1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
|
/* file.c
*
* $Id: file.c,v 1.3 1998/11/12 23:29:34 gram Exp $
*
* Wiretap Library
* Copyright (c) 1998 by Gilbert Ramirez <gram@verdict.uthscsa.edu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "wtap.h"
#include "lanalyzer.h"
#include "ngsniffer.h"
/* The open_file_* routines should return the WTAP_FILE_* type
* that they are checking for if the file is successfully recognized
* as such. If the file is not of that type, the routine should return
* WTAP_FILE_UNKNOWN */
static int open_file_pcap(wtap *wth, char *filename);
static int convert_dlt_to_wtap_encap(int dlt);
/* Opens a file and prepares a wtap struct */
wtap* wtap_open_offline(char *filename, int filetype)
{
wtap *wth;
wth = (wtap*)malloc(sizeof(wtap));
/* Open the file */
if (!(wth->fh = fopen(filename, "rb"))) {
return NULL;
}
/* If the filetype is unknown, try all my file types */
if (filetype == WTAP_FILE_UNKNOWN) {
/* WTAP_FILE_PCAP */
if ((wth->file_type = open_file_pcap(wth, filename)) != WTAP_FILE_UNKNOWN) {
goto success;
}
/* WTAP_FILE_NGSNIFFER */
if ((wth->file_type = ngsniffer_open(wth)) != WTAP_FILE_UNKNOWN) {
goto success;
}
/* WTAP_FILE_LANALYZER */
if ((wth->file_type = lanalyzer_open(wth)) != WTAP_FILE_UNKNOWN) {
goto success;
}
printf("failed\n");
/* WTAP_FILE_UNKNOWN */
goto failure;
}
/* If the user tells us what the file is supposed to be, check it */
switch (filetype) {
case WTAP_FILE_PCAP:
if ((wth->file_type = open_file_pcap(wth, filename)) != WTAP_FILE_UNKNOWN) {
goto success;
}
break;
case WTAP_FILE_NGSNIFFER:
if ((wth->file_type = ngsniffer_open(wth)) != WTAP_FILE_UNKNOWN) {
goto success;
}
break;
case WTAP_FILE_LANALYZER:
if ((wth->file_type = lanalyzer_open(wth)) != WTAP_FILE_UNKNOWN) {
goto success;
}
break;
default:
goto failure;
}
/* If we made it through the switch() statement w/o going to "success",
* then we failed. */
goto failure;
failure:
fclose(wth->fh);
free(wth);
wth = NULL;
return wth;
success:
buffer_init(&wth->frame_buffer, 1500);
wth->frame_number = 0;
wth->file_byte_offset = 0;
return wth;
}
/* libpcap/tcpdump files */
static
int open_file_pcap(wtap *wth, char *filename)
{
int bytes_read, dlt;
struct pcap_file_header file_hdr;
fseek(wth->fh, 0, SEEK_SET);
bytes_read = fread((char*)&file_hdr, 1,
sizeof(struct pcap_file_header), wth->fh);
if (bytes_read != sizeof(struct pcap_file_header)) {
return WTAP_FILE_UNKNOWN;
}
if (file_hdr.magic != 0xa1b2c3d4) {
return WTAP_FILE_UNKNOWN;
}
/* This is a pcap file */
wth->capture.pcap = pcap_open_offline(filename, wth->err_str);
dlt = pcap_datalink(wth->capture.pcap);
wth->encapsulation = convert_dlt_to_wtap_encap(dlt);
wth->subtype_read = NULL;
/* For most file types I don't fclose my handle, but for pcap I'm
* letting libpcap handle the file, so I don't need an open file
* handle. Libpcap already has the file open with the above
* pcap_open_offline() */
fclose(wth->fh);
return WTAP_FILE_PCAP;
}
static
int convert_dlt_to_wtap_encap(int dlt)
{
int encap[] = {
WTAP_ENCAP_NONE,
WTAP_ENCAP_ETHERNET,
WTAP_ENCAP_NONE,
WTAP_ENCAP_NONE,
WTAP_ENCAP_NONE,
WTAP_ENCAP_NONE,
WTAP_ENCAP_TR,
WTAP_ENCAP_NONE,
WTAP_ENCAP_SLIP,
WTAP_ENCAP_PPP,
WTAP_ENCAP_FDDI,
WTAP_ENCAP_NONE,
WTAP_ENCAP_RAW_IP,
WTAP_ENCAP_NONE,
WTAP_ENCAP_NONE,
WTAP_ENCAP_NONE,
WTAP_ENCAP_NONE
};
return encap[dlt];
}
|
