Lines Matching +full:magic +full:- +full:packet
21 * savefile.c - supports offline use of tcpdump
25 * Used to save the received packet headers, after filtering, to
33 #include <pcap-types.h>
46 #include "pcap-int.h"
49 #include "os-proto.h"
52 #include "sf-pcap.h"
53 #include "sf-pcapng.h"
54 #include "pcap-common.h"
67 * a HANDLE (which is OS-defined, not CRT-defined, and is part of the Win32
91 * it's in non-blocking mode. in sf_getnonblock()
101 * requests to put it in non-blocking mode. (If it's a in sf_setnonblock()
102 * pipe, it could be put in non-blocking mode, but that in sf_setnonblock()
107 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_setnonblock()
108 "Savefiles cannot be put into non-blocking mode"); in sf_setnonblock()
109 return (-1); in sf_setnonblock()
125 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_stats()
127 return (-1); in sf_stats()
134 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_stats_ex()
142 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_setbuff()
144 return (-1); in sf_setbuff()
150 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_setmode()
152 return (-1); in sf_setmode()
158 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_setmintocopy()
160 return (-1); in sf_setmintocopy()
166 (void)snprintf(pcap->errbuf, sizeof(pcap->errbuf), in sf_getevent()
175 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_oid_get_request()
184 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_oid_set_request()
192 pcapint_strlcpy(p->errbuf, "Sending packets isn't supported on savefiles", in sf_sendqueue_transmit()
200 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_setuserbuffer()
202 return (-1); in sf_setuserbuffer()
208 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_live_dump()
209 "Live packet dumping cannot be performed when reading from a file"); in sf_live_dump()
210 return (-1); in sf_live_dump()
216 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, in sf_live_dump_ended()
217 "Live packet dumping cannot be performed on a pcap_open_dead pcap_t"); in sf_live_dump_ended()
218 return (-1); in sf_live_dump_ended()
231 pcapint_strlcpy(p->errbuf, "Sending packets isn't supported on savefiles", in sf_inject()
233 return (-1); in sf_inject()
243 snprintf(p->errbuf, sizeof(p->errbuf), in sf_setdirection()
245 return (-1); in sf_setdirection()
251 if (p->rfile != stdin) in pcapint_sf_cleanup()
252 (void)fclose(p->rfile); in pcapint_sf_cleanup()
253 if (p->buffer != NULL) in pcapint_sf_cleanup()
254 free(p->buffer); in pcapint_sf_cleanup()
255 pcap_freecode(&p->fcode); in pcapint_sf_cleanup()
262 * If we're in UTF-8 mode, map the pathname from UTF-8 to UTF-16LE and
281 * Map from UTF-8 to UTF-16LE. in pcapint_charset_fopen()
294 * XXX - what about Windows errors? in pcapint_charset_fopen()
300 * Now convert the mode to UTF-16LE as well. in pcapint_charset_fopen()
322 * OK, we have UTF-16LE strings; hand them to in pcapint_charset_fopen()
328 * Make sure freeing the UTF-16LE string doesn't in pcapint_charset_fopen()
358 if (fname[0] == '-' && fname[1] == '\0') in pcap_open_offline_with_tstamp_precision()
377 * in "local code page" or "UTF-8" mode, and treats the in pcap_open_offline_with_tstamp_precision()
382 * support it, even though it does nothing. For MS-DOS, in pcap_open_offline_with_tstamp_precision()
443 * Given a link-layer header type and snapshot length, return a
447 * XXX - the only reason why we limit it to <= INT_MAX is so that
448 * it fits in p->snapshot, and the only reason that p->snapshot is
457 * link-layer type as a fallback. in pcapint_adjust_snapshot()
459 * XXX - we don't clamp snapshot lengths that are in pcapint_adjust_snapshot()
484 uint8_t magic[4]; in pcap_fopen_offline_with_tstamp_precision() local
506 * Windows Sniffer, and Microsoft Network Monitor) all have magic in pcap_fopen_offline_with_tstamp_precision()
509 amt_read = fread(&magic, 1, sizeof(magic), fp); in pcap_fopen_offline_with_tstamp_precision()
510 if (amt_read != sizeof(magic)) { in pcap_fopen_offline_with_tstamp_precision()
517 sizeof(magic), amt_read); in pcap_fopen_offline_with_tstamp_precision()
526 p = (*check_headers[i])(magic, fp, precision, errbuf, &err); in pcap_fopen_offline_with_tstamp_precision()
546 p->rfile = fp; in pcap_fopen_offline_with_tstamp_precision()
549 p->fddipad = 0; in pcap_fopen_offline_with_tstamp_precision()
559 p->selectable_fd = fileno(fp); in pcap_fopen_offline_with_tstamp_precision()
562 p->can_set_rfmon_op = sf_cant_set_rfmon; in pcap_fopen_offline_with_tstamp_precision()
563 p->read_op = pcapint_offline_read; in pcap_fopen_offline_with_tstamp_precision()
564 p->inject_op = sf_inject; in pcap_fopen_offline_with_tstamp_precision()
565 p->setfilter_op = pcapint_install_bpf_program; in pcap_fopen_offline_with_tstamp_precision()
566 p->setdirection_op = sf_setdirection; in pcap_fopen_offline_with_tstamp_precision()
567 p->set_datalink_op = NULL; /* we don't support munging link-layer headers */ in pcap_fopen_offline_with_tstamp_precision()
568 p->getnonblock_op = sf_getnonblock; in pcap_fopen_offline_with_tstamp_precision()
569 p->setnonblock_op = sf_setnonblock; in pcap_fopen_offline_with_tstamp_precision()
570 p->stats_op = sf_stats; in pcap_fopen_offline_with_tstamp_precision()
572 p->stats_ex_op = sf_stats_ex; in pcap_fopen_offline_with_tstamp_precision()
573 p->setbuff_op = sf_setbuff; in pcap_fopen_offline_with_tstamp_precision()
574 p->setmode_op = sf_setmode; in pcap_fopen_offline_with_tstamp_precision()
575 p->setmintocopy_op = sf_setmintocopy; in pcap_fopen_offline_with_tstamp_precision()
576 p->getevent_op = sf_getevent; in pcap_fopen_offline_with_tstamp_precision()
577 p->oid_get_request_op = sf_oid_get_request; in pcap_fopen_offline_with_tstamp_precision()
578 p->oid_set_request_op = sf_oid_set_request; in pcap_fopen_offline_with_tstamp_precision()
579 p->sendqueue_transmit_op = sf_sendqueue_transmit; in pcap_fopen_offline_with_tstamp_precision()
580 p->setuserbuffer_op = sf_setuserbuffer; in pcap_fopen_offline_with_tstamp_precision()
581 p->live_dump_op = sf_live_dump; in pcap_fopen_offline_with_tstamp_precision()
582 p->live_dump_ended_op = sf_live_dump_ended; in pcap_fopen_offline_with_tstamp_precision()
583 p->get_airpcap_handle_op = sf_get_airpcap_handle; in pcap_fopen_offline_with_tstamp_precision()
587 * For offline captures, the standard one-shot callback can in pcap_fopen_offline_with_tstamp_precision()
590 p->oneshot_callback = pcapint_oneshot; in pcap_fopen_offline_with_tstamp_precision()
595 p->breakloop_op = pcapint_breakloop_common; in pcap_fopen_offline_with_tstamp_precision()
600 p->bpf_codegen_flags = 0; in pcap_fopen_offline_with_tstamp_precision()
602 p->activated = 1; in pcap_fopen_offline_with_tstamp_precision()
623 * packet.
635 * which would overflow the packet count, causing it either in pcapint_offline_read()
639 * return a too-low count. in pcapint_offline_read()
641 * Therefore, if the packet count is unlimited, we clip in pcapint_offline_read()
654 * If so, return immediately - if we haven't read any in pcapint_offline_read()
655 * packets, clear the flag and return -2 to indicate in pcapint_offline_read()
661 if (p->break_loop) { in pcapint_offline_read()
663 p->break_loop = 0; in pcapint_offline_read()
664 return (-2); in pcapint_offline_read()
669 status = p->next_packet_op(p, &h, &data); in pcapint_offline_read()
684 * OK, we've read a packet; run it through the filter in pcapint_offline_read()
687 if ((fcode = p->fcode.bf_insns) == NULL || in pcapint_offline_read()
690 n++; /* count the packet */ in pcapint_offline_read()