wiretap/eyesdn.c

   1 /* eyesdn.c
   2  *
   3  * Wiretap Library
   4  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8
   9 #include "config.h"
  10 #include "eyesdn.h"
  11 #include "wtap-int.h"
  12 #include "file_wrappers.h"
  13
  14 #include <stdlib.h>
  15 #include <string.h>
  16
  17 static int eyesdn_file_type_subtype = -1;
  18
  19 void register_eyesdn(void);
  20
  21 /* This module reads the output of the EyeSDN USB S0/E1 ISDN probes
  22  * They store HDLC frames of D and B channels in a binary format
  23  * The fileformat is
  24  *
  25  * 1-6 Byte: EyeSDN - Magic
  26  * 7-n Byte: Frames
  27  *
  28  * Each Frame starts with the 0xff Flag byte
  29  * - Bytes 0-2: timestamp (usec in network byte order)
  30  * - Bytes 3-7: timestamp (40bits sec since 1970 in network byte order)
  31  * - Byte 8: channel (0 for D channel, 1-30 for B1-B30)
  32  * - Byte 9: Sender Bit 0(0 NT, 1 TE), Protocol in Bits 7:1, see enum
  33  * - Byte 10-11: frame size in bytes
  34  * - Byte 12-n: Frame Payload
  35  *
  36  * All multibyte values are represented in network byte order
  37  * The frame is terminated with a flag character (0xff)
  38  * bytes 0xff within a frame are escaped using the 0xfe escape character
  39  * the byte following the escape character is decremented by two:
  40  * so 0xfe 0xfd is actually a 0xff
  41  * Characters that need to be escaped are 0xff and 0xfe
  42  */
  43
  44
  45 static bool esc_read(FILE_T fh, uint8_t *buf, int len, int *err, char **err_info)
  46 {
  47         int i;
  48         int value;
  49
  50         for(i=0; i<len; i++) {
  51                 value=file_getc(fh);
  52                 if(value==-1) {
  53                         /* EOF or error */
  54                         *err=file_error(fh, err_info);
  55                         if(*err==0)
  56                                 *err=WTAP_ERR_SHORT_READ;
  57                         return false;
  58                 }
  59                 if(value==0xff) {
  60                         /* error !!, read into next frame */
  61                         *err=WTAP_ERR_BAD_FILE;
  62                         *err_info=g_strdup("eyesdn: No flag character seen in frame");
  63                         return false;
  64                 }
  65                 if(value==0xfe) {
  66                         /* we need to escape */
  67                         value=file_getc(fh);
  68                         if(value==-1) {
  69                                 /* EOF or error */
  70                                 *err=file_error(fh, err_info);
  71                                 if(*err==0)
  72                                         *err=WTAP_ERR_SHORT_READ;
  73                                 return false;
  74                         }
  75                         value+=2;
  76                 }
  77                 buf[i]=value;
  78         }
  79
  80         return true;
  81 }
  82
  83 /* Magic text to check for eyesdn-ness of file */
  84 static const unsigned char eyesdn_hdr_magic[]  =
  85 { 'E', 'y', 'e', 'S', 'D', 'N'};
  86 #define EYESDN_HDR_MAGIC_SIZE  sizeof(eyesdn_hdr_magic)
  87
  88 /* Size of a record header */
  89 #define EYESDN_HDR_LENGTH               12
  90
  91 static bool eyesdn_read(wtap *wth, wtap_rec *rec, Buffer *buf,
  92         int *err, char **err_info, int64_t *data_offset);
  93 static bool eyesdn_seek_read(wtap *wth, int64_t seek_off,
  94         wtap_rec *rec, Buffer *buf, int *err, char **err_info);
  95 static bool read_eyesdn_rec(FILE_T fh, wtap_rec *rec, Buffer* buf,
  96         int *err, char **err_info);
  97
  98 /* Seeks to the beginning of the next packet, and returns the
  99    byte offset.  Returns -1 on failure, and sets "*err" to the error
 100    and "*err_info" to null or an additional error string. */
 101 static int64_t eyesdn_seek_next_packet(wtap *wth, int *err, char **err_info)
 102 {
 103         int byte;
 104         int64_t cur_off;
 105
 106         while ((byte = file_getc(wth->fh)) != EOF) {
 107                 if (byte == 0xff) {
 108                         cur_off = file_tell(wth->fh);
 109                         if (cur_off == -1) {
 110                                 /* Error. */
 111                                 *err = file_error(wth->fh, err_info);
 112                                 return -1;
 113                         }
 114                         return cur_off;
 115                 }
 116         }
 117         /* EOF or error. */
 118         *err = file_error(wth->fh, err_info);
 119         return -1;
 120 }
 121
 122 wtap_open_return_val eyesdn_open(wtap *wth, int *err, char **err_info)
 123 {
 124         char    magic[EYESDN_HDR_MAGIC_SIZE];
 125
 126         /* Look for eyesdn header */
 127         if (!wtap_read_bytes(wth->fh, &magic, sizeof magic, err, err_info)) {
 128                 if (*err != WTAP_ERR_SHORT_READ)
 129                         return WTAP_OPEN_ERROR;
 130                 return WTAP_OPEN_NOT_MINE;
 131         }
 132         if (memcmp(magic, eyesdn_hdr_magic, EYESDN_HDR_MAGIC_SIZE) != 0)
 133                 return WTAP_OPEN_NOT_MINE;
 134
 135         wth->file_encap = WTAP_ENCAP_PER_PACKET;
 136         wth->file_type_subtype = eyesdn_file_type_subtype;
 137         wth->snapshot_length = 0; /* not known */
 138         wth->subtype_read = eyesdn_read;
 139         wth->subtype_seek_read = eyesdn_seek_read;
 140         wth->file_tsprec = WTAP_TSPREC_USEC;
 141
 142         return WTAP_OPEN_MINE;
 143 }
 144
 145 /* Find the next record and parse it; called from wtap_read(). */
 146 static bool eyesdn_read(wtap *wth, wtap_rec *rec, Buffer *buf,
 147     int *err, char **err_info, int64_t *data_offset)
 148 {
 149         int64_t offset;
 150
 151         /* Find the next record */
 152         offset = eyesdn_seek_next_packet(wth, err, err_info);
 153         if (offset < 1)
 154                 return false;
 155         *data_offset = offset;
 156
 157         /* Parse the record */
 158         return read_eyesdn_rec(wth->fh, rec, buf, err, err_info);
 159 }
 160
 161 /* Used to read packets in random-access fashion */
 162 static bool
 163 eyesdn_seek_read(wtap *wth, int64_t seek_off, wtap_rec *rec,
 164         Buffer *buf, int *err, char **err_info)
 165 {
 166         if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 167                 return false;
 168
 169         return read_eyesdn_rec(wth->random_fh, rec, buf, err, err_info);
 170 }
 171
 172 /* Parses a record. */
 173 static bool
 174 read_eyesdn_rec(FILE_T fh, wtap_rec *rec, Buffer *buf, int *err,
 175     char **err_info)
 176 {
 177         union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
 178         uint8_t         hdr[EYESDN_HDR_LENGTH];
 179         time_t          secs;
 180         int             usecs;
 181         unsigned        pkt_len;
 182         uint8_t         channel, direction;
 183         uint8_t         *pd;
 184
 185         /* Our file pointer should be at the summary information header
 186          * for a packet. Read in that header and extract the useful
 187          * information.
 188          */
 189         if (!esc_read(fh, hdr, EYESDN_HDR_LENGTH, err, err_info))
 190                 return false;
 191
 192         /* extract information from header */
 193         usecs = pntoh24(&hdr[0]);
 194 #ifdef TV64BITS
 195         secs = hdr[3];
 196 #else
 197         secs = 0;
 198 #endif
 199         secs = (secs << 8) | hdr[4];
 200         secs = (secs << 8) | hdr[5];
 201         secs = (secs << 8) | hdr[6];
 202         secs = (secs << 8) | hdr[7];
 203
 204         channel = hdr[8];
 205         direction = hdr[9];
 206         pkt_len = pntoh16(&hdr[10]);
 207
 208         switch(direction >> 1) {
 209
 210         default:
 211         case EYESDN_ENCAP_ISDN: /* ISDN */
 212                 pseudo_header->isdn.uton = direction & 1;
 213                 pseudo_header->isdn.channel = channel;
 214                 if(channel) { /* bearer channels */
 215                         rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_ISDN; /* recognises PPP */
 216                         pseudo_header->isdn.uton=!pseudo_header->isdn.uton; /* bug */
 217                 } else { /* D channel */
 218                         rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_ISDN;
 219                 }
 220                 break;
 221
 222         case EYESDN_ENCAP_MSG: /* Layer 1 message */
 223                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_LAYER1_EVENT;
 224                 pseudo_header->l1event.uton = (direction & 1);
 225                 break;
 226
 227         case EYESDN_ENCAP_LAPB: /* X.25 via LAPB */
 228                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_LAPB;
 229                 pseudo_header->dte_dce.flags = (direction & 1) ? 0 : 0x80;
 230                 break;
 231
 232         case EYESDN_ENCAP_ATM: { /* ATM cells */
 233 #define CELL_LEN 53
 234                 unsigned char cell[CELL_LEN];
 235                 int64_t cur_off;
 236
 237                 if(pkt_len != CELL_LEN) {
 238                         *err = WTAP_ERR_BAD_FILE;
 239                         *err_info = ws_strdup_printf(
 240                             "eyesdn: ATM cell has a length != 53 (%u)",
 241                             pkt_len);
 242                         return false;
 243                 }
 244
 245                 cur_off = file_tell(fh);
 246                 if (!esc_read(fh, cell, CELL_LEN, err, err_info))
 247                         return false;
 248                 if (file_seek(fh, cur_off, SEEK_SET, err) == -1)
 249                         return false;
 250                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_ATM_PDUS_UNTRUNCATED;
 251                 pseudo_header->atm.flags=ATM_RAW_CELL;
 252                 pseudo_header->atm.aal=AAL_UNKNOWN;
 253                 pseudo_header->atm.type=TRAF_UMTS_FP;
 254                 pseudo_header->atm.subtype=TRAF_ST_UNKNOWN;
 255                 pseudo_header->atm.vpi=((cell[0]&0xf)<<4) + (cell[0]&0xf);
 256                 pseudo_header->atm.vci=((cell[0]&0xf)<<4) + cell[0]; /* from cell */
 257                 pseudo_header->atm.channel=direction & 1;
 258                 }
 259                 break;
 260
 261         case EYESDN_ENCAP_MTP2: /* SS7 frames */
 262                 pseudo_header->mtp2.sent = direction & 1;
 263                 pseudo_header->mtp2.annex_a_used = MTP2_ANNEX_A_USED_UNKNOWN;
 264                 pseudo_header->mtp2.link_number = channel;
 265                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_MTP2_WITH_PHDR;
 266                 break;
 267
 268         case EYESDN_ENCAP_DPNSS: /* DPNSS */
 269                 pseudo_header->isdn.uton = direction & 1;
 270                 pseudo_header->isdn.channel = channel;
 271                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_DPNSS;
 272                 break;
 273
 274         case EYESDN_ENCAP_DASS2: /* DASS2 frames */
 275                 pseudo_header->isdn.uton = direction & 1;
 276                 pseudo_header->isdn.channel = channel;
 277                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_DPNSS;
 278                 break;
 279
 280         case EYESDN_ENCAP_BACNET: /* BACNET async over HDLC frames */
 281                 pseudo_header->isdn.uton = direction & 1;
 282                 pseudo_header->isdn.channel = channel;
 283                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR;
 284                 break;
 285
 286         case EYESDN_ENCAP_V5_EF: /* V5EF */
 287                 pseudo_header->isdn.uton = direction & 1;
 288                 pseudo_header->isdn.channel = channel;
 289                 rec->rec_header.packet_header.pkt_encap = WTAP_ENCAP_V5_EF;
 290                 break;
 291         }
 292
 293         if(pkt_len > WTAP_MAX_PACKET_SIZE_STANDARD) {
 294                 *err = WTAP_ERR_BAD_FILE;
 295                 *err_info = ws_strdup_printf("eyesdn: File has %u-byte packet, bigger than maximum of %u",
 296                     pkt_len, WTAP_MAX_PACKET_SIZE_STANDARD);
 297                 return false;
 298         }
 299
 300         rec->rec_type = REC_TYPE_PACKET;
 301         rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
 302         rec->presence_flags = WTAP_HAS_TS;
 303         rec->ts.secs = secs;
 304         rec->ts.nsecs = usecs * 1000;
 305         rec->rec_header.packet_header.caplen = pkt_len;
 306         rec->rec_header.packet_header.len = pkt_len;
 307
 308         /* Make sure we have enough room for the packet */
 309         ws_buffer_assure_space(buf, pkt_len);
 310
 311         pd = ws_buffer_start_ptr(buf);
 312         if (!esc_read(fh, pd, pkt_len, err, err_info))
 313                 return false;
 314         return true;
 315 }
 316
 317
 318 static bool
 319 esc_write(wtap_dumper *wdh, const uint8_t *buf, int len, int *err)
 320 {
 321         int i;
 322         uint8_t byte;
 323         static const uint8_t esc = 0xfe;
 324
 325         for(i=0; i<len; i++) {
 326                 byte=buf[i];
 327                 if(byte == 0xff || byte == 0xfe) {
 328                         /*
 329                          * Escape the frame delimiter and escape byte.
 330                          */
 331                         if (!wtap_dump_file_write(wdh, &esc, sizeof esc, err))
 332                                 return false;
 333                         byte-=2;
 334                 }
 335                 if (!wtap_dump_file_write(wdh, &byte, sizeof byte, err))
 336                         return false;
 337         }
 338         return true;
 339 }
 340
 341 static bool eyesdn_dump(wtap_dumper *wdh,
 342                             const wtap_rec *rec,
 343                             const uint8_t *pd, int *err, char **err_info);
 344
 345 static bool eyesdn_dump_open(wtap_dumper *wdh, int *err, char **err_info _U_)
 346 {
 347         wdh->subtype_write=eyesdn_dump;
 348
 349         if (!wtap_dump_file_write(wdh, eyesdn_hdr_magic,
 350             EYESDN_HDR_MAGIC_SIZE, err))
 351                 return false;
 352         *err=0;
 353         return true;
 354 }
 355
 356 static int eyesdn_dump_can_write_encap(int encap)
 357 {
 358         switch (encap) {
 359         case WTAP_ENCAP_ISDN:
 360         case WTAP_ENCAP_LAYER1_EVENT:
 361         case WTAP_ENCAP_DPNSS:
 362         case WTAP_ENCAP_ATM_PDUS_UNTRUNCATED:
 363         case WTAP_ENCAP_LAPB:
 364         case WTAP_ENCAP_MTP2_WITH_PHDR:
 365         case WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR:
 366         case WTAP_ENCAP_PER_PACKET:
 367                 return 0;
 368
 369         default:
 370                 return WTAP_ERR_UNWRITABLE_ENCAP;
 371         }
 372 }
 373
 374 /* Write a record for a packet to a dump file.
 375  *    Returns true on success, false on failure. */
 376 static bool eyesdn_dump(wtap_dumper *wdh,
 377                             const wtap_rec *rec,
 378                             const uint8_t *pd, int *err, char **err_info _U_)
 379 {
 380         static const uint8_t start_flag = 0xff;
 381         const union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
 382         uint8_t buf[EYESDN_HDR_LENGTH];
 383         int usecs;
 384         time_t secs;
 385         int channel;
 386         int origin;
 387         int protocol;
 388         int size;
 389
 390         /* We can only write packet records. */
 391         if (rec->rec_type != REC_TYPE_PACKET) {
 392                 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
 393                 return false;
 394         }
 395
 396         /* Don't write out anything bigger than we can read.
 397          * (The length field in packet headers is 16 bits, which
 398          * imposes a hard limit.) */
 399         if (rec->rec_header.packet_header.caplen > 65535) {
 400                 *err = WTAP_ERR_PACKET_TOO_LARGE;
 401                 return false;
 402         }
 403
 404         usecs=rec->ts.nsecs/1000;
 405         secs=rec->ts.secs;
 406         size=rec->rec_header.packet_header.caplen;
 407         origin = pseudo_header->isdn.uton;
 408         channel = pseudo_header->isdn.channel;
 409
 410         switch(rec->rec_header.packet_header.pkt_encap) {
 411
 412         case WTAP_ENCAP_ISDN:
 413                 protocol=EYESDN_ENCAP_ISDN; /* set depending on decoder format and mode */
 414                 break;
 415
 416         case WTAP_ENCAP_LAYER1_EVENT:
 417                 protocol=EYESDN_ENCAP_MSG;
 418                 break;
 419
 420         case WTAP_ENCAP_DPNSS:
 421                 protocol=EYESDN_ENCAP_DPNSS;
 422                 break;
 423
 424 #if 0
 425         case WTAP_ENCAP_DASS2:
 426                 protocol=EYESDN_ENCAP_DASS2;
 427                 break;
 428 #endif
 429
 430         case WTAP_ENCAP_ATM_PDUS_UNTRUNCATED:
 431                 protocol=EYESDN_ENCAP_ATM;
 432                 channel=0x80;
 433                 break;
 434
 435         case WTAP_ENCAP_LAPB:
 436                 protocol=EYESDN_ENCAP_LAPB;
 437                 break;
 438
 439         case WTAP_ENCAP_MTP2_WITH_PHDR:
 440                 protocol=EYESDN_ENCAP_MTP2;
 441                 break;
 442
 443         case WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR:
 444                 protocol=EYESDN_ENCAP_BACNET;
 445                 break;
 446
 447         case WTAP_ENCAP_V5_EF:
 448                 protocol=EYESDN_ENCAP_V5_EF;
 449                 break;
 450
 451         default:
 452                 *err=WTAP_ERR_UNWRITABLE_ENCAP;
 453                 return false;
 454         }
 455
 456         phton24(&buf[0], usecs);
 457
 458         buf[3] = (uint8_t)0;
 459         buf[4] = (uint8_t)(0xff & (secs >> 24));
 460         buf[5] = (uint8_t)(0xff & (secs >> 16));
 461         buf[6] = (uint8_t)(0xff & (secs >> 8));
 462         buf[7] = (uint8_t)(0xff & (secs >> 0));
 463
 464         buf[8] = (uint8_t) channel;
 465         buf[9] = (uint8_t) (origin?1:0) + (protocol << 1);
 466         phtons(&buf[10], size);
 467
 468         /* start flag */
 469         if (!wtap_dump_file_write(wdh, &start_flag, sizeof start_flag, err))
 470                 return false;
 471         if (!esc_write(wdh, buf, 12, err))
 472                 return false;
 473         if (!esc_write(wdh, pd, size, err))
 474                 return false;
 475         return true;
 476 }
 477
 478 static const struct supported_block_type eyesdn_blocks_supported[] = {
 479         /*
 480          * We support packet blocks, with no comments or other options.
 481          */
 482         { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
 483 };
 484
 485 static const struct file_type_subtype_info eyesdn_info = {
 486         "EyeSDN USB S0/E1 ISDN trace format", "eyesdn", "trc", NULL,
 487         false, BLOCKS_SUPPORTED(eyesdn_blocks_supported),
 488         eyesdn_dump_can_write_encap, eyesdn_dump_open, NULL
 489 };
 490
 491 void register_eyesdn(void)
 492 {
 493         eyesdn_file_type_subtype = wtap_register_file_type_subtype(&eyesdn_info);
 494
 495         /*
 496          * Register name for backwards compatibility with the
 497          * wtap_filetypes table in Lua.
 498          */
 499         wtap_register_backwards_compatibility_lua_name("EYESDN",
 500             eyesdn_file_type_subtype);
 501 }
 502
 503 /*
 504  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 505  *
 506  * Local variables:
 507  * c-basic-offset: 8
 508  * tab-width: 8
 509  * indent-tabs-mode: t
 510  * End:
 511  *
 512  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 513  * :indentSize=8:tabSize=8:noTabs=false:
 514  */