Support for new netscaler 3.5 trace format.

Change-Id: Ica74f3f9239a96486967cf248feb4313bc390734
Reviewed-on: https://code.wireshark.org/review/7751
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

5 files changed, 139 insertions, 6 deletions

diff --git a/wiretap/file_access.c b/wiretap/file_access.c
index 408d648eb4..38536ebae2 100644
--- a/wiretap/file_access.c
+++ b/wiretap/file_access.c
@@ -1593,6 +1593,11 @@ static const struct file_type_subtype_info dump_open_table_base[] = {
 	{ "Colasoft Packet Builder format", "colasoft-pb", "cscpkt", NULL,
 	  FALSE, FALSE, 0,
 	  NULL, NULL, NULL },
+
+	/* WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5 */
+	{ "NetScaler Trace (Version 3.5)", "nstrace35", "cap", NULL,
+	  TRUE, FALSE, 0,
+	  nstrace_35_dump_can_write_encap, nstrace_dump_open, NULL },
 };
 
 gint wtap_num_file_types_subtypes = sizeof(dump_open_table_base) / sizeof(struct file_type_subtype_info);
diff --git a/wiretap/netscaler.c b/wiretap/netscaler.c
index 6e68f5af16..b9678671fe 100644
--- a/wiretap/netscaler.c
+++ b/wiretap/netscaler.c
@@ -31,6 +31,7 @@
 #define NSPR_SIGSTR_V20 "NetScaler V20 Performance Data"
 #define NSPR_SIGSTR     NSPR_SIGSTR_V20
 #define NSPR_SIGSTR_V30 "Netscaler V30 Performance Data"
+#define NSPR_SIGSTR_V35 "Netscaler V35 Performance Data"
 /* Defined but not used */
 #define NSPR_SIGSTR_V21 "NetScaler V21 Performance Data"
 #define NSPR_SIGSTR_V22 "NetScaler V22 Performance Data"
@@ -63,6 +64,7 @@
 #define NSPR_SIGNATURE_V10      0x0101  /* signature */
 #define NSPR_SIGNATURE_V20      0x01    /* signature */
 #define NSPR_SIGNATURE_V30      NSPR_SIGNATURE_V20
+#define NSPR_SIGNATURE_V35      NSPR_SIGNATURE_V20
 #define NSPR_ABSTIME_V10        0x0107  /* data capture time in secs from 1970*/
 #define NSPR_ABSTIME_V20        0x07    /* data capture time in secs from 1970*/
 #define NSPR_RELTIME_V10        0x0108  /* relative time in ms from last time */
@@ -188,6 +190,15 @@ typedef struct nspr_signature_v30
 } nspr_signature_v30_t;
 #define nspr_signature_v30_s    ((guint32)sizeof(nspr_signature_v30_t))
 
+#define NSPR_SIGSIZE_V35        sizeof(NSPR_SIGSTR_V35) /* signature value size in bytes */
+typedef struct nspr_signature_v35
+{
+    NSPR_HEADER_V20(sig);  /* short performance header */
+    guint8 sig_EndianType; /* Endian Type for the data */
+    gchar sig_Signature[NSPR_SIGSIZE_V35]; /* Signature value */
+} nspr_signature_v35_t;
+#define nspr_signature_v35_s    ((guint32)sizeof(nspr_signature_v35_t))
+
 /* NSPR_ABSTIME_V10 and NSPR_SYSTARTIME_V10 structure */
 typedef struct nspr_abstime_v10
 {
@@ -438,6 +449,25 @@ typedef struct  nspr_pktracefull_v30
 } nspr_pktracefull_v30_t;
 #define nspr_pktracefull_v30_s  ((guint32)(sizeof(nspr_pktracefull_v30_t)))
 
+/* New full packet trace structure v35 for multipage spanning data */
+typedef struct  nspr_pktracefull_v35
+{
+    NSPR_HEADER3B_V30(fp);  /* long performance header */
+    guint8 fp_DevNo;   /* Network Device (NIC) number */
+    guint8 fp_AbsTimeHr[8];  /*High resolution absolute time in nanosec*/
+    guint8 fp_PcbDevNo[4];    /* PCB devno */
+    guint8 fp_lPcbDevNo[4];   /* link PCB devno */
+    guint8 fp_PktSizeOrg[2];  /* Original packet size */
+    guint8 fp_VlanTag[2]; /* vlan tag */
+    guint8 fp_Coreid[2]; /* coreid of the packet */
+    guint8 fp_headerlen[2];
+    guint8 fp_errorcode;
+    guint8 fp_app;
+    guint8 fp_ns_activity[4];
+    guint8 fp_nextrectype;
+} nspr_pktracefull_v35_t;
+#define nspr_pktracefull_v35_s  ((guint32)(sizeof(nspr_pktracefull_v35_t)))
+
 /* New partial packet trace structure v26 for vm info tracing */
 typedef struct nspr_pktracepart_v26
 {
@@ -524,6 +554,11 @@ typedef struct nspr_pktracepart_v26
 #define TRACE_V30_REC_LEN_OFF(phdr, enumprefix, structprefix, structname) \
     TRACE_V26_REC_LEN_OFF(phdr,enumprefix,structprefix,structname)\
 
+#define TRACE_V35_REC_LEN_OFF(phdr, enumprefix, structprefix, structname) \
+    TRACE_V23_REC_LEN_OFF(phdr,enumprefix,structprefix,structname)\
+    __TNDO(phdr,enumprefix,structname,data)\
+    __TNO(phdr,enumprefix,structprefix,structname,ns_activity,ns_activity)
+
     TRACE_V10_REC_LEN_OFF(NULL,v10_part,pp,pktracepart_v10)
     TRACE_V10_REC_LEN_OFF(NULL,v10_full,fp,pktracefull_v10)
     TRACE_V20_REC_LEN_OFF(NULL,v20_part,pp,pktracepart_v20)
@@ -541,6 +576,7 @@ typedef struct nspr_pktracepart_v26
     TRACE_V26_REC_LEN_OFF(NULL,v26_part,pp,pktracepart_v26)
     TRACE_V26_REC_LEN_OFF(NULL,v26_full,fp,pktracefull_v26)
     TRACE_V30_REC_LEN_OFF(NULL,v30_full,fp,pktracefull_v30)
+    TRACE_V35_REC_LEN_OFF(NULL,v35_full,fp,pktracefull_v35)
 
 #undef __TNV1O
 #undef __TNV1L
@@ -665,6 +701,13 @@ wtap_open_return_val nstrace_open(wtap *wth, int *err, gchar **err_info)
         page_size = GET_READ_PAGE_SIZEV3(file_size);
         break;
 
+    case WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5:
+        wth->file_encap = WTAP_ENCAP_NSTRACE_3_5;
+        g_free(nstrace_buf);
+        nstrace_buf = (gchar *)g_malloc(NSPR_PAGESIZE_TRACE);
+        page_size = GET_READ_PAGE_SIZEV3(file_size);
+        break;
+
     default:
         /* No known signature found, assume it's not NetScaler */
         g_free(nstrace_buf);
@@ -701,6 +744,11 @@ wtap_open_return_val nstrace_open(wtap *wth, int *err, gchar **err_info)
         wth->subtype_read = nstrace_read_v30;
         wth->subtype_seek_read = nstrace_seek_read_v30;
         break;
+
+    case WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5:
+        wth->subtype_read = nstrace_read_v30;
+        wth->subtype_seek_read = nstrace_seek_read_v30;
+        break;
     }
     wth->subtype_close = nstrace_close;
 
@@ -757,6 +805,7 @@ wtap_open_return_val nstrace_open(wtap *wth, int *err, gchar **err_info)
 nspm_signature_func(10)
 nspm_signature_func(20)
 nspm_signature_func(30)
+nspm_signature_func(35)
 
 /*
 ** Check signature and return the file type and subtype for files with
@@ -790,10 +839,13 @@ nspm_signature_version(wtap *wth, gchar *nstrace_buf, gint32 len)
                 (sigv20p->sig_RecordSize <= len) &&
                 ((gint32)sizeof(NSPR_SIGSTR_V20) <= len))
             {
-                if (!nspm_signature_isv20(sigv20p->sig_Signature))
+                if (!nspm_signature_isv20(sigv20p->sig_Signature)){
                     return WTAP_FILE_TYPE_SUBTYPE_NETSCALER_2_0;
-                else if (!nspm_signature_isv30(sigv20p->sig_Signature))
+                } else if (!nspm_signature_isv30(sigv20p->sig_Signature)){
                     return WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0;
+                }else if (!nspm_signature_isv35(sigv20p->sig_Signature)){
+                    return WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5;
+                }
             }
 #undef    sigv20p
         }
@@ -1178,6 +1230,11 @@ static gboolean nstrace_read_v20(wtap *wth, int *err, gchar **err_info, gint64 *
 
 #undef PACKET_DESCRIBE
 
+#define SETETHOFFSET_35(phdr)\
+  (phdr)->pseudo_header.nstr.eth_offset = pletoh16(&fp->fp_headerlen);\
+
+#define SETETHOFFSET_30(phdr) ;\
+
 #define TIMEDEFV30(phdr,fp,type) \
     do {\
         (phdr)->presence_flags = WTAP_HAS_TS;\
@@ -1187,6 +1244,8 @@ static gboolean nstrace_read_v20(wtap *wth, int *err, gchar **err_info, gint64 *
         (phdr)->ts.nsecs = (guint32) (nsg_creltime % 1000000000);\
     }while(0)
 
+#define TIMEDEFV35 TIMEDEFV30
+
 #define FULLSIZEDEFV30(phdr,fp,ver)\
     do {\
         (phdr)->presence_flags |= WTAP_HAS_CAP_LEN;\
@@ -1194,6 +1253,13 @@ static gboolean nstrace_read_v20(wtap *wth, int *err, gchar **err_info, gint64 *
         (phdr)->caplen = nspr_getv20recordsize((nspr_hd_v20_t *)fp);\
     }while(0)
 
+#define FULLSIZEDEFV35(phdr,fp,ver)\
+    do {\
+        (phdr)->presence_flags |= WTAP_HAS_CAP_LEN;\
+        (phdr)->len = pletoh16(&fp->fp_PktSizeOrg) + pletoh16(&fp->fp_headerlen);\
+        (phdr)->caplen = nspr_getv20recordsize((nspr_hd_v20_t *)fp);\
+    }while(0)
+
 #define PACKET_DESCRIBE(phdr,FULLPART,ver,enumprefix,type,structname,HEADERVER)\
     do {\
         nspr_##structname##_t *fp = (nspr_##structname##_t *) &nstrace_buf[nstrace_buf_offset];\
@@ -1201,6 +1267,7 @@ static gboolean nstrace_read_v20(wtap *wth, int *err, gchar **err_info, gint64 *
         TIMEDEFV##ver((phdr),fp,type);\
         FULLPART##SIZEDEFV##ver((phdr),fp,ver);\
         TRACE_V##ver##_REC_LEN_OFF((phdr),enumprefix,type,structname);\
+        SETETHOFFSET_##ver(phdr)\
         (phdr)->pseudo_header.nstr.rec_type = NSPR_HEADER_VERSION##HEADERVER;\
         ws_buffer_assure_space(wth->frame_buffer, (phdr)->caplen);\
         *data_offset = nstrace->xxx_offset + nstrace_buf_offset;\
@@ -1271,6 +1338,16 @@ static gboolean nstrace_read_v30(wtap *wth, int *err, gchar **err_info, gint64 *
 
 #undef GENERATE_CASE_FULL_V30
 
+#define GENERATE_CASE_FULL_V35(phdr,ver,HEADERVER) \
+        case NSPR_PDPKTRACEFULLTX_V##ver:\
+        case NSPR_PDPKTRACEFULLTXB_V##ver:\
+        case NSPR_PDPKTRACEFULLRX_V##ver:\
+        case NSPR_PDPKTRACEFULLNEWRX_V##ver:\
+            PACKET_DESCRIBE(phdr,FULL,ver,v##ver##_full,fp,pktracefull_v##ver,HEADERVER);
+                GENERATE_CASE_FULL_V35(&wth->phdr,35,350);
+
+#undef GENERATE_CASE_FULL_V35
+
                 case NSPR_ABSTIME_V20:
                 {
                     nstrace_buf_offset += nspr_getv20recordsize(hdp);
@@ -1520,12 +1597,22 @@ static gboolean nstrace_seek_read_v20(wtap *wth, gint64 seek_off,
 }
 
 #undef PACKET_DESCRIBE
+#undef SETETHOFFSET_35
+#undef SETETHOFFSET_30
+
+#define SETETHOFFSET_35(phdr)\
+   {\
+    (phdr)->pseudo_header.nstr.eth_offset = pletoh16(&fp->fp_headerlen);\
+   }
+
+#define SETETHOFFSET_30(phdr) ;\
 
 #define PACKET_DESCRIBE(phdr,FULLPART,ver,enumprefix,type,structname,HEADERVER)\
     do {\
         nspr_##structname##_t *fp= (nspr_##structname##_t*)pd;\
         (phdr)->rec_type = REC_TYPE_PACKET;\
         TIMEDEFV##ver((phdr),fp,type);\
+        SETETHOFFSET_##ver(phdr);\
         FULLPART##SIZEDEFV##ver((phdr),fp,ver);\
         TRACE_V##ver##_REC_LEN_OFF((phdr),enumprefix,type,structname);\
         (phdr)->pseudo_header.nstr.rec_type = NSPR_HEADER_VERSION##HEADERVER;\
@@ -1591,6 +1678,7 @@ static gboolean nstrace_seek_read_v30(wtap *wth, gint64 seek_off,
         switch ((( nspr_hd_v20_t*)pd)->phd_RecordType)
         {
             GENERATE_CASE_V30(phdr,30, 300);
+            GENERATE_CASE_V30(phdr,35, 350);
         }
 
     return TRUE;
@@ -1645,6 +1733,16 @@ int nstrace_30_dump_can_write_encap(int encap)
     return WTAP_ERR_UNWRITABLE_ENCAP;
 }
 
+/* Returns 0 if we could write the specified encapsulation type,
+** an error indication otherwise. */
+int nstrace_35_dump_can_write_encap(int encap)
+{
+    if (encap == WTAP_ENCAP_NSTRACE_3_5)
+        return 0;
+
+    return WTAP_ERR_UNWRITABLE_ENCAP;
+}
+
 /* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
 ** failure */
 gboolean nstrace_dump_open(wtap_dumper *wdh, int *err _U_)
@@ -1719,6 +1817,21 @@ static gboolean nstrace_add_signature(wtap_dumper *wdh, int *err)
 
         /* Move forward the page offset */
         nstrace->page_offset += (guint16) sig30.sig_RecordSize;
+    } else if (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5)
+    {
+        nspr_signature_v35_t sig35;
+
+        sig35.sig_RecordType = NSPR_SIGNATURE_V35;
+        sig35.sig_RecordSize = nspr_signature_v35_s;
+        memcpy(sig35.sig_Signature, NSPR_SIGSTR_V35, sizeof(NSPR_SIGSTR_V35));
+
+        /* Write the record into the file */
+        if (!wtap_dump_file_write(wdh, &sig35, sig35.sig_RecordSize,
+            err))
+            return FALSE;
+
+        /* Move forward the page offset */
+        nstrace->page_offset += (guint16) sig35.sig_RecordSize;
     } else
     {
         g_assert_not_reached();
@@ -1764,7 +1877,8 @@ nstrace_add_abstime(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
         nstrace->page_offset += nspr_abstime_v10_s;
 
     } else if ((wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_2_0) ||
-        (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0))    {
+        (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0) ||
+        (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5))    {
         guint32 reltime;
         guint64 abstime;
         nspr_abstime_v20_t abs20;
@@ -1822,7 +1936,8 @@ static gboolean nstrace_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
             if (!nstrace_add_signature(wdh, err) ||
                 !nstrace_add_abstime(wdh, phdr, pd, err))
                 return FALSE;
-        } else if (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0)
+        } else if (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0 ||
+                   wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5 )
         {
             if (!nstrace_add_signature(wdh, err) ||
                 !nstrace_add_abstime(wdh, phdr, pd, err))
@@ -1902,6 +2017,7 @@ static gboolean nstrace_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
         break;
 
     case NSPR_HEADER_VERSION300:
+    case NSPR_HEADER_VERSION350:
         if (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_1_0)
         {
             *err = WTAP_ERR_UNWRITABLE_FILE_TYPE;
@@ -1910,7 +2026,7 @@ static gboolean nstrace_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
         {
             *err = WTAP_ERR_UNWRITABLE_FILE_TYPE;
             return FALSE;
-        } else if (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0)
+        } else if (wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_0 || wdh->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5)
         {
             if (nstrace->page_offset + phdr->caplen >= nstrace->page_len)
             {
diff --git a/wiretap/netscaler.h b/wiretap/netscaler.h
index a4e080f594..2d68cc5731 100644
--- a/wiretap/netscaler.h
+++ b/wiretap/netscaler.h
@@ -101,6 +101,11 @@
 #define NSPR_PDPKTRACEFULLRX_V30    0xAA    /* Received packets before NIC pipelining */
 #define NSPR_PDPKTRACEFULLNEWRX_V30 0xAB    /* Received packets after NIC pipelining */
 
+#define NSPR_PDPKTRACEFULLTX_V35    0xAC    /* Transmitted */
+#define NSPR_PDPKTRACEFULLTXB_V35   0xAD   /* In transmit buffer */
+#define NSPR_PDPKTRACEFULLRX_V35    0xAE    /* Received packets before NIC pipelining */
+#define NSPR_PDPKTRACEFULLNEWRX_V35 0xAF    /* Received packets after NIC pipelining */
+
 
 /* Record types */
 #define	NSPR_HEADER_VERSION100 0x10
@@ -112,11 +117,13 @@
 #define NSPR_HEADER_VERSION205 0x25
 #define NSPR_HEADER_VERSION206 0x26
 #define NSPR_HEADER_VERSION300 0x30
+#define NSPR_HEADER_VERSION350 0x35
 
 wtap_open_return_val nstrace_open(wtap *wth, int *err, gchar **err_info);
 int nstrace_10_dump_can_write_encap(int encap);
 int nstrace_20_dump_can_write_encap(int encap);
 int nstrace_30_dump_can_write_encap(int encap);
+int nstrace_35_dump_can_write_encap(int encap);
 
 gboolean nstrace_dump_open(wtap_dumper *wdh, int *err);
 
diff --git a/wiretap/wtap.c b/wiretap/wtap.c
index 4de71ee723..897f0944cb 100644
--- a/wiretap/wtap.c
+++ b/wiretap/wtap.c
@@ -742,7 +742,10 @@ static struct encap_type_info encap_table_base[] = {
 	{ "OpenBSD loopback", "loop" },
 
 	/* WTAP_ENCAP_JSON */
-	{ "JavaScript Object Notation", "json" }
+	{ "JavaScript Object Notation", "json" },
+
+	/* WTAP_ENCAP_NSTRACE_3_5 */
+	{ "NetScaler Encapsulation 3.5 of Ethernet", "nstrace35" },
 };
 
 WS_DLL_LOCAL
diff --git a/wiretap/wtap.h b/wiretap/wtap.h
index 1185d6ac28..0f257ba275 100644
--- a/wiretap/wtap.h
+++ b/wiretap/wtap.h
@@ -263,6 +263,7 @@ extern "C" {
 #define WTAP_ENCAP_IPMI_TRACE                   174
 #define WTAP_ENCAP_LOOP                         175
 #define WTAP_ENCAP_JSON                         176
+#define WTAP_ENCAP_NSTRACE_3_5                  177
 /* After adding new item here, please also add new item to encap_table_base array */
 
 #define WTAP_NUM_ENCAP_TYPES                    wtap_get_num_encap_types()
@@ -350,6 +351,7 @@ extern "C" {
 #define WTAP_FILE_TYPE_SUBTYPE_COLASOFT_CAPSA                75
 #define WTAP_FILE_TYPE_SUBTYPE_COLASOFT_PACKET_BUILDER       76
 #define WTAP_FILE_TYPE_SUBTYPE_JSON                          77
+#define WTAP_FILE_TYPE_SUBTYPE_NETSCALER_3_5                 78
 
 #define WTAP_NUM_FILE_TYPES_SUBTYPES  wtap_get_num_file_types_subtypes()