2003-10-31 00:43:21 +00:00
|
|
|
/***************************************************************************
|
2011-05-03 05:26:10 +00:00
|
|
|
network_instruments.c - description
|
2003-10-31 00:43:21 +00:00
|
|
|
-------------------
|
|
|
|
begin : Wed Oct 29 2003
|
|
|
|
copyright : (C) 2003 by root
|
|
|
|
email : scotte[AT}netinst.com
|
|
|
|
***************************************************************************/
|
|
|
|
|
|
|
|
/***************************************************************************
|
|
|
|
* *
|
2018-03-08 10:18:49 +00:00
|
|
|
* SPDX-License-Identifier: GPL-2.0-or-later *
|
2003-10-31 00:43:21 +00:00
|
|
|
* *
|
|
|
|
***************************************************************************/
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2003-10-31 00:43:21 +00:00
|
|
|
#include "config.h"
|
|
|
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <errno.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include "wtap-int.h"
|
|
|
|
#include "file_wrappers.h"
|
|
|
|
#include "network_instruments.h"
|
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
static const char network_instruments_magic[] = {"ObserverPktBufferVersion=15.00"};
|
2003-10-31 00:43:21 +00:00
|
|
|
static const int true_magic_length = 17;
|
|
|
|
|
|
|
|
static const guint32 observer_packet_magic = 0x88888888;
|
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/*
|
|
|
|
* This structure is used to keep state when writing files. An instance is
|
|
|
|
* allocated for each file, and its address is stored in the wtap_dumper.priv
|
|
|
|
* pointer field.
|
|
|
|
*/
|
|
|
|
typedef struct {
|
|
|
|
guint64 packet_count;
|
|
|
|
guint8 network_type;
|
2011-05-03 05:28:39 +00:00
|
|
|
guint32 time_format;
|
2011-05-03 05:26:10 +00:00
|
|
|
} observer_dump_private_state;
|
2003-11-06 22:45:28 +00:00
|
|
|
|
2003-11-01 03:38:10 +00:00
|
|
|
/*
|
2011-05-03 05:26:10 +00:00
|
|
|
* Some time offsets are calculated in advance here, when the first Observer
|
|
|
|
* file is opened for reading or writing, and are then used to adjust frame
|
|
|
|
* timestamps as they are read or written.
|
2003-11-01 03:38:10 +00:00
|
|
|
*
|
2011-05-03 05:26:10 +00:00
|
|
|
* The Wiretap API expects timestamps in nanoseconds relative to
|
|
|
|
* January 1, 1970, 00:00:00 GMT (the Wiretap epoch).
|
2003-11-01 03:38:10 +00:00
|
|
|
*
|
2011-05-03 05:26:10 +00:00
|
|
|
* Observer versions before 13.10 encode frame timestamps in nanoseconds
|
|
|
|
* relative to January 1, 2000, 00:00:00 local time (the Observer epoch).
|
|
|
|
* Versions 13.10 and later switch over to GMT encoding. Which encoding was used
|
|
|
|
* when saving the file is identified via the time format TLV following
|
|
|
|
* the file header.
|
|
|
|
*
|
|
|
|
* Unfortunately, even though Observer versions before 13.10 saved in local
|
|
|
|
* time, they didn't include the timezone from which the frames were captured,
|
|
|
|
* so converting to GMT correctly from all timezones is impossible. So an
|
|
|
|
* assumption is made that the file is being read from within the same timezone
|
|
|
|
* that it was written.
|
|
|
|
*
|
|
|
|
* All code herein is normalized to versions 13.10 and later, special casing for
|
|
|
|
* versions earlier. In other words, timestamps are worked with as if
|
|
|
|
* they are GMT-encoded, and adjustments from local time are made only if
|
|
|
|
* the source file warrants it.
|
2011-10-12 18:04:58 +00:00
|
|
|
*
|
2011-05-03 05:26:10 +00:00
|
|
|
* All destination files are saved in GMT format.
|
2003-11-01 03:38:10 +00:00
|
|
|
*/
|
2011-05-03 05:26:10 +00:00
|
|
|
static const time_t ansi_to_observer_epoch_offset = 946684800;
|
|
|
|
static time_t gmt_to_localtime_offset = (time_t) -1;
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2017-04-17 18:02:49 +00:00
|
|
|
static const char *init_gmt_to_localtime_offset(void)
|
2003-10-31 00:43:21 +00:00
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
if (gmt_to_localtime_offset == (time_t) -1) {
|
2011-05-03 05:26:10 +00:00
|
|
|
time_t ansi_epoch_plus_one_day = 86400;
|
2017-04-17 18:02:49 +00:00
|
|
|
struct tm *tm;
|
2011-05-03 05:26:10 +00:00
|
|
|
struct tm gmt_tm;
|
|
|
|
struct tm local_tm;
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/*
|
|
|
|
* Compute the local time zone offset as the number of seconds west
|
|
|
|
* of GMT. There's no obvious cross-platform API for querying this
|
|
|
|
* directly. As a workaround, GMT and local tm structures are populated
|
|
|
|
* relative to the ANSI time_t epoch (plus one day to ensure that
|
|
|
|
* local time stays after 1970/1/1 00:00:00). They are then converted
|
|
|
|
* back to time_t as if they were both local times, resulting in the
|
|
|
|
* time zone offset being the difference between them.
|
|
|
|
*/
|
2017-04-17 18:02:49 +00:00
|
|
|
tm = gmtime(&ansi_epoch_plus_one_day);
|
|
|
|
if (tm == NULL)
|
|
|
|
return "gmtime(one day past the Epoch) fails (this \"shouldn't happen\")";
|
|
|
|
gmt_tm = *tm;
|
2017-04-18 05:31:53 +00:00
|
|
|
tm = localtime(&ansi_epoch_plus_one_day);
|
2017-04-17 18:02:49 +00:00
|
|
|
if (tm == NULL)
|
|
|
|
return "localtime(one day past the Epoch) fails (this \"shouldn't happen\")";
|
|
|
|
local_tm = *tm;
|
2011-05-03 05:26:10 +00:00
|
|
|
local_tm.tm_isdst = 0;
|
|
|
|
gmt_to_localtime_offset = mktime(&gmt_tm) - mktime(&local_tm);
|
|
|
|
}
|
2017-04-17 18:02:49 +00:00
|
|
|
return NULL;
|
2003-11-06 22:45:28 +00:00
|
|
|
}
|
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
|
2006-11-05 22:46:44 +00:00
|
|
|
gint64 *data_offset);
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean observer_seek_read(wtap *wth, gint64 seek_off,
|
2018-02-09 00:19:12 +00:00
|
|
|
wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
|
2015-06-20 22:57:57 +00:00
|
|
|
static int read_packet_header(wtap *wth, FILE_T fh, union wtap_pseudo_header *pseudo_header,
|
2012-07-18 22:10:34 +00:00
|
|
|
packet_entry_header *packet_header, int *err, gchar **err_info);
|
2014-05-09 05:18:49 +00:00
|
|
|
static gboolean process_packet_header(wtap *wth,
|
2018-02-09 00:19:12 +00:00
|
|
|
packet_entry_header *packet_header, wtap_rec *rec, int *err,
|
2013-06-05 00:36:57 +00:00
|
|
|
gchar **err_info);
|
2014-10-07 19:49:14 +00:00
|
|
|
static int read_packet_data(FILE_T fh, int offset_to_frame, int current_offset_from_packet_header,
|
|
|
|
Buffer *buf, int length, int *err, char **err_info);
|
2014-05-09 05:18:49 +00:00
|
|
|
static gboolean skip_to_next_packet(wtap *wth, int offset_to_next_packet,
|
2011-05-03 05:28:39 +00:00
|
|
|
int current_offset_from_packet_header, int *err, char **err_info);
|
2018-02-09 00:19:12 +00:00
|
|
|
static gboolean observer_dump(wtap_dumper *wdh, const wtap_rec *rec,
|
2014-12-18 00:02:50 +00:00
|
|
|
const guint8 *pd, int *err, gchar **err_info);
|
2011-05-03 05:26:10 +00:00
|
|
|
static gint observer_to_wtap_encap(int observer_encap);
|
|
|
|
static gint wtap_to_observer_encap(int wtap_encap);
|
2003-11-06 22:45:28 +00:00
|
|
|
|
2014-10-09 23:44:15 +00:00
|
|
|
wtap_open_return_val network_instruments_open(wtap *wth, int *err, gchar **err_info)
|
2003-11-06 22:45:28 +00:00
|
|
|
{
|
2018-11-14 05:27:38 +00:00
|
|
|
guint offset;
|
2011-05-03 05:28:39 +00:00
|
|
|
capture_file_header file_header;
|
2018-11-14 05:27:38 +00:00
|
|
|
guint header_offset;
|
2011-05-03 05:28:39 +00:00
|
|
|
guint i;
|
|
|
|
tlv_header tlvh;
|
2018-11-14 05:27:38 +00:00
|
|
|
guint seek_increment;
|
2011-05-03 05:28:39 +00:00
|
|
|
packet_entry_header packet_header;
|
|
|
|
observer_dump_private_state * private_state = NULL;
|
|
|
|
|
|
|
|
offset = 0;
|
|
|
|
|
|
|
|
/* read in the buffer file header */
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes(wth->fh, &file_header, sizeof file_header,
|
2014-10-07 07:39:54 +00:00
|
|
|
err, err_info)) {
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (*err != WTAP_ERR_SHORT_READ)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
return WTAP_OPEN_NOT_MINE;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
2018-11-14 05:27:38 +00:00
|
|
|
offset += (guint)sizeof file_header;
|
2011-05-03 05:28:39 +00:00
|
|
|
CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(file_header);
|
|
|
|
|
|
|
|
/* check if version info is present */
|
|
|
|
if (memcmp(file_header.observer_version, network_instruments_magic, true_magic_length)!=0) {
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_NOT_MINE;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
2003-10-31 00:43:21 +00:00
|
|
|
|
2018-11-14 05:27:38 +00:00
|
|
|
/* get the location of the first packet */
|
|
|
|
/* v15 and newer uses high byte offset, in previous versions it will be 0 */
|
|
|
|
header_offset = file_header.offset_to_first_packet + ((guint)(file_header.offset_to_first_packet_high_byte)<<16);
|
|
|
|
|
|
|
|
if (offset > header_offset) {
|
2018-11-14 05:29:07 +00:00
|
|
|
/*
|
|
|
|
* The packet data begins before the file header ends.
|
|
|
|
*/
|
2018-11-14 05:27:38 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("Observer: The first packet begins in the middle of the file header");
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
}
|
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* initialize the private state */
|
|
|
|
private_state = (observer_dump_private_state *) g_malloc(sizeof(observer_dump_private_state));
|
2011-05-03 05:28:39 +00:00
|
|
|
private_state->time_format = TIME_INFO_LOCAL;
|
2014-05-09 05:18:49 +00:00
|
|
|
wth->priv = (void *) private_state;
|
2011-05-03 05:28:39 +00:00
|
|
|
|
|
|
|
/* process extra information */
|
|
|
|
for (i = 0; i < file_header.number_of_information_elements; i++) {
|
2018-11-14 05:27:38 +00:00
|
|
|
guint tlv_data_length;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Make sure reading the TLV header won't put us in the middle
|
|
|
|
* of the packet data.
|
|
|
|
*/
|
|
|
|
if (offset + (guint)sizeof tlvh > header_offset) {
|
|
|
|
/*
|
|
|
|
* We're at or past the point where the packet data begins,
|
|
|
|
* but we have the IE header to read.
|
|
|
|
*/
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("Observer: TLVs run into the first packet data");
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
}
|
2011-05-03 05:28:39 +00:00
|
|
|
|
|
|
|
/* read the TLV header */
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes(wth->fh, &tlvh, sizeof tlvh, err, err_info))
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2018-11-14 05:27:38 +00:00
|
|
|
offset += (guint)sizeof tlvh;
|
2011-05-03 05:28:39 +00:00
|
|
|
TLV_HEADER_FROM_LE_IN_PLACE(tlvh);
|
|
|
|
|
|
|
|
if (tlvh.length < sizeof tlvh) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: bad record (TLV length %u < %lu)",
|
|
|
|
tlvh.length, (unsigned long)sizeof tlvh);
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
|
|
|
|
2018-11-14 05:27:38 +00:00
|
|
|
tlv_data_length = tlvh.length - (guint)sizeof tlvh;
|
|
|
|
/*
|
|
|
|
* Make sure reading the TLV data won't put us in the middle
|
|
|
|
* of the packet data.
|
|
|
|
*/
|
|
|
|
if (offset + tlv_data_length > header_offset) {
|
|
|
|
/*
|
|
|
|
* We're at or past the point where the packet data begins,
|
|
|
|
* but we have the IE data to read.
|
|
|
|
*/
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("Observer: TLVs run into the first packet data");
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* process (or skip over) the current TLV */
|
|
|
|
switch (tlvh.type) {
|
|
|
|
case INFORMATION_TYPE_TIME_INFO:
|
2018-11-14 05:27:38 +00:00
|
|
|
if (tlvh.length != sizeof tlvh + sizeof private_state->time_format) {
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("Observer: bad record (time information TLV length %u != %lu)",
|
|
|
|
tlvh.length,
|
|
|
|
(unsigned long)(sizeof tlvh + sizeof private_state->time_format));
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
}
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes(wth->fh, &private_state->time_format,
|
2014-10-07 07:39:54 +00:00
|
|
|
sizeof private_state->time_format,
|
|
|
|
err, err_info))
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
private_state->time_format = GUINT32_FROM_LE(private_state->time_format);
|
2018-11-14 05:27:38 +00:00
|
|
|
offset += (guint)sizeof private_state->time_format;
|
2011-05-03 05:28:39 +00:00
|
|
|
break;
|
|
|
|
default:
|
2018-11-14 05:27:38 +00:00
|
|
|
tlv_data_length = tlvh.length - (guint)sizeof tlvh;
|
|
|
|
if (tlv_data_length > 0) {
|
|
|
|
if (!wtap_read_bytes(wth->fh, NULL, tlv_data_length, err, err_info))
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
2018-11-14 05:27:38 +00:00
|
|
|
offset += tlv_data_length;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* get to the first packet */
|
|
|
|
seek_increment = header_offset - offset;
|
2018-11-14 05:27:38 +00:00
|
|
|
if (seek_increment != 0) {
|
2016-09-29 04:35:12 +00:00
|
|
|
if (!wtap_read_bytes(wth->fh, NULL, seek_increment, err, err_info))
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
|
|
|
|
2018-11-14 05:27:38 +00:00
|
|
|
/*
|
|
|
|
* We assume that all packets in a file have the same network type,
|
|
|
|
* whether they're data or expert information packets, and thus
|
|
|
|
* we can attempt to determine the network type by reading the
|
|
|
|
* first packet.
|
|
|
|
*
|
|
|
|
* If that's *not* the case, we need to use WTAP_ENCAP_PER_PACKET.
|
|
|
|
*
|
|
|
|
* Read the packet header. Don't assume there *is* a packet;
|
|
|
|
* if there isn't, report that as a bad file. (If we use
|
|
|
|
* WTAP_ENCAP_PER_PACKET, we don't need to handle that case, as
|
|
|
|
* we don't need to read the first packet.
|
|
|
|
*/
|
|
|
|
if (!wtap_read_bytes_or_eof(wth->fh, &packet_header, sizeof packet_header,
|
|
|
|
err, err_info)) {
|
|
|
|
if (*err == 0) {
|
|
|
|
/*
|
|
|
|
* EOF, so there *are* no records.
|
|
|
|
*/
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("Observer: No records in the file, so we can't determine the link-layer type");
|
|
|
|
}
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2018-11-14 05:27:38 +00:00
|
|
|
}
|
2011-05-03 05:28:39 +00:00
|
|
|
PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(packet_header);
|
|
|
|
|
|
|
|
/* check the packet's magic number */
|
|
|
|
if (packet_header.packet_magic != observer_packet_magic) {
|
2014-12-17 06:22:29 +00:00
|
|
|
*err = WTAP_ERR_UNSUPPORTED;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: unsupported packet version %ul", packet_header.packet_magic);
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* check the data link type */
|
|
|
|
if (observer_to_wtap_encap(packet_header.network_type) == WTAP_ENCAP_UNKNOWN) {
|
2014-12-17 06:22:29 +00:00
|
|
|
*err = WTAP_ERR_UNSUPPORTED;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: network type %u unknown or unsupported", packet_header.network_type);
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
2014-05-09 05:18:49 +00:00
|
|
|
wth->file_encap = observer_to_wtap_encap(packet_header.network_type);
|
2011-05-03 05:28:39 +00:00
|
|
|
|
|
|
|
/* set up the rest of the capture parameters */
|
2011-05-03 05:26:10 +00:00
|
|
|
private_state->packet_count = 0;
|
2014-05-09 05:18:49 +00:00
|
|
|
private_state->network_type = wtap_to_observer_encap(wth->file_encap);
|
|
|
|
wth->subtype_read = observer_read;
|
|
|
|
wth->subtype_seek_read = observer_seek_read;
|
|
|
|
wth->subtype_close = NULL;
|
|
|
|
wth->subtype_sequential_close = NULL;
|
|
|
|
wth->snapshot_length = 0; /* not available in header */
|
2014-09-28 18:37:06 +00:00
|
|
|
wth->file_tsprec = WTAP_TSPREC_NSEC;
|
2014-05-09 05:18:49 +00:00
|
|
|
wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_NETWORK_INSTRUMENTS;
|
2011-05-03 05:28:39 +00:00
|
|
|
|
|
|
|
/* reset the pointer to the first packet */
|
2014-05-09 05:18:49 +00:00
|
|
|
if (file_seek(wth->fh, header_offset, SEEK_SET, err) == -1)
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_ERROR;
|
2011-05-03 05:28:39 +00:00
|
|
|
|
2017-04-17 18:02:49 +00:00
|
|
|
if (init_gmt_to_localtime_offset() != NULL) {
|
|
|
|
*err = WTAP_ERR_INTERNAL;
|
|
|
|
/*
|
|
|
|
* XXX - we should return the error string, so the caller
|
|
|
|
* can report the details of the internal error, but that
|
|
|
|
* would require plugin file readers to do so for internal
|
|
|
|
* errors as well, which could break binary compatibility;
|
|
|
|
* we'll do that in the next release.
|
|
|
|
*/
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
}
|
2011-05-03 05:28:39 +00:00
|
|
|
|
2014-10-09 23:44:15 +00:00
|
|
|
return WTAP_OPEN_MINE;
|
2003-10-31 00:43:21 +00:00
|
|
|
}
|
|
|
|
|
2010-11-05 07:14:21 +00:00
|
|
|
/* Reads the next packet. */
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
|
2006-11-05 22:46:44 +00:00
|
|
|
gint64 *data_offset)
|
2003-10-31 00:43:21 +00:00
|
|
|
{
|
2012-05-04 16:56:18 +00:00
|
|
|
int header_bytes_consumed;
|
|
|
|
int data_bytes_consumed;
|
2011-05-03 05:28:39 +00:00
|
|
|
packet_entry_header packet_header;
|
2003-10-31 00:43:21 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* skip records other than data records */
|
|
|
|
for (;;) {
|
2014-05-09 05:18:49 +00:00
|
|
|
*data_offset = file_tell(wth->fh);
|
2006-04-14 10:22:29 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* process the packet header, including TLVs */
|
2018-02-09 00:19:12 +00:00
|
|
|
header_bytes_consumed = read_packet_header(wth, wth->fh, &wth->rec.rec_header.packet_header.pseudo_header, &packet_header, err,
|
2012-07-18 22:10:34 +00:00
|
|
|
err_info);
|
2012-05-04 16:56:18 +00:00
|
|
|
if (header_bytes_consumed <= 0)
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE; /* EOF or error */
|
2006-04-14 10:22:29 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
if (packet_header.packet_type == PACKET_TYPE_DATA_PACKET)
|
|
|
|
break;
|
2006-04-14 10:22:29 +00:00
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* skip to next packet */
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!skip_to_next_packet(wth, packet_header.offset_to_next_packet,
|
2012-05-04 16:56:18 +00:00
|
|
|
header_bytes_consumed, err, err_info)) {
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE; /* EOF or error */
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
|
|
|
|
2018-02-09 00:19:12 +00:00
|
|
|
if (!process_packet_header(wth, &packet_header, &wth->rec, err, err_info))
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2010-11-05 07:14:21 +00:00
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* read the frame data */
|
2014-05-09 05:18:49 +00:00
|
|
|
data_bytes_consumed = read_packet_data(wth->fh, packet_header.offset_to_frame,
|
2018-02-09 00:19:12 +00:00
|
|
|
header_bytes_consumed, wth->rec_data,
|
|
|
|
wth->rec.rec_header.packet_header.caplen, err, err_info);
|
2012-05-04 16:56:18 +00:00
|
|
|
if (data_bytes_consumed < 0) {
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* skip over any extra bytes following the frame data */
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!skip_to_next_packet(wth, packet_header.offset_to_next_packet,
|
2012-05-04 16:56:18 +00:00
|
|
|
header_bytes_consumed + data_bytes_consumed, err, err_info)) {
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
return TRUE;
|
2003-10-31 00:43:21 +00:00
|
|
|
}
|
|
|
|
|
2010-11-05 07:14:21 +00:00
|
|
|
/* Reads a packet at an offset. */
|
2014-05-23 10:50:02 +00:00
|
|
|
static gboolean observer_seek_read(wtap *wth, gint64 seek_off,
|
2018-02-09 00:19:12 +00:00
|
|
|
wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
|
2003-10-31 00:43:21 +00:00
|
|
|
{
|
2018-02-09 00:19:12 +00:00
|
|
|
union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
|
2011-05-03 05:28:39 +00:00
|
|
|
packet_entry_header packet_header;
|
|
|
|
int offset;
|
2012-07-18 22:10:34 +00:00
|
|
|
int data_bytes_consumed;
|
2003-10-31 00:43:21 +00:00
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2003-10-31 00:43:21 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* process the packet header, including TLVs */
|
2015-06-20 22:57:57 +00:00
|
|
|
offset = read_packet_header(wth, wth->random_fh, pseudo_header, &packet_header, err,
|
2012-07-18 22:10:34 +00:00
|
|
|
err_info);
|
2011-05-03 05:28:39 +00:00
|
|
|
if (offset <= 0)
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE; /* EOF or error */
|
2006-04-16 00:52:36 +00:00
|
|
|
|
2018-02-09 00:19:12 +00:00
|
|
|
if (!process_packet_header(wth, &packet_header, rec, err, err_info))
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2006-04-16 00:52:36 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* read the frame data */
|
2014-05-09 05:18:49 +00:00
|
|
|
data_bytes_consumed = read_packet_data(wth->random_fh, packet_header.offset_to_frame,
|
2018-02-09 00:19:12 +00:00
|
|
|
offset, buf, rec->rec_header.packet_header.caplen, err, err_info);
|
2012-07-15 16:37:25 +00:00
|
|
|
if (data_bytes_consumed < 0) {
|
2014-05-23 10:50:02 +00:00
|
|
|
return FALSE;
|
2012-07-15 16:37:25 +00:00
|
|
|
}
|
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
return TRUE;
|
2006-04-16 00:52:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2015-06-20 22:57:57 +00:00
|
|
|
read_packet_header(wtap *wth, FILE_T fh, union wtap_pseudo_header *pseudo_header,
|
2012-07-18 22:10:34 +00:00
|
|
|
packet_entry_header *packet_header, int *err, gchar **err_info)
|
2006-04-16 00:52:36 +00:00
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
int offset;
|
|
|
|
guint i;
|
|
|
|
tlv_header tlvh;
|
|
|
|
int seek_increment;
|
2012-02-12 23:50:13 +00:00
|
|
|
tlv_wireless_info wireless_header;
|
2011-05-03 05:28:39 +00:00
|
|
|
|
|
|
|
offset = 0;
|
|
|
|
|
|
|
|
/* pull off the packet header */
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes_or_eof(fh, packet_header, sizeof *packet_header,
|
2014-10-07 07:39:54 +00:00
|
|
|
err, err_info)) {
|
2014-10-07 19:49:14 +00:00
|
|
|
if (*err != 0)
|
|
|
|
return -1;
|
|
|
|
return 0; /* EOF */
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
offset += (int)sizeof *packet_header;
|
2011-05-03 05:26:10 +00:00
|
|
|
PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(*packet_header);
|
2010-11-05 07:14:21 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* check the packet's magic number */
|
|
|
|
if (packet_header->packet_magic != observer_packet_magic) {
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Some files are zero-padded at the end. There is no warning of this
|
|
|
|
* in the previous packet header information, such as setting
|
|
|
|
* offset_to_next_packet to zero. So detect this situation by treating
|
|
|
|
* an all-zero header as a sentinel. Return EOF when it is encountered,
|
|
|
|
* rather than treat it as a bad record.
|
|
|
|
*/
|
|
|
|
for (i = 0; i < sizeof *packet_header; i++) {
|
|
|
|
if (((guint8*) packet_header)[i] != 0)
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (i == sizeof *packet_header) {
|
|
|
|
*err = 0;
|
|
|
|
return 0; /* EOF */
|
|
|
|
}
|
|
|
|
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: bad record: Invalid magic number 0x%08x",
|
2011-10-12 18:04:58 +00:00
|
|
|
packet_header->packet_magic);
|
2011-05-03 05:28:39 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2015-06-20 22:57:57 +00:00
|
|
|
/* initialize the pseudo header */
|
|
|
|
switch (wth->file_encap) {
|
|
|
|
case WTAP_ENCAP_ETHERNET:
|
|
|
|
/* There is no FCS in the frame */
|
|
|
|
pseudo_header->eth.fcs_len = 0;
|
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
|
2015-12-09 22:26:46 +00:00
|
|
|
memset(&pseudo_header->ieee_802_11, 0, sizeof(pseudo_header->ieee_802_11));
|
2015-06-20 22:57:57 +00:00
|
|
|
pseudo_header->ieee_802_11.fcs_len = 0;
|
|
|
|
pseudo_header->ieee_802_11.decrypted = FALSE;
|
|
|
|
pseudo_header->ieee_802_11.datapad = FALSE;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
|
2015-06-20 22:57:57 +00:00
|
|
|
/* Updated below */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* process extra information */
|
|
|
|
for (i = 0; i < packet_header->number_of_information_elements; i++) {
|
|
|
|
/* read the TLV header */
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes(fh, &tlvh, sizeof tlvh, err, err_info))
|
2011-05-03 05:28:39 +00:00
|
|
|
return -1;
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
offset += (int)sizeof tlvh;
|
2011-05-03 05:26:10 +00:00
|
|
|
TLV_HEADER_FROM_LE_IN_PLACE(tlvh);
|
2005-06-30 02:31:15 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
if (tlvh.length < sizeof tlvh) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: bad record (TLV length %u < %lu)",
|
|
|
|
tlvh.length, (unsigned long)sizeof tlvh);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2012-01-28 17:10:50 +00:00
|
|
|
/* process (or skip over) the current TLV */
|
|
|
|
switch (tlvh.type) {
|
|
|
|
case INFORMATION_TYPE_WIRELESS:
|
2016-09-29 04:35:12 +00:00
|
|
|
/* XXX - what if tlvh.length != sizeof wireless_header? */
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
if (!wtap_read_bytes(fh, &wireless_header, sizeof wireless_header,
|
2014-10-07 07:39:54 +00:00
|
|
|
err, err_info))
|
2011-05-03 05:28:39 +00:00
|
|
|
return -1;
|
2012-07-18 22:10:34 +00:00
|
|
|
/* set decryption status */
|
2015-06-22 22:04:28 +00:00
|
|
|
/* XXX - what other bits are there in conditions? */
|
2012-07-18 22:10:34 +00:00
|
|
|
pseudo_header->ieee_802_11.decrypted = (wireless_header.conditions & WIRELESS_WEP_SUCCESS) != 0;
|
2015-12-09 22:26:46 +00:00
|
|
|
pseudo_header->ieee_802_11.has_channel = TRUE;
|
2012-02-12 23:50:13 +00:00
|
|
|
pseudo_header->ieee_802_11.channel = wireless_header.frequency;
|
2015-12-09 22:26:46 +00:00
|
|
|
pseudo_header->ieee_802_11.has_data_rate = TRUE;
|
2012-02-12 23:50:13 +00:00
|
|
|
pseudo_header->ieee_802_11.data_rate = wireless_header.rate;
|
2015-12-09 22:26:46 +00:00
|
|
|
pseudo_header->ieee_802_11.has_signal_percent = TRUE;
|
2014-10-29 23:03:08 +00:00
|
|
|
pseudo_header->ieee_802_11.signal_percent = wireless_header.strengthPercent;
|
Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.
Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.
Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.
Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:00:57 +00:00
|
|
|
offset += (int)sizeof wireless_header;
|
2012-01-28 17:10:50 +00:00
|
|
|
break;
|
|
|
|
default:
|
2012-02-12 23:50:13 +00:00
|
|
|
/* skip the TLV data */
|
|
|
|
seek_increment = tlvh.length - (int)sizeof tlvh;
|
|
|
|
if (seek_increment > 0) {
|
2016-09-29 04:35:12 +00:00
|
|
|
if (!wtap_read_bytes(fh, NULL, seek_increment, err, err_info))
|
2012-02-12 23:50:13 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
offset += seek_increment;
|
|
|
|
}
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return offset;
|
2006-04-16 00:52:36 +00:00
|
|
|
}
|
|
|
|
|
2013-06-05 00:36:57 +00:00
|
|
|
static gboolean
|
2014-05-09 05:18:49 +00:00
|
|
|
process_packet_header(wtap *wth, packet_entry_header *packet_header,
|
2018-02-09 00:19:12 +00:00
|
|
|
wtap_rec *rec, int *err, gchar **err_info)
|
2013-06-05 00:36:57 +00:00
|
|
|
{
|
2018-02-09 00:19:12 +00:00
|
|
|
/* set the wiretap record metadata fields */
|
|
|
|
rec->rec_type = REC_TYPE_PACKET;
|
|
|
|
rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
|
|
|
|
rec->rec_header.packet_header.pkt_encap = observer_to_wtap_encap(packet_header->network_type);
|
2014-05-09 05:18:49 +00:00
|
|
|
if(wth->file_encap == WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS) {
|
2018-02-09 00:19:12 +00:00
|
|
|
rec->rec_header.packet_header.len = packet_header->network_size;
|
|
|
|
rec->rec_header.packet_header.caplen = packet_header->captured_size;
|
2013-06-05 00:36:57 +00:00
|
|
|
} else {
|
2013-06-05 08:12:06 +00:00
|
|
|
/*
|
|
|
|
* XXX - what are those 4 bytes?
|
|
|
|
*
|
|
|
|
* The comment in the code said "neglect frame markers for wiretap",
|
|
|
|
* but in the captures I've seen, there's no actual data corresponding
|
|
|
|
* to them that might be a "frame marker".
|
|
|
|
*
|
|
|
|
* Instead, the packets had a network_size 4 bytes larger than the
|
|
|
|
* captured_size; does the network_size include the CRC, even
|
|
|
|
* though it's not included in a capture? If so, most other
|
|
|
|
* network analyzers that have a "network size" and a "captured
|
|
|
|
* size" don't include the CRC in the "network size" if they
|
|
|
|
* don't include the CRC in a full-length captured packet; the
|
|
|
|
* "captured size" is less than the "network size" only if a
|
|
|
|
* user-specified "snapshot length" caused the packet to be
|
|
|
|
* sliced at a particular point.
|
|
|
|
*
|
|
|
|
* That's the model that wiretap and Wireshark/TShark use, so
|
|
|
|
* we implement that model here.
|
|
|
|
*/
|
|
|
|
if (packet_header->network_size < 4) {
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("Observer: bad record: Packet length %u < 4",
|
|
|
|
packet_header->network_size);
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2018-02-09 00:19:12 +00:00
|
|
|
rec->rec_header.packet_header.len = packet_header->network_size - 4;
|
|
|
|
rec->rec_header.packet_header.caplen = MIN(packet_header->captured_size, rec->rec_header.packet_header.len);
|
2013-06-05 00:36:57 +00:00
|
|
|
}
|
2016-04-30 02:04:17 +00:00
|
|
|
/*
|
|
|
|
* The maximum value of packet_header->captured_size is 65535, which
|
Allow bigger snapshot lengths for D-Bus captures.
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except
for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for
them, because that's the largest possible D-Bus message size. See
https://bugs.freedesktop.org/show_bug.cgi?id=100220
for an example of the problems caused by limiting the snapshot length to
256KB for D-Bus.
Have a snapshot length of 0 in a capture_file structure mean "there is
no snapshot length for the file"; we don't need the has_snap field in
that case, a value of 0 mean "no, we don't have a snapshot length".
In dumpcap, start out with a pipe buffer size of 2KB, and grow it as
necessary. When checking for a too-big packet from a pipe, check
against the appropriate maximum - 128MB for DLT_DBUS, 256KB for
everything else.
Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20
Reviewed-on: https://code.wireshark.org/review/21952
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05 01:58:40 +00:00
|
|
|
* is less than WTAP_MAX_PACKET_SIZE_STANDARD will ever be, so we don't need
|
2016-04-30 02:04:17 +00:00
|
|
|
* to check it.
|
|
|
|
*/
|
2013-06-05 00:36:57 +00:00
|
|
|
|
|
|
|
/* set the wiretap timestamp, assuming for the moment that Observer encoded it in GMT */
|
2018-02-09 00:19:12 +00:00
|
|
|
rec->ts.secs = (time_t) ((packet_header->nano_seconds_since_2000 / 1000000000) + ansi_to_observer_epoch_offset);
|
|
|
|
rec->ts.nsecs = (int) (packet_header->nano_seconds_since_2000 % 1000000000);
|
2013-06-05 00:36:57 +00:00
|
|
|
|
|
|
|
/* adjust to local time, if necessary, also accounting for DST if the frame
|
|
|
|
was captured while it was in effect */
|
2014-05-09 05:18:49 +00:00
|
|
|
if (((observer_dump_private_state*)wth->priv)->time_format == TIME_INFO_LOCAL)
|
2013-06-05 00:36:57 +00:00
|
|
|
{
|
2017-04-18 05:31:53 +00:00
|
|
|
struct tm *tm;
|
2013-06-05 00:36:57 +00:00
|
|
|
struct tm daylight_tm;
|
|
|
|
struct tm standard_tm;
|
|
|
|
time_t dst_offset;
|
|
|
|
|
|
|
|
/* the Observer timestamp was encoded as local time, so add a
|
|
|
|
correction from local time to GMT */
|
2018-02-09 00:19:12 +00:00
|
|
|
rec->ts.secs += gmt_to_localtime_offset;
|
2013-06-05 00:36:57 +00:00
|
|
|
|
|
|
|
/* perform a DST adjustment if necessary */
|
2018-02-09 00:19:12 +00:00
|
|
|
tm = localtime(&rec->ts.secs);
|
2017-04-18 05:31:53 +00:00
|
|
|
if (tm != NULL) {
|
|
|
|
standard_tm = *tm;
|
|
|
|
if (standard_tm.tm_isdst > 0) {
|
|
|
|
daylight_tm = standard_tm;
|
|
|
|
standard_tm.tm_isdst = 0;
|
|
|
|
dst_offset = mktime(&standard_tm) - mktime(&daylight_tm);
|
2018-02-09 00:19:12 +00:00
|
|
|
rec->ts.secs -= dst_offset;
|
2017-04-18 05:31:53 +00:00
|
|
|
}
|
2013-06-05 00:36:57 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
static int
|
2014-10-07 19:49:14 +00:00
|
|
|
read_packet_data(FILE_T fh, int offset_to_frame, int current_offset_from_packet_header, Buffer *buf,
|
|
|
|
int length, int *err, char **err_info)
|
2006-04-16 00:52:36 +00:00
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
int seek_increment;
|
|
|
|
int bytes_consumed = 0;
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* validate offsets */
|
|
|
|
if (offset_to_frame < current_offset_from_packet_header) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: bad record (offset to packet data %d < %d)",
|
|
|
|
offset_to_frame, current_offset_from_packet_header);
|
|
|
|
return -1;
|
|
|
|
}
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
/* skip to the packet data */
|
2011-05-03 05:28:39 +00:00
|
|
|
seek_increment = offset_to_frame - current_offset_from_packet_header;
|
|
|
|
if (seek_increment > 0) {
|
2016-09-29 04:35:12 +00:00
|
|
|
if (!wtap_read_bytes(fh, NULL, seek_increment, err, err_info)) {
|
2011-05-03 05:28:39 +00:00
|
|
|
return -1;
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
|
|
|
bytes_consumed += seek_increment;
|
2011-05-03 05:28:39 +00:00
|
|
|
}
|
2003-10-31 00:43:21 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
/* read in the packet data */
|
2013-06-16 00:20:00 +00:00
|
|
|
if (!wtap_read_packet_bytes(fh, buf, length, err, err_info))
|
|
|
|
return FALSE;
|
2011-05-03 05:26:10 +00:00
|
|
|
bytes_consumed += length;
|
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
return bytes_consumed;
|
2003-10-31 00:43:21 +00:00
|
|
|
}
|
|
|
|
|
2006-04-16 00:52:36 +00:00
|
|
|
static gboolean
|
2014-10-07 19:49:14 +00:00
|
|
|
skip_to_next_packet(wtap *wth, int offset_to_next_packet, int current_offset_from_packet_header, int *err,
|
|
|
|
char **err_info)
|
2003-10-31 00:43:21 +00:00
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
int seek_increment;
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* validate offsets */
|
2011-05-03 05:28:39 +00:00
|
|
|
if (offset_to_next_packet < current_offset_from_packet_header) {
|
2011-12-13 09:53:50 +00:00
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
2011-05-03 05:28:39 +00:00
|
|
|
*err_info = g_strdup_printf("Observer: bad record (offset to next packet %d < %d)",
|
|
|
|
offset_to_next_packet, current_offset_from_packet_header);
|
|
|
|
return FALSE;
|
|
|
|
}
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
/* skip to the next packet header */
|
2011-05-03 05:28:39 +00:00
|
|
|
seek_increment = offset_to_next_packet - current_offset_from_packet_header;
|
|
|
|
if (seek_increment > 0) {
|
2016-09-29 04:35:12 +00:00
|
|
|
if (!wtap_read_bytes(wth->fh, NULL, seek_increment, err, err_info))
|
2011-05-03 05:28:39 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
return TRUE;
|
2003-10-31 00:43:21 +00:00
|
|
|
}
|
|
|
|
|
2003-11-06 22:45:28 +00:00
|
|
|
/* Returns 0 if we could write the specified encapsulation type,
|
|
|
|
an error indication otherwise. */
|
|
|
|
int network_instruments_dump_can_write_encap(int encap)
|
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
/* per-packet encapsulations aren't supported */
|
|
|
|
if (encap == WTAP_ENCAP_PER_PACKET)
|
|
|
|
return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2011-05-03 05:28:39 +00:00
|
|
|
if (encap < 0 || (wtap_to_observer_encap(encap) == OBSERVER_UNDEFINED))
|
2014-12-17 06:40:45 +00:00
|
|
|
return WTAP_ERR_UNWRITABLE_ENCAP;
|
2011-05-03 05:28:39 +00:00
|
|
|
|
|
|
|
return 0;
|
2003-11-06 22:45:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
|
2010-11-05 07:14:21 +00:00
|
|
|
failure. */
|
2014-05-09 05:18:49 +00:00
|
|
|
gboolean network_instruments_dump_open(wtap_dumper *wdh, int *err)
|
2003-11-06 22:45:28 +00:00
|
|
|
{
|
2011-05-03 05:26:10 +00:00
|
|
|
observer_dump_private_state * private_state = NULL;
|
|
|
|
capture_file_header file_header;
|
2018-11-14 05:27:38 +00:00
|
|
|
guint header_offset;
|
2011-05-03 05:26:10 +00:00
|
|
|
tlv_header comment_header;
|
2011-05-03 05:28:39 +00:00
|
|
|
tlv_time_info time_header;
|
2011-05-03 05:26:10 +00:00
|
|
|
char comment[64];
|
|
|
|
size_t comment_length;
|
|
|
|
struct tm * current_time;
|
|
|
|
time_t system_time;
|
|
|
|
|
|
|
|
/* initialize the private state */
|
|
|
|
private_state = (observer_dump_private_state *) g_malloc(sizeof(observer_dump_private_state));
|
|
|
|
private_state->packet_count = 0;
|
|
|
|
private_state->network_type = wtap_to_observer_encap(wdh->encap);
|
2011-05-03 05:28:39 +00:00
|
|
|
private_state->time_format = TIME_INFO_GMT;
|
2011-10-12 18:04:58 +00:00
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* populate the fields of wdh */
|
|
|
|
wdh->priv = (void *) private_state;
|
|
|
|
wdh->subtype_write = observer_dump;
|
|
|
|
|
|
|
|
/* initialize the file header */
|
|
|
|
memset(&file_header, 0x00, sizeof(file_header));
|
2011-05-03 05:28:39 +00:00
|
|
|
g_strlcpy(file_header.observer_version, network_instruments_magic, 31);
|
2018-11-14 05:27:38 +00:00
|
|
|
header_offset = (guint16)sizeof(file_header);
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
/* create the file comment TLV */
|
|
|
|
{
|
|
|
|
time(&system_time);
|
|
|
|
current_time = localtime(&system_time);
|
|
|
|
memset(&comment, 0x00, sizeof(comment));
|
2017-04-18 05:31:53 +00:00
|
|
|
if (current_time != NULL)
|
|
|
|
g_snprintf(comment, 64, "This capture was saved from Wireshark on %s", asctime(current_time));
|
|
|
|
else
|
|
|
|
g_snprintf(comment, 64, "This capture was saved from Wireshark");
|
2011-05-03 05:26:10 +00:00
|
|
|
comment_length = strlen(comment);
|
|
|
|
|
|
|
|
comment_header.type = INFORMATION_TYPE_COMMENT;
|
|
|
|
comment_header.length = (guint16) (sizeof(comment_header) + comment_length);
|
|
|
|
|
|
|
|
/* update the file header to account for the comment TLV */
|
|
|
|
file_header.number_of_information_elements++;
|
2018-11-14 05:27:38 +00:00
|
|
|
header_offset += comment_header.length;
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* create the timestamp encoding TLV */
|
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
time_header.type = INFORMATION_TYPE_TIME_INFO;
|
|
|
|
time_header.length = (guint16) (sizeof(time_header));
|
|
|
|
time_header.time_format = TIME_INFO_GMT;
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
/* update the file header to account for the timestamp encoding TLV */
|
|
|
|
file_header.number_of_information_elements++;
|
2018-11-14 05:27:38 +00:00
|
|
|
header_offset += time_header.length;
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
|
|
|
|
2018-11-14 05:27:38 +00:00
|
|
|
/* Store the offset to the first packet */
|
|
|
|
file_header.offset_to_first_packet_high_byte = (header_offset >> 16);
|
|
|
|
file_header.offset_to_first_packet = (header_offset & 0xFFFF);
|
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* write the file header, swapping any multibyte fields first */
|
|
|
|
CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(file_header);
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!wtap_dump_file_write(wdh, &file_header, sizeof(file_header), err)) {
|
2011-05-03 05:26:10 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
wdh->bytes_dumped += sizeof(file_header);
|
|
|
|
|
|
|
|
/* write the comment TLV */
|
|
|
|
{
|
|
|
|
TLV_HEADER_TO_LE_IN_PLACE(comment_header);
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!wtap_dump_file_write(wdh, &comment_header, sizeof(comment_header), err)) {
|
2011-05-03 05:26:10 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
wdh->bytes_dumped += sizeof(comment_header);
|
|
|
|
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!wtap_dump_file_write(wdh, &comment, comment_length, err)) {
|
2011-05-03 05:26:10 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
wdh->bytes_dumped += comment_length;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* write the time info TLV */
|
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
TLV_TIME_INFO_TO_LE_IN_PLACE(time_header);
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!wtap_dump_file_write(wdh, &time_header, sizeof(time_header), err)) {
|
2011-05-03 05:26:10 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
wdh->bytes_dumped += sizeof(time_header);
|
|
|
|
}
|
|
|
|
|
|
|
|
init_gmt_to_localtime_offset();
|
|
|
|
|
|
|
|
return TRUE;
|
2003-11-06 22:45:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Write a record for a packet to a dump file.
|
|
|
|
Returns TRUE on success, FALSE on failure. */
|
2018-02-09 00:19:12 +00:00
|
|
|
static gboolean observer_dump(wtap_dumper *wdh, const wtap_rec *rec,
|
2012-10-16 21:50:57 +00:00
|
|
|
const guint8 *pd,
|
2014-12-18 00:02:50 +00:00
|
|
|
int *err, gchar **err_info _U_)
|
2003-11-06 22:45:28 +00:00
|
|
|
{
|
2011-05-03 05:26:10 +00:00
|
|
|
observer_dump_private_state * private_state = NULL;
|
|
|
|
packet_entry_header packet_header;
|
|
|
|
guint64 seconds_since_2000;
|
|
|
|
|
2014-05-24 18:28:30 +00:00
|
|
|
/* We can only write packet records. */
|
2018-02-09 00:19:12 +00:00
|
|
|
if (rec->rec_type != REC_TYPE_PACKET) {
|
2014-12-18 00:31:49 +00:00
|
|
|
*err = WTAP_ERR_UNWRITABLE_REC_TYPE;
|
2014-05-24 18:28:30 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
Catch attempts to write multiple encapsulation types if unsupported.
If, in the process of opening the input file, we determine that it has
packets of more than one link-layer type, we can catch attempts to write
that file to a file of a format that doesn't support more than one
link-layer type at the time we try to open the output file.
If, however, we don't discover that the file has more than one
link-layer type until we've already created the output file - for
example, if we have a pcapng file with a new IDB, with a different
link-layer type from previous IDBs, after packet blocks for the earlier
interfces - we can't catch that until we try to write the packet.
Currently, that causes the packet's data to be written out as is, so the
output file claims it's of the file's link-layer type, causing programs
reading the file to misdissect the packet.
Report WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED on the write attempt
instead, and have a nicer error message for
WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED on a write.
Change-Id: Ic41f2e4367cfe5667eb30c88cc6d3bfe422462f6
Reviewed-on: https://code.wireshark.org/review/30617
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-14 03:38:12 +00:00
|
|
|
/*
|
|
|
|
* Make sure this packet doesn't have a link-layer type that
|
|
|
|
* differs from the one for the file.
|
|
|
|
*/
|
|
|
|
if (wdh->encap != rec->rec_header.packet_header.pkt_encap) {
|
|
|
|
*err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2014-01-22 00:26:36 +00:00
|
|
|
/* The captured size field is 16 bits, so there's a hard limit of
|
|
|
|
65535. */
|
2018-02-09 00:19:12 +00:00
|
|
|
if (rec->rec_header.packet_header.caplen > 65535) {
|
2014-01-22 00:26:36 +00:00
|
|
|
*err = WTAP_ERR_PACKET_TOO_LARGE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
/* convert the number of seconds since epoch from ANSI-relative to
|
|
|
|
Observer-relative */
|
2018-02-09 00:19:12 +00:00
|
|
|
if (rec->ts.secs < ansi_to_observer_epoch_offset) {
|
|
|
|
if(rec->ts.secs > (time_t) 0) {
|
|
|
|
seconds_since_2000 = rec->ts.secs;
|
2011-05-03 05:28:39 +00:00
|
|
|
} else {
|
|
|
|
seconds_since_2000 = (time_t) 0;
|
|
|
|
}
|
2011-05-03 05:26:10 +00:00
|
|
|
} else {
|
2018-02-09 00:19:12 +00:00
|
|
|
seconds_since_2000 = rec->ts.secs - ansi_to_observer_epoch_offset;
|
2011-05-03 05:26:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* populate the fields of the packet header */
|
|
|
|
private_state = (observer_dump_private_state *) wdh->priv;
|
|
|
|
|
|
|
|
memset(&packet_header, 0x00, sizeof(packet_header));
|
|
|
|
packet_header.packet_magic = observer_packet_magic;
|
|
|
|
packet_header.network_speed = 1000000;
|
2018-02-09 00:19:12 +00:00
|
|
|
packet_header.captured_size = (guint16) rec->rec_header.packet_header.caplen;
|
|
|
|
packet_header.network_size = (guint16) (rec->rec_header.packet_header.len + 4);
|
2011-05-03 05:26:10 +00:00
|
|
|
packet_header.offset_to_frame = sizeof(packet_header);
|
2011-05-03 05:50:30 +00:00
|
|
|
/* XXX - what if this doesn't fit in 16 bits? It's not guaranteed to... */
|
2018-02-09 00:19:12 +00:00
|
|
|
packet_header.offset_to_next_packet = (guint16)sizeof(packet_header) + rec->rec_header.packet_header.caplen;
|
2011-05-03 05:26:10 +00:00
|
|
|
packet_header.network_type = private_state->network_type;
|
|
|
|
packet_header.flags = 0x00;
|
|
|
|
packet_header.number_of_information_elements = 0;
|
|
|
|
packet_header.packet_type = PACKET_TYPE_DATA_PACKET;
|
|
|
|
packet_header.packet_number = private_state->packet_count;
|
|
|
|
packet_header.original_packet_number = packet_header.packet_number;
|
2018-02-09 00:19:12 +00:00
|
|
|
packet_header.nano_seconds_since_2000 = seconds_since_2000 * 1000000000 + rec->ts.nsecs;
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
private_state->packet_count++;
|
|
|
|
|
|
|
|
/* write the packet header */
|
|
|
|
PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(packet_header);
|
2014-05-09 05:18:49 +00:00
|
|
|
if (!wtap_dump_file_write(wdh, &packet_header, sizeof(packet_header), err)) {
|
2011-05-03 05:26:10 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
wdh->bytes_dumped += sizeof(packet_header);
|
|
|
|
|
|
|
|
/* write the packet data */
|
2018-02-09 00:19:12 +00:00
|
|
|
if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err)) {
|
2011-05-03 05:26:10 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
2018-02-09 00:19:12 +00:00
|
|
|
wdh->bytes_dumped += rec->rec_header.packet_header.caplen;
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
2003-11-06 22:45:28 +00:00
|
|
|
|
2011-05-03 05:26:10 +00:00
|
|
|
static gint observer_to_wtap_encap(int observer_encap)
|
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
switch(observer_encap) {
|
|
|
|
case OBSERVER_ETHERNET:
|
|
|
|
return WTAP_ENCAP_ETHERNET;
|
|
|
|
case OBSERVER_TOKENRING:
|
|
|
|
return WTAP_ENCAP_TOKEN_RING;
|
|
|
|
case OBSERVER_FIBRE_CHANNEL:
|
|
|
|
return WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS;
|
2012-01-18 22:05:01 +00:00
|
|
|
case OBSERVER_WIRELESS_802_11:
|
2012-01-28 17:10:50 +00:00
|
|
|
return WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
|
2011-05-03 05:28:39 +00:00
|
|
|
case OBSERVER_UNDEFINED:
|
|
|
|
return WTAP_ENCAP_UNKNOWN;
|
|
|
|
}
|
|
|
|
return WTAP_ENCAP_UNKNOWN;
|
2003-11-06 22:45:28 +00:00
|
|
|
}
|
2011-05-03 05:26:10 +00:00
|
|
|
|
|
|
|
static gint wtap_to_observer_encap(int wtap_encap)
|
|
|
|
{
|
2011-05-03 05:28:39 +00:00
|
|
|
switch(wtap_encap) {
|
|
|
|
case WTAP_ENCAP_ETHERNET:
|
|
|
|
return OBSERVER_ETHERNET;
|
|
|
|
case WTAP_ENCAP_TOKEN_RING:
|
|
|
|
return OBSERVER_TOKENRING;
|
|
|
|
case WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS:
|
|
|
|
return OBSERVER_FIBRE_CHANNEL;
|
|
|
|
case WTAP_ENCAP_UNKNOWN:
|
|
|
|
return OBSERVER_UNDEFINED;
|
|
|
|
}
|
|
|
|
return OBSERVER_UNDEFINED;
|
|
|
|
}
|
2015-01-02 00:45:22 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Editor modelines - http://www.wireshark.org/tools/modelines.html
|
|
|
|
*
|
|
|
|
* Local variables:
|
|
|
|
* c-basic-offset: 4
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: nil
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* vi: set shiftwidth=4 tabstop=8 expandtab:
|
|
|
|
* :indentSize=4:tabSize=8:noTabs=true:
|
|
|
|
*/
|