osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

Fix up time encodings. 

Add some new encodings for absolute time stamps, and use them as
appropriate; this fixes some cases where the time stamps in question
were being dissected incorrectly.

For the encodings with seconds and 1/2^32s of a second, don't
arbitrarily give only microsecond resolution; 2^32 is greater than 1
million, and, in fact, at least some NTP RFCs explicitly talk about time
resolution greater than 1 microsecond.

Update references in the RELOAD dissector to reflect the documents in
question having been updated and published as RFCs.

Change-Id: Icbe0b696d65eb622978eb71e99ddf699b84e4fca
Reviewed-on: https://code.wireshark.org/review/20759
Reviewed-by: Guy Harris <guy@alum.mit.edu>
This commit is contained in:
Guy Harris 2017-03-28 03:17:48 -07:00
parent 721182b09b
commit 8f515b1a99
12 changed files with 366 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
doc/README.dissector
View File

@ -1598,15 +1598,57 @@ For FT_ABSOLUTE_TIME fields, the encoding specifies the form in which
the time stamp is specified, as well as its byte order. The time stamp the time stamp is specified, as well as its byte order. The time stamp
encodings that are currently supported are: encodings that are currently supported are:
ENC_TIME_TIMESPEC - seconds (4 bytes) and nanoseconds (4 bytes) ENC_TIME_TIMESPEC - 8 bytes; the first 4 bytes are seconds since
of time since January 1, 1970, midnight UTC. the UN*X epoch (1970-01-01 00:00:00 UTC) and the next 4 bytes
(If the field length is 4, then nanosecs is defaulted to 0). are nanoseconds since that second. (I.e., a UN*X struct
timespec with a 4-byte time_t.)
ENC_TIME_NTP - 8 bytes; the first 4 bytes are seconds since the NTP
epoch (1901-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of
a second since that second. (I.e., a 64-bit count of 1/2^32's of a
second since the NTP epoch, with the upper 32 bits first and the
lower 32 bits second, even when little-endian.)
ENC_TIME_TOD - 8 bytes, as a count of microseconds since the System/3x0
and z/Architecture epoch (1900-01-01 00:00:00 GMT).
ENC_TIME_RTPS - 8 bytes; the first 4 bytes are seconds since the UN*X
epoch and the next 4 bytes are are 1/2^32's of a second since that
second. (I.e., it's the offspring of a mating between UN*X time and
NTP time.) It's used by the Object Management Group's Real-Time
Publish-Subscribe Wire Protocol for the Data Distribution Service.
ENC_TIME_TIMEVAL - 8 bytes; the first 4 bytes are seconds since the
UN*X epoch and the next 4 bytes are microseconds since that
second. (I.e., a UN*X struct timeval with a 4-byte time_t.)
ENC_TIME_SECS - 4 to 8 bytes, representing a value in seconds since
the UN*X epoch.
ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds
since the UN*X epoch.
ENC_TIME_SECS_NTP - 4 bytes, representing a count of seconds since
the NTP epoch. (I.e., seconds since the NTP epoch.)
ENC_TIME_RFC_3971 - 8 bytes, representing a count of 1/64ths of a
second since the UN*X epoch; see section 5.3.1 "Timestamp Option"
in RFC 3971.
ENC_TIME_NTP - an NTP timestamp, represented as a 64-bit For FT_RELATIVE_TIME fields, the encoding specifies the form in which
unsigned fixed-point number, in seconds relative to 0h the time stamp is specified, as well as its byte order. The time stamp
on 1 January 1900. The integer part is in the first 32 encodings that are currently supported are:
bits and the fraction part in the last 32 bits.
ENC_TIME_TIMESPEC - 8 bytes; the first 4 bytes are seconds and the
next 4 bytes are nanoseconds.
ENC_TIME_TIMEVAL - 8 bytes; the first 4 bytes are seconds and the
next 4 bytes are microseconds.
ENC_TIME_SECS - 4 to 8 bytes, representing a value in seconds.
ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds.
For other types, there is no support for proto_tree_add_item(). For other types, there is no support for proto_tree_add_item().
Now that definitions of fields have detailed information about bitfield Now that definitions of fields have detailed information about bitfield

8
epan/dissectors/packet-bitcoin.c
View File

@ -902,7 +902,7 @@ dissect_bitcoin_msg_addr(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree
ti = proto_tree_add_item(tree, &hfi_msg_addr_address, tvb, offset, 30, ENC_NA); ti = proto_tree_add_item(tree, &hfi_msg_addr_address, tvb, offset, 30, ENC_NA);
subtree = create_address_tree(tvb, ti, offset+4); subtree = create_address_tree(tvb, ti, offset+4);
proto_tree_add_item(subtree, &hfi_msg_addr_timestamp, tvb, offset, 4, ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN); proto_tree_add_item(subtree, &hfi_msg_addr_timestamp, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
offset += 26; offset += 26;
offset += 4; offset += 4;
} }
@ -1274,7 +1274,7 @@ dissect_bitcoin_msg_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, v
proto_tree_add_item(tree, &hfi_msg_block_merkle_root, tvb, offset, 32, ENC_NA); proto_tree_add_item(tree, &hfi_msg_block_merkle_root, tvb, offset, 32, ENC_NA);
offset += 32; offset += 32;
proto_tree_add_item(tree, &hfi_msg_block_time, tvb, offset, 4, ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN); proto_tree_add_item(tree, &hfi_msg_block_time, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
offset += 4; offset += 4;
proto_tree_add_item(tree, &hfi_msg_block_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN); proto_tree_add_item(tree, &hfi_msg_block_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN);
@ -1335,7 +1335,7 @@ dissect_bitcoin_msg_headers(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *t
proto_tree_add_item(subtree, &hfi_msg_headers_merkle_root, tvb, offset, 32, ENC_NA); proto_tree_add_item(subtree, &hfi_msg_headers_merkle_root, tvb, offset, 32, ENC_NA);
offset += 32; offset += 32;
proto_tree_add_item(subtree, &hfi_msg_headers_time, tvb, offset, 4, ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN); proto_tree_add_item(subtree, &hfi_msg_headers_time, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
offset += 4; offset += 4;
proto_tree_add_item(subtree, &hfi_msg_headers_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN); proto_tree_add_item(subtree, &hfi_msg_headers_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN);
@ -1488,7 +1488,7 @@ dissect_bitcoin_msg_merkleblock(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tre
proto_tree_add_item(tree, &hfi_msg_merkleblock_merkle_root, tvb, offset, 32, ENC_NA); proto_tree_add_item(tree, &hfi_msg_merkleblock_merkle_root, tvb, offset, 32, ENC_NA);
offset += 32; offset += 32;
proto_tree_add_item(tree, &hfi_msg_merkleblock_time, tvb, offset, 4, ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN); proto_tree_add_item(tree, &hfi_msg_merkleblock_time, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
offset += 4; offset += 4;
proto_tree_add_item(tree, &hfi_msg_merkleblock_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN); proto_tree_add_item(tree, &hfi_msg_merkleblock_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN);

2
epan/dissectors/packet-capwap.c
View File

@ -2260,7 +2260,7 @@ hf_capwap_msg_element_type_ac_descriptor_dtls_policy, ett_capwap_ac_descriptor_d
"AC Timestamp length %u wrong, must be = 4", optlen); "AC Timestamp length %u wrong, must be = 4", optlen);
break; break;
} }
proto_tree_add_item(sub_msg_element_type_tree, hf_capwap_msg_element_type_ac_timestamp, tvb, offset + 4, 4, ENC_TIME_NTP|ENC_BIG_ENDIAN); proto_tree_add_item(sub_msg_element_type_tree, hf_capwap_msg_element_type_ac_timestamp, tvb, offset + 4, 4, ENC_TIME_SECS_NTP|ENC_BIG_ENDIAN);
break; break;
case TYPE_ADD_STATION:{ /* Add Station (8) */ case TYPE_ADD_STATION:{ /* Add Station (8) */

2
epan/dissectors/packet-diameter.c
View File

@ -912,7 +912,7 @@ time_avp(diam_ctx_t *c, diam_avp_t *a, tvbuff_t *tvb, diam_sub_dis_t *diam_sub_d
if (c->tree) { if (c->tree) {
label = (char *)wmem_alloc(wmem_packet_scope(), ITEM_LABEL_LENGTH+1); label = (char *)wmem_alloc(wmem_packet_scope(), ITEM_LABEL_LENGTH+1);
pi = proto_tree_add_item(c->tree, (a->hf_value), tvb, 0, 4, ENC_TIME_NTP|ENC_BIG_ENDIAN); pi = proto_tree_add_item(c->tree, (a->hf_value), tvb, 0, 4, ENC_TIME_SECS_NTP|ENC_BIG_ENDIAN);
proto_item_fill_label(PITEM_FINFO(pi), label); proto_item_fill_label(PITEM_FINFO(pi), label);
label = strstr(label,": ")+2; label = strstr(label,": ")+2;
} }

2
epan/dissectors/packet-dns.c
View File

@ -3427,7 +3427,7 @@ dissect_dns_answer(tvbuff_t *tvb, int offsetx, int dns_data_offset,
proto_tree_add_string(rr_tree, hf_dns_tsig_algorithm_name, tvb, cur_offset, used_bytes, name_out); proto_tree_add_string(rr_tree, hf_dns_tsig_algorithm_name, tvb, cur_offset, used_bytes, name_out);
cur_offset += used_bytes; cur_offset += used_bytes;
ti = proto_tree_add_item(rr_tree, hf_dns_tsig_time_signed ,tvb, cur_offset, 6, ENC_NA); ti = proto_tree_add_item(rr_tree, hf_dns_tsig_time_signed ,tvb, cur_offset, 6, ENC_TIME_SECS|ENC_BIG_ENDIAN);
if(tvb_get_ntohs(tvb, cur_offset)) /* Time High */ if(tvb_get_ntohs(tvb, cur_offset)) /* Time High */
{ {
proto_item_append_text(ti, " (high bits set)"); proto_item_append_text(ti, " (high bits set)");

2
epan/dissectors/packet-erf.c
View File

@ -2442,7 +2442,7 @@ dissect_meta_record_tags(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
* little endian. * little endian.
*/ */
/* /*
* FIXME: ENC_TIME_NTP(_BASE_ZERO) | ENC_LITTLE_ENDIAN only swaps the * FIXME: ENC_TIME_NTP | ENC_LITTLE_ENDIAN only swaps the
* upper and lower 32 bits. Is that a bug or by design? Should add * upper and lower 32 bits. Is that a bug or by design? Should add
* a 'PTP" variant that doesn't round to microseconds and use that * a 'PTP" variant that doesn't round to microseconds and use that
* here. For now do by hand. * here. For now do by hand.

2
epan/dissectors/packet-icmpv6.c
View File

@ -1844,7 +1844,7 @@ dissect_icmpv6_nd_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree
* remaining 16 bits indicate the number of 1/64K fractions of a * remaining 16 bits indicate the number of 1/64K fractions of a
* second. * second.
*/ */
proto_tree_add_item(icmp6opt_tree, hf_icmpv6_opt_timestamp, tvb, opt_offset + 2, 4, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); proto_tree_add_item(icmp6opt_tree, hf_icmpv6_opt_timestamp, tvb, opt_offset, 8, ENC_TIME_RFC_3971|ENC_BIG_ENDIAN);
opt_offset += 8; opt_offset += 8;
break; break;
case ND_OPT_NONCE: /* Nonce option (14) */ case ND_OPT_NONCE: /* Nonce option (14) */

18
epan/dissectors/packet-netflow.c
View File

@ -5666,6 +5666,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
break; break;
case 37013: /* timestamp_interval */ case 37013: /* timestamp_interval */
/* XXX - what format is this in? */
ti = proto_tree_add_item(pdutree, hf_cflow_timestamp_interval, ti = proto_tree_add_item(pdutree, hf_cflow_timestamp_interval,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6183,6 +6184,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
break; break;
case (NTOP_BASE + 151): /* RTP_FIRST_TS */ case (NTOP_BASE + 151): /* RTP_FIRST_TS */
case ((VENDOR_NTOP << 16) | 151): /* RTP_FIRST_TS */ case ((VENDOR_NTOP << 16) | 151): /* RTP_FIRST_TS */
/* XXX - is this an NTP timestamp? */
ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_first_ts, ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_first_ts,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6193,6 +6195,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
break; break;
case (NTOP_BASE + 153): /* RTP_LAST_TS */ case (NTOP_BASE + 153): /* RTP_LAST_TS */
case ((VENDOR_NTOP << 16) | 153): /* RTP_LAST_TS */ case ((VENDOR_NTOP << 16) | 153): /* RTP_LAST_TS */
/* XXX - is this an NTP timestamp? */
ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_last_ts, ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_last_ts,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6367,6 +6370,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
tvb, offset, length, ENC_BIG_ENDIAN); tvb, offset, length, ENC_BIG_ENDIAN);
break; break;
case ((VENDOR_PLIXER << 16) | 111): /* origination_time */ case ((VENDOR_PLIXER << 16) | 111): /* origination_time */
/* XXX - what format is this? */
ti = proto_tree_add_item(pdutree, hf_pie_plixer_origination_time, ti = proto_tree_add_item(pdutree, hf_pie_plixer_origination_time,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6395,6 +6399,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
tvb, offset, length, gen_str); tvb, offset, length, gen_str);
break; break;
case ((VENDOR_PLIXER << 16) | 117): /* date_time */ case ((VENDOR_PLIXER << 16) | 117): /* date_time */
/* XXX - what format is this? */
ti = proto_tree_add_item(pdutree, hf_pie_plixer_date_time, ti = proto_tree_add_item(pdutree, hf_pie_plixer_date_time,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6840,10 +6845,18 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
tvb, offset, length, ENC_BIG_ENDIAN); tvb, offset, length, ENC_BIG_ENDIAN);
break; break;
case ((VENDOR_NETSCALER << 16) | 223): case ((VENDOR_NETSCALER << 16) | 223):
/*
* XXX - this says "sec"; is it just seconds since the UN*X epoch,
* i.e. should it be ENC_TIME_SECS?
*/
ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionupdatebeginsec, ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionupdatebeginsec,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
case ((VENDOR_NETSCALER << 16) | 224): case ((VENDOR_NETSCALER << 16) | 224):
/*
* XXX - this says "sec"; is it just seconds since the UN*X epoch,
* i.e. should it be ENC_TIME_SECS?
*/
ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionupdateendsec, ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionupdateendsec,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6904,6 +6917,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
tvb, offset, length, ENC_UTF_8|ENC_NA); tvb, offset, length, ENC_UTF_8|ENC_NA);
break; break;
case ((VENDOR_NETSCALER << 16) | 239): case ((VENDOR_NETSCALER << 16) | 239):
/* XXX - what format is this? */
ti = proto_tree_add_item(pdutree, hf_pie_netscaler_applicationstartuptime, ti = proto_tree_add_item(pdutree, hf_pie_netscaler_applicationstartuptime,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -6964,10 +6978,12 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
tvb, offset, length, ENC_BIG_ENDIAN); tvb, offset, length, ENC_BIG_ENDIAN);
break; break;
case ((VENDOR_NETSCALER << 16) | 254): case ((VENDOR_NETSCALER << 16) | 254):
/* XXX - what format is this? */
ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icanetworkupdatestarttime, ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icanetworkupdatestarttime,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
case ((VENDOR_NETSCALER << 16) | 255): case ((VENDOR_NETSCALER << 16) | 255):
/* XXX - what format is this? */
ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icanetworkupdateendtime, ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icanetworkupdateendtime,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN);
break; break;
@ -7032,7 +7048,7 @@ dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
/* START Barracuda Communications */ /* START Barracuda Communications */
case ((VENDOR_BARRACUDA << 16) | 1): case ((VENDOR_BARRACUDA << 16) | 1):
ti = proto_tree_add_item(pdutree, hf_pie_barracuda_timestamp, ti = proto_tree_add_item(pdutree, hf_pie_barracuda_timestamp,
tvb, offset, length, ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN); tvb, offset, length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
break; break;
case ((VENDOR_BARRACUDA << 16) | 2): case ((VENDOR_BARRACUDA << 16) | 2):
ti = proto_tree_add_item(pdutree, hf_pie_barracuda_logop, ti = proto_tree_add_item(pdutree, hf_pie_barracuda_logop,

20
epan/dissectors/packet-reload.c
View File

@ -22,12 +22,12 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
* *
* Please refer to the following specs for protocol detail: * Please refer to the following specs for protocol detail:
* - draft-ietf-p2psip-base-18 * - RFC 6940
* - draft-ietf-p2psip-sip-06 * - RFC 7904
* - draft-ietf-p2psip-service-discovery-03 * - RFC 7374
* - draft-ietf-p2psip-self-tuning-04 * - RFC 7363
* - draft-ietf-p2psip-diagnostics-10 * - RFC 7851
* - draft-zong-p2psip-drr-01 * - RFC 7263
*/ */
#include "config.h" #include "config.h"
@ -2967,10 +2967,10 @@ static int dissect_diagnosticrequest(int anchor, tvbuff_t *tvb, packet_info *pin
ti_local = proto_tree_add_item(tree, hf, tvb, offset, length, ENC_NA); ti_local = proto_tree_add_item(tree, hf, tvb, offset, length, ENC_NA);
local_tree = proto_item_add_subtree(ti_local, ett_reload_diagnosticrequest); local_tree = proto_item_add_subtree(ti_local, ett_reload_diagnosticrequest);
proto_tree_add_item(local_tree, hf_reload_diagnostic_expiration, tvb, offset, 8, ENC_TIME_NTP|ENC_BIG_ENDIAN); proto_tree_add_item(local_tree, hf_reload_diagnostic_expiration, tvb, offset, 8, ENC_TIME_MSECS|ENC_BIG_ENDIAN);
local_offset += 8; local_offset += 8;
proto_tree_add_item(local_tree, hf_reload_diagnosticrequest_timestampinitiated, tvb, proto_tree_add_item(local_tree, hf_reload_diagnosticrequest_timestampinitiated, tvb,
offset+local_offset, 8, ENC_TIME_NTP|ENC_BIG_ENDIAN); offset+local_offset, 8, ENC_TIME_MSECS|ENC_BIG_ENDIAN);
local_offset += 8; local_offset += 8;
local_offset += dissect_dmflag(tvb, local_tree, offset+local_offset); local_offset += dissect_dmflag(tvb, local_tree, offset+local_offset);
local_length = tvb_get_ntohl(tvb, offset+local_offset); local_length = tvb_get_ntohl(tvb, offset+local_offset);
@ -3202,10 +3202,10 @@ static int dissect_diagnosticresponse(int anchor, tvbuff_t *tvb, packet_info *pi
ti_local = proto_tree_add_item(tree, hf, tvb, offset, length, ENC_NA); ti_local = proto_tree_add_item(tree, hf, tvb, offset, length, ENC_NA);
local_tree = proto_item_add_subtree(ti_local, ett_reload_diagnosticresponse); local_tree = proto_item_add_subtree(ti_local, ett_reload_diagnosticresponse);
proto_tree_add_item(local_tree, hf_reload_diagnostic_expiration, tvb, offset, 8, ENC_TIME_NTP|ENC_BIG_ENDIAN); proto_tree_add_item(local_tree, hf_reload_diagnostic_expiration, tvb, offset, 8, ENC_TIME_MSECS|ENC_BIG_ENDIAN);
local_offset += 8; local_offset += 8;
proto_tree_add_item(local_tree, hf_reload_diagnosticresponse_timestampreceived, proto_tree_add_item(local_tree, hf_reload_diagnosticresponse_timestampreceived,
tvb, offset+local_offset, 8, ENC_TIME_NTP|ENC_BIG_ENDIAN); tvb, offset+local_offset, 8, ENC_TIME_MSECS|ENC_BIG_ENDIAN);
local_offset += 8; local_offset += 8;
proto_tree_add_item(local_tree, hf_reload_diagnosticresponse_hopcounter, tvb, offset+local_offset, 1, ENC_BIG_ENDIAN); proto_tree_add_item(local_tree, hf_reload_diagnosticresponse_hopcounter, tvb, offset+local_offset, 1, ENC_BIG_ENDIAN);

2
epan/dissectors/packet-synphasor.c
View File

@ -635,7 +635,7 @@ static gint dissect_header(tvbuff_t *tvb, proto_tree *tree)
offset += 2; offset += 2;
/* SOC */ /* SOC */
proto_tree_add_item(tree, hf_soc, tvb, offset, 4, ENC_TIME_TIMESPEC | ENC_BIG_ENDIAN); proto_tree_add_item(tree, hf_soc, tvb, offset, 4, ENC_TIME_SECS | ENC_BIG_ENDIAN);
offset += 4; offset += 4;
/* FRACSEC */ /* FRACSEC */

322
epan/proto.c
View File

@ -1680,37 +1680,40 @@ get_stringzpad_value(wmem_allocator_t *scope, tvbuff_t *tvb, gint start,
return tvb_get_string_enc(scope, tvb, start, length, encoding); return tvb_get_string_enc(scope, tvb, start, length, encoding);
} }
/* this can be called when there is no tree, so don't add that as a param */ /*
* Epochs for various non-UN*X time stamp formats.
*/
#define NTP_BASETIME G_GUINT64_CONSTANT(2208988800) /* NTP */
#define TOD_BASETIME G_GUINT64_CONSTANT(2208988800) /* System/3x0 and z/Architecture TOD clock */
/* this can be called when there is no tree, so tree may be null */
static void static void
get_time_value(tvbuff_t *tvb, const gint start, const gint length, const guint encoding, get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start,
nstime_t *time_stamp, const gboolean is_relative) const gint length, const guint encoding, nstime_t *time_stamp,
const gboolean is_relative)
{ {
guint32 tmpsecs; guint32 tmpsecs;
guint64 todsecs; guint64 todsecs;
/* relative timestamps don't do TOD/NTP */
if (is_relative &&
(encoding != (ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN)) &&
(encoding != (ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN)) )
{
/* XXX: I think this should call REPORT_DISSECTOR_BUG(), but
the existing code didn't do that, so I'm not either */
return;
}
switch (encoding) { switch (encoding) {
case ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN: case ENC_TIME_TIMESPEC|ENC_BIG_ENDIAN:
/* /*
* 4-byte UNIX epoch, possibly followed by * 4-byte seconds, followed by 4-byte fractional
* 4-byte fractional time in nanoseconds, * time in nanoseconds, both big-endian.
* both big-endian. * For absolute times, the seconds are seconds
* since the UN*X epoch.
*/ */
time_stamp->secs = (time_t)tvb_get_ntohl(tvb, start); time_stamp->secs = (time_t)tvb_get_ntohl(tvb, start);
if (length == 8) if (length == 8)
time_stamp->nsecs = tvb_get_ntohl(tvb, start+4); time_stamp->nsecs = tvb_get_ntohl(tvb, start+4);
else else if (length == 4) {
/*
* Backwards compatibility.
*/
time_stamp->nsecs = 0; time_stamp->nsecs = 0;
} else
report_type_length_mismatch(tree, "a timespec", length, TRUE);
break; break;
case ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN: case ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN:
@ -1718,21 +1721,27 @@ get_time_value(tvbuff_t *tvb, const gint start, const gint length, const guint e
* 4-byte UNIX epoch, possibly followed by * 4-byte UNIX epoch, possibly followed by
* 4-byte fractional time in nanoseconds, * 4-byte fractional time in nanoseconds,
* both little-endian. * both little-endian.
* For absolute times, the seconds are seconds
* since the UN*X epoch.
*/ */
time_stamp->secs = (time_t)tvb_get_letohl(tvb, start); time_stamp->secs = (time_t)tvb_get_letohl(tvb, start);
if (length == 8) if (length == 8)
time_stamp->nsecs = tvb_get_letohl(tvb, start+4); time_stamp->nsecs = tvb_get_letohl(tvb, start+4);
else else if (length == 4) {
/*
* Backwards compatibility.
*/
time_stamp->nsecs = 0; time_stamp->nsecs = 0;
} else
report_type_length_mismatch(tree, "a timespec", length, TRUE);
break; break;
case ENC_TIME_NTP|ENC_BIG_ENDIAN: case ENC_TIME_NTP|ENC_BIG_ENDIAN:
/* /*
* NTP time stamp, big-endian. * NTP time stamp, big-endian.
* Only supported for absolute times.
*/ */
DISSECTOR_ASSERT(!is_relative);
/* XXX - where should this go? */
#define NTP_BASETIME G_GUINT64_CONSTANT(2208988800)
/* We need a temporary variable here so the unsigned math /* We need a temporary variable here so the unsigned math
* works correctly (for years > 2036 according to RFC 2030 * works correctly (for years > 2036 according to RFC 2030
@ -1746,22 +1755,25 @@ get_time_value(tvbuff_t *tvb, const gint start, const gint length, const guint e
if (length == 8) { if (length == 8) {
/* /*
* We're using nanoseconds here (and we will * Convert 1/2^32s of a second to nanoseconds.
* display nanoseconds), but NTP's timestamps */
* have a precision in microseconds or greater. time_stamp->nsecs = (int)(1000000000*(tvb_get_ntohl(tvb, start+4)/4294967296.0));
* Round to 1 microsecond. } else if (length == 4) {
/*
* Backwards compatibility.
*/ */
time_stamp->nsecs = (int)(1000000*(tvb_get_ntohl(tvb, start+4)/4294967296.0));
time_stamp->nsecs *= 1000;
} else {
time_stamp->nsecs = 0; time_stamp->nsecs = 0;
} } else
report_type_length_mismatch(tree, "an NTP time stamp", length, TRUE);
break; break;
case ENC_TIME_NTP|ENC_LITTLE_ENDIAN: case ENC_TIME_NTP|ENC_LITTLE_ENDIAN:
/* /*
* NTP time stamp, big-endian. * NTP time stamp, little-endian.
* Only supported for absolute times.
*/ */
DISSECTOR_ASSERT(!is_relative);
tmpsecs = tvb_get_letohl(tvb, start); tmpsecs = tvb_get_letohl(tvb, start);
if (tmpsecs) if (tmpsecs)
time_stamp->secs = (time_t)(tmpsecs - (guint32)NTP_BASETIME); time_stamp->secs = (time_t)(tmpsecs - (guint32)NTP_BASETIME);
@ -1770,37 +1782,49 @@ get_time_value(tvbuff_t *tvb, const gint start, const gint length, const guint e
if (length == 8) { if (length == 8) {
/* /*
* We're using nanoseconds here (and we will * Convert 1/2^32s of a second to nanoseconds.
* display nanoseconds), but NTP's timestamps */
* have a precision in microseconds or greater. time_stamp->nsecs = (int)(1000000000*(tvb_get_letohl(tvb, start+4)/4294967296.0));
* Round to 1 microsecond. } else if (length == 4) {
/*
* Backwards compatibility.
*/ */
time_stamp->nsecs = (int)(1000000*(tvb_get_letohl(tvb, start+4)/4294967296.0));
time_stamp->nsecs *= 1000;
} else {
time_stamp->nsecs = 0; time_stamp->nsecs = 0;
} } else
report_type_length_mismatch(tree, "an NTP time stamp", length, TRUE);
break; break;
case ENC_TIME_TOD|ENC_BIG_ENDIAN: case ENC_TIME_TOD|ENC_BIG_ENDIAN:
/* /*
* TOD time stamp, big-endian. * S/3x0 and z/Architecture TOD clock time stamp,
* big-endian.
* Only supported for absolute times.
*/ */
/* XXX - where should this go? */ DISSECTOR_ASSERT(!is_relative);
#define TOD_BASETIME G_GUINT64_CONSTANT(2208988800) DISSECTOR_ASSERT(length == 8);
todsecs = tvb_get_ntoh64(tvb, start) >> 12; if (length == 8) {
time_stamp->secs = (time_t)((todsecs / 1000000) - TOD_BASETIME); todsecs = tvb_get_ntoh64(tvb, start) >> 12;
time_stamp->nsecs = (int)((todsecs % 1000000) * 1000); time_stamp->secs = (time_t)((todsecs / 1000000) - TOD_BASETIME);
time_stamp->nsecs = (int)((todsecs % 1000000) * 1000);
} else
report_type_length_mismatch(tree, "a TOD clock time stamp", length, TRUE);
break; break;
case ENC_TIME_TOD|ENC_LITTLE_ENDIAN: case ENC_TIME_TOD|ENC_LITTLE_ENDIAN:
/* /*
* TOD time stamp, big-endian. * S/3x0 and z/Architecture TOD clock time stamp,
* little-endian.
* Only supported for absolute times.
*/ */
todsecs = tvb_get_letoh64(tvb, start) >> 12 ; DISSECTOR_ASSERT(!is_relative);
time_stamp->secs = (time_t)((todsecs / 1000000) - TOD_BASETIME);
time_stamp->nsecs = (int)((todsecs % 1000000) * 1000); if (length == 8) {
todsecs = tvb_get_letoh64(tvb, start) >> 12 ;
time_stamp->secs = (time_t)((todsecs / 1000000) - TOD_BASETIME);
time_stamp->nsecs = (int)((todsecs % 1000000) * 1000);
} else
report_type_length_mismatch(tree, "a TOD clock time stamp", length, TRUE);
break; break;
case ENC_TIME_RTPS|ENC_BIG_ENDIAN: case ENC_TIME_RTPS|ENC_BIG_ENDIAN:
@ -1809,20 +1833,19 @@ get_time_value(tvbuff_t *tvb, const gint start, const gint length, const guint e
* as NTP, but with the origin of the time stamp being * as NTP, but with the origin of the time stamp being
* the UNIX epoch rather than the NTP epoch; big- * the UNIX epoch rather than the NTP epoch; big-
* endian. * endian.
*
* Only supported for absolute times.
*/ */
time_stamp->secs = (time_t)tvb_get_ntohl(tvb, start); DISSECTOR_ASSERT(!is_relative);
if (length == 8) { if (length == 8) {
time_stamp->secs = (time_t)tvb_get_ntohl(tvb, start);
/* /*
* We're using nanoseconds here (and we will * Convert 1/2^32s of a second to nanoseconds.
* display nanoseconds), but NTP's timestamps
* have a precision in microseconds or greater.
* Round to 1 microsecond.
*/ */
time_stamp->nsecs = (int)(1000000*(tvb_get_ntohl(tvb, start+4)/4294967296.0)); time_stamp->nsecs = (int)(1000000000*(tvb_get_ntohl(tvb, start+4)/4294967296.0));
time_stamp->nsecs *= 1000; } else
} else { report_type_length_mismatch(tree, "an RTPS time stamp", length, TRUE);
time_stamp->nsecs = 0;
}
break; break;
case ENC_TIME_RTPS|ENC_LITTLE_ENDIAN: case ENC_TIME_RTPS|ENC_LITTLE_ENDIAN:
@ -1831,38 +1854,183 @@ get_time_value(tvbuff_t *tvb, const gint start, const gint length, const guint e
* as NTP, but with the origin of the time stamp being * as NTP, but with the origin of the time stamp being
* the UNIX epoch rather than the NTP epoch; little- * the UNIX epoch rather than the NTP epoch; little-
* endian. * endian.
*
* Only supported for absolute times.
*/ */
time_stamp->secs = (time_t)tvb_get_letohl(tvb, start); DISSECTOR_ASSERT(!is_relative);
if (length == 8) { if (length == 8) {
time_stamp->secs = (time_t)tvb_get_letohl(tvb, start);
/* /*
* We're using nanoseconds here (and we will * Convert 1/2^32s of a second to nanoseconds.
* display nanoseconds), but NTP's timestamps
* have a precision in microseconds or greater.
* Round to 1 microsecond.
*/ */
time_stamp->nsecs = (int)(1000000*(tvb_get_letohl(tvb, start+4)/4294967296.0)); time_stamp->nsecs = (int)(1000000000*(tvb_get_letohl(tvb, start+4)/4294967296.0));
time_stamp->nsecs *= 1000; } else
} else { report_type_length_mismatch(tree, "an RTPS time stamp", length, TRUE);
time_stamp->nsecs = 0;
}
break; break;
case ENC_TIME_TIMEVAL|ENC_BIG_ENDIAN: case ENC_TIME_TIMEVAL|ENC_BIG_ENDIAN:
/* /*
* 4-byte UNIX epoch, followed by 4-byte fractional * 4-byte seconds, followed by 4-byte fractional
* time in microseconds, both big-endian. * time in microseconds, both big-endian.
* For absolute times, the seconds are seconds
* since the UN*X epoch.
*/ */
time_stamp->secs = (time_t)tvb_get_ntohl(tvb, start); if (length == 8) {
time_stamp->nsecs = tvb_get_ntohl(tvb, start+4)*1000; time_stamp->secs = (time_t)tvb_get_ntohl(tvb, start);
time_stamp->nsecs = tvb_get_ntohl(tvb, start+4)*1000;
} else
report_type_length_mismatch(tree, "a timeval", length, TRUE);
break; break;
case ENC_TIME_TIMEVAL|ENC_LITTLE_ENDIAN: case ENC_TIME_TIMEVAL|ENC_LITTLE_ENDIAN:
/* /*
* 4-byte UNIX epoch, followed by 4-byte fractional * 4-byte seconds, followed by 4-byte fractional
* time in microseconds, both little-endian. * time in microseconds, both little-endian.
* For absolute times, the seconds are seconds
* since the UN*X epoch.
*/ */
time_stamp->secs = (time_t)tvb_get_letohl(tvb, start); if (length == 8) {
time_stamp->nsecs = tvb_get_letohl(tvb, start+4)*1000; time_stamp->secs = (time_t)tvb_get_letohl(tvb, start);
time_stamp->nsecs = tvb_get_letohl(tvb, start+4)*1000;
} else
report_type_length_mismatch(tree, "a timeval", length, TRUE);
break;
case ENC_TIME_SECS|ENC_BIG_ENDIAN:
case ENC_TIME_SECS|ENC_LITTLE_ENDIAN:
/*
* Seconds, 1 to 8 bytes.
* For absolute times, it's seconds since the
* UN*X epoch.
*/
if (length >= 1 && length <= 8) {
time_stamp->secs = (time_t)get_uint64_value(tree, tvb, start, length, encoding);
time_stamp->nsecs = 0;
} else
report_type_length_mismatch(tree, "a time-in-seconds time stamp", length, TRUE);
break;
case ENC_TIME_MSECS|ENC_BIG_ENDIAN:
/*
* Milliseconds, 1 to 8 bytes.
* For absolute times, it's milliseconds since the
* UN*X epoch.
*/
if (length >= 1 && length <= 8) {
guint64 msecs;
msecs = get_uint64_value(tree, tvb, start, length, encoding);
time_stamp->secs = (time_t)(msecs / 1000);
time_stamp->nsecs = (int)(msecs % 1000);
} else
report_type_length_mismatch(tree, "a time-in-milliseconds time stamp", length, TRUE);
break;
case ENC_TIME_RFC_3971|ENC_BIG_ENDIAN:
/*
* 1/64ths of a second since the UN*X epoch,
* big-endian.
*
* Only supported for absolute times.
*/
DISSECTOR_ASSERT(!is_relative);
if (length == 8) {
/*
* The upper 48 bits are seconds since the
* UN*X epoch.
*/
time_stamp->secs = tvb_get_ntoh48(tvb, start);
/*
* The lower 16 bits are 1/2^16s of a second;
* convert them to nanoseconds.
*
* XXX - this may give the impression of higher
* precision than you actually get.
*/
time_stamp->nsecs = (int)(1000000000*(tvb_get_ntohs(tvb, start+6)/65536.0));
} else
report_type_length_mismatch(tree, "an RFC 3971-style time stamp", length, TRUE);
break;
case ENC_TIME_RFC_3971|ENC_LITTLE_ENDIAN:
/*
* 1/64ths of a second since the UN*X epoch,
* little-endian.
*
* Only supported for absolute times.
*/
DISSECTOR_ASSERT(!is_relative);
if (length == 8) {
/*
* XXX - this is assuming that, if anybody
* were ever to use this format - RFC 3971
* doesn't, because that's an Internet
* protocol, and those use network byte
* order, i.e. big-endian - they'd treat it
* as a 64-bit count of 1/2^16s of a second,
* putting the upper 48 bits at the end.
*
* The lower 48 bits are seconds since the
* UN*X epoch.
*/
time_stamp->secs = tvb_get_letoh48(tvb, start+2);
/*
* The upper 16 bits are 1/2^16s of a second;
* convert them to nanoseconds.
*
* XXX - this may give the impression of higher
* precision than you actually get.
*/
time_stamp->nsecs = (int)(1000000000*(tvb_get_letohs(tvb, start)/65536.0));
} else
report_type_length_mismatch(tree, "an RFC 3971-style time stamp", length, TRUE);
break;
case ENC_TIME_SECS_NTP|ENC_BIG_ENDIAN:
/*
* NTP time stamp, with 1-second resolution (i.e.,
* seconds since the NTP epoch), big-endian.
* Only supported for absolute times.
*/
DISSECTOR_ASSERT(!is_relative);
if (length == 4) {
/*
* We need a temporary variable here so the
* unsigned math works correctly (for
* years > 2036 according to RFC 2030
* chapter 3).
*/
tmpsecs = tvb_get_ntohl(tvb, start);
if (tmpsecs)
time_stamp->secs = (time_t)(tmpsecs - (guint32)NTP_BASETIME);
else
time_stamp->secs = tmpsecs; /* 0 */
time_stamp->nsecs = 0;
} else
report_type_length_mismatch(tree, "an NTP seconds-only time stamp", length, TRUE);
break;
case ENC_TIME_SECS_NTP|ENC_LITTLE_ENDIAN:
/*
* NTP time stamp, with 1-second resolution (i.e.,
* seconds since the NTP epoch), little-endian.
* Only supported for absolute times.
*/
DISSECTOR_ASSERT(!is_relative);
if (length == 4) {
tmpsecs = tvb_get_letohl(tvb, start);
if (tmpsecs)
time_stamp->secs = (time_t)(tmpsecs - (guint32)NTP_BASETIME);
else
time_stamp->secs = tmpsecs; /* 0 */
time_stamp->nsecs = 0;
} else
report_type_length_mismatch(tree, "an NTP seconds-only time stamp", length, TRUE);
break; break;
default: default:
@ -2278,7 +2446,7 @@ proto_tree_new_item(field_info *new_fi, proto_tree *tree,
report_type_length_mismatch(tree, "an absolute time value", length, length_error); report_type_length_mismatch(tree, "an absolute time value", length, length_error);
} }
get_time_value(tvb, start, length, encoding, &time_stamp, FALSE); get_time_value(tree, tvb, start, length, encoding, &time_stamp, FALSE);
proto_tree_set_time(new_fi, &time_stamp); proto_tree_set_time(new_fi, &time_stamp);
break; break;
@ -2305,7 +2473,7 @@ proto_tree_new_item(field_info *new_fi, proto_tree *tree,
report_type_length_mismatch(tree, "a relative time value", length, length_error); report_type_length_mismatch(tree, "a relative time value", length, length_error);
} }
get_time_value(tvb, start, length, encoding, &time_stamp, TRUE); get_time_value(tree, tvb, start, length, encoding, &time_stamp, TRUE);
proto_tree_set_time(new_fi, &time_stamp); proto_tree_set_time(new_fi, &time_stamp);
break; break;
@ -2846,7 +3014,7 @@ proto_tree_add_time_item(proto_tree *tree, int hfindex, tvbuff_t *tvb,
} }
tvb_ensure_bytes_exist(tvb, start, length); tvb_ensure_bytes_exist(tvb, start, length);
get_time_value(tvb, start, length, encoding, &time_stamp, is_relative); get_time_value(tree, tvb, start, length, encoding, &time_stamp, is_relative);
if (endoff) *endoff = length; if (endoff) *endoff = length;
} }

55
epan/proto.h
View File

@ -371,32 +371,43 @@ WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug(const char *message);
* *
* We now support: * We now support:
* *
* ENC_TIME_TIMESPEC - 4 or 8 bytes; the first 4 bytes are seconds since * ENC_TIME_TIMESPEC - 8 bytes; the first 4 bytes are seconds and the
* the UN*X epoch (1970-01-01 00:00:00 UTC), and, if there are 8 bytes, * next 4 bytes are nanoseconds. If the time is absolute, the seconds
* the next 4 bytes are nanoseconds since that second. (I.e., a UN*X * are seconds since the UN*X epoch (1970-01-01 00:00:00 UTC). (I.e.,
* struct timespec with a 4-byte time_t.) * a UN*X struct timespec with a 4-byte time_t.)
* *
* ENC_TIME_NTP - 4 or 8 bytes; the first 4 bytes are seconds since * ENC_TIME_NTP - 8 bytes; the first 4 bytes are seconds since the NTP
* the NTP epoch (1901-01-01 00:00:00 GMT), and, if there are 8 bytes, * epoch (1901-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of
* the next 4 bytes are 1/2^32's of a second since that second. (I.e., * a second since that second. (I.e., a 64-bit count of 1/2^32's of a
* a 64-bit count of 1/2^32's of a second since the NTP epoch, with * second since the NTP epoch, with the upper 32 bits first and the
* the upper 32 bits first and the lower 32 bits second, even when * lower 32 bits second, even when little-endian.)
* little-endian.)
* *
* ENC_TIME_TOD - 8 bytes, as a count of microseconds since the System/3x0 * ENC_TIME_TOD - 8 bytes, as a count of microseconds since the System/3x0
* and z/Architecture epoch (1900-01-01 00:00:00 GMT). * and z/Architecture epoch (1900-01-01 00:00:00 GMT).
* *
* ENC_TIME_RTPS - 4 or 8 bytes; the first 4 bytes are seconds since the * ENC_TIME_RTPS - 8 bytes; the first 4 bytes are seconds since the UN*X
* UN*X epoch, and, if there are 8 bytes, the next 4 bytes are are * epoch and the next 4 bytes are are 1/2^32's of a second since that
* 1/2^32's of a second since that second. (I.e., it's the offspring * second. (I.e., it's the offspring of a mating between UN*X time and
* of a mating between UN*X time and NTP time.) It's used by the Object * NTP time.) It's used by the Object Management Group's Real-Time
* Management Group's Real-Time Publish-Subscribe Wire Protocol for the * Publish-Subscribe Wire Protocol for the Data Distribution Service.
* Data Distribution Service.
* *
* ENC_TIME_TIMEVAL - 8 bytes; the first 4 bytes are seconds since * ENC_TIME_TIMEVAL - 8 bytes; the first 4 bytes are seconds and the
* the UN*X epoch (1970-01-01 00:00:00 UTC), and, if there are 8 bytes, * next 4 bytes are microseconds. If the time is absolute, the seconds
* the next 4 bytes are microseconds since that second. (I.e., a UN*X * are seconds since the UN*X epoch. (I.e., a UN*X struct timeval with
* struct timeval with a 4-byte time_t.) * a 4-byte time_t.)
*
* ENC_TIME_SECS - 4 to 8 bytes, representing a value in seconds.
* If the time is absolute, it's seconds since the UN*X epoch.
*
* ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds.
* If the time is absolute, it's milliseconds since the UN*X epoch.
*
* ENC_TIME_SECS_NTP - 4 bytes, representing a count of seconds since
* the NTP epoch. (I.e., seconds since the NTP epoch.)
*
* ENC_TIME_RFC_3971 - 8 bytes, representing a count of 1/64ths of a
* second since the UN*X epoch; see section 5.3.1 "Timestamp Option"
* in RFC 3971.
*/ */
#define ENC_TIME_TIMESPEC 0x00000000 #define ENC_TIME_TIMESPEC 0x00000000
#define ENC_TIME_NTP 0x00000002 #define ENC_TIME_NTP 0x00000002
@ -404,6 +415,10 @@ WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug(const char *message);
#define ENC_TIME_RTPS 0x00000008 #define ENC_TIME_RTPS 0x00000008
#define ENC_TIME_NTP_BASE_ZERO ENC_TIME_RTP /* for backwards source compatibility */ #define ENC_TIME_NTP_BASE_ZERO ENC_TIME_RTP /* for backwards source compatibility */
#define ENC_TIME_TIMEVAL 0x00000010 #define ENC_TIME_TIMEVAL 0x00000010
#define ENC_TIME_SECS 0x00000012
#define ENC_TIME_MSECS 0x00000014
#define ENC_TIME_SECS_NTP 0x00000018
#define ENC_TIME_RFC_3971 0x00000020
/* /*
* Historically, the only place the representation mattered for strings * Historically, the only place the representation mattered for strings