wiretap/commview.c

   1 /* commview.c
   2  * Routines for opening CommView file format packet captures
   3  * Copyright 2007, Stephen Fisher (see AUTHORS file)
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * Based on csids.c and nettl.c
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  24  * USA.
  25  */
  26
  27 /* A brief description of this file format is available at:
  28  *    http://www.tamos.com/htmlhelp/commview/logformat.htm
  29  */
  30
  31 #include "config.h"
  32
  33 #include <glib.h>
  34 #include <stdio.h>
  35 #include <stdlib.h>
  36 #include <errno.h>
  37 #include <string.h>
  38
  39 #include "wtap.h"
  40 #include "wtap-int.h"
  41 #include "buffer.h"
  42 #include "file_wrappers.h"
  43 #include "commview.h"
  44
  45 typedef struct commview_header {
  46         guint16         data_len;
  47         guint16         source_data_len;
  48         guint8          version;
  49         guint16         year;
  50         guint8          month;
  51         guint8          day;
  52         guint8          hours;
  53         guint8          minutes;
  54         guint8          seconds;
  55         guint32         usecs;
  56         guint8          flags;          /* Bit-field positions defined below */
  57         guint8          signal_level_percent;
  58         guint8          rate;
  59         guint8          band;
  60         guint8          channel;
  61         guint8          direction;      /* Or for WiFi, high order byte of
  62                                          * packet rate. */
  63         guint8          signal_level_dbm;
  64         guint8          noise_level;    /* In dBm (WiFi only) */
  65 } commview_header_t;
  66
  67 #define COMMVIEW_HEADER_SIZE 24
  68
  69 /* Bit-field positions for various fields in the flags variable of the header */
  70 #define FLAGS_MEDIUM            0x0F
  71 #define FLAGS_DECRYPTED         0x10
  72 #define FLAGS_BROKEN            0x20
  73 #define FLAGS_COMPRESSED        0x40
  74 #define FLAGS_RESERVED          0x80
  75
  76 /* Capture mediums as defined by the commview file format */
  77 #define MEDIUM_ETHERNET         0
  78 #define MEDIUM_WIFI             1
  79 #define MEDIUM_TOKEN_RING       2
  80
  81 static gboolean commview_read(wtap *wth, int *err, gchar **err_info,
  82                               gint64 *data_offset);
  83 static gboolean commview_seek_read(wtap *wth, gint64 seek_off,
  84                                    struct wtap_pkthdr *phdr,
  85                                    Buffer *buf, int *err, gchar **err_info);
  86 static gboolean commview_read_header(commview_header_t *cv_hdr, FILE_T fh,
  87                                      int *err, gchar **err_info);
  88 static gboolean commview_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
  89                               const guint8 *pd, int *err);
  90
  91 int commview_open(wtap *wth, int *err, gchar **err_info)
  92 {
  93         commview_header_t cv_hdr;
  94
  95         if(!commview_read_header(&cv_hdr, wth->fh, err, err_info)) {
  96                 if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
  97                         return -1;
  98                 return 0;
  99         }
 100
 101         /* If any of these fields do not match what we expect, bail out. */
 102         if(cv_hdr.version != 0 ||
 103            cv_hdr.year < 1970 || cv_hdr.year >= 2038 ||
 104            cv_hdr.month < 1 || cv_hdr.month > 12 ||
 105            cv_hdr.day < 1 || cv_hdr.day > 31 ||
 106            cv_hdr.hours > 23 ||
 107            cv_hdr.minutes > 59 ||
 108            cv_hdr.seconds > 60 ||
 109            cv_hdr.signal_level_percent > 100 ||
 110            (cv_hdr.flags & FLAGS_RESERVED) != 0 ||
 111            ((cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_ETHERNET &&
 112             (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_WIFI &&
 113             (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_TOKEN_RING))
 114                 return 0; /* Not our kind of file */
 115
 116         /* No file header. Reset the fh to 0 so we can read the first packet */
 117         if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
 118                 return -1;
 119
 120         /* Set up the pointers to the handlers for this file type */
 121         wth->subtype_read = commview_read;
 122         wth->subtype_seek_read = commview_seek_read;
 123
 124         wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_COMMVIEW;
 125         wth->file_encap = WTAP_ENCAP_PER_PACKET;
 126         wth->tsprecision = WTAP_FILE_TSPREC_USEC;
 127
 128         return 1; /* Our kind of file */
 129 }
 130
 131 static int
 132 commview_read_packet(FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf,
 133     int *err, gchar **err_info)
 134 {
 135         commview_header_t cv_hdr;
 136         struct tm tm;
 137
 138         if(!commview_read_header(&cv_hdr, fh, err, err_info))
 139                 return FALSE;
 140
 141         switch(cv_hdr.flags & FLAGS_MEDIUM) {
 142
 143         case MEDIUM_ETHERNET :
 144                 phdr->pkt_encap = WTAP_ENCAP_ETHERNET;
 145                 phdr->pseudo_header.eth.fcs_len = -1; /* Unknown */
 146                 break;
 147
 148         case MEDIUM_WIFI :
 149                 phdr->pkt_encap = WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
 150                 phdr->pseudo_header.ieee_802_11.fcs_len = -1; /* Unknown */
 151                 phdr->pseudo_header.ieee_802_11.channel = cv_hdr.channel;
 152                 phdr->pseudo_header.ieee_802_11.data_rate =
 153                     cv_hdr.rate | (cv_hdr.direction << 8);
 154                 phdr->pseudo_header.ieee_802_11.signal_level = cv_hdr.signal_level_percent;
 155                 break;
 156
 157         case MEDIUM_TOKEN_RING :
 158                 phdr->pkt_encap = WTAP_ENCAP_TOKEN_RING;
 159                 break;
 160
 161         default :
 162                 *err = WTAP_ERR_BAD_FILE;
 163                 *err_info = g_strdup_printf("commview: unsupported encap: %u",
 164                                             cv_hdr.flags & FLAGS_MEDIUM);
 165                 return FALSE;
 166         }
 167
 168         tm.tm_year = cv_hdr.year - 1900;
 169         tm.tm_mon = cv_hdr.month - 1;
 170         tm.tm_mday = cv_hdr.day;
 171         tm.tm_hour = cv_hdr.hours;
 172         tm.tm_min = cv_hdr.minutes;
 173         tm.tm_sec = cv_hdr.seconds;
 174         tm.tm_isdst = -1;
 175
 176         phdr->presence_flags = WTAP_HAS_TS;
 177
 178         phdr->len = cv_hdr.data_len;
 179         phdr->caplen = cv_hdr.data_len;
 180
 181         phdr->ts.secs = mktime(&tm);
 182         phdr->ts.nsecs = cv_hdr.usecs * 1000;
 183
 184         return wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info);
 185 }
 186
 187 static gboolean
 188 commview_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 189 {
 190         *data_offset = file_tell(wth->fh);
 191
 192         return commview_read_packet(wth->fh, &wth->phdr, wth->frame_buffer, err,
 193             err_info);
 194 }
 195
 196 static gboolean
 197 commview_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr,
 198                    Buffer *buf, int *err, gchar **err_info)
 199 {
 200         if(file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 201                 return FALSE;
 202
 203         return commview_read_packet(wth->random_fh, phdr, buf, err, err_info);
 204 }
 205
 206 static gboolean
 207 commview_read_header(commview_header_t *cv_hdr, FILE_T fh, int *err,
 208     gchar **err_info)
 209 {
 210         wtap_file_read_expected_bytes(&cv_hdr->data_len, 2, fh, err, err_info);
 211         wtap_file_read_expected_bytes(&cv_hdr->source_data_len, 2, fh, err, err_info);
 212         wtap_file_read_expected_bytes(&cv_hdr->version, 1, fh, err, err_info);
 213         wtap_file_read_expected_bytes(&cv_hdr->year, 2, fh, err, err_info);
 214         wtap_file_read_expected_bytes(&cv_hdr->month, 1, fh, err, err_info);
 215         wtap_file_read_expected_bytes(&cv_hdr->day, 1, fh, err, err_info);
 216         wtap_file_read_expected_bytes(&cv_hdr->hours, 1, fh, err, err_info);
 217         wtap_file_read_expected_bytes(&cv_hdr->minutes, 1, fh, err, err_info);
 218         wtap_file_read_expected_bytes(&cv_hdr->seconds, 1, fh, err, err_info);
 219         wtap_file_read_expected_bytes(&cv_hdr->usecs, 4, fh, err, err_info);
 220         wtap_file_read_expected_bytes(&cv_hdr->flags, 1, fh, err, err_info);
 221         wtap_file_read_expected_bytes(&cv_hdr->signal_level_percent, 1, fh, err, err_info);
 222         wtap_file_read_expected_bytes(&cv_hdr->rate, 1, fh, err, err_info);
 223         wtap_file_read_expected_bytes(&cv_hdr->band, 1, fh, err, err_info);
 224         wtap_file_read_expected_bytes(&cv_hdr->channel, 1, fh, err, err_info);
 225         wtap_file_read_expected_bytes(&cv_hdr->direction, 1, fh, err, err_info);
 226         wtap_file_read_expected_bytes(&cv_hdr->signal_level_dbm, 1, fh, err, err_info);
 227         wtap_file_read_expected_bytes(&cv_hdr->noise_level, 1, fh, err, err_info);
 228
 229         /* Convert multi-byte values from little endian to host endian format */
 230         cv_hdr->data_len = GUINT16_FROM_LE(cv_hdr->data_len);
 231         cv_hdr->source_data_len = GUINT16_FROM_LE(cv_hdr->source_data_len);
 232         cv_hdr->year = GUINT16_FROM_LE(cv_hdr->year);
 233         cv_hdr->usecs = GUINT32_FROM_LE(cv_hdr->usecs);
 234
 235         return TRUE;
 236 }
 237
 238 /* Returns 0 if we can write out the specified encapsulation type
 239  * into a CommView format file. */
 240 int commview_dump_can_write_encap(int encap)
 241 {
 242         switch (encap) {
 243
 244         case WTAP_ENCAP_ETHERNET :
 245         case WTAP_ENCAP_IEEE_802_11 :
 246         case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
 247         case WTAP_ENCAP_TOKEN_RING :
 248         case WTAP_ENCAP_PER_PACKET :
 249                 return 0;
 250
 251         default:
 252                 return WTAP_ERR_UNSUPPORTED_ENCAP;
 253         }
 254 }
 255
 256 /* Returns TRUE on success, FALSE on failure;
 257    sets "*err" to an error code on failure */
 258 gboolean commview_dump_open(wtap_dumper *wdh, int *err _U_)
 259 {
 260         wdh->subtype_write = commview_dump;
 261         wdh->subtype_close = NULL;
 262
 263         /* There is no file header to write out */
 264         wdh->bytes_dumped = 0;
 265
 266         return TRUE;
 267 }
 268
 269 /* Write a record for a packet to a dump file.
 270  * Returns TRUE on success, FALSE on failure. */
 271 static gboolean commview_dump(wtap_dumper *wdh,
 272                               const struct wtap_pkthdr *phdr,
 273                               const guint8 *pd, int *err)
 274 {
 275         commview_header_t cv_hdr;
 276         struct tm *tm;
 277
 278         /* Don't write out anything bigger than we can read.
 279          * (The length field in packet headers is 16 bits, which
 280          * imposes a hard limit.) */
 281         if (phdr->caplen > 65535) {
 282                 *err = WTAP_ERR_PACKET_TOO_LARGE;
 283                 return FALSE;
 284         }
 285
 286         memset(&cv_hdr, 0, sizeof(cv_hdr));
 287
 288         cv_hdr.data_len = GUINT16_TO_LE((guint16)phdr->caplen);
 289         cv_hdr.source_data_len = GUINT16_TO_LE((guint16)phdr->caplen);
 290         cv_hdr.version = 0;
 291
 292         tm = localtime(&phdr->ts.secs);
 293         cv_hdr.year = tm->tm_year + 1900;
 294         cv_hdr.month = tm->tm_mon + 1;
 295         cv_hdr.day = tm->tm_mday;
 296         cv_hdr.hours = tm->tm_hour;
 297         cv_hdr.minutes = tm->tm_min;
 298         cv_hdr.seconds = tm->tm_sec;
 299         cv_hdr.usecs = GUINT32_TO_LE(phdr->ts.nsecs / 1000);
 300
 301         switch(phdr->pkt_encap) {
 302
 303         case WTAP_ENCAP_ETHERNET :
 304                 cv_hdr.flags |= MEDIUM_ETHERNET;
 305                 break;
 306
 307         case WTAP_ENCAP_IEEE_802_11 :
 308                 cv_hdr.flags |=  MEDIUM_WIFI;
 309                 break;
 310
 311         case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
 312                 cv_hdr.flags |=  MEDIUM_WIFI;
 313
 314                 cv_hdr.channel = phdr->pseudo_header.ieee_802_11.channel;
 315                 cv_hdr.rate = (guint8)(phdr->pseudo_header.ieee_802_11.data_rate & 0xFF);
 316                 cv_hdr.direction = (guint8)((phdr->pseudo_header.ieee_802_11.data_rate >> 8) & 0xFF);
 317                 cv_hdr.signal_level_percent = phdr->pseudo_header.ieee_802_11.signal_level;
 318                 break;
 319
 320         case WTAP_ENCAP_TOKEN_RING :
 321                 cv_hdr.flags |= MEDIUM_TOKEN_RING;
 322                 break;
 323
 324         default :
 325                 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 326                 return FALSE;
 327         }
 328
 329         if (!wtap_dump_file_write(wdh, &cv_hdr.data_len, 2, err))
 330                 return FALSE;
 331         if (!wtap_dump_file_write(wdh, &cv_hdr.source_data_len, 2, err))
 332                 return FALSE;
 333         if (!wtap_dump_file_write(wdh, &cv_hdr.version, 1, err))
 334                 return FALSE;
 335         if (!wtap_dump_file_write(wdh, &cv_hdr.year, 2, err))
 336                 return FALSE;
 337         if (!wtap_dump_file_write(wdh, &cv_hdr.month, 1, err))
 338                 return FALSE;
 339         if (!wtap_dump_file_write(wdh, &cv_hdr.day, 1, err))
 340                 return FALSE;
 341         if (!wtap_dump_file_write(wdh, &cv_hdr.hours, 1, err))
 342                 return FALSE;
 343         if (!wtap_dump_file_write(wdh, &cv_hdr.minutes, 1, err))
 344                 return FALSE;
 345         if (!wtap_dump_file_write(wdh, &cv_hdr.seconds, 1, err))
 346                 return FALSE;
 347         if (!wtap_dump_file_write(wdh, &cv_hdr.usecs, 4, err))
 348                 return FALSE;
 349         if (!wtap_dump_file_write(wdh, &cv_hdr.flags, 1, err))
 350                 return FALSE;
 351         if (!wtap_dump_file_write(wdh, &cv_hdr.signal_level_percent, 1, err))
 352                 return FALSE;
 353         if (!wtap_dump_file_write(wdh, &cv_hdr.rate, 1, err))
 354                 return FALSE;
 355         if (!wtap_dump_file_write(wdh, &cv_hdr.band, 1, err))
 356                 return FALSE;
 357         if (!wtap_dump_file_write(wdh, &cv_hdr.channel, 1, err))
 358                 return FALSE;
 359         if (!wtap_dump_file_write(wdh, &cv_hdr.direction, 1, err))
 360                 return FALSE;
 361         if (!wtap_dump_file_write(wdh, &cv_hdr.signal_level_dbm, 2, err))
 362                 return FALSE;
 363         if (!wtap_dump_file_write(wdh, &cv_hdr.noise_level, 2, err))
 364                 return FALSE;
 365         wdh->bytes_dumped += COMMVIEW_HEADER_SIZE;
 366
 367         if (!wtap_dump_file_write(wdh, pd, phdr->caplen, err))
 368                 return FALSE;
 369         wdh->bytes_dumped += phdr->caplen;
 370
 371         return TRUE;
 372 }