6 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
30 #ifdef HAVE_SYS_TYPES_H
31 #include <sys/types.h>
41 #include "file_wrappers.h"
42 #include "file_util.h"
46 * Return the size of the file, as reported by the OS.
47 * (gint64, in case that's 64 bits.)
50 wtap_file_size(wtap *wth, int *err)
54 if (fstat(wth->fd, &statb) == -1) {
63 wtap_file_type(wtap *wth)
65 return wth->file_type;
69 wtap_snapshot_length(wtap *wth)
71 return wth->snapshot_length;
75 wtap_file_encap(wtap *wth)
77 return wth->file_encap;
81 wtap_file_tsprecision(wtap *wth)
83 return wth->tsprecision;
86 /* Table of the encapsulation types we know about. */
87 static const struct encap_type_info {
89 const char *short_name;
90 } encap_table[WTAP_NUM_ENCAP_TYPES] = {
91 /* WTAP_ENCAP_UNKNOWN */
94 /* WTAP_ENCAP_ETHERNET */
95 { "Ethernet", "ether" },
97 /* WTAP_ENCAP_TOKEN_RING */
98 { "Token Ring", "tr" },
100 /* WTAP_ENCAP_SLIP */
106 /* WTAP_ENCAP_FDDI */
109 /* WTAP_ENCAP_FDDI_BITSWAPPED */
110 { "FDDI with bit-swapped MAC addresses", "fddi-swapped" },
112 /* WTAP_ENCAP_RAW_IP */
113 { "Raw IP", "rawip" },
115 /* WTAP_ENCAP_ARCNET */
116 { "ARCNET", "arcnet" },
118 /* WTAP_ENCAP_ARCNET_LINUX */
119 { "Linux ARCNET", "arcnet_linux" },
121 /* WTAP_ENCAP_ATM_RFC1483 */
122 { "RFC 1483 ATM", "atm-rfc1483" },
124 /* WTAP_ENCAP_LINUX_ATM_CLIP */
125 { "Linux ATM CLIP", "linux-atm-clip" },
127 /* WTAP_ENCAP_LAPB */
130 /* WTAP_ENCAP_ATM_PDUS */
131 { "ATM PDUs", "atm-pdus" },
133 /* WTAP_ENCAP_ATM_PDUS_UNTRUNCATED */
134 { "ATM PDUs - untruncated", "atm-pdus-untruncated" },
136 /* WTAP_ENCAP_NULL */
139 /* WTAP_ENCAP_ASCEND */
140 { "Lucent/Ascend access equipment", "ascend" },
142 /* WTAP_ENCAP_ISDN */
145 /* WTAP_ENCAP_IP_OVER_FC */
146 { "RFC 2625 IP-over-Fibre Channel", "ip-over-fc" },
148 /* WTAP_ENCAP_PPP_WITH_PHDR */
149 { "PPP with Directional Info", "ppp-with-direction" },
151 /* WTAP_ENCAP_IEEE_802_11 */
152 { "IEEE 802.11 Wireless LAN", "ieee-802-11" },
154 /* WTAP_ENCAP_PRISM_HEADER */
155 { "IEEE 802.11 plus Prism II monitor mode header", "prism" },
157 /* WTAP_ENCAP_IEEE_802_11_WITH_RADIO */
158 { "IEEE 802.11 Wireless LAN with radio information", "ieee-802-11-radio" },
160 /* WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP */
161 { "IEEE 802.11 plus radiotap WLAN header", "ieee-802-11-radiotap" },
163 /* WTAP_ENCAP_IEEE_802_11_WLAN_AVS */
164 { "IEEE 802.11 plus AVS WLAN header", "ieee-802-11-avs" },
167 { "Linux cooked-mode capture", "linux-sll" },
169 /* WTAP_ENCAP_FRELAY */
170 { "Frame Relay", "frelay" },
172 /* WTAP_ENCAP_FRELAY_WITH_PHDR */
173 { "Frame Relay with Directional Info", "frelay-with-direction" },
175 /* WTAP_ENCAP_CHDLC */
176 { "Cisco HDLC", "chdlc" },
178 /* WTAP_ENCAP_CISCO_IOS */
179 { "Cisco IOS internal", "ios" },
181 /* WTAP_ENCAP_LOCALTALK */
182 { "Localtalk", "ltalk" },
184 /* WTAP_ENCAP_OLD_PFLOG */
185 { "OpenBSD PF Firewall logs, pre-3.4", "pflog-old" },
187 /* WTAP_ENCAP_HHDLC */
188 { "HiPath HDLC", "hhdlc" },
190 /* WTAP_ENCAP_DOCSIS */
191 { "Data Over Cable Service Interface Specification", "docsis" },
193 /* WTAP_ENCAP_COSINE */
194 { "CoSine L2 debug log", "cosine" },
196 /* WTAP_ENCAP_WFLEET_HDLC */
197 { "Wellfleet HDLC", "whdlc" },
199 /* WTAP_ENCAP_SDLC */
202 /* WTAP_ENCAP_TZSP */
203 { "Tazmen sniffer protocol", "tzsp" },
206 { "OpenBSD enc(4) encapsulating interface", "enc" },
208 /* WTAP_ENCAP_PFLOG */
209 { "OpenBSD PF Firewall logs", "pflog" },
211 /* WTAP_ENCAP_CHDLC_WITH_PHDR */
212 { "Cisco HDLC with Directional Info", "chdlc-with-direction" },
214 /* WTAP_ENCAP_BLUETOOTH_H4 */
215 { "Bluetooth H4", "bluetooth-h4" },
217 /* WTAP_ENCAP_MTP2 */
218 { "SS7 MTP2", "mtp2" },
220 /* WTAP_ENCAP_MTP3 */
221 { "SS7 MTP3", "mtp3" },
223 /* WTAP_ENCAP_IRDA */
226 /* WTAP_ENCAP_USER0 */
227 { "USER 0", "user0" },
229 /* WTAP_ENCAP_USER1 */
230 { "USER 1", "user1" },
232 /* WTAP_ENCAP_USER2 */
233 { "USER 2", "user2" },
235 /* WTAP_ENCAP_USER3 */
236 { "USER 3", "user3" },
238 /* WTAP_ENCAP_USER4 */
239 { "USER 4", "user4" },
241 /* WTAP_ENCAP_USER5 */
242 { "USER 5", "user5" },
244 /* WTAP_ENCAP_USER6 */
245 { "USER 6", "user6" },
247 /* WTAP_ENCAP_USER7 */
248 { "USER 7", "user7" },
250 /* WTAP_ENCAP_USER8 */
251 { "USER 8", "user8" },
253 /* WTAP_ENCAP_USER9 */
254 { "USER 9", "user9" },
256 /* WTAP_ENCAP_USER10 */
257 { "USER 10", "user10" },
259 /* WTAP_ENCAP_USER11 */
260 { "USER 11", "user11" },
262 /* WTAP_ENCAP_USER12 */
263 { "USER 12", "user12" },
265 /* WTAP_ENCAP_USER13 */
266 { "USER 13", "user13" },
268 /* WTAP_ENCAP_USER14 */
269 { "USER 14", "user14" },
271 /* WTAP_ENCAP_USER15 */
272 { "USER 15", "user15" },
274 /* WTAP_ENCAP_SYMANTEC */
275 { "Symantec Enterprise Firewall", "symantec" },
277 /* WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 */
278 { "Apple IP-over-IEEE 1394", "ap1394" },
280 /* WTAP_ENCAP_BACNET_MS_TP */
281 { "BACnet MS/TP", "bacnet-ms-tp" },
283 /* WTAP_ENCAP_NETTL_RAW_ICMP */
284 { "Raw ICMP with nettl headers", "raw-icmp-nettl" },
286 /* WTAP_ENCAP_NETTL_RAW_ICMPV6 */
287 { "Raw ICMPv6 with nettl headers", "raw-icmpv6-nettl" },
292 /* WTAP_ENCAP_GPRS_LLC */
293 { "GPRS LLC", "gprs-llc" },
295 /* WTAP_ENCAP_JUNIPER_ATM1 */
296 { "Juniper ATM1", "juniper-atm1" },
298 /* WTAP_ENCAP_JUNIPER_ATM2 */
299 { "Juniper ATM2", "juniper-atm2" },
301 /* WTAP_ENCAP_REDBACK */
302 { "Redback SmartEdge", "redback" },
304 /* WTAP_ENCAP_NETTL_RAW_IP */
305 { "Raw IP with nettl headers", "rawip-nettl" },
307 /* WTAP_ENCAP_NETTL_ETHERNET */
308 { "Ethernet with nettl headers", "ether-nettl" },
310 /* WTAP_ENCAP_NETTL_TOKEN_RING */
311 { "Token Ring with nettl headers", "tr-nettl" },
313 /* WTAP_ENCAP_NETTL_FDDI */
314 { "FDDI with nettl headers", "fddi-nettl" },
316 /* WTAP_ENCAP_NETTL_UNKNOWN */
317 { "Unknown link-layer type with nettl headers", "unknown-nettl" },
319 /* WTAP_ENCAP_MTP2_WITH_PHDR */
320 { "MTP2 with pseudoheader", "mtp2-with-phdr" },
322 /* WTAP_ENCAP_JUNIPER_PPPOE */
323 { "Juniper PPPoE", "juniper-pppoe" },
325 /* WTAP_ENCAP_GCOM_TIE1 */
326 { "GCOM TIE1", "gcom-tie1" },
328 /* WTAP_ENCAP_GCOM_SERIAL */
329 { "GCOM Serial", "gcom-serial" },
331 /* WTAP_ENCAP_NETTL_X25 */
332 { "X25 with nettl headers", "x25-nettl" },
335 { "K12 protocol analyzer", "k12" },
337 /* WTAP_ENCAP_JUNIPER_MLPPP */
338 { "Juniper MLPPP", "juniper-mlppp" },
340 /* WTAP_ENCAP_JUNIPER_MLFR */
341 { "Juniper MLFR", "juniper-mlfr" },
343 /* WTAP_ENCAP_JUNIPER_ETHER */
344 { "Juniper Ethernet", "juniper-ether" },
346 /* WTAP_ENCAP_JUNIPER_PPP */
347 { "Juniper PPP", "juniper-ppp" },
349 /* WTAP_ENCAP_JUNIPER_FRELAY */
350 { "Juniper Frame-Relay", "juniper-frelay" },
352 /* WTAP_ENCAP_JUNIPER_CHDLC */
353 { "Juniper C-HDLC", "juniper-chdlc" },
355 /* WTAP_ENCAP_JUNIPER_GGSN */
356 { "Juniper GGSN", "juniper-ggsn" },
358 /* WTAP_ENCAP_LINUX_LAPD */
362 /* Name that should be somewhat descriptive. */
364 *wtap_encap_string(int encap)
366 if (encap < 0 || encap >= WTAP_NUM_ENCAP_TYPES)
369 return encap_table[encap].name;
372 /* Name to use in, say, a command-line flag specifying the type. */
374 *wtap_encap_short_string(int encap)
376 if (encap < 0 || encap >= WTAP_NUM_ENCAP_TYPES)
379 return encap_table[encap].short_name;
382 /* Translate a short name to a capture file type. */
384 wtap_short_string_to_encap(const char *short_name)
388 for (encap = 0; encap < WTAP_NUM_ENCAP_TYPES; encap++) {
389 if (encap_table[encap].short_name != NULL &&
390 strcmp(short_name, encap_table[encap].short_name) == 0)
393 return -1; /* no such encapsulation type */
396 static const char *wtap_errlist[] = {
397 "The file isn't a plain file or pipe",
398 "The file is being opened for random access but is a pipe",
399 "The file isn't a capture file in a known format",
400 "File contains record data we don't support",
401 "That file format cannot be written to a pipe",
403 "Files can't be saved in that format",
404 "Files from that network type can't be saved in that format",
405 "That file format doesn't support per-packet encapsulations",
408 "Less data was read than was expected",
409 "File contains a record that's not valid",
410 "Less data was written than was requested",
411 "Uncompression error: data oddly truncated",
412 "Uncompression error: data would overflow buffer",
413 "Uncompression error: bad LZ77 offset",
414 "The standard input cannot be opened for random access",
416 #define WTAP_ERRLIST_SIZE (sizeof wtap_errlist / sizeof wtap_errlist[0])
419 *wtap_strerror(int err)
421 static char errbuf[128];
422 unsigned int wtap_errlist_index;
426 if (err >= WTAP_ERR_ZLIB_MIN && err <= WTAP_ERR_ZLIB_MAX) {
427 /* Assume it's a zlib error. */
428 sprintf(errbuf, "Uncompression error: %s",
429 zError(err - WTAP_ERR_ZLIB));
433 wtap_errlist_index = -1 - err;
434 if (wtap_errlist_index >= WTAP_ERRLIST_SIZE) {
435 sprintf(errbuf, "Error %d", err);
438 if (wtap_errlist[wtap_errlist_index] == NULL)
439 return "Unknown reason";
440 return wtap_errlist[wtap_errlist_index];
442 return strerror(err);
445 /* Close only the sequential side, freeing up memory it uses.
447 Note that we do *not* want to call the subtype's close function,
448 as it would free any per-subtype data, and that data may be
449 needed by the random-access side.
451 Instead, if the subtype has a "sequential close" function, we call it,
452 to free up stuff used only by the sequential side. */
454 wtap_sequential_close(wtap *wth)
456 if (wth->subtype_sequential_close != NULL)
457 (*wth->subtype_sequential_close)(wth);
459 if (wth->fh != NULL) {
464 if (wth->frame_buffer) {
465 buffer_free(wth->frame_buffer);
466 g_free(wth->frame_buffer);
467 wth->frame_buffer = NULL;
472 wtap_close(wtap *wth)
474 wtap_sequential_close(wth);
476 if (wth->subtype_close != NULL)
477 (*wth->subtype_close)(wth);
479 if (wth->random_fh != NULL)
480 file_close(wth->random_fh);
486 wtap_read(wtap *wth, int *err, gchar **err_info, long *data_offset)
489 * Set the packet encapsulation to the file's encapsulation
490 * value; if that's not WTAP_ENCAP_PER_PACKET, it's the
491 * right answer (and means that the read routine for this
492 * capture file type doesn't have to set it), and if it
493 * *is* WTAP_ENCAP_PER_PACKET, the caller needs to set it
496 wth->phdr.pkt_encap = wth->file_encap;
498 if (!wth->subtype_read(wth, err, err_info, data_offset))
499 return FALSE; /* failure */
502 * It makes no sense for the captured data length to be bigger
503 * than the actual data length.
505 if (wth->phdr.caplen > wth->phdr.len)
506 wth->phdr.caplen = wth->phdr.len;
509 * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
510 * probably means the file has that encapsulation type
511 * but the read routine didn't set this packet's
512 * encapsulation type.
514 g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET);
516 return TRUE; /* success */
520 * Return an approximation of the amount of data we've read sequentially
521 * from the file so far. (gint64, in case that's 64 bits.)
524 wtap_read_so_far(wtap *wth, int *err)
528 file_pos = eth_lseek(wth->fd, 0, SEEK_CUR);
529 if (file_pos == -1) {
543 union wtap_pseudo_header*
544 wtap_pseudoheader(wtap *wth)
546 return &wth->pseudo_header;
550 wtap_buf_ptr(wtap *wth)
552 return buffer_start_ptr(wth->frame_buffer);
556 wtap_seek_read(wtap *wth, long seek_off,
557 union wtap_pseudo_header *pseudo_header, guint8 *pd, int len,
558 int *err, gchar **err_info)
560 return wth->subtype_seek_read(wth, seek_off, pseudo_header, pd, len,