2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * savefile.c - supports offline use of tcpdump
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
35 #include <pcap-types.h>
46 #include <limits.h> /* for INT_MAX */
50 #ifdef HAVE_OS_PROTO_H
55 #include "sf-pcapng.h"
56 #include "pcap-common.h"
61 * This isn't exported on Windows, because it would only work if both
62 * WinPcap/Npcap and the code using it were to use the Universal CRT; otherwise,
63 * a FILE structure in WinPcap/Npcap and a FILE structure in the code using it
64 * could be different if they're using different versions of the C runtime.
66 * Instead, pcap/pcap.h defines it as a macro that wraps the hopen version,
67 * with the wrapper calling _fileno() and _get_osfhandle() themselves,
68 * so that it convert the appropriate CRT version's FILE structure to
69 * a HANDLE (which is OS-defined, not CRT-defined, and is part of the Win32
72 static pcap_t
*pcap_fopen_offline_with_tstamp_precision(FILE *, u_int
, char *);
76 * Setting O_BINARY on DOS/Windows is a bit tricky
79 #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
81 #if defined(__HIGHC__)
82 #define SET_BINMODE(f) setmode(f, O_BINARY)
84 #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
90 * XXX - TEMPORARY TO FIGURE OUT WHY WE'RE NOT GETTING WARNINGS ABOUT
91 * ASSIGNMENT OF A POINTER TO CONST CHAR VALUE TO A POINTER TO CHAR
94 LPCSTR
PacketGetLPCSTR(void);
95 const char *PacketGetConstCharStar(void);
104 PacketGetConstCharStar(void)
106 return "const char *";
111 sf_getnonblock(pcap_t
*p _U_
)
114 * This is a savefile, not a live capture file, so never say
115 * it's in non-blocking mode.
121 sf_setnonblock(pcap_t
*p
, int nonblock _U_
)
124 * This is a savefile, not a live capture file, so reject
125 * requests to put it in non-blocking mode. (If it's a
126 * pipe, it could be put in non-blocking mode, but that
127 * would significantly complicate the code to read packets,
128 * as it would have to handle reading partial packets and
129 * keeping the state of the read.)
131 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
132 "Savefiles cannot be put into non-blocking mode");
137 sf_stats(pcap_t
*p
, struct pcap_stat
*ps _U_
)
139 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
140 "Statistics aren't available from savefiles");
145 static struct pcap_stat
*
146 sf_stats_ex(pcap_t
*p
, int *size _U_
)
148 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
149 "Statistics aren't available from savefiles");
154 sf_setbuff(pcap_t
*p
, int dim _U_
)
156 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
157 "The kernel buffer size cannot be set while reading from a file");
162 sf_setmode(pcap_t
*p
, int mode _U_
)
164 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
165 "impossible to set mode while reading from a file");
170 sf_setmintocopy(pcap_t
*p
, int size _U_
)
172 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
173 "The mintocopy parameter cannot be set while reading from a file");
178 sf_getevent(pcap_t
*pcap
)
180 (void)snprintf(pcap
->errbuf
, sizeof(pcap
->errbuf
),
181 "The read event cannot be retrieved while reading from a file");
182 return (INVALID_HANDLE_VALUE
);
186 sf_oid_get_request(pcap_t
*p
, bpf_u_int32 oid _U_
, void *data _U_
,
189 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
190 "An OID get request cannot be performed on a file");
195 sf_oid_set_request(pcap_t
*p
, bpf_u_int32 oid _U_
, const void *data _U_
,
198 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
199 "An OID set request cannot be performed on a file");
204 sf_sendqueue_transmit(pcap_t
*p
, pcap_send_queue
*queue _U_
, int sync _U_
)
206 pcap_strlcpy(p
->errbuf
, "Sending packets isn't supported on savefiles",
212 sf_setuserbuffer(pcap_t
*p
, int size _U_
)
214 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
215 "The user buffer cannot be set when reading from a file");
220 sf_live_dump(pcap_t
*p
, char *filename _U_
, int maxsize _U_
, int maxpacks _U_
)
222 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
223 "Live packet dumping cannot be performed when reading from a file");
228 sf_live_dump_ended(pcap_t
*p
, int sync _U_
)
230 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
231 "Live packet dumping cannot be performed on a pcap_open_dead pcap_t");
235 static PAirpcapHandle
236 sf_get_airpcap_handle(pcap_t
*pcap _U_
)
243 sf_inject(pcap_t
*p
, const void *buf _U_
, int size _U_
)
245 pcap_strlcpy(p
->errbuf
, "Sending packets isn't supported on savefiles",
251 * Set direction flag: Which packets do we accept on a forwarding
252 * single device? IN, OUT or both?
255 sf_setdirection(pcap_t
*p
, pcap_direction_t d _U_
)
257 snprintf(p
->errbuf
, sizeof(p
->errbuf
),
258 "Setting direction is not supported on savefiles");
263 sf_cleanup(pcap_t
*p
)
265 if (p
->rfile
!= stdin
)
266 (void)fclose(p
->rfile
);
267 if (p
->buffer
!= NULL
)
269 pcap_freecode(&p
->fcode
);
274 * Wrapper for fopen() and _wfopen().
276 * If we're in UTF-8 mode, map the pathname from UTF-8 to UTF-16LE and
279 * If we're not, just use fopen(); that'll treat it as being in the
283 charset_fopen(const char *path
, const char *mode
)
286 #define MAX_MODE_LEN 16
287 wchar_t utf16_mode
[MAX_MODE_LEN
+1];
293 if (pcap_utf_8_mode
) {
295 * Map from UTF-8 to UTF-16LE.
296 * Fail if there are invalid characters in the input
297 * string, rather than converting them to REPLACEMENT
298 * CHARACTER; the latter is appropriate for strings
299 * to be displayed to the user, but for file names
300 * you just want the attempt to open the file to fail.
302 utf16_path
= cp_to_utf_16le(CP_UTF8
, path
,
303 MB_ERR_INVALID_CHARS
);
304 if (utf16_path
== NULL
) {
306 * Error. Assume errno has been set.
308 * XXX - what about Windows errors?
314 * Now convert the mode to UTF-16LE as well.
315 * We assume the mode is ASCII, and that
316 * it's short, so that's easy.
318 for (i
= 0; (c
= *mode
) != '\0'; i
++, mode
++) {
320 /* Not an ASCII character; fail with EINVAL. */
325 if (i
>= MAX_MODE_LEN
) {
326 /* The mode string is longer than we allow. */
333 utf16_mode
[i
] = '\0';
336 * OK, we have UTF-16LE strings; hand them to
339 fp
= _wfopen(utf16_path
, utf16_mode
);
342 * Make sure freeing the UTF-16LE string doesn't
343 * overwrite the error code we got from _wfopen().
352 * This takes strings in the local code page as an
355 return (fopen(path
, mode
));
361 pcap_open_offline_with_tstamp_precision(const char *fname
, u_int precision
,
368 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
369 "A null pointer was supplied as the file name");
372 if (fname
[0] == '-' && fname
[1] == '\0')
376 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
377 "The standard input is not open");
380 #if defined(_WIN32) || defined(MSDOS)
382 * We're reading from the standard input, so put it in binary
383 * mode, as savefiles are binary files.
390 * Use charset_fopen(); on Windows, it tests whether we're
391 * in "local code page" or "UTF-8" mode, and treats the
392 * pathname appropriately, and on other platforms, it just
395 * "b" is supported as of C90, so *all* UN*Xes should
396 * support it, even though it does nothing. For MS-DOS,
399 fp
= charset_fopen(fname
, "rb");
401 pcap_fmt_errmsg_for_errno(errbuf
, PCAP_ERRBUF_SIZE
,
406 p
= pcap_fopen_offline_with_tstamp_precision(fp
, precision
, errbuf
);
415 pcap_open_offline(const char *fname
, char *errbuf
)
417 return (pcap_open_offline_with_tstamp_precision(fname
,
418 PCAP_TSTAMP_PRECISION_MICRO
, errbuf
));
422 pcap_t
* pcap_hopen_offline_with_tstamp_precision(intptr_t osfd
, u_int precision
,
428 fd
= _open_osfhandle(osfd
, _O_RDONLY
);
431 pcap_fmt_errmsg_for_errno(errbuf
, PCAP_ERRBUF_SIZE
,
432 errno
, "_open_osfhandle");
436 file
= _fdopen(fd
, "rb");
439 pcap_fmt_errmsg_for_errno(errbuf
, PCAP_ERRBUF_SIZE
,
445 return pcap_fopen_offline_with_tstamp_precision(file
, precision
,
449 pcap_t
* pcap_hopen_offline(intptr_t osfd
, char *errbuf
)
451 return pcap_hopen_offline_with_tstamp_precision(osfd
,
452 PCAP_TSTAMP_PRECISION_MICRO
, errbuf
);
457 * Given a link-layer header type and snapshot length, return a
458 * snapshot length to use when reading the file; it's guaranteed
459 * to be > 0 and <= INT_MAX.
461 * XXX - the only reason why we limit it to <= INT_MAX is so that
462 * it fits in p->snapshot, and the only reason that p->snapshot is
463 * signed is that pcap_snapshot() returns an int, not an unsigned int.
466 pcap_adjust_snapshot(bpf_u_int32 linktype
, bpf_u_int32 snaplen
)
468 if (snaplen
== 0 || snaplen
> INT_MAX
) {
470 * Bogus snapshot length; use the maximum for this
471 * link-layer type as a fallback.
473 * XXX - we don't clamp snapshot lengths that are
474 * <= INT_MAX but > max_snaplen_for_dlt(linktype),
475 * so a capture file could cause us to allocate
476 * a Really Big Buffer.
478 snaplen
= max_snaplen_for_dlt(linktype
);
483 static pcap_t
*(*check_headers
[])(const uint8_t *, FILE *, u_int
, char *, int *) = {
488 #define N_FILE_TYPES (sizeof check_headers / sizeof check_headers[0])
494 pcap_fopen_offline_with_tstamp_precision(FILE *fp
, u_int precision
,
504 * Fail if we were passed a NULL fp.
506 * That shouldn't happen if we're opening with a path name, but
507 * it could happen if buggy code is opening with a FILE * and
508 * didn't bother to make sure the FILE * isn't null.
511 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
512 "Null FILE * pointer provided to savefile open routine");
517 * Read the first 4 bytes of the file; the network analyzer dump
518 * file formats we support (pcap and pcapng), and several other
519 * formats we might support in the future (such as snoop, DOS and
520 * Windows Sniffer, and Microsoft Network Monitor) all have magic
521 * numbers that are unique in their first 4 bytes.
523 amt_read
= fread(&magic
, 1, sizeof(magic
), fp
);
524 if (amt_read
!= sizeof(magic
)) {
526 pcap_fmt_errmsg_for_errno(errbuf
, PCAP_ERRBUF_SIZE
,
527 errno
, "error reading dump file");
529 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
530 "truncated dump file; tried to read %zu file header bytes, only got %zu",
531 sizeof(magic
), amt_read
);
537 * Try all file types.
539 for (i
= 0; i
< N_FILE_TYPES
; i
++) {
540 p
= (*check_headers
[i
])(magic
, fp
, precision
, errbuf
, &err
);
542 /* Yup, that's it. */
547 * Error trying to read the header.
554 * Well, who knows what this mess is....
556 snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "unknown file format");
562 /* Padding only needed for live capture fcode */
565 #if !defined(_WIN32) && !defined(MSDOS)
567 * You can do "select()" and "poll()" on plain files on most
568 * platforms, and should be able to do so on pipes.
570 * You can't do "select()" on anything other than sockets in
571 * Windows, so, on Win32 systems, we don't have "selectable_fd".
573 p
->selectable_fd
= fileno(fp
);
576 p
->read_op
= pcap_offline_read
;
577 p
->inject_op
= sf_inject
;
578 p
->setfilter_op
= install_bpf_program
;
579 p
->setdirection_op
= sf_setdirection
;
580 p
->set_datalink_op
= NULL
; /* we don't support munging link-layer headers */
581 p
->getnonblock_op
= sf_getnonblock
;
582 p
->setnonblock_op
= sf_setnonblock
;
583 p
->stats_op
= sf_stats
;
585 p
->stats_ex_op
= sf_stats_ex
;
586 p
->setbuff_op
= sf_setbuff
;
587 p
->setmode_op
= sf_setmode
;
588 p
->setmintocopy_op
= sf_setmintocopy
;
589 p
->getevent_op
= sf_getevent
;
590 p
->oid_get_request_op
= sf_oid_get_request
;
591 p
->oid_set_request_op
= sf_oid_set_request
;
592 p
->sendqueue_transmit_op
= sf_sendqueue_transmit
;
593 p
->setuserbuffer_op
= sf_setuserbuffer
;
594 p
->live_dump_op
= sf_live_dump
;
595 p
->live_dump_ended_op
= sf_live_dump_ended
;
596 p
->get_airpcap_handle_op
= sf_get_airpcap_handle
;
600 * For offline captures, the standard one-shot callback can
601 * be used for pcap_next()/pcap_next_ex().
603 p
->oneshot_callback
= pcap_oneshot
;
606 * Default breakloop operation.
608 p
->breakloop_op
= pcap_breakloop_common
;
611 * Savefiles never require special BPF code generation.
613 p
->bpf_codegen_flags
= 0;
621 * This isn't needed on Windows; we #define pcap_fopen_offline() as
622 * a wrapper around pcap_hopen_offline(), and we don't call it from
623 * inside this file, so it's unused.
627 pcap_fopen_offline(FILE *fp
, char *errbuf
)
629 return (pcap_fopen_offline_with_tstamp_precision(fp
,
630 PCAP_TSTAMP_PRECISION_MICRO
, errbuf
));
635 * Read packets from a capture file, and call the callback for each
637 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
640 pcap_offline_read(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
642 struct bpf_insn
*fcode
;
647 while (status
== 0) {
648 struct pcap_pkthdr h
;
651 * Has "pcap_breakloop()" been called?
652 * If so, return immediately - if we haven't read any
653 * packets, clear the flag and return -2 to indicate
654 * that we were told to break out of the loop, otherwise
655 * leave the flag set, so that the *next* call will break
656 * out of the loop without having read any packets, and
657 * return the number of packets we've processed so far.
667 status
= p
->next_packet_op(p
, &h
, &data
);
674 if ((fcode
= p
->fcode
.bf_insns
) == NULL
||
675 pcap_filter(fcode
, data
, h
.len
, h
.caplen
)) {
676 (*callback
)(user
, &h
, data
);
677 if (++n
>= cnt
&& cnt
> 0)
681 /*XXX this breaks semantics tcpslice expects */