src/dump.c

   1 /*
   2  * Copyright (C) 2009, 2010  Daniel Borkmann <daniel@netsniff-ng.org> and
   3  *                           Emmanuel Roullit <emmanuel@netsniff-ng.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or (at
   8  * your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
  13  * for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin St, Fifth Floor, Boston, MA 02110, USA
  18  */
  19
  20 #include <stdio.h>
  21 #include <stdint.h>
  22 #include <stdlib.h>
  23 #include <unistd.h>
  24 #include <assert.h>
  25 #include <errno.h>
  26
  27 #include <linux/if_packet.h>
  28 #include <linux/if_ether.h>
  29
  30 #include "pcap.h"
  31 #include "dump.h"
  32 #include "macros.h"
  33
  34 int pcap_write_header(int fd, int linktype, int thiszone, int snaplen)
  35 {
  36         struct pcap_file_header hdr = { 0 };
  37
  38         assert(fd != -1);
  39
  40         hdr.magic = TCPDUMP_MAGIC;
  41         hdr.version_major = PCAP_VERSION_MAJOR;
  42         hdr.version_minor = PCAP_VERSION_MINOR;
  43
  44         hdr.thiszone = thiszone;
  45         hdr.snaplen = snaplen;
  46         hdr.sigfigs = 0;
  47         hdr.linktype = linktype;
  48
  49         if (write(fd, (char *)&hdr, sizeof(hdr)) != sizeof(hdr)) {
  50                 err("Failed to write pcap header");
  51                 return (-1);
  52         }
  53
  54         return (0);
  55 }
  56
  57 void pcap_dump(int fd, struct tpacket_hdr *tp_h, const struct ethhdr const *sp)
  58 {
  59         struct pcap_sf_pkthdr sf_hdr;
  60
  61         /* we don't memset() sf_hdr here because we are in a critical path */
  62         sf_hdr.ts.tv_sec = tp_h->tp_sec;
  63         sf_hdr.ts.tv_usec = tp_h->tp_usec;
  64         sf_hdr.caplen = tp_h->tp_snaplen;
  65         sf_hdr.len = tp_h->tp_len;
  66
  67         /*
  68          * XXX we should check the return status
  69          * but then do what just inform the user
  70          * or exit gracefully ?
  71          */
  72
  73         if (write(fd, &sf_hdr, sizeof(sf_hdr)) != sizeof(sf_hdr)
  74             || write(fd, sp, sf_hdr.len) != sf_hdr.len) {
  75                 err("Cannot write pcap header");
  76                 close(fd);
  77                 exit(EXIT_FAILURE);
  78         }
  79 }