wiretap/commview.c

   1 /* commview.c
   2  * Routines for opening CommView file format packet captures
   3  * Copyright 2007, Stephen Fisher (see AUTHORS file)
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Based on csids.c and nettl.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  26  * USA.
  27  */
  28
  29 /* A brief description of this file format is available at:
  30  *    http://www.tamos.com/htmlhelp/commview/logformat.htm
  31  */
  32
  33 #include "config.h"
  34
  35 #include <glib.h>
  36 #include <stdio.h>
  37 #include <stdlib.h>
  38 #include <errno.h>
  39 #include <string.h>
  40
  41 #include "wtap.h"
  42 #include "wtap-int.h"
  43 #include "buffer.h"
  44 #include "file_wrappers.h"
  45 #include "commview.h"
  46
  47 typedef struct commview_header {
  48         guint16         data_len;
  49         guint16         source_data_len;
  50         guint8          version;
  51         guint16         year;
  52         guint8          month;
  53         guint8          day;
  54         guint8          hours;
  55         guint8          minutes;
  56         guint8          seconds;
  57         guint32         usecs;
  58         guint8          flags;          /* Bit-field positions defined below */
  59         guint8          signal_level_percent;
  60         guint8          rate;
  61         guint8          band;
  62         guint8          channel;
  63         guint8          direction;      /* Or for WiFi, high order byte of
  64                                          * packet rate. */
  65         guint8          signal_level_dbm;
  66         guint8          noise_level;    /* In dBm (WiFi only) */
  67 } commview_header_t;
  68
  69 #define COMMVIEW_HEADER_SIZE 24
  70
  71 /* Bit-field positions for various fields in the flags variable of the header */
  72 #define FLAGS_MEDIUM            0x0F
  73 #define FLAGS_DECRYPTED         0x10
  74 #define FLAGS_BROKEN            0x20
  75 #define FLAGS_COMPRESSED        0x40
  76 #define FLAGS_RESERVED          0x80
  77
  78 /* Capture mediums as defined by the commview file format */
  79 #define MEDIUM_ETHERNET         0
  80 #define MEDIUM_WIFI             1
  81 #define MEDIUM_TOKEN_RING       2
  82
  83 static gboolean commview_read(wtap *wth, int *err, gchar **err_info,
  84                               gint64 *data_offset);
  85 static gboolean commview_seek_read(wtap *wth, gint64 seek_off,
  86                                    struct wtap_pkthdr *phdr,
  87                                    guint8 *pd, int length, int *err,
  88                                    gchar **err_info);
  89 static gboolean commview_read_header(commview_header_t *cv_hdr, FILE_T fh,
  90                                      int *err, gchar **err_info);
  91 static gboolean commview_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
  92                               const guint8 *pd, int *err);
  93
  94 int commview_open(wtap *wth, int *err, gchar **err_info)
  95 {
  96         commview_header_t cv_hdr;
  97
  98         if(!commview_read_header(&cv_hdr, wth->fh, err, err_info)) {
  99                 if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
 100                         return -1;
 101                 return 0;
 102         }
 103
 104         /* If any of these fields do not match what we expect, bail out. */
 105         if(cv_hdr.version != 0 ||
 106            cv_hdr.year < 1970 || cv_hdr.year >= 2038 ||
 107            cv_hdr.month < 1 || cv_hdr.month > 12 ||
 108            cv_hdr.day < 1 || cv_hdr.day > 31 ||
 109            cv_hdr.hours > 23 ||
 110            cv_hdr.minutes > 59 ||
 111            cv_hdr.seconds > 60 ||
 112            cv_hdr.signal_level_percent > 100 ||
 113            (cv_hdr.flags & FLAGS_RESERVED) != 0 ||
 114            ((cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_ETHERNET &&
 115             (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_WIFI &&
 116             (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_TOKEN_RING))
 117                 return 0; /* Not our kind of file */
 118
 119         /* No file header. Reset the fh to 0 so we can read the first packet */
 120         if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
 121                 return -1;
 122
 123         /* Set up the pointers to the handlers for this file type */
 124         wth->subtype_read = commview_read;
 125         wth->subtype_seek_read = commview_seek_read;
 126
 127         wth->file_type = WTAP_FILE_COMMVIEW;
 128         wth->file_encap = WTAP_ENCAP_PER_PACKET;
 129         wth->tsprecision = WTAP_FILE_TSPREC_USEC;
 130
 131         return 1; /* Our kind of file */
 132 }
 133
 134 static gboolean
 135 commview_set_packet_header(const commview_header_t *cv_hdrp, struct wtap_pkthdr *phdr)
 136 {
 137         union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
 138         struct tm tm;
 139
 140         phdr->len = cv_hdrp->data_len;
 141         phdr->caplen = cv_hdrp->data_len;
 142
 143         tm.tm_year = cv_hdrp->year - 1900;
 144         tm.tm_mon = cv_hdrp->month - 1;
 145         tm.tm_mday = cv_hdrp->day;
 146         tm.tm_hour = cv_hdrp->hours;
 147         tm.tm_min = cv_hdrp->minutes;
 148         tm.tm_sec = cv_hdrp->seconds;
 149         tm.tm_isdst = -1;
 150
 151         phdr->ts.secs = mktime(&tm);
 152         phdr->ts.nsecs = cv_hdrp->usecs * 1000;
 153         phdr->presence_flags = WTAP_HAS_TS;
 154
 155         switch(cv_hdrp->flags & FLAGS_MEDIUM) {
 156
 157         case MEDIUM_ETHERNET :
 158                 phdr->pkt_encap = WTAP_ENCAP_ETHERNET;
 159                 pseudo_header->eth.fcs_len = -1; /* Unknown */
 160                 return TRUE;
 161
 162         case MEDIUM_WIFI :
 163                 phdr->pkt_encap = WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
 164                 pseudo_header->ieee_802_11.fcs_len = -1; /* Unknown */
 165                 pseudo_header->ieee_802_11.decrypted = FALSE;
 166                 pseudo_header->ieee_802_11.channel = cv_hdrp->channel;
 167                 pseudo_header->ieee_802_11.data_rate =
 168                     cv_hdrp->rate | (cv_hdrp->direction << 8);
 169                 pseudo_header->ieee_802_11.signal_level = cv_hdrp->signal_level_percent;
 170                 return TRUE;
 171
 172         case MEDIUM_TOKEN_RING :
 173                 phdr->pkt_encap = WTAP_ENCAP_TOKEN_RING;
 174                 /* Token Ring - no pseudo-header for that */
 175                 return TRUE;
 176         }
 177
 178         /* unknown - not handled */
 179         return FALSE;
 180 }
 181
 182 static gboolean
 183 commview_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 184 {
 185         commview_header_t cv_hdr;
 186         int bytes_read;
 187
 188         *data_offset = file_tell(wth->fh);
 189
 190         if(!commview_read_header(&cv_hdr, wth->fh, err, err_info))
 191                 return FALSE;
 192
 193         if(!commview_set_packet_header(&cv_hdr, &wth->phdr)) {
 194                 *err = WTAP_ERR_BAD_FILE;
 195                 *err_info = g_strdup_printf("commview: unsupported encap: %u",
 196                                             cv_hdr.flags & FLAGS_MEDIUM);
 197                 return FALSE;
 198         }
 199
 200         buffer_assure_space(wth->frame_buffer, cv_hdr.data_len);
 201         bytes_read = file_read(buffer_start_ptr(wth->frame_buffer),
 202                                cv_hdr.data_len, wth->fh);
 203         if(bytes_read != cv_hdr.data_len) {
 204                 *err = file_error(wth->fh, err_info);
 205                 if(*err == 0)
 206                         *err = WTAP_ERR_SHORT_READ;
 207                 return FALSE;
 208         }
 209
 210         return TRUE;
 211 }
 212
 213 static gboolean
 214 commview_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr,
 215                    guint8 *pd, int length, int *err,
 216                    gchar **err_info)
 217 {
 218         commview_header_t cv_hdr;
 219         int bytes_read;
 220
 221         if(file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 222                 return FALSE;
 223
 224         if(!commview_read_header(&cv_hdr, wth->random_fh, err, err_info)) {
 225                 if(*err == 0)
 226                         *err = WTAP_ERR_SHORT_READ;
 227
 228                 return FALSE;
 229         }
 230
 231         if(!commview_set_packet_header(&cv_hdr, phdr)) {
 232                 *err = WTAP_ERR_BAD_FILE;
 233                 *err_info = g_strdup_printf("commview: unsupported encap: %u",
 234                                             cv_hdr.flags & FLAGS_MEDIUM);
 235                 return FALSE;
 236         }
 237
 238         if(length != (int)phdr->caplen) {
 239                 *err = WTAP_ERR_BAD_FILE;
 240                 *err_info = g_strdup_printf("commview: record length %u doesn't match requested length %d", phdr->caplen, length);
 241                 return FALSE;
 242         }
 243
 244         bytes_read = file_read(pd, cv_hdr.data_len, wth->random_fh);
 245         if(bytes_read != cv_hdr.data_len) {
 246                 *err = file_error(wth->random_fh, err_info);
 247                 if(*err == 0)
 248                         *err = WTAP_ERR_SHORT_READ;
 249
 250                 return FALSE;
 251         }
 252
 253         return TRUE;
 254 }
 255
 256 static gboolean
 257 commview_read_header(commview_header_t *cv_hdr, FILE_T fh, int *err,
 258     gchar **err_info)
 259 {
 260         wtap_file_read_expected_bytes(&cv_hdr->data_len, 2, fh, err, err_info);
 261         wtap_file_read_expected_bytes(&cv_hdr->source_data_len, 2, fh, err, err_info);
 262         wtap_file_read_expected_bytes(&cv_hdr->version, 1, fh, err, err_info);
 263         wtap_file_read_expected_bytes(&cv_hdr->year, 2, fh, err, err_info);
 264         wtap_file_read_expected_bytes(&cv_hdr->month, 1, fh, err, err_info);
 265         wtap_file_read_expected_bytes(&cv_hdr->day, 1, fh, err, err_info);
 266         wtap_file_read_expected_bytes(&cv_hdr->hours, 1, fh, err, err_info);
 267         wtap_file_read_expected_bytes(&cv_hdr->minutes, 1, fh, err, err_info);
 268         wtap_file_read_expected_bytes(&cv_hdr->seconds, 1, fh, err, err_info);
 269         wtap_file_read_expected_bytes(&cv_hdr->usecs, 4, fh, err, err_info);
 270         wtap_file_read_expected_bytes(&cv_hdr->flags, 1, fh, err, err_info);
 271         wtap_file_read_expected_bytes(&cv_hdr->signal_level_percent, 1, fh, err, err_info);
 272         wtap_file_read_expected_bytes(&cv_hdr->rate, 1, fh, err, err_info);
 273         wtap_file_read_expected_bytes(&cv_hdr->band, 1, fh, err, err_info);
 274         wtap_file_read_expected_bytes(&cv_hdr->channel, 1, fh, err, err_info);
 275         wtap_file_read_expected_bytes(&cv_hdr->direction, 1, fh, err, err_info);
 276         wtap_file_read_expected_bytes(&cv_hdr->signal_level_dbm, 1, fh, err, err_info);
 277         wtap_file_read_expected_bytes(&cv_hdr->noise_level, 1, fh, err, err_info);
 278
 279         /* Convert multi-byte values from little endian to host endian format */
 280         cv_hdr->data_len = GUINT16_FROM_LE(cv_hdr->data_len);
 281         cv_hdr->source_data_len = GUINT16_FROM_LE(cv_hdr->source_data_len);
 282         cv_hdr->year = GUINT16_FROM_LE(cv_hdr->year);
 283         cv_hdr->usecs = GUINT32_FROM_LE(cv_hdr->usecs);
 284
 285         return TRUE;
 286 }
 287
 288 /* Returns 0 if we can write out the specified encapsulation type
 289  * into a CommView format file. */
 290 int commview_dump_can_write_encap(int encap)
 291 {
 292         switch (encap) {
 293
 294         case WTAP_ENCAP_ETHERNET :
 295         case WTAP_ENCAP_IEEE_802_11 :
 296         case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
 297         case WTAP_ENCAP_TOKEN_RING :
 298         case WTAP_ENCAP_PER_PACKET :
 299                 return 0;
 300
 301         default:
 302                 return WTAP_ERR_UNSUPPORTED_ENCAP;
 303         }
 304 }
 305
 306 /* Returns TRUE on success, FALSE on failure;
 307    sets "*err" to an error code on failure */
 308 gboolean commview_dump_open(wtap_dumper *wdh, int *err _U_)
 309 {
 310         wdh->subtype_write = commview_dump;
 311         wdh->subtype_close = NULL;
 312
 313         /* There is no file header to write out */
 314         wdh->bytes_dumped = 0;
 315
 316         return TRUE;
 317 }
 318
 319 /* Write a record for a packet to a dump file.
 320  * Returns TRUE on success, FALSE on failure. */
 321 static gboolean commview_dump(wtap_dumper *wdh,
 322                               const struct wtap_pkthdr *phdr,
 323                               const guint8 *pd, int *err)
 324 {
 325         const union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
 326         commview_header_t cv_hdr;
 327         struct tm *tm;
 328
 329         memset(&cv_hdr, 0, sizeof(cv_hdr));
 330
 331         cv_hdr.data_len = GUINT16_TO_LE((guint16)phdr->caplen);
 332         cv_hdr.source_data_len = GUINT16_TO_LE((guint16)phdr->caplen);
 333         cv_hdr.version = 0;
 334
 335         tm = localtime(&phdr->ts.secs);
 336         cv_hdr.year = tm->tm_year + 1900;
 337         cv_hdr.month = tm->tm_mon + 1;
 338         cv_hdr.day = tm->tm_mday;
 339         cv_hdr.hours = tm->tm_hour;
 340         cv_hdr.minutes = tm->tm_min;
 341         cv_hdr.seconds = tm->tm_sec;
 342         cv_hdr.usecs = GUINT32_TO_LE(phdr->ts.nsecs / 1000);
 343
 344         switch(phdr->pkt_encap) {
 345
 346         case WTAP_ENCAP_ETHERNET :
 347                 cv_hdr.flags |= MEDIUM_ETHERNET;
 348                 break;
 349
 350         case WTAP_ENCAP_IEEE_802_11 :
 351                 cv_hdr.flags |=  MEDIUM_WIFI;
 352                 break;
 353
 354         case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
 355                 cv_hdr.flags |=  MEDIUM_WIFI;
 356
 357                 cv_hdr.channel = pseudo_header->ieee_802_11.channel;
 358                 cv_hdr.rate = (guint8)(pseudo_header->ieee_802_11.data_rate & 0xFF);
 359                 cv_hdr.direction = (guint8)((pseudo_header->ieee_802_11.data_rate >> 8) & 0xFF);
 360                 cv_hdr.signal_level_percent = pseudo_header->ieee_802_11.signal_level;
 361                 break;
 362
 363         case WTAP_ENCAP_TOKEN_RING :
 364                 cv_hdr.flags |= MEDIUM_TOKEN_RING;
 365                 break;
 366
 367         default :
 368                 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 369                 return FALSE;
 370         }
 371
 372         if (!wtap_dump_file_write(wdh, &cv_hdr.data_len, 2, err))
 373                 return FALSE;
 374         if (!wtap_dump_file_write(wdh, &cv_hdr.source_data_len, 2, err))
 375                 return FALSE;
 376         if (!wtap_dump_file_write(wdh, &cv_hdr.version, 1, err))
 377                 return FALSE;
 378         if (!wtap_dump_file_write(wdh, &cv_hdr.year, 2, err))
 379                 return FALSE;
 380         if (!wtap_dump_file_write(wdh, &cv_hdr.month, 1, err))
 381                 return FALSE;
 382         if (!wtap_dump_file_write(wdh, &cv_hdr.day, 1, err))
 383                 return FALSE;
 384         if (!wtap_dump_file_write(wdh, &cv_hdr.hours, 1, err))
 385                 return FALSE;
 386         if (!wtap_dump_file_write(wdh, &cv_hdr.minutes, 1, err))
 387                 return FALSE;
 388         if (!wtap_dump_file_write(wdh, &cv_hdr.seconds, 1, err))
 389                 return FALSE;
 390         if (!wtap_dump_file_write(wdh, &cv_hdr.usecs, 4, err))
 391                 return FALSE;
 392         if (!wtap_dump_file_write(wdh, &cv_hdr.flags, 1, err))
 393                 return FALSE;
 394         if (!wtap_dump_file_write(wdh, &cv_hdr.signal_level_percent, 1, err))
 395                 return FALSE;
 396         if (!wtap_dump_file_write(wdh, &cv_hdr.rate, 1, err))
 397                 return FALSE;
 398         if (!wtap_dump_file_write(wdh, &cv_hdr.band, 1, err))
 399                 return FALSE;
 400         if (!wtap_dump_file_write(wdh, &cv_hdr.channel, 1, err))
 401                 return FALSE;
 402         if (!wtap_dump_file_write(wdh, &cv_hdr.direction, 1, err))
 403                 return FALSE;
 404         if (!wtap_dump_file_write(wdh, &cv_hdr.signal_level_dbm, 2, err))
 405                 return FALSE;
 406         if (!wtap_dump_file_write(wdh, &cv_hdr.noise_level, 2, err))
 407                 return FALSE;
 408         wdh->bytes_dumped += COMMVIEW_HEADER_SIZE;
 409
 410         if (!wtap_dump_file_write(wdh, pd, phdr->caplen, err))
 411                 return FALSE;
 412         wdh->bytes_dumped += phdr->caplen;
 413
 414         return TRUE;
 415 }