mirror of
https://github.com/wader/fq.git
synced 2025-01-07 06:36:26 +03:00
8e0dde03d0
This will allow passing both cli options and format options to sub decoder. Ex: pass keylog option to a tls decoder when decoding a pcap. Ex: pass decode options to a format inside a http body inside a pcap. Add ArgAs method to lookup argument based on type. This also makes the format decode function have same signature as sub decoders in the decode API. This change decode.Format a bit: DecodeFn is now just func(d *D) any DecodeInArg renamed to DefaultInArg
66 lines
1.7 KiB
Go
66 lines
1.7 KiB
Go
package inet
|
|
|
|
// TODO: rename NetworkLayer? wireshark calls it "Family", pcap-linktype(7) calls it "network-layer protocol"
|
|
|
|
import (
|
|
"github.com/wader/fq/format"
|
|
"github.com/wader/fq/pkg/decode"
|
|
"github.com/wader/fq/pkg/interp"
|
|
"github.com/wader/fq/pkg/scalar"
|
|
)
|
|
|
|
var bsdLoopbackFrameInetPacketGroup decode.Group
|
|
|
|
func init() {
|
|
interp.RegisterFormat(decode.Format{
|
|
Name: format.BSD_LOOPBACK_FRAME,
|
|
Description: "BSD loopback frame",
|
|
Groups: []string{format.LINK_FRAME},
|
|
Dependencies: []decode.Dependency{
|
|
{Names: []string{format.INET_PACKET}, Group: &bsdLoopbackFrameInetPacketGroup},
|
|
},
|
|
DecodeFn: decodeLoopbackFrame,
|
|
})
|
|
}
|
|
|
|
const (
|
|
bsdLoopbackNetworkLayerIPv4 = 0x2
|
|
bsdLoopbackNetworkLayerIPv6 = 0x1e
|
|
)
|
|
|
|
var bsdLoopbackFrameNetworkLayerEtherType = map[uint64]int{
|
|
bsdLoopbackNetworkLayerIPv4: format.EtherTypeIPv4,
|
|
bsdLoopbackNetworkLayerIPv6: format.EtherTypeIPv6,
|
|
}
|
|
|
|
var bsdLookbackNetworkLayerMap = scalar.UintMap{
|
|
bsdLoopbackNetworkLayerIPv4: {Sym: "ipv4", Description: `Internet protocol v4`},
|
|
bsdLoopbackNetworkLayerIPv6: {Sym: "ipv6", Description: `Internet protocol v6`},
|
|
}
|
|
|
|
func decodeLoopbackFrame(d *decode.D) any {
|
|
var lfi format.LinkFrameIn
|
|
if d.ArgAs(&lfi) {
|
|
if lfi.Type != format.LinkTypeNULL {
|
|
d.Fatalf("wrong link type %d", lfi.Type)
|
|
}
|
|
// TODO: where is this documented?
|
|
if lfi.IsLittleEndian {
|
|
d.Endian = decode.LittleEndian
|
|
}
|
|
}
|
|
// if no LinkFrameIn assume big endian for now
|
|
|
|
networkLayer := d.FieldU32("network_layer", bsdLookbackNetworkLayerMap, scalar.UintHex)
|
|
|
|
d.FieldFormatOrRawLen(
|
|
"payload",
|
|
d.BitsLeft(),
|
|
bsdLoopbackFrameInetPacketGroup,
|
|
// TODO: unknown mapped to ether type 0 is ok?
|
|
format.InetPacketIn{EtherType: bsdLoopbackFrameNetworkLayerEtherType[networkLayer]},
|
|
)
|
|
|
|
return nil
|
|
}
|