1
1
mirror of https://github.com/wader/fq.git synced 2024-12-24 22:05:31 +03:00
fq/format/inet/sll2_packet.go
Mattias Wadman 1ddea1ada3 interp,format: Refactor registry usage and use function helpers
Move registry to interp and add support for functions and filesystems.
This will be used later for allow formats to add own functions and fq code.

Add gojqextra function helpers to have more comfortable API to add functions.
Takes care of argument type casting and JQValue:s and some more things.

Refactor interp package to use new function helper and registry. Probably
fixes a bunch of JQValue bugs and other type errors.

Refactor out some mpeg nal things to mpeg format.

Refactor interp jq code into display.q and init.jq.

Remove undocumented aes_ctr funciton, was a test. Hopefully will add more crypto things laster.
2022-07-16 19:24:13 +02:00

67 lines
1.8 KiB
Go

package inet
// SLL stands for sockaddr_ll
// https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html
import (
"github.com/wader/fq/format"
"github.com/wader/fq/pkg/decode"
"github.com/wader/fq/pkg/interp"
"github.com/wader/fq/pkg/scalar"
)
var sllPacket2InetPacketGroup decode.Group
func init() {
interp.RegisterFormat(decode.Format{
Name: format.SLL2_PACKET,
Description: "Linux cooked capture encapsulation v2",
Groups: []string{format.LINK_FRAME},
Dependencies: []decode.Dependency{
{Names: []string{format.INET_PACKET}, Group: &sllPacket2InetPacketGroup},
},
DecodeFn: decodeSLL2,
})
}
func decodeSLL2(d *decode.D, in any) any {
if lfi, ok := in.(format.LinkFrameIn); ok {
if lfi.Type != format.LinkTypeLINUX_SLL2 {
d.Fatalf("wrong link type %d", lfi.Type)
}
}
protcolType := d.FieldU16("protocol_type", format.EtherTypeMap, scalar.ActualHex)
d.FieldU16("reserved")
d.FieldU32("interface_index")
arpHdrType := d.FieldU16("arphdr_type", arpHdrTypeMAp)
d.FieldU8("packet_type", sllPacketTypeMap)
addressLength := d.FieldU8("link_address_length", d.ValidateURange(0, 8))
// "If there are more than 8 bytes, only the first 8 bytes are present"
if addressLength > 8 {
addressLength = 8
}
// TODO: maybe skip padding and always read 8 bytes?
d.FieldU("link_address", int(addressLength)*8)
addressDiff := 8 - addressLength
if addressDiff > 0 {
d.FieldRawLen("padding", int64(addressDiff)*8)
}
// TODO: handle other arphdr types
switch arpHdrType {
case arpHdrTypeLoopback, arpHdrTypeEther:
_ = d.FieldMustGet("link_address").TryScalarFn(mapUToEtherSym, scalar.ActualHex)
d.FieldFormatOrRawLen(
"payload",
d.BitsLeft(),
sllPacket2InetPacketGroup,
format.LinkFrameIn{Type: int(protcolType)},
)
default:
d.FieldRawLen("payload", d.BitsLeft())
}
return nil
}