5 * Copyright (c) 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version 2
10 * of the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 #include "file_wrappers.h"
36 Daniel Thompson (STMicroelectronics) <daniel.thompson@st.com>
40 +------+------+------+------+
41 | t3 | t2 | t1 | t0 | t = time_t
42 +------+------+------+------+
45 | 0x06 | Time step (short)
47 | ts | ts = time step (tenths of seconds)
51 | 0x05 | Time step (long)
52 +------+------+------+------+
53 | ts3 | ts2 | ts1 | ts0 | ts = time step (tenths of seconds)
54 +------+------+------+------+
57 | 0x04 | Receive deliminator (not seen in practice)
61 | 0x03 | Send deliminator (not seen in practice)
65 | 0x02 | Received data
67 | n1 | n0 | n = number of bytes following
75 | n1 | n0 | n = number of bytes following
81 #define PPPD_SENT_DATA 0x01
82 #define PPPD_RECV_DATA 0x02
83 #define PPPD_SEND_DELIM 0x03
84 #define PPPD_RECV_DELIM 0x04
85 #define PPPD_TIME_STEP_LONG 0x05
86 #define PPPD_TIME_STEP_SHORT 0x06
87 #define PPPD_RESET_TIME 0x07
89 /* this buffer must be at least (2*PPPD_MTU) + sizeof(ppp_header) +
90 * sizeof(lcp_header) + sizeof(ipcp_header). PPPD_MTU is *very* rarely
91 * larger than 1500 so this value is fine.
93 #define PPPD_BUF_SIZE 8192
100 static gboolean pppdump_read(wtap *wth, int *err, gchar **err_info,
101 gint64 *data_offset);
102 static gboolean pppdump_seek_read(wtap *wth, gint64 seek_off,
103 struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
106 * Information saved about a packet, during the initial sequential pass
107 * through the file, to allow us to later re-read it when randomly
110 * "offset" is the offset in the file of the first data chunk containing data
111 * from that packet; note that it may also contain data from previous
114 * "num_bytes_to_skip" is the number of bytes from previous packets in that
117 * "dir" is the direction of the packet.
121 gint64 num_bytes_to_skip;
126 * Information about a packet currently being processed. There is one of
127 * these for the sent packet being processed and one of these for the
128 * received packet being processed, as we could be in the middle of
129 * processing both a received packet and a sent packet.
131 * "dir" is the direction of the packet.
133 * "cnt" is the number of bytes of packet data we've accumulated.
135 * "esc" is TRUE if the next byte we see is escaped (and thus must be XORed
136 * with 0x20 before saving it), FALSE otherwise.
138 * "buf" is a buffer containing the packet data we've accumulated.
140 * "id_offset" is the offset in the file of the first data chunk
141 * containing data from the packet we're processing.
143 * "sd_offset" is the offset in the file of the first data byte from
144 * the packet we're processing - which isn't necessarily right after
145 * the header of the first data chunk, as we may already have assembled
146 * packets from that chunk.
148 * "cd_offset" is the offset in the file of the current data chunk we're
155 guint8 buf[PPPD_BUF_SIZE];
162 * This keeps state used while processing records.
164 * "timestamp" is the seconds portion of the current time stamp value,
165 * as updated from PPPD_RESET_TIME, PPPD_TIME_STEP_LONG, and
166 * PPPD_TIME_STEP_SHORT records. "tenths" is the tenths-of-seconds
169 * "spkt" and "rpkt" are "pkt_t" structures for the sent and received
170 * packets we're currently working on.
172 * "offset" is the current offset in the file.
174 * "num_bytes" and "pkt" are information saved when we finish accumulating
175 * the data for a packet, if the data chunk we're working on still has more
178 * "num_bytes" is the number of bytes of additional data remaining
179 * in the chunk after we've finished accumulating the data for the
182 * "pkt" is the "pkt_t" for the type of packet the data chunk is for
183 * (sent or received packet).
185 * "seek_state" is another state structure used while processing records
186 * when doing a seek-and-read. (That structure doesn't itself have a
187 * "seek_state" structure.)
189 * "pids" is a GPtrArray of pointers to "pkt_id" structures for all the
190 * packets we've seen during the initial sequential pass, to allow us to
191 * later retrieve them with random accesses.
193 * "pkt_cnt" is the number of packets we've seen up to this point in the
196 typedef struct _pppdump_t {
204 struct _pppdump_t *seek_state;
210 process_data(pppdump_t *state, FILE_T fh, pkt_t *pkt, int n, guint8 *pd,
211 int *err, gchar **err_info, pkt_id *pid);
214 collate(pppdump_t*, FILE_T fh, int *err, gchar **err_info, guint8 *pd,
215 int *num_bytes, direction_enum *direction, pkt_id *pid,
216 gint64 num_bytes_to_skip);
219 pppdump_close(wtap *wth);
222 init_state(pppdump_t *state)
225 state->num_bytes = 0;
228 state->spkt.dir = DIRECTION_SENT;
230 state->spkt.esc = FALSE;
231 state->spkt.id_offset = 0;
232 state->spkt.sd_offset = 0;
233 state->spkt.cd_offset = 0;
235 state->rpkt.dir = DIRECTION_RECV;
237 state->rpkt.esc = FALSE;
238 state->rpkt.id_offset = 0;
239 state->rpkt.sd_offset = 0;
240 state->rpkt.cd_offset = 0;
242 state->seek_state = NULL;
243 state->offset = 0x100000; /* to detect errors during development */
248 pppdump_open(wtap *wth, int *err, gchar **err_info)
250 guint8 buffer[6]; /* Looking for: 0x07 t3 t2 t1 t0 ID */
254 /* There is no file header, only packet records. Fortunately for us,
255 * timestamp records are separated from packet records, so we should
256 * find an "initial time stamp" (i.e., a "reset time" record, or
257 * record type 0x07) at the beginning of the file. We'll check for
258 * that, plus a valid record following the 0x07 and the four bytes
259 * representing the timestamp.
262 bytes_read = file_read(buffer, sizeof(buffer), wth->fh);
263 if (bytes_read != (int) sizeof(buffer)) {
264 *err = file_error(wth->fh, err_info);
265 if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
270 if (buffer[0] == PPPD_RESET_TIME &&
271 (buffer[5] == PPPD_SENT_DATA ||
272 buffer[5] == PPPD_RECV_DATA ||
273 buffer[5] == PPPD_TIME_STEP_LONG ||
274 buffer[5] == PPPD_TIME_STEP_SHORT ||
275 buffer[5] == PPPD_RESET_TIME)) {
285 if (file_seek(wth->fh, 5, SEEK_SET, err) == -1)
288 state = (pppdump_t *)g_malloc(sizeof(pppdump_t));
289 wth->priv = (void *)state;
290 state->timestamp = pntoh32(&buffer[1]);
296 wth->file_encap = WTAP_ENCAP_PPP_WITH_PHDR;
297 wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_PPPDUMP;
299 wth->snapshot_length = PPPD_BUF_SIZE; /* just guessing */
300 wth->subtype_read = pppdump_read;
301 wth->subtype_seek_read = pppdump_seek_read;
302 wth->subtype_close = pppdump_close;
303 wth->tsprecision = WTAP_FILE_TSPREC_DSEC;
305 state->seek_state = g_new(pppdump_t,1);
307 /* If we have a random stream open, we're going to be reading
308 the file randomly; set up a GPtrArray of pointers to
309 information about how to retrieve the data for each packet. */
310 if (wth->random_fh != NULL)
311 state->pids = g_ptr_array_new();
319 /* Set part of the struct wtap_pkthdr. */
321 pppdump_set_phdr(struct wtap_pkthdr *phdr, int num_bytes,
322 direction_enum direction)
324 phdr->len = num_bytes;
325 phdr->caplen = num_bytes;
326 phdr->pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
328 phdr->pseudo_header.p2p.sent = (direction == DIRECTION_SENT ? TRUE : FALSE);
331 /* Find the next packet and parse it; called from wtap_read(). */
333 pppdump_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
336 direction_enum direction;
341 state = (pppdump_t *)wth->priv;
343 /* If we have a random stream open, allocate a structure to hold
344 the information needed to read this packet's data again. */
345 if (wth->random_fh != NULL) {
346 pid = g_new(pkt_id, 1);
348 *err = errno; /* assume a malloc failed and set "errno" */
353 pid = NULL; /* sequential only */
355 buffer_assure_space(wth->frame_buffer, PPPD_BUF_SIZE);
356 buf = buffer_start_ptr(wth->frame_buffer);
358 if (!collate(state, wth->fh, err, err_info, buf, &num_bytes, &direction,
366 pid->dir = direction;
369 g_ptr_array_add(state->pids, pid);
370 /* The user's data_offset is not really an offset, but a packet number. */
371 *data_offset = state->pkt_cnt;
374 wth->phdr.presence_flags = WTAP_HAS_TS;
375 wth->phdr.ts.secs = state->timestamp;
376 wth->phdr.ts.nsecs = state->tenths * 100000000;
377 pppdump_set_phdr(&wth->phdr, num_bytes, direction);
382 /* Returns number of bytes copied for record, -1 if failure.
384 * This is modeled after pppdump.c, the utility to parse pppd log files; it
385 * comes with the ppp distribution.
388 process_data(pppdump_t *state, FILE_T fh, pkt_t *pkt, int n, guint8 *pd,
389 int *err, gchar **err_info, pkt_id *pid)
395 for (; num_bytes > 0; --num_bytes) {
398 *err = file_error(fh, err_info);
400 *err = WTAP_ERR_SHORT_READ;
408 * Flag Sequence for RFC 1662 HDLC-like
411 * As this is a raw trace of octets going
412 * over the wire, and that might include
413 * the login sequence, there is no
414 * guarantee that *only* PPP traffic
415 * appears in this file, so there is no
416 * guarantee that the first 0x7e we see is
417 * a start flag sequence, and therefore we
418 * cannot safely ignore all characters up
419 * to the first 0x7e, and therefore we
420 * might end up with some bogus PPP
425 * We've seen stuff before this,
426 * so this is the end of a frame.
427 * Make a frame out of that stuff.
431 num_written = pkt->cnt;
433 if (num_written <= 0) {
437 if (num_written > PPPD_BUF_SIZE) {
438 *err = WTAP_ERR_UNC_OVERFLOW;
442 memcpy(pd, pkt->buf, num_written);
445 * Remember the offset of the
446 * first record containing data
447 * for this packet, and how far
448 * into that record to skip to
449 * get to the beginning of the
450 * data for this packet; the number
451 * of bytes to skip into that record
452 * is the file offset of the first
453 * byte of this packet minus the
454 * file offset of the first byte of
455 * this record, minus 3 bytes for the
456 * header of this record (which, if
457 * we re-read this record, we will
458 * process, not skip).
461 pid->offset = pkt->id_offset;
462 pid->num_bytes_to_skip =
463 pkt->sd_offset - pkt->id_offset - 3;
464 g_assert(pid->num_bytes_to_skip >= 0);
470 * There's more data in this
472 * Set the initial data offset
473 * for the next packet.
475 pkt->id_offset = pkt->cd_offset;
476 pkt->sd_offset = state->offset;
479 * There is no more data in
481 * Thus, we don't have the
482 * initial data offset for
488 state->num_bytes = num_bytes;
496 * Control Escape octet for octet-stuffed
497 * RFC 1662 HDLC-like framing.
501 * Control Escape not preceded by
502 * Control Escape; discard it
503 * but XOR the next octet with
510 * Control Escape preceded by Control Escape;
511 * treat it as an ordinary character,
512 * by falling through.
518 * This character was preceded by
519 * Control Escape, so XOR it with
520 * 0x20, as per RFC 1662's octet-
521 * stuffed framing, and clear
522 * the flag saying that the
523 * character should be escaped.
529 if (pkt->cnt >= PPPD_BUF_SIZE) {
530 *err = WTAP_ERR_UNC_OVERFLOW;
533 pkt->buf[pkt->cnt++] = c;
538 /* we could have run out of bytes to read */
542 /* Returns TRUE if packet data copied, FALSE if error occurred or EOF (no more records). */
544 collate(pppdump_t* state, FILE_T fh, int *err, gchar **err_info, guint8 *pd,
545 int *num_bytes, direction_enum *direction, pkt_id *pid,
546 gint64 num_bytes_to_skip)
551 int n, num_written = 0;
557 * Process any data left over in the current record when doing
558 * sequential processing.
560 if (state->num_bytes > 0) {
561 g_assert(num_bytes_to_skip == 0);
563 num_written = process_data(state, fh, pkt, state->num_bytes,
564 pd, err, err_info, pid);
566 if (num_written < 0) {
569 else if (num_written > 0) {
570 *num_bytes = num_written;
571 *direction = pkt->dir;
574 /* if 0 bytes written, keep processing */
577 * We didn't have any data left over, so the packet will
578 * start at the beginning of a record.
581 pid->num_bytes_to_skip = 0;
585 * That didn't get all the data for this packet, so process
586 * subsequent records.
588 start_offset = state->offset;
589 while ((id = file_getc(fh)) != EOF) {
594 pkt = id == PPPD_SENT_DATA ? &state->spkt : &state->rpkt;
597 * Save the offset of the beginning of
598 * the current record.
600 pkt->cd_offset = state->offset - 1;
603 * Get the length of the record.
605 byte0 = file_getc(fh);
609 byte1 = file_getc(fh);
613 n = (byte0 << 8) | byte1;
615 if (pkt->id_offset == 0) {
617 * We don't have the initial data
618 * offset for this packet, which
619 * means this is the first
620 * data record for that packet.
621 * Save the offset of the
622 * beginning of that record and
623 * the offset of the first data
624 * byte in the packet, which is
625 * the first data byte in the
628 pkt->id_offset = pkt->cd_offset;
629 pkt->sd_offset = state->offset;
635 g_assert(num_bytes_to_skip < n);
636 while (num_bytes_to_skip) {
637 if (file_getc(fh) == EOF)
643 num_written = process_data(state, fh, pkt, n,
644 pd, err, err_info, pid);
646 if (num_written < 0) {
649 else if (num_written > 0) {
650 *num_bytes = num_written;
651 *direction = pkt->dir;
654 /* if 0 bytes written, keep looping */
657 case PPPD_SEND_DELIM:
658 case PPPD_RECV_DELIM:
659 /* What can we do? */
662 case PPPD_RESET_TIME:
663 wtap_file_read_unknown_bytes(&time_long, sizeof(guint32), fh, err, err_info);
664 state->offset += sizeof(guint32);
665 state->timestamp = pntoh32(&time_long);
669 case PPPD_TIME_STEP_LONG:
670 wtap_file_read_unknown_bytes(&time_long, sizeof(guint32), fh, err, err_info);
671 state->offset += sizeof(guint32);
672 state->tenths += pntoh32(&time_long);
674 if (state->tenths >= 10) {
675 state->timestamp += state->tenths / 10;
676 state->tenths = state->tenths % 10;
681 case PPPD_TIME_STEP_SHORT:
682 wtap_file_read_unknown_bytes(&time_short, sizeof(guint8), fh, err, err_info);
683 state->offset += sizeof(guint8);
684 state->tenths += time_short;
686 if (state->tenths >= 10) {
687 state->timestamp += state->tenths / 10;
688 state->tenths = state->tenths % 10;
695 *err = WTAP_ERR_BAD_FILE;
696 *err_info = g_strdup_printf("pppdump: bad ID byte 0x%02x", id);
703 *err = file_error(fh, err_info);
705 if (state->offset != start_offset) {
707 * We read at least one byte, so we were working
708 * on a record; an EOF means that record was
711 *err = WTAP_ERR_SHORT_READ;
719 /* Used to read packets in random-access fashion */
721 pppdump_seek_read(wtap *wth,
723 struct wtap_pkthdr *phdr,
730 direction_enum direction;
733 gint64 num_bytes_to_skip;
735 state = (pppdump_t *)wth->priv;
737 pid = (pkt_id *)g_ptr_array_index(state->pids, seek_off);
739 *err = WTAP_ERR_BAD_FILE; /* XXX - better error? */
740 *err_info = g_strdup("pppdump: PID not found for record");
744 if (file_seek(wth->random_fh, pid->offset, SEEK_SET, err) == -1)
747 init_state(state->seek_state);
748 state->seek_state->offset = pid->offset;
750 buffer_assure_space(buf, PPPD_BUF_SIZE);
751 pd = buffer_start_ptr(buf);
754 * We'll start reading at the first record containing data from
755 * this packet; however, that doesn't mean "collate()" will
756 * stop only when we've read that packet, as there might be
757 * data for packets going in the other direction as well, and
758 * we might finish processing one of those packets before we
759 * finish processing the packet we're reading.
761 * Therefore, we keep reading until we get a packet that's
762 * going in the direction we want.
764 num_bytes_to_skip = pid->num_bytes_to_skip;
766 if (!collate(state->seek_state, wth->random_fh, err, err_info,
767 pd, &num_bytes, &direction, NULL, num_bytes_to_skip))
769 num_bytes_to_skip = 0;
770 } while (direction != pid->dir);
772 pppdump_set_phdr(phdr, num_bytes, pid->dir);
778 pppdump_close(wtap *wth)
782 state = (pppdump_t *)wth->priv;
784 if (state->seek_state) { /* should always be TRUE */
785 g_free(state->seek_state);
790 for (i = 0; i < g_ptr_array_len(state->pids); i++) {
791 g_free(g_ptr_array_index(state->pids, i));
793 g_ptr_array_free(state->pids, TRUE);