github.com/gopacket/gopacket@v1.1.0/pcapgo/pcapng.go (about)

     1  // Copyright 2018 The GoPacket Authors. All rights reserved.
     2  //
     3  // Use of this source code is governed by a BSD-style license
     4  // that can be found in the LICENSE file in the root of the source
     5  // tree.
     6  
     7  package pcapgo
     8  
     9  import (
    10  	"errors"
    11  	"math"
    12  	"time"
    13  
    14  	"github.com/gopacket/gopacket"
    15  	"github.com/gopacket/gopacket/layers"
    16  )
    17  
    18  // ErrNgVersionMismatch gets returned for unknown pcapng section versions. This can only happen if ReaderOptions.SkipUnknownVersion == false
    19  var ErrNgVersionMismatch = errors.New("Unknown pcapng Version in Section Header")
    20  
    21  // ErrNgLinkTypeMismatch gets returned if the link type of an interface is not the same as the link type from the first interface. This can only happen if ReaderOptions.ErrorOnMismatchingLinkType == true && ReaderOptions.WantMixedLinkType == false
    22  var ErrNgLinkTypeMismatch = errors.New("Link type of current interface is different from first one")
    23  
    24  const (
    25  	ngByteOrderMagic = 0x1A2B3C4D
    26  
    27  	// We can handle only version 1.0
    28  	ngVersionMajor = 1
    29  	ngVersionMinor = 0
    30  )
    31  
    32  type ngBlockType uint32
    33  
    34  const (
    35  	ngBlockTypeInterfaceDescriptor ngBlockType = 1          // Interface description block
    36  	ngBlockTypePacket              ngBlockType = 2          // Packet block (deprecated)
    37  	ngBlockTypeSimplePacket        ngBlockType = 3          // Simple packet block
    38  	ngBlockTypeInterfaceStatistics ngBlockType = 5          // Interface statistics block
    39  	ngBlockTypeEnhancedPacket      ngBlockType = 6          // Enhanced packet block
    40  	ngBlockTypeDecryptionSecrets   ngBlockType = 0x0000000A // Decryption secrets block
    41  	ngBlockTypeSectionHeader       ngBlockType = 0x0A0D0D0A // Section header block (same in both endians)
    42  )
    43  
    44  const (
    45  	/*
    46  	 * Type describing the format of Decryption Secrets Block (DSB).
    47  	 */
    48  	DSB_SECRETS_TYPE_TLS            uint32 = 0x544c534b /* TLS Key Log */
    49  	DSB_SECRETS_TYPE_SSH            uint32 = 0x5353484b /* SSH Key Log */
    50  	DSB_SECRETS_TYPE_WIREGUARD      uint32 = 0x57474b4c /* WireGuard Key Log */
    51  	DSB_SECRETS_TYPE_ZIGBEE_NWK_KEY uint32 = 0x5a4e574b /* Zigbee NWK Key */
    52  	DSB_SECRETS_TYPE_ZIGBEE_APS_KEY uint32 = 0x5a415053 /* Zigbee APS Key */
    53  )
    54  
    55  // define error types for DSB
    56  var (
    57  	ErrUnknownSecretsType = errors.New("Unknown Decryption Secrets Block (DSB) type")
    58  )
    59  
    60  type ngOptionCode uint16
    61  
    62  const (
    63  	ngOptionCodeEndOfOptions    ngOptionCode = iota // end of options. must be at the end of options in a block
    64  	ngOptionCodeComment                             // comment
    65  	ngOptionCodeHardware                            // description of the hardware
    66  	ngOptionCodeOS                                  // name of the operating system
    67  	ngOptionCodeUserApplication                     // name of the application
    68  )
    69  
    70  const (
    71  	ngOptionCodeInterfaceName                ngOptionCode = iota + 2 // interface name
    72  	ngOptionCodeInterfaceDescription                                 // interface description
    73  	ngOptionCodeInterfaceIPV4Address                                 // IPv4 network address and netmask for the interface
    74  	ngOptionCodeInterfaceIPV6Address                                 // IPv6 network address and prefix length for the interface
    75  	ngOptionCodeInterfaceMACAddress                                  // interface hardware MAC address
    76  	ngOptionCodeInterfaceEUIAddress                                  // interface hardware EUI address
    77  	ngOptionCodeInterfaceSpeed                                       // interface speed in bits/s
    78  	ngOptionCodeInterfaceTimestampResolution                         // timestamp resolution
    79  	ngOptionCodeInterfaceTimezone                                    // time zone
    80  	ngOptionCodeInterfaceFilter                                      // capture filter
    81  	ngOptionCodeInterfaceOS                                          // operating system
    82  	ngOptionCodeInterfaceFCSLength                                   // length of the Frame Check Sequence in bits
    83  	ngOptionCodeInterfaceTimestampOffset                             // offset (in seconds) that must be added to packet timestamp
    84  )
    85  
    86  const (
    87  	ngOptionCodeInterfaceStatisticsStartTime         ngOptionCode = iota + 2 // Start of capture
    88  	ngOptionCodeInterfaceStatisticsEndTime                                   // End of capture
    89  	ngOptionCodeInterfaceStatisticsInterfaceReceived                         // Packets received by physical interface
    90  	ngOptionCodeInterfaceStatisticsInterfaceDropped                          // Packets dropped by physical interface
    91  	ngOptionCodeInterfaceStatisticsFilterAccept                              // Packets accepted by filter
    92  	ngOptionCodeInterfaceStatisticsOSDrop                                    // Packets dropped by operating system
    93  	ngOptionCodeInterfaceStatisticsDelivered                                 // Packets delivered to user
    94  )
    95  
    96  // ngOption is a pcapng option
    97  type ngOption struct {
    98  	code   ngOptionCode
    99  	value  []byte
   100  	raw    interface{}
   101  	length uint16
   102  }
   103  
   104  // ngBlock is a pcapng block header
   105  type ngBlock struct {
   106  	typ    ngBlockType
   107  	length uint32 // remaining length of block
   108  }
   109  
   110  // NgResolution represents a pcapng timestamp resolution
   111  type NgResolution uint8
   112  
   113  // Binary returns true if the timestamp resolution is a negative power of two. Otherwise NgResolution is a negative power of 10.
   114  func (r NgResolution) Binary() bool {
   115  	if r&0x80 == 0x80 {
   116  		return true
   117  	}
   118  	return false
   119  }
   120  
   121  // Exponent returns the negative exponent of the resolution.
   122  func (r NgResolution) Exponent() uint8 {
   123  	return uint8(r) & 0x7f
   124  }
   125  
   126  // ToTimestampResolution converts an NgResolution to a gopaket.TimestampResolution
   127  func (r NgResolution) ToTimestampResolution() (ret gopacket.TimestampResolution) {
   128  	if r.Binary() {
   129  		ret.Base = 2
   130  	} else {
   131  		ret.Base = 10
   132  	}
   133  	ret.Exponent = -int(r.Exponent())
   134  	return
   135  }
   136  
   137  // NgNoValue64 is a placeholder for an empty numeric 64 bit value.
   138  const NgNoValue64 = math.MaxUint64
   139  
   140  // NgInterfaceStatistics hold the statistic for an interface at a single point in time. These values are already supposed to be accumulated. Most pcapng files contain this information at the end of the file/section.
   141  type NgInterfaceStatistics struct {
   142  	// LastUpdate is the last time the statistics were updated.
   143  	LastUpdate time.Time
   144  	// StartTime is the time packet capture started on this interface. This value might be zero if this option is missing.
   145  	StartTime time.Time
   146  	// EndTime is the time packet capture ended on this interface This value might be zero if this option is missing.
   147  	EndTime time.Time
   148  	// Comment can be an arbitrary comment. This value might be empty if this option is missing.
   149  	Comment string
   150  	// PacketsReceived are the number of received packets. This value might be NoValue64 if this option is missing.
   151  	PacketsReceived uint64
   152  	// PacketsReceived are the number of received packets. This value might be NoValue64 if this option is missing.
   153  	PacketsDropped uint64
   154  }
   155  
   156  var ngEmptyStatistics = NgInterfaceStatistics{
   157  	PacketsReceived: NgNoValue64,
   158  	PacketsDropped:  NgNoValue64,
   159  }
   160  
   161  // NgInterface holds all the information of a pcapng interface.
   162  type NgInterface struct {
   163  	// Name is the name of the interface. This value might be empty if this option is missing.
   164  	Name string
   165  	// Comment can be an arbitrary comment. This value might be empty if this option is missing.
   166  	Comment string
   167  	// Description is a description of the interface. This value might be empty if this option is missing.
   168  	Description string
   169  	// Filter is the filter used during packet capture. This value might be empty if this option is missing.
   170  	Filter string
   171  	// OS is the operating system this interface was controlled by. This value might be empty if this option is missing.
   172  	OS string
   173  	// LinkType is the linktype of the interface.
   174  	LinkType layers.LinkType
   175  	// TimestampResolution is the timestamp resolution of the packets in the pcapng file belonging to this interface.
   176  	TimestampResolution NgResolution
   177  	// TimestampResolution is the timestamp offset in seconds of the packets in the pcapng file belonging to this interface.
   178  	TimestampOffset uint64
   179  	// SnapLength is the maximum packet length captured by this interface. 0 for unlimited
   180  	SnapLength uint32
   181  	// Statistics holds the interface statistics
   182  	Statistics NgInterfaceStatistics
   183  
   184  	secondMask uint64
   185  	scaleUp    uint64
   186  	scaleDown  uint64
   187  }
   188  
   189  // Resolution returns the timestamp resolution of acquired timestamps before scaling to NanosecondTimestampResolution.
   190  func (i NgInterface) Resolution() gopacket.TimestampResolution {
   191  	return i.TimestampResolution.ToTimestampResolution()
   192  }
   193  
   194  // NgSectionInfo contains additional information of a pcapng section
   195  type NgSectionInfo struct {
   196  	// Hardware is the hardware this file was generated on. This value might be empty if this option is missing.
   197  	Hardware string
   198  	// OS is the operating system this file was generated on. This value might be empty if this option is missing.
   199  	OS string
   200  	// Application is the user space application this file was generated with. This value might be empty if this option is missing.
   201  	Application string
   202  	// Comment can be an arbitrary comment. This value might be empty if this option is missing.
   203  	Comment string
   204  }