ui/text_import.c

   1 /* text_import.c
   2  * State machine for text import
   3  * November 2010, Jaap Keuter <jaap.keuter@xs4all.nl>
   4  * Modified March 2021, Paul Weiß <paulniklasweiss@gmail.com>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * Based on text2pcap.c by Ashok Narayanan <ashokn@cisco.com>
  11  *
  12  * SPDX-License-Identifier: GPL-2.0-or-later
  13  */
  14
  15 /*******************************************************************************
  16  *
  17  * This code reads in an ASCII hexdump of this common format:
  18  *
  19  * 00000000  00 E0 1E A7 05 6F 00 10 5A A0 B9 12 08 00 46 00 .....o..Z.....F.
  20  * 00000010  03 68 00 00 00 00 0A 2E EE 33 0F 19 08 7F 0F 19 .h.......3......
  21  * 00000020  03 80 94 04 00 00 10 01 16 A2 0A 00 03 50 00 0C .............P..
  22  * 00000030  01 01 0F 19 03 80 11 01 1E 61 00 0C 03 01 0F 19 .........a......
  23  *
  24  * Each bytestring line consists of an offset, one or more bytes, and
  25  * text at the end. An offset is defined as a hex string of more than
  26  * two characters. A byte is defined as a hex string of exactly two
  27  * characters. The text at the end is ignored, as is any text before
  28  * the offset. Bytes read from a bytestring line are added to the
  29  * current packet only if all the following conditions are satisfied:
  30  *
  31  * - No text appears between the offset and the bytes (any bytes appearing after
  32  *   such text would be ignored)
  33  *
  34  * - The offset must be arithmetically correct, i.e. if the offset is 00000020,
  35  *   then exactly 32 bytes must have been read into this packet before this.
  36  *   If the offset is wrong, the packet is immediately terminated
  37  *
  38  * A packet start is signaled by a zero offset.
  39  *
  40  * Lines starting with #TEXT2PCAP are directives. These allow the user
  41  * to embed instructions into the capture file which allows text2pcap
  42  * to take some actions (e.g. specifying the encapsulation
  43  * etc.). Currently no directives are implemented.
  44  *
  45  * Lines beginning with # which are not directives are ignored as
  46  * comments. Currently all non-hexdump text is ignored by text2pcap;
  47  * in the future, text processing may be added, but lines prefixed
  48  * with '#' will still be ignored.
  49  *
  50  * The output is a libpcap packet containing Ethernet frames by
  51  * default. This program takes options which allow the user to add
  52  * dummy Ethernet, IP and UDP, TCP or SCTP headers to the packets in order
  53  * to allow dumps of L3 or higher protocols to be decoded.
  54  *
  55  * Considerable flexibility is built into this code to read hexdumps
  56  * of slightly different formats. For example, any text prefixing the
  57  * hexdump line is dropped (including mail forwarding '>'). The offset
  58  * can be any hex number of four digits or greater.
  59  *
  60  * This converter cannot read a single packet greater than
  61  * WTAP_MAX_PACKET_SIZE_STANDARD.  The snapshot length is automatically
  62  * set to WTAP_MAX_PACKET_SIZE_STANDARD.
  63  */
  64
  65 /*******************************************************************************
  66  * Alternatively this parses a Textfile based on a prel regex containing named
  67  * capturing groups like so:
  68  * (?<seqno>\d+)\s*(?<dir><|>)\s*(?<time>\d+:\d\d:\d\d.\d+)\s+(?<data>[0-9a-fA-F]+)\\s+
  69  *
  70  * Fields are decoded using a leanient parser, but only one attempt is made.
  71  * Except for in data invalid values will be replaced by default ones.
  72  * data currently only accepts plain HEX, OCT or BIN encoded data.
  73  * common field separators are ignored. Note however that 0x or 0b prefixing is
  74  * not supported and no automatic format detection is attempted.
  75  */
  76
  77 #include "config.h"
  78 #include "text_import.h"
  79
  80 #include <stdio.h>
  81 #include <stdlib.h>
  82 #include <string.h>
  83 #include <wsutil/file_util.h>
  84 #include <ws_exit_codes.h>
  85
  86 #include <time.h>
  87 #include <glib.h>
  88
  89 #include <errno.h>
  90 #include <assert.h>
  91
  92 #include <epan/tvbuff.h>
  93 #include <wsutil/crc32.h>
  94 #include <epan/in_cksum.h>
  95
  96 #include <wsutil/report_message.h>
  97 #include <wsutil/exported_pdu_tlvs.h>
  98
  99 #include <wsutil/nstime.h>
 100 #include <wsutil/time_util.h>
 101 #include <wsutil/ws_strptime.h>
 102
 103 #include <wsutil/version_info.h>
 104 #include <wsutil/cpu_info.h>
 105 #include <wsutil/os_version_info.h>
 106
 107 #include "text_import_scanner.h"
 108 #include "text_import_scanner_lex.h"
 109 #include "text_import_regex.h"
 110
 111 /*--- Options --------------------------------------------------------------------*/
 112
 113 /* maximum time precision we can handle = 10^(-SUBSEC_PREC) */
 114 #define SUBSEC_PREC 9
 115
 116 static text_import_info_t *info_p;
 117
 118 /* Dummy Ethernet header */
 119 static bool hdr_ethernet;
 120 static uint8_t hdr_eth_dest_addr[6] = {0x20, 0x52, 0x45, 0x43, 0x56, 0x00};
 121 static uint8_t hdr_eth_src_addr[6]  = {0x20, 0x53, 0x45, 0x4E, 0x44, 0x00};
 122 static uint32_t hdr_ethernet_proto;
 123
 124 /* Dummy IP header */
 125 static bool hdr_ip;
 126 static bool hdr_ipv6;
 127 static unsigned hdr_ip_proto;
 128
 129 /* Destination and source addresses for IP header */
 130 static ws_in6_addr NO_IPv6_ADDRESS    = {{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}};
 131 /* These IPv6 default addresses are unique local addresses generated using
 132  * the pseudo-random method from Section 3.2.2 of RFC 4193
 133  */
 134 static ws_in6_addr IPv6_SRC = {{0xfd, 0xce, 0xd8, 0x62, 0x14, 0x1b, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}};
 135 static ws_in6_addr IPv6_DST = {{0xfd, 0xce, 0xd8, 0x62, 0x14, 0x1b, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02}};
 136
 137 /* Dummy UDP header */
 138 static bool hdr_udp;
 139
 140 /* Dummy TCP header */
 141 static bool hdr_tcp;
 142
 143 /* TCP sequence numbers when has_direction is true */
 144 static uint32_t tcp_in_seq_num;
 145 static uint32_t tcp_out_seq_num;
 146
 147 /* Dummy SCTP header */
 148 static bool hdr_sctp;
 149
 150 /* Dummy DATA chunk header */
 151 static bool hdr_data_chunk;
 152 static uint8_t hdr_data_chunk_type;
 153 static uint8_t hdr_data_chunk_bits;
 154 static uint32_t hdr_data_chunk_tsn;
 155 static uint16_t hdr_data_chunk_sid;
 156 static uint16_t hdr_data_chunk_ssn;
 157
 158 /* Dummy ExportPdu header */
 159 static bool hdr_export_pdu;
 160
 161 /* Hex+ASCII text dump identification, to handle an edge case where
 162  * the ASCII representation contains patterns that look like bytes. */
 163 static uint8_t* pkt_lnstart;
 164
 165 static bool has_direction;
 166 static uint32_t direction = PACK_FLAGS_RECEPTION_TYPE_UNSPECIFIED;
 167 static bool has_seqno;
 168 static uint64_t seqno;
 169 /*--- Local data -----------------------------------------------------------------*/
 170
 171 /* This is where we store the packet currently being built */
 172 static uint8_t *packet_buf;
 173 static uint32_t curr_offset;
 174 static uint32_t packet_start;
 175 static bool offset_warned;
 176 static import_status_t start_new_packet(bool);
 177
 178 /* This buffer contains strings present before the packet offset 0 */
 179 #define PACKET_PREAMBLE_MAX_LEN    2048
 180 static uint8_t packet_preamble[PACKET_PREAMBLE_MAX_LEN+1];
 181 static int packet_preamble_len;
 182
 183 /* Time code of packet, derived from packet_preamble */
 184 static time_t   ts_sec;
 185 static uint32_t ts_nsec;
 186 static bool ts_fmt_iso;
 187 static struct tm timecode_default;
 188 static bool timecode_warned;
 189 /* The time delta to add to packets without a valid time code.
 190  * This can be no smaller than the time resolution of the dump
 191  * file, so the default is 1000 nanoseconds, or 1 microsecond.
 192  * XXX: We should at least get this from the resolution of the file we're
 193  * writing to, and possibly allow the user to set a different value.
 194  */
 195 static uint32_t ts_tick = 1000;
 196
 197 /* HDR_ETH Offset base to parse */
 198 static uint32_t offset_base = 16;
 199
 200 /* ----- State machine -----------------------------------------------------------*/
 201
 202 /* Current state of parser */
 203 typedef enum {
 204     INIT,             /* Waiting for start of new packet */
 205     START_OF_LINE,    /* Starting from beginning of line */
 206     READ_OFFSET,      /* Just read the offset */
 207     READ_BYTE,        /* Just read a byte */
 208     READ_TEXT         /* Just read text - ignore until EOL */
 209 } parser_state_t;
 210 static parser_state_t state = INIT;
 211
 212 static const char *state_str[] = {"Init",
 213                            "Start-of-line",
 214                            "Offset",
 215                            "Byte",
 216                            "Text"
 217 };
 218
 219 static const char *token_str[] = {"",
 220                            "Byte",
 221                            "Offset",
 222                            "Directive",
 223                            "Text",
 224                            "End-of-line",
 225                            "End-of-file"
 226 };
 227
 228 /* ----- Skeleton Packet Headers --------------------------------------------------*/
 229
 230 typedef struct {
 231     uint8_t dest_addr[6];
 232     uint8_t src_addr[6];
 233     uint16_t ethertype;
 234 } hdr_ethernet_t;
 235
 236 static hdr_ethernet_t HDR_ETHERNET;
 237
 238 typedef struct {
 239     uint8_t ver_hdrlen;
 240     uint8_t dscp;
 241     uint16_t packet_length;
 242     uint16_t identification;
 243     uint8_t flags;
 244     uint8_t fragment;
 245     uint8_t ttl;
 246     uint8_t protocol;
 247     uint16_t hdr_checksum;
 248     uint32_t src_addr;
 249     uint32_t dest_addr;
 250 } hdr_ip_t;
 251
 252 /* Default IPv4 addresses if none supplied */
 253 #if G_BYTE_ORDER == G_BIG_ENDIAN
 254 #define IP_ID  0x1234
 255 #define IP_SRC 0x0a010101
 256 #define IP_DST 0x0a020202
 257 #else
 258 #define IP_ID  0x3412
 259 #define IP_SRC 0x0101010a
 260 #define IP_DST 0x0202020a
 261 #endif
 262
 263 static hdr_ip_t HDR_IP =
 264   {0x45, 0, 0, IP_ID, 0, 0, 0xff, 0, 0, IP_SRC, IP_DST};
 265
 266 static struct {         /* pseudo header for checksum calculation */
 267     uint32_t src_addr;
 268     uint32_t dest_addr;
 269     uint8_t zero;
 270     uint8_t protocol;
 271     uint16_t length;
 272 } pseudoh;
 273
 274
 275 /* headers taken from glibc */
 276
 277 typedef struct {
 278     union  {
 279         struct ip6_hdrctl {
 280             uint32_t ip6_un1_flow;   /* 24 bits of flow-ID */
 281             uint16_t ip6_un1_plen;   /* payload length */
 282             uint8_t ip6_un1_nxt;    /* next header */
 283             uint8_t ip6_un1_hlim;   /* hop limit */
 284         } ip6_un1;
 285         uint8_t ip6_un2_vfc;       /* 4 bits version, 4 bits priority */
 286     } ip6_ctlun;
 287     ws_in6_addr ip6_src;      /* source address */
 288     ws_in6_addr ip6_dst;      /* destination address */
 289 } hdr_ipv6_t;
 290
 291 static hdr_ipv6_t HDR_IPv6;
 292
 293 /* https://tools.ietf.org/html/rfc2460#section-8.1 */
 294 static struct {                 /* pseudo header ipv6 for checksum calculation */
 295     struct  e_in6_addr src_addr6;
 296     struct  e_in6_addr dst_addr6;
 297     uint32_t length;
 298     uint8_t zero[3];
 299     uint8_t next_header;
 300 } pseudoh6;
 301
 302
 303 typedef struct {
 304     uint16_t source_port;
 305     uint16_t dest_port;
 306     uint16_t length;
 307     uint16_t checksum;
 308 } hdr_udp_t;
 309
 310 static hdr_udp_t HDR_UDP = {0, 0, 0, 0};
 311
 312 typedef struct {
 313     uint16_t source_port;
 314     uint16_t dest_port;
 315     uint32_t seq_num;
 316     uint32_t ack_num;
 317     uint8_t hdr_length;
 318     uint8_t flags;
 319     uint16_t window;
 320     uint16_t checksum;
 321     uint16_t urg;
 322 } hdr_tcp_t;
 323
 324 static hdr_tcp_t HDR_TCP = {0, 0, 0, 0, 0x50, 0, 0, 0, 0};
 325
 326 typedef struct {
 327     uint16_t src_port;
 328     uint16_t dest_port;
 329     uint32_t tag;
 330     uint32_t checksum;
 331 } hdr_sctp_t;
 332
 333 static hdr_sctp_t HDR_SCTP = {0, 0, 0, 0};
 334
 335 typedef struct {
 336     uint8_t type;
 337     uint8_t bits;
 338     uint16_t length;
 339     uint32_t tsn;
 340     uint16_t sid;
 341     uint16_t ssn;
 342     uint32_t ppid;
 343 } hdr_data_chunk_t;
 344
 345 static hdr_data_chunk_t HDR_DATA_CHUNK = {0, 0, 0, 0, 0, 0, 0};
 346
 347 typedef struct {
 348     uint16_t tag_type;
 349     uint16_t payload_len;
 350 } hdr_export_pdu_t;
 351
 352 static hdr_export_pdu_t HDR_EXPORT_PDU = {0, 0};
 353
 354 #define EXPORT_PDU_END_OF_OPTIONS_SIZE 4
 355
 356 /*----------------------------------------------------------------------
 357  * Parse a single hex number
 358  * Will abort the program if it can't parse the number
 359  * Pass in true if this is an offset, false if not
 360  */
 361 static import_status_t
 362 parse_num(const char *str, int offset, uint32_t* num)
 363 {
 364     char *c;
 365
 366     if (str == NULL) {
 367         report_failure("FATAL ERROR: str is NULL");
 368         return IMPORT_FAILURE;
 369     }
 370
 371     errno = 0;
 372     unsigned long ulnum = strtoul(str, &c, offset ? offset_base : 16);
 373     if (errno != 0) {
 374         report_failure("Unable to convert %s to base %u: %s", str,
 375             offset ? offset_base : 16, g_strerror(errno));
 376         return IMPORT_FAILURE;
 377     }
 378     if (c == str) {
 379         report_failure("Unable to convert %s to base %u", str,
 380             offset ? offset_base : 16);
 381         return IMPORT_FAILURE;
 382     }
 383     if (ulnum > UINT32_MAX) {
 384         report_failure("%s too large", str);
 385         return IMPORT_FAILURE;
 386     }
 387     *num = (uint32_t) ulnum;
 388     return IMPORT_SUCCESS;
 389 }
 390
 391 /*----------------------------------------------------------------------
 392  * Write this byte into current packet
 393  */
 394 static import_status_t
 395 write_byte(const char *str)
 396 {
 397     uint32_t num;
 398
 399     if (parse_num(str, false, &num) != IMPORT_SUCCESS)
 400         return IMPORT_FAILURE;
 401
 402     packet_buf[curr_offset] = (uint8_t) num;
 403     curr_offset++;
 404     if (curr_offset >= info_p->max_frame_length) /* packet full */
 405         if (start_new_packet(true) != IMPORT_SUCCESS)
 406            return IMPORT_FAILURE;
 407
 408     return IMPORT_SUCCESS;
 409 }
 410
 411 /*----------------------------------------------------------------------
 412  * Remove bytes from the current packet
 413  */
 414 static void
 415 unwrite_bytes (uint32_t nbytes)
 416 {
 417     curr_offset -= nbytes;
 418 }
 419
 420 /*----------------------------------------------------------------------
 421  * Determine SCTP chunk padding length
 422  */
 423 static uint32_t
 424 number_of_padding_bytes (uint32_t length)
 425 {
 426     uint32_t remainder;
 427
 428     remainder = length % 4;
 429
 430     if (remainder == 0)
 431         return 0;
 432     else
 433         return 4 - remainder;
 434 }
 435
 436 /*----------------------------------------------------------------------
 437  * Write current packet out
 438  *
 439  * @param cont [IN] true if a packet is being written because the max frame
 440  * length was reached, and the original packet from the input file is
 441  * continued in a later frame. Used to set fragmentation fields in dummy
 442  * headers (currently only implemented for SCTP; IPv4 could be added later.)
 443  */
 444 static import_status_t
 445 write_current_packet(bool cont)
 446 {
 447     int prefix_length = 0;
 448     int proto_length = 0;
 449     int ip_length = 0;
 450     int eth_trailer_length = 0;
 451     int prefix_index = 0;
 452     int i, padding_length;
 453
 454     if (curr_offset > 0) {
 455         /* Write the packet */
 456
 457         /* Is direction indication on with an inbound packet? */
 458         bool isOutbound = has_direction && (direction == PACK_FLAGS_DIRECTION_OUTBOUND);
 459
 460         /* Compute packet length */
 461         prefix_length = 0;
 462         if (hdr_export_pdu) {
 463             prefix_length += (int)sizeof(HDR_EXPORT_PDU) + (int)strlen(info_p->payload) + EXPORT_PDU_END_OF_OPTIONS_SIZE;
 464             proto_length = prefix_length + curr_offset;
 465         }
 466         if (hdr_data_chunk) { prefix_length += (int)sizeof(HDR_DATA_CHUNK); }
 467         if (hdr_sctp) { prefix_length += (int)sizeof(HDR_SCTP); }
 468         if (hdr_udp) { prefix_length += (int)sizeof(HDR_UDP); proto_length = prefix_length + curr_offset; }
 469         if (hdr_tcp) { prefix_length += (int)sizeof(HDR_TCP); proto_length = prefix_length + curr_offset; }
 470         if (hdr_ip) {
 471             prefix_length += (int)sizeof(HDR_IP);
 472             ip_length = prefix_length + curr_offset + ((hdr_data_chunk) ? number_of_padding_bytes(curr_offset) : 0);
 473         } else if (hdr_ipv6) {
 474             ip_length = prefix_length + curr_offset + ((hdr_data_chunk) ? number_of_padding_bytes(curr_offset) : 0);
 475             /* IPv6 payload length field does not include the header itself.
 476              * It does include extension headers, but we don't put any
 477              * (if we later do fragments, that would change.)
 478              */
 479             prefix_length += (int)sizeof(HDR_IPv6);
 480         }
 481         if (hdr_ethernet) { prefix_length += (int)sizeof(HDR_ETHERNET); }
 482
 483         /* Make room for dummy header */
 484         memmove(&packet_buf[prefix_length], packet_buf, curr_offset);
 485
 486         if (hdr_ethernet) {
 487             /* Pad trailer */
 488             if (prefix_length + curr_offset < 60) {
 489                 eth_trailer_length = 60 - (prefix_length + curr_offset);
 490             }
 491         }
 492
 493         /* Write Ethernet header */
 494         if (hdr_ethernet) {
 495             if (isOutbound)
 496             {
 497                 memcpy(HDR_ETHERNET.dest_addr, hdr_eth_src_addr, 6);
 498                 memcpy(HDR_ETHERNET.src_addr, hdr_eth_dest_addr, 6);
 499             } else {
 500                 memcpy(HDR_ETHERNET.dest_addr, hdr_eth_dest_addr, 6);
 501                 memcpy(HDR_ETHERNET.src_addr, hdr_eth_src_addr, 6);
 502             }
 503             HDR_ETHERNET.ethertype = g_htons(hdr_ethernet_proto);
 504             memcpy(&packet_buf[prefix_index], &HDR_ETHERNET, sizeof(HDR_ETHERNET));
 505             prefix_index += (int)sizeof(HDR_ETHERNET);
 506         }
 507
 508         /* Write IP header */
 509         if (hdr_ip) {
 510             vec_t cksum_vector[1];
 511
 512             if (isOutbound) {
 513                 HDR_IP.src_addr = info_p->ip_dest_addr.ipv4 ? info_p->ip_dest_addr.ipv4 : IP_DST;
 514                 HDR_IP.dest_addr = info_p->ip_src_addr.ipv4 ? info_p->ip_src_addr.ipv4 : IP_SRC;
 515             }
 516             else {
 517                 HDR_IP.src_addr = info_p->ip_src_addr.ipv4 ? info_p->ip_src_addr.ipv4 : IP_SRC;
 518                 HDR_IP.dest_addr = info_p->ip_dest_addr.ipv4 ? info_p->ip_dest_addr.ipv4 : IP_DST;
 519             }
 520             HDR_IP.packet_length = g_htons(ip_length);
 521             HDR_IP.protocol = (uint8_t) hdr_ip_proto;
 522             HDR_IP.hdr_checksum = 0;
 523             cksum_vector[0].ptr = (uint8_t *)&HDR_IP; cksum_vector[0].len = sizeof(HDR_IP);
 524             HDR_IP.hdr_checksum = in_cksum(cksum_vector, 1);
 525
 526             memcpy(&packet_buf[prefix_index], &HDR_IP, sizeof(HDR_IP));
 527             prefix_index += (int)sizeof(HDR_IP);
 528
 529             /* initialize pseudo header for checksum calculation */
 530             pseudoh.src_addr    = HDR_IP.src_addr;
 531             pseudoh.dest_addr   = HDR_IP.dest_addr;
 532             pseudoh.zero        = 0;
 533             pseudoh.protocol    = (uint8_t) hdr_ip_proto;
 534             pseudoh.length      = g_htons(proto_length);
 535         } else if (hdr_ipv6) {
 536             if (memcmp(&info_p->ip_dest_addr.ipv6, &NO_IPv6_ADDRESS, sizeof(ws_in6_addr))) {
 537                 memcpy(isOutbound ? &HDR_IPv6.ip6_src : &HDR_IPv6.ip6_dst, &info_p->ip_dest_addr.ipv6, sizeof(ws_in6_addr));
 538             } else {
 539                 memcpy(isOutbound ? &HDR_IPv6.ip6_src : &HDR_IPv6.ip6_dst, &IPv6_DST, sizeof(ws_in6_addr));
 540             }
 541             if (memcmp(&info_p->ip_src_addr.ipv6, &NO_IPv6_ADDRESS, sizeof(ws_in6_addr))) {
 542                 memcpy(isOutbound ? &HDR_IPv6.ip6_dst : &HDR_IPv6.ip6_src, &info_p->ip_src_addr.ipv6, sizeof(ws_in6_addr));
 543             } else {
 544                 memcpy(isOutbound ? &HDR_IPv6.ip6_dst : &HDR_IPv6.ip6_src, &IPv6_SRC, sizeof(ws_in6_addr));
 545             }
 546
 547             HDR_IPv6.ip6_ctlun.ip6_un2_vfc &= 0x0F;
 548             HDR_IPv6.ip6_ctlun.ip6_un2_vfc |= (6<< 4);
 549             HDR_IPv6.ip6_ctlun.ip6_un1.ip6_un1_plen = g_htons(ip_length);
 550             HDR_IPv6.ip6_ctlun.ip6_un1.ip6_un1_nxt  = (uint8_t) hdr_ip_proto;
 551             HDR_IPv6.ip6_ctlun.ip6_un1.ip6_un1_hlim = 32;
 552
 553             memcpy(&packet_buf[prefix_index], &HDR_IPv6, sizeof(HDR_IPv6));
 554             prefix_index += (int)sizeof(HDR_IPv6);
 555
 556             /* initialize pseudo ipv6 header for checksum calculation */
 557             pseudoh6.src_addr6  = HDR_IPv6.ip6_src;
 558             pseudoh6.dst_addr6  = HDR_IPv6.ip6_dst;
 559             memset(pseudoh6.zero, 0, sizeof(pseudoh6.zero));
 560             pseudoh6.next_header   = (uint8_t) hdr_ip_proto;
 561             pseudoh6.length      = g_htons(proto_length);
 562         }
 563
 564         /* Write UDP header */
 565         if (hdr_udp) {
 566             vec_t cksum_vector[3];
 567
 568             HDR_UDP.source_port = isOutbound ? g_htons(info_p->dst_port): g_htons(info_p->src_port);
 569             HDR_UDP.dest_port = isOutbound ? g_htons(info_p->src_port) : g_htons(info_p->dst_port);
 570             HDR_UDP.length = g_htons(proto_length);
 571
 572             HDR_UDP.checksum = 0;
 573             if (hdr_ipv6) {
 574                 cksum_vector[0].ptr = (uint8_t *)&pseudoh6; cksum_vector[0].len = sizeof(pseudoh6);
 575             } else {
 576                 cksum_vector[0].ptr = (uint8_t *)&pseudoh; cksum_vector[0].len = sizeof(pseudoh);
 577             }
 578             cksum_vector[1].ptr = (uint8_t *)&HDR_UDP; cksum_vector[1].len = sizeof(HDR_UDP);
 579             cksum_vector[2].ptr = &packet_buf[prefix_length]; cksum_vector[2].len = curr_offset;
 580             HDR_UDP.checksum = in_cksum(cksum_vector, 3);
 581
 582             memcpy(&packet_buf[prefix_index], &HDR_UDP, sizeof(HDR_UDP));
 583             prefix_index += (int)sizeof(HDR_UDP);
 584         }
 585
 586         /* Write TCP header */
 587         if (hdr_tcp) {
 588             vec_t cksum_vector[3];
 589
 590             HDR_TCP.source_port = isOutbound ? g_htons(info_p->dst_port): g_htons(info_p->src_port);
 591             HDR_TCP.dest_port = isOutbound ? g_htons(info_p->src_port) : g_htons(info_p->dst_port);
 592             /* set ack number if we have direction */
 593             if (has_direction) {
 594                 HDR_TCP.flags = 0x10;
 595                 HDR_TCP.ack_num = g_ntohl(isOutbound ? tcp_out_seq_num : tcp_in_seq_num);
 596                 HDR_TCP.ack_num = g_htonl(HDR_TCP.ack_num);
 597             }
 598             else {
 599                 HDR_TCP.flags = 0;
 600                 HDR_TCP.ack_num = 0;
 601             }
 602             HDR_TCP.seq_num = isOutbound ? tcp_in_seq_num : tcp_out_seq_num;
 603             HDR_TCP.window = g_htons(0x2000);
 604
 605             HDR_TCP.checksum = 0;
 606             if (hdr_ipv6) {
 607                 cksum_vector[0].ptr = (uint8_t *)&pseudoh6; cksum_vector[0].len = sizeof(pseudoh6);
 608             } else {
 609                 cksum_vector[0].ptr = (uint8_t *)&pseudoh; cksum_vector[0].len = sizeof(pseudoh);
 610             }
 611             cksum_vector[1].ptr = (uint8_t *)&HDR_TCP; cksum_vector[1].len = sizeof(HDR_TCP);
 612             cksum_vector[2].ptr = &packet_buf[prefix_length]; cksum_vector[2].len = curr_offset;
 613             HDR_TCP.checksum = in_cksum(cksum_vector, 3);
 614
 615             memcpy(&packet_buf[prefix_index], &HDR_TCP, sizeof(HDR_TCP));
 616             prefix_index += (int)sizeof(HDR_TCP);
 617             if (isOutbound) {
 618                 tcp_in_seq_num = g_ntohl(tcp_in_seq_num) + curr_offset;
 619                 tcp_in_seq_num = g_htonl(tcp_in_seq_num);
 620             }
 621             else {
 622                 tcp_out_seq_num = g_ntohl(tcp_out_seq_num) + curr_offset;
 623                 tcp_out_seq_num = g_htonl(tcp_out_seq_num);
 624             }
 625         }
 626
 627         /* Compute DATA chunk header and append padding */
 628         if (hdr_data_chunk) {
 629             hdr_data_chunk_bits = 0;
 630             if (packet_start == 0) {
 631                 hdr_data_chunk_bits |= 0x02;
 632             }
 633             if (!cont) {
 634                 hdr_data_chunk_bits |= 0x01;
 635             }
 636             HDR_DATA_CHUNK.type   = hdr_data_chunk_type;
 637             HDR_DATA_CHUNK.bits   = hdr_data_chunk_bits;
 638             HDR_DATA_CHUNK.length = g_htons(curr_offset + sizeof(HDR_DATA_CHUNK));
 639             HDR_DATA_CHUNK.tsn    = g_htonl(hdr_data_chunk_tsn);
 640             HDR_DATA_CHUNK.sid    = g_htons(hdr_data_chunk_sid);
 641             HDR_DATA_CHUNK.ssn    = g_htons(hdr_data_chunk_ssn);
 642             HDR_DATA_CHUNK.ppid   = g_htonl(info_p->ppi);
 643             hdr_data_chunk_tsn++;
 644             if (!cont) {
 645                 hdr_data_chunk_ssn++;
 646             }
 647             padding_length = number_of_padding_bytes(curr_offset);
 648             for (i=0; i<padding_length; i++)
 649                 packet_buf[prefix_length+curr_offset+i] = 0;
 650             curr_offset += padding_length;
 651         }
 652
 653         /* Write SCTP header */
 654         if (hdr_sctp) {
 655             HDR_SCTP.src_port  = isOutbound ? g_htons(info_p->dst_port): g_htons(info_p->src_port);
 656             HDR_SCTP.dest_port = isOutbound ? g_htons(info_p->src_port) : g_htons(info_p->dst_port);
 657             HDR_SCTP.tag       = g_htonl(info_p->tag);
 658             HDR_SCTP.checksum  = g_htonl(0);
 659
 660             HDR_SCTP.checksum  = crc32c_calculate(&HDR_SCTP, sizeof(HDR_SCTP), CRC32C_PRELOAD);
 661             if (hdr_data_chunk)
 662                 HDR_SCTP.checksum  = crc32c_calculate(&HDR_DATA_CHUNK, sizeof(HDR_DATA_CHUNK), HDR_SCTP.checksum);
 663             HDR_SCTP.checksum  = g_htonl(~crc32c_calculate(&packet_buf[prefix_length], curr_offset, HDR_SCTP.checksum));
 664
 665             memcpy(&packet_buf[prefix_index], &HDR_SCTP, sizeof(HDR_SCTP));
 666             prefix_index += (int)sizeof(HDR_SCTP);
 667         }
 668
 669         /* Write DATA chunk header */
 670         if (hdr_data_chunk) {
 671             memcpy(&packet_buf[prefix_index], &HDR_DATA_CHUNK, sizeof(HDR_DATA_CHUNK));
 672             /*prefix_index += (int)sizeof(HDR_DATA_CHUNK);*/
 673         }
 674
 675         /* Write ExportPDU header */
 676         if (hdr_export_pdu) {
 677             unsigned payload_len = (unsigned)strlen(info_p->payload);
 678             HDR_EXPORT_PDU.tag_type = g_htons(EXP_PDU_TAG_DISSECTOR_NAME);
 679             HDR_EXPORT_PDU.payload_len = g_htons(payload_len);
 680             memcpy(&packet_buf[prefix_index], &HDR_EXPORT_PDU, sizeof(HDR_EXPORT_PDU));
 681             prefix_index += sizeof(HDR_EXPORT_PDU);
 682             memcpy(&packet_buf[prefix_index], info_p->payload, payload_len);
 683             prefix_index += payload_len;
 684             /* Add end-of-options tag */
 685             memset(&packet_buf[prefix_index], 0x00, 4);
 686         }
 687
 688         /* Write Ethernet trailer */
 689         if (hdr_ethernet && eth_trailer_length > 0) {
 690             memset(&packet_buf[prefix_length+curr_offset], 0, eth_trailer_length);
 691         }
 692
 693         HDR_TCP.seq_num = g_ntohl(HDR_TCP.seq_num) + curr_offset;
 694         HDR_TCP.seq_num = g_htonl(HDR_TCP.seq_num);
 695
 696         /* Write the packet */
 697         wtap_rec rec;
 698         int err;
 699         char *err_info;
 700
 701         memset(&rec, 0, sizeof rec);
 702
 703         if (info_p->encapsulation == WTAP_ENCAP_SYSTEMD_JOURNAL) {
 704             rec.rec_type = REC_TYPE_SYSTEMD_JOURNAL_EXPORT;
 705             rec.block = wtap_block_create(WTAP_BLOCK_SYSTEMD_JOURNAL_EXPORT);
 706             rec.rec_header.systemd_journal_export_header.record_len = prefix_length + curr_offset + eth_trailer_length;
 707             rec.presence_flags = WTAP_HAS_CAP_LEN|WTAP_HAS_TS;
 708             /* XXX: Ignore our direction, packet id, and timestamp. For a
 709              * systemd Journal Export Block the timestamp comes from the
 710              * __REALTIME_TIMESTAMP= field. We don't check to see if that
 711              * field is there (it MUST be, but we don't check whether our
 712              * input is malformed in general), but since the presence flags
 713              * aren't really used when writing, it doesn't matter.
 714              */
 715         } else {
 716             rec.rec_type = REC_TYPE_PACKET;
 717             rec.block = wtap_block_create(WTAP_BLOCK_PACKET);
 718             rec.rec_header.packet_header.caplen = rec.rec_header.packet_header.len = prefix_length + curr_offset + eth_trailer_length;
 719             rec.ts.secs = ts_sec;
 720             rec.ts.nsecs = ts_nsec;
 721             rec.rec_header.packet_header.pkt_encap = info_p->encapsulation;
 722             rec.presence_flags = WTAP_HAS_CAP_LEN|WTAP_HAS_INTERFACE_ID|WTAP_HAS_TS;
 723             if (has_direction) {
 724                 wtap_block_add_uint32_option(rec.block, OPT_PKT_FLAGS, direction);
 725             }
 726             if (has_seqno) {
 727                 wtap_block_add_uint64_option(rec.block, OPT_PKT_PACKETID, seqno);
 728             }
 729         }
 730
 731         if (!wtap_dump(info_p->wdh, &rec, packet_buf, &err, &err_info)) {
 732             report_cfile_write_failure(info_p->import_text_filename,
 733                     info_p->output_filename, err, err_info,
 734                     info_p->num_packets_read,
 735                     wtap_dump_file_type_subtype(info_p->wdh));
 736             wtap_block_unref(rec.block);
 737             return IMPORT_FAILURE;
 738         }
 739         wtap_block_unref(rec.block);
 740         info_p->num_packets_written++;
 741     }
 742
 743     packet_start += curr_offset;
 744     curr_offset = 0;
 745     return IMPORT_SUCCESS;
 746 }
 747
 748
 749 /*----------------------------------------------------------------------
 750  * Append a token to the packet preamble.
 751  */
 752 static import_status_t
 753 append_to_preamble(char *str)
 754 {
 755     size_t toklen;
 756
 757     if (packet_preamble_len != 0) {
 758         if (packet_preamble_len == PACKET_PREAMBLE_MAX_LEN)
 759             return IMPORT_SUCCESS;    /* no room to add more preamble */
 760             /* XXX: Just keep going? This is probably not a problem, unless
 761              * someone had >2000 bytes of whitespace before the timestamp... */
 762         /* Add a blank separator between the previous token and this token. */
 763         packet_preamble[packet_preamble_len++] = ' ';
 764     }
 765     if(str == NULL){
 766         report_failure("FATAL ERROR: str is NULL");
 767         return IMPORT_FAILURE;
 768     }
 769     toklen = strlen(str);
 770     if (toklen != 0) {
 771         if (packet_preamble_len + toklen > PACKET_PREAMBLE_MAX_LEN)
 772             return IMPORT_SUCCESS;    /* no room to add token to the preamble */
 773             /* XXX: Just keep going? This is probably not a problem, as above.*/
 774         (void) g_strlcpy(&packet_preamble[packet_preamble_len], str, PACKET_PREAMBLE_MAX_LEN);
 775         packet_preamble_len += (int) toklen;
 776         if (ws_log_get_level() >= LOG_LEVEL_NOISY) {
 777             char *c;
 778             char xs[PACKET_PREAMBLE_MAX_LEN];
 779             (void) g_strlcpy(xs, packet_preamble, PACKET_PREAMBLE_MAX_LEN);
 780             while ((c = strchr(xs, '\r')) != NULL) *c=' ';
 781             ws_noisy("[[append_to_preamble: \"%s\"]]", xs);
 782         }
 783     }
 784
 785     return IMPORT_SUCCESS;
 786 }
 787
 788 #define INVALID_VALUE (-1)
 789
 790 #define WHITESPACE_VALUE (-2)
 791
 792 /*
 793  * Information on how to parse any plainly encoded binary data
 794  *
 795  * one Unit is least_common_mmultiple(bits_per_char, 8) bits.
 796  */
 797 struct plain_decoding_data {
 798     const char* name;
 799     unsigned chars_per_unit;
 800     unsigned bytes_per_unit : 3; /* Internally a uint64_t is used to hold units */
 801     unsigned bits_per_char : 6;
 802     int8_t table[256];
 803 };
 804
 805 #define _INVALID_INIT2 INVALID_VALUE, INVALID_VALUE
 806 #define _INVALID_INIT4 _INVALID_INIT2, _INVALID_INIT2
 807 #define _INVALID_INIT8 _INVALID_INIT4, _INVALID_INIT4
 808 #define _INVALID_INIT16 _INVALID_INIT8, _INVALID_INIT8
 809 #define _INVALID_INIT32 _INVALID_INIT16, _INVALID_INIT16
 810 #define _INVALID_INIT64 _INVALID_INIT32, _INVALID_INIT32
 811 #define _INVALID_INIT128 _INVALID_INIT64, _INVALID_INIT64
 812 #define _INVALID_INIT256 _INVALID_INIT128, _INVALID_INIT128
 813
 814 #define INVALID_INIT _INVALID_INIT256
 815 // this is a gcc/clang extension:
 816 //    [0 ... 255] = INVALID_VALUE
 817
 818 #define WHITESPACE_INIT \
 819     [' '] = WHITESPACE_VALUE, \
 820     ['\t'] = WHITESPACE_VALUE, \
 821     ['\n'] = WHITESPACE_VALUE, \
 822     ['\v'] = WHITESPACE_VALUE, \
 823     ['\f'] = WHITESPACE_VALUE, \
 824     ['\r'] = WHITESPACE_VALUE
 825
 826
 827 /*
 828  * Some compilers warn about initializing the same subobject
 829  * more than once with designated initializers.
 830  *
 831  * We're doing that - INVALID_INIT iniitalizes everything to
 832  * INVALID_VALUE, but then we override selected elements -
 833  * but we know what we're doing, so just suppress that
 834  * warning.
 835  */
 836 DIAG_OFF_INIT_TWICE
 837
 838 const struct plain_decoding_data hex_decode_info = {
 839     .chars_per_unit = 2,
 840     .bytes_per_unit = 1,
 841     .bits_per_char = 4,
 842     .table = {
 843         INVALID_INIT,
 844         WHITESPACE_INIT,
 845         [':'] = WHITESPACE_VALUE,
 846         ['0'] = 0,1,2,3,4,5,6,7,8,9,
 847         ['A'] = 10,11,12,13,14,15,
 848         ['a'] = 10,11,12,13,14,15
 849     }
 850 };
 851
 852 const struct plain_decoding_data bin_decode_info = {
 853     .chars_per_unit = 8,
 854     .bytes_per_unit = 1,
 855     .bits_per_char = 1,
 856     .table = {
 857         INVALID_INIT,
 858         WHITESPACE_INIT,
 859         ['0'] = 0, 1
 860     }
 861 };
 862
 863 const struct plain_decoding_data oct_decode_info = {
 864     .chars_per_unit = 8,
 865     .bytes_per_unit = 3,
 866     .bits_per_char = 3,
 867     .table = {
 868         INVALID_INIT,
 869         WHITESPACE_INIT,
 870         ['0'] = 0,1,2,3,4,5,6,7
 871     }
 872 };
 873
 874 const struct plain_decoding_data base64_decode_info = {
 875     .chars_per_unit = 4,
 876     .bytes_per_unit = 3,
 877     .bits_per_char = 6,
 878     .table = {
 879         INVALID_INIT,
 880         WHITESPACE_INIT,
 881         ['A'] = 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,
 882         ['a'] = 26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,
 883         ['0'] = 52,53,54,55,56,57,58,59,60,61,
 884         ['+'] = 62,
 885         ['/'] = 63,
 886         ['='] = WHITESPACE_VALUE /* padding at the end, the decoder doesn't need this, so just ignores it */
 887     }
 888 };
 889
 890 DIAG_ON_INIT_TWICE
 891
 892 /*******************************************************************************
 893  * The modularized part of this mess, used by the wrapper around the regex
 894  * engine in text_import_regex.c to hook into this state-machine backend.
 895  *
 896  * Should the rest be modularized as well? Maybe, but then start with pcap2text.c
 897  */
 898
 899  /**
 900   * This function parses encoded data according to <encoding> into binary data.
 901   * It will continue until one of the following conditions is met:
 902   *    - src is depletetd
 903   *    - dest cannot hold another full unit of data
 904   *    - an invalid character is read
 905   * When this happens any complete bytes will be recovered from the remaining
 906   * possibly incomplete unit and stored to dest (there will be no incomplete unit
 907   * if dest is full). Any remaining bits will be discarded.
 908   * src and dest will be advanced to where parsing including this last incomplete
 909   * unit stopped.
 910   * If you want to continue parsing (meaning incomplete units were due to call
 911   * fragmentation and not actually due to EOT) you have to resume the parser at
 912   * *src_last_unit and dest - result % bytes_per_unit
 913   */
 914 static int parse_plain_data(unsigned char** src, const unsigned char* src_end,
 915     uint8_t** dest, const uint8_t* dest_end, const struct plain_decoding_data* encoding,
 916     unsigned char** src_last_unit) {
 917     int status = 1;
 918     int units = 0;
 919     /* unit buffer */
 920     uint64_t c_val = 0;
 921     unsigned c_chars = 0;
 922     /**
 923      * Src data   |- - -|- - -|- - -|- - -|- - -|- - -|- - -|- - -|
 924      * Bytes      |- - - - - - - -|- - - - - - - -|- - - - - - - -|
 925      * Units      |- - - - - - - - - - - - - - - - - - - - - - - -|
 926      */
 927     uint64_t val;
 928     int j;
 929     if (ws_log_get_level() >= LOG_LEVEL_NOISY) {
 930         char* debug_str = wmem_strndup(NULL, *src, (src_end-*src));
 931         ws_noisy("parsing data: %s", debug_str);
 932         wmem_free(NULL, debug_str);
 933     }
 934     while (*src < src_end && *dest + encoding->bytes_per_unit <= dest_end) {
 935         val = encoding->table[**src];
 936         switch (val) {
 937           case INVALID_VALUE:
 938             status = -1;
 939             goto remainder;
 940           case WHITESPACE_VALUE:
 941             ws_warning("Unexpected char %d in data", **src);
 942             break;
 943           default:
 944             c_val = c_val << encoding->bits_per_char | val;
 945             ++c_chars;
 946             /* another full unit */
 947             if (c_chars == encoding->chars_per_unit) {
 948                 ++units;
 949                 if (src_last_unit)
 950                     *src_last_unit = *src;
 951                 c_chars = 0;
 952                 for (j = encoding->bytes_per_unit; j > 0; --j) {
 953                     **dest = (char) (c_val >> (j * 8 - 8));
 954                     *dest += 1;
 955                 }
 956             }
 957         }
 958         *src += 1;
 959     }
 960 remainder:
 961     for (j = c_chars * encoding->bits_per_char; j >= 8; j -= 8) {
 962         **dest = (char) (c_val >> (j - 8));
 963         *dest += 1;
 964     }
 965     return status * units;
 966 }
 967
 968 void parse_data(unsigned char* start_field, unsigned char* end_field, enum data_encoding encoding) {
 969     uint8_t* dest = &packet_buf[curr_offset];
 970     uint8_t* dest_end = &packet_buf[info_p->max_frame_length];
 971
 972     const struct plain_decoding_data* table; /* should be further down */
 973     switch (encoding) {
 974       case ENCODING_PLAIN_HEX:
 975       case ENCODING_PLAIN_OCT:
 976       case ENCODING_PLAIN_BIN:
 977       case ENCODING_BASE64:
 978         /* const struct plain_decoding_data* table; // This can't be here because gcc says no */
 979         switch (encoding) {
 980           case ENCODING_PLAIN_HEX:
 981             table = &hex_decode_info;
 982             break;
 983           case ENCODING_PLAIN_OCT:
 984             table = &oct_decode_info;
 985             break;
 986           case ENCODING_PLAIN_BIN:
 987             table = &bin_decode_info;
 988             break;
 989           case ENCODING_BASE64:
 990             table = &base64_decode_info;
 991             break;
 992           default:
 993             return;
 994         }
 995         info_p->num_packets_read++;
 996         while (1) {
 997             parse_plain_data(&start_field, end_field, &dest, dest_end, table, NULL);
 998             curr_offset = (int) (dest - packet_buf);
 999             if (curr_offset == info_p->max_frame_length) {
1000                 write_current_packet(true);
1001                 dest = &packet_buf[curr_offset];
1002             } else
1003                 break;
1004         }
1005         break;
1006       default:
1007           ws_critical("not implemented/invalid encoding type");
1008           return;
1009     }
1010 }
1011
1012 #define setFlags(VAL, MASK, FLAGS) \
1013     ((VAL) & ~(MASK)) | ((FLAGS) & (MASK))
1014
1015 static void _parse_dir(const unsigned char* start_field, const unsigned char* end_field _U_, const char* in_indicator, const char* out_indicator, uint32_t* dir) {
1016
1017     for (; *in_indicator && *start_field != *in_indicator; ++in_indicator);
1018     if (*in_indicator) {
1019         *dir = setFlags(*dir, PACK_FLAGS_DIRECTION_MASK << PACK_FLAGS_DIRECTION_SHIFT, PACK_FLAGS_DIRECTION_INBOUND);
1020         return;
1021     }
1022     for (; *out_indicator && *start_field != *out_indicator; ++out_indicator);
1023     if (*out_indicator) {
1024         *dir = setFlags(*dir, PACK_FLAGS_DIRECTION_MASK << PACK_FLAGS_DIRECTION_SHIFT, PACK_FLAGS_DIRECTION_OUTBOUND);
1025         return;
1026     }
1027     *dir = setFlags(*dir, PACK_FLAGS_DIRECTION_MASK << PACK_FLAGS_DIRECTION_SHIFT, PACK_FLAGS_DIRECTION_UNKNOWN);
1028 }
1029
1030 void parse_dir(const unsigned char* start_field, const unsigned char* end_field, const char* in_indicator, const char* out_indicator) {
1031     _parse_dir(start_field, end_field, in_indicator, out_indicator, &direction);
1032 }
1033
1034 #define PARSE_BUF 64
1035
1036 /* Attempt to parse a time according to the given format. If the conversion
1037  * succeeds, set sec and nsec appropriately and return true. If it fails,
1038  * leave sec and nsec unchanged and return false.
1039  */
1040 static bool
1041 _parse_time(const unsigned char* start_field, const unsigned char* end_field, const char* _format, time_t* sec, int* nsec) {
1042     struct tm timecode;
1043     time_t sec_buf;
1044     int nsec_buf = 0;
1045
1046     char field[PARSE_BUF];
1047     char format[PARSE_BUF];
1048
1049     char* subsecs_fmt;
1050     int  subseclen = -1;
1051
1052     char *cursor;
1053     char *p;
1054     int  i;
1055
1056     (void) g_strlcpy(field, start_field, MIN(end_field - start_field + 1, PARSE_BUF));
1057     if (ts_fmt_iso) {
1058         nstime_t ts_iso;
1059         if (!iso8601_to_nstime(&ts_iso, field, ISO8601_DATETIME_AUTO)) {
1060             return false;
1061         }
1062         *sec = ts_iso.secs;
1063         *nsec = ts_iso.nsecs;
1064     } else {
1065         (void) g_strlcpy(format, _format, PARSE_BUF);
1066
1067         /*
1068          * Initialize to today, local time, just in case not all fields
1069          * of the date and time are specified.
1070          */
1071         timecode = timecode_default;
1072         cursor = &field[0];
1073
1074         /*
1075          * %f is for fractions of seconds not supported by strptime
1076          * BTW: what is this function name? is this some russian joke?
1077          */
1078         subsecs_fmt = g_strrstr(format, "%f");
1079         if (subsecs_fmt) {
1080             *subsecs_fmt = 0;
1081         }
1082
1083         cursor = ws_strptime_p(cursor, format, &timecode);
1084
1085         if (cursor == NULL) {
1086             return false;
1087         }
1088
1089         if (subsecs_fmt != NULL) {
1090             /*
1091              * Parse subsecs and any following format
1092              */
1093             nsec_buf = (unsigned) strtol(cursor, &p, 10);
1094             if (p == cursor) {
1095                 return false;
1096             }
1097
1098             subseclen = (int) (p - cursor);
1099             cursor = p;
1100             cursor = ws_strptime_p(cursor, subsecs_fmt + 2, &timecode);
1101             if (cursor == NULL) {
1102                 return false;
1103             }
1104         }
1105
1106         if (subseclen > 0) {
1107             /*
1108              * Convert that number to a number
1109              * of nanoseconds; if it's N digits
1110              * long, it's in units of 10^(-N) seconds,
1111              * so, to convert it to units of
1112              * 10^-9 seconds, we multiply by
1113              * 10^(9-N).
1114              */
1115             if (subseclen > SUBSEC_PREC) {
1116                 /*
1117                  * *More* than 9 digits; 9-N is
1118                  * negative, so we divide by
1119                  * 10^(N-9).
1120                  */
1121                 for (i = subseclen - SUBSEC_PREC; i != 0; i--)
1122                     nsec_buf /= 10;
1123             } else if (subseclen < SUBSEC_PREC) {
1124                 for (i = SUBSEC_PREC - subseclen; i != 0; i--)
1125                     nsec_buf *= 10;
1126             }
1127         }
1128
1129         if ( -1 == (sec_buf = mktime(&timecode)) ) {
1130             return false;
1131         }
1132
1133         *sec = sec_buf;
1134         *nsec = nsec_buf;
1135     }
1136
1137     ws_noisy("parsed time %s Format(%s), time(%u), subsecs(%u)\n", field, _format, (uint32_t)*sec, (uint32_t)*nsec);
1138
1139     return true;
1140 }
1141
1142 void parse_time(const unsigned char* start_field, const unsigned char* end_field, const char* format) {
1143     if (format == NULL || !_parse_time(start_field, end_field, format, &ts_sec, &ts_nsec)) {
1144         ts_nsec += ts_tick;
1145     }
1146 }
1147
1148 void parse_seqno(const unsigned char* start_field, const unsigned char* end_field) {
1149     char* buf = (char*) g_alloca(end_field - start_field + 1);
1150     (void) g_strlcpy(buf, start_field, end_field - start_field + 1);
1151     seqno = g_ascii_strtoull(buf, NULL, 10);
1152 }
1153
1154 void flush_packet(void) {
1155     write_current_packet(false);
1156 }
1157
1158 /*----------------------------------------------------------------------
1159  * Parse the preamble to get the timecode.
1160  */
1161
1162 static void
1163 parse_preamble (void)
1164 {
1165     int  i;
1166     bool got_time = false;
1167
1168     /*
1169      * Null-terminate the preamble.
1170      */
1171     packet_preamble[packet_preamble_len] = '\0';
1172
1173     if (has_direction) {
1174         _parse_dir(&packet_preamble[0], &packet_preamble[1], "iI", "oO", &direction);
1175         i = (direction == PACK_FLAGS_DIRECTION_UNKNOWN) ? 0 : 1;
1176         while (packet_preamble[i] == ' ' ||
1177                packet_preamble[i] == '\r' ||
1178                packet_preamble[i] == '\t') {
1179             i++;
1180         }
1181         packet_preamble_len -= i;
1182         /* Also move the trailing '\0'. */
1183         memmove(packet_preamble, packet_preamble + i, packet_preamble_len + 1);
1184     }
1185
1186     /*
1187      * If no time stamp format was specified, don't attempt to parse
1188      * the packet preamble to extract a time stamp.
1189      */
1190
1191     /* Ensure preamble has more than two chars before attempting to parse.
1192      * This should cover line breaks etc that get counted.
1193      */
1194     if ( info_p->timestamp_format != NULL && strlen(packet_preamble) > 2 ) {
1195         got_time = _parse_time(packet_preamble, packet_preamble + strlen(packet_preamble), info_p->timestamp_format, &ts_sec, &ts_nsec);
1196         if (!got_time) {
1197             /* Let's only have a possible GUI popup once, other messages to log
1198              */
1199             if (!timecode_warned) {
1200                 report_warning("Time conversions (%s) failed, advancing time by %d ns from previous packet on failure. First failure was for %s on input packet %d.", info_p->timestamp_format, ts_tick, packet_preamble, info_p->num_packets_read);
1201                 timecode_warned = true;
1202             }
1203             ws_warning("Time conversion (%s) failed for %s on input packet %d.", info_p->timestamp_format, packet_preamble, info_p->num_packets_read);
1204         }
1205     }
1206     if (ws_log_get_level() >= LOG_LEVEL_NOISY) {
1207         char *c;
1208         while ((c = strchr(packet_preamble, '\r')) != NULL) *c=' ';
1209         ws_noisy("[[parse_preamble: \"%s\"]]", packet_preamble);
1210         ws_noisy("Format(%s), time(%u), subsecs(%u)", info_p->timestamp_format, (uint32_t)ts_sec, ts_nsec);
1211     }
1212
1213     if (!got_time) {
1214         ts_nsec += ts_tick;
1215     }
1216
1217     /* Clear Preamble */
1218     packet_preamble_len = 0;
1219 }
1220
1221 /*----------------------------------------------------------------------
1222  * Start a new packet
1223  *
1224  * @param cont [IN] true if a new packet is starting because the max frame
1225  * length was reached on the current packet, and the original packet from the
1226  * input file is continued in a later frame. Passed to write_current_packet,
1227  * where it is used to set fragmentation fields in dummy headers (currently
1228  * only implemented for SCTP; IPv4 could be added later.)
1229  */
1230 static import_status_t
1231 start_new_packet(bool cont)
1232 {
1233     ws_debug("Start new packet (cont = %s).", cont ? "true" : "false");
1234
1235     /* Write out the current packet, if required */
1236     if (write_current_packet(cont) != IMPORT_SUCCESS)
1237         return IMPORT_FAILURE;
1238     info_p->num_packets_read++;
1239
1240     /* Ensure we parse the packet preamble as it may contain the time */
1241     /* THIS IMPLIES A STATE TRANSITION OUTSIDE THE STATE MACHINE */
1242     parse_preamble();
1243
1244     return IMPORT_SUCCESS;
1245 }
1246
1247 /*----------------------------------------------------------------------
1248  * Process a directive
1249  */
1250 static void
1251 process_directive (char *str _U_)
1252 {
1253     char **tokens;
1254     tokens = g_strsplit_set(str+10, "\r\n", 2);
1255     ws_message("--- Directive [%s] currently unsupported ---", tokens[0]);
1256     g_strfreev(tokens);
1257 }
1258
1259 /*----------------------------------------------------------------------
1260  * Parse a single token (called from the scanner)
1261  */
1262 import_status_t
1263 parse_token(token_t token, char *str)
1264 {
1265     uint32_t num;
1266     /* Variables for the hex+ASCII identification / lookback */
1267     int     by_eol;
1268     int     rollback = 0;
1269     int     line_size;
1270     int     i;
1271     char   *s2;
1272     char    tmp_str[3];
1273     char  **tokens;
1274
1275     /*
1276      * This is implemented as a simple state machine of five states.
1277      * State transitions are caused by tokens being received from the
1278      * scanner. The code should be self_documenting.
1279      */
1280
1281     if (ws_log_get_level() >= LOG_LEVEL_NOISY) {
1282         /* Sanitize - remove all '\r' */
1283         char *c;
1284         if (str!=NULL) { while ((c = strchr(str, '\r')) != NULL) *c=' '; }
1285
1286         ws_noisy("(%s, %s \"%s\") -> (",
1287                 state_str[state], token_str[token], str ? str : "");
1288     }
1289
1290     switch(state) {
1291
1292     /* ----- Waiting for new packet -------------------------------------------*/
1293     case INIT:
1294         switch(token) {
1295         case T_TEXT:
1296             append_to_preamble(str);
1297             break;
1298         case T_DIRECTIVE:
1299             process_directive(str);
1300             break;
1301         case T_OFFSET:
1302             if (offset_base == 0) {
1303                 append_to_preamble(str);
1304                 /* If we're still in the INIT state, maybe there's something
1305                  * odd like a time format with no separators. That wouldn't
1306                  * work in a mode with an offset, but give it a try.
1307                  */
1308                 tokens = g_strsplit_set(str, ": \t\r\n", 2);
1309                 if (!offset_warned) {
1310                     report_warning("Running in no offset mode but read offset (%s) at start of file, treating as preamble", tokens[0]);
1311                     offset_warned = true;
1312                 }
1313                 ws_warning("Running in no offset mode but read offset (%s) at start of file, treating as preamble", tokens[0]);
1314                 g_strfreev(tokens);
1315                 break;
1316             }
1317             if (parse_num(str, true, &num) != IMPORT_SUCCESS)
1318                 return IMPORT_FAILURE;
1319             if (num == 0) {
1320                 /* New packet starts here */
1321                 if (start_new_packet(false) != IMPORT_SUCCESS)
1322                     return IMPORT_FAILURE;
1323                 state = READ_OFFSET;
1324                 pkt_lnstart = packet_buf + num;
1325             }
1326             break;
1327         case T_BYTE:
1328             if (offset_base == 0) {
1329                 if (start_new_packet(false) != IMPORT_SUCCESS)
1330                     return IMPORT_FAILURE;
1331                 if (write_byte(str) != IMPORT_SUCCESS)
1332                     return IMPORT_FAILURE;
1333                 state = READ_BYTE;
1334                 pkt_lnstart = packet_buf;
1335             }
1336             break;
1337         case T_EOF:
1338             if (write_current_packet(false) != IMPORT_SUCCESS)
1339                 return IMPORT_FAILURE;
1340             break;
1341         default:
1342             break;
1343         }
1344         break;
1345
1346     /* ----- Processing packet, start of new line -----------------------------*/
1347     case START_OF_LINE:
1348         switch(token) {
1349         case T_TEXT:
1350             append_to_preamble(str);
1351             break;
1352         case T_DIRECTIVE:
1353             process_directive(str);
1354             break;
1355         case T_OFFSET:
1356             if (offset_base == 0) {
1357                 /* After starting the packet there's no point adding it to
1358                  * the preamble in this mode (we only do one packet.)
1359                  * Use a generic warning message to suppress the many
1360                  * expected duplicates. */
1361                 tokens = g_strsplit_set(str, ": \t\r\n", 2);
1362                 if (!offset_warned) {
1363                     report_warning("Running in no offset mode but read offset (%s) at start of line, ignoring", tokens[0]);
1364                     offset_warned = true;
1365                 }
1366                 ws_warning("Running in no offset mode but read offset (%s) at start of line, ignoring.", tokens[0]);
1367                 g_strfreev(tokens);
1368                 break;
1369             }
1370             if (parse_num(str, true, &num) != IMPORT_SUCCESS)
1371                 return IMPORT_FAILURE;
1372             if (num == 0) {
1373                 /* New packet starts here */
1374                 if (start_new_packet(false) != IMPORT_SUCCESS)
1375                     return IMPORT_FAILURE;
1376                 packet_start = 0;
1377                 state = READ_OFFSET;
1378             } else if ((num - packet_start) != curr_offset) {
1379                 /*
1380                  * The offset we read isn't the one we expected.
1381                  * This may only mean that we mistakenly interpreted
1382                  * some text as byte values (e.g., if the text dump
1383                  * of packet data included a number with spaces around
1384                  * it).  If the offset is less than what we expected,
1385                  * assume that's the problem, and throw away the putative
1386                  * extra byte values.
1387                  */
1388                 if (num < curr_offset) {
1389                     unwrite_bytes(curr_offset - num);
1390                     state = READ_OFFSET;
1391                 } else {
1392                     /* Bad offset; switch to INIT state */
1393                     ws_message("Inconsistent offset. Expecting %0X, got %0X. Ignoring rest of packet",
1394                                 curr_offset, num);
1395                     if (write_current_packet(false) != IMPORT_SUCCESS)
1396                         return IMPORT_FAILURE;
1397                     state = INIT;
1398                 }
1399             } else {
1400                 state = READ_OFFSET;
1401             }
1402             pkt_lnstart = packet_buf + num;
1403             break;
1404         case T_BYTE:
1405             if (offset_base == 0) {
1406                 if (write_byte(str) != IMPORT_SUCCESS)
1407                     return IMPORT_FAILURE;
1408                 state = READ_BYTE;
1409                 pkt_lnstart = packet_buf;
1410             }
1411             break;
1412         case T_EOF:
1413             if (write_current_packet(false) != IMPORT_SUCCESS)
1414                 return IMPORT_FAILURE;
1415             break;
1416         default:
1417             break;
1418         }
1419         break;
1420
1421     /* ----- Processing packet, read offset -----------------------------------*/
1422     case READ_OFFSET:
1423         switch(token) {
1424         case T_BYTE:
1425             /* Record the byte */
1426             state = READ_BYTE;
1427             if (write_byte(str) != IMPORT_SUCCESS)
1428                 return IMPORT_FAILURE;
1429             break;
1430         case T_TEXT:
1431         case T_DIRECTIVE:
1432         case T_OFFSET:
1433             state = READ_TEXT;
1434             break;
1435         case T_EOL:
1436             state = START_OF_LINE;
1437             break;
1438         case T_EOF:
1439             if (write_current_packet(false) != IMPORT_SUCCESS)
1440                 return IMPORT_FAILURE;
1441             break;
1442         default:
1443             break;
1444         }
1445         break;
1446
1447     /* ----- Processing packet, read byte -------------------------------------*/
1448     case READ_BYTE:
1449         switch(token) {
1450         case T_BYTE:
1451             /* Record the byte */
1452             if (write_byte(str) != IMPORT_SUCCESS)
1453                 return IMPORT_FAILURE;
1454             break;
1455         case T_TEXT:
1456         case T_DIRECTIVE:
1457         case T_OFFSET:
1458         case T_EOL:
1459             by_eol = 0;
1460             state = READ_TEXT;
1461             if (token == T_EOL) {
1462                 by_eol = 1;
1463                 state = START_OF_LINE;
1464             }
1465             if (info_p->hexdump.identify_ascii) {
1466                 /* Here a line of pkt bytes reading is finished
1467                    compare the ascii and hex to avoid such situation:
1468                    "61 62 20 ab ", when ab is ascii dump then it should
1469                    not be treat as byte */
1470                 rollback = 0;
1471                 /* s2 is the ASCII string, s1 is the HEX string, e.g, when
1472                    s2 = "ab ", s1 = "616220"
1473                    we should find out the largest tail of s1 matches the head
1474                    of s2, it means the matched part in tail is the ASCII dump
1475                    of the head byte. These matched should be rollback */
1476                 line_size = curr_offset-(int)(pkt_lnstart-packet_buf);
1477                 s2 = (char*)g_malloc((line_size+1)/4+1);
1478                 /* gather the possible pattern */
1479                 for (i = 0; i < (line_size+1)/4; i++) {
1480                     tmp_str[0] = pkt_lnstart[i*3];
1481                     tmp_str[1] = pkt_lnstart[i*3+1];
1482                     tmp_str[2] = '\0';
1483                     /* it is a valid convertible string */
1484                     if (!g_ascii_isxdigit(tmp_str[0]) || !g_ascii_isxdigit(tmp_str[1])) {
1485                         break;
1486                     }
1487                     s2[i] = (char)strtoul(tmp_str, (char **)NULL, 16);
1488                     rollback++;
1489                     /* the 3rd entry is not a delimiter, so the possible byte pattern will not shown */
1490                     if (!(pkt_lnstart[i*3+2] == ' ')) {
1491                         if (by_eol != 1)
1492                             rollback--;
1493                         break;
1494                     }
1495                 }
1496                 /* If packet line start contains possible byte pattern, the line end
1497                    should contain the matched pattern if the user open the -a flag.
1498                    The packet will be possible invalid if the byte pattern cannot find
1499                    a matched one in the line of packet buffer.*/
1500                 if (rollback > 0) {
1501                     if (strncmp(pkt_lnstart+line_size-rollback, s2, rollback) == 0) {
1502                         unwrite_bytes(rollback);
1503                     }
1504                     /* Not matched. This line contains invalid packet bytes, so
1505                        discard the whole line */
1506                     else {
1507                         unwrite_bytes(line_size);
1508                     }
1509                 }
1510                 g_free(s2);
1511             }
1512             break;
1513         case T_EOF:
1514             if (write_current_packet(false) != IMPORT_SUCCESS)
1515                 return IMPORT_FAILURE;
1516             break;
1517         default:
1518             break;
1519         }
1520         break;
1521
1522     /* ----- Processing packet, read text -------------------------------------*/
1523     case READ_TEXT:
1524         switch(token) {
1525         case T_EOL:
1526             state = START_OF_LINE;
1527             break;
1528         case T_EOF:
1529             if (write_current_packet(false) != IMPORT_SUCCESS)
1530                 return IMPORT_FAILURE;
1531             break;
1532         default:
1533             break;
1534         }
1535         break;
1536
1537     default:
1538         report_failure("FATAL ERROR: Bad state (%d)", state);
1539         return IMPORT_FAILURE;
1540     }
1541
1542     ws_noisy(", %s)", state_str[state]);
1543
1544     return IMPORT_SUCCESS;
1545 }
1546
1547 /*----------------------------------------------------------------------
1548  * Import a text file.
1549  */
1550 int
1551 text_import(text_import_info_t * const info)
1552 {
1553     import_status_t status;
1554     int ret;
1555     struct tm *now_tm;
1556
1557     /* Lets start from the beginning */
1558     state = INIT;
1559     curr_offset = 0;
1560     packet_start = 0;
1561     packet_preamble_len = 0;
1562     direction = PACK_FLAGS_DIRECTION_UNKNOWN;
1563     ts_sec = time(0);            /* initialize to current time */
1564     now_tm = localtime(&ts_sec);
1565     if (now_tm == NULL) {
1566         /*
1567          * This shouldn't happen - on UN*X, this should Just Work, and
1568          * on 32 bit Windows built with 32 bit time_t, it won't work if ts_sec
1569          * is before the Epoch, but it's long after 1970 (and even 32 bit
1570          * Windows builds with 64 bit time_t by default now), so....
1571          */
1572         report_failure("localtime(right now) failed");
1573         return WS_EXIT_INIT_FAILED;
1574     }
1575     timecode_default = *now_tm;
1576     timecode_default.tm_isdst = -1;     /* Unknown for now, depends on time given to the strptime() function */
1577     ts_nsec = 0;
1578
1579     /* Get input parameters. */
1580     info_p = info;
1581
1582     /* Dummy headers */
1583     hdr_ethernet = false;
1584     hdr_ip = false;
1585     hdr_udp = false;
1586     hdr_tcp = false;
1587     hdr_sctp = false;
1588     hdr_data_chunk = false;
1589     hdr_export_pdu = false;
1590
1591     if (info->mode == TEXT_IMPORT_HEXDUMP) {
1592         switch (info->hexdump.offset_type)
1593         {
1594             case OFFSET_NONE:
1595                 offset_base = 0;
1596                 break;
1597             case OFFSET_HEX:
1598                 offset_base = 16;
1599                 break;
1600             case OFFSET_OCT:
1601                 offset_base = 8;
1602                 break;
1603             case OFFSET_DEC:
1604                 offset_base = 10;
1605                 break;
1606         }
1607         has_direction = info->hexdump.has_direction;
1608
1609     } else if (info->mode == TEXT_IMPORT_REGEX) {
1610         has_direction = g_regex_get_string_number(info->regex.format, "dir") >= 0;
1611         has_seqno = g_regex_get_string_number(info->regex.format, "seqno") >= 0;
1612     }
1613
1614     if (info->timestamp_format == NULL || g_ascii_strcasecmp(info->timestamp_format, "ISO")) {
1615         ts_fmt_iso = false;
1616     } else {
1617         ts_fmt_iso = true;
1618     }
1619     offset_warned = false;
1620     timecode_warned = false;
1621
1622     /* XXX: It would be good to know the time precision of the file,
1623      * to use for the time delta for packets without timestamps. (ts_tick)
1624      * That could either be added to text_import_info_t or a method
1625      * added to get it from wtap_dumper (which is opaque.)
1626      */
1627
1628     switch (info->dummy_header_type)
1629     {
1630         case HEADER_ETH:
1631             hdr_ethernet = true;
1632             hdr_ethernet_proto = info->pid;
1633             break;
1634
1635         case HEADER_IPV4:
1636             hdr_ip = true;
1637             hdr_ip_proto = info->protocol;
1638             break;
1639
1640         case HEADER_UDP:
1641             hdr_udp = true;
1642             hdr_tcp = false;
1643             hdr_ip = true;
1644             hdr_ip_proto = 17;
1645             break;
1646
1647         case HEADER_TCP:
1648             hdr_tcp = true;
1649             hdr_udp = false;
1650             hdr_ip = true;
1651             hdr_ip_proto = 6;
1652             break;
1653
1654         case HEADER_SCTP:
1655             hdr_sctp = true;
1656             hdr_ip = true;
1657             hdr_ip_proto = 132;
1658             break;
1659
1660         case HEADER_SCTP_DATA:
1661             hdr_sctp = true;
1662             hdr_data_chunk = true;
1663             hdr_ip = true;
1664             hdr_ip_proto = 132;
1665             break;
1666
1667         case HEADER_EXPORT_PDU:
1668             hdr_export_pdu = true;
1669             break;
1670
1671         default:
1672             break;
1673     }
1674
1675     if (hdr_ip) {
1676         if (info->ipv6) {
1677             hdr_ipv6 = true;
1678             hdr_ip = false;
1679             hdr_ethernet_proto = 0x86DD;
1680         } else {
1681             hdr_ethernet_proto = 0x0800;
1682         }
1683
1684         switch (info->encapsulation) {
1685
1686         case (WTAP_ENCAP_ETHERNET):
1687             hdr_ethernet = true;
1688             break;
1689
1690         case (WTAP_ENCAP_RAW_IP):
1691             break;
1692
1693         case (WTAP_ENCAP_RAW_IP4):
1694             if (info->ipv6) {
1695                 report_failure("Encapsulation %s only supports IPv4 headers, not IPv6", wtap_encap_name(info->encapsulation));
1696                 return WS_EXIT_INVALID_OPTION;
1697             }
1698             break;
1699
1700         case (WTAP_ENCAP_RAW_IP6):
1701             if (!info->ipv6) {
1702                 report_failure("Encapsulation %s only supports IPv6 headers, not IPv4", wtap_encap_name(info->encapsulation));
1703                 return WS_EXIT_INVALID_OPTION;
1704             }
1705             break;
1706
1707         default:
1708             report_failure("Dummy IP header not supported with encapsulation: %s (%s)", wtap_encap_name(info->encapsulation), wtap_encap_description(info->encapsulation));
1709             return WS_EXIT_INVALID_OPTION;
1710         }
1711     }
1712
1713     info->num_packets_read = 0;
1714     info->num_packets_written = 0;
1715
1716     packet_buf = (uint8_t *)g_malloc(sizeof(HDR_ETHERNET) + sizeof(HDR_IP) +
1717                                     sizeof(HDR_SCTP) + sizeof(HDR_DATA_CHUNK) +
1718                                     sizeof(HDR_EXPORT_PDU) + WTAP_MAX_PACKET_SIZE_STANDARD);
1719
1720     if (!packet_buf)
1721     {
1722         /* XXX: This doesn't happen, because g_malloc aborts the program on
1723          * error, unlike malloc or g_try_malloc.
1724          */
1725         report_failure("FATAL ERROR: no memory for packet buffer");
1726         return WS_EXIT_INIT_FAILED;
1727     }
1728
1729     if (info->mode == TEXT_IMPORT_HEXDUMP) {
1730         status = text_import_scan(info->hexdump.import_text_FILE);
1731         switch(status) {
1732         case (IMPORT_SUCCESS):
1733             ret = 0;
1734             break;
1735         case (IMPORT_FAILURE):
1736             ret = WS_EXIT_INVALID_FILE;
1737             break;
1738         case (IMPORT_INIT_FAILED):
1739             report_failure("Can't initialize scanner: %s", g_strerror(errno));
1740             ret = WS_EXIT_INIT_FAILED;
1741             break;
1742         default:
1743             ret = 0;
1744         }
1745     } else if (info->mode == TEXT_IMPORT_REGEX) {
1746         ret = text_import_regex(info);
1747         if (ret > 0) {
1748             info->num_packets_read = ret;
1749             ret = 0;
1750         } else if (ret < 0) {
1751             ret = WS_EXIT_INVALID_FILE;
1752         }
1753     } else {
1754         ret = WS_EXIT_INVALID_OPTION;
1755     }
1756     g_free(packet_buf);
1757     return ret;
1758 }
1759
1760 /* Write the SHB and IDB to the wtap_dump_params before opening the wtap dump
1761  * file. While dummy headers can be written automatically, this writes out
1762  * some extra information including an optional interface name.
1763  */
1764 int
1765 text_import_pre_open(wtap_dump_params * const params, int file_type_subtype, const char* const input_filename, const char* const interface_name)
1766 {
1767     wtap_block_t shb_hdr;
1768     wtap_block_t int_data;
1769     wtapng_if_descr_mandatory_t *int_data_mand;
1770     char    *comment;
1771     GString *info_str;
1772
1773     if (wtap_file_type_subtype_supports_block(file_type_subtype, WTAP_BLOCK_SECTION) != BLOCK_NOT_SUPPORTED &&
1774         wtap_file_type_subtype_supports_option(file_type_subtype, WTAP_BLOCK_SECTION, OPT_COMMENT) != OPTION_NOT_SUPPORTED) {
1775
1776         shb_hdr = wtap_block_create(WTAP_BLOCK_SECTION);
1777
1778         comment = ws_strdup_printf("Generated from input file %s.", input_filename);
1779         wtap_block_add_string_option(shb_hdr, OPT_COMMENT, comment, strlen(comment));
1780         g_free(comment);
1781
1782         info_str = g_string_new("");
1783         get_cpu_info(info_str);
1784         if (info_str->str) {
1785             wtap_block_add_string_option(shb_hdr, OPT_SHB_HARDWARE, info_str->str, info_str->len);
1786         }
1787         g_string_free(info_str, TRUE);
1788
1789         info_str = g_string_new("");
1790         get_os_version_info(info_str);
1791         if (info_str->str) {
1792             wtap_block_add_string_option(shb_hdr, OPT_SHB_OS, info_str->str, info_str->len);
1793         }
1794         g_string_free(info_str, TRUE);
1795
1796         wtap_block_add_string_option_format(shb_hdr, OPT_SHB_USERAPPL, "%s", get_appname_and_version());
1797
1798         params->shb_hdrs = g_array_new(false, false, sizeof(wtap_block_t));
1799         g_array_append_val(params->shb_hdrs, shb_hdr);
1800     }
1801
1802     /* wtap_dump_init_dumper() will create a interface block if the file type
1803      * supports it and one isn't created already, but since we have the
1804      * option of including the interface name, create it ourself.
1805      *
1806      * (XXX: IDBs should be optional for wtap_dump_init_dumper(), e.g. if
1807      * the encap type is WTAP_ENCAP_SYSTEMD_JOURNAL, which doesn't use
1808      * interfaces. But it's not, so always create it here.)
1809      */
1810     if (wtap_file_type_subtype_supports_block(file_type_subtype, WTAP_BLOCK_IF_ID_AND_INFO) != BLOCK_NOT_SUPPORTED) {
1811         int_data = wtap_block_create(WTAP_BLOCK_IF_ID_AND_INFO);
1812         int_data_mand = (wtapng_if_descr_mandatory_t*)wtap_block_get_mandatory_data(int_data);
1813
1814         int_data_mand->wtap_encap = params->encap;
1815         int_data_mand->time_units_per_second = 1000000000;
1816         int_data_mand->snap_len = params->snaplen;
1817
1818         if (interface_name != NULL) {
1819             wtap_block_add_string_option(int_data, OPT_IDB_NAME, interface_name, strlen(interface_name));
1820         } else {
1821             wtap_block_add_string_option(int_data, OPT_IDB_NAME, "Fake IF, text2pcap", strlen("Fake IF, text2pcap"));
1822         }
1823         if (params->tsprec >= 0 && params->tsprec <= WS_TSPREC_MAX) {
1824             /*
1825              * This is a valid time precision.
1826              */
1827
1828             /*
1829              * Compute 10^{params->tsprec}.
1830              */
1831             int_data_mand->time_units_per_second = 1;
1832             for (int i = 0; i < params->tsprec; i++)
1833                 int_data_mand->time_units_per_second *= 10;
1834
1835             if (params->tsprec != WTAP_TSPREC_USEC) {
1836                 /*
1837                  * Microsecond precision is the default, so we only
1838                  * add an option if the precision isn't microsecond
1839                  * precision.
1840                  */
1841                 wtap_block_add_uint8_option(int_data, OPT_IDB_TSRESOL, params->tsprec);
1842             }
1843         } else {
1844             /*
1845              * Either WTAP_TSPREC_PER_PACKET, WTAP_TSPREC_UNKNOWN,
1846              * or not a valid precision.
1847              *
1848              * Don't do this.
1849              */
1850             ws_assert_not_reached();
1851         }
1852
1853         params->idb_inf = g_new(wtapng_iface_descriptions_t,1);
1854         params->idb_inf->interface_data = g_array_new(false, false, sizeof(wtap_block_t));
1855         g_array_append_val(params->idb_inf->interface_data, int_data);
1856
1857     }
1858
1859     return EXIT_SUCCESS;
1860 }