?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / wiretap / netxray.c
blobff6ef19317c80ba2792c9067b919a3ff13450c29
1 /* netxray.c
2 *
3 * Wiretap Library
4 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "config.h"
10 #include "netxray.h"
11
12 #include <string.h>
13 #include "wtap-int.h"
14 #include "file_wrappers.h"
15 #include "atm.h"
16
17 /* Capture file header, *including* magic number, is padded to 128 bytes. */
18 #define CAPTUREFILE_HEADER_SIZE 128
19
20 /* Magic number size, in both 1.x and later files. */
21 #define MAGIC_SIZE 4
22
23 /* Magic number in NetXRay 1.x files. */
24 static const char old_netxray_magic[MAGIC_SIZE] = {
25 'V', 'L', '\0', '\0'
26 };
27
28 /* Magic number in NetXRay 2.0 and later, and Windows Sniffer, files. */
29 static const char netxray_magic[MAGIC_SIZE] = {
30 'X', 'C', 'P', '\0'
31 };
32
33 /* NetXRay file header (minus magic number). */
34 /* */
35 /* As field usages are identified, please revise as needed */
36 /* Please do *not* use netxray_hdr xxx... names in the code */
37 /* (Placeholder names for all 'unknown' fields are */
38 /* of form xxx_x<hex_hdr_offset> */
39 /* where <hex_hdr_offset> *includes* the magic number) */
40
41 struct netxray_hdr {
42 char version[8]; /* version number */
43 uint32_t start_time; /* UNIX [UTC] time when capture started */
44
45 uint32_t nframes; /* number of packets */
46 uint32_t xxx_x14; /* unknown [some kind of file offset] */
47 uint32_t start_offset; /* offset of first packet in capture */
48 uint32_t end_offset; /* offset after last packet in capture */
49
50 uint32_t xxx_x20; /* unknown [some kind of file offset] */
51 uint32_t xxx_x24; /* unknown [unused ?] */
52 uint32_t xxx_x28; /* unknown [some kind of file offset] */
53 uint8_t network; /* datalink type */
54 uint8_t network_plus; /* [See code] */
55 uint8_t xxx_x2E[2]; /* unknown */
56
57 uint8_t timeunit; /* encodes length of a tick */
58 uint8_t xxx_x31[3]; /* XXX - upper 3 bytes of timeunit ? */
59 uint32_t timelo; /* lower 32 bits of capture start time stamp */
60 uint32_t timehi; /* upper 32 bits of capture start time stamp */
61 uint32_t linespeed; /* speed of network, in bits/second */
62
63 uint8_t xxx_x40[12]; /* unknown [other stuff] */
64 uint8_t realtick[4]; /* (ticks/sec for Ethernet/Ndis/Timeunit=2 ?) */
65 /* (realtick[1], realtick[2] also currently */
66 /* used as flag for 'FCS presence') */
67
68 uint8_t xxx_x50[4]; /* unknown [other stuff] */
69 uint8_t captype; /* capture type */
70 uint8_t xxx_x55[3]; /* unknown [other stuff] */
71 uint8_t xxx_x58[4]; /* unknown [other stuff] */
72 uint8_t wan_hdlc_subsub_captype; /* WAN HDLC subsub_captype */
73 uint8_t xxx_x5D[3]; /* unknown [other stuff] */
74
75 uint8_t xxx_x60[16]; /* unknown [other stuff] */
76
77 uint8_t xxx_x70[14]; /* unknown [other stuff] */
78 int16_t timezone_hrs; /* timezone hours [at least for version 2.2..]; */
79 /* positive values = west of UTC: */
80 /* negative values = east of UTC: */
81 /* e.g. +5 is American Eastern */
82 /* [Does not appear to be adjusted for DST ] */
83 };
84
85 /*
86 * Capture type, in hdr.captype.
87 *
88 * Values other than 0 are dependent on the network type.
89 * For Ethernet captures, it indicates the type of capture pod.
90 * For WAN captures (all of which are done with a pod), it indicates
91 * the link-layer type.
92 */
93 #define CAPTYPE_NDIS 0 /* Capture on network interface using NDIS */
94
95 /*
96 * Ethernet capture types.
97 */
98 #define ETH_CAPTYPE_GIGPOD 2 /* gigabit Ethernet captured with pod */
99 #define ETH_CAPTYPE_OTHERPOD 3 /* non-gigabit Ethernet captured with pod */
100 #define ETH_CAPTYPE_OTHERPOD2 5 /* gigabit Ethernet via pod ?? */
101 /* Captype 5 seen in capture from Distributed Sniffer with: */
102 /* Version 4.50.211 software */
103 /* SysKonnect SK-9843 Gigabit Ethernet Server Adapter */
104 #define ETH_CAPTYPE_GIGPOD2 6 /* gigabit Ethernet, captured with blade on S6040-model Sniffer */
105
106 /*
107 * WAN capture types.
108 */
109 #define WAN_CAPTYPE_BROUTER 1 /* Bridge/router captured with pod */
110 #define WAN_CAPTYPE_PPP 3 /* PPP captured with pod */
111 #define WAN_CAPTYPE_FRELAY 4 /* Frame Relay captured with pod */
112 #define WAN_CAPTYPE_BROUTER2 5 /* Bridge/router captured with pod */
113 #define WAN_CAPTYPE_HDLC 6 /* HDLC (X.25, ISDN) captured with pod */
114 #define WAN_CAPTYPE_SDLC 7 /* SDLC captured with pod */
115 #define WAN_CAPTYPE_HDLC2 8 /* HDLC captured with pod */
116 #define WAN_CAPTYPE_BROUTER3 9 /* Bridge/router captured with pod */
117 #define WAN_CAPTYPE_SMDS 10 /* SMDS DXI */
118 #define WAN_CAPTYPE_BROUTER4 11 /* Bridge/router captured with pod */
119 #define WAN_CAPTYPE_BROUTER5 12 /* Bridge/router captured with pod */
120 #define WAN_CAPTYPE_CHDLC 19 /* Cisco router (CHDLC) captured with pod */
121
122 #define CAPTYPE_ATM 15 /* ATM captured with pod */
123
124 /*
125 * # of ticks that equal 1 second, in version 002.xxx files other
126 * than Ethernet captures with a captype other than CAPTYPE_NDIS;
127 * the index into this array is hdr.timeunit.
128 *
129 * DO NOT SEND IN PATCHES THAT CHANGE ANY OF THE NON-ZERO VALUES IN
130 * ANY OF THE TpS TABLES. THOSE VALUES ARE CORRECT FOR AT LEAST ONE
131 * CAPTURE, SO CHANGING THEM WILL BREAK AT LEAST SOME CAPTURES. WE
132 * WILL NOT CHECK IN PATCHES THAT CHANGE THESE VALUES.
133 *
134 * Instead, if a value in a TpS table is wrong, check whether captype
135 * has a non-zero value; if so, perhaps we need a new TpS table for the
136 * corresponding network type and captype, or perhaps the 'realtick'
137 * field contains the correct ticks-per-second value.
138 *
139 * TpS...[] entries of 0.0 mean that no capture file for the
140 * corresponding captype/timeunit values has yet been seen, or that
141 * we're using the 'realtick' value.
142 *
143 * XXX - 05/29/07: For Ethernet captype = 0 (NDIS) and timeunit = 2:
144 * Perusal of a number of Sniffer captures
145 * (including those from Wireshark bug reports
146 * and those from the Wireshark 'menagerie')
147 * suggests that 'realtick' for this case
148 * contains the correct ticks/second to be used.
149 * So: we'll use realtick for Ethernet captype=0 and timeunit=2.
150 * (It might be that realtick should be used for Ethernet captype = 0
151 * and timeunit = 1 but I've not yet enough captures to be sure).
152 * Based upon the captures reviewed to date, realtick cannot be used for
153 * any of the other Ethernet captype/timeunit combinations for which there
154 * are non-zero values in the TpS tables.
155 *
156 * In at least one capture where "realtick" doesn't correspond
157 * to the value from the appropriate TpS table, the per-packet header's
158 * "xxx" field is all zero, so it's not as if a 2.x header includes
159 * a "compatibility" time stamp corresponding to the value from the
160 * TpS table and a "real" time stamp corresponding to "realtick".
161 *
162 * XXX - the item corresponding to timeunit = 2 is 1193180.0, presumably
163 * because somebody found it gave the right answer for some captures, but
164 * 3 times that, i.e. 3579540.0, appears to give the right answer for some
165 * other captures.
166 *
167 * Some captures have realtick of 1193182, some have 3579545, and some
168 * have 1193000. Most of those, in one set of captures somebody has,
169 * are wrong. (Did that mean "wrong for some capture files, but not
170 * for the files in which they occurred", or "wrong for the files in
171 * which they occurred? If it's "wrong for some capture files, but
172 * not for the files in which they occurred", perhaps those were Ethernet
173 * captures with a captype of 0 and timeunit = 2, so that we now use
174 * realtick, and perhaps that fixes the problems.)
175 *
176 * XXX - in at least one ATM capture, hdr.realtick is 1193180.0
177 * and hdr.timeunit is 0. Does that capture have a captype of
178 * CAPTYPE_ATM? If so, what should the table for ATM captures with
179 * that captype be?
180 */
181 static const double TpS[] = { 1e6, 1193000.0, 1193182.0 };
182 #define NUM_NETXRAY_TIMEUNITS array_length(TpS)
183
184 /*
185 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_GIGPOD.
186 * 0.0 means "unknown".
187 *
188 * It appears that, at least for Ethernet captures, if captype is
189 * ETH_CAPTYPE_GIGPOD, that indicates that it's a gigabit Ethernet
190 * capture, possibly from a special whizzo gigabit pod, and also
191 * indicates that the time stamps have some higher resolution than
192 * in other captures, possibly thanks to a high-resolution timer
193 * on the pod.
194 *
195 * It also appears that the time units might differ for gigabit pod
196 * captures between version 002.001 and 002.002. For 002.001,
197 * the values below are correct; for 002.002, it's claimed that
198 * the right value for TpS_gigpod[2] is 1250000.0, but at least one
199 * 002.002 gigabit pod capture has 31250000.0 as the right value.
200 * XXX: Note that the TpS_otherpod[2] value is 1250000.0; It seems
201 * reasonable to suspect that the original claim might actually
202 * have been for a capture with a captype of 'otherpod'.
203 * (Based upon captures reviewed realtick does not contain the
204 * correct TpS values for the 'gigpod' captype).
205 */
206 static const double TpS_gigpod[] = { 1e9, 0.0, 31250000.0 };
207 #define NUM_NETXRAY_TIMEUNITS_GIGPOD array_length(TpS_gigpod)
208
209 /*
210 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_OTHERPOD.
211 * (Based upon captures reviewed realtick does not contain the
212 * correct TpS values for the 'otherpod' captype).
213 */
214 static const double TpS_otherpod[] = { 1e6, 0.0, 1250000.0 };
215 #define NUM_NETXRAY_TIMEUNITS_OTHERPOD array_length(TpS_otherpod)
216
217 /*
218 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_OTHERPOD2.
219 * (Based upon captures reviewed realtick does not contain the
220 * correct TpS values for the 'otherpod2' captype).
221 */
222 static const double TpS_otherpod2[] = { 1e6, 0.0, 0.0 };
223 #define NUM_NETXRAY_TIMEUNITS_OTHERPOD2 array_length(TpS_otherpod2)
224
225 /*
226 * Table of time units for Ethernet captures with captype ETH_CAPTYPE_GIGPOD2.
227 * (Based upon captures reviewed realtick does not contain the
228 * correct TpS values for the 'gigpod2' captype).
229 */
230 static const double TpS_gigpod2[] = { 1e9, 0.0, 20000000.0 };
231 #define NUM_NETXRAY_TIMEUNITS_GIGPOD2 array_length(TpS_gigpod2)
232
233 /* Version number strings. */
234 static const char vers_1_0[] = {
235 '0', '0', '1', '.', '0', '0', '0', '\0'
236 };
237
238 static const char vers_1_1[] = {
239 '0', '0', '1', '.', '1', '0', '0', '\0'
240 };
241
242 static const char vers_2_000[] = {
243 '0', '0', '2', '.', '0', '0', '0', '\0'
244 };
245
246 static const char vers_2_001[] = {
247 '0', '0', '2', '.', '0', '0', '1', '\0'
248 };
249
250 static const char vers_2_002[] = {
251 '0', '0', '2', '.', '0', '0', '2', '\0'
252 };
253
254 static const char vers_2_003[] = {
255 '0', '0', '2', '.', '0', '0', '3', '\0'
256 };
257
258 /* Old NetXRay data record format - followed by frame data. */
259 struct old_netxrayrec_hdr {
260 uint32_t timelo; /* lower 32 bits of time stamp */
261 uint32_t timehi; /* upper 32 bits of time stamp */
262 uint16_t len; /* packet length */
263 uint8_t xxx[6]; /* unknown */
264 };
265
266 /* NetXRay format version 1.x data record format - followed by frame data. */
267 struct netxrayrec_1_x_hdr {
268 uint32_t timelo; /* lower 32 bits of time stamp */
269 uint32_t timehi; /* upper 32 bits of time stamp */
270 uint16_t orig_len; /* packet length */
271 uint16_t incl_len; /* capture length */
272 uint8_t xxx[16]; /* unknown */
273 };
274
275 /*
276 * NetXRay format version 2.x data record format - followed by frame data.
277 *
278 * The xxx fields appear to be:
279 *
280 * xxx[0]: ATM traffic type and subtype in the low 3 bits of
281 * each nibble, and flags(?) in the upper bit of each nibble.
282 * Always 0 for 802.11?
283 *
284 * xxx[1]: Always 0 for 802.11?
285 *
286 * xxx[2], xxx[3]: for Ethernet, 802.11, ISDN LAPD, LAPB,
287 * Frame Relay, if both are 0xff, there are 4 bytes of stuff
288 * at the end of the packet data, which might be an FCS or
289 * which might be junk to discard.
290 *
291 * xxx[4-7]: Always 0 for 802.11?
292 *
293 * xxx[8], xxx[9]: 2 bytes of a flag word? If treated as
294 * a 2-byte little-endian flag word:
295 *
296 * 0x0001: Error of some sort, including bad CRC, although
297 * in one ISDN capture it's set in some B2 channel
298 * packets of unknown content (as opposed to the B1
299 * traffic in the capture, which is PPP)
300 * 0x0002: Seen in 802.11 - short preamble? Bad CRC?
301 * 0x0004: Some particular type of error?
302 * 0x0008: For (Gigabit?) Ethernet (with special probe?),
303 * 4 bytes at end are junk rather than CRC?
304 * 0x0100: CRC error on ATM? Protected and Not decrypted
305 * for 802.11? Bad CRC? Short preamble?
306 * 0x0200: Something for ATM? Something else for 802.11?
307 * 0x0400: raw ATM cell
308 * 0x0800: OAM cell?
309 * 0x2000: port on which the packet was captured?
310 *
311 * The Sniffer Portable 4.8 User's Guide lists a set of packet status
312 * flags including:
313 *
314 * packet is marked;
315 * packet was captured from Port A on the pod or adapter card;
316 * packet was captured from Port B on the pod or adapter card;
317 * packet has a symptom or diagnosis associated with it;
318 * packet is an event filter trigger;
319 * CRC error packet with normal packet size;
320 * CRC error packet with oversize error;
321 * packet size < 64 bytes (including CRC) but with valid CRC;
322 * packet size < 64 bytes (including CRC) with CRC error;
323 * packet size > 1518 bytes (including CRC) but with valid CRC;
324 * packet damaged by a collision;
325 * packet length not a multiple of 8 bits;
326 * address conflict in the ring on Token Ring;
327 * packet is not copied (received) by the destination host on
328 * Token Ring;
329 * AAL5 length error;
330 * AAL5 maximum segments error;
331 * ATM timeout error;
332 * ATM buffer error;
333 * ATM unknown error;
334 * and a ton of AAL2 errors.
335 *
336 * Not all those bits necessarily correspond to flag bits in the file,
337 * but some might.
338 *
339 * In one ATM capture, the 0x2000 bit was set for all frames; in another,
340 * it's unset for all frames. This, plus the ATMbook having two ports,
341 * suggests that it *might* be a "port A vs. port B" flag.
342 *
343 * The 0x0001 bit appears to be set for CRC errors on Ethernet and 802.11.
344 * It also appears to be set on ATM for AAL5 PDUs that appear to be
345 * completely reassembled and that have a CRC error and for frames that
346 * appear to be part of a full AAL5 PDU. In at least two files with
347 * frames of the former type, the 0x0100 and 0x0200 flags are set;
348 * in at least one file with frames of the latter type, neither of
349 * those flags are set.
350 *
351 * The field appears to be somewhat random in some captures,
352 * however.
353 *
354 * xxx[10]: for 802.11, always 0?
355 *
356 * xxx[11]: for 802.11, 0x05 if the packet is WEP-encrypted(?).
357 *
358 * xxx[12]: for 802.11, channel number.
359 *
360 * xxx[13]: for 802.11, data rate, in 500 Kb/s units.
361 *
362 * xxx[14]: for 802.11, signal strength.
363 *
364 * xxx[15]: for 802.11, noise level; 0xFF means none reported,
365 * 0x7F means 100%.
366 *
367 * xxx[16-19]: for 802.11, PHY header, at least for {HR/}DSSS,
368 * in at least one capture.
369 * In another capture, xxx[16] appears to be the
370 * data rate in 500 Kb/s units
371 * Chip-dependent stuff?
372 *
373 * xxx[20-25]: for 802.11, MAC address of sending machine(?).
374 *
375 * xxx[26]: for 802.11, one of 0x00, 0x01, 0x03, or 0x0b?
376 *
377 * xxx[27]: for 802.11, one of 0x00 or 0x30?
378 */
379 struct netxrayrec_2_x_hdr {
380 uint32_t timelo; /* lower 32 bits of time stamp */
381 uint32_t timehi; /* upper 32 bits of time stamp */
382 uint16_t orig_len; /* packet length */
383 uint16_t incl_len; /* capture length */
384 uint8_t xxx[28]; /* various data */
385 };
386
387 /*
388 * Union of the data record headers.
389 */
390 union netxrayrec_hdr {
391 struct old_netxrayrec_hdr old_hdr;
392 struct netxrayrec_1_x_hdr hdr_1_x;
393 struct netxrayrec_2_x_hdr hdr_2_x;
394 };
395
396 typedef struct {
397 time_t start_time;
398 double ticks_per_sec;
399 double start_timestamp;
400 bool wrapped;
401 uint32_t nframes;
402 int64_t start_offset;
403 int64_t end_offset;
404 int version_major;
405 bool fcs_valid; /* if packets have valid FCS at the end */
406 unsigned isdn_type; /* 1 = E1 PRI, 2 = T1 PRI, 3 = BRI */
407 } netxray_t;
408
409 static bool netxray_read(wtap *wth, wtap_rec *rec,
410 int *err, char **err_info, int64_t *data_offset);
411 static bool netxray_seek_read(wtap *wth, int64_t seek_off,
412 wtap_rec *rec, int *err, char **err_info);
413 static int netxray_process_rec_header(wtap *wth, FILE_T fh,
414 wtap_rec *rec, int *err, char **err_info);
415 static void netxray_guess_atm_type(wtap *wth, wtap_rec *rec);
416 static bool netxray_dump_1_1(wtap_dumper *wdh, const wtap_rec *rec,
417 const uint8_t *pd, int *err, char **err_info);
418 static bool netxray_dump_finish_1_1(wtap_dumper *wdh, int *err,
419 char **err_info);
420 static bool netxray_dump_2_0(wtap_dumper *wdh, const wtap_rec *rec,
421 const uint8_t *pd, int *err, char **err_info);
422 static bool netxray_dump_finish_2_0(wtap_dumper *wdh, int *err,
423 char **err_info);
424
425 static int netxray_old_file_type_subtype = -1;
426 static int netxray_1_0_file_type_subtype = -1;
427 static int netxray_1_1_file_type_subtype = -1;
428 static int netxray_2_00x_file_type_subtype = -1;
429
430 void register_netxray(void);
431
432 wtap_open_return_val
433 netxray_open(wtap *wth, int *err, char **err_info)
434 {
435 char magic[MAGIC_SIZE];
436 bool is_old;
437 struct netxray_hdr hdr;
438 unsigned network_type;
439 double ticks_per_sec;
440 int version_major, version_minor;
441 int file_type;
442 double start_timestamp;
443 static const int netxray_encap[] = {
444 WTAP_ENCAP_UNKNOWN,
445 WTAP_ENCAP_ETHERNET,
446 WTAP_ENCAP_TOKEN_RING,
447 WTAP_ENCAP_FDDI_BITSWAPPED,
448 /*
449 * XXX - some PPP captures may look like Ethernet,
450 * perhaps because they're using NDIS to capture on the
451 * same machine and it provides simulated-Ethernet
452 * packets, but captures taken with various serial
453 * pods use the same network type value but aren't
454 * shaped like Ethernet. We handle that below.
455 */
456 WTAP_ENCAP_ETHERNET, /* WAN(PPP), but shaped like Ethernet */
457 WTAP_ENCAP_UNKNOWN, /* LocalTalk */
458 WTAP_ENCAP_UNKNOWN, /* "DIX" - should not occur */
459 WTAP_ENCAP_UNKNOWN, /* ARCNET raw */
460 WTAP_ENCAP_UNKNOWN, /* ARCNET 878.2 */
461 WTAP_ENCAP_ATM_PDUS_UNTRUNCATED,/* ATM */
462 WTAP_ENCAP_IEEE_802_11_WITH_RADIO,
463 /* Wireless WAN with radio information */
464 WTAP_ENCAP_UNKNOWN /* IrDA */
465 };
466 #define NUM_NETXRAY_ENCAPS array_length(netxray_encap)
467 int file_encap;
468 unsigned isdn_type = 0;
469 netxray_t *netxray;
470
471 /* Read in the string that should be at the start of a NetXRay
472 * file */
473 if (!wtap_read_bytes(wth->fh, magic, MAGIC_SIZE, err, err_info)) {
474 if (*err != WTAP_ERR_SHORT_READ)
475 return WTAP_OPEN_ERROR;
476 return WTAP_OPEN_NOT_MINE;
477 }
478
479 if (memcmp(magic, netxray_magic, MAGIC_SIZE) == 0) {
480 is_old = false;
481 } else if (memcmp(magic, old_netxray_magic, MAGIC_SIZE) == 0) {
482 is_old = true;
483 } else {
484 return WTAP_OPEN_NOT_MINE;
485 }
486
487 /* Read the rest of the header. */
488 if (!wtap_read_bytes(wth->fh, &hdr, sizeof hdr, err, err_info))
489 return WTAP_OPEN_ERROR;
490
491 if (is_old) {
492 version_major = 0;
493 version_minor = 0;
494 file_type = netxray_old_file_type_subtype;
495 } else {
496 /* It appears that version 1.1 files (as produced by Windows
497 * Sniffer Pro 2.0.01) have the time stamp in microseconds,
498 * rather than the milliseconds version 1.0 files appear to
499 * have.
500 *
501 * It also appears that version 2.00x files have per-packet
502 * headers with some extra fields. */
503 if (memcmp(hdr.version, vers_1_0, sizeof vers_1_0) == 0) {
504 version_major = 1;
505 version_minor = 0;
506 file_type = netxray_1_0_file_type_subtype;
507 } else if (memcmp(hdr.version, vers_1_1, sizeof vers_1_1) == 0) {
508 version_major = 1;
509 version_minor = 1;
510 file_type = netxray_1_1_file_type_subtype;
511 } else if (memcmp(hdr.version, vers_2_000, sizeof vers_2_000) == 0) {
512 version_major = 2;
513 version_minor = 0;
514 file_type = netxray_2_00x_file_type_subtype;
515 } else if (memcmp(hdr.version, vers_2_001, sizeof vers_2_001) == 0) {
516 version_major = 2;
517 version_minor = 1;
518 file_type = netxray_2_00x_file_type_subtype;
519 } else if (memcmp(hdr.version, vers_2_002, sizeof vers_2_002) == 0) {
520 version_major = 2;
521 version_minor = 2;
522 file_type = netxray_2_00x_file_type_subtype;
523 } else if (memcmp(hdr.version, vers_2_003, sizeof vers_2_003) == 0) {
524 version_major = 2;
525 version_minor = 3;
526 file_type = netxray_2_00x_file_type_subtype;
527 } else {
528 *err = WTAP_ERR_UNSUPPORTED;
529 *err_info = ws_strdup_printf("netxray: version \"%.8s\" unsupported", hdr.version);
530 return WTAP_OPEN_ERROR;
531 }
532 }
533
534 switch (hdr.network_plus) {
535
536 case 0:
537 /*
538 * The byte after hdr.network is usually 0, in which case
539 * the hdr.network byte is an NDIS network type value - 1.
540 */
541 network_type = hdr.network + 1;
542 break;
543
544 case 2:
545 /*
546 * However, in some Ethernet captures, it's 2, and the
547 * hdr.network byte is 1 rather than 0. We assume
548 * that if there's a byte after hdr.network with the value
549 * 2, the hdr.network byte is an NDIS network type, rather
550 * than an NDIS network type - 1.
551 */
552 network_type = hdr.network;
553 break;
554
555 default:
556 *err = WTAP_ERR_UNSUPPORTED;
557 *err_info = ws_strdup_printf("netxray: the byte after the network type has the value %u, which I don't understand",
558 hdr.network_plus);
559 return WTAP_OPEN_ERROR;
560 }
561
562 if (network_type >= NUM_NETXRAY_ENCAPS
563 || netxray_encap[network_type] == WTAP_ENCAP_UNKNOWN) {
564 *err = WTAP_ERR_UNSUPPORTED;
565 *err_info = ws_strdup_printf("netxray: network type %u (%u) unknown or unsupported",
566 network_type, hdr.network_plus);
567 return WTAP_OPEN_ERROR;
568 }
569
570 /*
571 * Figure out the time stamp units and start time stamp.
572 */
573 start_timestamp = (double)pletoh32(&hdr.timelo)
574 + (double)pletoh32(&hdr.timehi)*4294967296.0;
575 if (is_old) {
576 ticks_per_sec = 1000.0;
577 wth->file_tsprec = WTAP_TSPREC_MSEC;
578 } else if (version_major == 1) {
579 switch (version_minor) {
580
581 case 0:
582 ticks_per_sec = 1000.0;
583 wth->file_tsprec = WTAP_TSPREC_MSEC;
584 break;
585
586 case 1:
587 /*
588 * In version 1.1 files (as produced by Windows
589 * Sniffer Pro 2.0.01), the time stamp is in
590 * microseconds, rather than the milliseconds
591 * time stamps in NetXRay and older versions
592 * of Windows Sniffer.
593 */
594 ticks_per_sec = 1000000.0;
595 wth->file_tsprec = WTAP_TSPREC_USEC;
596 break;
597
598 default:
599 /* "Can't happen" - we rejected that above */
600 *err = WTAP_ERR_INTERNAL;
601 *err_info = ws_strdup_printf("netxray: version %d.%d somehow didn't get rejected",
602 version_major, version_minor);
603 return WTAP_OPEN_ERROR;
604 }
605 } else if (version_major == 2) {
606 /*
607 * Get the time stamp units from the appropriate TpS
608 * table or from the file header.
609 */
610 switch (network_type) {
611
612 case 1:
613 /*
614 * Ethernet - the table to use depends on whether
615 * this is an NDIS or pod capture.
616 */
617 switch (hdr.captype) {
618
619 case CAPTYPE_NDIS:
620 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS) {
621 *err = WTAP_ERR_UNSUPPORTED;
622 *err_info = ws_strdup_printf(
623 "netxray: Unknown timeunit %u for Ethernet/CAPTYPE_NDIS version %.8s capture",
624 hdr.timeunit, hdr.version);
625 return WTAP_OPEN_ERROR;
626 }
627 /*
628 XXX: 05/29/07: Use 'realtick' instead of TpS table if timeunit=2;
629 Using 'realtick' in this case results
630 in the correct 'ticks per second' for all the captures that
631 I have of this type (including captures from a number of Wireshark
632 bug reports).
633 */
634 if (hdr.timeunit == 2) {
635 ticks_per_sec = pletoh32(hdr.realtick);
636 }
637 else {
638 ticks_per_sec = TpS[hdr.timeunit];
639 }
640 break;
641
642 case ETH_CAPTYPE_GIGPOD:
643 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_GIGPOD
644 || TpS_gigpod[hdr.timeunit] == 0.0) {
645 *err = WTAP_ERR_UNSUPPORTED;
646 *err_info = ws_strdup_printf(
647 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_GIGPOD version %.8s capture",
648 hdr.timeunit, hdr.version);
649 return WTAP_OPEN_ERROR;
650 }
651 ticks_per_sec = TpS_gigpod[hdr.timeunit];
652
653 /*
654 * At least for 002.002 and 002.003
655 * captures, the start time stamp is 0,
656 * not the value in the file.
657 */
658 if (version_minor == 2 || version_minor == 3)
659 start_timestamp = 0.0;
660 break;
661
662 case ETH_CAPTYPE_OTHERPOD:
663 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_OTHERPOD
664 || TpS_otherpod[hdr.timeunit] == 0.0) {
665 *err = WTAP_ERR_UNSUPPORTED;
666 *err_info = ws_strdup_printf(
667 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_OTHERPOD version %.8s capture",
668 hdr.timeunit, hdr.version);
669 return WTAP_OPEN_ERROR;
670 }
671 ticks_per_sec = TpS_otherpod[hdr.timeunit];
672
673 /*
674 * At least for 002.002 and 002.003
675 * captures, the start time stamp is 0,
676 * not the value in the file.
677 */
678 if (version_minor == 2 || version_minor == 3)
679 start_timestamp = 0.0;
680 break;
681
682 case ETH_CAPTYPE_OTHERPOD2:
683 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_OTHERPOD2
684 || TpS_otherpod2[hdr.timeunit] == 0.0) {
685 *err = WTAP_ERR_UNSUPPORTED;
686 *err_info = ws_strdup_printf(
687 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_OTHERPOD2 version %.8s capture",
688 hdr.timeunit, hdr.version);
689 return WTAP_OPEN_ERROR;
690 }
691 ticks_per_sec = TpS_otherpod2[hdr.timeunit];
692 /*
693 * XXX: start time stamp in the one capture file examined of this type was 0;
694 * We'll assume the start time handling is the same as for other pods.
695 *
696 * At least for 002.002 and 002.003
697 * captures, the start time stamp is 0,
698 * not the value in the file.
699 */
700 if (version_minor == 2 || version_minor == 3)
701 start_timestamp = 0.0;
702 break;
703
704 case ETH_CAPTYPE_GIGPOD2:
705 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS_GIGPOD2
706 || TpS_gigpod2[hdr.timeunit] == 0.0) {
707 *err = WTAP_ERR_UNSUPPORTED;
708 *err_info = ws_strdup_printf(
709 "netxray: Unknown timeunit %u for Ethernet/ETH_CAPTYPE_GIGPOD2 version %.8s capture",
710 hdr.timeunit, hdr.version);
711 return WTAP_OPEN_ERROR;
712 }
713 ticks_per_sec = TpS_gigpod2[hdr.timeunit];
714 /*
715 * XXX: start time stamp in the one capture file examined of this type was 0;
716 * We'll assume the start time handling is the same as for other pods.
717 *
718 * At least for 002.002 and 002.003
719 * captures, the start time stamp is 0,
720 * not the value in the file.
721 */
722 if (version_minor == 2 || version_minor == 3)
723 start_timestamp = 0.0;
724 break;
725
726 default:
727 *err = WTAP_ERR_UNSUPPORTED;
728 *err_info = ws_strdup_printf(
729 "netxray: Unknown capture type %u for Ethernet version %.8s capture",
730 hdr.captype, hdr.version);
731 return WTAP_OPEN_ERROR;
732 }
733 break;
734
735 default:
736 if (hdr.timeunit >= NUM_NETXRAY_TIMEUNITS) {
737 *err = WTAP_ERR_UNSUPPORTED;
738 *err_info = ws_strdup_printf(
739 "netxray: Unknown timeunit %u for %u/%u version %.8s capture",
740 hdr.timeunit, network_type, hdr.captype,
741 hdr.version);
742 return WTAP_OPEN_ERROR;
743 }
744 ticks_per_sec = TpS[hdr.timeunit];
745 break;
746 }
747
748 /*
749 * If the number of ticks per second is greater than
750 * 1 million, make the precision be nanoseconds rather
751 * than microseconds.
752 *
753 * XXX - do values only slightly greater than one million
754 * correspond to a resolution sufficiently better than
755 * 1 microsecond to display more digits of precision?
756 * XXX - Seems reasonable to use nanosecs only if TPS >= 10M
757 */
758 if (ticks_per_sec >= 1e7)
759 wth->file_tsprec = WTAP_TSPREC_NSEC;
760 else
761 wth->file_tsprec = WTAP_TSPREC_USEC;
762 } else {
763 /* "Can't happen" - we rejected that above */
764 *err = WTAP_ERR_INTERNAL;
765 *err_info = ws_strdup_printf("netxray: version %d.%d somehow didn't get rejected",
766 version_major, version_minor);
767 return WTAP_OPEN_ERROR;
768 }
769 start_timestamp = start_timestamp/ticks_per_sec;
770
771 if (network_type == 4) {
772 /*
773 * In version 0 and 1, we assume, for now, that all
774 * WAN captures have frames that look like Ethernet
775 * frames (as a result, presumably, of having passed
776 * through NDISWAN).
777 *
778 * In version 2, it looks as if there's stuff in the
779 * file header to specify what particular type of WAN
780 * capture we have.
781 */
782 if (version_major == 2) {
783 switch (hdr.captype) {
784
785 case WAN_CAPTYPE_PPP:
786 /*
787 * PPP.
788 */
789 file_encap = WTAP_ENCAP_PPP_WITH_PHDR;
790 break;
791
792 case WAN_CAPTYPE_FRELAY:
793 /*
794 * Frame Relay.
795 *
796 * XXX - in at least one capture, this
797 * is Cisco HDLC, not Frame Relay, but
798 * in another capture, it's Frame Relay.
799 *
800 * [Bytes in each capture:
801 * Cisco HDLC: hdr.xxx_x60[06:10]: 0x02 0x00 0x01 0x00 0x06
802 * Frame Relay: hdr.xxx_x60[06:10] 0x00 0x00 0x00 0x00 0x00
803
804 * Cisco HDLC: hdr.xxx_x60[14:15]: 0xff 0xff
805 * Frame Relay: hdr.xxx_x60[14:15]: 0x00 0x00
806 * ]
807 */
808 file_encap = WTAP_ENCAP_FRELAY_WITH_PHDR;
809 break;
810
811 case WAN_CAPTYPE_HDLC:
812 case WAN_CAPTYPE_HDLC2:
813 /*
814 * Various HDLC flavors?
815 */
816 switch (hdr.wan_hdlc_subsub_captype) {
817
818 case 0: /* LAPB/X.25 */
819 /*
820 * XXX - at least one capture of
821 * this type appears to be PPP.
822 */
823 file_encap = WTAP_ENCAP_LAPB;
824 break;
825
826 case 1: /* E1 PRI */
827 case 2: /* T1 PRI */
828 case 3: /* BRI */
829 file_encap = WTAP_ENCAP_ISDN;
830 isdn_type = hdr.wan_hdlc_subsub_captype;
831 break;
832
833 default:
834 *err = WTAP_ERR_UNSUPPORTED;
835 *err_info = ws_strdup_printf("netxray: WAN HDLC capture subsubtype 0x%02x unknown or unsupported",
836 hdr.wan_hdlc_subsub_captype);
837 return WTAP_OPEN_ERROR;
838 }
839 break;
840
841 case WAN_CAPTYPE_SDLC:
842 /*
843 * SDLC.
844 */
845 file_encap = WTAP_ENCAP_SDLC;
846 break;
847
848 case WAN_CAPTYPE_CHDLC:
849 /*
850 * Cisco router (CHDLC) captured with pod
851 */
852 file_encap = WTAP_ENCAP_CHDLC_WITH_PHDR;
853 break;
854
855 default:
856 *err = WTAP_ERR_UNSUPPORTED;
857 *err_info = ws_strdup_printf("netxray: WAN capture subtype 0x%02x unknown or unsupported",
858 hdr.captype);
859 return WTAP_OPEN_ERROR;
860 }
861 } else
862 file_encap = WTAP_ENCAP_ETHERNET;
863 } else
864 file_encap = netxray_encap[network_type];
865
866 /* This is a netxray file */
867 wth->file_type_subtype = file_type;
868 netxray = g_new(netxray_t, 1);
869 wth->priv = (void *)netxray;
870 wth->subtype_read = netxray_read;
871 wth->subtype_seek_read = netxray_seek_read;
872 wth->file_encap = file_encap;
873 wth->snapshot_length = 0; /* not available in header */
874 netxray->start_time = pletoh32(&hdr.start_time);
875 netxray->ticks_per_sec = ticks_per_sec;
876 netxray->start_timestamp = start_timestamp;
877 netxray->version_major = version_major;
878
879 /*
880 * If frames have an extra 4 bytes of stuff at the end, is
881 * it an FCS, or just junk?
882 */
883 netxray->fcs_valid = false;
884 switch (file_encap) {
885
886 case WTAP_ENCAP_ETHERNET:
887 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
888 case WTAP_ENCAP_ISDN:
889 case WTAP_ENCAP_LAPB:
890 /*
891 * It appears that, in at least some version 2 Ethernet
892 * captures, for frames that have 0xff in hdr_2_x.xxx[2]
893 * and hdr_2_x.xxx[3] in the per-packet header:
894 *
895 * if, in the file header, hdr.realtick[1] is 0x34
896 * and hdr.realtick[2] is 0x12, the frames have an
897 * FCS at the end;
898 *
899 * otherwise, they have 4 bytes of junk at the end.
900 *
901 * Yes, it's strange that you have to check the *middle*
902 * of the time stamp field; you can't check for any
903 * particular value of the time stamp field.
904 *
905 * For now, we assume that to be true for 802.11 captures
906 * as well; it appears to be the case for at least one
907 * such capture - the file doesn't have 0x34 and 0x12,
908 * and the 4 bytes at the end of the frames with 0xff
909 * are junk, not an FCS.
910 *
911 * For ISDN captures, it appears, at least in some
912 * captures, to be similar, although I haven't yet
913 * checked whether it's a valid FCS.
914 *
915 * XXX - should we do this for all encapsulation types?
916 *
917 * XXX - is there some other field that *really* indicates
918 * whether we have an FCS or not? The check of the time
919 * stamp is bizarre, as we're checking the middle.
920 * Perhaps hdr.realtick[0] is 0x00, in which case time
921 * stamp units in the range 1192960 through 1193215
922 * correspond to captures with an FCS, but that's still
923 * a bit bizarre.
924 *
925 * Note that there are captures with a network type of 0
926 * (Ethernet) and capture type of 0 (NDIS) that do, and
927 * that don't, have 0x34 0x12 in them, and at least one
928 * of the NDIS captures with 0x34 0x12 in it has FCSes,
929 * so it's not as if no NDIS captures have an FCS.
930 *
931 * There are also captures with a network type of 4 (WAN),
932 * capture type of 6 (HDLC), and subtype of 2 (T1 PRI) that
933 * do, and that don't, have 0x34 0x12, so there are at least
934 * some captures taken with a WAN pod that might lack an FCS.
935 * (We haven't yet tried dissecting the 4 bytes at the
936 * end of packets with hdr_2_x.xxx[2] and hdr_2_x.xxx[3]
937 * equal to 0xff as an FCS.)
938 *
939 * All captures I've seen that have 0x34 and 0x12 *and*
940 * have at least one frame with an FCS have a value of
941 * 0x01 in xxx_x40[4]. No captures I've seen with a network
942 * type of 0 (Ethernet) missing 0x34 0x12 have 0x01 there,
943 * however. However, there's at least one capture
944 * without 0x34 and 0x12, with a network type of 0,
945 * and with 0x01 in xxx_x40[4], *without* FCSes in the
946 * frames - the 4 bytes at the end are all zero - so it's
947 * not as simple as "xxx_x40[4] = 0x01 means the 4 bytes at
948 * the end are FCSes". Also, there's also at least one
949 * 802.11 capture with an xxx_x40[4] value of 0x01 with junk
950 * rather than an FCS at the end of the frame, so xxx_x40[4]
951 * isn't an obvious flag to determine whether the
952 * capture has FCSes.
953 *
954 * There don't seem to be any other values in any of the
955 * xxx_x5..., xxx_x6...., xxx_x7.... fields
956 * that obviously correspond to frames having an FCS.
957 *
958 * 05/29/07: Examination of numerous sniffer captures suggests
959 * that the apparent correlation of certain realtick
960 * bytes to 'FCS presence' may actually be
961 * a 'false positive'.
962 * ToDo: Review analysis and update code.
963 * It might be that the ticks-per-second value
964 * is hardware-dependent, and that hardware with
965 * a particular realtick value puts an FCS there
966 * and other hardware doesn't.
967 */
968 if (version_major == 2) {
969 if (hdr.realtick[1] == 0x34 && hdr.realtick[2] == 0x12)
970 netxray->fcs_valid = true;
971 }
972 break;
973 }
974
975 /*
976 * Remember the ISDN type, as we need it to interpret the
977 * channel number in ISDN captures.
978 */
979 netxray->isdn_type = isdn_type;
980
981 /* Remember the offset after the last packet in the capture (which
982 * isn't necessarily the last packet in the file), as it appears
983 * there's sometimes crud after it.
984 * XXX: Remember 'start_offset' to help testing for 'short file' at EOF
985 */
986 netxray->wrapped = false;
987 netxray->nframes = pletoh32(&hdr.nframes);
988 netxray->start_offset = pletoh32(&hdr.start_offset);
989 netxray->end_offset = pletoh32(&hdr.end_offset);
990
991 /* Seek to the beginning of the data records. */
992 if (file_seek(wth->fh, netxray->start_offset, SEEK_SET, err) == -1) {
993 return WTAP_OPEN_ERROR;
994 }
995
996 /*
997 * Add an IDB; we don't know how many interfaces were
998 * involved, so we just say one interface, about which
999 * we only know the link-layer type, snapshot length,
1000 * and time stamp resolution.
1001 */
1002 wtap_add_generated_idb(wth);
1003
1004 return WTAP_OPEN_MINE;
1005 }
1006
1007 /* Read the next packet */
1008 static bool
1009 netxray_read(wtap *wth, wtap_rec *rec, int *err, char **err_info,
1010 int64_t *data_offset)
1011 {
1012 netxray_t *netxray = (netxray_t *)wth->priv;
1013 int padding;
1014
1015 reread:
1016 /*
1017 * Return the offset of the record header, so we can reread it
1018 * if we go back to this frame.
1019 */
1020 *data_offset = file_tell(wth->fh);
1021
1022 /* Have we reached the end of the packet data? */
1023 if (*data_offset == netxray->end_offset) {
1024 /* Yes. */
1025 *err = 0; /* it's just an EOF, not an error */
1026 return false;
1027 }
1028
1029 /* Read and process record header. */
1030 padding = netxray_process_rec_header(wth, wth->fh, rec, err, err_info);
1031 if (padding < 0) {
1032 /*
1033 * Error or EOF.
1034 */
1035 if (*err != 0) {
1036 /*
1037 * Error of some sort; give up.
1038 */
1039 return false;
1040 }
1041
1042 /* We're at EOF. Wrap?
1043 * XXX: Need to handle 'short file' cases
1044 * (Distributed Sniffer seems to have a
1045 * certain small propensity to generate 'short' files
1046 * i.e. [many] bytes are missing from the end of the file)
1047 * case 1: start_offset < end_offset
1048 * wrap will read already read packets again;
1049 * so: error with "short file"
1050 * case 2: start_offset > end_offset ("circular" file)
1051 * wrap will mean there's a gap (missing packets).
1052 * However, I don't see a good way to identify this
1053 * case so we'll just have to allow the wrap.
1054 * (Maybe there can be an error message after all
1055 * packets are read since there'll be less packets than
1056 * specified in the file header).
1057 * Note that these cases occur *only* if a 'short' eof occurs exactly
1058 * at the expected beginning of a frame header record; If there is a
1059 * partial frame header (or partial frame data) record, then the
1060 * netxray_read... functions will detect the short record.
1061 */
1062 if (netxray->start_offset < netxray->end_offset) {
1063 *err = WTAP_ERR_SHORT_READ;
1064 return false;
1065 }
1066
1067 if (!netxray->wrapped) {
1068 /* Yes. Remember that we did. */
1069 netxray->wrapped = true;
1070 if (file_seek(wth->fh, CAPTUREFILE_HEADER_SIZE,
1071 SEEK_SET, err) == -1)
1072 return false;
1073 goto reread;
1074 }
1075
1076 /* We've already wrapped - don't wrap again. */
1077 return false;
1078 }
1079
1080 /*
1081 * Read the packet data.
1082 */
1083 if (!wtap_read_bytes_buffer(wth->fh, &rec->data,
1084 rec->rec_header.packet_header.caplen, err, err_info))
1085 return false;
1086
1087 /*
1088 * If there's extra stuff at the end of the record, skip it.
1089 */
1090 if (!wtap_read_bytes(wth->fh, NULL, padding, err, err_info))
1091 return false;
1092
1093 /*
1094 * If it's an ATM packet, and we don't have enough information
1095 * from the packet header to determine its type or subtype,
1096 * attempt to guess them from the packet data.
1097 */
1098 netxray_guess_atm_type(wth, rec);
1099 return true;
1100 }
1101
1102 static bool
1103 netxray_seek_read(wtap *wth, int64_t seek_off, wtap_rec *rec,
1104 int *err, char **err_info)
1105 {
1106 if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
1107 return false;
1108
1109 if (netxray_process_rec_header(wth, wth->random_fh, rec, err,
1110 err_info) == -1) {
1111 if (*err == 0) {
1112 /*
1113 * EOF - we report that as a short read, as
1114 * we've read this once and know that it
1115 * should be there.
1116 */
1117 *err = WTAP_ERR_SHORT_READ;
1118 }
1119 return false;
1120 }
1121
1122 /*
1123 * Read the packet data.
1124 */
1125 if (!wtap_read_bytes_buffer(wth->random_fh, &rec->data,
1126 rec->rec_header.packet_header.caplen, err, err_info))
1127 return false;
1128
1129 /*
1130 * If it's an ATM packet, and we don't have enough information
1131 * from the packet header to determine its type or subtype,
1132 * attempt to guess them from the packet data.
1133 */
1134 netxray_guess_atm_type(wth, rec);
1135 return true;
1136 }
1137
1138 static int
1139 netxray_process_rec_header(wtap *wth, FILE_T fh, wtap_rec *rec,
1140 int *err, char **err_info)
1141 {
1142 netxray_t *netxray = (netxray_t *)wth->priv;
1143 union netxrayrec_hdr hdr;
1144 int hdr_size = 0;
1145 double t;
1146 int packet_size;
1147 int padding = 0;
1148
1149 /* Read record header. */
1150 switch (netxray->version_major) {
1151
1152 case 0:
1153 hdr_size = sizeof (struct old_netxrayrec_hdr);
1154 break;
1155
1156 case 1:
1157 hdr_size = sizeof (struct netxrayrec_1_x_hdr);
1158 break;
1159
1160 case 2:
1161 hdr_size = sizeof (struct netxrayrec_2_x_hdr);
1162 break;
1163 }
1164 if (!wtap_read_bytes_or_eof(fh, (void *)&hdr, hdr_size, err, err_info)) {
1165 /*
1166 * If *err is 0, we're at EOF. *err being 0 and a return
1167 * value of -1 tells our caller we're at EOF.
1168 *
1169 * Otherwise, we got an error, and *err *not* being 0
1170 * and a return value tells our caller we have an error.
1171 */
1172 return -1;
1173 }
1174
1175 /*
1176 * If this is Ethernet, 802.11, ISDN, X.25, or ATM, set the
1177 * pseudo-header.
1178 */
1179 switch (netxray->version_major) {
1180
1181 case 1:
1182 switch (wth->file_encap) {
1183
1184 case WTAP_ENCAP_ETHERNET:
1185 /*
1186 * XXX - if hdr_1_x.xxx[15] is 1
1187 * the frame appears not to have any extra
1188 * stuff at the end, but if it's 0,
1189 * there appears to be 4 bytes of stuff
1190 * at the end, but it's not an FCS.
1191 *
1192 * Or is that just the low-order bit?
1193 *
1194 * For now, we just say "no FCS".
1195 */
1196 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
1197 break;
1198 }
1199 break;
1200
1201 case 2:
1202 switch (wth->file_encap) {
1203
1204 case WTAP_ENCAP_ETHERNET:
1205 /*
1206 * It appears, at least with version 2 captures,
1207 * that we have 4 bytes of stuff (which might be
1208 * a valid FCS or might be junk) at the end of
1209 * the packet if hdr_2_x.xxx[2] and
1210 * hdr_2_x.xxx[3] are 0xff, and we don't if
1211 * they don't.
1212 *
1213 * It also appears that if the low-order bit of
1214 * hdr_2_x.xxx[8] is set, the packet has a
1215 * bad FCS.
1216 */
1217 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1218 hdr.hdr_2_x.xxx[3] == 0xff) {
1219 /*
1220 * We have 4 bytes of stuff at the
1221 * end of the frame - FCS, or junk?
1222 */
1223 if (netxray->fcs_valid) {
1224 /*
1225 * FCS.
1226 */
1227 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 4;
1228 } else {
1229 /*
1230 * Junk.
1231 */
1232 padding = 4;
1233 }
1234 } else
1235 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
1236 break;
1237
1238 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
1239 /*
1240 * It appears, in one 802.11 capture, that
1241 * we have 4 bytes of junk at the ends of
1242 * frames in which hdr_2_x.xxx[2] and
1243 * hdr_2_x.xxx[3] are 0xff; I haven't
1244 * seen any frames where it's an FCS, but,
1245 * for now, we still check the fcs_valid
1246 * flag - I also haven't seen any capture
1247 * where we'd set it based on the realtick
1248 * value.
1249 *
1250 * It also appears that if the low-order bit of
1251 * hdr_2_x.xxx[8] is set, the packet has a
1252 * bad FCS. According to Ken Mann, the 0x4 bit
1253 * is sometimes also set for errors.
1254 *
1255 * Ken also says that xxx[11] is 0x5 when the
1256 * packet is WEP-encrypted.
1257 */
1258 memset(&rec->rec_header.packet_header.pseudo_header.ieee_802_11, 0, sizeof(rec->rec_header.packet_header.pseudo_header.ieee_802_11));
1259 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1260 hdr.hdr_2_x.xxx[3] == 0xff) {
1261 /*
1262 * We have 4 bytes of stuff at the
1263 * end of the frame - FCS, or junk?
1264 */
1265 if (netxray->fcs_valid) {
1266 /*
1267 * FCS.
1268 */
1269 rec->rec_header.packet_header.pseudo_header.ieee_802_11.fcs_len = 4;
1270 } else {
1271 /*
1272 * Junk.
1273 */
1274 padding = 4;
1275 }
1276 } else
1277 rec->rec_header.packet_header.pseudo_header.ieee_802_11.fcs_len = 0;
1278
1279 rec->rec_header.packet_header.pseudo_header.ieee_802_11.decrypted = false;
1280 rec->rec_header.packet_header.pseudo_header.ieee_802_11.datapad = false;
1281 rec->rec_header.packet_header.pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
1282
1283 /*
1284 * XXX - any other information, such as PHY
1285 * type, frequency, 11n/11ac information,
1286 * etc.?
1287 */
1288 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_channel = true;
1289 rec->rec_header.packet_header.pseudo_header.ieee_802_11.channel =
1290 hdr.hdr_2_x.xxx[12];
1291
1292 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_data_rate = true;
1293 rec->rec_header.packet_header.pseudo_header.ieee_802_11.data_rate =
1294 hdr.hdr_2_x.xxx[13];
1295
1296 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_signal_percent = true;
1297 rec->rec_header.packet_header.pseudo_header.ieee_802_11.signal_percent =
1298 hdr.hdr_2_x.xxx[14];
1299
1300 /*
1301 * According to Ken Mann, at least in the captures
1302 * he's seen, xxx[15] is the noise level, which
1303 * is either 0xFF meaning "none reported" or a value
1304 * from 0x00 to 0x7F for 0 to 100%.
1305 */
1306 if (hdr.hdr_2_x.xxx[15] != 0xFF) {
1307 rec->rec_header.packet_header.pseudo_header.ieee_802_11.has_noise_percent = true;
1308 rec->rec_header.packet_header.pseudo_header.ieee_802_11.noise_percent =
1309 hdr.hdr_2_x.xxx[15]*100/127;
1310 }
1311 break;
1312
1313 case WTAP_ENCAP_ISDN:
1314 /*
1315 * ISDN.
1316 *
1317 * The bottommost bit of byte 12 of hdr_2_x.xxx
1318 * is the direction flag.
1319 *
1320 * The bottom 5 bits of byte 13 of hdr_2_x.xxx
1321 * are the channel number, but some mapping is
1322 * required for PRI. (Is it really just the time
1323 * slot?)
1324 */
1325 rec->rec_header.packet_header.pseudo_header.isdn.uton =
1326 (hdr.hdr_2_x.xxx[12] & 0x01);
1327 rec->rec_header.packet_header.pseudo_header.isdn.channel =
1328 hdr.hdr_2_x.xxx[13] & 0x1F;
1329 switch (netxray->isdn_type) {
1330
1331 case 1:
1332 /*
1333 * E1 PRI. Channel numbers 0 and 16
1334 * are the D channel; channel numbers 1
1335 * through 15 are B1 through B15; channel
1336 * numbers 17 through 31 are B16 through
1337 * B31.
1338 */
1339 if (rec->rec_header.packet_header.pseudo_header.isdn.channel == 16)
1340 rec->rec_header.packet_header.pseudo_header.isdn.channel = 0;
1341 else if (rec->rec_header.packet_header.pseudo_header.isdn.channel > 16)
1342 rec->rec_header.packet_header.pseudo_header.isdn.channel -= 1;
1343 break;
1344
1345 case 2:
1346 /*
1347 * T1 PRI. Channel numbers 0 and 24
1348 * are the D channel; channel numbers 1
1349 * through 23 are B1 through B23.
1350 */
1351 if (rec->rec_header.packet_header.pseudo_header.isdn.channel == 24)
1352 rec->rec_header.packet_header.pseudo_header.isdn.channel = 0;
1353 else if (rec->rec_header.packet_header.pseudo_header.isdn.channel > 24)
1354 rec->rec_header.packet_header.pseudo_header.isdn.channel -= 1;
1355 break;
1356 }
1357
1358 /*
1359 * It appears, at least with version 2 captures,
1360 * that we have 4 bytes of stuff (which might be
1361 * a valid FCS or might be junk) at the end of
1362 * the packet if hdr_2_x.xxx[2] and
1363 * hdr_2_x.xxx[3] are 0xff, and we don't if
1364 * they don't.
1365 *
1366 * XXX - does the low-order bit of hdr_2_x.xxx[8]
1367 * indicate a bad FCS, as is the case with
1368 * Ethernet?
1369 */
1370 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1371 hdr.hdr_2_x.xxx[3] == 0xff) {
1372 /*
1373 * FCS, or junk, at the end.
1374 * XXX - is it an FCS if "fcs_valid" is
1375 * true?
1376 */
1377 padding = 4;
1378 }
1379 break;
1380
1381 case WTAP_ENCAP_LAPB:
1382 case WTAP_ENCAP_FRELAY_WITH_PHDR:
1383 /*
1384 * LAPB/X.25 and Frame Relay.
1385 *
1386 * The bottommost bit of byte 12 of hdr_2_x.xxx
1387 * is the direction flag. (Probably true for other
1388 * HDLC encapsulations as well.)
1389 */
1390 rec->rec_header.packet_header.pseudo_header.dte_dce.flags =
1391 (hdr.hdr_2_x.xxx[12] & 0x01) ? 0x00 : FROM_DCE;
1392
1393 /*
1394 * It appears, at least with version 2 captures,
1395 * that we have 4 bytes of stuff (which might be
1396 * a valid FCS or might be junk) at the end of
1397 * the packet if hdr_2_x.xxx[2] and
1398 * hdr_2_x.xxx[3] are 0xff, and we don't if
1399 * they don't.
1400 *
1401 * XXX - does the low-order bit of hdr_2_x.xxx[8]
1402 * indicate a bad FCS, as is the case with
1403 * Ethernet?
1404 */
1405 if (hdr.hdr_2_x.xxx[2] == 0xff &&
1406 hdr.hdr_2_x.xxx[3] == 0xff) {
1407 /*
1408 * FCS, or junk, at the end.
1409 * XXX - is it an FCS if "fcs_valid" is
1410 * true?
1411 */
1412 padding = 4;
1413 }
1414 break;
1415
1416 case WTAP_ENCAP_PPP_WITH_PHDR:
1417 case WTAP_ENCAP_SDLC:
1418 case WTAP_ENCAP_CHDLC_WITH_PHDR:
1419 rec->rec_header.packet_header.pseudo_header.p2p.sent =
1420 (hdr.hdr_2_x.xxx[12] & 0x01) ? true : false;
1421 break;
1422
1423 case WTAP_ENCAP_ATM_PDUS_UNTRUNCATED:
1424 /*
1425 * XXX - the low-order bit of hdr_2_x.xxx[8]
1426 * seems to indicate some sort of error. In
1427 * at least one capture, a number of packets
1428 * have that flag set, and they appear either
1429 * to be the beginning part of an incompletely
1430 * reassembled AAL5 PDU, with either checksum
1431 * errors at higher levels (possibly due to
1432 * the packet being reported as shorter than
1433 * it actually is, and checksumming failing
1434 * because it doesn't include all the data)
1435 * or "Malformed frame" errors from being
1436 * too short, or appear to be later parts
1437 * of an incompletely reassembled AAL5 PDU
1438 * with the last one in a sequence of errors
1439 * having what looks like an AAL5 trailer,
1440 * with a length and checksum.
1441 *
1442 * Does it just mean "reassembly failed",
1443 * as appears to be the case in those
1444 * packets, or does it mean "CRC error"
1445 * at the AAL5 layer (which would be the
1446 * case if you were treating an incompletely
1447 * reassembled PDU as a completely reassembled
1448 * PDU, although you'd also expect a length
1449 * error in that case), or does it mean
1450 * "generic error", with some other flag
1451 * or flags indicating what particular
1452 * error occurred? The documentation
1453 * for Sniffer Pro 4.7 indicates a bunch
1454 * of different error types, both in general
1455 * and for ATM in particular.
1456 *
1457 * No obvious bits in hdr_2_x.xxx appear
1458 * to be additional flags of that sort.
1459 *
1460 * XXX - in that capture, I see several
1461 * reassembly errors in a row; should those
1462 * packets be reassembled in the ATM dissector?
1463 * What happens if a reassembly fails because
1464 * a cell is bad?
1465 */
1466 rec->rec_header.packet_header.pseudo_header.atm.flags = 0;
1467 if (hdr.hdr_2_x.xxx[8] & 0x01)
1468 rec->rec_header.packet_header.pseudo_header.atm.flags |= ATM_REASSEMBLY_ERROR;
1469 /*
1470 * XXX - is 0x08 an "OAM cell" flag?
1471 * Are the 0x01 and 0x02 bits error indications?
1472 * Some packets in one capture that have the
1473 * 0x01 bit set in hdr_2_x.xxx[8] and that
1474 * appear to have been reassembled completely
1475 * but have a bad CRC have 0x03 in hdr_2_x.xxx[9]
1476 * (and don't have the 0x20 bit set).
1477 *
1478 * In the capture with incomplete reassemblies,
1479 * all packets have the 0x20 bit set. In at
1480 * least some of the captures with complete
1481 * reassemblies with CRC errors, no packets
1482 * have the 0x20 bit set.
1483 *
1484 * Are hdr_2_x.xxx[8] and hdr_2_x.xxx[9] a 16-bit
1485 * flag field?
1486 */
1487 if (hdr.hdr_2_x.xxx[9] & 0x04)
1488 rec->rec_header.packet_header.pseudo_header.atm.flags |= ATM_RAW_CELL;
1489 rec->rec_header.packet_header.pseudo_header.atm.vpi = hdr.hdr_2_x.xxx[11];
1490 rec->rec_header.packet_header.pseudo_header.atm.vci = pletoh16(&hdr.hdr_2_x.xxx[12]);
1491 rec->rec_header.packet_header.pseudo_header.atm.channel =
1492 (hdr.hdr_2_x.xxx[15] & 0x10)? 1 : 0;
1493 rec->rec_header.packet_header.pseudo_header.atm.cells = 0;
1494
1495 /*
1496 * XXX - the uppermost bit of hdr_2_xxx[0]
1497 * looks as if it might be a flag of some sort.
1498 * The remaining 3 bits appear to be an AAL
1499 * type - 5 is, surprise surprise, AAL5.
1500 */
1501 switch (hdr.hdr_2_x.xxx[0] & 0x70) {
1502
1503 case 0x00: /* Unknown */
1504 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1505 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1506 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1507 break;
1508
1509 case 0x10: /* XXX - AAL1? */
1510 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1511 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1512 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1513 break;
1514
1515 case 0x20: /* XXX - AAL2? */
1516 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1517 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1518 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1519 break;
1520
1521 case 0x40: /* XXX - AAL3/4? */
1522 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_UNKNOWN;
1523 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1524 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1525 break;
1526
1527 case 0x30: /* XXX - AAL5 cells seen with this */
1528 case 0x50: /* AAL5 (including signalling) */
1529 case 0x60: /* XXX - AAL5 cells seen with this */
1530 case 0x70: /* XXX - AAL5 cells seen with this */
1531 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_5;
1532 /*
1533 * XXX - is the 0x08 bit of hdr_2_x.xxx[0]
1534 * a flag? I've not yet seen a case where
1535 * it matters.
1536 */
1537 switch (hdr.hdr_2_x.xxx[0] & 0x07) {
1538
1539 case 0x01:
1540 case 0x02: /* Signalling traffic */
1541 rec->rec_header.packet_header.pseudo_header.atm.aal = AAL_SIGNALLING;
1542 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1543 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1544 break;
1545
1546 case 0x03: /* ILMI */
1547 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_ILMI;
1548 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1549 break;
1550
1551 case 0x00:
1552 case 0x04:
1553 case 0x05:
1554 /*
1555 * I've seen a frame with type
1556 * 0x30 and subtype 0x08 that
1557 * was LANE 802.3, a frame
1558 * with type 0x30 and subtype
1559 * 0x04 that was LANE 802.3,
1560 * and another frame with type
1561 * 0x30 and subtype 0x08 that
1562 * was junk with a string in
1563 * it that had also appeared
1564 * in some CDP and LE Control
1565 * frames, and that was preceded
1566 * by a malformed LE Control
1567 * frame - was that a reassembly
1568 * failure?
1569 *
1570 * I've seen frames with type
1571 * 0x50 and subtype 0x0c, some
1572 * of which were LE Control
1573 * frames, and at least one
1574 * of which was neither an LE
1575 * Control frame nor a LANE
1576 * 802.3 frame, and contained
1577 * the string "ForeThought_6.2.1
1578 * Alpha" - does that imply
1579 * FORE's own encapsulation,
1580 * or was this a reassembly failure?
1581 * The latter frame was preceded
1582 * by a malformed LE Control
1583 * frame.
1584 *
1585 * I've seen a couple of frames
1586 * with type 0x60 and subtype 0x00,
1587 * one of which was LANE 802.3 and
1588 * one of which was LE Control.
1589 * I've seen one frame with type
1590 * 0x60 and subtype 0x0c, which
1591 * was LANE 802.3.
1592 *
1593 * I've seen a couple of frames
1594 * with type 0x70 and subtype 0x00,
1595 * both of which were LANE 802.3.
1596 */
1597 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_LANE;
1598 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1599 break;
1600
1601 case 0x06: /* XXX - not seen yet */
1602 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_UNKNOWN;
1603 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN;
1604 break;
1605
1606 case 0x07: /* LLC multiplexed */
1607 rec->rec_header.packet_header.pseudo_header.atm.type = TRAF_LLCMX; /* XXX */
1608 rec->rec_header.packet_header.pseudo_header.atm.subtype = TRAF_ST_UNKNOWN; /* XXX */
1609 break;
1610 }
1611 break;
1612 }
1613 break;
1614 }
1615 break;
1616 }
1617
1618 rec->rec_type = REC_TYPE_PACKET;
1619 rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
1620 if (netxray->version_major == 0) {
1621 rec->presence_flags = WTAP_HAS_TS;
1622 t = (double)pletoh32(&hdr.old_hdr.timelo)
1623 + (double)pletoh32(&hdr.old_hdr.timehi)*4294967296.0;
1624 t /= netxray->ticks_per_sec;
1625 t -= netxray->start_timestamp;
1626 rec->ts.secs = netxray->start_time + (long)t;
1627 rec->ts.nsecs = (int)((t-(double)(unsigned long)(t))
1628 *1.0e9);
1629 /*
1630 * We subtract the padding from the packet size, so our caller
1631 * doesn't see it.
1632 */
1633 packet_size = pletoh16(&hdr.old_hdr.len);
1634 rec->rec_header.packet_header.caplen = packet_size - padding;
1635 rec->rec_header.packet_header.len = rec->rec_header.packet_header.caplen;
1636 } else {
1637 rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
1638 t = (double)pletoh32(&hdr.hdr_1_x.timelo)
1639 + (double)pletoh32(&hdr.hdr_1_x.timehi)*4294967296.0;
1640 t /= netxray->ticks_per_sec;
1641 t -= netxray->start_timestamp;
1642 rec->ts.secs = netxray->start_time + (time_t)t;
1643 rec->ts.nsecs = (int)((t-(double)(unsigned long)(t))
1644 *1.0e9);
1645 /*
1646 * We subtract the padding from the packet size, so our caller
1647 * doesn't see it.
1648 */
1649 packet_size = pletoh16(&hdr.hdr_1_x.incl_len);
1650 rec->rec_header.packet_header.caplen = packet_size - padding;
1651 rec->rec_header.packet_header.len = pletoh16(&hdr.hdr_1_x.orig_len) - padding;
1652 }
1653
1654 return padding;
1655 }
1656
1657 static void
1658 netxray_guess_atm_type(wtap *wth, wtap_rec *rec)
1659 {
1660 if (wth->file_encap == WTAP_ENCAP_ATM_PDUS_UNTRUNCATED &&
1661 !(rec->rec_header.packet_header.pseudo_header.atm.flags & ATM_REASSEMBLY_ERROR)) {
1662 if (rec->rec_header.packet_header.pseudo_header.atm.aal == AAL_UNKNOWN) {
1663 /*
1664 * Try to guess the type and subtype based
1665 * on the VPI/VCI and packet contents.
1666 */
1667 atm_guess_traffic_type(rec);
1668 } else if (rec->rec_header.packet_header.pseudo_header.atm.aal == AAL_5 &&
1669 rec->rec_header.packet_header.pseudo_header.atm.type == TRAF_LANE) {
1670 /*
1671 * Try to guess the subtype based on the
1672 * packet contents.
1673 */
1674 atm_guess_lane_type(rec);
1675 }
1676 }
1677 }
1678
1679 typedef struct {
1680 bool first_frame;
1681 uint32_t start_secs;
1682 uint32_t nframes;
1683 } netxray_dump_t;
1684
1685 static const struct {
1686 int wtap_encap_value;
1687 int ndis_value;
1688 } wtap_encap_1_1[] = {
1689 { WTAP_ENCAP_ETHERNET, 0 }, /* -> NDIS Ethernet */
1690 { WTAP_ENCAP_TOKEN_RING, 1 }, /* -> NDIS Token Ring */
1691 { WTAP_ENCAP_FDDI, 2 }, /* -> NDIS FDDI */
1692 { WTAP_ENCAP_FDDI_BITSWAPPED, 2 }, /* -> NDIS FDDI */
1693 };
1694 #define NUM_WTAP_ENCAPS_1_1 array_length(wtap_encap_1_1)
1695
1696 static int
1697 wtap_encap_to_netxray_1_1_encap(int encap)
1698 {
1699 unsigned int i;
1700
1701 for (i = 0; i < NUM_WTAP_ENCAPS_1_1; i++) {
1702 if (encap == wtap_encap_1_1[i].wtap_encap_value)
1703 return wtap_encap_1_1[i].ndis_value;
1704 }
1705
1706 return -1;
1707 }
1708
1709 /* Returns 0 if we could write the specified encapsulation type,
1710 an error indication otherwise. */
1711 static int
1712 netxray_dump_can_write_encap_1_1(int encap)
1713 {
1714 /* Per-packet encapsulations aren't supported. */
1715 if (encap == WTAP_ENCAP_PER_PACKET)
1716 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1717
1718 if (wtap_encap_to_netxray_1_1_encap(encap) == -1)
1719 return WTAP_ERR_UNWRITABLE_ENCAP;
1720
1721 return 0;
1722 }
1723
1724 /* Returns true on success, false on failure; sets "*err" to an error code on
1725 failure */
1726 static bool
1727 netxray_dump_open_1_1(wtap_dumper *wdh, int *err, char **err_info _U_)
1728 {
1729 netxray_dump_t *netxray;
1730
1731 wdh->subtype_write = netxray_dump_1_1;
1732 wdh->subtype_finish = netxray_dump_finish_1_1;
1733
1734 /* We can't fill in all the fields in the file header, as we
1735 haven't yet written any packets. As we'll have to rewrite
1736 the header when we've written out all the packets, we just
1737 skip over the header for now. */
1738 if (wtap_dump_file_seek(wdh, CAPTUREFILE_HEADER_SIZE, SEEK_SET, err) == -1)
1739 return false;
1740 wdh->bytes_dumped += CAPTUREFILE_HEADER_SIZE;
1741
1742 netxray = g_new(netxray_dump_t, 1);
1743 wdh->priv = (void *)netxray;
1744 netxray->first_frame = true;
1745 netxray->start_secs = 0;
1746 netxray->nframes = 0;
1747
1748 return true;
1749 }
1750
1751 /* Write a record for a packet to a dump file.
1752 Returns true on success, false on failure. */
1753 static bool
1754 netxray_dump_1_1(wtap_dumper *wdh,
1755 const wtap_rec *rec,
1756 const uint8_t *pd, int *err, char **err_info _U_)
1757 {
1758 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
1759 uint64_t timestamp;
1760 uint32_t t32;
1761 struct netxrayrec_1_x_hdr rec_hdr;
1762
1763 /* We can only write packet records. */
1764 if (rec->rec_type != REC_TYPE_PACKET) {
1765 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
1766 return false;
1767 }
1768
1769 /*
1770 * Make sure this packet doesn't have a link-layer type that
1771 * differs from the one for the file.
1772 */
1773 if (wdh->file_encap != rec->rec_header.packet_header.pkt_encap) {
1774 *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1775 return false;
1776 }
1777
1778 /* The captured length field is 16 bits, so there's a hard
1779 limit of 65535. */
1780 if (rec->rec_header.packet_header.caplen > 65535) {
1781 *err = WTAP_ERR_PACKET_TOO_LARGE;
1782 return false;
1783 }
1784
1785 /* NetXRay/Windows Sniffer files have a capture start date/time
1786 in the header, in a UNIX-style format, with one-second resolution,
1787 and a start time stamp with microsecond resolution that's just
1788 an arbitrary time stamp relative to some unknown time (boot
1789 time?), and have times relative to the start time stamp in
1790 the packet headers; pick the seconds value of the time stamp
1791 of the first packet as the UNIX-style start date/time, and make
1792 the high-resolution start time stamp 0, with the time stamp of
1793 packets being the delta between the stamp of the packet and
1794 the stamp of the first packet with the microseconds part 0. */
1795 if (netxray->first_frame) {
1796 netxray->first_frame = false;
1797 /*
1798 * XXX - NetXRay ran on Windows, where MSVC's localtime()
1799 * can't handle time_t < 0, so *maybe* it makes sense
1800 * to allow time stamps up to 2^32-1 "seconds since the
1801 * Epoch", but maybe the start time in those files is
1802 * signed, in which case we should check against
1803 * INT32_MIN and INT32_MAX and make start_secs a
1804 * int32_t.
1805 */
1806 if (rec->ts.secs < 0 || rec->ts.secs > WTAP_NSTIME_32BIT_SECS_MAX) {
1807 *err = WTAP_ERR_TIME_STAMP_NOT_SUPPORTED;
1808 return false;
1809 }
1810 netxray->start_secs = (uint32_t)rec->ts.secs;
1811 }
1812
1813 /* build the header for each packet */
1814 memset(&rec_hdr, '\0', sizeof(rec_hdr));
1815 timestamp = ((uint64_t)rec->ts.secs - (uint64_t)netxray->start_secs)*1000000
1816 + ((uint64_t)rec->ts.nsecs)/1000;
1817 t32 = (uint32_t)(timestamp%INT64_C(4294967296));
1818 rec_hdr.timelo = GUINT32_TO_LE(t32);
1819 t32 = (uint32_t)(timestamp/INT64_C(4294967296));
1820 rec_hdr.timehi = GUINT32_TO_LE(t32);
1821 rec_hdr.orig_len = GUINT16_TO_LE(rec->rec_header.packet_header.len);
1822 rec_hdr.incl_len = GUINT16_TO_LE(rec->rec_header.packet_header.caplen);
1823
1824 if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof(rec_hdr), err))
1825 return false;
1826
1827 /* write the packet data */
1828 if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
1829 return false;
1830
1831 netxray->nframes++;
1832
1833 return true;
1834 }
1835
1836 /* Finish writing to a dump file.
1837 Returns true on success, false on failure. */
1838 static bool
1839 netxray_dump_finish_1_1(wtap_dumper *wdh, int *err, char **err_info _U_)
1840 {
1841 char hdr_buf[CAPTUREFILE_HEADER_SIZE - sizeof(netxray_magic)];
1842 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
1843 int64_t filelen;
1844 struct netxray_hdr file_hdr;
1845
1846 if (-1 == (filelen = wtap_dump_file_tell(wdh, err)))
1847 return false;
1848
1849 /* Go back to beginning */
1850 if (wtap_dump_file_seek(wdh, 0, SEEK_SET, err) == -1)
1851 return false;
1852
1853 /* Rewrite the file header. */
1854 if (!wtap_dump_file_write(wdh, netxray_magic, sizeof netxray_magic, err))
1855 return false;
1856
1857 /* "sniffer" version ? */
1858 memset(&file_hdr, '\0', sizeof file_hdr);
1859 memcpy(file_hdr.version, vers_1_1, sizeof vers_1_1);
1860 file_hdr.start_time = GUINT32_TO_LE(netxray->start_secs);
1861 file_hdr.nframes = GUINT32_TO_LE(netxray->nframes);
1862 file_hdr.start_offset = GUINT32_TO_LE(CAPTUREFILE_HEADER_SIZE);
1863 /* XXX - large files? */
1864 file_hdr.end_offset = GUINT32_TO_LE((uint32_t)filelen);
1865 file_hdr.network = wtap_encap_to_netxray_1_1_encap(wdh->file_encap);
1866 file_hdr.timelo = GUINT32_TO_LE(0);
1867 file_hdr.timehi = GUINT32_TO_LE(0);
1868
1869 memset(hdr_buf, '\0', sizeof hdr_buf);
1870 memcpy(hdr_buf, &file_hdr, sizeof(file_hdr));
1871 if (!wtap_dump_file_write(wdh, hdr_buf, sizeof hdr_buf, err))
1872 return false;
1873
1874 /* Don't double-count the size of the file header */
1875 wdh->bytes_dumped = filelen;
1876 return true;
1877 }
1878
1879 static const struct {
1880 int wtap_encap_value;
1881 int ndis_value;
1882 } wtap_encap_2_0[] = {
1883 { WTAP_ENCAP_ETHERNET, 0 }, /* -> NDIS Ethernet */
1884 { WTAP_ENCAP_TOKEN_RING, 1 }, /* -> NDIS Token Ring */
1885 { WTAP_ENCAP_FDDI, 2 }, /* -> NDIS FDDI */
1886 { WTAP_ENCAP_FDDI_BITSWAPPED, 2 }, /* -> NDIS FDDI */
1887 { WTAP_ENCAP_PPP_WITH_PHDR, 3 }, /* -> NDIS WAN */
1888 { WTAP_ENCAP_FRELAY_WITH_PHDR, 3 }, /* -> NDIS WAN */
1889 { WTAP_ENCAP_LAPB, 3 }, /* -> NDIS WAN */
1890 { WTAP_ENCAP_SDLC, 3 }, /* -> NDIS WAN */
1891 };
1892 #define NUM_WTAP_ENCAPS_2_0 array_length(wtap_encap_2_0)
1893
1894 static int
1895 wtap_encap_to_netxray_2_0_encap(int encap)
1896 {
1897 unsigned int i;
1898
1899 for (i = 0; i < NUM_WTAP_ENCAPS_2_0; i++) {
1900 if (encap == wtap_encap_2_0[i].wtap_encap_value)
1901 return wtap_encap_2_0[i].ndis_value;
1902 }
1903
1904 return -1;
1905 }
1906
1907 /* Returns 0 if we could write the specified encapsulation type,
1908 an error indication otherwise. */
1909 static int
1910 netxray_dump_can_write_encap_2_0(int encap)
1911 {
1912 /* Per-packet encapsulations aren't supported. */
1913 if (encap == WTAP_ENCAP_PER_PACKET)
1914 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1915
1916 if (wtap_encap_to_netxray_2_0_encap(encap) == -1)
1917 return WTAP_ERR_UNWRITABLE_ENCAP;
1918
1919 return 0;
1920 }
1921
1922 /* Returns true on success, false on failure; sets "*err" to an error code on
1923 failure */
1924 static bool
1925 netxray_dump_open_2_0(wtap_dumper *wdh, int *err, char **err_info _U_)
1926 {
1927 netxray_dump_t *netxray;
1928
1929 wdh->subtype_write = netxray_dump_2_0;
1930 wdh->subtype_finish = netxray_dump_finish_2_0;
1931
1932 /* We can't fill in all the fields in the file header, as we
1933 haven't yet written any packets. As we'll have to rewrite
1934 the header when we've written out all the packets, we just
1935 skip over the header for now. */
1936 if (wtap_dump_file_seek(wdh, CAPTUREFILE_HEADER_SIZE, SEEK_SET, err) == -1)
1937 return false;
1938 wdh->bytes_dumped += CAPTUREFILE_HEADER_SIZE;
1939
1940 netxray = g_new(netxray_dump_t, 1);
1941 wdh->priv = (void *)netxray;
1942 netxray->first_frame = true;
1943 netxray->start_secs = 0;
1944 netxray->nframes = 0;
1945
1946 return true;
1947 }
1948
1949 /* Write a record for a packet to a dump file.
1950 Returns true on success, false on failure. */
1951 static bool
1952 netxray_dump_2_0(wtap_dumper *wdh,
1953 const wtap_rec *rec,
1954 const uint8_t *pd, int *err, char **err_info _U_)
1955 {
1956 const union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
1957 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
1958 uint64_t timestamp;
1959 uint32_t t32;
1960 struct netxrayrec_2_x_hdr rec_hdr;
1961
1962 /* We can only write packet records. */
1963 if (rec->rec_type != REC_TYPE_PACKET) {
1964 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
1965 return false;
1966 }
1967
1968 /*
1969 * Make sure this packet doesn't have a link-layer type that
1970 * differs from the one for the file.
1971 */
1972 if (wdh->file_encap != rec->rec_header.packet_header.pkt_encap) {
1973 *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
1974 return false;
1975 }
1976
1977 /* Don't write anything we're not willing to read. */
1978 if (rec->rec_header.packet_header.caplen > WTAP_MAX_PACKET_SIZE_STANDARD) {
1979 *err = WTAP_ERR_PACKET_TOO_LARGE;
1980 return false;
1981 }
1982
1983 /* NetXRay/Windows Sniffer files have a capture start date/time
1984 in the header, in a UNIX-style format, with one-second resolution,
1985 and a start time stamp with microsecond resolution that's just
1986 an arbitrary time stamp relative to some unknown time (boot
1987 time?), and have times relative to the start time stamp in
1988 the packet headers; pick the seconds value of the time stamp
1989 of the first packet as the UNIX-style start date/time, and make
1990 the high-resolution start time stamp 0, with the time stamp of
1991 packets being the delta between the stamp of the packet and
1992 the stamp of the first packet with the microseconds part 0. */
1993 if (netxray->first_frame) {
1994 netxray->first_frame = false;
1995 /*
1996 * XXX - NetXRay ran on Windows, where MSVC's localtime()
1997 * can't handle time_t < 0, so *maybe* it makes sense
1998 * to allow time stamps up to 2^32-1 "seconds since the
1999 * Epoch", but maybe the start time in those files is
2000 * signed, in which case we should check against
2001 * INT32_MIN and INT32_MAX and make start_secs a
2002 * int32_t.
2003 */
2004 if (rec->ts.secs < 0 || rec->ts.secs > WTAP_NSTIME_32BIT_SECS_MAX) {
2005 *err = WTAP_ERR_TIME_STAMP_NOT_SUPPORTED;
2006 return false;
2007 }
2008 netxray->start_secs = (uint32_t)rec->ts.secs;
2009 }
2010
2011 /* build the header for each packet */
2012 memset(&rec_hdr, '\0', sizeof(rec_hdr));
2013 timestamp = ((uint64_t)rec->ts.secs - (uint64_t)netxray->start_secs)*1000000
2014 + ((uint64_t)rec->ts.nsecs)/1000;
2015 t32 = (uint32_t)(timestamp%INT64_C(4294967296));
2016 rec_hdr.timelo = GUINT32_TO_LE(t32);
2017 t32 = (uint32_t)(timestamp/INT64_C(4294967296));
2018 rec_hdr.timehi = GUINT32_TO_LE(t32);
2019 rec_hdr.orig_len = GUINT16_TO_LE(rec->rec_header.packet_header.len);
2020 rec_hdr.incl_len = GUINT16_TO_LE(rec->rec_header.packet_header.caplen);
2021
2022 switch (rec->rec_header.packet_header.pkt_encap) {
2023
2024 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
2025 rec_hdr.xxx[12] =
2026 pseudo_header->ieee_802_11.has_channel ?
2027 pseudo_header->ieee_802_11.channel :
2028 0;
2029 rec_hdr.xxx[13] =
2030 pseudo_header->ieee_802_11.has_data_rate ?
2031 (uint8_t)pseudo_header->ieee_802_11.data_rate :
2032 0;
2033 rec_hdr.xxx[14] =
2034 pseudo_header->ieee_802_11.has_signal_percent ?
2035 pseudo_header->ieee_802_11.signal_percent :
2036 0;
2037 rec_hdr.xxx[15] =
2038 pseudo_header->ieee_802_11.has_noise_percent ?
2039 pseudo_header->ieee_802_11.noise_percent*127/100 :
2040 0xFF;
2041 break;
2042
2043 case WTAP_ENCAP_PPP_WITH_PHDR:
2044 case WTAP_ENCAP_SDLC:
2045 rec_hdr.xxx[12] |= pseudo_header->p2p.sent ? 0x01 : 0x00;
2046 break;
2047
2048 case WTAP_ENCAP_FRELAY_WITH_PHDR:
2049 rec_hdr.xxx[12] |= (pseudo_header->dte_dce.flags & FROM_DCE) ? 0x00 : 0x01;
2050 break;
2051 }
2052
2053 if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof(rec_hdr), err))
2054 return false;
2055
2056 /* write the packet data */
2057 if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
2058 return false;
2059
2060 netxray->nframes++;
2061
2062 return true;
2063 }
2064
2065 /* Finish writing to a dump file.
2066 Returns true on success, false on failure. */
2067 static bool
2068 netxray_dump_finish_2_0(wtap_dumper *wdh, int *err, char **err_info _U_)
2069 {
2070 char hdr_buf[CAPTUREFILE_HEADER_SIZE - sizeof(netxray_magic)];
2071 netxray_dump_t *netxray = (netxray_dump_t *)wdh->priv;
2072 int64_t filelen;
2073 struct netxray_hdr file_hdr;
2074
2075 if (-1 == (filelen = wtap_dump_file_tell(wdh, err)))
2076 return false;
2077
2078 /* Go back to beginning */
2079 if (wtap_dump_file_seek(wdh, 0, SEEK_SET, err) == -1)
2080 return false;
2081
2082 /* Rewrite the file header. */
2083 if (!wtap_dump_file_write(wdh, netxray_magic, sizeof netxray_magic, err))
2084 return false;
2085
2086 /* "sniffer" version ? */
2087 memset(&file_hdr, '\0', sizeof file_hdr);
2088 memcpy(file_hdr.version, vers_2_001, sizeof vers_2_001);
2089 file_hdr.start_time = GUINT32_TO_LE(netxray->start_secs);
2090 file_hdr.nframes = GUINT32_TO_LE(netxray->nframes);
2091 file_hdr.start_offset = GUINT32_TO_LE(CAPTUREFILE_HEADER_SIZE);
2092 /* XXX - large files? */
2093 file_hdr.end_offset = GUINT32_TO_LE((uint32_t)filelen);
2094 file_hdr.network = wtap_encap_to_netxray_2_0_encap(wdh->file_encap);
2095 file_hdr.timelo = GUINT32_TO_LE(0);
2096 file_hdr.timehi = GUINT32_TO_LE(0);
2097 switch (wdh->file_encap) {
2098
2099 case WTAP_ENCAP_PPP_WITH_PHDR:
2100 file_hdr.captype = WAN_CAPTYPE_PPP;
2101 break;
2102
2103 case WTAP_ENCAP_FRELAY_WITH_PHDR:
2104 file_hdr.captype = WAN_CAPTYPE_FRELAY;
2105 break;
2106
2107 case WTAP_ENCAP_LAPB:
2108 file_hdr.captype = WAN_CAPTYPE_HDLC;
2109 file_hdr.wan_hdlc_subsub_captype = 0;
2110 break;
2111
2112 case WTAP_ENCAP_SDLC:
2113 file_hdr.captype = WAN_CAPTYPE_SDLC;
2114 break;
2115
2116 default:
2117 file_hdr.captype = CAPTYPE_NDIS;
2118 break;
2119 }
2120
2121 memset(hdr_buf, '\0', sizeof hdr_buf);
2122 memcpy(hdr_buf, &file_hdr, sizeof(file_hdr));
2123 if (!wtap_dump_file_write(wdh, hdr_buf, sizeof hdr_buf, err))
2124 return false;
2125
2126 /* Don't double-count the size of the file header */
2127 wdh->bytes_dumped = filelen;
2128 return true;
2129 }
2130
2131 static const struct supported_block_type netxray_old_blocks_supported[] = {
2132 /*
2133 * We support packet blocks, with no comments or other options.
2134 */
2135 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2136 };
2137
2138 static const struct file_type_subtype_info netxray_old_info = {
2139 "Cinco Networks NetXRay 1.x", "netxray1", "cap", NULL,
2140 true, BLOCKS_SUPPORTED(netxray_old_blocks_supported),
2141 NULL, NULL, NULL
2142 };
2143
2144 static const struct supported_block_type netxray_1_0_blocks_supported[] = {
2145 /*
2146 * We support packet blocks, with no comments or other options.
2147 */
2148 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2149 };
2150
2151 static const struct file_type_subtype_info netxray_1_0_info = {
2152 "Cinco Networks NetXRay 2.0 or later", "netxray2", "cap", NULL,
2153 true, BLOCKS_SUPPORTED(netxray_1_0_blocks_supported),
2154 NULL, NULL, NULL
2155 };
2156
2157 static const struct supported_block_type netxray_1_1_blocks_supported[] = {
2158 /*
2159 * We support packet blocks, with no comments or other options.
2160 */
2161 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2162 };
2163
2164 static const struct file_type_subtype_info netxray_1_1_info = {
2165 "NetXray, Sniffer (Windows) 1.1", "ngwsniffer_1_1", "cap", NULL,
2166 true, BLOCKS_SUPPORTED(netxray_1_1_blocks_supported),
2167 netxray_dump_can_write_encap_1_1, netxray_dump_open_1_1, NULL
2168 };
2169
2170 static const struct supported_block_type netxray_2_00x_blocks_supported[] = {
2171 /*
2172 * We support packet blocks, with no comments or other options.
2173 */
2174 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
2175 };
2176
2177 static const struct file_type_subtype_info netxray_2_00x_info = {
2178 "Sniffer (Windows) 2.00x", "ngwsniffer_2_0", "cap", "caz",
2179 true, BLOCKS_SUPPORTED(netxray_2_00x_blocks_supported),
2180 netxray_dump_can_write_encap_2_0, netxray_dump_open_2_0, NULL
2181 };
2182
2183 void register_netxray(void)
2184 {
2185 netxray_old_file_type_subtype = wtap_register_file_type_subtype(&netxray_old_info);
2186 netxray_1_0_file_type_subtype = wtap_register_file_type_subtype(&netxray_1_0_info);
2187 netxray_1_1_file_type_subtype = wtap_register_file_type_subtype(&netxray_1_1_info);
2188 netxray_2_00x_file_type_subtype = wtap_register_file_type_subtype(&netxray_2_00x_info);
2189
2190 /*
2191 * Register names for backwards compatibility with the
2192 * wtap_filetypes table in Lua.
2193 */
2194 wtap_register_backwards_compatibility_lua_name("NETXRAY_OLD",
2195 netxray_old_file_type_subtype);
2196 wtap_register_backwards_compatibility_lua_name("NETXRAY_1_0",
2197 netxray_1_0_file_type_subtype);
2198 wtap_register_backwards_compatibility_lua_name("NETXRAY_1_1",
2199 netxray_1_1_file_type_subtype);
2200 wtap_register_backwards_compatibility_lua_name("NETXRAY_2_00x",
2201 netxray_2_00x_file_type_subtype);
2202 }
2203
2204 /*
2205 * Editor modelines - https://www.wireshark.org/tools/modelines.html
2206 *
2207 * Local variables:
2208 * c-basic-offset: 8
2209 * tab-width: 8
2210 * indent-tabs-mode: t
2211 * End:
2212 *
2213 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
2214 * :indentSize=8:tabSize=8:noTabs=false:
2215 */
Metzes wireshark repo