xref: /freebsd/contrib/libpcap/savefile.c (revision 6990ffd8a95caaba6858ad44ff1b3157d1efba8f)
1 /*
2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  * savefile.c - supports offline use of tcpdump
22  *	Extraction/creation by Jeffrey Mogul, DECWRL
23  *	Modified by Steve McCanne, LBL.
24  *
25  * Used to save the received packet headers, after filtering, to
26  * a file, and then read them later.
27  * The first record in the file contains saved values for the machine
28  * dependent values so we can print the dump file on any architecture.
29  */
30 
31 #ifndef lint
32 static const char rcsid[] =
33     "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.49 2000/12/21 10:29:23 guy Exp $ (LBL)";
34 #endif
35 
36 #ifdef HAVE_CONFIG_H
37 #include "config.h"
38 #endif
39 
40 #include <sys/types.h>
41 #include <sys/time.h>
42 
43 #include <errno.h>
44 #include <memory.h>
45 #include <stdio.h>
46 #include <stdlib.h>
47 #include <string.h>
48 #include <unistd.h>
49 
50 #include "pcap-int.h"
51 
52 #ifdef HAVE_OS_PROTO_H
53 #include "os-proto.h"
54 #endif
55 
56 #define TCPDUMP_MAGIC 0xa1b2c3d4
57 #define PATCHED_TCPDUMP_MAGIC 0xa1b2cd34
58 
59 /*
60  * We use the "receiver-makes-right" approach to byte order,
61  * because time is at a premium when we are writing the file.
62  * In other words, the pcap_file_header and pcap_pkthdr,
63  * records are written in host byte order.
64  * Note that the packets are always written in network byte order.
65  *
66  * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
67  * machine (if the file was written in little-end order).
68  */
69 #define	SWAPLONG(y) \
70 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
71 #define	SWAPSHORT(y) \
72 	( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
73 
74 #define SFERR_TRUNC		1
75 #define SFERR_BADVERSION	2
76 #define SFERR_BADF		3
77 #define SFERR_EOF		4 /* not really an error, just a status */
78 
79 /*
80  * We don't write DLT_* values to the capture file header, because
81  * they're not the same on all platforms.
82  *
83  * Unfortunately, the various flavors of BSD have not always used the same
84  * numerical values for the same data types, and various patches to
85  * libpcap for non-BSD OSes have added their own DLT_* codes for link
86  * layer encapsulation types seen on those OSes, and those codes have had,
87  * in some cases, values that were also used, on other platforms, for other
88  * link layer encapsulation types.
89  *
90  * This means that capture files of a type whose numerical DLT_* code
91  * means different things on different BSDs, or with different versions
92  * of libpcap, can't always be read on systems other than those like
93  * the one running on the machine on which the capture was made.
94  *
95  * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
96  * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
97  * codes to DLT_* codes when reading a savefile header.
98  *
99  * For those DLT_* codes that have, as far as we know, the same values on
100  * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
101  * DLT_xxx; that way, captures of those types can still be read by
102  * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
103  * captures of those types written by versions of libpcap that map DLT_
104  * values to LINKTYPE_ values can still be read by older versions
105  * of libpcap.
106  *
107  * The other LINKTYPE_* codes are given values starting at 100, in the
108  * hopes that no DLT_* code will be given one of those values.
109  *
110  * In order to ensure that a given LINKTYPE_* code's value will refer to
111  * the same encapsulation type on all platforms, you should not allocate
112  * a new LINKTYPE_* value without consulting "tcpdump-workers@tcpdump.org".
113  * The tcpdump developers will allocate a value for you, and will not
114  * subsequently allocate it to anybody else; that value will be added to
115  * the "pcap.h" in the tcpdump.org CVS repository, so that a future
116  * libpcap release will include it.
117  *
118  * You should, if possible, also contribute patches to libpcap and tcpdump
119  * to handle the new encapsulation type, so that they can also be checked
120  * into the tcpdump.org CVS repository and so that they will appear in
121  * future libpcap and tcpdump releases.
122  */
123 #define LINKTYPE_NULL		DLT_NULL
124 #define LINKTYPE_ETHERNET	DLT_EN10MB	/* also for 100Mb and up */
125 #define LINKTYPE_EXP_ETHERNET	DLT_EN3MB	/* 3Mb experimental Ethernet */
126 #define LINKTYPE_AX25		DLT_AX25
127 #define LINKTYPE_PRONET		DLT_PRONET
128 #define LINKTYPE_CHAOS		DLT_CHAOS
129 #define LINKTYPE_TOKEN_RING	DLT_IEEE802	/* DLT_IEEE802 is used for Token Ring */
130 #define LINKTYPE_ARCNET		DLT_ARCNET
131 #define LINKTYPE_SLIP		DLT_SLIP
132 #define LINKTYPE_PPP		DLT_PPP
133 #define LINKTYPE_FDDI		DLT_FDDI
134 
135 /*
136  * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
137  * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
138  * field) at the beginning of the packet.
139  *
140  * This is for use when there is always such a header; the address field
141  * might be 0xff, for regular PPP, or it might be an address field for Cisco
142  * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
143  * HDLC").  This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
144  *
145  * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
146  * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
147  * captures will be written out with a link type that NetBSD's tcpdump
148  * can read.
149  */
150 #define LINKTYPE_PPP_HDLC	50		/* PPP in HDLC-like framing */
151 
152 #define LINKTYPE_ATM_RFC1483	100		/* LLC/SNAP-encapsulated ATM */
153 #define LINKTYPE_RAW		101		/* raw IP */
154 #define LINKTYPE_SLIP_BSDOS	102		/* BSD/OS SLIP BPF header */
155 #define LINKTYPE_PPP_BSDOS	103		/* BSD/OS PPP BPF header */
156 #define LINKTYPE_C_HDLC		104		/* Cisco HDLC */
157 #define LINKTYPE_ATM_CLIP	106		/* Linux Classical IP over ATM */
158 
159 /*
160  * Reserved for future use.
161  */
162 #define LINKTYPE_IEEE802_11	105		/* IEEE 802.11 (wireless) */
163 #define LINKTYPE_FR		107		/* BSD/OS Frame Relay */
164 #define LINKTYPE_LOOP		108		/* OpenBSD loopback */
165 #define LINKTYPE_ENC		109		/* OpenBSD IPSEC enc */
166 #define LINKTYPE_LANE8023	110		/* ATM LANE + 802.3 */
167 #define LINKTYPE_HIPPI		111		/* NetBSD HIPPI */
168 #define LINKTYPE_HDLC		112		/* NetBSD HDLC framing */
169 
170 #define LINKTYPE_LINUX_SLL	113		/* Linux cooked socket capture */
171 
172 static struct linktype_map {
173 	int	dlt;
174 	int	linktype;
175 } map[] = {
176 	/*
177 	 * These DLT_* codes have LINKTYPE_* codes with values identical
178 	 * to the values of the corresponding DLT_* code.
179 	 */
180 	{ DLT_NULL,		LINKTYPE_NULL },
181 	{ DLT_EN10MB,		LINKTYPE_ETHERNET },
182 	{ DLT_EN3MB,		LINKTYPE_EXP_ETHERNET },
183 	{ DLT_AX25,		LINKTYPE_AX25 },
184 	{ DLT_PRONET,		LINKTYPE_PRONET },
185 	{ DLT_CHAOS,		LINKTYPE_CHAOS },
186 	{ DLT_IEEE802,		LINKTYPE_TOKEN_RING },
187 	{ DLT_ARCNET,		LINKTYPE_ARCNET },
188 	{ DLT_SLIP,		LINKTYPE_SLIP },
189 	{ DLT_PPP,		LINKTYPE_PPP },
190 	{ DLT_FDDI,	 	LINKTYPE_FDDI },
191 
192 	/*
193 	 * These DLT_* codes have different values on different
194 	 * platforms; we map them to LINKTYPE_* codes that
195 	 * have values that should never be equal to any DLT_*
196 	 * code.
197 	 */
198 	{ DLT_ATM_RFC1483, 	LINKTYPE_ATM_RFC1483 },
199 	{ DLT_RAW,		LINKTYPE_RAW },
200 	{ DLT_SLIP_BSDOS,	LINKTYPE_SLIP_BSDOS },
201 	{ DLT_PPP_BSDOS,	LINKTYPE_PPP_BSDOS },
202 
203 	/* BSD/OS Cisco HDLC */
204 	{ DLT_C_HDLC,		LINKTYPE_C_HDLC },
205 
206 	/*
207 	 * These DLT_* codes are not on all platforms, but, so far,
208 	 * there don't appear to be any platforms that define
209 	 * other codes with those values; we map them to
210 	 * different LINKTYPE_* values anyway, just in case.
211 	 */
212 
213 	/* Linux ATM Classical IP */
214 	{ DLT_ATM_CLIP,		LINKTYPE_ATM_CLIP },
215 
216 	/* NetBSD sync/async serial PPP (or Cisco HDLC) */
217 	{ DLT_PPP_SERIAL,	LINKTYPE_PPP_HDLC },
218 
219 	/* IEEE 802.11 wireless */
220 	{ DLT_IEEE802_11,	LINKTYPE_IEEE802_11 },
221 
222 	/* OpenBSD loopback */
223 	{ DLT_LOOP,		LINKTYPE_LOOP },
224 
225 	/* Linux cooked socket capture */
226 	{ DLT_LINUX_SLL,	LINKTYPE_LINUX_SLL },
227 
228 	/*
229 	 * Any platform that defines additional DLT_* codes should:
230 	 *
231 	 *	request a LINKTYPE_* code and value from tcpdump.org,
232 	 *	as per the above;
233 	 *
234 	 *	add, in their version of libpcap, an entry to map
235 	 *	those DLT_* codes to the corresponding LINKTYPE_*
236 	 *	code;
237 	 *
238 	 *	redefine, in their "net/bpf.h", any DLT_* values
239 	 *	that collide with the values used by their additional
240 	 *	DLT_* codes, to remove those collisions (but without
241 	 *	making them collide with any of the LINKTYPE_*
242 	 *	values equal to 50 or above; they should also avoid
243 	 *	defining DLT_* values that collide with those
244 	 *	LINKTYPE_* values, either).
245 	 */
246 	{ -1,			-1 }
247 };
248 
249 static int
250 dlt_to_linktype(int dlt)
251 {
252 	int i;
253 
254 	for (i = 0; map[i].dlt != -1; i++) {
255 		if (map[i].dlt == dlt)
256 			return (map[i].linktype);
257 	}
258 
259 	/*
260 	 * If we don't have a mapping for this DLT_ code, return an
261 	 * error; that means that the table above needs to have an
262 	 * entry added.
263 	 */
264 	return (-1);
265 }
266 
267 static int
268 linktype_to_dlt(int linktype)
269 {
270 	int i;
271 
272 	for (i = 0; map[i].linktype != -1; i++) {
273 		if (map[i].linktype == linktype)
274 			return (map[i].dlt);
275 	}
276 
277 	/*
278 	 * If we don't have an entry for this link type, return
279 	 * the link type value; it may be a DLT_ value from an
280 	 * older version of libpcap.
281 	 */
282 	return linktype;
283 }
284 
285 static int
286 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
287 {
288 	struct pcap_file_header hdr;
289 
290 	hdr.magic = TCPDUMP_MAGIC;
291 	hdr.version_major = PCAP_VERSION_MAJOR;
292 	hdr.version_minor = PCAP_VERSION_MINOR;
293 
294 	hdr.thiszone = thiszone;
295 	hdr.snaplen = snaplen;
296 	hdr.sigfigs = 0;
297 	hdr.linktype = linktype;
298 
299 	if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
300 		return (-1);
301 
302 	return (0);
303 }
304 
305 static void
306 swap_hdr(struct pcap_file_header *hp)
307 {
308 	hp->version_major = SWAPSHORT(hp->version_major);
309 	hp->version_minor = SWAPSHORT(hp->version_minor);
310 	hp->thiszone = SWAPLONG(hp->thiszone);
311 	hp->sigfigs = SWAPLONG(hp->sigfigs);
312 	hp->snaplen = SWAPLONG(hp->snaplen);
313 	hp->linktype = SWAPLONG(hp->linktype);
314 }
315 
316 pcap_t *
317 pcap_open_offline(const char *fname, char *errbuf)
318 {
319 	register pcap_t *p;
320 	register FILE *fp;
321 	struct pcap_file_header hdr;
322 	bpf_u_int32 magic;
323 	int linklen;
324 
325 	p = (pcap_t *)malloc(sizeof(*p));
326 	if (p == NULL) {
327 		strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
328 		return (NULL);
329 	}
330 
331 	memset((char *)p, 0, sizeof(*p));
332 	/*
333 	 * Set this field so we don't close stdin in pcap_close!
334 	 */
335 	p->fd = -1;
336 
337 	if (fname[0] == '-' && fname[1] == '\0')
338 		fp = stdin;
339 	else {
340 		fp = fopen(fname, "r");
341 		if (fp == NULL) {
342 			snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", fname,
343 			    pcap_strerror(errno));
344 			goto bad;
345 		}
346 	}
347 	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
348 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "fread: %s",
349 		    pcap_strerror(errno));
350 		goto bad;
351 	}
352 	magic = hdr.magic;
353 	if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC) {
354 		magic = SWAPLONG(magic);
355 		if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC) {
356 			snprintf(errbuf, PCAP_ERRBUF_SIZE,
357 			    "bad dump file format");
358 			goto bad;
359 		}
360 		p->sf.swapped = 1;
361 		swap_hdr(&hdr);
362 	}
363 	if (magic == PATCHED_TCPDUMP_MAGIC) {
364 		/*
365 		 * XXX - the patch that's in some versions of libpcap
366 		 * changes the packet header but not the magic number;
367 		 * we'd have to use some hacks^H^H^H^H^Hheuristics to
368 		 * detect that.
369 		 */
370 		p->sf.hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
371 	} else
372 		p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr);
373 	if (hdr.version_major < PCAP_VERSION_MAJOR) {
374 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format");
375 		goto bad;
376 	}
377 	p->tzoff = hdr.thiszone;
378 	p->snapshot = hdr.snaplen;
379 	p->linktype = linktype_to_dlt(hdr.linktype);
380 	p->sf.rfile = fp;
381 	p->bufsize = hdr.snaplen;
382 
383 	/* Align link header as required for proper data alignment */
384 	/* XXX should handle all types */
385 	switch (p->linktype) {
386 
387 	case DLT_EN10MB:
388 		linklen = 14;
389 		break;
390 
391 	case DLT_FDDI:
392 		linklen = 13 + 8;	/* fddi_header + llc */
393 		break;
394 
395 	case DLT_NULL:
396 	default:
397 		linklen = 0;
398 		break;
399 	}
400 
401 	if (p->bufsize < 0)
402 		p->bufsize = BPF_MAXBUFSIZE;
403 	p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
404 	if (p->sf.base == NULL) {
405 		strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE);
406 		goto bad;
407 	}
408 	p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
409 	p->sf.version_major = hdr.version_major;
410 	p->sf.version_minor = hdr.version_minor;
411 #ifdef PCAP_FDDIPAD
412 	/* XXX padding only needed for kernel fcode */
413 	pcap_fddipad = 0;
414 #endif
415 
416 	return (p);
417  bad:
418 	free(p);
419 	return (NULL);
420 }
421 
422 /*
423  * Read sf_readfile and return the next packet.  Return the header in hdr
424  * and the contents in buf.  Return 0 on success, SFERR_EOF if there were
425  * no more packets, and SFERR_TRUNC if a partial packet was encountered.
426  */
427 static int
428 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen)
429 {
430 	struct pcap_sf_patched_pkthdr sf_hdr;
431 	FILE *fp = p->sf.rfile;
432 
433 	/*
434 	 * Read the packet header; the structure we use as a buffer
435 	 * is the longer structure for files generated by the patched
436 	 * libpcap, but if the file has the magic number for an
437 	 * unpatched libpcap we only read as many bytes as the regular
438 	 * header has.
439 	 */
440 	if (fread(&sf_hdr, p->sf.hdrsize, 1, fp) != 1) {
441 		/* probably an EOF, though could be a truncated packet */
442 		return (1);
443 	}
444 
445 	if (p->sf.swapped) {
446 		/* these were written in opposite byte order */
447 		hdr->caplen = SWAPLONG(sf_hdr.caplen);
448 		hdr->len = SWAPLONG(sf_hdr.len);
449 		hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
450 		hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
451 	} else {
452 		hdr->caplen = sf_hdr.caplen;
453 		hdr->len = sf_hdr.len;
454 		hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
455 		hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
456 	}
457 	/*
458 	 * We interchanged the caplen and len fields at version 2.3,
459 	 * in order to match the bpf header layout.  But unfortunately
460 	 * some files were written with version 2.3 in their headers
461 	 * but without the interchanged fields.
462 	 */
463 	if (p->sf.version_minor < 3 ||
464 	    (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) {
465 		int t = hdr->caplen;
466 		hdr->caplen = hdr->len;
467 		hdr->len = t;
468 	}
469 
470 	if (hdr->caplen > buflen) {
471 		/*
472 		 * This can happen due to Solaris 2.3 systems tripping
473 		 * over the BUFMOD problem and not setting the snapshot
474 		 * correctly in the savefile header.  If the caplen isn't
475 		 * grossly wrong, try to salvage.
476 		 */
477 		static u_char *tp = NULL;
478 		static int tsize = 0;
479 
480 		if (hdr->caplen > 65535) {
481 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
482 			    "bogus savefile header");
483 			return (-1);
484 		}
485 
486 		if (tsize < hdr->caplen) {
487 			tsize = ((hdr->caplen + 1023) / 1024) * 1024;
488 			if (tp != NULL)
489 				free((u_char *)tp);
490 			tp = (u_char *)malloc(tsize);
491 			if (tp == NULL) {
492 				tsize = 0;
493 				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
494 				    "BUFMOD hack malloc");
495 				return (-1);
496 			}
497 		}
498 		if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
499 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
500 			    "truncated dump file");
501 			return (-1);
502 		}
503 		/*
504 		 * We can only keep up to buflen bytes.  Since caplen > buflen
505 		 * is exactly how we got here, we know we can only keep the
506 		 * first buflen bytes and must drop the remainder.  Adjust
507 		 * caplen accordingly, so we don't get confused later as
508 		 * to how many bytes we have to play with.
509 		 */
510 		hdr->caplen = buflen;
511 		memcpy((char *)buf, (char *)tp, buflen);
512 
513 	} else {
514 		/* read the packet itself */
515 
516 		if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
517 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
518 			    "truncated dump file");
519 			return (-1);
520 		}
521 	}
522 	return (0);
523 }
524 
525 /*
526  * Print out packets stored in the file initialized by sf_read_init().
527  * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
528  */
529 int
530 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
531 {
532 	struct bpf_insn *fcode = p->fcode.bf_insns;
533 	int status = 0;
534 	int n = 0;
535 
536 	while (status == 0) {
537 		struct pcap_pkthdr h;
538 
539 		status = sf_next_packet(p, &h, p->buffer, p->bufsize);
540 		if (status) {
541 			if (status == 1)
542 				return (0);
543 			return (status);
544 		}
545 
546 		if (fcode == NULL ||
547 		    bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
548 			(*callback)(user, &h, p->buffer);
549 			if (++n >= cnt && cnt > 0)
550 				break;
551 		}
552 	}
553 	/*XXX this breaks semantics tcpslice expects */
554 	return (n);
555 }
556 
557 /*
558  * Output a packet to the initialized dump file.
559  */
560 void
561 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
562 {
563 	register FILE *f;
564 	struct pcap_sf_pkthdr sf_hdr;
565 
566 	f = (FILE *)user;
567 	sf_hdr.ts.tv_sec  = h->ts.tv_sec;
568 	sf_hdr.ts.tv_usec = h->ts.tv_usec;
569 	sf_hdr.caplen     = h->caplen;
570 	sf_hdr.len        = h->len;
571 	/* XXX we should check the return status */
572 	(void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
573 	(void)fwrite((char *)sp, h->caplen, 1, f);
574 }
575 
576 /*
577  * Initialize so that sf_write() will output to the file named 'fname'.
578  */
579 pcap_dumper_t *
580 pcap_dump_open(pcap_t *p, const char *fname)
581 {
582 	FILE *f;
583 	int linktype;
584 
585 	linktype = dlt_to_linktype(p->linktype);
586 	if (linktype == -1) {
587 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
588 		    "%s: link-layer type %d isn't supported in savefiles",
589 		    fname, linktype);
590 		return (NULL);
591 	}
592 
593 	if (fname[0] == '-' && fname[1] == '\0')
594 		f = stdout;
595 	else {
596 		f = fopen(fname, "w");
597 		if (f == NULL) {
598 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
599 			    fname, pcap_strerror(errno));
600 			return (NULL);
601 		}
602 	}
603 	(void)sf_write_header(f, linktype, p->tzoff, p->snapshot);
604 	return ((pcap_dumper_t *)f);
605 }
606 
607 void
608 pcap_dump_close(pcap_dumper_t *p)
609 {
610 
611 #ifdef notyet
612 	if (ferror((FILE *)p))
613 		return-an-error;
614 	/* XXX should check return from fclose() too */
615 #endif
616 	(void)fclose((FILE *)p);
617 }
618