wiretap/erf.c

   1 /*
   2 *
   3 * Copyright (c) 2003 Endace Technology Ltd, Hamilton, New Zealand.
   4 * All rights reserved.
   5 *
   6 * This software and documentation has been developed by Endace Technology Ltd.
   7 * along with the DAG PCI network capture cards. For further information please
   8 * visit http://www.endace.com/.
   9 *
  10 * Redistribution and use in source and binary forms, with or without
  11 * modification, are permitted provided that the following conditions are met:
  12 *
  13 *  1. Redistributions of source code must retain the above copyright notice,
  14 *  this list of conditions and the following disclaimer.
  15 *
  16 *  2. Redistributions in binary form must reproduce the above copyright
  17 *  notice, this list of conditions and the following disclaimer in the
  18 *  documentation and/or other materials provided with the distribution.
  19 *
  20 *  3. The name of Endace Technology Ltd may not be used to endorse or promote
  21 *  products derived from this software without specific prior written
  22 *  permission.
  23 *
  24 * THIS SOFTWARE IS PROVIDED BY ENDACE TECHNOLOGY LTD ``AS IS'' AND ANY EXPRESS
  25 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
  27 * EVENT SHALL ENDACE TECHNOLOGY LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  29 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  30 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  31 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33 * POSSIBILITY OF SUCH DAMAGE.
  34 *
  35 * $Id$
  36 */
  37
  38 /*
  39  * erf - Endace ERF (Extensible Record Format)
  40  *
  41  * See
  42  *
  43  *      http://www.endace.com/support/EndaceRecordFormat.pdf
  44  */
  45
  46 #ifdef HAVE_CONFIG_H
  47 #include "config.h"
  48 #endif
  49
  50 #include <stdlib.h>
  51 #include <string.h>
  52
  53 #include "wtap-int.h"
  54 #include "file_wrappers.h"
  55 #include "buffer.h"
  56 #include "atm.h"
  57 #include "erf.h"
  58
  59 typedef guint32 atm_hdr_t;
  60
  61 static int erf_read_header(
  62                 FILE_T fh,
  63                 struct wtap_pkthdr *phdr,
  64                 union wtap_pseudo_header *pseudo_header,
  65                 erf_header_t *erf_header,
  66                 erf_t *erf,
  67                 int *err,
  68                 gchar **err_info,
  69                 guint32 *bytes_read,
  70                 guint32 *packet_size);
  71 static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
  72                 gint64 *data_offset);
  73 static gboolean erf_seek_read(wtap *wth, gint64 seek_off,
  74                 union wtap_pseudo_header *pseudo_header, guchar *pd,
  75                 int length, int *err, gchar **err_info);
  76 static void erf_close(wtap *wth);
  77 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap);
  78 static void erf_set_pseudo_header(
  79                 guint8 type,
  80                 erf_t *erf,
  81                 guchar *pd,
  82                 int length,
  83                 union wtap_pseudo_header *pseudo_header);
  84
  85 int erf_open(wtap *wth, int *err, gchar **err_info _U_)
  86 {
  87         guint32 i, n;
  88         char *s;
  89         guint32 records_for_erf_check = RECORDS_FOR_ERF_CHECK;
  90         guint32 atm_encap = WTAP_ENCAP_ATM_PDUS;
  91         gboolean is_rawatm = FALSE;
  92         gboolean is_ppp = FALSE;
  93         int common_type = 0;
  94         erf_timestamp_t prevts;
  95
  96         memset(&prevts, 0, sizeof(prevts));
  97
  98         if ((s = getenv("ERF_ATM_ENCAP")) != NULL) {
  99                 if (!strcmp(s, "sunatm")) {
 100                         atm_encap = WTAP_ENCAP_ATM_PDUS;
 101                 } else
 102                 if (!strcmp(s, "sunraw")) {
 103                         atm_encap = WTAP_ENCAP_ATM_PDUS;
 104                         is_rawatm = TRUE;
 105                 } else
 106                 if (!strcmp(s, "rfc1483")) {
 107                         atm_encap = WTAP_ENCAP_ATM_RFC1483;
 108                 }
 109         }
 110
 111         /* number of records to scan before deciding if this really is ERF (dflt=3) */
 112         if ((s = getenv("ERF_RECORDS_TO_CHECK")) != NULL) {
 113                 if ((n = atoi(s)) > 0 && n < 101) {
 114                         records_for_erf_check = n;
 115                 }
 116         }
 117
 118         /* ERF is a little hard because there's no magic number */
 119
 120         for (i = 0; i < records_for_erf_check; i++) {
 121
 122                 erf_header_t header;
 123                 guint32 packet_size;
 124                 erf_timestamp_t ts;
 125
 126                 int r = file_read(&header,1,sizeof(header),wth->fh);
 127
 128                 if (r == 0 ) break;
 129                 if (r != sizeof(header)) {
 130                         if ((*err = file_error(wth->fh)) != 0)
 131                                 return -1;
 132                         else
 133                         return 0;
 134                 }
 135
 136                 packet_size = g_ntohs(header.rlen) - sizeof(header);
 137
 138                 /* fail on invalid record type, decreasing timestamps or non-zero pad-bits */
 139                 /* Only header type up to Multi Channel HDLC are taken into account in this software version */
 140                 if (header.type == 0 || header.type > TYPE_MC_HDLC ) {
 141                         return 0;
 142                 }
 143
 144                 if ((ts = pletohll(&header.ts)) < prevts) {
 145                         /* reassembled AAL5 records may not be in time order, so allow 1 sec fudge */
 146                         if (header.type != TYPE_AAL5 || ((prevts-ts)>>32) > 1) {
 147                                 return 0;
 148                         }
 149                 }
 150                 memcpy(&prevts, &ts, sizeof(prevts));
 151
 152                 if (common_type == 0) {
 153                         common_type = header.type;
 154                 } else
 155                 if (common_type > 0 && common_type != header.type) {
 156                         common_type = -1;
 157                 }
 158
 159                 if (header.type == TYPE_HDLC_POS && !is_ppp) {
 160                         guint16 chdlc_hdr;
 161                         if (file_read(&chdlc_hdr,1,sizeof(chdlc_hdr),wth->fh) != sizeof(chdlc_hdr)) {
 162                                 *err = file_error(wth->fh);
 163                         }
 164                         packet_size -= sizeof(chdlc_hdr);
 165                         if (g_ntohs(chdlc_hdr) == 0xff03) {
 166                                 is_ppp = TRUE;
 167                         }
 168                 }
 169
 170                 if (file_seek(wth->fh, packet_size, SEEK_CUR, err) == -1) {
 171                         return -1;
 172                 }
 173         }
 174
 175         if (file_seek(wth->fh, 0L, SEEK_SET, err) == -1) {      /* rewind */
 176                 return -1;
 177         }
 178
 179         wth->data_offset = 0;
 180
 181         /* This is an ERF file */
 182         wth->file_type = WTAP_FILE_ERF;
 183         wth->snapshot_length = 0;       /* not available in header, only in frame */
 184         wth->capture.erf = g_malloc(sizeof(erf_t));
 185         wth->capture.erf->is_ppp = is_ppp;
 186         if (common_type == TYPE_AAL5) {
 187                 wth->capture.erf->atm_encap = WTAP_ENCAP_ATM_PDUS_UNTRUNCATED;
 188                 wth->capture.erf->is_rawatm = FALSE;
 189         } else {
 190                 wth->capture.erf->atm_encap = atm_encap;
 191                 wth->capture.erf->is_rawatm = is_rawatm;
 192         }
 193
 194         /*
 195          * Really want WTAP_ENCAP_PER_PACKET here but that severely limits
 196          * the number of output formats we can write to. If all the records
 197          * tested in the loop above were the same encap then use that one,
 198          * otherwise use WTAP_ENCAP_PER_PACKET.
 199          */
 200         wth->file_encap =
 201                 (common_type < 0
 202                         ? WTAP_ENCAP_PER_PACKET
 203                         : erf_encap_to_wtap_encap(wth->capture.erf, (guint8) common_type));
 204
 205         wth->subtype_read = erf_read;
 206         wth->subtype_seek_read = erf_seek_read;
 207         wth->subtype_close = erf_close;
 208     wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
 209
 210         return 1;
 211 }
 212
 213 /* Read the next packet */
 214 static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
 215     gint64 *data_offset)
 216 {
 217         erf_header_t erf_header;
 218         guint32 packet_size, bytes_read;
 219         gint32 offset = 0;
 220
 221         *data_offset = wth->data_offset;
 222
 223         if (!erf_read_header(
 224                         wth->fh,
 225                         &wth->phdr, &wth->pseudo_header, &erf_header, wth->capture.erf,
 226                         err, err_info, &bytes_read, &packet_size)) {
 227                 return FALSE;
 228         }
 229         wth->data_offset += bytes_read;
 230
 231         buffer_assure_space(wth->frame_buffer, packet_size+(wth->capture.erf->is_rawatm?(sizeof(atm_hdr_t)+1):0));
 232
 233         if (wth->capture.erf->is_rawatm) {
 234                 wtap_file_read_expected_bytes(
 235                         buffer_start_ptr(wth->frame_buffer), (gint32)sizeof(atm_hdr_t), wth->fh, err
 236                 );
 237                 wth->data_offset += sizeof(atm_hdr_t);
 238                 packet_size -= sizeof(atm_hdr_t);
 239                 offset += sizeof(atm_hdr_t)+1;
 240         }
 241
 242         wtap_file_read_expected_bytes(
 243                 buffer_start_ptr(wth->frame_buffer)+offset, (gint32)packet_size, wth->fh, err
 244         );
 245         wth->data_offset += packet_size;
 246
 247         erf_set_pseudo_header(
 248                         erf_header.type, wth->capture.erf,
 249                         buffer_start_ptr(wth->frame_buffer), packet_size, &wth->pseudo_header
 250         );
 251
 252         return TRUE;
 253 }
 254
 255 static gboolean erf_seek_read(wtap *wth, gint64 seek_off,
 256                 union wtap_pseudo_header *pseudo_header, guchar *pd,
 257                 int length, int *err, gchar **err_info)
 258 {
 259         erf_header_t erf_header;
 260         guint32 packet_size;
 261         int offset = 0;
 262
 263         if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 264                 return FALSE;
 265
 266         if (!erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header,
 267             wth->capture.erf, err, err_info, NULL, &packet_size))
 268                 return FALSE;
 269
 270         if (wth->capture.erf->is_rawatm) {
 271                 wtap_file_read_expected_bytes(pd, (int)sizeof(atm_hdr_t), wth->random_fh, err);
 272                 packet_size -= sizeof(atm_hdr_t);
 273                 offset += sizeof(atm_hdr_t)+1;
 274         }
 275
 276         wtap_file_read_expected_bytes(pd+offset, (int)packet_size, wth->random_fh, err);
 277
 278         erf_set_pseudo_header(erf_header.type, wth->capture.erf, pd, length, pseudo_header);
 279
 280         return TRUE;
 281 }
 282
 283 static void erf_close(wtap *wth)
 284 {
 285     g_free(wth->capture.erf);
 286 }
 287
 288 static int erf_read_header(
 289         FILE_T fh,
 290         struct wtap_pkthdr *phdr,
 291         union wtap_pseudo_header *pseudo_header,
 292         erf_header_t *erf_header,
 293         erf_t *erf,
 294         int *err,
 295         gchar **err_info,
 296         guint32 *bytes_read,
 297         guint32 *packet_size)
 298 {
 299         guint32 rec_size, skip;
 300
 301         wtap_file_read_expected_bytes(erf_header, sizeof(*erf_header), fh, err);
 302         if (bytes_read != NULL) {
 303                 *bytes_read = sizeof(*erf_header);
 304         }
 305
 306         rec_size = g_ntohs(erf_header->rlen);
 307         *packet_size = rec_size - sizeof(*erf_header);
 308         skip = 0; /* # bytes of payload to ignore */
 309
 310         if (*packet_size > WTAP_MAX_PACKET_SIZE) {
 311                 /*
 312                  * Probably a corrupt capture file; don't blow up trying
 313                  * to allocate space for an immensely-large packet.
 314                  */
 315                 *err = WTAP_ERR_BAD_RECORD;
 316                 *err_info = g_strdup_printf("erf: File has %u-byte packet, bigger than maximum of %u",
 317                     *packet_size, WTAP_MAX_PACKET_SIZE);
 318                 return FALSE;
 319         }
 320
 321         if (phdr != NULL) {
 322                 guint64 ts = pletohll(&erf_header->ts);
 323
 324                 phdr->ts.secs = (long) (ts >> 32);
 325                 ts = ((ts & 0xffffffff) * 1000 * 1000);
 326                 ts += (ts & 0x80000000) << 1; /* rounding */
 327                 phdr->ts.nsecs = ((long) (ts >> 32)) * 1000;
 328                 if (phdr->ts.nsecs >= 1000000000) {
 329                         phdr->ts.nsecs -= 1000000000;
 330                         phdr->ts.secs += 1;
 331                 }
 332         }
 333
 334         switch (erf_header->type) {
 335
 336         case TYPE_ATM:
 337         case TYPE_AAL5:
 338                 if (phdr != NULL) {
 339                         if (erf_header->type == TYPE_AAL5) {
 340                                 phdr->caplen = phdr->len = *packet_size - sizeof(atm_hdr_t);
 341                         } else {
 342                                 phdr->caplen = ATM_SLEN(erf_header, NULL);
 343                                 phdr->len = ATM_WLEN(erf_header, NULL);
 344                         }
 345                 }
 346
 347                 if (erf->atm_encap == WTAP_ENCAP_ATM_PDUS || erf->atm_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED) {
 348                         memset(&pseudo_header->atm, 0, sizeof(pseudo_header->atm));
 349                         if (erf->is_rawatm) {
 350                                 pseudo_header->atm.flags = ATM_RAW_CELL;
 351                                 if (phdr != NULL) {
 352                                         phdr->caplen += sizeof(atm_hdr_t)+1;
 353                                         phdr->len += sizeof(atm_hdr_t)+1;
 354                                 }
 355                         } else {
 356                                 atm_hdr_t atm_hdr;
 357
 358                                 wtap_file_read_expected_bytes(&atm_hdr, sizeof(atm_hdr), fh, err);
 359                                 if (bytes_read != NULL) {
 360                                         *bytes_read += sizeof(atm_hdr);
 361                                 }
 362                                 *packet_size -= sizeof(atm_hdr);
 363
 364                                 atm_hdr = g_ntohl(atm_hdr);
 365
 366                                 pseudo_header->atm.vpi = ((atm_hdr & 0x0ff00000) >> 20);
 367                                 pseudo_header->atm.vci = ((atm_hdr & 0x000ffff0) >>  4);
 368                                 pseudo_header->atm.channel = (erf_header->flags & 0x03);
 369                         }
 370                 } else {
 371                         skip = 4;
 372                 }
 373                 break;
 374         case TYPE_ETH:
 375                 if (phdr != NULL) {
 376                         phdr->caplen = ETHERNET_SLEN(erf_header, erf);
 377                         phdr->len = ETHERNET_WLEN(erf_header, erf);
 378                 }
 379                 skip = 2;
 380                 break;
 381         case TYPE_HDLC_POS:
 382                 if (phdr != NULL) {
 383                         phdr->caplen = HDLC_SLEN(erf_header, erf);
 384                         phdr->len = HDLC_WLEN(erf_header, erf);
 385                 }
 386                 memset(&pseudo_header->p2p, 0, sizeof(pseudo_header->p2p));
 387                 pseudo_header->p2p.sent = ((erf_header->flags & 0x01) ? TRUE : FALSE);
 388                 break;
 389         case TYPE_MC_HDLC:
 390                 if (phdr != NULL) {
 391                   phdr->caplen = MC_HDLC_SLEN(erf_header, erf);
 392                   phdr->len = MC_HDLC_WLEN(erf_header, erf);
 393                 }
 394                 /* Skip the MC header, so the first data to dissect will be the MTP2 header */
 395                 skip = 4;
 396                 memset(&pseudo_header->mtp2, 0, sizeof(pseudo_header->mtp2));
 397                 break;
 398         default:
 399                 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 400                 *err_info = g_strdup_printf("erf: unknown record encapsulation %u",
 401                     erf_header->type);
 402                 return FALSE;
 403         }
 404
 405         if (phdr != NULL) {
 406                 phdr->pkt_encap = erf_encap_to_wtap_encap(erf, erf_header->type);
 407         }
 408
 409         if (skip > 0) {
 410                 if (file_seek(fh, skip, SEEK_CUR, err) == -1) {
 411                         return FALSE;
 412                 }
 413                 if (bytes_read != NULL) {
 414                         *bytes_read += skip;
 415                 }
 416                 *packet_size -= skip;
 417         }
 418
 419         return TRUE;
 420 }
 421
 422 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap)
 423 {
 424         int wtap_encap = WTAP_ENCAP_UNKNOWN;
 425
 426         switch (erf_encap) {
 427         case TYPE_ATM:
 428         case TYPE_AAL5:
 429                 wtap_encap = erf->atm_encap;
 430                 break;
 431         case TYPE_ETH:
 432                 wtap_encap = WTAP_ENCAP_ETHERNET;
 433                 break;
 434         case TYPE_HDLC_POS:
 435                 wtap_encap = (erf->is_ppp ? WTAP_ENCAP_PPP : WTAP_ENCAP_CHDLC);
 436                 break;
 437         case TYPE_MC_HDLC:
 438                 wtap_encap = WTAP_ENCAP_MTP2;
 439                 break;
 440         default:
 441                 break;
 442         }
 443
 444         return wtap_encap;
 445 }
 446
 447 static void erf_set_pseudo_header(
 448         guint8 type, erf_t *erf, guchar *pd, int length, union wtap_pseudo_header *pseudo_header)
 449 {
 450         if (type == TYPE_ETH) {
 451                 /*
 452                  * We don't know whether there's an FCS in this frame or not.
 453                  */
 454                 pseudo_header->eth.fcs_len = -1;
 455         } else
 456         if (!erf->is_rawatm &&
 457                         (type == TYPE_ATM || type == TYPE_AAL5) &&
 458                         (erf->atm_encap == WTAP_ENCAP_ATM_PDUS ||
 459                          erf->atm_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED)) {
 460                 atm_guess_traffic_type(pd, length, pseudo_header);
 461         } else
 462         if (type == TYPE_AAL5) {
 463                 pseudo_header->atm.aal = AAL_5;
 464                 pseudo_header->atm.type = TRAF_UNKNOWN;
 465                 pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
 466         }
 467 }