6 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
30 #ifdef HAVE_SYS_TYPES_H
31 #include <sys/types.h>
44 #include "file_wrappers.h"
45 #include <wsutil/file_util.h>
49 * Return the size of the file, as reported by the OS.
50 * (gint64, in case that's 64 bits.)
53 wtap_file_size(wtap *wth, int *err)
57 if (ws_fstat64(wth->fd, &statb) == -1) {
66 wtap_file_type(wtap *wth)
68 return wth->file_type;
72 wtap_snapshot_length(wtap *wth)
74 return wth->snapshot_length;
78 wtap_file_encap(wtap *wth)
80 return wth->file_encap;
84 wtap_file_tsprecision(wtap *wth)
86 return wth->tsprecision;
89 /* Table of the encapsulation types we know about. */
90 struct encap_type_info {
92 const char *short_name;
95 static struct encap_type_info encap_table_base[] = {
96 /* WTAP_ENCAP_UNKNOWN */
97 { "Unknown", "unknown" },
99 /* WTAP_ENCAP_ETHERNET */
100 { "Ethernet", "ether" },
102 /* WTAP_ENCAP_TOKEN_RING */
103 { "Token Ring", "tr" },
105 /* WTAP_ENCAP_SLIP */
111 /* WTAP_ENCAP_FDDI */
114 /* WTAP_ENCAP_FDDI_BITSWAPPED */
115 { "FDDI with bit-swapped MAC addresses", "fddi-swapped" },
117 /* WTAP_ENCAP_RAW_IP */
118 { "Raw IP", "rawip" },
120 /* WTAP_ENCAP_ARCNET */
121 { "ARCNET", "arcnet" },
123 /* WTAP_ENCAP_ARCNET_LINUX */
124 { "Linux ARCNET", "arcnet_linux" },
126 /* WTAP_ENCAP_ATM_RFC1483 */
127 { "RFC 1483 ATM", "atm-rfc1483" },
129 /* WTAP_ENCAP_LINUX_ATM_CLIP */
130 { "Linux ATM CLIP", "linux-atm-clip" },
132 /* WTAP_ENCAP_LAPB */
135 /* WTAP_ENCAP_ATM_PDUS */
136 { "ATM PDUs", "atm-pdus" },
138 /* WTAP_ENCAP_ATM_PDUS_UNTRUNCATED */
139 { "ATM PDUs - untruncated", "atm-pdus-untruncated" },
141 /* WTAP_ENCAP_NULL */
144 /* WTAP_ENCAP_ASCEND */
145 { "Lucent/Ascend access equipment", "ascend" },
147 /* WTAP_ENCAP_ISDN */
150 /* WTAP_ENCAP_IP_OVER_FC */
151 { "RFC 2625 IP-over-Fibre Channel", "ip-over-fc" },
153 /* WTAP_ENCAP_PPP_WITH_PHDR */
154 { "PPP with Directional Info", "ppp-with-direction" },
156 /* WTAP_ENCAP_IEEE_802_11 */
157 { "IEEE 802.11 Wireless LAN", "ieee-802-11" },
159 /* WTAP_ENCAP_PRISM_HEADER */
160 { "IEEE 802.11 plus Prism II monitor mode header", "prism" },
162 /* WTAP_ENCAP_IEEE_802_11_WITH_RADIO */
163 { "IEEE 802.11 Wireless LAN with radio information", "ieee-802-11-radio" },
165 /* WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP */
166 { "IEEE 802.11 plus radiotap WLAN header", "ieee-802-11-radiotap" },
168 /* WTAP_ENCAP_IEEE_802_11_WLAN_AVS */
169 { "IEEE 802.11 plus AVS WLAN header", "ieee-802-11-avs" },
172 { "Linux cooked-mode capture", "linux-sll" },
174 /* WTAP_ENCAP_FRELAY */
175 { "Frame Relay", "frelay" },
177 /* WTAP_ENCAP_FRELAY_WITH_PHDR */
178 { "Frame Relay with Directional Info", "frelay-with-direction" },
180 /* WTAP_ENCAP_CHDLC */
181 { "Cisco HDLC", "chdlc" },
183 /* WTAP_ENCAP_CISCO_IOS */
184 { "Cisco IOS internal", "ios" },
186 /* WTAP_ENCAP_LOCALTALK */
187 { "Localtalk", "ltalk" },
189 /* WTAP_ENCAP_OLD_PFLOG */
190 { "OpenBSD PF Firewall logs, pre-3.4", "pflog-old" },
192 /* WTAP_ENCAP_HHDLC */
193 { "HiPath HDLC", "hhdlc" },
195 /* WTAP_ENCAP_DOCSIS */
196 { "Data Over Cable Service Interface Specification", "docsis" },
198 /* WTAP_ENCAP_COSINE */
199 { "CoSine L2 debug log", "cosine" },
201 /* WTAP_ENCAP_WFLEET_HDLC */
202 { "Wellfleet HDLC", "whdlc" },
204 /* WTAP_ENCAP_SDLC */
207 /* WTAP_ENCAP_TZSP */
208 { "Tazmen sniffer protocol", "tzsp" },
211 { "OpenBSD enc(4) encapsulating interface", "enc" },
213 /* WTAP_ENCAP_PFLOG */
214 { "OpenBSD PF Firewall logs", "pflog" },
216 /* WTAP_ENCAP_CHDLC_WITH_PHDR */
217 { "Cisco HDLC with Directional Info", "chdlc-with-direction" },
219 /* WTAP_ENCAP_BLUETOOTH_H4 */
220 { "Bluetooth H4", "bluetooth-h4" },
222 /* WTAP_ENCAP_MTP2 */
223 { "SS7 MTP2", "mtp2" },
225 /* WTAP_ENCAP_MTP3 */
226 { "SS7 MTP3", "mtp3" },
228 /* WTAP_ENCAP_IRDA */
231 /* WTAP_ENCAP_USER0 */
232 { "USER 0", "user0" },
234 /* WTAP_ENCAP_USER1 */
235 { "USER 1", "user1" },
237 /* WTAP_ENCAP_USER2 */
238 { "USER 2", "user2" },
240 /* WTAP_ENCAP_USER3 */
241 { "USER 3", "user3" },
243 /* WTAP_ENCAP_USER4 */
244 { "USER 4", "user4" },
246 /* WTAP_ENCAP_USER5 */
247 { "USER 5", "user5" },
249 /* WTAP_ENCAP_USER6 */
250 { "USER 6", "user6" },
252 /* WTAP_ENCAP_USER7 */
253 { "USER 7", "user7" },
255 /* WTAP_ENCAP_USER8 */
256 { "USER 8", "user8" },
258 /* WTAP_ENCAP_USER9 */
259 { "USER 9", "user9" },
261 /* WTAP_ENCAP_USER10 */
262 { "USER 10", "user10" },
264 /* WTAP_ENCAP_USER11 */
265 { "USER 11", "user11" },
267 /* WTAP_ENCAP_USER12 */
268 { "USER 12", "user12" },
270 /* WTAP_ENCAP_USER13 */
271 { "USER 13", "user13" },
273 /* WTAP_ENCAP_USER14 */
274 { "USER 14", "user14" },
276 /* WTAP_ENCAP_USER15 */
277 { "USER 15", "user15" },
279 /* WTAP_ENCAP_SYMANTEC */
280 { "Symantec Enterprise Firewall", "symantec" },
282 /* WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 */
283 { "Apple IP-over-IEEE 1394", "ap1394" },
285 /* WTAP_ENCAP_BACNET_MS_TP */
286 { "BACnet MS/TP", "bacnet-ms-tp" },
288 /* WTAP_ENCAP_NETTL_RAW_ICMP */
289 { "Raw ICMP with nettl headers", "raw-icmp-nettl" },
291 /* WTAP_ENCAP_NETTL_RAW_ICMPV6 */
292 { "Raw ICMPv6 with nettl headers", "raw-icmpv6-nettl" },
294 /* WTAP_ENCAP_GPRS_LLC */
295 { "GPRS LLC", "gprs-llc" },
297 /* WTAP_ENCAP_JUNIPER_ATM1 */
298 { "Juniper ATM1", "juniper-atm1" },
300 /* WTAP_ENCAP_JUNIPER_ATM2 */
301 { "Juniper ATM2", "juniper-atm2" },
303 /* WTAP_ENCAP_REDBACK */
304 { "Redback SmartEdge", "redback" },
306 /* WTAP_ENCAP_NETTL_RAW_IP */
307 { "Raw IP with nettl headers", "rawip-nettl" },
309 /* WTAP_ENCAP_NETTL_ETHERNET */
310 { "Ethernet with nettl headers", "ether-nettl" },
312 /* WTAP_ENCAP_NETTL_TOKEN_RING */
313 { "Token Ring with nettl headers", "tr-nettl" },
315 /* WTAP_ENCAP_NETTL_FDDI */
316 { "FDDI with nettl headers", "fddi-nettl" },
318 /* WTAP_ENCAP_NETTL_UNKNOWN */
319 { "Unknown link-layer type with nettl headers", "unknown-nettl" },
321 /* WTAP_ENCAP_MTP2_WITH_PHDR */
322 { "MTP2 with pseudoheader", "mtp2-with-phdr" },
324 /* WTAP_ENCAP_JUNIPER_PPPOE */
325 { "Juniper PPPoE", "juniper-pppoe" },
327 /* WTAP_ENCAP_GCOM_TIE1 */
328 { "GCOM TIE1", "gcom-tie1" },
330 /* WTAP_ENCAP_GCOM_SERIAL */
331 { "GCOM Serial", "gcom-serial" },
333 /* WTAP_ENCAP_NETTL_X25 */
334 { "X25 with nettl headers", "x25-nettl" },
337 { "K12 protocol analyzer", "k12" },
339 /* WTAP_ENCAP_JUNIPER_MLPPP */
340 { "Juniper MLPPP", "juniper-mlppp" },
342 /* WTAP_ENCAP_JUNIPER_MLFR */
343 { "Juniper MLFR", "juniper-mlfr" },
345 /* WTAP_ENCAP_JUNIPER_ETHER */
346 { "Juniper Ethernet", "juniper-ether" },
348 /* WTAP_ENCAP_JUNIPER_PPP */
349 { "Juniper PPP", "juniper-ppp" },
351 /* WTAP_ENCAP_JUNIPER_FRELAY */
352 { "Juniper Frame-Relay", "juniper-frelay" },
354 /* WTAP_ENCAP_JUNIPER_CHDLC */
355 { "Juniper C-HDLC", "juniper-chdlc" },
357 /* WTAP_ENCAP_JUNIPER_GGSN */
358 { "Juniper GGSN", "juniper-ggsn" },
360 /* WTAP_ENCAP_LINUX_LAPD */
363 /* WTAP_ENCAP_CATAPULT_DCT2000 */
364 { "Catapult DCT2000", "dct2000" },
367 { "ASN.1 Basic Encoding Rules", "ber" },
369 /* WTAP_ENCAP_JUNIPER_VP */
370 { "Juniper Voice PIC", "juniper-vp" },
373 { "Raw USB packets", "usb" },
375 /* WTAP_ENCAP_IEEE802_16_MAC_CPS */
376 { "IEEE 802.16 MAC Common Part Sublayer", "ieee-802-16-mac-cps" },
378 /* WTAP_ENCAP_NETTL_RAW_TELNET */
379 { "Raw telnet with nettl headers", "raw-telnet-nettl" },
381 /* WTAP_ENCAP_USB_LINUX */
382 { "USB packets with Linux header", "usb-linux" },
384 /* WTAP_ENCAP_MPEG */
388 { "Per-Packet Information header", "ppi" },
391 { "Endace Record File", "erf" },
393 /* WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR */
394 { "Bluetooth H4 with linux header", "bluetooth-h4-linux" },
396 /* WTAP_ENCAP_SITA */
397 { "SITA WAN packets", "sita-wan" },
399 /* WTAP_ENCAP_SCCP */
400 { "SS7 SCCP", "sccp" },
402 /* WTAP_ENCAP_BLUETOOTH_HCI */
403 { "Bluetooth without transport layer", "bluetooth-hci" },
405 /* WTAP_ENCAP_IPMB */
406 { "Intelligent Platform Management Bus", "ipmb" },
408 /* WTAP_ENCAP_IEEE802_15_4 */
409 { "IEEE 802.15.4 Wireless PAN", "wpan" },
411 /* WTAP_ENCAP_X2E_XORAYA */
412 { "X2E Xoraya", "x2e-xoraya" },
414 /* WTAP_ENCAP_FLEXRAY */
415 { "FlexRay", "flexray" },
418 { "Local Interconnect Network", "lin" },
420 /* WTAP_ENCAP_MOST */
421 { "Media Oriented Systems Transport", "most" },
423 /* WTAP_ENCAP_CAN20B */
424 { "Controller Area Network 2.0B", "can20b" },
426 /* WTAP_ENCAP_LAYER1_EVENT */
427 { "EyeSDN Layer 1 event", "layer1-event" },
429 /* WTAP_ENCAP_X2E_SERIAL */
430 { "X2E serial line capture", "x2e-serial" },
435 /* WTAP_ENCAP_IEEE802_15_4_NONASK_PHY */
436 { "IEEE 802.15.4 Wireless PAN non-ASK PHY", "wpan-nonask-phy" },
438 /* WTAP_ENCAP_TNEF */
439 { "Transport-Neutral Encapsulation Format", "tnef" },
441 /* WTAP_ENCAP_USB_LINUX_MMAPPED */
442 { "USB packets with Linux header and padding", "usb-linux-mmap" },
444 /* WTAP_ENCAP_GSM_UM */
445 { "GSM Um Interface", "gsm_um" },
447 /* WTAP_ENCAP_DPNSS */
448 { "Digital Private Signalling System No 1 Link Layer", "dpnss_link" },
450 /* WTAP_ENCAP_PACKETLOGGER */
451 { "PacketLogger", "packetlogger" },
453 /* WTAP_ENCAP_NSTRACE_1_0 */
454 { "NetScaler Encapsulation 1.0 of Ethernet", "nstrace10" },
456 /* WTAP_ENCAP_NSTRACE_2_0 */
457 { "NetScaler Encapsulation 2.0 of Ethernet", "nstrace20" },
459 /* WTAP_ENCAP_FIBRE_CHANNEL_FC2 */
460 { "Fibre Channel FC-2", "fc2" },
462 /* WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS */
463 { "Fibre Channel FC-2 With Frame Delimiter", "fc2sof"},
465 /* WTAP_ENCAP_JPEG_JFIF */
466 { "JPEG/JFIF", "jfif" },
468 /* WTAP_ENCAP_IPNET */
469 { "Solaris IPNET", "ipnet" },
471 /* WTAP_ENCAP_SOCKETCAN */
472 { "SocketCAN", "socketcan" },
474 /* WTAP_ENCAP_IEEE802_11_NETMON_RADIO */
475 { "IEEE 802.11 plus Network Monitor radio header", "ieee-802-11-netmon" },
477 /* WTAP_ENCAP_IEEE802_15_4_NOFCS */
478 { "IEEE 802.15.4 Wireless PAN with FCS not present", "wpan-nofcs" },
480 /* WTAP_ENCAP_RAW_IPFIX */
481 { "IPFIX", "ipfix" },
483 /* WTAP_ENCAP_RAW_IP4 */
484 { "Raw IPv4", "rawip4" },
486 /* WTAP_ENCAP_RAW_IP6 */
487 { "Raw IPv6", "rawip6" },
489 /* WTAP_ENCAP_LAPD */
490 { "Lapd header", "lapd" },
492 /* WTAP_ENCAP_DVBCI */
493 { "DVB-CI (Common Interface)", "dvbci"},
495 /* WTAP_ENCAP_MUX27010 */
496 { "MUX27010", "mux27010"}
499 gint wtap_num_encap_types = sizeof(encap_table_base) / sizeof(struct encap_type_info);
500 static GArray* encap_table_arr = NULL;
501 static const struct encap_type_info* encap_table = NULL;
503 static void wtap_init_encap_types(void) {
505 if (encap_table_arr) return;
507 encap_table_arr = g_array_new(FALSE,TRUE,sizeof(struct encap_type_info));
509 g_array_append_vals(encap_table_arr,encap_table_base,wtap_num_encap_types);
511 encap_table = (void*)encap_table_arr->data;
514 int wtap_get_num_encap_types(void) {
515 wtap_init_encap_types();
516 return wtap_num_encap_types;
520 int wtap_register_encap_type(char* name, char* short_name) {
521 struct encap_type_info e;
522 wtap_init_encap_types();
524 e.name = g_strdup(name);
525 e.short_name = g_strdup(short_name);
527 g_array_append_val(encap_table_arr,e);
529 encap_table = (void*)encap_table_arr->data;
531 return wtap_num_encap_types++;
535 /* Name that should be somewhat descriptive. */
537 *wtap_encap_string(int encap)
539 if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
541 else if (encap == WTAP_ENCAP_PER_PACKET)
544 return encap_table[encap].name;
547 /* Name to use in, say, a command-line flag specifying the type. */
549 *wtap_encap_short_string(int encap)
551 if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
553 else if (encap == WTAP_ENCAP_PER_PACKET)
556 return encap_table[encap].short_name;
559 /* Translate a short name to a capture file type. */
561 wtap_short_string_to_encap(const char *short_name)
565 for (encap = 0; encap < WTAP_NUM_ENCAP_TYPES; encap++) {
566 if (encap_table[encap].short_name != NULL &&
567 strcmp(short_name, encap_table[encap].short_name) == 0)
570 return -1; /* no such encapsulation type */
573 static const char *wtap_errlist[] = {
574 "The file isn't a plain file or pipe",
575 "The file is being opened for random access but is a pipe",
576 "The file isn't a capture file in a known format",
577 "File contains record data we don't support",
578 "That file format cannot be written to a pipe",
580 "Files can't be saved in that format",
581 "Files from that network type can't be saved in that format",
582 "That file format doesn't support per-packet encapsulations",
585 "Less data was read than was expected",
586 "File contains a record that's not valid",
587 "Less data was written than was requested",
588 "Uncompression error: data oddly truncated",
589 "Uncompression error: data would overflow buffer",
590 "Uncompression error: bad LZ77 offset",
591 "The standard input cannot be opened for random access",
592 "That file format doesn't support compression",
594 "Uncompression error",
597 #define WTAP_ERRLIST_SIZE (sizeof wtap_errlist / sizeof wtap_errlist[0])
600 *wtap_strerror(int err)
602 static char errbuf[128];
603 unsigned int wtap_errlist_index;
606 wtap_errlist_index = -1 - err;
607 if (wtap_errlist_index >= WTAP_ERRLIST_SIZE) {
608 g_snprintf(errbuf, 128, "Error %d", err);
611 if (wtap_errlist[wtap_errlist_index] == NULL)
612 return "Unknown reason";
613 return wtap_errlist[wtap_errlist_index];
615 return strerror(err);
618 /* Close only the sequential side, freeing up memory it uses.
620 Note that we do *not* want to call the subtype's close function,
621 as it would free any per-subtype data, and that data may be
622 needed by the random-access side.
624 Instead, if the subtype has a "sequential close" function, we call it,
625 to free up stuff used only by the sequential side. */
627 wtap_sequential_close(wtap *wth)
629 if (wth->subtype_sequential_close != NULL)
630 (*wth->subtype_sequential_close)(wth);
632 if (wth->fh != NULL) {
637 if (wth->frame_buffer) {
638 buffer_free(wth->frame_buffer);
639 g_free(wth->frame_buffer);
640 wth->frame_buffer = NULL;
645 g_fast_seek_item_free(gpointer data, gpointer user_data _U_)
651 wtap_close(wtap *wth)
653 wtap_sequential_close(wth);
655 if (wth->subtype_close != NULL)
656 (*wth->subtype_close)(wth);
658 if (wth->random_fh != NULL)
659 file_close(wth->random_fh);
661 if (wth->priv != NULL)
664 if (wth->fast_seek != NULL) {
665 g_ptr_array_foreach(wth->fast_seek, g_fast_seek_item_free, NULL);
666 g_ptr_array_free(wth->fast_seek, TRUE);
672 wtap_cleareof(wtap *wth _U_) {
674 if (file_eof(wth->fh))
675 file_clearerr(wth->fh);
678 void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4) {
680 wth->add_new_ipv4 = add_new_ipv4;
683 void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6) {
685 wth->add_new_ipv6 = add_new_ipv6;
689 wtap_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
692 * Set the packet encapsulation to the file's encapsulation
693 * value; if that's not WTAP_ENCAP_PER_PACKET, it's the
694 * right answer (and means that the read routine for this
695 * capture file type doesn't have to set it), and if it
696 * *is* WTAP_ENCAP_PER_PACKET, the caller needs to set it
699 wth->phdr.pkt_encap = wth->file_encap;
701 if (!wth->subtype_read(wth, err, err_info, data_offset)) {
703 * If we didn't get an error indication, we read
704 * the last packet. See if there's any deferred
705 * error, as might, for example, occur if we're
706 * reading a compressed file, and we got an error
707 * reading compressed data from the file, but
708 * got enough compressed data to decompress the
709 * last packet of the file.
712 *err = file_error(wth->fh, err_info);
713 return FALSE; /* failure */
717 * It makes no sense for the captured data length to be bigger
718 * than the actual data length.
720 if (wth->phdr.caplen > wth->phdr.len)
721 wth->phdr.caplen = wth->phdr.len;
724 * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
725 * probably means the file has that encapsulation type
726 * but the read routine didn't set this packet's
727 * encapsulation type.
729 g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET);
731 return TRUE; /* success */
735 * Return an approximation of the amount of data we've read sequentially
736 * from the file so far. (gint64, in case that's 64 bits.)
739 wtap_read_so_far(wtap *wth, int *err)
743 file_pos = ws_lseek64(wth->fd, 0, SEEK_CUR);
744 if (file_pos == -1) {
758 union wtap_pseudo_header*
759 wtap_pseudoheader(wtap *wth)
761 return &wth->pseudo_header;
765 wtap_buf_ptr(wtap *wth)
767 return buffer_start_ptr(wth->frame_buffer);
771 wtap_seek_read(wtap *wth, gint64 seek_off,
772 union wtap_pseudo_header *pseudo_header, guint8 *pd, int len,
773 int *err, gchar **err_info)
775 return wth->subtype_seek_read(wth, seek_off, pseudo_header, pd, len,