1 /* wtap.c
2  *
3  * Wiretap Library
4  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include <config.h>
10 
11 #include <string.h>
12 #include <errno.h>
13 
14 #include <sys/types.h>
15 
16 #include "wtap-int.h"
17 #include "wtap_opttypes.h"
18 
19 #include "file_wrappers.h"
20 #include <wsutil/file_util.h>
21 #include <wsutil/buffer.h>
22 #include <wsutil/ws_assert.h>
23 #include <wsutil/wslog.h>
24 #ifdef HAVE_PLUGINS
25 #include <wsutil/plugins.h>
26 #endif
27 
28 #ifdef HAVE_PLUGINS
29 static plugins_t *libwiretap_plugins = NULL;
30 #endif
31 
32 static GSList *wtap_plugins = NULL;
33 
34 #ifdef HAVE_PLUGINS
35 void
wtap_register_plugin(const wtap_plugin * plug)36 wtap_register_plugin(const wtap_plugin *plug)
37 {
38 	wtap_plugins = g_slist_prepend(wtap_plugins, (wtap_plugin *)plug);
39 }
40 #else /* HAVE_PLUGINS */
41 void
wtap_register_plugin(const wtap_plugin * plug _U_)42 wtap_register_plugin(const wtap_plugin *plug _U_)
43 {
44 	ws_warning("wtap_register_plugin: built without support for binary plugins");
45 }
46 #endif /* HAVE_PLUGINS */
47 
48 int
wtap_plugins_supported(void)49 wtap_plugins_supported(void)
50 {
51 #ifdef HAVE_PLUGINS
52 	return g_module_supported() ? 0 : 1;
53 #else
54 	return -1;
55 #endif
56 }
57 
58 static void
call_plugin_register_wtap_module(gpointer data,gpointer user_data _U_)59 call_plugin_register_wtap_module(gpointer data, gpointer user_data _U_)
60 {
61 	wtap_plugin *plug = (wtap_plugin *)data;
62 
63 	if (plug->register_wtap_module) {
64 		plug->register_wtap_module();
65 	}
66 }
67 
68 /*
69  * Return the size of the file, as reported by the OS.
70  * (gint64, in case that's 64 bits.)
71  */
72 gint64
wtap_file_size(wtap * wth,int * err)73 wtap_file_size(wtap *wth, int *err)
74 {
75 	ws_statb64 statb;
76 
77 	if (file_fstat((wth->fh == NULL) ? wth->random_fh : wth->fh,
78 	    &statb, err) == -1)
79 		return -1;
80 	return statb.st_size;
81 }
82 
83 /*
84  * Do an fstat on the file.
85  */
86 int
wtap_fstat(wtap * wth,ws_statb64 * statb,int * err)87 wtap_fstat(wtap *wth, ws_statb64 *statb, int *err)
88 {
89 	if (file_fstat((wth->fh == NULL) ? wth->random_fh : wth->fh,
90 	    statb, err) == -1)
91 		return -1;
92 	return 0;
93 }
94 
95 int
wtap_file_type_subtype(wtap * wth)96 wtap_file_type_subtype(wtap *wth)
97 {
98 	return wth->file_type_subtype;
99 }
100 
101 guint
wtap_snapshot_length(wtap * wth)102 wtap_snapshot_length(wtap *wth)
103 {
104 	return wth->snapshot_length;
105 }
106 
107 int
wtap_file_encap(wtap * wth)108 wtap_file_encap(wtap *wth)
109 {
110 	return wth->file_encap;
111 }
112 
113 int
wtap_file_tsprec(wtap * wth)114 wtap_file_tsprec(wtap *wth)
115 {
116 	return wth->file_tsprec;
117 }
118 
119 guint
wtap_file_get_num_shbs(wtap * wth)120 wtap_file_get_num_shbs(wtap *wth)
121 {
122 	return wth->shb_hdrs->len;
123 }
124 
125 wtap_block_t
wtap_file_get_shb(wtap * wth,guint shb_num)126 wtap_file_get_shb(wtap *wth, guint shb_num)
127 {
128 	if ((wth == NULL) || (wth->shb_hdrs == NULL) || (shb_num >= wth->shb_hdrs->len))
129 		return NULL;
130 
131 	return g_array_index(wth->shb_hdrs, wtap_block_t, shb_num);
132 }
133 
134 GArray*
wtap_file_get_shb_for_new_file(wtap * wth)135 wtap_file_get_shb_for_new_file(wtap *wth)
136 {
137 	guint shb_count;
138 	wtap_block_t shb_hdr_src, shb_hdr_dest;
139 	GArray* shb_hdrs;
140 
141 	if ((wth == NULL) || (wth->shb_hdrs == NULL) || (wth->shb_hdrs->len == 0))
142 		return NULL;
143 
144 	shb_hdrs = g_array_new(FALSE, FALSE, sizeof(wtap_block_t));
145 
146 	for (shb_count = 0; shb_count < wth->shb_hdrs->len; shb_count++) {
147 		shb_hdr_src = g_array_index(wth->shb_hdrs, wtap_block_t, shb_count);
148 		shb_hdr_dest = wtap_block_make_copy(shb_hdr_src);
149 		g_array_append_val(shb_hdrs, shb_hdr_dest);
150 	}
151 
152 	return shb_hdrs;
153 }
154 
155 /*
156  * XXX - replace with APIs that let us handle multiple comments.
157  */
158 void
wtap_write_shb_comment(wtap * wth,gchar * comment)159 wtap_write_shb_comment(wtap *wth, gchar *comment)
160 {
161 	if ((wth != NULL) && (wth->shb_hdrs != NULL) && (wth->shb_hdrs->len > 0)) {
162 		wtap_block_set_nth_string_option_value(g_array_index(wth->shb_hdrs, wtap_block_t, 0), OPT_COMMENT, 0, comment, (gsize)(comment ? strlen(comment) : 0));
163 	}
164 }
165 
166 wtapng_iface_descriptions_t *
wtap_file_get_idb_info(wtap * wth)167 wtap_file_get_idb_info(wtap *wth)
168 {
169 	wtapng_iface_descriptions_t *idb_info;
170 
171 	idb_info = g_new(wtapng_iface_descriptions_t,1);
172 
173 	idb_info->interface_data	= wth->interface_data;
174 
175 	return idb_info;
176 }
177 
178 wtap_block_t
wtap_get_next_interface_description(wtap * wth)179 wtap_get_next_interface_description(wtap *wth)
180 {
181 	if (wth->next_interface_data < wth->interface_data->len) {
182 		/*
183 		 * We have an IDB to return.  Advance to the next
184 		 * IDB, and return this one.
185 		 */
186 		wtap_block_t idb;
187 
188 		idb = g_array_index(wth->interface_data, wtap_block_t,
189 		    wth->next_interface_data);
190 		wth->next_interface_data++;
191 		return idb;
192 	}
193 
194 	/*
195 	 * We've returned all the interface descriptions we currently
196 	 * have.  (There may be more in the future, if we read more.)
197 	 */
198 	return NULL;
199 }
200 
201 void
wtap_add_idb(wtap * wth,wtap_block_t idb)202 wtap_add_idb(wtap *wth, wtap_block_t idb)
203 {
204 	g_array_append_val(wth->interface_data, idb);
205 }
206 
207 void
wtap_add_generated_idb(wtap * wth)208 wtap_add_generated_idb(wtap *wth)
209 {
210 	wtap_block_t idb;
211 	wtapng_if_descr_mandatory_t *if_descr_mand;
212 	int snaplen;
213 
214 	ws_assert(wth->file_encap != WTAP_ENCAP_UNKNOWN &&
215 	    wth->file_encap != WTAP_ENCAP_PER_PACKET);
216 	ws_assert(wth->file_tsprec != WTAP_TSPREC_UNKNOWN &&
217 	    wth->file_tsprec != WTAP_TSPREC_PER_PACKET);
218 
219 	idb = wtap_block_create(WTAP_BLOCK_IF_ID_AND_INFO);
220 
221 	if_descr_mand = (wtapng_if_descr_mandatory_t*)wtap_block_get_mandatory_data(idb);
222 	if_descr_mand->wtap_encap = wth->file_encap;
223 	if_descr_mand->tsprecision = wth->file_tsprec;
224 	switch (wth->file_tsprec) {
225 
226 	case WTAP_TSPREC_SEC:
227 		if_descr_mand->time_units_per_second = 1;
228 		wtap_block_add_uint8_option(idb, OPT_IDB_TSRESOL, 0);
229 		break;
230 
231 	case WTAP_TSPREC_DSEC:
232 		if_descr_mand->time_units_per_second = 10;
233 		wtap_block_add_uint8_option(idb, OPT_IDB_TSRESOL, 1);
234 		break;
235 
236 	case WTAP_TSPREC_CSEC:
237 		if_descr_mand->time_units_per_second = 100;
238 		wtap_block_add_uint8_option(idb, OPT_IDB_TSRESOL, 2);
239 		break;
240 
241 	case WTAP_TSPREC_MSEC:
242 		if_descr_mand->time_units_per_second = 1000;
243 		wtap_block_add_uint8_option(idb, OPT_IDB_TSRESOL, 3);
244 		break;
245 
246 	case WTAP_TSPREC_USEC:
247 		if_descr_mand->time_units_per_second = 1000000;
248 		/* This is the default, so no need to add an option */
249 		break;
250 
251 	case WTAP_TSPREC_NSEC:
252 		if_descr_mand->time_units_per_second = 1000000000;
253 		wtap_block_add_uint8_option(idb, OPT_IDB_TSRESOL, 9);
254 		break;
255 
256 	case WTAP_TSPREC_PER_PACKET:
257 	case WTAP_TSPREC_UNKNOWN:
258 	default:
259 		/*
260 		 * Don't do this.
261 		 */
262 		ws_assert_not_reached();
263 		break;
264 	}
265 	snaplen = wth->snapshot_length;
266 	if (snaplen == 0) {
267 		/*
268 		 * No snapshot length was specified.  Pick an
269 		 * appropriate snapshot length for this
270 		 * link-layer type.
271 		 *
272 		 * We use WTAP_MAX_PACKET_SIZE_STANDARD for everything except
273 		 * D-Bus, which has a maximum packet size of 128MB,
274 		 * and EBHSCR, which has a maximum packet size of 8MB,
275 		 * which is more than we want to put into files
276 		 * with other link-layer header types, as that
277 		 * might cause some software reading those files
278 		 * to allocate an unnecessarily huge chunk of
279 		 * memory for a packet buffer.
280 		 */
281 		if (wth->file_encap == WTAP_ENCAP_DBUS)
282 			snaplen = 128*1024*1024;
283 		else if (wth->file_encap == WTAP_ENCAP_EBHSCR)
284 			snaplen = 8*1024*1024;
285 		else
286 			snaplen = WTAP_MAX_PACKET_SIZE_STANDARD;
287 	}
288 	if_descr_mand->snap_len = snaplen;
289 	if_descr_mand->num_stat_entries = 0;          /* Number of ISBs */
290 	if_descr_mand->interface_statistics = NULL;
291 
292 	/*
293 	 * Add this IDB.
294 	 */
295 	wtap_add_idb(wth, idb);
296 }
297 
298 void
wtap_free_idb_info(wtapng_iface_descriptions_t * idb_info)299 wtap_free_idb_info(wtapng_iface_descriptions_t *idb_info)
300 {
301 	if (idb_info == NULL)
302 		return;
303 
304 	wtap_block_array_free(idb_info->interface_data);
305 	g_free(idb_info);
306 }
307 
308 gchar *
wtap_get_debug_if_descr(const wtap_block_t if_descr,const int indent,const char * line_end)309 wtap_get_debug_if_descr(const wtap_block_t if_descr,
310                         const int indent,
311                         const char* line_end)
312 {
313 	char* tmp_content;
314 	wtapng_if_descr_mandatory_t* if_descr_mand;
315 	GString *info = g_string_new("");
316 	guint64 tmp64;
317 	gint8 itmp8;
318 	guint8 tmp8;
319 	if_filter_opt_t if_filter;
320 
321 	ws_assert(if_descr);
322 
323 	if_descr_mand = (wtapng_if_descr_mandatory_t*)wtap_block_get_mandatory_data(if_descr);
324 	if (wtap_block_get_string_option_value(if_descr, OPT_IDB_NAME, &tmp_content) == WTAP_OPTTYPE_SUCCESS) {
325 		g_string_printf(info,
326 				"%*cName = %s%s", indent, ' ',
327 				tmp_content ? tmp_content : "UNKNOWN",
328 				line_end);
329 	}
330 
331 	if (wtap_block_get_string_option_value(if_descr, OPT_IDB_DESCRIPTION, &tmp_content) == WTAP_OPTTYPE_SUCCESS) {
332 		g_string_append_printf(info,
333 				"%*cDescription = %s%s", indent, ' ',
334 				tmp_content ? tmp_content : "NONE",
335 				line_end);
336 	}
337 
338 	g_string_append_printf(info,
339 			"%*cEncapsulation = %s (%d - %s)%s", indent, ' ',
340 			wtap_encap_description(if_descr_mand->wtap_encap),
341 			if_descr_mand->wtap_encap,
342 			wtap_encap_name(if_descr_mand->wtap_encap),
343 			line_end);
344 
345 	if (wtap_block_get_string_option_value(if_descr, OPT_IDB_HARDWARE, &tmp_content) == WTAP_OPTTYPE_SUCCESS) {
346 		g_string_append_printf(info,
347 				"%*cHardware = %s%s", indent, ' ',
348 				tmp_content ? tmp_content : "NONE",
349 				line_end);
350 	}
351 
352 	if (wtap_block_get_uint64_option_value(if_descr, OPT_IDB_SPEED, &tmp64) == WTAP_OPTTYPE_SUCCESS) {
353 		g_string_append_printf(info,
354 				"%*cSpeed = %" G_GINT64_MODIFIER "u%s", indent, ' ',
355 				tmp64,
356 				line_end);
357 	}
358 
359 	g_string_append_printf(info,
360 			"%*cCapture length = %u%s", indent, ' ',
361 			if_descr_mand->snap_len,
362 			line_end);
363 
364 	if (wtap_block_get_uint8_option_value(if_descr, OPT_IDB_FCSLEN, &itmp8) == WTAP_OPTTYPE_SUCCESS) {
365 		g_string_append_printf(info,
366 				"%*cFCS length = %d%s", indent, ' ',
367 				itmp8,
368 				line_end);
369 	}
370 
371 	g_string_append_printf(info,
372 			"%*cTime precision = %s (%d)%s", indent, ' ',
373 			wtap_tsprec_string(if_descr_mand->tsprecision),
374 			if_descr_mand->tsprecision,
375 			line_end);
376 
377 	g_string_append_printf(info,
378 			"%*cTime ticks per second = %" G_GINT64_MODIFIER "u%s", indent, ' ',
379 			if_descr_mand->time_units_per_second,
380 			line_end);
381 
382 	if (wtap_block_get_uint8_option_value(if_descr, OPT_IDB_TSRESOL, &tmp8) == WTAP_OPTTYPE_SUCCESS) {
383 		g_string_append_printf(info,
384 				"%*cTime resolution = 0x%.2x%s", indent, ' ',
385 				tmp8,
386 				line_end);
387 	}
388 
389 	if (wtap_block_get_if_filter_option_value(if_descr, OPT_IDB_FILTER, &if_filter) == WTAP_OPTTYPE_SUCCESS) {
390 		switch (if_filter.type) {
391 
392 		case if_filter_pcap:
393 			g_string_append_printf(info,
394 					"%*cFilter string = %s%s", indent, ' ',
395 					if_filter.data.filter_str,
396 					line_end);
397 			break;
398 
399 		case if_filter_bpf:
400 			g_string_append_printf(info,
401 					"%*cBPF filter length = %u%s", indent, ' ',
402 					if_filter.data.bpf_prog.bpf_prog_len,
403 					line_end);
404 			break;
405 
406 		default:
407 			g_string_append_printf(info,
408 					"%*cUnknown filter type %u%s", indent, ' ',
409 					if_filter.type,
410 					line_end);
411 			break;
412 		}
413 	}
414 
415 	if (wtap_block_get_string_option_value(if_descr, OPT_IDB_OS, &tmp_content) == WTAP_OPTTYPE_SUCCESS) {
416 		g_string_append_printf(info,
417 				"%*cOperating system = %s%s", indent, ' ',
418 				tmp_content ? tmp_content : "UNKNOWN",
419 				line_end);
420 	}
421 
422 	/*
423 	 * XXX - support multiple comments.
424 	 */
425 	if (wtap_block_get_nth_string_option_value(if_descr, OPT_COMMENT, 0, &tmp_content) == WTAP_OPTTYPE_SUCCESS) {
426 		g_string_append_printf(info,
427 				"%*cComment = %s%s", indent, ' ',
428 				tmp_content ? tmp_content : "NONE",
429 				line_end);
430 	}
431 
432 	g_string_append_printf(info,
433 			"%*cNumber of stat entries = %u%s", indent, ' ',
434 			if_descr_mand->num_stat_entries,
435 			line_end);
436 
437 	return g_string_free(info, FALSE);
438 }
439 
440 wtap_block_t
wtap_file_get_nrb(wtap * wth)441 wtap_file_get_nrb(wtap *wth)
442 {
443 	if ((wth == NULL) || (wth->nrb_hdrs == NULL) || (wth->nrb_hdrs->len == 0))
444 		return NULL;
445 
446 	return g_array_index(wth->nrb_hdrs, wtap_block_t, 0);
447 }
448 
449 GArray*
wtap_file_get_nrb_for_new_file(wtap * wth)450 wtap_file_get_nrb_for_new_file(wtap *wth)
451 {
452 	guint nrb_count;
453 	wtap_block_t nrb_hdr_src, nrb_hdr_dest;
454 	GArray* nrb_hdrs;
455 
456 	if ((wth == NULL || wth->nrb_hdrs == NULL) || (wth->nrb_hdrs->len == 0))
457 		return NULL;
458 
459 	nrb_hdrs = g_array_new(FALSE, FALSE, sizeof(wtap_block_t));
460 
461 	for (nrb_count = 0; nrb_count < wth->nrb_hdrs->len; nrb_count++) {
462 		nrb_hdr_src = g_array_index(wth->nrb_hdrs, wtap_block_t, nrb_count);
463 		nrb_hdr_dest = wtap_block_make_copy(nrb_hdr_src);
464 		g_array_append_val(nrb_hdrs, nrb_hdr_dest);
465 	}
466 
467 	return nrb_hdrs;
468 }
469 
470 void
wtap_dump_params_init(wtap_dump_params * params,wtap * wth)471 wtap_dump_params_init(wtap_dump_params *params, wtap *wth)
472 {
473 	memset(params, 0, sizeof(*params));
474 	if (wth == NULL)
475 		return;
476 
477 	params->encap = wtap_file_encap(wth);
478 	params->snaplen = wtap_snapshot_length(wth);
479 	params->tsprec = wtap_file_tsprec(wth);
480 	params->shb_hdrs = wtap_file_get_shb_for_new_file(wth);
481 	params->idb_inf = wtap_file_get_idb_info(wth);
482 	params->nrb_hdrs = wtap_file_get_nrb_for_new_file(wth);
483 	/* Assume that the input handle remains open until the dumper is closed.
484 	 * Refer to the DSBs from the input file, wtap_dump will then copy DSBs
485 	 * as they become available. */
486 	params->dsbs_growing = wth->dsbs;
487 	params->dont_copy_idbs = FALSE;
488 }
489 
490 /*
491  * XXX - eventually, we should make this wtap_dump_params_init(),
492  * and have everything copy IDBs as they're read.
493  */
494 void
wtap_dump_params_init_no_idbs(wtap_dump_params * params,wtap * wth)495 wtap_dump_params_init_no_idbs(wtap_dump_params *params, wtap *wth)
496 {
497 	memset(params, 0, sizeof(*params));
498 	if (wth == NULL)
499 		return;
500 
501 	params->encap = wtap_file_encap(wth);
502 	params->snaplen = wtap_snapshot_length(wth);
503 	params->tsprec = wtap_file_tsprec(wth);
504 	params->shb_hdrs = wtap_file_get_shb_for_new_file(wth);
505 	params->idb_inf = wtap_file_get_idb_info(wth);
506 	params->nrb_hdrs = wtap_file_get_nrb_for_new_file(wth);
507 	/* Assume that the input handle remains open until the dumper is closed.
508 	 * Refer to the DSBs from the input file, wtap_dump will then copy DSBs
509 	 * as they become available. */
510 	params->dsbs_growing = wth->dsbs;
511 	params->dont_copy_idbs = TRUE;
512 }
513 
514 void
wtap_dump_params_discard_decryption_secrets(wtap_dump_params * params)515 wtap_dump_params_discard_decryption_secrets(wtap_dump_params *params)
516 {
517 	params->dsbs_initial = NULL;
518 	params->dsbs_growing = NULL;
519 }
520 
521 void
wtap_dump_params_cleanup(wtap_dump_params * params)522 wtap_dump_params_cleanup(wtap_dump_params *params)
523 {
524 	wtap_block_array_free(params->shb_hdrs);
525 	/* params->idb_inf is currently expected to be freed by the caller. */
526 	wtap_block_array_free(params->nrb_hdrs);
527 
528 	memset(params, 0, sizeof(*params));
529 }
530 
531 /* Table of the encapsulation types we know about. */
532 struct encap_type_info {
533 	const char *name;
534 	const char *description;
535 };
536 
537 static struct encap_type_info encap_table_base[] = {
538 	/* WTAP_ENCAP_UNKNOWN */
539 	{ "unknown", "Unknown" },
540 
541 	/* WTAP_ENCAP_ETHERNET */
542 	{ "ether", "Ethernet" },
543 
544 	/* WTAP_ENCAP_TOKEN_RING */
545 	{ "tr", "Token Ring" },
546 
547 	/* WTAP_ENCAP_SLIP */
548 	{ "slip", "SLIP" },
549 
550 	/* WTAP_ENCAP_PPP */
551 	{ "ppp", "PPP" },
552 
553 	/* WTAP_ENCAP_FDDI */
554 	{ "fddi", "FDDI" },
555 
556 	/* WTAP_ENCAP_FDDI_BITSWAPPED */
557 	{ "fddi-swapped", "FDDI with bit-swapped MAC addresses" },
558 
559 	/* WTAP_ENCAP_RAW_IP */
560 	{ "rawip", "Raw IP" },
561 
562 	/* WTAP_ENCAP_ARCNET */
563 	{ "arcnet", "ARCNET" },
564 
565 	/* WTAP_ENCAP_ARCNET_LINUX */
566 	{ "arcnet_linux", "Linux ARCNET" },
567 
568 	/* WTAP_ENCAP_ATM_RFC1483 */
569 	{ "atm-rfc1483", "RFC 1483 ATM" },
570 
571 	/* WTAP_ENCAP_LINUX_ATM_CLIP */
572 	{ "linux-atm-clip", "Linux ATM CLIP" },
573 
574 	/* WTAP_ENCAP_LAPB */
575 	{ "lapb", "LAPB" },
576 
577 	/* WTAP_ENCAP_ATM_PDUS */
578 	{ "atm-pdus", "ATM PDUs" },
579 
580 	/* WTAP_ENCAP_ATM_PDUS_UNTRUNCATED */
581 	{ "atm-pdus-untruncated", "ATM PDUs - untruncated" },
582 
583 	/* WTAP_ENCAP_NULL */
584 	{ "null", "NULL/Loopback" },
585 
586 	/* WTAP_ENCAP_ASCEND */
587 	{ "ascend", "Lucent/Ascend access equipment" },
588 
589 	/* WTAP_ENCAP_ISDN */
590 	{ "isdn", "ISDN" },
591 
592 	/* WTAP_ENCAP_IP_OVER_FC */
593 	{ "ip-over-fc", "RFC 2625 IP-over-Fibre Channel" },
594 
595 	/* WTAP_ENCAP_PPP_WITH_PHDR */
596 	{ "ppp-with-direction", "PPP with Directional Info" },
597 
598 	/* WTAP_ENCAP_IEEE_802_11 */
599 	{ "ieee-802-11", "IEEE 802.11 Wireless LAN" },
600 
601 	/* WTAP_ENCAP_IEEE_802_11_PRISM */
602 	{ "ieee-802-11-prism", "IEEE 802.11 plus Prism II monitor mode radio header" },
603 
604 	/* WTAP_ENCAP_IEEE_802_11_WITH_RADIO */
605 	{ "ieee-802-11-radio", "IEEE 802.11 Wireless LAN with radio information" },
606 
607 	/* WTAP_ENCAP_IEEE_802_11_RADIOTAP */
608 	{ "ieee-802-11-radiotap", "IEEE 802.11 plus radiotap radio header" },
609 
610 	/* WTAP_ENCAP_IEEE_802_11_AVS */
611 	{ "ieee-802-11-avs", "IEEE 802.11 plus AVS radio header" },
612 
613 	/* WTAP_ENCAP_SLL */
614 	{ "linux-sll", "Linux cooked-mode capture v1" },
615 
616 	/* WTAP_ENCAP_FRELAY */
617 	{ "frelay", "Frame Relay" },
618 
619 	/* WTAP_ENCAP_FRELAY_WITH_PHDR */
620 	{ "frelay-with-direction", "Frame Relay with Directional Info" },
621 
622 	/* WTAP_ENCAP_CHDLC */
623 	{ "chdlc", "Cisco HDLC" },
624 
625 	/* WTAP_ENCAP_CISCO_IOS */
626 	{ "ios", "Cisco IOS internal" },
627 
628 	/* WTAP_ENCAP_LOCALTALK */
629 	{ "ltalk", "Localtalk" },
630 
631 	/* WTAP_ENCAP_OLD_PFLOG  */
632 	{ "pflog-old", "OpenBSD PF Firewall logs, pre-3.4" },
633 
634 	/* WTAP_ENCAP_HHDLC */
635 	{ "hhdlc", "HiPath HDLC" },
636 
637 	/* WTAP_ENCAP_DOCSIS */
638 	{ "docsis", "Data Over Cable Service Interface Specification" },
639 
640 	/* WTAP_ENCAP_COSINE */
641 	{ "cosine", "CoSine L2 debug log" },
642 
643 	/* WTAP_ENCAP_WFLEET_HDLC */
644 	{ "whdlc", "Wellfleet HDLC" },
645 
646 	/* WTAP_ENCAP_SDLC */
647 	{ "sdlc", "SDLC" },
648 
649 	/* WTAP_ENCAP_TZSP */
650 	{ "tzsp", "Tazmen sniffer protocol" },
651 
652 	/* WTAP_ENCAP_ENC */
653 	{ "enc", "OpenBSD enc(4) encapsulating interface" },
654 
655 	/* WTAP_ENCAP_PFLOG  */
656 	{ "pflog", "OpenBSD PF Firewall logs" },
657 
658 	/* WTAP_ENCAP_CHDLC_WITH_PHDR */
659 	{ "chdlc-with-direction", "Cisco HDLC with Directional Info" },
660 
661 	/* WTAP_ENCAP_BLUETOOTH_H4 */
662 	{ "bluetooth-h4", "Bluetooth H4" },
663 
664 	/* WTAP_ENCAP_MTP2 */
665 	{ "mtp2", "SS7 MTP2" },
666 
667 	/* WTAP_ENCAP_MTP3 */
668 	{ "mtp3", "SS7 MTP3" },
669 
670 	/* WTAP_ENCAP_IRDA */
671 	{ "irda", "IrDA" },
672 
673 	/* WTAP_ENCAP_USER0 */
674 	{ "user0", "USER 0" },
675 
676 	/* WTAP_ENCAP_USER1 */
677 	{ "user1", "USER 1" },
678 
679 	/* WTAP_ENCAP_USER2 */
680 	{ "user2", "USER 2" },
681 
682 	/* WTAP_ENCAP_USER3 */
683 	{ "user3", "USER 3" },
684 
685 	/* WTAP_ENCAP_USER4 */
686 	{ "user4", "USER 4" },
687 
688 	/* WTAP_ENCAP_USER5 */
689 	{ "user5", "USER 5" },
690 
691 	/* WTAP_ENCAP_USER6 */
692 	{ "user6", "USER 6" },
693 
694 	/* WTAP_ENCAP_USER7 */
695 	{ "user7", "USER 7" },
696 
697 	/* WTAP_ENCAP_USER8 */
698 	{ "user8", "USER 8" },
699 
700 	/* WTAP_ENCAP_USER9 */
701 	{ "user9", "USER 9" },
702 
703 	/* WTAP_ENCAP_USER10 */
704 	{ "user10", "USER 10" },
705 
706 	/* WTAP_ENCAP_USER11 */
707 	{ "user11", "USER 11" },
708 
709 	/* WTAP_ENCAP_USER12 */
710 	{ "user12", "USER 12" },
711 
712 	/* WTAP_ENCAP_USER13 */
713 	{ "user13", "USER 13" },
714 
715 	/* WTAP_ENCAP_USER14 */
716 	{ "user14", "USER 14" },
717 
718 	/* WTAP_ENCAP_USER15 */
719 	{ "user15", "USER 15" },
720 
721 	/* WTAP_ENCAP_SYMANTEC */
722 	{ "symantec", "Symantec Enterprise Firewall" },
723 
724 	/* WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 */
725 	{ "ap1394", "Apple IP-over-IEEE 1394" },
726 
727 	/* WTAP_ENCAP_BACNET_MS_TP */
728 	{ "bacnet-ms-tp", "BACnet MS/TP" },
729 
730 	/* WTAP_ENCAP_NETTL_RAW_ICMP */
731 	{ "raw-icmp-nettl", "Raw ICMP with nettl headers" },
732 
733 	/* WTAP_ENCAP_NETTL_RAW_ICMPV6 */
734 	{ "raw-icmpv6-nettl", "Raw ICMPv6 with nettl headers" },
735 
736 	/* WTAP_ENCAP_GPRS_LLC */
737 	{ "gprs-llc", "GPRS LLC" },
738 
739 	/* WTAP_ENCAP_JUNIPER_ATM1 */
740 	{ "juniper-atm1", "Juniper ATM1" },
741 
742 	/* WTAP_ENCAP_JUNIPER_ATM2 */
743 	{ "juniper-atm2", "Juniper ATM2" },
744 
745 	/* WTAP_ENCAP_REDBACK */
746 	{ "redback", "Redback SmartEdge" },
747 
748 	/* WTAP_ENCAP_NETTL_RAW_IP */
749 	{ "rawip-nettl", "Raw IP with nettl headers" },
750 
751 	/* WTAP_ENCAP_NETTL_ETHERNET */
752 	{ "ether-nettl", "Ethernet with nettl headers" },
753 
754 	/* WTAP_ENCAP_NETTL_TOKEN_RING */
755 	{ "tr-nettl", "Token Ring with nettl headers" },
756 
757 	/* WTAP_ENCAP_NETTL_FDDI */
758 	{ "fddi-nettl", "FDDI with nettl headers" },
759 
760 	/* WTAP_ENCAP_NETTL_UNKNOWN */
761 	{ "unknown-nettl", "Unknown link-layer type with nettl headers" },
762 
763 	/* WTAP_ENCAP_MTP2_WITH_PHDR */
764 	{ "mtp2-with-phdr", "MTP2 with pseudoheader" },
765 
766 	/* WTAP_ENCAP_JUNIPER_PPPOE */
767 	{ "juniper-pppoe", "Juniper PPPoE" },
768 
769 	/* WTAP_ENCAP_GCOM_TIE1 */
770 	{ "gcom-tie1", "GCOM TIE1" },
771 
772 	/* WTAP_ENCAP_GCOM_SERIAL */
773 	{ "gcom-serial", "GCOM Serial" },
774 
775 	/* WTAP_ENCAP_NETTL_X25 */
776 	{ "x25-nettl", "X.25 with nettl headers" },
777 
778 	/* WTAP_ENCAP_K12 */
779 	{ "k12", "K12 protocol analyzer" },
780 
781 	/* WTAP_ENCAP_JUNIPER_MLPPP */
782 	{ "juniper-mlppp", "Juniper MLPPP" },
783 
784 	/* WTAP_ENCAP_JUNIPER_MLFR */
785 	{ "juniper-mlfr", "Juniper MLFR" },
786 
787 	/* WTAP_ENCAP_JUNIPER_ETHER */
788 	{ "juniper-ether", "Juniper Ethernet" },
789 
790 	/* WTAP_ENCAP_JUNIPER_PPP */
791 	{ "juniper-ppp", "Juniper PPP" },
792 
793 	/* WTAP_ENCAP_JUNIPER_FRELAY */
794 	{ "juniper-frelay", "Juniper Frame-Relay" },
795 
796 	/* WTAP_ENCAP_JUNIPER_CHDLC */
797 	{ "juniper-chdlc", "Juniper C-HDLC" },
798 
799 	/* WTAP_ENCAP_JUNIPER_GGSN */
800 	{ "juniper-ggsn", "Juniper GGSN" },
801 
802 	/* WTAP_ENCAP_LINUX_LAPD */
803 	{ "linux-lapd", "LAPD with Linux pseudo-header" },
804 
805 	/* WTAP_ENCAP_CATAPULT_DCT2000 */
806 	{ "dct2000", "Catapult DCT2000" },
807 
808 	/* WTAP_ENCAP_BER */
809 	{ "ber", "ASN.1 Basic Encoding Rules" },
810 
811 	/* WTAP_ENCAP_JUNIPER_VP */
812 	{ "juniper-vp", "Juniper Voice PIC" },
813 
814 	/* WTAP_ENCAP_USB_FREEBSD */
815 	{ "usb-freebsd", "USB packets with FreeBSD header" },
816 
817 	/* WTAP_ENCAP_IEEE802_16_MAC_CPS */
818 	{ "ieee-802-16-mac-cps", "IEEE 802.16 MAC Common Part Sublayer" },
819 
820 	/* WTAP_ENCAP_NETTL_RAW_TELNET */
821 	{ "raw-telnet-nettl", "Raw telnet with nettl headers" },
822 
823 	/* WTAP_ENCAP_USB_LINUX */
824 	{ "usb-linux", "USB packets with Linux header" },
825 
826 	/* WTAP_ENCAP_MPEG */
827 	{ "mpeg", "MPEG" },
828 
829 	/* WTAP_ENCAP_PPI */
830 	{ "ppi", "Per-Packet Information header" },
831 
832 	/* WTAP_ENCAP_ERF */
833 	{ "erf", "Extensible Record Format" },
834 
835 	/* WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR */
836 	{ "bluetooth-h4-linux", "Bluetooth H4 with linux header" },
837 
838 	/* WTAP_ENCAP_SITA */
839 	{ "sita-wan", "SITA WAN packets" },
840 
841 	/* WTAP_ENCAP_SCCP */
842 	{ "sccp", "SS7 SCCP" },
843 
844 	/* WTAP_ENCAP_BLUETOOTH_HCI */
845 	{ "bluetooth-hci", "Bluetooth without transport layer" },
846 
847 	/* WTAP_ENCAP_IPMB_KONTRON */
848 	{ "ipmb-kontron", "Intelligent Platform Management Bus with Kontron pseudo-header" },
849 
850 	/* WTAP_ENCAP_IEEE802_15_4 */
851 	{ "wpan", "IEEE 802.15.4 Wireless PAN" },
852 
853 	/* WTAP_ENCAP_X2E_XORAYA */
854 	{ "x2e-xoraya", "X2E Xoraya" },
855 
856 	/* WTAP_ENCAP_FLEXRAY */
857 	{ "flexray", "FlexRay" },
858 
859 	/* WTAP_ENCAP_LIN */
860 	{ "lin", "Local Interconnect Network" },
861 
862 	/* WTAP_ENCAP_MOST */
863 	{ "most", "Media Oriented Systems Transport" },
864 
865 	/* WTAP_ENCAP_CAN20B */
866 	{ "can20b", "Controller Area Network 2.0B" },
867 
868 	/* WTAP_ENCAP_LAYER1_EVENT */
869 	{ "layer1-event", "EyeSDN Layer 1 event" },
870 
871 	/* WTAP_ENCAP_X2E_SERIAL */
872 	{ "x2e-serial", "X2E serial line capture" },
873 
874 	/* WTAP_ENCAP_I2C_LINUX */
875 	{ "i2c-linux", "I2C with Linux-specific pseudo-header" },
876 
877 	/* WTAP_ENCAP_IEEE802_15_4_NONASK_PHY */
878 	{ "wpan-nonask-phy", "IEEE 802.15.4 Wireless PAN non-ASK PHY" },
879 
880 	/* WTAP_ENCAP_TNEF */
881 	{ "tnef", "Transport-Neutral Encapsulation Format" },
882 
883 	/* WTAP_ENCAP_USB_LINUX_MMAPPED */
884 	{ "usb-linux-mmap", "USB packets with Linux header and padding" },
885 
886 	/* WTAP_ENCAP_GSM_UM */
887 	{ "gsm_um", "GSM Um Interface" },
888 
889 	/* WTAP_ENCAP_DPNSS */
890 	{ "dpnss_link", "Digital Private Signalling System No 1 Link Layer" },
891 
892 	/* WTAP_ENCAP_PACKETLOGGER */
893 	{ "packetlogger", "Apple Bluetooth PacketLogger" },
894 
895 	/* WTAP_ENCAP_NSTRACE_1_0 */
896 	{ "nstrace10", "NetScaler Encapsulation 1.0 of Ethernet" },
897 
898 	/* WTAP_ENCAP_NSTRACE_2_0 */
899 	{ "nstrace20", "NetScaler Encapsulation 2.0 of Ethernet" },
900 
901 	/* WTAP_ENCAP_FIBRE_CHANNEL_FC2 */
902 	{ "fc2", "Fibre Channel FC-2" },
903 
904 	/* WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS */
905 	{ "fc2sof", "Fibre Channel FC-2 With Frame Delimiter" },
906 
907 	/* WTAP_ENCAP_JPEG_JFIF */
908 	{ "jfif", "JPEG/JFIF" },
909 
910 	/* WTAP_ENCAP_IPNET */
911 	{ "ipnet", "Solaris IPNET" },
912 
913 	/* WTAP_ENCAP_SOCKETCAN */
914 	{ "socketcan", "SocketCAN" },
915 
916 	/* WTAP_ENCAP_IEEE_802_11_NETMON */
917 	{ "ieee-802-11-netmon", "IEEE 802.11 plus Network Monitor radio header" },
918 
919 	/* WTAP_ENCAP_IEEE802_15_4_NOFCS */
920 	{ "wpan-nofcs", "IEEE 802.15.4 Wireless PAN with FCS not present" },
921 
922 	/* WTAP_ENCAP_RAW_IPFIX */
923 	{ "ipfix", "RFC 5655/RFC 5101 IPFIX" },
924 
925 	/* WTAP_ENCAP_RAW_IP4 */
926 	{ "rawip4", "Raw IPv4" },
927 
928 	/* WTAP_ENCAP_RAW_IP6 */
929 	{ "rawip6", "Raw IPv6" },
930 
931 	/* WTAP_ENCAP_LAPD */
932 	{ "lapd", "LAPD" },
933 
934 	/* WTAP_ENCAP_DVBCI */
935 	{ "dvbci", "DVB-CI (Common Interface)" },
936 
937 	/* WTAP_ENCAP_MUX27010 */
938 	{ "mux27010", "MUX27010" },
939 
940 	/* WTAP_ENCAP_MIME */
941 	{ "mime", "MIME" },
942 
943 	/* WTAP_ENCAP_NETANALYZER */
944 	{ "netanalyzer", "Hilscher netANALYZER" },
945 
946 	/* WTAP_ENCAP_NETANALYZER_TRANSPARENT */
947 	{ "netanalyzer-transparent", "Hilscher netANALYZER-Transparent" },
948 
949 	/* WTAP_ENCAP_IP_OVER_IB */
950 	{ "ip-over-ib", "IP over InfiniBand" },
951 
952 	/* WTAP_ENCAP_MPEG_2_TS */
953 	{ "mp2ts", "ISO/IEC 13818-1 MPEG2-TS" },
954 
955 	/* WTAP_ENCAP_PPP_ETHER */
956 	{ "pppoes", "PPP-over-Ethernet session" },
957 
958 	/* WTAP_ENCAP_NFC_LLCP */
959 	{ "nfc-llcp", "NFC LLCP" },
960 
961 	/* WTAP_ENCAP_NFLOG */
962 	{ "nflog", "NFLOG" },
963 
964 	/* WTAP_ENCAP_V5_EF */
965 	{ "v5-ef", "V5 Envelope Function" },
966 
967 	/* WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR */
968 	{ "bacnet-ms-tp-with-direction", "BACnet MS/TP with Directional Info" },
969 
970 	/* WTAP_ENCAP_IXVERIWAVE */
971 	{ "ixveriwave", "IxVeriWave header and stats block" },
972 
973 	/* WTAP_ENCAP_SDH */
974 	{ "sdh", "SDH" },
975 
976 	/* WTAP_ENCAP_DBUS */
977 	{ "dbus", "D-Bus" },
978 
979 	/* WTAP_ENCAP_AX25_KISS */
980 	{ "ax25-kiss", "AX.25 with KISS header" },
981 
982 	/* WTAP_ENCAP_AX25 */
983 	{ "ax25", "Amateur Radio AX.25" },
984 
985 	/* WTAP_ENCAP_SCTP */
986 	{ "sctp", "SCTP" },
987 
988 	/* WTAP_ENCAP_INFINIBAND */
989 	{ "infiniband", "InfiniBand" },
990 
991 	/* WTAP_ENCAP_JUNIPER_SVCS */
992 	{ "juniper-svcs", "Juniper Services" },
993 
994 	/* WTAP_ENCAP_USBPCAP */
995 	{ "usb-usbpcap", "USB packets with USBPcap header" },
996 
997 	/* WTAP_ENCAP_RTAC_SERIAL */
998 	{ "rtac-serial", "RTAC serial-line" },
999 
1000 	/* WTAP_ENCAP_BLUETOOTH_LE_LL */
1001 	{ "bluetooth-le-ll", "Bluetooth Low Energy Link Layer" },
1002 
1003 	/* WTAP_ENCAP_WIRESHARK_UPPER_PDU */
1004 	{ "wireshark-upper-pdu", "Wireshark Upper PDU export" },
1005 
1006 	/* WTAP_ENCAP_STANAG_4607 */
1007 	{ "s4607", "STANAG 4607" },
1008 
1009 	/* WTAP_ENCAP_STANAG_5066_D_PDU */
1010 	{ "s5066-dpdu", "STANAG 5066 Data Transfer Sublayer PDUs(D_PDU)" },
1011 
1012 	/* WTAP_ENCAP_NETLINK */
1013 	{ "netlink", "Linux Netlink" },
1014 
1015 	/* WTAP_ENCAP_BLUETOOTH_LINUX_MONITOR */
1016 	{ "bluetooth-linux-monitor", "Bluetooth Linux Monitor" },
1017 
1018 	/* WTAP_ENCAP_BLUETOOTH_BREDR_BB */
1019 	{ "bluetooth-bredr-bb-rf", "Bluetooth BR/EDR Baseband RF" },
1020 
1021 	/* WTAP_ENCAP_BLUETOOTH_LE_LL_WITH_PHDR */
1022 	{ "bluetooth-le-ll-rf", "Bluetooth Low Energy Link Layer RF" },
1023 
1024 	/* WTAP_ENCAP_NSTRACE_3_0 */
1025 	{ "nstrace30", "NetScaler Encapsulation 3.0 of Ethernet" },
1026 
1027 	/* WTAP_ENCAP_LOGCAT */
1028 	{ "logcat", "Android Logcat Binary format" },
1029 
1030 	/* WTAP_ENCAP_LOGCAT_BRIEF */
1031 	{ "logcat_brief", "Android Logcat Brief text format" },
1032 
1033 	/* WTAP_ENCAP_LOGCAT_PROCESS */
1034 	{ "logcat_process", "Android Logcat Process text format" },
1035 
1036 	/* WTAP_ENCAP_LOGCAT_TAG */
1037 	{ "logcat_tag", "Android Logcat Tag text format" },
1038 
1039 	/* WTAP_ENCAP_LOGCAT_THREAD */
1040 	{ "logcat_thread", "Android Logcat Thread text format" },
1041 
1042 	/* WTAP_ENCAP_LOGCAT_TIME */
1043 	{ "logcat_time", "Android Logcat Time text format" },
1044 
1045 	/* WTAP_ENCAP_LOGCAT_THREADTIME */
1046 	{ "logcat_threadtime", "Android Logcat Threadtime text format" },
1047 
1048 	/* WTAP_ENCAP_LOGCAT_LONG */
1049 	{ "logcat_long", "Android Logcat Long text format" },
1050 
1051 	/* WTAP_ENCAP_PKTAP */
1052 	{ "pktap", "Apple PKTAP" },
1053 
1054 	/* WTAP_ENCAP_EPON */
1055 	{ "epon", "Ethernet Passive Optical Network" },
1056 
1057 	/* WTAP_ENCAP_IPMI_TRACE */
1058 	{ "ipmi-trace", "IPMI Trace Data Collection" },
1059 
1060 	/* WTAP_ENCAP_LOOP */
1061 	{ "loop", "OpenBSD loopback" },
1062 
1063 	/* WTAP_ENCAP_JSON */
1064 	{ "json", "JavaScript Object Notation" },
1065 
1066 	/* WTAP_ENCAP_NSTRACE_3_5 */
1067 	{ "nstrace35", "NetScaler Encapsulation 3.5 of Ethernet" },
1068 
1069 	/* WTAP_ENCAP_ISO14443 */
1070 	{ "iso14443", "ISO 14443 contactless smartcard standards" },
1071 
1072 	/* WTAP_ENCAP_GFP_T */
1073 	{ "gfp-t", "ITU-T G.7041/Y.1303 Generic Framing Procedure Transparent mode" },
1074 
1075 	/* WTAP_ENCAP_GFP_F */
1076 	{ "gfp-f", "ITU-T G.7041/Y.1303 Generic Framing Procedure Frame-mapped mode" },
1077 
1078 	/* WTAP_ENCAP_IP_OVER_IB_PCAP */
1079 	{ "ip-ib", "IP over IB" },
1080 
1081 	/* WTAP_ENCAP_JUNIPER_VN */
1082 	{ "juniper-vn", "Juniper VN" },
1083 
1084 	/* WTAP_ENCAP_USB_DARWIN */
1085 	{ "usb-darwin", "USB packets with Darwin (macOS, etc.) headers" },
1086 
1087 	/* WTAP_ENCAP_LORATAP */
1088 	{ "loratap", "LoRaTap" },
1089 
1090 	/* WTAP_ENCAP_3MB_ETHERNET */
1091 	{ "xeth", "Xerox 3MB Ethernet" },
1092 
1093 	/* WTAP_ENCAP_VSOCK */
1094 	{ "vsock", "Linux vsock" },
1095 
1096 	/* WTAP_ENCAP_NORDIC_BLE */
1097 	{ "nordic_ble", "nRF Sniffer for Bluetooth LE" },
1098 
1099 	/* WTAP_ENCAP_NETMON_NET_NETEVENT */
1100 	{ "netmon_event", "Network Monitor Network Event" },
1101 
1102 	/* WTAP_ENCAP_NETMON_HEADER */
1103 	{ "netmon_header", "Network Monitor Header" },
1104 
1105 	/* WTAP_ENCAP_NETMON_NET_FILTER */
1106 	{ "netmon_filter", "Network Monitor Filter" },
1107 
1108 	/* WTAP_ENCAP_NETMON_NETWORK_INFO_EX */
1109 	{ "netmon_network_info", "Network Monitor Network Info" },
1110 
1111 	/* WTAP_ENCAP_MA_WFP_CAPTURE_V4 */
1112 	{ "message_analyzer_wfp_capture_v4", "Message Analyzer WFP Capture v4" },
1113 
1114 	/* WTAP_ENCAP_MA_WFP_CAPTURE_V6 */
1115 	{ "message_analyzer_wfp_capture_v6", "Message Analyzer WFP Capture v6" },
1116 
1117 	/* WTAP_ENCAP_MA_WFP_CAPTURE_2V4 */
1118 	{ "message_analyzer_wfp_capture2_v4", "Message Analyzer WFP Capture2 v4" },
1119 
1120 	/* WTAP_ENCAP_MA_WFP_CAPTURE_2V6 */
1121 	{ "message_analyzer_wfp_capture2_v6", "Message Analyzer WFP Capture2 v6" },
1122 
1123 	/* WTAP_ENCAP_MA_WFP_CAPTURE_AUTH_V4 */
1124 	{ "message_analyzer_wfp_capture_auth_v4", "Message Analyzer WFP Capture Auth v4" },
1125 
1126 	/* WTAP_ENCAP_MA_WFP_CAPTURE_AUTH_V6 */
1127 	{ "message_analyzer_wfp_capture_auth_v6", "Message Analyzer WFP Capture Auth v6" },
1128 
1129 	/* WTAP_ENCAP_JUNIPER_ST */
1130 	{ "juniper-st", "Juniper Secure Tunnel Information" },
1131 
1132 	/* WTAP_ENCAP_ETHERNET_MPACKET */
1133 	{ "ether-mpacket", "IEEE 802.3br mPackets" },
1134 
1135 	/* WTAP_ENCAP_DOCSIS31_XRA31 */
1136 	{ "docsis31_xra31", "DOCSIS with Excentis XRA pseudo-header" },
1137 
1138 	/* WTAP_ENCAP_DPAUXMON */
1139 	{ "dpauxmon", "DisplayPort AUX channel with Unigraf pseudo-header" },
1140 
1141 	/* WTAP_ENCAP_RUBY_MARSHAL */
1142 	{ "ruby_marshal", "Ruby marshal object" },
1143 
1144 	/* WTAP_ENCAP_RFC7468 */
1145 	{ "rfc7468", "RFC 7468 file" },
1146 
1147 	/* WTAP_ENCAP_SYSTEMD_JOURNAL */
1148 	{ "sdjournal", "systemd journal" },
1149 
1150 	/* WTAP_ENCAP_EBHSCR */
1151 	{ "ebhscr", "Elektrobit High Speed Capture and Replay" },
1152 
1153 	/* WTAP_ENCAP_VPP */
1154 	{ "vpp", "Vector Packet Processing graph dispatch trace" },
1155 
1156 	/* WTAP_ENCAP_IEEE802_15_4_TAP */
1157 	{ "wpan-tap", "IEEE 802.15.4 Wireless with TAP pseudo-header" },
1158 
1159 	/* WTAP_ENCAP_LOG_3GPP */
1160 	{ "log_3GPP", "3GPP Phone Log" },
1161 
1162 	/* WTAP_ENCAP_USB_2_0 */
1163 	{ "usb-20", "USB 2.0/1.1/1.0 packets" },
1164 
1165 	/* WTAP_ENCAP_MP4 */
1166 	{ "mp4", "MP4 files" },
1167 
1168 	/* WTAP_ENCAP_SLL2 */
1169 	{ "linux-sll2", "Linux cooked-mode capture v2" },
1170 
1171 	/* WTAP_ENCAP_ZWAVE_SERIAL */
1172 	{ "zwave-serial", "Z-Wave Serial API packets" },
1173 
1174 	/* WTAP_ENCAP_ETW */
1175 	{ "etw", "Event Tracing for Windows messages" },
1176 
1177 	/* WTAP_ENCAP_ERI_ENB_LOG */
1178 	{ "eri_enb_log", "Ericsson eNode-B raw log" },
1179 
1180 };
1181 
1182 WS_DLL_LOCAL
1183 gint wtap_num_encap_types = sizeof(encap_table_base) / sizeof(struct encap_type_info);
1184 static GArray* encap_table_arr = NULL;
1185 
1186 #define encap_table_entry(encap)	\
1187 	g_array_index(encap_table_arr, struct encap_type_info, encap)
1188 
wtap_init_encap_types(void)1189 static void wtap_init_encap_types(void) {
1190 
1191 	if (encap_table_arr) return;
1192 
1193 	encap_table_arr = g_array_new(FALSE,TRUE,sizeof(struct encap_type_info));
1194 
1195 	g_array_append_vals(encap_table_arr,encap_table_base,wtap_num_encap_types);
1196 }
1197 
wtap_cleanup_encap_types(void)1198 static void wtap_cleanup_encap_types(void) {
1199 	if (encap_table_arr) {
1200 		g_array_free(encap_table_arr, TRUE);
1201 		encap_table_arr = NULL;
1202 	}
1203 }
1204 
wtap_get_num_encap_types(void)1205 int wtap_get_num_encap_types(void) {
1206 	return wtap_num_encap_types;
1207 }
1208 
1209 
1210 int
wtap_register_encap_type(const char * description,const char * name)1211 wtap_register_encap_type(const char *description, const char *name)
1212 {
1213 	struct encap_type_info e;
1214 
1215 	e.name = g_strdup(name);
1216 	e.description = g_strdup(description);
1217 
1218 	g_array_append_val(encap_table_arr,e);
1219 
1220 	return wtap_num_encap_types++;
1221 }
1222 
1223 /* Name to use in, say, a command-line flag specifying the type. */
1224 const char *
wtap_encap_name(int encap)1225 wtap_encap_name(int encap)
1226 {
1227 	if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
1228 		return "illegal";
1229 	else if (encap == WTAP_ENCAP_PER_PACKET)
1230 		return "per-packet";
1231 	else
1232 		return encap_table_entry(encap).name;
1233 }
1234 
1235 /* Description to show to users. */
1236 const char *
wtap_encap_description(int encap)1237 wtap_encap_description(int encap)
1238 {
1239 	if (encap < WTAP_ENCAP_PER_PACKET || encap >= WTAP_NUM_ENCAP_TYPES)
1240 		return "Illegal";
1241 	else if (encap == WTAP_ENCAP_PER_PACKET)
1242 		return "Per packet";
1243 	else
1244 		return encap_table_entry(encap).description;
1245 }
1246 
1247 /* Translate a name to a capture file type. */
1248 int
wtap_name_to_encap(const char * name)1249 wtap_name_to_encap(const char *name)
1250 {
1251 	int encap;
1252 
1253 	for (encap = 0; encap < WTAP_NUM_ENCAP_TYPES; encap++) {
1254 		if (encap_table_entry(encap).name != NULL &&
1255 		    strcmp(name, encap_table_entry(encap).name) == 0)
1256 			return encap;
1257 	}
1258 	return -1;	/* no such encapsulation type */
1259 }
1260 
1261 const char*
wtap_tsprec_string(int tsprec)1262 wtap_tsprec_string(int tsprec)
1263 {
1264 	const char* s;
1265 	switch (tsprec) {
1266 		case WTAP_TSPREC_PER_PACKET:
1267 			s = "per-packet";
1268 			break;
1269 		case WTAP_TSPREC_SEC:
1270 			s = "seconds";
1271 			break;
1272 		case WTAP_TSPREC_DSEC:
1273 			s = "deciseconds";
1274 			break;
1275 		case WTAP_TSPREC_CSEC:
1276 			s = "centiseconds";
1277 			break;
1278 		case WTAP_TSPREC_MSEC:
1279 			s = "milliseconds";
1280 			break;
1281 		case WTAP_TSPREC_USEC:
1282 			s = "microseconds";
1283 			break;
1284 		case WTAP_TSPREC_NSEC:
1285 			s = "nanoseconds";
1286 			break;
1287 		case WTAP_TSPREC_UNKNOWN:
1288 		default:
1289 			s = "UNKNOWN";
1290 			break;
1291 	}
1292 	return s;
1293 }
1294 
1295 static const char *wtap_errlist[] = {
1296 	/* WTAP_ERR_NOT_REGULAR_FILE */
1297 	"The file isn't a plain file or pipe",
1298 
1299 	/* WTAP_ERR_RANDOM_OPEN_PIPE */
1300 	"The file is being opened for random access but is a pipe",
1301 
1302 	/* WTAP_ERR_FILE_UNKNOWN_FORMAT */
1303 	"The file isn't a capture file in a known format",
1304 
1305 	/* WTAP_ERR_UNSUPPORTED */
1306 	"File contains record data we don't support",
1307 
1308 	/* WTAP_ERR_CANT_WRITE_TO_PIPE */
1309 	"That file format cannot be written to a pipe",
1310 
1311 	/* WTAP_ERR_CANT_OPEN */
1312 	NULL,
1313 
1314 	/* WTAP_ERR_UNWRITABLE_FILE_TYPE */
1315 	"Files can't be saved in that format",
1316 
1317 	/* WTAP_ERR_UNWRITABLE_ENCAP */
1318 	"Packets with that network type can't be saved in that format",
1319 
1320 	/* WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED */
1321 	"That file format doesn't support per-packet encapsulations",
1322 
1323 	/* WTAP_ERR_CANT_WRITE */
1324 	"A write failed for some unknown reason",
1325 
1326 	/* WTAP_ERR_CANT_CLOSE */
1327 	NULL,
1328 
1329 	/* WTAP_ERR_SHORT_READ */
1330 	"Less data was read than was expected",
1331 
1332 	/* WTAP_ERR_BAD_FILE */
1333 	"The file appears to be damaged or corrupt",
1334 
1335 	/* WTAP_ERR_SHORT_WRITE */
1336 	"Less data was written than was requested",
1337 
1338 	/* WTAP_ERR_UNC_OVERFLOW */
1339 	"Uncompression error: data would overflow buffer",
1340 
1341 	/* WTAP_ERR_RANDOM_OPEN_STDIN */
1342 	"The standard input cannot be opened for random access",
1343 
1344 	/* WTAP_ERR_COMPRESSION_NOT_SUPPORTED */
1345 	"That file format doesn't support compression",
1346 
1347 	/* WTAP_ERR_CANT_SEEK */
1348 	NULL,
1349 
1350 	/* WTAP_ERR_CANT_SEEK_COMPRESSED */
1351 	NULL,
1352 
1353 	/* WTAP_ERR_DECOMPRESS */
1354 	"Uncompression error",
1355 
1356 	/* WTAP_ERR_INTERNAL */
1357 	"Internal error",
1358 
1359 	/* WTAP_ERR_PACKET_TOO_LARGE */
1360 	"The packet being written is too large for that format",
1361 
1362 	/* WTAP_ERR_CHECK_WSLUA */
1363 	NULL,
1364 
1365 	/* WTAP_ERR_UNWRITABLE_REC_TYPE */
1366 	"That record type cannot be written in that format",
1367 
1368 	/* WTAP_ERR_UNWRITABLE_REC_DATA */
1369 	"That record can't be written in that format",
1370 
1371 	/* WTAP_ERR_DECOMPRESSION_NOT_SUPPORTED */
1372 	"We don't support decompressing that type of compressed file",
1373 };
1374 #define	WTAP_ERRLIST_SIZE	(sizeof wtap_errlist / sizeof wtap_errlist[0])
1375 
1376 const char *
wtap_strerror(int err)1377 wtap_strerror(int err)
1378 {
1379 	static char errbuf[128];
1380 	unsigned int wtap_errlist_index;
1381 
1382 	if (err < 0) {
1383 		wtap_errlist_index = -1 - err;
1384 		if (wtap_errlist_index >= WTAP_ERRLIST_SIZE) {
1385 			g_snprintf(errbuf, 128, "Error %d", err);
1386 			return errbuf;
1387 		}
1388 		if (wtap_errlist[wtap_errlist_index] == NULL)
1389 			return "Unknown reason";
1390 		return wtap_errlist[wtap_errlist_index];
1391 	} else
1392 		return g_strerror(err);
1393 }
1394 
1395 /* Close only the sequential side, freeing up memory it uses.
1396 
1397    Note that we do *not* want to call the subtype's close function,
1398    as it would free any per-subtype data, and that data may be
1399    needed by the random-access side.
1400 
1401    Instead, if the subtype has a "sequential close" function, we call it,
1402    to free up stuff used only by the sequential side. */
1403 void
wtap_sequential_close(wtap * wth)1404 wtap_sequential_close(wtap *wth)
1405 {
1406 	if (wth->subtype_sequential_close != NULL)
1407 		(*wth->subtype_sequential_close)(wth);
1408 
1409 	if (wth->fh != NULL) {
1410 		file_close(wth->fh);
1411 		wth->fh = NULL;
1412 	}
1413 }
1414 
1415 static void
g_fast_seek_item_free(gpointer data,gpointer user_data _U_)1416 g_fast_seek_item_free(gpointer data, gpointer user_data _U_)
1417 {
1418 	g_free(data);
1419 }
1420 
1421 /*
1422  * Close the file descriptors for the sequential and random streams, but
1423  * don't discard any information about those streams.  Used on Windows if
1424  * we need to rename a file that we have open or if we need to rename on
1425  * top of a file we have open.
1426  */
1427 void
wtap_fdclose(wtap * wth)1428 wtap_fdclose(wtap *wth)
1429 {
1430 	if (wth->fh != NULL)
1431 		file_fdclose(wth->fh);
1432 	if (wth->random_fh != NULL)
1433 		file_fdclose(wth->random_fh);
1434 }
1435 
1436 void
wtap_close(wtap * wth)1437 wtap_close(wtap *wth)
1438 {
1439 	wtap_sequential_close(wth);
1440 
1441 	if (wth->subtype_close != NULL)
1442 		(*wth->subtype_close)(wth);
1443 
1444 	if (wth->random_fh != NULL)
1445 		file_close(wth->random_fh);
1446 
1447 	g_free(wth->priv);
1448 
1449 	g_free(wth->pathname);
1450 
1451 	if (wth->fast_seek != NULL) {
1452 		g_ptr_array_foreach(wth->fast_seek, g_fast_seek_item_free, NULL);
1453 		g_ptr_array_free(wth->fast_seek, TRUE);
1454 	}
1455 
1456 	wtap_block_array_free(wth->shb_hdrs);
1457 	wtap_block_array_free(wth->nrb_hdrs);
1458 	wtap_block_array_free(wth->interface_data);
1459 	wtap_block_array_free(wth->dsbs);
1460 
1461 	g_free(wth);
1462 }
1463 
1464 void
wtap_cleareof(wtap * wth)1465 wtap_cleareof(wtap *wth) {
1466 	/* Reset EOF */
1467 	file_clearerr(wth->fh);
1468 }
1469 
wtap_set_cb_new_ipv4(wtap * wth,wtap_new_ipv4_callback_t add_new_ipv4)1470 void wtap_set_cb_new_ipv4(wtap *wth, wtap_new_ipv4_callback_t add_new_ipv4) {
1471 	if (wth)
1472 		wth->add_new_ipv4 = add_new_ipv4;
1473 }
1474 
wtap_set_cb_new_ipv6(wtap * wth,wtap_new_ipv6_callback_t add_new_ipv6)1475 void wtap_set_cb_new_ipv6(wtap *wth, wtap_new_ipv6_callback_t add_new_ipv6) {
1476 	if (wth)
1477 		wth->add_new_ipv6 = add_new_ipv6;
1478 }
1479 
wtap_set_cb_new_secrets(wtap * wth,wtap_new_secrets_callback_t add_new_secrets)1480 void wtap_set_cb_new_secrets(wtap *wth, wtap_new_secrets_callback_t add_new_secrets) {
1481 	/* Is a valid wth given that supports DSBs? */
1482 	if (!wth || !wth->dsbs)
1483 		return;
1484 
1485 	wth->add_new_secrets = add_new_secrets;
1486 	/*
1487 	 * Send all DSBs that were read so far to the new callback. file.c
1488 	 * relies on this to support redissection (during redissection, the
1489 	 * previous secrets are lost and has to be resupplied).
1490 	 */
1491 	for (guint i = 0; i < wth->dsbs->len; i++) {
1492 		wtap_block_t dsb = g_array_index(wth->dsbs, wtap_block_t, i);
1493 		wtapng_process_dsb(wth, dsb);
1494 	}
1495 }
1496 
1497 void
wtapng_process_dsb(wtap * wth,wtap_block_t dsb)1498 wtapng_process_dsb(wtap *wth, wtap_block_t dsb)
1499 {
1500 	const wtapng_dsb_mandatory_t *dsb_mand = (wtapng_dsb_mandatory_t*)wtap_block_get_mandatory_data(dsb);
1501 
1502 	if (wth->add_new_secrets)
1503 		wth->add_new_secrets(dsb_mand->secrets_type, dsb_mand->secrets_data, dsb_mand->secrets_len);
1504 }
1505 
1506 /* Perform per-packet initialization */
1507 static void
wtap_init_rec(wtap * wth,wtap_rec * rec)1508 wtap_init_rec(wtap *wth, wtap_rec *rec)
1509 {
1510 	/*
1511 	 * Set the packet encapsulation to the file's encapsulation
1512 	 * value; if that's not WTAP_ENCAP_PER_PACKET, it's the
1513 	 * right answer (and means that the read routine for this
1514 	 * capture file type doesn't have to set it), and if it
1515 	 * *is* WTAP_ENCAP_PER_PACKET, the caller needs to set it
1516 	 * anyway.
1517 	 *
1518 	 * Do the same for the packet time stamp resolution.
1519 	 */
1520 	rec->rec_header.packet_header.pkt_encap = wth->file_encap;
1521 	rec->tsprec = wth->file_tsprec;
1522 	rec->block = NULL;
1523 	rec->block_was_modified = FALSE;
1524 }
1525 
1526 gboolean
wtap_read(wtap * wth,wtap_rec * rec,Buffer * buf,int * err,gchar ** err_info,gint64 * offset)1527 wtap_read(wtap *wth, wtap_rec *rec, Buffer *buf, int *err,
1528 	gchar **err_info, gint64 *offset)
1529 {
1530 	/*
1531 	 * Initialize the record to default values.
1532 	 */
1533 	wtap_init_rec(wth, rec);
1534 
1535 	*err = 0;
1536 	*err_info = NULL;
1537 	if (!wth->subtype_read(wth, rec, buf, err, err_info, offset)) {
1538 		/*
1539 		 * If we didn't get an error indication, we read
1540 		 * the last packet.  See if there's any deferred
1541 		 * error, as might, for example, occur if we're
1542 		 * reading a compressed file, and we got an error
1543 		 * reading compressed data from the file, but
1544 		 * got enough compressed data to decompress the
1545 		 * last packet of the file.
1546 		 */
1547 		if (*err == 0)
1548 			*err = file_error(wth->fh, err_info);
1549 		if (rec->block != NULL) {
1550 			/*
1551 			 * Unreference any block created for this record.
1552 			 */
1553 			wtap_block_unref(rec->block);
1554 			rec->block = NULL;
1555 		}
1556 		return FALSE;	/* failure */
1557 	}
1558 
1559 	/*
1560 	 * Is this a packet record?
1561 	 */
1562 	if (rec->rec_type == REC_TYPE_PACKET) {
1563 		/*
1564 		 * It makes no sense for the captured data length
1565 		 * to be bigger than the actual data length.
1566 		 */
1567 		if (rec->rec_header.packet_header.caplen > rec->rec_header.packet_header.len)
1568 			rec->rec_header.packet_header.caplen = rec->rec_header.packet_header.len;
1569 
1570 		/*
1571 		 * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
1572 		 * probably means the file has that encapsulation type
1573 		 * but the read routine didn't set this packet's
1574 		 * encapsulation type.
1575 		 */
1576 		ws_assert(rec->rec_header.packet_header.pkt_encap != WTAP_ENCAP_PER_PACKET);
1577 	}
1578 
1579 	return TRUE;	/* success */
1580 }
1581 
1582 /*
1583  * Read a given number of bytes from a file into a buffer or, if
1584  * buf is NULL, just discard them.
1585  *
1586  * If we succeed, return TRUE.
1587  *
1588  * If we get an EOF, return FALSE with *err set to 0, reporting this
1589  * as an EOF.
1590  *
1591  * If we get fewer bytes than the specified number, return FALSE with
1592  * *err set to WTAP_ERR_SHORT_READ, reporting this as a short read
1593  * error.
1594  *
1595  * If we get a read error, return FALSE with *err and *err_info set
1596  * appropriately.
1597  */
1598 gboolean
wtap_read_bytes_or_eof(FILE_T fh,void * buf,unsigned int count,int * err,gchar ** err_info)1599 wtap_read_bytes_or_eof(FILE_T fh, void *buf, unsigned int count, int *err,
1600     gchar **err_info)
1601 {
1602 	int	bytes_read;
1603 
1604 	bytes_read = file_read(buf, count, fh);
1605 	if (bytes_read < 0 || (guint)bytes_read != count) {
1606 		*err = file_error(fh, err_info);
1607 		if (*err == 0 && bytes_read > 0)
1608 			*err = WTAP_ERR_SHORT_READ;
1609 		return FALSE;
1610 	}
1611 	return TRUE;
1612 }
1613 
1614 /*
1615  * Read a given number of bytes from a file into a buffer or, if
1616  * buf is NULL, just discard them.
1617  *
1618  * If we succeed, return TRUE.
1619  *
1620  * If we get fewer bytes than the specified number, including getting
1621  * an EOF, return FALSE with *err set to WTAP_ERR_SHORT_READ, reporting
1622  * this as a short read error.
1623  *
1624  * If we get a read error, return FALSE with *err and *err_info set
1625  * appropriately.
1626  */
1627 gboolean
wtap_read_bytes(FILE_T fh,void * buf,unsigned int count,int * err,gchar ** err_info)1628 wtap_read_bytes(FILE_T fh, void *buf, unsigned int count, int *err,
1629     gchar **err_info)
1630 {
1631 	int	bytes_read;
1632 
1633 	bytes_read = file_read(buf, count, fh);
1634 	if (bytes_read < 0 || (guint)bytes_read != count) {
1635 		*err = file_error(fh, err_info);
1636 		if (*err == 0)
1637 			*err = WTAP_ERR_SHORT_READ;
1638 		return FALSE;
1639 	}
1640 	return TRUE;
1641 }
1642 
1643 /*
1644  * Read packet data into a Buffer, growing the buffer as necessary.
1645  *
1646  * This returns an error on a short read, even if the short read hit
1647  * the EOF immediately.  (The assumption is that each packet has a
1648  * header followed by raw packet data, and that we've already read the
1649  * header, so if we get an EOF trying to read the packet data, the file
1650  * has been cut short, even if the read didn't read any data at all.)
1651  */
1652 gboolean
wtap_read_packet_bytes(FILE_T fh,Buffer * buf,guint length,int * err,gchar ** err_info)1653 wtap_read_packet_bytes(FILE_T fh, Buffer *buf, guint length, int *err,
1654     gchar **err_info)
1655 {
1656 	ws_buffer_assure_space(buf, length);
1657 	return wtap_read_bytes(fh, ws_buffer_start_ptr(buf), length, err,
1658 	    err_info);
1659 }
1660 
1661 /*
1662  * Return an approximation of the amount of data we've read sequentially
1663  * from the file so far.  (gint64, in case that's 64 bits.)
1664  */
1665 gint64
wtap_read_so_far(wtap * wth)1666 wtap_read_so_far(wtap *wth)
1667 {
1668 	return file_tell_raw(wth->fh);
1669 }
1670 
1671 /* Perform global/initial initialization */
1672 void
wtap_rec_init(wtap_rec * rec)1673 wtap_rec_init(wtap_rec *rec)
1674 {
1675 	memset(rec, 0, sizeof *rec);
1676 	ws_buffer_init(&rec->options_buf, 0);
1677 	/* In the future, see if we can create rec->block here once
1678 	 * and have it be reused like the rest of rec.
1679 	 * Currently it's recreated for each packet.
1680 	 */
1681 }
1682 
1683 /* re-initialize record */
1684 void
wtap_rec_reset(wtap_rec * rec)1685 wtap_rec_reset(wtap_rec *rec)
1686 {
1687 	wtap_block_unref(rec->block);
1688 	rec->block = NULL;
1689 	rec->block_was_modified = FALSE;
1690 }
1691 
1692 /* clean up record metadata */
1693 void
wtap_rec_cleanup(wtap_rec * rec)1694 wtap_rec_cleanup(wtap_rec *rec)
1695 {
1696 	wtap_rec_reset(rec);
1697 	ws_buffer_free(&rec->options_buf);
1698 }
1699 
1700 gboolean
wtap_seek_read(wtap * wth,gint64 seek_off,wtap_rec * rec,Buffer * buf,int * err,gchar ** err_info)1701 wtap_seek_read(wtap *wth, gint64 seek_off, wtap_rec *rec, Buffer *buf,
1702     int *err, gchar **err_info)
1703 {
1704 	/*
1705 	 * Initialize the record to default values.
1706 	 */
1707 	wtap_init_rec(wth, rec);
1708 
1709 	*err = 0;
1710 	*err_info = NULL;
1711 	if (!wth->subtype_seek_read(wth, seek_off, rec, buf, err, err_info)) {
1712 		if (rec->block != NULL) {
1713 			/*
1714 			 * Unreference any block created for this record.
1715 			 */
1716 			wtap_block_unref(rec->block);
1717 			rec->block = NULL;
1718 		}
1719 		return FALSE;
1720 	}
1721 
1722 	/*
1723 	 * Is this a packet record?
1724 	 */
1725 	if (rec->rec_type == REC_TYPE_PACKET) {
1726 		/*
1727 		 * It makes no sense for the captured data length
1728 		 * to be bigger than the actual data length.
1729 		 */
1730 		if (rec->rec_header.packet_header.caplen > rec->rec_header.packet_header.len)
1731 			rec->rec_header.packet_header.caplen = rec->rec_header.packet_header.len;
1732 
1733 		/*
1734 		 * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
1735 		 * probably means the file has that encapsulation type
1736 		 * but the read routine didn't set this packet's
1737 		 * encapsulation type.
1738 		 */
1739 		ws_assert(rec->rec_header.packet_header.pkt_encap != WTAP_ENCAP_PER_PACKET);
1740 	}
1741 
1742 	return TRUE;
1743 }
1744 
1745 static gboolean
wtap_full_file_read_file(wtap * wth,FILE_T fh,wtap_rec * rec,Buffer * buf,int * err,gchar ** err_info)1746 wtap_full_file_read_file(wtap *wth, FILE_T fh, wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
1747 {
1748 	gint64 file_size;
1749 	int packet_size = 0;
1750 	const int block_size = 1024 * 1024;
1751 
1752 	if ((file_size = wtap_file_size(wth, err)) == -1)
1753 		return FALSE;
1754 
1755 	if (file_size > G_MAXINT) {
1756 		/*
1757 		 * Avoid allocating space for an immensely-large file.
1758 		 */
1759 		*err = WTAP_ERR_BAD_FILE;
1760 		*err_info = g_strdup_printf("%s: File has %" G_GINT64_MODIFIER "d-byte packet, bigger than maximum of %u",
1761 				wtap_encap_name(wth->file_encap), file_size, G_MAXINT);
1762 		return FALSE;
1763 	}
1764 
1765 	/*
1766 	 * Compressed files might expand to a larger size than the actual file
1767 	 * size. Try to read the full size and then read in smaller increments
1768 	 * to avoid frequent memory reallocations.
1769 	 */
1770 	int buffer_size = block_size * (1 + (int)file_size / block_size);
1771 	for (;;) {
1772 		if (buffer_size <= 0) {
1773 			*err = WTAP_ERR_BAD_FILE;
1774 			*err_info = g_strdup_printf("%s: Uncompressed file is bigger than maximum of %u",
1775 					wtap_encap_name(wth->file_encap), G_MAXINT);
1776 			return FALSE;
1777 		}
1778 		ws_buffer_assure_space(buf, buffer_size);
1779 		int nread = file_read(ws_buffer_start_ptr(buf) + packet_size, buffer_size - packet_size, fh);
1780 		if (nread < 0) {
1781 			*err = file_error(fh, err_info);
1782 			if (*err == 0)
1783 				*err = WTAP_ERR_BAD_FILE;
1784 			return FALSE;
1785 		}
1786 		packet_size += nread;
1787 		if (packet_size != buffer_size) {
1788 			/* EOF */
1789 			break;
1790 		}
1791 		buffer_size += block_size;
1792 	}
1793 
1794 	rec->rec_type = REC_TYPE_PACKET;
1795 	rec->presence_flags = 0; /* yes, we have no bananas^Wtime stamp */
1796 	rec->ts.secs = 0;
1797 	rec->ts.nsecs = 0;
1798 	rec->rec_header.packet_header.caplen = packet_size;
1799 	rec->rec_header.packet_header.len = packet_size;
1800 
1801 	return TRUE;
1802 }
1803 
1804 gboolean
wtap_full_file_read(wtap * wth,wtap_rec * rec,Buffer * buf,int * err,gchar ** err_info,gint64 * data_offset)1805 wtap_full_file_read(wtap *wth, wtap_rec *rec, Buffer *buf,
1806                     int *err, gchar **err_info, gint64 *data_offset)
1807 {
1808 	gint64 offset = file_tell(wth->fh);
1809 
1810 	/* There is only one packet with the full file contents. */
1811 	if (offset != 0) {
1812 		*err = 0;
1813 		return FALSE;
1814 	}
1815 
1816 	*data_offset = offset;
1817 	return wtap_full_file_read_file(wth, wth->fh, rec, buf, err, err_info);
1818 }
1819 
1820 gboolean
wtap_full_file_seek_read(wtap * wth,gint64 seek_off,wtap_rec * rec,Buffer * buf,int * err,gchar ** err_info)1821 wtap_full_file_seek_read(wtap *wth, gint64 seek_off, wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
1822 {
1823 	/* There is only one packet with the full file contents. */
1824 	if (seek_off > 0) {
1825 		*err = 0;
1826 		return FALSE;
1827 	}
1828 
1829 	if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
1830 		return FALSE;
1831 
1832 	return wtap_full_file_read_file(wth, wth->random_fh, rec, buf, err, err_info);
1833 }
1834 
1835 /*
1836  * Initialize the library.
1837  */
1838 void
wtap_init(gboolean load_wiretap_plugins)1839 wtap_init(gboolean load_wiretap_plugins)
1840 {
1841 	init_open_routines();
1842 	wtap_opttypes_initialize();
1843 	wtap_init_encap_types();
1844 	wtap_init_file_type_subtypes();
1845 	if (load_wiretap_plugins) {
1846 #ifdef HAVE_PLUGINS
1847 		libwiretap_plugins = plugins_init(WS_PLUGIN_WIRETAP);
1848 #endif
1849 		g_slist_foreach(wtap_plugins, call_plugin_register_wtap_module, NULL);
1850 	}
1851 }
1852 
1853 /*
1854  * Cleanup the library
1855  */
1856 void
wtap_cleanup(void)1857 wtap_cleanup(void)
1858 {
1859 	wtap_cleanup_encap_types();
1860 	wtap_opttypes_cleanup();
1861 	ws_buffer_cleanup();
1862 	cleanup_open_routines();
1863 	g_slist_free(wtap_plugins);
1864 	wtap_plugins = NULL;
1865 #ifdef HAVE_PLUGINS
1866 	plugins_cleanup(libwiretap_plugins);
1867 	libwiretap_plugins = NULL;
1868 #endif
1869 }
1870 
1871 /*
1872  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
1873  *
1874  * Local variables:
1875  * c-basic-offset: 8
1876  * tab-width: 8
1877  * indent-tabs-mode: t
1878  * End:
1879  *
1880  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
1881  * :indentSize=8:tabSize=8:noTabs=false:
1882  */
1883