/* snoop.c
*
- * $Id: snoop.c,v 1.32 2000/09/21 04:41:36 gram Exp $
+ * $Id$
*
* Wiretap Library
- * Copyright (c) 1998 by Gilbert Ramirez <gram@xiexie.org>
- *
+ * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- *
*/
+
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include <errno.h>
+#include <string.h>
#include "wtap-int.h"
#include "file_wrappers.h"
#include "buffer.h"
+#include "atm.h"
#include "snoop.h"
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-
/* See RFC 1761 for a description of the "snoop" file format. */
/* Magic number in "snoop" files. */
guint32 ts_usec; /* timestamp microseconds */
};
-static gboolean snoop_read(wtap *wth, int *err, int *data_offset);
-static int snoop_seek_read(wtap *wth, int seek_off,
- union wtap_pseudo_header *pseudo_header, u_char *pd, int length);
-static int snoop_read_atm_pseudoheader(FILE_T fh,
+/*
+ * The link-layer header on ATM packets.
+ */
+struct snoop_atm_hdr {
+ guint8 flags; /* destination and traffic type */
+ guint8 vpi; /* VPI */
+ guint16 vci; /* VCI */
+};
+
+/*
+ * Extra information stuffed into the padding in Shomiti/Finisar Surveyor
+ * captures.
+ */
+struct shomiti_trailer {
+ guint16 phy_rx_length; /* length on the wire, including FCS? */
+ guint16 phy_rx_status; /* status flags */
+ guint32 ts_40_ns_lsb; /* 40 ns time stamp, low-order bytes? */
+ guint32 ts_40_ns_msb; /* 40 ns time stamp, low-order bytes? */
+ gint32 frame_id; /* "FrameID"? */
+};
+
+/*
+ * phy_rx_status flags.
+ */
+#define RX_STATUS_OVERFLOW 0x8000 /* overflow error */
+#define RX_STATUS_BAD_CRC 0x4000 /* CRC error */
+#define RX_STATUS_DRIBBLE_NIBBLE 0x2000 /* dribble/nibble bits? */
+#define RX_STATUS_SHORT_FRAME 0x1000 /* frame < 64 bytes */
+#define RX_STATUS_OVERSIZE_FRAME 0x0800 /* frame > 1518 bytes */
+#define RX_STATUS_GOOD_FRAME 0x0400 /* frame OK */
+#define RX_STATUS_N12_BYTES_RECEIVED 0x0200 /* first 12 bytes of frame received? */
+#define RX_STATUS_RXABORT 0x0100 /* RXABORT during reception */
+#define RX_STATUS_FIFO_ERROR 0x0080 /* receive FIFO error */
+#define RX_STATUS_TRIGGERED 0x0001 /* frame did trigger */
+
+static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
+ gint64 *data_offset);
+static gboolean snoop_seek_read(wtap *wth, gint64 seek_off,
+ union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+ int *err, gchar **err_info);
+static gboolean snoop_read_atm_pseudoheader(FILE_T fh,
+ union wtap_pseudo_header *pseudo_header, int *err);
+static gboolean snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
union wtap_pseudo_header *pseudo_header, int *err);
-static int snoop_read_rec_data(FILE_T fh, u_char *pd, int length, int *err);
+static gboolean snoop_read_rec_data(FILE_T fh, guchar *pd, int length,
+ int *err);
static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
- const union wtap_pseudo_header *pseudo_header, const u_char *pd, int *err);
+ const union wtap_pseudo_header *pseudo_header, const guchar *pd, int *err);
/*
* See
- *
+ *
* http://www.opengroup.org/onlinepubs/9638599/apdxf.htm
*
* for the "dlpi.h" header file specified by The Open Group, which lists
*
* http://mrpink.lerc.nasa.gov/118x/support.html
*
- * has links to modified versions of "tcpdump" and "libpcap" for SUNatm
- * DLPI support; they suggest the 3.0 verson of SUNatm uses those
- * values.
+ * had links to modified versions of "tcpdump" and "libpcap" for SUNatm
+ * DLPI support; they suggested that the 3.0 verson of SUNatm uses those
+ * values. The Wayback Machine archived that page, but not the stuff
+ * to which it linked, unfortunately.
*
* It also has a link to "convert.c", which is a program to convert files
* from the format written by the "atmsnoop" program that comes with the
*
* Source to an "atmdump" package, which includes a modified version of
* "libpcap" to handle SunATM DLPI and an ATM driver for FreeBSD, and
- * also includes "atmdump", which is a modified "tcpdump", says that an
+ * also includes "atmdump", which is a modified "tcpdump", is available
+ * at
+ *
+ * ftp://ftp.cs.ndsu.nodak.edu/pub/freebsd/atm/atm-bpf.tgz
+ *
+ * and that code also indicates that DL_IPATM is used, and that an
* ATM packet handed up from the Sun driver for the Sun SBus ATM card on
* Solaris 2.5.1 has 1 byte of direction, 1 byte of VPI, 2 bytes of VCI,
- * and then the ATM PDU, and suggests that the direction byte is 0x80 for
+ * and then the ATM PDU, and suggests that the direction flag is 0x80 for
* "transmitted" (presumably meaning DTE->DCE) and presumably not 0x80 for
- * "received" (presumably meaning DCE->DTE).
+ * "received" (presumably meaning DCE->DTE). That code was used as the
+ * basis for the SunATM support in current CVS versions of libpcap and
+ * tcpdump, and it works.
*
* In fact, the "direction" byte appears to have some other stuff, perhaps
* a traffic type, in the lower 7 bits, with the 8th bit indicating the
- * direction.
+ * direction. That appears to be the case.
*
* I don't know what the encapsulation of any of the other types is, so I
- * leave them all as WTAP_ENCAP_UNKNOWN. I also don't know whether "snoop"
- * can handle any of them (it presumably can't handle ATM, otherwise Sun
- * wouldn't have supplied "atmsnoop"; even if it can't, this may be useful
- * reference information for anybody doing code to use DLPI to do raw packet
- * captures on those network types.
+ * leave them all as WTAP_ENCAP_UNKNOWN, except for those for which Brian
+ * Ginsbach has supplied information about the way UNICOS/mp uses them.
+ * I also don't know whether "snoop" can handle any of them (it presumably
+ * can't handle ATM, otherwise Sun wouldn't have supplied "atmsnoop"; even
+ * if it can't, this may be useful reference information for anybody doing
+ * code to use DLPI to do raw packet captures on those network types.
+ *
+ * See
+ *
+ * http://web.archive.org/web/20010906213807/http://www.shomiti.com/support/TNCapFileFormat.htm
+ *
+ * for information on Shomiti's mutant flavor of snoop. For some unknown
+ * unknown reason, they decided not to just Go With The DLPI Flow, and
+ * instead used the types unspecified in RFC 1461 for their own nefarious
+ * purposes, such as distinguishing 10MB from 100MB from 1000MB Ethernet
+ * and distinguishing 4MB from 16MB Token Ring, and distinguishing both
+ * of them from the "Shomiti" versions of same.
*/
-int snoop_open(wtap *wth, int *err)
+int snoop_open(wtap *wth, int *err, gchar **err_info)
{
int bytes_read;
char magic[sizeof snoop_magic];
struct snoop_hdr hdr;
+ struct snooprec_hdr rec_hdr;
+ guint padbytes;
+ gboolean is_shomiti;
static const int snoop_encap[] = {
WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
WTAP_ENCAP_UNKNOWN, /* IEEE 802.4 Token Bus */
WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
WTAP_ENCAP_FDDI_BITSWAPPED,
- WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_NULL, /* Other */
WTAP_ENCAP_UNKNOWN, /* Frame Relay LAPF */
WTAP_ENCAP_UNKNOWN, /* Multi-protocol over Frame Relay */
WTAP_ENCAP_UNKNOWN, /* Character Async (e.g., SLIP and PPP?) */
WTAP_ENCAP_UNKNOWN, /* X.25 Classical IP */
- WTAP_ENCAP_UNKNOWN, /* software loopback */
+ WTAP_ENCAP_NULL, /* software loopback */
WTAP_ENCAP_UNKNOWN, /* not defined in "dlpi.h" */
- WTAP_ENCAP_UNKNOWN, /* Fibre Channel */
+ WTAP_ENCAP_IP_OVER_FC, /* Fibre Channel */
WTAP_ENCAP_UNKNOWN, /* ATM */
- WTAP_ENCAP_ATM_SNIFFER, /* ATM Classical IP */
+ WTAP_ENCAP_ATM_PDUS, /* ATM Classical IP */
WTAP_ENCAP_UNKNOWN, /* X.25 LAPB */
WTAP_ENCAP_UNKNOWN, /* ISDN */
WTAP_ENCAP_UNKNOWN, /* HIPPI */
WTAP_ENCAP_UNKNOWN, /* 100BaseT (but that's just Ethernet) */
};
#define NUM_SNOOP_ENCAPS (sizeof snoop_encap / sizeof snoop_encap[0])
+ static const int shomiti_encap[] = {
+ WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
+ WTAP_ENCAP_UNKNOWN, /* IEEE 802.4 Token Bus */
+ WTAP_ENCAP_TOKEN_RING,
+ WTAP_ENCAP_UNKNOWN, /* IEEE 802.6 Metro Net */
+ WTAP_ENCAP_ETHERNET,
+ WTAP_ENCAP_UNKNOWN, /* HDLC */
+ WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
+ WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
+ WTAP_ENCAP_FDDI_BITSWAPPED,
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_ETHERNET, /* Fast Ethernet */
+ WTAP_ENCAP_TOKEN_RING, /* 4MB 802.5 token ring */
+ WTAP_ENCAP_ETHERNET, /* Gigabit Ethernet */
+ WTAP_ENCAP_TOKEN_RING, /* "IEEE 802.5 Shomiti" */
+ WTAP_ENCAP_TOKEN_RING, /* "4MB IEEE 802.5 Shomiti" */
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_UNKNOWN, /* Other */
+ WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
+ };
+ #define NUM_SHOMITI_ENCAPS (sizeof shomiti_encap / sizeof shomiti_encap[0])
+ int file_encap;
/* Read in the string that should be at the start of a "snoop" file */
- file_seek(wth->fh, 0, SEEK_SET);
- wth->data_offset = 0;
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(magic, 1, sizeof magic, wth->fh);
if (bytes_read != sizeof magic) {
}
wth->data_offset += sizeof hdr;
- hdr.version = ntohl(hdr.version);
+ /*
+ * Make sure it's a version we support.
+ */
+ hdr.version = g_ntohl(hdr.version);
switch (hdr.version) {
case 2: /* Solaris 2.x and later snoop, and Shomiti
- Surveyor prior to 3.x */
- case 4: /* Shomiti Surveyor 3.x */
+ Surveyor prior to 3.0, or 3.0 and later
+ with NDIS card */
+ case 3: /* Surveyor 3.0 and later, with Shomiti CMM2 hardware */
+ case 4: /* Surveyor 3.0 and later, with Shomiti GAM hardware */
+ case 5: /* Surveyor 3.0 and later, with Shomiti THG hardware */
break;
default:
- g_message("snoop: version %u unsupported", hdr.version);
*err = WTAP_ERR_UNSUPPORTED;
+ *err_info = g_strdup_printf("snoop: version %u unsupported", hdr.version);
return -1;
}
- hdr.network = ntohl(hdr.network);
- if (hdr.network >= NUM_SNOOP_ENCAPS
- || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
- g_message("snoop: network type %u unknown or unsupported",
- hdr.network);
- *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+
+ /*
+ * Oh, this is lovely.
+ *
+ * I suppose Shomiti could give a bunch of lawyerly noise about
+ * how "well, RFC 1761 said they were unassigned, and that's
+ * the standard, not the DLPI header file, so it's perfectly OK
+ * for us to use them, blah blah blah", but it's still irritating
+ * as hell that they used the unassigned-in-RFC-1761 values for
+ * their own purposes - especially given that Sun also used
+ * one of them in atmsnoop.
+ *
+ * We can't determine whether it's a Shomiti capture based on
+ * the version number, as, according to their documentation on
+ * their capture file format, Shomiti uses a version number of 2
+ * if the data "was captured using an NDIS card", which presumably
+ * means "captured with an ordinary boring network card via NDIS"
+ * as opposed to "captured with our whizzo special capture
+ * hardware".
+ *
+ * The only way I can see to determine that is to check how much
+ * padding there is in the first packet - if there's enough
+ * padding for a Shomiti trailer, it's probably a Shomiti
+ * capture, and otherwise, it's probably from Snoop.
+ */
+
+ /*
+ * Start out assuming it's not a Shomiti capture.
+ */
+ is_shomiti = FALSE;
+
+ /* Read first record header. */
+ errno = WTAP_ERR_CANT_READ;
+ bytes_read = file_read(&rec_hdr, 1, sizeof rec_hdr, wth->fh);
+ if (bytes_read != sizeof rec_hdr) {
+ *err = file_error(wth->fh);
+ if (*err == 0 && bytes_read != 0)
+ *err = WTAP_ERR_SHORT_READ;
+ if (*err != 0) {
+ /*
+ * A real-live error.
+ */
+ return -1;
+ }
+
+ /*
+ * The file ends after the record header, which means this
+ * is a capture with no packets.
+ *
+ * We assume it's a snoop file; the actual type of file is
+ * irrelevant, as there are no records in it, and thus no
+ * extra information if it's a Shomiti capture, and no
+ * link-layer headers whose type we have to know, and no
+ * Ethernet frames that might have an FCS.
+ */
+ } else {
+ /*
+ * Compute the number of bytes of padding in the
+ * record. If it's at least the size of a Shomiti
+ * trailer record, we assume this is a Shomiti
+ * capture. (Some atmsnoop captures appear
+ * to have 4 bytes of padding, and at least one
+ * snoop capture appears to have 6 bytes of padding;
+ * the Shomiti header is larger than either of those.)
+ */
+ if (g_ntohl(rec_hdr.rec_len) >
+ (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len))) {
+ /*
+ * Well, we have padding; how much?
+ */
+ padbytes = g_ntohl(rec_hdr.rec_len) -
+ ((guint)sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
+
+ /*
+ * Is it at least the size of a Shomiti trailer?
+ */
+ is_shomiti =
+ (padbytes >= sizeof (struct shomiti_trailer));
+ }
+ }
+
+ /*
+ * Seek back to the beginning of the first record.
+ */
+ if (file_seek(wth->fh, wth->data_offset, SEEK_SET, err) == -1)
return -1;
+
+ hdr.network = g_ntohl(hdr.network);
+ if (is_shomiti) {
+ if (hdr.network >= NUM_SHOMITI_ENCAPS
+ || shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
+ *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+ *err_info = g_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
+ hdr.network);
+ return -1;
+ }
+ file_encap = shomiti_encap[hdr.network];
+
+ /* This is a Shomiti file */
+ wth->file_type = WTAP_FILE_SHOMITI;
+ } else {
+ if (hdr.network >= NUM_SNOOP_ENCAPS
+ || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
+ *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+ *err_info = g_strdup_printf("snoop: network type %u unknown or unsupported",
+ hdr.network);
+ return -1;
+ }
+ file_encap = snoop_encap[hdr.network];
+
+ /* This is a snoop file */
+ wth->file_type = WTAP_FILE_SNOOP;
}
- /* This is a snoop file */
- wth->file_type = WTAP_FILE_SNOOP;
+ /*
+ * We don't currently use the extra information in Shomiti
+ * records, so we use the same routines to read snoop and
+ * Shomiti files.
+ */
wth->subtype_read = snoop_read;
wth->subtype_seek_read = snoop_seek_read;
- wth->file_encap = snoop_encap[hdr.network];
- wth->snapshot_length = 16384; /* XXX - not available in header */
+ wth->file_encap = file_encap;
+ wth->snapshot_length = 0; /* not available in header */
+ wth->tsprecision = WTAP_FILE_TSPREC_USEC;
return 1;
}
+typedef struct {
+ guint8 pad[4];
+ guint8 undecrypt[2];
+ guint8 rate;
+ guint8 preamble;
+ guint8 code;
+ guint8 signal;
+ guint8 qual;
+ guint8 channel;
+} shomiti_wireless_header;
+
+
/* Read the next packet */
-static gboolean snoop_read(wtap *wth, int *err, int *data_offset)
+static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
+ gint64 *data_offset)
{
guint32 rec_size;
guint32 packet_size;
int bytes_read;
struct snooprec_hdr hdr;
char padbuf[4];
- int padbytes;
+ guint padbytes;
int bytes_to_read;
/* Read record header. */
bytes_read = file_read(&hdr, 1, sizeof hdr, wth->fh);
if (bytes_read != sizeof hdr) {
*err = file_error(wth->fh);
- if (*err == 0 && bytes_read != 0) {
+ if (*err == 0 && bytes_read != 0)
*err = WTAP_ERR_SHORT_READ;
- }
return FALSE;
}
wth->data_offset += sizeof hdr;
- rec_size = ntohl(hdr.rec_len);
- orig_size = ntohl(hdr.orig_len);
- packet_size = ntohl(hdr.incl_len);
+ rec_size = g_ntohl(hdr.rec_len);
+ orig_size = g_ntohl(hdr.orig_len);
+ packet_size = g_ntohl(hdr.incl_len);
if (packet_size > WTAP_MAX_PACKET_SIZE) {
/*
* Probably a corrupt capture file; don't blow up trying
* to allocate space for an immensely-large packet.
*/
- g_message("snoop: File has %u-byte packet, bigger than maximum of %u",
+ *err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
packet_size, WTAP_MAX_PACKET_SIZE);
+ return FALSE;
+ }
+ if (packet_size > rec_size) {
+ /*
+ * Probably a corrupt capture file.
+ */
*err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than record size %u",
+ packet_size, rec_size);
return FALSE;
}
* the VCI; read them and generate the pseudo-header from
* them.
*/
- if (wth->file_encap == WTAP_ENCAP_ATM_SNIFFER) {
- if (packet_size < 4) {
+ switch (wth->file_encap) {
+
+ case WTAP_ENCAP_ATM_PDUS:
+ if (packet_size < sizeof (struct snoop_atm_hdr)) {
/*
* Uh-oh, the packet isn't big enough to even
* have a pseudo-header.
*/
- g_message("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+ *err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header",
packet_size);
+ return FALSE;
+ }
+ if (!snoop_read_atm_pseudoheader(wth->fh, &wth->pseudo_header,
+ err))
+ return FALSE; /* Read error */
+
+ /*
+ * Don't count the pseudo-header as part of the packet.
+ */
+ rec_size -= (guint32)sizeof (struct snoop_atm_hdr);
+ orig_size -= (guint32)sizeof (struct snoop_atm_hdr);
+ packet_size -= (guint32)sizeof (struct snoop_atm_hdr);
+ wth->data_offset += sizeof (struct snoop_atm_hdr);
+ break;
+
+ case WTAP_ENCAP_ETHERNET:
+ /*
+ * If this is a snoop file, we assume there's no FCS in
+ * this frame; if this is a Shomit file, we assume there
+ * is. (XXX - or should we treat it a "maybe"?)
+ */
+ if (wth->file_type == WTAP_FILE_SHOMITI)
+ wth->pseudo_header.eth.fcs_len = 4;
+ else
+ wth->pseudo_header.eth.fcs_len = 0;
+ break;
+
+ case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+ if (packet_size < sizeof (shomiti_wireless_header)) {
+ /*
+ * Uh-oh, the packet isn't big enough to even
+ * have a pseudo-header.
+ */
*err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: Shomiti wireless file has a %u-byte packet, too small to have even a wireless pseudo-header",
+ packet_size);
return FALSE;
}
- if (snoop_read_atm_pseudoheader(wth->fh, &wth->pseudo_header,
- err) < 0)
+ if (!snoop_read_shomiti_wireless_pseudoheader(wth->fh,
+ &wth->pseudo_header, err))
return FALSE; /* Read error */
/*
* Don't count the pseudo-header as part of the packet.
*/
- rec_size -= 4;
- orig_size -= 4;
- packet_size -= 4;
- wth->data_offset += 4;
+ rec_size -= (guint32)sizeof (shomiti_wireless_header);
+ orig_size -= (guint32)sizeof (shomiti_wireless_header);
+ packet_size -= (guint32)sizeof (shomiti_wireless_header);
+ wth->data_offset += sizeof (shomiti_wireless_header);
+ break;
}
buffer_assure_space(wth->frame_buffer, packet_size);
- if (snoop_read_rec_data(wth->fh, buffer_start_ptr(wth->frame_buffer),
- packet_size, err) < 0)
+ if (!snoop_read_rec_data(wth->fh, buffer_start_ptr(wth->frame_buffer),
+ packet_size, err))
return FALSE; /* Read error */
wth->data_offset += packet_size;
- wth->phdr.ts.tv_sec = ntohl(hdr.ts_sec);
- wth->phdr.ts.tv_usec = ntohl(hdr.ts_usec);
+ wth->phdr.ts.secs = g_ntohl(hdr.ts_sec);
+ wth->phdr.ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
wth->phdr.caplen = packet_size;
wth->phdr.len = orig_size;
- wth->phdr.pkt_encap = wth->file_encap;
+
+ /*
+ * If this is ATM LANE traffic, try to guess what type of LANE
+ * traffic it is based on the packet contents.
+ */
+ if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
+ wth->pseudo_header.atm.type == TRAF_LANE) {
+ atm_guess_lane_type(buffer_start_ptr(wth->frame_buffer),
+ wth->phdr.caplen, &wth->pseudo_header);
+ }
/*
* Skip over the padding (don't "fseek()", as the standard
* There's probably not much padding (it's probably padded only
* to a 4-byte boundary), so we probably need only do one read.
*/
- padbytes = rec_size - (sizeof hdr + packet_size);
+ if (rec_size < (sizeof hdr + packet_size)) {
+ /*
+ * What, *negative* padding? Bogus.
+ */
+ *err = WTAP_ERR_BAD_RECORD;
+ *err_info = g_strdup_printf("snoop: File has %u-byte record with packet size of %u",
+ rec_size, packet_size);
+ return FALSE;
+ }
+ padbytes = rec_size - ((guint)sizeof hdr + packet_size);
while (padbytes != 0) {
bytes_to_read = padbytes;
- if (bytes_to_read > sizeof padbuf)
+ if ((unsigned)bytes_to_read > sizeof padbuf)
bytes_to_read = sizeof padbuf;
errno = WTAP_ERR_CANT_READ;
bytes_read = file_read(padbuf, 1, bytes_to_read, wth->fh);
return TRUE;
}
-static int
-snoop_seek_read(wtap *wth, int seek_off,
- union wtap_pseudo_header *pseudo_header, u_char *pd, int length)
+static gboolean
+snoop_seek_read(wtap *wth, gint64 seek_off,
+ union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+ int *err, gchar **err_info _U_)
{
- int ret;
- int err; /* XXX - return this */
+ if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
+ return FALSE;
- file_seek(wth->random_fh, seek_off, SEEK_SET);
+ switch (wth->file_encap) {
- if (wth->file_encap == WTAP_ENCAP_ATM_SNIFFER) {
- ret = snoop_read_atm_pseudoheader(wth->random_fh, pseudo_header,
- &err);
- if (ret < 0) {
+ case WTAP_ENCAP_ATM_PDUS:
+ if (!snoop_read_atm_pseudoheader(wth->random_fh, pseudo_header,
+ err)) {
/* Read error */
- return ret;
+ return FALSE;
+ }
+ break;
+
+ case WTAP_ENCAP_ETHERNET:
+ /*
+ * If this is a snoop file, we assume there's no FCS in
+ * this frame; if this is a Shomit file, we assume there
+ * is. (XXX - or should we treat it a "maybe"?)
+ */
+ if (wth->file_type == WTAP_FILE_SHOMITI)
+ pseudo_header->eth.fcs_len = 4;
+ else
+ pseudo_header->eth.fcs_len = 0;
+ break;
+
+ case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+ if (!snoop_read_shomiti_wireless_pseudoheader(wth->random_fh,
+ pseudo_header, err)) {
+ /* Read error */
+ return FALSE;
}
+ break;
}
/*
* Read the packet data.
*/
- return snoop_read_rec_data(wth->random_fh, pd, length, &err);
+ if (!snoop_read_rec_data(wth->random_fh, pd, length, err))
+ return FALSE; /* failed */
+
+ /*
+ * If this is ATM LANE traffic, try to guess what type of LANE
+ * traffic it is based on the packet contents.
+ */
+ if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
+ pseudo_header->atm.type == TRAF_LANE)
+ atm_guess_lane_type(pd, length, pseudo_header);
+ return TRUE;
}
-static int
+static gboolean
snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
int *err)
{
- char atm_phdr[4];
+ struct snoop_atm_hdr atm_phdr;
int bytes_read;
+ guint8 vpi;
+ guint16 vci;
errno = WTAP_ERR_CANT_READ;
- bytes_read = file_read(atm_phdr, 1, 4, fh);
- if (bytes_read != 4) {
+ bytes_read = file_read(&atm_phdr, 1, sizeof (struct snoop_atm_hdr), fh);
+ if (bytes_read != sizeof (struct snoop_atm_hdr)) {
*err = file_error(fh);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
- return -1;
+ return FALSE;
}
- pseudo_header->ngsniffer_atm.channel = (atm_phdr[0] & 0x80) ? 1 : 0;
- pseudo_header->ngsniffer_atm.Vpi = atm_phdr[1];
- pseudo_header->ngsniffer_atm.Vci = pntohs(&atm_phdr[2]);
-
- /* We don't have this information */
- pseudo_header->ngsniffer_atm.cells = 0;
- pseudo_header->ngsniffer_atm.aal5t_u2u = 0;
- pseudo_header->ngsniffer_atm.aal5t_len = 0;
- pseudo_header->ngsniffer_atm.aal5t_chksum = 0;
+ vpi = atm_phdr.vpi;
+ vci = pntohs(&atm_phdr.vci);
/*
- * Assume it's AAL5; we know nothing more about it.
- *
- * For what it's worth, in one "atmsnoop" capture,
- * the lower 7 bits of the first byte of the header
- * were 0x05 for ILMI traffic, 0x06 for Signalling
- * AAL traffic, and 0x02 for at least some RFC 1483-style
- * LLC multiplexed traffic.
+ * The lower 4 bits of the first byte of the header indicate
+ * the type of traffic, as per the "atmioctl.h" header in
+ * SunATM.
*/
- pseudo_header->ngsniffer_atm.AppTrafType = ATT_AAL5|ATT_HL_UNKNOWN;
- pseudo_header->ngsniffer_atm.AppHLType = AHLT_UNKNOWN;
+ switch (atm_phdr.flags & 0x0F) {
- return 0;
+ case 0x01: /* LANE */
+ pseudo_header->atm.aal = AAL_5;
+ pseudo_header->atm.type = TRAF_LANE;
+ break;
+
+ case 0x02: /* RFC 1483 LLC multiplexed traffic */
+ pseudo_header->atm.aal = AAL_5;
+ pseudo_header->atm.type = TRAF_LLCMX;
+ break;
+
+ case 0x05: /* ILMI */
+ pseudo_header->atm.aal = AAL_5;
+ pseudo_header->atm.type = TRAF_ILMI;
+ break;
+
+ case 0x06: /* Signalling AAL */
+ pseudo_header->atm.aal = AAL_SIGNALLING;
+ pseudo_header->atm.type = TRAF_UNKNOWN;
+ break;
+
+ case 0x03: /* MARS (RFC 2022) */
+ pseudo_header->atm.aal = AAL_5;
+ pseudo_header->atm.type = TRAF_UNKNOWN;
+ break;
+
+ case 0x04: /* IFMP (Ipsilon Flow Management Protocol; see RFC 1954) */
+ pseudo_header->atm.aal = AAL_5;
+ pseudo_header->atm.type = TRAF_UNKNOWN; /* XXX - TRAF_IPSILON? */
+ break;
+
+ default:
+ /*
+ * Assume it's AAL5, unless it's VPI 0 and VCI 5, in which
+ * case assume it's AAL_SIGNALLING; we know nothing more
+ * about it.
+ *
+ * XXX - is this necessary? Or are we guaranteed that
+ * all signalling traffic has a type of 0x06?
+ *
+ * XXX - is this guaranteed to be AAL5? Or, if the type is
+ * 0x00 ("raw"), might it be non-AAL5 traffic?
+ */
+ if (vpi == 0 && vci == 5)
+ pseudo_header->atm.aal = AAL_SIGNALLING;
+ else
+ pseudo_header->atm.aal = AAL_5;
+ pseudo_header->atm.type = TRAF_UNKNOWN;
+ break;
+ }
+ pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
+
+ pseudo_header->atm.vpi = vpi;
+ pseudo_header->atm.vci = vci;
+ pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
+
+ /* We don't have this information */
+ pseudo_header->atm.flags = 0;
+ pseudo_header->atm.cells = 0;
+ pseudo_header->atm.aal5t_u2u = 0;
+ pseudo_header->atm.aal5t_len = 0;
+ pseudo_header->atm.aal5t_chksum = 0;
+
+ return TRUE;
}
-static int
-snoop_read_rec_data(FILE_T fh, u_char *pd, int length, int *err)
+static gboolean
+snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
+ union wtap_pseudo_header *pseudo_header, int *err)
+{
+ shomiti_wireless_header whdr;
+ int bytes_read;
+
+ errno = WTAP_ERR_CANT_READ;
+ bytes_read = file_read(&whdr, 1, sizeof (shomiti_wireless_header), fh);
+ if (bytes_read != sizeof (shomiti_wireless_header)) {
+ *err = file_error(fh);
+ if (*err == 0)
+ *err = WTAP_ERR_SHORT_READ;
+ return FALSE;
+ }
+
+ pseudo_header->ieee_802_11.fcs_len = 4;
+ pseudo_header->ieee_802_11.channel = whdr.channel;
+ pseudo_header->ieee_802_11.data_rate = whdr.rate;
+ pseudo_header->ieee_802_11.signal_level = whdr.signal;
+
+ return TRUE;
+}
+
+static gboolean
+snoop_read_rec_data(FILE_T fh, guchar *pd, int length, int *err)
{
int bytes_read;
*err = file_error(fh);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
- return -1;
+ return FALSE;
}
- return 0;
+ return TRUE;
}
static const int wtap_encap[] = {
-1, /* WTAP_ENCAP_ATM_RFC1483 -> unsupported */
-1, /* WTAP_ENCAP_LINUX_ATM_CLIP -> unsupported */
-1, /* WTAP_ENCAP_LAPB -> unsupported*/
- -1, /* WTAP_ENCAP_ATM_SNIFFER -> unsupported */
- 0 /* WTAP_ENCAP_NULL -> DLT_NULL */
+ 0x12, /* WTAP_ENCAP_ATM_PDUS -> DL_IPATM */
+ -1 /* WTAP_ENCAP_NULL -> unsupported */
};
#define NUM_WTAP_ENCAPS (sizeof wtap_encap / sizeof wtap_encap[0])
/* Returns 0 if we could write the specified encapsulation type,
an error indication otherwise. */
-int snoop_dump_can_write_encap(int filetype, int encap)
+int snoop_dump_can_write_encap(int encap)
{
/* Per-packet encapsulations aren't supported. */
if (encap == WTAP_ENCAP_PER_PACKET)
return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
- if (encap < 0 || encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
+ if (encap < 0 || (unsigned)encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
return WTAP_ERR_UNSUPPORTED_ENCAP;
return 0;
/* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
failure */
-gboolean snoop_dump_open(wtap_dumper *wdh, int *err)
+gboolean snoop_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
{
struct snoop_hdr file_hdr;
- int nwritten;
+ size_t nwritten;
/* This is a snoop file */
wdh->subtype_write = snoop_dump;
/* Write the file header. */
nwritten = fwrite(&snoop_magic, 1, sizeof snoop_magic, wdh->fh);
if (nwritten != sizeof snoop_magic) {
- if (nwritten < 0)
+ if (nwritten == 0 && ferror(wdh->fh))
*err = errno;
else
*err = WTAP_ERR_SHORT_WRITE;
}
/* current "snoop" format is 2 */
- file_hdr.version = htonl(2);
- file_hdr.network = htonl(wtap_encap[wdh->encap]);
+ file_hdr.version = g_htonl(2);
+ file_hdr.network = g_htonl(wtap_encap[wdh->encap]);
nwritten = fwrite(&file_hdr, 1, sizeof file_hdr, wdh->fh);
if (nwritten != sizeof file_hdr) {
- if (nwritten < 0)
+ if (nwritten == 0 && ferror(wdh->fh))
*err = errno;
else
*err = WTAP_ERR_SHORT_WRITE;
/* Write a record for a packet to a dump file.
Returns TRUE on success, FALSE on failure. */
-static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
- const union wtap_pseudo_header *pseudo_header, const u_char *pd, int *err)
+static gboolean snoop_dump(wtap_dumper *wdh,
+ const struct wtap_pkthdr *phdr,
+ const union wtap_pseudo_header *pseudo_header _U_,
+ const guchar *pd, int *err)
{
struct snooprec_hdr rec_hdr;
- int nwritten;
+ size_t nwritten;
int reclen;
- int padlen;
+ guint padlen;
static char zeroes[4];
+ struct snoop_atm_hdr atm_hdr;
+ int atm_hdrsize;
+
+ if (wdh->encap == WTAP_ENCAP_ATM_PDUS)
+ atm_hdrsize = sizeof (struct snoop_atm_hdr);
+ else
+ atm_hdrsize = 0;
/* Record length = header length plus data length... */
- reclen = sizeof rec_hdr + phdr->caplen;
+ reclen = (int)sizeof rec_hdr + phdr->caplen + atm_hdrsize;
/* ... plus enough bytes to pad it to a 4-byte boundary. */
padlen = ((reclen + 3) & ~3) - reclen;
reclen += padlen;
- rec_hdr.orig_len = htonl(phdr->len);
- rec_hdr.incl_len = htonl(phdr->caplen);
- rec_hdr.rec_len = htonl(reclen);
+ rec_hdr.orig_len = g_htonl(phdr->len + atm_hdrsize);
+ rec_hdr.incl_len = g_htonl(phdr->caplen + atm_hdrsize);
+ rec_hdr.rec_len = g_htonl(reclen);
rec_hdr.cum_drops = 0;
- rec_hdr.ts_sec = htonl(phdr->ts.tv_sec);
- rec_hdr.ts_usec = htonl(phdr->ts.tv_usec);
+ rec_hdr.ts_sec = g_htonl(phdr->ts.secs);
+ rec_hdr.ts_usec = g_htonl(phdr->ts.nsecs / 1000);
nwritten = fwrite(&rec_hdr, 1, sizeof rec_hdr, wdh->fh);
if (nwritten != sizeof rec_hdr) {
- if (nwritten < 0)
+ if (nwritten == 0 && ferror(wdh->fh))
*err = errno;
else
*err = WTAP_ERR_SHORT_WRITE;
return FALSE;
}
+
+ if (wdh->encap == WTAP_ENCAP_ATM_PDUS) {
+ /*
+ * Write the ATM header.
+ */
+ atm_hdr.flags =
+ (pseudo_header->atm.channel == 0) ? 0x80 : 0x00;
+ switch (pseudo_header->atm.aal) {
+
+ case AAL_SIGNALLING:
+ /* Signalling AAL */
+ atm_hdr.flags |= 0x06;
+ break;
+
+ case AAL_5:
+ switch (pseudo_header->atm.type) {
+
+ case TRAF_LANE:
+ /* LANE */
+ atm_hdr.flags |= 0x01;
+ break;
+
+ case TRAF_LLCMX:
+ /* RFC 1483 LLC multiplexed traffic */
+ atm_hdr.flags |= 0x02;
+ break;
+
+ case TRAF_ILMI:
+ /* ILMI */
+ atm_hdr.flags |= 0x05;
+ break;
+ }
+ break;
+ }
+ atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;
+ atm_hdr.vci = g_htons(pseudo_header->atm.vci);
+ nwritten = fwrite(&atm_hdr, 1, sizeof atm_hdr, wdh->fh);
+ if (nwritten != sizeof atm_hdr) {
+ if (nwritten == 0 && ferror(wdh->fh))
+ *err = errno;
+ else
+ *err = WTAP_ERR_SHORT_WRITE;
+ return FALSE;
+ }
+ }
+
nwritten = fwrite(pd, 1, phdr->caplen, wdh->fh);
if (nwritten != phdr->caplen) {
- if (nwritten < 0)
+ if (nwritten == 0 && ferror(wdh->fh))
*err = errno;
else
*err = WTAP_ERR_SHORT_WRITE;
/* Now write the padding. */
nwritten = fwrite(zeroes, 1, padlen, wdh->fh);
if (nwritten != padlen) {
- if (nwritten < 0)
+ if (nwritten == 0 && ferror(wdh->fh))
*err = errno;
else
*err = WTAP_ERR_SHORT_WRITE;
git.samba.org / obnox / wireshark / wip.git / blobdiff