dumpcap: enable capture of pcapng from pipe

Reads pcapng blocks from a pipe.  Section header blocks are parsed for
endianess.  All other blocks only have the general block header parsed
for type and length, and then endianess converted if necessary.
Outputs all blocks using the original endianess format so none of the
other block types or options require parsing.

Change-Id: I2f4f0175013d8fc2cda42a63e7deacad537951e3
Bug: 11370
Reviewed-on: https://code.wireshark.org/review/24536
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

2 files changed, 36 insertions, 0 deletions

diff --git a/writecap/pcapio.c b/writecap/pcapio.c
index abc0af929a..328b63f3c5 100644
--- a/writecap/pcapio.c
+++ b/writecap/pcapio.c
@@ -284,6 +284,34 @@ pcapng_write_string_option(FILE* pfile,
         return TRUE;
 }
 
+/* Write a pre-formatted pcapng block directly to the output file */
+gboolean
+pcapng_write_block(FILE* pfile,
+                   const guint8 *data,
+                   guint32 length,
+                   guint64 *bytes_written,
+                   int *err)
+{
+    guint32 block_length, end_lenth;
+    /* Check
+     * - length and data are aligned to 4 bytes
+     * - block_total_length field is the same at the start and end of the block
+     *
+     * The block_total_length is not checked against the provided length but
+     * getting the trailing block_total_length from the length argument gives
+     * us an implicit check of correctness without needing to do an endian swap
+     */
+    if (((length & 3) != 0) || (((gintptr)data & 3) != 0)) {
+        return FALSE;
+    }
+    memcpy(&block_length, data+sizeof(guint32), sizeof(guint32));
+    memcpy(&end_lenth, data+length-sizeof(guint32), sizeof(guint32));
+    if (block_length != end_lenth) {
+        return FALSE;
+    }
+    return write_to_file(pfile, data, length, bytes_written, err);
+}
+
 gboolean
 pcapng_write_session_header_block(FILE* pfile,
                                   const char *comment,
diff --git a/writecap/pcapio.h b/writecap/pcapio.h
index 9263024f02..fbeb60d546 100644
--- a/writecap/pcapio.h
+++ b/writecap/pcapio.h
@@ -43,6 +43,14 @@ libpcap_write_packet(FILE* pfile,
 
 /* Writing pcap-ng files */
 
+/* Write a pre-formatted pcapng block */
+extern gboolean
+pcapng_write_block(FILE* pfile,
+                  const guint8 *data,
+                  guint32 block_total_length,
+                  guint64 *bytes_written,
+                  int *err);
+
 /** Write a section header block (SHB)
  *
  */