]> The Tcpdump Group git mirrors - libpcap/blob - savefile.c
projects / libpcap / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Handle DG/UX's wacky tcpdump format (major version 543, minor version 0,
[libpcap] / savefile.c
1 /*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * savefile.c - supports offline use of tcpdump
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
24 *
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
29 */
30
31 #ifndef lint
32 static const char rcsid[] =
33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.90 2003-10-24 23:55:06 guy Exp $ (LBL)";
34 #endif
35
36 #ifdef HAVE_CONFIG_H
37 #include "config.h"
38 #endif
39
40 #include <errno.h>
41 #include <memory.h>
42 #include <stdio.h>
43 #include <stdlib.h>
44 #include <string.h>
45
46 #include "pcap-int.h"
47
48 #ifdef HAVE_OS_PROTO_H
49 #include "os-proto.h"
50 #endif
51
52 #define TCPDUMP_MAGIC 0xa1b2c3d4
53 #define PATCHED_TCPDUMP_MAGIC 0xa1b2cd34
54
55 /*
56 * We use the "receiver-makes-right" approach to byte order,
57 * because time is at a premium when we are writing the file.
58 * In other words, the pcap_file_header and pcap_pkthdr,
59 * records are written in host byte order.
60 * Note that the bytes of packet data are written out in the order in
61 * which they were received, so multi-byte fields in packets are not
62 * written in host byte order, they're written in whatever order the
63 * sending machine put them in.
64 *
65 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
66 * machine (if the file was written in little-end order).
67 */
68 #define SWAPLONG(y) \
69 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
70 #define SWAPSHORT(y) \
71 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
72
73 #define SFERR_TRUNC 1
74 #define SFERR_BADVERSION 2
75 #define SFERR_BADF 3
76 #define SFERR_EOF 4 /* not really an error, just a status */
77
78 /*
79 * We don't write DLT_* values to the capture file header, because
80 * they're not the same on all platforms.
81 *
82 * Unfortunately, the various flavors of BSD have not always used the same
83 * numerical values for the same data types, and various patches to
84 * libpcap for non-BSD OSes have added their own DLT_* codes for link
85 * layer encapsulation types seen on those OSes, and those codes have had,
86 * in some cases, values that were also used, on other platforms, for other
87 * link layer encapsulation types.
88 *
89 * This means that capture files of a type whose numerical DLT_* code
90 * means different things on different BSDs, or with different versions
91 * of libpcap, can't always be read on systems other than those like
92 * the one running on the machine on which the capture was made.
93 *
94 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
95 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
96 * codes to DLT_* codes when reading a savefile header.
97 *
98 * For those DLT_* codes that have, as far as we know, the same values on
99 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
100 * DLT_xxx; that way, captures of those types can still be read by
101 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
102 * captures of those types written by versions of libpcap that map DLT_
103 * values to LINKTYPE_ values can still be read by older versions
104 * of libpcap.
105 *
106 * The other LINKTYPE_* codes are given values starting at 100, in the
107 * hopes that no DLT_* code will be given one of those values.
108 *
109 * In order to ensure that a given LINKTYPE_* code's value will refer to
110 * the same encapsulation type on all platforms, you should not allocate
111 * a new LINKTYPE_* value without consulting "tcpdump-workers@tcpdump.org".
112 * The tcpdump developers will allocate a value for you, and will not
113 * subsequently allocate it to anybody else; that value will be added to
114 * the "pcap.h" in the tcpdump.org CVS repository, so that a future
115 * libpcap release will include it.
116 *
117 * You should, if possible, also contribute patches to libpcap and tcpdump
118 * to handle the new encapsulation type, so that they can also be checked
119 * into the tcpdump.org CVS repository and so that they will appear in
120 * future libpcap and tcpdump releases.
121 */
122 #define LINKTYPE_NULL DLT_NULL
123 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */
124 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */
125 #define LINKTYPE_AX25 DLT_AX25
126 #define LINKTYPE_PRONET DLT_PRONET
127 #define LINKTYPE_CHAOS DLT_CHAOS
128 #define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
129 #define LINKTYPE_ARCNET DLT_ARCNET /* BSD-style headers */
130 #define LINKTYPE_SLIP DLT_SLIP
131 #define LINKTYPE_PPP DLT_PPP
132 #define LINKTYPE_FDDI DLT_FDDI
133
134 /*
135 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
136 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
137 * field) at the beginning of the packet.
138 *
139 * This is for use when there is always such a header; the address field
140 * might be 0xff, for regular PPP, or it might be an address field for Cisco
141 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
142 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
143 *
144 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
145 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
146 * captures will be written out with a link type that NetBSD's tcpdump
147 * can read.
148 */
149 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */
150
151 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */
152
153 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
154 #define LINKTYPE_RAW 101 /* raw IP */
155 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
156 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
157 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */
158 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */
159 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */
160 #define LINKTYPE_FRELAY 107 /* Frame Relay */
161 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */
162 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */
163
164 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */
165 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */
166 #define LINKTYPE_ECONET 115 /* Acorn Econet */
167
168 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */
169 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */
170 #define LINKTYPE_PRISM_HEADER 119 /* 802.11+Prism II monitor mode */
171 #define LINKTYPE_AIRONET_HEADER 120 /* FreeBSD Aironet driver stuff */
172 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */
173 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */
174
175 #define LINKTYPE_IEEE802_11_RADIO 127 /* 802.11 plus WLAN header */
176
177 #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */
178
179 #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */
180
181 #define LINKTYPE_JUNIPER_MLPPP 130 /* Juniper-internal chassis encapsulation */
182 #define LINKTYPE_JUNIPER_MLFR 131
183 #define LINKTYPE_JUNIPER_ES 132
184 #define LINKTYPE_JUNIPER_GGSN 133
185 #define LINKTYPE_JUNIPER_MFR 134
186 #define LINKTYPE_JUNIPER_ATM2 135
187 #define LINKTYPE_JUNIPER_SERVICES 136
188 #define LINKTYPE_JUNIPER_ATM1 137
189
190 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */
191
192 #define LINKTYPE_RAWSS7 139 /* see rawss7.h for */
193 #define LINKTYPE_RAWSS7_MTP2 140 /* information on these */
194 #define LINKTYPE_RAWSS7_MTP3 141 /* definitions */
195 #define LINKTYPE_RAWSS7_SCCP 142
196
197 /*
198 * These types are reserved for future use.
199 */
200 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */
201 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */
202 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */
203 #define LINKTYPE_IPFILTER 116 /* IP Filter capture files */
204 #define LINKTYPE_HHDLC 121 /* Siemens HiPath HDLC */
205 #define LINKTYPE_RIO 124 /* RapidIO */
206 #define LINKTYPE_PCI_EXP 125 /* PCI Express */
207 #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */
208
209 static struct linktype_map {
210 int dlt;
211 int linktype;
212 } map[] = {
213 /*
214 * These DLT_* codes have LINKTYPE_* codes with values identical
215 * to the values of the corresponding DLT_* code.
216 */
217 { DLT_NULL, LINKTYPE_NULL },
218 { DLT_EN10MB, LINKTYPE_ETHERNET },
219 { DLT_EN3MB, LINKTYPE_EXP_ETHERNET },
220 { DLT_AX25, LINKTYPE_AX25 },
221 { DLT_PRONET, LINKTYPE_PRONET },
222 { DLT_CHAOS, LINKTYPE_CHAOS },
223 { DLT_IEEE802, LINKTYPE_TOKEN_RING },
224 { DLT_ARCNET, LINKTYPE_ARCNET },
225 { DLT_SLIP, LINKTYPE_SLIP },
226 { DLT_PPP, LINKTYPE_PPP },
227 { DLT_FDDI, LINKTYPE_FDDI },
228
229 /*
230 * These DLT_* codes have different values on different
231 * platforms; we map them to LINKTYPE_* codes that
232 * have values that should never be equal to any DLT_*
233 * code.
234 */
235 #ifdef DLT_FR
236 /* BSD/OS Frame Relay */
237 { DLT_FR, LINKTYPE_FRELAY },
238 #endif
239 { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 },
240 { DLT_RAW, LINKTYPE_RAW },
241 { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS },
242 { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS },
243
244 /* BSD/OS Cisco HDLC */
245 { DLT_C_HDLC, LINKTYPE_C_HDLC },
246
247 /*
248 * These DLT_* codes are not on all platforms, but, so far,
249 * there don't appear to be any platforms that define
250 * other codes with those values; we map them to
251 * different LINKTYPE_* values anyway, just in case.
252 */
253
254 /* Linux ATM Classical IP */
255 { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP },
256
257 /* NetBSD sync/async serial PPP (or Cisco HDLC) */
258 { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC },
259
260 /* NetBSD PPP over Ethernet */
261 { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER },
262
263 /* IEEE 802.11 wireless */
264 { DLT_IEEE802_11, LINKTYPE_IEEE802_11 },
265
266 /* Frame Relay */
267 { DLT_FRELAY, LINKTYPE_FRELAY },
268
269 /* OpenBSD loopback */
270 { DLT_LOOP, LINKTYPE_LOOP },
271
272 /* Linux cooked socket capture */
273 { DLT_LINUX_SLL, LINKTYPE_LINUX_SLL },
274
275 /* Apple LocalTalk hardware */
276 { DLT_LTALK, LINKTYPE_LTALK },
277
278 /* Acorn Econet */
279 { DLT_ECONET, LINKTYPE_ECONET },
280
281 /* OpenBSD DLT_PFLOG */
282 { DLT_PFLOG, LINKTYPE_PFLOG },
283
284 /* For Cisco-internal use */
285 { DLT_CISCO_IOS, LINKTYPE_CISCO_IOS },
286
287 /* Prism II monitor-mode header plus 802.11 header */
288 { DLT_PRISM_HEADER, LINKTYPE_PRISM_HEADER },
289
290 /* FreeBSD Aironet driver stuff */
291 { DLT_AIRONET_HEADER, LINKTYPE_AIRONET_HEADER },
292
293 /* Siemens HiPath HDLC */
294 { DLT_HHDLC, LINKTYPE_HHDLC },
295
296 /* RFC 2625 IP-over-Fibre Channel */
297 { DLT_IP_OVER_FC, LINKTYPE_IP_OVER_FC },
298
299 /* Solaris+SunATM */
300 { DLT_SUNATM, LINKTYPE_SUNATM },
301
302 /* RapidIO */
303 { DLT_RIO, LINKTYPE_RIO },
304
305 /* PCI Express */
306 { DLT_PCI_EXP, LINKTYPE_PCI_EXP },
307
308 /* Xilinx Aurora link layer */
309 { DLT_AURORA, LINKTYPE_AURORA },
310
311 /* 802.11 plus WLAN header */
312 { DLT_IEEE802_11_RADIO, LINKTYPE_IEEE802_11_RADIO },
313
314 /* Tazmen Sniffer Protocol */
315 { DLT_TZSP, LINKTYPE_TZSP },
316
317 /* Arcnet with Linux-style link-layer headers */
318 { DLT_ARCNET_LINUX, LINKTYPE_ARCNET_LINUX },
319
320 /* Juniper-internal chassis encapsulation */
321 { DLT_JUNIPER_MLPPP, LINKTYPE_JUNIPER_MLPPP },
322 { DLT_JUNIPER_MLFR, LINKTYPE_JUNIPER_MLFR },
323 { DLT_JUNIPER_ES, LINKTYPE_JUNIPER_ES },
324 { DLT_JUNIPER_GGSN, LINKTYPE_JUNIPER_GGSN },
325 { DLT_JUNIPER_MFR, LINKTYPE_JUNIPER_MFR },
326 { DLT_JUNIPER_ATM2, LINKTYPE_JUNIPER_ATM2 },
327 { DLT_JUNIPER_SERVICES, LINKTYPE_JUNIPER_SERVICES },
328 { DLT_JUNIPER_ATM1, LINKTYPE_JUNIPER_ATM1 },
329
330 /* Apple IP-over-IEEE 1394 cooked header */
331 { DLT_APPLE_IP_OVER_IEEE1394, LINKTYPE_APPLE_IP_OVER_IEEE1394 },
332
333 /*
334 * Any platform that defines additional DLT_* codes should:
335 *
336 * request a LINKTYPE_* code and value from tcpdump.org,
337 * as per the above;
338 *
339 * add, in their version of libpcap, an entry to map
340 * those DLT_* codes to the corresponding LINKTYPE_*
341 * code;
342 *
343 * redefine, in their "net/bpf.h", any DLT_* values
344 * that collide with the values used by their additional
345 * DLT_* codes, to remove those collisions (but without
346 * making them collide with any of the LINKTYPE_*
347 * values equal to 50 or above; they should also avoid
348 * defining DLT_* values that collide with those
349 * LINKTYPE_* values, either).
350 */
351 { -1, -1 }
352 };
353
354 static int
355 dlt_to_linktype(int dlt)
356 {
357 int i;
358
359 for (i = 0; map[i].dlt != -1; i++) {
360 if (map[i].dlt == dlt)
361 return (map[i].linktype);
362 }
363
364 /*
365 * If we don't have a mapping for this DLT_ code, return an
366 * error; that means that the table above needs to have an
367 * entry added.
368 */
369 return (-1);
370 }
371
372 static int
373 linktype_to_dlt(int linktype)
374 {
375 int i;
376
377 for (i = 0; map[i].linktype != -1; i++) {
378 if (map[i].linktype == linktype)
379 return (map[i].dlt);
380 }
381
382 /*
383 * If we don't have an entry for this link type, return
384 * the link type value; it may be a DLT_ value from an
385 * older version of libpcap.
386 */
387 return linktype;
388 }
389
390 static int
391 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
392 {
393 struct pcap_file_header hdr;
394
395 hdr.magic = TCPDUMP_MAGIC;
396 hdr.version_major = PCAP_VERSION_MAJOR;
397 hdr.version_minor = PCAP_VERSION_MINOR;
398
399 hdr.thiszone = thiszone;
400 hdr.snaplen = snaplen;
401 hdr.sigfigs = 0;
402 hdr.linktype = linktype;
403
404 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
405 return (-1);
406
407 return (0);
408 }
409
410 static void
411 swap_hdr(struct pcap_file_header *hp)
412 {
413 hp->version_major = SWAPSHORT(hp->version_major);
414 hp->version_minor = SWAPSHORT(hp->version_minor);
415 hp->thiszone = SWAPLONG(hp->thiszone);
416 hp->sigfigs = SWAPLONG(hp->sigfigs);
417 hp->snaplen = SWAPLONG(hp->snaplen);
418 hp->linktype = SWAPLONG(hp->linktype);
419 }
420
421 static int
422 sf_stats(pcap_t *p, struct pcap_stat *ps)
423 {
424 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
425 "Statistics aren't available from savefiles");
426 return (-1);
427 }
428
429 static void
430 sf_close(pcap_t *p)
431 {
432 if (p->sf.rfile != stdin)
433 (void)fclose(p->sf.rfile);
434 if (p->sf.base != NULL)
435 free(p->sf.base);
436 }
437
438 pcap_t *
439 pcap_open_offline(const char *fname, char *errbuf)
440 {
441 register pcap_t *p;
442 register FILE *fp;
443 struct pcap_file_header hdr;
444 bpf_u_int32 magic;
445 int linklen;
446
447 p = (pcap_t *)malloc(sizeof(*p));
448 if (p == NULL) {
449 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
450 return (NULL);
451 }
452
453 memset((char *)p, 0, sizeof(*p));
454
455 if (fname[0] == '-' && fname[1] == '\0')
456 fp = stdin;
457 else {
458 #ifndef WIN32
459 fp = fopen(fname, "r");
460 #else
461 fp = fopen(fname, "rb");
462 #endif
463 if (fp == NULL) {
464 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", fname,
465 pcap_strerror(errno));
466 goto bad;
467 }
468 }
469 if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
470 snprintf(errbuf, PCAP_ERRBUF_SIZE, "fread: %s",
471 pcap_strerror(errno));
472 goto bad;
473 }
474 magic = hdr.magic;
475 if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC) {
476 magic = SWAPLONG(magic);
477 if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC) {
478 snprintf(errbuf, PCAP_ERRBUF_SIZE,
479 "bad dump file format");
480 goto bad;
481 }
482 p->sf.swapped = 1;
483 swap_hdr(&hdr);
484 }
485 if (magic == PATCHED_TCPDUMP_MAGIC) {
486 /*
487 * XXX - the patch that's in some versions of libpcap
488 * changes the packet header but not the magic number;
489 * we'd have to use some hacks^H^H^H^H^Hheuristics to
490 * detect that.
491 */
492 p->sf.hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
493 } else
494 p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr);
495 if (hdr.version_major < PCAP_VERSION_MAJOR) {
496 snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format");
497 goto bad;
498 }
499 p->tzoff = hdr.thiszone;
500 p->snapshot = hdr.snaplen;
501 p->linktype = linktype_to_dlt(hdr.linktype);
502 p->sf.rfile = fp;
503 #ifndef WIN32
504 p->bufsize = hdr.snaplen;
505 #else
506 /* Allocate the space for pcap_pkthdr as well. It will be used by pcap_read_ex */
507 p->bufsize = hdr.snaplen+sizeof(struct pcap_pkthdr);
508 #endif
509
510 /* Align link header as required for proper data alignment */
511 /* XXX should handle all types */
512 switch (p->linktype) {
513
514 case DLT_EN10MB:
515 linklen = 14;
516 break;
517
518 case DLT_FDDI:
519 linklen = 13 + 8; /* fddi_header + llc */
520 break;
521
522 case DLT_NULL:
523 default:
524 linklen = 0;
525 break;
526 }
527
528 if (p->bufsize < 0)
529 p->bufsize = BPF_MAXBUFSIZE;
530 p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
531 if (p->sf.base == NULL) {
532 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
533 goto bad;
534 }
535 p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
536 p->sf.version_major = hdr.version_major;
537 p->sf.version_minor = hdr.version_minor;
538 #ifdef PCAP_FDDIPAD
539 /* XXX padding only needed for kernel fcode */
540 pcap_fddipad = 0;
541 #endif
542
543 /*
544 * We interchanged the caplen and len fields at version 2.3,
545 * in order to match the bpf header layout. But unfortunately
546 * some files were written with version 2.3 in their headers
547 * but without the interchanged fields.
548 *
549 * In addition, DG/UX tcpdump writes out files with a version
550 * number of 543.0, and with the caplen and len fields in the
551 * pre-2.3 order.
552 */
553 switch (hdr.version_major) {
554
555 case 2:
556 if (hdr.version_minor < 3)
557 p->sf.lengths_swapped = SWAPPED;
558 else if (hdr.version_minor == 3)
559 p->sf.lengths_swapped = MAYBE_SWAPPED;
560 else
561 p->sf.lengths_swapped = NOT_SWAPPED;
562 break;
563
564 case 543:
565 p->sf.lengths_swapped = SWAPPED;
566 break;
567
568 default:
569 p->sf.lengths_swapped = NOT_SWAPPED;
570 break;
571 }
572
573 p->read_op = pcap_offline_read;
574 p->setfilter_op = install_bpf_program;
575 p->set_datalink_op = NULL; /* we don't support munging link-layer headers */
576 p->stats_op = sf_stats;
577 p->close_op = sf_close;
578
579 return (p);
580 bad:
581 if(fp)
582 fclose(fp);
583 free(p);
584 return (NULL);
585 }
586
587 /*
588 * Read sf_readfile and return the next packet. Return the header in hdr
589 * and the contents in buf. Return 0 on success, SFERR_EOF if there were
590 * no more packets, and SFERR_TRUNC if a partial packet was encountered.
591 */
592 static int
593 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, u_int buflen)
594 {
595 struct pcap_sf_patched_pkthdr sf_hdr;
596 FILE *fp = p->sf.rfile;
597 bpf_u_int32 t;
598
599 /*
600 * Read the packet header; the structure we use as a buffer
601 * is the longer structure for files generated by the patched
602 * libpcap, but if the file has the magic number for an
603 * unpatched libpcap we only read as many bytes as the regular
604 * header has.
605 */
606 if (fread(&sf_hdr, p->sf.hdrsize, 1, fp) != 1) {
607 /* probably an EOF, though could be a truncated packet */
608 return (1);
609 }
610
611 if (p->sf.swapped) {
612 /* these were written in opposite byte order */
613 hdr->caplen = SWAPLONG(sf_hdr.caplen);
614 hdr->len = SWAPLONG(sf_hdr.len);
615 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
616 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
617 } else {
618 hdr->caplen = sf_hdr.caplen;
619 hdr->len = sf_hdr.len;
620 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
621 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
622 }
623 /* Swap the caplen and len fields, if necessary. */
624 switch (p->sf.lengths_swapped) {
625
626 case NOT_SWAPPED:
627 break;
628
629 case MAYBE_SWAPPED:
630 if (hdr->caplen <= hdr->len) {
631 /*
632 * The captured length is <= the actual length,
633 * so presumably they weren't swapped.
634 */
635 break;
636 }
637 /* FALLTHROUGH */
638
639 case SWAPPED:
640 t = hdr->caplen;
641 hdr->caplen = hdr->len;
642 hdr->len = t;
643 break;
644 }
645
646 if (hdr->caplen > buflen) {
647 /*
648 * This can happen due to Solaris 2.3 systems tripping
649 * over the BUFMOD problem and not setting the snapshot
650 * correctly in the savefile header. If the caplen isn't
651 * grossly wrong, try to salvage.
652 */
653 static u_char *tp = NULL;
654 static size_t tsize = 0;
655
656 if (hdr->caplen > 65535) {
657 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
658 "bogus savefile header");
659 return (-1);
660 }
661
662 if (tsize < hdr->caplen) {
663 tsize = ((hdr->caplen + 1023) / 1024) * 1024;
664 if (tp != NULL)
665 free((u_char *)tp);
666 tp = (u_char *)malloc(tsize);
667 if (tp == NULL) {
668 tsize = 0;
669 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
670 "BUFMOD hack malloc");
671 return (-1);
672 }
673 }
674 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
675 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
676 "truncated dump file");
677 return (-1);
678 }
679 /*
680 * We can only keep up to buflen bytes. Since caplen > buflen
681 * is exactly how we got here, we know we can only keep the
682 * first buflen bytes and must drop the remainder. Adjust
683 * caplen accordingly, so we don't get confused later as
684 * to how many bytes we have to play with.
685 */
686 hdr->caplen = buflen;
687 memcpy((char *)buf, (char *)tp, buflen);
688
689 } else {
690 /* read the packet itself */
691
692 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
693 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
694 "truncated dump file");
695 return (-1);
696 }
697 }
698 return (0);
699 }
700
701 /*
702 * Print out packets stored in the file initialized by sf_read_init().
703 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
704 */
705 int
706 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
707 {
708 struct bpf_insn *fcode = p->fcode.bf_insns;
709 int status = 0;
710 int n = 0;
711
712 while (status == 0) {
713 struct pcap_pkthdr h;
714
715 status = sf_next_packet(p, &h, p->buffer, p->bufsize);
716 if (status) {
717 if (status == 1)
718 return (0);
719 return (status);
720 }
721
722 if (fcode == NULL ||
723 bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
724 (*callback)(user, &h, p->buffer);
725 if (++n >= cnt && cnt > 0)
726 break;
727 }
728 }
729 /*XXX this breaks semantics tcpslice expects */
730 return (n);
731 }
732
733 /*
734 * Output a packet to the initialized dump file.
735 */
736 void
737 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
738 {
739 register FILE *f;
740 struct pcap_sf_pkthdr sf_hdr;
741
742 f = (FILE *)user;
743 sf_hdr.ts.tv_sec = h->ts.tv_sec;
744 sf_hdr.ts.tv_usec = h->ts.tv_usec;
745 sf_hdr.caplen = h->caplen;
746 sf_hdr.len = h->len;
747 /* XXX we should check the return status */
748 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
749 (void)fwrite((char *)sp, h->caplen, 1, f);
750 }
751
752 /*
753 * Initialize so that sf_write() will output to the file named 'fname'.
754 */
755 pcap_dumper_t *
756 pcap_dump_open(pcap_t *p, const char *fname)
757 {
758 FILE *f;
759 int linktype;
760
761 linktype = dlt_to_linktype(p->linktype);
762 if (linktype == -1) {
763 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
764 "%s: link-layer type %d isn't supported in savefiles",
765 fname, linktype);
766 return (NULL);
767 }
768
769 if (fname[0] == '-' && fname[1] == '\0') {
770 f = stdout;
771 #ifdef WIN32
772 _setmode(_fileno(f), _O_BINARY);
773 #endif
774 } else {
775 #ifndef WIN32
776 f = fopen(fname, "w");
777 #else
778 f = fopen(fname, "wb");
779 setbuf(f, NULL); /* XXX - why? */
780 #endif
781 if (f == NULL) {
782 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
783 fname, pcap_strerror(errno));
784 return (NULL);
785 }
786 }
787 (void)sf_write_header(f, linktype, p->tzoff, p->snapshot);
788 return ((pcap_dumper_t *)f);
789 }
790
791 int
792 pcap_dump_flush(pcap_dumper_t *p)
793 {
794
795 if (fflush((FILE *)p) == EOF)
796 return (-1);
797 else
798 return (0);
799 }
800
801 void
802 pcap_dump_close(pcap_dumper_t *p)
803 {
804
805 #ifdef notyet
806 if (ferror((FILE *)p))
807 return-an-error;
808 /* XXX should check return from fclose() too */
809 #endif
810 (void)fclose((FILE *)p);
811 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism