From Florent DROUIN:

This is a replacement of the existing decoding of ERF files (Extensible Record
Format from Endace). 
For the decoding of the ERF files, according to the "type of record" given in
the ERF header, several decoders can be used. Up to now, the decoder is
determined according to an environment variable, or with a kind of heuristic.
And, all the treatment is done during the file extraction.

The new architecture, will separate the ERF file decoding, and the ERF record
decoding. The ERF records will be decoded with a specific dissector. This
dissector can be configured with options, to replace the environment variable.

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1839

svn path=/trunk/; revision=23092

1 files changed, 35 insertions, 55 deletions

diff --git a/wiretap/erf.h b/wiretap/erf.h
index 5a9a4d592e..cf46072b29 100644
--- a/wiretap/erf.h
+++ b/wiretap/erf.h
@@ -39,30 +39,30 @@
 #define __W_ERF_H__
 
 /* Record type defines */
-#define TYPE_LEGACY             0
-#define TYPE_HDLC_POS           1
-#define TYPE_ETH                2
-#define TYPE_ATM                3
-#define TYPE_AAL5               4
-#define TYPE_MC_HDLC            5
-#define TYPE_MC_RAW             6
-#define TYPE_MC_ATM             7
-#define TYPE_MC_RAW_CHANNEL     8
-#define TYPE_MC_AAL5            9
-#define TYPE_COLOR_HDLC_POS     10
-#define TYPE_COLOR_ETH          11
-#define TYPE_MC_AAL2            12
-#define TYPE_IP_COUNTER         13
-#define TYPE_TCP_FLOW_COUNTER   14
-#define TYPE_DSM_COLOR_HDLC_POS 15
-#define TYPE_DSM_COLOR_ETH      16
-#define TYPE_COLOR_MC_HDLC_POS  17
-#define TYPE_AAL2               18
+#define ERF_TYPE_LEGACY             0
+#define ERF_TYPE_HDLC_POS           1
+#define ERF_TYPE_ETH                2
+#define ERF_TYPE_ATM                3
+#define ERF_TYPE_AAL5               4
+#define ERF_TYPE_MC_HDLC            5
+#define ERF_TYPE_MC_RAW             6
+#define ERF_TYPE_MC_ATM             7
+#define ERF_TYPE_MC_RAW_CHANNEL     8
+#define ERF_TYPE_MC_AAL5            9
+#define ERF_TYPE_COLOR_HDLC_POS     10
+#define ERF_TYPE_COLOR_ETH          11
+#define ERF_TYPE_MC_AAL2            12
+#define ERF_TYPE_IP_COUNTER         13
+#define ERF_TYPE_TCP_FLOW_COUNTER   14
+#define ERF_TYPE_DSM_COLOR_HDLC_POS 15
+#define ERF_TYPE_DSM_COLOR_ETH      16
+#define ERF_TYPE_COLOR_MC_HDLC_POS  17
+#define ERF_TYPE_AAL2               18
 
-#define TYPE_PAD                48
+#define ERF_TYPE_PAD                48
 
-#define TYPE_MIN  1   /* sanity checking */
-#define TYPE_MAX  48  /* sanity checking */
+#define ERF_TYPE_MIN  1   /* sanity checking */
+#define ERF_TYPE_MAX  48  /* sanity checking */
 
  /*
   * The timestamp is 64bit unsigned fixed point little-endian value with
@@ -79,42 +79,22 @@ typedef struct erf_record {
 	guint16		wlen;
 } erf_header_t;
 
-#define MAX_RECORD_LEN	0x10000 /* 64k */
-#define RECORDS_FOR_ERF_CHECK	3
-#define FCS_BITS	32
-
-#ifndef min
-#define min(a, b) ((a) > (b) ? (b) : (a))
-#endif
-
-/*
- * ATM snaplength
- */
-#define ATM_SNAPLEN		48
-
-/*
- * Size of ATM payload 
- */
-#define ATM_SLEN(h, e)		ATM_SNAPLEN
-#define ATM_WLEN(h, e)		ATM_SNAPLEN
+typedef struct erf_mc_hdr {
+	guint32	mc;
+} erf_mc_header_t;
 
-/*
- * Size of Ethernet payload
- */
-#define ETHERNET_WLEN(h, e)	(g_htons((h)->wlen))
-#define ETHERNET_SLEN(h, e)	min(ETHERNET_WLEN(h, e), g_htons((h)->rlen) - sizeof(*(h)) - 2)
+typedef struct erf_eth_hdr {
+	guint16	eth;
+} erf_eth_header_t;
 
-/*
- * Size of HDLC payload
- */
-#define HDLC_WLEN(h, e)		(g_htons((h)->wlen))
-#define HDLC_SLEN(h, e)		min(HDLC_WLEN(h, e), g_htons((h)->rlen) - sizeof(*(h)))
+union erf_subhdr { 
+  struct erf_mc_hdr mc_hdr;
+  struct erf_eth_hdr eth_hdr;
+};
 
-/*
- * Size of MC_HDLC payload
- */
-#define MC_HDLC_WLEN(h, e)		(g_htons((h)->wlen))
-#define MC_HDLC_SLEN(h, e)		min(MC_HDLC_WLEN(h, e), g_htons((h)->rlen) - sizeof(*(h)) )
+#define MIN_RECORDS_FOR_ERF_CHECK 3
+#define RECORDS_FOR_ERF_CHECK 20
+#define FCS_BITS	32
 
 int erf_open(wtap *wth, int *err, gchar **err_info);