The Tcpdump Group git mirrors - libpcap/blob - savefile.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * savefile.c - supports offline use of tcpdump
  22  *      Extraction/creation by Jeffrey Mogul, DECWRL
  23  *      Modified by Steve McCanne, LBL.
  24  *
  25  * Used to save the received packet headers, after filtering, to
  26  * a file, and then read them later.
  27  * The first record in the file contains saved values for the machine
  28  * dependent values so we can print the dump file on any architecture.
  29  */
  30
  31 #ifndef lint
  32 static const char rcsid[] =
  33     "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.39 2000-04-27 09:11:14 itojun Exp $ (LBL)";
  34 #endif
  35
  36 #include <sys/types.h>
  37 #include <sys/time.h>
  38
  39 #include <errno.h>
  40 #include <memory.h>
  41 #include <stdio.h>
  42 #include <stdlib.h>
  43 #include <unistd.h>
  44
  45 #include "pcap-int.h"
  46
  47 #include "gnuc.h"
  48 #ifdef HAVE_OS_PROTO_H
  49 #include "os-proto.h"
  50 #endif
  51
  52 #define TCPDUMP_MAGIC 0xa1b2c3d4
  53
  54 /*
  55  * We use the "receiver-makes-right" approach to byte order,
  56  * because time is at a premium when we are writing the file.
  57  * In other words, the pcap_file_header and pcap_pkthdr,
  58  * records are written in host byte order.
  59  * Note that the packets are always written in network byte order.
  60  *
  61  * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
  62  * machine (if the file was written in little-end order).
  63  */
  64 #define SWAPLONG(y) \
  65 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
  66 #define SWAPSHORT(y) \
  67         ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
  68
  69 #define SFERR_TRUNC             1
  70 #define SFERR_BADVERSION        2
  71 #define SFERR_BADF              3
  72 #define SFERR_EOF               4 /* not really an error, just a status */
  73
  74 static int
  75 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
  76 {
  77         struct pcap_file_header hdr;
  78
  79         hdr.magic = TCPDUMP_MAGIC;
  80         hdr.version_major = PCAP_VERSION_MAJOR;
  81         hdr.version_minor = PCAP_VERSION_MINOR;
  82
  83         hdr.thiszone = thiszone;
  84         hdr.snaplen = snaplen;
  85         hdr.sigfigs = 0;
  86         hdr.linktype = linktype;
  87
  88         if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
  89                 return (-1);
  90
  91         return (0);
  92 }
  93
  94 static void
  95 swap_hdr(struct pcap_file_header *hp)
  96 {
  97         hp->version_major = SWAPSHORT(hp->version_major);
  98         hp->version_minor = SWAPSHORT(hp->version_minor);
  99         hp->thiszone = SWAPLONG(hp->thiszone);
 100         hp->sigfigs = SWAPLONG(hp->sigfigs);
 101         hp->snaplen = SWAPLONG(hp->snaplen);
 102         hp->linktype = SWAPLONG(hp->linktype);
 103 }
 104
 105 pcap_t *
 106 pcap_open_offline(const char *fname, char *errbuf)
 107 {
 108         register pcap_t *p;
 109         register FILE *fp;
 110         struct pcap_file_header hdr;
 111         int linklen;
 112
 113         p = (pcap_t *)malloc(sizeof(*p));
 114         if (p == NULL) {
 115                 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
 116                 return (NULL);
 117         }
 118
 119         memset((char *)p, 0, sizeof(*p));
 120         /*
 121          * Set this field so we don't close stdin in pcap_close!
 122          */
 123         p->fd = -1;
 124
 125         if (fname[0] == '-' && fname[1] == '\0')
 126                 fp = stdin;
 127         else {
 128                 fp = fopen(fname, "r");
 129                 if (fp == NULL) {
 130                         snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", fname,
 131                             pcap_strerror(errno));
 132                         goto bad;
 133                 }
 134         }
 135         if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
 136                 snprintf(errbuf, PCAP_ERRBUF_SIZE, "fread: %s",
 137                     pcap_strerror(errno));
 138                 goto bad;
 139         }
 140         if (hdr.magic != TCPDUMP_MAGIC) {
 141                 if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) {
 142                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
 143                             "bad dump file format");
 144                         goto bad;
 145                 }
 146                 p->sf.swapped = 1;
 147                 swap_hdr(&hdr);
 148         }
 149         if (hdr.version_major < PCAP_VERSION_MAJOR) {
 150                 snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format");
 151                 goto bad;
 152         }
 153         p->tzoff = hdr.thiszone;
 154         p->snapshot = hdr.snaplen;
 155         p->linktype = hdr.linktype;
 156         p->sf.rfile = fp;
 157         p->bufsize = hdr.snaplen;
 158
 159         /* Align link header as required for proper data alignment */
 160         /* XXX should handle all types */
 161         switch (p->linktype) {
 162
 163         case DLT_EN10MB:
 164                 linklen = 14;
 165                 break;
 166
 167         case DLT_FDDI:
 168                 linklen = 13 + 8;       /* fddi_header + llc */
 169                 break;
 170
 171         case DLT_NULL:
 172         default:
 173                 linklen = 0;
 174                 break;
 175         }
 176
 177         if (p->bufsize < 0)
 178                 p->bufsize = BPF_MAXBUFSIZE;
 179         p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
 180         if (p->sf.base == NULL) {
 181                 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
 182                 goto bad;
 183         }
 184         p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
 185         p->sf.version_major = hdr.version_major;
 186         p->sf.version_minor = hdr.version_minor;
 187 #ifdef PCAP_FDDIPAD
 188         /* XXX padding only needed for kernel fcode */
 189         pcap_fddipad = 0;
 190 #endif
 191
 192         return (p);
 193  bad:
 194         free(p);
 195         return (NULL);
 196 }
 197
 198 /*
 199  * Read sf_readfile and return the next packet.  Return the header in hdr
 200  * and the contents in buf.  Return 0 on success, SFERR_EOF if there were
 201  * no more packets, and SFERR_TRUNC if a partial packet was encountered.
 202  */
 203 static int
 204 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen)
 205 {
 206         struct pcap_sf_pkthdr sf_hdr;
 207         FILE *fp = p->sf.rfile;
 208
 209         /* read the stamp */
 210         if (fread(&sf_hdr, sizeof(struct pcap_sf_pkthdr), 1, fp) != 1) {
 211                 /* probably an EOF, though could be a truncated packet */
 212                 return (1);
 213         }
 214
 215         if (p->sf.swapped) {
 216                 /* these were written in opposite byte order */
 217                 hdr->caplen = SWAPLONG(sf_hdr.caplen);
 218                 hdr->len = SWAPLONG(sf_hdr.len);
 219                 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
 220                 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
 221         } else {
 222                 hdr->caplen = sf_hdr.caplen;
 223                 hdr->len = sf_hdr.len;
 224                 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
 225                 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
 226         }
 227         /*
 228          * We interchanged the caplen and len fields at version 2.3,
 229          * in order to match the bpf header layout.  But unfortunately
 230          * some files were written with version 2.3 in their headers
 231          * but without the interchanged fields.
 232          */
 233         if (p->sf.version_minor < 3 ||
 234             (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) {
 235                 int t = hdr->caplen;
 236                 hdr->caplen = hdr->len;
 237                 hdr->len = t;
 238         }
 239
 240         if (hdr->caplen > buflen) {
 241                 /*
 242                  * This can happen due to Solaris 2.3 systems tripping
 243                  * over the BUFMOD problem and not setting the snapshot
 244                  * correctly in the savefile header.  If the caplen isn't
 245                  * grossly wrong, try to salvage.
 246                  */
 247                 static u_char *tp = NULL;
 248                 static int tsize = 0;
 249
 250                 if (hdr->caplen > 65535) {
 251                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 252                             "bogus savefile header");
 253                         return (-1);
 254                 }
 255
 256                 if (tsize < hdr->caplen) {
 257                         tsize = ((hdr->caplen + 1023) / 1024) * 1024;
 258                         if (tp != NULL)
 259                                 free((u_char *)tp);
 260                         tp = (u_char *)malloc(tsize);
 261                         if (tp == NULL) {
 262                                 tsize = 0;
 263                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 264                                     "BUFMOD hack malloc");
 265                                 return (-1);
 266                         }
 267                 }
 268                 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
 269                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 270                             "truncated dump file");
 271                         return (-1);
 272                 }
 273                 /*
 274                  * We can only keep up to buflen bytes.  Since caplen > buflen
 275                  * is exactly how we got here, we know we can only keep the
 276                  * first buflen bytes and must drop the remainder.  Adjust
 277                  * caplen accordingly, so we don't get confused later as
 278                  * to how many bytes we have to play with.
 279                  */
 280                 hdr->caplen = buflen;
 281                 memcpy((char *)buf, (char *)tp, buflen);
 282
 283         } else {
 284                 /* read the packet itself */
 285
 286                 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
 287                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 288                             "truncated dump file");
 289                         return (-1);
 290                 }
 291         }
 292         return (0);
 293 }
 294
 295 /*
 296  * Print out packets stored in the file initialized by sf_read_init().
 297  * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
 298  */
 299 int
 300 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 301 {
 302         struct bpf_insn *fcode = p->fcode.bf_insns;
 303         int status = 0;
 304         int n = 0;
 305
 306         while (status == 0) {
 307                 struct pcap_pkthdr h;
 308
 309                 status = sf_next_packet(p, &h, p->buffer, p->bufsize);
 310                 if (status) {
 311                         if (status == 1)
 312                                 return (0);
 313                         return (status);
 314                 }
 315
 316                 if (fcode == NULL ||
 317                     bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
 318                         (*callback)(user, &h, p->buffer);
 319                         if (++n >= cnt && cnt > 0)
 320                                 break;
 321                 }
 322         }
 323         /*XXX this breaks semantics tcpslice expects */
 324         return (n);
 325 }
 326
 327 /*
 328  * Output a packet to the initialized dump file.
 329  */
 330 void
 331 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 332 {
 333         register FILE *f;
 334         struct pcap_sf_pkthdr sf_hdr;
 335
 336         f = (FILE *)user;
 337         sf_hdr.ts.tv_sec  = h->ts.tv_sec;
 338         sf_hdr.ts.tv_usec = h->ts.tv_usec;
 339         sf_hdr.caplen     = h->caplen;
 340         sf_hdr.len        = h->len;
 341         /* XXX we should check the return status */
 342         (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
 343         (void)fwrite((char *)sp, h->caplen, 1, f);
 344 }
 345
 346 /*
 347  * Initialize so that sf_write() will output to the file named 'fname'.
 348  */
 349 pcap_dumper_t *
 350 pcap_dump_open(pcap_t *p, const char *fname)
 351 {
 352         FILE *f;
 353         if (fname[0] == '-' && fname[1] == '\0')
 354                 f = stdout;
 355         else {
 356                 f = fopen(fname, "w");
 357                 if (f == NULL) {
 358                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
 359                             fname, pcap_strerror(errno));
 360                         return (NULL);
 361                 }
 362         }
 363         (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot);
 364         return ((pcap_dumper_t *)f);
 365 }
 366
 367 void
 368 pcap_dump_close(pcap_dumper_t *p)
 369 {
 370
 371 #ifdef notyet
 372         if (ferror((FILE *)p))
 373                 return-an-error;
 374         /* XXX should check return from fclose() too */
 375 #endif
 376         (void)fclose((FILE *)p);
 377 }