The Tcpdump Group git mirrors - libpcap/blob - sf-pcap.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * sf-pcap.c - libpcap-file-format-specific code from savefile.c
  22  *      Extraction/creation by Jeffrey Mogul, DECWRL
  23  *      Modified by Steve McCanne, LBL.
  24  *
  25  * Used to save the received packet headers, after filtering, to
  26  * a file, and then read them later.
  27  * The first record in the file contains saved values for the machine
  28  * dependent values so we can print the dump file on any architecture.
  29  */
  30
  31 #ifndef lint
  32 static const char rcsid[] _U_ =
  33     "@(#) $Header$ (LBL)";
  34 #endif
  35
  36 #ifdef HAVE_CONFIG_H
  37 #include "config.h"
  38 #endif
  39
  40 #ifdef WIN32
  41 #include <pcap-stdinc.h>
  42 #else /* WIN32 */
  43 #if HAVE_INTTYPES_H
  44 #include <inttypes.h>
  45 #elif HAVE_STDINT_H
  46 #include <stdint.h>
  47 #endif
  48 #ifdef HAVE_SYS_BITYPES_H
  49 #include <sys/bitypes.h>
  50 #endif
  51 #include <sys/types.h>
  52 #endif /* WIN32 */
  53
  54 #include <errno.h>
  55 #include <memory.h>
  56 #include <stdio.h>
  57 #include <stdlib.h>
  58 #include <string.h>
  59
  60 #include "pcap-int.h"
  61
  62 #include "pcap-common.h"
  63
  64 #ifdef HAVE_OS_PROTO_H
  65 #include "os-proto.h"
  66 #endif
  67
  68 #include "sf-pcap.h"
  69
  70 /*
  71  * Setting O_BINARY on DOS/Windows is a bit tricky
  72  */
  73 #if defined(WIN32)
  74   #define SET_BINMODE(f)  _setmode(_fileno(f), _O_BINARY)
  75 #elif defined(MSDOS)
  76   #if defined(__HIGHC__)
  77   #define SET_BINMODE(f)  setmode(f, O_BINARY)
  78   #else
  79   #define SET_BINMODE(f)  setmode(fileno(f), O_BINARY)
  80   #endif
  81 #endif
  82
  83 /*
  84  * Standard libpcap format.
  85  */
  86 #define TCPDUMP_MAGIC           0xa1b2c3d4
  87
  88 /*
  89  * Alexey Kuznetzov's modified libpcap format.
  90  */
  91 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
  92
  93 /*
  94  * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
  95  * for another modified format.
  96  */
  97 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
  98
  99 /*
 100  * Navtel Communcations' format, with nanosecond timestamps,
 101  * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
 102  */
 103 #define NAVTEL_TCPDUMP_MAGIC    0xa12b3c4d
 104
 105 /*
 106  * Normal libpcap format, except for seconds/nanoseconds timestamps,
 107  * as per a request by Ulf Lamping <ulf.lamping@web.de>
 108  */
 109 #define NSEC_TCPDUMP_MAGIC      0xa1b23c4d
 110
 111 /*
 112  * Mechanism for storing information about a capture in the upper
 113  * 6 bits of a linktype value in a capture file.
 114  *
 115  * LT_LINKTYPE_EXT(x) extracts the additional information.
 116  *
 117  * The rest of the bits are for a value describing the link-layer
 118  * value.  LT_LINKTYPE(x) extracts that value.
 119  */
 120 #define LT_LINKTYPE(x)          ((x) & 0x03FFFFFF)
 121 #define LT_LINKTYPE_EXT(x)      ((x) & 0xFC000000)
 122
 123 static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
 124
 125 /*
 126  * Private data for reading pcap savefiles.
 127  */
 128 typedef enum {
 129         NOT_SWAPPED,
 130         SWAPPED,
 131         MAYBE_SWAPPED
 132 } swapped_type_t;
 133
 134 struct pcap_sf {
 135         size_t hdrsize;
 136         swapped_type_t lengths_swapped;
 137 };
 138
 139 /*
 140  * Check whether this is a pcap savefile and, if it is, extract the
 141  * relevant information from the header.
 142  */
 143 pcap_t *
 144 pcap_check_header(bpf_u_int32 magic, FILE *fp, char *errbuf, int *err)
 145 {
 146         struct pcap_file_header hdr;
 147         size_t amt_read;
 148         pcap_t *p;
 149         int swapped = 0;
 150         struct pcap_sf *ps;
 151
 152         /*
 153          * Assume no read errors.
 154          */
 155         *err = 0;
 156
 157         /*
 158          * Check whether the first 4 bytes of the file are the magic
 159          * number for a pcap savefile, or for a byte-swapped pcap
 160          * savefile.
 161          */
 162         if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC) {
 163                 magic = SWAPLONG(magic);
 164                 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC)
 165                         return (NULL);  /* nope */
 166                 swapped = 1;
 167         }
 168
 169         /*
 170          * They are.  Put the magic number in the header, and read
 171          * the rest of the header.
 172          */
 173         hdr.magic = magic;
 174         amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
 175             sizeof(hdr) - sizeof(hdr.magic), fp);
 176         if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
 177                 if (ferror(fp)) {
 178                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
 179                             "error reading dump file: %s",
 180                             pcap_strerror(errno));
 181                 } else {
 182                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
 183                             "truncated dump file; tried to read %lu file header bytes, only got %lu",
 184                             (unsigned long)sizeof(hdr),
 185                             (unsigned long)amt_read);
 186                 }
 187                 *err = 1;
 188                 return (NULL);
 189         }
 190
 191         /*
 192          * If it's a byte-swapped capture file, byte-swap the header.
 193          */
 194         if (swapped) {
 195                 hdr.version_major = SWAPSHORT(hdr.version_major);
 196                 hdr.version_minor = SWAPSHORT(hdr.version_minor);
 197                 hdr.thiszone = SWAPLONG(hdr.thiszone);
 198                 hdr.sigfigs = SWAPLONG(hdr.sigfigs);
 199                 hdr.snaplen = SWAPLONG(hdr.snaplen);
 200                 hdr.linktype = SWAPLONG(hdr.linktype);
 201         }
 202
 203         if (hdr.version_major < PCAP_VERSION_MAJOR) {
 204                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
 205                     "archaic pcap savefile format");
 206                 *err = 1;
 207                 return (NULL);
 208         }
 209
 210         /*
 211          * OK, this is a good pcap file.
 212          * Allocate a pcap_t for it.
 213          */
 214         p = pcap_open_offline_common(errbuf, sizeof (struct pcap_sf));
 215         if (p == NULL) {
 216                 /* Allocation failed. */
 217                 *err = 1;
 218                 return (NULL);
 219         }
 220         p->swapped = swapped;
 221         p->version_major = hdr.version_major;
 222         p->version_minor = hdr.version_minor;
 223         p->tzoff = hdr.thiszone;
 224         p->snapshot = hdr.snaplen;
 225         p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
 226         p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
 227
 228         p->next_packet_op = pcap_next_packet;
 229
 230         ps = p->private;
 231
 232         /*
 233          * We interchanged the caplen and len fields at version 2.3,
 234          * in order to match the bpf header layout.  But unfortunately
 235          * some files were written with version 2.3 in their headers
 236          * but without the interchanged fields.
 237          *
 238          * In addition, DG/UX tcpdump writes out files with a version
 239          * number of 543.0, and with the caplen and len fields in the
 240          * pre-2.3 order.
 241          */
 242         switch (hdr.version_major) {
 243
 244         case 2:
 245                 if (hdr.version_minor < 3)
 246                         ps->lengths_swapped = SWAPPED;
 247                 else if (hdr.version_minor == 3)
 248                         ps->lengths_swapped = MAYBE_SWAPPED;
 249                 else
 250                         ps->lengths_swapped = NOT_SWAPPED;
 251                 break;
 252
 253         case 543:
 254                 ps->lengths_swapped = SWAPPED;
 255                 break;
 256
 257         default:
 258                 ps->lengths_swapped = NOT_SWAPPED;
 259                 break;
 260         }
 261
 262         if (magic == KUZNETZOV_TCPDUMP_MAGIC) {
 263                 /*
 264                  * XXX - the patch that's in some versions of libpcap
 265                  * changes the packet header but not the magic number,
 266                  * and some other versions with this magic number have
 267                  * some extra debugging information in the packet header;
 268                  * we'd have to use some hacks^H^H^H^H^Hheuristics to
 269                  * detect those variants.
 270                  *
 271                  * Ethereal does that, but it does so by trying to read
 272                  * the first two packets of the file with each of the
 273                  * record header formats.  That currently means it seeks
 274                  * backwards and retries the reads, which doesn't work
 275                  * on pipes.  We want to be able to read from a pipe, so
 276                  * that strategy won't work; we'd have to buffer some
 277                  * data ourselves and read from that buffer in order to
 278                  * make that work.
 279                  */
 280                 ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
 281
 282                 if (p->linktype == DLT_EN10MB) {
 283                         /*
 284                          * This capture might have been done in raw mode
 285                          * or cooked mode.
 286                          *
 287                          * If it was done in cooked mode, p->snapshot was
 288                          * passed to recvfrom() as the buffer size, meaning
 289                          * that the most packet data that would be copied
 290                          * would be p->snapshot.  However, a faked Ethernet
 291                          * header would then have been added to it, so the
 292                          * most data that would be in a packet in the file
 293                          * would be p->snapshot + 14.
 294                          *
 295                          * We can't easily tell whether the capture was done
 296                          * in raw mode or cooked mode, so we'll assume it was
 297                          * cooked mode, and add 14 to the snapshot length.
 298                          * That means that, for a raw capture, the snapshot
 299                          * length will be misleading if you use it to figure
 300                          * out why a capture doesn't have all the packet data,
 301                          * but there's not much we can do to avoid that.
 302                          */
 303                         p->snapshot += 14;
 304                 }
 305         } else
 306                 ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
 307
 308         /*
 309          * Allocate a buffer for the packet data.
 310          */
 311         p->bufsize = p->snapshot;
 312         if (p->bufsize <= 0) {
 313                 /*
 314                  * Bogus snapshot length; use 64KiB as a fallback.
 315                  */
 316                 p->bufsize = 65536;
 317         }
 318         p->buffer = malloc(p->bufsize);
 319         if (p->buffer == NULL) {
 320                 snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
 321                 free(p);
 322                 *err = 1;
 323                 return (NULL);
 324         }
 325
 326         return (p);
 327 }
 328
 329 /*
 330  * Read and return the next packet from the savefile.  Return the header
 331  * in hdr and a pointer to the contents in data.  Return 0 on success, 1
 332  * if there were no more packets, and -1 on an error.
 333  */
 334 static int
 335 pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
 336 {
 337         struct pcap_sf *ps = p->private;
 338         struct pcap_sf_patched_pkthdr sf_hdr;
 339         FILE *fp = p->rfile;
 340         size_t amt_read;
 341         bpf_u_int32 t;
 342
 343         /*
 344          * Read the packet header; the structure we use as a buffer
 345          * is the longer structure for files generated by the patched
 346          * libpcap, but if the file has the magic number for an
 347          * unpatched libpcap we only read as many bytes as the regular
 348          * header has.
 349          */
 350         amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
 351         if (amt_read != ps->hdrsize) {
 352                 if (ferror(fp)) {
 353                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 354                             "error reading dump file: %s",
 355                             pcap_strerror(errno));
 356                         return (-1);
 357                 } else {
 358                         if (amt_read != 0) {
 359                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 360                                     "truncated dump file; tried to read %lu header bytes, only got %lu",
 361                                     (unsigned long)ps->hdrsize,
 362                                     (unsigned long)amt_read);
 363                                 return (-1);
 364                         }
 365                         /* EOF */
 366                         return (1);
 367                 }
 368         }
 369
 370         if (p->swapped) {
 371                 /* these were written in opposite byte order */
 372                 hdr->caplen = SWAPLONG(sf_hdr.caplen);
 373                 hdr->len = SWAPLONG(sf_hdr.len);
 374                 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
 375                 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
 376         } else {
 377                 hdr->caplen = sf_hdr.caplen;
 378                 hdr->len = sf_hdr.len;
 379                 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
 380                 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
 381         }
 382         /* Swap the caplen and len fields, if necessary. */
 383         switch (ps->lengths_swapped) {
 384
 385         case NOT_SWAPPED:
 386                 break;
 387
 388         case MAYBE_SWAPPED:
 389                 if (hdr->caplen <= hdr->len) {
 390                         /*
 391                          * The captured length is <= the actual length,
 392                          * so presumably they weren't swapped.
 393                          */
 394                         break;
 395                 }
 396                 /* FALLTHROUGH */
 397
 398         case SWAPPED:
 399                 t = hdr->caplen;
 400                 hdr->caplen = hdr->len;
 401                 hdr->len = t;
 402                 break;
 403         }
 404
 405         if (hdr->caplen > p->bufsize) {
 406                 /*
 407                  * This can happen due to Solaris 2.3 systems tripping
 408                  * over the BUFMOD problem and not setting the snapshot
 409                  * correctly in the savefile header.  If the caplen isn't
 410                  * grossly wrong, try to salvage.
 411                  */
 412                 static u_char *tp = NULL;
 413                 static size_t tsize = 0;
 414
 415                 if (hdr->caplen > 65535) {
 416                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 417                             "bogus savefile header");
 418                         return (-1);
 419                 }
 420
 421                 if (tsize < hdr->caplen) {
 422                         tsize = ((hdr->caplen + 1023) / 1024) * 1024;
 423                         if (tp != NULL)
 424                                 free((u_char *)tp);
 425                         tp = (u_char *)malloc(tsize);
 426                         if (tp == NULL) {
 427                                 tsize = 0;
 428                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 429                                     "BUFMOD hack malloc");
 430                                 return (-1);
 431                         }
 432                 }
 433                 amt_read = fread((char *)tp, 1, hdr->caplen, fp);
 434                 if (amt_read != hdr->caplen) {
 435                         if (ferror(fp)) {
 436                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 437                                     "error reading dump file: %s",
 438                                     pcap_strerror(errno));
 439                         } else {
 440                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 441                                     "truncated dump file; tried to read %u captured bytes, only got %lu",
 442                                     hdr->caplen, (unsigned long)amt_read);
 443                         }
 444                         return (-1);
 445                 }
 446                 /*
 447                  * We can only keep up to p->bufsize bytes.  Since
 448                  * caplen > p->bufsize is exactly how we got here,
 449                  * we know we can only keep the first p->bufsize bytes
 450                  * and must drop the remainder.  Adjust caplen accordingly,
 451                  * so we don't get confused later as to how many bytes we
 452                  * have to play with.
 453                  */
 454                 hdr->caplen = p->bufsize;
 455                 memcpy(p->buffer, (char *)tp, p->bufsize);
 456         } else {
 457                 /* read the packet itself */
 458                 amt_read = fread(p->buffer, 1, hdr->caplen, fp);
 459                 if (amt_read != hdr->caplen) {
 460                         if (ferror(fp)) {
 461                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 462                                     "error reading dump file: %s",
 463                                     pcap_strerror(errno));
 464                         } else {
 465                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 466                                     "truncated dump file; tried to read %u captured bytes, only got %lu",
 467                                     hdr->caplen, (unsigned long)amt_read);
 468                         }
 469                         return (-1);
 470                 }
 471         }
 472         *data = p->buffer;
 473
 474         if (p->swapped) {
 475                 /*
 476                  * Convert pseudo-headers from the byte order of
 477                  * the host on which the file was saved to our
 478                  * byte order, as necessary.
 479                  */
 480                 switch (p->linktype) {
 481
 482                 case DLT_USB_LINUX:
 483                         swap_linux_usb_header(hdr, *data, 0);
 484                         break;
 485
 486                 case DLT_USB_LINUX_MMAPPED:
 487                         swap_linux_usb_header(hdr, *data, 1);
 488                         break;
 489                 }
 490         }
 491
 492         return (0);
 493 }
 494
 495 static int
 496 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
 497 {
 498         struct pcap_file_header hdr;
 499
 500         hdr.magic = TCPDUMP_MAGIC;
 501         hdr.version_major = PCAP_VERSION_MAJOR;
 502         hdr.version_minor = PCAP_VERSION_MINOR;
 503
 504         hdr.thiszone = thiszone;
 505         hdr.snaplen = snaplen;
 506         hdr.sigfigs = 0;
 507         hdr.linktype = linktype;
 508
 509         if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
 510                 return (-1);
 511
 512         return (0);
 513 }
 514
 515 /*
 516  * Output a packet to the initialized dump file.
 517  */
 518 void
 519 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 520 {
 521         register FILE *f;
 522         struct pcap_sf_pkthdr sf_hdr;
 523
 524         f = (FILE *)user;
 525         sf_hdr.ts.tv_sec  = h->ts.tv_sec;
 526         sf_hdr.ts.tv_usec = h->ts.tv_usec;
 527         sf_hdr.caplen     = h->caplen;
 528         sf_hdr.len        = h->len;
 529         /* XXX we should check the return status */
 530         (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
 531         (void)fwrite(sp, h->caplen, 1, f);
 532 }
 533
 534 static pcap_dumper_t *
 535 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
 536 {
 537
 538 #if defined(WIN32) || defined(MSDOS)
 539         /*
 540          * If we're writing to the standard output, put it in binary
 541          * mode, as savefiles are binary files.
 542          *
 543          * Otherwise, we turn off buffering.
 544          * XXX - why?  And why not on the standard output?
 545          */
 546         if (f == stdout)
 547                 SET_BINMODE(f);
 548         else
 549                 setbuf(f, NULL);
 550 #endif
 551         if (sf_write_header(f, linktype, p->tzoff, p->snapshot) == -1) {
 552                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
 553                     fname, pcap_strerror(errno));
 554                 if (f != stdout)
 555                         (void)fclose(f);
 556                 return (NULL);
 557         }
 558         return ((pcap_dumper_t *)f);
 559 }
 560
 561 /*
 562  * Initialize so that sf_write() will output to the file named 'fname'.
 563  */
 564 pcap_dumper_t *
 565 pcap_dump_open(pcap_t *p, const char *fname)
 566 {
 567         FILE *f;
 568         int linktype;
 569
 570         /*
 571          * If this pcap_t hasn't been activated, it doesn't have a
 572          * link-layer type, so we can't use it.
 573          */
 574         if (!p->activated) {
 575                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 576                     "%s: not-yet-activated pcap_t passed to pcap_dump_open",
 577                     fname);
 578                 return (NULL);
 579         }
 580         linktype = dlt_to_linktype(p->linktype);
 581         if (linktype == -1) {
 582                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 583                     "%s: link-layer type %d isn't supported in savefiles",
 584                     fname, p->linktype);
 585                 return (NULL);
 586         }
 587         linktype |= p->linktype_ext;
 588
 589         if (fname[0] == '-' && fname[1] == '\0') {
 590                 f = stdout;
 591                 fname = "standard output";
 592         } else {
 593 #if !defined(WIN32) && !defined(MSDOS)
 594                 f = fopen(fname, "w");
 595 #else
 596                 f = fopen(fname, "wb");
 597 #endif
 598                 if (f == NULL) {
 599                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
 600                             fname, pcap_strerror(errno));
 601                         return (NULL);
 602                 }
 603         }
 604         return (pcap_setup_dump(p, linktype, f, fname));
 605 }
 606
 607 /*
 608  * Initialize so that sf_write() will output to the given stream.
 609  */
 610 pcap_dumper_t *
 611 pcap_dump_fopen(pcap_t *p, FILE *f)
 612 {
 613         int linktype;
 614
 615         linktype = dlt_to_linktype(p->linktype);
 616         if (linktype == -1) {
 617                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 618                     "stream: link-layer type %d isn't supported in savefiles",
 619                     p->linktype);
 620                 return (NULL);
 621         }
 622         linktype |= p->linktype_ext;
 623
 624         return (pcap_setup_dump(p, linktype, f, "stream"));
 625 }
 626
 627 FILE *
 628 pcap_dump_file(pcap_dumper_t *p)
 629 {
 630         return ((FILE *)p);
 631 }
 632
 633 long
 634 pcap_dump_ftell(pcap_dumper_t *p)
 635 {
 636         return (ftell((FILE *)p));
 637 }
 638
 639 int
 640 pcap_dump_flush(pcap_dumper_t *p)
 641 {
 642
 643         if (fflush((FILE *)p) == EOF)
 644                 return (-1);
 645         else
 646                 return (0);
 647 }
 648
 649 void
 650 pcap_dump_close(pcap_dumper_t *p)
 651 {
 652
 653 #ifdef notyet
 654         if (ferror((FILE *)p))
 655                 return-an-error;
 656         /* XXX should check return from fclose() too */
 657 #endif
 658         (void)fclose((FILE *)p);
 659 }