| blob | 97b19b0538b82a7e318772e9404db530c61a8411 |
1 /* lanalyzer.c
2 *
3 * Wiretap Library
4 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
11 #define WS_LOG_DOMAIN LOG_DOMAIN_WIRETAP
14 #include <stdlib.h>
15 #include <errno.h>
19 /* The LANalyzer format is documented (at least in part) in Novell document
20 TID022037, which can be found at, among other places:
22 http://www.blacksheepnetworks.com/security/info/nw/lan/trace.txt
23 */
25 /* Record header format */
32 #define LA_RecordHeaderSize 4
34 /* Record type codes: */
36 #define RT_HeaderRegular 0x1001
37 #define RT_HeaderCyclic 0x1007
38 #define RT_RxChannelName 0x1006
39 #define RT_TxChannelName 0x100b
40 #define RT_FilterName 0x1032
41 #define RT_RxTemplateName 0x1035
42 #define RT_TxTemplateName 0x1036
43 #define RT_DisplayOptions 0x100a
44 #define RT_Summary 0x1002
45 #define RT_SubfileSummary 0x1003
46 #define RT_CyclicInformation 0x1009
47 #define RT_Index 0x1004
48 #define RT_PacketData 0x1005
50 #define LA_ProFileLimit (1024 * 1024 * 32)
55 /*
56 * These records have only 2-byte alignment for 4-byte quantities,
57 * so the structures aren't necessarily valid; they're kept as comments
58 * for reference purposes.
59 */
61 /*
62 * typedef struct {
63 * uint8_t day;
64 * uint8_t mon;
65 * int16_t year;
66 * } Date;
67 */
69 /*
70 * typedef struct {
71 * uint8_t second;
72 * uint8_t minute;
73 * uint8_t hour;
74 * uint8_t day;
75 * int16_t reserved;
76 * } Time;
77 */
79 /*
80 * RT_Summary:
81 *
82 * typedef struct {
83 * Date datcre;
84 * Date datclo;
85 * Time timeopn;
86 * Time timeclo;
87 * Eadr statadr;
88 * int16_t mxseqno;
89 * int16_t slcoff;
90 * int16_t mxslc;
91 * int32_t totpktt;
92 * int32_t statrg;
93 * int32_t stptrg;
94 * int32_t mxpkta[36];
95 * int16_t board_type;
96 * int16_t board_version;
97 * int8_t reserved[18];
98 * } Summary;
99 */
101 #define SummarySize (18+22+(4*36)+6+6+6+4+4)
103 /*
104 * typedef struct {
105 * int16_t rid;
106 * int16_t rlen;
107 * Summary s;
108 * } LA_SummaryRecord;
109 */
111 #define LA_SummaryRecordSize (SummarySize + 4)
113 /* LANalyzer board types (which indicate the type of network on which
114 the capture was done). */
119 /*
120 * typedef struct {
121 * int16_t rid;
122 * int16_t rlen;
123 * int16_t seqno;
124 * int32_t totpktf;
125 * } LA_SubfileSummaryRecord;
126 */
128 #define LA_SubfileSummaryRecordSize 10
131 #define LA_IndexSize 500
133 /*
134 * typedef struct {
135 * int16_t rid;
136 * int16_t rlen;
137 * int16_t idxsp; = LA_IndexSize
138 * int16_t idxct;
139 * int8_t idxgranu;
140 * int8_t idxvd;
141 * int32_t trcidx[LA_IndexSize + 2]; +2 undocumented but used by La 2.2
142 * } LA_IndexRecord;
143 */
145 #define LA_IndexRecordSize (10 + 4 * (LA_IndexSize + 2))
148 /*
149 * typedef struct {
150 * uint16_t rx_channels;
151 * uint16_t rx_errors;
152 * int16_t rx_frm_len;
153 * int16_t rx_frm_sln;
154 * TimeStamp rx_time;
155 * uint32_t pktno;
156 * int16_t prvlen;
157 * int16_t offset;
158 * int16_t tx_errs;
159 * int16_t rx_filters;
160 * int8_t unused[2];
161 * int16_t hwcolls;
162 * int16_t hwcollschans;
163 * Packetdata ....;
164 * } LA_PacketRecord;
165 */
167 #define LA_PacketRecordSize 32
171 nstime_t start;
183 };
195 };
202 };
216 };
223 };
244 };
250 };
257 };
275 {
276 LA_RecordHeader rec_header;
295 }
301 }
303 /* Read the major and minor version numbers */
305 /*
306 * Not enough room for the major and minor version numbers.
307 * Just treat that as a "not a LANalyzer file" indication.
308 */
310 }
316 }
320 /* Read the rest of the record as a comment. */
327 }
330 }
331 wtap_block_add_string_option(g_array_index(wth->shb_hdrs, wtap_block_t, 0), OPT_COMMENT, comment, record_length);
333 }
335 /*
336 * Read records until we find the start of packets.
337 * The document cited above claims that the first 11 records are
338 * in a particular sequence of types, but at least one capture
339 * doesn't have all the types listed in the order listed.
340 *
341 * If we don't have a summary record, we don't know the link-layer
342 * header type, so we can't read the file.
343 */
349 /*
350 * End of file and no packets;
351 * accept this file.
352 */
354 }
356 }
361 /*ws_message("Record 0x%04X Length %d", record_type, record_length);*/
363 /* Trace Summary Record */
368 record_length);
370 }
375 /* Assume that the date of the creation of the trace file
376 * is the same date of the trace. Lanalyzer doesn't
377 * store the creation date/time of the trace, but only of
378 * the file. Unless you traced at 11:55 PM and saved at 00:05
379 * AM, the assumption that trace.date == file.date is true.
380 */
384 /*ws_message("Day %d Month %d Year %d (%04X)", cr_day, cr_month,
385 cr_year, cr_year);*/
387 /* Get capture start time. I learned how to do
388 * this from Guy's code in ngsniffer.c
389 */
398 /*ws_message("Day %d Month %d Year %d", tm.tm_mday,
399 tm.tm_mon, tm.tm_year);*/
413 board_type);
415 }
421 }
424 /* Skip the rest of the record */
429 }
430 }
433 /* Trace Packet Data Record */
435 /* Go back header number of bytes so that lanalyzer_read
436 * can read this header */
439 }
443 /* Unknown record type - skip it */
446 }
448 }
449 }
451 done:
456 }
458 /* If we made it this far, then the file is a readable LANAlyzer file.
459 * Let's get some info from it. Note that we get wth->snapshot_length
460 * from a record later in the file. */
471 /*
472 * Add an IDB; we don't know how many interfaces were involved,
473 * so we just say one interface, about which we only know
474 * the link-layer type, snapshot length, and time stamp
475 * resolution.
476 */
480 }
482 #define DESCRIPTOR_LEN 32
486 {
498 /* read the record type and length. */
507 /* Only Trace Packet Data Records should occur now that we're in
508 * the middle of reading packets. If any other record type exists
509 * after a Trace Packet Data Record, mark it as an error. */
513 record_type);
515 }
518 /*
519 * Uh-oh, the record isn't big enough to even have a
520 * descriptor.
521 */
523 *err_info = ws_strdup_printf("lanalyzer: file has a %u-byte record, too small to have even a packet descriptor",
524 record_length);
526 }
529 /* Read the descriptor data */
535 /*
536 * The maximum value of packet_size is 65535, which is less than
537 * WTAP_MAX_PACKET_SIZE_STANDARD will ever be, so we don't need to check
538 * it.
539 */
541 /*
542 * OK, is the frame data size greater than what's left of the
543 * record?
544 */
546 /*
547 * Yes - treat this as an error.
548 */
552 }
569 /*
570 * It appears that the "true size" includes the FCS;
571 * make it reflect the non-FCS size (the "packet size"
572 * appears never to include the FCS, even if no slicing
573 * is done).
574 */
576 }
583 /* We assume there's no FCS in this frame. */
586 }
588 /* Read the packet data */
590 }
592 /* Read the next packet */
595 {
598 /* Read the record */
600 err_info);
601 }
605 {
609 /* Read the record */
615 }
617 }
619 /*---------------------------------------------------
620 * Returns true on success, false on error
621 * Write "cnt" bytes of zero with error control
622 *---------------------------------------------------*/
624 {
633 }
635 }
637 /*---------------------------------------------------
638 * Returns true on success, false on error
639 * Write an 8-bit value
640 *---------------------------------------------------*/
642 {
644 }
645 /*---------------------------------------------------
646 * Returns true on success, false on error
647 * Write a 16-bit value as little-endian
648 *---------------------------------------------------*/
650 {
653 }
654 /*---------------------------------------------------
655 * Returns true on success, false on error
656 * Write a 32-bit value as little-endian
657 *---------------------------------------------------*/
659 {
662 }
663 /*---------------------------------------------------
664 * Returns true on success, false on error
665 * Write a 48-bit value as little-endian
666 *---------------------------------------------------*/
668 {
669 #if G_BYTE_ORDER == G_BIG_ENDIAN
672 #else
675 #endif
678 }
679 /*---------------------------------------------------
680 * Write a record for a packet to a dump file.
681 * Returns true on success, false on failure.
682 *---------------------------------------------------*/
686 {
691 nstime_t td;
692 int thisSize = rec->rec_header.packet_header.caplen + LA_PacketRecordSize + LA_RecordHeaderSize;
694 /* We can only write packet records. */
698 }
700 /*
701 * Make sure this packet doesn't have a link-layer type that
702 * differs from the one for the file.
703 */
707 }
710 /* printf(" LA_ProFileLimit reached\n"); */
713 }
715 len = rec->rec_header.packet_header.caplen + (rec->rec_header.packet_header.caplen ? LA_PacketRecordSize : 0);
717 /* len goes into a 16-bit field, so there's a hard limit of 65535. */
721 }
729 /* collect some information for the
730 * finally written header
731 */
737 }
743 if (!s16write(wdh, (uint16_t) (rec->rec_header.packet_header.len + 4), err)) /* pr.rx_frm_len */
750 /* Convert to half-microseconds, rounded up. */
770 }
772 /*---------------------------------------------------
773 * Returns 0 if we could write the specified encapsulation type,
774 * an error indication otherwise.
775 *---------------------------------------------------*/
777 {
778 /* Per-packet encapsulations aren't supported. */
785 /*
786 * printf("lanalyzer_dump_can_write_encap(%d)\n",encap);
787 */
789 }
791 /*---------------------------------------------------
792 * Returns true on success, false on failure; sets "*err" to an
793 * error code on failure
794 *---------------------------------------------------*/
796 {
804 }
811 /* Some of the fields in the file header aren't known yet so
812 just skip over it for now. It will be created after all
813 of the packets have been written. */
821 + LA_SummaryRecordSize
822 + LA_SubfileSummaryRecordSize
831 }
833 /*---------------------------------------------------
834 *
835 *---------------------------------------------------*/
837 {
869 /*-----------------------------------------------------------------*/
916 /*
917 * statrg == 0; ? -1
918 * stptrg == 0; ? -1
919 * s.mxpkta[0]=0
920 */
931 /*-----------------------------------------------------------------*/
940 /*-----------------------------------------------------------------*/
944 /*-----------------------------------------------------------------*/
955 }
957 /*---------------------------------------------------
958 * Finish writing to a dump file.
959 * Returns true on success, false on failure.
960 *---------------------------------------------------*/
963 {
964 /* bytes_dumped already accounts for the size of the header,
965 * but lanalyzer_dump_header() (via wtap_dump_file_write())
966 * will keep incrementing it.
967 */
972 }
975 /*
976 * We support packet blocks, with no comments or other options.
977 */
979 };
985 };
988 {
991 /*
992 * Register name for backwards compatibility with the
993 * wtap_filetypes table in Lua.
994 */
996 lanalyzer_file_type_subtype);
997 }
999 /*
1000 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1001 *
1002 * Local variables:
1003 * c-basic-offset: 6
1004 * tab-width: 8
1005 * indent-tabs-mode: nil
1006 * End:
1007 *
1008 * vi: set shiftwidth=6 tabstop=8 expandtab:
1009 * :indentSize=6:tabSize=8:noTabs=true:
1010 */