2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * sf-pcap.c - libpcap-file-format-specific code from savefile.c
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
32 static const char rcsid[] _U_ =
33 "@(#) $Header$ (LBL)";
41 #include <pcap-stdinc.h>
48 #ifdef HAVE_SYS_BITYPES_H
49 #include <sys/bitypes.h>
51 #include <sys/types.h>
62 #include "pcap-common.h"
64 #ifdef HAVE_OS_PROTO_H
71 * Setting O_BINARY on DOS/Windows is a bit tricky
74 #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
76 #if defined(__HIGHC__)
77 #define SET_BINMODE(f) setmode(f, O_BINARY)
79 #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
84 * Standard libpcap format.
86 #define TCPDUMP_MAGIC 0xa1b2c3d4
89 * Alexey Kuznetzov's modified libpcap format.
91 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
94 * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
95 * for another modified format.
97 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
100 * Navtel Communcations' format, with nanosecond timestamps,
101 * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
103 #define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
106 * Normal libpcap format, except for seconds/nanoseconds timestamps,
107 * as per a request by Ulf Lamping <ulf.lamping@web.de>
109 #define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
112 * Mechanism for storing information about a capture in the upper
113 * 6 bits of a linktype value in a capture file.
115 * LT_LINKTYPE_EXT(x) extracts the additional information.
117 * The rest of the bits are for a value describing the link-layer
118 * value. LT_LINKTYPE(x) extracts that value.
120 #define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
121 #define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
123 static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
126 * Check whether this is a pcap savefile and, if it is, extract the
127 * relevant information from the header.
130 pcap_check_header(pcap_t *p, bpf_u_int32 magic, FILE *fp, char *errbuf)
132 struct pcap_file_header hdr;
136 * Check whether the first 4 bytes of the file are the magic
137 * number for a pcap savefile, or for a byte-swapped pcap
140 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC) {
141 magic = SWAPLONG(magic);
142 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC)
143 return (0); /* nope */
148 * They are. Put the magic number in the header, and read
149 * the rest of the header.
152 amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
153 sizeof(hdr) - sizeof(hdr.magic), fp);
154 if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
156 snprintf(errbuf, PCAP_ERRBUF_SIZE,
157 "error reading dump file: %s",
158 pcap_strerror(errno));
160 snprintf(errbuf, PCAP_ERRBUF_SIZE,
161 "truncated dump file; tried to read %lu file header bytes, only got %lu",
162 (unsigned long)sizeof(hdr),
163 (unsigned long)amt_read);
169 * If it's a byte-swapped capture file, byte-swap the header.
172 hdr.version_major = SWAPSHORT(hdr.version_major);
173 hdr.version_minor = SWAPSHORT(hdr.version_minor);
174 hdr.thiszone = SWAPLONG(hdr.thiszone);
175 hdr.sigfigs = SWAPLONG(hdr.sigfigs);
176 hdr.snaplen = SWAPLONG(hdr.snaplen);
177 hdr.linktype = SWAPLONG(hdr.linktype);
180 if (hdr.version_major < PCAP_VERSION_MAJOR) {
181 snprintf(errbuf, PCAP_ERRBUF_SIZE,
182 "archaic pcap savefile format");
185 p->sf.version_major = hdr.version_major;
186 p->sf.version_minor = hdr.version_minor;
187 p->tzoff = hdr.thiszone;
188 p->snapshot = hdr.snaplen;
189 p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
190 p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
192 p->sf.next_packet_op = pcap_next_packet;
195 * We interchanged the caplen and len fields at version 2.3,
196 * in order to match the bpf header layout. But unfortunately
197 * some files were written with version 2.3 in their headers
198 * but without the interchanged fields.
200 * In addition, DG/UX tcpdump writes out files with a version
201 * number of 543.0, and with the caplen and len fields in the
204 switch (hdr.version_major) {
207 if (hdr.version_minor < 3)
208 p->sf.lengths_swapped = SWAPPED;
209 else if (hdr.version_minor == 3)
210 p->sf.lengths_swapped = MAYBE_SWAPPED;
212 p->sf.lengths_swapped = NOT_SWAPPED;
216 p->sf.lengths_swapped = SWAPPED;
220 p->sf.lengths_swapped = NOT_SWAPPED;
224 if (magic == KUZNETZOV_TCPDUMP_MAGIC) {
226 * XXX - the patch that's in some versions of libpcap
227 * changes the packet header but not the magic number,
228 * and some other versions with this magic number have
229 * some extra debugging information in the packet header;
230 * we'd have to use some hacks^H^H^H^H^Hheuristics to
231 * detect those variants.
233 * Ethereal does that, but it does so by trying to read
234 * the first two packets of the file with each of the
235 * record header formats. That currently means it seeks
236 * backwards and retries the reads, which doesn't work
237 * on pipes. We want to be able to read from a pipe, so
238 * that strategy won't work; we'd have to buffer some
239 * data ourselves and read from that buffer in order to
242 p->sf.hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
244 if (p->linktype == DLT_EN10MB) {
246 * This capture might have been done in raw mode
249 * If it was done in cooked mode, p->snapshot was
250 * passed to recvfrom() as the buffer size, meaning
251 * that the most packet data that would be copied
252 * would be p->snapshot. However, a faked Ethernet
253 * header would then have been added to it, so the
254 * most data that would be in a packet in the file
255 * would be p->snapshot + 14.
257 * We can't easily tell whether the capture was done
258 * in raw mode or cooked mode, so we'll assume it was
259 * cooked mode, and add 14 to the snapshot length.
260 * That means that, for a raw capture, the snapshot
261 * length will be misleading if you use it to figure
262 * out why a capture doesn't have all the packet data,
263 * but there's not much we can do to avoid that.
268 p->sf.hdrsize = sizeof(struct pcap_sf_pkthdr);
271 * Allocate a buffer for the packet data.
273 p->bufsize = p->snapshot;
274 if (p->bufsize <= 0) {
276 * Bogus snapshot length; use 64KiB as a fallback.
280 p->buffer = malloc(p->bufsize);
281 if (p->buffer == NULL) {
282 snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
290 * Read and return the next packet from the savefile. Return the header
291 * in hdr and a pointer to the contents in data. Return 0 on success, 1
292 * if there were no more packets, and -1 on an error.
295 pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
297 struct pcap_sf_patched_pkthdr sf_hdr;
298 FILE *fp = p->sf.rfile;
303 * Read the packet header; the structure we use as a buffer
304 * is the longer structure for files generated by the patched
305 * libpcap, but if the file has the magic number for an
306 * unpatched libpcap we only read as many bytes as the regular
309 amt_read = fread(&sf_hdr, 1, p->sf.hdrsize, fp);
310 if (amt_read != p->sf.hdrsize) {
312 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
313 "error reading dump file: %s",
314 pcap_strerror(errno));
318 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
319 "truncated dump file; tried to read %lu header bytes, only got %lu",
320 (unsigned long)p->sf.hdrsize,
321 (unsigned long)amt_read);
330 /* these were written in opposite byte order */
331 hdr->caplen = SWAPLONG(sf_hdr.caplen);
332 hdr->len = SWAPLONG(sf_hdr.len);
333 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
334 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
336 hdr->caplen = sf_hdr.caplen;
337 hdr->len = sf_hdr.len;
338 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
339 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
341 /* Swap the caplen and len fields, if necessary. */
342 switch (p->sf.lengths_swapped) {
348 if (hdr->caplen <= hdr->len) {
350 * The captured length is <= the actual length,
351 * so presumably they weren't swapped.
359 hdr->caplen = hdr->len;
364 if (hdr->caplen > p->bufsize) {
366 * This can happen due to Solaris 2.3 systems tripping
367 * over the BUFMOD problem and not setting the snapshot
368 * correctly in the savefile header. If the caplen isn't
369 * grossly wrong, try to salvage.
371 static u_char *tp = NULL;
372 static size_t tsize = 0;
374 if (hdr->caplen > 65535) {
375 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
376 "bogus savefile header");
380 if (tsize < hdr->caplen) {
381 tsize = ((hdr->caplen + 1023) / 1024) * 1024;
384 tp = (u_char *)malloc(tsize);
387 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
388 "BUFMOD hack malloc");
392 amt_read = fread((char *)tp, 1, hdr->caplen, fp);
393 if (amt_read != hdr->caplen) {
395 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
396 "error reading dump file: %s",
397 pcap_strerror(errno));
399 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
400 "truncated dump file; tried to read %u captured bytes, only got %lu",
401 hdr->caplen, (unsigned long)amt_read);
406 * We can only keep up to p->bufsize bytes. Since
407 * caplen > p->bufsize is exactly how we got here,
408 * we know we can only keep the first p->bufsize bytes
409 * and must drop the remainder. Adjust caplen accordingly,
410 * so we don't get confused later as to how many bytes we
413 hdr->caplen = p->bufsize;
414 memcpy(p->buffer, (char *)tp, p->bufsize);
416 /* read the packet itself */
417 amt_read = fread(p->buffer, 1, hdr->caplen, fp);
418 if (amt_read != hdr->caplen) {
420 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
421 "error reading dump file: %s",
422 pcap_strerror(errno));
424 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
425 "truncated dump file; tried to read %u captured bytes, only got %lu",
426 hdr->caplen, (unsigned long)amt_read);
435 * Convert pseudo-headers from the byte order of
436 * the host on which the file was saved to our
437 * byte order, as necessary.
439 switch (p->linktype) {
442 swap_linux_usb_header(hdr, *data, 0);
445 case DLT_USB_LINUX_MMAPPED:
446 swap_linux_usb_header(hdr, *data, 1);
455 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
457 struct pcap_file_header hdr;
459 hdr.magic = TCPDUMP_MAGIC;
460 hdr.version_major = PCAP_VERSION_MAJOR;
461 hdr.version_minor = PCAP_VERSION_MINOR;
463 hdr.thiszone = thiszone;
464 hdr.snaplen = snaplen;
466 hdr.linktype = linktype;
468 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
475 * Output a packet to the initialized dump file.
478 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
481 struct pcap_sf_pkthdr sf_hdr;
484 sf_hdr.ts.tv_sec = h->ts.tv_sec;
485 sf_hdr.ts.tv_usec = h->ts.tv_usec;
486 sf_hdr.caplen = h->caplen;
488 /* XXX we should check the return status */
489 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
490 (void)fwrite(sp, h->caplen, 1, f);
493 static pcap_dumper_t *
494 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
497 #if defined(WIN32) || defined(MSDOS)
499 * If we're writing to the standard output, put it in binary
500 * mode, as savefiles are binary files.
502 * Otherwise, we turn off buffering.
503 * XXX - why? And why not on the standard output?
510 if (sf_write_header(f, linktype, p->tzoff, p->snapshot) == -1) {
511 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
512 fname, pcap_strerror(errno));
517 return ((pcap_dumper_t *)f);
521 * Initialize so that sf_write() will output to the file named 'fname'.
524 pcap_dump_open(pcap_t *p, const char *fname)
530 * If this pcap_t hasn't been activated, it doesn't have a
531 * link-layer type, so we can't use it.
534 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
535 "%s: not-yet-activated pcap_t passed to pcap_dump_open",
539 linktype = dlt_to_linktype(p->linktype);
540 if (linktype == -1) {
541 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
542 "%s: link-layer type %d isn't supported in savefiles",
546 linktype |= p->linktype_ext;
548 if (fname[0] == '-' && fname[1] == '\0') {
550 fname = "standard output";
552 #if !defined(WIN32) && !defined(MSDOS)
553 f = fopen(fname, "w");
555 f = fopen(fname, "wb");
558 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
559 fname, pcap_strerror(errno));
563 return (pcap_setup_dump(p, linktype, f, fname));
567 * Initialize so that sf_write() will output to the given stream.
570 pcap_dump_fopen(pcap_t *p, FILE *f)
574 linktype = dlt_to_linktype(p->linktype);
575 if (linktype == -1) {
576 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
577 "stream: link-layer type %d isn't supported in savefiles",
581 linktype |= p->linktype_ext;
583 return (pcap_setup_dump(p, linktype, f, "stream"));
587 pcap_dump_file(pcap_dumper_t *p)
593 pcap_dump_ftell(pcap_dumper_t *p)
595 return (ftell((FILE *)p));
599 pcap_dump_flush(pcap_dumper_t *p)
602 if (fflush((FILE *)p) == EOF)
609 pcap_dump_close(pcap_dumper_t *p)
613 if (ferror((FILE *)p))
615 /* XXX should check return from fclose() too */
617 (void)fclose((FILE *)p);