wiretap/snoop.c

   1 /* snoop.c
   2  *
   3  * Wiretap Library
   4  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8
   9 #include "config.h"
  10 #include "snoop.h"
  11
  12 #include <string.h>
  13 #include "wtap-int.h"
  14 #include "file_wrappers.h"
  15 #include "atm.h"
  16 #include <wsutil/802_11-utils.h>
  17 #include <wsutil/ws_roundup.h>
  18
  19 /* See RFC 1761 for a description of the "snoop" file format. */
  20
  21 typedef struct {
  22         bool is_shomiti;
  23 } snoop_t;
  24
  25 /* Magic number in "snoop" files. */
  26 static const char snoop_magic[] = {
  27         's', 'n', 'o', 'o', 'p', '\0', '\0', '\0'
  28 };
  29
  30 /* "snoop" file header (minus magic number). */
  31 struct snoop_hdr {
  32         uint32_t        version;        /* version number (should be 2) */
  33         uint32_t        network;        /* network type */
  34 };
  35
  36 /* "snoop" record header. */
  37 struct snooprec_hdr {
  38         uint32_t        orig_len;       /* actual length of packet */
  39         uint32_t        incl_len;       /* number of octets captured in file */
  40         uint32_t        rec_len;        /* length of record */
  41         uint32_t        cum_drops;      /* cumulative number of dropped packets */
  42         uint32_t        ts_sec;         /* timestamp seconds */
  43         uint32_t        ts_usec;        /* timestamp microseconds */
  44 };
  45
  46 /*
  47  * The link-layer header on ATM packets.
  48  */
  49 struct snoop_atm_hdr {
  50         uint8_t flags;          /* destination and traffic type */
  51         uint8_t vpi;            /* VPI */
  52         uint16_t        vci;            /* VCI */
  53 };
  54
  55 /*
  56  * Extra information stuffed into the padding in Shomiti/Finisar Surveyor
  57  * captures.
  58  */
  59 struct shomiti_trailer {
  60         uint16_t        phy_rx_length;  /* length on the wire, including FCS? */
  61         uint16_t        phy_rx_status;  /* status flags */
  62         uint32_t        ts_40_ns_lsb;   /* 40 ns time stamp, low-order bytes? */
  63         uint32_t        ts_40_ns_msb;   /* 40 ns time stamp, low-order bytes? */
  64         int32_t frame_id;       /* "FrameID"? */
  65 };
  66
  67 /*
  68  * phy_rx_status flags.
  69  */
  70 #define RX_STATUS_OVERFLOW              0x8000  /* overflow error */
  71 #define RX_STATUS_BAD_CRC               0x4000  /* CRC error */
  72 #define RX_STATUS_DRIBBLE_NIBBLE        0x2000  /* dribble/nibble bits? */
  73 #define RX_STATUS_SHORT_FRAME           0x1000  /* frame < 64 bytes */
  74 #define RX_STATUS_OVERSIZE_FRAME        0x0800  /* frame > 1518 bytes */
  75 #define RX_STATUS_GOOD_FRAME            0x0400  /* frame OK */
  76 #define RX_STATUS_N12_BYTES_RECEIVED    0x0200  /* first 12 bytes of frame received? */
  77 #define RX_STATUS_RXABORT               0x0100  /* RXABORT during reception */
  78 #define RX_STATUS_FIFO_ERROR            0x0080  /* receive FIFO error */
  79 #define RX_STATUS_TRIGGERED             0x0001  /* frame did trigger */
  80
  81 static bool snoop_read(wtap *wth, wtap_rec *rec, Buffer *buf,
  82     int *err, char **err_info, int64_t *data_offset);
  83 static bool snoop_seek_read(wtap *wth, int64_t seek_off,
  84     wtap_rec *rec, Buffer *buf, int *err, char **err_info);
  85 static int snoop_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
  86     Buffer *buf, int *err, char **err_info);
  87 static bool snoop_read_atm_pseudoheader(FILE_T fh,
  88     union wtap_pseudo_header *pseudo_header, int *err, char **err_info);
  89 static bool snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
  90     union wtap_pseudo_header *pseudo_header, int *err, char **err_info,
  91     int *header_size);
  92 static bool snoop_dump(wtap_dumper *wdh, const wtap_rec *rec,
  93     const uint8_t *pd, int *err, char **err_info);
  94
  95 static int snoop_file_type_subtype = -1;
  96 static int shomiti_file_type_subtype = -1;
  97
  98 void register_snoop(void);
  99
 100 /*
 101  * See
 102  *
 103  *      https://pubs.opengroup.org/onlinepubs/9638599/apdxf.htm
 104  *
 105  * for the "dlpi.h" header file specified by The Open Group, which lists
 106  * the DL_ values for various protocols; Solaris 7 uses the same values.
 107  *
 108  * See
 109  *
 110  *      https://www.iana.org/assignments/snoop-datalink-types
 111  *
 112  * for the IETF list of snoop datalink types.
 113  *
 114  * The page at
 115  *
 116  *      http://mrpink.lerc.nasa.gov/118x/support.html
 117  *
 118  * had links to modified versions of "tcpdump" and "libpcap" for SUNatm
 119  * DLPI support; they suggested that the 3.0 version of SUNatm uses those
 120  * values.  The Wayback Machine archived that page, but not the stuff
 121  * to which it linked, unfortunately.
 122  *
 123  * It also has a link to "convert.c", which is a program to convert files
 124  * from the format written by the "atmsnoop" program that comes with the
 125  * SunATM package to regular "snoop" format, claims that "SunATM 2.1 claimed
 126  * to be DL_FDDI (don't ask why).  SunATM 3.0 claims to be DL_IPATM, which
 127  * is 0x12".
 128  *
 129  * It also says that "ATM Mac header is 12 bytes long.", and seems to imply
 130  * that in an "atmsnoop" file, the header contains 2 bytes (direction and
 131  * VPI?), 2 bytes of VCI, 6 bytes of something, and 2 bytes of Ethernet
 132  * type; if those 6 bytes are 2 bytes of DSAP, 2 bytes of LSAP, 1 byte
 133  * of LLC control, and 3 bytes of SNAP OUI, that'd mean that an ATM
 134  * pseudo-header in an "atmsnoop" file is probably 1 byte of direction,
 135  * 1 byte of VPI, and 2 bytes of VCI.
 136  *
 137  * The aforementioned page also has a link to some capture files from
 138  * "atmsnoop"; this version of "snoop.c" appears to be able to read them.
 139  *
 140  * Source to an "atmdump" package, which includes a modified version of
 141  * "libpcap" to handle SunATM DLPI and an ATM driver for FreeBSD, and
 142  * also includes "atmdump", which is a modified "tcpdump", was available
 143  * at
 144  *
 145  *      ftp://ftp.cs.ndsu.nodak.edu/pub/freebsd/atm/atm-bpf.tgz
 146  *
 147  * (the host name is no longer valid) and that code also indicated that
 148  * DL_IPATM is used, and that an ATM packet handed up from the Sun driver
 149  * for the Sun SBus ATM card on Solaris 2.5.1 has 1 byte of direction,
 150  * 1 byte of VPI, 2 bytes of VCI, and then the ATM PDU, and suggests that
 151  * the direction flag is 0x80 for "transmitted" (presumably meaning
 152  * DTE->DCE) and presumably not 0x80 for "received" (presumably meaning
 153  * DCE->DTE).  That code was used as the basis for the SunATM support in
 154  * later versions of libpcap and tcpdump, and it worked at the time the
 155  * development was done with the SunATM code on the system on which the
 156  * development was done.
 157  *
 158  * In fact, the "direction" byte appears to have some other stuff, perhaps
 159  * a traffic type, in the lower 7 bits, with the 8th bit indicating the
 160  * direction.  That appears to be the case.
 161  *
 162  * I don't know what the encapsulation of any of the other types is, so I
 163  * leave them all as WTAP_ENCAP_UNKNOWN, except for those for which Brian
 164  * Ginsbach has supplied information about the way UNICOS/mp uses them.
 165  * I also don't know whether "snoop" can handle any of them (it presumably
 166  * can't handle ATM, otherwise Sun wouldn't have supplied "atmsnoop"; even
 167  * if it can't, this may be useful reference information for anybody doing
 168  * code to use DLPI to do raw packet captures on those network types.
 169  *
 170  *      https://web.archive.org/web/20010906213807/http://www.shomiti.com/support/TNCapFileFormat.htm
 171  *
 172  * gives information on Shomiti's mutant flavor of snoop.  For some unknown
 173  * reason, they decided not to just Go With The DLPI Flow, and instead used
 174  * the types unspecified in RFC 1461 for their own nefarious purposes, such
 175  * as distinguishing 10MB from 100MB from 1000MB Ethernet and distinguishing
 176  * 4MB from 16MB Token Ring, and distinguishing both of them from the
 177  * "Shomiti" versions of same.
 178  */
 179 wtap_open_return_val snoop_open(wtap *wth, int *err, char **err_info)
 180 {
 181         char magic[sizeof snoop_magic];
 182         struct snoop_hdr hdr;
 183         struct snooprec_hdr rec_hdr;
 184         unsigned padbytes;
 185         bool is_shomiti;
 186         static const int snoop_encap[] = {
 187                 WTAP_ENCAP_ETHERNET,    /* IEEE 802.3 */
 188                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.4 Token Bus */
 189                 WTAP_ENCAP_TOKEN_RING,
 190                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.6 Metro Net */
 191                 WTAP_ENCAP_ETHERNET,
 192                 WTAP_ENCAP_UNKNOWN,     /* HDLC */
 193                 WTAP_ENCAP_UNKNOWN,     /* Character Synchronous, e.g. bisync */
 194                 WTAP_ENCAP_UNKNOWN,     /* IBM Channel-to-Channel */
 195                 WTAP_ENCAP_FDDI_BITSWAPPED,
 196                 WTAP_ENCAP_NULL,        /* Other */
 197                 WTAP_ENCAP_UNKNOWN,     /* Frame Relay LAPF */
 198                 WTAP_ENCAP_UNKNOWN,     /* Multi-protocol over Frame Relay */
 199                 WTAP_ENCAP_UNKNOWN,     /* Character Async (e.g., SLIP and PPP?) */
 200                 WTAP_ENCAP_UNKNOWN,     /* X.25 Classical IP */
 201                 WTAP_ENCAP_NULL,        /* software loopback */
 202                 WTAP_ENCAP_UNKNOWN,     /* not defined in "dlpi.h" */
 203                 WTAP_ENCAP_IP_OVER_FC,  /* Fibre Channel */
 204                 WTAP_ENCAP_UNKNOWN,     /* ATM */
 205                 WTAP_ENCAP_ATM_PDUS,    /* ATM Classical IP */
 206                 WTAP_ENCAP_UNKNOWN,     /* X.25 LAPB */
 207                 WTAP_ENCAP_UNKNOWN,     /* ISDN */
 208                 WTAP_ENCAP_UNKNOWN,     /* HIPPI */
 209                 WTAP_ENCAP_UNKNOWN,     /* 100VG-AnyLAN Ethernet */
 210                 WTAP_ENCAP_UNKNOWN,     /* 100VG-AnyLAN Token Ring */
 211                 WTAP_ENCAP_UNKNOWN,     /* "ISO 8802/3 and Ethernet" */
 212                 WTAP_ENCAP_UNKNOWN,     /* 100BaseT (but that's just Ethernet) */
 213                 WTAP_ENCAP_IP_OVER_IB_SNOOP,    /* Infiniband */
 214         };
 215         #define NUM_SNOOP_ENCAPS array_length(snoop_encap)
 216         #define SNOOP_PRIVATE_BIT 0x80000000
 217         static const int snoop_private_encap[] = {
 218                 WTAP_ENCAP_UNKNOWN,     /* Not Used */
 219                 WTAP_ENCAP_UNKNOWN,     /* IPv4 Tunnel Link */
 220                 WTAP_ENCAP_UNKNOWN,     /* IPv6 Tunnel Link */
 221                 WTAP_ENCAP_UNKNOWN,     /* Virtual network interface */
 222                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.11 */
 223                 WTAP_ENCAP_IPNET,       /* ipnet(7D) link */
 224                 WTAP_ENCAP_UNKNOWN,     /* IPMP stub interface */
 225                 WTAP_ENCAP_UNKNOWN,     /* 6to4 Tunnel Link */
 226         };
 227         #define NUM_SNOOP_PRIVATE_ENCAPS array_length(snoop_private_encap)
 228         static const int shomiti_encap[] = {
 229                 WTAP_ENCAP_ETHERNET,    /* IEEE 802.3 */
 230                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.4 Token Bus */
 231                 WTAP_ENCAP_TOKEN_RING,
 232                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.6 Metro Net */
 233                 WTAP_ENCAP_ETHERNET,
 234                 WTAP_ENCAP_UNKNOWN,     /* HDLC */
 235                 WTAP_ENCAP_UNKNOWN,     /* Character Synchronous, e.g. bisync */
 236                 WTAP_ENCAP_UNKNOWN,     /* IBM Channel-to-Channel */
 237                 WTAP_ENCAP_FDDI_BITSWAPPED,
 238                 WTAP_ENCAP_UNKNOWN,     /* Other */
 239                 WTAP_ENCAP_ETHERNET,    /* Fast Ethernet */
 240                 WTAP_ENCAP_TOKEN_RING,  /* 4MB 802.5 token ring */
 241                 WTAP_ENCAP_ETHERNET,    /* Gigabit Ethernet */
 242                 WTAP_ENCAP_TOKEN_RING,  /* "IEEE 802.5 Shomiti" */
 243                 WTAP_ENCAP_TOKEN_RING,  /* "4MB IEEE 802.5 Shomiti" */
 244                 WTAP_ENCAP_UNKNOWN,     /* Other */
 245                 WTAP_ENCAP_UNKNOWN,     /* Other */
 246                 WTAP_ENCAP_UNKNOWN,     /* Other */
 247                 WTAP_ENCAP_IEEE_802_11_WITH_RADIO, /* IEEE 802.11 with Radio Header */
 248                 WTAP_ENCAP_ETHERNET,    /* 10 Gigabit Ethernet */
 249         };
 250         #define NUM_SHOMITI_ENCAPS array_length(shomiti_encap)
 251         int file_encap;
 252         int64_t saved_offset;
 253         snoop_t *snoop;
 254
 255         /* Read in the string that should be at the start of a "snoop" file */
 256         if (!wtap_read_bytes(wth->fh, magic, sizeof magic, err, err_info)) {
 257                 if (*err != WTAP_ERR_SHORT_READ)
 258                         return WTAP_OPEN_ERROR;
 259                 return WTAP_OPEN_NOT_MINE;
 260         }
 261
 262         if (memcmp(magic, snoop_magic, sizeof snoop_magic) != 0) {
 263                 return WTAP_OPEN_NOT_MINE;
 264         }
 265
 266         /* Read the rest of the header. */
 267         if (!wtap_read_bytes(wth->fh, &hdr, sizeof hdr, err, err_info))
 268                 return WTAP_OPEN_ERROR;
 269
 270         /*
 271          * Make sure it's a version we support.
 272          */
 273         hdr.version = g_ntohl(hdr.version);
 274         switch (hdr.version) {
 275
 276         case 2:         /* Solaris 2.x and later snoop, and Shomiti
 277                            Surveyor prior to 3.0, or 3.0 and later
 278                            with NDIS card */
 279         case 3:         /* Surveyor 3.0 and later, with Shomiti CMM2 hardware */
 280         case 4:         /* Surveyor 3.0 and later, with Shomiti GAM hardware */
 281         case 5:         /* Surveyor 3.0 and later, with Shomiti THG hardware */
 282                 break;
 283
 284         default:
 285                 *err = WTAP_ERR_UNSUPPORTED;
 286                 *err_info = ws_strdup_printf("snoop: version %u unsupported", hdr.version);
 287                 return WTAP_OPEN_ERROR;
 288         }
 289
 290         /*
 291          * Oh, this is lovely.
 292          *
 293          * I suppose Shomiti could give a bunch of lawyerly noise about
 294          * how "well, RFC 1761 said they were unassigned, and that's
 295          * the standard, not the DLPI header file, so it's perfectly OK
 296          * for us to use them, blah blah blah", but it's still irritating
 297          * as hell that they used the unassigned-in-RFC-1761 values for
 298          * their own purposes - especially given that Sun also used
 299          * one of them in atmsnoop.
 300          *
 301          * We can't determine whether it's a Shomiti capture based on
 302          * the version number, as, according to their documentation on
 303          * their capture file format, Shomiti uses a version number of 2
 304          * if the data "was captured using an NDIS card", which presumably
 305          * means "captured with an ordinary boring network card via NDIS"
 306          * as opposed to "captured with our whizzo special capture
 307          * hardware".
 308          *
 309          * The only way I can see to determine that is to check how much
 310          * padding there is in the first packet - if there's enough
 311          * padding for a Shomiti trailer, it's probably a Shomiti
 312          * capture, and otherwise, it's probably from Snoop.
 313          */
 314
 315         /*
 316          * Start out assuming it's not a Shomiti capture.
 317          */
 318         is_shomiti = false;
 319
 320         /* Read first record header. */
 321         saved_offset = file_tell(wth->fh);
 322         if (!wtap_read_bytes_or_eof(wth->fh, &rec_hdr, sizeof rec_hdr, err, err_info)) {
 323                 if (*err != 0)
 324                         return WTAP_OPEN_ERROR;
 325
 326                 /*
 327                  * The file ends after the record header, which means this
 328                  * is a capture with no packets.
 329                  *
 330                  * We assume it's a snoop file; the actual type of file is
 331                  * irrelevant, as there are no records in it, and thus no
 332                  * extra information if it's a Shomiti capture, and no
 333                  * link-layer headers whose type we have to know, and no
 334                  * Ethernet frames that might have an FCS.
 335                  */
 336         } else {
 337                 /*
 338                  * Compute the number of bytes of padding in the
 339                  * record.  If it's at least the size of a Shomiti
 340                  * trailer record, we assume this is a Shomiti
 341                  * capture.  (Some atmsnoop captures appear
 342                  * to have 4 bytes of padding, and at least one
 343                  * snoop capture appears to have 6 bytes of padding;
 344                  * the Shomiti header is larger than either of those.)
 345                  */
 346                 if (g_ntohl(rec_hdr.rec_len) >
 347                     (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len))) {
 348                         /*
 349                          * Well, we have padding; how much?
 350                          */
 351                         padbytes = g_ntohl(rec_hdr.rec_len) -
 352                             ((unsigned)sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
 353
 354                         /*
 355                          * Is it at least the size of a Shomiti trailer?
 356                          */
 357                         is_shomiti =
 358                             (padbytes >= sizeof (struct shomiti_trailer));
 359                 }
 360         }
 361
 362         /*
 363          * Seek back to the beginning of the first record.
 364          */
 365         if (file_seek(wth->fh, saved_offset, SEEK_SET, err) == -1)
 366                 return WTAP_OPEN_ERROR;
 367
 368         hdr.network = g_ntohl(hdr.network);
 369         if (is_shomiti) {
 370                 if (hdr.network >= NUM_SHOMITI_ENCAPS
 371                     || shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
 372                         *err = WTAP_ERR_UNSUPPORTED;
 373                         *err_info = ws_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
 374                             hdr.network);
 375                         return WTAP_OPEN_ERROR;
 376                 }
 377                 file_encap = shomiti_encap[hdr.network];
 378         } else if (hdr.network & SNOOP_PRIVATE_BIT) {
 379                 if ((hdr.network^SNOOP_PRIVATE_BIT) >= NUM_SNOOP_PRIVATE_ENCAPS
 380                     || snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT] == WTAP_ENCAP_UNKNOWN) {
 381                         *err = WTAP_ERR_UNSUPPORTED;
 382                         *err_info = ws_strdup_printf("snoop: private network type %u unknown or unsupported",
 383                             hdr.network);
 384                         return WTAP_OPEN_ERROR;
 385                 }
 386                 file_encap = snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT];
 387         } else {
 388                 if (hdr.network >= NUM_SNOOP_ENCAPS
 389                     || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
 390                         *err = WTAP_ERR_UNSUPPORTED;
 391                         *err_info = ws_strdup_printf("snoop: network type %u unknown or unsupported",
 392                             hdr.network);
 393                         return WTAP_OPEN_ERROR;
 394                 }
 395                 file_encap = snoop_encap[hdr.network];
 396         }
 397
 398         /*
 399          * We don't currently use the extra information in Shomiti
 400          * records, so we use the same routines to read snoop and
 401          * Shomiti files.
 402          */
 403         wth->file_type_subtype = is_shomiti ? shomiti_file_type_subtype : snoop_file_type_subtype;
 404         snoop = g_new0(snoop_t, 1);
 405         wth->priv = (void *)snoop;
 406         wth->subtype_read = snoop_read;
 407         wth->subtype_seek_read = snoop_seek_read;
 408         wth->file_encap = file_encap;
 409         wth->snapshot_length = 0;       /* not available in header */
 410         wth->file_tsprec = WTAP_TSPREC_USEC;
 411         snoop->is_shomiti = is_shomiti;
 412
 413         /*
 414          * Add an IDB; we don't know how many interfaces were
 415          * involved, so we just say one interface, about which
 416          * we only know the link-layer type, snapshot length,
 417          * and time stamp resolution.
 418          */
 419         wtap_add_generated_idb(wth);
 420
 421         return WTAP_OPEN_MINE;
 422 }
 423
 424 /*
 425  * XXX - pad[3] is the length of the header, not including
 426  * the length of the pad field; is it a 1-byte field, a 2-byte
 427  * field with pad[2] usually being 0, a 3-byte field with
 428  * pad[1] and pad[2] usually being 0, or a 4-byte field?
 429  *
 430  * If it's not a 4-byte field, is there anything significant
 431  * in the other bytes?
 432  *
 433  * Can the header length ever be less than 8, so that not
 434  * all the fields following pad are present?
 435  *
 436  * What's in undecrypt?  In captures I've seen, undecrypt[0]
 437  * is usually 0x00 but sometimes 0x02 or 0x06, and undecrypt[1]
 438  * is either 0x00 or 0x02.
 439  *
 440  * What's in preamble?  In captures I've seen, it's 0x00.
 441  *
 442  * What's in code?  In captures I've seen, it's 0x01 or 0x03.
 443  *
 444  * If the header is longer than 8 bytes, what are the other fields?
 445  */
 446 typedef struct {
 447         uint8_t pad[4];
 448         uint8_t undecrypt[2];
 449         uint8_t rate;
 450         uint8_t preamble;
 451         uint8_t code;
 452         uint8_t signal;
 453         uint8_t qual;
 454         uint8_t channel;
 455 } shomiti_wireless_header;
 456
 457
 458 /* Read the next packet */
 459 static bool snoop_read(wtap *wth, wtap_rec *rec, Buffer *buf,
 460     int *err, char **err_info, int64_t *data_offset)
 461 {
 462         int     padbytes;
 463
 464         *data_offset = file_tell(wth->fh);
 465
 466         padbytes = snoop_read_packet(wth, wth->fh, rec, buf, err, err_info);
 467         if (padbytes == -1)
 468                 return false;
 469
 470         /*
 471          * Skip over the padding, if any.
 472          */
 473         if (padbytes != 0) {
 474                 if (!wtap_read_bytes(wth->fh, NULL, padbytes, err, err_info))
 475                         return false;
 476         }
 477
 478         return true;
 479 }
 480
 481 static bool
 482 snoop_seek_read(wtap *wth, int64_t seek_off,
 483     wtap_rec *rec, Buffer *buf, int *err, char **err_info)
 484 {
 485         if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 486                 return false;
 487
 488         if (snoop_read_packet(wth, wth->random_fh, rec, buf, err, err_info) == -1) {
 489                 if (*err == 0)
 490                         *err = WTAP_ERR_SHORT_READ;
 491                 return false;
 492         }
 493         return true;
 494 }
 495
 496 static int
 497 snoop_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
 498     Buffer *buf, int *err, char **err_info)
 499 {
 500         snoop_t *snoop = (snoop_t *)wth->priv;
 501         struct snooprec_hdr hdr;
 502         uint32_t rec_size;
 503         uint32_t        packet_size;
 504         uint32_t orig_size;
 505         int header_size;
 506
 507         /* Read record header. */
 508         if (!wtap_read_bytes_or_eof(fh, &hdr, sizeof hdr, err, err_info))
 509                 return -1;
 510
 511         rec_size = g_ntohl(hdr.rec_len);
 512         orig_size = g_ntohl(hdr.orig_len);
 513         packet_size = g_ntohl(hdr.incl_len);
 514         if (orig_size > WTAP_MAX_PACKET_SIZE_STANDARD) {
 515                 /*
 516                  * Probably a corrupt capture file; don't blow up trying
 517                  * to allocate space for an immensely-large packet.
 518                  */
 519                 *err = WTAP_ERR_BAD_FILE;
 520                 *err_info = ws_strdup_printf("snoop: File has %u-byte original length, bigger than maximum of %u",
 521                     orig_size, WTAP_MAX_PACKET_SIZE_STANDARD);
 522                 return -1;
 523         }
 524         if (packet_size > WTAP_MAX_PACKET_SIZE_STANDARD) {
 525                 /*
 526                  * Probably a corrupt capture file; don't blow up trying
 527                  * to allocate space for an immensely-large packet.
 528                  */
 529                 *err = WTAP_ERR_BAD_FILE;
 530                 *err_info = ws_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
 531                     packet_size, WTAP_MAX_PACKET_SIZE_STANDARD);
 532                 return -1;
 533         }
 534         if (packet_size > rec_size) {
 535                 /*
 536                  * Probably a corrupt capture file.
 537                  */
 538                 *err = WTAP_ERR_BAD_FILE;
 539                 *err_info = ws_strdup_printf("snoop: File has %u-byte packet, bigger than record size %u",
 540                     packet_size, rec_size);
 541                 return -1;
 542         }
 543
 544         switch (wth->file_encap) {
 545
 546         case WTAP_ENCAP_ATM_PDUS:
 547                 /*
 548                  * This is an ATM packet, so the first four bytes are
 549                  * the direction of the packet (transmit/receive), the
 550                  * VPI, and the VCI; read them and generate the
 551                  * pseudo-header from them.
 552                  */
 553                 if (packet_size < sizeof (struct snoop_atm_hdr)) {
 554                         /*
 555                          * Uh-oh, the packet isn't big enough to even
 556                          * have a pseudo-header.
 557                          */
 558                         *err = WTAP_ERR_BAD_FILE;
 559                         *err_info = ws_strdup_printf("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header",
 560                             packet_size);
 561                         return -1;
 562                 }
 563                 if (!snoop_read_atm_pseudoheader(fh, &rec->rec_header.packet_header.pseudo_header,
 564                     err, err_info))
 565                         return -1;      /* Read error */
 566
 567                 /*
 568                  * Don't count the pseudo-header as part of the packet.
 569                  */
 570                 rec_size -= (uint32_t)sizeof (struct snoop_atm_hdr);
 571                 orig_size -= (uint32_t)sizeof (struct snoop_atm_hdr);
 572                 packet_size -= (uint32_t)sizeof (struct snoop_atm_hdr);
 573                 break;
 574
 575         case WTAP_ENCAP_ETHERNET:
 576                 /*
 577                  * If this is a snoop file, we assume there's no FCS in
 578                  * this frame; if this is a Shomit file, we assume there
 579                  * is.  (XXX - or should we treat it a "maybe"?)
 580                  */
 581                 if (snoop->is_shomiti)
 582                         rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 4;
 583                 else
 584                         rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
 585                 break;
 586
 587         case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
 588                 if (packet_size < sizeof (shomiti_wireless_header)) {
 589                         /*
 590                          * Uh-oh, the packet isn't big enough to even
 591                          * have a pseudo-header.
 592                          */
 593                         *err = WTAP_ERR_BAD_FILE;
 594                         *err_info = ws_strdup_printf("snoop: Shomiti wireless file has a %u-byte packet, too small to have even a wireless pseudo-header",
 595                             packet_size);
 596                         return -1;
 597                 }
 598                 if (!snoop_read_shomiti_wireless_pseudoheader(fh,
 599                     &rec->rec_header.packet_header.pseudo_header, err, err_info, &header_size))
 600                         return -1;      /* Read error */
 601
 602                 /*
 603                  * Don't count the pseudo-header as part of the packet.
 604                  */
 605                 rec_size -= header_size;
 606                 orig_size -= header_size;
 607                 packet_size -= header_size;
 608                 break;
 609         }
 610
 611         rec->rec_type = REC_TYPE_PACKET;
 612         rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
 613         rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 614         rec->ts.secs = g_ntohl(hdr.ts_sec);
 615         rec->ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
 616         rec->rec_header.packet_header.caplen = packet_size;
 617         rec->rec_header.packet_header.len = orig_size;
 618
 619         if (rec_size < (sizeof hdr + packet_size)) {
 620                 /*
 621                  * What, *negative* padding?  Bogus.
 622                  */
 623                 *err = WTAP_ERR_BAD_FILE;
 624                 *err_info = ws_strdup_printf("snoop: File has %u-byte record with packet size of %u",
 625                     rec_size, packet_size);
 626                 return -1;
 627         }
 628
 629         /*
 630          * Read the packet data.
 631          */
 632         if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
 633                 return -1;      /* failed */
 634
 635         /*
 636          * If this is ATM LANE traffic, try to guess what type of LANE
 637          * traffic it is based on the packet contents.
 638          */
 639         if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
 640             rec->rec_header.packet_header.pseudo_header.atm.type == TRAF_LANE) {
 641                 atm_guess_lane_type(rec, ws_buffer_start_ptr(buf));
 642         }
 643
 644         return rec_size - ((unsigned)sizeof hdr + packet_size);
 645 }
 646
 647 static bool
 648 snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
 649     int *err, char **err_info)
 650 {
 651         struct snoop_atm_hdr atm_phdr;
 652         uint8_t vpi;
 653         uint16_t        vci;
 654
 655         if (!wtap_read_bytes(fh, &atm_phdr, sizeof atm_phdr, err, err_info))
 656                 return false;
 657
 658         vpi = atm_phdr.vpi;
 659         vci = pntoh16(&atm_phdr.vci);
 660
 661         /*
 662          * The lower 4 bits of the first byte of the header indicate
 663          * the type of traffic, as per the "atmioctl.h" header in
 664          * SunATM.
 665          */
 666         switch (atm_phdr.flags & 0x0F) {
 667
 668         case 0x01:      /* LANE */
 669                 pseudo_header->atm.aal = AAL_5;
 670                 pseudo_header->atm.type = TRAF_LANE;
 671                 break;
 672
 673         case 0x02:      /* RFC 1483 LLC multiplexed traffic */
 674                 pseudo_header->atm.aal = AAL_5;
 675                 pseudo_header->atm.type = TRAF_LLCMX;
 676                 break;
 677
 678         case 0x05:      /* ILMI */
 679                 pseudo_header->atm.aal = AAL_5;
 680                 pseudo_header->atm.type = TRAF_ILMI;
 681                 break;
 682
 683         case 0x06:      /* Signalling AAL */
 684                 pseudo_header->atm.aal = AAL_SIGNALLING;
 685                 pseudo_header->atm.type = TRAF_UNKNOWN;
 686                 break;
 687
 688         case 0x03:      /* MARS (RFC 2022) */
 689                 pseudo_header->atm.aal = AAL_5;
 690                 pseudo_header->atm.type = TRAF_UNKNOWN;
 691                 break;
 692
 693         case 0x04:      /* IFMP (Ipsilon Flow Management Protocol; see RFC 1954) */
 694                 pseudo_header->atm.aal = AAL_5;
 695                 pseudo_header->atm.type = TRAF_UNKNOWN; /* XXX - TRAF_IPSILON? */
 696                 break;
 697
 698         default:
 699                 /*
 700                  * Assume it's AAL5, unless it's VPI 0 and VCI 5, in which
 701                  * case assume it's AAL_SIGNALLING; we know nothing more
 702                  * about it.
 703                  *
 704                  * XXX - is this necessary?  Or are we guaranteed that
 705                  * all signalling traffic has a type of 0x06?
 706                  *
 707                  * XXX - is this guaranteed to be AAL5?  Or, if the type is
 708                  * 0x00 ("raw"), might it be non-AAL5 traffic?
 709                  */
 710                 if (vpi == 0 && vci == 5)
 711                         pseudo_header->atm.aal = AAL_SIGNALLING;
 712                 else
 713                         pseudo_header->atm.aal = AAL_5;
 714                 pseudo_header->atm.type = TRAF_UNKNOWN;
 715                 break;
 716         }
 717         pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
 718
 719         pseudo_header->atm.vpi = vpi;
 720         pseudo_header->atm.vci = vci;
 721         pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
 722
 723         /* We don't have this information */
 724         pseudo_header->atm.flags = 0;
 725         pseudo_header->atm.cells = 0;
 726         pseudo_header->atm.aal5t_u2u = 0;
 727         pseudo_header->atm.aal5t_len = 0;
 728         pseudo_header->atm.aal5t_chksum = 0;
 729
 730         return true;
 731 }
 732
 733 static bool
 734 snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
 735     union wtap_pseudo_header *pseudo_header, int *err, char **err_info,
 736     int *header_size)
 737 {
 738         shomiti_wireless_header whdr;
 739         int     rsize;
 740
 741         if (!wtap_read_bytes(fh, &whdr, sizeof whdr, err, err_info))
 742                 return false;
 743
 744         /* the 4th byte of the pad is actually a header length,
 745          * we've already read 8 bytes of it, and it must never
 746          * be less than 8.
 747          *
 748          * XXX - presumably that means that the header length
 749          * doesn't include the length field, as we've read
 750          * 12 bytes total.
 751          */
 752         if (whdr.pad[3] < 8) {
 753                 *err = WTAP_ERR_BAD_FILE;
 754                 *err_info = ws_strdup_printf("snoop: Header length in Surveyor record is %u, less than minimum of 8",
 755                     whdr.pad[3]);
 756                 return false;
 757         }
 758         /* Skip the header. */
 759         rsize = ((int) whdr.pad[3]) - 8;
 760         if (!wtap_read_bytes(fh, NULL, rsize, err, err_info))
 761                 return false;
 762
 763         memset(&pseudo_header->ieee_802_11, 0, sizeof(pseudo_header->ieee_802_11));
 764         pseudo_header->ieee_802_11.fcs_len = 4;
 765         pseudo_header->ieee_802_11.decrypted = false;
 766         pseudo_header->ieee_802_11.datapad = false;
 767         pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
 768         pseudo_header->ieee_802_11.has_channel = true;
 769         pseudo_header->ieee_802_11.channel = whdr.channel;
 770         pseudo_header->ieee_802_11.has_data_rate = true;
 771         pseudo_header->ieee_802_11.data_rate = whdr.rate;
 772         pseudo_header->ieee_802_11.has_signal_percent = true;
 773         pseudo_header->ieee_802_11.signal_percent = whdr.signal;
 774
 775         /*
 776          * We don't know they PHY, but we do have the data rate;
 777          * try to guess the PHY based on the data rate and channel.
 778          */
 779         if (RATE_IS_DSSS(pseudo_header->ieee_802_11.data_rate)) {
 780                 /* 11b */
 781                 pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11B;
 782                 pseudo_header->ieee_802_11.phy_info.info_11b.has_short_preamble = false;
 783         } else if (RATE_IS_OFDM(pseudo_header->ieee_802_11.data_rate)) {
 784                 /* 11a or 11g, depending on the band. */
 785                 if (CHAN_IS_BG(pseudo_header->ieee_802_11.channel)) {
 786                         /* 11g */
 787                         pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11G;
 788                         pseudo_header->ieee_802_11.phy_info.info_11g.has_mode = false;
 789                 } else {
 790                         /* 11a */
 791                         pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11A;
 792                         pseudo_header->ieee_802_11.phy_info.info_11a.has_channel_type = false;
 793                         pseudo_header->ieee_802_11.phy_info.info_11a.has_turbo_type = false;
 794                 }
 795         }
 796
 797         /* add back the header and don't forget the pad as well */
 798         *header_size = rsize + 8 + 4;
 799
 800         return true;
 801 }
 802
 803 static const int wtap_encap[] = {
 804         -1,             /* WTAP_ENCAP_UNKNOWN -> unsupported */
 805         0x04,           /* WTAP_ENCAP_ETHERNET -> DL_ETHER */
 806         0x02,           /* WTAP_ENCAP_TOKEN_RING -> DL_TPR */
 807         -1,             /* WTAP_ENCAP_SLIP -> unsupported */
 808         -1,             /* WTAP_ENCAP_PPP -> unsupported */
 809         0x08,           /* WTAP_ENCAP_FDDI -> DL_FDDI */
 810         0x08,           /* WTAP_ENCAP_FDDI_BITSWAPPED -> DL_FDDI */
 811         -1,             /* WTAP_ENCAP_RAW_IP -> unsupported */
 812         -1,             /* WTAP_ENCAP_ARCNET -> unsupported */
 813         -1,             /* WTAP_ENCAP_ARCNET_LINUX -> unsupported */
 814         -1,             /* WTAP_ENCAP_ATM_RFC1483 -> unsupported */
 815         -1,             /* WTAP_ENCAP_LINUX_ATM_CLIP -> unsupported */
 816         -1,             /* WTAP_ENCAP_LAPB -> unsupported*/
 817         0x12,           /* WTAP_ENCAP_ATM_PDUS -> DL_IPATM */
 818 };
 819 #define NUM_WTAP_ENCAPS array_length(wtap_encap)
 820
 821 /* Returns 0 if we could write the specified encapsulation type,
 822    an error indication otherwise. */
 823 static int snoop_dump_can_write_encap(int encap)
 824 {
 825         /* Per-packet encapsulations aren't supported. */
 826         if (encap == WTAP_ENCAP_PER_PACKET)
 827                 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
 828
 829         if (encap < 0 || (unsigned)encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
 830                 return WTAP_ERR_UNWRITABLE_ENCAP;
 831
 832         return 0;
 833 }
 834
 835 /* Returns true on success, false on failure; sets "*err" to an error code on
 836    failure */
 837 static bool snoop_dump_open(wtap_dumper *wdh, int *err, char **err_info _U_)
 838 {
 839         struct snoop_hdr file_hdr;
 840
 841         /* This is a snoop file */
 842         wdh->subtype_write = snoop_dump;
 843
 844         /* Write the file header. */
 845         if (!wtap_dump_file_write(wdh, &snoop_magic, sizeof snoop_magic, err))
 846                 return false;
 847
 848         /* current "snoop" format is 2 */
 849         file_hdr.version = g_htonl(2);
 850         file_hdr.network = g_htonl(wtap_encap[wdh->file_encap]);
 851         if (!wtap_dump_file_write(wdh, &file_hdr, sizeof file_hdr, err))
 852                 return false;
 853
 854         return true;
 855 }
 856
 857 /* Write a record for a packet to a dump file.
 858    Returns true on success, false on failure. */
 859 static bool snoop_dump(wtap_dumper *wdh,
 860         const wtap_rec *rec,
 861         const uint8_t *pd, int *err, char **err_info _U_)
 862 {
 863         const union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
 864         struct snooprec_hdr rec_hdr;
 865         int reclen;
 866         unsigned padlen;
 867         static const char zeroes[4] = {0};
 868         struct snoop_atm_hdr atm_hdr;
 869         int atm_hdrsize;
 870
 871         /* We can only write packet records. */
 872         if (rec->rec_type != REC_TYPE_PACKET) {
 873                 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
 874                 return false;
 875         }
 876
 877         /*
 878          * Make sure this packet doesn't have a link-layer type that
 879          * differs from the one for the file.
 880          */
 881         if (wdh->file_encap != rec->rec_header.packet_header.pkt_encap) {
 882                 *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
 883                 return false;
 884         }
 885
 886         if (wdh->file_encap == WTAP_ENCAP_ATM_PDUS)
 887                 atm_hdrsize = sizeof (struct snoop_atm_hdr);
 888         else
 889                 atm_hdrsize = 0;
 890
 891         /* Record length = header length plus data length... */
 892         reclen = (int)sizeof rec_hdr + rec->rec_header.packet_header.caplen + atm_hdrsize;
 893
 894
 895         /* ... plus enough bytes to pad it to a 4-byte boundary. */
 896         padlen = WS_ROUNDUP_4(reclen) - reclen;
 897         reclen += padlen;
 898
 899         /* Don't write anything we're not willing to read. */
 900         if (rec->rec_header.packet_header.caplen + atm_hdrsize > WTAP_MAX_PACKET_SIZE_STANDARD) {
 901                 *err = WTAP_ERR_PACKET_TOO_LARGE;
 902                 return false;
 903         }
 904
 905         rec_hdr.orig_len = g_htonl(rec->rec_header.packet_header.len + atm_hdrsize);
 906         rec_hdr.incl_len = g_htonl(rec->rec_header.packet_header.caplen + atm_hdrsize);
 907         rec_hdr.rec_len = g_htonl(reclen);
 908         rec_hdr.cum_drops = 0;
 909         rec_hdr.ts_sec = g_htonl(rec->ts.secs);
 910         rec_hdr.ts_usec = g_htonl(rec->ts.nsecs / 1000);
 911         if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof rec_hdr, err))
 912                 return false;
 913
 914         if (wdh->file_encap == WTAP_ENCAP_ATM_PDUS) {
 915                 /*
 916                  * Write the ATM header.
 917                  */
 918                 atm_hdr.flags =
 919                     (pseudo_header->atm.channel == 0) ? 0x80 : 0x00;
 920                 switch (pseudo_header->atm.aal) {
 921
 922                 case AAL_SIGNALLING:
 923                         /* Signalling AAL */
 924                         atm_hdr.flags |= 0x06;
 925                         break;
 926
 927                 case AAL_5:
 928                         switch (pseudo_header->atm.type) {
 929
 930                         case TRAF_LANE:
 931                                 /* LANE */
 932                                 atm_hdr.flags |= 0x01;
 933                                 break;
 934
 935                         case TRAF_LLCMX:
 936                                 /* RFC 1483 LLC multiplexed traffic */
 937                                 atm_hdr.flags |= 0x02;
 938                                 break;
 939
 940                         case TRAF_ILMI:
 941                                 /* ILMI */
 942                                 atm_hdr.flags |= 0x05;
 943                                 break;
 944                         }
 945                         break;
 946                 }
 947                 atm_hdr.vpi = (uint8_t) pseudo_header->atm.vpi;
 948                 atm_hdr.vci = g_htons(pseudo_header->atm.vci);
 949                 if (!wtap_dump_file_write(wdh, &atm_hdr, sizeof atm_hdr, err))
 950                         return false;
 951         }
 952
 953         if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
 954                 return false;
 955
 956         /* Now write the padding. */
 957         if (!wtap_dump_file_write(wdh, zeroes, padlen, err))
 958                 return false;
 959         return true;
 960 }
 961
 962 static const struct supported_block_type snoop_blocks_supported[] = {
 963         /*
 964          * We support packet blocks, with no comments or other options.
 965          */
 966         { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
 967 };
 968
 969 static const struct file_type_subtype_info snoop_info = {
 970         "Sun snoop", "snoop", "snoop", "cap",
 971         false, BLOCKS_SUPPORTED(snoop_blocks_supported),
 972         snoop_dump_can_write_encap, snoop_dump_open, NULL
 973 };
 974
 975 static const struct supported_block_type shomiti_blocks_supported[] = {
 976         /*
 977          * We support packet blocks, with no comments or other options.
 978          */
 979         { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
 980 };
 981
 982 static const struct file_type_subtype_info shomiti_info = {
 983         "Shomiti/Finisar Surveyor", "shomiti", "cap", NULL,
 984         false, BLOCKS_SUPPORTED(shomiti_blocks_supported),
 985         NULL, NULL, NULL
 986 };
 987
 988 void register_snoop(void)
 989 {
 990         snoop_file_type_subtype = wtap_register_file_type_subtype(&snoop_info);
 991         shomiti_file_type_subtype = wtap_register_file_type_subtype(&shomiti_info);
 992
 993         /*
 994          * Register names for backwards compatibility with the
 995          * wtap_filetypes table in Lua.
 996          */
 997         wtap_register_backwards_compatibility_lua_name("SNOOP",
 998             snoop_file_type_subtype);
 999         wtap_register_backwards_compatibility_lua_name("SHOMITI",
1000             shomiti_file_type_subtype);
1001 }
1002
1003 /*
1004  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
1005  *
1006  * Local variables:
1007  * c-basic-offset: 8
1008  * tab-width: 8
1009  * indent-tabs-mode: t
1010  * End:
1011  *
1012  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
1013  * :indentSize=8:tabSize=8:noTabs=false:
1014  */