1 /* 2 * Copyright (c) 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * savefile.c - supports offline use of tcpdump 22 * Extraction/creation by Jeffrey Mogul, DECWRL 23 * Modified by Steve McCanne, LBL. 24 * 25 * Used to save the received packet headers, after filtering, to 26 * a file, and then read them later. 27 * The first record in the file contains saved values for the machine 28 * dependent values so we can print the dump file on any architecture. 29 */ 30 31 #ifndef lint 32 static const char rcsid[] = 33 "@(#) $Header: savefile.c,v 1.37 97/10/15 21:58:58 leres Exp $ (LBL)"; 34 #endif 35 36 #include <sys/types.h> 37 #include <sys/time.h> 38 39 #include <errno.h> 40 #include <memory.h> 41 #include <stdio.h> 42 #include <stdlib.h> 43 #include <unistd.h> 44 45 #include "pcap-int.h" 46 47 #include "gnuc.h" 48 #ifdef HAVE_OS_PROTO_H 49 #include "os-proto.h" 50 #endif 51 52 #define TCPDUMP_MAGIC 0xa1b2c3d4 53 54 /* 55 * We use the "receiver-makes-right" approach to byte order, 56 * because time is at a premium when we are writing the file. 57 * In other words, the pcap_file_header and pcap_pkthdr, 58 * records are written in host byte order. 59 * Note that the packets are always written in network byte order. 60 * 61 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian 62 * machine (if the file was written in little-end order). 63 */ 64 #define SWAPLONG(y) \ 65 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 66 #define SWAPSHORT(y) \ 67 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) ) 68 69 #define SFERR_TRUNC 1 70 #define SFERR_BADVERSION 2 71 #define SFERR_BADF 3 72 #define SFERR_EOF 4 /* not really an error, just a status */ 73 74 static int 75 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen) 76 { 77 struct pcap_file_header hdr; 78 79 hdr.magic = TCPDUMP_MAGIC; 80 hdr.version_major = PCAP_VERSION_MAJOR; 81 hdr.version_minor = PCAP_VERSION_MINOR; 82 83 hdr.thiszone = thiszone; 84 hdr.snaplen = snaplen; 85 hdr.sigfigs = 0; 86 hdr.linktype = linktype; 87 88 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) 89 return (-1); 90 91 return (0); 92 } 93 94 static void 95 swap_hdr(struct pcap_file_header *hp) 96 { 97 hp->version_major = SWAPSHORT(hp->version_major); 98 hp->version_minor = SWAPSHORT(hp->version_minor); 99 hp->thiszone = SWAPLONG(hp->thiszone); 100 hp->sigfigs = SWAPLONG(hp->sigfigs); 101 hp->snaplen = SWAPLONG(hp->snaplen); 102 hp->linktype = SWAPLONG(hp->linktype); 103 } 104 105 pcap_t * 106 pcap_open_offline(const char *fname, char *errbuf) 107 { 108 register pcap_t *p; 109 register FILE *fp; 110 struct pcap_file_header hdr; 111 int linklen; 112 113 p = (pcap_t *)malloc(sizeof(*p)); 114 if (p == NULL) { 115 strcpy(errbuf, "out of swap"); 116 return (NULL); 117 } 118 119 memset((char *)p, 0, sizeof(*p)); 120 /* 121 * Set this field so we don't close stdin in pcap_close! 122 */ 123 p->fd = -1; 124 125 if (fname[0] == '-' && fname[1] == '\0') 126 fp = stdin; 127 else { 128 fp = fopen(fname, "r"); 129 if (fp == NULL) { 130 sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno)); 131 goto bad; 132 } 133 } 134 if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) { 135 sprintf(errbuf, "fread: %s", pcap_strerror(errno)); 136 goto bad; 137 } 138 if (hdr.magic != TCPDUMP_MAGIC) { 139 if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) { 140 sprintf(errbuf, "bad dump file format"); 141 goto bad; 142 } 143 p->sf.swapped = 1; 144 swap_hdr(&hdr); 145 } 146 if (hdr.version_major < PCAP_VERSION_MAJOR) { 147 sprintf(errbuf, "archaic file format"); 148 goto bad; 149 } 150 p->tzoff = hdr.thiszone; 151 p->snapshot = hdr.snaplen; 152 p->linktype = hdr.linktype; 153 p->sf.rfile = fp; 154 p->bufsize = hdr.snaplen; 155 156 /* Align link header as required for proper data alignment */ 157 /* XXX should handle all types */ 158 switch (p->linktype) { 159 160 case DLT_EN10MB: 161 linklen = 14; 162 break; 163 164 case DLT_FDDI: 165 linklen = 13 + 8; /* fddi_header + llc */ 166 break; 167 168 case DLT_NULL: 169 default: 170 linklen = 0; 171 break; 172 } 173 174 p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT); 175 p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT); 176 p->sf.version_major = hdr.version_major; 177 p->sf.version_minor = hdr.version_minor; 178 #ifdef PCAP_FDDIPAD 179 /* XXX padding only needed for kernel fcode */ 180 pcap_fddipad = 0; 181 #endif 182 183 return (p); 184 bad: 185 free(p); 186 return (NULL); 187 } 188 189 /* 190 * Read sf_readfile and return the next packet. Return the header in hdr 191 * and the contents in buf. Return 0 on success, SFERR_EOF if there were 192 * no more packets, and SFERR_TRUNC if a partial packet was encountered. 193 */ 194 static int 195 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen) 196 { 197 FILE *fp = p->sf.rfile; 198 199 /* read the stamp */ 200 if (fread((char *)hdr, sizeof(struct pcap_pkthdr), 1, fp) != 1) { 201 /* probably an EOF, though could be a truncated packet */ 202 return (1); 203 } 204 205 if (p->sf.swapped) { 206 /* these were written in opposite byte order */ 207 hdr->caplen = SWAPLONG(hdr->caplen); 208 hdr->len = SWAPLONG(hdr->len); 209 hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec); 210 hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec); 211 } 212 /* 213 * We interchanged the caplen and len fields at version 2.3, 214 * in order to match the bpf header layout. But unfortunately 215 * some files were written with version 2.3 in their headers 216 * but without the interchanged fields. 217 */ 218 if (p->sf.version_minor < 3 || 219 (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) { 220 int t = hdr->caplen; 221 hdr->caplen = hdr->len; 222 hdr->len = t; 223 } 224 225 if (hdr->caplen > buflen) { 226 /* 227 * This can happen due to Solaris 2.3 systems tripping 228 * over the BUFMOD problem and not setting the snapshot 229 * correctly in the savefile header. If the caplen isn't 230 * grossly wrong, try to salvage. 231 */ 232 static u_char *tp = NULL; 233 static int tsize = 0; 234 235 if (hdr->caplen > 65535) { 236 sprintf(p->errbuf, "bogus savefile header"); 237 return (-1); 238 } 239 if (tsize < hdr->caplen) { 240 tsize = ((hdr->caplen + 1023) / 1024) * 1024; 241 if (tp != NULL) 242 free((u_char *)tp); 243 tp = (u_char *)malloc(tsize); 244 if (tp == NULL) { 245 tsize = 0; 246 sprintf(p->errbuf, "BUFMOD hack malloc"); 247 return (-1); 248 } 249 } 250 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) { 251 sprintf(p->errbuf, "truncated dump file"); 252 return (-1); 253 } 254 /* 255 * We can only keep up to buflen bytes. Since caplen > buflen 256 * is exactly how we got here, we know we can only keep the 257 * first buflen bytes and must drop the remainder. Adjust 258 * caplen accordingly, so we don't get confused later as 259 * to how many bytes we have to play with. 260 */ 261 hdr->caplen = buflen; 262 memcpy((char *)buf, (char *)tp, buflen); 263 264 } else { 265 /* read the packet itself */ 266 267 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) { 268 sprintf(p->errbuf, "truncated dump file"); 269 return (-1); 270 } 271 } 272 return (0); 273 } 274 275 /* 276 * Print out packets stored in the file initialized by sf_read_init(). 277 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof. 278 */ 279 int 280 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) 281 { 282 struct bpf_insn *fcode = p->fcode.bf_insns; 283 int status = 0; 284 int n = 0; 285 286 while (status == 0) { 287 struct pcap_pkthdr h; 288 289 status = sf_next_packet(p, &h, p->buffer, p->bufsize); 290 if (status) { 291 if (status == 1) 292 return (0); 293 return (status); 294 } 295 296 if (fcode == NULL || 297 bpf_filter(fcode, p->buffer, h.len, h.caplen)) { 298 (*callback)(user, &h, p->buffer); 299 if (++n >= cnt && cnt > 0) 300 break; 301 } 302 } 303 /*XXX this breaks semantics tcpslice expects */ 304 return (n); 305 } 306 307 /* 308 * Output a packet to the initialized dump file. 309 */ 310 void 311 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 312 { 313 register FILE *f; 314 315 f = (FILE *)user; 316 /* XXX we should check the return status */ 317 (void)fwrite((char *)h, sizeof(*h), 1, f); 318 (void)fwrite((char *)sp, h->caplen, 1, f); 319 } 320 321 /* 322 * Initialize so that sf_write() will output to the file named 'fname'. 323 */ 324 pcap_dumper_t * 325 pcap_dump_open(pcap_t *p, const char *fname) 326 { 327 FILE *f; 328 if (fname[0] == '-' && fname[1] == '\0') 329 f = stdout; 330 else { 331 f = fopen(fname, "w"); 332 if (f == NULL) { 333 sprintf(p->errbuf, "%s: %s", 334 fname, pcap_strerror(errno)); 335 return (NULL); 336 } 337 } 338 (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot); 339 return ((pcap_dumper_t *)f); 340 } 341 342 void 343 pcap_dump_close(pcap_dumper_t *p) 344 { 345 346 #ifdef notyet 347 if (ferror((FILE *)p)) 348 return-an-error; 349 /* XXX should check return from fclose() too */ 350 #endif 351 (void)fclose((FILE *)p); 352 } 353