1 /* snoop.c
2 *
3 * Wiretap Library
4 * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "config.h"
10 #include <errno.h>
11 #include <string.h>
12 #include "wtap-int.h"
13 #include "file_wrappers.h"
14 #include "atm.h"
15 #include "snoop.h"
16 #include <wsutil/802_11-utils.h>
17 #include <wsutil/ws_roundup.h>
18
19 /* See RFC 1761 for a description of the "snoop" file format. */
20
21 typedef struct {
22 gboolean is_shomiti;
23 } snoop_t;
24
25 /* Magic number in "snoop" files. */
26 static const char snoop_magic[] = {
27 's', 'n', 'o', 'o', 'p', '\0', '\0', '\0'
28 };
29
30 /* "snoop" file header (minus magic number). */
31 struct snoop_hdr {
32 guint32 version; /* version number (should be 2) */
33 guint32 network; /* network type */
34 };
35
36 /* "snoop" record header. */
37 struct snooprec_hdr {
38 guint32 orig_len; /* actual length of packet */
39 guint32 incl_len; /* number of octets captured in file */
40 guint32 rec_len; /* length of record */
41 guint32 cum_drops; /* cumulative number of dropped packets */
42 guint32 ts_sec; /* timestamp seconds */
43 guint32 ts_usec; /* timestamp microseconds */
44 };
45
46 /*
47 * The link-layer header on ATM packets.
48 */
49 struct snoop_atm_hdr {
50 guint8 flags; /* destination and traffic type */
51 guint8 vpi; /* VPI */
52 guint16 vci; /* VCI */
53 };
54
55 /*
56 * Extra information stuffed into the padding in Shomiti/Finisar Surveyor
57 * captures.
58 */
59 struct shomiti_trailer {
60 guint16 phy_rx_length; /* length on the wire, including FCS? */
61 guint16 phy_rx_status; /* status flags */
62 guint32 ts_40_ns_lsb; /* 40 ns time stamp, low-order bytes? */
63 guint32 ts_40_ns_msb; /* 40 ns time stamp, low-order bytes? */
64 gint32 frame_id; /* "FrameID"? */
65 };
66
67 /*
68 * phy_rx_status flags.
69 */
70 #define RX_STATUS_OVERFLOW 0x8000 /* overflow error */
71 #define RX_STATUS_BAD_CRC 0x4000 /* CRC error */
72 #define RX_STATUS_DRIBBLE_NIBBLE 0x2000 /* dribble/nibble bits? */
73 #define RX_STATUS_SHORT_FRAME 0x1000 /* frame < 64 bytes */
74 #define RX_STATUS_OVERSIZE_FRAME 0x0800 /* frame > 1518 bytes */
75 #define RX_STATUS_GOOD_FRAME 0x0400 /* frame OK */
76 #define RX_STATUS_N12_BYTES_RECEIVED 0x0200 /* first 12 bytes of frame received? */
77 #define RX_STATUS_RXABORT 0x0100 /* RXABORT during reception */
78 #define RX_STATUS_FIFO_ERROR 0x0080 /* receive FIFO error */
79 #define RX_STATUS_TRIGGERED 0x0001 /* frame did trigger */
80
81 static gboolean snoop_read(wtap *wth, wtap_rec *rec, Buffer *buf,
82 int *err, gchar **err_info, gint64 *data_offset);
83 static gboolean snoop_seek_read(wtap *wth, gint64 seek_off,
84 wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
85 static int snoop_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
86 Buffer *buf, int *err, gchar **err_info);
87 static gboolean snoop_read_atm_pseudoheader(FILE_T fh,
88 union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
89 static gboolean snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
90 union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
91 int *header_size);
92 static gboolean snoop_dump(wtap_dumper *wdh, const wtap_rec *rec,
93 const guint8 *pd, int *err, gchar **err_info);
94
95 static int snoop_file_type_subtype = -1;
96 static int shomiti_file_type_subtype = -1;
97
98 void register_snoop(void);
99
ShutdownMedia_m()100 /*
101 * See
102 *
103 * https://pubs.opengroup.org/onlinepubs/9638599/apdxf.htm
104 *
105 * for the "dlpi.h" header file specified by The Open Group, which lists
106 * the DL_ values for various protocols; Solaris 7 uses the same values.
107 *
108 * See
109 *
110 * https://www.iana.org/assignments/snoop-datalink-types
111 *
112 * for the IETF list of snoop datalink types.
113 *
114 * The page at
115 *
116 * http://mrpink.lerc.nasa.gov/118x/support.html
117 *
118 * had links to modified versions of "tcpdump" and "libpcap" for SUNatm
119 * DLPI support; they suggested that the 3.0 version of SUNatm uses those
120 * values. The Wayback Machine archived that page, but not the stuff
121 * to which it linked, unfortunately.
122 *
123 * It also has a link to "convert.c", which is a program to convert files
124 * from the format written by the "atmsnoop" program that comes with the
125 * SunATM package to regular "snoop" format, claims that "SunATM 2.1 claimed
126 * to be DL_FDDI (don't ask why). SunATM 3.0 claims to be DL_IPATM, which
127 * is 0x12".
128 *
129 * It also says that "ATM Mac header is 12 bytes long.", and seems to imply
130 * that in an "atmsnoop" file, the header contains 2 bytes (direction and
131 * VPI?), 2 bytes of VCI, 6 bytes of something, and 2 bytes of Ethernet
132 * type; if those 6 bytes are 2 bytes of DSAP, 2 bytes of LSAP, 1 byte
133 * of LLC control, and 3 bytes of SNAP OUI, that'd mean that an ATM
134 * pseudo-header in an "atmsnoop" file is probably 1 byte of direction,
135 * 1 byte of VPI, and 2 bytes of VCI.
136 *
137 * The aforementioned page also has a link to some capture files from
138 * "atmsnoop"; this version of "snoop.c" appears to be able to read them.
139 *
140 * Source to an "atmdump" package, which includes a modified version of
141 * "libpcap" to handle SunATM DLPI and an ATM driver for FreeBSD, and
142 * also includes "atmdump", which is a modified "tcpdump", was available
143 * at
144 *
145 * ftp://ftp.cs.ndsu.nodak.edu/pub/freebsd/atm/atm-bpf.tgz
146 *
147 * (the host name is no longer valid) and that code also indicated that
148 * DL_IPATM is used, and that an ATM packet handed up from the Sun driver
149 * for the Sun SBus ATM card on Solaris 2.5.1 has 1 byte of direction,
150 * 1 byte of VPI, 2 bytes of VCI, and then the ATM PDU, and suggests that
151 * the direction flag is 0x80 for "transmitted" (presumably meaning
152 * DTE->DCE) and presumably not 0x80 for "received" (presumably meaning
153 * DCE->DTE). That code was used as the basis for the SunATM support in
154 * later versions of libpcap and tcpdump, and it worked at the time the
155 * development was done with the SunATM code on the system on which the
156 * development was done.
157 *
158 * In fact, the "direction" byte appears to have some other stuff, perhaps
159 * a traffic type, in the lower 7 bits, with the 8th bit indicating the
160 * direction. That appears to be the case.
161 *
162 * I don't know what the encapsulation of any of the other types is, so I
163 * leave them all as WTAP_ENCAP_UNKNOWN, except for those for which Brian
164 * Ginsbach has supplied information about the way UNICOS/mp uses them.
165 * I also don't know whether "snoop" can handle any of them (it presumably
166 * can't handle ATM, otherwise Sun wouldn't have supplied "atmsnoop"; even
167 * if it can't, this may be useful reference information for anybody doing
168 * code to use DLPI to do raw packet captures on those network types.
169 *
170 * https://web.archive.org/web/20010906213807/http://www.shomiti.com/support/TNCapFileFormat.htm
171 *
172 * gives information on Shomiti's mutant flavor of snoop. For some unknown
173 * reason, they decided not to just Go With The DLPI Flow, and instead used
174 * the types unspecified in RFC 1461 for their own nefarious purposes, such
175 * as distinguishing 10MB from 100MB from 1000MB Ethernet and distinguishing
176 * 4MB from 16MB Token Ring, and distinguishing both of them from the
177 * "Shomiti" versions of same.
178 */
179 wtap_open_return_val snoop_open(wtap *wth, int *err, gchar **err_info)
180 {
181 char magic[sizeof snoop_magic];
182 struct snoop_hdr hdr;
183 struct snooprec_hdr rec_hdr;
184 guint padbytes;
185 gboolean is_shomiti;
186 static const int snoop_encap[] = {
187 WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
188 WTAP_ENCAP_UNKNOWN, /* IEEE 802.4 Token Bus */
189 WTAP_ENCAP_TOKEN_RING,
190 WTAP_ENCAP_UNKNOWN, /* IEEE 802.6 Metro Net */
191 WTAP_ENCAP_ETHERNET,
192 WTAP_ENCAP_UNKNOWN, /* HDLC */
193 WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
194 WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
195 WTAP_ENCAP_FDDI_BITSWAPPED,
196 WTAP_ENCAP_NULL, /* Other */
197 WTAP_ENCAP_UNKNOWN, /* Frame Relay LAPF */
198 WTAP_ENCAP_UNKNOWN, /* Multi-protocol over Frame Relay */
199 WTAP_ENCAP_UNKNOWN, /* Character Async (e.g., SLIP and PPP?) */
200 WTAP_ENCAP_UNKNOWN, /* X.25 Classical IP */
201 WTAP_ENCAP_NULL, /* software loopback */
202 WTAP_ENCAP_UNKNOWN, /* not defined in "dlpi.h" */
203 WTAP_ENCAP_IP_OVER_FC, /* Fibre Channel */
204 WTAP_ENCAP_UNKNOWN, /* ATM */
205 WTAP_ENCAP_ATM_PDUS, /* ATM Classical IP */
206 WTAP_ENCAP_UNKNOWN, /* X.25 LAPB */
207 WTAP_ENCAP_UNKNOWN, /* ISDN */
208 WTAP_ENCAP_UNKNOWN, /* HIPPI */
209 WTAP_ENCAP_UNKNOWN, /* 100VG-AnyLAN Ethernet */
210 WTAP_ENCAP_UNKNOWN, /* 100VG-AnyLAN Token Ring */
211 WTAP_ENCAP_UNKNOWN, /* "ISO 8802/3 and Ethernet" */
212 WTAP_ENCAP_UNKNOWN, /* 100BaseT (but that's just Ethernet) */
213 WTAP_ENCAP_IP_OVER_IB_SNOOP, /* Infiniband */
214 };
215 #define NUM_SNOOP_ENCAPS (sizeof snoop_encap / sizeof snoop_encap[0])
216 #define SNOOP_PRIVATE_BIT 0x80000000
217 static const int snoop_private_encap[] = {
218 WTAP_ENCAP_UNKNOWN, /* Not Used */
219 WTAP_ENCAP_UNKNOWN, /* IPv4 Tunnel Link */
220 WTAP_ENCAP_UNKNOWN, /* IPv6 Tunnel Link */
221 WTAP_ENCAP_UNKNOWN, /* Virtual network interface */
222 WTAP_ENCAP_UNKNOWN, /* IEEE 802.11 */
223 WTAP_ENCAP_IPNET, /* ipnet(7D) link */
224 WTAP_ENCAP_UNKNOWN, /* IPMP stub interface */
225 WTAP_ENCAP_UNKNOWN, /* 6to4 Tunnel Link */
226 };
227 #define NUM_SNOOP_PRIVATE_ENCAPS (sizeof snoop_private_encap / sizeof snoop_private_encap[0])
228 static const int shomiti_encap[] = {
229 WTAP_ENCAP_ETHERNET, /* IEEE 802.3 */
230 WTAP_ENCAP_UNKNOWN, /* IEEE 802.4 Token Bus */
231 WTAP_ENCAP_TOKEN_RING,
232 WTAP_ENCAP_UNKNOWN, /* IEEE 802.6 Metro Net */
233 WTAP_ENCAP_ETHERNET,
234 WTAP_ENCAP_UNKNOWN, /* HDLC */
235 WTAP_ENCAP_UNKNOWN, /* Character Synchronous, e.g. bisync */
236 WTAP_ENCAP_UNKNOWN, /* IBM Channel-to-Channel */
237 WTAP_ENCAP_FDDI_BITSWAPPED,
238 WTAP_ENCAP_UNKNOWN, /* Other */
239 WTAP_ENCAP_ETHERNET, /* Fast Ethernet */
240 WTAP_ENCAP_TOKEN_RING, /* 4MB 802.5 token ring */
241 WTAP_ENCAP_ETHERNET, /* Gigabit Ethernet */
242 WTAP_ENCAP_TOKEN_RING, /* "IEEE 802.5 Shomiti" */
243 WTAP_ENCAP_TOKEN_RING, /* "4MB IEEE 802.5 Shomiti" */
244 WTAP_ENCAP_UNKNOWN, /* Other */
245 WTAP_ENCAP_UNKNOWN, /* Other */
246 WTAP_ENCAP_UNKNOWN, /* Other */
247 WTAP_ENCAP_IEEE_802_11_WITH_RADIO, /* IEEE 802.11 with Radio Header */
248 WTAP_ENCAP_ETHERNET, /* 10 Gigabit Ethernet */
249 };
250 #define NUM_SHOMITI_ENCAPS (sizeof shomiti_encap / sizeof shomiti_encap[0])
251 int file_encap;
252 gint64 saved_offset;
253 snoop_t *snoop;
254
255 /* Read in the string that should be at the start of a "snoop" file */
256 if (!wtap_read_bytes(wth->fh, magic, sizeof magic, err, err_info)) {
257 if (*err != WTAP_ERR_SHORT_READ)
258 return WTAP_OPEN_ERROR;
259 return WTAP_OPEN_NOT_MINE;
260 }
261
262 if (memcmp(magic, snoop_magic, sizeof snoop_magic) != 0) {
263 return WTAP_OPEN_NOT_MINE;
264 }
265
266 /* Read the rest of the header. */
267 if (!wtap_read_bytes(wth->fh, &hdr, sizeof hdr, err, err_info))
268 return WTAP_OPEN_ERROR;
269
270 /*
271 * Make sure it's a version we support.
272 */
273 hdr.version = g_ntohl(hdr.version);
274 switch (hdr.version) {
275
276 case 2: /* Solaris 2.x and later snoop, and Shomiti
277 Surveyor prior to 3.0, or 3.0 and later
278 with NDIS card */
279 case 3: /* Surveyor 3.0 and later, with Shomiti CMM2 hardware */
280 case 4: /* Surveyor 3.0 and later, with Shomiti GAM hardware */
281 case 5: /* Surveyor 3.0 and later, with Shomiti THG hardware */
282 break;
283
284 default:
285 *err = WTAP_ERR_UNSUPPORTED;
286 *err_info = g_strdup_printf("snoop: version %u unsupported", hdr.version);
287 return WTAP_OPEN_ERROR;
288 }
289
290 /*
291 * Oh, this is lovely.
292 *
293 * I suppose Shomiti could give a bunch of lawyerly noise about
294 * how "well, RFC 1761 said they were unassigned, and that's
295 * the standard, not the DLPI header file, so it's perfectly OK
296 * for us to use them, blah blah blah", but it's still irritating
297 * as hell that they used the unassigned-in-RFC-1761 values for
298 * their own purposes - especially given that Sun also used
299 * one of them in atmsnoop.
300 *
301 * We can't determine whether it's a Shomiti capture based on
302 * the version number, as, according to their documentation on
303 * their capture file format, Shomiti uses a version number of 2
304 * if the data "was captured using an NDIS card", which presumably
305 * means "captured with an ordinary boring network card via NDIS"
306 * as opposed to "captured with our whizzo special capture
307 * hardware".
308 *
309 * The only way I can see to determine that is to check how much
310 * padding there is in the first packet - if there's enough
311 * padding for a Shomiti trailer, it's probably a Shomiti
312 * capture, and otherwise, it's probably from Snoop.
313 */
314
315 /*
316 * Start out assuming it's not a Shomiti capture.
317 */
318 is_shomiti = FALSE;
319
320 /* Read first record header. */
321 saved_offset = file_tell(wth->fh);
322 if (!wtap_read_bytes_or_eof(wth->fh, &rec_hdr, sizeof rec_hdr, err, err_info)) {
323 if (*err != 0)
324 return WTAP_OPEN_ERROR;
325
326 /*
327 * The file ends after the record header, which means this
328 * is a capture with no packets.
329 *
330 * We assume it's a snoop file; the actual type of file is
331 * irrelevant, as there are no records in it, and thus no
332 * extra information if it's a Shomiti capture, and no
333 * link-layer headers whose type we have to know, and no
334 * Ethernet frames that might have an FCS.
335 */
336 } else {
337 /*
338 * Compute the number of bytes of padding in the
339 * record. If it's at least the size of a Shomiti
340 * trailer record, we assume this is a Shomiti
341 * capture. (Some atmsnoop captures appear
342 * to have 4 bytes of padding, and at least one
343 * snoop capture appears to have 6 bytes of padding;
344 * the Shomiti header is larger than either of those.)
345 */
346 if (g_ntohl(rec_hdr.rec_len) >
347 (sizeof rec_hdr + g_ntohl(rec_hdr.incl_len))) {
348 /*
349 * Well, we have padding; how much?
350 */
351 padbytes = g_ntohl(rec_hdr.rec_len) -
352 ((guint)sizeof rec_hdr + g_ntohl(rec_hdr.incl_len));
353
354 /*
355 * Is it at least the size of a Shomiti trailer?
356 */
357 is_shomiti =
358 (padbytes >= sizeof (struct shomiti_trailer));
359 }
360 }
361
362 /*
363 * Seek back to the beginning of the first record.
364 */
365 if (file_seek(wth->fh, saved_offset, SEEK_SET, err) == -1)
366 return WTAP_OPEN_ERROR;
367
368 hdr.network = g_ntohl(hdr.network);
369 if (is_shomiti) {
370 if (hdr.network >= NUM_SHOMITI_ENCAPS
371 || shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
372 *err = WTAP_ERR_UNSUPPORTED;
373 *err_info = g_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
374 hdr.network);
375 return WTAP_OPEN_ERROR;
376 }
377 file_encap = shomiti_encap[hdr.network];
378 } else if (hdr.network & SNOOP_PRIVATE_BIT) {
379 if ((hdr.network^SNOOP_PRIVATE_BIT) >= NUM_SNOOP_PRIVATE_ENCAPS
380 || snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT] == WTAP_ENCAP_UNKNOWN) {
381 *err = WTAP_ERR_UNSUPPORTED;
382 *err_info = g_strdup_printf("snoop: private network type %u unknown or unsupported",
383 hdr.network);
384 return WTAP_OPEN_ERROR;
385 }
386 file_encap = snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT];
387 } else {
388 if (hdr.network >= NUM_SNOOP_ENCAPS
389 || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
390 *err = WTAP_ERR_UNSUPPORTED;
391 *err_info = g_strdup_printf("snoop: network type %u unknown or unsupported",
392 hdr.network);
393 return WTAP_OPEN_ERROR;
394 }
395 file_encap = snoop_encap[hdr.network];
396 }
397
398 /*
399 * We don't currently use the extra information in Shomiti
400 * records, so we use the same routines to read snoop and
401 * Shomiti files.
402 */
403 wth->file_type_subtype = is_shomiti ? shomiti_file_type_subtype : snoop_file_type_subtype;
404 snoop = g_new0(snoop_t, 1);
405 wth->priv = (void *)snoop;
406 wth->subtype_read = snoop_read;
407 wth->subtype_seek_read = snoop_seek_read;
408 wth->file_encap = file_encap;
409 wth->snapshot_length = 0; /* not available in header */
410 wth->file_tsprec = WTAP_TSPREC_USEC;
411 snoop->is_shomiti = is_shomiti;
412
413 /*
414 * Add an IDB; we don't know how many interfaces were
415 * involved, so we just say one interface, about which
416 * we only know the link-layer type, snapshot length,
417 * and time stamp resolution.
418 */
419 wtap_add_generated_idb(wth);
420
421 return WTAP_OPEN_MINE;
422 }
423
424 /*
425 * XXX - pad[3] is the length of the header, not including
426 * the length of the pad field; is it a 1-byte field, a 2-byte
427 * field with pad[2] usually being 0, a 3-byte field with
428 * pad[1] and pad[2] usually being 0, or a 4-byte field?
429 *
430 * If it's not a 4-byte field, is there anything significant
431 * in the other bytes?
432 *
433 * Can the header length ever be less than 8, so that not
434 * all the fields following pad are present?
435 *
436 * What's in undecrypt? In captures I've seen, undecrypt[0]
437 * is usually 0x00 but sometimes 0x02 or 0x06, and undecrypt[1]
438 * is either 0x00 or 0x02.
439 *
440 * What's in preamble? In captures I've seen, it's 0x00.
441 *
442 * What's in code? In captures I've seen, it's 0x01 or 0x03.
443 *
444 * If the header is longer than 8 bytes, what are the other fields?
445 */
446 typedef struct {
447 guint8 pad[4];
448 guint8 undecrypt[2];
449 guint8 rate;
450 guint8 preamble;
451 guint8 code;
452 guint8 signal;
453 guint8 qual;
454 guint8 channel;
455 } shomiti_wireless_header;
456
457
458 /* Read the next packet */
459 static gboolean snoop_read(wtap *wth, wtap_rec *rec, Buffer *buf,
IsVideo()460 int *err, gchar **err_info, gint64 *data_offset)
461 {
462 int padbytes;
463
464 *data_offset = file_tell(wth->fh);
465
466 padbytes = snoop_read_packet(wth, wth->fh, rec, buf, err, err_info);
467 if (padbytes == -1)
468 return FALSE;
469
470 /*
471 * Skip over the padding, if any.
472 */
473 if (padbytes != 0) {
474 if (!wtap_read_bytes(wth->fh, NULL, padbytes, err, err_info))
475 return FALSE;
476 }
477
478 return TRUE;
479 }
480
481 static gboolean
482 snoop_seek_read(wtap *wth, gint64 seek_off,
483 wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
484 {
485 if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
486 return FALSE;
487
488 if (snoop_read_packet(wth, wth->random_fh, rec, buf, err, err_info) == -1) {
489 if (*err == 0)
490 *err = WTAP_ERR_SHORT_READ;
491 return FALSE;
492 }
493 return TRUE;
494 }
495
496 static int
497 snoop_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
498 Buffer *buf, int *err, gchar **err_info)
499 {
500 snoop_t *snoop = (snoop_t *)wth->priv;
501 struct snooprec_hdr hdr;
502 guint32 rec_size;
503 guint32 packet_size;
504 guint32 orig_size;
505 int header_size;
506
507 /* Read record header. */
508 if (!wtap_read_bytes_or_eof(fh, &hdr, sizeof hdr, err, err_info))
509 return -1;
510
511 rec_size = g_ntohl(hdr.rec_len);
512 orig_size = g_ntohl(hdr.orig_len);
513 packet_size = g_ntohl(hdr.incl_len);
514 if (orig_size > WTAP_MAX_PACKET_SIZE_STANDARD) {
515 /*
516 * Probably a corrupt capture file; don't blow up trying
517 * to allocate space for an immensely-large packet.
518 */
519 *err = WTAP_ERR_BAD_FILE;
520 *err_info = g_strdup_printf("snoop: File has %u-byte original length, bigger than maximum of %u",
521 orig_size, WTAP_MAX_PACKET_SIZE_STANDARD);
522 return -1;
523 }
524 if (packet_size > WTAP_MAX_PACKET_SIZE_STANDARD) {
525 /*
526 * Probably a corrupt capture file; don't blow up trying
527 * to allocate space for an immensely-large packet.
528 */
529 *err = WTAP_ERR_BAD_FILE;
530 *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
531 packet_size, WTAP_MAX_PACKET_SIZE_STANDARD);
532 return -1;
533 }
534 if (packet_size > rec_size) {
535 /*
536 * Probably a corrupt capture file.
537 */
538 *err = WTAP_ERR_BAD_FILE;
539 *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than record size %u",
540 packet_size, rec_size);
541 return -1;
542 }
543
544 switch (wth->file_encap) {
545
546 case WTAP_ENCAP_ATM_PDUS:
547 /*
548 * This is an ATM packet, so the first four bytes are
549 * the direction of the packet (transmit/receive), the
550 * VPI, and the VCI; read them and generate the
551 * pseudo-header from them.
552 */
553 if (packet_size < sizeof (struct snoop_atm_hdr)) {
554 /*
555 * Uh-oh, the packet isn't big enough to even
556 * have a pseudo-header.
557 */
558 *err = WTAP_ERR_BAD_FILE;
559 *err_info = g_strdup_printf("snoop: atmsnoop file has a %u-byte packet, too small to have even an ATM pseudo-header",
560 packet_size);
561 return -1;
562 }
563 if (!snoop_read_atm_pseudoheader(fh, &rec->rec_header.packet_header.pseudo_header,
564 err, err_info))
565 return -1; /* Read error */
566
567 /*
568 * Don't count the pseudo-header as part of the packet.
569 */
570 rec_size -= (guint32)sizeof (struct snoop_atm_hdr);
571 orig_size -= (guint32)sizeof (struct snoop_atm_hdr);
572 packet_size -= (guint32)sizeof (struct snoop_atm_hdr);
573 break;
574
575 case WTAP_ENCAP_ETHERNET:
576 /*
577 * If this is a snoop file, we assume there's no FCS in
578 * this frame; if this is a Shomit file, we assume there
579 * is. (XXX - or should we treat it a "maybe"?)
580 */
581 if (snoop->is_shomiti)
582 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 4;
583 else
584 rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
585 break;
586
587 case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
588 if (packet_size < sizeof (shomiti_wireless_header)) {
589 /*
590 * Uh-oh, the packet isn't big enough to even
591 * have a pseudo-header.
592 */
593 *err = WTAP_ERR_BAD_FILE;
594 *err_info = g_strdup_printf("snoop: Shomiti wireless file has a %u-byte packet, too small to have even a wireless pseudo-header",
595 packet_size);
596 return -1;
597 }
598 if (!snoop_read_shomiti_wireless_pseudoheader(fh,
599 &rec->rec_header.packet_header.pseudo_header, err, err_info, &header_size))
600 return -1; /* Read error */
601
602 /*
603 * Don't count the pseudo-header as part of the packet.
604 */
605 rec_size -= header_size;
606 orig_size -= header_size;
607 packet_size -= header_size;
608 break;
609 }
610
611 rec->rec_type = REC_TYPE_PACKET;
612 rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
613 rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
614 rec->ts.secs = g_ntohl(hdr.ts_sec);
615 rec->ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
616 rec->rec_header.packet_header.caplen = packet_size;
617 rec->rec_header.packet_header.len = orig_size;
618
619 if (rec_size < (sizeof hdr + packet_size)) {
620 /*
621 * What, *negative* padding? Bogus.
622 */
623 *err = WTAP_ERR_BAD_FILE;
624 *err_info = g_strdup_printf("snoop: File has %u-byte record with packet size of %u",
625 rec_size, packet_size);
626 return -1;
627 }
628
629 /*
630 * Read the packet data.
631 */
632 if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
633 return -1; /* failed */
634
635 /*
636 * If this is ATM LANE traffic, try to guess what type of LANE
637 * traffic it is based on the packet contents.
638 */
639 if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
640 rec->rec_header.packet_header.pseudo_header.atm.type == TRAF_LANE) {
641 atm_guess_lane_type(rec, ws_buffer_start_ptr(buf));
642 }
643
644 return rec_size - ((guint)sizeof hdr + packet_size);
645 }
646
647 static gboolean
648 snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
649 int *err, gchar **err_info)
650 {
651 struct snoop_atm_hdr atm_phdr;
652 guint8 vpi;
653 guint16 vci;
654
655 if (!wtap_read_bytes(fh, &atm_phdr, sizeof atm_phdr, err, err_info))
656 return FALSE;
657
658 vpi = atm_phdr.vpi;
659 vci = pntoh16(&atm_phdr.vci);
660
661 /*
662 * The lower 4 bits of the first byte of the header indicate
663 * the type of traffic, as per the "atmioctl.h" header in
664 * SunATM.
665 */
666 switch (atm_phdr.flags & 0x0F) {
667
668 case 0x01: /* LANE */
669 pseudo_header->atm.aal = AAL_5;
670 pseudo_header->atm.type = TRAF_LANE;
671 break;
672
673 case 0x02: /* RFC 1483 LLC multiplexed traffic */
674 pseudo_header->atm.aal = AAL_5;
675 pseudo_header->atm.type = TRAF_LLCMX;
676 break;
677
678 case 0x05: /* ILMI */
679 pseudo_header->atm.aal = AAL_5;
680 pseudo_header->atm.type = TRAF_ILMI;
681 break;
682
683 case 0x06: /* Signalling AAL */
684 pseudo_header->atm.aal = AAL_SIGNALLING;
685 pseudo_header->atm.type = TRAF_UNKNOWN;
686 break;
687
688 case 0x03: /* MARS (RFC 2022) */
689 pseudo_header->atm.aal = AAL_5;
690 pseudo_header->atm.type = TRAF_UNKNOWN;
691 break;
692
693 case 0x04: /* IFMP (Ipsilon Flow Management Protocol; see RFC 1954) */
694 pseudo_header->atm.aal = AAL_5;
695 pseudo_header->atm.type = TRAF_UNKNOWN; /* XXX - TRAF_IPSILON? */
696 break;
697
698 default:
699 /*
700 * Assume it's AAL5, unless it's VPI 0 and VCI 5, in which
701 * case assume it's AAL_SIGNALLING; we know nothing more
702 * about it.
703 *
704 * XXX - is this necessary? Or are we guaranteed that
705 * all signalling traffic has a type of 0x06?
706 *
707 * XXX - is this guaranteed to be AAL5? Or, if the type is
708 * 0x00 ("raw"), might it be non-AAL5 traffic?
709 */
710 if (vpi == 0 && vci == 5)
711 pseudo_header->atm.aal = AAL_SIGNALLING;
712 else
713 pseudo_header->atm.aal = AAL_5;
714 pseudo_header->atm.type = TRAF_UNKNOWN;
715 break;
716 }
717 pseudo_header->atm.subtype = TRAF_ST_UNKNOWN;
718
719 pseudo_header->atm.vpi = vpi;
720 pseudo_header->atm.vci = vci;
721 pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
722
723 /* We don't have this information */
724 pseudo_header->atm.flags = 0;
725 pseudo_header->atm.cells = 0;
726 pseudo_header->atm.aal5t_u2u = 0;
727 pseudo_header->atm.aal5t_len = 0;
728 pseudo_header->atm.aal5t_chksum = 0;
729
730 return TRUE;
731 }
732
733 static gboolean
734 snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
735 union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
736 int *header_size)
737 {
738 shomiti_wireless_header whdr;
739 int rsize;
740
741 if (!wtap_read_bytes(fh, &whdr, sizeof whdr, err, err_info))
742 return FALSE;
743
744 /* the 4th byte of the pad is actually a header length,
745 * we've already read 8 bytes of it, and it must never
746 * be less than 8.
747 *
748 * XXX - presumably that means that the header length
749 * doesn't include the length field, as we've read
750 * 12 bytes total.
751 */
752 if (whdr.pad[3] < 8) {
753 *err = WTAP_ERR_BAD_FILE;
754 *err_info = g_strdup_printf("snoop: Header length in Surveyor record is %u, less than minimum of 8",
755 whdr.pad[3]);
756 return FALSE;
757 }
758 /* Skip the header. */
759 rsize = ((int) whdr.pad[3]) - 8;
760 if (!wtap_read_bytes(fh, NULL, rsize, err, err_info))
761 return FALSE;
762
763 memset(&pseudo_header->ieee_802_11, 0, sizeof(pseudo_header->ieee_802_11));
764 pseudo_header->ieee_802_11.fcs_len = 4;
765 pseudo_header->ieee_802_11.decrypted = FALSE;
766 pseudo_header->ieee_802_11.datapad = FALSE;
767 pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
768 pseudo_header->ieee_802_11.has_channel = TRUE;
769 pseudo_header->ieee_802_11.channel = whdr.channel;
770 pseudo_header->ieee_802_11.has_data_rate = TRUE;
771 pseudo_header->ieee_802_11.data_rate = whdr.rate;
772 pseudo_header->ieee_802_11.has_signal_percent = TRUE;
773 pseudo_header->ieee_802_11.signal_percent = whdr.signal;
774
775 /*
776 * We don't know they PHY, but we do have the data rate;
777 * try to guess the PHY based on the data rate and channel.
778 */
779 if (RATE_IS_DSSS(pseudo_header->ieee_802_11.data_rate)) {
780 /* 11b */
781 pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11B;
782 pseudo_header->ieee_802_11.phy_info.info_11b.has_short_preamble = FALSE;
783 } else if (RATE_IS_OFDM(pseudo_header->ieee_802_11.data_rate)) {
784 /* 11a or 11g, depending on the band. */
785 if (CHAN_IS_BG(pseudo_header->ieee_802_11.channel)) {
786 /* 11g */
787 pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11G;
788 pseudo_header->ieee_802_11.phy_info.info_11g.has_mode = FALSE;
789 } else {
790 /* 11a */
791 pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11A;
792 pseudo_header->ieee_802_11.phy_info.info_11a.has_channel_type = FALSE;
793 pseudo_header->ieee_802_11.phy_info.info_11a.has_turbo_type = FALSE;
794 }
795 }
796
797 /* add back the header and don't forget the pad as well */
798 *header_size = rsize + 8 + 4;
799
800 return TRUE;
801 }
802
803 static const int wtap_encap[] = {
804 -1, /* WTAP_ENCAP_UNKNOWN -> unsupported */
805 0x04, /* WTAP_ENCAP_ETHERNET -> DL_ETHER */
806 0x02, /* WTAP_ENCAP_TOKEN_RING -> DL_TPR */
807 -1, /* WTAP_ENCAP_SLIP -> unsupported */
808 -1, /* WTAP_ENCAP_PPP -> unsupported */
809 0x08, /* WTAP_ENCAP_FDDI -> DL_FDDI */
810 0x08, /* WTAP_ENCAP_FDDI_BITSWAPPED -> DL_FDDI */
811 -1, /* WTAP_ENCAP_RAW_IP -> unsupported */
812 -1, /* WTAP_ENCAP_ARCNET -> unsupported */
813 -1, /* WTAP_ENCAP_ARCNET_LINUX -> unsupported */
814 -1, /* WTAP_ENCAP_ATM_RFC1483 -> unsupported */
815 -1, /* WTAP_ENCAP_LINUX_ATM_CLIP -> unsupported */
816 -1, /* WTAP_ENCAP_LAPB -> unsupported*/
817 0x12, /* WTAP_ENCAP_ATM_PDUS -> DL_IPATM */
818 };
819 #define NUM_WTAP_ENCAPS (sizeof wtap_encap / sizeof wtap_encap[0])
820
821 /* Returns 0 if we could write the specified encapsulation type,
822 an error indication otherwise. */
823 static int snoop_dump_can_write_encap(int encap)
824 {
825 /* Per-packet encapsulations aren't supported. */
826 if (encap == WTAP_ENCAP_PER_PACKET)
827 return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
828
829 if (encap < 0 || (unsigned)encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
830 return WTAP_ERR_UNWRITABLE_ENCAP;
831
832 return 0;
833 }
834
835 /* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
836 failure */
837 static gboolean snoop_dump_open(wtap_dumper *wdh, int *err, gchar **err_info _U_)
838 {
839 struct snoop_hdr file_hdr;
840
841 /* This is a snoop file */
842 wdh->subtype_write = snoop_dump;
843
844 /* Write the file header. */
845 if (!wtap_dump_file_write(wdh, &snoop_magic, sizeof snoop_magic, err))
846 return FALSE;
847
848 /* current "snoop" format is 2 */
849 file_hdr.version = g_htonl(2);
850 file_hdr.network = g_htonl(wtap_encap[wdh->encap]);
851 if (!wtap_dump_file_write(wdh, &file_hdr, sizeof file_hdr, err))
852 return FALSE;
853
854 return TRUE;
855 }
856
857 /* Write a record for a packet to a dump file.
858 Returns TRUE on success, FALSE on failure. */
859 static gboolean snoop_dump(wtap_dumper *wdh,
860 const wtap_rec *rec,
861 const guint8 *pd, int *err, gchar **err_info _U_)
862 {
863 const union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
864 struct snooprec_hdr rec_hdr;
865 int reclen;
866 guint padlen;
867 static const char zeroes[4] = {0};
868 struct snoop_atm_hdr atm_hdr;
869 int atm_hdrsize;
870
871 /* We can only write packet records. */
872 if (rec->rec_type != REC_TYPE_PACKET) {
873 *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
874 return FALSE;
875 }
876
877 /*
878 * Make sure this packet doesn't have a link-layer type that
879 * differs from the one for the file.
880 */
881 if (wdh->encap != rec->rec_header.packet_header.pkt_encap) {
882 *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
883 return FALSE;
884 }
885
886 if (wdh->encap == WTAP_ENCAP_ATM_PDUS)
887 atm_hdrsize = sizeof (struct snoop_atm_hdr);
888 else
889 atm_hdrsize = 0;
890
891 /* Record length = header length plus data length... */
892 reclen = (int)sizeof rec_hdr + rec->rec_header.packet_header.caplen + atm_hdrsize;
893
894
895 /* ... plus enough bytes to pad it to a 4-byte boundary. */
896 padlen = WS_ROUNDUP_4(reclen) - reclen;
897 reclen += padlen;
898
899 /* Don't write anything we're not willing to read. */
900 if (rec->rec_header.packet_header.caplen + atm_hdrsize > WTAP_MAX_PACKET_SIZE_STANDARD) {
901 *err = WTAP_ERR_PACKET_TOO_LARGE;
902 return FALSE;
903 }
904
905 rec_hdr.orig_len = g_htonl(rec->rec_header.packet_header.len + atm_hdrsize);
906 rec_hdr.incl_len = g_htonl(rec->rec_header.packet_header.caplen + atm_hdrsize);
907 rec_hdr.rec_len = g_htonl(reclen);
908 rec_hdr.cum_drops = 0;
909 rec_hdr.ts_sec = g_htonl(rec->ts.secs);
910 rec_hdr.ts_usec = g_htonl(rec->ts.nsecs / 1000);
911 if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof rec_hdr, err))
912 return FALSE;
913
914 if (wdh->encap == WTAP_ENCAP_ATM_PDUS) {
915 /*
916 * Write the ATM header.
917 */
918 atm_hdr.flags =
919 (pseudo_header->atm.channel == 0) ? 0x80 : 0x00;
920 switch (pseudo_header->atm.aal) {
921
922 case AAL_SIGNALLING:
923 /* Signalling AAL */
924 atm_hdr.flags |= 0x06;
925 break;
926
927 case AAL_5:
928 switch (pseudo_header->atm.type) {
929
930 case TRAF_LANE:
931 /* LANE */
932 atm_hdr.flags |= 0x01;
933 break;
934
935 case TRAF_LLCMX:
936 /* RFC 1483 LLC multiplexed traffic */
937 atm_hdr.flags |= 0x02;
938 break;
939
940 case TRAF_ILMI:
941 /* ILMI */
942 atm_hdr.flags |= 0x05;
943 break;
944 }
945 break;
946 }
947 atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;
948 atm_hdr.vci = g_htons(pseudo_header->atm.vci);
949 if (!wtap_dump_file_write(wdh, &atm_hdr, sizeof atm_hdr, err))
950 return FALSE;
951 }
952
953 if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
954 return FALSE;
955
956 /* Now write the padding. */
957 if (!wtap_dump_file_write(wdh, zeroes, padlen, err))
958 return FALSE;
959 return TRUE;
960 }
961
962 static const struct supported_block_type snoop_blocks_supported[] = {
963 /*
964 * We support packet blocks, with no comments or other options.
965 */
966 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
967 };
968
969 static const struct file_type_subtype_info snoop_info = {
970 "Sun snoop", "snoop", "snoop", "cap",
971 FALSE, BLOCKS_SUPPORTED(snoop_blocks_supported),
972 snoop_dump_can_write_encap, snoop_dump_open, NULL
973 };
974
975 static const struct supported_block_type shomiti_blocks_supported[] = {
976 /*
977 * We support packet blocks, with no comments or other options.
978 */
979 { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
980 };
981
982 static const struct file_type_subtype_info shomiti_info = {
983 "Shomiti/Finisar Surveyor", "shomiti", "cap", NULL,
984 FALSE, BLOCKS_SUPPORTED(shomiti_blocks_supported),
985 NULL, NULL, NULL
986 };
987
988 void register_snoop(void)
989 {
990 snoop_file_type_subtype = wtap_register_file_type_subtype(&snoop_info);
991 shomiti_file_type_subtype = wtap_register_file_type_subtype(&shomiti_info);
992
993 /*
994 * Register names for backwards compatibility with the
995 * wtap_filetypes table in Lua.
996 */
997 wtap_register_backwards_compatibility_lua_name("SNOOP",
998 snoop_file_type_subtype);
999 wtap_register_backwards_compatibility_lua_name("SHOMITI",
1000 shomiti_file_type_subtype);
1001 }
1002
1003 /*
1004 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1005 *
1006 * Local variables:
1007 * c-basic-offset: 8
1008 * tab-width: 8
1009 * indent-tabs-mode: t
1010 * End:
1011 *
1012 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
1013 * :indentSize=8:tabSize=8:noTabs=false:
1014 */
1015