|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Copyright (c) 1993, 1994, 1995, 1996, 1997
|
|
Packit |
209cc3 |
* The Regents of the University of California. All rights reserved.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* Redistribution and use in source and binary forms, with or without
|
|
Packit |
209cc3 |
* modification, are permitted provided that: (1) source code distributions
|
|
Packit |
209cc3 |
* retain the above copyright notice and this paragraph in its entirety, (2)
|
|
Packit |
209cc3 |
* distributions including binary code include the above copyright notice and
|
|
Packit |
209cc3 |
* this paragraph in its entirety in the documentation or other materials
|
|
Packit |
209cc3 |
* provided with the distribution, and (3) all advertising materials mentioning
|
|
Packit |
209cc3 |
* features or use of this software display the following acknowledgement:
|
|
Packit |
209cc3 |
* ``This product includes software developed by the University of California,
|
|
Packit |
209cc3 |
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
|
|
Packit |
209cc3 |
* the University nor the names of its contributors may be used to endorse
|
|
Packit |
209cc3 |
* or promote products derived from this software without specific prior
|
|
Packit |
209cc3 |
* written permission.
|
|
Packit |
209cc3 |
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|
|
Packit |
209cc3 |
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
|
Packit |
209cc3 |
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* sf-pcap.c - libpcap-file-format-specific code from savefile.c
|
|
Packit |
209cc3 |
* Extraction/creation by Jeffrey Mogul, DECWRL
|
|
Packit |
209cc3 |
* Modified by Steve McCanne, LBL.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* Used to save the received packet headers, after filtering, to
|
|
Packit |
209cc3 |
* a file, and then read them later.
|
|
Packit |
209cc3 |
* The first record in the file contains saved values for the machine
|
|
Packit |
209cc3 |
* dependent values so we can print the dump file on any architecture.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#ifdef HAVE_CONFIG_H
|
|
Packit |
209cc3 |
#include <config.h>
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#include <pcap-types.h>
|
|
Packit |
209cc3 |
#ifdef _WIN32
|
|
Packit |
209cc3 |
#include <io.h>
|
|
Packit |
209cc3 |
#include <fcntl.h>
|
|
Packit |
209cc3 |
#endif /* _WIN32 */
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#include <errno.h>
|
|
Packit |
209cc3 |
#include <memory.h>
|
|
Packit |
209cc3 |
#include <stdio.h>
|
|
Packit |
209cc3 |
#include <stdlib.h>
|
|
Packit |
209cc3 |
#include <string.h>
|
|
Packit |
209cc3 |
#include <limits.h> /* for INT_MAX */
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#include "pcap-int.h"
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#include "pcap-common.h"
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#ifdef HAVE_OS_PROTO_H
|
|
Packit |
209cc3 |
#include "os-proto.h"
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#include "sf-pcap.h"
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Setting O_BINARY on DOS/Windows is a bit tricky
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#if defined(_WIN32)
|
|
Packit |
209cc3 |
#define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
|
|
Packit |
209cc3 |
#elif defined(MSDOS)
|
|
Packit |
209cc3 |
#if defined(__HIGHC__)
|
|
Packit |
209cc3 |
#define SET_BINMODE(f) setmode(f, O_BINARY)
|
|
Packit |
209cc3 |
#else
|
|
Packit |
209cc3 |
#define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Standard libpcap format.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#define TCPDUMP_MAGIC 0xa1b2c3d4
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Alexey Kuznetzov's modified libpcap format.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
|
|
Packit |
209cc3 |
* for another modified format.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Navtel Communcations' format, with nanosecond timestamps,
|
|
Packit |
209cc3 |
* as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Normal libpcap format, except for seconds/nanoseconds timestamps,
|
|
Packit |
209cc3 |
* as per a request by Ulf Lamping <ulf.lamping@web.de>
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Mechanism for storing information about a capture in the upper
|
|
Packit |
209cc3 |
* 6 bits of a linktype value in a capture file.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* LT_LINKTYPE_EXT(x) extracts the additional information.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* The rest of the bits are for a value describing the link-layer
|
|
Packit |
209cc3 |
* value. LT_LINKTYPE(x) extracts that value.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
|
|
Packit |
209cc3 |
#define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#ifdef _WIN32
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* This isn't exported on Windows, because it would only work if both
|
|
Packit |
209cc3 |
* libpcap and the code using it were using the same C runtime; otherwise they
|
|
Packit |
209cc3 |
* would be using different definitions of a FILE structure.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* Instead we define this as a macro in pcap/pcap.h that wraps the hopen
|
|
Packit |
209cc3 |
* version that we do export, passing it a raw OS HANDLE, as defined by the
|
|
Packit |
209cc3 |
* Win32 / Win64 ABI, obtained from the _fileno() and _get_osfhandle()
|
|
Packit |
209cc3 |
* functions of the appropriate CRT.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
static pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *f);
|
|
Packit |
209cc3 |
#endif /* _WIN32 */
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Private data for reading pcap savefiles.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
typedef enum {
|
|
Packit |
209cc3 |
NOT_SWAPPED,
|
|
Packit |
209cc3 |
SWAPPED,
|
|
Packit |
209cc3 |
MAYBE_SWAPPED
|
|
Packit |
209cc3 |
} swapped_type_t;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
typedef enum {
|
|
Packit |
209cc3 |
PASS_THROUGH,
|
|
Packit |
209cc3 |
SCALE_UP,
|
|
Packit |
209cc3 |
SCALE_DOWN
|
|
Packit |
209cc3 |
} tstamp_scale_type_t;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
struct pcap_sf {
|
|
Packit |
209cc3 |
size_t hdrsize;
|
|
Packit |
209cc3 |
swapped_type_t lengths_swapped;
|
|
Packit |
209cc3 |
tstamp_scale_type_t scale_type;
|
|
Packit |
209cc3 |
};
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Check whether this is a pcap savefile and, if it is, extract the
|
|
Packit |
209cc3 |
* relevant information from the header.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
pcap_t *
|
|
Packit |
209cc3 |
pcap_check_header(const uint8_t *magic, FILE *fp, u_int precision, char *errbuf,
|
|
Packit |
209cc3 |
int *err)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
bpf_u_int32 magic_int;
|
|
Packit |
209cc3 |
struct pcap_file_header hdr;
|
|
Packit |
209cc3 |
size_t amt_read;
|
|
Packit |
209cc3 |
pcap_t *p;
|
|
Packit |
209cc3 |
int swapped = 0;
|
|
Packit |
209cc3 |
struct pcap_sf *ps;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Assume no read errors.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
*err = 0;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Check whether the first 4 bytes of the file are the magic
|
|
Packit |
209cc3 |
* number for a pcap savefile, or for a byte-swapped pcap
|
|
Packit |
209cc3 |
* savefile.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
memcpy(&magic_int, magic, sizeof(magic_int));
|
|
Packit |
209cc3 |
if (magic_int != TCPDUMP_MAGIC &&
|
|
Packit |
209cc3 |
magic_int != KUZNETZOV_TCPDUMP_MAGIC &&
|
|
Packit |
209cc3 |
magic_int != NSEC_TCPDUMP_MAGIC) {
|
|
Packit |
209cc3 |
magic_int = SWAPLONG(magic_int);
|
|
Packit |
209cc3 |
if (magic_int != TCPDUMP_MAGIC &&
|
|
Packit |
209cc3 |
magic_int != KUZNETZOV_TCPDUMP_MAGIC &&
|
|
Packit |
209cc3 |
magic_int != NSEC_TCPDUMP_MAGIC)
|
|
Packit |
209cc3 |
return (NULL); /* nope */
|
|
Packit |
209cc3 |
swapped = 1;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* They are. Put the magic number in the header, and read
|
|
Packit |
209cc3 |
* the rest of the header.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
hdr.magic = magic_int;
|
|
Packit |
209cc3 |
amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
|
|
Packit |
209cc3 |
sizeof(hdr) - sizeof(hdr.magic), fp);
|
|
Packit |
209cc3 |
if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
|
|
Packit |
209cc3 |
if (ferror(fp)) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "error reading dump file");
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"truncated dump file; tried to read %" PRIsize " file header bytes, only got %" PRIsize,
|
|
Packit |
209cc3 |
sizeof(hdr), amt_read);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
*err = 1;
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* If it's a byte-swapped capture file, byte-swap the header.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (swapped) {
|
|
Packit |
209cc3 |
hdr.version_major = SWAPSHORT(hdr.version_major);
|
|
Packit |
209cc3 |
hdr.version_minor = SWAPSHORT(hdr.version_minor);
|
|
Packit |
209cc3 |
hdr.thiszone = SWAPLONG(hdr.thiszone);
|
|
Packit |
209cc3 |
hdr.sigfigs = SWAPLONG(hdr.sigfigs);
|
|
Packit |
209cc3 |
hdr.snaplen = SWAPLONG(hdr.snaplen);
|
|
Packit |
209cc3 |
hdr.linktype = SWAPLONG(hdr.linktype);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (hdr.version_major < PCAP_VERSION_MAJOR) {
|
|
Packit |
209cc3 |
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"archaic pcap savefile format");
|
|
Packit |
209cc3 |
*err = 1;
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* currently only versions 2.[0-4] are supported with
|
|
Packit |
209cc3 |
* the exception of 543.0 for DG/UX tcpdump.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (! ((hdr.version_major == PCAP_VERSION_MAJOR &&
|
|
Packit |
209cc3 |
hdr.version_minor <= PCAP_VERSION_MINOR) ||
|
|
Packit |
209cc3 |
(hdr.version_major == 543 &&
|
|
Packit |
209cc3 |
hdr.version_minor == 0))) {
|
|
Packit |
209cc3 |
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"unsupported pcap savefile version %u.%u",
|
|
Packit |
209cc3 |
hdr.version_major, hdr.version_minor);
|
|
Packit |
209cc3 |
*err = 1;
|
|
Packit |
209cc3 |
return NULL;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* OK, this is a good pcap file.
|
|
Packit |
209cc3 |
* Allocate a pcap_t for it.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
p = pcap_open_offline_common(errbuf, sizeof (struct pcap_sf));
|
|
Packit |
209cc3 |
if (p == NULL) {
|
|
Packit |
209cc3 |
/* Allocation failed. */
|
|
Packit |
209cc3 |
*err = 1;
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
p->swapped = swapped;
|
|
Packit |
209cc3 |
p->version_major = hdr.version_major;
|
|
Packit |
209cc3 |
p->version_minor = hdr.version_minor;
|
|
Packit |
209cc3 |
p->tzoff = hdr.thiszone;
|
|
Packit |
209cc3 |
p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
|
|
Packit |
209cc3 |
p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
|
|
Packit |
209cc3 |
p->snapshot = pcap_adjust_snapshot(p->linktype, hdr.snaplen);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
p->next_packet_op = pcap_next_packet;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
ps = p->priv;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
p->opt.tstamp_precision = precision;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Will we need to scale the timestamps to match what the
|
|
Packit |
209cc3 |
* user wants?
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
switch (precision) {
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case PCAP_TSTAMP_PRECISION_MICRO:
|
|
Packit |
209cc3 |
if (magic_int == NSEC_TCPDUMP_MAGIC) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The file has nanoseconds, the user
|
|
Packit |
209cc3 |
* wants microseconds; scale the
|
|
Packit |
209cc3 |
* precision down.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
ps->scale_type = SCALE_DOWN;
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The file has microseconds, the
|
|
Packit |
209cc3 |
* user wants microseconds; nothing to do.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
ps->scale_type = PASS_THROUGH;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case PCAP_TSTAMP_PRECISION_NANO:
|
|
Packit |
209cc3 |
if (magic_int == NSEC_TCPDUMP_MAGIC) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The file has nanoseconds, the
|
|
Packit |
209cc3 |
* user wants nanoseconds; nothing to do.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
ps->scale_type = PASS_THROUGH;
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The file has microoseconds, the user
|
|
Packit |
209cc3 |
* wants nanoseconds; scale the
|
|
Packit |
209cc3 |
* precision up.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
ps->scale_type = SCALE_UP;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
default:
|
|
Packit |
209cc3 |
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"unknown time stamp resolution %u", precision);
|
|
Packit |
209cc3 |
free(p);
|
|
Packit |
209cc3 |
*err = 1;
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* We interchanged the caplen and len fields at version 2.3,
|
|
Packit |
209cc3 |
* in order to match the bpf header layout. But unfortunately
|
|
Packit |
209cc3 |
* some files were written with version 2.3 in their headers
|
|
Packit |
209cc3 |
* but without the interchanged fields.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* In addition, DG/UX tcpdump writes out files with a version
|
|
Packit |
209cc3 |
* number of 543.0, and with the caplen and len fields in the
|
|
Packit |
209cc3 |
* pre-2.3 order.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
switch (hdr.version_major) {
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case 2:
|
|
Packit |
209cc3 |
if (hdr.version_minor < 3)
|
|
Packit |
209cc3 |
ps->lengths_swapped = SWAPPED;
|
|
Packit |
209cc3 |
else if (hdr.version_minor == 3)
|
|
Packit |
209cc3 |
ps->lengths_swapped = MAYBE_SWAPPED;
|
|
Packit |
209cc3 |
else
|
|
Packit |
209cc3 |
ps->lengths_swapped = NOT_SWAPPED;
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case 543:
|
|
Packit |
209cc3 |
ps->lengths_swapped = SWAPPED;
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
default:
|
|
Packit |
209cc3 |
ps->lengths_swapped = NOT_SWAPPED;
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (magic_int == KUZNETZOV_TCPDUMP_MAGIC) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* XXX - the patch that's in some versions of libpcap
|
|
Packit |
209cc3 |
* changes the packet header but not the magic number,
|
|
Packit |
209cc3 |
* and some other versions with this magic number have
|
|
Packit |
209cc3 |
* some extra debugging information in the packet header;
|
|
Packit |
209cc3 |
* we'd have to use some hacks^H^H^H^H^Hheuristics to
|
|
Packit |
209cc3 |
* detect those variants.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* Ethereal does that, but it does so by trying to read
|
|
Packit |
209cc3 |
* the first two packets of the file with each of the
|
|
Packit |
209cc3 |
* record header formats. That currently means it seeks
|
|
Packit |
209cc3 |
* backwards and retries the reads, which doesn't work
|
|
Packit |
209cc3 |
* on pipes. We want to be able to read from a pipe, so
|
|
Packit |
209cc3 |
* that strategy won't work; we'd have to buffer some
|
|
Packit |
209cc3 |
* data ourselves and read from that buffer in order to
|
|
Packit |
209cc3 |
* make that work.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (p->linktype == DLT_EN10MB) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* This capture might have been done in raw mode
|
|
Packit |
209cc3 |
* or cooked mode.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* If it was done in cooked mode, p->snapshot was
|
|
Packit |
209cc3 |
* passed to recvfrom() as the buffer size, meaning
|
|
Packit |
209cc3 |
* that the most packet data that would be copied
|
|
Packit |
209cc3 |
* would be p->snapshot. However, a faked Ethernet
|
|
Packit |
209cc3 |
* header would then have been added to it, so the
|
|
Packit |
209cc3 |
* most data that would be in a packet in the file
|
|
Packit |
209cc3 |
* would be p->snapshot + 14.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* We can't easily tell whether the capture was done
|
|
Packit |
209cc3 |
* in raw mode or cooked mode, so we'll assume it was
|
|
Packit |
209cc3 |
* cooked mode, and add 14 to the snapshot length.
|
|
Packit |
209cc3 |
* That means that, for a raw capture, the snapshot
|
|
Packit |
209cc3 |
* length will be misleading if you use it to figure
|
|
Packit |
209cc3 |
* out why a capture doesn't have all the packet data,
|
|
Packit |
209cc3 |
* but there's not much we can do to avoid that.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* But don't grow the snapshot length past the
|
|
Packit |
209cc3 |
* maximum value of an int.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (p->snapshot <= INT_MAX - 14)
|
|
Packit |
209cc3 |
p->snapshot += 14;
|
|
Packit |
209cc3 |
else
|
|
Packit |
209cc3 |
p->snapshot = INT_MAX;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
} else
|
|
Packit |
209cc3 |
ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Allocate a buffer for the packet data.
|
|
Packit |
209cc3 |
* Choose the minimum of the file's snapshot length and 2K bytes;
|
|
Packit |
209cc3 |
* that should be enough for most network packets - we'll grow it
|
|
Packit |
209cc3 |
* if necessary. That way, we don't allocate a huge chunk of
|
|
Packit |
209cc3 |
* memory just because there's a huge snapshot length, as the
|
|
Packit |
209cc3 |
* snapshot length might be larger than the size of the largest
|
|
Packit |
209cc3 |
* packet.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
p->bufsize = p->snapshot;
|
|
Packit |
209cc3 |
if (p->bufsize > 2048)
|
|
Packit |
209cc3 |
p->bufsize = 2048;
|
|
Packit |
209cc3 |
p->buffer = malloc(p->bufsize);
|
|
Packit |
209cc3 |
if (p->buffer == NULL) {
|
|
Packit |
209cc3 |
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
|
|
Packit |
209cc3 |
free(p);
|
|
Packit |
209cc3 |
*err = 1;
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
p->cleanup_op = sf_cleanup;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
return (p);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Grow the packet buffer to the specified size.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
static int
|
|
Packit |
209cc3 |
grow_buffer(pcap_t *p, u_int bufsize)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
void *bigger_buffer;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
bigger_buffer = realloc(p->buffer, bufsize);
|
|
Packit |
209cc3 |
if (bigger_buffer == NULL) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "out of memory");
|
|
Packit |
209cc3 |
return (0);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
p->buffer = bigger_buffer;
|
|
Packit |
209cc3 |
p->bufsize = bufsize;
|
|
Packit |
209cc3 |
return (1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Read and return the next packet from the savefile. Return the header
|
|
Packit |
209cc3 |
* in hdr and a pointer to the contents in data. Return 0 on success, 1
|
|
Packit |
209cc3 |
* if there were no more packets, and -1 on an error.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
static int
|
|
Packit |
209cc3 |
pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
struct pcap_sf *ps = p->priv;
|
|
Packit |
209cc3 |
struct pcap_sf_patched_pkthdr sf_hdr;
|
|
Packit |
209cc3 |
FILE *fp = p->rfile;
|
|
Packit |
209cc3 |
size_t amt_read;
|
|
Packit |
209cc3 |
bpf_u_int32 t;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Read the packet header; the structure we use as a buffer
|
|
Packit |
209cc3 |
* is the longer structure for files generated by the patched
|
|
Packit |
209cc3 |
* libpcap, but if the file has the magic number for an
|
|
Packit |
209cc3 |
* unpatched libpcap we only read as many bytes as the regular
|
|
Packit |
209cc3 |
* header has.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
|
|
Packit |
209cc3 |
if (amt_read != ps->hdrsize) {
|
|
Packit |
209cc3 |
if (ferror(fp)) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "error reading dump file");
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
if (amt_read != 0) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"truncated dump file; tried to read %" PRIsize " header bytes, only got %" PRIsize,
|
|
Packit |
209cc3 |
ps->hdrsize, amt_read);
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
/* EOF */
|
|
Packit |
209cc3 |
return (1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (p->swapped) {
|
|
Packit |
209cc3 |
/* these were written in opposite byte order */
|
|
Packit |
209cc3 |
hdr->caplen = SWAPLONG(sf_hdr.caplen);
|
|
Packit |
209cc3 |
hdr->len = SWAPLONG(sf_hdr.len);
|
|
Packit |
209cc3 |
hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
|
|
Packit |
209cc3 |
hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
hdr->caplen = sf_hdr.caplen;
|
|
Packit |
209cc3 |
hdr->len = sf_hdr.len;
|
|
Packit |
209cc3 |
hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
|
|
Packit |
209cc3 |
hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
switch (ps->scale_type) {
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case PASS_THROUGH:
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Just pass the time stamp through.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case SCALE_UP:
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* File has microseconds, user wants nanoseconds; convert
|
|
Packit |
209cc3 |
* it.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
hdr->ts.tv_usec = hdr->ts.tv_usec * 1000;
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case SCALE_DOWN:
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* File has nanoseconds, user wants microseconds; convert
|
|
Packit |
209cc3 |
* it.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
hdr->ts.tv_usec = hdr->ts.tv_usec / 1000;
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/* Swap the caplen and len fields, if necessary. */
|
|
Packit |
209cc3 |
switch (ps->lengths_swapped) {
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case NOT_SWAPPED:
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case MAYBE_SWAPPED:
|
|
Packit |
209cc3 |
if (hdr->caplen <= hdr->len) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The captured length is <= the actual length,
|
|
Packit |
209cc3 |
* so presumably they weren't swapped.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
/* FALLTHROUGH */
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case SWAPPED:
|
|
Packit |
209cc3 |
t = hdr->caplen;
|
|
Packit |
209cc3 |
hdr->caplen = hdr->len;
|
|
Packit |
209cc3 |
hdr->len = t;
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Is the packet bigger than we consider sane?
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Yes. This may be a damaged or fuzzed file.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* Is it bigger than the snapshot length?
|
|
Packit |
209cc3 |
* (We don't treat that as an error if it's not
|
|
Packit |
209cc3 |
* bigger than the maximum we consider sane; see
|
|
Packit |
209cc3 |
* below.)
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (hdr->caplen > (bpf_u_int32)p->snapshot) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"invalid packet capture length %u, bigger than "
|
|
Packit |
209cc3 |
"snaplen of %d", hdr->caplen, p->snapshot);
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"invalid packet capture length %u, bigger than "
|
|
Packit |
209cc3 |
"maximum of %u", hdr->caplen,
|
|
Packit |
209cc3 |
max_snaplen_for_dlt(p->linktype));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (hdr->caplen > (bpf_u_int32)p->snapshot) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The packet is bigger than the snapshot length
|
|
Packit |
209cc3 |
* for this file.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* This can happen due to Solaris 2.3 systems tripping
|
|
Packit |
209cc3 |
* over the BUFMOD problem and not setting the snapshot
|
|
Packit |
209cc3 |
* length correctly in the savefile header.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* libpcap 0.4 and later on Solaris 2.3 should set the
|
|
Packit |
209cc3 |
* snapshot length correctly in the pcap file header,
|
|
Packit |
209cc3 |
* even though they don't set a snapshot length in bufmod
|
|
Packit |
209cc3 |
* (the buggy bufmod chops off the *beginning* of the
|
|
Packit |
209cc3 |
* packet if a snapshot length is specified); they should
|
|
Packit |
209cc3 |
* also reduce the captured length, as supplied to the
|
|
Packit |
209cc3 |
* per-packet callback, to the snapshot length if it's
|
|
Packit |
209cc3 |
* greater than the snapshot length, so the code using
|
|
Packit |
209cc3 |
* libpcap should see the packet cut off at the snapshot
|
|
Packit |
209cc3 |
* length, even though the full packet is copied up to
|
|
Packit |
209cc3 |
* userland.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* However, perhaps some versions of libpcap failed to
|
|
Packit |
209cc3 |
* set the snapshot length currectly in the file header
|
|
Packit |
209cc3 |
* or the per-packet header, or perhaps this is a
|
|
Packit |
209cc3 |
* corrupted safefile or a savefile built/modified by a
|
|
Packit |
209cc3 |
* fuzz tester, so we check anyway. We grow the buffer
|
|
Packit |
209cc3 |
* to be big enough for the snapshot length, read up
|
|
Packit |
209cc3 |
* to the snapshot length, discard the rest of the
|
|
Packit |
209cc3 |
* packet, and report the snapshot length as the captured
|
|
Packit |
209cc3 |
* length; we don't want to hand our caller a packet
|
|
Packit |
209cc3 |
* bigger than the snapshot length, because they might
|
|
Packit |
209cc3 |
* be assuming they'll never be handed such a packet,
|
|
Packit |
209cc3 |
* and might copy the packet into a snapshot-length-
|
|
Packit |
209cc3 |
* sized buffer, assuming it'll fit.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
size_t bytes_to_discard;
|
|
Packit |
209cc3 |
size_t bytes_to_read, bytes_read;
|
|
Packit |
209cc3 |
char discard_buf[4096];
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (hdr->caplen > p->bufsize) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Grow the buffer to the snapshot length.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (!grow_buffer(p, p->snapshot))
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Read the first p->snapshot bytes into the buffer.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
amt_read = fread(p->buffer, 1, p->snapshot, fp);
|
|
Packit |
209cc3 |
if (amt_read != (bpf_u_int32)p->snapshot) {
|
|
Packit |
209cc3 |
if (ferror(fp)) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf,
|
|
Packit |
209cc3 |
PCAP_ERRBUF_SIZE, errno,
|
|
Packit |
209cc3 |
"error reading dump file");
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Yes, this uses hdr->caplen; technically,
|
|
Packit |
209cc3 |
* it's true, because we would try to read
|
|
Packit |
209cc3 |
* and discard the rest of those bytes, and
|
|
Packit |
209cc3 |
* that would fail because we got EOF before
|
|
Packit |
209cc3 |
* the read finished.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"truncated dump file; tried to read %u captured bytes, only got %" PRIsize,
|
|
Packit |
209cc3 |
p->snapshot, amt_read);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Now read and discard what's left.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
bytes_to_discard = hdr->caplen - p->snapshot;
|
|
Packit |
209cc3 |
bytes_read = amt_read;
|
|
Packit |
209cc3 |
while (bytes_to_discard != 0) {
|
|
Packit |
209cc3 |
bytes_to_read = bytes_to_discard;
|
|
Packit |
209cc3 |
if (bytes_to_read > sizeof (discard_buf))
|
|
Packit |
209cc3 |
bytes_to_read = sizeof (discard_buf);
|
|
Packit |
209cc3 |
amt_read = fread(discard_buf, 1, bytes_to_read, fp);
|
|
Packit |
209cc3 |
bytes_read += amt_read;
|
|
Packit |
209cc3 |
if (amt_read != bytes_to_read) {
|
|
Packit |
209cc3 |
if (ferror(fp)) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf,
|
|
Packit |
209cc3 |
PCAP_ERRBUF_SIZE, errno,
|
|
Packit |
209cc3 |
"error reading dump file");
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"truncated dump file; tried to read %u captured bytes, only got %" PRIsize,
|
|
Packit |
209cc3 |
hdr->caplen, bytes_read);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
bytes_to_discard -= amt_read;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Adjust caplen accordingly, so we don't get confused later
|
|
Packit |
209cc3 |
* as to how many bytes we have to play with.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
hdr->caplen = p->snapshot;
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* The packet is within the snapshot length for this file.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (hdr->caplen > p->bufsize) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Grow the buffer to the next power of 2, or
|
|
Packit |
209cc3 |
* the snaplen, whichever is lower.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
u_int new_bufsize;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
new_bufsize = hdr->caplen;
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* http://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
new_bufsize--;
|
|
Packit |
209cc3 |
new_bufsize |= new_bufsize >> 1;
|
|
Packit |
209cc3 |
new_bufsize |= new_bufsize >> 2;
|
|
Packit |
209cc3 |
new_bufsize |= new_bufsize >> 4;
|
|
Packit |
209cc3 |
new_bufsize |= new_bufsize >> 8;
|
|
Packit |
209cc3 |
new_bufsize |= new_bufsize >> 16;
|
|
Packit |
209cc3 |
new_bufsize++;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (new_bufsize > (u_int)p->snapshot)
|
|
Packit |
209cc3 |
new_bufsize = p->snapshot;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (!grow_buffer(p, new_bufsize))
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/* read the packet itself */
|
|
Packit |
209cc3 |
amt_read = fread(p->buffer, 1, hdr->caplen, fp);
|
|
Packit |
209cc3 |
if (amt_read != hdr->caplen) {
|
|
Packit |
209cc3 |
if (ferror(fp)) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf,
|
|
Packit |
209cc3 |
PCAP_ERRBUF_SIZE, errno,
|
|
Packit |
209cc3 |
"error reading dump file");
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"truncated dump file; tried to read %u captured bytes, only got %" PRIsize,
|
|
Packit |
209cc3 |
hdr->caplen, amt_read);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
*data = p->buffer;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (p->swapped)
|
|
Packit |
209cc3 |
swap_pseudo_headers(p->linktype, hdr, *data);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
return (0);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
static int
|
|
Packit |
209cc3 |
sf_write_header(pcap_t *p, FILE *fp, int linktype, int thiszone, int snaplen)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
struct pcap_file_header hdr;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
hdr.magic = p->opt.tstamp_precision == PCAP_TSTAMP_PRECISION_NANO ? NSEC_TCPDUMP_MAGIC : TCPDUMP_MAGIC;
|
|
Packit |
209cc3 |
hdr.version_major = PCAP_VERSION_MAJOR;
|
|
Packit |
209cc3 |
hdr.version_minor = PCAP_VERSION_MINOR;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
hdr.thiszone = thiszone;
|
|
Packit |
209cc3 |
hdr.snaplen = snaplen;
|
|
Packit |
209cc3 |
hdr.sigfigs = 0;
|
|
Packit |
209cc3 |
hdr.linktype = linktype;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
return (0);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Output a packet to the initialized dump file.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
void
|
|
Packit |
209cc3 |
pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
register FILE *f;
|
|
Packit |
209cc3 |
struct pcap_sf_pkthdr sf_hdr;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
f = (FILE *)user;
|
|
Packit |
209cc3 |
sf_hdr.ts.tv_sec = h->ts.tv_sec;
|
|
Packit |
209cc3 |
sf_hdr.ts.tv_usec = h->ts.tv_usec;
|
|
Packit |
209cc3 |
sf_hdr.caplen = h->caplen;
|
|
Packit |
209cc3 |
sf_hdr.len = h->len;
|
|
Packit |
209cc3 |
/* XXX we should check the return status */
|
|
Packit |
209cc3 |
(void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
|
|
Packit |
209cc3 |
(void)fwrite(sp, h->caplen, 1, f);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
static pcap_dumper_t *
|
|
Packit |
209cc3 |
pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#if defined(_WIN32) || defined(MSDOS)
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* If we're writing to the standard output, put it in binary
|
|
Packit |
209cc3 |
* mode, as savefiles are binary files.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* Otherwise, we turn off buffering.
|
|
Packit |
209cc3 |
* XXX - why? And why not on the standard output?
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (f == stdout)
|
|
Packit |
209cc3 |
SET_BINMODE(f);
|
|
Packit |
209cc3 |
else
|
|
Packit |
209cc3 |
setvbuf(f, NULL, _IONBF, 0);
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "Can't write to %s", fname);
|
|
Packit |
209cc3 |
if (f != stdout)
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return ((pcap_dumper_t *)f);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Initialize so that sf_write() will output to the file named 'fname'.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
pcap_dumper_t *
|
|
Packit |
209cc3 |
pcap_dump_open(pcap_t *p, const char *fname)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
FILE *f;
|
|
Packit |
209cc3 |
int linktype;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* If this pcap_t hasn't been activated, it doesn't have a
|
|
Packit |
209cc3 |
* link-layer type, so we can't use it.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (!p->activated) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: not-yet-activated pcap_t passed to pcap_dump_open",
|
|
Packit |
209cc3 |
fname);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
linktype = dlt_to_linktype(p->linktype);
|
|
Packit |
209cc3 |
if (linktype == -1) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: link-layer type %d isn't supported in savefiles",
|
|
Packit |
209cc3 |
fname, p->linktype);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
linktype |= p->linktype_ext;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (fname == NULL) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"A null pointer was supplied as the file name");
|
|
Packit |
209cc3 |
return NULL;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
if (fname[0] == '-' && fname[1] == '\0') {
|
|
Packit |
209cc3 |
f = stdout;
|
|
Packit |
209cc3 |
fname = "standard output";
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* "b" is supported as of C90, so *all* UN*Xes should
|
|
Packit |
209cc3 |
* support it, even though it does nothing. It's
|
|
Packit |
209cc3 |
* required on Windows, as the file is a binary file
|
|
Packit |
209cc3 |
* and must be written in binary mode.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
f = fopen(fname, "wb");
|
|
Packit |
209cc3 |
if (f == NULL) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "%s", fname);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return (pcap_setup_dump(p, linktype, f, fname));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#ifdef _WIN32
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Initialize so that sf_write() will output to a stream wrapping the given raw
|
|
Packit |
209cc3 |
* OS file HANDLE.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
pcap_dumper_t *
|
|
Packit |
209cc3 |
pcap_dump_hopen(pcap_t *p, intptr_t osfd)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
int fd;
|
|
Packit |
209cc3 |
FILE *file;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
fd = _open_osfhandle(osfd, _O_APPEND);
|
|
Packit |
209cc3 |
if (fd < 0) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "_open_osfhandle");
|
|
Packit |
209cc3 |
return NULL;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
file = _fdopen(fd, "wb");
|
|
Packit |
209cc3 |
if (file == NULL) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "_fdopen");
|
|
Packit |
209cc3 |
_close(fd);
|
|
Packit |
209cc3 |
return NULL;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
return pcap_dump_fopen(p, file);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
#endif /* _WIN32 */
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Initialize so that sf_write() will output to the given stream.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
#ifdef _WIN32
|
|
Packit |
209cc3 |
static
|
|
Packit |
209cc3 |
#endif /* _WIN32 */
|
|
Packit |
209cc3 |
pcap_dumper_t *
|
|
Packit |
209cc3 |
pcap_dump_fopen(pcap_t *p, FILE *f)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
int linktype;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
linktype = dlt_to_linktype(p->linktype);
|
|
Packit |
209cc3 |
if (linktype == -1) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"stream: link-layer type %d isn't supported in savefiles",
|
|
Packit |
209cc3 |
p->linktype);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
linktype |= p->linktype_ext;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
return (pcap_setup_dump(p, linktype, f, "stream"));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
pcap_dumper_t *
|
|
Packit |
209cc3 |
pcap_dump_open_append(pcap_t *p, const char *fname)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
FILE *f;
|
|
Packit |
209cc3 |
int linktype;
|
|
Packit |
209cc3 |
size_t amt_read;
|
|
Packit |
209cc3 |
struct pcap_file_header ph;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
linktype = dlt_to_linktype(p->linktype);
|
|
Packit |
209cc3 |
if (linktype == -1) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: link-layer type %d isn't supported in savefiles",
|
|
Packit |
209cc3 |
fname, linktype);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (fname == NULL) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"A null pointer was supplied as the file name");
|
|
Packit |
209cc3 |
return NULL;
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
if (fname[0] == '-' && fname[1] == '\0')
|
|
Packit |
209cc3 |
return (pcap_setup_dump(p, linktype, stdout, "standard output"));
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* "a" will cause the file *not* to be truncated if it exists
|
|
Packit |
209cc3 |
* but will cause it to be created if it doesn't. It will
|
|
Packit |
209cc3 |
* also cause all writes to be done at the end of the file,
|
|
Packit |
209cc3 |
* but will allow reads to be done anywhere in the file. This
|
|
Packit |
209cc3 |
* is what we need, because we need to read from the beginning
|
|
Packit |
209cc3 |
* of the file to see if it already has a header and packets
|
|
Packit |
209cc3 |
* or if it doesn't.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* "b" is supported as of C90, so *all* UN*Xes should support it,
|
|
Packit |
209cc3 |
* even though it does nothing. It's required on Windows, as the
|
|
Packit |
209cc3 |
* file is a binary file and must be read in binary mode.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
f = fopen(fname, "ab+");
|
|
Packit |
209cc3 |
if (f == NULL) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "%s", fname);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Try to read a pcap header.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* We do not assume that the file will be positioned at the
|
|
Packit |
209cc3 |
* beginning immediately after we've opened it - we seek to
|
|
Packit |
209cc3 |
* the beginning. ISO C says it's implementation-defined
|
|
Packit |
209cc3 |
* whether the file position indicator is at the beginning
|
|
Packit |
209cc3 |
* or the end of the file after an append-mode open, and
|
|
Packit |
209cc3 |
* it wasn't obvious from the Single UNIX Specification
|
|
Packit |
209cc3 |
* or the Microsoft documentation how that works on SUS-
|
|
Packit |
209cc3 |
* compliant systems or on Windows.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (fseek(f, 0, SEEK_SET) == -1) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "Can't seek to the beginning of %s", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
amt_read = fread(&ph, 1, sizeof (ph), f);
|
|
Packit |
209cc3 |
if (amt_read != sizeof (ph)) {
|
|
Packit |
209cc3 |
if (ferror(f)) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "%s", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
} else if (feof(f) && amt_read > 0) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: truncated pcap file header", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#if defined(_WIN32) || defined(MSDOS)
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* We turn off buffering.
|
|
Packit |
209cc3 |
* XXX - why? And why not on the standard output?
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
setvbuf(f, NULL, _IONBF, 0);
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* If a header is already present and:
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* it's not for a pcap file of the appropriate resolution
|
|
Packit |
209cc3 |
* and the right byte order for this machine;
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* the link-layer header types don't match;
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* the snapshot lengths don't match;
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* return an error.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (amt_read > 0) {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* A header is already present.
|
|
Packit |
209cc3 |
* Do the checks.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
switch (ph.magic) {
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case TCPDUMP_MAGIC:
|
|
Packit |
209cc3 |
if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_MICRO) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: different time stamp precision, cannot append to file", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case NSEC_TCPDUMP_MAGIC:
|
|
Packit |
209cc3 |
if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_NANO) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: different time stamp precision, cannot append to file", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
break;
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case SWAPLONG(TCPDUMP_MAGIC):
|
|
Packit |
209cc3 |
case SWAPLONG(NSEC_TCPDUMP_MAGIC):
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: different byte order, cannot append to file", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
case KUZNETZOV_TCPDUMP_MAGIC:
|
|
Packit |
209cc3 |
case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC):
|
|
Packit |
209cc3 |
case NAVTEL_TCPDUMP_MAGIC:
|
|
Packit |
209cc3 |
case SWAPLONG(NAVTEL_TCPDUMP_MAGIC):
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: not a pcap file to which we can append", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
default:
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: not a pcap file", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Good version?
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (ph.version_major != PCAP_VERSION_MAJOR ||
|
|
Packit |
209cc3 |
ph.version_minor != PCAP_VERSION_MINOR) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: version is %u.%u, cannot append to file", fname,
|
|
Packit |
209cc3 |
ph.version_major, ph.version_minor);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
if ((bpf_u_int32)linktype != ph.linktype) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: different linktype, cannot append to file", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
if ((bpf_u_int32)p->snapshot != ph.snaplen) {
|
|
Packit |
209cc3 |
pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
"%s: different snaplen, cannot append to file", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
} else {
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* A header isn't present; attempt to write it.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "Can't write to %s", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* Start writing at the end of the file.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* XXX - this shouldn't be necessary, given that we're opening
|
|
Packit |
209cc3 |
* the file in append mode, and ISO C specifies that all writes
|
|
Packit |
209cc3 |
* are done at the end of the file in that mode.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
if (fseek(f, 0, SEEK_END) == -1) {
|
|
Packit |
209cc3 |
pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
|
|
Packit |
209cc3 |
errno, "Can't seek to the end of %s", fname);
|
|
Packit |
209cc3 |
(void)fclose(f);
|
|
Packit |
209cc3 |
return (NULL);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
return ((pcap_dumper_t *)f);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
FILE *
|
|
Packit |
209cc3 |
pcap_dump_file(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
return ((FILE *)p);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
long
|
|
Packit |
209cc3 |
pcap_dump_ftell(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
return (ftell((FILE *)p));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#if defined(HAVE_FSEEKO)
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* We have fseeko(), so we have ftello().
|
|
Packit |
209cc3 |
* If we have large file support (files larger than 2^31-1 bytes),
|
|
Packit |
209cc3 |
* ftello() will give us a current file position with more than 32
|
|
Packit |
209cc3 |
* bits.
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
int64_t
|
|
Packit |
209cc3 |
pcap_dump_ftell64(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
return (ftello((FILE *)p));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
#elif defined(_MSC_VER)
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* We have Visual Studio; we support only 2005 and later, so we have
|
|
Packit |
209cc3 |
* _ftelli64().
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
int64_t
|
|
Packit |
209cc3 |
pcap_dump_ftell64(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
return (_ftelli64((FILE *)p));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
#else
|
|
Packit |
209cc3 |
/*
|
|
Packit |
209cc3 |
* We don't have ftello() or _ftelli64(), so fall back on ftell().
|
|
Packit |
209cc3 |
* Either long is 64 bits, in which case ftell() should suffice,
|
|
Packit |
209cc3 |
* or this is probably an older 32-bit UN*X without large file
|
|
Packit |
209cc3 |
* support, which means you'll probably get errors trying to
|
|
Packit |
209cc3 |
* write files > 2^31-1, so it won't matter anyway.
|
|
Packit |
209cc3 |
*
|
|
Packit |
209cc3 |
* XXX - what about MinGW?
|
|
Packit |
209cc3 |
*/
|
|
Packit |
209cc3 |
int64_t
|
|
Packit |
209cc3 |
pcap_dump_ftell64(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
return (ftell((FILE *)p));
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
int
|
|
Packit |
209cc3 |
pcap_dump_flush(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
if (fflush((FILE *)p) == EOF)
|
|
Packit |
209cc3 |
return (-1);
|
|
Packit |
209cc3 |
else
|
|
Packit |
209cc3 |
return (0);
|
|
Packit |
209cc3 |
}
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
void
|
|
Packit |
209cc3 |
pcap_dump_close(pcap_dumper_t *p)
|
|
Packit |
209cc3 |
{
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
#ifdef notyet
|
|
Packit |
209cc3 |
if (ferror((FILE *)p))
|
|
Packit |
209cc3 |
return-an-error;
|
|
Packit |
209cc3 |
/* XXX should check return from fclose() too */
|
|
Packit |
209cc3 |
#endif
|
|
Packit |
209cc3 |
(void)fclose((FILE *)p);
|
|
Packit |
209cc3 |
}
|