1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
|
/* ftap-int.h
*
* Filetap Library
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#ifndef __FTAP_INT_H__
#define __FTAP_INT_H__
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#endif
#include <glib.h>
#include <stdio.h>
#include <time.h>
#ifdef HAVE_WINSOCK2_H
#include <winsock2.h>
#endif
#include <wsutil/file_util.h>
#include "ftap.h"
WS_DLL_PUBLIC
int ftap_fstat(ftap *fth, ws_statb64 *statb, int *err);
typedef gboolean (*subtype_read_func)(struct ftap*, int*, char**, gint64*);
typedef gboolean (*subtype_seek_read_func)(struct ftap*, gint64,
Buffer *buf,
int, int *, char **);
/**
* Struct holding data of the currently read file.
*/
struct ftap {
FILE_F fh;
FILE_F random_fh; /**< Secondary FILE_T for random access */
int file_type_subtype;
guint snapshot_length;
struct Buffer *frame_buffer;
void *priv;
subtype_read_func subtype_read;
subtype_seek_read_func subtype_seek_read;
void (*subtype_sequential_close)(struct ftap*);
void (*subtype_close)(struct ftap*);
int file_encap; /* per-file, for those
* file formats that have
* per-file encapsulation
* types
*/
GPtrArray *fast_seek;
};
extern gint ftap_num_file_types;
#include <wsutil/pint.h>
/* Macros to byte-swap possibly-unaligned 64-bit, 32-bit and 16-bit quantities;
* they take a pointer to the quantity, and byte-swap it in place.
*/
#define PBSWAP64(p) \
{ \
guint8 tmp; \
tmp = (p)[7]; \
(p)[7] = (p)[0]; \
(p)[0] = tmp; \
tmp = (p)[6]; \
(p)[6] = (p)[1]; \
(p)[1] = tmp; \
tmp = (p)[5]; \
(p)[5] = (p)[2]; \
(p)[2] = tmp; \
tmp = (p)[4]; \
(p)[4] = (p)[3]; \
(p)[3] = tmp; \
}
#define PBSWAP32(p) \
{ \
guint8 tmp; \
tmp = (p)[3]; \
(p)[3] = (p)[0]; \
(p)[0] = tmp; \
tmp = (p)[2]; \
(p)[2] = (p)[1]; \
(p)[1] = tmp; \
}
#define PBSWAP16(p) \
{ \
guint8 tmp; \
tmp = (p)[1]; \
(p)[1] = (p)[0]; \
(p)[0] = tmp; \
}
/* Pointer routines to put items out in a particular byte order.
* These will work regardless of the byte alignment of the pointer.
*/
#ifndef phtons
#define phtons(p, v) \
{ \
(p)[0] = (guint8)((v) >> 8); \
(p)[1] = (guint8)((v) >> 0); \
}
#endif
#ifndef phton24
#define phton24(p, v) \
{ \
(p)[0] = (guint8)((v) >> 16); \
(p)[1] = (guint8)((v) >> 8); \
(p)[2] = (guint8)((v) >> 0); \
}
#endif
#ifndef phtonl
#define phtonl(p, v) \
{ \
(p)[0] = (guint8)((v) >> 24); \
(p)[1] = (guint8)((v) >> 16); \
(p)[2] = (guint8)((v) >> 8); \
(p)[3] = (guint8)((v) >> 0); \
}
#endif
#ifndef phtonll
#define phtonll(p, v) \
{ \
(p)[0] = (guint8)((v) >> 56); \
(p)[1] = (guint8)((v) >> 48); \
(p)[2] = (guint8)((v) >> 40); \
(p)[3] = (guint8)((v) >> 32); \
(p)[4] = (guint8)((v) >> 24); \
(p)[5] = (guint8)((v) >> 16); \
(p)[6] = (guint8)((v) >> 8); \
(p)[7] = (guint8)((v) >> 0); \
}
#endif
#ifndef phtoles
#define phtoles(p, v) \
{ \
(p)[0] = (guint8)((v) >> 0); \
(p)[1] = (guint8)((v) >> 8); \
}
#endif
#ifndef phtolel
#define phtolel(p, v) \
{ \
(p)[0] = (guint8)((v) >> 0); \
(p)[1] = (guint8)((v) >> 8); \
(p)[2] = (guint8)((v) >> 16); \
(p)[3] = (guint8)((v) >> 24); \
}
#endif
#ifndef phtolell
#define phtolell(p, v) \
{ \
(p)[0] = (guint8)((v) >> 0); \
(p)[1] = (guint8)((v) >> 8); \
(p)[2] = (guint8)((v) >> 16); \
(p)[3] = (guint8)((v) >> 24); \
(p)[4] = (guint8)((v) >> 32); \
(p)[5] = (guint8)((v) >> 40); \
(p)[6] = (guint8)((v) >> 48); \
(p)[7] = (guint8)((v) >> 56); \
}
#endif
#define ftap_file_read_unknown_bytes(target, num_bytes, fh, err, err_info) \
G_STMT_START \
{ \
int _bytes_read; \
_bytes_read = file_read((target), (num_bytes), (fh)); \
if (_bytes_read != (int) (num_bytes)) { \
*(err) = file_error((fh), (err_info)); \
return FALSE; \
} \
} \
G_STMT_END
#define ftap_file_read_expected_bytes(target, num_bytes, fh, err, err_info) \
G_STMT_START \
{ \
int _bytes_read; \
_bytes_read = file_read((target), (num_bytes), (fh)); \
if (_bytes_read != (int) (num_bytes)) { \
*(err) = file_error((fh), (err_info)); \
if (*(err) == 0 && _bytes_read > 0) { \
*(err) = FTAP_ERR_SHORT_READ; \
} \
return FALSE; \
} \
} \
G_STMT_END
/* glib doesn't have g_ptr_array_len of all things!*/
#ifndef g_ptr_array_len
#define g_ptr_array_len(a) ((a)->len)
#endif
/*** get GSList of all compressed file extensions ***/
GSList *ftap_get_compressed_file_extensions(void);
/*
* Read packet data into a Buffer, growing the buffer as necessary.
*
* This returns an error on a short read, even if the short read hit
* the EOF immediately. (The assumption is that each packet has a
* header followed by raw packet data, and that we've already read the
* header, so if we get an EOF trying to read the packet data, the file
* has been cut short, even if the read didn't read any data at all.)
*/
gboolean
ftap_read_packet_bytes(FILE_F fh, Buffer *buf, guint length, int *err,
gchar **err_info);
#endif /* __FTAP_INT_H__ */
/*
* Editor modelines
*
* Local Variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* ex: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/
|
