diff options
Diffstat (limited to 'wiretap')
44 files changed, 120 insertions, 22 deletions
diff --git a/wiretap/5views.c b/wiretap/5views.c index 98e9d325a3..90e2e75f1a 100644 --- a/wiretap/5views.c +++ b/wiretap/5views.c @@ -262,6 +262,7 @@ _5views_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) TimeStamped_Header.Utc = pletohl(&TimeStamped_Header.Utc); TimeStamped_Header.NanoSecondes = pletohl(&TimeStamped_Header.NanoSecondes); + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.ts.secs = TimeStamped_Header.Utc; wth->phdr.ts.nsecs = TimeStamped_Header.NanoSecondes; wth->phdr.caplen = packet_size; diff --git a/wiretap/aethra.c b/wiretap/aethra.c index ae53423785..b6099b681a 100644 --- a/wiretap/aethra.c +++ b/wiretap/aethra.c @@ -298,6 +298,7 @@ packet, hdr.rec_type, packet_size, hdr.flags); found: msecs = pletohl(hdr.timestamp); + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.ts.secs = aethra->start + (msecs / 1000); wth->phdr.ts.nsecs = (msecs % 1000) * 1000000; wth->phdr.caplen = packet_size; diff --git a/wiretap/airopeek9.c b/wiretap/airopeek9.c index 44a520b52f..b322e8bf04 100644 --- a/wiretap/airopeek9.c +++ b/wiretap/airopeek9.c @@ -517,6 +517,8 @@ static gboolean airopeekv9_read(wtap *wth, int *err, gchar **err_info, return FALSE; } + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + /* fill in packet header length values before slicelength may be adjusted */ wth->phdr.len = hdr_info.length; diff --git a/wiretap/ascendtext.c b/wiretap/ascendtext.c index 612a202b09..569713e043 100644 --- a/wiretap/ascendtext.c +++ b/wiretap/ascendtext.c @@ -317,6 +317,7 @@ static gboolean ascend_read(wtap *wth, int *err, gchar **err_info, if (ascend->inittime > header.secs) ascend->inittime -= header.secs; } + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.ts.secs = header.secs + ascend->inittime; wth->phdr.ts.nsecs = header.usecs * 1000; wth->phdr.caplen = header.caplen; diff --git a/wiretap/ber.c b/wiretap/ber.c index e426246d0a..df0b1687af 100644 --- a/wiretap/ber.c +++ b/wiretap/ber.c @@ -47,7 +47,6 @@ static gboolean ber_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off guint8 *buf; gint64 file_size; int packet_size; - ws_statb64 statb; *err = 0; @@ -79,13 +78,12 @@ static gboolean ber_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off wth->data_offset += packet_size; + wth->phdr.presence_flags = 0; /* yes, we have no bananas^Wtime stamp */ + wth->phdr.caplen = packet_size; wth->phdr.len = packet_size; - if (wtap_fstat(wth, &statb, err) == -1) - return FALSE; - - wth->phdr.ts.secs = statb.st_mtime; + wth->phdr.ts.secs = 0; wth->phdr.ts.nsecs = 0; return TRUE; diff --git a/wiretap/btsnoop.c b/wiretap/btsnoop.c index 8863f8967f..a8e6d80e73 100644 --- a/wiretap/btsnoop.c +++ b/wiretap/btsnoop.c @@ -206,6 +206,7 @@ static gboolean btsnoop_read(wtap *wth, int *err, gchar **err_info, ts = GINT64_FROM_BE(hdr.ts_usec); ts -= KUnixTimeBase; + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.ts.secs = (guint)(ts / 1000000); wth->phdr.ts.nsecs = (guint)((ts % 1000000) * 1000); wth->phdr.caplen = packet_size; diff --git a/wiretap/catapult_dct2000.c b/wiretap/catapult_dct2000.c index 865d9b9826..041ee83275 100644 --- a/wiretap/catapult_dct2000.c +++ b/wiretap/catapult_dct2000.c @@ -334,6 +334,8 @@ catapult_dct2000_read(wtap *wth, int *err, gchar **err_info _U_, g_snprintf(timestamp_string, MAX_TIMESTAMP_LEN, "%d.%04d", seconds, useconds/100); + wth->phdr.presence_flags = WTAP_HAS_TS; + /* All packets go to Catapult DCT2000 stub dissector */ wth->phdr.pkt_encap = WTAP_ENCAP_CATAPULT_DCT2000; diff --git a/wiretap/commview.c b/wiretap/commview.c index 31aa385646..15d619b239 100644 --- a/wiretap/commview.c +++ b/wiretap/commview.c @@ -212,6 +212,8 @@ commview_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) wth->data_offset += cv_hdr.data_len; + wth->phdr.presence_flags = WTAP_HAS_TS; + wth->phdr.len = cv_hdr.data_len; wth->phdr.caplen = cv_hdr.data_len; diff --git a/wiretap/cosine.c b/wiretap/cosine.c index 390070024b..083ce596b7 100644 --- a/wiretap/cosine.c +++ b/wiretap/cosine.c @@ -335,6 +335,7 @@ static gboolean cosine_read(wtap *wth, int *err, gchar **err_info, return FALSE; wth->data_offset = offset; + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.caplen = caplen; *data_offset = offset; return TRUE; diff --git a/wiretap/csids.c b/wiretap/csids.c index 093d8eb4b5..fb05e34b35 100644 --- a/wiretap/csids.c +++ b/wiretap/csids.c @@ -187,6 +187,7 @@ static gboolean csids_read(wtap *wth, int *err, gchar **err_info, wth->data_offset += hdr.caplen; + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.len = hdr.caplen; wth->phdr.caplen = hdr.caplen; wth->phdr.ts.secs = hdr.seconds; diff --git a/wiretap/daintree-sna.c b/wiretap/daintree-sna.c index d9094c4452..0b66f7e897 100644 --- a/wiretap/daintree-sna.c +++ b/wiretap/daintree-sna.c @@ -152,6 +152,8 @@ daintree_sna_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) wth->data_offset += strlen(readLine); } while (readLine[0] == COMMENT_LINE); + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + /* parse one line of capture data */ if (sscanf(readLine, "%*s %18" G_GINT64_MODIFIER "u.%9d %9u %" READDATA_MAX_FIELD_SIZE "s", &seconds, &wth->phdr.ts.nsecs, &wth->phdr.len, readData) != 4) { diff --git a/wiretap/dbs-etherwatch.c b/wiretap/dbs-etherwatch.c index 366a118aba..7bc6ff1be6 100644 --- a/wiretap/dbs-etherwatch.c +++ b/wiretap/dbs-etherwatch.c @@ -477,6 +477,8 @@ parse_dbs_etherwatch_packet(wtap *wth, FILE_T fh, guint8* buf, int *err, } if (wth) { + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + p = strstr(months, mon); if (p) tm.tm_mon = (int)(p - months) / 3; diff --git a/wiretap/dct3trace.c b/wiretap/dct3trace.c index 12910bebac..f3a6169abd 100644 --- a/wiretap/dct3trace.c +++ b/wiretap/dct3trace.c @@ -352,6 +352,7 @@ static gboolean dct3trace_read(wtap *wth, int *err, gchar **err_info, } /* We've got a full packet! */ + wth->phdr.presence_flags = 0; /* no time stamp, no separate "on the wire" length */ wth->phdr.ts.secs = 0; wth->phdr.ts.nsecs = 0; wth->phdr.caplen = buf_len; diff --git a/wiretap/erf.c b/wiretap/erf.c index aee62fa304..2ffddfabdb 100644 --- a/wiretap/erf.c +++ b/wiretap/erf.c @@ -377,6 +377,7 @@ static int erf_read_header(FILE_T fh, if (phdr != NULL) { guint64 ts = pletohll(&erf_header->ts); + phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; phdr->ts.secs = (long) (ts >> 32); ts = ((ts & 0xffffffff) * 1000 * 1000 * 1000); ts += (ts & 0x80000000) << 1; /* rounding */ diff --git a/wiretap/etherpeek.c b/wiretap/etherpeek.c index e28b373f0e..b0cb8c12b3 100644 --- a/wiretap/etherpeek.c +++ b/wiretap/etherpeek.c @@ -402,6 +402,8 @@ static gboolean etherpeek_read_v7(wtap *wth, int *err, gchar **err_info, sliceLength = length; } + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + /* fill in packet header length values before slicelength may be adjusted */ wth->phdr.len = length; diff --git a/wiretap/eyesdn.c b/wiretap/eyesdn.c index c2bf571e7c..897e32e329 100644 --- a/wiretap/eyesdn.c +++ b/wiretap/eyesdn.c @@ -367,6 +367,7 @@ parse_eyesdn_rec_hdr(wtap *wth, FILE_T fh, } if (wth) { + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.ts.secs = secs; wth->phdr.ts.nsecs = usecs * 1000; wth->phdr.caplen = pkt_len; diff --git a/wiretap/hcidump.c b/wiretap/hcidump.c index 07242fe4e1..fdcc3cb175 100644 --- a/wiretap/hcidump.c +++ b/wiretap/hcidump.c @@ -80,6 +80,7 @@ static gboolean hcidump_read(wtap *wth, int *err, gchar **err_info, } wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.ts.secs = GUINT32_FROM_LE(dh.ts_sec); wth->phdr.ts.nsecs = GUINT32_FROM_LE(dh.ts_usec) * 1000; wth->phdr.caplen = packet_size; diff --git a/wiretap/i4btrace.c b/wiretap/i4btrace.c index ce6421aefc..05b6087583 100644 --- a/wiretap/i4btrace.c +++ b/wiretap/i4btrace.c @@ -156,6 +156,8 @@ static gboolean i4btrace_read(wtap *wth, int *err, gchar **err_info, return FALSE; } + wth->phdr.presence_flags = WTAP_HAS_TS; + wth->phdr.len = length; wth->phdr.caplen = length; diff --git a/wiretap/ipfix.c b/wiretap/ipfix.c index cdfcdc53e9..07a7c0acee 100644 --- a/wiretap/ipfix.c +++ b/wiretap/ipfix.c @@ -275,6 +275,7 @@ ipfix_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer), msg_hdr.message_length, wth->fh, err, err_info); + wth->phdr.presence_flags = 0; wth->phdr.len = msg_hdr.message_length; wth->phdr.caplen = msg_hdr.message_length; wth->phdr.ts.secs = 0; diff --git a/wiretap/iptrace.c b/wiretap/iptrace.c index b9a382c810..3b6c7739e2 100644 --- a/wiretap/iptrace.c +++ b/wiretap/iptrace.c @@ -212,6 +212,7 @@ static gboolean iptrace_read_1_0(wtap *wth, int *err, gchar **err_info, return FALSE; /* Read error */ wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.len = packet_size; wth->phdr.caplen = packet_size; wth->phdr.ts.secs = pntohl(&header[4]); @@ -426,6 +427,7 @@ static gboolean iptrace_read_2_0(wtap *wth, int *err, gchar **err_info, return FALSE; /* Read error */ wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.len = packet_size; wth->phdr.caplen = packet_size; wth->phdr.ts.secs = pntohl(&header[32]); diff --git a/wiretap/iseries.c b/wiretap/iseries.c index d77ee728e9..66eec92204 100644 --- a/wiretap/iseries.c +++ b/wiretap/iseries.c @@ -616,6 +616,8 @@ iseries_parse_packet (wtap * wth, FILE_T fh, return -1; } + wth->phdr.presence_flags = WTAP_HAS_CAP_LEN; + /* * If we have Wiretap Header then populate it here * @@ -625,6 +627,7 @@ iseries_parse_packet (wtap * wth, FILE_T fh, */ if (iseries->have_date) { + wth->phdr.presence_flags |= WTAP_HAS_TS; tm.tm_year = 100 + iseries->year; tm.tm_mon = iseries->month - 1; tm.tm_mday = iseries->day; @@ -645,9 +648,9 @@ iseries_parse_packet (wtap * wth, FILE_T fh, } } - wth->phdr.caplen = cap_len; - wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET; - pseudo_header->eth.fcs_len = -1; + wth->phdr.caplen = cap_len; + wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET; + pseudo_header->eth.fcs_len = -1; /* * Start Reading packet contents diff --git a/wiretap/k12.c b/wiretap/k12.c index 0ff3d68f16..cabfd26935 100644 --- a/wiretap/k12.c +++ b/wiretap/k12.c @@ -450,6 +450,8 @@ static gboolean k12_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off wth->data_offset = offset; + wth->phdr.presence_flags = WTAP_HAS_TS; + ts = pntohll(buffer + K12_PACKET_TIMESTAMP); wth->phdr.ts.secs = (guint32) ((ts / 2000000) + 631152000); diff --git a/wiretap/k12text.l b/wiretap/k12text.l index 95fd387b9c..867725231c 100644 --- a/wiretap/k12text.l +++ b/wiretap/k12text.l @@ -250,6 +250,8 @@ k12text_read(wtap *wth, int *err, char ** err_info, gint64 *data_offset) *data_offset = wth->data_offset; /* file position for beginning of this frame */ wth->data_offset += file_bytes_read; /* file position after end of this frame */ + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + wth->phdr.ts.secs = 946681200 + (3600*g_h) + (60*g_m) + g_s; wth->phdr.ts.nsecs = 1000000*g_ms + 1000*g_ns; diff --git a/wiretap/lanalyzer.c b/wiretap/lanalyzer.c index 5fbf8714c2..d762f386c0 100644 --- a/wiretap/lanalyzer.c +++ b/wiretap/lanalyzer.c @@ -522,6 +522,8 @@ static gboolean lanalyzer_read(wtap *wth, int *err, gchar **err_info, return FALSE; } + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + time_low = pletohs(&descriptor[8]); time_med = pletohs(&descriptor[10]); time_high = pletohs(&descriptor[12]); diff --git a/wiretap/libpcap.c b/wiretap/libpcap.c index c5d1b31738..22ace095ae 100644 --- a/wiretap/libpcap.c +++ b/wiretap/libpcap.c @@ -661,6 +661,8 @@ static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info, return FALSE; /* Read error */ wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + /* Update the Timestamp, if not already done */ if (wth->file_encap != WTAP_ENCAP_ERF) { wth->phdr.ts.secs = hdr.hdr.ts_sec; diff --git a/wiretap/mime_file.c b/wiretap/mime_file.c index 2cb1ebdb36..ff46ab9e7a 100644 --- a/wiretap/mime_file.c +++ b/wiretap/mime_file.c @@ -93,7 +93,9 @@ mime_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) return FALSE; } - wth->phdr.ts.secs = (time_t) wth->data_offset; + wth->phdr.presence_flags = 0; + + wth->phdr.ts.secs = 0; wth->phdr.ts.nsecs = 0; *data_offset = wth->data_offset; diff --git a/wiretap/mpeg.c b/wiretap/mpeg.c index cf60fe2375..eedbd6ca2b 100644 --- a/wiretap/mpeg.c +++ b/wiretap/mpeg.c @@ -232,6 +232,7 @@ mpeg_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) packet_size, err, err_info)) return FALSE; wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS; /* XXX - relative, not absolute! */ wth->phdr.ts = ts; wth->phdr.caplen = packet_size; wth->phdr.len = packet_size; @@ -297,7 +298,7 @@ good_magic: mpeg = (mpeg_t *)g_malloc(sizeof(mpeg_t)); wth->priv = (void *)mpeg; - mpeg->now.secs = time(NULL); + mpeg->now.secs = 0; mpeg->now.nsecs = 0; mpeg->t0 = mpeg->now.secs; diff --git a/wiretap/netmon.c b/wiretap/netmon.c index 23a2d8a23b..53563dedff 100644 --- a/wiretap/netmon.c +++ b/wiretap/netmon.c @@ -677,6 +677,7 @@ again: } secs += (time_t)(t/1000000000); nsecs = (guint32)(t%1000000000); + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.ts.secs = netmon->start_secs + secs; wth->phdr.ts.nsecs = nsecs; wth->phdr.caplen = packet_size; diff --git a/wiretap/netscaler.c b/wiretap/netscaler.c index a4a634d1d7..5f07aaca94 100644 --- a/wiretap/netscaler.c +++ b/wiretap/netscaler.c @@ -700,6 +700,8 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of case NSPR_PDPKTRACEFULLTXB_V10: case NSPR_PDPKTRACEFULLRX_V10: + wth->phdr.presence_flags = WTAP_HAS_TS; + nsg_creltime += ns_hrtime2nsec(pletohl(&fp->fp_RelTimeHr)); wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000); wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000); @@ -724,6 +726,8 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of case NSPR_PDPKTRACEPARTTXB_V10: case NSPR_PDPKTRACEPARTRX_V10: + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + nsg_creltime += ns_hrtime2nsec(pletohl(&pp->pp_RelTimeHr)); wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000); wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000); @@ -777,6 +781,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of #define TIMEDEFV20(fp,type) \ do {\ + wth->phdr.presence_flags |= WTAP_HAS_TS;\ nsg_creltime += ns_hrtime2nsec(pletohl(fp->type##_RelTimeHr));\ wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);\ wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);\ @@ -784,6 +789,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of #define TIMEDEFV23(fp,type) \ do {\ + wth->phdr.presence_flags |= WTAP_HAS_TS;\ /* access _AbsTimeHr as a 64bit value */\ nsg_creltime = pletohll(fp->type##_AbsTimeHr);\ wth->phdr.ts.secs = (guint32) (nsg_creltime / 1000000000);\ @@ -795,6 +801,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of #define PPSIZEDEFV20(pp,ver) \ do {\ + wth->phdr.presence_flags |= WTAP_HAS_CAP_LEN;\ wth->phdr.len = pletohs(&pp->pp_PktSizeOrg) + nspr_pktracepart_v##ver##_s;\ wth->phdr.caplen = nspr_getv20recordsize((nspr_hd_v20_t *)pp);\ }while(0) diff --git a/wiretap/netscreen.c b/wiretap/netscreen.c index e3c29e70f3..d5011c84ce 100644 --- a/wiretap/netscreen.c +++ b/wiretap/netscreen.c @@ -233,6 +233,8 @@ static gboolean netscreen_read(wtap *wth, int *err, gchar **err_info, if (offset < 0) return FALSE; + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + /* Parse the header */ pkt_len = parse_netscreen_rec_hdr(wth, line, cap_int, &cap_dir, cap_dst, &wth->pseudo_header, err, err_info); diff --git a/wiretap/nettl.c b/wiretap/nettl.c index 735fe9edf7..83868011bf 100644 --- a/wiretap/nettl.c +++ b/wiretap/nettl.c @@ -640,6 +640,7 @@ nettl_read_rec_header(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr, length, padlen); return -1; } + phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; phdr->len = length - padlen; if (caplen < padlen) { *err = WTAP_ERR_BAD_FILE; diff --git a/wiretap/network_instruments.c b/wiretap/network_instruments.c index a574934a22..7ffa513cd7 100644 --- a/wiretap/network_instruments.c +++ b/wiretap/network_instruments.c @@ -303,6 +303,7 @@ static gboolean observer_read(wtap *wth, int *err, gchar **err_info, } /* set the wiretap packet header fields */ + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.pkt_encap = observer_to_wtap_encap(packet_header.network_type); if(wth->file_encap == WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS) { wth->phdr.len = packet_header.network_size; diff --git a/wiretap/netxray.c b/wiretap/netxray.c index f7285fd7ca..231c877b7f 100644 --- a/wiretap/netxray.c +++ b/wiretap/netxray.c @@ -1008,6 +1008,7 @@ reread: &wth->pseudo_header, &hdr); if (netxray->version_major == 0) { + wth->phdr.presence_flags = WTAP_HAS_TS; t = (double)pletohl(&hdr.old_hdr.timelo) + (double)pletohl(&hdr.old_hdr.timehi)*4294967296.0; t /= netxray->ticks_per_sec; @@ -1022,6 +1023,7 @@ reread: wth->phdr.caplen = packet_size - padding; wth->phdr.len = wth->phdr.caplen; } else { + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; t = (double)pletohl(&hdr.hdr_1_x.timelo) + (double)pletohl(&hdr.hdr_1_x.timehi)*4294967296.0; t /= netxray->ticks_per_sec; diff --git a/wiretap/ngsniffer.c b/wiretap/ngsniffer.c index 211ddbb90e..0529cf4c60 100644 --- a/wiretap/ngsniffer.c +++ b/wiretap/ngsniffer.c @@ -1198,6 +1198,7 @@ found: return FALSE; } + wth->phdr.presence_flags = true_size ? WTAP_HAS_TS|WTAP_HAS_CAP_LEN : WTAP_HAS_TS; wth->phdr.len = true_size ? true_size : size; wth->phdr.caplen = size; diff --git a/wiretap/packetlogger.c b/wiretap/packetlogger.c index 7e03b79a52..e8435698d7 100644 --- a/wiretap/packetlogger.c +++ b/wiretap/packetlogger.c @@ -131,6 +131,8 @@ packetlogger_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) wth->data_offset += (pl_hdr.len + 4); + wth->phdr.presence_flags = WTAP_HAS_TS; + wth->phdr.len = pl_hdr.len - 8; wth->phdr.caplen = pl_hdr.len - 8; diff --git a/wiretap/pcapng.c b/wiretap/pcapng.c index f1f1942cb6..12b9cf667b 100644 --- a/wiretap/pcapng.c +++ b/wiretap/pcapng.c @@ -2027,6 +2027,14 @@ pcapng_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) id = (gint)wblock.data.packet.interface_id; int_data = g_array_index(pcapng->interface_data, interface_data_t, id); time_units_per_second = int_data.time_units_per_second; + /* XXX - not WTAP_HAS_TS for an SPB */ + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN|WTAP_HAS_INTERFACE_ID; + if (wblock.data.packet.opt_comment != NULL) + wth->phdr.presence_flags |= WTAP_HAS_COMMENTS; + /* XXX - only if the option is present, for an EPB */ + wth->phdr.presence_flags |= WTAP_HAS_DROP_COUNT; + /* XXX - only if the option is present */ + wth->phdr.presence_flags |= WTAP_HAS_PACK_FLAGS; wth->phdr.pkt_encap = int_data.wtap_encap; wth->phdr.ts.secs = (time_t)(ts / time_units_per_second); wth->phdr.ts.nsecs = (int)(((ts % time_units_per_second) * 1000000000) / time_units_per_second); diff --git a/wiretap/pppdump.c b/wiretap/pppdump.c index 46465bca7a..84cbadd92d 100644 --- a/wiretap/pppdump.c +++ b/wiretap/pppdump.c @@ -356,6 +356,7 @@ pppdump_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset) *data_offset = state->pkt_cnt; state->pkt_cnt++; + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.len = num_bytes; wth->phdr.caplen = num_bytes; wth->phdr.ts.secs = state->timestamp; diff --git a/wiretap/radcom.c b/wiretap/radcom.c index a4fe9b30e6..a81d72ccf0 100644 --- a/wiretap/radcom.c +++ b/wiretap/radcom.c @@ -308,6 +308,8 @@ static gboolean radcom_read(wtap *wth, int *err, gchar **err_info, real_length -= 2; } + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + wth->phdr.len = real_length; wth->phdr.caplen = length; diff --git a/wiretap/snoop.c b/wiretap/snoop.c index c284465ee1..a0296db139 100644 --- a/wiretap/snoop.c +++ b/wiretap/snoop.c @@ -591,6 +591,7 @@ static gboolean snoop_read(wtap *wth, int *err, gchar **err_info, return FALSE; /* Read error */ wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.ts.secs = g_ntohl(hdr.ts_sec); wth->phdr.ts.nsecs = g_ntohl(hdr.ts_usec) * 1000; wth->phdr.caplen = packet_size; diff --git a/wiretap/tnef.c b/wiretap/tnef.c index d43ffc9270..f7772509d0 100644 --- a/wiretap/tnef.c +++ b/wiretap/tnef.c @@ -40,7 +40,6 @@ static gboolean tnef_read(wtap *wth, int *err, gchar **err_info, gint64 *data_of guint8 *buf; gint64 file_size; int packet_size; - ws_statb64 statb; *err = 0; @@ -72,13 +71,12 @@ static gboolean tnef_read(wtap *wth, int *err, gchar **err_info, gint64 *data_of wth->data_offset += packet_size; + wth->phdr.presence_flags = 0; /* no time stamp, no "real length" */ + wth->phdr.caplen = packet_size; wth->phdr.len = packet_size; - if (wtap_fstat(wth, &statb, err) == -1) - return FALSE; - - wth->phdr.ts.secs = statb.st_mtime; + wth->phdr.ts.secs = 0; wth->phdr.ts.nsecs = 0; return TRUE; diff --git a/wiretap/toshiba.c b/wiretap/toshiba.c index 921bd988aa..7f29072636 100644 --- a/wiretap/toshiba.c +++ b/wiretap/toshiba.c @@ -355,6 +355,7 @@ parse_toshiba_rec_hdr(wtap *wth, FILE_T fh, } if (wth) { + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; wth->phdr.ts.secs = hr * 3600 + min * 60 + sec; wth->phdr.ts.nsecs = csec * 10000000; wth->phdr.caplen = pkt_len; diff --git a/wiretap/visual.c b/wiretap/visual.c index e516f14e64..de10c33f43 100644 --- a/wiretap/visual.c +++ b/wiretap/visual.c @@ -379,6 +379,8 @@ static gboolean visual_read(wtap *wth, int *err, gchar **err_info, } wth->data_offset += packet_size; + wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN; + /* Set the packet time and length. */ t = visual->start_time; t += ((double)pletohl(&vpkt_hdr.ts_delta))*1000; diff --git a/wiretap/vms.c b/wiretap/vms.c index 109b20964d..2b02dbf0d0 100644 --- a/wiretap/vms.c +++ b/wiretap/vms.c @@ -444,6 +444,7 @@ parse_vms_rec_hdr(wtap *wth, FILE_T fh, int *err, gchar **err_info) tm.tm_year -= 1900; tm.tm_isdst = -1; + wth->phdr.presence_flags = WTAP_HAS_TS; wth->phdr.ts.secs = mktime(&tm); wth->phdr.ts.nsecs = csec * 10000000; wth->phdr.caplen = pkt_len; diff --git a/wiretap/wtap.h b/wiretap/wtap.h index 10c498c55f..1f0a23baac 100644 --- a/wiretap/wtap.h +++ b/wiretap/wtap.h @@ -821,18 +821,46 @@ struct wtap_nstime { }; struct wtap_pkthdr { + guint32 presence_flags; /* what stuff do we have? */ struct wtap_nstime ts; - guint32 caplen; /* data length in the file */ - guint32 len; /* data length on the wire */ - int pkt_encap; + guint32 caplen; /* data length in the file */ + guint32 len; /* data length on the wire */ + int pkt_encap; /* pcapng variables */ - guint32 interface_id; /* identifier of the interface. */ + guint32 interface_id; /* identifier of the interface. */ /* options */ - gchar *opt_comment; /* NULL if not available */ - guint64 drop_count; /* number of packets lost (by the interface and the operating system) between this packet and the preceding one. */ - guint32 pack_flags; /* XXX - 0 for now (any value for "we don't have it"?) */ + gchar *opt_comment; /* NULL if not available */ + guint64 drop_count; /* number of packets lost (by the interface and the operating system) between this packet and the preceding one. */ + guint32 pack_flags; /* XXX - 0 for now (any value for "we don't have it"?) */ }; +/* + * Bits in presence_flags, indicating which of the fields we have. + * + * For the time stamp, we may need some more flags to indicate + * whether the time stamp is an absolute date-and-time stamp, an + * absolute time-only stamp (which can make relative time + * calculations tricky, as you could in theory have two time + * stamps separated by an unknown number of days), or a time stamp + * relative to some unspecified time in the past (see mpeg.c). + * + * There is no presence flag for len - there has to be *some* length + * value for the packet. (The "captured length" can be missing if + * the file format doesn't report a captured length distinct from + * the on-the-network length because the application(s) producing those + * files don't support slicing packets.) + * + * There could be a presence flag for the packet encapsulation - if it's + * absent, use the file encapsulation - but it's not clear that's useful; + * we currently do that in the module for the file format. + */ +#define WTAP_HAS_TS 0x00000001 /* time stamp */ +#define WTAP_HAS_CAP_LEN 0x00000002 /* captured length separate from on-the-network length */ +#define WTAP_HAS_INTERFACE_ID 0x00000004 /* interface ID */ +#define WTAP_HAS_COMMENTS 0x00000008 /* comments */ +#define WTAP_HAS_DROP_COUNT 0x00000010 /* drop count */ +#define WTAP_HAS_PACK_FLAGS 0x00000020 /* packet flags */ + /** * Holds the option strings from pcapng:s Section Header block(SHB). */ |