contrib/ipfilter/ipft_pc.c

   1 /*
   2  * Copyright (C) 1993-2001 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  */
   6 #if defined(__sgi) && (IRIX > 602)
   7 # include <sys/ptimers.h>
   8 #endif
   9 #include <stdio.h>
  10 #include <string.h>
  11 #if !defined(__SVR4) && !defined(__GNUC__)
  12 #include <strings.h>
  13 #endif
  14 #include <sys/types.h>
  15 #include <sys/time.h>
  16 #include <stdlib.h>
  17 #include <unistd.h>
  18 #include <stddef.h>
  19 #include <sys/socket.h>
  20 #include <sys/ioctl.h>
  21 #include <sys/param.h>
  22 #include <netinet/in.h>
  23 #include <netinet/in_systm.h>
  24 #ifndef linux
  25 #include <netinet/ip_var.h>
  26 #endif
  27 #include <netinet/ip.h>
  28 #include <netinet/tcp.h>
  29 #include <net/if.h>
  30 #include "ip_compat.h"
  31 #include <netinet/tcpip.h>
  32 #include "ipf.h"
  33 #include "pcap.h"
  34 #include "bpf.h"
  35 #include "ipt.h"
  36
  37 #if !defined(lint)
  38 static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 2.2.2.5 2002/12/06 11:40:25 darrenr Exp $";
  39 #endif
  40
  41 struct  llc     {
  42         int     lc_type;
  43         int     lc_sz;  /* LLC header length */
  44         int     lc_to;  /* LLC Type offset */
  45         int     lc_tl;  /* LLC Type length */
  46 };
  47
  48 /*
  49  * While many of these maybe the same, some do have different header formats
  50  * which make this useful.
  51  */
  52
  53 static  struct  llc     llcs[] = {
  54         { DLT_NULL, 0, 0, 0 },
  55         { DLT_EN10MB, 14, 12, 2 },
  56         { DLT_EN3MB, 0, 0, 0 },
  57         { DLT_AX25, 0, 0, 0 },
  58         { DLT_PRONET, 0, 0, 0 },
  59         { DLT_CHAOS, 0, 0, 0 },
  60         { DLT_IEEE802, 0, 0, 0 },
  61         { DLT_ARCNET, 0, 0, 0 },
  62         { DLT_SLIP, 0, 0, 0 },
  63         { DLT_PPP, 0, 0, 0 },
  64         { DLT_FDDI, 0, 0, 0 },
  65 #ifdef DLT_ATMRFC1483
  66         { DLT_ATMRFC1483, 0, 0, 0 },
  67 #endif
  68         { DLT_RAW, 0, 0, 0 },
  69 #ifdef  DLT_ENC
  70         { DLT_ENC, 0, 0, 0 },
  71 #endif
  72 #ifdef  DLT_SLIP_BSDOS
  73         { DLT_SLIP_BSDOS, 0, 0, 0 },
  74 #endif
  75 #ifdef  DLT_PPP_BSDOS
  76         { DLT_PPP_BSDOS, 0, 0, 0 },
  77 #endif
  78 #ifdef  DLT_HIPPI
  79         { DLT_HIPPI, 0, 0, 0 },
  80 #endif
  81 #ifdef  DLT_HDLC
  82         { DLT_HDLC, 0, 0, 0 },
  83 #endif
  84 #ifdef  DLT_PPP_SERIAL
  85         { DLT_PPP_SERIAL, 4, 4, 0 },
  86 #endif
  87 #ifdef  DLT_PPP_ETHER
  88         { DLT_PPP_ETHER, 8, 8, 0 },
  89 #endif
  90 #ifdef  DLT_ECONET
  91         { DLT_ECONET, 0, 0, 0 },
  92 #endif
  93         { -1, -1, -1, -1 }
  94 };
  95
  96 static  int     pcap_open __P((char *));
  97 static  int     pcap_close __P((void));
  98 static  int     pcap_readip __P((char *, int, char **, int *));
  99 static  void    swap_hdr __P((pcaphdr_t *));
 100 static  int     pcap_read_rec __P((struct pcap_pkthdr *));
 101
 102 static  int     pfd = -1, s_type = -1, swapped = 0;
 103 static  struct llc      *llcp = NULL;
 104
 105 struct  ipread  pcap = { pcap_open, pcap_close, pcap_readip };
 106
 107 #define SWAPLONG(y)     \
 108         ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
 109 #define SWAPSHORT(y)    \
 110         ( (((y)&0xff)<<8) | (((y)&0xff00)>>8) )
 111
 112 static  void    swap_hdr(p)
 113 pcaphdr_t       *p;
 114 {
 115         p->pc_v_maj = SWAPSHORT(p->pc_v_maj);
 116         p->pc_v_min = SWAPSHORT(p->pc_v_min);
 117         p->pc_zone = SWAPLONG(p->pc_zone);
 118         p->pc_sigfigs = SWAPLONG(p->pc_sigfigs);
 119         p->pc_slen = SWAPLONG(p->pc_slen);
 120         p->pc_type = SWAPLONG(p->pc_type);
 121 }
 122
 123 static  int     pcap_open(fname)
 124 char    *fname;
 125 {
 126         pcaphdr_t ph;
 127         int fd, i;
 128
 129         if (pfd != -1)
 130                 return pfd;
 131
 132         if (!strcmp(fname, "-"))
 133                 fd = 0;
 134         else if ((fd = open(fname, O_RDONLY)) == -1)
 135                 return -1;
 136
 137         if (read(fd, (char *)&ph, sizeof(ph)) != sizeof(ph))
 138                 return -2;
 139
 140         if (ph.pc_id != TCPDUMP_MAGIC) {
 141                 if (SWAPLONG(ph.pc_id) != TCPDUMP_MAGIC) {
 142                         (void) close(fd);
 143                         return -2;
 144                 }
 145                 swapped = 1;
 146                 swap_hdr(&ph);
 147         }
 148
 149         if (ph.pc_v_maj != PCAP_VERSION_MAJ) {
 150                 (void) close(fd);
 151                 return -2;
 152         }
 153
 154         for (i = 0; llcs[i].lc_type != -1; i++)
 155                 if (llcs[i].lc_type == ph.pc_type) {
 156                         llcp = llcs + i;
 157                         break;
 158                 }
 159
 160         if (llcp == NULL) {
 161                 (void) close(fd);
 162                 return -2;
 163         }
 164
 165         pfd = fd;
 166         s_type = ph.pc_type;
 167         printf("opened pcap file %s:\n", fname);
 168         printf("\tid: %08x version: %d.%d type: %d snap %d\n",
 169                 ph.pc_id, ph.pc_v_maj, ph.pc_v_min, ph.pc_type, ph.pc_slen);
 170
 171         return fd;
 172 }
 173
 174
 175 static  int     pcap_close()
 176 {
 177         return close(pfd);
 178 }
 179
 180
 181 /*
 182  * read in the header (and validate) which should be the first record
 183  * in a pcap file.
 184  */
 185 static  int     pcap_read_rec(rec)
 186 struct  pcap_pkthdr *rec;
 187 {
 188         int     n, p;
 189
 190         if (read(pfd, (char *)rec, sizeof(*rec)) != sizeof(*rec))
 191                 return -2;
 192
 193         if (swapped) {
 194                 rec->ph_clen = SWAPLONG(rec->ph_clen);
 195                 rec->ph_len = SWAPLONG(rec->ph_len);
 196                 rec->ph_ts.tv_sec = SWAPLONG(rec->ph_ts.tv_sec);
 197                 rec->ph_ts.tv_usec = SWAPLONG(rec->ph_ts.tv_usec);
 198         }
 199         p = rec->ph_clen;
 200         n = MIN(p, rec->ph_len);
 201         if (!n || n < 0)
 202                 return -3;
 203
 204         return p;
 205 }
 206
 207
 208 #ifdef  notyet
 209 /*
 210  * read an entire pcap packet record.  only the data part is copied into
 211  * the available buffer, with the number of bytes copied returned.
 212  */
 213 static  int     pcap_read(buf, cnt)
 214 char    *buf;
 215 int     cnt;
 216 {
 217         struct  pcap_pkthdr rec;
 218         static  char    *bufp = NULL;
 219         int     i, n;
 220
 221         if ((i = pcap_read_rec(&rec)) <= 0)
 222                 return i;
 223
 224         if (!bufp)
 225                 bufp = malloc(i);
 226         else
 227                 bufp = realloc(bufp, i);
 228
 229         if (read(pfd, bufp, i) != i)
 230                 return -2;
 231
 232         n = MIN(i, cnt);
 233         bcopy(bufp, buf, n);
 234         return n;
 235 }
 236 #endif
 237
 238
 239 /*
 240  * return only an IP packet read into buf
 241  */
 242 static  int     pcap_readip(buf, cnt, ifn, dir)
 243 char    *buf, **ifn;
 244 int     cnt, *dir;
 245 {
 246         static  char    *bufp = NULL;
 247         struct  pcap_pkthdr rec;
 248         struct  llc     *l;
 249         char    *s, ty[4];
 250         int     i, n;
 251
 252         l = llcp;
 253
 254         /* do { */
 255                 if ((i = pcap_read_rec(&rec)) <= 0)
 256                         return i;
 257
 258                 if (!bufp)
 259                         bufp = malloc(i);
 260                 else
 261                         bufp = realloc(bufp, i);
 262                 s = bufp;
 263
 264                 if (read(pfd, s, i) != i)
 265                         return -2;
 266
 267                 i -= l->lc_sz;
 268                 s += l->lc_to;
 269                 bcopy(s, ty, l->lc_tl);
 270                 s += l->lc_tl;
 271         /* } while (ty[0] != 0x8 && ty[1] != 0); */
 272         n = MIN(i, cnt);
 273         bcopy(s, buf, n);
 274         return n;
 275 }