The Tcpdump Group git mirrors - libpcap/blob - savefile.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * savefile.c - supports offline use of tcpdump
  22  *      Extraction/creation by Jeffrey Mogul, DECWRL
  23  *      Modified by Steve McCanne, LBL.
  24  *
  25  * Used to save the received packet headers, after filtering, to
  26  * a file, and then read them later.
  27  * The first record in the file contains saved values for the machine
  28  * dependent values so we can print the dump file on any architecture.
  29  */
  30
  31 #ifndef lint
  32 static const char rcsid[] =
  33     "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.37.1.1 1999-10-07 23:46:40 mcr Exp $ (LBL)";
  34 #endif
  35
  36 #include <sys/types.h>
  37 #include <sys/time.h>
  38
  39 #include <errno.h>
  40 #include <memory.h>
  41 #include <stdio.h>
  42 #include <stdlib.h>
  43 #include <unistd.h>
  44
  45 #include "pcap-int.h"
  46
  47 #include "gnuc.h"
  48 #ifdef HAVE_OS_PROTO_H
  49 #include "os-proto.h"
  50 #endif
  51
  52 #define TCPDUMP_MAGIC 0xa1b2c3d4
  53
  54 /*
  55  * We use the "receiver-makes-right" approach to byte order,
  56  * because time is at a premium when we are writing the file.
  57  * In other words, the pcap_file_header and pcap_pkthdr,
  58  * records are written in host byte order.
  59  * Note that the packets are always written in network byte order.
  60  *
  61  * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
  62  * machine (if the file was written in little-end order).
  63  */
  64 #define SWAPLONG(y) \
  65 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
  66 #define SWAPSHORT(y) \
  67         ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
  68
  69 #define SFERR_TRUNC             1
  70 #define SFERR_BADVERSION        2
  71 #define SFERR_BADF              3
  72 #define SFERR_EOF               4 /* not really an error, just a status */
  73
  74 static int
  75 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
  76 {
  77         struct pcap_file_header hdr;
  78
  79         hdr.magic = TCPDUMP_MAGIC;
  80         hdr.version_major = PCAP_VERSION_MAJOR;
  81         hdr.version_minor = PCAP_VERSION_MINOR;
  82
  83         hdr.thiszone = thiszone;
  84         hdr.snaplen = snaplen;
  85         hdr.sigfigs = 0;
  86         hdr.linktype = linktype;
  87
  88         if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
  89                 return (-1);
  90
  91         return (0);
  92 }
  93
  94 static void
  95 swap_hdr(struct pcap_file_header *hp)
  96 {
  97         hp->version_major = SWAPSHORT(hp->version_major);
  98         hp->version_minor = SWAPSHORT(hp->version_minor);
  99         hp->thiszone = SWAPLONG(hp->thiszone);
 100         hp->sigfigs = SWAPLONG(hp->sigfigs);
 101         hp->snaplen = SWAPLONG(hp->snaplen);
 102         hp->linktype = SWAPLONG(hp->linktype);
 103 }
 104
 105 pcap_t *
 106 pcap_open_offline(const char *fname, char *errbuf)
 107 {
 108         register pcap_t *p;
 109         register FILE *fp;
 110         struct pcap_file_header hdr;
 111         int linklen;
 112
 113         p = (pcap_t *)malloc(sizeof(*p));
 114         if (p == NULL) {
 115                 strcpy(errbuf, "out of swap");
 116                 return (NULL);
 117         }
 118
 119         memset((char *)p, 0, sizeof(*p));
 120         /*
 121          * Set this field so we don't close stdin in pcap_close!
 122          */
 123         p->fd = -1;
 124
 125         if (fname[0] == '-' && fname[1] == '\0')
 126                 fp = stdin;
 127         else {
 128                 fp = fopen(fname, "r");
 129                 if (fp == NULL) {
 130                         sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno));
 131                         goto bad;
 132                 }
 133         }
 134         if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
 135                 sprintf(errbuf, "fread: %s", pcap_strerror(errno));
 136                 goto bad;
 137         }
 138         if (hdr.magic != TCPDUMP_MAGIC) {
 139                 if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) {
 140                         sprintf(errbuf, "bad dump file format");
 141                         goto bad;
 142                 }
 143                 p->sf.swapped = 1;
 144                 swap_hdr(&hdr);
 145         }
 146         if (hdr.version_major < PCAP_VERSION_MAJOR) {
 147                 sprintf(errbuf, "archaic file format");
 148                 goto bad;
 149         }
 150         p->tzoff = hdr.thiszone;
 151         p->snapshot = hdr.snaplen;
 152         p->linktype = hdr.linktype;
 153         p->sf.rfile = fp;
 154         p->bufsize = hdr.snaplen;
 155
 156         /* Align link header as required for proper data alignment */
 157         /* XXX should handle all types */
 158         switch (p->linktype) {
 159
 160         case DLT_EN10MB:
 161                 linklen = 14;
 162                 break;
 163
 164         case DLT_FDDI:
 165                 linklen = 13 + 8;       /* fddi_header + llc */
 166                 break;
 167
 168         case DLT_NULL:
 169         default:
 170                 linklen = 0;
 171                 break;
 172         }
 173
 174         p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
 175         p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
 176         p->sf.version_major = hdr.version_major;
 177         p->sf.version_minor = hdr.version_minor;
 178 #ifdef PCAP_FDDIPAD
 179         /* XXX padding only needed for kernel fcode */
 180         pcap_fddipad = 0;
 181 #endif
 182
 183         return (p);
 184  bad:
 185         free(p);
 186         return (NULL);
 187 }
 188
 189 /*
 190  * Read sf_readfile and return the next packet.  Return the header in hdr
 191  * and the contents in buf.  Return 0 on success, SFERR_EOF if there were
 192  * no more packets, and SFERR_TRUNC if a partial packet was encountered.
 193  */
 194 static int
 195 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen)
 196 {
 197         FILE *fp = p->sf.rfile;
 198
 199         /* read the stamp */
 200         if (fread((char *)hdr, sizeof(struct pcap_pkthdr), 1, fp) != 1) {
 201                 /* probably an EOF, though could be a truncated packet */
 202                 return (1);
 203         }
 204
 205         if (p->sf.swapped) {
 206                 /* these were written in opposite byte order */
 207                 hdr->caplen = SWAPLONG(hdr->caplen);
 208                 hdr->len = SWAPLONG(hdr->len);
 209                 hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec);
 210                 hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec);
 211         }
 212         /*
 213          * We interchanged the caplen and len fields at version 2.3,
 214          * in order to match the bpf header layout.  But unfortunately
 215          * some files were written with version 2.3 in their headers
 216          * but without the interchanged fields.
 217          */
 218         if (p->sf.version_minor < 3 ||
 219             (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) {
 220                 int t = hdr->caplen;
 221                 hdr->caplen = hdr->len;
 222                 hdr->len = t;
 223         }
 224
 225         if (hdr->caplen > buflen) {
 226                 /*
 227                  * This can happen due to Solaris 2.3 systems tripping
 228                  * over the BUFMOD problem and not setting the snapshot
 229                  * correctly in the savefile header.  If the caplen isn't
 230                  * grossly wrong, try to salvage.
 231                  */
 232                 static u_char *tp = NULL;
 233                 static int tsize = 0;
 234
 235                 if (hdr->caplen > 65535) {
 236                         sprintf(p->errbuf, "bogus savefile header");
 237                         return (-1);
 238                 }
 239                 if (tsize < hdr->caplen) {
 240                         tsize = ((hdr->caplen + 1023) / 1024) * 1024;
 241                         if (tp != NULL)
 242                                 free((u_char *)tp);
 243                         tp = (u_char *)malloc(tsize);
 244                         if (tp == NULL) {
 245                                 tsize = 0;
 246                                 sprintf(p->errbuf, "BUFMOD hack malloc");
 247                                 return (-1);
 248                         }
 249                 }
 250                 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
 251                         sprintf(p->errbuf, "truncated dump file");
 252                         return (-1);
 253                 }
 254                 /*
 255                  * We can only keep up to buflen bytes.  Since caplen > buflen
 256                  * is exactly how we got here, we know we can only keep the
 257                  * first buflen bytes and must drop the remainder.  Adjust
 258                  * caplen accordingly, so we don't get confused later as
 259                  * to how many bytes we have to play with.
 260                  */
 261                 hdr->caplen = buflen;
 262                 memcpy((char *)buf, (char *)tp, buflen);
 263
 264         } else {
 265                 /* read the packet itself */
 266
 267                 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
 268                         sprintf(p->errbuf, "truncated dump file");
 269                         return (-1);
 270                 }
 271         }
 272         return (0);
 273 }
 274
 275 /*
 276  * Print out packets stored in the file initialized by sf_read_init().
 277  * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
 278  */
 279 int
 280 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 281 {
 282         struct bpf_insn *fcode = p->fcode.bf_insns;
 283         int status = 0;
 284         int n = 0;
 285
 286         while (status == 0) {
 287                 struct pcap_pkthdr h;
 288
 289                 status = sf_next_packet(p, &h, p->buffer, p->bufsize);
 290                 if (status) {
 291                         if (status == 1)
 292                                 return (0);
 293                         return (status);
 294                 }
 295
 296                 if (fcode == NULL ||
 297                     bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
 298                         (*callback)(user, &h, p->buffer);
 299                         if (++n >= cnt && cnt > 0)
 300                                 break;
 301                 }
 302         }
 303         /*XXX this breaks semantics tcpslice expects */
 304         return (n);
 305 }
 306
 307 /*
 308  * Output a packet to the initialized dump file.
 309  */
 310 void
 311 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 312 {
 313         register FILE *f;
 314
 315         f = (FILE *)user;
 316         /* XXX we should check the return status */
 317         (void)fwrite((char *)h, sizeof(*h), 1, f);
 318         (void)fwrite((char *)sp, h->caplen, 1, f);
 319 }
 320
 321 /*
 322  * Initialize so that sf_write() will output to the file named 'fname'.
 323  */
 324 pcap_dumper_t *
 325 pcap_dump_open(pcap_t *p, const char *fname)
 326 {
 327         FILE *f;
 328         if (fname[0] == '-' && fname[1] == '\0')
 329                 f = stdout;
 330         else {
 331                 f = fopen(fname, "w");
 332                 if (f == NULL) {
 333                         sprintf(p->errbuf, "%s: %s",
 334                             fname, pcap_strerror(errno));
 335                         return (NULL);
 336                 }
 337         }
 338         (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot);
 339         return ((pcap_dumper_t *)f);
 340 }
 341
 342 void
 343 pcap_dump_close(pcap_dumper_t *p)
 344 {
 345
 346 #ifdef notyet
 347         if (ferror((FILE *)p))
 348                 return-an-error;
 349         /* XXX should check return from fclose() too */
 350 #endif
 351         (void)fclose((FILE *)p);
 352 }