wiretap/merge.c

   1 /* Combine multiple dump files, either by appending or by merging by timestamp
   2  *
   3  * Written by Scott Renfro <scott@renfro.org> based on
   4  * editcap by Richard Sharpe and Guy Harris
   5  *
   6  * Copyright 2013, Scott Renfro <scott[AT]renfro.org>
   7  *
   8  * $Id$
   9  *
  10  * Wireshark - Network traffic analyzer
  11  * By Gerald Combs <gerald@wireshark.org>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 2 of the License, or
  17  * (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License along
  25  * with this program; if not, write to the Free Software Foundation, Inc.,
  26  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  27  */
  28
  29 #include "config.h"
  30
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <glib.h>
  34 #include <errno.h>
  35
  36 #ifdef HAVE_UNISTD_H
  37 #include <unistd.h>
  38 #endif
  39
  40 #ifdef HAVE_SYS_TIME_H
  41 #include <sys/time.h>
  42 #endif
  43
  44 #include <string.h>
  45 #include "merge.h"
  46
  47 /*
  48  * Scan through the arguments and open the input files
  49  */
  50 gboolean
  51 merge_open_in_files(int in_file_count, char *const *in_file_names,
  52                     merge_in_file_t **in_files, int *err, gchar **err_info,
  53                     int *err_fileno)
  54 {
  55   int i, j;
  56   size_t files_size = in_file_count * sizeof(merge_in_file_t);
  57   merge_in_file_t *files;
  58   gint64 size;
  59
  60   files = (merge_in_file_t *)g_malloc(files_size);
  61   *in_files = files;
  62
  63   for (i = 0; i < in_file_count; i++) {
  64     files[i].filename    = in_file_names[i];
  65     files[i].wth         = wtap_open_offline(in_file_names[i], err, err_info, FALSE);
  66     files[i].data_offset = 0;
  67     files[i].state       = PACKET_NOT_PRESENT;
  68     files[i].packet_num  = 0;
  69     if (!files[i].wth) {
  70       /* Close the files we've already opened. */
  71       for (j = 0; j < i; j++)
  72         wtap_close(files[j].wth);
  73       *err_fileno = i;
  74       return FALSE;
  75     }
  76     size = wtap_file_size(files[i].wth, err);
  77     if (size == -1) {
  78       for (j = 0; j <= i; j++)
  79         wtap_close(files[j].wth);
  80       *err_fileno = i;
  81       return FALSE;
  82     }
  83     files[i].size = size;
  84   }
  85   return TRUE;
  86 }
  87
  88 /*
  89  * Scan through and close each input file
  90  */
  91 void
  92 merge_close_in_files(int count, merge_in_file_t in_files[])
  93 {
  94   int i;
  95   for (i = 0; i < count; i++) {
  96     wtap_close(in_files[i].wth);
  97   }
  98 }
  99
 100 /*
 101  * Select an output frame type based on the input files
 102  * From Guy: If all files have the same frame type, then use that.
 103  *           Otherwise select WTAP_ENCAP_PER_PACKET.  If the selected
 104  *           output file type doesn't support per packet frame types,
 105  *           then the wtap_dump_open call will fail with a reasonable
 106  *           error condition.
 107  */
 108 int
 109 merge_select_frame_type(int count, merge_in_file_t files[])
 110 {
 111   int i;
 112   int selected_frame_type;
 113
 114   selected_frame_type = wtap_file_encap(files[0].wth);
 115
 116   for (i = 1; i < count; i++) {
 117     int this_frame_type = wtap_file_encap(files[i].wth);
 118     if (selected_frame_type != this_frame_type) {
 119       selected_frame_type = WTAP_ENCAP_PER_PACKET;
 120       break;
 121     }
 122   }
 123
 124   return selected_frame_type;
 125 }
 126
 127 /*
 128  * Scan through input files and find maximum snapshot length
 129  */
 130 int
 131 merge_max_snapshot_length(int count, merge_in_file_t in_files[])
 132 {
 133   int i;
 134   int max_snapshot = 0;
 135   int snapshot_length;
 136
 137   for (i = 0; i < count; i++) {
 138     snapshot_length = wtap_snapshot_length(in_files[i].wth);
 139     if (snapshot_length == 0) {
 140       /* Snapshot length of input file not known. */
 141       snapshot_length = WTAP_MAX_PACKET_SIZE;
 142     }
 143     if (snapshot_length > max_snapshot)
 144       max_snapshot = snapshot_length;
 145   }
 146   return max_snapshot;
 147 }
 148
 149 /*
 150  * returns TRUE if first argument is earlier than second
 151  */
 152 static gboolean
 153 is_earlier(nstime_t *l, nstime_t *r) /* XXX, move to nstime.c */
 154 {
 155   if (l->secs > r->secs) {  /* left is later */
 156     return FALSE;
 157   } else if (l->secs < r->secs) { /* left is earlier */
 158     return TRUE;
 159   } else if (l->nsecs > r->nsecs) { /* tv_sec equal, l.usec later */
 160     return FALSE;
 161   }
 162   /* either one < two or one == two
 163    * either way, return one
 164    */
 165   return TRUE;
 166 }
 167
 168 /*
 169  * Read the next packet, in chronological order, from the set of files
 170  * to be merged.
 171  *
 172  * On success, set *err to 0 and return a pointer to the merge_in_file_t
 173  * for the file from which the packet was read.
 174  *
 175  * On a read error, set *err to the error and return a pointer to the
 176  * merge_in_file_t for the file on which we got an error.
 177  *
 178  * On an EOF (meaning all the files are at EOF), set *err to 0 and return
 179  * NULL.
 180  */
 181 merge_in_file_t *
 182 merge_read_packet(int in_file_count, merge_in_file_t in_files[],
 183                   int *err, gchar **err_info)
 184 {
 185   int i;
 186   int ei = -1;
 187   nstime_t tv = { sizeof(time_t) > sizeof(int) ? LONG_MAX : INT_MAX, INT_MAX };
 188   struct wtap_pkthdr *phdr;
 189
 190   /*
 191    * Make sure we have a packet available from each file, if there are any
 192    * packets left in the file in question, and search for the packet
 193    * with the earliest time stamp.
 194    */
 195   for (i = 0; i < in_file_count; i++) {
 196     if (in_files[i].state == PACKET_NOT_PRESENT) {
 197       /*
 198        * No packet available, and we haven't seen an error or EOF yet,
 199        * so try to read the next packet.
 200        */
 201       if (!wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset)) {
 202         if (*err != 0) {
 203           in_files[i].state = GOT_ERROR;
 204           return &in_files[i];
 205         }
 206         in_files[i].state = AT_EOF;
 207       } else
 208         in_files[i].state = PACKET_PRESENT;
 209     }
 210
 211     if (in_files[i].state == PACKET_PRESENT) {
 212       phdr = wtap_phdr(in_files[i].wth);
 213       if (is_earlier(&phdr->ts, &tv)) {
 214         tv = phdr->ts;
 215         ei = i;
 216       }
 217     }
 218   }
 219
 220   if (ei == -1) {
 221     /* All the streams are at EOF.  Return an EOF indication. */
 222     *err = 0;
 223     return NULL;
 224   }
 225
 226   /* We'll need to read another packet from this file. */
 227   in_files[ei].state = PACKET_NOT_PRESENT;
 228
 229   /* Count this packet. */
 230   in_files[ei].packet_num++;
 231
 232   /*
 233    * Return a pointer to the merge_in_file_t of the file from which the
 234    * packet was read.
 235    */
 236   *err = 0;
 237   return &in_files[ei];
 238 }
 239
 240 /*
 241  * Read the next packet, in file sequence order, from the set of files
 242  * to be merged.
 243  *
 244  * On success, set *err to 0 and return a pointer to the merge_in_file_t
 245  * for the file from which the packet was read.
 246  *
 247  * On a read error, set *err to the error and return a pointer to the
 248  * merge_in_file_t for the file on which we got an error.
 249  *
 250  * On an EOF (meaning all the files are at EOF), set *err to 0 and return
 251  * NULL.
 252  */
 253 merge_in_file_t *
 254 merge_append_read_packet(int in_file_count, merge_in_file_t in_files[],
 255                          int *err, gchar **err_info)
 256 {
 257   int i;
 258
 259   /*
 260    * Find the first file not at EOF, and read the next packet from it.
 261    */
 262   for (i = 0; i < in_file_count; i++) {
 263     if (in_files[i].state == AT_EOF)
 264       continue; /* This file is already at EOF */
 265     if (wtap_read(in_files[i].wth, err, err_info, &in_files[i].data_offset))
 266       break; /* We have a packet */
 267     if (*err != 0) {
 268       /* Read error - quit immediately. */
 269       in_files[i].state = GOT_ERROR;
 270       return &in_files[i];
 271     }
 272     /* EOF - flag this file as being at EOF, and try the next one. */
 273     in_files[i].state = AT_EOF;
 274   }
 275   if (i == in_file_count) {
 276     /* All the streams are at EOF.  Return an EOF indication. */
 277     *err = 0;
 278     return NULL;
 279   }
 280
 281   /*
 282    * Return a pointer to the merge_in_file_t of the file from which the
 283    * packet was read.
 284    */
 285   *err = 0;
 286   return &in_files[i];
 287 }