wiretap/snoop.c

   1 /* snoop.c
   2  *
   3  * $Id$
   4  *
   5  * Wiretap Library
   6  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License
  10  * as published by the Free Software Foundation; either version 2
  11  * of the License, or (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22
  23 #include "config.h"
  24 #include <errno.h>
  25 #include <string.h>
  26 #include "wtap-int.h"
  27 #include "file_wrappers.h"
  28 #include "buffer.h"
  29 #include "atm.h"
  30 #include "snoop.h"
  31 /* See RFC 1761 for a description of the "snoop" file format. */
  32
  33 /* Magic number in "snoop" files. */
  34 static const char snoop_magic[] = {
  35         's', 'n', 'o', 'o', 'p', '\0', '\0', '\0'
  36 };
  37
  38 /* "snoop" file header (minus magic number). */
  39 struct snoop_hdr {
  40         guint32 version;        /* version number (should be 2) */
  41         guint32 network;        /* network type */
  42 };
  43
  44 /* "snoop" record header. */
  45 struct snooprec_hdr {
  46         guint32 orig_len;       /* actual length of packet */
  47         guint32 incl_len;       /* number of octets captured in file */
  48         guint32 rec_len;        /* length of record */
  49         guint32 cum_drops;      /* cumulative number of dropped packets */
  50         guint32 ts_sec;         /* timestamp seconds */
  51         guint32 ts_usec;        /* timestamp microseconds */
  52 };
  53
  54 /*
  55  * The link-layer header on ATM packets.
  56  */
  57 struct snoop_atm_hdr {
  58         guint8  flags;          /* destination and traffic type */
  59         guint8  vpi;            /* VPI */
  60         guint16 vci;            /* VCI */
  61 };
  62
  63 /*
  64  * Extra information stuffed into the padding in Shomiti/Finisar Surveyor
  65  * captures.
  66  */
  67 struct shomiti_trailer {
  68         guint16 phy_rx_length;  /* length on the wire, including FCS? */
  69         guint16 phy_rx_status;  /* status flags */
  70         guint32 ts_40_ns_lsb;   /* 40 ns time stamp, low-order bytes? */
  71         guint32 ts_40_ns_msb;   /* 40 ns time stamp, low-order bytes? */
  72         gint32  frame_id;       /* "FrameID"? */
  73 };
  74
  75 /*
  76  * phy_rx_status flags.
  77  */
  78 #define RX_STATUS_OVERFLOW              0x8000  /* overflow error */
  79 #define RX_STATUS_BAD_CRC               0x4000  /* CRC error */
  80 #define RX_STATUS_DRIBBLE_NIBBLE        0x2000  /* dribble/nibble bits? */
  81 #define RX_STATUS_SHORT_FRAME           0x1000  /* frame < 64 bytes */
  82 #define RX_STATUS_OVERSIZE_FRAME        0x0800  /* frame > 1518 bytes */
  83 #define RX_STATUS_GOOD_FRAME            0x0400  /* frame OK */
  84 #define RX_STATUS_N12_BYTES_RECEIVED    0x0200  /* first 12 bytes of frame received? */
  85 #define RX_STATUS_RXABORT               0x0100  /* RXABORT during reception */
  86 #define RX_STATUS_FIFO_ERROR            0x0080  /* receive FIFO error */
  87 #define RX_STATUS_TRIGGERED             0x0001  /* frame did trigger */
  88
  89 static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
  90     gint64 *data_offset);
  91 static gboolean snoop_seek_read(wtap *wth, gint64 seek_off,
  92     struct wtap_pkthdr *phdr, Buffer *buf, int length,
  93     int *err, gchar **err_info);
  94 static int snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
  95     Buffer *buf, int *err, gchar **err_info);
  96 static gboolean snoop_read_atm_pseudoheader(FILE_T fh,
  97     union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
  98 static gboolean snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
  99     union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
 100     int *header_size);
 101 static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
 102     const guint8 *pd, int *err);
 103
 104 /*
 105  * See
 106  *
 107  *      http://www.opengroup.org/onlinepubs/9638599/apdxf.htm
 108  *
 109  * for the "dlpi.h" header file specified by The Open Group, which lists
 110  * the DL_ values for various protocols; Solaris 7 uses the same values.
 111  *
 112  * See
 113  *
 114  *      http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml
 115  *
 116  * for the IETF list of snoop datalink types.
 117  *
 118  * The page at
 119  *
 120  *      http://mrpink.lerc.nasa.gov/118x/support.html
 121  *
 122  * had links to modified versions of "tcpdump" and "libpcap" for SUNatm
 123  * DLPI support; they suggested that the 3.0 verson of SUNatm uses those
 124  * values.  The Wayback Machine archived that page, but not the stuff
 125  * to which it linked, unfortunately.
 126  *
 127  * It also has a link to "convert.c", which is a program to convert files
 128  * from the format written by the "atmsnoop" program that comes with the
 129  * SunATM package to regular "snoop" format, claims that "SunATM 2.1 claimed
 130  * to be DL_FDDI (don't ask why).  SunATM 3.0 claims to be DL_IPATM, which
 131  * is 0x12".
 132  *
 133  * It also says that "ATM Mac header is 12 bytes long.", and seems to imply
 134  * that in an "atmsnoop" file, the header contains 2 bytes (direction and
 135  * VPI?), 2 bytes of VCI, 6 bytes of something, and 2 bytes of Ethernet
 136  * type; if those 6 bytes are 2 bytes of DSAP, 2 bytes of LSAP, 1 byte
 137  * of LLC control, and 3 bytes of SNAP OUI, that'd mean that an ATM
 138  * pseudo-header in an "atmsnoop" file is probably 1 byte of direction,
 139  * 1 byte of VPI, and 2 bytes of VCI.
 140  *
 141  * The aforementioned page also has a link to some capture files from
 142  * "atmsnoop"; this version of "snoop.c" appears to be able to read them.
 143  *
 144  * Source to an "atmdump" package, which includes a modified version of
 145  * "libpcap" to handle SunATM DLPI and an ATM driver for FreeBSD, and
 146  * also includes "atmdump", which is a modified "tcpdump", was available
 147  * at
 148  *
 149  *      ftp://ftp.cs.ndsu.nodak.edu/pub/freebsd/atm/atm-bpf.tgz
 150  *
 151  * (the host name is no longer valid) and that code also indicated that
 152  * DL_IPATM is used, and that an ATM packet handed up from the Sun driver
 153  * for the Sun SBus ATM card on Solaris 2.5.1 has 1 byte of direction,
 154  * 1 byte of VPI, 2 bytes of VCI, and then the ATM PDU, and suggests that
 155  * the direction flag is 0x80 for "transmitted" (presumably meaning
 156  * DTE->DCE) and presumably not 0x80 for "received" (presumably meaning
 157  * DCE->DTE).  That code was used as the basis for the SunATM support in
 158  * later versions of libpcap and tcpdump, and it worked at the time the
 159  * development was done with the SunATM code on the system on which the
 160  * development was done.
 161  *
 162  * In fact, the "direction" byte appears to have some other stuff, perhaps
 163  * a traffic type, in the lower 7 bits, with the 8th bit indicating the
 164  * direction.  That appears to be the case.
 165  *
 166  * I don't know what the encapsulation of any of the other types is, so I
 167  * leave them all as WTAP_ENCAP_UNKNOWN, except for those for which Brian
 168  * Ginsbach has supplied information about the way UNICOS/mp uses them.
 169  * I also don't know whether "snoop" can handle any of them (it presumably
 170  * can't handle ATM, otherwise Sun wouldn't have supplied "atmsnoop"; even
 171  * if it can't, this may be useful reference information for anybody doing
 172  * code to use DLPI to do raw packet captures on those network types.
 173  *
 174  * Once upon a time
 175  *
 176  *      http://web.archive.org/web/20010906213807/http://www.shomiti.com/support/TNCapFileFormat.htm
 177  *
 178  * gave information on Shomiti's mutant flavor of snoop; Shomiti's Web site
 179  * is no longer available on the Wayback Machine.  For some unknown reason,
 180  * they decided not to just Go With The DLPI Flow, and instead used the types
 181  * unspecified in RFC 1461 for their own nefarious purposes, such as
 182  * distinguishing 10MB from 100MB from 1000MB Ethernet and distinguishing
 183  * 4MB from 16MB Token Ring, and distinguishing both of them from the
 184  * "Shomiti" versions of same.
 185  */
 186 int snoop_open(wtap *wth, int *err, gchar **err_info)
 187 {
 188         int bytes_read;
 189         char magic[sizeof snoop_magic];
 190         struct snoop_hdr hdr;
 191         struct snooprec_hdr rec_hdr;
 192         guint padbytes;
 193         gboolean is_shomiti;
 194         static const int snoop_encap[] = {
 195                 WTAP_ENCAP_ETHERNET,    /* IEEE 802.3 */
 196                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.4 Token Bus */
 197                 WTAP_ENCAP_TOKEN_RING,
 198                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.6 Metro Net */
 199                 WTAP_ENCAP_ETHERNET,
 200                 WTAP_ENCAP_UNKNOWN,     /* HDLC */
 201                 WTAP_ENCAP_UNKNOWN,     /* Character Synchronous, e.g. bisync */
 202                 WTAP_ENCAP_UNKNOWN,     /* IBM Channel-to-Channel */
 203                 WTAP_ENCAP_FDDI_BITSWAPPED,
 204                 WTAP_ENCAP_NULL,        /* Other */
 205                 WTAP_ENCAP_UNKNOWN,     /* Frame Relay LAPF */
 206                 WTAP_ENCAP_UNKNOWN,     /* Multi-protocol over Frame Relay */
 207                 WTAP_ENCAP_UNKNOWN,     /* Character Async (e.g., SLIP and PPP?) */
 208                 WTAP_ENCAP_UNKNOWN,     /* X.25 Classical IP */
 209                 WTAP_ENCAP_NULL,        /* software loopback */
 210                 WTAP_ENCAP_UNKNOWN,     /* not defined in "dlpi.h" */
 211                 WTAP_ENCAP_IP_OVER_FC,  /* Fibre Channel */
 212                 WTAP_ENCAP_UNKNOWN,     /* ATM */
 213                 WTAP_ENCAP_ATM_PDUS,    /* ATM Classical IP */
 214                 WTAP_ENCAP_UNKNOWN,     /* X.25 LAPB */
 215                 WTAP_ENCAP_UNKNOWN,     /* ISDN */
 216                 WTAP_ENCAP_UNKNOWN,     /* HIPPI */
 217                 WTAP_ENCAP_UNKNOWN,     /* 100VG-AnyLAN Ethernet */
 218                 WTAP_ENCAP_UNKNOWN,     /* 100VG-AnyLAN Token Ring */
 219                 WTAP_ENCAP_UNKNOWN,     /* "ISO 8802/3 and Ethernet" */
 220                 WTAP_ENCAP_UNKNOWN,     /* 100BaseT (but that's just Ethernet) */
 221                 WTAP_ENCAP_IP_OVER_IB,  /* Infiniband */
 222         };
 223         #define NUM_SNOOP_ENCAPS (sizeof snoop_encap / sizeof snoop_encap[0])
 224         #define SNOOP_PRIVATE_BIT 0x80000000
 225         static const int snoop_private_encap[] = {
 226                 WTAP_ENCAP_UNKNOWN,     /* Not Used */
 227                 WTAP_ENCAP_UNKNOWN,     /* IPv4 Tunnel Link */
 228                 WTAP_ENCAP_UNKNOWN,     /* IPv6 Tunnel Link */
 229                 WTAP_ENCAP_UNKNOWN,     /* Virtual network interface */
 230                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.11 */
 231                 WTAP_ENCAP_IPNET,       /* ipnet(7D) link */
 232                 WTAP_ENCAP_UNKNOWN,     /* IPMP stub interface */
 233                 WTAP_ENCAP_UNKNOWN,     /* 6to4 Tunnel Link */
 234         };
 235         #define NUM_SNOOP_PRIVATE_ENCAPS (sizeof snoop_private_encap / sizeof snoop_private_encap[0])
 236         static const int shomiti_encap[] = {
 237                 WTAP_ENCAP_ETHERNET,    /* IEEE 802.3 */
 238                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.4 Token Bus */
 239                 WTAP_ENCAP_TOKEN_RING,
 240                 WTAP_ENCAP_UNKNOWN,     /* IEEE 802.6 Metro Net */
 241                 WTAP_ENCAP_ETHERNET,
 242                 WTAP_ENCAP_UNKNOWN,     /* HDLC */
 243                 WTAP_ENCAP_UNKNOWN,     /* Character Synchronous, e.g. bisync */
 244                 WTAP_ENCAP_UNKNOWN,     /* IBM Channel-to-Channel */
 245                 WTAP_ENCAP_FDDI_BITSWAPPED,
 246                 WTAP_ENCAP_UNKNOWN,     /* Other */
 247                 WTAP_ENCAP_ETHERNET,    /* Fast Ethernet */
 248                 WTAP_ENCAP_TOKEN_RING,  /* 4MB 802.5 token ring */
 249                 WTAP_ENCAP_ETHERNET,    /* Gigabit Ethernet */
 250                 WTAP_ENCAP_TOKEN_RING,  /* "IEEE 802.5 Shomiti" */
 251                 WTAP_ENCAP_TOKEN_RING,  /* "4MB IEEE 802.5 Shomiti" */
 252                 WTAP_ENCAP_UNKNOWN,     /* Other */
 253                 WTAP_ENCAP_UNKNOWN,     /* Other */
 254                 WTAP_ENCAP_UNKNOWN,     /* Other */
 255                 WTAP_ENCAP_IEEE_802_11_WITH_RADIO, /* IEEE 802.11 with Radio Header */
 256                 WTAP_ENCAP_ETHERNET,    /* 10 Gigabit Ethernet */
 257         };
 258         #define NUM_SHOMITI_ENCAPS (sizeof shomiti_encap / sizeof shomiti_encap[0])
 259         int file_encap;
 260         gint64 saved_offset;
 261
 262         /* Read in the string that should be at the start of a "snoop" file */
 263         errno = WTAP_ERR_CANT_READ;
 264         bytes_read = file_read(magic, sizeof magic, wth->fh);
 265         if (bytes_read != sizeof magic) {
 266                 *err = file_error(wth->fh, err_info);
 267                 if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
 268                         return -1;
 269                 return 0;
 270         }
 271
 272         if (memcmp(magic, snoop_magic, sizeof snoop_magic) != 0) {
 273                 return 0;
 274         }
 275
 276         /* Read the rest of the header. */
 277         errno = WTAP_ERR_CANT_READ;
 278         bytes_read = file_read(&hdr, sizeof hdr, wth->fh);
 279         if (bytes_read != sizeof hdr) {
 280                 *err = file_error(wth->fh, err_info);
 281                 if (*err == 0)
 282                         *err = WTAP_ERR_SHORT_READ;
 283                 return -1;
 284         }
 285
 286         /*
 287          * Make sure it's a version we support.
 288          */
 289         hdr.version = g_ntohl(hdr.version);
 290         switch (hdr.version) {
 291
 292         case 2:         /* Solaris 2.x and later snoop, and Shomiti
 293                            Surveyor prior to 3.0, or 3.0 and later
 294                            with NDIS card */
 295         case 3:         /* Surveyor 3.0 and later, with Shomiti CMM2 hardware */
 296         case 4:         /* Surveyor 3.0 and later, with Shomiti GAM hardware */
 297         case 5:         /* Surveyor 3.0 and later, with Shomiti THG hardware */
 298                 break;
 299
 300         default:
 301                 *err = WTAP_ERR_UNSUPPORTED;
 302                 *err_info = g_strdup_printf("snoop: version %u unsupported", hdr.version);
 303                 return -1;
 304         }
 305
 306         /*
 307          * Oh, this is lovely.
 308          *
 309          * I suppose Shomiti could give a bunch of lawyerly noise about
 310          * how "well, RFC 1761 said they were unassigned, and that's
 311          * the standard, not the DLPI header file, so it's perfectly OK
 312          * for us to use them, blah blah blah", but it's still irritating
 313          * as hell that they used the unassigned-in-RFC-1761 values for
 314          * their own purposes - especially given that Sun also used
 315          * one of them in atmsnoop.
 316          *
 317          * We can't determine whether it's a Shomiti capture based on
 318          * the version number, as, according to their documentation on
 319          * their capture file format, Shomiti uses a version number of 2
 320          * if the data "was captured using an NDIS card", which presumably
 321          * means "captured with an ordinary boring network card via NDIS"
 322          * as opposed to "captured with our whizzo special capture
 323          * hardware".
 324          *
 325          * The only way I can see to determine that is to check how much
 326          * padding there is in the first packet - if there's enough
 327          * padding for a Shomiti trailer, it's probably a Shomiti
 328          * capture, and otherwise, it's probably from Snoop.
 329          */
 330
 331         /*
 332          * Start out assuming it's not a Shomiti capture.
 333          */
 334         is_shomiti = FALSE;
 335
 336         /* Read first record header. */
 337         saved_offset = file_tell(wth->fh);
 338         errno = WTAP_ERR_CANT_READ;
 339         bytes_read = file_read(&rec_hdr, sizeof rec_hdr, wth->fh);
 340         if (bytes_read != sizeof rec_hdr) {
 341                 *err = file_error(wth->fh, err_info);
 342                 if (*err == 0)
 343                         *err = WTAP_ERR_SHORT_READ;
 344                 return -1;
 345
 346                 /*
 347                  * The file ends after the record header, which means this
 348                  * is a capture with no packets.
 349                  *
 350                  * We assume it's a snoop file; the actual type of file is
 351                  * irrelevant, as there are no records in it, and thus no
 352                  * extra information if it's a Shomiti capture, and no
 353                  * link-layer headers whose type we have to know, and no
 354                  * Ethernet frames that might have an FCS.
 355                  */
 356         } else {
 357                 /*
 358                  * Compute the number of bytes of padding in the
 359                  * record.  If it's at least the size of a Shomiti
 360                  * trailer record, we assume this is a Shomiti
 361                  * capture.  (Some atmsnoop captures appear
 362                  * to have 4 bytes of padding, and at least one
 363                  * snoop capture appears to have 6 bytes of padding;
 364                  * the Shomiti header is larger than either of those.)
 365                  */
 366                 if (g_ntohl(rec_hdr.rec_len) >
 367                     (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len))) {
 368                         /*
 369                          * Well, we have padding; how much?
 370                          */
 371                         padbytes = g_ntohl(rec_hdr.rec_len) -
 372                             ((guint)sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
 373
 374                         /*
 375                          * Is it at least the size of a Shomiti trailer?
 376                          */
 377                         is_shomiti =
 378                             (padbytes >= sizeof (struct shomiti_trailer));
 379                 }
 380         }
 381
 382         /*
 383          * Seek back to the beginning of the first record.
 384          */
 385         if (file_seek(wth->fh, saved_offset, SEEK_SET, err) == -1)
 386                 return -1;
 387
 388         hdr.network = g_ntohl(hdr.network);
 389         if (is_shomiti) {
 390                 if (hdr.network >= NUM_SHOMITI_ENCAPS
 391                     || shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
 392                         *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 393                         *err_info = g_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
 394                             hdr.network);
 395                         return -1;
 396                 }
 397                 file_encap = shomiti_encap[hdr.network];
 398
 399                 /* This is a Shomiti file */
 400                 wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_SHOMITI;
 401         } else if (hdr.network & SNOOP_PRIVATE_BIT) {
 402                 if ((hdr.network^SNOOP_PRIVATE_BIT) >= NUM_SNOOP_PRIVATE_ENCAPS
 403                     || snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT] == WTAP_ENCAP_UNKNOWN) {
 404                         *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 405                         *err_info = g_strdup_printf("snoop: private network type %u unknown or unsupported",
 406                             hdr.network);
 407                         return -1;
 408                 }
 409                 file_encap = snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT];
 410
 411                 /* This is a snoop file */
 412                 wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_SNOOP;
 413         } else {
 414                 if (hdr.network >= NUM_SNOOP_ENCAPS
 415                     || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
 416                         *err = WTAP_ERR_UNSUPPORTED_ENCAP;
 417                         *err_info = g_strdup_printf("snoop: network type %u unknown or unsupported",
 418                             hdr.network);
 419                         return -1;
 420                 }
 421                 file_encap = snoop_encap[hdr.network];
 422
 423                 /* This is a snoop file */
 424                 wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_SNOOP;
 425         }
 426
 427         /*
 428          * We don't currently use the extra information in Shomiti
 429          * records, so we use the same routines to read snoop and
 430          * Shomiti files.
 431          */
 432         wth->subtype_read = snoop_read;
 433         wth->subtype_seek_read = snoop_seek_read;
 434         wth->file_encap = file_encap;
 435         wth->snapshot_length = 0;       /* not available in header */
 436         wth->tsprecision = WTAP_FILE_TSPREC_USEC;
 437         return 1;
 438 }
 439
 440 typedef struct {
 441         guint8 pad[4];
 442         guint8 undecrypt[2];
 443         guint8 rate;
 444         guint8 preamble;
 445         guint8 code;
 446         guint8 signal;
 447         guint8 qual;
 448         guint8 channel;
 449 } shomiti_wireless_header;
 450
 451
 452 /* Read the next packet */
 453 static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
 454     gint64 *data_offset)
 455 {
 456         int     padbytes;
 457         int     bytes_read;
 458         char    padbuf[4];
 459         int     bytes_to_read;
 460
 461         *data_offset = file_tell(wth->fh);
 462
 463         padbytes = snoop_read_packet(wth, wth->fh, &wth->phdr,
 464             wth->frame_buffer, err, err_info);
 465         if (padbytes == -1)
 466                 return FALSE;
 467
 468         /*
 469          * Skip over the padding (don't "fseek()", as the standard
 470          * I/O library on some platforms discards buffered data if
 471          * you do that, which means it does a lot more reads).
 472          *
 473          * XXX - is that still true?
 474          *
 475          * There's probably not much padding (it's probably padded only
 476          * to a 4-byte boundary), so we probably need only do one read.
 477          */
 478         while (padbytes != 0) {
 479                 bytes_to_read = padbytes;
 480                 if ((unsigned)bytes_to_read > sizeof padbuf)
 481                         bytes_to_read = sizeof padbuf;
 482                 errno = WTAP_ERR_CANT_READ;
 483                 bytes_read = file_read(padbuf, bytes_to_read, wth->fh);
 484                 if (bytes_read != bytes_to_read) {
 485                         *err = file_error(wth->fh, err_info);
 486                         if (*err == 0)
 487                                 *err = WTAP_ERR_SHORT_READ;
 488                         return FALSE;
 489                 }
 490                 padbytes -= bytes_read;
 491         }
 492
 493         return TRUE;
 494 }
 495
 496 static gboolean
 497 snoop_seek_read(wtap *wth, gint64 seek_off,
 498     struct wtap_pkthdr *phdr, Buffer *buf, int length _U_,
 499     int *err, gchar **err_info)
 500 {
 501         if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 502                 return FALSE;
 503
 504         if (snoop_read_packet(wth, wth->random_fh, phdr, buf, err, err_info) == -1) {
 505                 if (*err == 0)
 506                         *err = WTAP_ERR_SHORT_READ;
 507                 return FALSE;
 508         }
 509         return TRUE;
 510 }
 511
 512 static int
 513 snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
 514     Buffer *buf, int *err, gchar **err_info)
 515 {
 516         struct snooprec_hdr hdr;
 517         int     bytes_read;
 518         guint32 rec_size;
 519         guint32 packet_size;
 520         guint32 orig_size;
 521         int header_size;
 522
 523         /* Read record header. */
 524         errno = WTAP_ERR_CANT_READ;
 525         bytes_read = file_read(&hdr, sizeof hdr, fh);
 526         if (bytes_read != sizeof hdr) {
 527                 *err = file_error(fh, err_info);
 528                 if (*err == 0 && bytes_read != 0)
 529                         *err = WTAP_ERR_SHORT_READ;
 530                 return -1;
 531         }
 532
 533         rec_size = g_ntohl(hdr.rec_len);
 534         orig_size = g_ntohl(hdr.orig_len);
 535         packet_size = g_ntohl(hdr.incl_len);
 536         if (orig_size > WTAP_MAX_PACKET_SIZE) {
 537                 /*
 538                  * Probably a corrupt capture file; don't blow up trying
 539                  * to allocate space for an immensely-large packet.
 540                  */
 541                 *err = WTAP_ERR_BAD_FILE;
 542                 *err_info = g_strdup_printf("snoop: File has %u-byte original length, bigger than maximum of %u",
 543                     orig_size, WTAP_MAX_PACKET_SIZE);
 544                 return -1;
 545         }
 546         if (packet_size > WTAP_MAX_PACKET_SIZE) {
 547                 /*
 548                  * Probably a corrupt capture file; don't blow up trying
 549                  * to allocate space for an immensely-large packet.
 550                  */
 551                 *err = WTAP_ERR_BAD_FILE;
 552                 *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
 553                     packet_size, WTAP_MAX_PACKET_SIZE);
 554                 return -1;
 555         }
 556         if (packet_size > rec_size) {
 557                 /*
 558                  * Probably a corrupt capture file.
 559                  */
 560                 *err = WTAP_ERR_BAD_FILE;
 561                 *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than record size %u",
 562                     packet_size, rec_size);
 563                 return -1;
 564         }
 565
 566         switch (wth->file_encap) {
 567
 568         case WTAP_ENCAP_ATM_PDUS:
 569                 /*
 570                  * This is an ATM packet, so the first four bytes are
 571                  * the direction of the packet (transmit/receive), the
 572                  * VPI, and the VCI; read them and generate the
 573                  * pseudo-header from them.
 574                  */
 575                 if (packet_size < sizeof (struct snoop_atm_hdr)) {
 576                         /*
 577                          * Uh-oh, the packet isn't big enough to even
 578                          * have a pseudo-header.
 579                          */
 580                         *err = WTAP_ERR_BAD_FILE;
 581                         *err_info = g_strdup_printf("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header",
 582                             packet_size);
 583                         return -1;
 584                 }
 585                 if (!snoop_read_atm_pseudoheader(fh, &phdr->pseudo_header,
 586                     err, err_info))
 587                         return -1;      /* Read error */
 588
 589                 /*
 590                  * Don't count the pseudo-header as part of the packet.
 591                  */
 592                 rec_size -= (guint32)sizeof (struct snoop_atm_hdr);
 593                 orig_size -= (guint32)sizeof (struct snoop_atm_hdr);
 594                 packet_size -= (guint32)sizeof (struct snoop_atm_hdr);
 595                 break;
 596
 597         case WTAP_ENCAP_ETHERNET:
 598                 /*
 599                  * If this is a snoop file, we assume there's no FCS in
 600                  * this frame; if this is a Shomit file, we assume there
 601                  * is.  (XXX - or should we treat it a "maybe"?)
 602                  */
 603                 if (wth->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_SHOMITI)
 604                         phdr->pseudo_header.eth.fcs_len = 4;
 605                 else
 606                         phdr->pseudo_header.eth.fcs_len = 0;
 607                 break;
 608
 609         case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
 610                 if (packet_size < sizeof (shomiti_wireless_header)) {
 611                         /*
 612                          * Uh-oh, the packet isn't big enough to even
 613                          * have a pseudo-header.
 614                          */
 615                         *err = WTAP_ERR_BAD_FILE;
 616                         *err_info = g_strdup_printf("snoop: Shomiti wireless file has a %u-byte packet, too small to have even a wireless pseudo-header",
 617                             packet_size);
 618                         return -1;
 619                 }
 620                 if (!snoop_read_shomiti_wireless_pseudoheader(fh,
 621                     &phdr->pseudo_header, err, err_info, &header_size))
 622                         return -1;      /* Read error */
 623
 624                 /*
 625                  * Don't count the pseudo-header as part of the packet.
 626                  */
 627                 rec_size -= header_size;
 628                 orig_size -= header_size;
 629                 packet_size -= header_size;
 630                 break;
 631         }
 632
 633         phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 634         phdr->ts.secs = g_ntohl(hdr.ts_sec);
 635         phdr->ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
 636         phdr->caplen = packet_size;
 637         phdr->len = orig_size;
 638
 639         if (rec_size < (sizeof hdr + packet_size)) {
 640                 /*
 641                  * What, *negative* padding?  Bogus.
 642                  */
 643                 *err = WTAP_ERR_BAD_FILE;
 644                 *err_info = g_strdup_printf("snoop: File has %u-byte record with packet size of %u",
 645                     rec_size, packet_size);
 646                 return -1;
 647         }
 648
 649         /*
 650          * Read the packet data.
 651          */
 652         if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
 653                 return -1;      /* failed */
 654
 655         /*
 656          * If this is ATM LANE traffic, try to guess what type of LANE
 657          * traffic it is based on the packet contents.
 658          */
 659         if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
 660             phdr->pseudo_header.atm.type == TRAF_LANE) {
 661                 atm_guess_lane_type(buffer_start_ptr(buf), packet_size,
 662                     &phdr->pseudo_header);
 663         }
 664
 665         return rec_size - ((guint)sizeof hdr + packet_size);
 666 }
 667
 668 static gboolean
 669 snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
 670     int *err, gchar **err_info)
 671 {
 672         struct snoop_atm_hdr atm_phdr;
 673         int     bytes_read;
 674         guint8  vpi;
 675         guint16 vci;
 676
 677         errno = WTAP_ERR_CANT_READ;
 678         bytes_read = file_read(&atm_phdr, sizeof (struct snoop_atm_hdr), fh);
 679         if (bytes_read != sizeof (struct snoop_atm_hdr)) {
 680                 *err = file_error(fh, err_info);
 681                 if (*err == 0)
 682                         *err = WTAP_ERR_SHORT_READ;
 683                 return FALSE;
 684         }
 685
 686         vpi = atm_phdr.vpi;
 687         vci = pntohs(&atm_phdr.vci);
 688
 689         /*
 690          * The lower 4 bits of the first byte of the header indicate
 691          * the type of traffic, as per the "atmioctl.h" header in
 692          * SunATM.
 693          */
 694         switch (atm_phdr.flags & 0x0F) {
 695
 696         case 0x01:      /* LANE */
 697                 pseudo_header->atm.aal = AAL_5;
 698                 pseudo_header->atm.type = TRAF_LANE;
 699                 break;
 700
 701         case 0x02:      /* RFC 1483 LLC multiplexed traffic */
 702                 pseudo_header->atm.aal = AAL_5;
 703                 pseudo_header->atm.type = TRAF_LLCMX;
 704                 break;
 705
 706         case 0x05:      /* ILMI */
 707                 pseudo_header->atm.aal = AAL_5;
 708                 pseudo_header->atm.type = TRAF_ILMI;
 709                 break;
 710
 711         case 0x06:      /* Signalling AAL */
 712                 pseudo_header->atm.aal = AAL_SIGNALLING;
 713                 pseudo_header->atm.type = TRAF_UNKNOWN;
 714                 break;
 715
 716         case 0x03:      /* MARS (RFC 2022) */
 717                 pseudo_header->atm.aal = AAL_5;
 718                 pseudo_header->atm.type = TRAF_UNKNOWN;
 719                 break;
 720
 721         case 0x04:      /* IFMP (Ipsilon Flow Management Protocol; see RFC 1954) */
 722                 pseudo_header->atm.aal = AAL_5;
 723                 pseudo_header->atm.type = TRAF_UNKNOWN; /* XXX - TRAF_IPSILON? */
 724                 break;
 725
 726         default:
 727                 /*
 728                  * Assume it's AAL5, unless it's VPI 0 and VCI 5, in which
 729                  * case assume it's AAL_SIGNALLING; we know nothing more
 730                  * about it.
 731                  *
 732                  * XXX - is this necessary?  Or are we guaranteed that
 733                  * all signalling traffic has a type of 0x06?
 734                  *
 735                  * XXX - is this guaranteed to be AAL5?  Or, if the type is
 736                  * 0x00 ("raw"), might it be non-AAL5 traffic?
 737                  */
 738                 if (vpi == 0 && vci == 5)
 739                         pseudo_header->atm.aal = AAL_SIGNALLING;
 740                 else
 741                         pseudo_header->atm.aal = AAL_5;
 742                 pseudo_header->atm.type = TRAF_UNKNOWN;
 743                 break;
 744         }
 745         pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
 746
 747         pseudo_header->atm.vpi = vpi;
 748         pseudo_header->atm.vci = vci;
 749         pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
 750
 751         /* We don't have this information */
 752         pseudo_header->atm.flags = 0;
 753         pseudo_header->atm.cells = 0;
 754         pseudo_header->atm.aal5t_u2u = 0;
 755         pseudo_header->atm.aal5t_len = 0;
 756         pseudo_header->atm.aal5t_chksum = 0;
 757
 758         return TRUE;
 759 }
 760
 761 static gboolean
 762 snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
 763     union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
 764     int *header_size)
 765 {
 766         shomiti_wireless_header whdr;
 767         int     bytes_read;
 768         int     rsize;
 769
 770         errno = WTAP_ERR_CANT_READ;
 771         bytes_read = file_read(&whdr, sizeof (shomiti_wireless_header), fh);
 772         if (bytes_read != sizeof (shomiti_wireless_header)) {
 773                 *err = file_error(fh, err_info);
 774                 if (*err == 0)
 775                         *err = WTAP_ERR_SHORT_READ;
 776                 return FALSE;
 777         }
 778
 779         /* the 4th byte of the pad is actually a header length,
 780          * we've already read 8 bytes of it, and it must never
 781          * be less than 8.
 782          *
 783          * XXX - presumably that means that the header length
 784          * doesn't include the length field, as we've read
 785          * 12 bytes total.
 786          *
 787          * XXX - what's in the other 3 bytes of the padding?  Is it a
 788          * 4-byte length field?
 789          * XXX - is there anything in the rest of the header of interest?
 790          * XXX - are there any files where the header is shorter than
 791          * 4 bytes of length plus 8 bytes of information?
 792          */
 793         if (whdr.pad[3] < 8) {
 794                 *err = WTAP_ERR_BAD_FILE;
 795                 *err_info = g_strdup_printf("snoop: Header length in Surveyor record is %u, less than minimum of 8",
 796                     whdr.pad[3]);
 797                 return FALSE;
 798         }
 799         /* Skip the header. */
 800         rsize = ((int) whdr.pad[3]) - 8;
 801         if (file_seek(fh, rsize, SEEK_CUR, err) == -1)
 802                 return FALSE;
 803
 804         pseudo_header->ieee_802_11.fcs_len = 4;
 805         pseudo_header->ieee_802_11.channel = whdr.channel;
 806         pseudo_header->ieee_802_11.data_rate = whdr.rate;
 807         pseudo_header->ieee_802_11.signal_level = whdr.signal;
 808
 809         /* add back the header and don't forget the pad as well */
 810         *header_size = rsize + 8 + 4;
 811
 812         return TRUE;
 813 }
 814
 815 static const int wtap_encap[] = {
 816         -1,             /* WTAP_ENCAP_UNKNOWN -> unsupported */
 817         0x04,           /* WTAP_ENCAP_ETHERNET -> DL_ETHER */
 818         0x02,           /* WTAP_ENCAP_TOKEN_RING -> DL_TPR */
 819         -1,             /* WTAP_ENCAP_SLIP -> unsupported */
 820         -1,             /* WTAP_ENCAP_PPP -> unsupported */
 821         0x08,           /* WTAP_ENCAP_FDDI -> DL_FDDI */
 822         0x08,           /* WTAP_ENCAP_FDDI_BITSWAPPED -> DL_FDDI */
 823         -1,             /* WTAP_ENCAP_RAW_IP -> unsupported */
 824         -1,             /* WTAP_ENCAP_ARCNET -> unsupported */
 825         -1,             /* WTAP_ENCAP_ARCNET_LINUX -> unsupported */
 826         -1,             /* WTAP_ENCAP_ATM_RFC1483 -> unsupported */
 827         -1,             /* WTAP_ENCAP_LINUX_ATM_CLIP -> unsupported */
 828         -1,             /* WTAP_ENCAP_LAPB -> unsupported*/
 829         0x12,           /* WTAP_ENCAP_ATM_PDUS -> DL_IPATM */
 830 };
 831 #define NUM_WTAP_ENCAPS (sizeof wtap_encap / sizeof wtap_encap[0])
 832
 833 /* Returns 0 if we could write the specified encapsulation type,
 834    an error indication otherwise. */
 835 int snoop_dump_can_write_encap(int encap)
 836 {
 837         /* Per-packet encapsulations aren't supported. */
 838         if (encap == WTAP_ENCAP_PER_PACKET)
 839                 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
 840
 841         if (encap < 0 || (unsigned)encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
 842                 return WTAP_ERR_UNSUPPORTED_ENCAP;
 843
 844         return 0;
 845 }
 846
 847 /* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
 848    failure */
 849 gboolean snoop_dump_open(wtap_dumper *wdh, int *err)
 850 {
 851         struct snoop_hdr file_hdr;
 852
 853         /* This is a snoop file */
 854         wdh->subtype_write = snoop_dump;
 855         wdh->subtype_close = NULL;
 856
 857         /* Write the file header. */
 858         if (!wtap_dump_file_write(wdh, &snoop_magic, sizeof snoop_magic, err))
 859                 return FALSE;
 860
 861         /* current "snoop" format is 2 */
 862         file_hdr.version = g_htonl(2);
 863         file_hdr.network = g_htonl(wtap_encap[wdh->encap]);
 864         if (!wtap_dump_file_write(wdh, &file_hdr, sizeof file_hdr, err))
 865                 return FALSE;
 866
 867         return TRUE;
 868 }
 869
 870 /* Write a record for a packet to a dump file.
 871    Returns TRUE on success, FALSE on failure. */
 872 static gboolean snoop_dump(wtap_dumper *wdh,
 873         const struct wtap_pkthdr *phdr,
 874         const guint8 *pd, int *err)
 875 {
 876         const union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
 877         struct snooprec_hdr rec_hdr;
 878         int reclen;
 879         guint padlen;
 880         static const char zeroes[4] = {0};
 881         struct snoop_atm_hdr atm_hdr;
 882         int atm_hdrsize;
 883
 884         if (wdh->encap == WTAP_ENCAP_ATM_PDUS)
 885                 atm_hdrsize = sizeof (struct snoop_atm_hdr);
 886         else
 887                 atm_hdrsize = 0;
 888
 889         /* Record length = header length plus data length... */
 890         reclen = (int)sizeof rec_hdr + phdr->caplen + atm_hdrsize;
 891
 892         /* ... plus enough bytes to pad it to a 4-byte boundary. */
 893         padlen = ((reclen + 3) & ~3) - reclen;
 894         reclen += padlen;
 895
 896         rec_hdr.orig_len = g_htonl(phdr->len + atm_hdrsize);
 897         rec_hdr.incl_len = g_htonl(phdr->caplen + atm_hdrsize);
 898         rec_hdr.rec_len = g_htonl(reclen);
 899         rec_hdr.cum_drops = 0;
 900         rec_hdr.ts_sec = g_htonl(phdr->ts.secs);
 901         rec_hdr.ts_usec = g_htonl(phdr->ts.nsecs / 1000);
 902         if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof rec_hdr, err))
 903                 return FALSE;
 904
 905         if (wdh->encap == WTAP_ENCAP_ATM_PDUS) {
 906                 /*
 907                  * Write the ATM header.
 908                  */
 909                 atm_hdr.flags =
 910                     (pseudo_header->atm.channel == 0) ? 0x80 : 0x00;
 911                 switch (pseudo_header->atm.aal) {
 912
 913                 case AAL_SIGNALLING:
 914                         /* Signalling AAL */
 915                         atm_hdr.flags |= 0x06;
 916                         break;
 917
 918                 case AAL_5:
 919                         switch (pseudo_header->atm.type) {
 920
 921                         case TRAF_LANE:
 922                                 /* LANE */
 923                                 atm_hdr.flags |= 0x01;
 924                                 break;
 925
 926                         case TRAF_LLCMX:
 927                                 /* RFC 1483 LLC multiplexed traffic */
 928                                 atm_hdr.flags |= 0x02;
 929                                 break;
 930
 931                         case TRAF_ILMI:
 932                                 /* ILMI */
 933                                 atm_hdr.flags |= 0x05;
 934                                 break;
 935                         }
 936                         break;
 937                 }
 938                 atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;
 939                 atm_hdr.vci = g_htons(pseudo_header->atm.vci);
 940                 if (!wtap_dump_file_write(wdh, &atm_hdr, sizeof atm_hdr, err))
 941                         return FALSE;
 942         }
 943
 944         if (!wtap_dump_file_write(wdh, pd, phdr->caplen, err))
 945                 return FALSE;
 946
 947         /* Now write the padding. */
 948         if (!wtap_dump_file_write(wdh, zeroes, padlen, err))
 949                 return FALSE;
 950         return TRUE;
 951 }