Add a partial decoder for PCAPNG

1 files changed, 70 insertions, 2 deletions

diff --git a/plugins/pcap.lua b/plugins/pcap.lua
index 1b8d791..ca61026 100644
--- a/plugins/pcap.lua
+++ b/plugins/pcap.lua
@@ -17,8 +17,14 @@
 --
 
 local detect = function (c)
-	local magic = c:read (4)
-	return magic == "\xa1\xb2\xc3\xd4" or magic == "\xd4\xc3\xb2\xa1"
+	local magic = c:u32 ()
+	return magic == 0xa1b2c3d4 or magic == 0xd4c3b2a1
+end
+
+local detect_ng = function (c)
+	local magic = c (9):u32 ()
+	return c:u32 () == 0x0a0d0d0a
+		and (magic == 0x1a2b3c4d or magic == 0x4d3c2b1a)
 end
 
 -- Specified in http://www.tcpdump.org/linktypes.html
@@ -176,3 +182,65 @@ end
 
 hex.register { type="pcap", detect=detect, decode=decode }
 
+-- As described by https://github.com/pcapng/pcapng
+local decode_ng = function (c)
+	assert (c.position == 1)
+	if not detect_ng (c ()) then error ("not a PCAPNG file") end
+
+	c.endianity = "le"
+	c (9):u32 ("byte-order magic: %s", function (u32)
+		if u32 == 0x1a2b3c4d then return "little-endian" end
+
+		c.endianity = "be"
+		return "big-endian"
+	end)
+
+	local function decode_block_type (u32)
+		if u32 == 0x0a0d0d0a then return "Section Header Block" end
+		if u32 == 0x00000001 then return "Interface Description Block" end
+		if u32 == 0x00000003 then return "Simple Packet Block" end
+		if u32 == 0x00000004 then return "Name Resolution Block" end
+		if u32 == 0x00000005 then return "Interface Statistics Block" end
+		if u32 == 0x00000006 then return "Enhanced Packet Block" end
+
+		if u32 == 0x00000BAD or u32 == 0x40000BAD then
+			return "Custom Block"
+		end
+		return "unknown: %d", u32
+	end
+
+	local function decode_shb (c)
+		local magic = c:u32 ()
+		local p, vmajor, vminor = c.position, c:u16 (), c:u16 ()
+		c (p, c.position - 1):mark ("PCAPNG version: %d.%d", vmajor, vminor)
+		-- XXX: what exactly does section_len mean?
+		local section_len = c:u64 ("section length: %d")
+
+		while not c.eof do
+			-- TODO: decode the meaning of options as well
+			local type = c:u16 ("option type: %d")
+			local length = c:u16 ("option length: %d")
+
+			local p = c.position
+			c.position = c.position + length + (-length & 3)
+			c (p, c.position - 1):mark ("option value")
+		end
+	end
+
+	while not c.eof do
+		local block_start = c.position
+		local block_type = c:u32 ("PCAPNG block type: %s", decode_block_type)
+		local block_len = c:u32 ("PCAPNG block length: %d")
+
+		local data_start = c.position
+		c.position = block_start + block_len - 4
+
+		local data = c (data_start, c.position - 1)
+		-- TODO: also decode other types of blocks
+		if block_type == 0x0a0d0d0a then decode_shb (data) end
+
+		local shb_len_end = c:u32 ("PCAPNG trailing block length: %d")
+	end
+end
+
+hex.register { type="pcapng", detect=detect_ng, decode=decode_ng }