1996-08-19 20:36:34 +00:00
|
|
|
/*
|
1998-09-15 19:28:10 +00:00
|
|
|
* Copyright (c) 1993, 1994, 1995, 1996, 1997
|
1996-08-19 20:36:34 +00:00
|
|
|
* The Regents of the University of California. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that: (1) source code distributions
|
|
|
|
* retain the above copyright notice and this paragraph in its entirety, (2)
|
|
|
|
* distributions including binary code include the above copyright notice and
|
|
|
|
* this paragraph in its entirety in the documentation or other materials
|
|
|
|
* provided with the distribution, and (3) all advertising materials mentioning
|
|
|
|
* features or use of this software display the following acknowledgement:
|
|
|
|
* ``This product includes software developed by the University of California,
|
|
|
|
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
|
|
|
|
* the University nor the names of its contributors may be used to endorse
|
|
|
|
* or promote products derived from this software without specific prior
|
|
|
|
* written permission.
|
|
|
|
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|
|
|
|
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
|
|
|
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
1997-05-27 00:01:12 +00:00
|
|
|
*
|
1996-08-19 20:36:34 +00:00
|
|
|
* savefile.c - supports offline use of tcpdump
|
|
|
|
* Extraction/creation by Jeffrey Mogul, DECWRL
|
|
|
|
* Modified by Steve McCanne, LBL.
|
|
|
|
*
|
|
|
|
* Used to save the received packet headers, after filtering, to
|
|
|
|
* a file, and then read them later.
|
|
|
|
* The first record in the file contains saved values for the machine
|
|
|
|
* dependent values so we can print the dump file on any architecture.
|
|
|
|
*/
|
|
|
|
|
2001-04-03 04:18:09 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
2018-05-18 12:21:19 +00:00
|
|
|
#include <config.h>
|
1997-05-27 00:01:12 +00:00
|
|
|
#endif
|
|
|
|
|
2018-05-18 12:21:19 +00:00
|
|
|
#include <pcap-types.h>
|
2017-02-12 07:04:44 +00:00
|
|
|
#ifdef _WIN32
|
2018-05-18 12:21:19 +00:00
|
|
|
#include <io.h>
|
|
|
|
#include <fcntl.h>
|
2017-02-12 07:04:44 +00:00
|
|
|
#endif /* _WIN32 */
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
|
1996-08-19 20:36:34 +00:00
|
|
|
#include <errno.h>
|
|
|
|
#include <memory.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
2001-04-03 04:18:09 +00:00
|
|
|
#include <string.h>
|
2019-10-06 04:26:37 +00:00
|
|
|
#include <limits.h> /* for INT_MAX */
|
1996-08-19 20:36:34 +00:00
|
|
|
|
|
|
|
#include "pcap-int.h"
|
|
|
|
|
|
|
|
#ifdef HAVE_OS_PROTO_H
|
|
|
|
#include "os-proto.h"
|
|
|
|
#endif
|
|
|
|
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
#include "sf-pcap.h"
|
2018-05-18 12:21:19 +00:00
|
|
|
#include "sf-pcapng.h"
|
2019-10-06 04:26:37 +00:00
|
|
|
#include "pcap-common.h"
|
2023-03-27 18:45:17 +00:00
|
|
|
#include "charconv.h"
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/*
|
2023-03-27 18:45:17 +00:00
|
|
|
* This isn't exported on Windows, because it would only work if both
|
2019-10-06 04:26:37 +00:00
|
|
|
* WinPcap/Npcap and the code using it were to use the Universal CRT; otherwise,
|
|
|
|
* a FILE structure in WinPcap/Npcap and a FILE structure in the code using it
|
2017-02-12 07:04:44 +00:00
|
|
|
* could be different if they're using different versions of the C runtime.
|
|
|
|
*
|
2023-03-27 18:45:17 +00:00
|
|
|
* Instead, pcap/pcap.h defines it as a macro that wraps the hopen version,
|
|
|
|
* with the wrapper calling _fileno() and _get_osfhandle() themselves,
|
|
|
|
* so that it convert the appropriate CRT version's FILE structure to
|
2017-02-12 07:04:44 +00:00
|
|
|
* a HANDLE (which is OS-defined, not CRT-defined, and is part of the Win32
|
|
|
|
* and Win64 ABIs).
|
|
|
|
*/
|
|
|
|
static pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *, u_int, char *);
|
|
|
|
#endif
|
|
|
|
|
2005-05-29 17:46:52 +00:00
|
|
|
/*
|
|
|
|
* Setting O_BINARY on DOS/Windows is a bit tricky
|
|
|
|
*/
|
2017-02-12 07:04:44 +00:00
|
|
|
#if defined(_WIN32)
|
2005-07-11 03:24:53 +00:00
|
|
|
#define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
|
2005-05-29 17:46:52 +00:00
|
|
|
#elif defined(MSDOS)
|
|
|
|
#if defined(__HIGHC__)
|
|
|
|
#define SET_BINMODE(f) setmode(f, O_BINARY)
|
|
|
|
#else
|
|
|
|
#define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
2004-03-31 09:07:39 +00:00
|
|
|
static int
|
2018-05-18 12:21:19 +00:00
|
|
|
sf_getnonblock(pcap_t *p _U_)
|
2004-03-31 09:07:39 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* This is a savefile, not a live capture file, so never say
|
|
|
|
* it's in non-blocking mode.
|
|
|
|
*/
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2018-05-18 12:21:19 +00:00
|
|
|
sf_setnonblock(pcap_t *p, int nonblock _U_)
|
2004-03-31 09:07:39 +00:00
|
|
|
{
|
|
|
|
/*
|
2012-01-31 17:22:07 +00:00
|
|
|
* This is a savefile, not a live capture file, so reject
|
|
|
|
* requests to put it in non-blocking mode. (If it's a
|
|
|
|
* pipe, it could be put in non-blocking mode, but that
|
|
|
|
* would significantly complicate the code to read packets,
|
|
|
|
* as it would have to handle reading partial packets and
|
|
|
|
* keeping the state of the read.)
|
2004-03-31 09:07:39 +00:00
|
|
|
*/
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2012-01-31 17:22:07 +00:00
|
|
|
"Savefiles cannot be put into non-blocking mode");
|
|
|
|
return (-1);
|
2004-03-31 09:07:39 +00:00
|
|
|
}
|
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
static int
|
|
|
|
sf_cant_set_rfmon(pcap_t *p _U_)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* This is a savefile, not a device on which you can capture,
|
|
|
|
* so never say it supports being put into monitor mode.
|
|
|
|
*/
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2004-03-31 09:07:39 +00:00
|
|
|
static int
|
2018-05-18 12:21:19 +00:00
|
|
|
sf_stats(pcap_t *p, struct pcap_stat *ps _U_)
|
2004-03-31 09:07:39 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2004-03-31 09:07:39 +00:00
|
|
|
"Statistics aren't available from savefiles");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
static struct pcap_stat *
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_stats_ex(pcap_t *p, int *size _U_)
|
2017-02-12 07:04:44 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"Statistics aren't available from savefiles");
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
2009-03-21 20:43:56 +00:00
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_setbuff(pcap_t *p, int dim _U_)
|
2009-03-21 20:43:56 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2009-03-21 20:43:56 +00:00
|
|
|
"The kernel buffer size cannot be set while reading from a file");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_setmode(pcap_t *p, int mode _U_)
|
2009-03-21 20:43:56 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2009-03-21 20:43:56 +00:00
|
|
|
"impossible to set mode while reading from a file");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_setmintocopy(pcap_t *p, int size _U_)
|
2009-03-21 20:43:56 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2009-03-21 20:43:56 +00:00
|
|
|
"The mintocopy parameter cannot be set while reading from a file");
|
|
|
|
return (-1);
|
|
|
|
}
|
2017-02-12 07:04:44 +00:00
|
|
|
|
|
|
|
static HANDLE
|
|
|
|
sf_getevent(pcap_t *pcap)
|
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
(void)snprintf(pcap->errbuf, sizeof(pcap->errbuf),
|
2017-02-12 07:04:44 +00:00
|
|
|
"The read event cannot be retrieved while reading from a file");
|
|
|
|
return (INVALID_HANDLE_VALUE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
sf_oid_get_request(pcap_t *p, bpf_u_int32 oid _U_, void *data _U_,
|
|
|
|
size_t *lenp _U_)
|
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"An OID get request cannot be performed on a file");
|
|
|
|
return (PCAP_ERROR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
sf_oid_set_request(pcap_t *p, bpf_u_int32 oid _U_, const void *data _U_,
|
|
|
|
size_t *lenp _U_)
|
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"An OID set request cannot be performed on a file");
|
|
|
|
return (PCAP_ERROR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static u_int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_sendqueue_transmit(pcap_t *p, pcap_send_queue *queue _U_, int sync _U_)
|
2017-02-12 07:04:44 +00:00
|
|
|
{
|
2019-10-06 04:26:37 +00:00
|
|
|
pcap_strlcpy(p->errbuf, "Sending packets isn't supported on savefiles",
|
2017-02-12 07:04:44 +00:00
|
|
|
PCAP_ERRBUF_SIZE);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_setuserbuffer(pcap_t *p, int size _U_)
|
2017-02-12 07:04:44 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"The user buffer cannot be set when reading from a file");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_live_dump(pcap_t *p, char *filename _U_, int maxsize _U_, int maxpacks _U_)
|
2017-02-12 07:04:44 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"Live packet dumping cannot be performed when reading from a file");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_live_dump_ended(pcap_t *p, int sync _U_)
|
2017-02-12 07:04:44 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"Live packet dumping cannot be performed on a pcap_open_dead pcap_t");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static PAirpcapHandle
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_get_airpcap_handle(pcap_t *pcap _U_)
|
2017-02-12 07:04:44 +00:00
|
|
|
{
|
|
|
|
return (NULL);
|
|
|
|
}
|
2009-03-21 20:43:56 +00:00
|
|
|
#endif
|
|
|
|
|
2005-05-29 17:46:52 +00:00
|
|
|
static int
|
2023-03-27 18:45:17 +00:00
|
|
|
sf_inject(pcap_t *p, const void *buf _U_, int size _U_)
|
2005-05-29 17:46:52 +00:00
|
|
|
{
|
2019-10-06 04:26:37 +00:00
|
|
|
pcap_strlcpy(p->errbuf, "Sending packets isn't supported on savefiles",
|
2005-05-29 17:46:52 +00:00
|
|
|
PCAP_ERRBUF_SIZE);
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
2005-07-11 03:24:53 +00:00
|
|
|
/*
|
|
|
|
* Set direction flag: Which packets do we accept on a forwarding
|
|
|
|
* single device? IN, OUT or both?
|
|
|
|
*/
|
|
|
|
static int
|
2018-05-18 12:21:19 +00:00
|
|
|
sf_setdirection(pcap_t *p, pcap_direction_t d _U_)
|
2005-07-11 03:24:53 +00:00
|
|
|
{
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(p->errbuf, sizeof(p->errbuf),
|
2005-07-11 03:24:53 +00:00
|
|
|
"Setting direction is not supported on savefiles");
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
|
2015-01-06 18:58:31 +00:00
|
|
|
void
|
2009-03-21 20:43:56 +00:00
|
|
|
sf_cleanup(pcap_t *p)
|
2004-03-31 09:07:39 +00:00
|
|
|
{
|
2015-01-06 18:58:31 +00:00
|
|
|
if (p->rfile != stdin)
|
|
|
|
(void)fclose(p->rfile);
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
if (p->buffer != NULL)
|
|
|
|
free(p->buffer);
|
2012-01-31 17:22:07 +00:00
|
|
|
pcap_freecode(&p->fcode);
|
2004-03-31 09:07:39 +00:00
|
|
|
}
|
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/*
|
|
|
|
* Wrapper for fopen() and _wfopen().
|
|
|
|
*
|
|
|
|
* If we're in UTF-8 mode, map the pathname from UTF-8 to UTF-16LE and
|
|
|
|
* call _wfopen().
|
|
|
|
*
|
|
|
|
* If we're not, just use fopen(); that'll treat it as being in the
|
|
|
|
* local code page.
|
|
|
|
*/
|
|
|
|
FILE *
|
|
|
|
charset_fopen(const char *path, const char *mode)
|
|
|
|
{
|
|
|
|
wchar_t *utf16_path;
|
|
|
|
#define MAX_MODE_LEN 16
|
|
|
|
wchar_t utf16_mode[MAX_MODE_LEN+1];
|
|
|
|
int i;
|
|
|
|
char c;
|
|
|
|
FILE *fp;
|
|
|
|
int save_errno;
|
|
|
|
|
|
|
|
if (pcap_utf_8_mode) {
|
|
|
|
/*
|
|
|
|
* Map from UTF-8 to UTF-16LE.
|
|
|
|
* Fail if there are invalid characters in the input
|
|
|
|
* string, rather than converting them to REPLACEMENT
|
|
|
|
* CHARACTER; the latter is appropriate for strings
|
|
|
|
* to be displayed to the user, but for file names
|
|
|
|
* you just want the attempt to open the file to fail.
|
|
|
|
*/
|
|
|
|
utf16_path = cp_to_utf_16le(CP_UTF8, path,
|
|
|
|
MB_ERR_INVALID_CHARS);
|
|
|
|
if (utf16_path == NULL) {
|
|
|
|
/*
|
|
|
|
* Error. Assume errno has been set.
|
|
|
|
*
|
|
|
|
* XXX - what about Windows errors?
|
|
|
|
*/
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Now convert the mode to UTF-16LE as well.
|
|
|
|
* We assume the mode is ASCII, and that
|
|
|
|
* it's short, so that's easy.
|
|
|
|
*/
|
|
|
|
for (i = 0; (c = *mode) != '\0'; i++, mode++) {
|
|
|
|
if (c > 0x7F) {
|
|
|
|
/* Not an ASCII character; fail with EINVAL. */
|
|
|
|
free(utf16_path);
|
|
|
|
errno = EINVAL;
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
if (i >= MAX_MODE_LEN) {
|
|
|
|
/* The mode string is longer than we allow. */
|
|
|
|
free(utf16_path);
|
|
|
|
errno = EINVAL;
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
utf16_mode[i] = c;
|
|
|
|
}
|
|
|
|
utf16_mode[i] = '\0';
|
|
|
|
|
|
|
|
/*
|
|
|
|
* OK, we have UTF-16LE strings; hand them to
|
|
|
|
* _wfopen().
|
|
|
|
*/
|
|
|
|
fp = _wfopen(utf16_path, utf16_mode);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Make sure freeing the UTF-16LE string doesn't
|
|
|
|
* overwrite the error code we got from _wfopen().
|
|
|
|
*/
|
|
|
|
save_errno = errno;
|
|
|
|
free(utf16_path);
|
|
|
|
errno = save_errno;
|
|
|
|
|
|
|
|
return (fp);
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* This takes strings in the local code page as an
|
|
|
|
* argument.
|
|
|
|
*/
|
|
|
|
return (fopen(path, mode));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
1996-08-19 20:36:34 +00:00
|
|
|
pcap_t *
|
2015-01-06 18:58:31 +00:00
|
|
|
pcap_open_offline_with_tstamp_precision(const char *fname, u_int precision,
|
2017-02-12 07:04:44 +00:00
|
|
|
char *errbuf)
|
2005-05-29 17:46:52 +00:00
|
|
|
{
|
|
|
|
FILE *fp;
|
|
|
|
pcap_t *p;
|
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
if (fname == NULL) {
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
2017-02-12 07:04:44 +00:00
|
|
|
"A null pointer was supplied as the file name");
|
|
|
|
return (NULL);
|
|
|
|
}
|
2005-05-29 17:46:52 +00:00
|
|
|
if (fname[0] == '-' && fname[1] == '\0')
|
2005-07-11 03:24:53 +00:00
|
|
|
{
|
2005-05-29 17:46:52 +00:00
|
|
|
fp = stdin;
|
2023-03-27 18:45:17 +00:00
|
|
|
if (fp == NULL) {
|
|
|
|
snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
"The standard input is not open");
|
|
|
|
return (NULL);
|
|
|
|
}
|
2017-02-12 07:04:44 +00:00
|
|
|
#if defined(_WIN32) || defined(MSDOS)
|
2005-07-11 03:24:53 +00:00
|
|
|
/*
|
|
|
|
* We're reading from the standard input, so put it in binary
|
|
|
|
* mode, as savefiles are binary files.
|
|
|
|
*/
|
|
|
|
SET_BINMODE(fp);
|
|
|
|
#endif
|
|
|
|
}
|
2005-05-29 17:46:52 +00:00
|
|
|
else {
|
2018-05-18 12:21:19 +00:00
|
|
|
/*
|
2023-03-27 18:45:17 +00:00
|
|
|
* Use charset_fopen(); on Windows, it tests whether we're
|
|
|
|
* in "local code page" or "UTF-8" mode, and treats the
|
|
|
|
* pathname appropriately, and on other platforms, it just
|
|
|
|
* wraps fopen().
|
|
|
|
*
|
2018-05-18 12:21:19 +00:00
|
|
|
* "b" is supported as of C90, so *all* UN*Xes should
|
2023-03-27 18:45:17 +00:00
|
|
|
* support it, even though it does nothing. For MS-DOS,
|
|
|
|
* we again need it.
|
2018-05-18 12:21:19 +00:00
|
|
|
*/
|
2023-03-27 18:45:17 +00:00
|
|
|
fp = charset_fopen(fname, "rb");
|
2005-05-29 17:46:52 +00:00
|
|
|
if (fp == NULL) {
|
2018-05-18 12:21:19 +00:00
|
|
|
pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
errno, "%s", fname);
|
2005-05-29 17:46:52 +00:00
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
}
|
2015-01-06 18:58:31 +00:00
|
|
|
p = pcap_fopen_offline_with_tstamp_precision(fp, precision, errbuf);
|
2005-05-29 17:46:52 +00:00
|
|
|
if (p == NULL) {
|
|
|
|
if (fp != stdin)
|
|
|
|
fclose(fp);
|
|
|
|
}
|
|
|
|
return (p);
|
|
|
|
}
|
|
|
|
|
2015-01-06 18:58:31 +00:00
|
|
|
pcap_t *
|
|
|
|
pcap_open_offline(const char *fname, char *errbuf)
|
|
|
|
{
|
|
|
|
return (pcap_open_offline_with_tstamp_precision(fname,
|
|
|
|
PCAP_TSTAMP_PRECISION_MICRO, errbuf));
|
|
|
|
}
|
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
#ifdef _WIN32
|
2015-01-06 18:58:31 +00:00
|
|
|
pcap_t* pcap_hopen_offline_with_tstamp_precision(intptr_t osfd, u_int precision,
|
|
|
|
char *errbuf)
|
2009-03-21 20:43:56 +00:00
|
|
|
{
|
|
|
|
int fd;
|
|
|
|
FILE *file;
|
|
|
|
|
|
|
|
fd = _open_osfhandle(osfd, _O_RDONLY);
|
2017-02-12 07:04:44 +00:00
|
|
|
if ( fd < 0 )
|
2009-03-21 20:43:56 +00:00
|
|
|
{
|
2018-05-18 12:21:19 +00:00
|
|
|
pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
errno, "_open_osfhandle");
|
2009-03-21 20:43:56 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
file = _fdopen(fd, "rb");
|
2017-02-12 07:04:44 +00:00
|
|
|
if ( file == NULL )
|
2009-03-21 20:43:56 +00:00
|
|
|
{
|
2018-05-18 12:21:19 +00:00
|
|
|
pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
errno, "_fdopen");
|
2019-10-06 04:26:37 +00:00
|
|
|
_close(fd);
|
2009-03-21 20:43:56 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2015-01-06 18:58:31 +00:00
|
|
|
return pcap_fopen_offline_with_tstamp_precision(file, precision,
|
|
|
|
errbuf);
|
|
|
|
}
|
|
|
|
|
|
|
|
pcap_t* pcap_hopen_offline(intptr_t osfd, char *errbuf)
|
|
|
|
{
|
|
|
|
return pcap_hopen_offline_with_tstamp_precision(osfd,
|
|
|
|
PCAP_TSTAMP_PRECISION_MICRO, errbuf);
|
2009-03-21 20:43:56 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2019-10-06 04:26:37 +00:00
|
|
|
/*
|
|
|
|
* Given a link-layer header type and snapshot length, return a
|
|
|
|
* snapshot length to use when reading the file; it's guaranteed
|
|
|
|
* to be > 0 and <= INT_MAX.
|
|
|
|
*
|
|
|
|
* XXX - the only reason why we limit it to <= INT_MAX is so that
|
|
|
|
* it fits in p->snapshot, and the only reason that p->snapshot is
|
|
|
|
* signed is that pcap_snapshot() returns an int, not an unsigned int.
|
|
|
|
*/
|
|
|
|
bpf_u_int32
|
|
|
|
pcap_adjust_snapshot(bpf_u_int32 linktype, bpf_u_int32 snaplen)
|
|
|
|
{
|
|
|
|
if (snaplen == 0 || snaplen > INT_MAX) {
|
|
|
|
/*
|
|
|
|
* Bogus snapshot length; use the maximum for this
|
|
|
|
* link-layer type as a fallback.
|
|
|
|
*
|
|
|
|
* XXX - we don't clamp snapshot lengths that are
|
|
|
|
* <= INT_MAX but > max_snaplen_for_dlt(linktype),
|
|
|
|
* so a capture file could cause us to allocate
|
|
|
|
* a Really Big Buffer.
|
|
|
|
*/
|
|
|
|
snaplen = max_snaplen_for_dlt(linktype);
|
|
|
|
}
|
|
|
|
return snaplen;
|
|
|
|
}
|
|
|
|
|
|
|
|
static pcap_t *(*check_headers[])(const uint8_t *, FILE *, u_int, char *, int *) = {
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
pcap_check_header,
|
|
|
|
pcap_ng_check_header
|
|
|
|
};
|
|
|
|
|
|
|
|
#define N_FILE_TYPES (sizeof check_headers / sizeof check_headers[0])
|
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
#ifdef _WIN32
|
2009-03-21 20:43:56 +00:00
|
|
|
static
|
|
|
|
#endif
|
2005-05-29 17:46:52 +00:00
|
|
|
pcap_t *
|
2015-01-06 18:58:31 +00:00
|
|
|
pcap_fopen_offline_with_tstamp_precision(FILE *fp, u_int precision,
|
|
|
|
char *errbuf)
|
1996-08-19 20:36:34 +00:00
|
|
|
{
|
|
|
|
register pcap_t *p;
|
2019-10-06 04:26:37 +00:00
|
|
|
uint8_t magic[4];
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
size_t amt_read;
|
|
|
|
u_int i;
|
2015-01-06 18:58:31 +00:00
|
|
|
int err;
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
/*
|
|
|
|
* Fail if we were passed a NULL fp.
|
|
|
|
*
|
|
|
|
* That shouldn't happen if we're opening with a path name, but
|
|
|
|
* it could happen if buggy code is opening with a FILE * and
|
|
|
|
* didn't bother to make sure the FILE * isn't null.
|
|
|
|
*/
|
|
|
|
if (fp == NULL) {
|
|
|
|
snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
"Null FILE * pointer provided to savefile open routine");
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
/*
|
|
|
|
* Read the first 4 bytes of the file; the network analyzer dump
|
2018-05-18 12:21:19 +00:00
|
|
|
* file formats we support (pcap and pcapng), and several other
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
* formats we might support in the future (such as snoop, DOS and
|
|
|
|
* Windows Sniffer, and Microsoft Network Monitor) all have magic
|
|
|
|
* numbers that are unique in their first 4 bytes.
|
|
|
|
*/
|
2019-10-06 04:26:37 +00:00
|
|
|
amt_read = fread(&magic, 1, sizeof(magic), fp);
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
if (amt_read != sizeof(magic)) {
|
2005-05-29 17:46:52 +00:00
|
|
|
if (ferror(fp)) {
|
2018-05-18 12:21:19 +00:00
|
|
|
pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
errno, "error reading dump file");
|
2005-05-29 17:46:52 +00:00
|
|
|
} else {
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(errbuf, PCAP_ERRBUF_SIZE,
|
|
|
|
"truncated dump file; tried to read %zu file header bytes, only got %zu",
|
2019-10-06 04:26:37 +00:00
|
|
|
sizeof(magic), amt_read);
|
1996-08-19 20:36:34 +00:00
|
|
|
}
|
2015-01-06 18:58:31 +00:00
|
|
|
return (NULL);
|
1996-08-19 20:36:34 +00:00
|
|
|
}
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Try all file types.
|
|
|
|
*/
|
|
|
|
for (i = 0; i < N_FILE_TYPES; i++) {
|
2015-01-06 18:58:31 +00:00
|
|
|
p = (*check_headers[i])(magic, fp, precision, errbuf, &err);
|
|
|
|
if (p != NULL) {
|
|
|
|
/* Yup, that's it. */
|
|
|
|
goto found;
|
|
|
|
}
|
|
|
|
if (err) {
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
/*
|
|
|
|
* Error trying to read the header.
|
|
|
|
*/
|
2015-01-06 18:58:31 +00:00
|
|
|
return (NULL);
|
1996-08-19 20:36:34 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
/*
|
|
|
|
* Well, who knows what this mess is....
|
|
|
|
*/
|
2023-03-27 18:45:17 +00:00
|
|
|
snprintf(errbuf, PCAP_ERRBUF_SIZE, "unknown file format");
|
2015-01-06 18:58:31 +00:00
|
|
|
return (NULL);
|
1996-08-19 20:36:34 +00:00
|
|
|
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
found:
|
2015-01-06 18:58:31 +00:00
|
|
|
p->rfile = fp;
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2005-05-29 17:46:52 +00:00
|
|
|
/* Padding only needed for live capture fcode */
|
|
|
|
p->fddipad = 0;
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
#if !defined(_WIN32) && !defined(MSDOS)
|
2004-03-31 09:07:39 +00:00
|
|
|
/*
|
|
|
|
* You can do "select()" and "poll()" on plain files on most
|
|
|
|
* platforms, and should be able to do so on pipes.
|
|
|
|
*
|
|
|
|
* You can't do "select()" on anything other than sockets in
|
|
|
|
* Windows, so, on Win32 systems, we don't have "selectable_fd".
|
|
|
|
*/
|
|
|
|
p->selectable_fd = fileno(fp);
|
|
|
|
#endif
|
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
p->can_set_rfmon_op = sf_cant_set_rfmon;
|
2004-03-31 09:07:39 +00:00
|
|
|
p->read_op = pcap_offline_read;
|
2005-05-29 17:46:52 +00:00
|
|
|
p->inject_op = sf_inject;
|
2004-03-31 09:07:39 +00:00
|
|
|
p->setfilter_op = install_bpf_program;
|
2005-07-11 03:24:53 +00:00
|
|
|
p->setdirection_op = sf_setdirection;
|
2004-03-31 09:07:39 +00:00
|
|
|
p->set_datalink_op = NULL; /* we don't support munging link-layer headers */
|
|
|
|
p->getnonblock_op = sf_getnonblock;
|
|
|
|
p->setnonblock_op = sf_setnonblock;
|
|
|
|
p->stats_op = sf_stats;
|
2017-02-12 07:04:44 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
p->stats_ex_op = sf_stats_ex;
|
2009-03-21 20:43:56 +00:00
|
|
|
p->setbuff_op = sf_setbuff;
|
|
|
|
p->setmode_op = sf_setmode;
|
|
|
|
p->setmintocopy_op = sf_setmintocopy;
|
2017-02-12 07:04:44 +00:00
|
|
|
p->getevent_op = sf_getevent;
|
|
|
|
p->oid_get_request_op = sf_oid_get_request;
|
|
|
|
p->oid_set_request_op = sf_oid_set_request;
|
|
|
|
p->sendqueue_transmit_op = sf_sendqueue_transmit;
|
|
|
|
p->setuserbuffer_op = sf_setuserbuffer;
|
|
|
|
p->live_dump_op = sf_live_dump;
|
|
|
|
p->live_dump_ended_op = sf_live_dump_ended;
|
|
|
|
p->get_airpcap_handle_op = sf_get_airpcap_handle;
|
2009-03-21 20:43:56 +00:00
|
|
|
#endif
|
2015-01-06 18:58:31 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* For offline captures, the standard one-shot callback can
|
|
|
|
* be used for pcap_next()/pcap_next_ex().
|
|
|
|
*/
|
|
|
|
p->oneshot_callback = pcap_oneshot;
|
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
/*
|
|
|
|
* Default breakloop operation.
|
|
|
|
*/
|
|
|
|
p->breakloop_op = pcap_breakloop_common;
|
|
|
|
|
2017-02-12 07:04:44 +00:00
|
|
|
/*
|
|
|
|
* Savefiles never require special BPF code generation.
|
|
|
|
*/
|
|
|
|
p->bpf_codegen_flags = 0;
|
|
|
|
|
2009-03-21 20:43:56 +00:00
|
|
|
p->activated = 1;
|
2004-03-31 09:07:39 +00:00
|
|
|
|
1996-08-19 20:36:34 +00:00
|
|
|
return (p);
|
2015-01-06 18:58:31 +00:00
|
|
|
}
|
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
/*
|
|
|
|
* This isn't needed on Windows; we #define pcap_fopen_offline() as
|
|
|
|
* a wrapper around pcap_hopen_offline(), and we don't call it from
|
|
|
|
* inside this file, so it's unused.
|
|
|
|
*/
|
|
|
|
#ifndef _WIN32
|
2015-01-06 18:58:31 +00:00
|
|
|
pcap_t *
|
|
|
|
pcap_fopen_offline(FILE *fp, char *errbuf)
|
|
|
|
{
|
|
|
|
return (pcap_fopen_offline_with_tstamp_precision(fp,
|
|
|
|
PCAP_TSTAMP_PRECISION_MICRO, errbuf));
|
1996-08-19 20:36:34 +00:00
|
|
|
}
|
2023-03-27 18:45:17 +00:00
|
|
|
#endif
|
1996-08-19 20:36:34 +00:00
|
|
|
|
|
|
|
/*
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
* Read packets from a capture file, and call the callback for each
|
|
|
|
* packet.
|
1996-08-19 20:36:34 +00:00
|
|
|
* If cnt > 0, return after 'cnt' packets, otherwise continue until eof.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
|
|
|
|
{
|
2005-05-29 17:46:52 +00:00
|
|
|
struct bpf_insn *fcode;
|
1996-08-19 20:36:34 +00:00
|
|
|
int n = 0;
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
u_char *data;
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
/*
|
|
|
|
* This can conceivably process more than INT_MAX packets,
|
|
|
|
* which would overflow the packet count, causing it either
|
|
|
|
* to look like a negative number, and thus cause us to
|
|
|
|
* return a value that looks like an error, or overflow
|
|
|
|
* back into positive territory, and thus cause us to
|
|
|
|
* return a too-low count.
|
|
|
|
*
|
|
|
|
* Therefore, if the packet count is unlimited, we clip
|
|
|
|
* it at INT_MAX; this routine is not expected to
|
|
|
|
* process packets indefinitely, so that's not an issue.
|
|
|
|
*/
|
|
|
|
if (PACKET_COUNT_IS_UNLIMITED(cnt))
|
|
|
|
cnt = INT_MAX;
|
|
|
|
|
|
|
|
for (;;) {
|
1996-08-19 20:36:34 +00:00
|
|
|
struct pcap_pkthdr h;
|
2023-03-27 18:45:17 +00:00
|
|
|
int status;
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2004-03-31 09:07:39 +00:00
|
|
|
/*
|
|
|
|
* Has "pcap_breakloop()" been called?
|
|
|
|
* If so, return immediately - if we haven't read any
|
|
|
|
* packets, clear the flag and return -2 to indicate
|
|
|
|
* that we were told to break out of the loop, otherwise
|
|
|
|
* leave the flag set, so that the *next* call will break
|
|
|
|
* out of the loop without having read any packets, and
|
|
|
|
* return the number of packets we've processed so far.
|
|
|
|
*/
|
|
|
|
if (p->break_loop) {
|
|
|
|
if (n == 0) {
|
|
|
|
p->break_loop = 0;
|
|
|
|
return (-2);
|
|
|
|
} else
|
|
|
|
return (n);
|
|
|
|
}
|
|
|
|
|
2015-01-06 18:58:31 +00:00
|
|
|
status = p->next_packet_op(p, &h, &data);
|
2023-03-27 18:45:17 +00:00
|
|
|
if (status < 0) {
|
|
|
|
/*
|
|
|
|
* Error. Pass it back to the caller.
|
|
|
|
*/
|
1996-08-19 20:36:34 +00:00
|
|
|
return (status);
|
|
|
|
}
|
2023-03-27 18:45:17 +00:00
|
|
|
if (status == 0) {
|
|
|
|
/*
|
|
|
|
* EOF. Nothing more to process;
|
|
|
|
*/
|
|
|
|
break;
|
|
|
|
}
|
1996-08-19 20:36:34 +00:00
|
|
|
|
2023-03-27 18:45:17 +00:00
|
|
|
/*
|
|
|
|
* OK, we've read a packet; run it through the filter
|
|
|
|
* and, if it passes, process it.
|
|
|
|
*/
|
2005-05-29 17:46:52 +00:00
|
|
|
if ((fcode = p->fcode.bf_insns) == NULL ||
|
2023-03-27 18:45:17 +00:00
|
|
|
pcap_filter(fcode, data, h.len, h.caplen)) {
|
Update libpcap to 1.1.1.
Changes:
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.
Fix build on RHEL5.
Fix shared library build on AIX.
Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
Add SocketCAN capture support
Add Myricom SNF API support
Update Endace DAG and ERF support
Add support for shared libraries on Solaris, HP-UX, and AIX
Build, install, and un-install shared libraries by default;
don't build/install shared libraries on platforms we don't support
Fix building from a directory other than the source directory
Fix compiler warnings and builds on some platforms
Update config.guess and config.sub
Support monitor mode on mac80211 devices on Linux
Fix USB memory-mapped capturing on Linux; it requires a new DLT_
value
On Linux, scan /sys/class/net for devices if we have it; scan
it, or /proc/net/dev if we don't have /sys/class/net, even if
we have getifaddrs(), as it'll find interfaces with no
addresses
Add limited support for reading pcap-ng files
Fix BPF driver-loading error handling on AIX
Support getting the full-length interface description on FreeBSD
In the lexical analyzer, free up any addrinfo structure we got back
from getaddrinfo().
Add support for BPF and libdlpi in OpenSolaris (and SXCE)
Hyphenate "link-layer" everywhere
Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
In pcap_read_linux_mmap(), if there are no frames available, call
poll() even if we're in non-blocking mode, so we pick up
errors, and check for the errors in question.
Note that poll() works on BPF devices is Snow Leopard
If an ENXIO or ENETDOWN is received, it may mean the device has
gone away. Deal with it.
For BPF, raise the default capture buffer size to from 32k to 512k
Support ps_ifdrop on Linux
Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
under cygwin.
Changes to Linux mmapped captures.
Fix bug where create_ring would fail for particular snaplen and
buffer size combinations
Update pcap-config so that it handles libpcap requiring
additional libraries
Add workaround for threadsafeness on Windows
Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
DLT: Add DLT_CAN_SOCKETCAN
DLT: Add Solaris ipnet
Don't check for DLT_IPNET if it's not defined
Add link-layer types for Fibre Channel FC-2
Add link-layer types for Wireless HART
Add link-layer types for AOS
Add link-layer types for DECT
Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
Install headers unconditionally, and include vlan.h/bluetooth.h if
enabled
Autoconf fixes+cleanup
Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
Support disabling SITA support (--without-sita)
Return -1 on failure to create packet ring (if supported but
creation failed)
Fix handling of 'any' device, so that it can be opened, and no longer
attempt to open it in Monitor mode
Add support for snapshot length for USB Memory-Mapped Interface
Fix configure and build on recent Linux kernels
Fix memory-mapped Linux capture to support pcap_next() and
pcap_next_ex()
Fixes for Linux USB capture
DLT: Add DLT_LINUX_EVDEV
DLT: Add DLT_GSMTAP_UM
DLT: Add DLT_GSMTAP_ABIS
2010-10-28 16:22:13 +00:00
|
|
|
(*callback)(user, &h, data);
|
2023-03-27 18:45:17 +00:00
|
|
|
n++; /* count the packet */
|
|
|
|
if (n >= cnt)
|
1996-08-19 20:36:34 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/*XXX this breaks semantics tcpslice expects */
|
|
|
|
return (n);
|
|
|
|
}
|