/* peekclassic.c
- * Routines for opening files in what WildPackets calls the classic file
- * format in the description of their "PeekRdr Sample Application" (C++
- * source code to read their capture files, downloading of which requires
- * a maintenance contract, so it's not free as in beer and probably not
- * as in speech, either).
+ * Routines for opening files in what Savvius (formerly WildPackets) calls
+ * the classic file format in the description of their "PeekRdr Sample
+ * Application" (C++ source code to read their capture files, downloading
+ * of which requires a maintenance contract, so it's not free as in beer
+ * and probably not as in speech, either).
*
* As that description says, it's used by AiroPeek and AiroPeek NX prior
* to 2.0, EtherPeek prior to 6.0, and EtherPeek NX prior to 3.0. It
*
* Copyright (c) 2001, Daniel Thompson <d.thompson@gmx.net>
*
- * $Id$
- *
* Wiretap Library
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
*
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "config.h"
#include <string.h>
#include "wtap-int.h"
#include "file_wrappers.h"
-#include "buffer.h"
#include "peekclassic.h"
/* CREDITS
*
(sizeof (peekclassic_encap) / sizeof (peekclassic_encap[0]))
typedef struct {
- struct timeval reference_time;
+ time_t reference_time;
} peekclassic_t;
static gboolean peekclassic_read_v7(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset);
static gboolean peekclassic_seek_read_v7(wtap *wth, gint64 seek_off,
- struct wtap_pkthdr *phdr, Buffer *buf, int length,
- int *err, gchar **err_info);
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
static int peekclassic_read_packet_v7(wtap *wth, FILE_T fh,
- struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
static gboolean peekclassic_read_v56(wtap *wth, int *err, gchar **err_info,
gint64 *data_offset);
static gboolean peekclassic_seek_read_v56(wtap *wth, gint64 seek_off,
- struct wtap_pkthdr *phdr, Buffer *buf, int length,
- int *err, gchar **err_info);
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
static gboolean peekclassic_read_packet_v56(wtap *wth, FILE_T fh,
- struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
-int peekclassic_open(wtap *wth, int *err, gchar **err_info)
+wtap_open_return_val peekclassic_open(wtap *wth, int *err, gchar **err_info)
{
peekclassic_header_t ep_hdr;
- int bytes_read;
- struct timeval reference_time;
+ time_t reference_time;
int file_encap;
peekclassic_t *peekclassic;
* and we may have to add more checks at some point.
*/
g_assert(sizeof(ep_hdr.master) == PEEKCLASSIC_MASTER_HDR_SIZE);
- bytes_read = file_read(&ep_hdr.master, (int)sizeof(ep_hdr.master),
- wth->fh);
- if (bytes_read != sizeof(ep_hdr.master)) {
- *err = file_error(wth->fh, err_info);
- if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
- return -1;
- return 0;
+ if (!wtap_read_bytes(wth->fh, &ep_hdr.master,
+ (int)sizeof(ep_hdr.master), err, err_info)) {
+ if (*err != WTAP_ERR_SHORT_READ)
+ return WTAP_OPEN_ERROR;
+ return WTAP_OPEN_NOT_MINE;
}
/*
/* get the secondary header */
g_assert(sizeof(ep_hdr.secondary.v567) ==
PEEKCLASSIC_V567_HDR_SIZE);
- bytes_read = file_read(&ep_hdr.secondary.v567,
- (int)sizeof(ep_hdr.secondary.v567), wth->fh);
- if (bytes_read != sizeof(ep_hdr.secondary.v567)) {
- *err = file_error(wth->fh, err_info);
- if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
- return -1;
- return 0;
+ if (!wtap_read_bytes(wth->fh, &ep_hdr.secondary.v567,
+ (int)sizeof(ep_hdr.secondary.v567), err, err_info)) {
+ if (*err != WTAP_ERR_SHORT_READ)
+ return WTAP_OPEN_ERROR;
+ return WTAP_OPEN_NOT_MINE;
}
if ((0 != ep_hdr.secondary.v567.reserved[0]) ||
(0 != ep_hdr.secondary.v567.reserved[1]) ||
(0 != ep_hdr.secondary.v567.reserved[2])) {
/* still unknown */
- return 0;
+ return WTAP_OPEN_NOT_MINE;
}
/*
/*
* Assume this isn't a Peek classic file.
*/
- return 0;
+ return WTAP_OPEN_NOT_MINE;
}
break;
* some radio information. Presumably
* this is from AiroPeek.
*/
- file_encap = WTAP_ENCAP_IEEE_802_11_AIROPEEK;
+ file_encap = WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
break;
default:
/*
* Assume this isn't a Peek classic file.
*/
- return 0;
+ return WTAP_OPEN_NOT_MINE;
}
break;
/*
* Assume this isn't a Peek classic file.
*/
- return 0;
+ return WTAP_OPEN_NOT_MINE;
}
ep_hdr.secondary.v567.linkSpeed =
g_ntohl(ep_hdr.secondary.v567.linkSpeed);
- /* Get the reference time as a "struct timeval" */
- reference_time.tv_sec =
- ep_hdr.secondary.v567.timeDate - mac2unix;
- reference_time.tv_usec = 0;
+ /* Get the reference time as a time_t */
+ reference_time = ep_hdr.secondary.v567.timeDate - mac2unix;
break;
default:
/*
* Assume this isn't a Peek classic file.
*/
- return 0;
+ return WTAP_OPEN_NOT_MINE;
}
/*
case 5:
case 6:
- wth->file_type = WTAP_FILE_PEEKCLASSIC_V56;
+ wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_PEEKCLASSIC_V56;
/*
* XXX - can we get the file encapsulation from the
* header in the same way we do for V7 files?
break;
case 7:
- wth->file_type = WTAP_FILE_PEEKCLASSIC_V7;
+ wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_PEEKCLASSIC_V7;
wth->file_encap = file_encap;
wth->subtype_read = peekclassic_read_v7;
wth->subtype_seek_read = peekclassic_seek_read_v7;
}
wth->snapshot_length = 0; /* not available in header */
- wth->tsprecision = WTAP_FILE_TSPREC_USEC;
+ wth->file_tsprec = WTAP_TSPREC_USEC;
- return 1;
+ return WTAP_OPEN_MINE;
}
static gboolean peekclassic_read_v7(wtap *wth, int *err, gchar **err_info,
*data_offset = file_tell(wth->fh);
/* Read the packet. */
- sliceLength = peekclassic_read_packet_v7(wth, wth->fh, &wth->phdr,
- wth->frame_buffer, err, err_info);
+ sliceLength = peekclassic_read_packet_v7(wth, wth->fh, &wth->rec,
+ wth->rec_data, err, err_info);
if (sliceLength < 0)
return FALSE;
/* Skip extra ignored data at the end of the packet. */
- if ((guint32)sliceLength > wth->phdr.caplen) {
- if (!file_skip(wth->fh, sliceLength - wth->phdr.caplen, err))
+ if ((guint32)sliceLength > wth->rec.rec_header.packet_header.caplen) {
+ if (!wtap_read_bytes(wth->fh, NULL, sliceLength - wth->rec.rec_header.packet_header.caplen,
+ err, err_info))
return FALSE;
}
/* Records are padded to an even length, so if the slice length
is odd, read the padding byte. */
if (sliceLength & 0x01) {
- if (!file_skip(wth->fh, 1, err))
+ if (!wtap_read_bytes(wth->fh, NULL, 1, err, err_info))
return FALSE;
}
}
static gboolean peekclassic_seek_read_v7(wtap *wth, gint64 seek_off,
- struct wtap_pkthdr *phdr, Buffer *buf, int length _U_,
- int *err, gchar **err_info)
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
{
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
/* Read the packet. */
- if (peekclassic_read_packet_v7(wth, wth->random_fh, phdr, buf,
+ if (peekclassic_read_packet_v7(wth, wth->random_fh, rec, buf,
err, err_info) == -1) {
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return TRUE;
}
+#define RADIO_INFO_SIZE 4
+
static int peekclassic_read_packet_v7(wtap *wth, FILE_T fh,
- struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
{
guint8 ep_pkt[PEEKCLASSIC_V7_PKT_SIZE];
- int bytes_read;
#if 0
guint16 protoNum;
#endif
guint64 timestamp;
time_t tsecs;
guint32 tusecs;
+ guint8 radio_info[RADIO_INFO_SIZE];
- bytes_read = file_read(ep_pkt, sizeof(ep_pkt), fh);
- if (bytes_read != (int) sizeof(ep_pkt)) {
- *err = file_error(fh, err_info);
- if (*err == 0 && bytes_read > 0)
- *err = WTAP_ERR_SHORT_READ;
+ if (!wtap_read_bytes_or_eof(fh, ep_pkt, sizeof(ep_pkt), err, err_info))
return -1;
- }
/* Extract the fields from the packet */
#if 0
- protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V7_PROTONUM_OFFSET]);
+ protoNum = pntoh16(&ep_pkt[PEEKCLASSIC_V7_PROTONUM_OFFSET]);
#endif
- length = pntohs(&ep_pkt[PEEKCLASSIC_V7_LENGTH_OFFSET]);
- sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V7_SLICE_LENGTH_OFFSET]);
+ length = pntoh16(&ep_pkt[PEEKCLASSIC_V7_LENGTH_OFFSET]);
+ sliceLength = pntoh16(&ep_pkt[PEEKCLASSIC_V7_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V7_FLAGS_OFFSET];
#endif
status = ep_pkt[PEEKCLASSIC_V7_STATUS_OFFSET];
- timestamp = pntohll(&ep_pkt[PEEKCLASSIC_V7_TIMESTAMP_OFFSET]);
+ timestamp = pntoh64(&ep_pkt[PEEKCLASSIC_V7_TIMESTAMP_OFFSET]);
/* force sliceLength to be the actual length of the packet */
if (0 == sliceLength) {
sliceLength = length;
}
+ /*
+ * The maximum value of sliceLength and length are 65535, which
+ * are less than WTAP_MAX_PACKET_SIZE_STANDARD will ever be, so we don't
+ * need to check them.
+ */
/* fill in packet header values */
- phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+ rec->rec_type = REC_TYPE_PACKET;
+ rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
tsecs = (time_t) (timestamp/1000000);
tusecs = (guint32) (timestamp - tsecs*1000000);
- phdr->ts.secs = tsecs - mac2unix;
- phdr->ts.nsecs = tusecs * 1000;
- phdr->len = length;
- phdr->caplen = sliceLength;
+ rec->ts.secs = tsecs - mac2unix;
+ rec->ts.nsecs = tusecs * 1000;
+ rec->rec_header.packet_header.len = length;
+ rec->rec_header.packet_header.caplen = sliceLength;
switch (wth->file_encap) {
- case WTAP_ENCAP_IEEE_802_11_AIROPEEK:
- phdr->pseudo_header.ieee_802_11.fcs_len = 0; /* no FCS */
- phdr->pseudo_header.ieee_802_11.decrypted = FALSE;
+ case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+ memset(&rec->rec_header.packet_header.pseudo_header.ieee_802_11, 0, sizeof(rec->rec_header.packet_header.pseudo_header.ieee_802_11));
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.fcs_len = 0; /* no FCS */
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.decrypted = FALSE;
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.datapad = FALSE;
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
+
+ /*
+ * Now process the radio information pseudo-header.
+ * It's a 4-byte pseudo-header, consisting of:
+ *
+ * 1 byte of data rate, in units of 500 kb/s;
+ *
+ * 1 byte of channel number;
+ *
+ * 1 byte of signal strength as a percentage of
+ * the maximum, i.e. (RXVECTOR RSSI/RXVECTOR RSSI_Max)*100,
+ * or, at least, that's what I infer it is, given what
+ * the WildPackets note "Converting Signal Strength
+ * Percentage to dBm Values" says (it also says that
+ * the conversion the percentage to a dBm value is
+ * an adapter-dependent process, so, as we don't know
+ * what type of adapter was used to do the capture,
+ * we can't do the conversion);
+ *
+ * 1 byte of unknown content (padding?).
+ */
+ if (rec->rec_header.packet_header.len < RADIO_INFO_SIZE || rec->rec_header.packet_header.caplen < RADIO_INFO_SIZE) {
+ *err = WTAP_ERR_BAD_FILE;
+ *err_info = g_strdup_printf("peekclassic: 802.11 packet has length < 4");
+ return -1;
+ }
+ rec->rec_header.packet_header.len -= RADIO_INFO_SIZE;
+ rec->rec_header.packet_header.caplen -= RADIO_INFO_SIZE;
+ sliceLength -= RADIO_INFO_SIZE;
+
+ /* read the pseudo-header */
+ if (!wtap_read_bytes(fh, radio_info, RADIO_INFO_SIZE, err, err_info))
+ return -1;
+
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_data_rate = TRUE;
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.data_rate = radio_info[0];
+
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_channel = TRUE;
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.channel = radio_info[1];
+
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_signal_percent = TRUE;
+ rec->rec_header.packet_header.pseudo_header.ieee_802_11.signal_percent = radio_info[2];
/*
* The last 4 bytes appear to be random data - the length
* of junk at the end you get in Wireless Sniffer
* captures.
*/
- if (phdr->len < 4 || phdr->caplen < 4) {
+ if (rec->rec_header.packet_header.len < 4 || rec->rec_header.packet_header.caplen < 4) {
*err = WTAP_ERR_BAD_FILE;
- *err_info = g_strdup_printf("peekclassic: 802.11 packet has length < 4");
+ *err_info = g_strdup_printf("peekclassic: 802.11 packet has length < 8");
return -1;
}
- phdr->len -= 4;
- phdr->caplen -= 4;
+ rec->rec_header.packet_header.len -= 4;
+ rec->rec_header.packet_header.caplen -= 4;
break;
case WTAP_ENCAP_ETHERNET:
/* XXX - it appears that if the low-order bit of
"status" is 0, there's an FCS in this frame,
and if it's 1, there's 4 bytes of 0. */
- phdr->pseudo_header.eth.fcs_len = (status & 0x01) ? 0 : 4;
+ rec->rec_header.packet_header.pseudo_header.eth.fcs_len = (status & 0x01) ? 0 : 4;
break;
}
/* read the packet data */
- if (!wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info))
+ if (!wtap_read_packet_bytes(fh, buf, rec->rec_header.packet_header.caplen, err, err_info))
return -1;
return sliceLength;
*data_offset = file_tell(wth->fh);
/* read the packet */
- if (!peekclassic_read_packet_v56(wth, wth->fh, &wth->phdr,
- wth->frame_buffer, err, err_info))
+ if (!peekclassic_read_packet_v56(wth, wth->fh, &wth->rec,
+ wth->rec_data, err, err_info))
return FALSE;
/*
}
static gboolean peekclassic_seek_read_v56(wtap *wth, gint64 seek_off,
- struct wtap_pkthdr *phdr, Buffer *buf, int length _U_,
- int *err, gchar **err_info)
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
{
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
/* read the packet */
- if (!peekclassic_read_packet_v56(wth, wth->random_fh, phdr, buf,
+ if (!peekclassic_read_packet_v56(wth, wth->random_fh, rec, buf,
err, err_info)) {
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
}
static gboolean peekclassic_read_packet_v56(wtap *wth, FILE_T fh,
- struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
+ wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
{
peekclassic_t *peekclassic = (peekclassic_t *)wth->priv;
guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
#endif
unsigned int i;
- wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), fh, err,
- err_info);
+ if (!wtap_read_bytes_or_eof(fh, ep_pkt, sizeof(ep_pkt), err, err_info))
+ return FALSE;
/* Extract the fields from the packet */
- length = pntohs(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
- sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
+ length = pntoh16(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
+ sliceLength = pntoh16(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
#if 0
flags = ep_pkt[PEEKCLASSIC_V56_FLAGS_OFFSET];
status = ep_pkt[PEEKCLASSIC_V56_STATUS_OFFSET];
#endif
- timestamp = pntohl(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
+ timestamp = pntoh32(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
#if 0
- destNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
- srcNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
+ destNum = pntoh16(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
+ srcNum = pntoh16(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
#endif
- protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
+ protoNum = pntoh16(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
#if 0
memcpy(protoStr, &ep_pkt[PEEKCLASSIC_V56_PROTOSTR_OFFSET],
sizeof protoStr);
if (0 == sliceLength) {
sliceLength = length;
}
+ /*
+ * The maximum value of sliceLength and length are 65535, which
+ * are less than WTAP_MAX_PACKET_SIZE_STANDARD will ever be, so we don't
+ * need to check them.
+ */
/* fill in packet header values */
- phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+ rec->rec_type = REC_TYPE_PACKET;
+ rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
/* timestamp is in milliseconds since reference_time */
- phdr->ts.secs = peekclassic->reference_time.tv_sec
- + (timestamp / 1000);
- phdr->ts.nsecs = 1000 * (timestamp % 1000) * 1000;
- phdr->len = length;
- phdr->caplen = sliceLength;
+ rec->ts.secs = peekclassic->reference_time + (timestamp / 1000);
+ rec->ts.nsecs = 1000 * (timestamp % 1000) * 1000;
+ rec->rec_header.packet_header.len = length;
+ rec->rec_header.packet_header.caplen = sliceLength;
- phdr->pkt_encap = WTAP_ENCAP_UNKNOWN;
+ rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_UNKNOWN;
for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
if (peekclassic_encap[i].protoNum == protoNum) {
- phdr->pkt_encap = peekclassic_encap[i].encap;
+ rec->rec_header.packet_header.pkt_encap = peekclassic_encap[i].encap;
}
}
- switch (phdr->pkt_encap) {
+ switch (rec->rec_header.packet_header.pkt_encap) {
case WTAP_ENCAP_ETHERNET:
/* We assume there's no FCS in this frame. */
- phdr->pseudo_header.eth.fcs_len = 0;
+ rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
break;
}
/* read the packet data */
return wtap_read_packet_bytes(fh, buf, sliceLength, err, err_info);
}
+
+/*
+ * Editor modelines - http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 8
+ * tab-width: 8
+ * indent-tabs-mode: t
+ * End:
+ *
+ * vi: set shiftwidth=8 tabstop=8 noexpandtab:
+ * :indentSize=8:tabSize=8:noTabs=false:
+ */
git.samba.org / metze / wireshark / wip.git / blobdiff