/* snoop.c
*
- * $Id: snoop.c,v 1.61 2003/01/10 04:04:42 guy Exp $
+ * $Id$
*
* Wiretap Library
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
guint16 vci; /* VCI */
};
-static gboolean snoop_read(wtap *wth, int *err, long *data_offset);
-static gboolean snoop_seek_read(wtap *wth, long seek_off,
- union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err);
+/*
+ * Extra information stuffed into the padding in Shomiti/Finisar Surveyor
+ * captures.
+ */
+struct shomiti_trailer {
+ guint16 phy_rx_length; /* length on the wire, including FCS? */
+ guint16 phy_rx_status; /* status flags */
+ guint32 ts_40_ns_lsb; /* 40 ns time stamp, low-order bytes? */
+ guint32 ts_40_ns_msb; /* 40 ns time stamp, low-order bytes? */
+ gint32 frame_id; /* "FrameID"? */
+};
+
+/*
+ * phy_rx_status flags.
+ */
+#define RX_STATUS_OVERFLOW 0x8000 /* overflow error */
+#define RX_STATUS_BAD_CRC 0x4000 /* CRC error */
+#define RX_STATUS_DRIBBLE_NIBBLE 0x2000 /* dribble/nibble bits? */
+#define RX_STATUS_SHORT_FRAME 0x1000 /* frame < 64 bytes */
+#define RX_STATUS_OVERSIZE_FRAME 0x0800 /* frame > 1518 bytes */
+#define RX_STATUS_GOOD_FRAME 0x0400 /* frame OK */
+#define RX_STATUS_N12_BYTES_RECEIVED 0x0200 /* first 12 bytes of frame received? */
+#define RX_STATUS_RXABORT 0x0100 /* RXABORT during reception */
+#define RX_STATUS_FIFO_ERROR 0x0080 /* receive FIFO error */
+#define RX_STATUS_TRIGGERED 0x0001 /* frame did trigger */
+
+static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
+ gint64 *data_offset);
+static gboolean snoop_seek_read(wtap *wth, gint64 seek_off,
+ union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+ int *err, gchar **err_info);
static gboolean snoop_read_atm_pseudoheader(FILE_T fh,
union wtap_pseudo_header *pseudo_header, int *err);
+static gboolean snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
+ union wtap_pseudo_header *pseudo_header, int *err);
static gboolean snoop_read_rec_data(FILE_T fh, guchar *pd, int length,
int *err);
static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
* and distinguishing 4MB from 16MB Token Ring, and distinguishing both
* of them from the "Shomiti" versions of same.
*/
-int snoop_open(wtap *wth, int *err)
+int snoop_open(wtap *wth, int *err, gchar **err_info)
{
int bytes_read;
char magic[sizeof snoop_magic];
struct snoop_hdr hdr;
struct snooprec_hdr rec_hdr;
- int padbytes;
+ guint padbytes;
gboolean is_shomiti;
static const int snoop_encap[] = {
WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
WTAP_ENCAP_FDDI_BITSWAPPED,
- WTAP_ENCAP_RAW_IP, /* Other */
+ WTAP_ENCAP_NULL, /* Other */
WTAP_ENCAP_UNKNOWN, /* Frame Relay LAPF */
WTAP_ENCAP_UNKNOWN, /* Multi-protocol over Frame Relay */
WTAP_ENCAP_UNKNOWN, /* Character Async (e.g., SLIP and PPP?) */
WTAP_ENCAP_UNKNOWN, /* X.25 Classical IP */
- WTAP_ENCAP_RAW_IP, /* software loopback */
+ WTAP_ENCAP_NULL, /* software loopback */
WTAP_ENCAP_UNKNOWN, /* not defined in "dlpi.h" */
WTAP_ENCAP_IP_OVER_FC, /* Fibre Channel */
WTAP_ENCAP_UNKNOWN, /* ATM */
WTAP_ENCAP_ETHERNET, /* Gigabit Ethernet */
WTAP_ENCAP_TOKEN_RING, /* "IEEE 802.5 Shomiti" */
WTAP_ENCAP_TOKEN_RING, /* "4MB IEEE 802.5 Shomiti" */
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
};
#define NUM_SHOMITI_ENCAPS (sizeof shomiti_encap / sizeof shomiti_encap[0])
int file_encap;
break;
default:
- g_message("snoop: version %u unsupported", hdr.version);
*err = WTAP_ERR_UNSUPPORTED;
+ *err_info = g_strdup_printf("snoop: version %u unsupported", hdr.version);
return -1;
}
* hardware".
*
* The only way I can see to determine that is to check how much
- * padding there is in the first packet - if there're 3 bytes or
- * fewer, it's probably Sun snoop, which uses the padding only
- * for padding, but if there's more, it's probably a Shomiti tool,
- * which uses the padding for additional information.
+ * padding there is in the first packet - if there's enough
+ * padding for a Shomiti trailer, it's probably a Shomiti
+ * capture, and otherwise, it's probably from Snoop.
*/
+ /*
+ * Start out assuming it's not a Shomiti capture.
+ */
+ is_shomiti = FALSE;
+
/* Read first record header. */
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(&rec_hdr, 1, sizeof rec_hdr, wth->fh);
* A real-live error.
*/
return -1;
- } else {
- /*
- * The file ends after the record header,
- * which means this is a capture with no
- * packets.
- *
- * Assume it's a snoop file; the actual type
- * of file is irrelevant, as there are no
- * records in it, and thus no extra information
- * if it's a Shomiti capture, and no link-layer
- * headers whose type we have to know.
- */
- is_shomiti = FALSE;
}
+
+ /*
+ * The file ends after the record header, which means this
+ * is a capture with no packets.
+ *
+ * We assume it's a snoop file; the actual type of file is
+ * irrelevant, as there are no records in it, and thus no
+ * extra information if it's a Shomiti capture, and no
+ * link-layer headers whose type we have to know, and no
+ * Ethernet frames that might have an FCS.
+ */
} else {
/*
* Compute the number of bytes of padding in the
- * record. If it's greater than 3, this must be a
- * Shomiti capture.
+ * record. If it's at least the size of a Shomiti
+ * trailer record, we assume this is a Shomiti
+ * capture. (Some atmsnoop captures appear
+ * to have 4 bytes of padding, and at least one
+ * snoop capture appears to have 6 bytes of padding;
+ * the Shomiti header is larger than either of those.)
*/
- padbytes = g_ntohl(rec_hdr.rec_len) -
- (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
- is_shomiti = (padbytes > 3);
+ if (g_ntohl(rec_hdr.rec_len) >
+ (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len))) {
+ /*
+ * Well, we have padding; how much?
+ */
+ padbytes = g_ntohl(rec_hdr.rec_len) -
+ (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
+
+ /*
+ * Is it at least the size of a Shomiti trailer?
+ */
+ is_shomiti =
+ (padbytes >= sizeof (struct shomiti_trailer));
+ }
}
/*
if (is_shomiti) {
if (hdr.network >= NUM_SHOMITI_ENCAPS
|| shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
- g_message("snoop: Shomiti network type %u unknown or unsupported",
- hdr.network);
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
+ *err_info = g_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
+ hdr.network);
return -1;
}
file_encap = shomiti_encap[hdr.network];
} else {
if (hdr.network >= NUM_SNOOP_ENCAPS
|| snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
- g_message("snoop: network type %u unknown or unsupported",
- hdr.network);
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
+ *err_info = g_strdup_printf("snoop: network type %u unknown or unsupported",
+ hdr.network);
return -1;
}
file_encap = snoop_encap[hdr.network];
wth->subtype_seek_read = snoop_seek_read;
wth->file_encap = file_encap;
wth->snapshot_length = 0; /* not available in header */
+ wth->tsprecision = WTAP_FILE_TSPREC_USEC;
return 1;
}
+typedef struct {
+ guint8 pad[4];
+ guint8 undecrypt[2];
+ guint8 rate;
+ guint8 preamble;
+ guint8 code;
+ guint8 signal;
+ guint8 qual;
+ guint8 channel;
+} shomiti_wireless_header;
+
+
/* Read the next packet */
-static gboolean snoop_read(wtap *wth, int *err, long *data_offset)
+static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
+ gint64 *data_offset)
{
guint32 rec_size;
guint32 packet_size;
int bytes_read;
struct snooprec_hdr hdr;
char padbuf[4];
- int padbytes;
+ guint padbytes;
int bytes_to_read;
/* Read record header. */
* Probably a corrupt capture file; don't blow up trying
* to allocate space for an immensely-large packet.
*/
- g_message("snoop: File has %u-byte packet, bigger than maximum of %u",
+ *err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
+ return FALSE;
+ }
+ if (packet_size > rec_size) {
+ /*
+ * Probably a corrupt capture file.
+ */
*err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than record size %u",
+ packet_size, rec_size);
return FALSE;
}
* the VCI; read them and generate the pseudo-header from
* them.
*/
- if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+ switch (wth->file_encap) {
+
+ case WTAP_ENCAP_ATM_PDUS:
if (packet_size < sizeof (struct snoop_atm_hdr)) {
/*
* Uh-oh, the packet isn't big enough to even
* have a pseudo-header.
*/
- g_message("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
- packet_size);
*err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+ packet_size);
return FALSE;
}
if (!snoop_read_atm_pseudoheader(wth->fh, &wth->pseudo_header,
orig_size -= sizeof (struct snoop_atm_hdr);
packet_size -= sizeof (struct snoop_atm_hdr);
wth->data_offset += sizeof (struct snoop_atm_hdr);
+ break;
+
+ case WTAP_ENCAP_ETHERNET:
+ /*
+ * If this is a snoop file, we assume there's no FCS in
+ * this frame; if this is a Shomit file, we assume there
+ * is. (XXX - or should we treat it a "maybe"?)
+ */
+ if (wth->file_type == WTAP_FILE_SHOMITI)
+ wth->pseudo_header.eth.fcs_len = 4;
+ else
+ wth->pseudo_header.eth.fcs_len = 0;
+ break;
+
+ case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+ if (packet_size < sizeof (shomiti_wireless_header)) {
+ /*
+ * Uh-oh, the packet isn't big enough to even
+ * have a pseudo-header.
+ */
+ *err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: Shomiti wireless file has a %u-byte packet, too small to have even a wireless pseudo-header\n",
+ packet_size);
+ return FALSE;
+ }
+ if (!snoop_read_shomiti_wireless_pseudoheader(wth->fh,
+ &wth->pseudo_header, err))
+ return FALSE; /* Read error */
+
+ /*
+ * Don't count the pseudo-header as part of the packet.
+ */
+ rec_size -= sizeof (shomiti_wireless_header);
+ orig_size -= sizeof (shomiti_wireless_header);
+ packet_size -= sizeof (shomiti_wireless_header);
+ wth->data_offset += sizeof (shomiti_wireless_header);
+ break;
}
buffer_assure_space(wth->frame_buffer, packet_size);
return FALSE; /* Read error */
wth->data_offset += packet_size;
- wth->phdr.ts.tv_sec = g_ntohl(hdr.ts_sec);
- wth->phdr.ts.tv_usec = g_ntohl(hdr.ts_usec);
+ wth->phdr.ts.secs = g_ntohl(hdr.ts_sec);
+ wth->phdr.ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
wth->phdr.caplen = packet_size;
wth->phdr.len = orig_size;
- wth->phdr.pkt_encap = wth->file_encap;
/*
* If this is ATM LANE traffic, try to guess what type of LANE
* There's probably not much padding (it's probably padded only
* to a 4-byte boundary), so we probably need only do one read.
*/
+ if (rec_size < (sizeof hdr + packet_size)) {
+ /*
+ * What, *negative* padding? Bogus.
+ */
+ *err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: File has %u-byte record with packet size of %u",
+ rec_size, packet_size);
+ return FALSE;
+ }
padbytes = rec_size - (sizeof hdr + packet_size);
while (padbytes != 0) {
bytes_to_read = padbytes;
}
static gboolean
-snoop_seek_read(wtap *wth, long seek_off,
- union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err)
+snoop_seek_read(wtap *wth, gint64 seek_off,
+ union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+ int *err, gchar **err_info _U_)
{
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
- if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+ switch (wth->file_encap) {
+
+ case WTAP_ENCAP_ATM_PDUS:
if (!snoop_read_atm_pseudoheader(wth->random_fh, pseudo_header,
err)) {
/* Read error */
return FALSE;
}
+ break;
+
+ case WTAP_ENCAP_ETHERNET:
+ /*
+ * If this is a snoop file, we assume there's no FCS in
+ * this frame; if this is a Shomit file, we assume there
+ * is. (XXX - or should we treat it a "maybe"?)
+ */
+ if (wth->file_type == WTAP_FILE_SHOMITI)
+ pseudo_header->eth.fcs_len = 4;
+ else
+ pseudo_header->eth.fcs_len = 0;
+ break;
+
+ case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+ if (!snoop_read_shomiti_wireless_pseudoheader(wth->random_fh,
+ pseudo_header, err)) {
+ /* Read error */
+ return FALSE;
+ }
+ break;
}
/*
return TRUE;
}
+static gboolean
+snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
+ union wtap_pseudo_header *pseudo_header, int *err)
+{
+ shomiti_wireless_header whdr;
+ int bytes_read;
+
+ errno = WTAP_ERR_CANT_READ;
+ bytes_read = file_read(&whdr, 1, sizeof (shomiti_wireless_header), fh);
+ if (bytes_read != sizeof (shomiti_wireless_header)) {
+ *err = file_error(fh);
+ if (*err == 0)
+ *err = WTAP_ERR_SHORT_READ;
+ return FALSE;
+ }
+
+ pseudo_header->ieee_802_11.fcs_len = 4;
+ pseudo_header->ieee_802_11.channel = whdr.channel;
+ pseudo_header->ieee_802_11.data_rate = whdr.rate;
+ pseudo_header->ieee_802_11.signal_level = whdr.signal;
+
+ return TRUE;
+}
+
static gboolean
snoop_read_rec_data(FILE_T fh, guchar *pd, int length, int *err)
{
rec_hdr.incl_len = g_htonl(phdr->caplen + atm_hdrsize);
rec_hdr.rec_len = g_htonl(reclen);
rec_hdr.cum_drops = 0;
- rec_hdr.ts_sec = g_htonl(phdr->ts.tv_sec);
- rec_hdr.ts_usec = g_htonl(phdr->ts.tv_usec);
+ rec_hdr.ts_sec = g_htonl(phdr->ts.secs);
+ rec_hdr.ts_usec = g_htonl(phdr->ts.nsecs / 1000);
nwritten = fwrite(&rec_hdr, 1, sizeof rec_hdr, wdh->fh);
if (nwritten != sizeof rec_hdr) {
if (nwritten == 0 && ferror(wdh->fh))
}
break;
}
- atm_hdr.vpi = pseudo_header->atm.vpi;
+ atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;
atm_hdr.vci = g_htons(pseudo_header->atm.vci);
nwritten = fwrite(&atm_hdr, 1, sizeof atm_hdr, wdh->fh);
if (nwritten != sizeof atm_hdr) {
git.samba.org / metze / wireshark / wip.git / blobdiff