1 /*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * sf-pcap.c - libpcap-file-format-specific code from savefile.c
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
24 *
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
29 */
30
31 #ifdef HAVE_CONFIG_H
32 #include <config.h>
33 #endif
34
35 #include <pcap-types.h>
36 #ifdef _WIN32
37 #include <io.h>
38 #include <fcntl.h>
39 #endif /* _WIN32 */
40
41 #include <errno.h>
42 #include <memory.h>
43 #include <stdio.h>
44 #include <stdlib.h>
45 #include <string.h>
46 #include <limits.h> /* for INT_MAX */
47
48 #include "pcap-int.h"
49
50 #include "pcap-common.h"
51
52 #ifdef HAVE_OS_PROTO_H
53 #include "os-proto.h"
54 #endif
55
56 #include "sf-pcap.h"
57
58 /*
59 * Setting O_BINARY on DOS/Windows is a bit tricky
60 */
61 #if defined(_WIN32)
62 #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
63 #elif defined(MSDOS)
64 #if defined(__HIGHC__)
65 #define SET_BINMODE(f) setmode(f, O_BINARY)
66 #else
67 #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
68 #endif
69 #endif
70
71 /*
72 * Standard libpcap format.
73 */
74 #define TCPDUMP_MAGIC 0xa1b2c3d4
75
76 /*
77 * Alexey Kuznetzov's modified libpcap format.
78 */
79 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
80
81 /*
82 * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
83 * for another modified format.
84 */
85 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
86
87 /*
88 * Navtel Communcations' format, with nanosecond timestamps,
89 * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
90 */
91 #define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
92
93 /*
94 * Normal libpcap format, except for seconds/nanoseconds timestamps,
95 * as per a request by Ulf Lamping <ulf.lamping@web.de>
96 */
97 #define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
98
99 /*
100 * Mechanism for storing information about a capture in the upper
101 * 6 bits of a linktype value in a capture file.
102 *
103 * LT_LINKTYPE_EXT(x) extracts the additional information.
104 *
105 * The rest of the bits are for a value describing the link-layer
106 * value. LT_LINKTYPE(x) extracts that value.
107 */
108 #define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
109 #define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
110
111 static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
112
113 #ifdef _WIN32
114 /*
115 * This isn't exported on Windows, because it would only work if both
116 * libpcap and the code using it were using the same C runtime; otherwise they
117 * would be using different definitions of a FILE structure.
118 *
119 * Instead we define this as a macro in pcap/pcap.h that wraps the hopen
120 * version that we do export, passing it a raw OS HANDLE, as defined by the
121 * Win32 / Win64 ABI, obtained from the _fileno() and _get_osfhandle()
122 * functions of the appropriate CRT.
123 */
124 static pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *f);
125 #endif /* _WIN32 */
126
127 /*
128 * Private data for reading pcap savefiles.
129 */
130 typedef enum {
131 NOT_SWAPPED,
132 SWAPPED,
133 MAYBE_SWAPPED
134 } swapped_type_t;
135
136 typedef enum {
137 PASS_THROUGH,
138 SCALE_UP,
139 SCALE_DOWN
140 } tstamp_scale_type_t;
141
142 struct pcap_sf {
143 size_t hdrsize;
144 swapped_type_t lengths_swapped;
145 tstamp_scale_type_t scale_type;
146 };
147
148 /*
149 * Check whether this is a pcap savefile and, if it is, extract the
150 * relevant information from the header.
151 */
152 pcap_t *
pcap_check_header(const uint8_t * magic,FILE * fp,u_int precision,char * errbuf,int * err)153 pcap_check_header(const uint8_t *magic, FILE *fp, u_int precision, char *errbuf,
154 int *err)
155 {
156 bpf_u_int32 magic_int;
157 struct pcap_file_header hdr;
158 size_t amt_read;
159 pcap_t *p;
160 int swapped = 0;
161 struct pcap_sf *ps;
162
163 /*
164 * Assume no read errors.
165 */
166 *err = 0;
167
168 /*
169 * Check whether the first 4 bytes of the file are the magic
170 * number for a pcap savefile, or for a byte-swapped pcap
171 * savefile.
172 */
173 memcpy(&magic_int, magic, sizeof(magic_int));
174 if (magic_int != TCPDUMP_MAGIC &&
175 magic_int != KUZNETZOV_TCPDUMP_MAGIC &&
176 magic_int != NSEC_TCPDUMP_MAGIC) {
177 magic_int = SWAPLONG(magic_int);
178 if (magic_int != TCPDUMP_MAGIC &&
179 magic_int != KUZNETZOV_TCPDUMP_MAGIC &&
180 magic_int != NSEC_TCPDUMP_MAGIC)
181 return (NULL); /* nope */
182 swapped = 1;
183 }
184
185 /*
186 * They are. Put the magic number in the header, and read
187 * the rest of the header.
188 */
189 hdr.magic = magic_int;
190 amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
191 sizeof(hdr) - sizeof(hdr.magic), fp);
192 if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
193 if (ferror(fp)) {
194 pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
195 errno, "error reading dump file");
196 } else {
197 snprintf(errbuf, PCAP_ERRBUF_SIZE,
198 "truncated dump file; tried to read %zu file header bytes, only got %zu",
199 sizeof(hdr), amt_read);
200 }
201 *err = 1;
202 return (NULL);
203 }
204
205 /*
206 * If it's a byte-swapped capture file, byte-swap the header.
207 */
208 if (swapped) {
209 hdr.version_major = SWAPSHORT(hdr.version_major);
210 hdr.version_minor = SWAPSHORT(hdr.version_minor);
211 hdr.thiszone = SWAPLONG(hdr.thiszone);
212 hdr.sigfigs = SWAPLONG(hdr.sigfigs);
213 hdr.snaplen = SWAPLONG(hdr.snaplen);
214 hdr.linktype = SWAPLONG(hdr.linktype);
215 }
216
217 if (hdr.version_major < PCAP_VERSION_MAJOR) {
218 snprintf(errbuf, PCAP_ERRBUF_SIZE,
219 "archaic pcap savefile format");
220 *err = 1;
221 return (NULL);
222 }
223
224 /*
225 * currently only versions 2.[0-4] are supported with
226 * the exception of 543.0 for DG/UX tcpdump.
227 */
228 if (! ((hdr.version_major == PCAP_VERSION_MAJOR &&
229 hdr.version_minor <= PCAP_VERSION_MINOR) ||
230 (hdr.version_major == 543 &&
231 hdr.version_minor == 0))) {
232 snprintf(errbuf, PCAP_ERRBUF_SIZE,
233 "unsupported pcap savefile version %u.%u",
234 hdr.version_major, hdr.version_minor);
235 *err = 1;
236 return NULL;
237 }
238
239 /*
240 * OK, this is a good pcap file.
241 * Allocate a pcap_t for it.
242 */
243 p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_sf);
244 if (p == NULL) {
245 /* Allocation failed. */
246 *err = 1;
247 return (NULL);
248 }
249 p->swapped = swapped;
250 p->version_major = hdr.version_major;
251 p->version_minor = hdr.version_minor;
252 p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
253 p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
254 p->snapshot = pcap_adjust_snapshot(p->linktype, hdr.snaplen);
255
256 p->next_packet_op = pcap_next_packet;
257
258 ps = p->priv;
259
260 p->opt.tstamp_precision = precision;
261
262 /*
263 * Will we need to scale the timestamps to match what the
264 * user wants?
265 */
266 switch (precision) {
267
268 case PCAP_TSTAMP_PRECISION_MICRO:
269 if (magic_int == NSEC_TCPDUMP_MAGIC) {
270 /*
271 * The file has nanoseconds, the user
272 * wants microseconds; scale the
273 * precision down.
274 */
275 ps->scale_type = SCALE_DOWN;
276 } else {
277 /*
278 * The file has microseconds, the
279 * user wants microseconds; nothing to do.
280 */
281 ps->scale_type = PASS_THROUGH;
282 }
283 break;
284
285 case PCAP_TSTAMP_PRECISION_NANO:
286 if (magic_int == NSEC_TCPDUMP_MAGIC) {
287 /*
288 * The file has nanoseconds, the
289 * user wants nanoseconds; nothing to do.
290 */
291 ps->scale_type = PASS_THROUGH;
292 } else {
293 /*
294 * The file has microseconds, the user
295 * wants nanoseconds; scale the
296 * precision up.
297 */
298 ps->scale_type = SCALE_UP;
299 }
300 break;
301
302 default:
303 snprintf(errbuf, PCAP_ERRBUF_SIZE,
304 "unknown time stamp resolution %u", precision);
305 free(p);
306 *err = 1;
307 return (NULL);
308 }
309
310 /*
311 * We interchanged the caplen and len fields at version 2.3,
312 * in order to match the bpf header layout. But unfortunately
313 * some files were written with version 2.3 in their headers
314 * but without the interchanged fields.
315 *
316 * In addition, DG/UX tcpdump writes out files with a version
317 * number of 543.0, and with the caplen and len fields in the
318 * pre-2.3 order.
319 */
320 switch (hdr.version_major) {
321
322 case 2:
323 if (hdr.version_minor < 3)
324 ps->lengths_swapped = SWAPPED;
325 else if (hdr.version_minor == 3)
326 ps->lengths_swapped = MAYBE_SWAPPED;
327 else
328 ps->lengths_swapped = NOT_SWAPPED;
329 break;
330
331 case 543:
332 ps->lengths_swapped = SWAPPED;
333 break;
334
335 default:
336 ps->lengths_swapped = NOT_SWAPPED;
337 break;
338 }
339
340 if (magic_int == KUZNETZOV_TCPDUMP_MAGIC) {
341 /*
342 * XXX - the patch that's in some versions of libpcap
343 * changes the packet header but not the magic number,
344 * and some other versions with this magic number have
345 * some extra debugging information in the packet header;
346 * we'd have to use some hacks^H^H^H^H^Hheuristics to
347 * detect those variants.
348 *
349 * Ethereal does that, but it does so by trying to read
350 * the first two packets of the file with each of the
351 * record header formats. That currently means it seeks
352 * backwards and retries the reads, which doesn't work
353 * on pipes. We want to be able to read from a pipe, so
354 * that strategy won't work; we'd have to buffer some
355 * data ourselves and read from that buffer in order to
356 * make that work.
357 */
358 ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
359
360 if (p->linktype == DLT_EN10MB) {
361 /*
362 * This capture might have been done in raw mode
363 * or cooked mode.
364 *
365 * If it was done in cooked mode, p->snapshot was
366 * passed to recvfrom() as the buffer size, meaning
367 * that the most packet data that would be copied
368 * would be p->snapshot. However, a faked Ethernet
369 * header would then have been added to it, so the
370 * most data that would be in a packet in the file
371 * would be p->snapshot + 14.
372 *
373 * We can't easily tell whether the capture was done
374 * in raw mode or cooked mode, so we'll assume it was
375 * cooked mode, and add 14 to the snapshot length.
376 * That means that, for a raw capture, the snapshot
377 * length will be misleading if you use it to figure
378 * out why a capture doesn't have all the packet data,
379 * but there's not much we can do to avoid that.
380 *
381 * But don't grow the snapshot length past the
382 * maximum value of an int.
383 */
384 if (p->snapshot <= INT_MAX - 14)
385 p->snapshot += 14;
386 else
387 p->snapshot = INT_MAX;
388 }
389 } else
390 ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
391
392 /*
393 * Allocate a buffer for the packet data.
394 * Choose the minimum of the file's snapshot length and 2K bytes;
395 * that should be enough for most network packets - we'll grow it
396 * if necessary. That way, we don't allocate a huge chunk of
397 * memory just because there's a huge snapshot length, as the
398 * snapshot length might be larger than the size of the largest
399 * packet.
400 */
401 p->bufsize = p->snapshot;
402 if (p->bufsize > 2048)
403 p->bufsize = 2048;
404 p->buffer = malloc(p->bufsize);
405 if (p->buffer == NULL) {
406 snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
407 free(p);
408 *err = 1;
409 return (NULL);
410 }
411
412 p->cleanup_op = sf_cleanup;
413
414 return (p);
415 }
416
417 /*
418 * Grow the packet buffer to the specified size.
419 */
420 static int
grow_buffer(pcap_t * p,u_int bufsize)421 grow_buffer(pcap_t *p, u_int bufsize)
422 {
423 void *bigger_buffer;
424
425 bigger_buffer = realloc(p->buffer, bufsize);
426 if (bigger_buffer == NULL) {
427 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "out of memory");
428 return (0);
429 }
430 p->buffer = bigger_buffer;
431 p->bufsize = bufsize;
432 return (1);
433 }
434
435 /*
436 * Read and return the next packet from the savefile. Return the header
437 * in hdr and a pointer to the contents in data. Return 0 on success, 1
438 * if there were no more packets, and -1 on an error.
439 */
440 static int
pcap_next_packet(pcap_t * p,struct pcap_pkthdr * hdr,u_char ** data)441 pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
442 {
443 struct pcap_sf *ps = p->priv;
444 struct pcap_sf_patched_pkthdr sf_hdr;
445 FILE *fp = p->rfile;
446 size_t amt_read;
447 bpf_u_int32 t;
448
449 /*
450 * Read the packet header; the structure we use as a buffer
451 * is the longer structure for files generated by the patched
452 * libpcap, but if the file has the magic number for an
453 * unpatched libpcap we only read as many bytes as the regular
454 * header has.
455 */
456 amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
457 if (amt_read != ps->hdrsize) {
458 if (ferror(fp)) {
459 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
460 errno, "error reading dump file");
461 return (-1);
462 } else {
463 if (amt_read != 0) {
464 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
465 "truncated dump file; tried to read %zu header bytes, only got %zu",
466 ps->hdrsize, amt_read);
467 return (-1);
468 }
469 /* EOF */
470 return (1);
471 }
472 }
473
474 if (p->swapped) {
475 /* these were written in opposite byte order */
476 hdr->caplen = SWAPLONG(sf_hdr.caplen);
477 hdr->len = SWAPLONG(sf_hdr.len);
478 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
479 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
480 } else {
481 hdr->caplen = sf_hdr.caplen;
482 hdr->len = sf_hdr.len;
483 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
484 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
485 }
486
487 switch (ps->scale_type) {
488
489 case PASS_THROUGH:
490 /*
491 * Just pass the time stamp through.
492 */
493 break;
494
495 case SCALE_UP:
496 /*
497 * File has microseconds, user wants nanoseconds; convert
498 * it.
499 */
500 hdr->ts.tv_usec = hdr->ts.tv_usec * 1000;
501 break;
502
503 case SCALE_DOWN:
504 /*
505 * File has nanoseconds, user wants microseconds; convert
506 * it.
507 */
508 hdr->ts.tv_usec = hdr->ts.tv_usec / 1000;
509 break;
510 }
511
512 /* Swap the caplen and len fields, if necessary. */
513 switch (ps->lengths_swapped) {
514
515 case NOT_SWAPPED:
516 break;
517
518 case MAYBE_SWAPPED:
519 if (hdr->caplen <= hdr->len) {
520 /*
521 * The captured length is <= the actual length,
522 * so presumably they weren't swapped.
523 */
524 break;
525 }
526 /* FALLTHROUGH */
527
528 case SWAPPED:
529 t = hdr->caplen;
530 hdr->caplen = hdr->len;
531 hdr->len = t;
532 break;
533 }
534
535 /*
536 * Is the packet bigger than we consider sane?
537 */
538 if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) {
539 /*
540 * Yes. This may be a damaged or fuzzed file.
541 *
542 * Is it bigger than the snapshot length?
543 * (We don't treat that as an error if it's not
544 * bigger than the maximum we consider sane; see
545 * below.)
546 */
547 if (hdr->caplen > (bpf_u_int32)p->snapshot) {
548 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
549 "invalid packet capture length %u, bigger than "
550 "snaplen of %d", hdr->caplen, p->snapshot);
551 } else {
552 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
553 "invalid packet capture length %u, bigger than "
554 "maximum of %u", hdr->caplen,
555 max_snaplen_for_dlt(p->linktype));
556 }
557 return (-1);
558 }
559
560 if (hdr->caplen > (bpf_u_int32)p->snapshot) {
561 /*
562 * The packet is bigger than the snapshot length
563 * for this file.
564 *
565 * This can happen due to Solaris 2.3 systems tripping
566 * over the BUFMOD problem and not setting the snapshot
567 * length correctly in the savefile header.
568 *
569 * libpcap 0.4 and later on Solaris 2.3 should set the
570 * snapshot length correctly in the pcap file header,
571 * even though they don't set a snapshot length in bufmod
572 * (the buggy bufmod chops off the *beginning* of the
573 * packet if a snapshot length is specified); they should
574 * also reduce the captured length, as supplied to the
575 * per-packet callback, to the snapshot length if it's
576 * greater than the snapshot length, so the code using
577 * libpcap should see the packet cut off at the snapshot
578 * length, even though the full packet is copied up to
579 * userland.
580 *
581 * However, perhaps some versions of libpcap failed to
582 * set the snapshot length currectly in the file header
583 * or the per-packet header, or perhaps this is a
584 * corrupted safefile or a savefile built/modified by a
585 * fuzz tester, so we check anyway. We grow the buffer
586 * to be big enough for the snapshot length, read up
587 * to the snapshot length, discard the rest of the
588 * packet, and report the snapshot length as the captured
589 * length; we don't want to hand our caller a packet
590 * bigger than the snapshot length, because they might
591 * be assuming they'll never be handed such a packet,
592 * and might copy the packet into a snapshot-length-
593 * sized buffer, assuming it'll fit.
594 */
595 size_t bytes_to_discard;
596 size_t bytes_to_read, bytes_read;
597 char discard_buf[4096];
598
599 if (hdr->caplen > p->bufsize) {
600 /*
601 * Grow the buffer to the snapshot length.
602 */
603 if (!grow_buffer(p, p->snapshot))
604 return (-1);
605 }
606
607 /*
608 * Read the first p->snapshot bytes into the buffer.
609 */
610 amt_read = fread(p->buffer, 1, p->snapshot, fp);
611 if (amt_read != (bpf_u_int32)p->snapshot) {
612 if (ferror(fp)) {
613 pcap_fmt_errmsg_for_errno(p->errbuf,
614 PCAP_ERRBUF_SIZE, errno,
615 "error reading dump file");
616 } else {
617 /*
618 * Yes, this uses hdr->caplen; technically,
619 * it's true, because we would try to read
620 * and discard the rest of those bytes, and
621 * that would fail because we got EOF before
622 * the read finished.
623 */
624 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
625 "truncated dump file; tried to read %u captured bytes, only got %zu",
626 p->snapshot, amt_read);
627 }
628 return (-1);
629 }
630
631 /*
632 * Now read and discard what's left.
633 */
634 bytes_to_discard = hdr->caplen - p->snapshot;
635 bytes_read = amt_read;
636 while (bytes_to_discard != 0) {
637 bytes_to_read = bytes_to_discard;
638 if (bytes_to_read > sizeof (discard_buf))
639 bytes_to_read = sizeof (discard_buf);
640 amt_read = fread(discard_buf, 1, bytes_to_read, fp);
641 bytes_read += amt_read;
642 if (amt_read != bytes_to_read) {
643 if (ferror(fp)) {
644 pcap_fmt_errmsg_for_errno(p->errbuf,
645 PCAP_ERRBUF_SIZE, errno,
646 "error reading dump file");
647 } else {
648 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
649 "truncated dump file; tried to read %u captured bytes, only got %zu",
650 hdr->caplen, bytes_read);
651 }
652 return (-1);
653 }
654 bytes_to_discard -= amt_read;
655 }
656
657 /*
658 * Adjust caplen accordingly, so we don't get confused later
659 * as to how many bytes we have to play with.
660 */
661 hdr->caplen = p->snapshot;
662 } else {
663 /*
664 * The packet is within the snapshot length for this file.
665 */
666 if (hdr->caplen > p->bufsize) {
667 /*
668 * Grow the buffer to the next power of 2, or
669 * the snaplen, whichever is lower.
670 */
671 u_int new_bufsize;
672
673 new_bufsize = hdr->caplen;
674 /*
675 * https://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
676 */
677 new_bufsize--;
678 new_bufsize |= new_bufsize >> 1;
679 new_bufsize |= new_bufsize >> 2;
680 new_bufsize |= new_bufsize >> 4;
681 new_bufsize |= new_bufsize >> 8;
682 new_bufsize |= new_bufsize >> 16;
683 new_bufsize++;
684
685 if (new_bufsize > (u_int)p->snapshot)
686 new_bufsize = p->snapshot;
687
688 if (!grow_buffer(p, new_bufsize))
689 return (-1);
690 }
691
692 /* read the packet itself */
693 amt_read = fread(p->buffer, 1, hdr->caplen, fp);
694 if (amt_read != hdr->caplen) {
695 if (ferror(fp)) {
696 pcap_fmt_errmsg_for_errno(p->errbuf,
697 PCAP_ERRBUF_SIZE, errno,
698 "error reading dump file");
699 } else {
700 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
701 "truncated dump file; tried to read %u captured bytes, only got %zu",
702 hdr->caplen, amt_read);
703 }
704 return (-1);
705 }
706 }
707 *data = p->buffer;
708
709 if (p->swapped)
710 swap_pseudo_headers(p->linktype, hdr, *data);
711
712 return (0);
713 }
714
715 static int
sf_write_header(pcap_t * p,FILE * fp,int linktype,int snaplen)716 sf_write_header(pcap_t *p, FILE *fp, int linktype, int snaplen)
717 {
718 struct pcap_file_header hdr;
719
720 hdr.magic = p->opt.tstamp_precision == PCAP_TSTAMP_PRECISION_NANO ? NSEC_TCPDUMP_MAGIC : TCPDUMP_MAGIC;
721 hdr.version_major = PCAP_VERSION_MAJOR;
722 hdr.version_minor = PCAP_VERSION_MINOR;
723
724 /*
725 * https://www.tcpdump.org/manpages/pcap-savefile.5.txt states:
726 * thiszone: 4-byte time zone offset; this is always 0.
727 * sigfigs: 4-byte number giving the accuracy of time stamps
728 * in the file; this is always 0.
729 */
730 hdr.thiszone = 0;
731 hdr.sigfigs = 0;
732 hdr.snaplen = snaplen;
733 hdr.linktype = linktype;
734
735 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
736 return (-1);
737
738 return (0);
739 }
740
741 /*
742 * Output a packet to the initialized dump file.
743 */
744 void
pcap_dump(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)745 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
746 {
747 register FILE *f;
748 struct pcap_sf_pkthdr sf_hdr;
749
750 f = (FILE *)user;
751 /*
752 * Better not try writing pcap files after
753 * 2038-01-19 03:14:07 UTC; switch to pcapng.
754 */
755 sf_hdr.ts.tv_sec = (bpf_int32)h->ts.tv_sec;
756 sf_hdr.ts.tv_usec = (bpf_int32)h->ts.tv_usec;
757 sf_hdr.caplen = h->caplen;
758 sf_hdr.len = h->len;
759 /* XXX we should check the return status */
760 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
761 (void)fwrite(sp, h->caplen, 1, f);
762 }
763
764 static pcap_dumper_t *
pcap_setup_dump(pcap_t * p,int linktype,FILE * f,const char * fname)765 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
766 {
767
768 #if defined(_WIN32) || defined(MSDOS)
769 /*
770 * If we're writing to the standard output, put it in binary
771 * mode, as savefiles are binary files.
772 *
773 * Otherwise, we turn off buffering.
774 * XXX - why? And why not on the standard output?
775 */
776 if (f == stdout)
777 SET_BINMODE(f);
778 else
779 setvbuf(f, NULL, _IONBF, 0);
780 #endif
781 if (sf_write_header(p, f, linktype, p->snapshot) == -1) {
782 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
783 errno, "Can't write to %s", fname);
784 if (f != stdout)
785 (void)fclose(f);
786 return (NULL);
787 }
788 return ((pcap_dumper_t *)f);
789 }
790
791 /*
792 * Initialize so that sf_write() will output to the file named 'fname'.
793 */
794 pcap_dumper_t *
pcap_dump_open(pcap_t * p,const char * fname)795 pcap_dump_open(pcap_t *p, const char *fname)
796 {
797 FILE *f;
798 int linktype;
799
800 /*
801 * If this pcap_t hasn't been activated, it doesn't have a
802 * link-layer type, so we can't use it.
803 */
804 if (!p->activated) {
805 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
806 "%s: not-yet-activated pcap_t passed to pcap_dump_open",
807 fname);
808 return (NULL);
809 }
810 linktype = dlt_to_linktype(p->linktype);
811 if (linktype == -1) {
812 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
813 "%s: link-layer type %d isn't supported in savefiles",
814 fname, p->linktype);
815 return (NULL);
816 }
817 linktype |= p->linktype_ext;
818
819 if (fname == NULL) {
820 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
821 "A null pointer was supplied as the file name");
822 return NULL;
823 }
824 if (fname[0] == '-' && fname[1] == '\0') {
825 f = stdout;
826 fname = "standard output";
827 } else {
828 /*
829 * "b" is supported as of C90, so *all* UN*Xes should
830 * support it, even though it does nothing. It's
831 * required on Windows, as the file is a binary file
832 * and must be written in binary mode.
833 */
834 f = charset_fopen(fname, "wb");
835 if (f == NULL) {
836 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
837 errno, "%s", fname);
838 return (NULL);
839 }
840 }
841 return (pcap_setup_dump(p, linktype, f, fname));
842 }
843
844 #ifdef _WIN32
845 /*
846 * Initialize so that sf_write() will output to a stream wrapping the given raw
847 * OS file HANDLE.
848 */
849 pcap_dumper_t *
pcap_dump_hopen(pcap_t * p,intptr_t osfd)850 pcap_dump_hopen(pcap_t *p, intptr_t osfd)
851 {
852 int fd;
853 FILE *file;
854
855 fd = _open_osfhandle(osfd, _O_APPEND);
856 if (fd < 0) {
857 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
858 errno, "_open_osfhandle");
859 return NULL;
860 }
861
862 file = _fdopen(fd, "wb");
863 if (file == NULL) {
864 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
865 errno, "_fdopen");
866 _close(fd);
867 return NULL;
868 }
869
870 return pcap_dump_fopen(p, file);
871 }
872 #endif /* _WIN32 */
873
874 /*
875 * Initialize so that sf_write() will output to the given stream.
876 */
877 #ifdef _WIN32
878 static
879 #endif /* _WIN32 */
880 pcap_dumper_t *
pcap_dump_fopen(pcap_t * p,FILE * f)881 pcap_dump_fopen(pcap_t *p, FILE *f)
882 {
883 int linktype;
884
885 linktype = dlt_to_linktype(p->linktype);
886 if (linktype == -1) {
887 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
888 "stream: link-layer type %d isn't supported in savefiles",
889 p->linktype);
890 return (NULL);
891 }
892 linktype |= p->linktype_ext;
893
894 return (pcap_setup_dump(p, linktype, f, "stream"));
895 }
896
897 pcap_dumper_t *
pcap_dump_open_append(pcap_t * p,const char * fname)898 pcap_dump_open_append(pcap_t *p, const char *fname)
899 {
900 FILE *f;
901 int linktype;
902 size_t amt_read;
903 struct pcap_file_header ph;
904
905 linktype = dlt_to_linktype(p->linktype);
906 if (linktype == -1) {
907 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
908 "%s: link-layer type %d isn't supported in savefiles",
909 fname, linktype);
910 return (NULL);
911 }
912
913 if (fname == NULL) {
914 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
915 "A null pointer was supplied as the file name");
916 return NULL;
917 }
918 if (fname[0] == '-' && fname[1] == '\0')
919 return (pcap_setup_dump(p, linktype, stdout, "standard output"));
920
921 /*
922 * "a" will cause the file *not* to be truncated if it exists
923 * but will cause it to be created if it doesn't. It will
924 * also cause all writes to be done at the end of the file,
925 * but will allow reads to be done anywhere in the file. This
926 * is what we need, because we need to read from the beginning
927 * of the file to see if it already has a header and packets
928 * or if it doesn't.
929 *
930 * "b" is supported as of C90, so *all* UN*Xes should support it,
931 * even though it does nothing. It's required on Windows, as the
932 * file is a binary file and must be read in binary mode.
933 */
934 f = charset_fopen(fname, "ab+");
935 if (f == NULL) {
936 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
937 errno, "%s", fname);
938 return (NULL);
939 }
940
941 /*
942 * Try to read a pcap header.
943 *
944 * We do not assume that the file will be positioned at the
945 * beginning immediately after we've opened it - we seek to
946 * the beginning. ISO C says it's implementation-defined
947 * whether the file position indicator is at the beginning
948 * or the end of the file after an append-mode open, and
949 * it wasn't obvious from the Single UNIX Specification
950 * or the Microsoft documentation how that works on SUS-
951 * compliant systems or on Windows.
952 */
953 if (fseek(f, 0, SEEK_SET) == -1) {
954 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
955 errno, "Can't seek to the beginning of %s", fname);
956 (void)fclose(f);
957 return (NULL);
958 }
959 amt_read = fread(&ph, 1, sizeof (ph), f);
960 if (amt_read != sizeof (ph)) {
961 if (ferror(f)) {
962 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
963 errno, "%s", fname);
964 (void)fclose(f);
965 return (NULL);
966 } else if (feof(f) && amt_read > 0) {
967 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
968 "%s: truncated pcap file header", fname);
969 (void)fclose(f);
970 return (NULL);
971 }
972 }
973
974 #if defined(_WIN32) || defined(MSDOS)
975 /*
976 * We turn off buffering.
977 * XXX - why? And why not on the standard output?
978 */
979 setvbuf(f, NULL, _IONBF, 0);
980 #endif
981
982 /*
983 * If a header is already present and:
984 *
985 * it's not for a pcap file of the appropriate resolution
986 * and the right byte order for this machine;
987 *
988 * the link-layer header types don't match;
989 *
990 * the snapshot lengths don't match;
991 *
992 * return an error.
993 */
994 if (amt_read > 0) {
995 /*
996 * A header is already present.
997 * Do the checks.
998 */
999 switch (ph.magic) {
1000
1001 case TCPDUMP_MAGIC:
1002 if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_MICRO) {
1003 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1004 "%s: different time stamp precision, cannot append to file", fname);
1005 (void)fclose(f);
1006 return (NULL);
1007 }
1008 break;
1009
1010 case NSEC_TCPDUMP_MAGIC:
1011 if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_NANO) {
1012 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1013 "%s: different time stamp precision, cannot append to file", fname);
1014 (void)fclose(f);
1015 return (NULL);
1016 }
1017 break;
1018
1019 case SWAPLONG(TCPDUMP_MAGIC):
1020 case SWAPLONG(NSEC_TCPDUMP_MAGIC):
1021 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1022 "%s: different byte order, cannot append to file", fname);
1023 (void)fclose(f);
1024 return (NULL);
1025
1026 case KUZNETZOV_TCPDUMP_MAGIC:
1027 case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC):
1028 case NAVTEL_TCPDUMP_MAGIC:
1029 case SWAPLONG(NAVTEL_TCPDUMP_MAGIC):
1030 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1031 "%s: not a pcap file to which we can append", fname);
1032 (void)fclose(f);
1033 return (NULL);
1034
1035 default:
1036 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1037 "%s: not a pcap file", fname);
1038 (void)fclose(f);
1039 return (NULL);
1040 }
1041
1042 /*
1043 * Good version?
1044 */
1045 if (ph.version_major != PCAP_VERSION_MAJOR ||
1046 ph.version_minor != PCAP_VERSION_MINOR) {
1047 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1048 "%s: version is %u.%u, cannot append to file", fname,
1049 ph.version_major, ph.version_minor);
1050 (void)fclose(f);
1051 return (NULL);
1052 }
1053 if ((bpf_u_int32)linktype != ph.linktype) {
1054 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1055 "%s: different linktype, cannot append to file", fname);
1056 (void)fclose(f);
1057 return (NULL);
1058 }
1059 if ((bpf_u_int32)p->snapshot != ph.snaplen) {
1060 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1061 "%s: different snaplen, cannot append to file", fname);
1062 (void)fclose(f);
1063 return (NULL);
1064 }
1065 } else {
1066 /*
1067 * A header isn't present; attempt to write it.
1068 */
1069 if (sf_write_header(p, f, linktype, p->snapshot) == -1) {
1070 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
1071 errno, "Can't write to %s", fname);
1072 (void)fclose(f);
1073 return (NULL);
1074 }
1075 }
1076
1077 /*
1078 * Start writing at the end of the file.
1079 *
1080 * XXX - this shouldn't be necessary, given that we're opening
1081 * the file in append mode, and ISO C specifies that all writes
1082 * are done at the end of the file in that mode.
1083 */
1084 if (fseek(f, 0, SEEK_END) == -1) {
1085 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
1086 errno, "Can't seek to the end of %s", fname);
1087 (void)fclose(f);
1088 return (NULL);
1089 }
1090 return ((pcap_dumper_t *)f);
1091 }
1092
1093 FILE *
pcap_dump_file(pcap_dumper_t * p)1094 pcap_dump_file(pcap_dumper_t *p)
1095 {
1096 return ((FILE *)p);
1097 }
1098
1099 long
pcap_dump_ftell(pcap_dumper_t * p)1100 pcap_dump_ftell(pcap_dumper_t *p)
1101 {
1102 return (ftell((FILE *)p));
1103 }
1104
1105 #if defined(HAVE_FSEEKO)
1106 /*
1107 * We have fseeko(), so we have ftello().
1108 * If we have large file support (files larger than 2^31-1 bytes),
1109 * ftello() will give us a current file position with more than 32
1110 * bits.
1111 */
1112 int64_t
pcap_dump_ftell64(pcap_dumper_t * p)1113 pcap_dump_ftell64(pcap_dumper_t *p)
1114 {
1115 return (ftello((FILE *)p));
1116 }
1117 #elif defined(_MSC_VER)
1118 /*
1119 * We have Visual Studio; we support only 2005 and later, so we have
1120 * _ftelli64().
1121 */
1122 int64_t
pcap_dump_ftell64(pcap_dumper_t * p)1123 pcap_dump_ftell64(pcap_dumper_t *p)
1124 {
1125 return (_ftelli64((FILE *)p));
1126 }
1127 #else
1128 /*
1129 * We don't have ftello() or _ftelli64(), so fall back on ftell().
1130 * Either long is 64 bits, in which case ftell() should suffice,
1131 * or this is probably an older 32-bit UN*X without large file
1132 * support, which means you'll probably get errors trying to
1133 * write files > 2^31-1, so it won't matter anyway.
1134 *
1135 * XXX - what about MinGW?
1136 */
1137 int64_t
pcap_dump_ftell64(pcap_dumper_t * p)1138 pcap_dump_ftell64(pcap_dumper_t *p)
1139 {
1140 return (ftell((FILE *)p));
1141 }
1142 #endif
1143
1144 int
pcap_dump_flush(pcap_dumper_t * p)1145 pcap_dump_flush(pcap_dumper_t *p)
1146 {
1147
1148 if (fflush((FILE *)p) == EOF)
1149 return (-1);
1150 else
1151 return (0);
1152 }
1153
1154 void
pcap_dump_close(pcap_dumper_t * p)1155 pcap_dump_close(pcap_dumper_t *p)
1156 {
1157
1158 #ifdef notyet
1159 if (ferror((FILE *)p))
1160 return-an-error;
1161 /* XXX should check return from fclose() too */
1162 #endif
1163 (void)fclose((FILE *)p);
1164 }
1165