4 * Copyright (C) 2012 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
14 static const char rcsid[] = "@(#)$Id$";
19 int lc_sz; /* LLC header length */
20 int lc_to; /* LLC Type offset */
21 int lc_tl; /* LLC Type length */
25 * While many of these maybe the same, some do have different header formats
26 * which make this useful.
29 static struct llc llcs[] = {
30 { 0, 0, 0, 0 }, /* DLT_NULL */
31 { 1, 14, 12, 2 }, /* DLT_Ethernet */
32 { 10, 0, 0, 0 }, /* DLT_FDDI */
33 { 12, 0, 0, 0 }, /* DLT_RAW */
54 static int ipcap_open __P((char *));
55 static int ipcap_close __P((void));
56 static int ipcap_readip __P((mb_t *, char **, int *));
57 static int ipcap_read_rec __P((packetheader_t *));
58 static void iswap_hdr __P((fileheader_t *));
60 static int pfd = -1, swapped = 0;
61 static struct llc *llcp = NULL;
63 struct ipread pcap = { ipcap_open, ipcap_close, ipcap_readip, 0 };
66 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
67 #define SWAPSHORT(y) \
68 ( (((y)&0xff)<<8) | (((y)&0xff00)>>8) )
70 static void iswap_hdr(p)
73 p->major = SWAPSHORT(p->major);
74 p->minor = SWAPSHORT(p->minor);
75 p->timezone = SWAPLONG(p->timezone);
76 p->sigfigs = SWAPLONG(p->sigfigs);
77 p->snaplen = SWAPLONG(p->snaplen);
78 p->type = SWAPLONG(p->type);
81 static int ipcap_open(fname)
90 if (!strcmp(fname, "-"))
92 else if ((fd = open(fname, O_RDONLY)) == -1)
95 if (read(fd, (char *)&ph, sizeof(ph)) != sizeof(ph))
98 if (ph.id != 0xa1b2c3d4) {
99 if (SWAPLONG(ph.id) != 0xa1b2c3d4) {
107 for (i = 0; llcs[i].lc_type != -1; i++)
108 if (llcs[i].lc_type == ph.type) {
119 printf("opened pcap file %s:\n", fname);
120 printf("\tid: %08x version: %d.%d type: %d snap %d\n",
121 ph.id, ph.major, ph.minor, ph.type, ph.snaplen);
127 static int ipcap_close()
134 * read in the header (and validate) which should be the first record
137 static int ipcap_read_rec(rec)
147 i = read(pfd, (char *)rec, sizeof(*rec));
155 rec->caplen = SWAPLONG(rec->caplen);
156 rec->wirelen = SWAPLONG(rec->wirelen);
157 rec->seconds = SWAPLONG(rec->seconds);
158 rec->microseconds = SWAPLONG(rec->microseconds);
161 n = MIN(p, rec->wirelen);
165 if (p < 0 || p > 65536)
173 * read an entire pcap packet record. only the data part is copied into
174 * the available buffer, with the number of bytes copied returned.
176 static int ipcap_read(buf, cnt)
181 static char *bufp = NULL;
184 if ((i = ipcap_read_rec(&rec)) <= 0)
190 bufp = realloc(bufp, i);
192 if (read(pfd, bufp, i) != i)
203 * return only an IP packet read into buf
205 static int ipcap_readip(mb, ifn, dir)
210 static char *bufp = NULL;
219 ifn = ifn; /* gcc -Wextra */
220 dir = dir; /* gcc -Wextra */
222 buf = (char *)mb->mb_buf;
223 cnt = sizeof(mb->mb_buf);
227 if ((i = ipcap_read_rec(&rec)) <= 0)
233 bufp = realloc(bufp, i);
236 for (j = i, n = 0; j > 0; ) {
247 bcopy(s, ty, l->lc_tl);
249 /* } while (ty[0] != 0x8 && ty[1] != 0); */