/* ntp_fmt_ts - converts NTP timestamp to human readable string.
* reftime - 64bit timestamp (IN)
* returns pointer to filled buffer. This buffer will be freed automatically once
* dissection of the next packet occurs.
*/
const char *
ntp_fmt_ts(const guint8 *reftime)
{
guint32 tempstmp, tempfrac;
time_t temptime;
struct tm *bd;
double fractime;
char *buff;
tempstmp = pntohl(&reftime[0]);
tempfrac = pntohl(&reftime[4]);
if ((tempstmp == 0) && (tempfrac == 0)) {
return "NULL";
}
temptime = tempstmp - (guint32) NTP_BASETIME;
bd = gmtime(&temptime);
if(!bd){
return "Not representable";
}
fractime = bd->tm_sec + tempfrac / 4294967296.0;
buff=ep_alloc(NTP_TS_SIZE);
g_snprintf(buff, NTP_TS_SIZE,
"%s %2d, %d %02d:%02d:%09.6f UTC",
mon_names[bd->tm_mon],
bd->tm_mday,
bd->tm_year + 1900,
bd->tm_hour,
bd->tm_min,
fractime);
return buff;
}
void
capture_prism(const guchar *pd, int offset, int len, packet_counts *ld)
{
guint32 cookie;
if (!BYTES_ARE_IN_FRAME(offset, len, 4)) {
ld->other++;
return;
}
/* Some captures with DLT_PRISM have the AVS WLAN header */
cookie = pntohl(pd);
if ((cookie == WLANCAP_MAGIC_COOKIE_V1) ||
(cookie == WLANCAP_MAGIC_COOKIE_V2)) {
capture_wlancap(pd, offset, len, ld);
return;
}
/* Prism header */
if (!BYTES_ARE_IN_FRAME(offset, len, PRISM_HEADER_LENGTH)) {
ld->other++;
return;
}
offset += PRISM_HEADER_LENGTH;
/* 802.11 header follows */
capture_ieee80211(pd, offset, len, ld);
}
int
decode_tcp_nfs_half(struct tuple4 *addr, struct half_stream *hs)
{
u_char *p, *buf;
int i, len, discard;
u_int32_t fraghdr;
buf = hs->data;
len = hs->count - hs->offset;
discard = 0;
for (p = buf; p + 4 < buf + len; ) {
fraghdr = pntohl(p);
p += 4 + FRAGLEN(fraghdr);
if (p > buf + len)
return (0);
if (LASTFRAG(fraghdr)) {
i = p - buf;
decode_nfs(addr, buf, i);
buf += i;
len -= i;
discard += i;
}
}
return (discard);
}
/* Find the next packet and parse it; called from wtap_read(). */
static gboolean csids_read(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset)
{
csids_t *csids = (csids_t *)wth->priv;
guint8 *buf;
int bytesRead = 0;
struct csids_header hdr;
*data_offset = file_tell(wth->fh);
bytesRead = file_read( &hdr, sizeof( struct csids_header) , wth->fh );
if( bytesRead != sizeof( struct csids_header) ) {
*err = file_error( wth->fh, err_info );
if (*err == 0 && bytesRead != 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
hdr.seconds = pntohl(&hdr.seconds);
hdr.caplen = pntohs(&hdr.caplen);
/* Make sure we have enough room for the packet */
buffer_assure_space(wth->frame_buffer, hdr.caplen);
buf = buffer_start_ptr(wth->frame_buffer);
bytesRead = file_read( buf, hdr.caplen, wth->fh );
if( bytesRead != hdr.caplen ) {
*err = file_error( wth->fh, err_info );
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = hdr.caplen;
wth->phdr.caplen = hdr.caplen;
wth->phdr.ts.secs = hdr.seconds;
wth->phdr.ts.nsecs = 0;
if( csids->byteswapped ) {
if( hdr.caplen >= 2 ) {
PBSWAP16(buf); /* the ip len */
if( hdr.caplen >= 4 ) {
PBSWAP16(buf+2); /* ip id */
if( hdr.caplen >= 6 )
PBSWAP16(buf+4); /* ip flags and fragoff */
}
}
}
return TRUE;
}
static gboolean
csids_read_packet(FILE_T fh, csids_t *csids, struct wtap_pkthdr *phdr,
Buffer *buf, int *err, gchar **err_info)
{
struct csids_header hdr;
int bytesRead = 0;
guint8 *pd;
bytesRead = file_read( &hdr, sizeof( struct csids_header), fh );
if( bytesRead != sizeof( struct csids_header) ) {
*err = file_error( fh, err_info );
if (*err == 0 && bytesRead != 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
hdr.seconds = pntohl(&hdr.seconds);
hdr.caplen = pntohs(&hdr.caplen);
phdr->presence_flags = WTAP_HAS_TS;
phdr->len = hdr.caplen;
phdr->caplen = hdr.caplen;
phdr->ts.secs = hdr.seconds;
phdr->ts.nsecs = 0;
if( !wtap_read_packet_bytes( fh, buf, phdr->caplen, err, err_info ) )
return FALSE;
pd = buffer_start_ptr( buf );
if( csids->byteswapped ) {
if( phdr->caplen >= 2 ) {
PBSWAP16(pd); /* the ip len */
if( phdr->caplen >= 4 ) {
PBSWAP16(pd+2); /* ip id */
if( phdr->caplen >= 6 )
PBSWAP16(pd+4); /* ip flags and fragoff */
}
}
}
return TRUE;
}
void
capture_wlancap(const guchar *pd, int offset, int len, packet_counts *ld)
{
guint32 length;
if (!BYTES_ARE_IN_FRAME(offset, len, sizeof(guint32)*2)) {
ld->other++;
return;
}
length = pntohl(pd+sizeof(guint32));
if (!BYTES_ARE_IN_FRAME(offset, len, length)) {
ld->other++;
return;
}
offset += length;
/* 802.11 header follows */
capture_ieee80211(pd, offset, len, ld);
}
/* XXX - return -1 on I/O error and actually do something with 'err'. */
int csids_open(wtap *wth, int *err, gchar **err_info)
{
/* There is no file header. There is only a header for each packet
* so we read a packet header and compare the caplen with iplen. They
* should always be equal except with the wierd byteswap version.
*
* THIS IS BROKEN-- anytime the caplen is 0x0101 or 0x0202 up to 0x0505
* this will byteswap it. I need to fix this. XXX --mlh
*/
int tmp,iplen,bytesRead;
gboolean byteswap = FALSE;
struct csids_header hdr;
csids_t *csids;
/* check the file to make sure it is a csids file. */
bytesRead = file_read( &hdr, sizeof( struct csids_header), wth->fh );
if( bytesRead != sizeof( struct csids_header) ) {
*err = file_error( wth->fh, err_info );
if( *err != 0 ) {
return -1;
} else {
return 0;
}
}
if( hdr.zeropad != 0 || hdr.caplen == 0 ) {
return 0;
}
hdr.seconds = pntohl( &hdr.seconds );
hdr.caplen = pntohs( &hdr.caplen );
bytesRead = file_read( &tmp, 2, wth->fh );
if( bytesRead != 2 ) {
*err = file_error( wth->fh, err_info );
if( *err != 0 ) {
return -1;
} else {
return 0;
}
}
bytesRead = file_read( &iplen, 2, wth->fh );
if( bytesRead != 2 ) {
*err = file_error( wth->fh, err_info );
if( *err != 0 ) {
return -1;
} else {
return 0;
}
}
iplen = pntohs(&iplen);
if ( iplen == 0 )
return(0);
/* if iplen and hdr.caplen are equal, default to no byteswap. */
if( iplen > hdr.caplen ) {
/* maybe this is just a byteswapped version. the iplen ipflags */
/* and ipid are swapped. We cannot use the normal swaps because */
/* we don't know the host */
iplen = BSWAP16(iplen);
if( iplen <= hdr.caplen ) {
/* we know this format */
byteswap = TRUE;
} else {
/* don't know this one */
return 0;
}
} else {
byteswap = FALSE;
}
/* no file header. So reset the fh to 0 so we can read the first packet */
if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
return -1;
wth->data_offset = 0;
csids = (csids_t *)g_malloc(sizeof(csids_t));
wth->priv = (void *)csids;
csids->byteswapped = byteswap;
wth->file_encap = WTAP_ENCAP_RAW_IP;
wth->file_type = WTAP_FILE_CSIDS;
wth->snapshot_length = 0; /* not known */
wth->subtype_read = csids_read;
wth->subtype_seek_read = csids_seek_read;
wth->tsprecision = WTAP_FILE_TSPREC_SEC;
return 1;
}
/* Tests a tvbuff against the expected pattern/length.
* Returns TRUE if all tests succeeed, FALSE if any test fails */
gboolean
test(tvbuff_t *tvb, gchar* name,
guint8* expected_data, guint expected_length, guint expected_reported_length)
{
guint length;
guint reported_length;
guint8 *ptr;
volatile gboolean ex_thrown;
volatile guint32 val32;
guint32 expected32;
guint incr, i;
length = tvb_length(tvb);
if (length != expected_length) {
printf("01: Failed TVB=%s Length of tvb=%u while expected length=%u\n",
name, length, expected_length);
failed = TRUE;
return FALSE;
}
reported_length = tvb_reported_length(tvb);
if (reported_length != expected_reported_length) {
printf("01: Failed TVB=%s Reported length of tvb=%u while expected reported length=%u\n",
name, reported_length, expected_reported_length);
failed = TRUE;
return FALSE;
}
/* Test boundary case. A BoundsError exception should be thrown. */
ex_thrown = FALSE;
TRY {
tvb_get_ptr(tvb, 0, length + 1);
}
CATCH(BoundsError) {
ex_thrown = TRUE;
}
CATCH(FragmentBoundsError) {
printf("02: Caught wrong exception: FragmentBoundsError\n");
}
CATCH(ReportedBoundsError) {
printf("02: Caught wrong exception: ReportedBoundsError\n");
}
CATCH_ALL {
printf("02: Caught wrong exception: %lu, exc->except_id.except_code\n");
}
ENDTRY;
if (!ex_thrown) {
printf("02: Failed TVB=%s No BoundsError when retrieving %u bytes\n",
name, length + 1);
failed = TRUE;
return FALSE;
}
/* Test boundary case with reported_length+1. A ReportedBoundsError
exception should be thrown. */
ex_thrown = FALSE;
TRY {
tvb_get_ptr(tvb, 0, reported_length + 1);
}
CATCH(BoundsError) {
printf("03: Caught wrong exception: BoundsError\n");
}
CATCH(FragmentBoundsError) {
printf("03: Caught wrong exception: FragmentBoundsError\n");
}
CATCH(ReportedBoundsError) {
ex_thrown = TRUE;
}
CATCH_ALL {
printf("02: Caught wrong exception: %lu, exc->except_id.except_code\n");
}
ENDTRY;
if (!ex_thrown) {
printf("03: Failed TVB=%s No ReportedBoundsError when retrieving %u bytes\n",
name, reported_length + 1);
failed = TRUE;
return FALSE;
}
/* Test boundary case. A BoundsError exception should be thrown. */
ex_thrown = FALSE;
TRY {
tvb_get_ptr(tvb, -1, 2);
}
CATCH(BoundsError) {
ex_thrown = TRUE;
}
CATCH(FragmentBoundsError) {
printf("04: Caught wrong exception: FragmentBoundsError\n");
}
CATCH(ReportedBoundsError) {
printf("04: Caught wrong exception: ReportedBoundsError\n");
}
CATCH_ALL {
printf("02: Caught wrong exception: %lu, exc->except_id.except_code\n");
}
ENDTRY;
if (!ex_thrown) {
printf("04: Failed TVB=%s No BoundsError when retrieving 2 bytes from"
" offset -1\n", name);
failed = TRUE;
return FALSE;
}
/* Test boundary case. A BoundsError exception should not be thrown. */
ex_thrown = FALSE;
TRY {
tvb_get_ptr(tvb, 0, 1);
}
CATCH(BoundsError) {
ex_thrown = TRUE;
}
CATCH(FragmentBoundsError) {
printf("05: Caught wrong exception: FragmentBoundsError\n");
}
CATCH(ReportedBoundsError) {
printf("05: Caught wrong exception: ReportedBoundsError\n");
}
CATCH_ALL {
printf("02: Caught wrong exception: %lu, exc->except_id.except_code\n");
}
ENDTRY;
if (ex_thrown) {
printf("05: Failed TVB=%s BoundsError when retrieving 1 bytes from"
" offset 0\n", name);
failed = TRUE;
return FALSE;
}
/* Test boundary case. A BoundsError exception should not be thrown. */
ex_thrown = FALSE;
TRY {
tvb_get_ptr(tvb, -1, 1);
}
CATCH(BoundsError) {
ex_thrown = TRUE;
}
CATCH(FragmentBoundsError) {
printf("06: Caught wrong exception: FragmentBoundsError\n");
}
CATCH(ReportedBoundsError) {
printf("06: Caught wrong exception: ReportedBoundsError\n");
}
CATCH_ALL {
printf("02: Caught wrong exception: %lu, exc->except_id.except_code\n");
}
ENDTRY;
if (ex_thrown) {
printf("06: Failed TVB=%s BoundsError when retrieving 1 bytes from"
" offset -1\n", name);
failed = TRUE;
return FALSE;
}
/* Check data at boundary. An exception should not be thrown. */
if (length >= 4) {
ex_thrown = FALSE;
TRY {
val32 = tvb_get_ntohl(tvb, 0);
}
CATCH_ALL {
ex_thrown = TRUE;
}
ENDTRY;
if (ex_thrown) {
printf("07: Failed TVB=%s Exception when retrieving "
"guint32 from offset 0\n", name);
failed = TRUE;
return FALSE;
}
expected32 = pntohl(expected_data);
if (val32 != expected32) {
printf("08: Failed TVB=%s guint32 @ 0 %u != expected %u\n",
name, val32, expected32);
failed = TRUE;
return FALSE;
}
}
int
pppdump_open(wtap *wth, int *err, gchar **err_info)
{
guint8 buffer[6]; /* Looking for: 0x07 t3 t2 t1 t0 ID */
pppdump_t *state;
/* There is no file header, only packet records. Fortunately for us,
* timestamp records are separated from packet records, so we should
* find an "initial time stamp" (i.e., a "reset time" record, or
* record type 0x07) at the beginning of the file. We'll check for
* that, plus a valid record following the 0x07 and the four bytes
* representing the timestamp.
*/
wtap_file_read_unknown_bytes(buffer, sizeof(buffer), wth->fh, err,
err_info);
if (buffer[0] == PPPD_RESET_TIME &&
(buffer[5] == PPPD_SENT_DATA ||
buffer[5] == PPPD_RECV_DATA ||
buffer[5] == PPPD_TIME_STEP_LONG ||
buffer[5] == PPPD_TIME_STEP_SHORT ||
buffer[5] == PPPD_RESET_TIME)) {
goto my_file_type;
}
else {
return 0;
}
my_file_type:
if (file_seek(wth->fh, 5, SEEK_SET, err) == -1)
return -1;
state = (pppdump_t *)g_malloc(sizeof(pppdump_t));
wth->priv = (void *)state;
state->timestamp = pntohl(&buffer[1]);
state->tenths = 0;
init_state(state);
state->offset = 5;
wth->file_encap = WTAP_ENCAP_PPP_WITH_PHDR;
wth->file_type = WTAP_FILE_PPPDUMP;
wth->snapshot_length = PPPD_BUF_SIZE; /* just guessing */
wth->subtype_read = pppdump_read;
wth->subtype_seek_read = pppdump_seek_read;
wth->subtype_close = pppdump_close;
wth->tsprecision = WTAP_FILE_TSPREC_DSEC;
state->seek_state = g_new(pppdump_t,1);
/* If we have a random stream open, we're going to be reading
the file randomly; set up a GPtrArray of pointers to
information about how to retrieve the data for each packet. */
if (wth->random_fh != NULL)
state->pids = g_ptr_array_new();
else
state->pids = NULL;
state->pkt_cnt = 0;
return 1;
}
/* Returns TRUE if packet data copied, FALSE if error occurred or EOF (no more records). */
static gboolean
collate(pppdump_t* state, FILE_T fh, int *err, gchar **err_info, guint8 *pd,
int *num_bytes, direction_enum *direction, pkt_id *pid,
gint64 num_bytes_to_skip)
{
int id;
pkt_t *pkt = NULL;
int byte0, byte1;
int n, num_written = 0;
gint64 start_offset;
guint32 time_long;
guint8 time_short;
/*
* Process any data left over in the current record when doing
* sequential processing.
*/
if (state->num_bytes > 0) {
g_assert(num_bytes_to_skip == 0);
pkt = state->pkt;
num_written = process_data(state, fh, pkt, state->num_bytes,
pd, err, err_info, pid);
if (num_written < 0) {
return FALSE;
}
else if (num_written > 0) {
*num_bytes = num_written;
*direction = pkt->dir;
return TRUE;
}
/* if 0 bytes written, keep processing */
} else {
/*
* We didn't have any data left over, so the packet will
* start at the beginning of a record.
*/
if (pid)
pid->num_bytes_to_skip = 0;
}
/*
* That didn't get all the data for this packet, so process
* subsequent records.
*/
start_offset = state->offset;
while ((id = file_getc(fh)) != EOF) {
state->offset++;
switch (id) {
case PPPD_SENT_DATA:
case PPPD_RECV_DATA:
pkt = id == PPPD_SENT_DATA ? &state->spkt : &state->rpkt;
/*
* Save the offset of the beginning of
* the current record.
*/
pkt->cd_offset = state->offset - 1;
/*
* Get the length of the record.
*/
byte0 = file_getc(fh);
if (byte0 == EOF)
goto done;
state->offset++;
byte1 = file_getc(fh);
if (byte1 == EOF)
goto done;
state->offset++;
n = (byte0 << 8) | byte1;
if (pkt->id_offset == 0) {
/*
* We don't have the initial data
* offset for this packet, which
* means this is the first
* data record for that packet.
* Save the offset of the
* beginning of that record and
* the offset of the first data
* byte in the packet, which is
* the first data byte in the
* record.
*/
pkt->id_offset = pkt->cd_offset;
pkt->sd_offset = state->offset;
}
if (n == 0)
continue;
g_assert(num_bytes_to_skip < n);
while (num_bytes_to_skip) {
if (file_getc(fh) == EOF)
goto done;
state->offset++;
num_bytes_to_skip--;
n--;
}
num_written = process_data(state, fh, pkt, n,
pd, err, err_info, pid);
if (num_written < 0) {
return FALSE;
}
else if (num_written > 0) {
*num_bytes = num_written;
*direction = pkt->dir;
return TRUE;
}
/* if 0 bytes written, keep looping */
break;
case PPPD_SEND_DELIM:
case PPPD_RECV_DELIM:
/* What can we do? */
break;
case PPPD_RESET_TIME:
wtap_file_read_unknown_bytes(&time_long, sizeof(guint32), fh, err, err_info);
state->offset += sizeof(guint32);
state->timestamp = pntohl(&time_long);
state->tenths = 0;
break;
case PPPD_TIME_STEP_LONG:
wtap_file_read_unknown_bytes(&time_long, sizeof(guint32), fh, err, err_info);
state->offset += sizeof(guint32);
state->tenths += pntohl(&time_long);
if (state->tenths >= 10) {
state->timestamp += state->tenths / 10;
state->tenths = state->tenths % 10;
}
break;
case PPPD_TIME_STEP_SHORT:
wtap_file_read_unknown_bytes(&time_short, sizeof(guint8), fh, err, err_info);
state->offset += sizeof(guint8);
state->tenths += time_short;
if (state->tenths >= 10) {
state->timestamp += state->tenths / 10;
state->tenths = state->tenths % 10;
}
break;
default:
/* XXX - bad file */
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("pppdump: bad ID byte 0x%02x", id);
return FALSE;
}
}
done:
*err = file_error(fh, err_info);
if (*err == 0) {
if (state->offset != start_offset) {
/*
* We read at least one byte, so we were working
* on a record; an EOF means that record was
* cut short.
*/
*err = WTAP_ERR_SHORT_READ;
}
}
return FALSE;
}
/*
* get_record: Get the next record into a buffer
* Every about 0x2000 bytes 0x10 bytes are inserted in the file,
* even in the middle of a record.
* This reads the next record without the eventual 0x10 bytes.
* returns the length of the record + the stuffing (if any)
*
* Returns number of bytes read on success, 0 on EOF, -1 on error;
* if -1 is returned, *err is set to the error indication and, for
* errors where that's appropriate, *err_info is set to an additional
* error string.
*
* XXX: works at most with 0x1FFF bytes per record
*/
static gint get_record(guint8** bufferp, FILE_T fh, gint64 file_offset,
int *err, gchar **err_info) {
static guint8* buffer = NULL;
static guint buffer_len = 0x2000 ;
guint bytes_read;
guint last_read;
guint left;
guint8 junk[0x14];
guint8* writep;
#ifdef DEBUG_K12
guint actual_len;
#endif
/* where the next unknown 0x10 bytes are stuffed to the file */
guint junky_offset = 0x2000 - (gint) ( (file_offset - 0x200) % 0x2000 );
K12_DBG(6,("get_record: ENTER: junky_offset=%" G_GINT64_MODIFIER "d, file_offset=%" G_GINT64_MODIFIER "d",junky_offset,file_offset));
/* no buffer is given, lets create it */
if (buffer == NULL) {
buffer = g_malloc(0x2000);
buffer_len = 0x2000;
}
*bufferp = buffer;
if ( junky_offset == 0x2000 ) {
/* the length of the record is 0x10 bytes ahead from we are reading */
bytes_read = file_read(junk,0x14,fh);
if (bytes_read == 2 && junk[0] == 0xff && junk[1] == 0xff) {
K12_DBG(1,("get_record: EOF"));
return 0;
} else if ( bytes_read < 0x14 ){
K12_DBG(1,("get_record: SHORT READ OR ERROR"));
*err = file_error(fh, err_info);
if (*err == 0) {
*err = WTAP_ERR_SHORT_READ;
}
return -1;
}
memcpy(buffer,&(junk[0x10]),4);
} else {
/* the length of the record is right where we are reading */
bytes_read = file_read(buffer, 0x4, fh);
if (bytes_read == 2 && buffer[0] == 0xff && buffer[1] == 0xff) {
K12_DBG(1,("get_record: EOF"));
return 0;
} else if ( bytes_read != 0x4 ) {
K12_DBG(1,("get_record: SHORT READ OR ERROR"));
*err = file_error(fh, err_info);
if (*err == 0) {
*err = WTAP_ERR_SHORT_READ;
}
return -1;
}
}
left = pntohl(buffer);
#ifdef DEBUG_K12
actual_len = left;
#endif
junky_offset -= 0x4;
K12_DBG(5,("get_record: GET length=%u",left));
/* XXX - Is WTAP_MAX_PACKET_SIZE */
if (left < 4 || left > WTAP_MAX_PACKET_SIZE) {
K12_DBG(1,("get_record: Invalid GET length=%u",left));
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("get_record: Invalid GET length=%u",left);
return -1;
}
while (left > buffer_len) *bufferp = buffer = g_realloc(buffer,buffer_len*=2);
writep = buffer + 4;
left -= 4;
do {
K12_DBG(6,("get_record: looping left=%d junky_offset=%" G_GINT64_MODIFIER "d",left,junky_offset));
if (junky_offset > left) {
bytes_read += last_read = file_read(writep, left, fh);
if ( last_read != left ) {
K12_DBG(1,("get_record: SHORT READ OR ERROR"));
*err = file_error(fh, err_info);
if (*err == 0) {
*err = WTAP_ERR_SHORT_READ;
}
return -1;
} else {
K12_HEXDMP(5,file_offset, "GOT record", buffer, actual_len);
return bytes_read;
}
} else {
bytes_read += last_read = file_read(writep, junky_offset, fh);
if ( last_read != junky_offset ) {
K12_DBG(1,("get_record: SHORT READ OR ERROR, read=%d expected=%d",last_read, junky_offset));
*err = file_error(fh, err_info);
if (*err == 0) {
*err = WTAP_ERR_SHORT_READ;
}
return -1;
}
writep += last_read;
bytes_read += last_read = file_read(junk, 0x10, fh);
if ( last_read != 0x10 ) {
K12_DBG(1,("get_record: SHORT READ OR ERROR"));
*err = file_error(fh, err_info);
if (*err == 0) {
*err = WTAP_ERR_SHORT_READ;
}
return -1;
}
left -= junky_offset;
junky_offset = 0x2000;
}
} while(left);
K12_HEXDMP(5,file_offset, "GOT record", buffer, actual_len);
return bytes_read;
}
static gboolean k12_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) {
k12_t *k12 = (k12_t *)wth->priv;
k12_src_desc_t* src_desc;
guint8* buffer = NULL;
gint64 offset;
gint len;
guint32 type;
guint32 src_id;
guint64 ts;
guint32 extra_len;
offset = wth->data_offset;
/* ignore the record if it isn't a packet */
do {
K12_DBG(5,("k12_read: offset=%i",offset));
*data_offset = offset;
len = get_record(&buffer, wth->fh, offset, err, err_info);
if (len < 0) {
return FALSE;
} else if (len == 0) {
*err = 0;
return FALSE;
}
type = pntohl(buffer + K12_RECORD_TYPE);
src_id = pntohl(buffer + K12_RECORD_SRC_ID);
if ( ! (src_desc = g_hash_table_lookup(k12->src_by_id,GUINT_TO_POINTER(src_id))) ) {
/*
* Some records from K15 files have a port ID of an undeclared
* interface which happens to be the only one with the first byte changed.
* It is still unknown how to recognize when this happens.
* If the lookup of the interface record fails we'll mask it
* and retry.
*/
src_desc = g_hash_table_lookup(k12->src_by_id,GUINT_TO_POINTER(src_id&K12_RECORD_SRC_ID_MASK));
}
K12_DBG(5,("k12_read: record type=%x src_id=%x",type,src_id));
offset += len;
} while ( ((type & K12_MASK_PACKET) != K12_REC_PACKET) || !src_id || !src_desc );
wth->data_offset = offset;
wth->phdr.presence_flags = WTAP_HAS_TS;
ts = pntohll(buffer + K12_PACKET_TIMESTAMP);
wth->phdr.ts.secs = (guint32) ((ts / 2000000) + 631152000);
wth->phdr.ts.nsecs = (guint32) ( (ts % 2000000) * 500 );
K12_DBG(3,("k12_read: PACKET RECORD type=%x src_id=%x secs=%u nsecs=%u",type,src_id, wth->phdr.ts.secs,wth->phdr.ts.nsecs));
wth->phdr.len = wth->phdr.caplen = pntohl(buffer + K12_RECORD_FRAME_LEN) & 0x00001FFF;
extra_len = len - K12_PACKET_FRAME - wth->phdr.caplen;
/* the frame */
buffer_assure_space(wth->frame_buffer, wth->phdr.caplen);
memcpy(buffer_start_ptr(wth->frame_buffer), buffer + K12_PACKET_FRAME, wth->phdr.caplen);
/* extra information need by some protocols */
buffer_assure_space(&(k12->extra_info), extra_len);
memcpy(buffer_start_ptr(&(k12->extra_info)),
buffer + K12_PACKET_FRAME + wth->phdr.caplen, extra_len);
wth->pseudo_header.k12.extra_info = (void*)buffer_start_ptr(&(k12->extra_info));
wth->pseudo_header.k12.extra_length = extra_len;
wth->pseudo_header.k12.input = src_id;
K12_DBG(5,("k12_read: wth->pseudo_header.k12.input=%x wth->phdr.len=%i input_name='%s' stack_file='%s' type=%x",
wth->pseudo_header.k12.input,wth->phdr.len,src_desc->input_name,src_desc->stack_file,src_desc->input_type));\
wth->pseudo_header.k12.input_name = src_desc->input_name;
wth->pseudo_header.k12.stack_file = src_desc->stack_file;
wth->pseudo_header.k12.input_type = src_desc->input_type;
switch(src_desc->input_type) {
case K12_PORT_ATMPVC:
if ((long)(K12_PACKET_FRAME + wth->phdr.len + K12_PACKET_OFFSET_CID) < len) {
wth->pseudo_header.k12.input_info.atm.vp = pntohs(buffer + (K12_PACKET_FRAME + wth->phdr.caplen + K12_PACKET_OFFSET_VP));
wth->pseudo_header.k12.input_info.atm.vc = pntohs(buffer + (K12_PACKET_FRAME + wth->phdr.caplen + K12_PACKET_OFFSET_VC));
wth->pseudo_header.k12.input_info.atm.cid = *((unsigned char*)(buffer + K12_PACKET_FRAME + wth->phdr.len + K12_PACKET_OFFSET_CID));
break;
}
/* Fall through */
default:
memcpy(&(wth->pseudo_header.k12.input_info),&(src_desc->input_info),sizeof(src_desc->input_info));
break;
}
wth->pseudo_header.k12.stuff = k12;
return TRUE;
}
/* Read the next packet */
static gboolean iptrace_read_2_0(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset)
{
int ret;
guint32 packet_size;
guint8 header[IPTRACE_2_0_PHDR_SIZE];
guint8 *data_ptr;
iptrace_2_0_phdr pkt_hdr;
guint8 fddi_padding[3];
/* Read the descriptor data */
*data_offset = wth->data_offset;
ret = iptrace_read_rec_header(wth->fh, header, IPTRACE_2_0_PHDR_SIZE,
err, err_info);
if (ret <= 0) {
/* Read error or EOF */
return FALSE;
}
wth->data_offset += IPTRACE_2_0_PHDR_SIZE;
/*
* Byte 28 of the frame header appears to be a BSD-style IFT_xxx
* value giving the type of the interface. Check out the
* <net/if_types.h> header file.
*/
pkt_hdr.if_type = header[28];
wth->phdr.pkt_encap = wtap_encap_ift(pkt_hdr.if_type);
/* Read the packet data */
packet_size = pntohl(&header[0]);
if (packet_size < IPTRACE_2_0_PDATA_SIZE) {
/*
* Uh-oh, the record isn't big enough to even have a
* packet meta-data header.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size);
return FALSE;
}
packet_size -= IPTRACE_2_0_PDATA_SIZE;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (wth->phdr.pkt_encap == WTAP_ENCAP_FDDI_BITSWAPPED) {
/*
* The packet size is really a record size and includes
* the padding.
*/
if (packet_size < 3) {
/*
* Uh-oh, the record isn't big enough to even have
* the padding.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size + IPTRACE_2_0_PDATA_SIZE);
return FALSE;
}
packet_size -= 3;
wth->data_offset += 3;
/*
* Read the padding.
*/
if (!iptrace_read_rec_data(wth->fh, fddi_padding, 3, err,
err_info))
return FALSE; /* Read error */
}
if (packet_size > WTAP_MAX_PACKET_SIZE) {
/*
* Probably a corrupt capture file; don't blow up trying
* to allocate space for an immensely-large packet.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
return FALSE;
}
buffer_assure_space( wth->frame_buffer, packet_size );
data_ptr = buffer_start_ptr( wth->frame_buffer );
if (!iptrace_read_rec_data(wth->fh, data_ptr, packet_size, err,
err_info))
return FALSE; /* Read error */
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = packet_size;
wth->phdr.caplen = packet_size;
wth->phdr.ts.secs = pntohl(&header[32]);
wth->phdr.ts.nsecs = pntohl(&header[36]);
if (wth->phdr.pkt_encap == WTAP_ENCAP_UNKNOWN) {
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
*err_info = g_strdup_printf("iptrace: interface type IFT=0x%02x unknown or unsupported",
pkt_hdr.if_type);
return FALSE;
}
/* Fill in the pseudo-header. */
fill_in_pseudo_header(wth->phdr.pkt_encap, data_ptr, wth->phdr.caplen,
&wth->pseudo_header, header);
/* If the per-file encapsulation isn't known, set it to this
packet's encapsulation.
If it *is* known, and it isn't this packet's encapsulation,
set it to WTAP_ENCAP_PER_PACKET, as this file doesn't
have a single encapsulation for all packets in the file. */
if (wth->file_encap == WTAP_ENCAP_UNKNOWN)
wth->file_encap = wth->phdr.pkt_encap;
else {
if (wth->file_encap != wth->phdr.pkt_encap)
wth->file_encap = WTAP_ENCAP_PER_PACKET;
}
return TRUE;
}
static gboolean peekclassic_read_packet_v56(wtap *wth, FILE_T fh,
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
{
peekclassic_t *peekclassic = (peekclassic_t *)wth->priv;
guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
guint16 length;
guint16 sliceLength;
#if 0
guint8 flags;
guint8 status;
#endif
guint32 timestamp;
#if 0
guint16 destNum;
guint16 srcNum;
#endif
guint16 protoNum;
#if 0
char protoStr[8];
#endif
unsigned int i;
wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), fh, err,
err_info);
/* Extract the fields from the packet */
length = pntohs(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V56_FLAGS_OFFSET];
status = ep_pkt[PEEKCLASSIC_V56_STATUS_OFFSET];
#endif
timestamp = pntohl(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
#if 0
destNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
srcNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
#endif
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
#if 0
memcpy(protoStr, &ep_pkt[PEEKCLASSIC_V56_PROTOSTR_OFFSET],
sizeof protoStr);
#endif
/*
* XXX - is the captured packet data padded to a multiple
* of 2 bytes?
*/
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
/* fill in packet header values */
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* timestamp is in milliseconds since reference_time */
phdr->ts.secs = peekclassic->reference_time.tv_sec
+ (timestamp / 1000);
phdr->ts.nsecs = 1000 * (timestamp % 1000) * 1000;
phdr->len = length;
phdr->caplen = sliceLength;
phdr->pkt_encap = WTAP_ENCAP_UNKNOWN;
for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
if (peekclassic_encap[i].protoNum == protoNum) {
phdr->pkt_encap = peekclassic_encap[i].encap;
}
}
switch (phdr->pkt_encap) {
case WTAP_ENCAP_ETHERNET:
/* We assume there's no FCS in this frame. */
phdr->pseudo_header.eth.fcs_len = 0;
break;
}
/* read the packet data */
return wtap_read_packet_bytes(fh, buf, sliceLength, err, err_info);
}
uint32_t Tvbuff::tvb_get_ntohl(tvbuff_t *tvb,int offset)
{
const uint8_t* ptr;
ptr = ensure_contiguous(tvb,offset,sizeof(uint32_t));
return pntohl(ptr);
}
static void visual_set_pseudo_header(int encap, struct visual_pkt_hdr *vpkt_hdr,
struct visual_atm_hdr *vatm_hdr, union wtap_pseudo_header *pseudo_header)
{
guint32 packet_status;
/* Set status flags. The only status currently supported for all
encapsulations is direction. This either goes in the p2p or the
X.25 pseudo header. It would probably be better to move this up
into the phdr. */
packet_status = pletohl(&vpkt_hdr->status);
switch (encap)
{
case WTAP_ENCAP_ETHERNET:
/* XXX - is there an FCS in the frame? */
pseudo_header->eth.fcs_len = -1;
break;
case WTAP_ENCAP_CHDLC_WITH_PHDR:
case WTAP_ENCAP_PPP_WITH_PHDR:
pseudo_header->p2p.sent = (packet_status & PS_SENT) ? TRUE : FALSE;
break;
case WTAP_ENCAP_FRELAY_WITH_PHDR:
case WTAP_ENCAP_LAPB:
pseudo_header->x25.flags =
(packet_status & PS_SENT) ? 0x00 : FROM_DCE;
break;
case WTAP_ENCAP_ATM_PDUS:
/* Set defaults */
pseudo_header->atm.type = TRAF_UNKNOWN;
pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
pseudo_header->atm.aal5t_len = 0;
/* Next two items not supported. Defaulting to zero */
pseudo_header->atm.aal5t_u2u = 0;
pseudo_header->atm.aal5t_chksum = 0;
/* Flags appear only to convey that packet is a raw cell. Set to 0 */
pseudo_header->atm.flags = 0;
/* Not supported. Defaulting to zero */
pseudo_header->atm.aal2_cid = 0;
switch(vatm_hdr->category & VN_CAT_TYPE_MASK )
{
case VN_AAL1:
pseudo_header->atm.aal = AAL_1;
break;
case VN_AAL2:
pseudo_header->atm.aal = AAL_2;
break;
case VN_AAL34:
pseudo_header->atm.aal = AAL_3_4;
break;
case VN_AAL5:
pseudo_header->atm.aal = AAL_5;
pseudo_header->atm.type = TRAF_LLCMX;
pseudo_header->atm.aal5t_len = pntohl(&vatm_hdr->data_length);
break;
case VN_OAM:
/* Marking next 3 as OAM versus unknown */
case VN_O191:
case VN_IDLE:
case VN_RM:
pseudo_header->atm.aal = AAL_OAMCELL;
break;
case VN_UNKNOWN:
default:
pseudo_header->atm.aal = AAL_UNKNOWN;
break;
}
pseudo_header->atm.vpi = pntohs(&vatm_hdr->vpi) & 0x0FFF;
pseudo_header->atm.vci = pntohs(&vatm_hdr->vci);
pseudo_header->atm.cells = pntohs(&vatm_hdr->cell_count);
/* Using bit value of 1 (DCE -> DTE) to indicate From Network */
pseudo_header->atm.channel = vatm_hdr->info & FROM_NETWORK;
break;
}
}
static int
nettl_read_rec_header(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
union wtap_pseudo_header *pseudo_header, int *err,
gchar **err_info, gboolean *fddihack)
{
nettl_t *nettl = (nettl_t *)wth->priv;
int bytes_read;
struct nettlrec_hdr rec_hdr;
guint16 hdr_len;
struct nettlrec_ns_ls_drv_eth_hdr drv_eth_hdr;
guint16 length, caplen;
int offset = 0;
int subsys;
int padlen;
guint8 dummyc[16];
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&rec_hdr.hdr_len, sizeof rec_hdr.hdr_len, fh);
if (bytes_read != sizeof rec_hdr.hdr_len) {
*err = file_error(fh, err_info);
if (*err != 0)
return -1;
if (bytes_read != 0) {
*err = WTAP_ERR_SHORT_READ;
return -1;
}
return 0;
}
offset += 2;
hdr_len = g_ntohs(rec_hdr.hdr_len);
if (hdr_len < NETTL_REC_HDR_LEN) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("nettl: record header length %u too short",
hdr_len);
return -1;
}
bytes_read = file_read(&rec_hdr.subsys, NETTL_REC_HDR_LEN - 2, fh);
if (bytes_read != NETTL_REC_HDR_LEN - 2) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
offset += NETTL_REC_HDR_LEN - 2;
subsys = g_ntohs(rec_hdr.subsys);
hdr_len -= NETTL_REC_HDR_LEN;
if (file_seek(fh, hdr_len, SEEK_CUR, err) == -1)
return -1;
offset += hdr_len;
if ( (pntohl(&rec_hdr.kind) & NETTL_HDR_PDU_MASK) == 0 ) {
/* not actually a data packet (PDU) trace record */
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_IP;
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
padlen = 0;
} else switch (subsys) {
case NETTL_SUBSYS_LAN100 :
case NETTL_SUBSYS_EISA100BT :
case NETTL_SUBSYS_BASE100 :
case NETTL_SUBSYS_GSC100BT :
case NETTL_SUBSYS_PCI100BT :
case NETTL_SUBSYS_SPP100BT :
case NETTL_SUBSYS_100VG :
case NETTL_SUBSYS_GELAN :
case NETTL_SUBSYS_BTLAN :
case NETTL_SUBSYS_INTL100 :
case NETTL_SUBSYS_IGELAN :
case NETTL_SUBSYS_IETHER :
case NETTL_SUBSYS_IXGBE :
case NETTL_SUBSYS_HSSN :
case NETTL_SUBSYS_IGSSN :
case NETTL_SUBSYS_ICXGBE :
case NETTL_SUBSYS_IEXGBE :
case NETTL_SUBSYS_HPPB_FDDI :
case NETTL_SUBSYS_EISA_FDDI :
case NETTL_SUBSYS_PCI_FDDI :
case NETTL_SUBSYS_HSC_FDDI :
case NETTL_SUBSYS_TOKEN :
case NETTL_SUBSYS_PCI_TR :
case NETTL_SUBSYS_NS_LS_IP :
case NETTL_SUBSYS_NS_LS_LOOPBACK :
case NETTL_SUBSYS_NS_LS_TCP :
case NETTL_SUBSYS_NS_LS_UDP :
case NETTL_SUBSYS_HP_APAPORT :
case NETTL_SUBSYS_HP_APALACP :
case NETTL_SUBSYS_NS_LS_IPV6 :
case NETTL_SUBSYS_NS_LS_ICMPV6 :
case NETTL_SUBSYS_NS_LS_ICMP :
case NETTL_SUBSYS_NS_LS_TELNET :
case NETTL_SUBSYS_NS_LS_SCTP :
if( (subsys == NETTL_SUBSYS_NS_LS_IP)
|| (subsys == NETTL_SUBSYS_NS_LS_LOOPBACK)
|| (subsys == NETTL_SUBSYS_NS_LS_UDP)
|| (subsys == NETTL_SUBSYS_NS_LS_TCP)
|| (subsys == NETTL_SUBSYS_NS_LS_SCTP)
|| (subsys == NETTL_SUBSYS_NS_LS_IPV6)) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_IP;
} else if (subsys == NETTL_SUBSYS_NS_LS_ICMP) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_ICMP;
} else if (subsys == NETTL_SUBSYS_NS_LS_ICMPV6) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_ICMPV6;
} else if (subsys == NETTL_SUBSYS_NS_LS_TELNET) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_RAW_TELNET;
} else if( (subsys == NETTL_SUBSYS_HPPB_FDDI)
|| (subsys == NETTL_SUBSYS_EISA_FDDI)
|| (subsys == NETTL_SUBSYS_PCI_FDDI)
|| (subsys == NETTL_SUBSYS_HSC_FDDI) ) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_FDDI;
} else if( (subsys == NETTL_SUBSYS_PCI_TR)
|| (subsys == NETTL_SUBSYS_TOKEN) ) {
phdr->pkt_encap = WTAP_ENCAP_NETTL_TOKEN_RING;
} else {
phdr->pkt_encap = WTAP_ENCAP_NETTL_ETHERNET;
}
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
/* HPPB FDDI has different inbound vs outbound trace records */
if (subsys == NETTL_SUBSYS_HPPB_FDDI) {
if (pntohl(&rec_hdr.kind) == NETTL_HDR_PDUIN) {
/* inbound is very strange...
there are an extra 3 bytes after the DSAP and SSAP
for SNAP frames ???
*/
*fddihack=TRUE;
padlen = 0;
} else {
/* outbound appears to have variable padding */
bytes_read = file_read(dummyc, 9, fh);
if (bytes_read != 9) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
/* padding is usually either a total 11 or 16 bytes??? */
padlen = (int)dummyc[8];
if (file_seek(fh, padlen, SEEK_CUR, err) == -1)
return -1;
padlen += 9;
offset += padlen;
}
} else if ( (subsys == NETTL_SUBSYS_PCI_FDDI)
|| (subsys == NETTL_SUBSYS_EISA_FDDI)
|| (subsys == NETTL_SUBSYS_HSC_FDDI) ) {
/* other flavor FDDI cards have an extra 3 bytes of padding */
if (file_seek(fh, 3, SEEK_CUR, err) == -1)
return -1;
padlen = 3;
offset += padlen;
} else if (subsys == NETTL_SUBSYS_NS_LS_LOOPBACK) {
/* LOOPBACK has an extra 26 bytes of padding */
if (file_seek(fh, 26, SEEK_CUR, err) == -1)
return -1;
padlen = 26;
offset += padlen;
} else if (subsys == NETTL_SUBSYS_NS_LS_SCTP) {
/*
* SCTP 8 byte header that we will ignore...
* 32 bit integer defines format
* 1 = Log
* 2 = ASCII
* 3 = Binary (PDUs should be Binary format)
* 32 bit integer defines type
* 1 = Inbound
* 2 = Outbound
*/
if (file_seek(fh, 8, SEEK_CUR, err) == -1)
return -1;
padlen = 8;
offset += padlen;
} else {
padlen = 0;
}
break;
case NETTL_SUBSYS_NS_LS_DRIVER :
/* XXX we dont know how to identify this as ethernet frames, so
we assumes everything is. We will crash and burn for anything else */
/* for encapsulated 100baseT we do this */
phdr->pkt_encap = WTAP_ENCAP_NETTL_ETHERNET;
bytes_read = file_read(&drv_eth_hdr, NS_LS_DRV_ETH_HDR_LEN, fh);
if (bytes_read != NS_LS_DRV_ETH_HDR_LEN) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return -1;
}
offset += NS_LS_DRV_ETH_HDR_LEN;
length = pntohs(&drv_eth_hdr.length);
caplen = pntohs(&drv_eth_hdr.caplen);
/*
* XXX - is there a length field that would give the length
* of this header, so that we don't have to check for
* nettl files from HP-UX 11?
*
* And what are the extra two bytes?
*/
if (nettl->is_hpux_11) {
if (file_seek(fh, 2, SEEK_CUR, err) == -1) return -1;
offset += 2;
}
padlen = 0;
break;
case NETTL_SUBSYS_SX25L2:
case NETTL_SUBSYS_SX25L3:
/*
* XXX - is the 24-byte padding actually a header with
* packet lengths, time stamps, etc., just as is the case
* for NETTL_SUBSYS_NS_LS_DRIVER? It might be
*
* guint8 caplen[2];
* guint8 length[2];
* guint8 xxc[4];
* guint8 sec[4];
* guint8 usec[4];
* guint8 xxd[4];
*
* or something such as that - if it has 4 bytes before that
* (making it 24 bytes), it'd be like struct
* nettlrec_ns_ls_drv_eth_hdr but with 2 more bytes at the end.
*
* And is "from_dce" at xxa[0] in the nettlrec_hdr structure?
*/
phdr->pkt_encap = WTAP_ENCAP_NETTL_X25;
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
padlen = 24; /* sizeof (struct nettlrec_sx25l2_hdr) - NETTL_REC_HDR_LEN + 4 */
if (file_seek(fh, padlen, SEEK_CUR, err) == -1)
return -1;
offset += padlen;
break;
default:
/* We're going to assume it's ethernet if we don't recognize the
subsystem -- We'll probably spew junks and core if it isn't... */
wth->file_encap = WTAP_ENCAP_PER_PACKET;
phdr->pkt_encap = WTAP_ENCAP_NETTL_ETHERNET;
length = pntohl(&rec_hdr.length);
caplen = pntohl(&rec_hdr.caplen);
padlen = 0;
break;
}
if (length < padlen) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("nettl: packet length %u in record header too short, less than %u",
length, padlen);
return -1;
}
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
phdr->len = length - padlen;
if (caplen < padlen) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("nettl: captured length %u in record header too short, less than %u",
caplen, padlen);
return -1;
}
phdr->caplen = caplen - padlen;
phdr->ts.secs = pntohl(&rec_hdr.sec);
phdr->ts.nsecs = pntohl(&rec_hdr.usec) * 1000;
pseudo_header->nettl.subsys = subsys;
pseudo_header->nettl.devid = pntohl(&rec_hdr.devid);
pseudo_header->nettl.kind = pntohl(&rec_hdr.kind);
pseudo_header->nettl.pid = pntohl(&rec_hdr.pid);
pseudo_header->nettl.uid = pntohs(&rec_hdr.uid);
return offset;
}
static void
fill_fp_info(fp_info *p_fp_info, guchar *extra_info, guint32 length)
{
guint adj = 0;
/* 0x11=control frame 0x30=data frame */
guint info_type = pntohs(extra_info);
/* 1=FDD, 2=TDD 3.84, 3=TDD 1.28 */
guchar radio_mode = extra_info[14];
guchar channel_type = 0;
guint i;
if (!p_fp_info || length < 22)
return;
/* Store division type */
p_fp_info->division = radio_mode;
/* Format used by K15, later fields are shifted by 8 bytes. */
if (pntohs(extra_info+2) == 5)
adj = 8;
p_fp_info->iface_type = IuB_Interface;
p_fp_info->release = 0; /* dummy */
p_fp_info->release_year = 0; /* dummy */
p_fp_info->release_month = 0; /* dummy */
/* 1=UL, 2=DL */
if (extra_info[15] == 1)
p_fp_info->is_uplink = 1;
else
p_fp_info->is_uplink = 0;
if (info_type == 0x11) /* control frame */
channel_type = extra_info[21 + adj];
else if (info_type == 0x30) /* data frame */
channel_type = extra_info[22 + adj];
switch (channel_type) {
case 1:
p_fp_info->channel = CHANNEL_BCH;
break;
case 2:
p_fp_info->channel = CHANNEL_PCH;
p_fp_info->paging_indications = 0; /* dummy */
break;
case 3:
p_fp_info->channel = CHANNEL_CPCH;
break;
case 4:
if (radio_mode == 1)
p_fp_info->channel = CHANNEL_RACH_FDD;
else if (radio_mode == 2)
p_fp_info->channel = CHANNEL_RACH_TDD;
else
p_fp_info->channel = CHANNEL_RACH_TDD_128;
break;
case 5:
if (radio_mode == 1)
p_fp_info->channel = CHANNEL_FACH_FDD;
else
p_fp_info->channel = CHANNEL_FACH_TDD;
break;
case 6:
if (radio_mode == 2)
p_fp_info->channel = CHANNEL_USCH_TDD_384;
else
p_fp_info->channel = CHANNEL_USCH_TDD_128;
break;
case 7:
if (radio_mode == 1)
p_fp_info->channel = CHANNEL_DSCH_FDD;
else
p_fp_info->channel = CHANNEL_DSCH_TDD;
break;
case 8:
p_fp_info->channel = CHANNEL_DCH;
break;
}
p_fp_info->dch_crc_present = 2; /* information not available */
if (info_type == 0x30) { /* data frame */
p_fp_info->num_chans = extra_info[23 + adj];
/* For each channel */
for (i = 0; i < (guint)p_fp_info->num_chans && (36+i*104+adj) <= length; ++i) {
/* Read TB size */
p_fp_info->chan_tf_size[i] = pntohl(extra_info+28+i*104+adj);
if (p_fp_info->chan_tf_size[i])
/* Work out number of TBs on this channel */
p_fp_info->chan_num_tbs[i] = pntohl(extra_info+32+i*104+adj)
/ p_fp_info->chan_tf_size[i];
}
}
}
int
rpc_decode(u_char *buf, int len, struct rpc_msg *msg)
{
XDR xdrs;
u_int32_t fraghdr;
u_char *p, *tmp;
int stat, tmplen;
if (len < 20)
return (0);
p = buf + 4;
/* If not recognizably RPC, try TCP record defragmentation */
if (pntohl(p) != CALL && pntohl(p) != REPLY) {
tmp = buf;
tmplen = 0;
for (;;) {
fraghdr = pntohl(tmp);
if (FRAGLEN(fraghdr) + 4 > len)
return (0);
len -= 4;
memmove(tmp, tmp + 4, len);
tmplen += FRAGLEN(fraghdr);
if (LASTFRAG(fraghdr))
break;
tmp += FRAGLEN(fraghdr);
len -= FRAGLEN(fraghdr);
if (len < 4)
return (0);
}
len = tmplen;
}
/* Decode RPC message. */
memset(msg, 0, sizeof(*msg));
if (ntohl(((struct rpc_msg *)buf)->rm_direction) == CALL) {
xdrmem_create(&xdrs, buf, len, XDR_DECODE);
if (!xdr_callmsg(&xdrs, msg)) {
xdr_destroy(&xdrs);
return (0);
}
}
else if (ntohl(((struct rpc_msg *)buf)->rm_direction) == REPLY) {
msg->acpted_rply.ar_results.proc = (xdrproc_t) xdr_void;
xdrmem_create(&xdrs, buf, len, XDR_DECODE);
if (!xdr_replymsg(&xdrs, msg)) {
xdr_destroy(&xdrs);
return (0);
}
}
stat = xdr_getpos(&xdrs);
xdr_destroy(&xdrs);
return (stat);
}
static gboolean
peekclassic_read_v56(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
{
peekclassic_t *peekclassic = (peekclassic_t *)wth->priv;
guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
guint16 length;
guint16 sliceLength;
#if 0
guint8 flags;
guint8 status;
#endif
guint32 timestamp;
#if 0
guint16 destNum;
guint16 srcNum;
#endif
guint16 protoNum;
char protoStr[8];
unsigned int i;
/*
* XXX - in order to figure out whether this packet is an
* Ethernet packet or not, we have to look at the packet
* header, so we have to remember the address of the header,
* not the address of the data, for random access.
*
* If we can determine that from the file header, rather than
* the packet header, we can remember the offset of the data,
* and not have the seek_read routine read the header.
*/
*data_offset = file_tell(wth->fh);
wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->fh, err,
err_info);
/* Extract the fields from the packet */
length = pntohs(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V56_FLAGS_OFFSET];
status = ep_pkt[PEEKCLASSIC_V56_STATUS_OFFSET];
#endif
timestamp = pntohl(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
#if 0
destNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
srcNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
#endif
protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
memcpy(protoStr, &ep_pkt[PEEKCLASSIC_V56_PROTOSTR_OFFSET],
sizeof protoStr);
/*
* XXX - is the captured packet data padded to a multiple
* of 2 bytes?
*/
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
/* read the frame data */
buffer_assure_space(wth->frame_buffer, sliceLength);
wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
sliceLength, wth->fh, err, err_info);
/* fill in packet header values */
wth->phdr.len = length;
wth->phdr.caplen = sliceLength;
/* timestamp is in milliseconds since reference_time */
wth->phdr.ts.secs = peekclassic->reference_time.tv_sec
+ (timestamp / 1000);
wth->phdr.ts.nsecs = 1000 * (timestamp % 1000) * 1000;
wth->phdr.pkt_encap = WTAP_ENCAP_UNKNOWN;
for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
if (peekclassic_encap[i].protoNum == protoNum) {
wth->phdr.pkt_encap = peekclassic_encap[i].encap;
}
}
switch (wth->phdr.pkt_encap) {
case WTAP_ENCAP_ETHERNET:
/* We assume there's no FCS in this frame. */
wth->phdr.pseudo_header.eth.fcs_len = 0;
break;
}
return TRUE;
}
static gboolean
visual_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
Buffer *buf, int *err, gchar **err_info)
{
struct visual_read_info *visual = (struct visual_read_info *)wth->priv;
struct visual_pkt_hdr vpkt_hdr;
int bytes_read;
guint32 packet_size;
struct visual_atm_hdr vatm_hdr;
double t;
time_t secs;
guint32 usecs;
guint32 packet_status;
guint8 *pd;
/* Read the packet header. */
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&vpkt_hdr, (unsigned int)sizeof vpkt_hdr, fh);
if (bytes_read < 0 || (size_t)bytes_read != sizeof vpkt_hdr)
{
*err = file_error(fh, err_info);
if (*err == 0 && bytes_read != 0)
{
*err = WTAP_ERR_SHORT_READ;
}
return FALSE;
}
/* Get the included length of data. This includes extra headers + payload */
packet_size = pletohs(&vpkt_hdr.incl_len);
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* Set the packet time and length. */
t = visual->start_time;
t += ((double)pletohl(&vpkt_hdr.ts_delta))*1000;
secs = (time_t)(t/1000000);
usecs = (guint32)(t - secs*1000000);
phdr->ts.secs = secs;
phdr->ts.nsecs = usecs * 1000;
phdr->len = pletohs(&vpkt_hdr.orig_len);
packet_status = pletohl(&vpkt_hdr.status);
/* Do encapsulation-specific processing.
Most Visual capture types include the FCS in the original length
value, but don't include the FCS as part of the payload or captured
length. This is different from the model used in most other capture
file formats, including pcap and pcap-ng in cases where the FCS isn't
captured (which are the typical cases), and causes the RTP audio
payload save to fail since then captured len != orig len.
We adjust the original length to remove the FCS bytes we counted based
on the file encapsualtion type. The only downside to this fix is
throughput calculations will be slightly lower as it won't include
the FCS bytes. However, as noted, that problem also exists with
other capture formats.
We also set status flags. The only status currently supported for
all encapsulations is direction. This either goes in the p2p or the
X.25 pseudo header. It would probably be better to move this up
into the phdr. */
switch (wth->file_encap)
{
case WTAP_ENCAP_ETHERNET:
/* Ethernet has a 4-byte FCS. */
if (phdr->len < 4)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Ethernet packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 4;
/* XXX - the above implies that there's never an FCS; should this
set the FCS length to 0? */
phdr->pseudo_header.eth.fcs_len = -1;
break;
case WTAP_ENCAP_CHDLC_WITH_PHDR:
/* This has a 2-byte FCS. */
if (phdr->len < 2)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Cisco HDLC packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 2;
phdr->pseudo_header.p2p.sent = (packet_status & PS_SENT) ? TRUE : FALSE;
break;
case WTAP_ENCAP_PPP_WITH_PHDR:
/* No FCS.
XXX - true? Note that PPP can negotiate no FCS, a 2-byte FCS,
or a 4-byte FCS. */
phdr->pseudo_header.p2p.sent = (packet_status & PS_SENT) ? TRUE : FALSE;
break;
case WTAP_ENCAP_FRELAY_WITH_PHDR:
/* This has a 2-byte FCS. */
if (phdr->len < 2)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Frame Relay packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 2;
phdr->pseudo_header.x25.flags =
(packet_status & PS_SENT) ? 0x00 : FROM_DCE;
break;
case WTAP_ENCAP_LAPB:
/* This has a 2-byte FCS. */
if (phdr->len < 2)
{
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: Frame Relay packet has %u-byte original packet, less than the FCS length",
phdr->len);
return FALSE;
}
phdr->len -= 2;
phdr->pseudo_header.x25.flags =
(packet_status & PS_SENT) ? 0x00 : FROM_DCE;
break;
case WTAP_ENCAP_ATM_PDUS:
/* ATM original length doesn't include any FCS. Do nothing to
the packet length.
ATM packets have an additional packet header; read and
process it. */
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&vatm_hdr, (unsigned int)sizeof vatm_hdr, fh);
if (bytes_read < 0 || (size_t)bytes_read != sizeof vatm_hdr)
{
*err = file_error(fh, err_info);
if (*err == 0)
{
*err = WTAP_ERR_SHORT_READ;
}
return FALSE;
}
/* Remove ATM header from length of included bytes in capture, as
this header was appended by the processor doing the packet
reassembly, and was not transmitted across the wire */
packet_size -= (guint32)sizeof vatm_hdr;
/* Set defaults */
phdr->pseudo_header.atm.type = TRAF_UNKNOWN;
phdr->pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
phdr->pseudo_header.atm.aal5t_len = 0;
/* Next two items not supported. Defaulting to zero */
phdr->pseudo_header.atm.aal5t_u2u = 0;
phdr->pseudo_header.atm.aal5t_chksum = 0;
/* Flags appear only to convey that packet is a raw cell. Set to 0 */
phdr->pseudo_header.atm.flags = 0;
/* Not supported. Defaulting to zero */
phdr->pseudo_header.atm.aal2_cid = 0;
switch(vatm_hdr.category & VN_CAT_TYPE_MASK )
{
case VN_AAL1:
phdr->pseudo_header.atm.aal = AAL_1;
break;
case VN_AAL2:
phdr->pseudo_header.atm.aal = AAL_2;
break;
case VN_AAL34:
phdr->pseudo_header.atm.aal = AAL_3_4;
break;
case VN_AAL5:
phdr->pseudo_header.atm.aal = AAL_5;
phdr->pseudo_header.atm.type = TRAF_LLCMX;
phdr->pseudo_header.atm.aal5t_len = pntohl(&vatm_hdr.data_length);
break;
case VN_OAM:
/* Marking next 3 as OAM versus unknown */
case VN_O191:
case VN_IDLE:
case VN_RM:
phdr->pseudo_header.atm.aal = AAL_OAMCELL;
break;
case VN_UNKNOWN:
default:
phdr->pseudo_header.atm.aal = AAL_UNKNOWN;
break;
}
phdr->pseudo_header.atm.vpi = pntohs(&vatm_hdr.vpi) & 0x0FFF;
phdr->pseudo_header.atm.vci = pntohs(&vatm_hdr.vci);
phdr->pseudo_header.atm.cells = pntohs(&vatm_hdr.cell_count);
/* Using bit value of 1 (DCE -> DTE) to indicate From Network */
phdr->pseudo_header.atm.channel = vatm_hdr.info & FROM_NETWORK;
break;
/* Not sure about token ring. Just leaving alone for now. */
case WTAP_ENCAP_TOKEN_RING:
default:
break;
}
phdr->caplen = packet_size;
/* Check for too-large packet. */
if (packet_size > WTAP_MAX_PACKET_SIZE)
{
/* Probably a corrupt capture file; don't blow up trying
to allocate space for an immensely-large packet. */
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("visual: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
return FALSE;
}
/* Sanity check */
if (phdr->len < phdr->caplen)
{
phdr->len = phdr->caplen;
}
/* Read the packet data */
if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
return FALSE;
if (wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR)
{
/* Fill in the encapsulation. Visual files have a media type in the
file header and an encapsulation type in each packet header. Files
with a media type of HDLC can be either Cisco EtherType or PPP.
The encapsulation hint values we've seen are:
2 - seen in an Ethernet capture
13 - seen in a PPP capture; possibly also seen in Cisco HDLC
captures
14 - seen in a PPP capture; probably seen only for PPP.
According to bug 2005, the collection probe can be configured
for PPP, in which case the encapsulation hint is 14, or can
be configured for auto-detect, in which case the encapsulation
hint is 13, and the encapsulation must be guessed from the
packet contents. Auto-detect is the default. */
pd = buffer_start_ptr(buf);
/* If PPP is specified in the encap hint, then use that */
if (vpkt_hdr.encap_hint == 14)
{
/* But first we need to examine the first three octets to
try to determine the proper encapsulation, see RFC 2364. */
if (packet_size >= 3 &&
(0xfe == pd[0]) && (0xfe == pd[1]) && (0x03 == pd[2]))
{
/* It is actually LLC encapsulated PPP */
phdr->pkt_encap = WTAP_ENCAP_ATM_RFC1483;
}
else
{
/* It is actually PPP */
phdr->pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
}
}
else
{
/* Otherwise, we need to examine the first two octets to
try to determine the encapsulation. */
if (packet_size >= 2 && (0xff == pd[0]) && (0x03 == pd[1]))
{
/* It is actually PPP */
phdr->pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
}
}
}
return TRUE;
}