2 * Routines for opening CommView file format packet captures
3 * Copyright 2007, Stephen Fisher (see AUTHORS file)
7 * Wireshark - Network traffic analyzer
8 * By Gerald Combs <gerald@wireshark.org>
9 * Copyright 1998 Gerald Combs
11 * Based on csids.c and nettl.c
13 * This program is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU General Public License
15 * as published by the Free Software Foundation; either version 2
16 * of the License, or (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
29 /* A brief description of this file format is available at:
30 * http://www.tamos.com/htmlhelp/commview/logformat.htm
46 #include "file_wrappers.h"
49 typedef struct commview_header {
51 guint16 source_data_len;
60 guint8 flags; /* Bit-field positions defined below */
65 guint8 direction; /* Not applicable to WiFi packets */
66 guint16 reserved; /* Unused bytes */
69 #define COMMVIEW_HEADER_SIZE 24
71 /* Bit-field positions for various fields in the flags variable of the header */
72 #define FLAGS_MEDIUM 0x0F
73 #define FLAGS_DECRYPTED 0x10
74 #define FLAGS_BROKEN 0x20
75 #define FLAGS_COMPRESSED 0x40
76 #define FLAGS_RESERVED 0x80
78 /* Capture mediums as defined by the commview file format */
79 #define MEDIUM_ETHERNET 0
81 #define MEDIUM_TOKEN_RING 2
83 static gboolean commview_read(wtap *wth, int *err, gchar **err_info _U_,
85 static gboolean commview_seek_read(wtap *wth, gint64 seek_off,
86 union wtap_pseudo_header *pseudo_header,
87 guchar *pd, int length, int *err,
88 gchar **err_info _U_);
89 static gboolean commview_read_header(commview_header_t *cv_hdr, FILE_T fh,
91 static gboolean commview_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
92 const union wtap_pseudo_header *pseudo_header _U_,
93 const guchar *pd, int *err);
95 int commview_open(wtap *wth, int *err, gchar **err_info _U_)
97 commview_header_t cv_hdr;
99 if(!commview_read_header(&cv_hdr, wth->fh, err))
102 /* If any of these fields do not match what we expect, bail out. */
103 if(cv_hdr.version != 0 ||
104 cv_hdr.year < 1970 || cv_hdr.year >= 2038 ||
105 cv_hdr.month < 1 || cv_hdr.month > 12 ||
106 cv_hdr.day < 1 || cv_hdr.day > 31 ||
108 cv_hdr.minutes > 59 ||
109 cv_hdr.seconds > 60 ||
110 cv_hdr.signal_level > 100 ||
111 (cv_hdr.direction != 0x00 && cv_hdr.direction != 0x01 &&
112 cv_hdr.direction != 0x02) ||
113 (cv_hdr.flags & FLAGS_RESERVED) != 0 ||
114 ((cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_ETHERNET &&
115 (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_WIFI &&
116 (cv_hdr.flags & FLAGS_MEDIUM) != MEDIUM_TOKEN_RING) ||
117 cv_hdr.reserved != 0)
118 return 0; /* Not our kind of file */
120 /* No file header. Reset the fh to 0 so we can read the first packet */
121 if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
124 /* Set up the pointers to the handlers for this file type */
125 wth->subtype_read = commview_read;
126 wth->subtype_seek_read = commview_seek_read;
128 wth->data_offset = 0;
129 wth->file_type = WTAP_FILE_COMMVIEW;
130 wth->file_encap = WTAP_ENCAP_PER_PACKET;
131 wth->tsprecision = WTAP_FILE_TSPREC_USEC;
133 return 1; /* Our kind of file */
137 commview_read(wtap *wth, int *err, gchar **err_info _U_, gint64 *data_offset)
139 commview_header_t cv_hdr;
143 *data_offset = wth->data_offset;
145 if(!commview_read_header(&cv_hdr, wth->fh, err))
148 wth->data_offset += COMMVIEW_HEADER_SIZE;
150 switch(cv_hdr.flags & FLAGS_MEDIUM) {
152 case MEDIUM_ETHERNET :
153 wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET;
157 wth->phdr.pkt_encap = WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
160 case MEDIUM_TOKEN_RING :
161 wth->phdr.pkt_encap = WTAP_ENCAP_TOKEN_RING;
164 *err = WTAP_ERR_BAD_RECORD;
165 *err_info = g_strdup_printf("commview: unsupported encap: %u",
166 cv_hdr.flags & FLAGS_MEDIUM);
170 buffer_assure_space(wth->frame_buffer, cv_hdr.data_len);
171 bytes_read = file_read(buffer_start_ptr(wth->frame_buffer), 1,
172 cv_hdr.data_len, wth->fh);
173 if(bytes_read != cv_hdr.data_len) {
174 *err = file_error(wth->fh);
176 *err = WTAP_ERR_SHORT_READ;
180 tm.tm_year = cv_hdr.year - 1900;
181 tm.tm_mon = cv_hdr.month - 1;
182 tm.tm_mday = cv_hdr.day;
183 tm.tm_hour = cv_hdr.hours;
184 tm.tm_min = cv_hdr.minutes;
185 tm.tm_sec = cv_hdr.seconds;
188 wth->data_offset += cv_hdr.data_len;
190 wth->phdr.len = cv_hdr.data_len;
191 wth->phdr.caplen = cv_hdr.data_len;
193 wth->phdr.ts.secs = mktime(&tm);
194 wth->phdr.ts.nsecs = cv_hdr.usecs * 1000;
200 commview_seek_read(wtap *wth, gint64 seek_off, union wtap_pseudo_header
201 *pseudo_header, guchar *pd, int length, int *err,
202 gchar **err_info _U_)
204 commview_header_t cv_hdr;
207 if(file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
210 if(!commview_read_header(&cv_hdr, wth->random_fh, err)) {
212 *err = WTAP_ERR_SHORT_READ;
217 if(length != cv_hdr.data_len) {
218 *err = WTAP_ERR_BAD_RECORD;
219 *err_info = g_strdup_printf("commview: record length %u doesn't match requested length %d", cv_hdr.data_len, length);
223 /* Pass some data to the 802.11 dissector if this is a WiFi packet */
224 if((cv_hdr.flags & FLAGS_MEDIUM) == MEDIUM_WIFI) {
225 pseudo_header->ieee_802_11.fcs_len = -1; /* Unknown */
226 pseudo_header->ieee_802_11.channel = cv_hdr.channel;
227 pseudo_header->ieee_802_11.data_rate = cv_hdr.rate;
228 pseudo_header->ieee_802_11.signal_level = cv_hdr.signal_level;
231 bytes_read = file_read(pd, 1, cv_hdr.data_len, wth->random_fh);
232 if(bytes_read != cv_hdr.data_len) {
233 *err = file_error(wth->random_fh);
235 *err = WTAP_ERR_SHORT_READ;
244 commview_read_header(commview_header_t *cv_hdr, FILE_T fh, int *err)
248 bytes_read += file_read(&cv_hdr->data_len, 2, 1, fh);
249 bytes_read += file_read(&cv_hdr->source_data_len, 2, 1, fh);
250 bytes_read += file_read(&cv_hdr->version, 1, 1, fh);
251 bytes_read += file_read(&cv_hdr->year, 2, 1, fh);
252 bytes_read += file_read(&cv_hdr->month, 1, 1, fh);
253 bytes_read += file_read(&cv_hdr->day, 1, 1, fh);
254 bytes_read += file_read(&cv_hdr->hours, 1, 1, fh);
255 bytes_read += file_read(&cv_hdr->minutes, 1, 1, fh);
256 bytes_read += file_read(&cv_hdr->seconds, 1, 1, fh);
257 bytes_read += file_read(&cv_hdr->usecs, 4, 1, fh);
258 bytes_read += file_read(&cv_hdr->flags, 1, 1, fh);
259 bytes_read += file_read(&cv_hdr->signal_level, 1, 1, fh);
260 bytes_read += file_read(&cv_hdr->rate, 1, 1, fh);
261 bytes_read += file_read(&cv_hdr->band, 1, 1, fh);
262 bytes_read += file_read(&cv_hdr->channel, 1, 1, fh);
263 bytes_read += file_read(&cv_hdr->direction, 1, 1, fh);
264 bytes_read += file_read(&cv_hdr->reserved, 2, 1, fh);
266 /* Convert multi-byte values from little endian to host endian format */
267 cv_hdr->data_len = GUINT16_FROM_LE(cv_hdr->data_len);
268 cv_hdr->source_data_len = GUINT16_FROM_LE(cv_hdr->source_data_len);
269 cv_hdr->year = GUINT16_FROM_LE(cv_hdr->year);
270 cv_hdr->usecs = GUINT32_FROM_LE(cv_hdr->usecs);
272 if(bytes_read < COMMVIEW_HEADER_SIZE) {
273 *err = file_error(fh);
274 if(*err == 0 && bytes_read > 0)
275 *err = WTAP_ERR_SHORT_READ;
283 /* Returns 0 if we can write out the specified encapsulation type
284 * into a CommView format file. */
285 int commview_dump_can_write_encap(int encap)
289 case WTAP_ENCAP_ETHERNET :
290 case WTAP_ENCAP_IEEE_802_11 :
291 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
292 case WTAP_ENCAP_TOKEN_RING :
293 case WTAP_ENCAP_PER_PACKET :
297 return WTAP_ERR_UNSUPPORTED_ENCAP;
301 /* Returns TRUE on success, FALSE on failure;
302 sets "*err" to an error code on failure */
303 gboolean commview_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_,
306 wdh->subtype_write = commview_dump;
307 wdh->subtype_close = NULL;
309 /* There is no file header to write out */
310 wdh->bytes_dumped = 0;
315 /* Write a record for a packet to a dump file.
316 * Returns TRUE on success, FALSE on failure. */
317 static gboolean commview_dump(wtap_dumper *wdh,
318 const struct wtap_pkthdr *phdr,
319 const union wtap_pseudo_header *pseudo_header,
320 const guchar *pd, int *err)
322 commview_header_t cv_hdr;
323 size_t bytes_written = 0;
326 memset(&cv_hdr, 0, sizeof(cv_hdr));
328 cv_hdr.data_len = GUINT16_TO_LE((guint16)phdr->caplen);
329 cv_hdr.source_data_len = GUINT16_TO_LE((guint16)phdr->caplen);
332 strftime(date_time, 5, "%Y", localtime(&phdr->ts.secs));
333 cv_hdr.year = GUINT16_TO_LE((guint16)strtol(date_time, NULL, 10));
335 strftime(date_time, 5, "%m", localtime(&phdr->ts.secs));
336 cv_hdr.month = (guint8)strtol(date_time, NULL, 10);
338 strftime(date_time, 5, "%d", localtime(&phdr->ts.secs));
339 cv_hdr.day = (guint8)strtol(date_time, NULL, 10);
341 strftime(date_time, 5, "%H", localtime(&phdr->ts.secs));
342 cv_hdr.hours = (guint8)strtol(date_time, NULL, 10);
344 strftime(date_time, 5, "%M", localtime(&phdr->ts.secs));
345 cv_hdr.minutes = (guint8)strtol(date_time, NULL, 10);
347 strftime(date_time, 5, "%S", localtime(&phdr->ts.secs));
348 cv_hdr.seconds = (guint8)strtol(date_time, NULL, 10);
350 cv_hdr.usecs = GUINT32_TO_LE(phdr->ts.nsecs / 1000);
352 switch(phdr->pkt_encap) {
354 case WTAP_ENCAP_ETHERNET :
355 cv_hdr.flags |= MEDIUM_ETHERNET;
358 case WTAP_ENCAP_IEEE_802_11 :
359 cv_hdr.flags |= MEDIUM_WIFI;
362 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO :
363 cv_hdr.flags |= MEDIUM_WIFI;
365 cv_hdr.channel = pseudo_header->ieee_802_11.channel;
366 cv_hdr.rate = pseudo_header->ieee_802_11.data_rate;
367 cv_hdr.signal_level = pseudo_header->ieee_802_11.signal_level;
371 case WTAP_ENCAP_TOKEN_RING :
372 cv_hdr.flags |= MEDIUM_TOKEN_RING;
375 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
379 bytes_written += fwrite(&cv_hdr.data_len, 2, 1, wdh->fh);
380 bytes_written += fwrite(&cv_hdr.source_data_len, 2, 1, wdh->fh);
381 bytes_written += fwrite(&cv_hdr.version, 1, 1, wdh->fh);
382 bytes_written += fwrite(&cv_hdr.year, 2, 1, wdh->fh);
383 bytes_written += fwrite(&cv_hdr.month, 1, 1, wdh->fh);
384 bytes_written += fwrite(&cv_hdr.day, 1, 1, wdh->fh);
385 bytes_written += fwrite(&cv_hdr.hours, 1, 1, wdh->fh);
386 bytes_written += fwrite(&cv_hdr.minutes, 1, 1, wdh->fh);
387 bytes_written += fwrite(&cv_hdr.seconds, 1, 1, wdh->fh);
388 bytes_written += fwrite(&cv_hdr.usecs, 4, 1, wdh->fh);
389 bytes_written += fwrite(&cv_hdr.flags, 1, 1, wdh->fh);
390 bytes_written += fwrite(&cv_hdr.signal_level, 1, 1, wdh->fh);
391 bytes_written += fwrite(&cv_hdr.rate, 1, 1, wdh->fh);
392 bytes_written += fwrite(&cv_hdr.band, 1, 1, wdh->fh);
393 bytes_written += fwrite(&cv_hdr.channel, 1, 1, wdh->fh);
394 bytes_written += fwrite(&cv_hdr.direction, 1, 1, wdh->fh);
395 bytes_written += fwrite(&cv_hdr.reserved, 2, 1, wdh->fh);
397 if(bytes_written != 17) { /* 17 units of data should have been written
399 if(bytes_written == 0 && ferror(wdh->fh))
402 *err = WTAP_ERR_SHORT_WRITE;
407 wdh->bytes_dumped += COMMVIEW_HEADER_SIZE;
409 bytes_written = fwrite(pd, 1, phdr->caplen, wdh->fh);
411 if(bytes_written != phdr->caplen) {
412 if(bytes_written == 0 && ferror(wdh->fh))
415 *err = WTAP_ERR_SHORT_WRITE;
420 wdh->bytes_dumped += phdr->caplen;