mirror of
https://github.com/wader/fq.git
synced 2024-12-25 22:34:14 +03:00
1ddea1ada3
Move registry to interp and add support for functions and filesystems. This will be used later for allow formats to add own functions and fq code. Add gojqextra function helpers to have more comfortable API to add functions. Takes care of argument type casting and JQValue:s and some more things. Refactor interp package to use new function helper and registry. Probably fixes a bunch of JQValue bugs and other type errors. Refactor out some mpeg nal things to mpeg format. Refactor interp jq code into display.q and init.jq. Remove undocumented aes_ctr funciton, was a test. Hopefully will add more crypto things laster.
67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
package inet
|
|
|
|
// SLL stands for sockaddr_ll
|
|
// https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html
|
|
|
|
import (
|
|
"github.com/wader/fq/format"
|
|
"github.com/wader/fq/pkg/decode"
|
|
"github.com/wader/fq/pkg/interp"
|
|
"github.com/wader/fq/pkg/scalar"
|
|
)
|
|
|
|
var sllPacket2InetPacketGroup decode.Group
|
|
|
|
func init() {
|
|
interp.RegisterFormat(decode.Format{
|
|
Name: format.SLL2_PACKET,
|
|
Description: "Linux cooked capture encapsulation v2",
|
|
Groups: []string{format.LINK_FRAME},
|
|
Dependencies: []decode.Dependency{
|
|
{Names: []string{format.INET_PACKET}, Group: &sllPacket2InetPacketGroup},
|
|
},
|
|
DecodeFn: decodeSLL2,
|
|
})
|
|
}
|
|
|
|
func decodeSLL2(d *decode.D, in any) any {
|
|
if lfi, ok := in.(format.LinkFrameIn); ok {
|
|
if lfi.Type != format.LinkTypeLINUX_SLL2 {
|
|
d.Fatalf("wrong link type %d", lfi.Type)
|
|
}
|
|
}
|
|
|
|
protcolType := d.FieldU16("protocol_type", format.EtherTypeMap, scalar.ActualHex)
|
|
d.FieldU16("reserved")
|
|
d.FieldU32("interface_index")
|
|
arpHdrType := d.FieldU16("arphdr_type", arpHdrTypeMAp)
|
|
d.FieldU8("packet_type", sllPacketTypeMap)
|
|
addressLength := d.FieldU8("link_address_length", d.ValidateURange(0, 8))
|
|
// "If there are more than 8 bytes, only the first 8 bytes are present"
|
|
if addressLength > 8 {
|
|
addressLength = 8
|
|
}
|
|
// TODO: maybe skip padding and always read 8 bytes?
|
|
d.FieldU("link_address", int(addressLength)*8)
|
|
addressDiff := 8 - addressLength
|
|
if addressDiff > 0 {
|
|
d.FieldRawLen("padding", int64(addressDiff)*8)
|
|
}
|
|
|
|
// TODO: handle other arphdr types
|
|
switch arpHdrType {
|
|
case arpHdrTypeLoopback, arpHdrTypeEther:
|
|
_ = d.FieldMustGet("link_address").TryScalarFn(mapUToEtherSym, scalar.ActualHex)
|
|
d.FieldFormatOrRawLen(
|
|
"payload",
|
|
d.BitsLeft(),
|
|
sllPacket2InetPacketGroup,
|
|
format.LinkFrameIn{Type: int(protcolType)},
|
|
)
|
|
default:
|
|
d.FieldRawLen("payload", d.BitsLeft())
|
|
}
|
|
|
|
return nil
|
|
}
|