static gboolean
libpcap_seek_read(wtap *wth, gint64 seek_off,
struct wtap_pkthdr *phdr, guint8 *pd, int length,
int *err, gchar **err_info)
{
union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
int phdr_len;
libpcap_t *libpcap;
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
libpcap = (libpcap_t *)wth->priv;
phdr_len = pcap_process_pseudo_header(wth->random_fh, wth->file_type,
wth->file_encap, length, FALSE, NULL, pseudo_header, err, err_info);
if (phdr_len < 0)
return FALSE; /* error */
/*
* Read the packet data.
*/
if (!libpcap_read_rec_data(wth->random_fh, pd, length, err, err_info))
return FALSE; /* failed */
pcap_read_post_process(wth->file_type, wth->file_encap,
pseudo_header, pd, length, libpcap->byte_swapped, -1);
return TRUE;
}
/* Read the next packet */
static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset)
{
libpcap_t *libpcap;
*data_offset = file_tell(wth->fh);
if (!libpcap_process_header(wth, wth->fh, &wth->phdr, err, err_info))
return FALSE;
buffer_assure_space(wth->frame_buffer, wth->phdr.caplen);
if (!libpcap_read_rec_data(wth->fh, buffer_start_ptr(wth->frame_buffer),
wth->phdr.caplen, err, err_info))
return FALSE; /* Read error */
libpcap = (libpcap_t *)wth->priv;
pcap_read_post_process(wth->file_type, wth->file_encap,
&wth->phdr.pseudo_header, buffer_start_ptr(wth->frame_buffer),
wth->phdr.caplen, libpcap->byte_swapped, -1);
return TRUE;
}
static gboolean
libpcap_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
Buffer *buf, int *err, gchar **err_info)
{
struct pcaprec_ss990915_hdr hdr;
guint packet_size;
guint orig_size;
int phdr_len;
libpcap_t *libpcap;
if (!libpcap_read_header(wth, fh, err, err_info, &hdr))
return FALSE;
if (hdr.hdr.incl_len > WTAP_MAX_PACKET_SIZE) {
/*
* Probably a corrupt capture file; return an error,
* so that our caller doesn't blow up trying to allocate
* space for an immensely-large packet.
*/
*err = WTAP_ERR_BAD_FILE;
if (err_info != NULL) {
*err_info = g_strdup_printf("pcap: File has %u-byte packet, bigger than maximum of %u",
hdr.hdr.incl_len, WTAP_MAX_PACKET_SIZE);
}
return FALSE;
}
packet_size = hdr.hdr.incl_len;
orig_size = hdr.hdr.orig_len;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (wth->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_PCAP_AIX &&
(wth->file_encap == WTAP_ENCAP_FDDI ||
wth->file_encap == WTAP_ENCAP_FDDI_BITSWAPPED)) {
/*
* The packet size is really a record size and includes
* the padding.
*/
packet_size -= 3;
orig_size -= 3;
/*
* Skip the padding.
*/
if (!file_skip(fh, 3, err))
return FALSE;
}
phdr_len = pcap_process_pseudo_header(fh, wth->file_type_subtype,
wth->file_encap, packet_size, TRUE, phdr, err, err_info);
if (phdr_len < 0)
return FALSE; /* error */
/*
* Don't count any pseudo-header as part of the packet.
*/
orig_size -= phdr_len;
packet_size -= phdr_len;
phdr->rec_type = REC_TYPE_PACKET;
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Update the timestamp, if not already done */
if (wth->file_encap != WTAP_ENCAP_ERF) {
phdr->ts.secs = hdr.hdr.ts_sec;
if (wth->file_tsprec == WTAP_TSPREC_NSEC)
phdr->ts.nsecs = hdr.hdr.ts_usec;
else
phdr->ts.nsecs = hdr.hdr.ts_usec * 1000;
} else {
/* Set interface ID for ERF format */
phdr->presence_flags |= WTAP_HAS_INTERFACE_ID;
phdr->interface_id = phdr->pseudo_header.erf.phdr.flags & 0x03;
}
phdr->caplen = packet_size;
phdr->len = orig_size;
/*
* Read the packet data.
*/
if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
return FALSE; /* failed */
libpcap = (libpcap_t *)wth->priv;
pcap_read_post_process(wth->file_type_subtype, wth->file_encap,
phdr, ws_buffer_start_ptr(buf), libpcap->byte_swapped, -1);
return TRUE;
}
/* Read the next packet */
static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset)
{
struct pcaprec_ss990915_hdr hdr;
guint packet_size;
guint orig_size;
int bytes_read;
guint8 fddi_padding[3];
int phdr_len;
libpcap_t *libpcap;
bytes_read = libpcap_read_header(wth, err, err_info, &hdr);
if (bytes_read == -1) {
/*
* We failed to read the header.
*/
return FALSE;
}
packet_size = hdr.hdr.incl_len;
orig_size = hdr.hdr.orig_len;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (wth->file_type == WTAP_FILE_PCAP_AIX &&
(wth->file_encap == WTAP_ENCAP_FDDI ||
wth->file_encap == WTAP_ENCAP_FDDI_BITSWAPPED)) {
/*
* The packet size is really a record size and includes
* the padding.
*/
packet_size -= 3;
orig_size -= 3;
/*
* Read the padding.
*/
if (!libpcap_read_rec_data(wth->fh, fddi_padding, 3, err,
err_info))
return FALSE; /* Read error */
}
*data_offset = file_tell(wth->fh);
libpcap = (libpcap_t *)wth->priv;
phdr_len = pcap_process_pseudo_header(wth->fh, wth->file_type,
wth->file_encap, packet_size, TRUE, &wth->phdr,
&wth->phdr.pseudo_header, err, err_info);
if (phdr_len < 0)
return FALSE; /* error */
/*
* Don't count any pseudo-header as part of the packet.
*/
orig_size -= phdr_len;
packet_size -= phdr_len;
buffer_assure_space(wth->frame_buffer, packet_size);
if (!libpcap_read_rec_data(wth->fh, buffer_start_ptr(wth->frame_buffer),
packet_size, err, err_info))
return FALSE; /* Read error */
wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Update the Timestamp, if not already done */
if (wth->file_encap != WTAP_ENCAP_ERF) {
wth->phdr.ts.secs = hdr.hdr.ts_sec;
if(wth->tsprecision == WTAP_FILE_TSPREC_NSEC) {
wth->phdr.ts.nsecs = hdr.hdr.ts_usec;
} else {
wth->phdr.ts.nsecs = hdr.hdr.ts_usec * 1000;
}
} else {
/* Set interface ID for ERF format */
wth->phdr.presence_flags |= WTAP_HAS_INTERFACE_ID;
wth->phdr.interface_id = wth->phdr.pseudo_header.erf.phdr.flags & 0x03;
}
wth->phdr.caplen = packet_size;
wth->phdr.len = orig_size;
pcap_read_post_process(wth->file_type, wth->file_encap,
&wth->phdr.pseudo_header, buffer_start_ptr(wth->frame_buffer),
wth->phdr.caplen, libpcap->byte_swapped, -1);
return TRUE;
}
static gboolean
libpcap_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
Buffer *buf, int *err, gchar **err_info)
{
struct pcaprec_ss990915_hdr hdr;
guint packet_size;
guint orig_size;
int bytes_read;
int phdr_len;
libpcap_t *libpcap;
bytes_read = libpcap_read_header(wth, fh, err, err_info, &hdr);
if (bytes_read == -1) {
/*
* We failed to read the header.
*/
return FALSE;
}
packet_size = hdr.hdr.incl_len;
orig_size = hdr.hdr.orig_len;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (wth->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_PCAP_AIX &&
(wth->file_encap == WTAP_ENCAP_FDDI ||
wth->file_encap == WTAP_ENCAP_FDDI_BITSWAPPED)) {
/*
* The packet size is really a record size and includes
* the padding.
*/
packet_size -= 3;
orig_size -= 3;
/*
* Skip the padding.
*/
if (!file_skip(fh, 3, err))
return FALSE;
}
phdr_len = pcap_process_pseudo_header(fh, wth->file_type_subtype,
wth->file_encap, packet_size, TRUE, phdr, err, err_info);
if (phdr_len < 0)
return FALSE; /* error */
/*
* Don't count any pseudo-header as part of the packet.
*/
orig_size -= phdr_len;
packet_size -= phdr_len;
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Update the timestamp, if not already done */
if (wth->file_encap != WTAP_ENCAP_ERF) {
phdr->ts.secs = hdr.hdr.ts_sec;
if (wth->tsprecision == WTAP_FILE_TSPREC_NSEC)
phdr->ts.nsecs = hdr.hdr.ts_usec;
else
phdr->ts.nsecs = hdr.hdr.ts_usec * 1000;
} else {
/* Set interface ID for ERF format */
phdr->presence_flags |= WTAP_HAS_INTERFACE_ID;
phdr->interface_id = phdr->pseudo_header.erf.phdr.flags & 0x03;
}
phdr->caplen = packet_size;
phdr->len = orig_size;
/*
* Read the packet data.
*/
if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
return FALSE; /* failed */
libpcap = (libpcap_t *)wth->priv;
pcap_read_post_process(wth->file_type_subtype, wth->file_encap,
&phdr->pseudo_header, buffer_start_ptr(buf), packet_size,
libpcap->byte_swapped, -1);
return TRUE;
}
