ongrep

A cleaned up fork of ngrep for OpenBSD
git clone git://git.sgregoratto.me/ongrep
Log | Files | Refs | README | LICENSE

ngrep.h (4055B)


      1 /*
      2  * Copyright (c) 2017  Jordan Ritter <jpr5@darkridge.com>
      3  * Copyright (c) 2020  Stephen Gregoratto <dev@sgregoratto.me>
      4  *
      5  * Please refer to the LICENSE file for more information.
      6  *
      7  */
      8 
      9 /*
     10  * We cache the standard frame sizes here to save us time and
     11  * additional dependencies on more operating system include files.
     12  */
     13 #define ETHHDR_SIZE 14
     14 #define TOKENRING_SIZE 22
     15 #define PPPHDR_SIZE 4
     16 #define SLIPHDR_SIZE 16
     17 #define RAWHDR_SIZE 0
     18 #define LOOPHDR_SIZE 4
     19 #define FDDIHDR_SIZE 21
     20 #define ISDNHDR_SIZE 16
     21 #define IEEE80211HDR_SIZE 32
     22 #define PFLOGHDR_SIZE 48
     23 #define VLANHDR_SIZE 4
     24 #define IPNETHDR_SIZE 24
     25 
     26 #define EXTRACT_16BITS(p)                                                      \
     27 	((uint16_t)((uint16_t) * ((const uint8_t *)(p) + 0) << 8 |             \
     28 		    (uint16_t) * ((const uint8_t *)(p) + 1)))
     29 
     30 #define UNUSED __attribute__((__unused__))
     31 
     32 /*
     33  * Default patterns for BPF and regular expression filters.
     34  *
     35  * When targeting IP frames with a BPF filter, optionally-present VLAN frames
     36  * will be excluded by default, thus any IP traffic on a VLAN'd network is
     37  * invisible to ngrep by default.  This requires the user to specify "vlan"
     38  * every time they are on a VLAN'd network, which gets irritating fast.
     39  *
     40  * In turn, this leads to a surprising behavior when working with pcap dump
     41  * files created from a "vlan" filter: reading and re-processing them requires
     42  * the same "vlan" filter to be specified, otherwise the traffic will be
     43  * invisible.  IOW, when the dump reader is targeting IP traffic in the dump but
     44  * doesn't know (or remember) the "vlan" filter was specified, they will see
     45  * nothing -- and mistakenly blame ngrep.
     46  *
     47  * While the behavior is technically consistent, to the user it can be
     48  * surprising, confusing, and therefore Dumb As Shit.  For convenience' sake, we
     49  * fix this for them by including VLAN (optionally) back into the stream
     50  * targeting IP traffic, and compensating for the variable offset in the packet
     51  * decoder.
     52  */
     53 #define BPF_FILTER_IP_TYPE	"(ip || ip6)"
     54 #define BPF_TEMPLATE_IP		BPF_FILTER_IP_TYPE
     55 #define BPF_TEMPLATE_IP_VLAN	"(" BPF_FILTER_IP_TYPE " || (vlan && " BPF_FILTER_IP_TYPE "))"
     56 
     57 #define WORD_REGEX	"((^%s\\W)|(\\W%s$)|(\\W%s\\W))"
     58 
     59 typedef void	(*dump_func)(unsigned char *, uint32_t, uint16_t, uint16_t);
     60 typedef int8_t	(*match_func)(unsigned char *, uint32_t, uint16_t *,
     61 			uint16_t *);
     62 typedef void	(*delay_func)(struct pcap_pkthdr *);
     63 typedef void	(*ts_func)(struct pcap_pkthdr *);
     64 
     65 int	setup_pcap_source(void);
     66 int	setup_bpf_filter(char **);
     67 int	hextoc(char d, char *c);
     68 int	setup_hex_match(void);
     69 int	setup_pattern_match(void);
     70 int	setup_matcher(void);
     71 
     72 void	process(u_char *, struct pcap_pkthdr *, u_char *);
     73 
     74 __dead void	usage(void);
     75 void		update_windowsize(int32_t);
     76 __dead void	clean_exit(int);
     77 
     78 void	dump_packet(struct pcap_pkthdr *, u_char *, uint8_t, unsigned char *, uint32_t,
     79 		const char *, const char *, uint16_t, uint16_t, uint8_t,
     80 		uint16_t, uint8_t, uint16_t, uint32_t);
     81 
     82 void	dump_unwrapped(unsigned char *, uint32_t, uint16_t, uint16_t);
     83 void	dump_formatted(unsigned char *, uint32_t, uint16_t, uint16_t);
     84 void	dump_byline(unsigned char *, uint32_t, uint16_t, uint16_t);
     85 
     86 void	dump_delay_proc_init(struct pcap_pkthdr *);
     87 void	dump_delay_proc(struct pcap_pkthdr *);
     88 
     89 int8_t	re_match_func(unsigned char *, uint32_t, uint16_t *, uint16_t *);
     90 int8_t	bin_match_func(unsigned char *, uint32_t, uint16_t *, uint16_t *);
     91 int8_t	blank_match_func(unsigned char *, uint32_t, uint16_t *, uint16_t *);
     92 
     93 void	print_time_absolute(struct pcap_pkthdr *);
     94 void	print_time_diff(struct pcap_pkthdr *);
     95 void	print_time_offset(struct pcap_pkthdr *);
     96 
     97 char	*get_filter_from_file(void);
     98 char	*get_filter_from_argv(char **);
     99 
    100 uint8_t	strishex(char *);
    101 
    102 void	 drop_privs(void);
    103 
    104 struct NGREP_rtaphdr_t {
    105 	uint8_t		it_version;
    106 	uint8_t		it_pad;
    107 	uint16_t	it_len;
    108 	uint32_t	it_present;
    109 };
    110 
    111 /* ANSI color/hilite stuff. */
    112 const char	ANSI_red[] = "\33[01;31m";
    113 const char	ANSI_bold[] = "\33[01m";
    114 const char     *ANSI_hilite = ANSI_red;
    115 const char	ANSI_off[] = "\33[00m";