1a85e14b0SPeter Avalos /*
2a85e14b0SPeter Avalos * Copyright (c) 1993, 1994, 1995, 1996, 1997
3a85e14b0SPeter Avalos * The Regents of the University of California. All rights reserved.
4a85e14b0SPeter Avalos *
5a85e14b0SPeter Avalos * Redistribution and use in source and binary forms, with or without
6a85e14b0SPeter Avalos * modification, are permitted provided that: (1) source code distributions
7a85e14b0SPeter Avalos * retain the above copyright notice and this paragraph in its entirety, (2)
8a85e14b0SPeter Avalos * distributions including binary code include the above copyright notice and
9a85e14b0SPeter Avalos * this paragraph in its entirety in the documentation or other materials
10a85e14b0SPeter Avalos * provided with the distribution, and (3) all advertising materials mentioning
11a85e14b0SPeter Avalos * features or use of this software display the following acknowledgement:
12a85e14b0SPeter Avalos * ``This product includes software developed by the University of California,
13a85e14b0SPeter Avalos * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14a85e14b0SPeter Avalos * the University nor the names of its contributors may be used to endorse
15a85e14b0SPeter Avalos * or promote products derived from this software without specific prior
16a85e14b0SPeter Avalos * written permission.
17a85e14b0SPeter Avalos * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18a85e14b0SPeter Avalos * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19a85e14b0SPeter Avalos * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20a85e14b0SPeter Avalos *
21a85e14b0SPeter Avalos * sf-pcap.c - libpcap-file-format-specific code from savefile.c
22a85e14b0SPeter Avalos * Extraction/creation by Jeffrey Mogul, DECWRL
23a85e14b0SPeter Avalos * Modified by Steve McCanne, LBL.
24a85e14b0SPeter Avalos *
25a85e14b0SPeter Avalos * Used to save the received packet headers, after filtering, to
26a85e14b0SPeter Avalos * a file, and then read them later.
27a85e14b0SPeter Avalos * The first record in the file contains saved values for the machine
28a85e14b0SPeter Avalos * dependent values so we can print the dump file on any architecture.
29a85e14b0SPeter Avalos */
30a85e14b0SPeter Avalos
31a85e14b0SPeter Avalos #ifdef HAVE_CONFIG_H
323a289941SAaron LI #include <config.h>
33a85e14b0SPeter Avalos #endif
34a85e14b0SPeter Avalos
353a289941SAaron LI #include <pcap-types.h>
3697a9217aSAntonio Huete Jimenez #ifdef _WIN32
373a289941SAaron LI #include <io.h>
383a289941SAaron LI #include <fcntl.h>
3997a9217aSAntonio Huete Jimenez #endif /* _WIN32 */
40a85e14b0SPeter Avalos
41a85e14b0SPeter Avalos #include <errno.h>
42a85e14b0SPeter Avalos #include <memory.h>
43a85e14b0SPeter Avalos #include <stdio.h>
44a85e14b0SPeter Avalos #include <stdlib.h>
45a85e14b0SPeter Avalos #include <string.h>
463a289941SAaron LI #include <limits.h> /* for INT_MAX */
47a85e14b0SPeter Avalos
48a85e14b0SPeter Avalos #include "pcap-int.h"
49a85e14b0SPeter Avalos
50a85e14b0SPeter Avalos #include "pcap-common.h"
51a85e14b0SPeter Avalos
52a85e14b0SPeter Avalos #ifdef HAVE_OS_PROTO_H
53a85e14b0SPeter Avalos #include "os-proto.h"
54a85e14b0SPeter Avalos #endif
55a85e14b0SPeter Avalos
56a85e14b0SPeter Avalos #include "sf-pcap.h"
57a85e14b0SPeter Avalos
58a85e14b0SPeter Avalos /*
59a85e14b0SPeter Avalos * Setting O_BINARY on DOS/Windows is a bit tricky
60a85e14b0SPeter Avalos */
6197a9217aSAntonio Huete Jimenez #if defined(_WIN32)
62a85e14b0SPeter Avalos #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
63a85e14b0SPeter Avalos #elif defined(MSDOS)
64a85e14b0SPeter Avalos #if defined(__HIGHC__)
65a85e14b0SPeter Avalos #define SET_BINMODE(f) setmode(f, O_BINARY)
66a85e14b0SPeter Avalos #else
67a85e14b0SPeter Avalos #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
68a85e14b0SPeter Avalos #endif
69a85e14b0SPeter Avalos #endif
70a85e14b0SPeter Avalos
71a85e14b0SPeter Avalos /*
72a85e14b0SPeter Avalos * Standard libpcap format.
73a85e14b0SPeter Avalos */
74a85e14b0SPeter Avalos #define TCPDUMP_MAGIC 0xa1b2c3d4
75a85e14b0SPeter Avalos
76a85e14b0SPeter Avalos /*
77a85e14b0SPeter Avalos * Alexey Kuznetzov's modified libpcap format.
78a85e14b0SPeter Avalos */
79a85e14b0SPeter Avalos #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
80a85e14b0SPeter Avalos
81a85e14b0SPeter Avalos /*
82a85e14b0SPeter Avalos * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
83a85e14b0SPeter Avalos * for another modified format.
84a85e14b0SPeter Avalos */
85a85e14b0SPeter Avalos #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
86a85e14b0SPeter Avalos
87a85e14b0SPeter Avalos /*
88a85e14b0SPeter Avalos * Navtel Communcations' format, with nanosecond timestamps,
89a85e14b0SPeter Avalos * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
90a85e14b0SPeter Avalos */
91a85e14b0SPeter Avalos #define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
92a85e14b0SPeter Avalos
93a85e14b0SPeter Avalos /*
94a85e14b0SPeter Avalos * Normal libpcap format, except for seconds/nanoseconds timestamps,
95a85e14b0SPeter Avalos * as per a request by Ulf Lamping <ulf.lamping@web.de>
96a85e14b0SPeter Avalos */
97a85e14b0SPeter Avalos #define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
98a85e14b0SPeter Avalos
99a85e14b0SPeter Avalos /*
100a85e14b0SPeter Avalos * Mechanism for storing information about a capture in the upper
101a85e14b0SPeter Avalos * 6 bits of a linktype value in a capture file.
102a85e14b0SPeter Avalos *
103a85e14b0SPeter Avalos * LT_LINKTYPE_EXT(x) extracts the additional information.
104a85e14b0SPeter Avalos *
105a85e14b0SPeter Avalos * The rest of the bits are for a value describing the link-layer
106a85e14b0SPeter Avalos * value. LT_LINKTYPE(x) extracts that value.
107a85e14b0SPeter Avalos */
108a85e14b0SPeter Avalos #define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
109a85e14b0SPeter Avalos #define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
110a85e14b0SPeter Avalos
111a85e14b0SPeter Avalos static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
112a85e14b0SPeter Avalos
1133a289941SAaron LI #ifdef _WIN32
1143a289941SAaron LI /*
1153a289941SAaron LI * This isn't exported on Windows, because it would only work if both
1163a289941SAaron LI * libpcap and the code using it were using the same C runtime; otherwise they
1173a289941SAaron LI * would be using different definitions of a FILE structure.
1183a289941SAaron LI *
1193a289941SAaron LI * Instead we define this as a macro in pcap/pcap.h that wraps the hopen
1203a289941SAaron LI * version that we do export, passing it a raw OS HANDLE, as defined by the
1213a289941SAaron LI * Win32 / Win64 ABI, obtained from the _fileno() and _get_osfhandle()
1223a289941SAaron LI * functions of the appropriate CRT.
1233a289941SAaron LI */
1243a289941SAaron LI static pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *f);
1253a289941SAaron LI #endif /* _WIN32 */
1263a289941SAaron LI
127a85e14b0SPeter Avalos /*
12897a9217aSAntonio Huete Jimenez * Private data for reading pcap savefiles.
12997a9217aSAntonio Huete Jimenez */
13097a9217aSAntonio Huete Jimenez typedef enum {
13197a9217aSAntonio Huete Jimenez NOT_SWAPPED,
13297a9217aSAntonio Huete Jimenez SWAPPED,
13397a9217aSAntonio Huete Jimenez MAYBE_SWAPPED
13497a9217aSAntonio Huete Jimenez } swapped_type_t;
13597a9217aSAntonio Huete Jimenez
13697a9217aSAntonio Huete Jimenez typedef enum {
13797a9217aSAntonio Huete Jimenez PASS_THROUGH,
13897a9217aSAntonio Huete Jimenez SCALE_UP,
13997a9217aSAntonio Huete Jimenez SCALE_DOWN
14097a9217aSAntonio Huete Jimenez } tstamp_scale_type_t;
14197a9217aSAntonio Huete Jimenez
14297a9217aSAntonio Huete Jimenez struct pcap_sf {
14397a9217aSAntonio Huete Jimenez size_t hdrsize;
14497a9217aSAntonio Huete Jimenez swapped_type_t lengths_swapped;
14597a9217aSAntonio Huete Jimenez tstamp_scale_type_t scale_type;
14697a9217aSAntonio Huete Jimenez };
14797a9217aSAntonio Huete Jimenez
14897a9217aSAntonio Huete Jimenez /*
149a85e14b0SPeter Avalos * Check whether this is a pcap savefile and, if it is, extract the
150a85e14b0SPeter Avalos * relevant information from the header.
151a85e14b0SPeter Avalos */
15297a9217aSAntonio Huete Jimenez pcap_t *
pcap_check_header(const uint8_t * magic,FILE * fp,u_int precision,char * errbuf,int * err)1533a289941SAaron LI pcap_check_header(const uint8_t *magic, FILE *fp, u_int precision, char *errbuf,
15497a9217aSAntonio Huete Jimenez int *err)
155a85e14b0SPeter Avalos {
1563a289941SAaron LI bpf_u_int32 magic_int;
157a85e14b0SPeter Avalos struct pcap_file_header hdr;
158a85e14b0SPeter Avalos size_t amt_read;
15997a9217aSAntonio Huete Jimenez pcap_t *p;
16097a9217aSAntonio Huete Jimenez int swapped = 0;
16197a9217aSAntonio Huete Jimenez struct pcap_sf *ps;
16297a9217aSAntonio Huete Jimenez
16397a9217aSAntonio Huete Jimenez /*
16497a9217aSAntonio Huete Jimenez * Assume no read errors.
16597a9217aSAntonio Huete Jimenez */
16697a9217aSAntonio Huete Jimenez *err = 0;
167a85e14b0SPeter Avalos
168a85e14b0SPeter Avalos /*
169a85e14b0SPeter Avalos * Check whether the first 4 bytes of the file are the magic
170a85e14b0SPeter Avalos * number for a pcap savefile, or for a byte-swapped pcap
171a85e14b0SPeter Avalos * savefile.
172a85e14b0SPeter Avalos */
1733a289941SAaron LI memcpy(&magic_int, magic, sizeof(magic_int));
1743a289941SAaron LI if (magic_int != TCPDUMP_MAGIC &&
1753a289941SAaron LI magic_int != KUZNETZOV_TCPDUMP_MAGIC &&
1763a289941SAaron LI magic_int != NSEC_TCPDUMP_MAGIC) {
1773a289941SAaron LI magic_int = SWAPLONG(magic_int);
1783a289941SAaron LI if (magic_int != TCPDUMP_MAGIC &&
1793a289941SAaron LI magic_int != KUZNETZOV_TCPDUMP_MAGIC &&
1803a289941SAaron LI magic_int != NSEC_TCPDUMP_MAGIC)
18197a9217aSAntonio Huete Jimenez return (NULL); /* nope */
18297a9217aSAntonio Huete Jimenez swapped = 1;
183a85e14b0SPeter Avalos }
184a85e14b0SPeter Avalos
185a85e14b0SPeter Avalos /*
186a85e14b0SPeter Avalos * They are. Put the magic number in the header, and read
187a85e14b0SPeter Avalos * the rest of the header.
188a85e14b0SPeter Avalos */
1893a289941SAaron LI hdr.magic = magic_int;
190a85e14b0SPeter Avalos amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
191a85e14b0SPeter Avalos sizeof(hdr) - sizeof(hdr.magic), fp);
192a85e14b0SPeter Avalos if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
193a85e14b0SPeter Avalos if (ferror(fp)) {
1943a289941SAaron LI pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
1953a289941SAaron LI errno, "error reading dump file");
196a85e14b0SPeter Avalos } else {
197*ea16f64eSAntonio Huete Jimenez snprintf(errbuf, PCAP_ERRBUF_SIZE,
198*ea16f64eSAntonio Huete Jimenez "truncated dump file; tried to read %zu file header bytes, only got %zu",
1993a289941SAaron LI sizeof(hdr), amt_read);
200a85e14b0SPeter Avalos }
20197a9217aSAntonio Huete Jimenez *err = 1;
20297a9217aSAntonio Huete Jimenez return (NULL);
203a85e14b0SPeter Avalos }
204a85e14b0SPeter Avalos
205a85e14b0SPeter Avalos /*
206a85e14b0SPeter Avalos * If it's a byte-swapped capture file, byte-swap the header.
207a85e14b0SPeter Avalos */
20897a9217aSAntonio Huete Jimenez if (swapped) {
209a85e14b0SPeter Avalos hdr.version_major = SWAPSHORT(hdr.version_major);
210a85e14b0SPeter Avalos hdr.version_minor = SWAPSHORT(hdr.version_minor);
211a85e14b0SPeter Avalos hdr.thiszone = SWAPLONG(hdr.thiszone);
212a85e14b0SPeter Avalos hdr.sigfigs = SWAPLONG(hdr.sigfigs);
213a85e14b0SPeter Avalos hdr.snaplen = SWAPLONG(hdr.snaplen);
214a85e14b0SPeter Avalos hdr.linktype = SWAPLONG(hdr.linktype);
215a85e14b0SPeter Avalos }
216a85e14b0SPeter Avalos
217a85e14b0SPeter Avalos if (hdr.version_major < PCAP_VERSION_MAJOR) {
218*ea16f64eSAntonio Huete Jimenez snprintf(errbuf, PCAP_ERRBUF_SIZE,
219a85e14b0SPeter Avalos "archaic pcap savefile format");
22097a9217aSAntonio Huete Jimenez *err = 1;
22197a9217aSAntonio Huete Jimenez return (NULL);
222a85e14b0SPeter Avalos }
22397a9217aSAntonio Huete Jimenez
22497a9217aSAntonio Huete Jimenez /*
22597a9217aSAntonio Huete Jimenez * currently only versions 2.[0-4] are supported with
22697a9217aSAntonio Huete Jimenez * the exception of 543.0 for DG/UX tcpdump.
22797a9217aSAntonio Huete Jimenez */
22897a9217aSAntonio Huete Jimenez if (! ((hdr.version_major == PCAP_VERSION_MAJOR &&
22997a9217aSAntonio Huete Jimenez hdr.version_minor <= PCAP_VERSION_MINOR) ||
23097a9217aSAntonio Huete Jimenez (hdr.version_major == 543 &&
23197a9217aSAntonio Huete Jimenez hdr.version_minor == 0))) {
232*ea16f64eSAntonio Huete Jimenez snprintf(errbuf, PCAP_ERRBUF_SIZE,
23397a9217aSAntonio Huete Jimenez "unsupported pcap savefile version %u.%u",
23497a9217aSAntonio Huete Jimenez hdr.version_major, hdr.version_minor);
23597a9217aSAntonio Huete Jimenez *err = 1;
23697a9217aSAntonio Huete Jimenez return NULL;
23797a9217aSAntonio Huete Jimenez }
23897a9217aSAntonio Huete Jimenez
23997a9217aSAntonio Huete Jimenez /*
24097a9217aSAntonio Huete Jimenez * OK, this is a good pcap file.
24197a9217aSAntonio Huete Jimenez * Allocate a pcap_t for it.
24297a9217aSAntonio Huete Jimenez */
243*ea16f64eSAntonio Huete Jimenez p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_sf);
24497a9217aSAntonio Huete Jimenez if (p == NULL) {
24597a9217aSAntonio Huete Jimenez /* Allocation failed. */
24697a9217aSAntonio Huete Jimenez *err = 1;
24797a9217aSAntonio Huete Jimenez return (NULL);
24897a9217aSAntonio Huete Jimenez }
24997a9217aSAntonio Huete Jimenez p->swapped = swapped;
25097a9217aSAntonio Huete Jimenez p->version_major = hdr.version_major;
25197a9217aSAntonio Huete Jimenez p->version_minor = hdr.version_minor;
252a85e14b0SPeter Avalos p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
253a85e14b0SPeter Avalos p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
2543a289941SAaron LI p->snapshot = pcap_adjust_snapshot(p->linktype, hdr.snaplen);
255a85e14b0SPeter Avalos
25697a9217aSAntonio Huete Jimenez p->next_packet_op = pcap_next_packet;
25797a9217aSAntonio Huete Jimenez
25897a9217aSAntonio Huete Jimenez ps = p->priv;
25997a9217aSAntonio Huete Jimenez
26097a9217aSAntonio Huete Jimenez p->opt.tstamp_precision = precision;
26197a9217aSAntonio Huete Jimenez
26297a9217aSAntonio Huete Jimenez /*
26397a9217aSAntonio Huete Jimenez * Will we need to scale the timestamps to match what the
26497a9217aSAntonio Huete Jimenez * user wants?
26597a9217aSAntonio Huete Jimenez */
26697a9217aSAntonio Huete Jimenez switch (precision) {
26797a9217aSAntonio Huete Jimenez
26897a9217aSAntonio Huete Jimenez case PCAP_TSTAMP_PRECISION_MICRO:
2693a289941SAaron LI if (magic_int == NSEC_TCPDUMP_MAGIC) {
27097a9217aSAntonio Huete Jimenez /*
27197a9217aSAntonio Huete Jimenez * The file has nanoseconds, the user
27297a9217aSAntonio Huete Jimenez * wants microseconds; scale the
27397a9217aSAntonio Huete Jimenez * precision down.
27497a9217aSAntonio Huete Jimenez */
27597a9217aSAntonio Huete Jimenez ps->scale_type = SCALE_DOWN;
27697a9217aSAntonio Huete Jimenez } else {
27797a9217aSAntonio Huete Jimenez /*
27897a9217aSAntonio Huete Jimenez * The file has microseconds, the
27997a9217aSAntonio Huete Jimenez * user wants microseconds; nothing to do.
28097a9217aSAntonio Huete Jimenez */
28197a9217aSAntonio Huete Jimenez ps->scale_type = PASS_THROUGH;
28297a9217aSAntonio Huete Jimenez }
28397a9217aSAntonio Huete Jimenez break;
28497a9217aSAntonio Huete Jimenez
28597a9217aSAntonio Huete Jimenez case PCAP_TSTAMP_PRECISION_NANO:
2863a289941SAaron LI if (magic_int == NSEC_TCPDUMP_MAGIC) {
28797a9217aSAntonio Huete Jimenez /*
28897a9217aSAntonio Huete Jimenez * The file has nanoseconds, the
28997a9217aSAntonio Huete Jimenez * user wants nanoseconds; nothing to do.
29097a9217aSAntonio Huete Jimenez */
29197a9217aSAntonio Huete Jimenez ps->scale_type = PASS_THROUGH;
29297a9217aSAntonio Huete Jimenez } else {
29397a9217aSAntonio Huete Jimenez /*
294*ea16f64eSAntonio Huete Jimenez * The file has microseconds, the user
29597a9217aSAntonio Huete Jimenez * wants nanoseconds; scale the
29697a9217aSAntonio Huete Jimenez * precision up.
29797a9217aSAntonio Huete Jimenez */
29897a9217aSAntonio Huete Jimenez ps->scale_type = SCALE_UP;
29997a9217aSAntonio Huete Jimenez }
30097a9217aSAntonio Huete Jimenez break;
30197a9217aSAntonio Huete Jimenez
30297a9217aSAntonio Huete Jimenez default:
303*ea16f64eSAntonio Huete Jimenez snprintf(errbuf, PCAP_ERRBUF_SIZE,
30497a9217aSAntonio Huete Jimenez "unknown time stamp resolution %u", precision);
30597a9217aSAntonio Huete Jimenez free(p);
30697a9217aSAntonio Huete Jimenez *err = 1;
30797a9217aSAntonio Huete Jimenez return (NULL);
30897a9217aSAntonio Huete Jimenez }
309a85e14b0SPeter Avalos
310a85e14b0SPeter Avalos /*
311a85e14b0SPeter Avalos * We interchanged the caplen and len fields at version 2.3,
312a85e14b0SPeter Avalos * in order to match the bpf header layout. But unfortunately
313a85e14b0SPeter Avalos * some files were written with version 2.3 in their headers
314a85e14b0SPeter Avalos * but without the interchanged fields.
315a85e14b0SPeter Avalos *
316a85e14b0SPeter Avalos * In addition, DG/UX tcpdump writes out files with a version
317a85e14b0SPeter Avalos * number of 543.0, and with the caplen and len fields in the
318a85e14b0SPeter Avalos * pre-2.3 order.
319a85e14b0SPeter Avalos */
320a85e14b0SPeter Avalos switch (hdr.version_major) {
321a85e14b0SPeter Avalos
322a85e14b0SPeter Avalos case 2:
323a85e14b0SPeter Avalos if (hdr.version_minor < 3)
32497a9217aSAntonio Huete Jimenez ps->lengths_swapped = SWAPPED;
325a85e14b0SPeter Avalos else if (hdr.version_minor == 3)
32697a9217aSAntonio Huete Jimenez ps->lengths_swapped = MAYBE_SWAPPED;
327a85e14b0SPeter Avalos else
32897a9217aSAntonio Huete Jimenez ps->lengths_swapped = NOT_SWAPPED;
329a85e14b0SPeter Avalos break;
330a85e14b0SPeter Avalos
331a85e14b0SPeter Avalos case 543:
33297a9217aSAntonio Huete Jimenez ps->lengths_swapped = SWAPPED;
333a85e14b0SPeter Avalos break;
334a85e14b0SPeter Avalos
335a85e14b0SPeter Avalos default:
33697a9217aSAntonio Huete Jimenez ps->lengths_swapped = NOT_SWAPPED;
337a85e14b0SPeter Avalos break;
338a85e14b0SPeter Avalos }
339a85e14b0SPeter Avalos
3403a289941SAaron LI if (magic_int == KUZNETZOV_TCPDUMP_MAGIC) {
341a85e14b0SPeter Avalos /*
342a85e14b0SPeter Avalos * XXX - the patch that's in some versions of libpcap
343a85e14b0SPeter Avalos * changes the packet header but not the magic number,
344a85e14b0SPeter Avalos * and some other versions with this magic number have
345a85e14b0SPeter Avalos * some extra debugging information in the packet header;
346a85e14b0SPeter Avalos * we'd have to use some hacks^H^H^H^H^Hheuristics to
347a85e14b0SPeter Avalos * detect those variants.
348a85e14b0SPeter Avalos *
349a85e14b0SPeter Avalos * Ethereal does that, but it does so by trying to read
350a85e14b0SPeter Avalos * the first two packets of the file with each of the
351a85e14b0SPeter Avalos * record header formats. That currently means it seeks
352a85e14b0SPeter Avalos * backwards and retries the reads, which doesn't work
353a85e14b0SPeter Avalos * on pipes. We want to be able to read from a pipe, so
354a85e14b0SPeter Avalos * that strategy won't work; we'd have to buffer some
355a85e14b0SPeter Avalos * data ourselves and read from that buffer in order to
356a85e14b0SPeter Avalos * make that work.
357a85e14b0SPeter Avalos */
35897a9217aSAntonio Huete Jimenez ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
359a85e14b0SPeter Avalos
360a85e14b0SPeter Avalos if (p->linktype == DLT_EN10MB) {
361a85e14b0SPeter Avalos /*
362a85e14b0SPeter Avalos * This capture might have been done in raw mode
363a85e14b0SPeter Avalos * or cooked mode.
364a85e14b0SPeter Avalos *
365a85e14b0SPeter Avalos * If it was done in cooked mode, p->snapshot was
366a85e14b0SPeter Avalos * passed to recvfrom() as the buffer size, meaning
367a85e14b0SPeter Avalos * that the most packet data that would be copied
368a85e14b0SPeter Avalos * would be p->snapshot. However, a faked Ethernet
369a85e14b0SPeter Avalos * header would then have been added to it, so the
370a85e14b0SPeter Avalos * most data that would be in a packet in the file
371a85e14b0SPeter Avalos * would be p->snapshot + 14.
372a85e14b0SPeter Avalos *
373a85e14b0SPeter Avalos * We can't easily tell whether the capture was done
374a85e14b0SPeter Avalos * in raw mode or cooked mode, so we'll assume it was
375a85e14b0SPeter Avalos * cooked mode, and add 14 to the snapshot length.
376a85e14b0SPeter Avalos * That means that, for a raw capture, the snapshot
377a85e14b0SPeter Avalos * length will be misleading if you use it to figure
378a85e14b0SPeter Avalos * out why a capture doesn't have all the packet data,
379a85e14b0SPeter Avalos * but there's not much we can do to avoid that.
3803a289941SAaron LI *
3813a289941SAaron LI * But don't grow the snapshot length past the
3823a289941SAaron LI * maximum value of an int.
383a85e14b0SPeter Avalos */
3843a289941SAaron LI if (p->snapshot <= INT_MAX - 14)
385a85e14b0SPeter Avalos p->snapshot += 14;
3863a289941SAaron LI else
3873a289941SAaron LI p->snapshot = INT_MAX;
388a85e14b0SPeter Avalos }
389a85e14b0SPeter Avalos } else
39097a9217aSAntonio Huete Jimenez ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
391a85e14b0SPeter Avalos
392a85e14b0SPeter Avalos /*
393a85e14b0SPeter Avalos * Allocate a buffer for the packet data.
3943a289941SAaron LI * Choose the minimum of the file's snapshot length and 2K bytes;
3953a289941SAaron LI * that should be enough for most network packets - we'll grow it
3963a289941SAaron LI * if necessary. That way, we don't allocate a huge chunk of
3973a289941SAaron LI * memory just because there's a huge snapshot length, as the
3983a289941SAaron LI * snapshot length might be larger than the size of the largest
3993a289941SAaron LI * packet.
400a85e14b0SPeter Avalos */
401a85e14b0SPeter Avalos p->bufsize = p->snapshot;
4023a289941SAaron LI if (p->bufsize > 2048)
4033a289941SAaron LI p->bufsize = 2048;
404a85e14b0SPeter Avalos p->buffer = malloc(p->bufsize);
405a85e14b0SPeter Avalos if (p->buffer == NULL) {
406*ea16f64eSAntonio Huete Jimenez snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
40797a9217aSAntonio Huete Jimenez free(p);
40897a9217aSAntonio Huete Jimenez *err = 1;
40997a9217aSAntonio Huete Jimenez return (NULL);
410a85e14b0SPeter Avalos }
411a85e14b0SPeter Avalos
41297a9217aSAntonio Huete Jimenez p->cleanup_op = sf_cleanup;
41397a9217aSAntonio Huete Jimenez
41497a9217aSAntonio Huete Jimenez return (p);
415a85e14b0SPeter Avalos }
416a85e14b0SPeter Avalos
417a85e14b0SPeter Avalos /*
4183a289941SAaron LI * Grow the packet buffer to the specified size.
4193a289941SAaron LI */
4203a289941SAaron LI static int
grow_buffer(pcap_t * p,u_int bufsize)4213a289941SAaron LI grow_buffer(pcap_t *p, u_int bufsize)
4223a289941SAaron LI {
4233a289941SAaron LI void *bigger_buffer;
4243a289941SAaron LI
4253a289941SAaron LI bigger_buffer = realloc(p->buffer, bufsize);
4263a289941SAaron LI if (bigger_buffer == NULL) {
427*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "out of memory");
4283a289941SAaron LI return (0);
4293a289941SAaron LI }
4303a289941SAaron LI p->buffer = bigger_buffer;
4313a289941SAaron LI p->bufsize = bufsize;
4323a289941SAaron LI return (1);
4333a289941SAaron LI }
4343a289941SAaron LI
4353a289941SAaron LI /*
436a85e14b0SPeter Avalos * Read and return the next packet from the savefile. Return the header
437a85e14b0SPeter Avalos * in hdr and a pointer to the contents in data. Return 0 on success, 1
438a85e14b0SPeter Avalos * if there were no more packets, and -1 on an error.
439a85e14b0SPeter Avalos */
440a85e14b0SPeter Avalos static int
pcap_next_packet(pcap_t * p,struct pcap_pkthdr * hdr,u_char ** data)441a85e14b0SPeter Avalos pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
442a85e14b0SPeter Avalos {
44397a9217aSAntonio Huete Jimenez struct pcap_sf *ps = p->priv;
444a85e14b0SPeter Avalos struct pcap_sf_patched_pkthdr sf_hdr;
44597a9217aSAntonio Huete Jimenez FILE *fp = p->rfile;
446a85e14b0SPeter Avalos size_t amt_read;
447a85e14b0SPeter Avalos bpf_u_int32 t;
448a85e14b0SPeter Avalos
449a85e14b0SPeter Avalos /*
450a85e14b0SPeter Avalos * Read the packet header; the structure we use as a buffer
451a85e14b0SPeter Avalos * is the longer structure for files generated by the patched
452a85e14b0SPeter Avalos * libpcap, but if the file has the magic number for an
453a85e14b0SPeter Avalos * unpatched libpcap we only read as many bytes as the regular
454a85e14b0SPeter Avalos * header has.
455a85e14b0SPeter Avalos */
45697a9217aSAntonio Huete Jimenez amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
45797a9217aSAntonio Huete Jimenez if (amt_read != ps->hdrsize) {
458a85e14b0SPeter Avalos if (ferror(fp)) {
4593a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
4603a289941SAaron LI errno, "error reading dump file");
461a85e14b0SPeter Avalos return (-1);
462a85e14b0SPeter Avalos } else {
463a85e14b0SPeter Avalos if (amt_read != 0) {
464*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
465*ea16f64eSAntonio Huete Jimenez "truncated dump file; tried to read %zu header bytes, only got %zu",
4663a289941SAaron LI ps->hdrsize, amt_read);
467a85e14b0SPeter Avalos return (-1);
468a85e14b0SPeter Avalos }
469a85e14b0SPeter Avalos /* EOF */
470a85e14b0SPeter Avalos return (1);
471a85e14b0SPeter Avalos }
472a85e14b0SPeter Avalos }
473a85e14b0SPeter Avalos
47497a9217aSAntonio Huete Jimenez if (p->swapped) {
475a85e14b0SPeter Avalos /* these were written in opposite byte order */
476a85e14b0SPeter Avalos hdr->caplen = SWAPLONG(sf_hdr.caplen);
477a85e14b0SPeter Avalos hdr->len = SWAPLONG(sf_hdr.len);
478a85e14b0SPeter Avalos hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
479a85e14b0SPeter Avalos hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
480a85e14b0SPeter Avalos } else {
481a85e14b0SPeter Avalos hdr->caplen = sf_hdr.caplen;
482a85e14b0SPeter Avalos hdr->len = sf_hdr.len;
483a85e14b0SPeter Avalos hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
484a85e14b0SPeter Avalos hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
485a85e14b0SPeter Avalos }
48697a9217aSAntonio Huete Jimenez
48797a9217aSAntonio Huete Jimenez switch (ps->scale_type) {
48897a9217aSAntonio Huete Jimenez
48997a9217aSAntonio Huete Jimenez case PASS_THROUGH:
49097a9217aSAntonio Huete Jimenez /*
49197a9217aSAntonio Huete Jimenez * Just pass the time stamp through.
49297a9217aSAntonio Huete Jimenez */
49397a9217aSAntonio Huete Jimenez break;
49497a9217aSAntonio Huete Jimenez
49597a9217aSAntonio Huete Jimenez case SCALE_UP:
49697a9217aSAntonio Huete Jimenez /*
49797a9217aSAntonio Huete Jimenez * File has microseconds, user wants nanoseconds; convert
49897a9217aSAntonio Huete Jimenez * it.
49997a9217aSAntonio Huete Jimenez */
50097a9217aSAntonio Huete Jimenez hdr->ts.tv_usec = hdr->ts.tv_usec * 1000;
50197a9217aSAntonio Huete Jimenez break;
50297a9217aSAntonio Huete Jimenez
50397a9217aSAntonio Huete Jimenez case SCALE_DOWN:
50497a9217aSAntonio Huete Jimenez /*
50597a9217aSAntonio Huete Jimenez * File has nanoseconds, user wants microseconds; convert
50697a9217aSAntonio Huete Jimenez * it.
50797a9217aSAntonio Huete Jimenez */
50897a9217aSAntonio Huete Jimenez hdr->ts.tv_usec = hdr->ts.tv_usec / 1000;
50997a9217aSAntonio Huete Jimenez break;
51097a9217aSAntonio Huete Jimenez }
51197a9217aSAntonio Huete Jimenez
512a85e14b0SPeter Avalos /* Swap the caplen and len fields, if necessary. */
51397a9217aSAntonio Huete Jimenez switch (ps->lengths_swapped) {
514a85e14b0SPeter Avalos
515a85e14b0SPeter Avalos case NOT_SWAPPED:
516a85e14b0SPeter Avalos break;
517a85e14b0SPeter Avalos
518a85e14b0SPeter Avalos case MAYBE_SWAPPED:
519a85e14b0SPeter Avalos if (hdr->caplen <= hdr->len) {
520a85e14b0SPeter Avalos /*
521a85e14b0SPeter Avalos * The captured length is <= the actual length,
522a85e14b0SPeter Avalos * so presumably they weren't swapped.
523a85e14b0SPeter Avalos */
524a85e14b0SPeter Avalos break;
525a85e14b0SPeter Avalos }
526a85e14b0SPeter Avalos /* FALLTHROUGH */
527a85e14b0SPeter Avalos
528a85e14b0SPeter Avalos case SWAPPED:
529a85e14b0SPeter Avalos t = hdr->caplen;
530a85e14b0SPeter Avalos hdr->caplen = hdr->len;
531a85e14b0SPeter Avalos hdr->len = t;
532a85e14b0SPeter Avalos break;
533a85e14b0SPeter Avalos }
534a85e14b0SPeter Avalos
535a85e14b0SPeter Avalos /*
5363a289941SAaron LI * Is the packet bigger than we consider sane?
5373a289941SAaron LI */
5383a289941SAaron LI if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) {
5393a289941SAaron LI /*
5403a289941SAaron LI * Yes. This may be a damaged or fuzzed file.
5413a289941SAaron LI *
5423a289941SAaron LI * Is it bigger than the snapshot length?
5433a289941SAaron LI * (We don't treat that as an error if it's not
5443a289941SAaron LI * bigger than the maximum we consider sane; see
5453a289941SAaron LI * below.)
5463a289941SAaron LI */
5473a289941SAaron LI if (hdr->caplen > (bpf_u_int32)p->snapshot) {
548*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
5493a289941SAaron LI "invalid packet capture length %u, bigger than "
5503a289941SAaron LI "snaplen of %d", hdr->caplen, p->snapshot);
5513a289941SAaron LI } else {
552*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
5533a289941SAaron LI "invalid packet capture length %u, bigger than "
5543a289941SAaron LI "maximum of %u", hdr->caplen,
5553a289941SAaron LI max_snaplen_for_dlt(p->linktype));
5563a289941SAaron LI }
5573a289941SAaron LI return (-1);
5583a289941SAaron LI }
5593a289941SAaron LI
5603a289941SAaron LI if (hdr->caplen > (bpf_u_int32)p->snapshot) {
5613a289941SAaron LI /*
5623a289941SAaron LI * The packet is bigger than the snapshot length
5633a289941SAaron LI * for this file.
5643a289941SAaron LI *
565a85e14b0SPeter Avalos * This can happen due to Solaris 2.3 systems tripping
566a85e14b0SPeter Avalos * over the BUFMOD problem and not setting the snapshot
5673a289941SAaron LI * length correctly in the savefile header.
5683a289941SAaron LI *
5693a289941SAaron LI * libpcap 0.4 and later on Solaris 2.3 should set the
5703a289941SAaron LI * snapshot length correctly in the pcap file header,
5713a289941SAaron LI * even though they don't set a snapshot length in bufmod
5723a289941SAaron LI * (the buggy bufmod chops off the *beginning* of the
5733a289941SAaron LI * packet if a snapshot length is specified); they should
5743a289941SAaron LI * also reduce the captured length, as supplied to the
5753a289941SAaron LI * per-packet callback, to the snapshot length if it's
5763a289941SAaron LI * greater than the snapshot length, so the code using
5773a289941SAaron LI * libpcap should see the packet cut off at the snapshot
5783a289941SAaron LI * length, even though the full packet is copied up to
5793a289941SAaron LI * userland.
5803a289941SAaron LI *
5813a289941SAaron LI * However, perhaps some versions of libpcap failed to
5823a289941SAaron LI * set the snapshot length currectly in the file header
5833a289941SAaron LI * or the per-packet header, or perhaps this is a
5843a289941SAaron LI * corrupted safefile or a savefile built/modified by a
5853a289941SAaron LI * fuzz tester, so we check anyway. We grow the buffer
5863a289941SAaron LI * to be big enough for the snapshot length, read up
5873a289941SAaron LI * to the snapshot length, discard the rest of the
5883a289941SAaron LI * packet, and report the snapshot length as the captured
5893a289941SAaron LI * length; we don't want to hand our caller a packet
5903a289941SAaron LI * bigger than the snapshot length, because they might
5913a289941SAaron LI * be assuming they'll never be handed such a packet,
5923a289941SAaron LI * and might copy the packet into a snapshot-length-
5933a289941SAaron LI * sized buffer, assuming it'll fit.
594a85e14b0SPeter Avalos */
59597a9217aSAntonio Huete Jimenez size_t bytes_to_discard;
59697a9217aSAntonio Huete Jimenez size_t bytes_to_read, bytes_read;
59797a9217aSAntonio Huete Jimenez char discard_buf[4096];
598a85e14b0SPeter Avalos
5993a289941SAaron LI if (hdr->caplen > p->bufsize) {
6003a289941SAaron LI /*
6013a289941SAaron LI * Grow the buffer to the snapshot length.
6023a289941SAaron LI */
6033a289941SAaron LI if (!grow_buffer(p, p->snapshot))
604a85e14b0SPeter Avalos return (-1);
605a85e14b0SPeter Avalos }
606a85e14b0SPeter Avalos
60797a9217aSAntonio Huete Jimenez /*
6083a289941SAaron LI * Read the first p->snapshot bytes into the buffer.
60997a9217aSAntonio Huete Jimenez */
6103a289941SAaron LI amt_read = fread(p->buffer, 1, p->snapshot, fp);
6113a289941SAaron LI if (amt_read != (bpf_u_int32)p->snapshot) {
612a85e14b0SPeter Avalos if (ferror(fp)) {
6133a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf,
6143a289941SAaron LI PCAP_ERRBUF_SIZE, errno,
6153a289941SAaron LI "error reading dump file");
616a85e14b0SPeter Avalos } else {
61797a9217aSAntonio Huete Jimenez /*
61897a9217aSAntonio Huete Jimenez * Yes, this uses hdr->caplen; technically,
61997a9217aSAntonio Huete Jimenez * it's true, because we would try to read
62097a9217aSAntonio Huete Jimenez * and discard the rest of those bytes, and
62197a9217aSAntonio Huete Jimenez * that would fail because we got EOF before
62297a9217aSAntonio Huete Jimenez * the read finished.
62397a9217aSAntonio Huete Jimenez */
624*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
625*ea16f64eSAntonio Huete Jimenez "truncated dump file; tried to read %u captured bytes, only got %zu",
6263a289941SAaron LI p->snapshot, amt_read);
627a85e14b0SPeter Avalos }
628a85e14b0SPeter Avalos return (-1);
629a85e14b0SPeter Avalos }
63097a9217aSAntonio Huete Jimenez
631a85e14b0SPeter Avalos /*
63297a9217aSAntonio Huete Jimenez * Now read and discard what's left.
63397a9217aSAntonio Huete Jimenez */
6343a289941SAaron LI bytes_to_discard = hdr->caplen - p->snapshot;
63597a9217aSAntonio Huete Jimenez bytes_read = amt_read;
63697a9217aSAntonio Huete Jimenez while (bytes_to_discard != 0) {
63797a9217aSAntonio Huete Jimenez bytes_to_read = bytes_to_discard;
63897a9217aSAntonio Huete Jimenez if (bytes_to_read > sizeof (discard_buf))
63997a9217aSAntonio Huete Jimenez bytes_to_read = sizeof (discard_buf);
64097a9217aSAntonio Huete Jimenez amt_read = fread(discard_buf, 1, bytes_to_read, fp);
64197a9217aSAntonio Huete Jimenez bytes_read += amt_read;
64297a9217aSAntonio Huete Jimenez if (amt_read != bytes_to_read) {
64397a9217aSAntonio Huete Jimenez if (ferror(fp)) {
6443a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf,
6453a289941SAaron LI PCAP_ERRBUF_SIZE, errno,
6463a289941SAaron LI "error reading dump file");
64797a9217aSAntonio Huete Jimenez } else {
648*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
649*ea16f64eSAntonio Huete Jimenez "truncated dump file; tried to read %u captured bytes, only got %zu",
6503a289941SAaron LI hdr->caplen, bytes_read);
65197a9217aSAntonio Huete Jimenez }
65297a9217aSAntonio Huete Jimenez return (-1);
65397a9217aSAntonio Huete Jimenez }
65497a9217aSAntonio Huete Jimenez bytes_to_discard -= amt_read;
65597a9217aSAntonio Huete Jimenez }
65697a9217aSAntonio Huete Jimenez
65797a9217aSAntonio Huete Jimenez /*
65897a9217aSAntonio Huete Jimenez * Adjust caplen accordingly, so we don't get confused later
65997a9217aSAntonio Huete Jimenez * as to how many bytes we have to play with.
660a85e14b0SPeter Avalos */
6613a289941SAaron LI hdr->caplen = p->snapshot;
662a85e14b0SPeter Avalos } else {
6633a289941SAaron LI /*
6643a289941SAaron LI * The packet is within the snapshot length for this file.
6653a289941SAaron LI */
6663a289941SAaron LI if (hdr->caplen > p->bufsize) {
6673a289941SAaron LI /*
6683a289941SAaron LI * Grow the buffer to the next power of 2, or
6693a289941SAaron LI * the snaplen, whichever is lower.
6703a289941SAaron LI */
6713a289941SAaron LI u_int new_bufsize;
6723a289941SAaron LI
6733a289941SAaron LI new_bufsize = hdr->caplen;
6743a289941SAaron LI /*
675*ea16f64eSAntonio Huete Jimenez * https://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
6763a289941SAaron LI */
6773a289941SAaron LI new_bufsize--;
6783a289941SAaron LI new_bufsize |= new_bufsize >> 1;
6793a289941SAaron LI new_bufsize |= new_bufsize >> 2;
6803a289941SAaron LI new_bufsize |= new_bufsize >> 4;
6813a289941SAaron LI new_bufsize |= new_bufsize >> 8;
6823a289941SAaron LI new_bufsize |= new_bufsize >> 16;
6833a289941SAaron LI new_bufsize++;
6843a289941SAaron LI
6853a289941SAaron LI if (new_bufsize > (u_int)p->snapshot)
6863a289941SAaron LI new_bufsize = p->snapshot;
6873a289941SAaron LI
6883a289941SAaron LI if (!grow_buffer(p, new_bufsize))
6893a289941SAaron LI return (-1);
6903a289941SAaron LI }
6913a289941SAaron LI
692a85e14b0SPeter Avalos /* read the packet itself */
693a85e14b0SPeter Avalos amt_read = fread(p->buffer, 1, hdr->caplen, fp);
694a85e14b0SPeter Avalos if (amt_read != hdr->caplen) {
695a85e14b0SPeter Avalos if (ferror(fp)) {
6963a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf,
6973a289941SAaron LI PCAP_ERRBUF_SIZE, errno,
6983a289941SAaron LI "error reading dump file");
699a85e14b0SPeter Avalos } else {
700*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
701*ea16f64eSAntonio Huete Jimenez "truncated dump file; tried to read %u captured bytes, only got %zu",
7023a289941SAaron LI hdr->caplen, amt_read);
703a85e14b0SPeter Avalos }
704a85e14b0SPeter Avalos return (-1);
705a85e14b0SPeter Avalos }
706a85e14b0SPeter Avalos }
707a85e14b0SPeter Avalos *data = p->buffer;
708a85e14b0SPeter Avalos
70997a9217aSAntonio Huete Jimenez if (p->swapped)
71097a9217aSAntonio Huete Jimenez swap_pseudo_headers(p->linktype, hdr, *data);
711a85e14b0SPeter Avalos
712a85e14b0SPeter Avalos return (0);
713a85e14b0SPeter Avalos }
714a85e14b0SPeter Avalos
715a85e14b0SPeter Avalos static int
sf_write_header(pcap_t * p,FILE * fp,int linktype,int snaplen)716*ea16f64eSAntonio Huete Jimenez sf_write_header(pcap_t *p, FILE *fp, int linktype, int snaplen)
717a85e14b0SPeter Avalos {
718a85e14b0SPeter Avalos struct pcap_file_header hdr;
719a85e14b0SPeter Avalos
72097a9217aSAntonio Huete Jimenez hdr.magic = p->opt.tstamp_precision == PCAP_TSTAMP_PRECISION_NANO ? NSEC_TCPDUMP_MAGIC : TCPDUMP_MAGIC;
721a85e14b0SPeter Avalos hdr.version_major = PCAP_VERSION_MAJOR;
722a85e14b0SPeter Avalos hdr.version_minor = PCAP_VERSION_MINOR;
723a85e14b0SPeter Avalos
724*ea16f64eSAntonio Huete Jimenez /*
725*ea16f64eSAntonio Huete Jimenez * https://www.tcpdump.org/manpages/pcap-savefile.5.txt states:
726*ea16f64eSAntonio Huete Jimenez * thiszone: 4-byte time zone offset; this is always 0.
727*ea16f64eSAntonio Huete Jimenez * sigfigs: 4-byte number giving the accuracy of time stamps
728*ea16f64eSAntonio Huete Jimenez * in the file; this is always 0.
729*ea16f64eSAntonio Huete Jimenez */
730*ea16f64eSAntonio Huete Jimenez hdr.thiszone = 0;
731a85e14b0SPeter Avalos hdr.sigfigs = 0;
732*ea16f64eSAntonio Huete Jimenez hdr.snaplen = snaplen;
733a85e14b0SPeter Avalos hdr.linktype = linktype;
734a85e14b0SPeter Avalos
735a85e14b0SPeter Avalos if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
736a85e14b0SPeter Avalos return (-1);
737a85e14b0SPeter Avalos
738a85e14b0SPeter Avalos return (0);
739a85e14b0SPeter Avalos }
740a85e14b0SPeter Avalos
741a85e14b0SPeter Avalos /*
742a85e14b0SPeter Avalos * Output a packet to the initialized dump file.
743a85e14b0SPeter Avalos */
744a85e14b0SPeter Avalos void
pcap_dump(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)745a85e14b0SPeter Avalos pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
746a85e14b0SPeter Avalos {
747a85e14b0SPeter Avalos register FILE *f;
748a85e14b0SPeter Avalos struct pcap_sf_pkthdr sf_hdr;
749a85e14b0SPeter Avalos
750a85e14b0SPeter Avalos f = (FILE *)user;
751*ea16f64eSAntonio Huete Jimenez /*
752*ea16f64eSAntonio Huete Jimenez * Better not try writing pcap files after
753*ea16f64eSAntonio Huete Jimenez * 2038-01-19 03:14:07 UTC; switch to pcapng.
754*ea16f64eSAntonio Huete Jimenez */
755*ea16f64eSAntonio Huete Jimenez sf_hdr.ts.tv_sec = (bpf_int32)h->ts.tv_sec;
756*ea16f64eSAntonio Huete Jimenez sf_hdr.ts.tv_usec = (bpf_int32)h->ts.tv_usec;
757a85e14b0SPeter Avalos sf_hdr.caplen = h->caplen;
758a85e14b0SPeter Avalos sf_hdr.len = h->len;
759a85e14b0SPeter Avalos /* XXX we should check the return status */
760a85e14b0SPeter Avalos (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
761a85e14b0SPeter Avalos (void)fwrite(sp, h->caplen, 1, f);
762a85e14b0SPeter Avalos }
763a85e14b0SPeter Avalos
764a85e14b0SPeter Avalos static pcap_dumper_t *
pcap_setup_dump(pcap_t * p,int linktype,FILE * f,const char * fname)765a85e14b0SPeter Avalos pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
766a85e14b0SPeter Avalos {
767a85e14b0SPeter Avalos
76897a9217aSAntonio Huete Jimenez #if defined(_WIN32) || defined(MSDOS)
769a85e14b0SPeter Avalos /*
770a85e14b0SPeter Avalos * If we're writing to the standard output, put it in binary
771a85e14b0SPeter Avalos * mode, as savefiles are binary files.
772a85e14b0SPeter Avalos *
773a85e14b0SPeter Avalos * Otherwise, we turn off buffering.
774a85e14b0SPeter Avalos * XXX - why? And why not on the standard output?
775a85e14b0SPeter Avalos */
776a85e14b0SPeter Avalos if (f == stdout)
777a85e14b0SPeter Avalos SET_BINMODE(f);
778a85e14b0SPeter Avalos else
7793a289941SAaron LI setvbuf(f, NULL, _IONBF, 0);
780a85e14b0SPeter Avalos #endif
781*ea16f64eSAntonio Huete Jimenez if (sf_write_header(p, f, linktype, p->snapshot) == -1) {
7823a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
7833a289941SAaron LI errno, "Can't write to %s", fname);
784a85e14b0SPeter Avalos if (f != stdout)
785a85e14b0SPeter Avalos (void)fclose(f);
786a85e14b0SPeter Avalos return (NULL);
787a85e14b0SPeter Avalos }
788a85e14b0SPeter Avalos return ((pcap_dumper_t *)f);
789a85e14b0SPeter Avalos }
790a85e14b0SPeter Avalos
791a85e14b0SPeter Avalos /*
792a85e14b0SPeter Avalos * Initialize so that sf_write() will output to the file named 'fname'.
793a85e14b0SPeter Avalos */
794a85e14b0SPeter Avalos pcap_dumper_t *
pcap_dump_open(pcap_t * p,const char * fname)795a85e14b0SPeter Avalos pcap_dump_open(pcap_t *p, const char *fname)
796a85e14b0SPeter Avalos {
797a85e14b0SPeter Avalos FILE *f;
798a85e14b0SPeter Avalos int linktype;
799a85e14b0SPeter Avalos
800a85e14b0SPeter Avalos /*
801a85e14b0SPeter Avalos * If this pcap_t hasn't been activated, it doesn't have a
802a85e14b0SPeter Avalos * link-layer type, so we can't use it.
803a85e14b0SPeter Avalos */
804a85e14b0SPeter Avalos if (!p->activated) {
805*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
806a85e14b0SPeter Avalos "%s: not-yet-activated pcap_t passed to pcap_dump_open",
807a85e14b0SPeter Avalos fname);
808a85e14b0SPeter Avalos return (NULL);
809a85e14b0SPeter Avalos }
810a85e14b0SPeter Avalos linktype = dlt_to_linktype(p->linktype);
811a85e14b0SPeter Avalos if (linktype == -1) {
812*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
813a85e14b0SPeter Avalos "%s: link-layer type %d isn't supported in savefiles",
814a85e14b0SPeter Avalos fname, p->linktype);
815a85e14b0SPeter Avalos return (NULL);
816a85e14b0SPeter Avalos }
817a85e14b0SPeter Avalos linktype |= p->linktype_ext;
818a85e14b0SPeter Avalos
81997a9217aSAntonio Huete Jimenez if (fname == NULL) {
820*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
82197a9217aSAntonio Huete Jimenez "A null pointer was supplied as the file name");
82297a9217aSAntonio Huete Jimenez return NULL;
82397a9217aSAntonio Huete Jimenez }
824a85e14b0SPeter Avalos if (fname[0] == '-' && fname[1] == '\0') {
825a85e14b0SPeter Avalos f = stdout;
826a85e14b0SPeter Avalos fname = "standard output";
827a85e14b0SPeter Avalos } else {
8283a289941SAaron LI /*
8293a289941SAaron LI * "b" is supported as of C90, so *all* UN*Xes should
8303a289941SAaron LI * support it, even though it does nothing. It's
8313a289941SAaron LI * required on Windows, as the file is a binary file
8323a289941SAaron LI * and must be written in binary mode.
8333a289941SAaron LI */
834*ea16f64eSAntonio Huete Jimenez f = charset_fopen(fname, "wb");
835a85e14b0SPeter Avalos if (f == NULL) {
8363a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
8373a289941SAaron LI errno, "%s", fname);
838a85e14b0SPeter Avalos return (NULL);
839a85e14b0SPeter Avalos }
840a85e14b0SPeter Avalos }
841a85e14b0SPeter Avalos return (pcap_setup_dump(p, linktype, f, fname));
842a85e14b0SPeter Avalos }
843a85e14b0SPeter Avalos
8443a289941SAaron LI #ifdef _WIN32
8453a289941SAaron LI /*
8463a289941SAaron LI * Initialize so that sf_write() will output to a stream wrapping the given raw
8473a289941SAaron LI * OS file HANDLE.
8483a289941SAaron LI */
8493a289941SAaron LI pcap_dumper_t *
pcap_dump_hopen(pcap_t * p,intptr_t osfd)8503a289941SAaron LI pcap_dump_hopen(pcap_t *p, intptr_t osfd)
8513a289941SAaron LI {
8523a289941SAaron LI int fd;
8533a289941SAaron LI FILE *file;
8543a289941SAaron LI
8553a289941SAaron LI fd = _open_osfhandle(osfd, _O_APPEND);
8563a289941SAaron LI if (fd < 0) {
8573a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
8583a289941SAaron LI errno, "_open_osfhandle");
8593a289941SAaron LI return NULL;
8603a289941SAaron LI }
8613a289941SAaron LI
8623a289941SAaron LI file = _fdopen(fd, "wb");
8633a289941SAaron LI if (file == NULL) {
8643a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
8653a289941SAaron LI errno, "_fdopen");
8663a289941SAaron LI _close(fd);
8673a289941SAaron LI return NULL;
8683a289941SAaron LI }
8693a289941SAaron LI
8703a289941SAaron LI return pcap_dump_fopen(p, file);
8713a289941SAaron LI }
8723a289941SAaron LI #endif /* _WIN32 */
8733a289941SAaron LI
874a85e14b0SPeter Avalos /*
875a85e14b0SPeter Avalos * Initialize so that sf_write() will output to the given stream.
876a85e14b0SPeter Avalos */
8773a289941SAaron LI #ifdef _WIN32
8783a289941SAaron LI static
8793a289941SAaron LI #endif /* _WIN32 */
880a85e14b0SPeter Avalos pcap_dumper_t *
pcap_dump_fopen(pcap_t * p,FILE * f)881a85e14b0SPeter Avalos pcap_dump_fopen(pcap_t *p, FILE *f)
882a85e14b0SPeter Avalos {
883a85e14b0SPeter Avalos int linktype;
884a85e14b0SPeter Avalos
885a85e14b0SPeter Avalos linktype = dlt_to_linktype(p->linktype);
886a85e14b0SPeter Avalos if (linktype == -1) {
887*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
888a85e14b0SPeter Avalos "stream: link-layer type %d isn't supported in savefiles",
889a85e14b0SPeter Avalos p->linktype);
890a85e14b0SPeter Avalos return (NULL);
891a85e14b0SPeter Avalos }
892a85e14b0SPeter Avalos linktype |= p->linktype_ext;
893a85e14b0SPeter Avalos
894a85e14b0SPeter Avalos return (pcap_setup_dump(p, linktype, f, "stream"));
895a85e14b0SPeter Avalos }
896a85e14b0SPeter Avalos
89797a9217aSAntonio Huete Jimenez pcap_dumper_t *
pcap_dump_open_append(pcap_t * p,const char * fname)89897a9217aSAntonio Huete Jimenez pcap_dump_open_append(pcap_t *p, const char *fname)
89997a9217aSAntonio Huete Jimenez {
90097a9217aSAntonio Huete Jimenez FILE *f;
90197a9217aSAntonio Huete Jimenez int linktype;
90297a9217aSAntonio Huete Jimenez size_t amt_read;
90397a9217aSAntonio Huete Jimenez struct pcap_file_header ph;
90497a9217aSAntonio Huete Jimenez
90597a9217aSAntonio Huete Jimenez linktype = dlt_to_linktype(p->linktype);
90697a9217aSAntonio Huete Jimenez if (linktype == -1) {
907*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
90897a9217aSAntonio Huete Jimenez "%s: link-layer type %d isn't supported in savefiles",
90997a9217aSAntonio Huete Jimenez fname, linktype);
91097a9217aSAntonio Huete Jimenez return (NULL);
91197a9217aSAntonio Huete Jimenez }
91297a9217aSAntonio Huete Jimenez
91397a9217aSAntonio Huete Jimenez if (fname == NULL) {
914*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
91597a9217aSAntonio Huete Jimenez "A null pointer was supplied as the file name");
91697a9217aSAntonio Huete Jimenez return NULL;
91797a9217aSAntonio Huete Jimenez }
91897a9217aSAntonio Huete Jimenez if (fname[0] == '-' && fname[1] == '\0')
91997a9217aSAntonio Huete Jimenez return (pcap_setup_dump(p, linktype, stdout, "standard output"));
92097a9217aSAntonio Huete Jimenez
9213a289941SAaron LI /*
9223a289941SAaron LI * "a" will cause the file *not* to be truncated if it exists
9233a289941SAaron LI * but will cause it to be created if it doesn't. It will
9243a289941SAaron LI * also cause all writes to be done at the end of the file,
9253a289941SAaron LI * but will allow reads to be done anywhere in the file. This
9263a289941SAaron LI * is what we need, because we need to read from the beginning
9273a289941SAaron LI * of the file to see if it already has a header and packets
9283a289941SAaron LI * or if it doesn't.
9293a289941SAaron LI *
9303a289941SAaron LI * "b" is supported as of C90, so *all* UN*Xes should support it,
9313a289941SAaron LI * even though it does nothing. It's required on Windows, as the
9323a289941SAaron LI * file is a binary file and must be read in binary mode.
9333a289941SAaron LI */
934*ea16f64eSAntonio Huete Jimenez f = charset_fopen(fname, "ab+");
93597a9217aSAntonio Huete Jimenez if (f == NULL) {
9363a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
9373a289941SAaron LI errno, "%s", fname);
93897a9217aSAntonio Huete Jimenez return (NULL);
93997a9217aSAntonio Huete Jimenez }
94097a9217aSAntonio Huete Jimenez
94197a9217aSAntonio Huete Jimenez /*
94297a9217aSAntonio Huete Jimenez * Try to read a pcap header.
9433a289941SAaron LI *
9443a289941SAaron LI * We do not assume that the file will be positioned at the
9453a289941SAaron LI * beginning immediately after we've opened it - we seek to
9463a289941SAaron LI * the beginning. ISO C says it's implementation-defined
9473a289941SAaron LI * whether the file position indicator is at the beginning
9483a289941SAaron LI * or the end of the file after an append-mode open, and
9493a289941SAaron LI * it wasn't obvious from the Single UNIX Specification
9503a289941SAaron LI * or the Microsoft documentation how that works on SUS-
9513a289941SAaron LI * compliant systems or on Windows.
95297a9217aSAntonio Huete Jimenez */
9533a289941SAaron LI if (fseek(f, 0, SEEK_SET) == -1) {
9543a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
9553a289941SAaron LI errno, "Can't seek to the beginning of %s", fname);
9563a289941SAaron LI (void)fclose(f);
9573a289941SAaron LI return (NULL);
9583a289941SAaron LI }
95997a9217aSAntonio Huete Jimenez amt_read = fread(&ph, 1, sizeof (ph), f);
96097a9217aSAntonio Huete Jimenez if (amt_read != sizeof (ph)) {
96197a9217aSAntonio Huete Jimenez if (ferror(f)) {
9623a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
9633a289941SAaron LI errno, "%s", fname);
9643a289941SAaron LI (void)fclose(f);
96597a9217aSAntonio Huete Jimenez return (NULL);
96697a9217aSAntonio Huete Jimenez } else if (feof(f) && amt_read > 0) {
967*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
96897a9217aSAntonio Huete Jimenez "%s: truncated pcap file header", fname);
9693a289941SAaron LI (void)fclose(f);
97097a9217aSAntonio Huete Jimenez return (NULL);
97197a9217aSAntonio Huete Jimenez }
97297a9217aSAntonio Huete Jimenez }
97397a9217aSAntonio Huete Jimenez
97497a9217aSAntonio Huete Jimenez #if defined(_WIN32) || defined(MSDOS)
97597a9217aSAntonio Huete Jimenez /*
97697a9217aSAntonio Huete Jimenez * We turn off buffering.
97797a9217aSAntonio Huete Jimenez * XXX - why? And why not on the standard output?
97897a9217aSAntonio Huete Jimenez */
9793a289941SAaron LI setvbuf(f, NULL, _IONBF, 0);
98097a9217aSAntonio Huete Jimenez #endif
98197a9217aSAntonio Huete Jimenez
98297a9217aSAntonio Huete Jimenez /*
98397a9217aSAntonio Huete Jimenez * If a header is already present and:
98497a9217aSAntonio Huete Jimenez *
98597a9217aSAntonio Huete Jimenez * it's not for a pcap file of the appropriate resolution
98697a9217aSAntonio Huete Jimenez * and the right byte order for this machine;
98797a9217aSAntonio Huete Jimenez *
98897a9217aSAntonio Huete Jimenez * the link-layer header types don't match;
98997a9217aSAntonio Huete Jimenez *
99097a9217aSAntonio Huete Jimenez * the snapshot lengths don't match;
99197a9217aSAntonio Huete Jimenez *
99297a9217aSAntonio Huete Jimenez * return an error.
99397a9217aSAntonio Huete Jimenez */
99497a9217aSAntonio Huete Jimenez if (amt_read > 0) {
99597a9217aSAntonio Huete Jimenez /*
99697a9217aSAntonio Huete Jimenez * A header is already present.
99797a9217aSAntonio Huete Jimenez * Do the checks.
99897a9217aSAntonio Huete Jimenez */
99997a9217aSAntonio Huete Jimenez switch (ph.magic) {
100097a9217aSAntonio Huete Jimenez
100197a9217aSAntonio Huete Jimenez case TCPDUMP_MAGIC:
100297a9217aSAntonio Huete Jimenez if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_MICRO) {
1003*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
100497a9217aSAntonio Huete Jimenez "%s: different time stamp precision, cannot append to file", fname);
10053a289941SAaron LI (void)fclose(f);
100697a9217aSAntonio Huete Jimenez return (NULL);
100797a9217aSAntonio Huete Jimenez }
100897a9217aSAntonio Huete Jimenez break;
100997a9217aSAntonio Huete Jimenez
101097a9217aSAntonio Huete Jimenez case NSEC_TCPDUMP_MAGIC:
101197a9217aSAntonio Huete Jimenez if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_NANO) {
1012*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
101397a9217aSAntonio Huete Jimenez "%s: different time stamp precision, cannot append to file", fname);
10143a289941SAaron LI (void)fclose(f);
101597a9217aSAntonio Huete Jimenez return (NULL);
101697a9217aSAntonio Huete Jimenez }
101797a9217aSAntonio Huete Jimenez break;
101897a9217aSAntonio Huete Jimenez
101997a9217aSAntonio Huete Jimenez case SWAPLONG(TCPDUMP_MAGIC):
102097a9217aSAntonio Huete Jimenez case SWAPLONG(NSEC_TCPDUMP_MAGIC):
1021*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
102297a9217aSAntonio Huete Jimenez "%s: different byte order, cannot append to file", fname);
10233a289941SAaron LI (void)fclose(f);
102497a9217aSAntonio Huete Jimenez return (NULL);
102597a9217aSAntonio Huete Jimenez
102697a9217aSAntonio Huete Jimenez case KUZNETZOV_TCPDUMP_MAGIC:
102797a9217aSAntonio Huete Jimenez case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC):
102897a9217aSAntonio Huete Jimenez case NAVTEL_TCPDUMP_MAGIC:
102997a9217aSAntonio Huete Jimenez case SWAPLONG(NAVTEL_TCPDUMP_MAGIC):
1030*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
103197a9217aSAntonio Huete Jimenez "%s: not a pcap file to which we can append", fname);
10323a289941SAaron LI (void)fclose(f);
103397a9217aSAntonio Huete Jimenez return (NULL);
103497a9217aSAntonio Huete Jimenez
103597a9217aSAntonio Huete Jimenez default:
1036*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
103797a9217aSAntonio Huete Jimenez "%s: not a pcap file", fname);
10383a289941SAaron LI (void)fclose(f);
103997a9217aSAntonio Huete Jimenez return (NULL);
104097a9217aSAntonio Huete Jimenez }
104197a9217aSAntonio Huete Jimenez
104297a9217aSAntonio Huete Jimenez /*
104397a9217aSAntonio Huete Jimenez * Good version?
104497a9217aSAntonio Huete Jimenez */
104597a9217aSAntonio Huete Jimenez if (ph.version_major != PCAP_VERSION_MAJOR ||
104697a9217aSAntonio Huete Jimenez ph.version_minor != PCAP_VERSION_MINOR) {
1047*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
104897a9217aSAntonio Huete Jimenez "%s: version is %u.%u, cannot append to file", fname,
104997a9217aSAntonio Huete Jimenez ph.version_major, ph.version_minor);
10503a289941SAaron LI (void)fclose(f);
105197a9217aSAntonio Huete Jimenez return (NULL);
105297a9217aSAntonio Huete Jimenez }
105397a9217aSAntonio Huete Jimenez if ((bpf_u_int32)linktype != ph.linktype) {
1054*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
105597a9217aSAntonio Huete Jimenez "%s: different linktype, cannot append to file", fname);
10563a289941SAaron LI (void)fclose(f);
105797a9217aSAntonio Huete Jimenez return (NULL);
105897a9217aSAntonio Huete Jimenez }
105997a9217aSAntonio Huete Jimenez if ((bpf_u_int32)p->snapshot != ph.snaplen) {
1060*ea16f64eSAntonio Huete Jimenez snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
106197a9217aSAntonio Huete Jimenez "%s: different snaplen, cannot append to file", fname);
10623a289941SAaron LI (void)fclose(f);
106397a9217aSAntonio Huete Jimenez return (NULL);
106497a9217aSAntonio Huete Jimenez }
106597a9217aSAntonio Huete Jimenez } else {
106697a9217aSAntonio Huete Jimenez /*
106797a9217aSAntonio Huete Jimenez * A header isn't present; attempt to write it.
106897a9217aSAntonio Huete Jimenez */
1069*ea16f64eSAntonio Huete Jimenez if (sf_write_header(p, f, linktype, p->snapshot) == -1) {
10703a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
10713a289941SAaron LI errno, "Can't write to %s", fname);
107297a9217aSAntonio Huete Jimenez (void)fclose(f);
107397a9217aSAntonio Huete Jimenez return (NULL);
107497a9217aSAntonio Huete Jimenez }
107597a9217aSAntonio Huete Jimenez }
107697a9217aSAntonio Huete Jimenez
107797a9217aSAntonio Huete Jimenez /*
107897a9217aSAntonio Huete Jimenez * Start writing at the end of the file.
10793a289941SAaron LI *
10803a289941SAaron LI * XXX - this shouldn't be necessary, given that we're opening
10813a289941SAaron LI * the file in append mode, and ISO C specifies that all writes
10823a289941SAaron LI * are done at the end of the file in that mode.
108397a9217aSAntonio Huete Jimenez */
108497a9217aSAntonio Huete Jimenez if (fseek(f, 0, SEEK_END) == -1) {
10853a289941SAaron LI pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
10863a289941SAaron LI errno, "Can't seek to the end of %s", fname);
108797a9217aSAntonio Huete Jimenez (void)fclose(f);
108897a9217aSAntonio Huete Jimenez return (NULL);
108997a9217aSAntonio Huete Jimenez }
109097a9217aSAntonio Huete Jimenez return ((pcap_dumper_t *)f);
109197a9217aSAntonio Huete Jimenez }
109297a9217aSAntonio Huete Jimenez
1093a85e14b0SPeter Avalos FILE *
pcap_dump_file(pcap_dumper_t * p)1094a85e14b0SPeter Avalos pcap_dump_file(pcap_dumper_t *p)
1095a85e14b0SPeter Avalos {
1096a85e14b0SPeter Avalos return ((FILE *)p);
1097a85e14b0SPeter Avalos }
1098a85e14b0SPeter Avalos
1099a85e14b0SPeter Avalos long
pcap_dump_ftell(pcap_dumper_t * p)1100a85e14b0SPeter Avalos pcap_dump_ftell(pcap_dumper_t *p)
1101a85e14b0SPeter Avalos {
1102a85e14b0SPeter Avalos return (ftell((FILE *)p));
1103a85e14b0SPeter Avalos }
1104a85e14b0SPeter Avalos
11053a289941SAaron LI #if defined(HAVE_FSEEKO)
11063a289941SAaron LI /*
11073a289941SAaron LI * We have fseeko(), so we have ftello().
11083a289941SAaron LI * If we have large file support (files larger than 2^31-1 bytes),
11093a289941SAaron LI * ftello() will give us a current file position with more than 32
11103a289941SAaron LI * bits.
11113a289941SAaron LI */
11123a289941SAaron LI int64_t
pcap_dump_ftell64(pcap_dumper_t * p)11133a289941SAaron LI pcap_dump_ftell64(pcap_dumper_t *p)
11143a289941SAaron LI {
11153a289941SAaron LI return (ftello((FILE *)p));
11163a289941SAaron LI }
11173a289941SAaron LI #elif defined(_MSC_VER)
11183a289941SAaron LI /*
11193a289941SAaron LI * We have Visual Studio; we support only 2005 and later, so we have
11203a289941SAaron LI * _ftelli64().
11213a289941SAaron LI */
11223a289941SAaron LI int64_t
pcap_dump_ftell64(pcap_dumper_t * p)11233a289941SAaron LI pcap_dump_ftell64(pcap_dumper_t *p)
11243a289941SAaron LI {
11253a289941SAaron LI return (_ftelli64((FILE *)p));
11263a289941SAaron LI }
11273a289941SAaron LI #else
11283a289941SAaron LI /*
11293a289941SAaron LI * We don't have ftello() or _ftelli64(), so fall back on ftell().
11303a289941SAaron LI * Either long is 64 bits, in which case ftell() should suffice,
11313a289941SAaron LI * or this is probably an older 32-bit UN*X without large file
11323a289941SAaron LI * support, which means you'll probably get errors trying to
11333a289941SAaron LI * write files > 2^31-1, so it won't matter anyway.
11343a289941SAaron LI *
11353a289941SAaron LI * XXX - what about MinGW?
11363a289941SAaron LI */
11373a289941SAaron LI int64_t
pcap_dump_ftell64(pcap_dumper_t * p)11383a289941SAaron LI pcap_dump_ftell64(pcap_dumper_t *p)
11393a289941SAaron LI {
11403a289941SAaron LI return (ftell((FILE *)p));
11413a289941SAaron LI }
11423a289941SAaron LI #endif
11433a289941SAaron LI
1144a85e14b0SPeter Avalos int
pcap_dump_flush(pcap_dumper_t * p)1145a85e14b0SPeter Avalos pcap_dump_flush(pcap_dumper_t *p)
1146a85e14b0SPeter Avalos {
1147a85e14b0SPeter Avalos
1148a85e14b0SPeter Avalos if (fflush((FILE *)p) == EOF)
1149a85e14b0SPeter Avalos return (-1);
1150a85e14b0SPeter Avalos else
1151a85e14b0SPeter Avalos return (0);
1152a85e14b0SPeter Avalos }
1153a85e14b0SPeter Avalos
1154a85e14b0SPeter Avalos void
pcap_dump_close(pcap_dumper_t * p)1155a85e14b0SPeter Avalos pcap_dump_close(pcap_dumper_t *p)
1156a85e14b0SPeter Avalos {
1157a85e14b0SPeter Avalos
1158a85e14b0SPeter Avalos #ifdef notyet
1159a85e14b0SPeter Avalos if (ferror((FILE *)p))
1160a85e14b0SPeter Avalos return-an-error;
1161a85e14b0SPeter Avalos /* XXX should check return from fclose() too */
1162a85e14b0SPeter Avalos #endif
1163a85e14b0SPeter Avalos (void)fclose((FILE *)p);
1164a85e14b0SPeter Avalos }
1165