pcap/savefile.c

   1 /*
   2  * Copyright (c) 1999 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * "Portions Copyright (c) 1999 Apple Computer, Inc.  All Rights
   7  * Reserved.  This file contains Original Code and/or Modifications of
   8  * Original Code as defined in and that are subject to the Apple Public
   9  * Source License Version 1.0 (the 'License').  You may not use this file
  10  * except in compliance with the License.  Please obtain a copy of the
  11  * License at http://www.apple.com/publicsource and read it before using
  12  * this file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
  19  * License for the specific language governing rights and limitations
  20  * under the License."
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24 /*      $OpenBSD: savefile.c,v 1.4 1996/07/12 13:19:13 mickey Exp $     */
  25
  26 /*
  27  * Copyright (c) 1993, 1994, 1995
  28  *      The Regents of the University of California.  All rights reserved.
  29  *
  30  * Redistribution and use in source and binary forms, with or without
  31  * modification, are permitted provided that: (1) source code distributions
  32  * retain the above copyright notice and this paragraph in its entirety, (2)
  33  * distributions including binary code include the above copyright notice and
  34  * this paragraph in its entirety in the documentation or other materials
  35  * provided with the distribution, and (3) all advertising materials mentioning
  36  * features or use of this software display the following acknowledgement:
  37  * ``This product includes software developed by the University of California,
  38  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  39  * the University nor the names of its contributors may be used to endorse
  40  * or promote products derived from this software without specific prior
  41  * written permission.
  42  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  43  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  44  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  45  */
  46 #ifndef lint
  47 static char rcsid[] =
  48     "@(#)Header: savefile.c,v 1.28 95/10/07 03:09:06 leres Exp (LBL)";
  49 #endif
  50
  51 /*
  52  * savefile.c - supports offline use of tcpdump
  53  *      Extraction/creation by Jeffrey Mogul, DECWRL
  54  *      Modified by Steve McCanne, LBL.
  55  *
  56  * Used to save the received packet headers, after filtering, to
  57  * a file, and then read them later.
  58  * The first record in the file contains saved values for the machine
  59  * dependent values so we can print the dump file on any architecture.
  60  */
  61
  62 #include <sys/types.h>
  63 #include <sys/time.h>
  64
  65 #include <net/bpf.h>
  66
  67 #include <errno.h>
  68 #include <memory.h>
  69 #include <stdio.h>
  70 #include <stdlib.h>
  71 #include <unistd.h>
  72
  73 #ifdef HAVE_OS_PROTO_H
  74 #include "os-proto.h"
  75 #endif
  76
  77 #include "pcap-int.h"
  78
  79 #define TCPDUMP_MAGIC 0xa1b2c3d4
  80
  81 /*
  82  * We use the "receiver-makes-right" approach to byte order,
  83  * because time is at a premium when we are writing the file.
  84  * In other words, the pcap_file_header and pcap_pkthdr,
  85  * records are written in host byte order.
  86  * Note that the packets are always written in network byte order.
  87  *
  88  * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
  89  * machine (if the file was written in little-end order).
  90  */
  91 #define SWAPLONG(y) \
  92 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
  93 #define SWAPSHORT(y) \
  94         ( (((y)&0xff)<<8) | (((y)&0xff00)>>8) )
  95
  96 #define SFERR_TRUNC             1
  97 #define SFERR_BADVERSION        2
  98 #define SFERR_BADF              3
  99 #define SFERR_EOF               4 /* not really an error, just a status */
 100
 101 static int
 102 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
 103 {
 104         struct pcap_file_header hdr;
 105
 106         hdr.magic = TCPDUMP_MAGIC;
 107         hdr.version_major = PCAP_VERSION_MAJOR;
 108         hdr.version_minor = PCAP_VERSION_MINOR;
 109
 110         hdr.thiszone = thiszone;
 111         hdr.snaplen = snaplen;
 112         hdr.sigfigs = 0;
 113         hdr.linktype = linktype;
 114
 115         if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
 116                 return (-1);
 117
 118         return (0);
 119 }
 120
 121 static void
 122 swap_hdr(struct pcap_file_header *hp)
 123 {
 124         hp->version_major = SWAPSHORT(hp->version_major);
 125         hp->version_minor = SWAPSHORT(hp->version_minor);
 126         hp->thiszone = SWAPLONG(hp->thiszone);
 127         hp->sigfigs = SWAPLONG(hp->sigfigs);
 128         hp->snaplen = SWAPLONG(hp->snaplen);
 129         hp->linktype = SWAPLONG(hp->linktype);
 130 }
 131
 132 pcap_t *
 133 pcap_open_offline(char *fname, char *errbuf)
 134 {
 135         register pcap_t *p;
 136         register FILE *fp;
 137         struct pcap_file_header hdr;
 138         int linklen;
 139
 140         p = (pcap_t *)malloc(sizeof(*p));
 141         if (p == NULL) {
 142                 strcpy(errbuf, "out of swap");
 143                 return (NULL);
 144         }
 145
 146         memset((char *)p, 0, sizeof(*p));
 147         /*
 148          * Set this field so we don't close stdin in pcap_close!
 149          */
 150         p->fd = -1;
 151
 152         if (fname[0] == '-' && fname[1] == '\0')
 153                 fp = stdin;
 154         else {
 155                 fp = fopen(fname, "r");
 156                 if (fp == NULL) {
 157                         sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno));
 158                         goto bad;
 159                 }
 160         }
 161         if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
 162                 sprintf(errbuf, "fread: %s", pcap_strerror(errno));
 163                 goto bad;
 164         }
 165         if (hdr.magic != TCPDUMP_MAGIC) {
 166                 if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) {
 167                         sprintf(errbuf, "bad dump file format");
 168                         goto bad;
 169                 }
 170                 p->sf.swapped = 1;
 171                 swap_hdr(&hdr);
 172         }
 173         if (hdr.version_major < PCAP_VERSION_MAJOR) {
 174                 sprintf(errbuf, "archaic file format");
 175                 goto bad;
 176         }
 177         p->tzoff = hdr.thiszone;
 178         p->snapshot = hdr.snaplen;
 179         p->linktype = hdr.linktype;
 180         p->sf.rfile = fp;
 181         p->bufsize = hdr.snaplen;
 182
 183         /* Align link header as required for proper data alignment */
 184         /* XXX should handle all types */
 185         switch (p->linktype) {
 186
 187         case DLT_EN10MB:
 188                 linklen = 14;
 189                 break;
 190
 191         case DLT_FDDI:
 192                 linklen = 13 + 8;       /* fddi_header + llc */
 193                 break;
 194
 195         case DLT_NULL:
 196         default:
 197                 linklen = 0;
 198                 break;
 199         }
 200
 201         p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
 202         p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
 203         p->sf.version_major = hdr.version_major;
 204         p->sf.version_minor = hdr.version_minor;
 205
 206         return (p);
 207  bad:
 208         free(p);
 209         return (NULL);
 210 }
 211
 212 /*
 213  * Read sf_readfile and return the next packet.  Return the header in hdr
 214  * and the contents in buf.  Return 0 on success, SFERR_EOF if there were
 215  * no more packets, and SFERR_TRUNC if a partial packet was encountered.
 216  */
 217 static int
 218 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen)
 219 {
 220         FILE *fp = p->sf.rfile;
 221
 222         /* read the stamp */
 223         if (fread((char *)hdr, sizeof(struct pcap_pkthdr), 1, fp) != 1) {
 224                 /* probably an EOF, though could be a truncated packet */
 225                 return (1);
 226         }
 227
 228         if (p->sf.swapped) {
 229                 /* these were written in opposite byte order */
 230                 hdr->caplen = SWAPLONG(hdr->caplen);
 231                 hdr->len = SWAPLONG(hdr->len);
 232                 hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec);
 233                 hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec);
 234         }
 235         /*
 236          * We interchanged the caplen and len fields at version 2.3,
 237          * in order to match the bpf header layout.  But unfortunately
 238          * some files were written with version 2.3 in their headers
 239          * but without the interchanged fields.
 240          */
 241         if (p->sf.version_minor < 3 ||
 242             (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) {
 243                 int t = hdr->caplen;
 244                 hdr->caplen = hdr->len;
 245                 hdr->len = t;
 246         }
 247
 248         if (hdr->caplen > buflen) {
 249                 /*
 250                  * This can happen due to Solaris 2.3 systems tripping
 251                  * over the BUFMOD problem and not setting the snapshot
 252                  * correctly in the savefile header.  If the caplen isn't
 253                  * grossly wrong, try to salvage.
 254                  */
 255                 static u_char *tp = NULL;
 256                 static int tsize = 0;
 257
 258                 if (tsize < hdr->caplen) {
 259                         tsize = ((hdr->caplen + 1023) / 1024) * 1024;
 260                         if (tp != NULL)
 261                                 free((u_char *)tp);
 262                         tp = (u_char *)malloc(tsize);
 263                         if (tp == NULL) {
 264                                 sprintf(p->errbuf, "BUFMOD hack malloc");
 265                                 return (-1);
 266                         }
 267                 }
 268                 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
 269                         sprintf(p->errbuf, "truncated dump file");
 270                         return (-1);
 271                 }
 272                 memcpy((char *)buf, (char *)tp, buflen);
 273
 274         } else {
 275                 /* read the packet itself */
 276
 277                 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
 278                         sprintf(p->errbuf, "truncated dump file");
 279                         return (-1);
 280                 }
 281         }
 282         return (0);
 283 }
 284
 285 /*
 286  * Print out packets stored in the file initialized by sf_read_init().
 287  * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
 288  */
 289 int
 290 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 291 {
 292         struct bpf_insn *fcode = p->fcode.bf_insns;
 293         int status = 0;
 294         int n = 0;
 295
 296         while (status == 0) {
 297                 struct pcap_pkthdr h;
 298
 299                 status = sf_next_packet(p, &h, p->buffer, p->bufsize);
 300                 if (status) {
 301                         if (status == 1)
 302                                 return (0);
 303                         return (status);
 304                 }
 305
 306                 if (fcode == NULL ||
 307                     bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
 308                         (*callback)(user, &h, p->buffer);
 309                         if (++n >= cnt && cnt > 0)
 310                                 break;
 311                 }
 312         }
 313         /*XXX this breaks semantics tcpslice expects */
 314         return (n);
 315 }
 316
 317 /*
 318  * Output a packet to the initialized dump file.
 319  */
 320 void
 321 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 322 {
 323         register FILE *f;
 324
 325         f = (FILE *)user;
 326         /* XXX we should check the return status */
 327         (void)fwrite((char *)h, sizeof(*h), 1, f);
 328         (void)fwrite((char *)sp, h->caplen, 1, f);
 329 }
 330
 331 /*
 332  * Initialize so that sf_write() will output to the file named 'fname'.
 333  */
 334 pcap_dumper_t *
 335 pcap_dump_open(pcap_t *p, char *fname)
 336 {
 337         FILE *f;
 338         if (fname[0] == '-' && fname[1] == '\0')
 339                 f = stdout;
 340         else {
 341                 f = fopen(fname, "w");
 342                 if (f == NULL) {
 343                         sprintf(p->errbuf, "%s: %s",
 344                             fname, pcap_strerror(errno));
 345                         return (NULL);
 346                 }
 347         }
 348         (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot);
 349         return ((pcap_dumper_t *)f);
 350 }
 351
 352 void
 353 pcap_dump_close(pcap_dumper_t *p)
 354 {
 355
 356 #ifdef notyet
 357         if (ferror((FILE *)p))
 358                 return-an-error;
 359         /* XXX should check return from fclose() too */
 360 #endif
 361         (void)fclose((FILE *)p);
 362 }