nmsg  0.9.0
pkt.c
1 /* pkt nmsg message module */
2 
3 /*
4  * Copyright (c) 2010 by Farsight Security, Inc.
5  *
6  * Licensed under the Apache License, Version 2.0 (the "License");
7  * you may not use this file except in compliance with the License.
8  * You may obtain a copy of the License at
9  *
10  * http://www.apache.org/licenses/LICENSE-2.0
11  *
12  * Unless required by applicable law or agreed to in writing, software
13  * distributed under the License is distributed on an "AS IS" BASIS,
14  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15  * See the License for the specific language governing permissions and
16  * limitations under the License.
17  */
18 
19 /* Import. */
20 
21 #include "pkt.pb-c.h"
22 
23 /* Exported via module context. */
24 
25 static nmsg_res
26 pkt_pcap_init(void *clos, nmsg_pcap_t pcap);
27 
28 static nmsg_res
29 pkt_pkt_to_payload(void *clos, nmsg_pcap_t pcap, nmsg_message_t *m);
30 
31 /* Data. */
32 
33 struct nmsg_msgmod_field pkt_fields[] = {
34  {
36  .name = "len_frame",
37  },
38  {
39  .type = nmsg_msgmod_ft_bytes,
40  .name = "payload",
41  },
42  NMSG_MSGMOD_FIELD_END
43 };
44 
45 /* Export. */
46 
47 struct nmsg_msgmod_plugin nmsg_msgmod_ctx = {
48  NMSG_MSGMOD_REQUIRED_INIT,
49  .vendor = NMSG_VENDOR_BASE,
50  .msgtype = { NMSG_VENDOR_BASE_PKT_ID, NMSG_VENDOR_BASE_PKT_NAME },
51 
52  .pbdescr = &nmsg__base__pkt__descriptor,
53  .fields = pkt_fields,
54  .pkt_to_payload = pkt_pkt_to_payload,
55  .pcap_init = pkt_pcap_init
56 };
57 
58 static nmsg_res
59 pkt_pcap_init(void *clos, nmsg_pcap_t pcap) {
60  if (nmsg_pcap_get_datalink(pcap) != DLT_EN10MB) {
61  if (nmsg_get_debug() >= 1)
62  fprintf(stderr, "%s: ERROR: This message type cannot be used "
63  "safely with datalink types other than DLT_EN10MB.\n",
64  __func__);
65  return (nmsg_res_failure);
66  }
67  return (nmsg_res_success);
68 }
69 
70 static nmsg_res
71 pkt_pkt_to_payload(void *clos, nmsg_pcap_t pcap, nmsg_message_t *m) {
72  Nmsg__Base__Pkt *pkt;
73  const uint8_t *pkt_data;
74  int snaplen;
75  nmsg_res res;
76  size_t buf_sz;
77  struct pcap_pkthdr *pkt_hdr;
78  struct timespec ts;
79  uint8_t *buf;
80 
81  /* get a packet and return it as an encapsulated message object */
82  res = nmsg_pcap_input_read_raw(pcap, &pkt_hdr, &pkt_data, &ts);
83  if (res != nmsg_res_success)
84  return (res);
85 
86  /* get snaplen */
87  snaplen = nmsg_pcap_snapshot(pcap);
88  if (snaplen == 0)
89  snaplen = 65535;
90 
91  /* allocate space for serialized payload */
92  buf = malloc(snaplen + 64);
93  if (buf == NULL)
94  return (nmsg_res_memfail);
95 
96  /* initialize the Nmsg__Base__Pkt object */
97  pkt = calloc(1, sizeof(*pkt));
98  if (pkt == NULL) {
99  free(buf);
100  return (nmsg_res_memfail);
101  }
102  nmsg__base__pkt__init(pkt);
103 
104  pkt->payload.len = pkt_hdr->caplen;
105  pkt->payload.data = (uint8_t *) pkt_data;
106  pkt->len_frame = pkt_hdr->len;
107  pkt->has_len_frame = 1;
108  buf_sz = nmsg__base__pkt__pack(pkt, buf);
109  pkt->payload.len = 0;
110  pkt->payload.data = NULL;
111  *m = nmsg_message_from_raw_payload(NMSG_VENDOR_BASE_ID,
112  NMSG_VENDOR_BASE_PKT_ID,
113  buf, buf_sz, &ts);
114  free(pkt);
115  return (nmsg_res_success);
116 }
Structure exported by message modules to implement a new message type.
nmsg_res
nmsg result code
Definition: res.h:25
success
Definition: res.h:26
int nmsg_pcap_get_datalink(nmsg_pcap_t pcap)
Get the datalink type of the underlying pcap handle.
Definition: pcap_input.c:346
out of memory
Definition: res.h:29
Protobuf byte array.
Definition: msgmod.h:78
Structure mapping protocol buffer schema fields to nmsg_msgmod_field_type values for "transparent" mo...
Protobuf uint32.
Definition: msgmod.h:102
generic failure
Definition: res.h:27
nmsg_msgmod_field_type type
Intended (nmsg) type of this protobuf field.
int nmsg_pcap_snapshot(nmsg_pcap_t pcap)
Get the snapshot length of the underlying pcap handle.
Definition: pcap_input.c:336
nmsg_message_t nmsg_message_from_raw_payload(unsigned vid, unsigned msgtype, uint8_t *data, size_t sz, const struct timespec *ts)
Initialize a new message object from an opaque payload blob.
int nmsg_get_debug(void)
Retrieve the current debug level.
Definition: nmsg.c:71
nmsg_res nmsg_pcap_input_read_raw(nmsg_pcap_t pcap, struct pcap_pkthdr **pkt_hdr, const uint8_t **pkt_data, struct timespec *ts)
Read a raw packet from an nmsg_pcap_t input.
Definition: pcap_input.c:100