tcpdump.c

/*
 * Copyright (c) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
 *               2002, 2003, 2004
 *	Ohio University.
 *
 * ---
 * 
 * Starting with the release of tcptrace version 6 in 2001, tcptrace
 * is licensed under the GNU General Public License (GPL).  We believe
 * that, among the available licenses, the GPL will do the best job of
 * allowing tcptrace to continue to be a valuable, freely-available
 * and well-maintained tool for the networking community.
 *
 * Previous versions of tcptrace were released under a license that
 * was much less restrictive with respect to how tcptrace could be
 * used in commercial products.  Because of this, I am willing to
 * consider alternate license arrangements as allowed in Section 10 of
 * the GNU GPL.  Before I would consider licensing tcptrace under an
 * alternate agreement with a particular individual or company,
 * however, I would have to be convinced that such an alternative
 * would be to the greater benefit of the networking community.
 * 
 * ---
 *
 * This file is part of Tcptrace.
 *
 * Tcptrace was originally written and continues to be maintained by
 * Shawn Ostermann with the help of a group of devoted students and
 * users (see the file 'THANKS').  The work on tcptrace has been made
 * possible over the years through the generous support of NASA GRC,
 * the National Science Foundation, and Sun Microsystems.
 *
 * Tcptrace is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * Tcptrace is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Tcptrace (in the file 'COPYING'); if not, write to the
 * Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
 * MA 02111-1307 USA
 * 
 * Author:	Shawn Ostermann
 * 		School of Electrical Engineering and Computer Science
 * 		Ohio University
 * 		Athens, OH
 *		ostermann@cs.ohiou.edu
 *		http://www.tcptrace.org/
 */


#include "readtraces.h"
#include <stdio.h>

#include "tcpdump.h"
#include <pcap.h>


/* external ref, in case missing in older version */
extern int pcap_offline_read(void *, int, pcap_handler, u_char *);

/* global pointer, the pcap info header */
static pcap_t *pcap;


/* Interaction with pcap */
static struct ether_header eth_header;
#define EH_SIZE sizeof(struct ether_header)
static char *ip_buf;  /* [IP_MAXPACKET] */
static struct pcap_pkthdr *callback_phdr;
static void *callback_plast;

/* the memcpy() function that gcc likes to stuff into the program has alignment
   problems, so here's MY version.  It's only used for small stuff, so the
   copy should be "cheap", but we can't be too fancy due to alignment boo boos */
void *
MemCpy(void *vp1, void *vp2, size_t n)
{
    char *p1 = vp1;
    char *p2 = vp2;

    while (n-->0)
    *p1++=*p2++;

    return(vp1);
}

/* -------------------------------------------------*/

void *
MallocZ(
  int nbytes)
{
	char *ptr;

	ptr = malloc(nbytes);
	if (ptr == NULL) {
		perror("Malloc failed, fatal\n");
		fprintf(stderr,"\
when memory allocation fails, it's either because:\n\
1) You're out of swap space, talk to your local sysadmin about making more\n\
   (look for system commands 'swap' or 'swapon' for quick fixes)\n\
2) The amount of memory that your OS gives each process is too little\n\
   That's a system configuration issue that you'll need to discuss\n\
   with the system administrator\n\
");
		exit(2);
	}

	memset(ptr,'\00',nbytes);  /* BZERO */

	return(ptr);
}

void *
ReallocZ(
    void *oldptr,
    int obytes,
    int nbytes)
{
	char *ptr;

	ptr = realloc(oldptr,nbytes);
	if (ptr == NULL) {
		fprintf(stderr,
			"Realloc failed (%d bytes --> %d bytes), fatal\n",
			obytes, nbytes);
		perror("realloc");
		exit(2);
	}
	if (obytes < nbytes) {
	    memset((char *)ptr+obytes,'\00',nbytes-obytes);  /* BZERO */
	}

	return(ptr);
}

/* -------------------------------------------------*/

static int callback(
    char *user,
    struct pcap_pkthdr *phdr,
    char *buf)
{
    int type;
    int iplen;
    static int offset = -1;
  
    struct vlanh{
      tt_uint16 vlan_num;
      tt_uint16 vlan_proto;
    } *vlanhptr;
  
    iplen = phdr->caplen;
    if (iplen > IP_MAXPACKET)
	iplen = IP_MAXPACKET;

    type = pcap_datalink(pcap);

    /* remember the stuff we always save */
    callback_phdr = phdr;

    /* kindof ugly, but about the only way to make them fit together :-( */
    switch (type) {
      case 100:
	/* for some reason, the windows version of tcpdump is using */
	/* this.  It looks just like ethernet to me */
      case PCAP_DLT_EN10MB:
	offset = find_ip_eth(buf); /* Here we check if we are dealing with Straight Ethernet encapsulation or PPPoE */
	memcpy(&eth_header, buf, EH_SIZE); /* save ether header */
	switch (offset)
	{
		case EH_SIZE: /* straight Ethernet encapsulation */
			memcpy((char *)ip_buf,buf+offset,iplen-offset);
			callback_plast = ip_buf+iplen-offset-1;
			break;
		case PPPOE_SIZE: /* PPPoE encapsulation */
			/* we use a fake ether type here */
			eth_header.ether_type = htons(ETHERTYPE_IP);
			memcpy((char *)ip_buf,buf+offset,iplen-offset);
			callback_plast = ip_buf+iplen-offset-1;
			break;
	        case -1: /* Not an IP packet */
	                 /* Let's check if it is a VLAN header that
			  * caused us to receive -1, and if we had an IP
			  * packet buried inside */
	                if (eth_header.ether_type == htons(ETHERTYPE_VLAN)) {
			  vlanhptr=(struct vlanh*) (buf+EH_SIZE);
			  if ( (ntohs(vlanhptr->vlan_proto) == ETHERTYPE_IP)    // ||
			      // (ntohs(vlanhptr->vlan_proto) == ETHERTYPE_IPV6)
			     ) {
			    offset=EH_SIZE+sizeof(struct vlanh);
			    memcpy((char *)ip_buf,buf+offset,iplen-offset);
			    callback_plast = ip_buf+iplen-offset-1;
			    /* Set ethernet type as whatever followed the dumb
			     * VLAN header to prevent the rest of the code
			     * from ignoring us.
			     */
			    eth_header.ether_type=vlanhptr->vlan_proto;
			    break;
			    }
			}	  
			return (-1);
		default: /* should not be used, but we never know ... */
			return (-1);
	}
	break;
      case PCAP_DLT_IEEE802:
	/* just pretend it's "normal" ethernet */
	offset = 14;		/* 22 bytes of IEEE cruft */
	memcpy(&eth_header,buf,EH_SIZE);  /* save ether header */
	memcpy(ip_buf,buf+offset,iplen-offset);
	callback_plast = (char *)ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_SLIP:
	memcpy(ip_buf,buf+16,iplen-16);
	callback_plast = (char *)ip_buf+iplen-16-1;
	break;
      case PCAP_DLT_PPP:
	/* deals with raw PPP and also with HDLC PPP frames */
	offset = find_ip_ppp(buf);
	if (offset < 0) /* Not an IP packet */
		return (-1);
	memcpy((char *)ip_buf,buf+offset,iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_FDDI:
	if (offset < 0)
	      offset = find_ip_fddi(buf,iplen);
	if (offset < 0)
	      return(-1);
	memcpy((char *)ip_buf,buf+offset,iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_NULL:
	/* no phys header attached */
	offset = 4;
	memcpy((char *)ip_buf,buf+offset,iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_ATM_RFC1483:
	/* ATM RFC1483 - LLC/SNAP ecapsulated atm */
	memcpy((char*)ip_buf,buf+8,iplen-8);
	callback_plast = ip_buf+iplen-8-1;
	break;
      case PCAP_DLT_RAW:
	/* raw IP */
	offset = 0;
	memcpy((char *)ip_buf,buf+offset,iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_LINUX_SLL:
	/* linux cooked socket */
	offset = 16;
	memcpy((char *)ip_buf, buf+offset, iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      // Patch sent by Brandon Eisenamann to passby 802.11, LLC/SNAP
      // and Prism2 headers to get to the IP packet.
      case PCAP_DLT_IEEE802_11:
	offset=24+8;// 802.11 header + LLC/SNAP header
	memcpy((char *)ip_buf, buf+offset, iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_IEEE802_11_RADIO:
	offset=64+24;//WLAN header + 802.11 header
	memcpy(&eth_header,buf,EH_SIZE); // save ethernet header
	memcpy((char *)ip_buf, buf+offset, iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_PRISM2:
	offset=144+24+8; // PRISM2+IEEE 802.11+ LLC/SNAP headers
	memcpy((char *)ip_buf, buf+offset, iplen-offset);
	callback_plast = ip_buf+iplen-offset-1;
	break;
      case PCAP_DLT_C_HDLC:
	offset=4;
	memcpy((char *)ip_buf, buf+offset, iplen-offset);
	callback_plast = (char *)ip_buf+iplen-offset-1;
	break;
      default:
	fprintf(stderr,"Don't understand link-level format (%d)\n", type);

	exit(1);
    }
    
    return(0);
}


/* currently only works for ETHERNET and FDDI */
int
pread_tcpdump(
    struct timeval	*ptime,
    int		 	*plen,
    int		 	*ptlen,
    void		**pphys,
    int			*pphystype,
    struct ip		**ppip,
    void		**pplast)
{
    int ret;

    while (1) {
        if ((ret = pcap_dispatch(pcap,1,(pcap_handler)callback,0)) != 1) { //Sriharsha Gangam
	//if ((ret = pcap_offline_read(pcap,1,(pcap_handler)callback,0)) != 1) {
	    /* prob EOF */

	    if (ret == -1) {
		char *error;
		error = pcap_geterr(pcap);

		if (error && *error)
		    fprintf(stderr,"PCAP error: '%s'\n",pcap_geterr(pcap));
		/* else, it's just EOF */
	    }
	    
	    return(0);
	}



	/* at least one tcpdump implementation (AIX) seems to be */
	/* storing NANOseconds in the usecs field of the timestamp. */
	/* This confuses EVERYTHING.  Try to compensate. */
	{
	    static Bool bogus_nanoseconds = FALSE;
	    if ((callback_phdr->ts.tv_usec >= US_PER_SEC) ||
		(bogus_nanoseconds)) {
		if (!bogus_nanoseconds) {
		    fprintf(stderr,
			    "tcpdump: attempting to adapt to bogus nanosecond timestamps\n");
		    bogus_nanoseconds = TRUE;
		}
		callback_phdr->ts.tv_usec /= 1000;
	    }
	}

	/* fill in all of the return values */
	*pphys     = &eth_header;/* everything assumed to be ethernet */
	*pphystype = PHYS_ETHER; /* everything assumed to be ethernet */
	*ppip      = (struct ip *) ip_buf;
	*pplast    = callback_plast; /* last byte in IP packet */
	/* (copying time structure in 2 steps to avoid RedHat brain damage) */
	ptime->tv_usec = callback_phdr->ts.tv_usec;
	ptime->tv_sec = callback_phdr->ts.tv_sec;
	*plen      = callback_phdr->len;
	*ptlen     = callback_phdr->caplen;

	/* if it's not IP, then skip it */
	if ((ntohs(eth_header.ether_type) != ETHERTYPE_IP)) { 
         //&& (ntohs(eth_header.ether_type) != ETHERTYPE_IPV6)) {
	 //   if (debug > 2)
	 //	fprintf(stderr,"pread_tcpdump: not an IP packet\n");
	    continue;
	}

	return(1);
    }
}


int is_tcpdump(char *filename)
{
    char errbuf[100];
    char *physname = "<unknown>";
    int type;


// #ifdef __WIN32   
//      if ((pcap = pcap_open_offline(filename, errbuf)) == NULL) {
// #else       
/* kwsuh ..
      if ((pcap = pcap_open_offline("-", errbuf)) == NULL) {
*/

      if ((pcap = pcap_open_offline(filename, errbuf)) == NULL) {
// #endif /* __WIN32 */	  

	// if (debug > 2)
	//    fprintf(stderr,"PCAP said: '%s'\n", errbuf);
	rewind(stdin);
	return(0);
    }
/*
    if (debug) {
	printf("Using 'pcap' version of tcpdump\n");
	if (debug > 1) {
	    printf("\tversion_major: %d\n", pcap_major_version(pcap));
	    printf("\tversion_minor: %d\n", pcap_minor_version(pcap));
	    printf("\tsnaplen: %d\n", pcap_snapshot(pcap));
	    printf("\tlinktype: %d\n", pcap_datalink(pcap));
	    printf("\tswapped: %d\n", pcap_is_swapped(pcap));
	}
    }
*/

    /* check the phys type (pretend everything is ethernet) */
    memset(&eth_header,0,EH_SIZE);
    switch (type = pcap_datalink(pcap)) {
      case 100:
      case PCAP_DLT_EN10MB:
	/* OK, we understand this one */
	physname = "Ethernet";
	break;
      case PCAP_DLT_IEEE802:
	/* just pretend it's normal ethernet */
	physname = "Ethernet";
	break;
      case PCAP_DLT_SLIP:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "Slip";
	break;
      case PCAP_DLT_PPP:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "PPP or HDLC PPP";
	break;
      case PCAP_DLT_FDDI:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "FDDI";
	break;
      case PCAP_DLT_NULL:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "NULL";
	break;
      case PCAP_DLT_ATM_RFC1483:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "ATM, LLC/SNAP encapsulated";
	break;
      case PCAP_DLT_RAW:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "RAW_IP";
	break;
      case PCAP_DLT_LINUX_SLL:
	/* linux cooked socket type */
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "Linux Cooked Socket";
	break;
      case PCAP_DLT_IEEE802_11:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "IEEE802_11";
	break;
      case PCAP_DLT_IEEE802_11_RADIO:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "IEEE802_11_RADIO";
	break;
      case PCAP_DLT_PRISM2:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "PRISM2";
	break;
      case PCAP_DLT_C_HDLC:
	eth_header.ether_type = htons(ETHERTYPE_IP);
	physname = "Cisco HDLC";
	break;
      default:
        fprintf(stderr,"tcptrace did not understand link format (%d)!\n",type);
        fprintf(stderr,
		"\t If you can give us a capture file with this link format\n\
\t or even better, a patch to decipher this format, we shall add it in, \n\
\t in a future release.\n");
	rewind(stdin);
	return(0);
    }

    //  if (debug)
    //	fprintf(stderr,"Tcpdump format, physical type is %d (%s)\n",
    //		type, physname);

    /* set up some stuff */
    ip_buf = MallocZ(IP_MAXPACKET);


    return(1);
}