wiretap/erf.c

   1 /*
   2 *
   3 * Copyright (c) 2003 Endace Technology Ltd, Hamilton, New Zealand.
   4 * All rights reserved.
   5 *
   6 * This software and documentation has been developed by Endace Technology Ltd.
   7 * along with the DAG PCI network capture cards. For further information please
   8 * visit http://www.endace.com/.
   9 *
  10 * Redistribution and use in source and binary forms, with or without
  11 * modification, are permitted provided that the following conditions are met:
  12 *
  13 *  1. Redistributions of source code must retain the above copyright notice,
  14 *  this list of conditions and the following disclaimer.
  15 *
  16 *  2. Redistributions in binary form must reproduce the above copyright
  17 *  notice, this list of conditions and the following disclaimer in the
  18 *  documentation and/or other materials provided with the distribution.
  19 *
  20 *  3. The name of Endace Technology Ltd may not be used to endorse or promote
  21 *  products derived from this software without specific prior written
  22 *  permission.
  23 *
  24 * THIS SOFTWARE IS PROVIDED BY ENDACE TECHNOLOGY LTD ``AS IS'' AND ANY EXPRESS
  25 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
  27 * EVENT SHALL ENDACE TECHNOLOGY LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  29 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  30 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  31 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33 * POSSIBILITY OF SUCH DAMAGE.
  34 *
  35 * $Id: erf.c,v 1.2 2003/08/26 23:07:43 guy Exp $
  36 */
  37
  38 /*
  39  * erf - Endace ERF (Extensible Record Format)
  40  */
  41
  42 #ifdef HAVE_CONFIG_H
  43 #include "config.h"
  44 #endif
  45
  46 #include <stdlib.h>
  47 #include <string.h>
  48
  49 #include "wtap-int.h"
  50 #include "file_wrappers.h"
  51 #include "buffer.h"
  52 #include "atm.h"
  53 #include "erf.h"
  54
  55 typedef guint32 atm_hdr_t;
  56
  57 static int erf_read_header(
  58                 FILE_T fh,
  59                 struct wtap_pkthdr *phdr,
  60                 union wtap_pseudo_header *pseudo_header,
  61                 erf_header_t *erf_header,
  62                 erf_t *erf,
  63                 int *err,
  64                 guint32 *bytes_read,
  65                 guint32 *packet_size);
  66 static gboolean erf_read(wtap *wth, int *err, long *data_offset);
  67 static gboolean erf_seek_read(wtap *wth, long seek_off,
  68                 union wtap_pseudo_header *pseudo_header, guchar *pd,
  69                 int length, int *err);
  70 static void erf_close(wtap *wth);
  71 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap);
  72
  73 int erf_open(wtap *wth, int *err)
  74 {
  75         guint32 i, n;
  76         char *s;
  77         guint32 records_for_erf_check = RECORDS_FOR_ERF_CHECK;
  78         guint32 atm_encap = WTAP_ENCAP_ATM_PDUS;
  79         gboolean is_rawatm = FALSE;
  80         gboolean is_ppp = FALSE;
  81         int common_type = 0;
  82         erf_timestamp_t prevts;
  83
  84         memset(&prevts, 0, sizeof(prevts));
  85
  86         if ((s = getenv("ERF_ATM_ENCAP")) != NULL) {
  87                 if (!strcmp(s, "sunatm")) {
  88                         atm_encap = WTAP_ENCAP_ATM_PDUS;
  89                 } else
  90                 if (!strcmp(s, "sunraw")) {
  91                         atm_encap = WTAP_ENCAP_ATM_PDUS;
  92                         is_rawatm = TRUE;
  93                 } else
  94                 if (!strcmp(s, "rfc1483")) {
  95                         atm_encap = WTAP_ENCAP_ATM_RFC1483;
  96                 }
  97         }
  98
  99         /* number of records to scan before deciding if this really is ERF (dflt=3) */
 100         if ((s = getenv("ERF_RECORDS_TO_CHECK")) != NULL) {
 101                 if ((n = atoi(s)) > 0 && n < 101) {
 102                         records_for_erf_check = n;
 103                 }
 104         }
 105
 106         /* ERF is a little hard because there's no magic number */
 107
 108         for (i = 0; i < records_for_erf_check; i++) {
 109
 110                 erf_header_t header;
 111                 guint32 packet_size;
 112                 erf_timestamp_t ts;
 113
 114                 if (file_read(&header,1,sizeof(header),wth->fh) != sizeof(header)) {
 115                         if ((*err = file_error(wth->fh)) != 0)
 116                                 return -1;
 117                         else
 118                                 break; /* eof */
 119                 }
 120
 121                 packet_size = g_ntohs(header.rlen) - sizeof(header);
 122
 123                 /* fail on invalid record type, decreasing timestamps or non-zero pad-bits */
 124                 if (header.type == 0 || header.type > TYPE_AAL5 ||
 125                     (header.flags & 0xc0) != 0) {
 126                         return 0;
 127                 }
 128
 129 #ifdef G_HAVE_GINT64
 130                 if ((ts = pletohll(&header.ts)) < prevts) {
 131                         return 0;
 132                 }
 133 #else
 134                 ts[0] = pletohl(&header.ts[0]); /* frac */
 135                 ts[1] = pletohl(&header.ts[1]); /* sec */
 136                 if ((ts[1] < prevts[1]) ||
 137                                 (ts[1] == prevts[1] && ts[0] < prevts[0])) {
 138                         return 0;
 139                 }
 140 #endif
 141                 memcpy(&prevts, &ts, sizeof(prevts));
 142
 143                 if (common_type == 0) {
 144                         common_type = header.type;
 145                 } else
 146                 if (common_type > 0 && common_type != header.type) {
 147                         common_type = -1;
 148                 }
 149
 150                 if (header.type == TYPE_HDLC_POS && !is_ppp) {
 151                         guint16 chdlc_hdr;
 152                         if (file_read(&chdlc_hdr,1,sizeof(chdlc_hdr),wth->fh) != sizeof(chdlc_hdr)) {
 153                                 *err = file_error(wth->fh);
 154                         }
 155                         packet_size -= sizeof(chdlc_hdr);
 156                         if (g_ntohs(chdlc_hdr) == 0xff03) {
 157                                 is_ppp = TRUE;
 158                         }
 159                 }
 160
 161                 if (file_seek(wth->fh, packet_size, SEEK_CUR, err) == -1) {
 162                         return -1;
 163                 }
 164         }
 165
 166         if (file_seek(wth->fh, 0L, SEEK_SET, err) == -1) {      /* rewind */
 167                 return -1;
 168         }
 169
 170         wth->data_offset = 0;
 171
 172         /* This is an ERF file */
 173         wth->file_type = WTAP_FILE_ERF;
 174         wth->snapshot_length = 0;       /* not available in header, only in frame */
 175         wth->capture.erf = g_malloc(sizeof(erf_t));
 176         wth->capture.erf->atm_encap = atm_encap;
 177         wth->capture.erf->is_rawatm = is_rawatm;
 178         wth->capture.erf->is_ppp = is_ppp;
 179
 180         /*
 181          * Really want WTAP_ENCAP_PER_PACKET here but that severely limits
 182          * the number of output formats we can write to. If all the records
 183          * tested in the loop above were the same encap then use that one,
 184          * otherwise use WTAP_ENCAP_PER_PACKET.
 185          */
 186         wth->file_encap =
 187                 (common_type < 0
 188                         ? WTAP_ENCAP_PER_PACKET
 189                         : erf_encap_to_wtap_encap(wth->capture.erf, common_type));
 190
 191         wth->subtype_read = erf_read;
 192         wth->subtype_seek_read = erf_seek_read;
 193         wth->subtype_close = erf_close;
 194
 195         return 1;
 196 }
 197
 198 /* Read the next packet */
 199 static gboolean erf_read(wtap *wth, int *err, long *data_offset)
 200 {
 201         erf_header_t erf_header;
 202         guint32 packet_size, bytes_read;
 203         gint32 offset = 0;
 204
 205         *data_offset = wth->data_offset;
 206
 207         if (!erf_read_header(
 208                         wth->fh,
 209                         &wth->phdr, &wth->pseudo_header, &erf_header, wth->capture.erf,
 210                         err, &bytes_read, &packet_size)) {
 211                 return FALSE;
 212         }
 213         wth->data_offset += bytes_read;
 214
 215         buffer_assure_space(wth->frame_buffer, packet_size+(wth->capture.erf->is_rawatm?(sizeof(atm_hdr_t)+1):0));
 216
 217         if (wth->capture.erf->is_rawatm) {
 218                 wtap_file_read_expected_bytes(
 219                         buffer_start_ptr(wth->frame_buffer), (gint32)sizeof(atm_hdr_t), wth->fh, err
 220                 );
 221                 wth->data_offset += sizeof(atm_hdr_t);
 222                 packet_size -= sizeof(atm_hdr_t);
 223                 offset += sizeof(atm_hdr_t)+1;
 224         }
 225
 226         wtap_file_read_expected_bytes(
 227                 buffer_start_ptr(wth->frame_buffer)+offset, (gint32)packet_size, wth->fh, err
 228         );
 229         wth->data_offset += packet_size;
 230
 231         if (erf_header.type == TYPE_ATM && wth->capture.erf->atm_encap == WTAP_ENCAP_ATM_PDUS && !wth->capture.erf->is_rawatm) {
 232                 atm_guess_traffic_type(
 233                         buffer_start_ptr(wth->frame_buffer), packet_size, &wth->pseudo_header
 234                 );
 235         }
 236
 237         return TRUE;
 238 }
 239
 240 static gboolean erf_seek_read(wtap *wth, long seek_off,
 241                 union wtap_pseudo_header *pseudo_header, guchar *pd,
 242                 int length, int *err)
 243 {
 244         erf_header_t erf_header;
 245         guint32 packet_size;
 246
 247         if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 248                 return FALSE;
 249
 250         erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header, wth->capture.erf, err, NULL, &packet_size);
 251
 252         if (wth->capture.erf->is_rawatm) {
 253                 wtap_file_read_expected_bytes(pd, (int)sizeof(atm_hdr_t), wth->random_fh, err);
 254                 pd += sizeof(atm_hdr_t)+1;
 255         }
 256
 257         wtap_file_read_expected_bytes(pd, (int)packet_size, wth->random_fh, err);
 258
 259         if (erf_header.type == TYPE_ATM && wth->capture.erf->atm_encap == WTAP_ENCAP_ATM_PDUS && !wth->capture.erf->is_rawatm) {
 260                 atm_guess_traffic_type(pd, length, pseudo_header);
 261         }
 262
 263         return TRUE;
 264 }
 265
 266 static void erf_close(wtap *wth)
 267 {
 268     g_free(wth->capture.erf);
 269 }
 270
 271 static int erf_read_header(
 272         FILE_T fh,
 273         struct wtap_pkthdr *phdr,
 274         union wtap_pseudo_header *pseudo_header,
 275         erf_header_t *erf_header,
 276         erf_t *erf,
 277         int *err,
 278         guint32 *bytes_read,
 279         guint32 *packet_size)
 280 {
 281         guint32 rec_size, skip;
 282
 283         wtap_file_read_expected_bytes(erf_header, sizeof(*erf_header), fh, err);
 284         if (bytes_read != NULL) {
 285                 *bytes_read = sizeof(*erf_header);
 286         }
 287
 288         rec_size = g_ntohs(erf_header->rlen);
 289         *packet_size = rec_size - sizeof(*erf_header);
 290         skip = 0; /* # bytes of payload to ignore */
 291
 292         if (*packet_size > WTAP_MAX_PACKET_SIZE) {
 293                 /*
 294                  * Probably a corrupt capture file; don't blow up trying
 295                  * to allocate space for an immensely-large packet.
 296                  */
 297                 g_message("erf: File has %u-byte packet, bigger than maximum of %u",
 298                     *packet_size, WTAP_MAX_PACKET_SIZE);
 299                 *err = WTAP_ERR_BAD_RECORD;
 300                 return FALSE;
 301         }
 302
 303         if (phdr != NULL ) {
 304 #ifdef G_HAVE_GINT64
 305                 guint64 ts = pletohll(&erf_header->ts);
 306
 307                 phdr->ts.tv_sec = ts >> 32;
 308                 ts = ((ts & 0xffffffff) * 1000 * 1000);
 309                 ts += (ts & 0x80000000) << 1; /* rounding */
 310                 phdr->ts.tv_usec = ts >> 32;
 311                 if (phdr->ts.tv_usec >= 1000000) {
 312                         phdr->ts.tv_usec -= 1000000;
 313                         phdr->ts.tv_sec += 1;
 314                 }
 315 #else
 316                 phdr->ts.tv_sec = pletohl(&erf_header->ts[1]);
 317                 phdr->ts.tv_usec =
 318                         (unsigned long)((pletohl(&erf_header->ts[0])*1000000.0)/0xffffffffUL);
 319 #endif
 320         }
 321
 322         switch (erf_header->type) {
 323
 324         case TYPE_ATM:
 325
 326                 if (phdr != NULL) {
 327                         phdr->caplen = ATM_SLEN(erf_header, NULL);
 328                         phdr->len = ATM_WLEN(erf_header, NULL);
 329                 }
 330
 331                 if (erf->atm_encap == WTAP_ENCAP_ATM_PDUS) {
 332                         memset(&pseudo_header->atm, 0, sizeof(pseudo_header->atm));
 333                         if (erf->is_rawatm) {
 334                                 pseudo_header->atm.flags = ATM_RAW_CELL;
 335                                 if (phdr != NULL) {
 336                                         phdr->caplen += sizeof(atm_hdr_t)+1;
 337                                         phdr->len += sizeof(atm_hdr_t)+1;
 338                                 }
 339                         } else {
 340                                 atm_hdr_t atm_hdr;
 341
 342                                 wtap_file_read_expected_bytes(&atm_hdr, sizeof(atm_hdr), fh, err);
 343                                 if (bytes_read != NULL) {
 344                                         *bytes_read += sizeof(atm_hdr);
 345                                 }
 346                                 *packet_size -= sizeof(atm_hdr);
 347
 348                                 atm_hdr = g_ntohl(atm_hdr);
 349
 350                                 pseudo_header->atm.vpi = ((atm_hdr & 0x0ff00000) >> 20);
 351                                 pseudo_header->atm.vci = ((atm_hdr & 0x000ffff0) >>  4);
 352                                 pseudo_header->atm.channel = (erf_header->flags & 0x03);
 353                         }
 354                 } else {
 355                         skip = 4;
 356                 }
 357                 break;
 358         case TYPE_ETH:
 359                 if (phdr != NULL) {
 360                         phdr->caplen = ETHERNET_SLEN(erf_header, erf);
 361                         phdr->len = ETHERNET_WLEN(erf_header, erf);
 362                 }
 363                 skip = 2;
 364                 break;
 365         case TYPE_HDLC_POS:
 366                 if (phdr != NULL) {
 367                         phdr->caplen = HDLC_SLEN(erf_header, erf);
 368                         phdr->len = HDLC_WLEN(erf_header, erf);
 369                 }
 370                 memset(&pseudo_header->p2p, 0, sizeof(pseudo_header->p2p));
 371                 pseudo_header->p2p.sent = ((erf_header->flags & 0x01) ? TRUE : FALSE);
 372                 break;
 373         default:
 374                 *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 375                 return FALSE;
 376         }
 377
 378         if (phdr != NULL) {
 379                 phdr->pkt_encap = erf_encap_to_wtap_encap(erf, erf_header->type);
 380         }
 381
 382         if (skip > 0) {
 383                 if (file_seek(fh, skip, SEEK_CUR, err) == -1) {
 384                         return FALSE;
 385                 }
 386                 if (bytes_read != NULL) {
 387                         *bytes_read += skip;
 388                 }
 389                 *packet_size -= skip;
 390         }
 391
 392         return TRUE;
 393 }
 394
 395 static int erf_encap_to_wtap_encap(erf_t *erf, guint8 erf_encap)
 396 {
 397         int wtap_encap = WTAP_ENCAP_UNKNOWN;
 398
 399         switch (erf_encap) {
 400         case TYPE_ATM:
 401         case TYPE_AAL5:
 402                 wtap_encap = erf->atm_encap;
 403                 break;
 404         case TYPE_ETH:
 405                 wtap_encap = WTAP_ENCAP_ETHERNET;
 406                 break;
 407         case TYPE_HDLC_POS:
 408                 wtap_encap = (erf->is_ppp ? WTAP_ENCAP_PPP : WTAP_ENCAP_CHDLC);
 409                 break;
 410         default:
 411                 break;
 412         }
 413
 414         return wtap_encap;
 415 }