The Tcpdump Group git mirrors - libpcap/blob - sf-pcap.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * sf-pcap.c - libpcap-file-format-specific code from savefile.c
  22  *      Extraction/creation by Jeffrey Mogul, DECWRL
  23  *      Modified by Steve McCanne, LBL.
  24  *
  25  * Used to save the received packet headers, after filtering, to
  26  * a file, and then read them later.
  27  * The first record in the file contains saved values for the machine
  28  * dependent values so we can print the dump file on any architecture.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 #include <config.h>
  33 #endif
  34
  35 #include <pcap-types.h>
  36 #ifdef _WIN32
  37 #include <io.h>
  38 #include <fcntl.h>
  39 #endif /* _WIN32 */
  40
  41 #include <errno.h>
  42 #include <memory.h>
  43 #include <stdio.h>
  44 #include <stdlib.h>
  45 #include <string.h>
  46
  47 #include "pcap-int.h"
  48
  49 #include "pcap-common.h"
  50
  51 #ifdef HAVE_OS_PROTO_H
  52 #include "os-proto.h"
  53 #endif
  54
  55 #include "sf-pcap.h"
  56
  57 /*
  58  * Setting O_BINARY on DOS/Windows is a bit tricky
  59  */
  60 #if defined(_WIN32)
  61   #define SET_BINMODE(f)  _setmode(_fileno(f), _O_BINARY)
  62 #elif defined(MSDOS)
  63   #if defined(__HIGHC__)
  64   #define SET_BINMODE(f)  setmode(f, O_BINARY)
  65   #else
  66   #define SET_BINMODE(f)  setmode(fileno(f), O_BINARY)
  67   #endif
  68 #endif
  69
  70 /*
  71  * Standard libpcap format.
  72  */
  73 #define TCPDUMP_MAGIC           0xa1b2c3d4
  74
  75 /*
  76  * Alexey Kuznetzov's modified libpcap format.
  77  */
  78 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
  79
  80 /*
  81  * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
  82  * for another modified format.
  83  */
  84 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
  85
  86 /*
  87  * Navtel Communcations' format, with nanosecond timestamps,
  88  * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
  89  */
  90 #define NAVTEL_TCPDUMP_MAGIC    0xa12b3c4d
  91
  92 /*
  93  * Normal libpcap format, except for seconds/nanoseconds timestamps,
  94  * as per a request by Ulf Lamping <ulf.lamping@web.de>
  95  */
  96 #define NSEC_TCPDUMP_MAGIC      0xa1b23c4d
  97
  98 /*
  99  * Mechanism for storing information about a capture in the upper
 100  * 6 bits of a linktype value in a capture file.
 101  *
 102  * LT_LINKTYPE_EXT(x) extracts the additional information.
 103  *
 104  * The rest of the bits are for a value describing the link-layer
 105  * value.  LT_LINKTYPE(x) extracts that value.
 106  */
 107 #define LT_LINKTYPE(x)          ((x) & 0x03FFFFFF)
 108 #define LT_LINKTYPE_EXT(x)      ((x) & 0xFC000000)
 109
 110 static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
 111
 112 /*
 113  * Private data for reading pcap savefiles.
 114  */
 115 typedef enum {
 116         NOT_SWAPPED,
 117         SWAPPED,
 118         MAYBE_SWAPPED
 119 } swapped_type_t;
 120
 121 typedef enum {
 122         PASS_THROUGH,
 123         SCALE_UP,
 124         SCALE_DOWN
 125 } tstamp_scale_type_t;
 126
 127 struct pcap_sf {
 128         size_t hdrsize;
 129         swapped_type_t lengths_swapped;
 130         tstamp_scale_type_t scale_type;
 131 };
 132
 133 /*
 134  * Check whether this is a pcap savefile and, if it is, extract the
 135  * relevant information from the header.
 136  */
 137 pcap_t *
 138 pcap_check_header(bpf_u_int32 magic, FILE *fp, u_int precision, char *errbuf,
 139                   int *err)
 140 {
 141         struct pcap_file_header hdr;
 142         size_t amt_read;
 143         pcap_t *p;
 144         int swapped = 0;
 145         struct pcap_sf *ps;
 146
 147         /*
 148          * Assume no read errors.
 149          */
 150         *err = 0;
 151
 152         /*
 153          * Check whether the first 4 bytes of the file are the magic
 154          * number for a pcap savefile, or for a byte-swapped pcap
 155          * savefile.
 156          */
 157         if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC &&
 158             magic != NSEC_TCPDUMP_MAGIC) {
 159                 magic = SWAPLONG(magic);
 160                 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC &&
 161                     magic != NSEC_TCPDUMP_MAGIC)
 162                         return (NULL);  /* nope */
 163                 swapped = 1;
 164         }
 165
 166         /*
 167          * They are.  Put the magic number in the header, and read
 168          * the rest of the header.
 169          */
 170         hdr.magic = magic;
 171         amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
 172             sizeof(hdr) - sizeof(hdr.magic), fp);
 173         if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
 174                 if (ferror(fp)) {
 175                         pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 176                             "error reading dump file: %s",
 177                             pcap_strerror(errno));
 178                 } else {
 179                         pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 180                             "truncated dump file; tried to read %lu file header bytes, only got %lu",
 181                             (unsigned long)sizeof(hdr),
 182                             (unsigned long)amt_read);
 183                 }
 184                 *err = 1;
 185                 return (NULL);
 186         }
 187
 188         /*
 189          * If it's a byte-swapped capture file, byte-swap the header.
 190          */
 191         if (swapped) {
 192                 hdr.version_major = SWAPSHORT(hdr.version_major);
 193                 hdr.version_minor = SWAPSHORT(hdr.version_minor);
 194                 hdr.thiszone = SWAPLONG(hdr.thiszone);
 195                 hdr.sigfigs = SWAPLONG(hdr.sigfigs);
 196                 hdr.snaplen = SWAPLONG(hdr.snaplen);
 197                 hdr.linktype = SWAPLONG(hdr.linktype);
 198         }
 199
 200         if (hdr.version_major < PCAP_VERSION_MAJOR) {
 201                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 202                     "archaic pcap savefile format");
 203                 *err = 1;
 204                 return (NULL);
 205         }
 206
 207         /*
 208          * currently only versions 2.[0-4] are supported with
 209          * the exception of 543.0 for DG/UX tcpdump.
 210          */
 211         if (! ((hdr.version_major == PCAP_VERSION_MAJOR &&
 212                 hdr.version_minor <= PCAP_VERSION_MINOR) ||
 213                (hdr.version_major == 543 &&
 214                 hdr.version_minor == 0))) {
 215                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 216                          "unsupported pcap savefile version %u.%u",
 217                          hdr.version_major, hdr.version_minor);
 218                 *err = 1;
 219                 return NULL;
 220         }
 221
 222         /*
 223          * OK, this is a good pcap file.
 224          * Allocate a pcap_t for it.
 225          */
 226         p = pcap_open_offline_common(errbuf, sizeof (struct pcap_sf));
 227         if (p == NULL) {
 228                 /* Allocation failed. */
 229                 *err = 1;
 230                 return (NULL);
 231         }
 232         p->swapped = swapped;
 233         p->version_major = hdr.version_major;
 234         p->version_minor = hdr.version_minor;
 235         p->tzoff = hdr.thiszone;
 236         p->snapshot = hdr.snaplen;
 237         if (p->snapshot <= 0) {
 238                 /*
 239                  * Bogus snapshot length; use the maximum for this
 240                  * link-layer type as a fallback.
 241                  *
 242                  * XXX - the only reason why snapshot is signed is
 243                  * that pcap_snapshot() returns an int, not an
 244                  * unsigned int.
 245                  */
 246                 p->snapshot = max_snaplen_for_dlt(hdr.linktype);
 247         }
 248         p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
 249         p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
 250
 251         p->next_packet_op = pcap_next_packet;
 252
 253         ps = p->priv;
 254
 255         p->opt.tstamp_precision = precision;
 256
 257         /*
 258          * Will we need to scale the timestamps to match what the
 259          * user wants?
 260          */
 261         switch (precision) {
 262
 263         case PCAP_TSTAMP_PRECISION_MICRO:
 264                 if (magic == NSEC_TCPDUMP_MAGIC) {
 265                         /*
 266                          * The file has nanoseconds, the user
 267                          * wants microseconds; scale the
 268                          * precision down.
 269                          */
 270                         ps->scale_type = SCALE_DOWN;
 271                 } else {
 272                         /*
 273                          * The file has microseconds, the
 274                          * user wants microseconds; nothing to do.
 275                          */
 276                         ps->scale_type = PASS_THROUGH;
 277                 }
 278                 break;
 279
 280         case PCAP_TSTAMP_PRECISION_NANO:
 281                 if (magic == NSEC_TCPDUMP_MAGIC) {
 282                         /*
 283                          * The file has nanoseconds, the
 284                          * user wants nanoseconds; nothing to do.
 285                          */
 286                         ps->scale_type = PASS_THROUGH;
 287                 } else {
 288                         /*
 289                          * The file has microoseconds, the user
 290                          * wants nanoseconds; scale the
 291                          * precision up.
 292                          */
 293                         ps->scale_type = SCALE_UP;
 294                 }
 295                 break;
 296
 297         default:
 298                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
 299                     "unknown time stamp resolution %u", precision);
 300                 free(p);
 301                 *err = 1;
 302                 return (NULL);
 303         }
 304
 305         /*
 306          * We interchanged the caplen and len fields at version 2.3,
 307          * in order to match the bpf header layout.  But unfortunately
 308          * some files were written with version 2.3 in their headers
 309          * but without the interchanged fields.
 310          *
 311          * In addition, DG/UX tcpdump writes out files with a version
 312          * number of 543.0, and with the caplen and len fields in the
 313          * pre-2.3 order.
 314          */
 315         switch (hdr.version_major) {
 316
 317         case 2:
 318                 if (hdr.version_minor < 3)
 319                         ps->lengths_swapped = SWAPPED;
 320                 else if (hdr.version_minor == 3)
 321                         ps->lengths_swapped = MAYBE_SWAPPED;
 322                 else
 323                         ps->lengths_swapped = NOT_SWAPPED;
 324                 break;
 325
 326         case 543:
 327                 ps->lengths_swapped = SWAPPED;
 328                 break;
 329
 330         default:
 331                 ps->lengths_swapped = NOT_SWAPPED;
 332                 break;
 333         }
 334
 335         if (magic == KUZNETZOV_TCPDUMP_MAGIC) {
 336                 /*
 337                  * XXX - the patch that's in some versions of libpcap
 338                  * changes the packet header but not the magic number,
 339                  * and some other versions with this magic number have
 340                  * some extra debugging information in the packet header;
 341                  * we'd have to use some hacks^H^H^H^H^Hheuristics to
 342                  * detect those variants.
 343                  *
 344                  * Ethereal does that, but it does so by trying to read
 345                  * the first two packets of the file with each of the
 346                  * record header formats.  That currently means it seeks
 347                  * backwards and retries the reads, which doesn't work
 348                  * on pipes.  We want to be able to read from a pipe, so
 349                  * that strategy won't work; we'd have to buffer some
 350                  * data ourselves and read from that buffer in order to
 351                  * make that work.
 352                  */
 353                 ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
 354
 355                 if (p->linktype == DLT_EN10MB) {
 356                         /*
 357                          * This capture might have been done in raw mode
 358                          * or cooked mode.
 359                          *
 360                          * If it was done in cooked mode, p->snapshot was
 361                          * passed to recvfrom() as the buffer size, meaning
 362                          * that the most packet data that would be copied
 363                          * would be p->snapshot.  However, a faked Ethernet
 364                          * header would then have been added to it, so the
 365                          * most data that would be in a packet in the file
 366                          * would be p->snapshot + 14.
 367                          *
 368                          * We can't easily tell whether the capture was done
 369                          * in raw mode or cooked mode, so we'll assume it was
 370                          * cooked mode, and add 14 to the snapshot length.
 371                          * That means that, for a raw capture, the snapshot
 372                          * length will be misleading if you use it to figure
 373                          * out why a capture doesn't have all the packet data,
 374                          * but there's not much we can do to avoid that.
 375                          */
 376                         p->snapshot += 14;
 377                 }
 378         } else
 379                 ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
 380
 381         /*
 382          * Allocate a buffer for the packet data.
 383          * Choose the minimum of the file's snapshot length and 2K bytes;
 384          * that should be enough for most network packets - we'll grow it
 385          * if necessary.  That way, we don't allocate a huge chunk of
 386          * memory just because there's a huge snapshot length, as the
 387          * snapshot length might be larger than the size of the largest
 388          * packet.
 389          */
 390         p->bufsize = p->snapshot;
 391         if (p->bufsize > 2048)
 392                 p->bufsize = 2048;
 393         p->buffer = malloc(p->bufsize);
 394         if (p->buffer == NULL) {
 395                 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
 396                 free(p);
 397                 *err = 1;
 398                 return (NULL);
 399         }
 400
 401         p->cleanup_op = sf_cleanup;
 402
 403         return (p);
 404 }
 405
 406 /*
 407  * Grow the packet buffer to the specified size.
 408  */
 409 static int
 410 grow_buffer(pcap_t *p, u_int bufsize)
 411 {
 412         void *bigger_buffer;
 413
 414         bigger_buffer = realloc(p->buffer, bufsize);
 415         if (bigger_buffer == NULL) {
 416                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "out of memory");
 417                 return (0);
 418         }
 419         p->buffer = bigger_buffer;
 420         p->bufsize = bufsize;
 421         return (1);
 422 }
 423
 424 /*
 425  * Read and return the next packet from the savefile.  Return the header
 426  * in hdr and a pointer to the contents in data.  Return 0 on success, 1
 427  * if there were no more packets, and -1 on an error.
 428  */
 429 static int
 430 pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
 431 {
 432         struct pcap_sf *ps = p->priv;
 433         struct pcap_sf_patched_pkthdr sf_hdr;
 434         FILE *fp = p->rfile;
 435         size_t amt_read;
 436         bpf_u_int32 t;
 437
 438         /*
 439          * Read the packet header; the structure we use as a buffer
 440          * is the longer structure for files generated by the patched
 441          * libpcap, but if the file has the magic number for an
 442          * unpatched libpcap we only read as many bytes as the regular
 443          * header has.
 444          */
 445         amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
 446         if (amt_read != ps->hdrsize) {
 447                 if (ferror(fp)) {
 448                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 449                             "error reading dump file: %s",
 450                             pcap_strerror(errno));
 451                         return (-1);
 452                 } else {
 453                         if (amt_read != 0) {
 454                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 455                                     "truncated dump file; tried to read %lu header bytes, only got %lu",
 456                                     (unsigned long)ps->hdrsize,
 457                                     (unsigned long)amt_read);
 458                                 return (-1);
 459                         }
 460                         /* EOF */
 461                         return (1);
 462                 }
 463         }
 464
 465         if (p->swapped) {
 466                 /* these were written in opposite byte order */
 467                 hdr->caplen = SWAPLONG(sf_hdr.caplen);
 468                 hdr->len = SWAPLONG(sf_hdr.len);
 469                 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
 470                 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
 471         } else {
 472                 hdr->caplen = sf_hdr.caplen;
 473                 hdr->len = sf_hdr.len;
 474                 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
 475                 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
 476         }
 477
 478         switch (ps->scale_type) {
 479
 480         case PASS_THROUGH:
 481                 /*
 482                  * Just pass the time stamp through.
 483                  */
 484                 break;
 485
 486         case SCALE_UP:
 487                 /*
 488                  * File has microseconds, user wants nanoseconds; convert
 489                  * it.
 490                  */
 491                 hdr->ts.tv_usec = hdr->ts.tv_usec * 1000;
 492                 break;
 493
 494         case SCALE_DOWN:
 495                 /*
 496                  * File has nanoseconds, user wants microseconds; convert
 497                  * it.
 498                  */
 499                 hdr->ts.tv_usec = hdr->ts.tv_usec / 1000;
 500                 break;
 501         }
 502
 503         /* Swap the caplen and len fields, if necessary. */
 504         switch (ps->lengths_swapped) {
 505
 506         case NOT_SWAPPED:
 507                 break;
 508
 509         case MAYBE_SWAPPED:
 510                 if (hdr->caplen <= hdr->len) {
 511                         /*
 512                          * The captured length is <= the actual length,
 513                          * so presumably they weren't swapped.
 514                          */
 515                         break;
 516                 }
 517                 /* FALLTHROUGH */
 518
 519         case SWAPPED:
 520                 t = hdr->caplen;
 521                 hdr->caplen = hdr->len;
 522                 hdr->len = t;
 523                 break;
 524         }
 525
 526         /*
 527          * Is the packet bigger than we consider sane?
 528          */
 529         if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) {
 530                 /*
 531                  * Yes.  This may be a damaged or fuzzed file.
 532                  *
 533                  * Is it bigger than the snapshot length?
 534                  * (We don't treat that as an error if it's not
 535                  * bigger than the maximum we consider sane; see
 536                  * below.)
 537                  */
 538                 if (hdr->caplen > (bpf_u_int32)p->snapshot) {
 539                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 540                             "invalid packet capture length %u, bigger than "
 541                             "snaplen of %d", hdr->caplen, p->snapshot);
 542                 } else {
 543                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 544                             "invalid packet capture length %u, bigger than "
 545                             "maximum of %u", hdr->caplen,
 546                             max_snaplen_for_dlt(p->linktype));
 547                 }
 548                 return (-1);
 549         }
 550
 551         if (hdr->caplen > (bpf_u_int32)p->snapshot) {
 552                 /*
 553                  * The packet is bigger than the snapshot length
 554                  * for this file.
 555                  *
 556                  * This can happen due to Solaris 2.3 systems tripping
 557                  * over the BUFMOD problem and not setting the snapshot
 558                  * length correctly in the savefile header.
 559                  *
 560                  * libpcap 0.4 and later on Solaris 2.3 should set the
 561                  * snapshot length correctly in the pcap file header,
 562                  * even though they don't set a snapshot length in bufmod
 563                  * (the buggy bufmod chops off the *beginning* of the
 564                  * packet if a snapshot length is specified); they should
 565                  * also reduce the captured length, as supplied to the
 566                  * per-packet callback, to the snapshot length if it's
 567                  * greater than the snapshot length, so the code using
 568                  * libpcap should see the packet cut off at the snapshot
 569                  * length, even though the full packet is copied up to
 570                  * userland.
 571                  *
 572                  * However, perhaps some versions of libpcap failed to
 573                  * set the snapshot length currectly in the file header
 574                  * or the per-packet header,  or perhaps this is a
 575                  * corrupted safefile or a savefile built/modified by a
 576                  * fuzz tester, so we check anyway.
 577                  */
 578                 size_t bytes_to_discard;
 579                 size_t bytes_to_read, bytes_read;
 580                 char discard_buf[4096];
 581
 582                 if (hdr->caplen > p->bufsize) {
 583                         /*
 584                          * Grow the buffer to the snapshot length.
 585                          */
 586                         if (!grow_buffer(p, p->snapshot))
 587                                 return (-1);
 588                 }
 589
 590                 /*
 591                  * Read the first p->bufsize bytes into the buffer.
 592                  */
 593                 amt_read = fread(p->buffer, 1, p->bufsize, fp);
 594                 if (amt_read != p->bufsize) {
 595                         if (ferror(fp)) {
 596                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 597                                     "error reading dump file: %s",
 598                                     pcap_strerror(errno));
 599                         } else {
 600                                 /*
 601                                  * Yes, this uses hdr->caplen; technically,
 602                                  * it's true, because we would try to read
 603                                  * and discard the rest of those bytes, and
 604                                  * that would fail because we got EOF before
 605                                  * the read finished.
 606                                  */
 607                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 608                                     "truncated dump file; tried to read %u captured bytes, only got %lu",
 609                                     hdr->caplen, (unsigned long)amt_read);
 610                         }
 611                         return (-1);
 612                 }
 613
 614                 /*
 615                  * Now read and discard what's left.
 616                  */
 617                 bytes_to_discard = hdr->caplen - p->bufsize;
 618                 bytes_read = amt_read;
 619                 while (bytes_to_discard != 0) {
 620                         bytes_to_read = bytes_to_discard;
 621                         if (bytes_to_read > sizeof (discard_buf))
 622                                 bytes_to_read = sizeof (discard_buf);
 623                         amt_read = fread(discard_buf, 1, bytes_to_read, fp);
 624                         bytes_read += amt_read;
 625                         if (amt_read != bytes_to_read) {
 626                                 if (ferror(fp)) {
 627                                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 628                                             "error reading dump file: %s",
 629                                             pcap_strerror(errno));
 630                                 } else {
 631                                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 632                                             "truncated dump file; tried to read %u captured bytes, only got %lu",
 633                                             hdr->caplen, (unsigned long)bytes_read);
 634                                 }
 635                                 return (-1);
 636                         }
 637                         bytes_to_discard -= amt_read;
 638                 }
 639
 640                 /*
 641                  * Adjust caplen accordingly, so we don't get confused later
 642                  * as to how many bytes we have to play with.
 643                  */
 644                 hdr->caplen = p->bufsize;
 645         } else {
 646                 if (hdr->caplen > p->bufsize) {
 647                         /*
 648                          * Grow the buffer to the next power of 2, or
 649                          * the snaplen, whichever is lower.
 650                          */
 651                         u_int new_bufsize;
 652
 653                         new_bufsize = hdr->caplen;
 654                         /*
 655                          * http://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
 656                          */
 657                         new_bufsize--;
 658                         new_bufsize |= new_bufsize >> 1;
 659                         new_bufsize |= new_bufsize >> 2;
 660                         new_bufsize |= new_bufsize >> 4;
 661                         new_bufsize |= new_bufsize >> 8;
 662                         new_bufsize |= new_bufsize >> 16;
 663                         new_bufsize++;
 664
 665                         if (new_bufsize > (u_int)p->snapshot)
 666                                 new_bufsize = p->snapshot;
 667
 668                         if (!grow_buffer(p, new_bufsize))
 669                                 return (-1);
 670                 }
 671
 672                 /* read the packet itself */
 673                 amt_read = fread(p->buffer, 1, hdr->caplen, fp);
 674                 if (amt_read != hdr->caplen) {
 675                         if (ferror(fp)) {
 676                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 677                                     "error reading dump file: %s",
 678                                     pcap_strerror(errno));
 679                         } else {
 680                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 681                                     "truncated dump file; tried to read %u captured bytes, only got %lu",
 682                                     hdr->caplen, (unsigned long)amt_read);
 683                         }
 684                         return (-1);
 685                 }
 686         }
 687         *data = p->buffer;
 688
 689         if (p->swapped)
 690                 swap_pseudo_headers(p->linktype, hdr, *data);
 691
 692         return (0);
 693 }
 694
 695 static int
 696 sf_write_header(pcap_t *p, FILE *fp, int linktype, int thiszone, int snaplen)
 697 {
 698         struct pcap_file_header hdr;
 699
 700         hdr.magic = p->opt.tstamp_precision == PCAP_TSTAMP_PRECISION_NANO ? NSEC_TCPDUMP_MAGIC : TCPDUMP_MAGIC;
 701         hdr.version_major = PCAP_VERSION_MAJOR;
 702         hdr.version_minor = PCAP_VERSION_MINOR;
 703
 704         hdr.thiszone = thiszone;
 705         hdr.snaplen = snaplen;
 706         hdr.sigfigs = 0;
 707         hdr.linktype = linktype;
 708
 709         if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
 710                 return (-1);
 711
 712         return (0);
 713 }
 714
 715 /*
 716  * Output a packet to the initialized dump file.
 717  */
 718 void
 719 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 720 {
 721         register FILE *f;
 722         struct pcap_sf_pkthdr sf_hdr;
 723
 724         f = (FILE *)user;
 725         sf_hdr.ts.tv_sec  = h->ts.tv_sec;
 726         sf_hdr.ts.tv_usec = h->ts.tv_usec;
 727         sf_hdr.caplen     = h->caplen;
 728         sf_hdr.len        = h->len;
 729         /* XXX we should check the return status */
 730         (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
 731         (void)fwrite(sp, h->caplen, 1, f);
 732 }
 733
 734 static pcap_dumper_t *
 735 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
 736 {
 737
 738 #if defined(_WIN32) || defined(MSDOS)
 739         /*
 740          * If we're writing to the standard output, put it in binary
 741          * mode, as savefiles are binary files.
 742          *
 743          * Otherwise, we turn off buffering.
 744          * XXX - why?  And why not on the standard output?
 745          */
 746         if (f == stdout)
 747                 SET_BINMODE(f);
 748         else
 749                 setbuf(f, NULL);
 750 #endif
 751         if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
 752                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
 753                     fname, pcap_strerror(errno));
 754                 if (f != stdout)
 755                         (void)fclose(f);
 756                 return (NULL);
 757         }
 758         return ((pcap_dumper_t *)f);
 759 }
 760
 761 /*
 762  * Initialize so that sf_write() will output to the file named 'fname'.
 763  */
 764 pcap_dumper_t *
 765 pcap_dump_open(pcap_t *p, const char *fname)
 766 {
 767         FILE *f;
 768         int linktype;
 769
 770         /*
 771          * If this pcap_t hasn't been activated, it doesn't have a
 772          * link-layer type, so we can't use it.
 773          */
 774         if (!p->activated) {
 775                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 776                     "%s: not-yet-activated pcap_t passed to pcap_dump_open",
 777                     fname);
 778                 return (NULL);
 779         }
 780         linktype = dlt_to_linktype(p->linktype);
 781         if (linktype == -1) {
 782                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 783                     "%s: link-layer type %d isn't supported in savefiles",
 784                     fname, p->linktype);
 785                 return (NULL);
 786         }
 787         linktype |= p->linktype_ext;
 788
 789         if (fname == NULL) {
 790                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 791                     "A null pointer was supplied as the file name");
 792                 return NULL;
 793         }
 794         if (fname[0] == '-' && fname[1] == '\0') {
 795                 f = stdout;
 796                 fname = "standard output";
 797         } else {
 798 #if !defined(_WIN32) && !defined(MSDOS)
 799                 f = fopen(fname, "w");
 800 #else
 801                 f = fopen(fname, "wb");
 802 #endif
 803                 if (f == NULL) {
 804                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
 805                             fname, pcap_strerror(errno));
 806                         return (NULL);
 807                 }
 808         }
 809         return (pcap_setup_dump(p, linktype, f, fname));
 810 }
 811
 812 /*
 813  * Initialize so that sf_write() will output to the given stream.
 814  */
 815 pcap_dumper_t *
 816 pcap_dump_fopen(pcap_t *p, FILE *f)
 817 {
 818         int linktype;
 819
 820         linktype = dlt_to_linktype(p->linktype);
 821         if (linktype == -1) {
 822                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 823                     "stream: link-layer type %d isn't supported in savefiles",
 824                     p->linktype);
 825                 return (NULL);
 826         }
 827         linktype |= p->linktype_ext;
 828
 829         return (pcap_setup_dump(p, linktype, f, "stream"));
 830 }
 831
 832 pcap_dumper_t *
 833 pcap_dump_open_append(pcap_t *p, const char *fname)
 834 {
 835         FILE *f;
 836         int linktype;
 837         size_t amt_read;
 838         struct pcap_file_header ph;
 839
 840         linktype = dlt_to_linktype(p->linktype);
 841         if (linktype == -1) {
 842                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 843                     "%s: link-layer type %d isn't supported in savefiles",
 844                     fname, linktype);
 845                 return (NULL);
 846         }
 847
 848         if (fname == NULL) {
 849                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 850                     "A null pointer was supplied as the file name");
 851                 return NULL;
 852         }
 853         if (fname[0] == '-' && fname[1] == '\0')
 854                 return (pcap_setup_dump(p, linktype, stdout, "standard output"));
 855
 856 #if !defined(_WIN32) && !defined(MSDOS)
 857         f = fopen(fname, "r+");
 858 #else
 859         f = fopen(fname, "rb+");
 860 #endif
 861         if (f == NULL) {
 862                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
 863                     fname, pcap_strerror(errno));
 864                 return (NULL);
 865         }
 866
 867         /*
 868          * Try to read a pcap header.
 869          */
 870         amt_read = fread(&ph, 1, sizeof (ph), f);
 871         if (amt_read != sizeof (ph)) {
 872                 if (ferror(f)) {
 873                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
 874                             fname, pcap_strerror(errno));
 875                         fclose(f);
 876                         return (NULL);
 877                 } else if (feof(f) && amt_read > 0) {
 878                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 879                             "%s: truncated pcap file header", fname);
 880                         fclose(f);
 881                         return (NULL);
 882                 }
 883         }
 884
 885 #if defined(_WIN32) || defined(MSDOS)
 886         /*
 887          * We turn off buffering.
 888          * XXX - why?  And why not on the standard output?
 889          */
 890         setbuf(f, NULL);
 891 #endif
 892
 893         /*
 894          * If a header is already present and:
 895          *
 896          *      it's not for a pcap file of the appropriate resolution
 897          *      and the right byte order for this machine;
 898          *
 899          *      the link-layer header types don't match;
 900          *
 901          *      the snapshot lengths don't match;
 902          *
 903          * return an error.
 904          */
 905         if (amt_read > 0) {
 906                 /*
 907                  * A header is already present.
 908                  * Do the checks.
 909                  */
 910                 switch (ph.magic) {
 911
 912                 case TCPDUMP_MAGIC:
 913                         if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_MICRO) {
 914                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 915                                     "%s: different time stamp precision, cannot append to file", fname);
 916                                 fclose(f);
 917                                 return (NULL);
 918                         }
 919                         break;
 920
 921                 case NSEC_TCPDUMP_MAGIC:
 922                         if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_NANO) {
 923                                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 924                                     "%s: different time stamp precision, cannot append to file", fname);
 925                                 fclose(f);
 926                                 return (NULL);
 927                         }
 928                         break;
 929
 930                 case SWAPLONG(TCPDUMP_MAGIC):
 931                 case SWAPLONG(NSEC_TCPDUMP_MAGIC):
 932                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 933                             "%s: different byte order, cannot append to file", fname);
 934                         fclose(f);
 935                         return (NULL);
 936
 937                 case KUZNETZOV_TCPDUMP_MAGIC:
 938                 case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC):
 939                 case NAVTEL_TCPDUMP_MAGIC:
 940                 case SWAPLONG(NAVTEL_TCPDUMP_MAGIC):
 941                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 942                             "%s: not a pcap file to which we can append", fname);
 943                         fclose(f);
 944                         return (NULL);
 945
 946                 default:
 947                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 948                             "%s: not a pcap file", fname);
 949                         fclose(f);
 950                         return (NULL);
 951                 }
 952
 953                 /*
 954                  * Good version?
 955                  */
 956                 if (ph.version_major != PCAP_VERSION_MAJOR ||
 957                     ph.version_minor != PCAP_VERSION_MINOR) {
 958                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 959                             "%s: version is %u.%u, cannot append to file", fname,
 960                             ph.version_major, ph.version_minor);
 961                         fclose(f);
 962                         return (NULL);
 963                 }
 964                 if ((bpf_u_int32)linktype != ph.linktype) {
 965                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 966                             "%s: different linktype, cannot append to file", fname);
 967                         fclose(f);
 968                         return (NULL);
 969                 }
 970                 if ((bpf_u_int32)p->snapshot != ph.snaplen) {
 971                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 972                             "%s: different snaplen, cannot append to file", fname);
 973                         fclose(f);
 974                         return (NULL);
 975                 }
 976         } else {
 977                 /*
 978                  * A header isn't present; attempt to write it.
 979                  */
 980                 if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
 981                         pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
 982                             fname, pcap_strerror(errno));
 983                         (void)fclose(f);
 984                         return (NULL);
 985                 }
 986         }
 987
 988         /*
 989          * Start writing at the end of the file.
 990          */
 991         if (fseek(f, 0, SEEK_END) == -1) {
 992                 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't seek to end of %s: %s",
 993                     fname, pcap_strerror(errno));
 994                 (void)fclose(f);
 995                 return (NULL);
 996         }
 997         return ((pcap_dumper_t *)f);
 998 }
 999
1000 FILE *
1001 pcap_dump_file(pcap_dumper_t *p)
1002 {
1003         return ((FILE *)p);
1004 }
1005
1006 long
1007 pcap_dump_ftell(pcap_dumper_t *p)
1008 {
1009         return (ftell((FILE *)p));
1010 }
1011
1012 int
1013 pcap_dump_flush(pcap_dumper_t *p)
1014 {
1015
1016         if (fflush((FILE *)p) == EOF)
1017                 return (-1);
1018         else
1019                 return (0);
1020 }
1021
1022 void
1023 pcap_dump_close(pcap_dumper_t *p)
1024 {
1025
1026 #ifdef notyet
1027         if (ferror((FILE *)p))
1028                 return-an-error;
1029         /* XXX should check return from fclose() too */
1030 #endif
1031         (void)fclose((FILE *)p);
1032 }