1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright (C) 1993-2001 by Darren Reed. 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 5*0Sstevel@tonic-gate * 6*0Sstevel@tonic-gate * $Id: ipft_pc.c,v 1.9 2003/02/16 02:32:36 darrenr Exp $ 7*0Sstevel@tonic-gate */ 8*0Sstevel@tonic-gate #include "ipf.h" 9*0Sstevel@tonic-gate #include "pcap-ipf.h" 10*0Sstevel@tonic-gate #include "bpf-ipf.h" 11*0Sstevel@tonic-gate #include "ipt.h" 12*0Sstevel@tonic-gate 13*0Sstevel@tonic-gate #if !defined(lint) 14*0Sstevel@tonic-gate static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 1.9 2003/02/16 02:32:36 darrenr Exp $"; 15*0Sstevel@tonic-gate #endif 16*0Sstevel@tonic-gate 17*0Sstevel@tonic-gate struct llc { 18*0Sstevel@tonic-gate int lc_type; 19*0Sstevel@tonic-gate int lc_sz; /* LLC header length */ 20*0Sstevel@tonic-gate int lc_to; /* LLC Type offset */ 21*0Sstevel@tonic-gate int lc_tl; /* LLC Type length */ 22*0Sstevel@tonic-gate }; 23*0Sstevel@tonic-gate 24*0Sstevel@tonic-gate /* 25*0Sstevel@tonic-gate * While many of these maybe the same, some do have different header formats 26*0Sstevel@tonic-gate * which make this useful. 27*0Sstevel@tonic-gate */ 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate static struct llc llcs[] = { 30*0Sstevel@tonic-gate { DLT_NULL, 0, 0, 0 }, 31*0Sstevel@tonic-gate { DLT_EN10MB, 14, 12, 2 }, 32*0Sstevel@tonic-gate { DLT_EN3MB, 0, 0, 0 }, 33*0Sstevel@tonic-gate { DLT_AX25, 0, 0, 0 }, 34*0Sstevel@tonic-gate { DLT_PRONET, 0, 0, 0 }, 35*0Sstevel@tonic-gate { DLT_CHAOS, 0, 0, 0 }, 36*0Sstevel@tonic-gate { DLT_IEEE802, 0, 0, 0 }, 37*0Sstevel@tonic-gate { DLT_ARCNET, 0, 0, 0 }, 38*0Sstevel@tonic-gate { DLT_SLIP, 0, 0, 0 }, 39*0Sstevel@tonic-gate { DLT_PPP, 0, 0, 0 }, 40*0Sstevel@tonic-gate { DLT_FDDI, 0, 0, 0 }, 41*0Sstevel@tonic-gate #ifdef DLT_ATMRFC1483 42*0Sstevel@tonic-gate { DLT_ATMRFC1483, 0, 0, 0 }, 43*0Sstevel@tonic-gate #endif 44*0Sstevel@tonic-gate { DLT_RAW, 0, 0, 0 }, 45*0Sstevel@tonic-gate #ifdef DLT_ENC 46*0Sstevel@tonic-gate { DLT_ENC, 0, 0, 0 }, 47*0Sstevel@tonic-gate #endif 48*0Sstevel@tonic-gate #ifdef DLT_SLIP_BSDOS 49*0Sstevel@tonic-gate { DLT_SLIP_BSDOS, 0, 0, 0 }, 50*0Sstevel@tonic-gate #endif 51*0Sstevel@tonic-gate #ifdef DLT_PPP_BSDOS 52*0Sstevel@tonic-gate { DLT_PPP_BSDOS, 0, 0, 0 }, 53*0Sstevel@tonic-gate #endif 54*0Sstevel@tonic-gate #ifdef DLT_HIPPI 55*0Sstevel@tonic-gate { DLT_HIPPI, 0, 0, 0 }, 56*0Sstevel@tonic-gate #endif 57*0Sstevel@tonic-gate #ifdef DLT_HDLC 58*0Sstevel@tonic-gate { DLT_HDLC, 0, 0, 0 }, 59*0Sstevel@tonic-gate #endif 60*0Sstevel@tonic-gate #ifdef DLT_PPP_SERIAL 61*0Sstevel@tonic-gate { DLT_PPP_SERIAL, 4, 4, 0 }, 62*0Sstevel@tonic-gate #endif 63*0Sstevel@tonic-gate #ifdef DLT_PPP_ETHER 64*0Sstevel@tonic-gate { DLT_PPP_ETHER, 8, 8, 0 }, 65*0Sstevel@tonic-gate #endif 66*0Sstevel@tonic-gate #ifdef DLT_ECONET 67*0Sstevel@tonic-gate { DLT_ECONET, 0, 0, 0 }, 68*0Sstevel@tonic-gate #endif 69*0Sstevel@tonic-gate { -1, -1, -1, -1 } 70*0Sstevel@tonic-gate }; 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gate static int pcap_open __P((char *)); 73*0Sstevel@tonic-gate static int pcap_close __P((void)); 74*0Sstevel@tonic-gate static int pcap_readip __P((char *, int, char **, int *)); 75*0Sstevel@tonic-gate static void swap_hdr __P((pcaphdr_t *)); 76*0Sstevel@tonic-gate static int pcap_read_rec __P((struct pcap_pkthdr *)); 77*0Sstevel@tonic-gate 78*0Sstevel@tonic-gate static int pfd = -1, s_type = -1, swapped = 0; 79*0Sstevel@tonic-gate static struct llc *llcp = NULL; 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate struct ipread pcap = { pcap_open, pcap_close, pcap_readip, 0 }; 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate #define SWAPLONG(y) \ 84*0Sstevel@tonic-gate ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 85*0Sstevel@tonic-gate #define SWAPSHORT(y) \ 86*0Sstevel@tonic-gate ( (((y)&0xff)<<8) | (((y)&0xff00)>>8) ) 87*0Sstevel@tonic-gate 88*0Sstevel@tonic-gate static void swap_hdr(p) 89*0Sstevel@tonic-gate pcaphdr_t *p; 90*0Sstevel@tonic-gate { 91*0Sstevel@tonic-gate p->pc_v_maj = SWAPSHORT(p->pc_v_maj); 92*0Sstevel@tonic-gate p->pc_v_min = SWAPSHORT(p->pc_v_min); 93*0Sstevel@tonic-gate p->pc_zone = SWAPLONG(p->pc_zone); 94*0Sstevel@tonic-gate p->pc_sigfigs = SWAPLONG(p->pc_sigfigs); 95*0Sstevel@tonic-gate p->pc_slen = SWAPLONG(p->pc_slen); 96*0Sstevel@tonic-gate p->pc_type = SWAPLONG(p->pc_type); 97*0Sstevel@tonic-gate } 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate static int pcap_open(fname) 100*0Sstevel@tonic-gate char *fname; 101*0Sstevel@tonic-gate { 102*0Sstevel@tonic-gate pcaphdr_t ph; 103*0Sstevel@tonic-gate int fd, i; 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate if (pfd != -1) 106*0Sstevel@tonic-gate return pfd; 107*0Sstevel@tonic-gate 108*0Sstevel@tonic-gate if (!strcmp(fname, "-")) 109*0Sstevel@tonic-gate fd = 0; 110*0Sstevel@tonic-gate else if ((fd = open(fname, O_RDONLY)) == -1) 111*0Sstevel@tonic-gate return -1; 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate if (read(fd, (char *)&ph, sizeof(ph)) != sizeof(ph)) 114*0Sstevel@tonic-gate return -2; 115*0Sstevel@tonic-gate 116*0Sstevel@tonic-gate if (ph.pc_id != TCPDUMP_MAGIC) { 117*0Sstevel@tonic-gate if (SWAPLONG(ph.pc_id) != TCPDUMP_MAGIC) { 118*0Sstevel@tonic-gate (void) close(fd); 119*0Sstevel@tonic-gate return -2; 120*0Sstevel@tonic-gate } 121*0Sstevel@tonic-gate swapped = 1; 122*0Sstevel@tonic-gate swap_hdr(&ph); 123*0Sstevel@tonic-gate } 124*0Sstevel@tonic-gate 125*0Sstevel@tonic-gate if (ph.pc_v_maj != PCAP_VERSION_MAJ) { 126*0Sstevel@tonic-gate (void) close(fd); 127*0Sstevel@tonic-gate return -2; 128*0Sstevel@tonic-gate } 129*0Sstevel@tonic-gate 130*0Sstevel@tonic-gate for (i = 0; llcs[i].lc_type != -1; i++) 131*0Sstevel@tonic-gate if (llcs[i].lc_type == ph.pc_type) { 132*0Sstevel@tonic-gate llcp = llcs + i; 133*0Sstevel@tonic-gate break; 134*0Sstevel@tonic-gate } 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate if (llcp == NULL) { 137*0Sstevel@tonic-gate (void) close(fd); 138*0Sstevel@tonic-gate return -2; 139*0Sstevel@tonic-gate } 140*0Sstevel@tonic-gate 141*0Sstevel@tonic-gate pfd = fd; 142*0Sstevel@tonic-gate s_type = ph.pc_type; 143*0Sstevel@tonic-gate printf("opened pcap file %s:\n", fname); 144*0Sstevel@tonic-gate printf("\tid: %08x version: %d.%d type: %d snap %d\n", 145*0Sstevel@tonic-gate ph.pc_id, ph.pc_v_maj, ph.pc_v_min, ph.pc_type, ph.pc_slen); 146*0Sstevel@tonic-gate 147*0Sstevel@tonic-gate return fd; 148*0Sstevel@tonic-gate } 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate static int pcap_close() 152*0Sstevel@tonic-gate { 153*0Sstevel@tonic-gate return close(pfd); 154*0Sstevel@tonic-gate } 155*0Sstevel@tonic-gate 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate /* 158*0Sstevel@tonic-gate * read in the header (and validate) which should be the first record 159*0Sstevel@tonic-gate * in a pcap file. 160*0Sstevel@tonic-gate */ 161*0Sstevel@tonic-gate static int pcap_read_rec(rec) 162*0Sstevel@tonic-gate struct pcap_pkthdr *rec; 163*0Sstevel@tonic-gate { 164*0Sstevel@tonic-gate int n, p; 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate if (read(pfd, (char *)rec, sizeof(*rec)) != sizeof(*rec)) 167*0Sstevel@tonic-gate return -2; 168*0Sstevel@tonic-gate 169*0Sstevel@tonic-gate if (swapped) { 170*0Sstevel@tonic-gate rec->ph_clen = SWAPLONG(rec->ph_clen); 171*0Sstevel@tonic-gate rec->ph_len = SWAPLONG(rec->ph_len); 172*0Sstevel@tonic-gate rec->ph_ts.tv_sec = SWAPLONG(rec->ph_ts.tv_sec); 173*0Sstevel@tonic-gate rec->ph_ts.tv_usec = SWAPLONG(rec->ph_ts.tv_usec); 174*0Sstevel@tonic-gate } 175*0Sstevel@tonic-gate p = rec->ph_clen; 176*0Sstevel@tonic-gate n = MIN(p, rec->ph_len); 177*0Sstevel@tonic-gate if (!n || n < 0) 178*0Sstevel@tonic-gate return -3; 179*0Sstevel@tonic-gate 180*0Sstevel@tonic-gate return p; 181*0Sstevel@tonic-gate } 182*0Sstevel@tonic-gate 183*0Sstevel@tonic-gate 184*0Sstevel@tonic-gate #ifdef notyet 185*0Sstevel@tonic-gate /* 186*0Sstevel@tonic-gate * read an entire pcap packet record. only the data part is copied into 187*0Sstevel@tonic-gate * the available buffer, with the number of bytes copied returned. 188*0Sstevel@tonic-gate */ 189*0Sstevel@tonic-gate static int pcap_read(buf, cnt) 190*0Sstevel@tonic-gate char *buf; 191*0Sstevel@tonic-gate int cnt; 192*0Sstevel@tonic-gate { 193*0Sstevel@tonic-gate struct pcap_pkthdr rec; 194*0Sstevel@tonic-gate static char *bufp = NULL; 195*0Sstevel@tonic-gate int i, n; 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate if ((i = pcap_read_rec(&rec)) <= 0) 198*0Sstevel@tonic-gate return i; 199*0Sstevel@tonic-gate 200*0Sstevel@tonic-gate if (!bufp) 201*0Sstevel@tonic-gate bufp = malloc(i); 202*0Sstevel@tonic-gate else 203*0Sstevel@tonic-gate bufp = realloc(bufp, i); 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate if (read(pfd, bufp, i) != i) 206*0Sstevel@tonic-gate return -2; 207*0Sstevel@tonic-gate 208*0Sstevel@tonic-gate n = MIN(i, cnt); 209*0Sstevel@tonic-gate bcopy(bufp, buf, n); 210*0Sstevel@tonic-gate return n; 211*0Sstevel@tonic-gate } 212*0Sstevel@tonic-gate #endif 213*0Sstevel@tonic-gate 214*0Sstevel@tonic-gate 215*0Sstevel@tonic-gate /* 216*0Sstevel@tonic-gate * return only an IP packet read into buf 217*0Sstevel@tonic-gate */ 218*0Sstevel@tonic-gate static int pcap_readip(buf, cnt, ifn, dir) 219*0Sstevel@tonic-gate char *buf, **ifn; 220*0Sstevel@tonic-gate int cnt, *dir; 221*0Sstevel@tonic-gate { 222*0Sstevel@tonic-gate static char *bufp = NULL; 223*0Sstevel@tonic-gate struct pcap_pkthdr rec; 224*0Sstevel@tonic-gate struct llc *l; 225*0Sstevel@tonic-gate char *s, ty[4]; 226*0Sstevel@tonic-gate int i, n; 227*0Sstevel@tonic-gate 228*0Sstevel@tonic-gate l = llcp; 229*0Sstevel@tonic-gate 230*0Sstevel@tonic-gate /* do { */ 231*0Sstevel@tonic-gate if ((i = pcap_read_rec(&rec)) <= 0) 232*0Sstevel@tonic-gate return i; 233*0Sstevel@tonic-gate 234*0Sstevel@tonic-gate if (!bufp) 235*0Sstevel@tonic-gate bufp = malloc(i); 236*0Sstevel@tonic-gate else 237*0Sstevel@tonic-gate bufp = realloc(bufp, i); 238*0Sstevel@tonic-gate s = bufp; 239*0Sstevel@tonic-gate 240*0Sstevel@tonic-gate if (read(pfd, s, i) != i) 241*0Sstevel@tonic-gate return -2; 242*0Sstevel@tonic-gate 243*0Sstevel@tonic-gate i -= l->lc_sz; 244*0Sstevel@tonic-gate s += l->lc_to; 245*0Sstevel@tonic-gate bcopy(s, ty, l->lc_tl); 246*0Sstevel@tonic-gate s += l->lc_tl; 247*0Sstevel@tonic-gate /* } while (ty[0] != 0x8 && ty[1] != 0); */ 248*0Sstevel@tonic-gate n = MIN(i, cnt); 249*0Sstevel@tonic-gate bcopy(s, buf, n); 250*0Sstevel@tonic-gate return n; 251*0Sstevel@tonic-gate } 252