2003-08-26 07:10:39 +00:00
|
|
|
/*
|
2007-10-08 11:41:21 +00:00
|
|
|
*
|
|
|
|
* Copyright (c) 2003 Endace Technology Ltd, Hamilton, New Zealand.
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* This software and documentation has been developed by Endace Technology Ltd.
|
|
|
|
* along with the DAG PCI network capture cards. For further information please
|
|
|
|
* visit http://www.endace.com/.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions are met:
|
|
|
|
*
|
|
|
|
* 1. Redistributions of source code must retain the above copyright notice,
|
|
|
|
* this list of conditions and the following disclaimer.
|
|
|
|
*
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* 3. The name of Endace Technology Ltd may not be used to endorse or promote
|
|
|
|
* products derived from this software without specific prior written
|
|
|
|
* permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY ENDACE TECHNOLOGY LTD ``AS IS'' AND ANY EXPRESS
|
|
|
|
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
|
|
|
* EVENT SHALL ENDACE TECHNOLOGY LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
|
|
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
|
|
|
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
|
|
|
|
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* $Id$
|
|
|
|
*/
|
2003-08-26 07:10:39 +00:00
|
|
|
|
2007-11-19 19:09:01 +00:00
|
|
|
/*
|
2003-08-26 07:10:39 +00:00
|
|
|
* erf - Endace ERF (Extensible Record Format)
|
2005-02-03 02:26:20 +00:00
|
|
|
*
|
|
|
|
* See
|
|
|
|
*
|
|
|
|
* http://www.endace.com/support/EndaceRecordFormat.pdf
|
2003-08-26 07:10:39 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include "config.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <string.h>
|
|
|
|
|
|
|
|
#include "wtap-int.h"
|
|
|
|
#include "file_wrappers.h"
|
|
|
|
#include "buffer.h"
|
|
|
|
#include "atm.h"
|
|
|
|
#include "erf.h"
|
|
|
|
|
2008-04-12 10:21:51 +00:00
|
|
|
#ifndef min
|
|
|
|
#define min(a, b) ((a) > (b) ? (b) : (a))
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static int erf_read_header(FILE_T fh,
|
2007-10-08 11:41:21 +00:00
|
|
|
struct wtap_pkthdr *phdr,
|
|
|
|
union wtap_pseudo_header *pseudo_header,
|
|
|
|
erf_header_t *erf_header,
|
|
|
|
int *err,
|
|
|
|
gchar **err_info,
|
|
|
|
guint32 *bytes_read,
|
|
|
|
guint32 *packet_size);
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
|
2007-10-08 11:41:21 +00:00
|
|
|
gint64 *data_offset);
|
2006-11-05 22:46:44 +00:00
|
|
|
static gboolean erf_seek_read(wtap *wth, gint64 seek_off,
|
2007-10-08 11:41:21 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header, guchar *pd,
|
|
|
|
int length, int *err, gchar **err_info);
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2008-04-12 10:21:51 +00:00
|
|
|
extern int erf_open(wtap *wth, int *err, gchar **err_info _U_)
|
2003-08-26 07:10:39 +00:00
|
|
|
{
|
2008-01-09 22:58:34 +00:00
|
|
|
int i, n, records_for_erf_check = RECORDS_FOR_ERF_CHECK;
|
2007-10-08 11:41:21 +00:00
|
|
|
char *s;
|
2008-01-09 22:58:34 +00:00
|
|
|
erf_timestamp_t prevts,ts;
|
|
|
|
erf_header_t header;
|
2007-10-08 11:41:21 +00:00
|
|
|
guint32 mc_hdr;
|
|
|
|
guint16 eth_hdr;
|
2008-01-09 22:58:34 +00:00
|
|
|
guint32 packet_size;
|
|
|
|
guint16 rlen,wlen;
|
2008-09-29 16:20:24 +00:00
|
|
|
guint64 erf_ext_header;
|
|
|
|
guint8 type;
|
2008-01-09 22:58:34 +00:00
|
|
|
size_t r;
|
|
|
|
gchar * buffer;
|
2007-10-08 11:41:21 +00:00
|
|
|
|
|
|
|
memset(&prevts, 0, sizeof(prevts));
|
|
|
|
|
2008-01-09 22:58:34 +00:00
|
|
|
/* number of records to scan before deciding if this really is ERF */
|
2007-10-08 11:41:21 +00:00
|
|
|
if ((s = getenv("ERF_RECORDS_TO_CHECK")) != NULL) {
|
|
|
|
if ((n = atoi(s)) > 0 && n < 101) {
|
|
|
|
records_for_erf_check = n;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-01-10 08:49:11 +00:00
|
|
|
/*
|
|
|
|
* ERF is a little hard because there's no magic number; we look at
|
|
|
|
* the first few records and see if they look enough like ERF
|
|
|
|
* records.
|
|
|
|
*/
|
2007-10-08 11:41:21 +00:00
|
|
|
|
|
|
|
for (i = 0; i < records_for_erf_check; i++) { /* records_for_erf_check */
|
|
|
|
|
2008-01-09 22:58:34 +00:00
|
|
|
r = file_read(&header,1,sizeof(header),wth->fh);
|
2007-10-08 11:41:21 +00:00
|
|
|
|
|
|
|
if (r == 0 ) break;
|
|
|
|
if (r != sizeof(header)) {
|
|
|
|
if ((*err = file_error(wth->fh)) != 0) {
|
|
|
|
return -1;
|
|
|
|
} else {
|
2008-01-09 22:58:34 +00:00
|
|
|
/* ERF header too short accept the file,
|
|
|
|
only if the very first records have been successfully checked */
|
2007-10-08 11:41:21 +00:00
|
|
|
if (i < MIN_RECORDS_FOR_ERF_CHECK) {
|
|
|
|
return 0;
|
|
|
|
} else {
|
|
|
|
/* BREAK, the last record is too short, and will be ignored */
|
|
|
|
break;
|
2003-08-26 07:10:39 +00:00
|
|
|
}
|
2007-10-08 11:41:21 +00:00
|
|
|
}
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2008-01-09 22:58:34 +00:00
|
|
|
rlen=g_ntohs(header.rlen);
|
|
|
|
wlen=g_ntohs(header.wlen);
|
|
|
|
packet_size = rlen - sizeof(header);
|
2007-10-08 11:41:21 +00:00
|
|
|
|
2008-04-12 10:21:51 +00:00
|
|
|
/* fail on invalid record type, invalid rlen, timestamps decreasing, or incrementing too far */
|
|
|
|
|
|
|
|
/* Test valid rlen >= 16 */
|
|
|
|
if (rlen < 16) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-11-05 20:43:25 +00:00
|
|
|
if (packet_size > WTAP_MAX_PACKET_SIZE) {
|
|
|
|
/*
|
|
|
|
* Probably a corrupt capture file; don't blow up trying
|
|
|
|
* to allocate space for an immensely-large packet.
|
|
|
|
*/
|
|
|
|
return 0;
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
/* Skip PAD records, timestamps may not be set */
|
2008-09-29 16:20:24 +00:00
|
|
|
if ((header.type & 0x7F) == ERF_TYPE_PAD) {
|
2007-10-08 11:41:21 +00:00
|
|
|
if (file_seek(wth->fh, packet_size, SEEK_CUR, err) == -1) {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2007-11-06 19:22:51 +00:00
|
|
|
/* fail on invalid record type, decreasing timestamps or non-zero pad-bits */
|
|
|
|
/* Not all types within this range are decoded, but it is a first filter */
|
2008-09-29 16:20:24 +00:00
|
|
|
if ((header.type & 0x7F) == 0 || (header.type & 0x7F) > ERF_TYPE_MAX ) {
|
2007-11-06 19:22:51 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2008-04-12 10:21:51 +00:00
|
|
|
|
2008-09-29 16:20:24 +00:00
|
|
|
/* The ERF_TYPE_MAX is the PAD record, but the last used type is ERF_TYPE_RAW_LINK */
|
|
|
|
if ((header.type & 0x7F) > ERF_TYPE_RAW_LINK) {
|
2007-11-06 19:22:51 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2008-04-12 10:21:51 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
if ((ts = pletohll(&header.ts)) < prevts) {
|
2008-04-12 10:21:51 +00:00
|
|
|
/* reassembled AALx records may not be in time order, also records are not in strict time order between physical interfaces, so allow 1 sec fudge */
|
|
|
|
if ( ((prevts-ts)>>32) > 1 ) {
|
|
|
|
return 0;
|
2007-10-08 11:41:21 +00:00
|
|
|
}
|
|
|
|
}
|
2008-04-12 10:21:51 +00:00
|
|
|
|
|
|
|
/* Check to see if timestamp increment is > 1 week */
|
|
|
|
if ( (i) && (ts > prevts) && (((ts-prevts)>>32) > 3600*24*7) ) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
memcpy(&prevts, &ts, sizeof(prevts));
|
|
|
|
|
2008-09-29 16:20:24 +00:00
|
|
|
/* Read over the extension headers */
|
|
|
|
type = header.type;
|
|
|
|
while (type & 0x80){
|
|
|
|
if (file_read(&erf_ext_header, 1, sizeof(erf_ext_header),wth->fh) != sizeof(erf_ext_header)) {
|
|
|
|
*err = file_error(wth->fh);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
packet_size -= sizeof(erf_ext_header);
|
|
|
|
memcpy(&type, &erf_ext_header, sizeof(type));
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
/* Read over MC or ETH subheader */
|
2008-09-29 16:20:24 +00:00
|
|
|
switch(header.type & 0x7F) {
|
2007-10-08 11:41:21 +00:00
|
|
|
case ERF_TYPE_MC_HDLC:
|
|
|
|
case ERF_TYPE_MC_RAW:
|
|
|
|
case ERF_TYPE_MC_ATM:
|
|
|
|
case ERF_TYPE_MC_RAW_CHANNEL:
|
|
|
|
case ERF_TYPE_MC_AAL5:
|
|
|
|
case ERF_TYPE_MC_AAL2:
|
|
|
|
case ERF_TYPE_COLOR_MC_HDLC_POS:
|
|
|
|
if (file_read(&mc_hdr,1,sizeof(mc_hdr),wth->fh) != sizeof(mc_hdr)) {
|
|
|
|
*err = file_error(wth->fh);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
packet_size -= sizeof(mc_hdr);
|
|
|
|
break;
|
|
|
|
case ERF_TYPE_ETH:
|
|
|
|
case ERF_TYPE_COLOR_ETH:
|
|
|
|
case ERF_TYPE_DSM_COLOR_ETH:
|
|
|
|
if (file_read(ð_hdr,1,sizeof(eth_hdr),wth->fh) != sizeof(eth_hdr)) {
|
|
|
|
*err = file_error(wth->fh);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
packet_size -= sizeof(eth_hdr);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2008-01-09 22:58:34 +00:00
|
|
|
/* The file_seek function do not return an error if the end of file
|
|
|
|
is reached whereas the record is truncated */
|
|
|
|
buffer=g_malloc(packet_size);
|
|
|
|
r = file_read(buffer, 1, packet_size, wth->fh);
|
|
|
|
g_free(buffer);
|
|
|
|
|
|
|
|
if (r != packet_size) {
|
|
|
|
/* ERF record too short, accept the file,
|
|
|
|
only if the very first records have been successfully checked */
|
|
|
|
if (i < MIN_RECORDS_FOR_ERF_CHECK) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
}
|
|
|
|
} /* records_for_erf_check */
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
if (file_seek(wth->fh, 0L, SEEK_SET, err) == -1) { /* rewind */
|
|
|
|
return -1;
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
wth->data_offset = 0;
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
/* This is an ERF file */
|
|
|
|
wth->file_type = WTAP_FILE_ERF;
|
|
|
|
wth->snapshot_length = 0; /* not available in header, only in frame */
|
|
|
|
|
|
|
|
/*
|
2008-01-10 08:49:11 +00:00
|
|
|
* Use the encapsulation for ERF records.
|
2007-10-08 11:41:21 +00:00
|
|
|
*/
|
2008-01-10 08:49:11 +00:00
|
|
|
wth->file_encap = WTAP_ENCAP_ERF;
|
2007-10-08 11:41:21 +00:00
|
|
|
|
|
|
|
wth->subtype_read = erf_read;
|
|
|
|
wth->subtype_seek_read = erf_seek_read;
|
|
|
|
wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
|
|
|
|
|
|
|
|
return 1;
|
2003-08-26 07:10:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Read the next packet */
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
static gboolean erf_read(wtap *wth, int *err, gchar **err_info,
|
2007-10-08 11:41:21 +00:00
|
|
|
gint64 *data_offset)
|
2003-08-26 07:10:39 +00:00
|
|
|
{
|
2007-10-08 11:41:21 +00:00
|
|
|
erf_header_t erf_header;
|
|
|
|
guint32 packet_size, bytes_read;
|
|
|
|
|
|
|
|
*data_offset = wth->data_offset;
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
do {
|
|
|
|
if (!erf_read_header(wth->fh,
|
|
|
|
&wth->phdr, &wth->pseudo_header, &erf_header,
|
|
|
|
err, err_info, &bytes_read, &packet_size)) {
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
wth->data_offset += bytes_read;
|
|
|
|
} while ( erf_header.type == ERF_TYPE_PAD );
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
buffer_assure_space(wth->frame_buffer, packet_size);
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
|
|
|
|
(gint32)(packet_size), wth->fh, err );
|
|
|
|
wth->data_offset += packet_size;
|
|
|
|
|
|
|
|
return TRUE;
|
2003-08-26 07:10:39 +00:00
|
|
|
}
|
|
|
|
|
2006-11-05 22:46:44 +00:00
|
|
|
static gboolean erf_seek_read(wtap *wth, gint64 seek_off,
|
2007-10-08 11:41:21 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header, guchar *pd,
|
2008-04-12 10:21:51 +00:00
|
|
|
int length _U_, int *err, gchar **err_info)
|
2003-08-26 07:10:39 +00:00
|
|
|
{
|
2007-10-08 11:41:21 +00:00
|
|
|
erf_header_t erf_header;
|
|
|
|
guint32 packet_size;
|
2003-08-26 07:10:39 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
|
|
|
|
return FALSE;
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2008-07-14 05:46:09 +00:00
|
|
|
do {
|
|
|
|
if (!erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header,
|
|
|
|
err, err_info, NULL, &packet_size))
|
|
|
|
return FALSE;
|
|
|
|
} while ( erf_header.type == ERF_TYPE_PAD );
|
2003-08-26 07:10:39 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
wtap_file_read_expected_bytes(pd, (int)packet_size, wth->random_fh, err);
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
return TRUE;
|
2003-08-26 07:10:39 +00:00
|
|
|
}
|
|
|
|
|
2008-04-12 10:21:51 +00:00
|
|
|
static int erf_read_header(FILE_T fh,
|
2007-10-08 11:41:21 +00:00
|
|
|
struct wtap_pkthdr *phdr,
|
|
|
|
union wtap_pseudo_header *pseudo_header,
|
|
|
|
erf_header_t *erf_header,
|
|
|
|
int *err,
|
|
|
|
gchar **err_info,
|
|
|
|
guint32 *bytes_read,
|
|
|
|
guint32 *packet_size)
|
2003-08-26 07:10:39 +00:00
|
|
|
{
|
2007-10-08 11:41:21 +00:00
|
|
|
guint32 mc_hdr;
|
2008-09-29 16:20:24 +00:00
|
|
|
guint8 erf_exhdr[8];
|
|
|
|
guint64 erf_exhdr_sw;
|
|
|
|
guint8 type = 0;
|
2008-04-12 10:21:51 +00:00
|
|
|
guint16 eth_hdr,skiplen=0;
|
2008-09-29 16:20:24 +00:00
|
|
|
int i = 0 , max = sizeof(pseudo_header->erf.ehdr_list)/sizeof(struct erf_ehdr);
|
|
|
|
;
|
2007-10-08 11:41:21 +00:00
|
|
|
|
|
|
|
wtap_file_read_expected_bytes(erf_header, sizeof(*erf_header), fh, err);
|
|
|
|
if (bytes_read != NULL) {
|
|
|
|
*bytes_read = sizeof(*erf_header);
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2008-04-12 10:21:51 +00:00
|
|
|
*packet_size = g_ntohs(erf_header->rlen) - sizeof(*erf_header);
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
if (*packet_size > WTAP_MAX_PACKET_SIZE) {
|
|
|
|
/*
|
|
|
|
* Probably a corrupt capture file; don't blow up trying
|
|
|
|
* to allocate space for an immensely-large packet.
|
|
|
|
*/
|
|
|
|
*err = WTAP_ERR_BAD_RECORD;
|
|
|
|
*err_info = g_strdup_printf("erf: File has %u-byte packet, bigger than maximum of %u",
|
|
|
|
*packet_size, WTAP_MAX_PACKET_SIZE);
|
|
|
|
return FALSE;
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
if (phdr != NULL) {
|
|
|
|
guint64 ts = pletohll(&erf_header->ts);
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
phdr->ts.secs = (long) (ts >> 32);
|
|
|
|
ts = ((ts & 0xffffffff) * 1000 * 1000 * 1000);
|
|
|
|
ts += (ts & 0x80000000) << 1; /* rounding */
|
|
|
|
phdr->ts.nsecs = ((long) (ts >> 32));
|
|
|
|
if (phdr->ts.nsecs >= 1000000000) {
|
|
|
|
phdr->ts.nsecs -= 1000000000;
|
|
|
|
phdr->ts.secs += 1;
|
|
|
|
}
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
/* Copy the ERF pseudo header */
|
|
|
|
pseudo_header->erf.phdr.ts = pletohll(&erf_header->ts);
|
|
|
|
pseudo_header->erf.phdr.type = erf_header->type;
|
|
|
|
pseudo_header->erf.phdr.flags = erf_header->flags;
|
|
|
|
pseudo_header->erf.phdr.rlen = g_ntohs(erf_header->rlen);
|
|
|
|
pseudo_header->erf.phdr.lctr = g_ntohs(erf_header->lctr);
|
|
|
|
pseudo_header->erf.phdr.wlen = g_ntohs(erf_header->wlen);
|
|
|
|
|
2008-09-29 16:20:24 +00:00
|
|
|
/* Copy the ERF extension header into the pseudo header */
|
|
|
|
type = erf_header->type;
|
|
|
|
while (type & 0x80){
|
|
|
|
wtap_file_read_expected_bytes(&erf_exhdr, sizeof(erf_exhdr), fh, err);
|
|
|
|
if (bytes_read != NULL)
|
|
|
|
*bytes_read += sizeof(erf_exhdr);
|
|
|
|
*packet_size -= sizeof(erf_exhdr);
|
|
|
|
skiplen += sizeof(erf_exhdr);
|
|
|
|
erf_exhdr_sw = pntohll((guint64*) &(erf_exhdr[0]));
|
|
|
|
if (i < max)
|
|
|
|
memcpy(&pseudo_header->erf.ehdr_list[i].ehdr, &erf_exhdr_sw, sizeof(erf_exhdr_sw));
|
|
|
|
type = erf_exhdr[0];
|
|
|
|
i++;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (erf_header->type & 0x7F) {
|
|
|
|
case ERF_TYPE_IPV4:
|
|
|
|
case ERF_TYPE_IPV6:
|
|
|
|
case ERF_TYPE_RAW_LINK:
|
2008-03-14 17:47:53 +00:00
|
|
|
case ERF_TYPE_INFINIBAND:
|
2008-04-12 10:21:51 +00:00
|
|
|
/***
|
|
|
|
if (phdr != NULL) {
|
2008-03-14 17:47:53 +00:00
|
|
|
phdr->len = g_htons(erf_header->wlen);
|
|
|
|
phdr->caplen = g_htons(erf_header->wlen);
|
|
|
|
}
|
2008-04-12 10:21:51 +00:00
|
|
|
return TRUE;
|
|
|
|
***/
|
2008-03-14 17:47:53 +00:00
|
|
|
break;
|
2008-07-14 05:46:09 +00:00
|
|
|
case ERF_TYPE_PAD:
|
2007-10-08 11:41:21 +00:00
|
|
|
case ERF_TYPE_HDLC_POS:
|
|
|
|
case ERF_TYPE_COLOR_HDLC_POS:
|
|
|
|
case ERF_TYPE_DSM_COLOR_HDLC_POS:
|
|
|
|
case ERF_TYPE_ATM:
|
|
|
|
case ERF_TYPE_AAL5:
|
|
|
|
case ERF_TYPE_AAL2:
|
|
|
|
break;
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
case ERF_TYPE_ETH:
|
|
|
|
case ERF_TYPE_COLOR_ETH:
|
|
|
|
case ERF_TYPE_DSM_COLOR_ETH:
|
2007-11-19 19:09:01 +00:00
|
|
|
wtap_file_read_expected_bytes(ð_hdr, sizeof(eth_hdr), fh, err);
|
2007-10-08 11:41:21 +00:00
|
|
|
if (bytes_read != NULL)
|
2007-11-19 19:09:01 +00:00
|
|
|
*bytes_read += sizeof(eth_hdr);
|
|
|
|
*packet_size -= sizeof(eth_hdr);
|
2008-09-29 16:20:24 +00:00
|
|
|
skiplen += sizeof(eth_hdr);
|
2007-10-08 11:41:21 +00:00
|
|
|
pseudo_header->erf.subhdr.eth_hdr = g_htons(eth_hdr);
|
|
|
|
break;
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
case ERF_TYPE_MC_HDLC:
|
|
|
|
case ERF_TYPE_MC_RAW:
|
|
|
|
case ERF_TYPE_MC_ATM:
|
|
|
|
case ERF_TYPE_MC_RAW_CHANNEL:
|
|
|
|
case ERF_TYPE_MC_AAL5:
|
|
|
|
case ERF_TYPE_MC_AAL2:
|
|
|
|
case ERF_TYPE_COLOR_MC_HDLC_POS:
|
2007-11-19 19:09:01 +00:00
|
|
|
wtap_file_read_expected_bytes(&mc_hdr, sizeof(mc_hdr), fh, err);
|
2007-10-08 11:41:21 +00:00
|
|
|
if (bytes_read != NULL)
|
2007-11-19 19:09:01 +00:00
|
|
|
*bytes_read += sizeof(mc_hdr);
|
|
|
|
*packet_size -= sizeof(mc_hdr);
|
2008-09-29 16:20:24 +00:00
|
|
|
skiplen += sizeof(mc_hdr);
|
2007-10-08 11:41:21 +00:00
|
|
|
pseudo_header->erf.subhdr.mc_hdr = g_htonl(mc_hdr);
|
|
|
|
break;
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
case ERF_TYPE_IP_COUNTER:
|
|
|
|
case ERF_TYPE_TCP_FLOW_COUNTER:
|
|
|
|
/* unsupported, continue with default: */
|
|
|
|
default:
|
|
|
|
*err = WTAP_ERR_UNSUPPORTED_ENCAP;
|
|
|
|
*err_info = g_strdup_printf("erf: unknown record encapsulation %u",
|
|
|
|
erf_header->type);
|
|
|
|
return FALSE;
|
|
|
|
}
|
2007-11-19 19:09:01 +00:00
|
|
|
|
2007-10-08 11:41:21 +00:00
|
|
|
if (phdr != NULL) {
|
2008-04-12 10:21:51 +00:00
|
|
|
phdr->len = g_htons(erf_header->wlen);
|
|
|
|
phdr->caplen = min( g_htons(erf_header->wlen),
|
|
|
|
g_htons(erf_header->rlen) - sizeof(*erf_header) - skiplen );
|
2007-10-08 11:41:21 +00:00
|
|
|
}
|
|
|
|
return TRUE;
|
2003-08-26 07:10:39 +00:00
|
|
|
}
|