2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * savefile.c - supports offline use of tcpdump
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
32 static const char rcsid
[] =
33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.55.2.7 2002-06-07 04:31:56 guy Exp $ (LBL)";
48 #ifdef HAVE_OS_PROTO_H
52 #define TCPDUMP_MAGIC 0xa1b2c3d4
53 #define PATCHED_TCPDUMP_MAGIC 0xa1b2cd34
56 * We use the "receiver-makes-right" approach to byte order,
57 * because time is at a premium when we are writing the file.
58 * In other words, the pcap_file_header and pcap_pkthdr,
59 * records are written in host byte order.
60 * Note that the packets are always written in network byte order.
62 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
63 * machine (if the file was written in little-end order).
66 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
67 #define SWAPSHORT(y) \
68 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
71 #define SFERR_BADVERSION 2
73 #define SFERR_EOF 4 /* not really an error, just a status */
76 * We don't write DLT_* values to the capture file header, because
77 * they're not the same on all platforms.
79 * Unfortunately, the various flavors of BSD have not always used the same
80 * numerical values for the same data types, and various patches to
81 * libpcap for non-BSD OSes have added their own DLT_* codes for link
82 * layer encapsulation types seen on those OSes, and those codes have had,
83 * in some cases, values that were also used, on other platforms, for other
84 * link layer encapsulation types.
86 * This means that capture files of a type whose numerical DLT_* code
87 * means different things on different BSDs, or with different versions
88 * of libpcap, can't always be read on systems other than those like
89 * the one running on the machine on which the capture was made.
91 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
92 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
93 * codes to DLT_* codes when reading a savefile header.
95 * For those DLT_* codes that have, as far as we know, the same values on
96 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
97 * DLT_xxx; that way, captures of those types can still be read by
98 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
99 * captures of those types written by versions of libpcap that map DLT_
100 * values to LINKTYPE_ values can still be read by older versions
103 * The other LINKTYPE_* codes are given values starting at 100, in the
104 * hopes that no DLT_* code will be given one of those values.
106 * In order to ensure that a given LINKTYPE_* code's value will refer to
107 * the same encapsulation type on all platforms, you should not allocate
108 * a new LINKTYPE_* value without consulting "tcpdump-workers@tcpdump.org".
109 * The tcpdump developers will allocate a value for you, and will not
110 * subsequently allocate it to anybody else; that value will be added to
111 * the "pcap.h" in the tcpdump.org CVS repository, so that a future
112 * libpcap release will include it.
114 * You should, if possible, also contribute patches to libpcap and tcpdump
115 * to handle the new encapsulation type, so that they can also be checked
116 * into the tcpdump.org CVS repository and so that they will appear in
117 * future libpcap and tcpdump releases.
119 #define LINKTYPE_NULL DLT_NULL
120 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */
121 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */
122 #define LINKTYPE_AX25 DLT_AX25
123 #define LINKTYPE_PRONET DLT_PRONET
124 #define LINKTYPE_CHAOS DLT_CHAOS
125 #define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
126 #define LINKTYPE_ARCNET DLT_ARCNET
127 #define LINKTYPE_SLIP DLT_SLIP
128 #define LINKTYPE_PPP DLT_PPP
129 #define LINKTYPE_FDDI DLT_FDDI
132 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
133 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
134 * field) at the beginning of the packet.
136 * This is for use when there is always such a header; the address field
137 * might be 0xff, for regular PPP, or it might be an address field for Cisco
138 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
139 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
141 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
142 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
143 * captures will be written out with a link type that NetBSD's tcpdump
146 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */
148 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */
150 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
151 #define LINKTYPE_RAW 101 /* raw IP */
152 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
153 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
154 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */
155 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */
156 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */
157 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */
159 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */
160 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */
161 #define LINKTYPE_ECONET 115 /* Acorn Econet */
163 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */
164 #define LINKTYPE_PRISM_HEADER 119 /* 802.11+Prism II monitor mode */
165 #define LINKTYPE_AIRONET_HEADER 120 /* FreeBSD Aironet driver stuff */
168 * These types are reserved for future use.
170 #define LINKTYPE_FRELAY 107 /* Frame Relay */
171 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */
172 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */
173 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */
174 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */
175 #define LINKTYPE_IPFILTER 116 /* IP Filter capture files */
176 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */
177 #define LINKTYPE_HHDLC 121 /* Siemens HiPath HDLC */
178 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */
179 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */
181 static struct linktype_map
{
186 * These DLT_* codes have LINKTYPE_* codes with values identical
187 * to the values of the corresponding DLT_* code.
189 { DLT_NULL
, LINKTYPE_NULL
},
190 { DLT_EN10MB
, LINKTYPE_ETHERNET
},
191 { DLT_EN3MB
, LINKTYPE_EXP_ETHERNET
},
192 { DLT_AX25
, LINKTYPE_AX25
},
193 { DLT_PRONET
, LINKTYPE_PRONET
},
194 { DLT_CHAOS
, LINKTYPE_CHAOS
},
195 { DLT_IEEE802
, LINKTYPE_TOKEN_RING
},
196 { DLT_ARCNET
, LINKTYPE_ARCNET
},
197 { DLT_SLIP
, LINKTYPE_SLIP
},
198 { DLT_PPP
, LINKTYPE_PPP
},
199 { DLT_FDDI
, LINKTYPE_FDDI
},
202 * These DLT_* codes have different values on different
203 * platforms; we map them to LINKTYPE_* codes that
204 * have values that should never be equal to any DLT_*
208 /* BSD/OS Frame Relay */
209 { DLT_FR
, LINKTYPE_FRELAY
},
211 { DLT_ATM_RFC1483
, LINKTYPE_ATM_RFC1483
},
212 { DLT_RAW
, LINKTYPE_RAW
},
213 { DLT_SLIP_BSDOS
, LINKTYPE_SLIP_BSDOS
},
214 { DLT_PPP_BSDOS
, LINKTYPE_PPP_BSDOS
},
216 /* BSD/OS Cisco HDLC */
217 { DLT_C_HDLC
, LINKTYPE_C_HDLC
},
220 * These DLT_* codes are not on all platforms, but, so far,
221 * there don't appear to be any platforms that define
222 * other codes with those values; we map them to
223 * different LINKTYPE_* values anyway, just in case.
226 /* Linux ATM Classical IP */
227 { DLT_ATM_CLIP
, LINKTYPE_ATM_CLIP
},
229 /* NetBSD sync/async serial PPP (or Cisco HDLC) */
230 { DLT_PPP_SERIAL
, LINKTYPE_PPP_HDLC
},
232 /* NetBSD PPP over Ethernet */
233 { DLT_PPP_ETHER
, LINKTYPE_PPP_ETHER
},
235 /* IEEE 802.11 wireless */
236 { DLT_IEEE802_11
, LINKTYPE_IEEE802_11
},
239 { DLT_FRELAY
, LINKTYPE_FRELAY
},
241 /* OpenBSD loopback */
242 { DLT_LOOP
, LINKTYPE_LOOP
},
244 /* Linux cooked socket capture */
245 { DLT_LINUX_SLL
, LINKTYPE_LINUX_SLL
},
247 /* Apple LocalTalk hardware */
248 { DLT_LTALK
, LINKTYPE_LTALK
},
251 { DLT_ECONET
, LINKTYPE_ECONET
},
253 /* For Cisco-internal use */
254 { DLT_CISCO_IOS
, LINKTYPE_CISCO_IOS
},
256 /* Prism II monitor-mode header plus 802.11 header */
257 { DLT_PRISM_HEADER
, LINKTYPE_PRISM_HEADER
},
259 /* FreeBSD Aironet driver stuff */
260 { DLT_AIRONET_HEADER
, LINKTYPE_AIRONET_HEADER
},
262 /* Siemens HiPath HDLC */
263 { DLT_HHDLC
, LINKTYPE_HHDLC
},
265 /* RFC 2625 IP-over-Fibre Channel */
266 { DLT_IP_OVER_FC
, LINKTYPE_IP_OVER_FC
},
269 { DLT_SUNATM
, LINKTYPE_SUNATM
},
272 * Any platform that defines additional DLT_* codes should:
274 * request a LINKTYPE_* code and value from tcpdump.org,
277 * add, in their version of libpcap, an entry to map
278 * those DLT_* codes to the corresponding LINKTYPE_*
281 * redefine, in their "net/bpf.h", any DLT_* values
282 * that collide with the values used by their additional
283 * DLT_* codes, to remove those collisions (but without
284 * making them collide with any of the LINKTYPE_*
285 * values equal to 50 or above; they should also avoid
286 * defining DLT_* values that collide with those
287 * LINKTYPE_* values, either).
293 dlt_to_linktype(int dlt
)
297 for (i
= 0; map
[i
].dlt
!= -1; i
++) {
298 if (map
[i
].dlt
== dlt
)
299 return (map
[i
].linktype
);
303 * If we don't have a mapping for this DLT_ code, return an
304 * error; that means that the table above needs to have an
311 linktype_to_dlt(int linktype
)
315 for (i
= 0; map
[i
].linktype
!= -1; i
++) {
316 if (map
[i
].linktype
== linktype
)
321 * If we don't have an entry for this link type, return
322 * the link type value; it may be a DLT_ value from an
323 * older version of libpcap.
329 sf_write_header(FILE *fp
, int linktype
, int thiszone
, int snaplen
)
331 struct pcap_file_header hdr
;
333 hdr
.magic
= TCPDUMP_MAGIC
;
334 hdr
.version_major
= PCAP_VERSION_MAJOR
;
335 hdr
.version_minor
= PCAP_VERSION_MINOR
;
337 hdr
.thiszone
= thiszone
;
338 hdr
.snaplen
= snaplen
;
340 hdr
.linktype
= linktype
;
342 if (fwrite((char *)&hdr
, sizeof(hdr
), 1, fp
) != 1)
349 swap_hdr(struct pcap_file_header
*hp
)
351 hp
->version_major
= SWAPSHORT(hp
->version_major
);
352 hp
->version_minor
= SWAPSHORT(hp
->version_minor
);
353 hp
->thiszone
= SWAPLONG(hp
->thiszone
);
354 hp
->sigfigs
= SWAPLONG(hp
->sigfigs
);
355 hp
->snaplen
= SWAPLONG(hp
->snaplen
);
356 hp
->linktype
= SWAPLONG(hp
->linktype
);
360 pcap_open_offline(const char *fname
, char *errbuf
)
364 struct pcap_file_header hdr
;
368 p
= (pcap_t
*)malloc(sizeof(*p
));
370 strlcpy(errbuf
, "out of swap", PCAP_ERRBUF_SIZE
);
374 memset((char *)p
, 0, sizeof(*p
));
376 * Set this field so we don't close stdin in pcap_close!
380 if (fname
[0] == '-' && fname
[1] == '\0')
383 fp
= fopen(fname
, "r");
385 snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s", fname
,
386 pcap_strerror(errno
));
390 if (fread((char *)&hdr
, sizeof(hdr
), 1, fp
) != 1) {
391 snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "fread: %s",
392 pcap_strerror(errno
));
396 if (magic
!= TCPDUMP_MAGIC
&& magic
!= PATCHED_TCPDUMP_MAGIC
) {
397 magic
= SWAPLONG(magic
);
398 if (magic
!= TCPDUMP_MAGIC
&& magic
!= PATCHED_TCPDUMP_MAGIC
) {
399 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
400 "bad dump file format");
406 if (magic
== PATCHED_TCPDUMP_MAGIC
) {
408 * XXX - the patch that's in some versions of libpcap
409 * changes the packet header but not the magic number;
410 * we'd have to use some hacks^H^H^H^H^Hheuristics to
413 p
->sf
.hdrsize
= sizeof(struct pcap_sf_patched_pkthdr
);
415 p
->sf
.hdrsize
= sizeof(struct pcap_sf_pkthdr
);
416 if (hdr
.version_major
< PCAP_VERSION_MAJOR
) {
417 snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "archaic file format");
420 p
->tzoff
= hdr
.thiszone
;
421 p
->snapshot
= hdr
.snaplen
;
422 p
->linktype
= linktype_to_dlt(hdr
.linktype
);
424 p
->bufsize
= hdr
.snaplen
;
426 /* Align link header as required for proper data alignment */
427 /* XXX should handle all types */
428 switch (p
->linktype
) {
435 linklen
= 13 + 8; /* fddi_header + llc */
445 p
->bufsize
= BPF_MAXBUFSIZE
;
446 p
->sf
.base
= (u_char
*)malloc(p
->bufsize
+ BPF_ALIGNMENT
);
447 if (p
->sf
.base
== NULL
) {
448 strlcpy(errbuf
, "out of swap", PCAP_ERRBUF_SIZE
);
451 p
->buffer
= p
->sf
.base
+ BPF_ALIGNMENT
- (linklen
% BPF_ALIGNMENT
);
452 p
->sf
.version_major
= hdr
.version_major
;
453 p
->sf
.version_minor
= hdr
.version_minor
;
455 /* XXX padding only needed for kernel fcode */
466 * Read sf_readfile and return the next packet. Return the header in hdr
467 * and the contents in buf. Return 0 on success, SFERR_EOF if there were
468 * no more packets, and SFERR_TRUNC if a partial packet was encountered.
471 sf_next_packet(pcap_t
*p
, struct pcap_pkthdr
*hdr
, u_char
*buf
, int buflen
)
473 struct pcap_sf_patched_pkthdr sf_hdr
;
474 FILE *fp
= p
->sf
.rfile
;
477 * Read the packet header; the structure we use as a buffer
478 * is the longer structure for files generated by the patched
479 * libpcap, but if the file has the magic number for an
480 * unpatched libpcap we only read as many bytes as the regular
483 if (fread(&sf_hdr
, p
->sf
.hdrsize
, 1, fp
) != 1) {
484 /* probably an EOF, though could be a truncated packet */
489 /* these were written in opposite byte order */
490 hdr
->caplen
= SWAPLONG(sf_hdr
.caplen
);
491 hdr
->len
= SWAPLONG(sf_hdr
.len
);
492 hdr
->ts
.tv_sec
= SWAPLONG(sf_hdr
.ts
.tv_sec
);
493 hdr
->ts
.tv_usec
= SWAPLONG(sf_hdr
.ts
.tv_usec
);
495 hdr
->caplen
= sf_hdr
.caplen
;
496 hdr
->len
= sf_hdr
.len
;
497 hdr
->ts
.tv_sec
= sf_hdr
.ts
.tv_sec
;
498 hdr
->ts
.tv_usec
= sf_hdr
.ts
.tv_usec
;
501 * We interchanged the caplen and len fields at version 2.3,
502 * in order to match the bpf header layout. But unfortunately
503 * some files were written with version 2.3 in their headers
504 * but without the interchanged fields.
506 if (p
->sf
.version_minor
< 3 ||
507 (p
->sf
.version_minor
== 3 && hdr
->caplen
> hdr
->len
)) {
509 hdr
->caplen
= hdr
->len
;
513 if (hdr
->caplen
> buflen
) {
515 * This can happen due to Solaris 2.3 systems tripping
516 * over the BUFMOD problem and not setting the snapshot
517 * correctly in the savefile header. If the caplen isn't
518 * grossly wrong, try to salvage.
520 static u_char
*tp
= NULL
;
521 static int tsize
= 0;
523 if (hdr
->caplen
> 65535) {
524 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
525 "bogus savefile header");
529 if (tsize
< hdr
->caplen
) {
530 tsize
= ((hdr
->caplen
+ 1023) / 1024) * 1024;
533 tp
= (u_char
*)malloc(tsize
);
536 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
537 "BUFMOD hack malloc");
541 if (fread((char *)tp
, hdr
->caplen
, 1, fp
) != 1) {
542 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
543 "truncated dump file");
547 * We can only keep up to buflen bytes. Since caplen > buflen
548 * is exactly how we got here, we know we can only keep the
549 * first buflen bytes and must drop the remainder. Adjust
550 * caplen accordingly, so we don't get confused later as
551 * to how many bytes we have to play with.
553 hdr
->caplen
= buflen
;
554 memcpy((char *)buf
, (char *)tp
, buflen
);
557 /* read the packet itself */
559 if (fread((char *)buf
, hdr
->caplen
, 1, fp
) != 1) {
560 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
561 "truncated dump file");
569 * Print out packets stored in the file initialized by sf_read_init().
570 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
573 pcap_offline_read(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
575 struct bpf_insn
*fcode
= p
->fcode
.bf_insns
;
579 while (status
== 0) {
580 struct pcap_pkthdr h
;
582 status
= sf_next_packet(p
, &h
, p
->buffer
, p
->bufsize
);
590 bpf_filter(fcode
, p
->buffer
, h
.len
, h
.caplen
)) {
591 (*callback
)(user
, &h
, p
->buffer
);
592 if (++n
>= cnt
&& cnt
> 0)
596 /*XXX this breaks semantics tcpslice expects */
601 * Output a packet to the initialized dump file.
604 pcap_dump(u_char
*user
, const struct pcap_pkthdr
*h
, const u_char
*sp
)
607 struct pcap_sf_pkthdr sf_hdr
;
610 sf_hdr
.ts
.tv_sec
= h
->ts
.tv_sec
;
611 sf_hdr
.ts
.tv_usec
= h
->ts
.tv_usec
;
612 sf_hdr
.caplen
= h
->caplen
;
614 /* XXX we should check the return status */
615 (void)fwrite(&sf_hdr
, sizeof(sf_hdr
), 1, f
);
616 (void)fwrite((char *)sp
, h
->caplen
, 1, f
);
620 * Initialize so that sf_write() will output to the file named 'fname'.
623 pcap_dump_open(pcap_t
*p
, const char *fname
)
628 linktype
= dlt_to_linktype(p
->linktype
);
629 if (linktype
== -1) {
630 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
631 "%s: link-layer type %d isn't supported in savefiles",
636 if (fname
[0] == '-' && fname
[1] == '\0')
639 f
= fopen(fname
, "w");
641 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s",
642 fname
, pcap_strerror(errno
));
646 (void)sf_write_header(f
, linktype
, p
->tzoff
, p
->snapshot
);
647 return ((pcap_dumper_t
*)f
);
651 pcap_dump_close(pcap_dumper_t
*p
)
655 if (ferror((FILE *)p
))
657 /* XXX should check return from fclose() too */
659 (void)fclose((FILE *)p
);