2012-07-09 23:07:28 +00:00
|
|
|
/* peektagged.c
|
|
|
|
* Routines for opening files in what WildPackets calls the tagged file
|
|
|
|
* format in the description of their "PeekRdr Sample Application" (C++
|
|
|
|
* source code to read their capture files, downloading of which requires
|
|
|
|
* a maintenance contract, so it's not free as in beer and probably not
|
|
|
|
* as in speech, either).
|
|
|
|
*
|
|
|
|
* As that description says, it's used by AiroPeek and AiroPeek NX 2.0
|
|
|
|
* and later, EtherPeek 6.0 and later, EtherPeek NX 3.0 and later,
|
|
|
|
* EtherPeek VX 1.0 and later, GigaPeek NX 1.0 and later, Omni3 1.0
|
|
|
|
* and later (both OmniPeek and the Remote Engine), and WANPeek NX
|
|
|
|
* 1.0 and later. They also say it'll be used by future WildPackets
|
|
|
|
* products.
|
2003-12-02 19:37:05 +00:00
|
|
|
*
|
|
|
|
* Wiretap Library
|
|
|
|
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 22:56:06 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
2003-12-02 19:37:05 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
#include <errno.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include "wtap-int.h"
|
|
|
|
#include "file_wrappers.h"
|
2014-07-15 23:40:46 +00:00
|
|
|
#include <wsutil/buffer.h>
|
2012-07-09 23:07:28 +00:00
|
|
|
#include "peektagged.h"
|
2003-12-02 19:37:05 +00:00
|
|
|
|
|
|
|
/* CREDITS
|
|
|
|
*
|
|
|
|
* This file decoder could not have been writen without examining
|
2012-12-29 21:46:59 +00:00
|
|
|
* http://www.varsanofiev.com/inside/airopeekv9.htm, the help from
|
2012-07-09 23:07:28 +00:00
|
|
|
* Martin Regner and Guy Harris, and the etherpeek.c file (as it
|
|
|
|
* was called before renaming it to peekclassic.c).
|
2004-02-06 02:11:52 +00:00
|
|
|
*/
|
|
|
|
|
2012-12-29 21:59:27 +00:00
|
|
|
/*
|
|
|
|
* Section header.
|
|
|
|
*
|
|
|
|
* A Peek tagged file consists of multiple sections, each of which begins
|
|
|
|
* with a header in the following format.
|
|
|
|
*
|
|
|
|
* The section ID is a 4-character string saying what type of section
|
|
|
|
* it is. The section length is a little-endian field giving the
|
|
|
|
* length of the section, in bytes, including the section header
|
|
|
|
* itself. The other field of the section header is a little-endian
|
|
|
|
* constant that always appears to be 0x00000200.
|
|
|
|
*
|
|
|
|
* Files we've seen have the following sections, in order:
|
|
|
|
*
|
|
|
|
* "\177vers" - version information. The contents are XML, giving
|
|
|
|
* the file format version and application version information.
|
|
|
|
*
|
|
|
|
* "sess" - capture session information. The contents are XML, giving
|
|
|
|
* various information about the capture session.
|
|
|
|
*
|
|
|
|
* "pkts" - captured packets. The contents are binary records, one for
|
|
|
|
* each packet, with the record being a list of tagged values followed
|
|
|
|
* by the raw packet data.
|
|
|
|
*/
|
2012-07-09 23:07:28 +00:00
|
|
|
typedef struct peektagged_section_header {
|
2012-12-29 21:59:27 +00:00
|
|
|
gint8 section_id[4]; /* string identifying the section */
|
|
|
|
guint32 section_len; /* little-endian section length */
|
|
|
|
guint32 section_const; /* little-endian 0x00000200 */
|
2012-07-09 23:07:28 +00:00
|
|
|
} peektagged_section_header_t;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2008-09-11 03:37:16 +00:00
|
|
|
/*
|
|
|
|
* Network subtype values.
|
|
|
|
*
|
|
|
|
* XXX - do different network subtype values for 802.11 indicate different
|
|
|
|
* network adapter types, with some adapters supplying the FCS and others
|
|
|
|
* not supplying the FCS?
|
|
|
|
*/
|
2012-07-09 23:07:28 +00:00
|
|
|
#define PEEKTAGGED_NST_ETHERNET 0
|
|
|
|
#define PEEKTAGGED_NST_802_11 1 /* 802.11 with 0's at the end */
|
|
|
|
#define PEEKTAGGED_NST_802_11_2 2 /* 802.11 with 0's at the end */
|
|
|
|
#define PEEKTAGGED_NST_802_11_WITH_FCS 3 /* 802.11 with FCS at the end */
|
2004-02-06 20:50:44 +00:00
|
|
|
|
|
|
|
/* tags for fields in packet header */
|
2012-07-09 23:07:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_LENGTH 0x0000
|
|
|
|
#define TAG_PEEKTAGGED_TIMESTAMP_LOWER 0x0001
|
|
|
|
#define TAG_PEEKTAGGED_TIMESTAMP_UPPER 0x0002
|
2014-10-28 06:49:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_FLAGS_AND_STATUS 0x0003 /* upper 24 bits unused? */
|
2012-07-09 23:07:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_CHANNEL 0x0004
|
2014-10-28 06:49:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_RATE 0x0005 /* or MCS index for 802.11n */
|
2012-07-09 23:07:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_SIGNAL_PERC 0x0006
|
|
|
|
#define TAG_PEEKTAGGED_SIGNAL_DBM 0x0007
|
|
|
|
#define TAG_PEEKTAGGED_NOISE_PERC 0x0008
|
|
|
|
#define TAG_PEEKTAGGED_NOISE_DBM 0x0009
|
2013-12-26 12:58:26 +00:00
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x000A 0x000A
|
2014-10-28 06:49:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_CENTER_FREQUENCY 0x000D /* Frequency */
|
2013-12-26 12:58:26 +00:00
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x000E 0x000E
|
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x000F 0x000F /* 000F-0013 - dBm values? */
|
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x0010 0x0010
|
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x0011 0x0011
|
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x0012 0x0012
|
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x0013 0x0013
|
|
|
|
#define TAG_PEEKTAGGED_UNKNOWN_0x0014 0x0014
|
2014-10-28 06:49:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_EXT_FLAGS 0x0015 /* Extended flags for 802.11n and beyond */
|
2013-12-26 12:58:26 +00:00
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
#define TAG_PEEKTAGGED_SLICE_LENGTH 0xffff
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-10-28 06:49:28 +00:00
|
|
|
/*
|
|
|
|
* Flags.
|
|
|
|
*
|
|
|
|
* We're assuming here that the "remote Peek" flags from bug 9586 are
|
|
|
|
* the same as the "Peek tagged" flags.
|
|
|
|
*/
|
|
|
|
#define FLAGS_CONTROL_FRAME 0x01 /* Frame is a control frame */
|
|
|
|
#define FLAGS_HAS_CRC_ERROR 0x02 /* Frame has a CRC error */
|
|
|
|
#define FLAGS_HAS_FRAME_ERROR 0x04 /* Frame has a frame error */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Status.
|
|
|
|
*
|
|
|
|
* Is this in the next 8 bits of the "flags and status" field?
|
|
|
|
*/
|
|
|
|
#define STATUS_PROTECTED 0x0400 /* Frame is protected (encrypted) */
|
|
|
|
#define STATUS_DECRYPT_ERROR 0x0800 /* Error decrypting protected frame */
|
|
|
|
#define STATUS_SHORT_PREAMBLE 0x4000 /* Short preamble */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Extended flags.
|
|
|
|
*
|
|
|
|
* Some determined from bug 10637, some determined from bug 9586,
|
|
|
|
* and the ones present in both agree, so we're assuming that
|
|
|
|
* the "remote Peek" protocol and the "Peek tagged" file format
|
|
|
|
* use the same bits (which wouldn't be too surprising, as they
|
|
|
|
* both come from Wildpackets).
|
|
|
|
*/
|
|
|
|
#define EXT_FLAG_20_MHZ_LOWER 0x00000001
|
|
|
|
#define EXT_FLAG_20_MHZ_UPPER 0x00000002
|
|
|
|
#define EXT_FLAG_40_MHZ 0x00000004
|
|
|
|
#define EXT_FLAG_HALF_GI 0x00000008
|
|
|
|
#define EXT_FLAG_FULL_GI 0x00000010
|
|
|
|
#define EXT_FLAG_AMPDU 0x00000020
|
|
|
|
#define EXT_FLAG_AMSDU 0x00000040
|
|
|
|
#define EXT_FLAG_802_11ac 0x00000080
|
|
|
|
#define EXT_FLAG_MCS_INDEX_USED 0x00000100
|
|
|
|
|
2014-10-28 07:24:49 +00:00
|
|
|
/*
|
|
|
|
* XXX - mapping to radiotap, for fields that don't just map to wiretap
|
|
|
|
* fields:
|
|
|
|
*
|
|
|
|
* FLAGS_CONTROL_FRAME: no equivalent - is it useful? Can just look at FC?
|
|
|
|
*
|
|
|
|
* FLAGS_HAS_CRC_ERROR: flags.{frame failed FCS check}
|
|
|
|
*
|
|
|
|
* FLAGS_HAS_FRAME_ERROR: no equivalent
|
|
|
|
*
|
|
|
|
* STATUS_PROTECTED: flags.{sent/received with WEP encryption}?
|
|
|
|
*
|
|
|
|
* STATUS_DECRYPT_ERROR: no equivalent
|
|
|
|
*
|
|
|
|
* STATUS_SHORT_PREAMBLE: flags.{sent/received with short preamble}
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_CHANNEL: no equivalent, but could be mapped to Channel
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_RATE: Rate if it's a data rate, MCS.mcs if it's an MCS
|
|
|
|
* Does EXT_FLAG_MCS_INDEX_USED map to the "MCS known" bit ?
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_SIGNAL_PERC: no equivalent
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_SIGNAL_DBM: Antenna signal
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_NOISE_PERC: no equivalent
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_NOISE_DBM: Antenna noise
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_CENTER_FREQUENCY: XChannel.freq
|
|
|
|
*
|
|
|
|
* TAG_PEEKTAGGED_UNKNOWN_0x000F - TAG_PEEKTAGGED_UNKNOWN_0x0013: no equivalent
|
|
|
|
*
|
|
|
|
* EXT_FLAG_20_MHZ_LOWER
|
|
|
|
* EXT_FLAG_20_MHZ_UPPER
|
|
|
|
* EXT_FLAG_40_MHZ:
|
|
|
|
* mcs.bandwidth = 0: none of them set
|
|
|
|
* mcs.bandwidth = 1: EXT_FLAG_40_MHZ set
|
|
|
|
* mcs.bandwidth = 2: EXT_FLAG_20_MHZ_LOWER set
|
|
|
|
* mcs.bandwidth = 3: EXT_FLAG_20_MHZ_UPPER set
|
|
|
|
* anything else: ???
|
|
|
|
*
|
|
|
|
* EXT_FLAG_HALF_GI: mcs.{guard interval} = 1 (short GI)
|
|
|
|
*
|
|
|
|
* EXT_FLAG_FULL_GI: mcs.{guard interval} = 0 (long GI)
|
|
|
|
*
|
|
|
|
* EXT_FLAG_AMPDU: A-MPDU status present? What about its value?
|
|
|
|
*
|
|
|
|
* EXT_FLAG_AMSDU: ???
|
|
|
|
*
|
|
|
|
* EXT_FLAG_802_11ac: nothing currently
|
|
|
|
*
|
|
|
|
* EXT_FLAG_MCS_INDEX_USED: see above?
|
|
|
|
*/
|
|
|
|
|
2004-02-06 04:27:19 +00:00
|
|
|
/* 64-bit time in nanoseconds from the (Windows FILETIME) epoch */
|
2012-07-09 23:07:28 +00:00
|
|
|
typedef struct peektagged_utime {
|
2003-12-02 19:37:05 +00:00
|
|
|
guint32 upper;
|
|
|
|
guint32 lower;
|
2012-07-09 23:07:28 +00:00
|
|
|
} peektagged_utime;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2010-02-26 07:59:54 +00:00
|
|
|
typedef struct {
|
|
|
|
gboolean has_fcs;
|
2012-07-09 23:07:28 +00:00
|
|
|
} peektagged_t;
|
2010-02-26 07:59:54 +00:00
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean peektagged_read(wtap *wth, int *err, gchar **err_info,
|
2006-11-05 22:46:44 +00:00
|
|
|
gint64 *data_offset);
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean peektagged_seek_read(wtap *wth, gint64 seek_off,
|
2014-05-09 05:18:49 +00:00
|
|
|
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
static int wtap_file_read_pattern (wtap *wth, const char *pattern, int *err,
|
2011-04-21 09:41:52 +00:00
|
|
|
gchar **err_info)
|
2003-12-02 19:37:05 +00:00
|
|
|
{
|
2003-12-02 20:27:14 +00:00
|
|
|
int c;
|
2005-07-22 07:55:51 +00:00
|
|
|
const char *cp;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
|
|
|
cp = pattern;
|
|
|
|
while (*cp)
|
|
|
|
{
|
2014-05-09 05:18:49 +00:00
|
|
|
c = file_getc(wth->fh);
|
|
|
|
if (c == EOF)
|
|
|
|
{
|
|
|
|
*err = file_error(wth->fh, err_info);
|
|
|
|
if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
|
|
|
|
return -1; /* error */
|
|
|
|
return 0; /* EOF */
|
|
|
|
}
|
|
|
|
if (c == *cp)
|
|
|
|
cp++;
|
|
|
|
else
|
|
|
|
{
|
|
|
|
if (c == pattern[0])
|
|
|
|
cp = &pattern[1];
|
|
|
|
else
|
|
|
|
cp = pattern;
|
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|
2003-12-02 20:27:14 +00:00
|
|
|
return (*cp == '\0' ? 1 : 0);
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
static int wtap_file_read_till_separator (wtap *wth, char *buffer, int buflen,
|
2011-04-21 09:41:52 +00:00
|
|
|
const char *separators, int *err,
|
|
|
|
gchar **err_info)
|
2003-12-02 19:37:05 +00:00
|
|
|
{
|
2003-12-02 20:27:14 +00:00
|
|
|
int c;
|
2003-12-02 19:37:05 +00:00
|
|
|
char *cp;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (cp = buffer, i = 0; i < buflen; i++, cp++)
|
|
|
|
{
|
2014-05-09 05:18:49 +00:00
|
|
|
c = file_getc(wth->fh);
|
|
|
|
if (c == EOF)
|
|
|
|
{
|
|
|
|
*err = file_error(wth->fh, err_info);
|
|
|
|
if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
|
|
|
|
return -1; /* error */
|
|
|
|
return 0; /* EOF */
|
|
|
|
}
|
|
|
|
if (strchr (separators, c) != NULL)
|
|
|
|
{
|
|
|
|
*cp = '\0';
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
*cp = c;
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|
|
|
|
return i;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
static int wtap_file_read_number (wtap *wth, guint32 *num, int *err,
|
2011-04-21 09:41:52 +00:00
|
|
|
gchar **err_info)
|
2003-12-02 19:37:05 +00:00
|
|
|
{
|
2003-12-02 20:27:14 +00:00
|
|
|
int ret;
|
2003-12-02 19:37:05 +00:00
|
|
|
char str_num[12];
|
2003-12-03 19:47:36 +00:00
|
|
|
unsigned long value;
|
2003-12-02 19:37:05 +00:00
|
|
|
char *p;
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_till_separator (wth, str_num, sizeof (str_num)-1, "<",
|
|
|
|
err, err_info);
|
2014-10-10 10:21:57 +00:00
|
|
|
if (ret == 0 || ret == -1) {
|
2014-05-09 05:18:49 +00:00
|
|
|
/* 0 means EOF, which means "not a valid Peek tagged file";
|
|
|
|
-1 means error, and "err" has been set. */
|
|
|
|
return ret;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
value = strtoul (str_num, &p, 10);
|
2009-04-22 03:07:37 +00:00
|
|
|
if (p == str_num || value > G_MAXUINT32)
|
2014-05-09 05:18:49 +00:00
|
|
|
return 0;
|
2009-04-22 03:07:37 +00:00
|
|
|
*num = (guint32)value;
|
2003-12-02 20:27:14 +00:00
|
|
|
return 1;
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2014-10-09 23:44:15 +00:00
|
|
|
wtap_open_return_val peektagged_open(wtap *wth, int *err, gchar **err_info)
|
2003-12-02 19:37:05 +00:00
|
|
|
{
|
2012-07-09 23:07:28 +00:00
|
|
|
peektagged_section_header_t ap_hdr;
|
2003-12-02 20:27:14 +00:00
|
|
|
int ret;
|
2003-12-02 19:37:05 +00:00
|
|
|
guint32 fileVersion;
|
|
|
|
guint32 mediaType;
|
2007-05-21 16:16:18 +00:00
|
|
|
guint32 mediaSubType = 0;
|
2003-12-02 19:37:05 +00:00
|
|
|
int file_encap;
|
2012-07-09 23:07:28 +00:00
|
|
|
static const int peektagged_encap[] = {
|
2014-05-09 05:18:49 +00:00
|
|
|
WTAP_ENCAP_ETHERNET,
|
|
|
|
WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
|
|
|
|
WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
|
|
|
|
WTAP_ENCAP_IEEE_802_11_WITH_RADIO
|
2004-02-06 02:11:52 +00:00
|
|
|
};
|
2012-07-09 23:07:28 +00:00
|
|
|
#define NUM_PEEKTAGGED_ENCAPS (sizeof peektagged_encap / sizeof peektagged_encap[0])
|
|
|
|
peektagged_t *peektagged;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes(wth->fh, &ap_hdr, (int)sizeof(ap_hdr), err, err_info)) {
|
|
|
|
if (*err != WTAP_ERR_SHORT_READ)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
return WTAP_OPEN_NOT_MINE;
|
Do not call wtap_file_read_unknown_bytes() or
wtap_file_read_expected_bytes() from an open routine - open routines are
supposed to return -1 on error, 0 if the file doesn't appear to be a
file of the specified type, or 1 if the file does appear to be a file of
the specified type, but those macros will cause the caller to return
FALSE on errors (so that, even if there's an I/O error, it reports "the
file isn't a file of the specified type" rather than "we got an error
trying to read the file").
When doing reads in an open routine before we've concluded that the file
is probably of the right type, return 0, rather than -1, if we get
WTAP_ERR_SHORT_READ - if we don't have enough data to check whether a
file is of a given type, we should keep trying other types, not give up.
For reads done *after* we've concluded the file is probably of the right
type, if a read doesn't return the number of bytes we asked for, but
returns an error of 0, return WTAP_ERR_SHORT_READ - the file is
apparently cut short.
For NetMon and NetXRay/Windows Sniffer files, use a #define for the
magic number size, and use that for both magic numbers.
svn path=/trunk/; revision=46803
2012-12-27 12:19:25 +00:00
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2003-12-02 20:27:14 +00:00
|
|
|
if (memcmp (ap_hdr.section_id, "\177ver", sizeof(ap_hdr.section_id)) != 0)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_NOT_MINE; /* doesn't begin with a "\177ver" section */
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2003-12-02 20:27:14 +00:00
|
|
|
/*
|
|
|
|
* XXX - we should get the length of the "\177ver" section, check
|
|
|
|
* that it's followed by a little-endian 0x00000200, and then,
|
|
|
|
* when reading the XML, make sure we don't go past the end of
|
2004-02-06 04:27:19 +00:00
|
|
|
* that section, and skip to the end of that section when
|
2003-12-02 20:27:14 +00:00
|
|
|
* we have the file version (and possibly check to make sure all
|
|
|
|
* tags are properly opened and closed).
|
|
|
|
*/
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_pattern (wth, "<FileVersion>", err, err_info);
|
2014-10-10 01:14:12 +00:00
|
|
|
if (ret == -1)
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
if (ret == 0) {
|
|
|
|
/* 0 means EOF, which means "not a valid Peek tagged file" */
|
|
|
|
return WTAP_OPEN_NOT_MINE;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_number (wth, &fileVersion, err, err_info);
|
2014-10-10 01:14:12 +00:00
|
|
|
if (ret == -1)
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
if (ret == 0) {
|
|
|
|
/* 0 means EOF, which means "not a valid Peek tagged file" */
|
|
|
|
return WTAP_OPEN_NOT_MINE;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
|
|
|
|
2012-07-09 23:10:45 +00:00
|
|
|
/* If we got this far, we assume it's a Peek tagged file. */
|
2003-12-02 20:27:14 +00:00
|
|
|
if (fileVersion != 9) {
|
2004-02-06 04:27:19 +00:00
|
|
|
/* We only support version 9. */
|
2003-12-02 20:27:14 +00:00
|
|
|
*err = WTAP_ERR_UNSUPPORTED;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup_printf("peektagged: version %u unsupported",
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
fileVersion);
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* XXX - once we've skipped the "\177ver" section, we should
|
|
|
|
* check for a "sess" section and fail if we don't see it.
|
|
|
|
* Then we should get the length of the "sess" section, check
|
|
|
|
* that it's followed by a little-endian 0x00000200, and then,
|
|
|
|
* when reading the XML, make sure we don't go past the end of
|
2004-02-06 02:11:52 +00:00
|
|
|
* that section, and skip to the end of the section when
|
2003-12-02 20:27:14 +00:00
|
|
|
* we have the file version (and possibly check to make sure all
|
|
|
|
* tags are properly opened and closed).
|
|
|
|
*/
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_pattern (wth, "<MediaType>", err, err_info);
|
2003-12-02 20:27:14 +00:00
|
|
|
if (ret == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
if (ret == 0) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup("peektagged: <MediaType> tag not found");
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
2004-02-06 02:11:52 +00:00
|
|
|
/* XXX - this appears to be 0 in both the EtherPeek and AiroPeek
|
|
|
|
files we've seen; should we require it to be 0? */
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_number (wth, &mediaType, err, err_info);
|
2003-12-02 20:27:14 +00:00
|
|
|
if (ret == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
if (ret == 0) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup("peektagged: <MediaType> value not found");
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_pattern (wth, "<MediaSubType>", err, err_info);
|
2004-02-06 02:11:52 +00:00
|
|
|
if (ret == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2004-02-06 02:11:52 +00:00
|
|
|
if (ret == 0) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup("peektagged: <MediaSubType> tag not found");
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2004-02-06 02:11:52 +00:00
|
|
|
}
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_number (wth, &mediaSubType, err, err_info);
|
2004-02-06 02:11:52 +00:00
|
|
|
if (ret == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2004-02-06 02:11:52 +00:00
|
|
|
if (ret == 0) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup("peektagged: <MediaSubType> value not found");
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2004-02-06 02:11:52 +00:00
|
|
|
}
|
2012-07-09 23:07:28 +00:00
|
|
|
if (mediaSubType >= NUM_PEEKTAGGED_ENCAPS
|
|
|
|
|| peektagged_encap[mediaSubType] == WTAP_ENCAP_UNKNOWN) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
|
|
|
|
*err_info = g_strdup_printf("peektagged: network type %u unknown or unsupported",
|
|
|
|
mediaSubType);
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2004-02-06 02:11:52 +00:00
|
|
|
}
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
ret = wtap_file_read_pattern (wth, "pkts", err, err_info);
|
2003-12-02 20:27:14 +00:00
|
|
|
if (ret == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
if (ret == 0) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2003-12-02 20:27:14 +00:00
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
|
|
|
|
/* skip 8 zero bytes */
|
2014-05-09 05:18:49 +00:00
|
|
|
if (file_seek (wth->fh, 8L, SEEK_CUR, err) == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_NOT_MINE;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
|
|
|
/*
|
2012-07-09 23:10:45 +00:00
|
|
|
* This is an Peek tagged file.
|
2003-12-02 19:37:05 +00:00
|
|
|
*/
|
2012-07-09 23:07:28 +00:00
|
|
|
file_encap = peektagged_encap[mediaSubType];
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_PEEKTAGGED;
|
|
|
|
wth->file_encap = file_encap;
|
|
|
|
wth->subtype_read = peektagged_read;
|
|
|
|
wth->subtype_seek_read = peektagged_seek_read;
|
2014-09-28 18:37:06 +00:00
|
|
|
wth->file_tsprec = WTAP_TSPREC_NSEC;
|
2004-02-06 20:50:44 +00:00
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
peektagged = (peektagged_t *)g_malloc(sizeof(peektagged_t));
|
2014-05-09 05:18:49 +00:00
|
|
|
wth->priv = (void *)peektagged;
|
2004-02-06 20:50:44 +00:00
|
|
|
switch (mediaSubType) {
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case PEEKTAGGED_NST_ETHERNET:
|
|
|
|
case PEEKTAGGED_NST_802_11:
|
|
|
|
case PEEKTAGGED_NST_802_11_2:
|
2014-05-09 05:18:49 +00:00
|
|
|
peektagged->has_fcs = FALSE;
|
|
|
|
break;
|
2004-02-06 20:50:44 +00:00
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case PEEKTAGGED_NST_802_11_WITH_FCS:
|
2014-05-09 05:18:49 +00:00
|
|
|
peektagged->has_fcs = TRUE;
|
|
|
|
break;
|
2004-02-06 20:50:44 +00:00
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
wth->snapshot_length = 0; /* not available in header */
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_MINE;
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|
|
|
|
|
2004-02-06 02:11:52 +00:00
|
|
|
typedef struct {
|
2003-12-02 19:37:05 +00:00
|
|
|
guint32 length;
|
|
|
|
guint32 sliceLength;
|
2012-07-09 23:07:28 +00:00
|
|
|
peektagged_utime timestamp;
|
2004-02-06 02:11:52 +00:00
|
|
|
struct ieee_802_11_phdr ieee_802_11;
|
|
|
|
} hdr_info_t;
|
|
|
|
|
2013-06-02 23:20:11 +00:00
|
|
|
/*
|
|
|
|
* Time stamps appear to be in nanoseconds since the Windows epoch
|
|
|
|
* as used in FILETIMEs, i.e. midnight, January 1, 1601.
|
|
|
|
*
|
|
|
|
* This magic number came from "nt_time_to_nstime()" in "packet-smb.c".
|
|
|
|
* 1970-1601 is 369; I'm not sure what the extra 3 days and 6 hours are
|
|
|
|
* that are being subtracted.
|
|
|
|
*/
|
|
|
|
#define TIME_FIXUP_CONSTANT (369.0*365.25*24*60*60-(3.0*24*60*60+6.0*60*60))
|
|
|
|
|
2004-02-06 02:11:52 +00:00
|
|
|
/*
|
2013-06-17 21:18:47 +00:00
|
|
|
* Read the packet.
|
2004-02-06 02:11:52 +00:00
|
|
|
*
|
|
|
|
* XXX - we should supply the additional radio information;
|
|
|
|
* the pseudo-header should probably be supplied in a fashion
|
2013-06-02 23:20:11 +00:00
|
|
|
* similar to the radiotap radio header, so that the 802.11
|
2004-02-06 02:11:52 +00:00
|
|
|
* dissector can determine which, if any, information items
|
|
|
|
* are present.
|
|
|
|
*/
|
2009-04-22 03:57:37 +00:00
|
|
|
static int
|
2014-05-09 05:18:49 +00:00
|
|
|
peektagged_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
|
2013-06-17 21:18:47 +00:00
|
|
|
Buffer *buf, int *err, gchar **err_info)
|
2004-02-06 02:11:52 +00:00
|
|
|
{
|
2014-05-09 05:18:49 +00:00
|
|
|
peektagged_t *peektagged = (peektagged_t *)wth->priv;
|
2013-06-02 23:20:11 +00:00
|
|
|
hdr_info_t hdr_info;
|
2009-04-22 03:57:37 +00:00
|
|
|
int header_len = 0;
|
2004-02-06 02:11:52 +00:00
|
|
|
guint8 tag_value[6];
|
|
|
|
guint16 tag;
|
2004-02-06 04:48:06 +00:00
|
|
|
gboolean saw_length = FALSE;
|
|
|
|
gboolean saw_timestamp_lower = FALSE;
|
|
|
|
gboolean saw_timestamp_upper = FALSE;
|
2013-06-02 23:20:11 +00:00
|
|
|
int skip_len = 0;
|
|
|
|
double t;
|
2004-02-06 02:11:52 +00:00
|
|
|
|
2013-06-03 07:48:59 +00:00
|
|
|
memset(&hdr_info, 0, sizeof(hdr_info_t));
|
2013-06-03 01:07:26 +00:00
|
|
|
|
2004-02-06 02:11:52 +00:00
|
|
|
/* Extract the fields from the packet header */
|
|
|
|
do {
|
|
|
|
/* Get the tag and value.
|
|
|
|
XXX - this assumes all values are 4 bytes long. */
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes_or_eof(fh, tag_value, sizeof tag_value, err, err_info)) {
|
2004-02-06 02:11:52 +00:00
|
|
|
if (*err == 0) {
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
/*
|
|
|
|
* Short read if we've read something already;
|
|
|
|
* just an EOF if we haven't.
|
|
|
|
*/
|
|
|
|
if (header_len != 0)
|
2004-02-06 02:11:52 +00:00
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
|
|
|
}
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 02:11:52 +00:00
|
|
|
}
|
2009-04-22 03:57:37 +00:00
|
|
|
header_len += (int) sizeof(tag_value);
|
2013-12-03 20:35:50 +00:00
|
|
|
tag = pletoh16(&tag_value[0]);
|
2004-02-06 02:11:52 +00:00
|
|
|
switch (tag) {
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_LENGTH:
|
2004-02-06 04:48:06 +00:00
|
|
|
if (saw_length) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup("peektagged: record has two length fields");
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 04:48:06 +00:00
|
|
|
}
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.length = pletoh32(&tag_value[2]);
|
2004-02-06 04:48:06 +00:00
|
|
|
saw_length = TRUE;
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
2013-11-08 17:17:57 +00:00
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_TIMESTAMP_LOWER:
|
2004-02-06 04:48:06 +00:00
|
|
|
if (saw_timestamp_lower) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup("peektagged: record has two timestamp-lower fields");
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 04:48:06 +00:00
|
|
|
}
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.timestamp.lower = pletoh32(&tag_value[2]);
|
2004-02-06 04:48:06 +00:00
|
|
|
saw_timestamp_lower = TRUE;
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_TIMESTAMP_UPPER:
|
2004-02-06 04:48:06 +00:00
|
|
|
if (saw_timestamp_upper) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup("peektagged: record has two timestamp-upper fields");
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 04:48:06 +00:00
|
|
|
}
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.timestamp.upper = pletoh32(&tag_value[2]);
|
2004-02-06 04:48:06 +00:00
|
|
|
saw_timestamp_upper = TRUE;
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_FLAGS_AND_STATUS:
|
2004-02-06 03:12:21 +00:00
|
|
|
/* XXX - not used yet */
|
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_CHANNEL:
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.ieee_802_11.channel = pletoh32(&tag_value[2]);
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_RATE:
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.ieee_802_11.data_rate = pletoh32(&tag_value[2]);
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_SIGNAL_PERC:
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.ieee_802_11.signal_level = pletoh32(&tag_value[2]);
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_SIGNAL_DBM:
|
2004-02-06 02:11:52 +00:00
|
|
|
/* XXX - not used yet */
|
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_NOISE_PERC:
|
2004-02-06 02:11:52 +00:00
|
|
|
/* XXX - not used yet */
|
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_NOISE_DBM:
|
2004-02-06 02:11:52 +00:00
|
|
|
/* XXX - not used yet */
|
|
|
|
break;
|
|
|
|
|
2013-12-26 12:58:26 +00:00
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x000A:
|
|
|
|
/* XXX - seen in an OmniPeek 802.11n capture; value unknown */
|
|
|
|
break;
|
|
|
|
|
2014-10-28 06:49:28 +00:00
|
|
|
case TAG_PEEKTAGGED_CENTER_FREQUENCY:
|
|
|
|
/* XXX - also seen in an EtherPeek capture; value unknown */
|
2013-12-26 12:58:26 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x000E:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; value unknown */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x000F:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; dBm value? */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x0010:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; dBm value? */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x0011:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; dBm value? */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x0012:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; dBm value? */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x0013:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; dBm value? */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case TAG_PEEKTAGGED_UNKNOWN_0x0014:
|
|
|
|
/* XXX - seen in an AiroPeek/OmniPeek capture; value unknown */
|
|
|
|
break;
|
|
|
|
|
2014-10-28 06:49:28 +00:00
|
|
|
case TAG_PEEKTAGGED_EXT_FLAGS:
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
2012-07-09 23:07:28 +00:00
|
|
|
case TAG_PEEKTAGGED_SLICE_LENGTH:
|
2013-12-03 20:35:50 +00:00
|
|
|
hdr_info.sliceLength = pletoh32(&tag_value[2]);
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
2012-07-09 23:07:28 +00:00
|
|
|
} while (tag != TAG_PEEKTAGGED_SLICE_LENGTH); /* last tag */
|
2004-02-06 02:11:52 +00:00
|
|
|
|
2004-02-06 04:48:06 +00:00
|
|
|
if (!saw_length) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup("peektagged: record has no length field");
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 04:48:06 +00:00
|
|
|
}
|
|
|
|
if (!saw_timestamp_lower) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup("peektagged: record has no timestamp-lower field");
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 04:48:06 +00:00
|
|
|
}
|
|
|
|
if (!saw_timestamp_upper) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup("peektagged: record has no timestamp-upper field");
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2004-02-06 04:48:06 +00:00
|
|
|
}
|
|
|
|
|
2011-12-13 02:42:42 +00:00
|
|
|
/*
|
|
|
|
* If sliceLength is 0, force it to be the actual length of the packet.
|
|
|
|
*/
|
2004-02-06 02:11:52 +00:00
|
|
|
if (hdr_info.sliceLength == 0)
|
|
|
|
hdr_info.sliceLength = hdr_info.length;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2011-12-13 02:42:42 +00:00
|
|
|
if (hdr_info.sliceLength > WTAP_MAX_PACKET_SIZE) {
|
|
|
|
/*
|
|
|
|
* Probably a corrupt capture file; don't blow up trying
|
|
|
|
* to allocate space for an immensely-large packet.
|
|
|
|
*/
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2012-07-09 23:07:28 +00:00
|
|
|
*err_info = g_strdup_printf("peektagged: File has %u-byte packet, bigger than maximum of %u",
|
2011-12-13 02:42:42 +00:00
|
|
|
hdr_info.sliceLength, WTAP_MAX_PACKET_SIZE);
|
2013-06-02 23:20:11 +00:00
|
|
|
return -1;
|
2011-12-13 02:42:42 +00:00
|
|
|
}
|
|
|
|
|
2014-05-24 18:28:30 +00:00
|
|
|
phdr->rec_type = REC_TYPE_PACKET;
|
2013-06-02 23:20:11 +00:00
|
|
|
phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
|
|
|
|
phdr->len = hdr_info.length;
|
|
|
|
phdr->caplen = hdr_info.sliceLength;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2013-06-02 23:20:11 +00:00
|
|
|
/* calculate and fill in packet time stamp */
|
2004-02-06 02:11:52 +00:00
|
|
|
t = (double) hdr_info.timestamp.lower +
|
|
|
|
(double) hdr_info.timestamp.upper * 4294967296.0;
|
2004-02-06 04:27:19 +00:00
|
|
|
t *= 1.0e-9;
|
|
|
|
t -= TIME_FIXUP_CONSTANT;
|
2013-06-02 23:20:11 +00:00
|
|
|
phdr->ts.secs = (time_t) t;
|
|
|
|
phdr->ts.nsecs = (guint32) ((t - phdr->ts.secs)*1000000000);
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
switch (wth->file_encap) {
|
2004-02-06 02:11:52 +00:00
|
|
|
|
|
|
|
case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
|
2013-06-02 23:20:11 +00:00
|
|
|
phdr->pseudo_header.ieee_802_11 = hdr_info.ieee_802_11;
|
2012-07-09 23:07:28 +00:00
|
|
|
if (peektagged->has_fcs)
|
2013-06-02 23:20:11 +00:00
|
|
|
phdr->pseudo_header.ieee_802_11.fcs_len = 4;
|
2004-02-06 20:50:44 +00:00
|
|
|
else {
|
2013-06-02 23:20:11 +00:00
|
|
|
if (phdr->len < 4 || phdr->caplen < 4) {
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("peektagged: 802.11 packet has length < 4");
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
phdr->pseudo_header.ieee_802_11.fcs_len = 0;
|
|
|
|
phdr->len -= 4;
|
|
|
|
phdr->caplen -= 4;
|
|
|
|
skip_len = 4;
|
2004-02-06 20:50:44 +00:00
|
|
|
}
|
2013-06-02 23:20:11 +00:00
|
|
|
phdr->pseudo_header.ieee_802_11.decrypted = FALSE;
|
2004-02-06 03:12:21 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ENCAP_ETHERNET:
|
|
|
|
/*
|
|
|
|
* The last 4 bytes appear to be 0 in the captures I've seen;
|
|
|
|
* are there any captures where it's an FCS?
|
2004-02-06 02:11:52 +00:00
|
|
|
*/
|
2013-06-02 23:20:11 +00:00
|
|
|
if (phdr->len < 4 || phdr->caplen < 4) {
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("peektagged: Ethernet packet has length < 4");
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
phdr->pseudo_header.eth.fcs_len = 0;
|
|
|
|
phdr->len -= 4;
|
|
|
|
phdr->caplen -= 4;
|
|
|
|
skip_len = 4;
|
2004-02-06 02:11:52 +00:00
|
|
|
break;
|
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2013-06-17 21:18:47 +00:00
|
|
|
/* Read the packet data. */
|
|
|
|
if (!wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info))
|
|
|
|
return -1;
|
|
|
|
|
2013-06-02 23:20:11 +00:00
|
|
|
return skip_len;
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean peektagged_read(wtap *wth, int *err, gchar **err_info,
|
2013-06-02 23:20:11 +00:00
|
|
|
gint64 *data_offset)
|
|
|
|
{
|
|
|
|
int skip_len;
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
*data_offset = file_tell(wth->fh);
|
2013-06-02 23:20:11 +00:00
|
|
|
|
2013-06-17 21:18:47 +00:00
|
|
|
/* Read the packet. */
|
2014-05-09 05:18:49 +00:00
|
|
|
skip_len = peektagged_read_packet(wth, wth->fh, &wth->phdr,
|
|
|
|
wth->frame_buffer, err, err_info);
|
2013-06-02 23:20:11 +00:00
|
|
|
if (skip_len == -1)
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2013-06-02 23:20:11 +00:00
|
|
|
|
|
|
|
if (skip_len != 0) {
|
2014-05-09 05:18:49 +00:00
|
|
|
/* Skip extra junk at the end of the packet data. */
|
|
|
|
if (!file_skip(wth->fh, skip_len, err))
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2013-06-02 23:20:11 +00:00
|
|
|
}
|
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
return TRUE;
|
2013-06-02 23:20:11 +00:00
|
|
|
}
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean
|
2014-05-09 05:18:49 +00:00
|
|
|
peektagged_seek_read(wtap *wth, gint64 seek_off,
|
|
|
|
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
|
2003-12-02 19:37:05 +00:00
|
|
|
{
|
2014-05-09 05:18:49 +00:00
|
|
|
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2003-12-02 19:37:05 +00:00
|
|
|
|
2013-06-17 21:18:47 +00:00
|
|
|
/* Read the packet. */
|
2014-05-09 05:18:49 +00:00
|
|
|
if (peektagged_read_packet(wth, wth->random_fh, phdr, buf, err, err_info) == -1) {
|
2013-06-17 21:18:47 +00:00
|
|
|
if (*err == 0)
|
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2013-06-17 21:18:47 +00:00
|
|
|
}
|
2014-05-23 10:50:02 +00:00
|
|
|
return TRUE;
|
2003-12-02 19:37:05 +00:00
|
|
|
}
|