1 /* 2 * Copyright (c) 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * savefile.c - supports offline use of tcpdump 22 * Extraction/creation by Jeffrey Mogul, DECWRL 23 * Modified by Steve McCanne, LBL. 24 * 25 * Used to save the received packet headers, after filtering, to 26 * a file, and then read them later. 27 * The first record in the file contains saved values for the machine 28 * dependent values so we can print the dump file on any architecture. 29 */ 30 31 #ifndef lint 32 static const char rcsid[] = 33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.38 1999/11/21 01:11:58 assar Exp $ (LBL)"; 34 #endif 35 36 #include <sys/types.h> 37 #include <sys/time.h> 38 39 #include <errno.h> 40 #include <memory.h> 41 #include <stdio.h> 42 #include <stdlib.h> 43 #include <unistd.h> 44 45 #include "pcap-int.h" 46 47 #include "gnuc.h" 48 #ifdef HAVE_OS_PROTO_H 49 #include "os-proto.h" 50 #endif 51 52 #define TCPDUMP_MAGIC 0xa1b2c3d4 53 54 /* 55 * We use the "receiver-makes-right" approach to byte order, 56 * because time is at a premium when we are writing the file. 57 * In other words, the pcap_file_header and pcap_pkthdr, 58 * records are written in host byte order. 59 * Note that the packets are always written in network byte order. 60 * 61 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian 62 * machine (if the file was written in little-end order). 63 */ 64 #define SWAPLONG(y) \ 65 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 66 #define SWAPSHORT(y) \ 67 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) ) 68 69 #define SFERR_TRUNC 1 70 #define SFERR_BADVERSION 2 71 #define SFERR_BADF 3 72 #define SFERR_EOF 4 /* not really an error, just a status */ 73 74 static int 75 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen) 76 { 77 struct pcap_file_header hdr; 78 79 hdr.magic = TCPDUMP_MAGIC; 80 hdr.version_major = PCAP_VERSION_MAJOR; 81 hdr.version_minor = PCAP_VERSION_MINOR; 82 83 hdr.thiszone = thiszone; 84 hdr.snaplen = snaplen; 85 hdr.sigfigs = 0; 86 hdr.linktype = linktype; 87 88 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) 89 return (-1); 90 91 return (0); 92 } 93 94 static void 95 swap_hdr(struct pcap_file_header *hp) 96 { 97 hp->version_major = SWAPSHORT(hp->version_major); 98 hp->version_minor = SWAPSHORT(hp->version_minor); 99 hp->thiszone = SWAPLONG(hp->thiszone); 100 hp->sigfigs = SWAPLONG(hp->sigfigs); 101 hp->snaplen = SWAPLONG(hp->snaplen); 102 hp->linktype = SWAPLONG(hp->linktype); 103 } 104 105 pcap_t * 106 pcap_open_offline(const char *fname, char *errbuf) 107 { 108 register pcap_t *p; 109 register FILE *fp; 110 struct pcap_file_header hdr; 111 int linklen; 112 113 p = (pcap_t *)malloc(sizeof(*p)); 114 if (p == NULL) { 115 strcpy(errbuf, "out of swap"); 116 return (NULL); 117 } 118 119 memset((char *)p, 0, sizeof(*p)); 120 /* 121 * Set this field so we don't close stdin in pcap_close! 122 */ 123 p->fd = -1; 124 125 if (fname[0] == '-' && fname[1] == '\0') 126 fp = stdin; 127 else { 128 fp = fopen(fname, "r"); 129 if (fp == NULL) { 130 sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno)); 131 goto bad; 132 } 133 } 134 if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) { 135 sprintf(errbuf, "fread: %s", pcap_strerror(errno)); 136 goto bad; 137 } 138 if (hdr.magic != TCPDUMP_MAGIC) { 139 if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) { 140 sprintf(errbuf, "bad dump file format"); 141 goto bad; 142 } 143 p->sf.swapped = 1; 144 swap_hdr(&hdr); 145 } 146 if (hdr.version_major < PCAP_VERSION_MAJOR) { 147 sprintf(errbuf, "archaic file format"); 148 goto bad; 149 } 150 p->tzoff = hdr.thiszone; 151 p->snapshot = hdr.snaplen; 152 p->linktype = hdr.linktype; 153 p->sf.rfile = fp; 154 p->bufsize = hdr.snaplen; 155 156 /* Align link header as required for proper data alignment */ 157 /* XXX should handle all types */ 158 switch (p->linktype) { 159 160 case DLT_EN10MB: 161 linklen = 14; 162 break; 163 164 case DLT_FDDI: 165 linklen = 13 + 8; /* fddi_header + llc */ 166 break; 167 168 case DLT_NULL: 169 default: 170 linklen = 0; 171 break; 172 } 173 174 p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT); 175 p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT); 176 p->sf.version_major = hdr.version_major; 177 p->sf.version_minor = hdr.version_minor; 178 #ifdef PCAP_FDDIPAD 179 /* XXX padding only needed for kernel fcode */ 180 pcap_fddipad = 0; 181 #endif 182 183 return (p); 184 bad: 185 free(p); 186 return (NULL); 187 } 188 189 /* 190 * Read sf_readfile and return the next packet. Return the header in hdr 191 * and the contents in buf. Return 0 on success, SFERR_EOF if there were 192 * no more packets, and SFERR_TRUNC if a partial packet was encountered. 193 */ 194 static int 195 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen) 196 { 197 struct pcap_sf_pkthdr sf_hdr; 198 FILE *fp = p->sf.rfile; 199 200 /* read the stamp */ 201 if (fread(&sf_hdr, sizeof(struct pcap_sf_pkthdr), 1, fp) != 1) { 202 /* probably an EOF, though could be a truncated packet */ 203 return (1); 204 } 205 206 if (p->sf.swapped) { 207 /* these were written in opposite byte order */ 208 hdr->caplen = SWAPLONG(sf_hdr.caplen); 209 hdr->len = SWAPLONG(sf_hdr.len); 210 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec); 211 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec); 212 } else { 213 hdr->caplen = sf_hdr.caplen; 214 hdr->len = sf_hdr.len; 215 hdr->ts.tv_sec = sf_hdr.ts.tv_sec; 216 hdr->ts.tv_usec = sf_hdr.ts.tv_usec; 217 } 218 /* 219 * We interchanged the caplen and len fields at version 2.3, 220 * in order to match the bpf header layout. But unfortunately 221 * some files were written with version 2.3 in their headers 222 * but without the interchanged fields. 223 */ 224 if (p->sf.version_minor < 3 || 225 (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) { 226 int t = hdr->caplen; 227 hdr->caplen = hdr->len; 228 hdr->len = t; 229 } 230 231 if (hdr->caplen > buflen) { 232 /* 233 * This can happen due to Solaris 2.3 systems tripping 234 * over the BUFMOD problem and not setting the snapshot 235 * correctly in the savefile header. If the caplen isn't 236 * grossly wrong, try to salvage. 237 */ 238 static u_char *tp = NULL; 239 static int tsize = 0; 240 241 if (hdr->caplen > 65535) { 242 sprintf(p->errbuf, "bogus savefile header"); 243 return (-1); 244 } 245 if (tsize < hdr->caplen) { 246 tsize = ((hdr->caplen + 1023) / 1024) * 1024; 247 if (tp != NULL) 248 free((u_char *)tp); 249 tp = (u_char *)malloc(tsize); 250 if (tp == NULL) { 251 tsize = 0; 252 sprintf(p->errbuf, "BUFMOD hack malloc"); 253 return (-1); 254 } 255 } 256 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) { 257 sprintf(p->errbuf, "truncated dump file"); 258 return (-1); 259 } 260 /* 261 * We can only keep up to buflen bytes. Since caplen > buflen 262 * is exactly how we got here, we know we can only keep the 263 * first buflen bytes and must drop the remainder. Adjust 264 * caplen accordingly, so we don't get confused later as 265 * to how many bytes we have to play with. 266 */ 267 hdr->caplen = buflen; 268 memcpy((char *)buf, (char *)tp, buflen); 269 270 } else { 271 /* read the packet itself */ 272 273 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) { 274 sprintf(p->errbuf, "truncated dump file"); 275 return (-1); 276 } 277 } 278 return (0); 279 } 280 281 /* 282 * Print out packets stored in the file initialized by sf_read_init(). 283 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof. 284 */ 285 int 286 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) 287 { 288 struct bpf_insn *fcode = p->fcode.bf_insns; 289 int status = 0; 290 int n = 0; 291 292 while (status == 0) { 293 struct pcap_pkthdr h; 294 295 status = sf_next_packet(p, &h, p->buffer, p->bufsize); 296 if (status) { 297 if (status == 1) 298 return (0); 299 return (status); 300 } 301 302 if (fcode == NULL || 303 bpf_filter(fcode, p->buffer, h.len, h.caplen)) { 304 (*callback)(user, &h, p->buffer); 305 if (++n >= cnt && cnt > 0) 306 break; 307 } 308 } 309 /*XXX this breaks semantics tcpslice expects */ 310 return (n); 311 } 312 313 /* 314 * Output a packet to the initialized dump file. 315 */ 316 void 317 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 318 { 319 register FILE *f; 320 struct pcap_sf_pkthdr sf_hdr; 321 322 f = (FILE *)user; 323 sf_hdr.ts.tv_sec = h->ts.tv_sec; 324 sf_hdr.ts.tv_usec = h->ts.tv_usec; 325 sf_hdr.caplen = h->caplen; 326 sf_hdr.len = h->len; 327 /* XXX we should check the return status */ 328 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f); 329 (void)fwrite((char *)sp, h->caplen, 1, f); 330 } 331 332 /* 333 * Initialize so that sf_write() will output to the file named 'fname'. 334 */ 335 pcap_dumper_t * 336 pcap_dump_open(pcap_t *p, const char *fname) 337 { 338 FILE *f; 339 if (fname[0] == '-' && fname[1] == '\0') 340 f = stdout; 341 else { 342 f = fopen(fname, "w"); 343 if (f == NULL) { 344 sprintf(p->errbuf, "%s: %s", 345 fname, pcap_strerror(errno)); 346 return (NULL); 347 } 348 } 349 (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot); 350 return ((pcap_dumper_t *)f); 351 } 352 353 void 354 pcap_dump_close(pcap_dumper_t *p) 355 { 356 357 #ifdef notyet 358 if (ferror((FILE *)p)) 359 return-an-error; 360 /* XXX should check return from fclose() too */ 361 #endif 362 (void)fclose((FILE *)p); 363 } 364