etl: fix handling of the packet flags.

Use #defines, not numbers, for inbound and outbound. and test only the
direction part of the packet flags, in case any other bits are set.
This commit is contained in:
Guy Harris 2021-04-28 02:22:00 -07:00
parent 4e9d2be9ae
commit 3bfe597f5b
2 changed files with 4 additions and 4 deletions

View File

@ -138,12 +138,12 @@ dissect_etw(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree _U_, void* data
col_set_str(pinfo->cinfo, COL_DEF_DST, "windows");
if (memcmp(&mbim_net_providerid, &provider_id, sizeof(e_guid_t)) == 0) {
if (pinfo->rec->presence_flags & WTAP_HAS_PACK_FLAGS) {
switch(pinfo->rec->rec_header.packet_header.pack_flags) {
case 1:
switch(pinfo->rec->rec_header.packet_header.pack_flags & PACK_FLAGS_DIRECTION_MASK) {
case PACK_FLAGS_DIRECTION_INBOUND:
col_set_str(pinfo->cinfo, COL_DEF_SRC, "device");
col_set_str(pinfo->cinfo, COL_DEF_DST, "host");
break;
case 2:
case PACK_FLAGS_DIRECTION_OUTBOUND:
col_set_str(pinfo->cinfo, COL_DEF_SRC, "host");
col_set_str(pinfo->cinfo, COL_DEF_DST, "device");
break;

View File

@ -284,7 +284,7 @@ void wtap_etl_rec_dump(ULARGE_INTEGER timestamp, WTAP_ETL_RECORD* etl_record, UL
rec.rec_header.packet_header.len = total_packet_length;
rec.rec_header.packet_header.pkt_encap = WTAP_ENCAP_ETW;
rec.presence_flags = rec.presence_flags | WTAP_HAS_PACK_FLAGS;
rec.rec_header.packet_header.pack_flags = is_inbound ? 1 : 2;
rec.rec_header.packet_header.pack_flags = is_inbound ? PACK_FLAGS_DIRECTION_INBOUND : PACK_FLAGS_DIRECTION_OUTBOUND;
/* Convert usec of the timestamp into nstime_t */
rec.ts.secs = (time_t)(timestamp.QuadPart / G_USEC_PER_SEC);
rec.ts.nsecs = (int)(((timestamp.QuadPart % G_USEC_PER_SEC) * G_NSEC_PER_SEC) / G_USEC_PER_SEC);