wiretap/pppdump.c

   1 /* pppdump.c
   2  *
   3  * $Id: pppdump.c,v 1.19 2002/06/07 07:27:35 guy Exp $
   4  *
   5  * Copyright (c) 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include "config.h"
  24 #endif
  25 #include "wtap-int.h"
  26 #include "buffer.h"
  27 #include "pppdump.h"
  28 #include "file_wrappers.h"
  29
  30 #include <glib.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <errno.h>
  34 #include <string.h>
  35
  36 /*
  37 pppdump records
  38 Daniel Thompson (STMicroelectronics) <daniel.thompson@st.com>
  39
  40 +------+
  41 | 0x07 +------+------+------+         Reset time
  42 |  t3  |  t2  |  t1  |  t0  |         t = time_t
  43 +------+------+------+------+
  44
  45 +------+
  46 | 0x06 |                              Time step (short)
  47 |  ts  |                              ts = time step (tenths)
  48 +------+
  49
  50 +------+
  51 | 0x05 +------+------+------+         Time step (long)
  52 | ts3  | ts2  | ts1  | ts0  |         ts = time step (tenths)
  53 +------+------+------+------+
  54
  55 +------+
  56 | 0x04 |                              Receive deliminator (not seen in practice)
  57 +------+
  58
  59 +------+
  60 | 0x03 |                              Send deliminator (not seen in practice)
  61 +------+
  62
  63 +------+
  64 | 0x02 +------+                       Received data
  65 |  n1  |  n0  |                       n = number of bytes following
  66 |    data     |
  67 |             |
  68
  69 +------+
  70 | 0x01 +------+                       Sent data
  71 |  n1  |  n0  |                       n = number of bytes following
  72 |    data     |
  73 |             |
  74 */
  75
  76 #define PPPD_SENT_DATA          0x01
  77 #define PPPD_RECV_DATA          0x02
  78 #define PPPD_SEND_DELIM         0x03
  79 #define PPPD_RECV_DELIM         0x04
  80 #define PPPD_TIME_STEP_LONG     0x05
  81 #define PPPD_TIME_STEP_SHORT    0x06
  82 #define PPPD_RESET_TIME         0x07
  83
  84 #define PPPD_NULL               0x00    /* For my own use */
  85
  86 /* this buffer must be at least (2*PPPD_MTU) + sizeof(ppp_header) + sizeof(lcp_header) +
  87  * sizeof(ipcp_header). PPPD_MTU is *very* rarely larger than 1500 so this value is fine
  88  */
  89 #define PPPD_BUF_SIZE           8192
  90
  91 typedef enum {
  92         DIRECTION_SENT,
  93         DIRECTION_RECV
  94 } direction_enum;
  95
  96 static gboolean pppdump_read(wtap *wth, int *err, long *data_offset);
  97 static gboolean pppdump_seek_read(wtap *wth, long seek_off,
  98         union wtap_pseudo_header *pseudo_header, guint8 *pd, int len, int *err);
  99
 100 typedef struct {
 101         long            offset;
 102         int             num_saved_states;
 103         direction_enum  dir;
 104 } pkt_id;
 105
 106 typedef struct {
 107         direction_enum  dir;
 108         int             cnt;
 109         gboolean        esc;
 110         guint8          buf[PPPD_BUF_SIZE];
 111         long            id_offset;
 112 } pkt_t;
 113
 114 /* Partial-record state */
 115 typedef struct {
 116         int             num_bytes;
 117         pkt_t           *pkt;
 118 } prec_state;
 119
 120 struct _pppdump_t;
 121
 122 typedef struct _pppdump_t {
 123         time_t                  timestamp;
 124         guint                   tenths;
 125         pkt_t                   spkt;
 126         pkt_t                   rpkt;
 127         long                    offset;
 128         GList                   *precs;
 129         struct _pppdump_t       *seek_state;
 130         GPtrArray               *pids;
 131         guint                   pkt_cnt;
 132         int                     num_saved_states;
 133 } pppdump_t;
 134
 135 static int
 136 process_data(pppdump_t *state, FILE_T fh, pkt_t *pkt, int n, guint8 *pd, int *err,
 137                 gboolean *state_saved);
 138
 139 static gboolean
 140 collate(pppdump_t*, FILE_T fh, int *err, guint8 *pd, int *num_bytes,
 141                 direction_enum *direction, pkt_id *pid);
 142
 143 static void
 144 pppdump_close(wtap *wth);
 145
 146 static void
 147 init_state(pppdump_t *state)
 148 {
 149
 150         state->precs = NULL;
 151
 152         state->spkt.dir = DIRECTION_SENT;
 153         state->spkt.cnt = 0;
 154         state->spkt.esc = FALSE;
 155         state->spkt.id_offset = 0;
 156
 157         state->rpkt.dir = DIRECTION_RECV;
 158         state->rpkt.cnt = 0;
 159         state->rpkt.esc = FALSE;
 160         state->rpkt.id_offset = 0;
 161
 162         state->seek_state = NULL;
 163         state->offset = 0x100000; /* to detect errors during development */
 164 }
 165
 166
 167 int
 168 pppdump_open(wtap *wth, int *err)
 169 {
 170         guint8          buffer[6];      /* Looking for: 0x07 t3 t2 t1 t0 ID */
 171         pppdump_t       *state;
 172
 173         /* There is no file header, only packet records. Fortunately for us,
 174         * timestamp records are separated from packet records, so we should
 175         * find an "initial time stamp" (i.e., a "reset time" record, or
 176         * record type 0x07) at the beginning of the file. We'll check for
 177         * that, plus a valid record following the 0x07 and the four bytes
 178         * representing the timestamp.
 179         */
 180
 181         wtap_file_read_unknown_bytes(buffer, sizeof(buffer), wth->fh, err);
 182
 183         if (buffer[0] == PPPD_RESET_TIME &&
 184                         (buffer[5] == PPPD_SENT_DATA ||
 185                          buffer[5] == PPPD_RECV_DATA ||
 186                          buffer[5] == PPPD_TIME_STEP_LONG ||
 187                          buffer[5] == PPPD_TIME_STEP_SHORT ||
 188                          buffer[5] == PPPD_RESET_TIME)) {
 189
 190                 goto my_file_type;
 191         }
 192         else {
 193                 return 0;
 194         }
 195
 196   my_file_type:
 197
 198         if (file_seek(wth->fh, 5, SEEK_SET, err) == -1)
 199                 return -1;
 200
 201         state = wth->capture.generic = g_malloc(sizeof(pppdump_t));
 202         state->timestamp = pntohl(&buffer[1]);
 203         state->tenths = 0;
 204
 205         init_state(state);
 206
 207         state->offset = 5;
 208         wth->file_encap = WTAP_ENCAP_PPP_WITH_PHDR;
 209         wth->file_type = WTAP_FILE_PPPDUMP;
 210
 211         wth->snapshot_length = PPPD_BUF_SIZE; /* just guessing */
 212         wth->subtype_read = pppdump_read;
 213         wth->subtype_seek_read = pppdump_seek_read;
 214         wth->subtype_close = pppdump_close;
 215
 216         state->seek_state = g_malloc(sizeof(pppdump_t));
 217
 218         state->pids = g_ptr_array_new();
 219         state->pkt_cnt = 0;
 220         state->num_saved_states = 0;
 221
 222         return 1;
 223 }
 224
 225 /* Find the next packet and parse it; called from wtap_loop(). */
 226 static gboolean
 227 pppdump_read(wtap *wth, int *err, long *data_offset)
 228 {
 229         gboolean        retval;
 230         int             num_bytes;
 231         direction_enum  direction;
 232         guint8          *buf;
 233         pppdump_t       *state;
 234         pkt_id          *pid;
 235
 236         buffer_assure_space(wth->frame_buffer, PPPD_BUF_SIZE);
 237         buf = buffer_start_ptr(wth->frame_buffer);
 238
 239         state = wth->capture.generic;
 240         pid = g_new(pkt_id, 1);
 241         if (!pid) {
 242                 *err = errno;   /* assume a malloc failed and set "errno" */
 243                 return FALSE;
 244         }
 245         pid->offset = 0;
 246         pid->num_saved_states = 0;
 247
 248         retval = collate(state, wth->fh, err, buf, &num_bytes, &direction, pid);
 249
 250         if (!retval) {
 251                 g_free(pid);
 252                 return FALSE;
 253         }
 254
 255         pid->dir = direction;
 256
 257         g_ptr_array_add(state->pids, pid);
 258         /* The user's data_offset is not really an offset, but a packet number. */
 259         *data_offset = state->pkt_cnt;
 260         state->pkt_cnt++;
 261
 262         wth->phdr.len           = num_bytes;
 263         wth->phdr.caplen        = num_bytes;
 264         wth->phdr.ts.tv_sec     = state->timestamp;
 265         wth->phdr.ts.tv_usec    = state->tenths * 100000;
 266         wth->phdr.pkt_encap     = WTAP_ENCAP_PPP_WITH_PHDR;
 267
 268         wth->pseudo_header.p2p.sent = (direction == DIRECTION_SENT ? TRUE : FALSE);
 269
 270         return TRUE;
 271 }
 272
 273 #define PKT(x)  (x)->dir == DIRECTION_SENT ? "SENT" : "RECV"
 274
 275 static gboolean
 276 save_prec_state(pppdump_t *state, int num_bytes, pkt_t *pkt)
 277 {
 278         prec_state      *prec;
 279
 280         prec = g_new(prec_state, 1);
 281         if (!prec) {
 282                 return FALSE;
 283         }
 284         prec->num_bytes = num_bytes;
 285         prec->pkt = pkt;
 286
 287         state->precs = g_list_append(state->precs, prec);
 288         return TRUE;
 289 }
 290
 291 static int
 292 process_data_from_prec_state(pppdump_t *state, FILE_T fh, guint8* pd, int *err,
 293                 gboolean *state_saved, pkt_t **ppkt)
 294 {
 295         prec_state      *prec;
 296
 297         prec = state->precs->data;
 298
 299         state->precs = g_list_remove(state->precs, prec);
 300
 301         *ppkt = prec->pkt;
 302
 303         return process_data(state, fh, prec->pkt, prec->num_bytes, pd, err, state_saved);
 304 }
 305
 306
 307
 308 /* Returns number of bytes copied for record, -1 if failure.
 309  *
 310  * This is modeled after pppdump.c, the utility to parse pppd log files; it comes with the ppp
 311  * distribution.
 312  */
 313 static int
 314 process_data(pppdump_t *state, FILE_T fh, pkt_t *pkt, int n, guint8 *pd, int *err,
 315                 gboolean *state_saved)
 316 {
 317         int     c;
 318         int     num_bytes = n;
 319         int     num_written;
 320
 321         *state_saved = FALSE;
 322         for (; num_bytes > 0; --num_bytes) {
 323                 c = file_getc(fh);
 324                 state->offset++;
 325                 switch (c) {
 326                         case EOF:
 327                                 if (*err == 0) {
 328                                         *err = WTAP_ERR_SHORT_READ;
 329                                 }
 330                                 return -1;
 331                                 break;
 332
 333                         case '~':
 334                                 if (pkt->cnt > 0) {
 335                                         pkt->esc = FALSE;
 336
 337                                         num_written = pkt->cnt;
 338                                         pkt->cnt = 0;
 339                                         if (num_written <= 0) {
 340                                                 return 0;
 341                                         }
 342
 343                                         if (num_written > PPPD_BUF_SIZE) {
 344                                                 *err = WTAP_ERR_UNC_OVERFLOW;
 345                                                 return -1;
 346                                         }
 347
 348                                         memcpy(pd, pkt->buf, num_written);
 349
 350                                         num_bytes--;
 351                                         if (num_bytes > 0) {
 352                                                 if (!save_prec_state(state, num_bytes, pkt)) {
 353                                                         *err = errno;
 354                                                         return -1;
 355                                                 }
 356                                                 *state_saved = TRUE;
 357                                         }
 358                                         return num_written;
 359                                 }
 360                                 break;
 361
 362                         case '}':
 363                                 if (!pkt->esc) {
 364                                         pkt->esc = TRUE;
 365                                         break;
 366                                 }
 367                                 /* else fall through */
 368
 369                         default:
 370                                 if (pkt->esc) {
 371                                         c ^= 0x20;
 372                                         pkt->esc = FALSE;
 373                                 }
 374
 375                                 pkt->buf[pkt->cnt++] = c;
 376                                 if (pkt->cnt > PPPD_BUF_SIZE) {
 377                                         *err = WTAP_ERR_UNC_OVERFLOW;
 378                                         return -1;
 379                                 }
 380                                 break;
 381                 }
 382         }
 383
 384         /* we could have run out of bytes to read */
 385         return 0;
 386
 387 }
 388
 389
 390
 391
 392 /* Returns TRUE if packet data copied, FALSE if error occurred or EOF (no more records). */
 393 static gboolean
 394 collate(pppdump_t* state, FILE_T fh, int *err, guint8 *pd, int *num_bytes,
 395                 direction_enum *direction, pkt_id *pid)
 396 {
 397         int             id;
 398         pkt_t           *pkt = NULL;
 399         int             n, num_written = 0;
 400         gboolean        ss = FALSE;
 401         guint32         time_long;
 402         guint8          time_short;
 403
 404         if (!state->precs) {
 405                 state->num_saved_states = 0;
 406         }
 407         if (pid) {
 408                 pid->num_saved_states = state->num_saved_states;
 409         }
 410
 411
 412         while (state->precs) {
 413                 num_written = process_data_from_prec_state(state, fh, pd, err, &ss, &pkt);
 414                 state->num_saved_states++;
 415                 if (pid) {
 416                         pid->num_saved_states++;
 417                 }
 418
 419                 if (num_written < 0) {
 420                         return FALSE;
 421                 }
 422                 else if (num_written > 0) {
 423                         *num_bytes = num_written;
 424                         *direction = pkt->dir;
 425                         if (pid) {
 426                                 pid->offset = pkt->id_offset;
 427                         }
 428                         if (!ss) {
 429                                 pkt->id_offset = 0;
 430                         }
 431                         return TRUE;
 432                 }
 433                 /* if 0 bytes written, keep processing */
 434         }
 435
 436         while ((id = file_getc(fh)) != EOF) {
 437                 state->offset++;
 438                 switch (id) {
 439                         case PPPD_SENT_DATA:
 440                         case PPPD_RECV_DATA:
 441                                 pkt = id == PPPD_SENT_DATA ? &state->spkt : &state->rpkt;
 442
 443                                 if (pkt->id_offset == 0) {
 444                                         pkt->id_offset = state->offset - 1;
 445                                 }
 446
 447                                 n = file_getc(fh);
 448                                 n = (n << 8) + file_getc(fh);
 449                                 state->offset += 2;
 450
 451                                 num_written = process_data(state, fh, pkt, n, pd, err, &ss);
 452
 453                                 if (num_written < 0) {
 454                                         return FALSE;
 455                                 }
 456                                 else if (num_written > 0) {
 457                                         *num_bytes = num_written;
 458                                         *direction = pkt->dir;
 459                                         if (pid) {
 460                                                 pid->offset = pkt->id_offset;
 461                                         }
 462                                         if (!ss) {
 463                                                 pkt->id_offset = 0;
 464                                         }
 465                                         return TRUE;
 466                                 }
 467                                 /* if 0 bytes written, keep looping */
 468
 469                                 break;
 470
 471                         case PPPD_SEND_DELIM:
 472                         case PPPD_RECV_DELIM:
 473                                 /* What can we do? */
 474                                 break;
 475
 476                         case PPPD_RESET_TIME:
 477                                 wtap_file_read_unknown_bytes(&time_long, sizeof(guint32), fh, err);
 478                                 state->offset += sizeof(guint32);
 479                                 state->timestamp = pntohl(&time_long);
 480                                 state->tenths = 0;
 481                                 break;
 482
 483                         case PPPD_TIME_STEP_LONG:
 484                                 wtap_file_read_unknown_bytes(&time_long, sizeof(guint32), fh, err);
 485                                 state->offset += sizeof(guint32);
 486                                 state->tenths += pntohl(&time_long);
 487
 488                                 if (state->tenths >= 10) {
 489                                         state->timestamp += state->tenths / 10;
 490                                         state->tenths = state->tenths % 10;
 491                                 }
 492
 493                                 break;
 494
 495                         case PPPD_TIME_STEP_SHORT:
 496                                 wtap_file_read_unknown_bytes(&time_short, sizeof(guint8), fh, err);
 497                                 state->offset += sizeof(guint8);
 498                                 state->tenths += time_short;
 499
 500                                 if (state->tenths >= 10) {
 501                                         state->timestamp += state->tenths / 10;
 502                                         state->tenths = state->tenths % 10;
 503                                 }
 504
 505                                 break;
 506
 507                         default:
 508                                 /* XXX - bad file */
 509                                 g_message("pppdump: bad ID byte 0x%02x", id);
 510                                 *err = WTAP_ERR_BAD_RECORD;
 511                                 return FALSE;
 512                 }
 513
 514         }
 515
 516         *err = file_error(fh);
 517         return FALSE;
 518 }
 519
 520
 521
 522 /* Used to read packets in random-access fashion */
 523 static gboolean
 524 pppdump_seek_read (wtap *wth,
 525                  long seek_off,
 526                  union wtap_pseudo_header *pseudo_header,
 527                  guint8 *pd,
 528                  int len,
 529                  int *err)
 530 {
 531         int             num_bytes;
 532         direction_enum  direction;
 533         gboolean        retval;
 534         pppdump_t       *state;
 535         pkt_id          *pid;
 536         int             i;
 537
 538
 539         state = wth->capture.generic;
 540
 541         pid = g_ptr_array_index(state->pids, seek_off);
 542         if (!pid) {
 543                 *err = WTAP_ERR_BAD_RECORD;     /* XXX - better error? */
 544                 return FALSE;
 545         }
 546
 547         if (file_seek(wth->random_fh, pid->offset, SEEK_SET, err) == -1)
 548                 return FALSE;
 549
 550         init_state(state->seek_state);
 551
 552         for (i = 0 ; i <= pid->num_saved_states; i++) {
 553           again:
 554                 retval = collate(state->seek_state, wth->random_fh, err, pd, &num_bytes,
 555                                 &direction, NULL);
 556
 557                 if (!retval) {
 558                         return FALSE;
 559                 }
 560
 561                 if (direction != pid->dir) {
 562                         goto again;
 563                 }
 564         }
 565
 566         if (len != num_bytes) {
 567                 *err = WTAP_ERR_BAD_RECORD;     /* XXX - better error? */
 568                 return FALSE;
 569         }
 570
 571         pseudo_header->p2p.sent = (pid->dir == DIRECTION_SENT ? TRUE : FALSE);
 572
 573         return TRUE;
 574 }
 575
 576 static void
 577 simple_g_free(gpointer data, gpointer dummy _U_)
 578 {
 579         if (data)
 580                 g_free(data);
 581 }
 582
 583 static void
 584 pppdump_close(wtap *wth)
 585 {
 586         pppdump_t       *state;
 587
 588         state = wth->capture.generic;
 589
 590         if (state->precs) {
 591                 g_list_foreach(state->precs, simple_g_free, NULL);
 592                 g_list_free(state->precs);
 593         }
 594
 595         if (state->seek_state) { /* should always be TRUE */
 596                 g_free(state->seek_state);
 597         }
 598
 599         if (state->pids) { /* should always be TRUE */
 600                 unsigned int i;
 601                 for (i = 0; i < g_ptr_array_len(state->pids); i++) {
 602                         g_free(g_ptr_array_index(state->pids, i));
 603                 }
 604                 g_ptr_array_free(state->pids, TRUE);
 605         }
 606
 607         g_free(state);
 608
 609 }