forked from osmocom/wireshark
![Pascal Quantin](/assets/img/avatar_default.png)
Change-Id: Ief3c86562d5eadb845b5a32dc704a61ccd27fdf6 Reviewed-on: https://code.wireshark.org/review/2443 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
1103 lines
26 KiB
C
1103 lines
26 KiB
C
/* wtap.c
|
|
*
|
|
* Wiretap Library
|
|
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version 2
|
|
* of the License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <string.h>
|
|
#include <errno.h>
|
|
|
|
#ifdef HAVE_SYS_TYPES_H
|
|
#include <sys/types.h>
|
|
#endif
|
|
|
|
#ifdef HAVE_UNISTD_H
|
|
#include <unistd.h>
|
|
#endif
|
|
|
|
#ifdef HAVE_LIBZ
|
|
#include <zlib.h>
|
|
#endif
|
|
|
|
#include "wtap-int.h"
|
|
|
|
#include "file_wrappers.h"
|
|
#include <wsutil/file_util.h>
|
|
#include "buffer.h"
|
|
|
|
#ifdef HAVE_PLUGINS
|
|
|
|
#include <wsutil/plugins.h>
|
|
|
|
/*
|
|
* List of wiretap plugins.
|
|
*/
|
|
typedef struct {
|
|
void (*register_wtap_module)(void); /* routine to call to register a wiretap module */
|
|
} wtap_plugin;
|
|
|
|
static GSList *wtap_plugins = NULL;
|
|
|
|
/*
|
|
* Callback for each plugin found.
|
|
*/
|
|
static gboolean
|
|
check_for_wtap_plugin(GModule *handle)
|
|
{
|
|
gpointer gp;
|
|
void (*register_wtap_module)(void);
|
|
wtap_plugin *plugin;
|
|
|
|
/*
|
|
* Do we have a register_wtap_module routine?
|
|
*/
|
|
if (!g_module_symbol(handle, "register_wtap_module", &gp)) {
|
|
/* No, so this isn't a wiretap module plugin. */
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* Yes - this plugin includes one or more wiretap modules.
|
|
*/
|
|
register_wtap_module = (void (*)(void))gp;
|
|
|
|
/*
|
|
* Add this one to the list of wiretap module plugins.
|
|
*/
|
|
plugin = (wtap_plugin *)g_malloc(sizeof (wtap_plugin));
|
|
plugin->register_wtap_module = register_wtap_module;
|
|
wtap_plugins = g_slist_append(wtap_plugins, plugin);
|
|
return TRUE;
|
|
}
|
|
|
|
void
|
|
wtap_register_plugin_types(void)
|
|
{
|
|
add_plugin_type("libwiretap", check_for_wtap_plugin);
|
|
}
|
|
|
|
static void
|
|
register_wtap_module_plugin(gpointer data, gpointer user_data _U_)
|
|
{
|
|
wtap_plugin *plugin = (wtap_plugin *)data;
|
|
|
|
(plugin->register_wtap_module)();
|
|
}
|
|
|
|
/*
|
|
* For all wiretap module plugins, call their register routines.
|
|
*/
|
|
void
|
|
register_all_wiretap_modules(void)
|
|
{
|
|
g_slist_foreach(wtap_plugins, register_wtap_module_plugin, NULL);
|
|
}
|
|
#endif /* HAVE_PLUGINS */
|
|
|
|
/*
|
|
* Return the size of the file, as reported by the OS.
|
|
* (gint64, in case that's 64 bits.)
|
|
*/
|
|
gint64
|
|
wtap_file_size(wtap *wth, int *err)
|
|
{
|
|
ws_statb64 statb;
|
|
|
|
if (file_fstat((wth->fh == NULL) ? wth->random_fh : wth->fh,
|
|
&statb, err) == -1)
|
|
return -1;
|
|
return statb.st_size;
|
|
}
|
|
|
|
/*
|
|
* Do an fstat on the file.
|
|
*/
|
|
int
|
|
wtap_fstat(wtap *wth, ws_statb64 *statb, int *err)
|
|
{
|
|
if (file_fstat((wth->fh == NULL) ? wth->random_fh : wth->fh,
|
|
statb, err) == -1)
|
|
return -1;
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
wtap_file_type_subtype(wtap *wth)
|
|
{
|
|
return wth->file_type_subtype;
|
|
}
|
|
|
|
gboolean
|
|
wtap_iscompressed(wtap *wth)
|
|
{
|
|
return file_iscompressed((wth->fh == NULL) ? wth->random_fh : wth->fh);
|
|
}
|
|
|
|
guint
|
|
wtap_snapshot_length(wtap *wth)
|
|
{
|
|
return wth->snapshot_length;
|
|
}
|
|
|
|
int
|
|
wtap_file_encap(wtap *wth)
|
|
{
|
|
return wth->file_encap;
|
|
}
|
|
|
|
int
|
|
wtap_file_tsprecision(wtap *wth)
|
|
{
|
|
return wth->tsprecision;
|
|
}
|
|
|
|
wtapng_section_t *
|
|
wtap_file_get_shb_info(wtap *wth)
|
|
{
|
|
wtapng_section_t *shb_hdr;
|
|
|
|
if(wth == NULL)
|
|
return NULL;
|
|
shb_hdr = g_new(wtapng_section_t,1);
|
|
shb_hdr->section_length = wth->shb_hdr.section_length;
|
|
/* options */
|
|
shb_hdr->opt_comment = wth->shb_hdr.opt_comment; /* NULL if not available */
|
|
shb_hdr->shb_hardware = wth->shb_hdr.shb_hardware; /* NULL if not available, UTF-8 string containing the description of the hardware used to create this section. */
|
|
shb_hdr->shb_os = wth->shb_hdr.shb_os; /* NULL if not available, UTF-8 string containing the name of the operating system used to create this section. */
|
|
shb_hdr->shb_user_appl = wth->shb_hdr.shb_user_appl; /* NULL if not available, UTF-8 string containing the name of the application used to create this section. */
|
|
|
|
|
|
return shb_hdr;
|
|
}
|
|
|
|
void
|
|
wtap_write_shb_comment(wtap *wth, gchar *comment)
|
|
{
|
|
g_free(wth->shb_hdr.opt_comment);
|
|
wth->shb_hdr.opt_comment = comment;
|
|
|
|
}
|
|
|
|
wtapng_iface_descriptions_t *
|
|
wtap_file_get_idb_info(wtap *wth)
|
|
{
|
|
wtapng_iface_descriptions_t *idb_info;
|
|
|
|
idb_info = g_new(wtapng_iface_descriptions_t,1);
|
|
|
|
idb_info->interface_data = wth->interface_data;
|
|
|
|
return idb_info;
|
|
}
|
|
|
|
/* Table of the encapsulation types we know about. */
|
|
struct encap_type_info {
|
|
const char *name;
|
|
const char *short_name;
|
|
};
|
|
|
|
static struct encap_type_info encap_table_base[] = {
|
|
/* WTAP_ENCAP_UNKNOWN */
|
|
{ "Unknown", "unknown" },
|
|
|
|
/* WTAP_ENCAP_ETHERNET */
|
|
{ "Ethernet", "ether" },
|
|
|
|
/* WTAP_ENCAP_TOKEN_RING */
|
|
{ "Token Ring", "tr" },
|
|
|
|
/* WTAP_ENCAP_SLIP */
|
|
{ "SLIP", "slip" },
|
|
|
|
/* WTAP_ENCAP_PPP */
|
|
{ "PPP", "ppp" },
|
|
|
|
/* WTAP_ENCAP_FDDI */
|
|
{ "FDDI", "fddi" },
|
|
|
|
/* WTAP_ENCAP_FDDI_BITSWAPPED */
|
|
{ "FDDI with bit-swapped MAC addresses", "fddi-swapped" },
|
|
|
|
/* WTAP_ENCAP_RAW_IP */
|
|
{ "Raw IP", "rawip" },
|
|
|
|
/* WTAP_ENCAP_ARCNET */
|
|
{ "ARCNET", "arcnet" },
|
|
|
|
/* WTAP_ENCAP_ARCNET_LINUX */
|
|
{ "Linux ARCNET", "arcnet_linux" },
|
|
|
|
/* WTAP_ENCAP_ATM_RFC1483 */
|
|
{ "RFC 1483 ATM", "atm-rfc1483" },
|
|
|
|
/* WTAP_ENCAP_LINUX_ATM_CLIP */
|
|
{ "Linux ATM CLIP", "linux-atm-clip" },
|
|
|
|
/* WTAP_ENCAP_LAPB */
|
|
{ "LAPB", "lapb" },
|
|
|
|
/* WTAP_ENCAP_ATM_PDUS */
|
|
{ "ATM PDUs", "atm-pdus" },
|
|
|
|
/* WTAP_ENCAP_ATM_PDUS_UNTRUNCATED */
|
|
{ "ATM PDUs - untruncated", "atm-pdus-untruncated" },
|
|
|
|
/* WTAP_ENCAP_NULL */
|
|
{ "NULL", "null" },
|
|
|
|
/* WTAP_ENCAP_ASCEND */
|
|
{ "Lucent/Ascend access equipment", "ascend" },
|
|
|
|
/* WTAP_ENCAP_ISDN */
|
|
{ "ISDN", "isdn" },
|
|
|
|
/* WTAP_ENCAP_IP_OVER_FC */
|
|
{ "RFC 2625 IP-over-Fibre Channel", "ip-over-fc" },
|
|
|
|
/* WTAP_ENCAP_PPP_WITH_PHDR */
|
|
{ "PPP with Directional Info", "ppp-with-direction" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11 */
|
|
{ "IEEE 802.11 Wireless LAN", "ieee-802-11" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_PRISM */
|
|
{ "IEEE 802.11 plus Prism II monitor mode radio header", "ieee-802-11-prism" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_WITH_RADIO */
|
|
{ "IEEE 802.11 Wireless LAN with radio information", "ieee-802-11-radio" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_RADIOTAP */
|
|
{ "IEEE 802.11 plus radiotap radio header", "ieee-802-11-radiotap" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_AVS */
|
|
{ "IEEE 802.11 plus AVS radio header", "ieee-802-11-avs" },
|
|
|
|
/* WTAP_ENCAP_SLL */
|
|
{ "Linux cooked-mode capture", "linux-sll" },
|
|
|
|
/* WTAP_ENCAP_FRELAY */
|
|
{ "Frame Relay", "frelay" },
|
|
|
|
/* WTAP_ENCAP_FRELAY_WITH_PHDR */
|
|
{ "Frame Relay with Directional Info", "frelay-with-direction" },
|
|
|
|
/* WTAP_ENCAP_CHDLC */
|
|
{ "Cisco HDLC", "chdlc" },
|
|
|
|
/* WTAP_ENCAP_CISCO_IOS */
|
|
{ "Cisco IOS internal", "ios" },
|
|
|
|
/* WTAP_ENCAP_LOCALTALK */
|
|
{ "Localtalk", "ltalk" },
|
|
|
|
/* WTAP_ENCAP_OLD_PFLOG */
|
|
{ "OpenBSD PF Firewall logs, pre-3.4", "pflog-old" },
|
|
|
|
/* WTAP_ENCAP_HHDLC */
|
|
{ "HiPath HDLC", "hhdlc" },
|
|
|
|
/* WTAP_ENCAP_DOCSIS */
|
|
{ "Data Over Cable Service Interface Specification", "docsis" },
|
|
|
|
/* WTAP_ENCAP_COSINE */
|
|
{ "CoSine L2 debug log", "cosine" },
|
|
|
|
/* WTAP_ENCAP_WFLEET_HDLC */
|
|
{ "Wellfleet HDLC", "whdlc" },
|
|
|
|
/* WTAP_ENCAP_SDLC */
|
|
{ "SDLC", "sdlc" },
|
|
|
|
/* WTAP_ENCAP_TZSP */
|
|
{ "Tazmen sniffer protocol", "tzsp" },
|
|
|
|
/* WTAP_ENCAP_ENC */
|
|
{ "OpenBSD enc(4) encapsulating interface", "enc" },
|
|
|
|
/* WTAP_ENCAP_PFLOG */
|
|
{ "OpenBSD PF Firewall logs", "pflog" },
|
|
|
|
/* WTAP_ENCAP_CHDLC_WITH_PHDR */
|
|
{ "Cisco HDLC with Directional Info", "chdlc-with-direction" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_H4 */
|
|
{ "Bluetooth H4", "bluetooth-h4" },
|
|
|
|
/* WTAP_ENCAP_MTP2 */
|
|
{ "SS7 MTP2", "mtp2" },
|
|
|
|
/* WTAP_ENCAP_MTP3 */
|
|
{ "SS7 MTP3", "mtp3" },
|
|
|
|
/* WTAP_ENCAP_IRDA */
|
|
{ "IrDA", "irda" },
|
|
|
|
/* WTAP_ENCAP_USER0 */
|
|
{ "USER 0", "user0" },
|
|
|
|
/* WTAP_ENCAP_USER1 */
|
|
{ "USER 1", "user1" },
|
|
|
|
/* WTAP_ENCAP_USER2 */
|
|
{ "USER 2", "user2" },
|
|
|
|
/* WTAP_ENCAP_USER3 */
|
|
{ "USER 3", "user3" },
|
|
|
|
/* WTAP_ENCAP_USER4 */
|
|
{ "USER 4", "user4" },
|
|
|
|
/* WTAP_ENCAP_USER5 */
|
|
{ "USER 5", "user5" },
|
|
|
|
/* WTAP_ENCAP_USER6 */
|
|
{ "USER 6", "user6" },
|
|
|
|
/* WTAP_ENCAP_USER7 */
|
|
{ "USER 7", "user7" },
|
|
|
|
/* WTAP_ENCAP_USER8 */
|
|
{ "USER 8", "user8" },
|
|
|
|
/* WTAP_ENCAP_USER9 */
|
|
{ "USER 9", "user9" },
|
|
|
|
/* WTAP_ENCAP_USER10 */
|
|
{ "USER 10", "user10" },
|
|
|
|
/* WTAP_ENCAP_USER11 */
|
|
{ "USER 11", "user11" },
|
|
|
|
/* WTAP_ENCAP_USER12 */
|
|
{ "USER 12", "user12" },
|
|
|
|
/* WTAP_ENCAP_USER13 */
|
|
{ "USER 13", "user13" },
|
|
|
|
/* WTAP_ENCAP_USER14 */
|
|
{ "USER 14", "user14" },
|
|
|
|
/* WTAP_ENCAP_USER15 */
|
|
{ "USER 15", "user15" },
|
|
|
|
/* WTAP_ENCAP_SYMANTEC */
|
|
{ "Symantec Enterprise Firewall", "symantec" },
|
|
|
|
/* WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 */
|
|
{ "Apple IP-over-IEEE 1394", "ap1394" },
|
|
|
|
/* WTAP_ENCAP_BACNET_MS_TP */
|
|
{ "BACnet MS/TP", "bacnet-ms-tp" },
|
|
|
|
/* WTAP_ENCAP_NETTL_RAW_ICMP */
|
|
{ "Raw ICMP with nettl headers", "raw-icmp-nettl" },
|
|
|
|
/* WTAP_ENCAP_NETTL_RAW_ICMPV6 */
|
|
{ "Raw ICMPv6 with nettl headers", "raw-icmpv6-nettl" },
|
|
|
|
/* WTAP_ENCAP_GPRS_LLC */
|
|
{ "GPRS LLC", "gprs-llc" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_ATM1 */
|
|
{ "Juniper ATM1", "juniper-atm1" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_ATM2 */
|
|
{ "Juniper ATM2", "juniper-atm2" },
|
|
|
|
/* WTAP_ENCAP_REDBACK */
|
|
{ "Redback SmartEdge", "redback" },
|
|
|
|
/* WTAP_ENCAP_NETTL_RAW_IP */
|
|
{ "Raw IP with nettl headers", "rawip-nettl" },
|
|
|
|
/* WTAP_ENCAP_NETTL_ETHERNET */
|
|
{ "Ethernet with nettl headers", "ether-nettl" },
|
|
|
|
/* WTAP_ENCAP_NETTL_TOKEN_RING */
|
|
{ "Token Ring with nettl headers", "tr-nettl" },
|
|
|
|
/* WTAP_ENCAP_NETTL_FDDI */
|
|
{ "FDDI with nettl headers", "fddi-nettl" },
|
|
|
|
/* WTAP_ENCAP_NETTL_UNKNOWN */
|
|
{ "Unknown link-layer type with nettl headers", "unknown-nettl" },
|
|
|
|
/* WTAP_ENCAP_MTP2_WITH_PHDR */
|
|
{ "MTP2 with pseudoheader", "mtp2-with-phdr" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_PPPOE */
|
|
{ "Juniper PPPoE", "juniper-pppoe" },
|
|
|
|
/* WTAP_ENCAP_GCOM_TIE1 */
|
|
{ "GCOM TIE1", "gcom-tie1" },
|
|
|
|
/* WTAP_ENCAP_GCOM_SERIAL */
|
|
{ "GCOM Serial", "gcom-serial" },
|
|
|
|
/* WTAP_ENCAP_NETTL_X25 */
|
|
{ "X.25 with nettl headers", "x25-nettl" },
|
|
|
|
/* WTAP_ENCAP_K12 */
|
|
{ "K12 protocol analyzer", "k12" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_MLPPP */
|
|
{ "Juniper MLPPP", "juniper-mlppp" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_MLFR */
|
|
{ "Juniper MLFR", "juniper-mlfr" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_ETHER */
|
|
{ "Juniper Ethernet", "juniper-ether" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_PPP */
|
|
{ "Juniper PPP", "juniper-ppp" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_FRELAY */
|
|
{ "Juniper Frame-Relay", "juniper-frelay" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_CHDLC */
|
|
{ "Juniper C-HDLC", "juniper-chdlc" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_GGSN */
|
|
{ "Juniper GGSN", "juniper-ggsn" },
|
|
|
|
/* WTAP_ENCAP_LINUX_LAPD */
|
|
{ "LAPD with Linux pseudo-header", "linux-lapd" },
|
|
|
|
/* WTAP_ENCAP_CATAPULT_DCT2000 */
|
|
{ "Catapult DCT2000", "dct2000" },
|
|
|
|
/* WTAP_ENCAP_BER */
|
|
{ "ASN.1 Basic Encoding Rules", "ber" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_VP */
|
|
{ "Juniper Voice PIC", "juniper-vp" },
|
|
|
|
/* WTAP_ENCAP_USB */
|
|
{ "Raw USB packets", "usb" },
|
|
|
|
/* WTAP_ENCAP_IEEE802_16_MAC_CPS */
|
|
{ "IEEE 802.16 MAC Common Part Sublayer", "ieee-802-16-mac-cps" },
|
|
|
|
/* WTAP_ENCAP_NETTL_RAW_TELNET */
|
|
{ "Raw telnet with nettl headers", "raw-telnet-nettl" },
|
|
|
|
/* WTAP_ENCAP_USB_LINUX */
|
|
{ "USB packets with Linux header", "usb-linux" },
|
|
|
|
/* WTAP_ENCAP_MPEG */
|
|
{ "MPEG", "mpeg" },
|
|
|
|
/* WTAP_ENCAP_PPI */
|
|
{ "Per-Packet Information header", "ppi" },
|
|
|
|
/* WTAP_ENCAP_ERF */
|
|
{ "Extensible Record Format", "erf" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR */
|
|
{ "Bluetooth H4 with linux header", "bluetooth-h4-linux" },
|
|
|
|
/* WTAP_ENCAP_SITA */
|
|
{ "SITA WAN packets", "sita-wan" },
|
|
|
|
/* WTAP_ENCAP_SCCP */
|
|
{ "SS7 SCCP", "sccp" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_HCI */
|
|
{ "Bluetooth without transport layer", "bluetooth-hci" },
|
|
|
|
/* WTAP_ENCAP_IPMB */
|
|
{ "Intelligent Platform Management Bus", "ipmb" },
|
|
|
|
/* WTAP_ENCAP_IEEE802_15_4 */
|
|
{ "IEEE 802.15.4 Wireless PAN", "wpan" },
|
|
|
|
/* WTAP_ENCAP_X2E_XORAYA */
|
|
{ "X2E Xoraya", "x2e-xoraya" },
|
|
|
|
/* WTAP_ENCAP_FLEXRAY */
|
|
{ "FlexRay", "flexray" },
|
|
|
|
/* WTAP_ENCAP_LIN */
|
|
{ "Local Interconnect Network", "lin" },
|
|
|
|
/* WTAP_ENCAP_MOST */
|
|
{ "Media Oriented Systems Transport", "most" },
|
|
|
|
/* WTAP_ENCAP_CAN20B */
|
|
{ "Controller Area Network 2.0B", "can20b" },
|
|
|
|
/* WTAP_ENCAP_LAYER1_EVENT */
|
|
{ "EyeSDN Layer 1 event", "layer1-event" },
|
|
|
|
/* WTAP_ENCAP_X2E_SERIAL */
|
|
{ "X2E serial line capture", "x2e-serial" },
|
|
|
|
/* WTAP_ENCAP_I2C */
|
|
{ "I2C", "i2c" },
|
|
|
|
/* WTAP_ENCAP_IEEE802_15_4_NONASK_PHY */
|
|
{ "IEEE 802.15.4 Wireless PAN non-ASK PHY", "wpan-nonask-phy" },
|
|
|
|
/* WTAP_ENCAP_TNEF */
|
|
{ "Transport-Neutral Encapsulation Format", "tnef" },
|
|
|
|
/* WTAP_ENCAP_USB_LINUX_MMAPPED */
|
|
{ "USB packets with Linux header and padding", "usb-linux-mmap" },
|
|
|
|
/* WTAP_ENCAP_GSM_UM */
|
|
{ "GSM Um Interface", "gsm_um" },
|
|
|
|
/* WTAP_ENCAP_DPNSS */
|
|
{ "Digital Private Signalling System No 1 Link Layer", "dpnss_link" },
|
|
|
|
/* WTAP_ENCAP_PACKETLOGGER */
|
|
{ "PacketLogger", "packetlogger" },
|
|
|
|
/* WTAP_ENCAP_NSTRACE_1_0 */
|
|
{ "NetScaler Encapsulation 1.0 of Ethernet", "nstrace10" },
|
|
|
|
/* WTAP_ENCAP_NSTRACE_2_0 */
|
|
{ "NetScaler Encapsulation 2.0 of Ethernet", "nstrace20" },
|
|
|
|
/* WTAP_ENCAP_FIBRE_CHANNEL_FC2 */
|
|
{ "Fibre Channel FC-2", "fc2" },
|
|
|
|
/* WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS */
|
|
{ "Fibre Channel FC-2 With Frame Delimiter", "fc2sof"},
|
|
|
|
/* WTAP_ENCAP_JPEG_JFIF */
|
|
{ "JPEG/JFIF", "jfif" },
|
|
|
|
/* WTAP_ENCAP_IPNET */
|
|
{ "Solaris IPNET", "ipnet" },
|
|
|
|
/* WTAP_ENCAP_SOCKETCAN */
|
|
{ "SocketCAN", "socketcan" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_NETMON */
|
|
{ "IEEE 802.11 plus Network Monitor radio header", "ieee-802-11-netmon" },
|
|
|
|
/* WTAP_ENCAP_IEEE802_15_4_NOFCS */
|
|
{ "IEEE 802.15.4 Wireless PAN with FCS not present", "wpan-nofcs" },
|
|
|
|
/* WTAP_ENCAP_RAW_IPFIX */
|
|
{ "IPFIX", "ipfix" },
|
|
|
|
/* WTAP_ENCAP_RAW_IP4 */
|
|
{ "Raw IPv4", "rawip4" },
|
|
|
|
/* WTAP_ENCAP_RAW_IP6 */
|
|
{ "Raw IPv6", "rawip6" },
|
|
|
|
/* WTAP_ENCAP_LAPD */
|
|
{ "LAPD", "lapd" },
|
|
|
|
/* WTAP_ENCAP_DVBCI */
|
|
{ "DVB-CI (Common Interface)", "dvbci"},
|
|
|
|
/* WTAP_ENCAP_MUX27010 */
|
|
{ "MUX27010", "mux27010"},
|
|
|
|
/* WTAP_ENCAP_MIME */
|
|
{ "MIME", "mime" },
|
|
|
|
/* WTAP_ENCAP_NETANALYZER */
|
|
{ "netANALYZER", "netanalyzer" },
|
|
|
|
/* WTAP_ENCAP_NETANALYZER_TRANSPARENT */
|
|
{ "netANALYZER-Transparent", "netanalyzer-transparent" },
|
|
|
|
/* WTAP_ENCAP_IP_OVER_IB */
|
|
{ "IP over Infiniband", "ip-over-ib" },
|
|
|
|
/* WTAP_ENCAP_MPEG_2_TS */
|
|
{ "ISO/IEC 13818-1 MPEG2-TS", "mp2ts" },
|
|
|
|
/* WTAP_ENCAP_PPP_ETHER */
|
|
{ "PPP-over-Ethernet session", "pppoes" },
|
|
|
|
/* WTAP_ENCAP_NFC_LLCP */
|
|
{ "NFC LLCP", "nfc-llcp" },
|
|
|
|
/* WTAP_ENCAP_NFLOG */
|
|
{ "NFLOG", "nflog" },
|
|
|
|
/* WTAP_ENCAP_V5_EF */
|
|
{ "V5 Envelope Function", "v5-ef" },
|
|
|
|
/* WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR */
|
|
{ "BACnet MS/TP with Directional Info", "bacnet-ms-tp-with-direction" },
|
|
|
|
/* WTAP_ENCAP_IXVERIWAVE */
|
|
{ "IxVeriWave header and stats block", "ixveriwave" },
|
|
|
|
/* WTAP_ENCAP_IEEE_802_11_AIROPEEK */
|
|
{ "IEEE 802.11 plus AiroPeek radio header", "ieee-802-11-airopeek" },
|
|
|
|
/* WTAP_ENCAP_SDH */
|
|
{ "SDH", "sdh" },
|
|
|
|
/* WTAP_ENCAP_DBUS */
|
|
{ "D-Bus", "dbus" },
|
|
|
|
/* WTAP_ENCAP_AX25_KISS */
|
|
{ "AX.25 with KISS header", "ax25-kiss" },
|
|
|
|
/* WTAP_ENCAP_AX25 */
|
|
{ "Amateur Radio AX.25", "ax25" },
|
|
|
|
/* WTAP_ENCAP_SCTP */
|
|
{ "SCTP", "sctp" },
|
|
|
|
/* WTAP_ENCAP_INFINIBAND */
|
|
{ "InfiniBand", "infiniband" },
|
|
|
|
/* WTAP_ENCAP_JUNIPER_SVCS */
|
|
{ "Juniper Services", "juniper-svcs" },
|
|
|
|
/* WTAP_ENCAP_USBPCAP */
|
|
{ "USB packets with USBPcap header", "usb-usbpcap" },
|
|
|
|
/* WTAP_ENCAP_RTAC_SERIAL */
|
|
{ "RTAC serial-line", "rtac-serial" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_LE_LL */
|
|
{ "Bluetooth Low Energy Link Layer", "bluetooth-le-ll" },
|
|
|
|
/* WTAP_ENCAP_WIRESHARK_UPPER_PDU */
|
|
{ "Wireshark Upper PDU export", "wireshark-upper-pdu" },
|
|
|
|
/* WTAP_ENCAP_STANAG_4607 */
|
|
{ "STANAG 4607", "s4607" },
|
|
|
|
/* WTAP_ENCAP_STANAG_5066_D_PDU */
|
|
{ "STANAG 5066 Data Transfer Sublayer PDUs(D_PDU)", "s5066-dpdu"},
|
|
|
|
/* WTAP_ENCAP_NETLINK */
|
|
{ "Linux Netlink", "netlink" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_LINUX_MONITOR */
|
|
{ "Bluetooth Linux Monitor", "bluetooth-linux-monitor" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_BREDR_BB */
|
|
{ "Bluetooth BR/EDR Baseband RF", "bluetooth-bredr-bb-rf" },
|
|
|
|
/* WTAP_ENCAP_BLUETOOTH_LE_LL_WITH_PHDR */
|
|
{ "Bluetooth Low Energy Link Layer RF", "bluetooth-le-ll-rf" },
|
|
|
|
/* WTAP_ENCAP_NSTRACE_3_0 */
|
|
{ "NetScaler Encapsulation 3.0 of Ethernet", "nstrace30" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT */
|
|
{ "Android Logcat Binary format", "logcat" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_BRIEF */
|
|
{ "Android Logcat Brief text format", "logcat_brief" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_PROCESS */
|
|
{ "Android Logcat Process text format", "logcat_process" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_TAG */
|
|
{ "Android Logcat Tag text format", "logcat_tag" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_THREAD */
|
|
{ "Android Logcat Thread text format", "logcat_thread" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_TIME */
|
|
{ "Android Logcat Time text format", "logcat_time" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_THREADTIME */
|
|
{ "Android Logcat Threadtime text format", "logcat_threadtime" },
|
|
|
|
/* WTAP_ENCAP_LOGCAT_LONG */
|
|
{ "Android Logcat Long text format", "logcat_long" },
|
|
|
|
/* WTAP_ENCAP_PKTAP */
|
|
{ "Apple PKTAP", "pktap" },
|
|
|
|
/* WTAP_ENCAP_EPON */
|
|
{ "Ethernet Passive Optical Network", "epon" },
|
|
|
|
/* WTAP_ENCAP_IPMI_TRACE */
|
|
{ "IPMI Trace Data Collection", "ipmi-trace" },
|
|
};
|
|
|
|
WS_DLL_LOCAL
|
|
gint wtap_num_encap_types = sizeof(encap_table_base) / sizeof(struct encap_type_info);
|
|
static GArray* encap_table_arr = NULL;
|
|
|
|
#define encap_table_entry(encap) \
|
|
g_array_index(encap_table_arr, struct encap_type_info, encap)
|
|
|
|
static void wtap_init_encap_types(void) {
|
|
|
|
if (encap_table_arr) return;
|
|
|
|
encap_table_arr = g_array_new(FALSE,TRUE,sizeof(struct encap_type_info));
|
|
|
|
g_array_append_vals(encap_table_arr,encap_table_base,wtap_num_encap_types);
|
|
}
|
|
|
|
int wtap_get_num_encap_types(void) {
|
|
wtap_init_encap_types();
|
|
return wtap_num_encap_types;
|
|
}
|
|
|
|
|
|
int wtap_register_encap_type(const char* name, const char* short_name) {
|
|
struct encap_type_info e;
|
|
wtap_init_encap_types();
|
|
|
|
e.name = g_strdup(name);
|
|
e.short_name = g_strdup(short_name);
|
|
|
|
g_array_append_val(encap_table_arr,e);
|
|
|
|
return wtap_num_encap_types++;
|
|
}
|
|
|
|
|
|
/* Name that should be somewhat descriptive. */
|
|
const char *
|
|
wtap_encap_string(int encap)
|
|
{
|
|
if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
|
|
return "Illegal";
|
|
else if (encap == WTAP_ENCAP_PER_PACKET)
|
|
return "Per packet";
|
|
else
|
|
return encap_table_entry(encap).name;
|
|
}
|
|
|
|
/* Name to use in, say, a command-line flag specifying the type. */
|
|
const char *
|
|
wtap_encap_short_string(int encap)
|
|
{
|
|
if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
|
|
return "illegal";
|
|
else if (encap == WTAP_ENCAP_PER_PACKET)
|
|
return "per-packet";
|
|
else
|
|
return encap_table_entry(encap).short_name;
|
|
}
|
|
|
|
/* Translate a short name to a capture file type. */
|
|
int
|
|
wtap_short_string_to_encap(const char *short_name)
|
|
{
|
|
int encap;
|
|
|
|
for (encap = 0; encap < WTAP_NUM_ENCAP_TYPES; encap++) {
|
|
if (encap_table_entry(encap).short_name != NULL &&
|
|
strcmp(short_name, encap_table_entry(encap).short_name) == 0)
|
|
return encap;
|
|
}
|
|
return -1; /* no such encapsulation type */
|
|
}
|
|
|
|
static const char *wtap_errlist[] = {
|
|
"The file isn't a plain file or pipe",
|
|
"The file is being opened for random access but is a pipe",
|
|
"The file isn't a capture file in a known format",
|
|
"File contains record data we don't support",
|
|
"That file format cannot be written to a pipe",
|
|
NULL,
|
|
"Files can't be saved in that format",
|
|
"Files from that network type can't be saved in that format",
|
|
"That file format doesn't support per-packet encapsulations",
|
|
NULL,
|
|
NULL,
|
|
"Less data was read than was expected",
|
|
"The file appears to be damaged or corrupt",
|
|
"Less data was written than was requested",
|
|
"Uncompression error: data oddly truncated",
|
|
"Uncompression error: data would overflow buffer",
|
|
"Uncompression error: bad LZ77 offset",
|
|
"The standard input cannot be opened for random access",
|
|
"That file format doesn't support compression",
|
|
NULL,
|
|
NULL,
|
|
"Uncompression error",
|
|
"Internal error",
|
|
"The packet being written is too large for that format",
|
|
NULL,
|
|
"That record type cannot be written in that format"
|
|
};
|
|
#define WTAP_ERRLIST_SIZE (sizeof wtap_errlist / sizeof wtap_errlist[0])
|
|
|
|
const char *
|
|
wtap_strerror(int err)
|
|
{
|
|
static char errbuf[128];
|
|
unsigned int wtap_errlist_index;
|
|
|
|
if (err < 0) {
|
|
wtap_errlist_index = -1 - err;
|
|
if (wtap_errlist_index >= WTAP_ERRLIST_SIZE) {
|
|
g_snprintf(errbuf, 128, "Error %d", err);
|
|
return errbuf;
|
|
}
|
|
if (wtap_errlist[wtap_errlist_index] == NULL)
|
|
return "Unknown reason";
|
|
return wtap_errlist[wtap_errlist_index];
|
|
} else
|
|
return g_strerror(err);
|
|
}
|
|
|
|
/* Close only the sequential side, freeing up memory it uses.
|
|
|
|
Note that we do *not* want to call the subtype's close function,
|
|
as it would free any per-subtype data, and that data may be
|
|
needed by the random-access side.
|
|
|
|
Instead, if the subtype has a "sequential close" function, we call it,
|
|
to free up stuff used only by the sequential side. */
|
|
void
|
|
wtap_sequential_close(wtap *wth)
|
|
{
|
|
if (wth->subtype_sequential_close != NULL)
|
|
(*wth->subtype_sequential_close)(wth);
|
|
|
|
if (wth->fh != NULL) {
|
|
file_close(wth->fh);
|
|
wth->fh = NULL;
|
|
}
|
|
|
|
if (wth->frame_buffer) {
|
|
buffer_free(wth->frame_buffer);
|
|
g_free(wth->frame_buffer);
|
|
wth->frame_buffer = NULL;
|
|
}
|
|
}
|
|
|
|
static void
|
|
g_fast_seek_item_free(gpointer data, gpointer user_data _U_)
|
|
{
|
|
g_free(data);
|
|
}
|
|
|
|
/*
|
|
* Close the file descriptors for the sequential and random streams, but
|
|
* don't discard any information about those streams. Used on Windows if
|
|
* we need to rename a file that we have open or if we need to rename on
|
|
* top of a file we have open.
|
|
*/
|
|
void
|
|
wtap_fdclose(wtap *wth)
|
|
{
|
|
if (wth->fh != NULL)
|
|
file_fdclose(wth->fh);
|
|
if (wth->random_fh != NULL)
|
|
file_fdclose(wth->random_fh);
|
|
}
|
|
|
|
void
|
|
wtap_close(wtap *wth)
|
|
{
|
|
guint i, j;
|
|
wtapng_if_descr_t *wtapng_if_descr;
|
|
wtapng_if_stats_t *if_stats;
|
|
|
|
wtap_sequential_close(wth);
|
|
|
|
if (wth->subtype_close != NULL)
|
|
(*wth->subtype_close)(wth);
|
|
|
|
if (wth->random_fh != NULL)
|
|
file_close(wth->random_fh);
|
|
|
|
if (wth->priv != NULL)
|
|
g_free(wth->priv);
|
|
|
|
if (wth->fast_seek != NULL) {
|
|
g_ptr_array_foreach(wth->fast_seek, g_fast_seek_item_free, NULL);
|
|
g_ptr_array_free(wth->fast_seek, TRUE);
|
|
}
|
|
for(i = 0; i < wth->interface_data->len; i++) {
|
|
wtapng_if_descr = &g_array_index(wth->interface_data, wtapng_if_descr_t, i);
|
|
if(wtapng_if_descr->opt_comment != NULL){
|
|
g_free(wtapng_if_descr->opt_comment);
|
|
}
|
|
if(wtapng_if_descr->if_name != NULL){
|
|
g_free(wtapng_if_descr->if_name);
|
|
}
|
|
if(wtapng_if_descr->if_description != NULL){
|
|
g_free(wtapng_if_descr->if_description);
|
|
}
|
|
if(wtapng_if_descr->if_filter_str != NULL){
|
|
g_free(wtapng_if_descr->if_filter_str);
|
|
}
|
|
if(wtapng_if_descr->if_filter_bpf_bytes != NULL){
|
|
g_free(wtapng_if_descr->if_filter_bpf_bytes);
|
|
}
|
|
if(wtapng_if_descr->if_os != NULL){
|
|
g_free(wtapng_if_descr->if_os);
|
|
}
|
|
for(j = 0; j < wtapng_if_descr->num_stat_entries; j++) {
|
|
if_stats = &g_array_index(wtapng_if_descr->interface_statistics, wtapng_if_stats_t, j);
|
|
if(if_stats->opt_comment != NULL){
|
|
g_free(if_stats->opt_comment);
|
|
}
|
|
}
|
|
if(wtapng_if_descr->num_stat_entries != 0){
|
|
g_array_free(wtapng_if_descr->interface_statistics, TRUE);
|
|
}
|
|
}
|
|
g_array_free(wth->interface_data, TRUE);
|
|
g_free(wth);
|
|
}
|
|
|
|
void
|
|
wtap_cleareof(wtap *wth) {
|
|
/* Reset EOF */
|
|
file_clearerr(wth->fh);
|
|
}
|
|
|
|
void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4) {
|
|
if (wth)
|
|
wth->add_new_ipv4 = add_new_ipv4;
|
|
}
|
|
|
|
void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6) {
|
|
if (wth)
|
|
wth->add_new_ipv6 = add_new_ipv6;
|
|
}
|
|
|
|
gboolean
|
|
wtap_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
|
|
{
|
|
/*
|
|
* Set the packet encapsulation to the file's encapsulation
|
|
* value; if that's not WTAP_ENCAP_PER_PACKET, it's the
|
|
* right answer (and means that the read routine for this
|
|
* capture file type doesn't have to set it), and if it
|
|
* *is* WTAP_ENCAP_PER_PACKET, the caller needs to set it
|
|
* anyway.
|
|
*/
|
|
wth->phdr.pkt_encap = wth->file_encap;
|
|
|
|
if (!wth->subtype_read(wth, err, err_info, data_offset)) {
|
|
/*
|
|
* If we didn't get an error indication, we read
|
|
* the last packet. See if there's any deferred
|
|
* error, as might, for example, occur if we're
|
|
* reading a compressed file, and we got an error
|
|
* reading compressed data from the file, but
|
|
* got enough compressed data to decompress the
|
|
* last packet of the file.
|
|
*/
|
|
if (*err == 0)
|
|
*err = file_error(wth->fh, err_info);
|
|
return FALSE; /* failure */
|
|
}
|
|
|
|
/*
|
|
* It makes no sense for the captured data length to be bigger
|
|
* than the actual data length.
|
|
*/
|
|
if (wth->phdr.caplen > wth->phdr.len)
|
|
wth->phdr.caplen = wth->phdr.len;
|
|
|
|
/*
|
|
* Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
|
|
* probably means the file has that encapsulation type
|
|
* but the read routine didn't set this packet's
|
|
* encapsulation type.
|
|
*/
|
|
g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET);
|
|
|
|
return TRUE; /* success */
|
|
}
|
|
|
|
/*
|
|
* Read packet data into a Buffer, growing the buffer as necessary.
|
|
*
|
|
* This returns an error on a short read, even if the short read hit
|
|
* the EOF immediately. (The assumption is that each packet has a
|
|
* header followed by raw packet data, and that we've already read the
|
|
* header, so if we get an EOF trying to read the packet data, the file
|
|
* has been cut short, even if the read didn't read any data at all.)
|
|
*/
|
|
gboolean
|
|
wtap_read_packet_bytes(FILE_T fh, Buffer *buf, guint length, int *err,
|
|
gchar **err_info)
|
|
{
|
|
int bytes_read;
|
|
|
|
buffer_assure_space(buf, length);
|
|
errno = WTAP_ERR_CANT_READ;
|
|
bytes_read = file_read(buffer_start_ptr(buf), length, fh);
|
|
|
|
if (bytes_read < 0 || (guint)bytes_read != length) {
|
|
*err = file_error(fh, err_info);
|
|
if (*err == 0)
|
|
*err = WTAP_ERR_SHORT_READ;
|
|
return FALSE;
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
/*
|
|
* Return an approximation of the amount of data we've read sequentially
|
|
* from the file so far. (gint64, in case that's 64 bits.)
|
|
*/
|
|
gint64
|
|
wtap_read_so_far(wtap *wth)
|
|
{
|
|
return file_tell_raw(wth->fh);
|
|
}
|
|
|
|
struct wtap_pkthdr *
|
|
wtap_phdr(wtap *wth)
|
|
{
|
|
return &wth->phdr;
|
|
}
|
|
|
|
guint8 *
|
|
wtap_buf_ptr(wtap *wth)
|
|
{
|
|
return buffer_start_ptr(wth->frame_buffer);
|
|
}
|
|
|
|
gboolean
|
|
wtap_seek_read(wtap *wth, gint64 seek_off,
|
|
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
|
|
{
|
|
if (!wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info))
|
|
return FALSE;
|
|
|
|
/*
|
|
* It makes no sense for the captured data length to be bigger
|
|
* than the actual data length.
|
|
*/
|
|
if (phdr->caplen > phdr->len)
|
|
phdr->caplen = phdr->len;
|
|
|
|
/*
|
|
* Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
|
|
* probably means the file has that encapsulation type
|
|
* but the read routine didn't set this packet's
|
|
* encapsulation type.
|
|
*/
|
|
g_assert(phdr->pkt_encap != WTAP_ENCAP_PER_PACKET);
|
|
|
|
return TRUE;
|
|
}
|