From ebfbf958f6930b2dad486b33277470e8368dc111 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicol=C3=A1s=20Alvarez?= Date: Wed, 3 Feb 2021 18:12:29 -0300 Subject: [PATCH] Add ENC_TIME_NSECS timestamp encoding Add a new timestamp encoding format ENC_TIME_NSECS, like ENC_TIME_SEC but for nanosecond values. Needed for my work-in-progress dissector for Apple push notifications. --- doc/README.dissector | 5 +++++ epan/proto.c | 21 +++++++++++++++++++++ epan/proto.h | 4 ++++ 3 files changed, 30 insertions(+) diff --git a/doc/README.dissector b/doc/README.dissector index 422cdf6e1a..0e76c0f99d 100644 --- a/doc/README.dissector +++ b/doc/README.dissector @@ -1820,6 +1820,9 @@ encodings that are currently supported are: ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds since the UN*X epoch. + ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds since + the UN*X epoch. + ENC_TIME_SECS_NTP - 4 bytes, representing a count of seconds since the NTP epoch. @@ -1854,6 +1857,8 @@ encodings that are currently supported are: ENC_TIME_MSECS - 6 to 8 bytes, representing a value in milliseconds. + ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds. + For other types, there is no support for proto_tree_add_item(). Now that definitions of fields have detailed information about bitfield diff --git a/epan/proto.c b/epan/proto.c index e703bc69a8..25c5b349bb 100644 --- a/epan/proto.c +++ b/epan/proto.c @@ -2223,6 +2223,27 @@ get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start, } break; + case ENC_TIME_NSECS|ENC_BIG_ENDIAN: + case ENC_TIME_NSECS|ENC_LITTLE_ENDIAN: + /* + * nanoseconds, 1 to 8 bytes. + * For absolute times, it's nanoseconds since the + * UN*X epoch. + */ + + if (length >= 1 && length <= 8) { + guint64 nsecs; + + nsecs = get_uint64_value(tree, tvb, start, length, encoding); + time_stamp->secs = (time_t)(nsecs / 1000000000); + time_stamp->nsecs = (int)(nsecs % 1000000000); + } else { + time_stamp->secs = 0; + time_stamp->nsecs = 0; + report_type_length_mismatch(tree, "a time-in-nanoseconds time stamp", length, (length < 4)); + } + break; + case ENC_TIME_RFC_3971|ENC_BIG_ENDIAN: /* * 1/64ths of a second since the UN*X epoch, diff --git a/epan/proto.h b/epan/proto.h index f094179373..b893db9c65 100644 --- a/epan/proto.h +++ b/epan/proto.h @@ -581,6 +581,9 @@ void proto_report_dissector_bug(const char *format, ...) * ENC_TIME_CLASSIC_MAC_OS_SECS - 4-8 bytes, representing a count of seconds * since January 1, 1904, 00:00:00 UTC. * + * ENC_TIME_NSECS - 8 bytes, representing a value in nanoseconds. + * If the time is absolute, it's nanoseconds since the UN*X epoch. + * * The backwards-compatibility names are defined as hex numbers so that * the script to generate init.lua will add them as global variables, * along with the new names. @@ -600,6 +603,7 @@ void proto_report_dissector_bug(const char *format, ...) #define ENC_TIME_MSEC_NTP 0x00000022 #define ENC_TIME_MIP6 0x00000024 #define ENC_TIME_CLASSIC_MAC_OS_SECS 0x00000026 +#define ENC_TIME_NSECS 0x00000028 /* * For cases where a string encoding contains a timestamp, use one