1 /* $NetBSD: sf-pcap.c,v 1.6 2015/03/31 21:39:42 christos Exp $ */
4 * Copyright (c) 1993, 1994, 1995, 1996, 1997
5 * The Regents of the University of California. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that: (1) source code distributions
9 * retain the above copyright notice and this paragraph in its entirety, (2)
10 * distributions including binary code include the above copyright notice and
11 * this paragraph in its entirety in the documentation or other materials
12 * provided with the distribution, and (3) all advertising materials mentioning
13 * features or use of this software display the following acknowledgement:
14 * ``This product includes software developed by the University of California,
15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16 * the University nor the names of its contributors may be used to endorse
17 * or promote products derived from this software without specific prior
19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * sf-pcap.c - libpcap-file-format-specific code from savefile.c
24 * Extraction/creation by Jeffrey Mogul, DECWRL
25 * Modified by Steve McCanne, LBL.
27 * Used to save the received packet headers, after filtering, to
28 * a file, and then read them later.
29 * The first record in the file contains saved values for the machine
30 * dependent values so we can print the dump file on any architecture.
34 static const char rcsid
[] _U_
=
38 #include <sys/cdefs.h>
39 __RCSID("$NetBSD: sf-pcap.c,v 1.6 2015/03/31 21:39:42 christos Exp $");
46 #include <pcap-stdinc.h>
53 #ifdef HAVE_SYS_BITYPES_H
54 #include <sys/bitypes.h>
56 #include <sys/types.h>
67 #include "pcap-common.h"
69 #ifdef HAVE_OS_PROTO_H
76 * Setting O_BINARY on DOS/Windows is a bit tricky
79 #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
81 #if defined(__HIGHC__)
82 #define SET_BINMODE(f) setmode(f, O_BINARY)
84 #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
89 * Standard libpcap format.
91 #define TCPDUMP_MAGIC 0xa1b2c3d4
94 * Alexey Kuznetzov's modified libpcap format.
96 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
99 * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
100 * for another modified format.
102 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
105 * Navtel Communcations' format, with nanosecond timestamps,
106 * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
108 #define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
111 * Normal libpcap format, except for seconds/nanoseconds timestamps,
112 * as per a request by Ulf Lamping <ulf.lamping@web.de>
114 #define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
117 * Mechanism for storing information about a capture in the upper
118 * 6 bits of a linktype value in a capture file.
120 * LT_LINKTYPE_EXT(x) extracts the additional information.
122 * The rest of the bits are for a value describing the link-layer
123 * value. LT_LINKTYPE(x) extracts that value.
125 #define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
126 #define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
128 static int pcap_next_packet(pcap_t
*p
, struct pcap_pkthdr
*hdr
, u_char
**datap
);
131 * Private data for reading pcap savefiles.
143 } tstamp_scale_type_t
;
147 swapped_type_t lengths_swapped
;
148 tstamp_scale_type_t scale_type
;
152 * Check whether this is a pcap savefile and, if it is, extract the
153 * relevant information from the header.
156 pcap_check_header(bpf_u_int32 magic
, FILE *fp
, u_int precision
, char *errbuf
,
159 struct pcap_file_header hdr
;
166 * Assume no read errors.
171 * Check whether the first 4 bytes of the file are the magic
172 * number for a pcap savefile, or for a byte-swapped pcap
175 if (magic
!= TCPDUMP_MAGIC
&& magic
!= KUZNETZOV_TCPDUMP_MAGIC
&&
176 magic
!= NSEC_TCPDUMP_MAGIC
) {
177 magic
= SWAPLONG(magic
);
178 if (magic
!= TCPDUMP_MAGIC
&& magic
!= KUZNETZOV_TCPDUMP_MAGIC
&&
179 magic
!= NSEC_TCPDUMP_MAGIC
)
180 return (NULL
); /* nope */
185 * They are. Put the magic number in the header, and read
186 * the rest of the header.
189 amt_read
= fread(((char *)&hdr
) + sizeof hdr
.magic
, 1,
190 sizeof(hdr
) - sizeof(hdr
.magic
), fp
);
191 if (amt_read
!= sizeof(hdr
) - sizeof(hdr
.magic
)) {
193 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
194 "error reading dump file: %s",
195 pcap_strerror(errno
));
197 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
198 "truncated dump file; tried to read %lu file header bytes, only got %lu",
199 (unsigned long)sizeof(hdr
),
200 (unsigned long)amt_read
);
207 * If it's a byte-swapped capture file, byte-swap the header.
210 hdr
.version_major
= SWAPSHORT(hdr
.version_major
);
211 hdr
.version_minor
= SWAPSHORT(hdr
.version_minor
);
212 hdr
.thiszone
= SWAPLONG(hdr
.thiszone
);
213 hdr
.sigfigs
= SWAPLONG(hdr
.sigfigs
);
214 hdr
.snaplen
= SWAPLONG(hdr
.snaplen
);
215 hdr
.linktype
= SWAPLONG(hdr
.linktype
);
218 if (hdr
.version_major
< PCAP_VERSION_MAJOR
) {
219 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
220 "archaic pcap savefile format");
226 * OK, this is a good pcap file.
227 * Allocate a pcap_t for it.
229 p
= pcap_open_offline_common(errbuf
, sizeof (struct pcap_sf
));
231 /* Allocation failed. */
235 p
->swapped
= swapped
;
236 p
->version_major
= hdr
.version_major
;
237 p
->version_minor
= hdr
.version_minor
;
238 p
->tzoff
= hdr
.thiszone
;
239 p
->snapshot
= hdr
.snaplen
;
240 p
->linktype
= linktype_to_dlt(LT_LINKTYPE(hdr
.linktype
));
241 p
->linktype_ext
= LT_LINKTYPE_EXT(hdr
.linktype
);
243 p
->next_packet_op
= pcap_next_packet
;
247 p
->opt
.tstamp_precision
= precision
;
250 * Will we need to scale the timestamps to match what the
255 case PCAP_TSTAMP_PRECISION_MICRO
:
256 if (magic
== NSEC_TCPDUMP_MAGIC
) {
258 * The file has nanoseconds, the user
259 * wants microseconds; scale the
262 ps
->scale_type
= SCALE_DOWN
;
265 * The file has microseconds, the
266 * user wants microseconds; nothing to do.
268 ps
->scale_type
= PASS_THROUGH
;
272 case PCAP_TSTAMP_PRECISION_NANO
:
273 if (magic
== NSEC_TCPDUMP_MAGIC
) {
275 * The file has nanoseconds, the
276 * user wants nanoseconds; nothing to do.
278 ps
->scale_type
= PASS_THROUGH
;
281 * The file has microoseconds, the user
282 * wants nanoseconds; scale the
285 ps
->scale_type
= SCALE_UP
;
290 snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
291 "unknown time stamp resolution %u", precision
);
298 * We interchanged the caplen and len fields at version 2.3,
299 * in order to match the bpf header layout. But unfortunately
300 * some files were written with version 2.3 in their headers
301 * but without the interchanged fields.
303 * In addition, DG/UX tcpdump writes out files with a version
304 * number of 543.0, and with the caplen and len fields in the
307 switch (hdr
.version_major
) {
310 if (hdr
.version_minor
< 3)
311 ps
->lengths_swapped
= SWAPPED
;
312 else if (hdr
.version_minor
== 3)
313 ps
->lengths_swapped
= MAYBE_SWAPPED
;
315 ps
->lengths_swapped
= NOT_SWAPPED
;
319 ps
->lengths_swapped
= SWAPPED
;
323 ps
->lengths_swapped
= NOT_SWAPPED
;
327 if (magic
== KUZNETZOV_TCPDUMP_MAGIC
) {
329 * XXX - the patch that's in some versions of libpcap
330 * changes the packet header but not the magic number,
331 * and some other versions with this magic number have
332 * some extra debugging information in the packet header;
333 * we'd have to use some hacks^H^H^H^H^Hheuristics to
334 * detect those variants.
336 * Ethereal does that, but it does so by trying to read
337 * the first two packets of the file with each of the
338 * record header formats. That currently means it seeks
339 * backwards and retries the reads, which doesn't work
340 * on pipes. We want to be able to read from a pipe, so
341 * that strategy won't work; we'd have to buffer some
342 * data ourselves and read from that buffer in order to
345 ps
->hdrsize
= sizeof(struct pcap_sf_patched_pkthdr
);
347 if (p
->linktype
== DLT_EN10MB
) {
349 * This capture might have been done in raw mode
352 * If it was done in cooked mode, p->snapshot was
353 * passed to recvfrom() as the buffer size, meaning
354 * that the most packet data that would be copied
355 * would be p->snapshot. However, a faked Ethernet
356 * header would then have been added to it, so the
357 * most data that would be in a packet in the file
358 * would be p->snapshot + 14.
360 * We can't easily tell whether the capture was done
361 * in raw mode or cooked mode, so we'll assume it was
362 * cooked mode, and add 14 to the snapshot length.
363 * That means that, for a raw capture, the snapshot
364 * length will be misleading if you use it to figure
365 * out why a capture doesn't have all the packet data,
366 * but there's not much we can do to avoid that.
371 ps
->hdrsize
= sizeof(struct pcap_sf_pkthdr
);
374 * Allocate a buffer for the packet data.
376 p
->bufsize
= p
->snapshot
;
377 if (p
->bufsize
<= 0) {
379 * Bogus snapshot length; use the maximum as a fallback.
381 p
->bufsize
= MAXIMUM_SNAPLEN
;
383 p
->buffer
= malloc(p
->bufsize
);
384 if (p
->buffer
== NULL
) {
385 snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "out of memory");
391 p
->cleanup_op
= sf_cleanup
;
397 * Read and return the next packet from the savefile. Return the header
398 * in hdr and a pointer to the contents in data. Return 0 on success, 1
399 * if there were no more packets, and -1 on an error.
402 pcap_next_packet(pcap_t
*p
, struct pcap_pkthdr
*hdr
, u_char
**data
)
404 struct pcap_sf
*ps
= p
->priv
;
405 struct pcap_sf_patched_pkthdr sf_hdr
;
411 * Read the packet header; the structure we use as a buffer
412 * is the longer structure for files generated by the patched
413 * libpcap, but if the file has the magic number for an
414 * unpatched libpcap we only read as many bytes as the regular
417 amt_read
= fread(&sf_hdr
, 1, ps
->hdrsize
, fp
);
418 if (amt_read
!= ps
->hdrsize
) {
420 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
421 "error reading dump file: %s",
422 pcap_strerror(errno
));
426 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
427 "truncated dump file; tried to read %lu header bytes, only got %lu",
428 (unsigned long)ps
->hdrsize
,
429 (unsigned long)amt_read
);
438 /* these were written in opposite byte order */
439 hdr
->caplen
= SWAPLONG(sf_hdr
.caplen
);
440 hdr
->len
= SWAPLONG(sf_hdr
.len
);
441 hdr
->ts
.tv_sec
= SWAPLONG(sf_hdr
.ts
.tv_sec
);
442 hdr
->ts
.tv_usec
= SWAPLONG(sf_hdr
.ts
.tv_usec
);
444 hdr
->caplen
= sf_hdr
.caplen
;
445 hdr
->len
= sf_hdr
.len
;
446 hdr
->ts
.tv_sec
= sf_hdr
.ts
.tv_sec
;
447 hdr
->ts
.tv_usec
= sf_hdr
.ts
.tv_usec
;
450 switch (ps
->scale_type
) {
454 * Just pass the time stamp through.
460 * File has microseconds, user wants nanoseconds; convert
463 hdr
->ts
.tv_usec
= hdr
->ts
.tv_usec
* 1000;
468 * File has nanoseconds, user wants microseconds; convert
471 hdr
->ts
.tv_usec
= hdr
->ts
.tv_usec
/ 1000;
475 /* Swap the caplen and len fields, if necessary. */
476 switch (ps
->lengths_swapped
) {
482 if (hdr
->caplen
<= hdr
->len
) {
484 * The captured length is <= the actual length,
485 * so presumably they weren't swapped.
493 hdr
->caplen
= hdr
->len
;
498 if ((int)hdr
->caplen
> p
->bufsize
) {
500 * This can happen due to Solaris 2.3 systems tripping
501 * over the BUFMOD problem and not setting the snapshot
502 * correctly in the savefile header. If the caplen isn't
503 * grossly wrong, try to salvage.
505 static u_char
*tp
= NULL
;
506 static size_t tsize
= 0;
508 if (hdr
->caplen
> MAXIMUM_SNAPLEN
) {
509 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
510 "bogus savefile header");
514 if (tsize
< hdr
->caplen
) {
515 tsize
= ((hdr
->caplen
+ 1023) / 1024) * 1024;
518 tp
= (u_char
*)malloc(tsize
);
521 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
522 "BUFMOD hack malloc");
526 amt_read
= fread((char *)tp
, 1, hdr
->caplen
, fp
);
527 if (amt_read
!= hdr
->caplen
) {
529 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
530 "error reading dump file: %s",
531 pcap_strerror(errno
));
533 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
534 "truncated dump file; tried to read %u captured bytes, only got %lu",
535 hdr
->caplen
, (unsigned long)amt_read
);
540 * We can only keep up to p->bufsize bytes. Since
541 * caplen > p->bufsize is exactly how we got here,
542 * we know we can only keep the first p->bufsize bytes
543 * and must drop the remainder. Adjust caplen accordingly,
544 * so we don't get confused later as to how many bytes we
547 hdr
->caplen
= p
->bufsize
;
548 memcpy(p
->buffer
, (char *)tp
, p
->bufsize
);
550 /* read the packet itself */
551 amt_read
= fread(p
->buffer
, 1, hdr
->caplen
, fp
);
552 if (amt_read
!= hdr
->caplen
) {
554 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
555 "error reading dump file: %s",
556 pcap_strerror(errno
));
558 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
559 "truncated dump file; tried to read %u captured bytes, only got %lu",
560 hdr
->caplen
, (unsigned long)amt_read
);
568 swap_pseudo_headers(p
->linktype
, hdr
, *data
);
574 sf_write_header(pcap_t
*p
, FILE *fp
, int linktype
, int thiszone
, int snaplen
)
576 struct pcap_file_header hdr
;
578 hdr
.magic
= p
->opt
.tstamp_precision
== PCAP_TSTAMP_PRECISION_NANO
? NSEC_TCPDUMP_MAGIC
: TCPDUMP_MAGIC
;
579 hdr
.version_major
= PCAP_VERSION_MAJOR
;
580 hdr
.version_minor
= PCAP_VERSION_MINOR
;
582 hdr
.thiszone
= thiszone
;
583 hdr
.snaplen
= snaplen
;
585 hdr
.linktype
= linktype
;
587 if (fwrite((char *)&hdr
, sizeof(hdr
), 1, fp
) != 1)
594 * Output a packet to the initialized dump file.
597 pcap_dump(u_char
*user
, const struct pcap_pkthdr
*h
, const u_char
*sp
)
600 struct pcap_sf_pkthdr sf_hdr
;
603 sf_hdr
.ts
.tv_sec
= h
->ts
.tv_sec
;
604 sf_hdr
.ts
.tv_usec
= h
->ts
.tv_usec
;
605 sf_hdr
.caplen
= h
->caplen
;
607 /* XXX we should check the return status */
608 (void)fwrite(&sf_hdr
, sizeof(sf_hdr
), 1, f
);
609 (void)fwrite(sp
, h
->caplen
, 1, f
);
612 static pcap_dumper_t
*
613 pcap_setup_dump(pcap_t
*p
, int linktype
, FILE *f
, const char *fname
)
616 #if defined(WIN32) || defined(MSDOS)
618 * If we're writing to the standard output, put it in binary
619 * mode, as savefiles are binary files.
621 * Otherwise, we turn off buffering.
622 * XXX - why? And why not on the standard output?
629 if (sf_write_header(p
, f
, linktype
, p
->tzoff
, p
->snapshot
) == -1) {
630 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "Can't write to %s: %s",
631 fname
, pcap_strerror(errno
));
636 return ((pcap_dumper_t
*)f
);
640 * Initialize so that sf_write() will output to the file named 'fname'.
643 pcap_dump_open(pcap_t
*p
, const char *fname
)
649 * If this pcap_t hasn't been activated, it doesn't have a
650 * link-layer type, so we can't use it.
653 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
654 "%s: not-yet-activated pcap_t passed to pcap_dump_open",
658 linktype
= dlt_to_linktype(p
->linktype
);
659 if (linktype
== -1) {
660 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
661 "%s: link-layer type %d isn't supported in savefiles",
665 linktype
|= p
->linktype_ext
;
667 if (fname
[0] == '-' && fname
[1] == '\0') {
669 fname
= "standard output";
671 #if !defined(WIN32) && !defined(MSDOS)
672 f
= fopen(fname
, "w");
674 f
= fopen(fname
, "wb");
677 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s",
678 fname
, pcap_strerror(errno
));
682 return (pcap_setup_dump(p
, linktype
, f
, fname
));
686 * Initialize so that sf_write() will output to the given stream.
689 pcap_dump_fopen(pcap_t
*p
, FILE *f
)
693 linktype
= dlt_to_linktype(p
->linktype
);
694 if (linktype
== -1) {
695 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
696 "stream: link-layer type %d isn't supported in savefiles",
700 linktype
|= p
->linktype_ext
;
702 return (pcap_setup_dump(p
, linktype
, f
, "stream"));
706 pcap_dump_open_append(pcap_t
*p
, const char *fname
)
711 struct pcap_file_header ph
;
713 linktype
= dlt_to_linktype(p
->linktype
);
714 if (linktype
== -1) {
715 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
716 "%s: link-layer type %d isn't supported in savefiles",
720 if (fname
[0] == '-' && fname
[1] == '\0')
721 return (pcap_setup_dump(p
, linktype
, stdout
, "standard output"));
723 #if !defined(WIN32) && !defined(MSDOS)
724 f
= fopen(fname
, "r+");
726 f
= fopen(fname
, "rb+");
729 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s",
730 fname
, pcap_strerror(errno
));
735 * Try to read a pcap header.
737 amt_read
= fread(&ph
, 1, sizeof (ph
), f
);
738 if (amt_read
!= sizeof (ph
)) {
740 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s",
741 fname
, pcap_strerror(errno
));
744 } else if (feof(f
) && amt_read
> 0) {
745 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
746 "%s: truncated pcap file header", fname
);
752 #if defined(WIN32) || defined(MSDOS)
754 * We turn off buffering.
755 * XXX - why? And why not on the standard output?
761 * If a header is already present and:
763 * it's not for a pcap file of the appropriate resolution
764 * and the right byte order for this machine;
766 * the link-layer header types don't match;
768 * the snapshot lengths don't match;
774 * A header is already present.
780 if (p
->opt
.tstamp_precision
!= PCAP_TSTAMP_PRECISION_MICRO
) {
781 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
782 "%s: different time stamp precision, cannot append to file", fname
);
788 case NSEC_TCPDUMP_MAGIC
:
789 if (p
->opt
.tstamp_precision
!= PCAP_TSTAMP_PRECISION_NANO
) {
790 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
791 "%s: different time stamp precision, cannot append to file", fname
);
797 case SWAPLONG(TCPDUMP_MAGIC
):
798 case SWAPLONG(NSEC_TCPDUMP_MAGIC
):
799 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
800 "%s: different byte order, cannot append to file", fname
);
804 case KUZNETZOV_TCPDUMP_MAGIC
:
805 case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC
):
806 case NAVTEL_TCPDUMP_MAGIC
:
807 case SWAPLONG(NAVTEL_TCPDUMP_MAGIC
):
808 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
809 "%s: not a pcap file to which we can append", fname
);
814 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
815 "%s: not a pcap file", fname
);
823 if (ph
.version_major
!= PCAP_VERSION_MAJOR
||
824 ph
.version_minor
!= PCAP_VERSION_MINOR
) {
825 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
826 "%s: version is %u.%u, cannot append to file", fname
,
827 ph
.version_major
, ph
.version_minor
);
831 if (linktype
!= (int)ph
.linktype
) {
832 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
833 "%s: different linktype, cannot append to file", fname
);
837 if (p
->snapshot
!= (int)ph
.snaplen
) {
838 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
839 "%s: different snaplen, cannot append to file", fname
);
845 * A header isn't present; attempt to write it.
847 if (sf_write_header(p
, f
, linktype
, p
->tzoff
, p
->snapshot
) == -1) {
848 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "Can't write to %s: %s",
849 fname
, pcap_strerror(errno
));
856 * Start writing at the end of the file.
858 if (fseek(f
, 0, SEEK_END
) == -1) {
859 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "Can't seek to end of %s: %s",
860 fname
, pcap_strerror(errno
));
864 return ((pcap_dumper_t
*)f
);
868 pcap_dump_file(pcap_dumper_t
*p
)
874 pcap_dump_ftell(pcap_dumper_t
*p
)
876 return (ftell((FILE *)p
));
880 pcap_dump_flush(pcap_dumper_t
*p
)
883 if (fflush((FILE *)p
) == EOF
)
890 pcap_dump_close(pcap_dumper_t
*p
)
894 if (ferror((FILE *)p
))
896 /* XXX should check return from fclose() too */
898 (void)fclose((FILE *)p
);