/* MAGIC + Static fields + Extension Length */
if (pktlen < JUNIPER_ETHER_HEADER_LEN)
return TCPEDIT_ERROR;
config = (jnpr_ether_config_t *)ctx->encoder->config;
/* next make sure the L2 header is present */
if ((packet[JUNIPER_ETHER_OPTIONS_OFFSET] & JUNIPER_ETHER_L2PRESENT) != JUNIPER_ETHER_L2PRESENT) {
tcpedit_seterr(ctx->tcpedit, "Frame is missing L2 Header: %x", packet[JUNIPER_ETHER_OPTIONS_OFFSET]);
return TCPEDIT_ERROR;
}
/* then get the Juniper header length */
memcpy(&jnpr_hdr_len, &packet[JUNIPER_ETHER_EXTLEN_OFFSET], 2);
jnpr_hdr_len = ntohs(jnpr_hdr_len) + JUNIPER_ETHER_HEADER_LEN;
ethernet = packet + jnpr_hdr_len;
/* let the en10mb plugin do the rest of the work */
return tcpedit_dlt_proto(config->subctx, DLT_EN10MB, ethernet, (pktlen - jnpr_hdr_len));
}
/*
* Function returns a pointer to the layer 3 protocol header or NULL on error
*/
u_char *
dlt_jnpr_ether_get_layer3(tcpeditdlt_t *ctx, u_char *packet, int pktlen)
{
int l2len;
assert(ctx);
assert(packet);
/* next make sure the L2 header is present */
if ((packet[JUNIPER_ETHER_OPTIONS_OFFSET] & JUNIPER_ETHER_L2PRESENT) != JUNIPER_ETHER_L2PRESENT) {
tcpedit_seterr(ctx->tcpedit, "Frame is missing L2 Header: %x", packet[JUNIPER_ETHER_OPTIONS_OFFSET]);
return NULL;
}
l2len = dlt_jnpr_ether_l2len(ctx, packet, pktlen);
if (l2len == -1 || pktlen < l2len)
return NULL;
return tcpedit_dlt_l3data_copy(ctx, packet, pktlen, l2len);
}
/*
* function merges the packet (containing L2 and old L3) with the l3data buffer
* containing the new l3 data. Note, if L2 % 4 == 0, then they're pointing to the
* same buffer, otherwise there was a memcpy involved on strictly aligned architectures
* like SPARC
*/
u_char *
dlt_jnpr_ether_merge_layer3(tcpeditdlt_t *ctx, u_char *packet, int pktlen, u_char *ipv4_data, u_char *ipv6_data)
{
int l2len;
assert(ctx);
assert(packet);
assert(ipv4_data || ipv6_data);
l2len = dlt_jnpr_ether_l2len(ctx, packet, pktlen);
if (l2len == -1 || pktlen < l2len)
return NULL;
return tcpedit_dlt_l3data_merge(ctx, packet, pktlen, ipv4_data ?: ipv6_data, l2len);
}
/*
* return a static pointer to the source/destination MAC address
* return NULL on error/address doesn't exist
*/
u_char *
dlt_jnpr_ether_get_mac(tcpeditdlt_t *ctx, tcpeditdlt_mac_type_t mac, const u_char *packet, int pktlen)
{
const u_char *ethernet = NULL;
jnpr_ether_config_t *config;
int jnpr_hdr_len = 0;
assert(ctx);
assert(packet);
if (pktlen < JUNIPER_ETHER_EXTLEN_OFFSET + 2)
return NULL;
config = (jnpr_ether_config_t *)ctx->encoder->config;
/* first get the Juniper header length */
memcpy(&jnpr_hdr_len, &packet[JUNIPER_ETHER_EXTLEN_OFFSET], 2);
jnpr_hdr_len = ntohs(jnpr_hdr_len) + JUNIPER_ETHER_HEADER_LEN;
ethernet = packet + jnpr_hdr_len;
return dlt_en10mb_get_mac(config->subctx, mac, ethernet, (pktlen - jnpr_hdr_len));
}
/*
* return the length of the L2 header of the current packet
*/
int
dlt_jnpr_ether_l2len(tcpeditdlt_t *ctx, const u_char *packet, int pktlen)
{
int len, res;
jnpr_ether_config_t *config;
assert(ctx);
assert(packet);
if (pktlen < JUNIPER_ETHER_EXTLEN_OFFSET + 2)
return -1;
config = (jnpr_ether_config_t *)ctx->encoder->config;
/* first get the Juniper header length */
memcpy(&len, &packet[JUNIPER_ETHER_EXTLEN_OFFSET], 2);
len = ntohs(len) + JUNIPER_ETHER_HEADER_LEN;
dbgx(3, "juniper header len: %u", len);
/* add the 802.3 length */
res = tcpedit_dlt_l2len(config->subctx, DLT_EN10MB, (packet + len), (pktlen - len));
if (res == -1)
return TCPEDIT_ERROR;
len += res;
dbgx(3, "total l2len: %u", len);
/* and return that */
return len;
}
tcpeditdlt_l2addr_type_t
dlt_jnpr_ether_l2addr_type(void)
{
return ETHERNET;
}