savefile.c revision 39291 
1/*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * savefile.c - supports offline use of tcpdump
22 *	Extraction/creation by Jeffrey Mogul, DECWRL
23 *	Modified by Steve McCanne, LBL.
24 *
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
29 */
30
31#ifndef lint
32static const char rcsid[] =
33    "@(#) $Header: savefile.c,v 1.37 97/10/15 21:58:58 leres Exp $ (LBL)";
34#endif
35
36#include <sys/types.h>
37#include <sys/time.h>
38
39#include <errno.h>
40#include <memory.h>
41#include <stdio.h>
42#include <stdlib.h>
43#include <unistd.h>
44
45#include "pcap-int.h"
46
47#include "gnuc.h"
48#ifdef HAVE_OS_PROTO_H
49#include "os-proto.h"
50#endif
51
52#define TCPDUMP_MAGIC 0xa1b2c3d4
53
54/*
55 * We use the "receiver-makes-right" approach to byte order,
56 * because time is at a premium when we are writing the file.
57 * In other words, the pcap_file_header and pcap_pkthdr,
58 * records are written in host byte order.
59 * Note that the packets are always written in network byte order.
60 *
61 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
62 * machine (if the file was written in little-end order).
63 */
64#define	SWAPLONG(y) \
65((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
66#define	SWAPSHORT(y) \
67	( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
68
69#define SFERR_TRUNC		1
70#define SFERR_BADVERSION	2
71#define SFERR_BADF		3
72#define SFERR_EOF		4 /* not really an error, just a status */
73
74static int
75sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
76{
77	struct pcap_file_header hdr;
78
79	hdr.magic = TCPDUMP_MAGIC;
80	hdr.version_major = PCAP_VERSION_MAJOR;
81	hdr.version_minor = PCAP_VERSION_MINOR;
82
83	hdr.thiszone = thiszone;
84	hdr.snaplen = snaplen;
85	hdr.sigfigs = 0;
86	hdr.linktype = linktype;
87
88	if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
89		return (-1);
90
91	return (0);
92}
93
94static void
95swap_hdr(struct pcap_file_header *hp)
96{
97	hp->version_major = SWAPSHORT(hp->version_major);
98	hp->version_minor = SWAPSHORT(hp->version_minor);
99	hp->thiszone = SWAPLONG(hp->thiszone);
100	hp->sigfigs = SWAPLONG(hp->sigfigs);
101	hp->snaplen = SWAPLONG(hp->snaplen);
102	hp->linktype = SWAPLONG(hp->linktype);
103}
104
105pcap_t *
106pcap_open_offline(const char *fname, char *errbuf)
107{
108	register pcap_t *p;
109	register FILE *fp;
110	struct pcap_file_header hdr;
111	int linklen;
112
113	p = (pcap_t *)malloc(sizeof(*p));
114	if (p == NULL) {
115		strcpy(errbuf, "out of swap");
116		return (NULL);
117	}
118
119	memset((char *)p, 0, sizeof(*p));
120	/*
121	 * Set this field so we don't close stdin in pcap_close!
122	 */
123	p->fd = -1;
124
125	if (fname[0] == '-' && fname[1] == '\0')
126		fp = stdin;
127	else {
128		fp = fopen(fname, "r");
129		if (fp == NULL) {
130			sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno));
131			goto bad;
132		}
133	}
134	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
135		sprintf(errbuf, "fread: %s", pcap_strerror(errno));
136		goto bad;
137	}
138	if (hdr.magic != TCPDUMP_MAGIC) {
139		if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) {
140			sprintf(errbuf, "bad dump file format");
141			goto bad;
142		}
143		p->sf.swapped = 1;
144		swap_hdr(&hdr);
145	}
146	if (hdr.version_major < PCAP_VERSION_MAJOR) {
147		sprintf(errbuf, "archaic file format");
148		goto bad;
149	}
150	p->tzoff = hdr.thiszone;
151	p->snapshot = hdr.snaplen;
152	p->linktype = hdr.linktype;
153	p->sf.rfile = fp;
154	p->bufsize = hdr.snaplen;
155
156	/* Align link header as required for proper data alignment */
157	/* XXX should handle all types */
158	switch (p->linktype) {
159
160	case DLT_EN10MB:
161		linklen = 14;
162		break;
163
164	case DLT_FDDI:
165		linklen = 13 + 8;	/* fddi_header + llc */
166		break;
167
168	case DLT_NULL:
169	default:
170		linklen = 0;
171		break;
172	}
173
174	p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
175	p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
176	p->sf.version_major = hdr.version_major;
177	p->sf.version_minor = hdr.version_minor;
178#ifdef PCAP_FDDIPAD
179	/* XXX padding only needed for kernel fcode */
180	pcap_fddipad = 0;
181#endif
182
183	return (p);
184 bad:
185	free(p);
186	return (NULL);
187}
188
189/*
190 * Read sf_readfile and return the next packet.  Return the header in hdr
191 * and the contents in buf.  Return 0 on success, SFERR_EOF if there were
192 * no more packets, and SFERR_TRUNC if a partial packet was encountered.
193 */
194static int
195sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen)
196{
197	FILE *fp = p->sf.rfile;
198
199	/* read the stamp */
200	if (fread((char *)hdr, sizeof(struct pcap_pkthdr), 1, fp) != 1) {
201		/* probably an EOF, though could be a truncated packet */
202		return (1);
203	}
204
205	if (p->sf.swapped) {
206		/* these were written in opposite byte order */
207		hdr->caplen = SWAPLONG(hdr->caplen);
208		hdr->len = SWAPLONG(hdr->len);
209		hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec);
210		hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec);
211	}
212	/*
213	 * We interchanged the caplen and len fields at version 2.3,
214	 * in order to match the bpf header layout.  But unfortunately
215	 * some files were written with version 2.3 in their headers
216	 * but without the interchanged fields.
217	 */
218	if (p->sf.version_minor < 3 ||
219	    (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) {
220		int t = hdr->caplen;
221		hdr->caplen = hdr->len;
222		hdr->len = t;
223	}
224
225	if (hdr->caplen > buflen) {
226		/*
227		 * This can happen due to Solaris 2.3 systems tripping
228		 * over the BUFMOD problem and not setting the snapshot
229		 * correctly in the savefile header.  If the caplen isn't
230		 * grossly wrong, try to salvage.
231		 */
232		static u_char *tp = NULL;
233		static int tsize = 0;
234
235		if (hdr->caplen > 65535) {
236			sprintf(p->errbuf, "bogus savefile header");
237			return (-1);
238		}
239		if (tsize < hdr->caplen) {
240			tsize = ((hdr->caplen + 1023) / 1024) * 1024;
241			if (tp != NULL)
242				free((u_char *)tp);
243			tp = (u_char *)malloc(tsize);
244			if (tp == NULL) {
245				tsize = 0;
246				sprintf(p->errbuf, "BUFMOD hack malloc");
247				return (-1);
248			}
249		}
250		if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
251			sprintf(p->errbuf, "truncated dump file");
252			return (-1);
253		}
254		/*
255		 * We can only keep up to buflen bytes.  Since caplen > buflen
256		 * is exactly how we got here, we know we can only keep the
257		 * first buflen bytes and must drop the remainder.  Adjust
258		 * caplen accordingly, so we don't get confused later as
259		 * to how many bytes we have to play with.
260		 */
261		hdr->caplen = buflen;
262		memcpy((char *)buf, (char *)tp, buflen);
263
264	} else {
265		/* read the packet itself */
266
267		if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
268			sprintf(p->errbuf, "truncated dump file");
269			return (-1);
270		}
271	}
272	return (0);
273}
274
275/*
276 * Print out packets stored in the file initialized by sf_read_init().
277 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
278 */
279int
280pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
281{
282	struct bpf_insn *fcode = p->fcode.bf_insns;
283	int status = 0;
284	int n = 0;
285
286	while (status == 0) {
287		struct pcap_pkthdr h;
288
289		status = sf_next_packet(p, &h, p->buffer, p->bufsize);
290		if (status) {
291			if (status == 1)
292				return (0);
293			return (status);
294		}
295
296		if (fcode == NULL ||
297		    bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
298			(*callback)(user, &h, p->buffer);
299			if (++n >= cnt && cnt > 0)
300				break;
301		}
302	}
303	/*XXX this breaks semantics tcpslice expects */
304	return (n);
305}
306
307/*
308 * Output a packet to the initialized dump file.
309 */
310void
311pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
312{
313	register FILE *f;
314
315	f = (FILE *)user;
316	/* XXX we should check the return status */
317	(void)fwrite((char *)h, sizeof(*h), 1, f);
318	(void)fwrite((char *)sp, h->caplen, 1, f);
319}
320
321/*
322 * Initialize so that sf_write() will output to the file named 'fname'.
323 */
324pcap_dumper_t *
325pcap_dump_open(pcap_t *p, const char *fname)
326{
327	FILE *f;
328	if (fname[0] == '-' && fname[1] == '\0')
329		f = stdout;
330	else {
331		f = fopen(fname, "w");
332		if (f == NULL) {
333			sprintf(p->errbuf, "%s: %s",
334			    fname, pcap_strerror(errno));
335			return (NULL);
336		}
337	}
338	(void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot);
339	return ((pcap_dumper_t *)f);
340}
341
342void
343pcap_dump_close(pcap_dumper_t *p)
344{
345
346#ifdef notyet
347	if (ferror((FILE *)p))
348		return-an-error;
349	/* XXX should check return from fclose() too */
350#endif
351	(void)fclose((FILE *)p);
352}
353