1 /* 2 * Copyright (c) 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * savefile.c - supports offline use of tcpdump 22 * Extraction/creation by Jeffrey Mogul, DECWRL 23 * Modified by Steve McCanne, LBL. 24 * 25 * Used to save the received packet headers, after filtering, to 26 * a file, and then read them later. 27 * The first record in the file contains saved values for the machine 28 * dependent values so we can print the dump file on any architecture. 29 */ 30 31 #ifndef lint 32 static const char rcsid[] = 33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.49 2000/12/21 10:29:23 guy Exp $ (LBL)"; 34 #endif 35 36 #ifdef HAVE_CONFIG_H 37 #include "config.h" 38 #endif 39 40 #include <sys/types.h> 41 #include <sys/time.h> 42 43 #include <errno.h> 44 #include <memory.h> 45 #include <stdio.h> 46 #include <stdlib.h> 47 #include <string.h> 48 #include <unistd.h> 49 50 #include "pcap-int.h" 51 52 #ifdef HAVE_OS_PROTO_H 53 #include "os-proto.h" 54 #endif 55 56 #define TCPDUMP_MAGIC 0xa1b2c3d4 57 #define PATCHED_TCPDUMP_MAGIC 0xa1b2cd34 58 59 /* 60 * We use the "receiver-makes-right" approach to byte order, 61 * because time is at a premium when we are writing the file. 62 * In other words, the pcap_file_header and pcap_pkthdr, 63 * records are written in host byte order. 64 * Note that the packets are always written in network byte order. 65 * 66 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian 67 * machine (if the file was written in little-end order). 68 */ 69 #define SWAPLONG(y) \ 70 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 71 #define SWAPSHORT(y) \ 72 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) ) 73 74 #define SFERR_TRUNC 1 75 #define SFERR_BADVERSION 2 76 #define SFERR_BADF 3 77 #define SFERR_EOF 4 /* not really an error, just a status */ 78 79 /* 80 * We don't write DLT_* values to the capture file header, because 81 * they're not the same on all platforms. 82 * 83 * Unfortunately, the various flavors of BSD have not always used the same 84 * numerical values for the same data types, and various patches to 85 * libpcap for non-BSD OSes have added their own DLT_* codes for link 86 * layer encapsulation types seen on those OSes, and those codes have had, 87 * in some cases, values that were also used, on other platforms, for other 88 * link layer encapsulation types. 89 * 90 * This means that capture files of a type whose numerical DLT_* code 91 * means different things on different BSDs, or with different versions 92 * of libpcap, can't always be read on systems other than those like 93 * the one running on the machine on which the capture was made. 94 * 95 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes 96 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* 97 * codes to DLT_* codes when reading a savefile header. 98 * 99 * For those DLT_* codes that have, as far as we know, the same values on 100 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as 101 * DLT_xxx; that way, captures of those types can still be read by 102 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and 103 * captures of those types written by versions of libpcap that map DLT_ 104 * values to LINKTYPE_ values can still be read by older versions 105 * of libpcap. 106 * 107 * The other LINKTYPE_* codes are given values starting at 100, in the 108 * hopes that no DLT_* code will be given one of those values. 109 * 110 * In order to ensure that a given LINKTYPE_* code's value will refer to 111 * the same encapsulation type on all platforms, you should not allocate 112 * a new LINKTYPE_* value without consulting "tcpdump-workers@tcpdump.org". 113 * The tcpdump developers will allocate a value for you, and will not 114 * subsequently allocate it to anybody else; that value will be added to 115 * the "pcap.h" in the tcpdump.org CVS repository, so that a future 116 * libpcap release will include it. 117 * 118 * You should, if possible, also contribute patches to libpcap and tcpdump 119 * to handle the new encapsulation type, so that they can also be checked 120 * into the tcpdump.org CVS repository and so that they will appear in 121 * future libpcap and tcpdump releases. 122 */ 123 #define LINKTYPE_NULL DLT_NULL 124 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ 125 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ 126 #define LINKTYPE_AX25 DLT_AX25 127 #define LINKTYPE_PRONET DLT_PRONET 128 #define LINKTYPE_CHAOS DLT_CHAOS 129 #define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */ 130 #define LINKTYPE_ARCNET DLT_ARCNET 131 #define LINKTYPE_SLIP DLT_SLIP 132 #define LINKTYPE_PPP DLT_PPP 133 #define LINKTYPE_FDDI DLT_FDDI 134 135 /* 136 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 137 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol 138 * field) at the beginning of the packet. 139 * 140 * This is for use when there is always such a header; the address field 141 * might be 0xff, for regular PPP, or it might be an address field for Cisco 142 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco 143 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. 144 * 145 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that 146 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL 147 * captures will be written out with a link type that NetBSD's tcpdump 148 * can read. 149 */ 150 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ 151 152 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ 153 #define LINKTYPE_RAW 101 /* raw IP */ 154 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ 155 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ 156 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ 157 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ 158 159 /* 160 * Reserved for future use. 161 */ 162 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ 163 #define LINKTYPE_FR 107 /* BSD/OS Frame Relay */ 164 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */ 165 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ 166 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ 167 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ 168 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ 169 170 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ 171 172 static struct linktype_map { 173 int dlt; 174 int linktype; 175 } map[] = { 176 /* 177 * These DLT_* codes have LINKTYPE_* codes with values identical 178 * to the values of the corresponding DLT_* code. 179 */ 180 { DLT_NULL, LINKTYPE_NULL }, 181 { DLT_EN10MB, LINKTYPE_ETHERNET }, 182 { DLT_EN3MB, LINKTYPE_EXP_ETHERNET }, 183 { DLT_AX25, LINKTYPE_AX25 }, 184 { DLT_PRONET, LINKTYPE_PRONET }, 185 { DLT_CHAOS, LINKTYPE_CHAOS }, 186 { DLT_IEEE802, LINKTYPE_TOKEN_RING }, 187 { DLT_ARCNET, LINKTYPE_ARCNET }, 188 { DLT_SLIP, LINKTYPE_SLIP }, 189 { DLT_PPP, LINKTYPE_PPP }, 190 { DLT_FDDI, LINKTYPE_FDDI }, 191 192 /* 193 * These DLT_* codes have different values on different 194 * platforms; we map them to LINKTYPE_* codes that 195 * have values that should never be equal to any DLT_* 196 * code. 197 */ 198 { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 }, 199 { DLT_RAW, LINKTYPE_RAW }, 200 { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS }, 201 { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS }, 202 203 /* BSD/OS Cisco HDLC */ 204 { DLT_C_HDLC, LINKTYPE_C_HDLC }, 205 206 /* 207 * These DLT_* codes are not on all platforms, but, so far, 208 * there don't appear to be any platforms that define 209 * other codes with those values; we map them to 210 * different LINKTYPE_* values anyway, just in case. 211 */ 212 213 /* Linux ATM Classical IP */ 214 { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP }, 215 216 /* NetBSD sync/async serial PPP (or Cisco HDLC) */ 217 { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC }, 218 219 /* IEEE 802.11 wireless */ 220 { DLT_IEEE802_11, LINKTYPE_IEEE802_11 }, 221 222 /* OpenBSD loopback */ 223 { DLT_LOOP, LINKTYPE_LOOP }, 224 225 /* Linux cooked socket capture */ 226 { DLT_LINUX_SLL, LINKTYPE_LINUX_SLL }, 227 228 /* 229 * Any platform that defines additional DLT_* codes should: 230 * 231 * request a LINKTYPE_* code and value from tcpdump.org, 232 * as per the above; 233 * 234 * add, in their version of libpcap, an entry to map 235 * those DLT_* codes to the corresponding LINKTYPE_* 236 * code; 237 * 238 * redefine, in their "net/bpf.h", any DLT_* values 239 * that collide with the values used by their additional 240 * DLT_* codes, to remove those collisions (but without 241 * making them collide with any of the LINKTYPE_* 242 * values equal to 50 or above; they should also avoid 243 * defining DLT_* values that collide with those 244 * LINKTYPE_* values, either). 245 */ 246 { -1, -1 } 247 }; 248 249 static int 250 dlt_to_linktype(int dlt) 251 { 252 int i; 253 254 for (i = 0; map[i].dlt != -1; i++) { 255 if (map[i].dlt == dlt) 256 return (map[i].linktype); 257 } 258 259 /* 260 * If we don't have a mapping for this DLT_ code, return an 261 * error; that means that the table above needs to have an 262 * entry added. 263 */ 264 return (-1); 265 } 266 267 static int 268 linktype_to_dlt(int linktype) 269 { 270 int i; 271 272 for (i = 0; map[i].linktype != -1; i++) { 273 if (map[i].linktype == linktype) 274 return (map[i].dlt); 275 } 276 277 /* 278 * If we don't have an entry for this link type, return 279 * the link type value; it may be a DLT_ value from an 280 * older version of libpcap. 281 */ 282 return linktype; 283 } 284 285 static int 286 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen) 287 { 288 struct pcap_file_header hdr; 289 290 hdr.magic = TCPDUMP_MAGIC; 291 hdr.version_major = PCAP_VERSION_MAJOR; 292 hdr.version_minor = PCAP_VERSION_MINOR; 293 294 hdr.thiszone = thiszone; 295 hdr.snaplen = snaplen; 296 hdr.sigfigs = 0; 297 hdr.linktype = linktype; 298 299 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) 300 return (-1); 301 302 return (0); 303 } 304 305 static void 306 swap_hdr(struct pcap_file_header *hp) 307 { 308 hp->version_major = SWAPSHORT(hp->version_major); 309 hp->version_minor = SWAPSHORT(hp->version_minor); 310 hp->thiszone = SWAPLONG(hp->thiszone); 311 hp->sigfigs = SWAPLONG(hp->sigfigs); 312 hp->snaplen = SWAPLONG(hp->snaplen); 313 hp->linktype = SWAPLONG(hp->linktype); 314 } 315 316 pcap_t * 317 pcap_open_offline(const char *fname, char *errbuf) 318 { 319 register pcap_t *p; 320 register FILE *fp; 321 struct pcap_file_header hdr; 322 bpf_u_int32 magic; 323 int linklen; 324 325 p = (pcap_t *)malloc(sizeof(*p)); 326 if (p == NULL) { 327 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE); 328 return (NULL); 329 } 330 331 memset((char *)p, 0, sizeof(*p)); 332 /* 333 * Set this field so we don't close stdin in pcap_close! 334 */ 335 p->fd = -1; 336 337 if (fname[0] == '-' && fname[1] == '\0') 338 fp = stdin; 339 else { 340 fp = fopen(fname, "r"); 341 if (fp == NULL) { 342 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", fname, 343 pcap_strerror(errno)); 344 goto bad; 345 } 346 } 347 if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) { 348 snprintf(errbuf, PCAP_ERRBUF_SIZE, "fread: %s", 349 pcap_strerror(errno)); 350 goto bad; 351 } 352 magic = hdr.magic; 353 if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC) { 354 magic = SWAPLONG(magic); 355 if (magic != TCPDUMP_MAGIC && magic != PATCHED_TCPDUMP_MAGIC) { 356 snprintf(errbuf, PCAP_ERRBUF_SIZE, 357 "bad dump file format"); 358 goto bad; 359 } 360 p->sf.swapped = 1; 361 swap_hdr(&hdr); 362 } 363 if (magic == PATCHED_TCPDUMP_MAGIC) { 364 /* 365 * XXX - the patch that's in some versions of libpcap 366 * changes the packet header but not the magic number; 367 * we'd have to use some hacks^H^H^H^H^Hheuristics to 368 * detect that. 369 */ 370 p->sf.hdrsize = sizeof(struct pcap_sf_patched_pkthdr); 371 } else 372 p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr); 373 if (hdr.version_major < PCAP_VERSION_MAJOR) { 374 snprintf(errbuf, PCAP_ERRBUF_SIZE, "archaic file format"); 375 goto bad; 376 } 377 p->tzoff = hdr.thiszone; 378 p->snapshot = hdr.snaplen; 379 p->linktype = linktype_to_dlt(hdr.linktype); 380 p->sf.rfile = fp; 381 p->bufsize = hdr.snaplen; 382 383 /* Align link header as required for proper data alignment */ 384 /* XXX should handle all types */ 385 switch (p->linktype) { 386 387 case DLT_EN10MB: 388 linklen = 14; 389 break; 390 391 case DLT_FDDI: 392 linklen = 13 + 8; /* fddi_header + llc */ 393 break; 394 395 case DLT_NULL: 396 default: 397 linklen = 0; 398 break; 399 } 400 401 if (p->bufsize < 0) 402 p->bufsize = BPF_MAXBUFSIZE; 403 p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT); 404 if (p->sf.base == NULL) { 405 strlcpy(errbuf, "out of swap", PCAP_ERRBUF_SIZE); 406 goto bad; 407 } 408 p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT); 409 p->sf.version_major = hdr.version_major; 410 p->sf.version_minor = hdr.version_minor; 411 #ifdef PCAP_FDDIPAD 412 /* XXX padding only needed for kernel fcode */ 413 pcap_fddipad = 0; 414 #endif 415 416 return (p); 417 bad: 418 free(p); 419 return (NULL); 420 } 421 422 /* 423 * Read sf_readfile and return the next packet. Return the header in hdr 424 * and the contents in buf. Return 0 on success, SFERR_EOF if there were 425 * no more packets, and SFERR_TRUNC if a partial packet was encountered. 426 */ 427 static int 428 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen) 429 { 430 struct pcap_sf_patched_pkthdr sf_hdr; 431 FILE *fp = p->sf.rfile; 432 433 /* 434 * Read the packet header; the structure we use as a buffer 435 * is the longer structure for files generated by the patched 436 * libpcap, but if the file has the magic number for an 437 * unpatched libpcap we only read as many bytes as the regular 438 * header has. 439 */ 440 if (fread(&sf_hdr, p->sf.hdrsize, 1, fp) != 1) { 441 /* probably an EOF, though could be a truncated packet */ 442 return (1); 443 } 444 445 if (p->sf.swapped) { 446 /* these were written in opposite byte order */ 447 hdr->caplen = SWAPLONG(sf_hdr.caplen); 448 hdr->len = SWAPLONG(sf_hdr.len); 449 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec); 450 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec); 451 } else { 452 hdr->caplen = sf_hdr.caplen; 453 hdr->len = sf_hdr.len; 454 hdr->ts.tv_sec = sf_hdr.ts.tv_sec; 455 hdr->ts.tv_usec = sf_hdr.ts.tv_usec; 456 } 457 /* 458 * We interchanged the caplen and len fields at version 2.3, 459 * in order to match the bpf header layout. But unfortunately 460 * some files were written with version 2.3 in their headers 461 * but without the interchanged fields. 462 */ 463 if (p->sf.version_minor < 3 || 464 (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) { 465 int t = hdr->caplen; 466 hdr->caplen = hdr->len; 467 hdr->len = t; 468 } 469 470 if (hdr->caplen > buflen) { 471 /* 472 * This can happen due to Solaris 2.3 systems tripping 473 * over the BUFMOD problem and not setting the snapshot 474 * correctly in the savefile header. If the caplen isn't 475 * grossly wrong, try to salvage. 476 */ 477 static u_char *tp = NULL; 478 static int tsize = 0; 479 480 if (hdr->caplen > 65535) { 481 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 482 "bogus savefile header"); 483 return (-1); 484 } 485 486 if (tsize < hdr->caplen) { 487 tsize = ((hdr->caplen + 1023) / 1024) * 1024; 488 if (tp != NULL) 489 free((u_char *)tp); 490 tp = (u_char *)malloc(tsize); 491 if (tp == NULL) { 492 tsize = 0; 493 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 494 "BUFMOD hack malloc"); 495 return (-1); 496 } 497 } 498 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) { 499 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 500 "truncated dump file"); 501 return (-1); 502 } 503 /* 504 * We can only keep up to buflen bytes. Since caplen > buflen 505 * is exactly how we got here, we know we can only keep the 506 * first buflen bytes and must drop the remainder. Adjust 507 * caplen accordingly, so we don't get confused later as 508 * to how many bytes we have to play with. 509 */ 510 hdr->caplen = buflen; 511 memcpy((char *)buf, (char *)tp, buflen); 512 513 } else { 514 /* read the packet itself */ 515 516 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) { 517 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 518 "truncated dump file"); 519 return (-1); 520 } 521 } 522 return (0); 523 } 524 525 /* 526 * Print out packets stored in the file initialized by sf_read_init(). 527 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof. 528 */ 529 int 530 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) 531 { 532 struct bpf_insn *fcode = p->fcode.bf_insns; 533 int status = 0; 534 int n = 0; 535 536 while (status == 0) { 537 struct pcap_pkthdr h; 538 539 status = sf_next_packet(p, &h, p->buffer, p->bufsize); 540 if (status) { 541 if (status == 1) 542 return (0); 543 return (status); 544 } 545 546 if (fcode == NULL || 547 bpf_filter(fcode, p->buffer, h.len, h.caplen)) { 548 (*callback)(user, &h, p->buffer); 549 if (++n >= cnt && cnt > 0) 550 break; 551 } 552 } 553 /*XXX this breaks semantics tcpslice expects */ 554 return (n); 555 } 556 557 /* 558 * Output a packet to the initialized dump file. 559 */ 560 void 561 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 562 { 563 register FILE *f; 564 struct pcap_sf_pkthdr sf_hdr; 565 566 f = (FILE *)user; 567 sf_hdr.ts.tv_sec = h->ts.tv_sec; 568 sf_hdr.ts.tv_usec = h->ts.tv_usec; 569 sf_hdr.caplen = h->caplen; 570 sf_hdr.len = h->len; 571 /* XXX we should check the return status */ 572 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f); 573 (void)fwrite((char *)sp, h->caplen, 1, f); 574 } 575 576 /* 577 * Initialize so that sf_write() will output to the file named 'fname'. 578 */ 579 pcap_dumper_t * 580 pcap_dump_open(pcap_t *p, const char *fname) 581 { 582 FILE *f; 583 int linktype; 584 585 linktype = dlt_to_linktype(p->linktype); 586 if (linktype == -1) { 587 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 588 "%s: link-layer type %d isn't supported in savefiles", 589 fname, linktype); 590 return (NULL); 591 } 592 593 if (fname[0] == '-' && fname[1] == '\0') 594 f = stdout; 595 else { 596 f = fopen(fname, "w"); 597 if (f == NULL) { 598 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s", 599 fname, pcap_strerror(errno)); 600 return (NULL); 601 } 602 } 603 (void)sf_write_header(f, linktype, p->tzoff, p->snapshot); 604 return ((pcap_dumper_t *)f); 605 } 606 607 void 608 pcap_dump_close(pcap_dumper_t *p) 609 { 610 611 #ifdef notyet 612 if (ferror((FILE *)p)) 613 return-an-error; 614 /* XXX should check return from fclose() too */ 615 #endif 616 (void)fclose((FILE *)p); 617 } 618