2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * savefile.c - supports offline use of tcpdump
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
32 static const char rcsid[] =
33 "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.38 1999/11/21 01:11:58 assar Exp $ (LBL)";
36 #include <sys/types.h>
48 #ifdef HAVE_OS_PROTO_H
52 #define TCPDUMP_MAGIC 0xa1b2c3d4
55 * We use the "receiver-makes-right" approach to byte order,
56 * because time is at a premium when we are writing the file.
57 * In other words, the pcap_file_header and pcap_pkthdr,
58 * records are written in host byte order.
59 * Note that the packets are always written in network byte order.
61 * ntoh[ls] aren't sufficient because we might need to swap on a big-endian
62 * machine (if the file was written in little-end order).
65 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
66 #define SWAPSHORT(y) \
67 ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) )
70 #define SFERR_BADVERSION 2
72 #define SFERR_EOF 4 /* not really an error, just a status */
75 sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
77 struct pcap_file_header hdr;
79 hdr.magic = TCPDUMP_MAGIC;
80 hdr.version_major = PCAP_VERSION_MAJOR;
81 hdr.version_minor = PCAP_VERSION_MINOR;
83 hdr.thiszone = thiszone;
84 hdr.snaplen = snaplen;
86 hdr.linktype = linktype;
88 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
95 swap_hdr(struct pcap_file_header *hp)
97 hp->version_major = SWAPSHORT(hp->version_major);
98 hp->version_minor = SWAPSHORT(hp->version_minor);
99 hp->thiszone = SWAPLONG(hp->thiszone);
100 hp->sigfigs = SWAPLONG(hp->sigfigs);
101 hp->snaplen = SWAPLONG(hp->snaplen);
102 hp->linktype = SWAPLONG(hp->linktype);
106 pcap_open_offline(const char *fname, char *errbuf)
110 struct pcap_file_header hdr;
113 p = (pcap_t *)malloc(sizeof(*p));
115 strcpy(errbuf, "out of swap");
119 memset((char *)p, 0, sizeof(*p));
121 * Set this field so we don't close stdin in pcap_close!
125 if (fname[0] == '-' && fname[1] == '\0')
128 fp = fopen(fname, "r");
130 sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno));
134 if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
135 sprintf(errbuf, "fread: %s", pcap_strerror(errno));
138 if (hdr.magic != TCPDUMP_MAGIC) {
139 if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) {
140 sprintf(errbuf, "bad dump file format");
146 if (hdr.version_major < PCAP_VERSION_MAJOR) {
147 sprintf(errbuf, "archaic file format");
150 p->tzoff = hdr.thiszone;
151 p->snapshot = hdr.snaplen;
152 p->linktype = hdr.linktype;
154 p->bufsize = hdr.snaplen;
156 /* Align link header as required for proper data alignment */
157 /* XXX should handle all types */
158 switch (p->linktype) {
165 linklen = 13 + 8; /* fddi_header + llc */
174 p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT);
175 p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT);
176 p->sf.version_major = hdr.version_major;
177 p->sf.version_minor = hdr.version_minor;
179 /* XXX padding only needed for kernel fcode */
190 * Read sf_readfile and return the next packet. Return the header in hdr
191 * and the contents in buf. Return 0 on success, SFERR_EOF if there were
192 * no more packets, and SFERR_TRUNC if a partial packet was encountered.
195 sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen)
197 struct pcap_sf_pkthdr sf_hdr;
198 FILE *fp = p->sf.rfile;
201 if (fread(&sf_hdr, sizeof(struct pcap_sf_pkthdr), 1, fp) != 1) {
202 /* probably an EOF, though could be a truncated packet */
207 /* these were written in opposite byte order */
208 hdr->caplen = SWAPLONG(sf_hdr.caplen);
209 hdr->len = SWAPLONG(sf_hdr.len);
210 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
211 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
213 hdr->caplen = sf_hdr.caplen;
214 hdr->len = sf_hdr.len;
215 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
216 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
219 * We interchanged the caplen and len fields at version 2.3,
220 * in order to match the bpf header layout. But unfortunately
221 * some files were written with version 2.3 in their headers
222 * but without the interchanged fields.
224 if (p->sf.version_minor < 3 ||
225 (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) {
227 hdr->caplen = hdr->len;
231 if (hdr->caplen > buflen) {
233 * This can happen due to Solaris 2.3 systems tripping
234 * over the BUFMOD problem and not setting the snapshot
235 * correctly in the savefile header. If the caplen isn't
236 * grossly wrong, try to salvage.
238 static u_char *tp = NULL;
239 static int tsize = 0;
241 if (hdr->caplen > 65535) {
242 sprintf(p->errbuf, "bogus savefile header");
245 if (tsize < hdr->caplen) {
246 tsize = ((hdr->caplen + 1023) / 1024) * 1024;
249 tp = (u_char *)malloc(tsize);
252 sprintf(p->errbuf, "BUFMOD hack malloc");
256 if (fread((char *)tp, hdr->caplen, 1, fp) != 1) {
257 sprintf(p->errbuf, "truncated dump file");
261 * We can only keep up to buflen bytes. Since caplen > buflen
262 * is exactly how we got here, we know we can only keep the
263 * first buflen bytes and must drop the remainder. Adjust
264 * caplen accordingly, so we don't get confused later as
265 * to how many bytes we have to play with.
267 hdr->caplen = buflen;
268 memcpy((char *)buf, (char *)tp, buflen);
271 /* read the packet itself */
273 if (fread((char *)buf, hdr->caplen, 1, fp) != 1) {
274 sprintf(p->errbuf, "truncated dump file");
282 * Print out packets stored in the file initialized by sf_read_init().
283 * If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
286 pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
288 struct bpf_insn *fcode = p->fcode.bf_insns;
292 while (status == 0) {
293 struct pcap_pkthdr h;
295 status = sf_next_packet(p, &h, p->buffer, p->bufsize);
303 bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
304 (*callback)(user, &h, p->buffer);
305 if (++n >= cnt && cnt > 0)
309 /*XXX this breaks semantics tcpslice expects */
314 * Output a packet to the initialized dump file.
317 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
320 struct pcap_sf_pkthdr sf_hdr;
323 sf_hdr.ts.tv_sec = h->ts.tv_sec;
324 sf_hdr.ts.tv_usec = h->ts.tv_usec;
325 sf_hdr.caplen = h->caplen;
327 /* XXX we should check the return status */
328 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
329 (void)fwrite((char *)sp, h->caplen, 1, f);
333 * Initialize so that sf_write() will output to the file named 'fname'.
336 pcap_dump_open(pcap_t *p, const char *fname)
339 if (fname[0] == '-' && fname[1] == '\0')
342 f = fopen(fname, "w");
344 sprintf(p->errbuf, "%s: %s",
345 fname, pcap_strerror(errno));
349 (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot);
350 return ((pcap_dumper_t *)f);
354 pcap_dump_close(pcap_dumper_t *p)
358 if (ferror((FILE *)p))
360 /* XXX should check return from fclose() too */
362 (void)fclose((FILE *)p);