wiretap/erf.c

   1 /*
   2 *
   3 * Copyright (c) 2003 Endace Technology Ltd, Hamilton, New Zealand.
   4 * All rights reserved.
   5 *
   6 * This software and documentation has been developed by Endace Technology Ltd.
   7 * along with the DAG PCI network capture cards. For further information please
   8 * visit http://www.endace.com/.
   9 *
  10 * Redistribution and use in source and binary forms, with or without
  11 * modification, are permitted provided that the following conditions are met:
  12 *
  13 *  1. Redistributions of source code must retain the above copyright notice,
  14 *  this list of conditions and the following disclaimer.
  15 *
  16 *  2. Redistributions in binary form must reproduce the above copyright
  17 *  notice, this list of conditions and the following disclaimer in the
  18 *  documentation and/or other materials provided with the distribution.
  19 *
  20 *  3. The name of Endace Technology Ltd may not be used to endorse or promote
  21 *  products derived from this software without specific prior written
  22 *  permission.
  23 *
  24 * THIS SOFTWARE IS PROVIDED BY ENDACE TECHNOLOGY LTD ``AS IS'' AND ANY EXPRESS
  25 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
  27 * EVENT SHALL ENDACE TECHNOLOGY LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  29 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  30 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  31 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33 * POSSIBILITY OF SUCH DAMAGE.
  34 *
  35 * $Id$
  36 */
  37
  38 /*
  39  * erf - Endace ERF (Extensible Record Format)
  40  *
  41  * See
  42  *
  43  *      http://www.endace.com/support/EndaceRecordFormat.pdf
  44  */
  45
  46 #ifdef HAVE_CONFIG_H
  47 #include "config.h"
  48 #endif
  49
  50 #include <stdlib.h>
  51 #include <string.h>
  52
  53 #include "wtap-int.h"
  54 #include "file_wrappers.h"
  55 #include "buffer.h"
  56 #include "atm.h"
  57 #include "erf.h"
  58
  59 typedef guint32 atm_hdr_t;
  60
  61 static int erf_read_header(
  62                 FILE_T fh,
  63                 struct wtap_pkthdr *phdr,
  64                 union wtap_pseudo_header *pseudo_header,
  65                 erf_header_t *erf_header,
  66                 erf_t *erf,
  67                 int *err,
  68                 gchar **err_info,
  69                 guint32 *bytes_read,
  70                 guint32 *packet_size);
  71 static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
  72                 long *data_offset);
  73 static gboolean erf_seek_read(wtap *wth, long seek_off,
  74                 union wtap_pseudo_header *pseudo_header, guchar *pd,
  75                 int length, int *err, gchar **err_info);
  76 static void erf_close(wtap *wth);
  77 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap);
  78 static void erf_set_pseudo_header(
  79                 guint8 type,
  80                 erf_t *erf,
  81                 guchar *pd,
  82                 int length,
  83                 union wtap_pseudo_header *pseudo_header);
  84
  85 int erf_open(wtap *wth, int *err, gchar **err_info _U_)
  86 {
  87         guint32 i, n;
  88         char *s;
  89         guint32 records_for_erf_check = RECORDS_FOR_ERF_CHECK;
  90         guint32 atm_encap = WTAP_ENCAP_ATM_PDUS;
  91         gboolean is_rawatm = FALSE;
  92         gboolean is_ppp = FALSE;
  93         int common_type = 0;
  94         erf_timestamp_t prevts;
  95
  96         memset(&prevts, 0, sizeof(prevts));
  97
  98         if ((s = getenv("ERF_ATM_ENCAP")) != NULL) {
  99                 if (!strcmp(s, "sunatm")) {
 100                         atm_encap = WTAP_ENCAP_ATM_PDUS;
 101                 } else
 102                 if (!strcmp(s, "sunraw")) {
 103                         atm_encap = WTAP_ENCAP_ATM_PDUS;
 104                         is_rawatm = TRUE;
 105                 } else
 106                 if (!strcmp(s, "rfc1483")) {
 107                         atm_encap = WTAP_ENCAP_ATM_RFC1483;
 108                 }
 109         }
 110
 111         /* number of records to scan before deciding if this really is ERF (dflt=3) */
 112         if ((s = getenv("ERF_RECORDS_TO_CHECK")) != NULL) {
 113                 if ((n = atoi(s)) > 0 && n < 101) {
 114                         records_for_erf_check = n;
 115                 }
 116         }
 117
 118         /* ERF is a little hard because there's no magic number */
 119
 120         for (i = 0; i < records_for_erf_check; i++) {
 121
 122                 erf_header_t header;
 123                 guint32 packet_size;
 124                 erf_timestamp_t ts;
 125
 126                 if (file_read(&header,1,sizeof(header),wth->fh) != sizeof(header)) {
 127                         if ((*err = file_error(wth->fh)) != 0)
 128                                 return -1;
 129                         else
 130                         return 0;
 131                 }
 132
 133                 packet_size = g_ntohs(header.rlen) - sizeof(header);
 134
 135                 /* fail on invalid record type, decreasing timestamps or non-zero pad-bits */
 136                 if (header.type == 0 || header.type > TYPE_AAL5 ||
 137                     (header.flags & 0xc0) != 0) {
 138                         return 0;
 139                 }
 140
 141                 if ((ts = pletohll(&header.ts)) < prevts) {
 142                         /* reassembled AAL5 records may not be in time order, so allow 1 sec fudge */
 143                         if (header.type != TYPE_AAL5 || ((prevts-ts)>>32) > 1) {
 144                                 return 0;
 145                         }
 146                 }
 147                 memcpy(&prevts, &ts, sizeof(prevts));
 148
 149                 if (common_type == 0) {
 150                         common_type = header.type;
 151                 } else
 152                 if (common_type > 0 && common_type != header.type) {
 153                         common_type = -1;
 154                 }
 155
 156                 if (header.type == TYPE_HDLC_POS && !is_ppp) {
 157                         guint16 chdlc_hdr;
 158                         if (file_read(&chdlc_hdr,1,sizeof(chdlc_hdr),wth->fh) != sizeof(chdlc_hdr)) {
 159                                 *err = file_error(wth->fh);
 160                         }
 161                         packet_size -= sizeof(chdlc_hdr);
 162                         if (g_ntohs(chdlc_hdr) == 0xff03) {
 163                                 is_ppp = TRUE;
 164                         }
 165                 }
 166
 167                 if (file_seek(wth->fh, packet_size, SEEK_CUR, err) == -1) {
 168                         return -1;
 169                 }
 170         }
 171
 172         if (file_seek(wth->fh, 0L, SEEK_SET, err) == -1) {      /* rewind */
 173                 return -1;
 174         }
 175
 176         wth->data_offset = 0;
 177
 178         /* This is an ERF file */
 179         wth->file_type = WTAP_FILE_ERF;
 180         wth->snapshot_length = 0;       /* not available in header, only in frame */
 181         wth->capture.erf = g_malloc(sizeof(erf_t));
 182         wth->capture.erf->is_ppp = is_ppp;
 183         if (common_type == TYPE_AAL5) {
 184                 wth->capture.erf->atm_encap = WTAP_ENCAP_ATM_PDUS_UNTRUNCATED;
 185                 wth->capture.erf->is_rawatm = FALSE;
 186         } else {
 187                 wth->capture.erf->atm_encap = atm_encap;
 188                 wth->capture.erf->is_rawatm = is_rawatm;
 189         }
 190
 191         /*
 192          * Really want WTAP_ENCAP_PER_PACKET here but that severely limits
 193          * the number of output formats we can write to. If all the records
 194          * tested in the loop above were the same encap then use that one,
 195          * otherwise use WTAP_ENCAP_PER_PACKET.
 196          */
 197         wth->file_encap =
 198                 (common_type < 0
 199                         ? WTAP_ENCAP_PER_PACKET
 200                         : erf_encap_to_wtap_encap(wth->capture.erf, (guint8) common_type));
 201
 202         wth->subtype_read = erf_read;
 203         wth->subtype_seek_read = erf_seek_read;
 204         wth->subtype_close = erf_close;
 205     wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
 206
 207         return 1;
 208 }
 209
 210 /* Read the next packet */
 211 static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
 212     long *data_offset)
 213 {
 214         erf_header_t erf_header;
 215         guint32 packet_size, bytes_read;
 216         gint32 offset = 0;
 217
 218         *data_offset = wth->data_offset;
 219
 220         if (!erf_read_header(
 221                         wth->fh,
 222                         &wth->phdr, &wth->pseudo_header, &erf_header, wth->capture.erf,
 223                         err, err_info, &bytes_read, &packet_size)) {
 224                 return FALSE;
 225         }
 226         wth->data_offset += bytes_read;
 227
 228         buffer_assure_space(wth->frame_buffer, packet_size+(wth->capture.erf->is_rawatm?(sizeof(atm_hdr_t)+1):0));
 229
 230         if (wth->capture.erf->is_rawatm) {
 231                 wtap_file_read_expected_bytes(
 232                         buffer_start_ptr(wth->frame_buffer), (gint32)sizeof(atm_hdr_t), wth->fh, err
 233                 );
 234                 wth->data_offset += sizeof(atm_hdr_t);
 235                 packet_size -= sizeof(atm_hdr_t);
 236                 offset += sizeof(atm_hdr_t)+1;
 237         }
 238
 239         wtap_file_read_expected_bytes(
 240                 buffer_start_ptr(wth->frame_buffer)+offset, (gint32)packet_size, wth->fh, err
 241         );
 242         wth->data_offset += packet_size;
 243
 244         erf_set_pseudo_header(
 245                         erf_header.type, wth->capture.erf,
 246                         buffer_start_ptr(wth->frame_buffer), packet_size, &wth->pseudo_header
 247         );
 248
 249         return TRUE;
 250 }
 251
 252 static gboolean erf_seek_read(wtap *wth, long seek_off,
 253                 union wtap_pseudo_header *pseudo_header, guchar *pd,
 254                 int length, int *err, gchar **err_info)
 255 {
 256         erf_header_t erf_header;
 257         guint32 packet_size;
 258         int offset = 0;
 259
 260         if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 261                 return FALSE;
 262
 263         if (!erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header,
 264             wth->capture.erf, err, err_info, NULL, &packet_size))
 265                 return FALSE;
 266
 267         if (wth->capture.erf->is_rawatm) {
 268                 wtap_file_read_expected_bytes(pd, (int)sizeof(atm_hdr_t), wth->random_fh, err);
 269                 packet_size -= sizeof(atm_hdr_t);
 270                 offset += sizeof(atm_hdr_t)+1;
 271         }
 272
 273         wtap_file_read_expected_bytes(pd+offset, (int)packet_size, wth->random_fh, err);
 274
 275         erf_set_pseudo_header(erf_header.type, wth->capture.erf, pd, length, pseudo_header);
 276
 277         return TRUE;
 278 }
 279
 280 static void erf_close(wtap *wth)
 281 {
 282     g_free(wth->capture.erf);
 283 }
 284
 285 static int erf_read_header(
 286         FILE_T fh,
 287         struct wtap_pkthdr *phdr,
 288         union wtap_pseudo_header *pseudo_header,
 289         erf_header_t *erf_header,
 290         erf_t *erf,
 291         int *err,
 292         gchar **err_info,
 293         guint32 *bytes_read,
 294         guint32 *packet_size)
 295 {
 296         guint32 rec_size, skip;
 297
 298         wtap_file_read_expected_bytes(erf_header, sizeof(*erf_header), fh, err);
 299         if (bytes_read != NULL) {
 300                 *bytes_read = sizeof(*erf_header);
 301         }
 302
 303         rec_size = g_ntohs(erf_header->rlen);
 304         *packet_size = rec_size - sizeof(*erf_header);
 305         skip = 0; /* # bytes of payload to ignore */
 306
 307         if (*packet_size > WTAP_MAX_PACKET_SIZE) {
 308                 /*
 309                  * Probably a corrupt capture file; don't blow up trying
 310                  * to allocate space for an immensely-large packet.
 311                  */
 312                 *err = WTAP_ERR_BAD_RECORD;
 313                 *err_info = g_strdup_printf("erf: File has %u-byte packet, bigger than maximum of %u",
 314                     *packet_size, WTAP_MAX_PACKET_SIZE);
 315                 return FALSE;
 316         }
 317
 318         if (phdr != NULL) {
 319                 guint64 ts = pletohll(&erf_header->ts);
 320
 321                 phdr->ts.secs = (long) (ts >> 32);
 322                 ts = ((ts & 0xffffffff) * 1000 * 1000);
 323                 ts += (ts & 0x80000000) << 1; /* rounding */
 324                 phdr->ts.nsecs = ((long) (ts >> 32)) * 1000;
 325                 if (phdr->ts.nsecs >= 1000000000) {
 326                         phdr->ts.nsecs -= 1000000000;
 327                         phdr->ts.secs += 1;
 328                 }
 329         }
 330
 331         switch (erf_header->type) {
 332
 333         case TYPE_ATM:
 334         case TYPE_AAL5:
 335                 if (phdr != NULL) {
 336                         if (erf_header->type == TYPE_AAL5) {
 337                                 phdr->caplen = phdr->len = *packet_size - sizeof(atm_hdr_t);
 338                         } else {
 339                                 phdr->caplen = ATM_SLEN(erf_header, NULL);
 340                                 phdr->len = ATM_WLEN(erf_header, NULL);
 341                         }
 342                 }
 343
 344                 if (erf->atm_encap == WTAP_ENCAP_ATM_PDUS || erf->atm_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED) {
 345                         memset(&pseudo_header->atm, 0, sizeof(pseudo_header->atm));
 346                         if (erf->is_rawatm) {
 347                                 pseudo_header->atm.flags = ATM_RAW_CELL;
 348                                 if (phdr != NULL) {
 349                                         phdr->caplen += sizeof(atm_hdr_t)+1;
 350                                         phdr->len += sizeof(atm_hdr_t)+1;
 351                                 }
 352                         } else {
 353                                 atm_hdr_t atm_hdr;
 354
 355                                 wtap_file_read_expected_bytes(&atm_hdr, sizeof(atm_hdr), fh, err);
 356                                 if (bytes_read != NULL) {
 357                                         *bytes_read += sizeof(atm_hdr);
 358                                 }
 359                                 *packet_size -= sizeof(atm_hdr);
 360
 361                                 atm_hdr = g_ntohl(atm_hdr);
 362
 363                                 pseudo_header->atm.vpi = ((atm_hdr & 0x0ff00000) >> 20);
 364                                 pseudo_header->atm.vci = ((atm_hdr & 0x000ffff0) >>  4);
 365                                 pseudo_header->atm.channel = (erf_header->flags & 0x03);
 366                         }
 367                 } else {
 368                         skip = 4;
 369                 }
 370                 break;
 371         case TYPE_ETH:
 372                 if (phdr != NULL) {
 373                         phdr->caplen = ETHERNET_SLEN(erf_header, erf);
 374                         phdr->len = ETHERNET_WLEN(erf_header, erf);
 375                 }
 376                 skip = 2;
 377                 break;
 378         case TYPE_HDLC_POS:
 379                 if (phdr != NULL) {
 380                         phdr->caplen = HDLC_SLEN(erf_header, erf);
 381                         phdr->len = HDLC_WLEN(erf_header, erf);
 382                 }
 383                 memset(&pseudo_header->p2p, 0, sizeof(pseudo_header->p2p));
 384                 pseudo_header->p2p.sent = ((erf_header->flags & 0x01) ? TRUE : FALSE);
 385                 break;
 386         default:
 387                 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 388                 *err_info = g_strdup_printf("erf: unknown record encapsulation %u",
 389                     erf_header->type);
 390                 return FALSE;
 391         }
 392
 393         if (phdr != NULL) {
 394                 phdr->pkt_encap = erf_encap_to_wtap_encap(erf, erf_header->type);
 395         }
 396
 397         if (skip > 0) {
 398                 if (file_seek(fh, skip, SEEK_CUR, err) == -1) {
 399                         return FALSE;
 400                 }
 401                 if (bytes_read != NULL) {
 402                         *bytes_read += skip;
 403                 }
 404                 *packet_size -= skip;
 405         }
 406
 407         return TRUE;
 408 }
 409
 410 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap)
 411 {
 412         int wtap_encap = WTAP_ENCAP_UNKNOWN;
 413
 414         switch (erf_encap) {
 415         case TYPE_ATM:
 416         case TYPE_AAL5:
 417                 wtap_encap = erf->atm_encap;
 418                 break;
 419         case TYPE_ETH:
 420                 wtap_encap = WTAP_ENCAP_ETHERNET;
 421                 break;
 422         case TYPE_HDLC_POS:
 423                 wtap_encap = (erf->is_ppp ? WTAP_ENCAP_PPP : WTAP_ENCAP_CHDLC);
 424                 break;
 425         default:
 426                 break;
 427         }
 428
 429         return wtap_encap;
 430 }
 431
 432 static void erf_set_pseudo_header(
 433         guint8 type, erf_t *erf, guchar *pd, int length, union wtap_pseudo_header *pseudo_header)
 434 {
 435         if (type == TYPE_ETH) {
 436                 /*
 437                  * We don't know whether there's an FCS in this frame or not.
 438                  */
 439                 pseudo_header->eth.fcs_len = -1;
 440         } else
 441         if (!erf->is_rawatm &&
 442                         (type == TYPE_ATM || type == TYPE_AAL5) &&
 443                         (erf->atm_encap == WTAP_ENCAP_ATM_PDUS ||
 444                          erf->atm_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED)) {
 445                 atm_guess_traffic_type(pd, length, pseudo_header);
 446         } else
 447         if (type == TYPE_AAL5) {
 448                 pseudo_header->atm.aal = AAL_5;
 449                 pseudo_header->atm.type = TRAF_UNKNOWN;
 450                 pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
 451         }
 452 }