3 * Copyright (c) 2003 Endace Technology Ltd, Hamilton, New Zealand.
6 * This software and documentation has been developed by Endace Technology Ltd.
7 * along with the DAG PCI network capture cards. For further information please
8 * visit http://www.endace.com/.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions are met:
13 * 1. Redistributions of source code must retain the above copyright notice,
14 * this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
20 * 3. The name of Endace Technology Ltd may not be used to endorse or promote
21 * products derived from this software without specific prior written
24 * THIS SOFTWARE IS PROVIDED BY ENDACE TECHNOLOGY LTD ``AS IS'' AND ANY EXPRESS
25 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
27 * EVENT SHALL ENDACE TECHNOLOGY LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
30 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
31 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33 * POSSIBILITY OF SUCH DAMAGE.
39 * erf - Endace ERF (Extensible Record Format)
43 * http://www.endace.com/support/EndaceRecordFormat.pdf
54 #include "file_wrappers.h"
59 typedef guint32 atm_hdr_t;
61 static int erf_read_header(
63 struct wtap_pkthdr *phdr,
64 union wtap_pseudo_header *pseudo_header,
65 erf_header_t *erf_header,
70 guint32 *packet_size);
71 static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
73 static gboolean erf_seek_read(wtap *wth, long seek_off,
74 union wtap_pseudo_header *pseudo_header, guchar *pd,
75 int length, int *err, gchar **err_info);
76 static void erf_close(wtap *wth);
77 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap);
78 static void erf_set_pseudo_header(
83 union wtap_pseudo_header *pseudo_header);
85 int erf_open(wtap *wth, int *err, gchar **err_info _U_)
89 guint32 records_for_erf_check = RECORDS_FOR_ERF_CHECK;
90 guint32 atm_encap = WTAP_ENCAP_ATM_PDUS;
91 gboolean is_rawatm = FALSE;
92 gboolean is_ppp = FALSE;
94 erf_timestamp_t prevts;
96 memset(&prevts, 0, sizeof(prevts));
98 if ((s = getenv("ERF_ATM_ENCAP")) != NULL) {
99 if (!strcmp(s, "sunatm")) {
100 atm_encap = WTAP_ENCAP_ATM_PDUS;
102 if (!strcmp(s, "sunraw")) {
103 atm_encap = WTAP_ENCAP_ATM_PDUS;
106 if (!strcmp(s, "rfc1483")) {
107 atm_encap = WTAP_ENCAP_ATM_RFC1483;
111 /* number of records to scan before deciding if this really is ERF (dflt=3) */
112 if ((s = getenv("ERF_RECORDS_TO_CHECK")) != NULL) {
113 if ((n = atoi(s)) > 0 && n < 101) {
114 records_for_erf_check = n;
118 /* ERF is a little hard because there's no magic number */
120 for (i = 0; i < records_for_erf_check; i++) {
126 if (file_read(&header,1,sizeof(header),wth->fh) != sizeof(header)) {
127 if ((*err = file_error(wth->fh)) != 0)
133 packet_size = g_ntohs(header.rlen) - sizeof(header);
135 /* fail on invalid record type, decreasing timestamps or non-zero pad-bits */
136 if (header.type == 0 || header.type > TYPE_AAL5 ||
137 (header.flags & 0xc0) != 0) {
141 if ((ts = pletohll(&header.ts)) < prevts) {
142 /* reassembled AAL5 records may not be in time order, so allow 1 sec fudge */
143 if (header.type != TYPE_AAL5 || ((prevts-ts)>>32) > 1) {
147 memcpy(&prevts, &ts, sizeof(prevts));
149 if (common_type == 0) {
150 common_type = header.type;
152 if (common_type > 0 && common_type != header.type) {
156 if (header.type == TYPE_HDLC_POS && !is_ppp) {
158 if (file_read(&chdlc_hdr,1,sizeof(chdlc_hdr),wth->fh) != sizeof(chdlc_hdr)) {
159 *err = file_error(wth->fh);
161 packet_size -= sizeof(chdlc_hdr);
162 if (g_ntohs(chdlc_hdr) == 0xff03) {
167 if (file_seek(wth->fh, packet_size, SEEK_CUR, err) == -1) {
172 if (file_seek(wth->fh, 0L, SEEK_SET, err) == -1) { /* rewind */
176 wth->data_offset = 0;
178 /* This is an ERF file */
179 wth->file_type = WTAP_FILE_ERF;
180 wth->snapshot_length = 0; /* not available in header, only in frame */
181 wth->capture.erf = g_malloc(sizeof(erf_t));
182 wth->capture.erf->is_ppp = is_ppp;
183 if (common_type == TYPE_AAL5) {
184 wth->capture.erf->atm_encap = WTAP_ENCAP_ATM_PDUS_UNTRUNCATED;
185 wth->capture.erf->is_rawatm = FALSE;
187 wth->capture.erf->atm_encap = atm_encap;
188 wth->capture.erf->is_rawatm = is_rawatm;
192 * Really want WTAP_ENCAP_PER_PACKET here but that severely limits
193 * the number of output formats we can write to. If all the records
194 * tested in the loop above were the same encap then use that one,
195 * otherwise use WTAP_ENCAP_PER_PACKET.
199 ? WTAP_ENCAP_PER_PACKET
200 : erf_encap_to_wtap_encap(wth->capture.erf, (guint8) common_type));
202 wth->subtype_read = erf_read;
203 wth->subtype_seek_read = erf_seek_read;
204 wth->subtype_close = erf_close;
205 wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
210 /* Read the next packet */
211 static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
214 erf_header_t erf_header;
215 guint32 packet_size, bytes_read;
218 *data_offset = wth->data_offset;
220 if (!erf_read_header(
222 &wth->phdr, &wth->pseudo_header, &erf_header, wth->capture.erf,
223 err, err_info, &bytes_read, &packet_size)) {
226 wth->data_offset += bytes_read;
228 buffer_assure_space(wth->frame_buffer, packet_size+(wth->capture.erf->is_rawatm?(sizeof(atm_hdr_t)+1):0));
230 if (wth->capture.erf->is_rawatm) {
231 wtap_file_read_expected_bytes(
232 buffer_start_ptr(wth->frame_buffer), (gint32)sizeof(atm_hdr_t), wth->fh, err
234 wth->data_offset += sizeof(atm_hdr_t);
235 packet_size -= sizeof(atm_hdr_t);
236 offset += sizeof(atm_hdr_t)+1;
239 wtap_file_read_expected_bytes(
240 buffer_start_ptr(wth->frame_buffer)+offset, (gint32)packet_size, wth->fh, err
242 wth->data_offset += packet_size;
244 erf_set_pseudo_header(
245 erf_header.type, wth->capture.erf,
246 buffer_start_ptr(wth->frame_buffer), packet_size, &wth->pseudo_header
252 static gboolean erf_seek_read(wtap *wth, long seek_off,
253 union wtap_pseudo_header *pseudo_header, guchar *pd,
254 int length, int *err, gchar **err_info)
256 erf_header_t erf_header;
260 if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
263 if (!erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header,
264 wth->capture.erf, err, err_info, NULL, &packet_size))
267 if (wth->capture.erf->is_rawatm) {
268 wtap_file_read_expected_bytes(pd, (int)sizeof(atm_hdr_t), wth->random_fh, err);
269 packet_size -= sizeof(atm_hdr_t);
270 offset += sizeof(atm_hdr_t)+1;
273 wtap_file_read_expected_bytes(pd+offset, (int)packet_size, wth->random_fh, err);
275 erf_set_pseudo_header(erf_header.type, wth->capture.erf, pd, length, pseudo_header);
280 static void erf_close(wtap *wth)
282 g_free(wth->capture.erf);
285 static int erf_read_header(
287 struct wtap_pkthdr *phdr,
288 union wtap_pseudo_header *pseudo_header,
289 erf_header_t *erf_header,
294 guint32 *packet_size)
296 guint32 rec_size, skip;
298 wtap_file_read_expected_bytes(erf_header, sizeof(*erf_header), fh, err);
299 if (bytes_read != NULL) {
300 *bytes_read = sizeof(*erf_header);
303 rec_size = g_ntohs(erf_header->rlen);
304 *packet_size = rec_size - sizeof(*erf_header);
305 skip = 0; /* # bytes of payload to ignore */
307 if (*packet_size > WTAP_MAX_PACKET_SIZE) {
309 * Probably a corrupt capture file; don't blow up trying
310 * to allocate space for an immensely-large packet.
312 *err = WTAP_ERR_BAD_RECORD;
313 *err_info = g_strdup_printf("erf: File has %u-byte packet, bigger than maximum of %u",
314 *packet_size, WTAP_MAX_PACKET_SIZE);
319 guint64 ts = pletohll(&erf_header->ts);
321 phdr->ts.secs = (long) (ts >> 32);
322 ts = ((ts & 0xffffffff) * 1000 * 1000);
323 ts += (ts & 0x80000000) << 1; /* rounding */
324 phdr->ts.nsecs = ((long) (ts >> 32)) * 1000;
325 if (phdr->ts.nsecs >= 1000000000) {
326 phdr->ts.nsecs -= 1000000000;
331 switch (erf_header->type) {
336 if (erf_header->type == TYPE_AAL5) {
337 phdr->caplen = phdr->len = *packet_size - sizeof(atm_hdr_t);
339 phdr->caplen = ATM_SLEN(erf_header, NULL);
340 phdr->len = ATM_WLEN(erf_header, NULL);
344 if (erf->atm_encap == WTAP_ENCAP_ATM_PDUS || erf->atm_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED) {
345 memset(&pseudo_header->atm, 0, sizeof(pseudo_header->atm));
346 if (erf->is_rawatm) {
347 pseudo_header->atm.flags = ATM_RAW_CELL;
349 phdr->caplen += sizeof(atm_hdr_t)+1;
350 phdr->len += sizeof(atm_hdr_t)+1;
355 wtap_file_read_expected_bytes(&atm_hdr, sizeof(atm_hdr), fh, err);
356 if (bytes_read != NULL) {
357 *bytes_read += sizeof(atm_hdr);
359 *packet_size -= sizeof(atm_hdr);
361 atm_hdr = g_ntohl(atm_hdr);
363 pseudo_header->atm.vpi = ((atm_hdr & 0x0ff00000) >> 20);
364 pseudo_header->atm.vci = ((atm_hdr & 0x000ffff0) >> 4);
365 pseudo_header->atm.channel = (erf_header->flags & 0x03);
373 phdr->caplen = ETHERNET_SLEN(erf_header, erf);
374 phdr->len = ETHERNET_WLEN(erf_header, erf);
380 phdr->caplen = HDLC_SLEN(erf_header, erf);
381 phdr->len = HDLC_WLEN(erf_header, erf);
383 memset(&pseudo_header->p2p, 0, sizeof(pseudo_header->p2p));
384 pseudo_header->p2p.sent = ((erf_header->flags & 0x01) ? TRUE : FALSE);
387 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
388 *err_info = g_strdup_printf("erf: unknown record encapsulation %u",
394 phdr->pkt_encap = erf_encap_to_wtap_encap(erf, erf_header->type);
398 if (file_seek(fh, skip, SEEK_CUR, err) == -1) {
401 if (bytes_read != NULL) {
404 *packet_size -= skip;
410 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap)
412 int wtap_encap = WTAP_ENCAP_UNKNOWN;
417 wtap_encap = erf->atm_encap;
420 wtap_encap = WTAP_ENCAP_ETHERNET;
423 wtap_encap = (erf->is_ppp ? WTAP_ENCAP_PPP : WTAP_ENCAP_CHDLC);
432 static void erf_set_pseudo_header(
433 guint8 type, erf_t *erf, guchar *pd, int length, union wtap_pseudo_header *pseudo_header)
435 if (type == TYPE_ETH) {
437 * We don't know whether there's an FCS in this frame or not.
439 pseudo_header->eth.fcs_len = -1;
441 if (!erf->is_rawatm &&
442 (type == TYPE_ATM || type == TYPE_AAL5) &&
443 (erf->atm_encap == WTAP_ENCAP_ATM_PDUS ||
444 erf->atm_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED)) {
445 atm_guess_traffic_type(pd, length, pseudo_header);
447 if (type == TYPE_AAL5) {
448 pseudo_header->atm.aal = AAL_5;
449 pseudo_header->atm.type = TRAF_UNKNOWN;
450 pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;