static gboolean iptrace_seek_read_2_0(wtap *wth, gint64 seek_off,
union wtap_pseudo_header *pseudo_header, guint8 *pd, int packet_size,
int *err, gchar **err_info)
{
int ret;
guint8 header[IPTRACE_2_0_PHDR_SIZE];
int pkt_encap;
guint8 fddi_padding[3];
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
/* Read the descriptor data */
ret = iptrace_read_rec_header(wth->random_fh, header,
IPTRACE_2_0_PHDR_SIZE, err, err_info);
if (ret <= 0) {
/* Read error or EOF */
if (ret == 0) {
/* EOF means "short read" in random-access mode */
*err = WTAP_ERR_SHORT_READ;
}
return FALSE;
}
/*
* Get the interface type.
*/
pkt_encap = wtap_encap_ift(header[28]);
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (pkt_encap == WTAP_ENCAP_FDDI_BITSWAPPED) {
/*
* Read the padding.
*/
if (!iptrace_read_rec_data(wth->random_fh, fddi_padding, 3,
err, err_info))
return FALSE; /* Read error */
}
/* Get the packet data */
if (!iptrace_read_rec_data(wth->random_fh, pd, packet_size, err,
err_info))
return FALSE;
/* Fill in the pseudo-header. */
fill_in_pseudo_header(pkt_encap, pd, packet_size, pseudo_header,
header);
return TRUE;
}
static gboolean
iptrace_read_rec_2_0(FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf,
int *err, gchar **err_info)
{
guint8 header[IPTRACE_2_0_PHDR_SIZE];
int ret;
iptrace_2_0_phdr pkt_hdr;
guint32 packet_size;
ret = iptrace_read_rec_header(fh, header, IPTRACE_2_0_PHDR_SIZE,
err, err_info);
if (ret <= 0) {
/* Read error or EOF */
return FALSE;
}
/*
* Byte 28 of the frame header appears to be a BSD-style IFT_xxx
* value giving the type of the interface. Check out the
* <net/if_types.h> header file.
*/
pkt_hdr.if_type = header[28];
phdr->pkt_encap = wtap_encap_ift(pkt_hdr.if_type);
#if 0
/*
* We used to error out if the interface type in iptrace was
* unknown/unhandled, but an iptrace may contain packets
* from a variety of interfaces, some known, and others
* unknown.
*
* It is better to display the data even for unknown interface
* types, isntead of erroring out. In the future, it would be
* nice to be able to flag which frames are shown as data
* because their interface type is unknown, and also present
* the interface type number to the user so that it can be
* reported easily back to the Wireshark developer.
*
* XXX - what types are there that are used in files but
* that we don't handle?
*/
if (phdr->pkt_encap == WTAP_ENCAP_UNKNOWN) {
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
*err_info = g_strdup_printf("iptrace: interface type IFT=0x%02x unknown or unsupported",
pkt_hdr.if_type);
return FALSE;
}
#endif
/* Read the packet metadata */
packet_size = pntoh32(&header[0]);
if (packet_size < IPTRACE_2_0_PDATA_SIZE) {
/*
* Uh-oh, the record isn't big enough to even have a
* packet meta-data header.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size);
return FALSE;
}
packet_size -= IPTRACE_2_0_PDATA_SIZE;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (phdr->pkt_encap == WTAP_ENCAP_FDDI_BITSWAPPED) {
/*
* The packet size is really a record size and includes
* the padding.
*/
if (packet_size < 3) {
/*
* Uh-oh, the record isn't big enough to even have
* the padding.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size + IPTRACE_2_0_PDATA_SIZE);
return FALSE;
}
packet_size -= 3;
/*
* Skip the padding.
*/
if (!file_skip(fh, 3, err))
return FALSE;
}
if (packet_size > WTAP_MAX_PACKET_SIZE) {
/*
* Probably a corrupt capture file; don't blow up trying
* to allocate space for an immensely-large packet.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
return FALSE;
}
phdr->rec_type = REC_TYPE_PACKET;
phdr->presence_flags = WTAP_HAS_TS;
phdr->len = packet_size;
phdr->caplen = packet_size;
phdr->ts.secs = pntoh32(&header[32]);
phdr->ts.nsecs = pntoh32(&header[36]);
/* Fill in the pseudo_header. */
fill_in_pseudo_header(phdr->pkt_encap, &phdr->pseudo_header, header);
/* Get the packet data */
return iptrace_read_rec_data(fh, buf, phdr, err, err_info);
}
static gboolean
iptrace_read_rec_1_0(FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf,
int *err, gchar **err_info)
{
guint8 header[IPTRACE_1_0_PHDR_SIZE];
int ret;
iptrace_1_0_phdr pkt_hdr;
guint32 packet_size;
ret = iptrace_read_rec_header(fh, header, IPTRACE_1_0_PHDR_SIZE,
err, err_info);
if (ret <= 0) {
/* Read error or EOF */
return FALSE;
}
/*
* Byte 28 of the frame header appears to be a BSD-style IFT_xxx
* value giving the type of the interface. Check out the
* <net/if_types.h> header file.
*/
pkt_hdr.if_type = header[28];
phdr->pkt_encap = wtap_encap_ift(pkt_hdr.if_type);
if (phdr->pkt_encap == WTAP_ENCAP_UNKNOWN) {
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
*err_info = g_strdup_printf("iptrace: interface type IFT=0x%02x unknown or unsupported",
pkt_hdr.if_type);
return FALSE;
}
/* Read the packet metadata */
packet_size = pntoh32(&header[0]);
if (packet_size < IPTRACE_1_0_PDATA_SIZE) {
/*
* Uh-oh, the record isn't big enough to even have a
* packet meta-data header.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size);
return FALSE;
}
packet_size -= IPTRACE_1_0_PDATA_SIZE;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (phdr->pkt_encap == WTAP_ENCAP_FDDI_BITSWAPPED) {
/*
* The packet size is really a record size and includes
* the padding.
*/
if (packet_size < 3) {
/*
* Uh-oh, the record isn't big enough to even have
* the padding.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size + IPTRACE_1_0_PDATA_SIZE);
return FALSE;
}
packet_size -= 3;
/*
* Skip the padding.
*/
if (!file_skip(fh, 3, err))
return FALSE;
}
if (packet_size > WTAP_MAX_PACKET_SIZE) {
/*
* Probably a corrupt capture file; don't blow up trying
* to allocate space for an immensely-large packet.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
return FALSE;
}
phdr->rec_type = REC_TYPE_PACKET;
phdr->presence_flags = WTAP_HAS_TS;
phdr->len = packet_size;
phdr->caplen = packet_size;
phdr->ts.secs = pntoh32(&header[4]);
phdr->ts.nsecs = 0;
/* Fill in the pseudo-header. */
fill_in_pseudo_header(phdr->pkt_encap, &phdr->pseudo_header, header);
/* Get the packet data */
return iptrace_read_rec_data(fh, buf, phdr, err, err_info);
}
/* Read the next packet */
static gboolean iptrace_read_2_0(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset)
{
int ret;
guint32 packet_size;
guint8 header[IPTRACE_2_0_PHDR_SIZE];
guint8 *data_ptr;
iptrace_2_0_phdr pkt_hdr;
guint8 fddi_padding[3];
/* Read the descriptor data */
*data_offset = wth->data_offset;
ret = iptrace_read_rec_header(wth->fh, header, IPTRACE_2_0_PHDR_SIZE,
err, err_info);
if (ret <= 0) {
/* Read error or EOF */
return FALSE;
}
wth->data_offset += IPTRACE_2_0_PHDR_SIZE;
/*
* Byte 28 of the frame header appears to be a BSD-style IFT_xxx
* value giving the type of the interface. Check out the
* <net/if_types.h> header file.
*/
pkt_hdr.if_type = header[28];
wth->phdr.pkt_encap = wtap_encap_ift(pkt_hdr.if_type);
/* Read the packet data */
packet_size = pntohl(&header[0]);
if (packet_size < IPTRACE_2_0_PDATA_SIZE) {
/*
* Uh-oh, the record isn't big enough to even have a
* packet meta-data header.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size);
return FALSE;
}
packet_size -= IPTRACE_2_0_PDATA_SIZE;
/*
* AIX appears to put 3 bytes of padding in front of FDDI
* frames; strip that crap off.
*/
if (wth->phdr.pkt_encap == WTAP_ENCAP_FDDI_BITSWAPPED) {
/*
* The packet size is really a record size and includes
* the padding.
*/
if (packet_size < 3) {
/*
* Uh-oh, the record isn't big enough to even have
* the padding.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: file has a %u-byte record, too small to have even a packet meta-data header",
packet_size + IPTRACE_2_0_PDATA_SIZE);
return FALSE;
}
packet_size -= 3;
wth->data_offset += 3;
/*
* Read the padding.
*/
if (!iptrace_read_rec_data(wth->fh, fddi_padding, 3, err,
err_info))
return FALSE; /* Read error */
}
if (packet_size > WTAP_MAX_PACKET_SIZE) {
/*
* Probably a corrupt capture file; don't blow up trying
* to allocate space for an immensely-large packet.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("iptrace: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
return FALSE;
}
buffer_assure_space( wth->frame_buffer, packet_size );
data_ptr = buffer_start_ptr( wth->frame_buffer );
if (!iptrace_read_rec_data(wth->fh, data_ptr, packet_size, err,
err_info))
return FALSE; /* Read error */
wth->data_offset += packet_size;
wth->phdr.presence_flags = WTAP_HAS_TS;
wth->phdr.len = packet_size;
wth->phdr.caplen = packet_size;
wth->phdr.ts.secs = pntohl(&header[32]);
wth->phdr.ts.nsecs = pntohl(&header[36]);
if (wth->phdr.pkt_encap == WTAP_ENCAP_UNKNOWN) {
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
*err_info = g_strdup_printf("iptrace: interface type IFT=0x%02x unknown or unsupported",
pkt_hdr.if_type);
return FALSE;
}
/* Fill in the pseudo-header. */
fill_in_pseudo_header(wth->phdr.pkt_encap, data_ptr, wth->phdr.caplen,
&wth->pseudo_header, header);
/* If the per-file encapsulation isn't known, set it to this
packet's encapsulation.
If it *is* known, and it isn't this packet's encapsulation,
set it to WTAP_ENCAP_PER_PACKET, as this file doesn't
have a single encapsulation for all packets in the file. */
if (wth->file_encap == WTAP_ENCAP_UNKNOWN)
wth->file_encap = wth->phdr.pkt_encap;
else {
if (wth->file_encap != wth->phdr.pkt_encap)
wth->file_encap = WTAP_ENCAP_PER_PACKET;
}
return TRUE;
}