The Tcpdump Group git mirrors - libpcap/blob - sf-pcap.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * sf-pcap.c - libpcap-file-format-specific code from savefile.c
  22  *      Extraction/creation by Jeffrey Mogul, DECWRL
  23  *      Modified by Steve McCanne, LBL.
  24  *
  25  * Used to save the received packet headers, after filtering, to
  26  * a file, and then read them later.
  27  * The first record in the file contains saved values for the machine
  28  * dependent values so we can print the dump file on any architecture.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 #include <config.h>
  33 #endif
  34
  35 #include <pcap-types.h>
  36 #ifdef _WIN32
  37 #include <io.h>
  38 #include <fcntl.h>
  39 #endif /* _WIN32 */
  40
  41 #include <errno.h>
  42 #include <memory.h>
  43 #include <stdio.h>
  44 #include <stdlib.h>
  45 #include <string.h>
  46
  47 #include "pcap-int.h"
  48
  49 #include "pcap-common.h"
  50
  51 #ifdef HAVE_OS_PROTO_H
  52 #include "os-proto.h"
  53 #endif
  54
  55 #include "sf-pcap.h"
  56
  57 /*
  58  * Setting O_BINARY on DOS/Windows is a bit tricky
  59  */
  60 #if defined(_WIN32)
  61   #define SET_BINMODE(f)  _setmode(_fileno(f), _O_BINARY)
  62 #elif defined(MSDOS)
  63   #if defined(__HIGHC__)
  64   #define SET_BINMODE(f)  setmode(f, O_BINARY)
  65   #else
  66   #define SET_BINMODE(f)  setmode(fileno(f), O_BINARY)
  67   #endif
  68 #endif
  69
  70 /*
  71  * Standard libpcap format.
  72  */
  73 #define TCPDUMP_MAGIC           0xa1b2c3d4
  74
  75 /*
  76  * Alexey Kuznetzov's modified libpcap format.
  77  */
  78 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
  79
  80 /*
  81  * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
  82  * for another modified format.
  83  */
  84 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
  85
  86 /*
  87  * Navtel Communcations' format, with nanosecond timestamps,
  88  * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
  89  */
  90 #define NAVTEL_TCPDUMP_MAGIC    0xa12b3c4d
  91
  92 /*
  93  * Normal libpcap format, except for seconds/nanoseconds timestamps,
  94  * as per a request by Ulf Lamping <ulf.lamping@web.de>
  95  */
  96 #define NSEC_TCPDUMP_MAGIC      0xa1b23c4d
  97
  98 /*
  99  * Mechanism for storing information about a capture in the upper
 100  * 6 bits of a linktype value in a capture file.
 101  *
 102  * LT_LINKTYPE_EXT(x) extracts the additional information.
 103  *
 104  * The rest of the bits are for a value describing the link-layer
 105  * value.  LT_LINKTYPE(x) extracts that value.
 106  */
 107 #define LT_LINKTYPE(x)          ((x) & 0x03FFFFFF)
 108 #define LT_LINKTYPE_EXT(x)      ((x) & 0xFC000000)
 109
 110 static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
 111
 112 /*
 113  * Private data for reading pcap savefiles.
 114  */
 115 typedef enum {
 116         NOT_SWAPPED,
 117         SWAPPED,
 118         MAYBE_SWAPPED
 119 } swapped_type_t;
 120
 121 typedef enum {
 122         PASS_THROUGH,
 123         SCALE_UP,
 124         SCALE_DOWN
 125 } tstamp_scale_type_t;
 126
 127 struct pcap_sf {
 128         size_t hdrsize;
 129         swapped_type_t lengths_swapped;
 130         tstamp_scale_type_t scale_type;
 131 };
 132
 133 /*
 134  * Check whether this is a pcap savefile and, if it is, extract the
 135  * relevant information from the header.
 136  */
 137 pcap_t *
 138 pcap_check_header(bpf_u_int32 magic, FILE *fp, u_int precision, char *errbuf,
 139                   int *err)
 140 {
 141         struct pcap_file_header hdr;
 142         size_t amt_read;
 143         pcap_t *p;
 144         int swapped = 0;
 145         struct pcap_sf *ps;
 146
 147         /*
 148          * Assume no read errors.
 149          */
 150         *err = 0;
 151
 152         /*
 153          * Check whether the first 4 bytes of the file are the magic
 154          * number for a pcap savefile, or for a byte-swapped pcap
 155          * savefile.
 156          */
 157         if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC &&
 158             magic != NSEC_TCPDUMP_MAGIC) {
 159                 magic = SWAPLONG(magic);
 160                 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC &&
 161                     magic != NSEC_TCPDUMP_MAGIC)
 162                         return (NULL);  /* nope */
 163                 swapped = 1;
 164         }
 165
 166         /*
 167          * They are.  Put the magic number in the header, and read
 168          * the rest of the header.
 169          */
 170         hdr.magic = magic;
 171         amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
 172             sizeof(hdr) - sizeof(hdr.magic), fp);
 173         if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
 174                 if (ferror(fp)) {
 175                         pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
 176                             errno, "error reading dump file");
 177                 } else {
 178                         pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 179                             "truncated dump file; tried to read %lu file header bytes, only got %lu",
 180                             (unsigned long)sizeof(hdr),
 181                             (unsigned long)amt_read);
 182                 }
 183                 *err = 1;
 184                 return (NULL);
 185         }
 186
 187         /*
 188          * If it's a byte-swapped capture file, byte-swap the header.
 189          */
 190         if (swapped) {
 191                 hdr.version_major = SWAPSHORT(hdr.version_major);
 192                 hdr.version_minor = SWAPSHORT(hdr.version_minor);
 193                 hdr.thiszone = SWAPLONG(hdr.thiszone);
 194                 hdr.sigfigs = SWAPLONG(hdr.sigfigs);
 195                 hdr.snaplen = SWAPLONG(hdr.snaplen);
 196                 hdr.linktype = SWAPLONG(hdr.linktype);
 197         }
 198
 199         if (hdr.version_major < PCAP_VERSION_MAJOR) {
 200                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 201                     "archaic pcap savefile format");
 202                 *err = 1;
 203                 return (NULL);
 204         }
 205
 206         /*
 207          * currently only versions 2.[0-4] are supported with
 208          * the exception of 543.0 for DG/UX tcpdump.
 209          */
 210         if (! ((hdr.version_major == PCAP_VERSION_MAJOR &&
 211                 hdr.version_minor <= PCAP_VERSION_MINOR) ||
 212                (hdr.version_major == 543 &&
 213                 hdr.version_minor == 0))) {
 214                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 215                          "unsupported pcap savefile version %u.%u",
 216                          hdr.version_major, hdr.version_minor);
 217                 *err = 1;
 218                 return NULL;
 219         }
 220
 221         /*
 222          * OK, this is a good pcap file.
 223          * Allocate a pcap_t for it.
 224          */
 225         p = pcap_open_offline_common(errbuf, sizeof (struct pcap_sf));
 226         if (p == NULL) {
 227                 /* Allocation failed. */
 228                 *err = 1;
 229                 return (NULL);
 230         }
 231         p->swapped = swapped;
 232         p->version_major = hdr.version_major;
 233         p->version_minor = hdr.version_minor;
 234         p->tzoff = hdr.thiszone;
 235         p->snapshot = hdr.snaplen;
 236         if (p->snapshot <= 0) {
 237                 /*
 238                  * Bogus snapshot length; use the maximum for this
 239                  * link-layer type as a fallback.
 240                  *
 241                  * XXX - the only reason why snapshot is signed is
 242                  * that pcap_snapshot() returns an int, not an
 243                  * unsigned int.
 244                  */
 245                 p->snapshot = max_snaplen_for_dlt(hdr.linktype);
 246         }
 247         p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
 248         p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
 249
 250         p->next_packet_op = pcap_next_packet;
 251
 252         ps = p->priv;
 253
 254         p->opt.tstamp_precision = precision;
 255
 256         /*
 257          * Will we need to scale the timestamps to match what the
 258          * user wants?
 259          */
 260         switch (precision) {
 261
 262         case PCAP_TSTAMP_PRECISION_MICRO:
 263                 if (magic == NSEC_TCPDUMP_MAGIC) {
 264                         /*
 265                          * The file has nanoseconds, the user
 266                          * wants microseconds; scale the
 267                          * precision down.
 268                          */
 269                         ps->scale_type = SCALE_DOWN;
 270                 } else {
 271                         /*
 272                          * The file has microseconds, the
 273                          * user wants microseconds; nothing to do.
 274                          */
 275                         ps->scale_type = PASS_THROUGH;
 276                 }
 277                 break;
 278
 279         case PCAP_TSTAMP_PRECISION_NANO:
 280                 if (magic == NSEC_TCPDUMP_MAGIC) {
 281                         /*
 282                          * The file has nanoseconds, the
 283                          * user wants nanoseconds; nothing to do.
 284                          */
 285                         ps->scale_type = PASS_THROUGH;
 286                 } else {
 287                         /*
 288                          * The file has microoseconds, the user
 289                          * wants nanoseconds; scale the
 290                          * precision up.
 291                          */
 292                         ps->scale_type = SCALE_UP;
 293                 }
 294                 break;
 295
 296         default:
 297                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 298                     "unknown time stamp resolution %u", precision);
 299                 free(p);
 300                 *err = 1;
 301                 return (NULL);
 302         }
 303
 304         /*
 305          * We interchanged the caplen and len fields at version 2.3,
 306          * in order to match the bpf header layout.  But unfortunately
 307          * some files were written with version 2.3 in their headers
 308          * but without the interchanged fields.
 309          *
 310          * In addition, DG/UX tcpdump writes out files with a version
 311          * number of 543.0, and with the caplen and len fields in the
 312          * pre-2.3 order.
 313          */
 314         switch (hdr.version_major) {
 315
 316         case 2:
 317                 if (hdr.version_minor < 3)
 318                         ps->lengths_swapped = SWAPPED;
 319                 else if (hdr.version_minor == 3)
 320                         ps->lengths_swapped = MAYBE_SWAPPED;
 321                 else
 322                         ps->lengths_swapped = NOT_SWAPPED;
 323                 break;
 324
 325         case 543:
 326                 ps->lengths_swapped = SWAPPED;
 327                 break;
 328
 329         default:
 330                 ps->lengths_swapped = NOT_SWAPPED;
 331                 break;
 332         }
 333
 334         if (magic == KUZNETZOV_TCPDUMP_MAGIC) {
 335                 /*
 336                  * XXX - the patch that's in some versions of libpcap
 337                  * changes the packet header but not the magic number,
 338                  * and some other versions with this magic number have
 339                  * some extra debugging information in the packet header;
 340                  * we'd have to use some hacks^H^H^H^H^Hheuristics to
 341                  * detect those variants.
 342                  *
 343                  * Ethereal does that, but it does so by trying to read
 344                  * the first two packets of the file with each of the
 345                  * record header formats.  That currently means it seeks
 346                  * backwards and retries the reads, which doesn't work
 347                  * on pipes.  We want to be able to read from a pipe, so
 348                  * that strategy won't work; we'd have to buffer some
 349                  * data ourselves and read from that buffer in order to
 350                  * make that work.
 351                  */
 352                 ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
 353
 354                 if (p->linktype == DLT_EN10MB) {
 355                         /*
 356                          * This capture might have been done in raw mode
 357                          * or cooked mode.
 358                          *
 359                          * If it was done in cooked mode, p->snapshot was
 360                          * passed to recvfrom() as the buffer size, meaning
 361                          * that the most packet data that would be copied
 362                          * would be p->snapshot.  However, a faked Ethernet
 363                          * header would then have been added to it, so the
 364                          * most data that would be in a packet in the file
 365                          * would be p->snapshot + 14.
 366                          *
 367                          * We can't easily tell whether the capture was done
 368                          * in raw mode or cooked mode, so we'll assume it was
 369                          * cooked mode, and add 14 to the snapshot length.
 370                          * That means that, for a raw capture, the snapshot
 371                          * length will be misleading if you use it to figure
 372                          * out why a capture doesn't have all the packet data,
 373                          * but there's not much we can do to avoid that.
 374                          */
 375                         p->snapshot += 14;
 376                 }
 377         } else
 378                 ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
 379
 380         /*
 381          * Allocate a buffer for the packet data.
 382          * Choose the minimum of the file's snapshot length and 2K bytes;
 383          * that should be enough for most network packets - we'll grow it
 384          * if necessary.  That way, we don't allocate a huge chunk of
 385          * memory just because there's a huge snapshot length, as the
 386          * snapshot length might be larger than the size of the largest
 387          * packet.
 388          */
 389         p->bufsize = p->snapshot;
 390         if (p->bufsize > 2048)
 391                 p->bufsize = 2048;
 392         p->buffer = malloc(p->bufsize);
 393         if (p->buffer == NULL) {
 394                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
 395                 free(p);
 396                 *err = 1;
 397                 return (NULL);
 398         }
 399
 400         p->cleanup_op = sf_cleanup;
 401
 402         return (p);
 403 }
 404
 405 /*
 406  * Grow the packet buffer to the specified size.
 407  */
 408 static int
 409 grow_buffer(pcap_t *p, u_int bufsize)
 410 {
 411         void *bigger_buffer;
 412
 413         bigger_buffer = realloc(p->buffer, bufsize);
 414         if (bigger_buffer == NULL) {
 415                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "out of memory");
 416                 return (0);
 417         }
 418         p->buffer = bigger_buffer;
 419         p->bufsize = bufsize;
 420         return (1);
 421 }
 422
 423 /*
 424  * Read and return the next packet from the savefile.  Return the header
 425  * in hdr and a pointer to the contents in data.  Return 0 on success, 1
 426  * if there were no more packets, and -1 on an error.
 427  */
 428 static int
 429 pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
 430 {
 431         struct pcap_sf *ps = p->priv;
 432         struct pcap_sf_patched_pkthdr sf_hdr;
 433         FILE *fp = p->rfile;
 434         size_t amt_read;
 435         bpf_u_int32 t;
 436
 437         /*
 438          * Read the packet header; the structure we use as a buffer
 439          * is the longer structure for files generated by the patched
 440          * libpcap, but if the file has the magic number for an
 441          * unpatched libpcap we only read as many bytes as the regular
 442          * header has.
 443          */
 444         amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
 445         if (amt_read != ps->hdrsize) {
 446                 if (ferror(fp)) {
 447                         pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 448                             errno, "error reading dump file");
 449                         return (-1);
 450                 } else {
 451                         if (amt_read != 0) {
 452                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 453                                     "truncated dump file; tried to read %lu header bytes, only got %lu",
 454                                     (unsigned long)ps->hdrsize,
 455                                     (unsigned long)amt_read);
 456                                 return (-1);
 457                         }
 458                         /* EOF */
 459                         return (1);
 460                 }
 461         }
 462
 463         if (p->swapped) {
 464                 /* these were written in opposite byte order */
 465                 hdr->caplen = SWAPLONG(sf_hdr.caplen);
 466                 hdr->len = SWAPLONG(sf_hdr.len);
 467                 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
 468                 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
 469         } else {
 470                 hdr->caplen = sf_hdr.caplen;
 471                 hdr->len = sf_hdr.len;
 472                 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
 473                 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
 474         }
 475
 476         switch (ps->scale_type) {
 477
 478         case PASS_THROUGH:
 479                 /*
 480                  * Just pass the time stamp through.
 481                  */
 482                 break;
 483
 484         case SCALE_UP:
 485                 /*
 486                  * File has microseconds, user wants nanoseconds; convert
 487                  * it.
 488                  */
 489                 hdr->ts.tv_usec = hdr->ts.tv_usec * 1000;
 490                 break;
 491
 492         case SCALE_DOWN:
 493                 /*
 494                  * File has nanoseconds, user wants microseconds; convert
 495                  * it.
 496                  */
 497                 hdr->ts.tv_usec = hdr->ts.tv_usec / 1000;
 498                 break;
 499         }
 500
 501         /* Swap the caplen and len fields, if necessary. */
 502         switch (ps->lengths_swapped) {
 503
 504         case NOT_SWAPPED:
 505                 break;
 506
 507         case MAYBE_SWAPPED:
 508                 if (hdr->caplen <= hdr->len) {
 509                         /*
 510                          * The captured length is <= the actual length,
 511                          * so presumably they weren't swapped.
 512                          */
 513                         break;
 514                 }
 515                 /* FALLTHROUGH */
 516
 517         case SWAPPED:
 518                 t = hdr->caplen;
 519                 hdr->caplen = hdr->len;
 520                 hdr->len = t;
 521                 break;
 522         }
 523
 524         /*
 525          * Is the packet bigger than we consider sane?
 526          */
 527         if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) {
 528                 /*
 529                  * Yes.  This may be a damaged or fuzzed file.
 530                  *
 531                  * Is it bigger than the snapshot length?
 532                  * (We don't treat that as an error if it's not
 533                  * bigger than the maximum we consider sane; see
 534                  * below.)
 535                  */
 536                 if (hdr->caplen > (bpf_u_int32)p->snapshot) {
 537                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 538                             "invalid packet capture length %u, bigger than "
 539                             "snaplen of %d", hdr->caplen, p->snapshot);
 540                 } else {
 541                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 542                             "invalid packet capture length %u, bigger than "
 543                             "maximum of %u", hdr->caplen,
 544                             max_snaplen_for_dlt(p->linktype));
 545                 }
 546                 return (-1);
 547         }
 548
 549         if (hdr->caplen > (bpf_u_int32)p->snapshot) {
 550                 /*
 551                  * The packet is bigger than the snapshot length
 552                  * for this file.
 553                  *
 554                  * This can happen due to Solaris 2.3 systems tripping
 555                  * over the BUFMOD problem and not setting the snapshot
 556                  * length correctly in the savefile header.
 557                  *
 558                  * libpcap 0.4 and later on Solaris 2.3 should set the
 559                  * snapshot length correctly in the pcap file header,
 560                  * even though they don't set a snapshot length in bufmod
 561                  * (the buggy bufmod chops off the *beginning* of the
 562                  * packet if a snapshot length is specified); they should
 563                  * also reduce the captured length, as supplied to the
 564                  * per-packet callback, to the snapshot length if it's
 565                  * greater than the snapshot length, so the code using
 566                  * libpcap should see the packet cut off at the snapshot
 567                  * length, even though the full packet is copied up to
 568                  * userland.
 569                  *
 570                  * However, perhaps some versions of libpcap failed to
 571                  * set the snapshot length currectly in the file header
 572                  * or the per-packet header,  or perhaps this is a
 573                  * corrupted safefile or a savefile built/modified by a
 574                  * fuzz tester, so we check anyway.
 575                  */
 576                 size_t bytes_to_discard;
 577                 size_t bytes_to_read, bytes_read;
 578                 char discard_buf[4096];
 579
 580                 if (hdr->caplen > p->bufsize) {
 581                         /*
 582                          * Grow the buffer to the snapshot length.
 583                          */
 584                         if (!grow_buffer(p, p->snapshot))
 585                                 return (-1);
 586                 }
 587
 588                 /*
 589                  * Read the first p->bufsize bytes into the buffer.
 590                  */
 591                 amt_read = fread(p->buffer, 1, p->bufsize, fp);
 592                 if (amt_read != p->bufsize) {
 593                         if (ferror(fp)) {
 594                                 pcap_fmt_errmsg_for_errno(p->errbuf,
 595                                      PCAP_ERRBUF_SIZE, errno,
 596                                     "error reading dump file");
 597                         } else {
 598                                 /*
 599                                  * Yes, this uses hdr->caplen; technically,
 600                                  * it's true, because we would try to read
 601                                  * and discard the rest of those bytes, and
 602                                  * that would fail because we got EOF before
 603                                  * the read finished.
 604                                  */
 605                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 606                                     "truncated dump file; tried to read %u captured bytes, only got %lu",
 607                                     hdr->caplen, (unsigned long)amt_read);
 608                         }
 609                         return (-1);
 610                 }
 611
 612                 /*
 613                  * Now read and discard what's left.
 614                  */
 615                 bytes_to_discard = hdr->caplen - p->bufsize;
 616                 bytes_read = amt_read;
 617                 while (bytes_to_discard != 0) {
 618                         bytes_to_read = bytes_to_discard;
 619                         if (bytes_to_read > sizeof (discard_buf))
 620                                 bytes_to_read = sizeof (discard_buf);
 621                         amt_read = fread(discard_buf, 1, bytes_to_read, fp);
 622                         bytes_read += amt_read;
 623                         if (amt_read != bytes_to_read) {
 624                                 if (ferror(fp)) {
 625                                         pcap_fmt_errmsg_for_errno(p->errbuf,
 626                                             PCAP_ERRBUF_SIZE, errno,
 627                                             "error reading dump file");
 628                                 } else {
 629                                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 630                                             "truncated dump file; tried to read %u captured bytes, only got %lu",
 631                                             hdr->caplen, (unsigned long)bytes_read);
 632                                 }
 633                                 return (-1);
 634                         }
 635                         bytes_to_discard -= amt_read;
 636                 }
 637
 638                 /*
 639                  * Adjust caplen accordingly, so we don't get confused later
 640                  * as to how many bytes we have to play with.
 641                  */
 642                 hdr->caplen = p->bufsize;
 643         } else {
 644                 if (hdr->caplen > p->bufsize) {
 645                         /*
 646                          * Grow the buffer to the next power of 2, or
 647                          * the snaplen, whichever is lower.
 648                          */
 649                         u_int new_bufsize;
 650
 651                         new_bufsize = hdr->caplen;
 652                         /*
 653                          * http://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
 654                          */
 655                         new_bufsize--;
 656                         new_bufsize |= new_bufsize >> 1;
 657                         new_bufsize |= new_bufsize >> 2;
 658                         new_bufsize |= new_bufsize >> 4;
 659                         new_bufsize |= new_bufsize >> 8;
 660                         new_bufsize |= new_bufsize >> 16;
 661                         new_bufsize++;
 662
 663                         if (new_bufsize > (u_int)p->snapshot)
 664                                 new_bufsize = p->snapshot;
 665
 666                         if (!grow_buffer(p, new_bufsize))
 667                                 return (-1);
 668                 }
 669
 670                 /* read the packet itself */
 671                 amt_read = fread(p->buffer, 1, hdr->caplen, fp);
 672                 if (amt_read != hdr->caplen) {
 673                         if (ferror(fp)) {
 674                                 pcap_fmt_errmsg_for_errno(p->errbuf,
 675                                     PCAP_ERRBUF_SIZE, errno,
 676                                     "error reading dump file");
 677                         } else {
 678                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 679                                     "truncated dump file; tried to read %u captured bytes, only got %lu",
 680                                     hdr->caplen, (unsigned long)amt_read);
 681                         }
 682                         return (-1);
 683                 }
 684         }
 685         *data = p->buffer;
 686
 687         if (p->swapped)
 688                 swap_pseudo_headers(p->linktype, hdr, *data);
 689
 690         return (0);
 691 }
 692
 693 static int
 694 sf_write_header(pcap_t *p, FILE *fp, int linktype, int thiszone, int snaplen)
 695 {
 696         struct pcap_file_header hdr;
 697
 698         hdr.magic = p->opt.tstamp_precision == PCAP_TSTAMP_PRECISION_NANO ? NSEC_TCPDUMP_MAGIC : TCPDUMP_MAGIC;
 699         hdr.version_major = PCAP_VERSION_MAJOR;
 700         hdr.version_minor = PCAP_VERSION_MINOR;
 701
 702         hdr.thiszone = thiszone;
 703         hdr.snaplen = snaplen;
 704         hdr.sigfigs = 0;
 705         hdr.linktype = linktype;
 706
 707         if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
 708                 return (-1);
 709
 710         return (0);
 711 }
 712
 713 /*
 714  * Output a packet to the initialized dump file.
 715  */
 716 void
 717 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 718 {
 719         register FILE *f;
 720         struct pcap_sf_pkthdr sf_hdr;
 721
 722         f = (FILE *)user;
 723         sf_hdr.ts.tv_sec  = h->ts.tv_sec;
 724         sf_hdr.ts.tv_usec = h->ts.tv_usec;
 725         sf_hdr.caplen     = h->caplen;
 726         sf_hdr.len        = h->len;
 727         /* XXX we should check the return status */
 728         (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
 729         (void)fwrite(sp, h->caplen, 1, f);
 730 }
 731
 732 static pcap_dumper_t *
 733 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
 734 {
 735
 736 #if defined(_WIN32) || defined(MSDOS)
 737         /*
 738          * If we're writing to the standard output, put it in binary
 739          * mode, as savefiles are binary files.
 740          *
 741          * Otherwise, we turn off buffering.
 742          * XXX - why?  And why not on the standard output?
 743          */
 744         if (f == stdout)
 745                 SET_BINMODE(f);
 746         else
 747                 setvbuf(f, NULL, _IONBF, 0);
 748 #endif
 749         if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
 750                 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 751                     errno, "Can't write to %s", fname);
 752                 if (f != stdout)
 753                         (void)fclose(f);
 754                 return (NULL);
 755         }
 756         return ((pcap_dumper_t *)f);
 757 }
 758
 759 /*
 760  * Initialize so that sf_write() will output to the file named 'fname'.
 761  */
 762 pcap_dumper_t *
 763 pcap_dump_open(pcap_t *p, const char *fname)
 764 {
 765         FILE *f;
 766         int linktype;
 767
 768         /*
 769          * If this pcap_t hasn't been activated, it doesn't have a
 770          * link-layer type, so we can't use it.
 771          */
 772         if (!p->activated) {
 773                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 774                     "%s: not-yet-activated pcap_t passed to pcap_dump_open",
 775                     fname);
 776                 return (NULL);
 777         }
 778         linktype = dlt_to_linktype(p->linktype);
 779         if (linktype == -1) {
 780                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 781                     "%s: link-layer type %d isn't supported in savefiles",
 782                     fname, p->linktype);
 783                 return (NULL);
 784         }
 785         linktype |= p->linktype_ext;
 786
 787         if (fname == NULL) {
 788                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 789                     "A null pointer was supplied as the file name");
 790                 return NULL;
 791         }
 792         if (fname[0] == '-' && fname[1] == '\0') {
 793                 f = stdout;
 794                 fname = "standard output";
 795         } else {
 796                 /*
 797                  * "b" is supported as of C90, so *all* UN*Xes should
 798                  * support it, even though it does nothing.  It's
 799                  * required on Windows, as the file is a binary file
 800                  * and must be written in binary mode.
 801                  */
 802                 f = fopen(fname, "wb");
 803                 if (f == NULL) {
 804                         pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 805                             errno, "%s", fname);
 806                         return (NULL);
 807                 }
 808         }
 809         return (pcap_setup_dump(p, linktype, f, fname));
 810 }
 811
 812 /*
 813  * Initialize so that sf_write() will output to the given stream.
 814  */
 815 pcap_dumper_t *
 816 pcap_dump_fopen(pcap_t *p, FILE *f)
 817 {
 818         int linktype;
 819
 820         linktype = dlt_to_linktype(p->linktype);
 821         if (linktype == -1) {
 822                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 823                     "stream: link-layer type %d isn't supported in savefiles",
 824                     p->linktype);
 825                 return (NULL);
 826         }
 827         linktype |= p->linktype_ext;
 828
 829         return (pcap_setup_dump(p, linktype, f, "stream"));
 830 }
 831
 832 pcap_dumper_t *
 833 pcap_dump_open_append(pcap_t *p, const char *fname)
 834 {
 835         FILE *f;
 836         int linktype;
 837         size_t amt_read;
 838         struct pcap_file_header ph;
 839
 840         linktype = dlt_to_linktype(p->linktype);
 841         if (linktype == -1) {
 842                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 843                     "%s: link-layer type %d isn't supported in savefiles",
 844                     fname, linktype);
 845                 return (NULL);
 846         }
 847
 848         if (fname == NULL) {
 849                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 850                     "A null pointer was supplied as the file name");
 851                 return NULL;
 852         }
 853         if (fname[0] == '-' && fname[1] == '\0')
 854                 return (pcap_setup_dump(p, linktype, stdout, "standard output"));
 855
 856         /*
 857          * "b" is supported as of C90, so *all* UN*Xes should support it,
 858          * even though it does nothing.  It's required on Windows, as the
 859          * file is a binary file and must be read in binary mode.
 860          */
 861         f = fopen(fname, "rb+");
 862         if (f == NULL) {
 863                 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 864                     errno, "%s", fname);
 865                 return (NULL);
 866         }
 867
 868         /*
 869          * Try to read a pcap header.
 870          */
 871         amt_read = fread(&ph, 1, sizeof (ph), f);
 872         if (amt_read != sizeof (ph)) {
 873                 if (ferror(f)) {
 874                         pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 875                             errno, "%s", fname);
 876                         fclose(f);
 877                         return (NULL);
 878                 } else if (feof(f) && amt_read > 0) {
 879                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 880                             "%s: truncated pcap file header", fname);
 881                         fclose(f);
 882                         return (NULL);
 883                 }
 884         }
 885
 886 #if defined(_WIN32) || defined(MSDOS)
 887         /*
 888          * We turn off buffering.
 889          * XXX - why?  And why not on the standard output?
 890          */
 891         setvbuf(f, NULL, _IONBF, 0);
 892 #endif
 893
 894         /*
 895          * If a header is already present and:
 896          *
 897          *      it's not for a pcap file of the appropriate resolution
 898          *      and the right byte order for this machine;
 899          *
 900          *      the link-layer header types don't match;
 901          *
 902          *      the snapshot lengths don't match;
 903          *
 904          * return an error.
 905          */
 906         if (amt_read > 0) {
 907                 /*
 908                  * A header is already present.
 909                  * Do the checks.
 910                  */
 911                 switch (ph.magic) {
 912
 913                 case TCPDUMP_MAGIC:
 914                         if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_MICRO) {
 915                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 916                                     "%s: different time stamp precision, cannot append to file", fname);
 917                                 fclose(f);
 918                                 return (NULL);
 919                         }
 920                         break;
 921
 922                 case NSEC_TCPDUMP_MAGIC:
 923                         if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_NANO) {
 924                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 925                                     "%s: different time stamp precision, cannot append to file", fname);
 926                                 fclose(f);
 927                                 return (NULL);
 928                         }
 929                         break;
 930
 931                 case SWAPLONG(TCPDUMP_MAGIC):
 932                 case SWAPLONG(NSEC_TCPDUMP_MAGIC):
 933                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 934                             "%s: different byte order, cannot append to file", fname);
 935                         fclose(f);
 936                         return (NULL);
 937
 938                 case KUZNETZOV_TCPDUMP_MAGIC:
 939                 case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC):
 940                 case NAVTEL_TCPDUMP_MAGIC:
 941                 case SWAPLONG(NAVTEL_TCPDUMP_MAGIC):
 942                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 943                             "%s: not a pcap file to which we can append", fname);
 944                         fclose(f);
 945                         return (NULL);
 946
 947                 default:
 948                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 949                             "%s: not a pcap file", fname);
 950                         fclose(f);
 951                         return (NULL);
 952                 }
 953
 954                 /*
 955                  * Good version?
 956                  */
 957                 if (ph.version_major != PCAP_VERSION_MAJOR ||
 958                     ph.version_minor != PCAP_VERSION_MINOR) {
 959                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 960                             "%s: version is %u.%u, cannot append to file", fname,
 961                             ph.version_major, ph.version_minor);
 962                         fclose(f);
 963                         return (NULL);
 964                 }
 965                 if ((bpf_u_int32)linktype != ph.linktype) {
 966                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 967                             "%s: different linktype, cannot append to file", fname);
 968                         fclose(f);
 969                         return (NULL);
 970                 }
 971                 if ((bpf_u_int32)p->snapshot != ph.snaplen) {
 972                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 973                             "%s: different snaplen, cannot append to file", fname);
 974                         fclose(f);
 975                         return (NULL);
 976                 }
 977         } else {
 978                 /*
 979                  * A header isn't present; attempt to write it.
 980                  */
 981                 if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
 982                         pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 983                             errno, "Can't write to %s", fname);
 984                         (void)fclose(f);
 985                         return (NULL);
 986                 }
 987         }
 988
 989         /*
 990          * Start writing at the end of the file.
 991          */
 992         if (fseek(f, 0, SEEK_END) == -1) {
 993                 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
 994                     errno, "Can't seek to end of %s", fname);
 995                 (void)fclose(f);
 996                 return (NULL);
 997         }
 998         return ((pcap_dumper_t *)f);
 999 }
1000
1001 FILE *
1002 pcap_dump_file(pcap_dumper_t *p)
1003 {
1004         return ((FILE *)p);
1005 }
1006
1007 long
1008 pcap_dump_ftell(pcap_dumper_t *p)
1009 {
1010         return (ftell((FILE *)p));
1011 }
1012
1013 #if defined(HAVE_FSEEKO)
1014 /*
1015  * We have fseeko(), so we have ftello().
1016  * If we have large file support (files larger than 2^31-1 bytes),
1017  * ftello() will give us a current file position with more than 32
1018  * bits.
1019  */
1020 int64_t
1021 pcap_dump_ftell64(pcap_dumper_t *p)
1022 {
1023         return (ftello((FILE *)p));
1024 }
1025 #elif defined(_MSC_VER)
1026 /*
1027  * We have Visual Studio; we support only 2005 and later, so we have
1028  * _ftelli64().
1029  */
1030 int64_t
1031 pcap_dump_ftell64(pcap_dumper_t *p)
1032 {
1033         return (_ftelli64((FILE *)p));
1034 }
1035 #else
1036 /*
1037  * We don't have ftello() or _ftelli64(), so fall back on ftell().
1038  * Either long is 64 bits, in which case ftell() should suffice,
1039  * or this is probably an older 32-bit UN*X without large file
1040  * support, which means you'll probably get errors trying to
1041  * write files > 2^31-1, so it won't matter anyway.
1042  *
1043  * XXX - what about MinGW?
1044  */
1045 int64_t
1046 pcap_dump_ftell64(pcap_dumper_t *p)
1047 {
1048         return (ftell((FILE *)p));
1049 }
1050 #endif
1051
1052 int
1053 pcap_dump_flush(pcap_dumper_t *p)
1054 {
1055
1056         if (fflush((FILE *)p) == EOF)
1057                 return (-1);
1058         else
1059                 return (0);
1060 }
1061
1062 void
1063 pcap_dump_close(pcap_dumper_t *p)
1064 {
1065
1066 #ifdef notyet
1067         if (ferror((FILE *)p))
1068                 return-an-error;
1069         /* XXX should check return from fclose() too */
1070 #endif
1071         (void)fclose((FILE *)p);
1072 }