1b00ab754SHans Petter Selasky /*
2b00ab754SHans Petter Selasky * Copyright (c) 1993, 1994, 1995, 1996, 1997
3b00ab754SHans Petter Selasky * The Regents of the University of California. All rights reserved.
4b00ab754SHans Petter Selasky *
5b00ab754SHans Petter Selasky * Redistribution and use in source and binary forms, with or without
6b00ab754SHans Petter Selasky * modification, are permitted provided that: (1) source code distributions
7b00ab754SHans Petter Selasky * retain the above copyright notice and this paragraph in its entirety, (2)
8b00ab754SHans Petter Selasky * distributions including binary code include the above copyright notice and
9b00ab754SHans Petter Selasky * this paragraph in its entirety in the documentation or other materials
10b00ab754SHans Petter Selasky * provided with the distribution, and (3) all advertising materials mentioning
11b00ab754SHans Petter Selasky * features or use of this software display the following acknowledgement:
12b00ab754SHans Petter Selasky * ``This product includes software developed by the University of California,
13b00ab754SHans Petter Selasky * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14b00ab754SHans Petter Selasky * the University nor the names of its contributors may be used to endorse
15b00ab754SHans Petter Selasky * or promote products derived from this software without specific prior
16b00ab754SHans Petter Selasky * written permission.
17b00ab754SHans Petter Selasky * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18b00ab754SHans Petter Selasky * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19b00ab754SHans Petter Selasky * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20b00ab754SHans Petter Selasky *
21b00ab754SHans Petter Selasky * sf-pcapng.c - pcapng-file-format-specific code from savefile.c
22b00ab754SHans Petter Selasky */
23b00ab754SHans Petter Selasky
24b00ab754SHans Petter Selasky #ifdef HAVE_CONFIG_H
25b00ab754SHans Petter Selasky #include <config.h>
26b00ab754SHans Petter Selasky #endif
27b00ab754SHans Petter Selasky
28b00ab754SHans Petter Selasky #include <pcap/pcap-inttypes.h>
29b00ab754SHans Petter Selasky
30b00ab754SHans Petter Selasky #include <errno.h>
31b00ab754SHans Petter Selasky #include <memory.h>
32b00ab754SHans Petter Selasky #include <stdio.h>
33b00ab754SHans Petter Selasky #include <stdlib.h>
34b00ab754SHans Petter Selasky #include <string.h>
35b00ab754SHans Petter Selasky
36b00ab754SHans Petter Selasky #include "pcap-int.h"
37*6f9cba8fSJoseph Mingrone #include "pcap-util.h"
38b00ab754SHans Petter Selasky
39b00ab754SHans Petter Selasky #include "pcap-common.h"
40b00ab754SHans Petter Selasky
41b00ab754SHans Petter Selasky #ifdef HAVE_OS_PROTO_H
42b00ab754SHans Petter Selasky #include "os-proto.h"
43b00ab754SHans Petter Selasky #endif
44b00ab754SHans Petter Selasky
45b00ab754SHans Petter Selasky #include "sf-pcapng.h"
46b00ab754SHans Petter Selasky
47b00ab754SHans Petter Selasky /*
48b00ab754SHans Petter Selasky * Block types.
49b00ab754SHans Petter Selasky */
50b00ab754SHans Petter Selasky
51b00ab754SHans Petter Selasky /*
52b00ab754SHans Petter Selasky * Common part at the beginning of all blocks.
53b00ab754SHans Petter Selasky */
54b00ab754SHans Petter Selasky struct block_header {
55b00ab754SHans Petter Selasky bpf_u_int32 block_type;
56b00ab754SHans Petter Selasky bpf_u_int32 total_length;
57b00ab754SHans Petter Selasky };
58b00ab754SHans Petter Selasky
59b00ab754SHans Petter Selasky /*
60b00ab754SHans Petter Selasky * Common trailer at the end of all blocks.
61b00ab754SHans Petter Selasky */
62b00ab754SHans Petter Selasky struct block_trailer {
63b00ab754SHans Petter Selasky bpf_u_int32 total_length;
64b00ab754SHans Petter Selasky };
65b00ab754SHans Petter Selasky
66b00ab754SHans Petter Selasky /*
67b00ab754SHans Petter Selasky * Common options.
68b00ab754SHans Petter Selasky */
69b00ab754SHans Petter Selasky #define OPT_ENDOFOPT 0 /* end of options */
70b00ab754SHans Petter Selasky #define OPT_COMMENT 1 /* comment string */
71b00ab754SHans Petter Selasky
72b00ab754SHans Petter Selasky /*
73b00ab754SHans Petter Selasky * Option header.
74b00ab754SHans Petter Selasky */
75b00ab754SHans Petter Selasky struct option_header {
76b00ab754SHans Petter Selasky u_short option_code;
77b00ab754SHans Petter Selasky u_short option_length;
78b00ab754SHans Petter Selasky };
79b00ab754SHans Petter Selasky
80b00ab754SHans Petter Selasky /*
81b00ab754SHans Petter Selasky * Structures for the part of each block type following the common
82b00ab754SHans Petter Selasky * part.
83b00ab754SHans Petter Selasky */
84b00ab754SHans Petter Selasky
85b00ab754SHans Petter Selasky /*
86b00ab754SHans Petter Selasky * Section Header Block.
87b00ab754SHans Petter Selasky */
88b00ab754SHans Petter Selasky #define BT_SHB 0x0A0D0D0A
8957e22627SCy Schubert #define BT_SHB_INSANE_MAX 1024U*1024U*1U /* 1MB should be enough */
90b00ab754SHans Petter Selasky struct section_header_block {
91b00ab754SHans Petter Selasky bpf_u_int32 byte_order_magic;
92b00ab754SHans Petter Selasky u_short major_version;
93b00ab754SHans Petter Selasky u_short minor_version;
94b00ab754SHans Petter Selasky uint64_t section_length;
95b00ab754SHans Petter Selasky /* followed by options and trailer */
96b00ab754SHans Petter Selasky };
97b00ab754SHans Petter Selasky
98b00ab754SHans Petter Selasky /*
99b00ab754SHans Petter Selasky * Byte-order magic value.
100b00ab754SHans Petter Selasky */
101b00ab754SHans Petter Selasky #define BYTE_ORDER_MAGIC 0x1A2B3C4D
102b00ab754SHans Petter Selasky
103b00ab754SHans Petter Selasky /*
104b00ab754SHans Petter Selasky * Current version number. If major_version isn't PCAP_NG_VERSION_MAJOR,
105*6f9cba8fSJoseph Mingrone * or if minor_version isn't PCAP_NG_VERSION_MINOR or 2, that means that
106*6f9cba8fSJoseph Mingrone * this code can't read the file.
107b00ab754SHans Petter Selasky */
108b00ab754SHans Petter Selasky #define PCAP_NG_VERSION_MAJOR 1
109b00ab754SHans Petter Selasky #define PCAP_NG_VERSION_MINOR 0
110b00ab754SHans Petter Selasky
111b00ab754SHans Petter Selasky /*
112b00ab754SHans Petter Selasky * Interface Description Block.
113b00ab754SHans Petter Selasky */
114b00ab754SHans Petter Selasky #define BT_IDB 0x00000001
115b00ab754SHans Petter Selasky
116b00ab754SHans Petter Selasky struct interface_description_block {
117b00ab754SHans Petter Selasky u_short linktype;
118b00ab754SHans Petter Selasky u_short reserved;
119b00ab754SHans Petter Selasky bpf_u_int32 snaplen;
120b00ab754SHans Petter Selasky /* followed by options and trailer */
121b00ab754SHans Petter Selasky };
122b00ab754SHans Petter Selasky
123b00ab754SHans Petter Selasky /*
124b00ab754SHans Petter Selasky * Options in the IDB.
125b00ab754SHans Petter Selasky */
126b00ab754SHans Petter Selasky #define IF_NAME 2 /* interface name string */
127b00ab754SHans Petter Selasky #define IF_DESCRIPTION 3 /* interface description string */
128b00ab754SHans Petter Selasky #define IF_IPV4ADDR 4 /* interface's IPv4 address and netmask */
129b00ab754SHans Petter Selasky #define IF_IPV6ADDR 5 /* interface's IPv6 address and prefix length */
130b00ab754SHans Petter Selasky #define IF_MACADDR 6 /* interface's MAC address */
131b00ab754SHans Petter Selasky #define IF_EUIADDR 7 /* interface's EUI address */
132b00ab754SHans Petter Selasky #define IF_SPEED 8 /* interface's speed, in bits/s */
133b00ab754SHans Petter Selasky #define IF_TSRESOL 9 /* interface's time stamp resolution */
134b00ab754SHans Petter Selasky #define IF_TZONE 10 /* interface's time zone */
135b00ab754SHans Petter Selasky #define IF_FILTER 11 /* filter used when capturing on interface */
136b00ab754SHans Petter Selasky #define IF_OS 12 /* string OS on which capture on this interface was done */
137b00ab754SHans Petter Selasky #define IF_FCSLEN 13 /* FCS length for this interface */
138b00ab754SHans Petter Selasky #define IF_TSOFFSET 14 /* time stamp offset for this interface */
139b00ab754SHans Petter Selasky
140b00ab754SHans Petter Selasky /*
141b00ab754SHans Petter Selasky * Enhanced Packet Block.
142b00ab754SHans Petter Selasky */
143b00ab754SHans Petter Selasky #define BT_EPB 0x00000006
144b00ab754SHans Petter Selasky
145b00ab754SHans Petter Selasky struct enhanced_packet_block {
146b00ab754SHans Petter Selasky bpf_u_int32 interface_id;
147b00ab754SHans Petter Selasky bpf_u_int32 timestamp_high;
148b00ab754SHans Petter Selasky bpf_u_int32 timestamp_low;
149b00ab754SHans Petter Selasky bpf_u_int32 caplen;
150b00ab754SHans Petter Selasky bpf_u_int32 len;
151b00ab754SHans Petter Selasky /* followed by packet data, options, and trailer */
152b00ab754SHans Petter Selasky };
153b00ab754SHans Petter Selasky
154b00ab754SHans Petter Selasky /*
155b00ab754SHans Petter Selasky * Simple Packet Block.
156b00ab754SHans Petter Selasky */
157b00ab754SHans Petter Selasky #define BT_SPB 0x00000003
158b00ab754SHans Petter Selasky
159b00ab754SHans Petter Selasky struct simple_packet_block {
160b00ab754SHans Petter Selasky bpf_u_int32 len;
161b00ab754SHans Petter Selasky /* followed by packet data and trailer */
162b00ab754SHans Petter Selasky };
163b00ab754SHans Petter Selasky
164b00ab754SHans Petter Selasky /*
165b00ab754SHans Petter Selasky * Packet Block.
166b00ab754SHans Petter Selasky */
167b00ab754SHans Petter Selasky #define BT_PB 0x00000002
168b00ab754SHans Petter Selasky
169b00ab754SHans Petter Selasky struct packet_block {
170b00ab754SHans Petter Selasky u_short interface_id;
171b00ab754SHans Petter Selasky u_short drops_count;
172b00ab754SHans Petter Selasky bpf_u_int32 timestamp_high;
173b00ab754SHans Petter Selasky bpf_u_int32 timestamp_low;
174b00ab754SHans Petter Selasky bpf_u_int32 caplen;
175b00ab754SHans Petter Selasky bpf_u_int32 len;
176b00ab754SHans Petter Selasky /* followed by packet data, options, and trailer */
177b00ab754SHans Petter Selasky };
178b00ab754SHans Petter Selasky
179b00ab754SHans Petter Selasky /*
180b00ab754SHans Petter Selasky * Block cursor - used when processing the contents of a block.
181b00ab754SHans Petter Selasky * Contains a pointer into the data being processed and a count
182b00ab754SHans Petter Selasky * of bytes remaining in the block.
183b00ab754SHans Petter Selasky */
184b00ab754SHans Petter Selasky struct block_cursor {
185b00ab754SHans Petter Selasky u_char *data;
186b00ab754SHans Petter Selasky size_t data_remaining;
187b00ab754SHans Petter Selasky bpf_u_int32 block_type;
188b00ab754SHans Petter Selasky };
189b00ab754SHans Petter Selasky
190b00ab754SHans Petter Selasky typedef enum {
191b00ab754SHans Petter Selasky PASS_THROUGH,
192b00ab754SHans Petter Selasky SCALE_UP_DEC,
193b00ab754SHans Petter Selasky SCALE_DOWN_DEC,
194b00ab754SHans Petter Selasky SCALE_UP_BIN,
195b00ab754SHans Petter Selasky SCALE_DOWN_BIN
196b00ab754SHans Petter Selasky } tstamp_scale_type_t;
197b00ab754SHans Petter Selasky
198b00ab754SHans Petter Selasky /*
199b00ab754SHans Petter Selasky * Per-interface information.
200b00ab754SHans Petter Selasky */
201b00ab754SHans Petter Selasky struct pcap_ng_if {
202*6f9cba8fSJoseph Mingrone uint32_t snaplen; /* snapshot length */
20357e22627SCy Schubert uint64_t tsresol; /* time stamp resolution */
204b00ab754SHans Petter Selasky tstamp_scale_type_t scale_type; /* how to scale */
20557e22627SCy Schubert uint64_t scale_factor; /* time stamp scale factor for power-of-10 tsresol */
206b00ab754SHans Petter Selasky uint64_t tsoffset; /* time stamp offset */
207b00ab754SHans Petter Selasky };
208b00ab754SHans Petter Selasky
209b00ab754SHans Petter Selasky /*
210b00ab754SHans Petter Selasky * Per-pcap_t private data.
211b00ab754SHans Petter Selasky *
212b00ab754SHans Petter Selasky * max_blocksize is the maximum size of a block that we'll accept. We
213b00ab754SHans Petter Selasky * reject blocks bigger than this, so we don't consume too much memory
214b00ab754SHans Petter Selasky * with a truly huge block. It can change as we see IDBs with different
215b00ab754SHans Petter Selasky * link-layer header types. (Currently, we don't support IDBs with
216b00ab754SHans Petter Selasky * different link-layer header types, but we will support it in the
217b00ab754SHans Petter Selasky * future, when we offer file-reading APIs that support it.)
218b00ab754SHans Petter Selasky *
219b00ab754SHans Petter Selasky * XXX - that's an issue on ILP32 platforms, where the maximum block
220b00ab754SHans Petter Selasky * size of 2^31-1 would eat all but one byte of the entire address space.
221b00ab754SHans Petter Selasky * It's less of an issue on ILP64/LLP64 platforms, but the actual size
222b00ab754SHans Petter Selasky * of the address space may be limited by 1) the number of *significant*
223b00ab754SHans Petter Selasky * address bits (currently, x86-64 only supports 48 bits of address), 2)
224b00ab754SHans Petter Selasky * any limitations imposed by the operating system; 3) any limitations
225b00ab754SHans Petter Selasky * imposed by the amount of available backing store for anonymous pages,
226b00ab754SHans Petter Selasky * so we impose a limit regardless of the size of a pointer.
227b00ab754SHans Petter Selasky */
228b00ab754SHans Petter Selasky struct pcap_ng_sf {
22957e22627SCy Schubert uint64_t user_tsresol; /* time stamp resolution requested by the user */
230b00ab754SHans Petter Selasky u_int max_blocksize; /* don't grow buffer size past this */
231b00ab754SHans Petter Selasky bpf_u_int32 ifcount; /* number of interfaces seen in this capture */
232b00ab754SHans Petter Selasky bpf_u_int32 ifaces_size; /* size of array below */
233b00ab754SHans Petter Selasky struct pcap_ng_if *ifaces; /* array of interface information */
234b00ab754SHans Petter Selasky };
235b00ab754SHans Petter Selasky
236b00ab754SHans Petter Selasky /*
23757e22627SCy Schubert * The maximum block size we start with; we use an arbitrary value of
23857e22627SCy Schubert * 16 MiB.
239b00ab754SHans Petter Selasky */
24057e22627SCy Schubert #define INITIAL_MAX_BLOCKSIZE (16*1024*1024)
24157e22627SCy Schubert
24257e22627SCy Schubert /*
24357e22627SCy Schubert * Maximum block size for a given maximum snapshot length; we define it
24457e22627SCy Schubert * as the size of an EPB with a max_snaplen-sized packet and 128KB of
24557e22627SCy Schubert * options.
24657e22627SCy Schubert */
24757e22627SCy Schubert #define MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen) \
24857e22627SCy Schubert (sizeof (struct block_header) + \
249b00ab754SHans Petter Selasky sizeof (struct enhanced_packet_block) + \
250b00ab754SHans Petter Selasky (max_snaplen) + 131072 + \
251b00ab754SHans Petter Selasky sizeof (struct block_trailer))
252b00ab754SHans Petter Selasky
253b00ab754SHans Petter Selasky static void pcap_ng_cleanup(pcap_t *p);
254b00ab754SHans Petter Selasky static int pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr,
255b00ab754SHans Petter Selasky u_char **data);
256b00ab754SHans Petter Selasky
257b00ab754SHans Petter Selasky static int
read_bytes(FILE * fp,void * buf,size_t bytes_to_read,int fail_on_eof,char * errbuf)258b00ab754SHans Petter Selasky read_bytes(FILE *fp, void *buf, size_t bytes_to_read, int fail_on_eof,
259b00ab754SHans Petter Selasky char *errbuf)
260b00ab754SHans Petter Selasky {
261b00ab754SHans Petter Selasky size_t amt_read;
262b00ab754SHans Petter Selasky
263b00ab754SHans Petter Selasky amt_read = fread(buf, 1, bytes_to_read, fp);
264b00ab754SHans Petter Selasky if (amt_read != bytes_to_read) {
265b00ab754SHans Petter Selasky if (ferror(fp)) {
266b00ab754SHans Petter Selasky pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
267b00ab754SHans Petter Selasky errno, "error reading dump file");
268b00ab754SHans Petter Selasky } else {
269b00ab754SHans Petter Selasky if (amt_read == 0 && !fail_on_eof)
270b00ab754SHans Petter Selasky return (0); /* EOF */
271*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
272*6f9cba8fSJoseph Mingrone "truncated pcapng dump file; tried to read %zu bytes, only got %zu",
27357e22627SCy Schubert bytes_to_read, amt_read);
274b00ab754SHans Petter Selasky }
275b00ab754SHans Petter Selasky return (-1);
276b00ab754SHans Petter Selasky }
277b00ab754SHans Petter Selasky return (1);
278b00ab754SHans Petter Selasky }
279b00ab754SHans Petter Selasky
280b00ab754SHans Petter Selasky static int
read_block(FILE * fp,pcap_t * p,struct block_cursor * cursor,char * errbuf)281b00ab754SHans Petter Selasky read_block(FILE *fp, pcap_t *p, struct block_cursor *cursor, char *errbuf)
282b00ab754SHans Petter Selasky {
283b00ab754SHans Petter Selasky struct pcap_ng_sf *ps;
284b00ab754SHans Petter Selasky int status;
285b00ab754SHans Petter Selasky struct block_header bhdr;
28657e22627SCy Schubert struct block_trailer *btrlr;
287b00ab754SHans Petter Selasky u_char *bdata;
288b00ab754SHans Petter Selasky size_t data_remaining;
289b00ab754SHans Petter Selasky
290b00ab754SHans Petter Selasky ps = p->priv;
291b00ab754SHans Petter Selasky
292b00ab754SHans Petter Selasky status = read_bytes(fp, &bhdr, sizeof(bhdr), 0, errbuf);
293b00ab754SHans Petter Selasky if (status <= 0)
294b00ab754SHans Petter Selasky return (status); /* error or EOF */
295b00ab754SHans Petter Selasky
296b00ab754SHans Petter Selasky if (p->swapped) {
297b00ab754SHans Petter Selasky bhdr.block_type = SWAPLONG(bhdr.block_type);
298b00ab754SHans Petter Selasky bhdr.total_length = SWAPLONG(bhdr.total_length);
299b00ab754SHans Petter Selasky }
300b00ab754SHans Petter Selasky
301b00ab754SHans Petter Selasky /*
302b00ab754SHans Petter Selasky * Is this block "too small" - i.e., is it shorter than a block
303b00ab754SHans Petter Selasky * header plus a block trailer?
304b00ab754SHans Petter Selasky */
305b00ab754SHans Petter Selasky if (bhdr.total_length < sizeof(struct block_header) +
306b00ab754SHans Petter Selasky sizeof(struct block_trailer)) {
307*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
308*6f9cba8fSJoseph Mingrone "block in pcapng dump file has a length of %u < %zu",
309b00ab754SHans Petter Selasky bhdr.total_length,
31057e22627SCy Schubert sizeof(struct block_header) + sizeof(struct block_trailer));
31157e22627SCy Schubert return (-1);
31257e22627SCy Schubert }
31357e22627SCy Schubert
31457e22627SCy Schubert /*
31557e22627SCy Schubert * Is the block total length a multiple of 4?
31657e22627SCy Schubert */
31757e22627SCy Schubert if ((bhdr.total_length % 4) != 0) {
31857e22627SCy Schubert /*
31957e22627SCy Schubert * No. Report that as an error.
32057e22627SCy Schubert */
321*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
322*6f9cba8fSJoseph Mingrone "block in pcapng dump file has a length of %u that is not a multiple of 4",
32357e22627SCy Schubert bhdr.total_length);
324b00ab754SHans Petter Selasky return (-1);
325b00ab754SHans Petter Selasky }
326b00ab754SHans Petter Selasky
327b00ab754SHans Petter Selasky /*
328b00ab754SHans Petter Selasky * Is the buffer big enough?
329b00ab754SHans Petter Selasky */
330b00ab754SHans Petter Selasky if (p->bufsize < bhdr.total_length) {
331b00ab754SHans Petter Selasky /*
33257e22627SCy Schubert * No - make it big enough, unless it's too big, in
33357e22627SCy Schubert * which case we fail.
334b00ab754SHans Petter Selasky */
335b00ab754SHans Petter Selasky void *bigger_buffer;
336b00ab754SHans Petter Selasky
337b00ab754SHans Petter Selasky if (bhdr.total_length > ps->max_blocksize) {
338*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE, "pcapng block size %u > maximum %u", bhdr.total_length,
339b00ab754SHans Petter Selasky ps->max_blocksize);
340b00ab754SHans Petter Selasky return (-1);
341b00ab754SHans Petter Selasky }
342b00ab754SHans Petter Selasky bigger_buffer = realloc(p->buffer, bhdr.total_length);
343b00ab754SHans Petter Selasky if (bigger_buffer == NULL) {
344*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
345b00ab754SHans Petter Selasky return (-1);
346b00ab754SHans Petter Selasky }
347b00ab754SHans Petter Selasky p->buffer = bigger_buffer;
348b00ab754SHans Petter Selasky }
349b00ab754SHans Petter Selasky
350b00ab754SHans Petter Selasky /*
351b00ab754SHans Petter Selasky * Copy the stuff we've read to the buffer, and read the rest
352b00ab754SHans Petter Selasky * of the block.
353b00ab754SHans Petter Selasky */
354b00ab754SHans Petter Selasky memcpy(p->buffer, &bhdr, sizeof(bhdr));
355b00ab754SHans Petter Selasky bdata = (u_char *)p->buffer + sizeof(bhdr);
356b00ab754SHans Petter Selasky data_remaining = bhdr.total_length - sizeof(bhdr);
357b00ab754SHans Petter Selasky if (read_bytes(fp, bdata, data_remaining, 1, errbuf) == -1)
358b00ab754SHans Petter Selasky return (-1);
359b00ab754SHans Petter Selasky
360b00ab754SHans Petter Selasky /*
36157e22627SCy Schubert * Get the block size from the trailer.
36257e22627SCy Schubert */
36357e22627SCy Schubert btrlr = (struct block_trailer *)(bdata + data_remaining - sizeof (struct block_trailer));
36457e22627SCy Schubert if (p->swapped)
36557e22627SCy Schubert btrlr->total_length = SWAPLONG(btrlr->total_length);
36657e22627SCy Schubert
36757e22627SCy Schubert /*
36857e22627SCy Schubert * Is the total length from the trailer the same as the total
36957e22627SCy Schubert * length from the header?
37057e22627SCy Schubert */
37157e22627SCy Schubert if (bhdr.total_length != btrlr->total_length) {
37257e22627SCy Schubert /*
37357e22627SCy Schubert * No.
37457e22627SCy Schubert */
375*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
37657e22627SCy Schubert "block total length in header and trailer don't match");
37757e22627SCy Schubert return (-1);
37857e22627SCy Schubert }
37957e22627SCy Schubert
38057e22627SCy Schubert /*
381b00ab754SHans Petter Selasky * Initialize the cursor.
382b00ab754SHans Petter Selasky */
383b00ab754SHans Petter Selasky cursor->data = bdata;
384b00ab754SHans Petter Selasky cursor->data_remaining = data_remaining - sizeof(struct block_trailer);
385b00ab754SHans Petter Selasky cursor->block_type = bhdr.block_type;
386b00ab754SHans Petter Selasky return (1);
387b00ab754SHans Petter Selasky }
388b00ab754SHans Petter Selasky
389b00ab754SHans Petter Selasky static void *
get_from_block_data(struct block_cursor * cursor,size_t chunk_size,char * errbuf)390b00ab754SHans Petter Selasky get_from_block_data(struct block_cursor *cursor, size_t chunk_size,
391b00ab754SHans Petter Selasky char *errbuf)
392b00ab754SHans Petter Selasky {
393b00ab754SHans Petter Selasky void *data;
394b00ab754SHans Petter Selasky
395b00ab754SHans Petter Selasky /*
396b00ab754SHans Petter Selasky * Make sure we have the specified amount of data remaining in
397b00ab754SHans Petter Selasky * the block data.
398b00ab754SHans Petter Selasky */
399b00ab754SHans Petter Selasky if (cursor->data_remaining < chunk_size) {
400*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
401b00ab754SHans Petter Selasky "block of type %u in pcapng dump file is too short",
402b00ab754SHans Petter Selasky cursor->block_type);
403b00ab754SHans Petter Selasky return (NULL);
404b00ab754SHans Petter Selasky }
405b00ab754SHans Petter Selasky
406b00ab754SHans Petter Selasky /*
407b00ab754SHans Petter Selasky * Return the current pointer, and skip past the chunk.
408b00ab754SHans Petter Selasky */
409b00ab754SHans Petter Selasky data = cursor->data;
410b00ab754SHans Petter Selasky cursor->data += chunk_size;
411b00ab754SHans Petter Selasky cursor->data_remaining -= chunk_size;
412b00ab754SHans Petter Selasky return (data);
413b00ab754SHans Petter Selasky }
414b00ab754SHans Petter Selasky
415b00ab754SHans Petter Selasky static struct option_header *
get_opthdr_from_block_data(pcap_t * p,struct block_cursor * cursor,char * errbuf)416b00ab754SHans Petter Selasky get_opthdr_from_block_data(pcap_t *p, struct block_cursor *cursor, char *errbuf)
417b00ab754SHans Petter Selasky {
418b00ab754SHans Petter Selasky struct option_header *opthdr;
419b00ab754SHans Petter Selasky
420b00ab754SHans Petter Selasky opthdr = get_from_block_data(cursor, sizeof(*opthdr), errbuf);
421b00ab754SHans Petter Selasky if (opthdr == NULL) {
422b00ab754SHans Petter Selasky /*
423b00ab754SHans Petter Selasky * Option header is cut short.
424b00ab754SHans Petter Selasky */
425b00ab754SHans Petter Selasky return (NULL);
426b00ab754SHans Petter Selasky }
427b00ab754SHans Petter Selasky
428b00ab754SHans Petter Selasky /*
429b00ab754SHans Petter Selasky * Byte-swap it if necessary.
430b00ab754SHans Petter Selasky */
431b00ab754SHans Petter Selasky if (p->swapped) {
432b00ab754SHans Petter Selasky opthdr->option_code = SWAPSHORT(opthdr->option_code);
433b00ab754SHans Petter Selasky opthdr->option_length = SWAPSHORT(opthdr->option_length);
434b00ab754SHans Petter Selasky }
435b00ab754SHans Petter Selasky
436b00ab754SHans Petter Selasky return (opthdr);
437b00ab754SHans Petter Selasky }
438b00ab754SHans Petter Selasky
439b00ab754SHans Petter Selasky static void *
get_optvalue_from_block_data(struct block_cursor * cursor,struct option_header * opthdr,char * errbuf)440b00ab754SHans Petter Selasky get_optvalue_from_block_data(struct block_cursor *cursor,
441b00ab754SHans Petter Selasky struct option_header *opthdr, char *errbuf)
442b00ab754SHans Petter Selasky {
443b00ab754SHans Petter Selasky size_t padded_option_len;
444b00ab754SHans Petter Selasky void *optvalue;
445b00ab754SHans Petter Selasky
446b00ab754SHans Petter Selasky /* Pad option length to 4-byte boundary */
447b00ab754SHans Petter Selasky padded_option_len = opthdr->option_length;
448b00ab754SHans Petter Selasky padded_option_len = ((padded_option_len + 3)/4)*4;
449b00ab754SHans Petter Selasky
450b00ab754SHans Petter Selasky optvalue = get_from_block_data(cursor, padded_option_len, errbuf);
451b00ab754SHans Petter Selasky if (optvalue == NULL) {
452b00ab754SHans Petter Selasky /*
453b00ab754SHans Petter Selasky * Option value is cut short.
454b00ab754SHans Petter Selasky */
455b00ab754SHans Petter Selasky return (NULL);
456b00ab754SHans Petter Selasky }
457b00ab754SHans Petter Selasky
458b00ab754SHans Petter Selasky return (optvalue);
459b00ab754SHans Petter Selasky }
460b00ab754SHans Petter Selasky
461b00ab754SHans Petter Selasky static int
process_idb_options(pcap_t * p,struct block_cursor * cursor,uint64_t * tsresol,uint64_t * tsoffset,int * is_binary,char * errbuf)46257e22627SCy Schubert process_idb_options(pcap_t *p, struct block_cursor *cursor, uint64_t *tsresol,
463b00ab754SHans Petter Selasky uint64_t *tsoffset, int *is_binary, char *errbuf)
464b00ab754SHans Petter Selasky {
465b00ab754SHans Petter Selasky struct option_header *opthdr;
466b00ab754SHans Petter Selasky void *optvalue;
467b00ab754SHans Petter Selasky int saw_tsresol, saw_tsoffset;
46857e22627SCy Schubert uint8_t tsresol_opt;
469b00ab754SHans Petter Selasky u_int i;
470b00ab754SHans Petter Selasky
471b00ab754SHans Petter Selasky saw_tsresol = 0;
472b00ab754SHans Petter Selasky saw_tsoffset = 0;
473b00ab754SHans Petter Selasky while (cursor->data_remaining != 0) {
474b00ab754SHans Petter Selasky /*
475b00ab754SHans Petter Selasky * Get the option header.
476b00ab754SHans Petter Selasky */
477b00ab754SHans Petter Selasky opthdr = get_opthdr_from_block_data(p, cursor, errbuf);
478b00ab754SHans Petter Selasky if (opthdr == NULL) {
479b00ab754SHans Petter Selasky /*
480b00ab754SHans Petter Selasky * Option header is cut short.
481b00ab754SHans Petter Selasky */
482b00ab754SHans Petter Selasky return (-1);
483b00ab754SHans Petter Selasky }
484b00ab754SHans Petter Selasky
485b00ab754SHans Petter Selasky /*
486b00ab754SHans Petter Selasky * Get option value.
487b00ab754SHans Petter Selasky */
488b00ab754SHans Petter Selasky optvalue = get_optvalue_from_block_data(cursor, opthdr,
489b00ab754SHans Petter Selasky errbuf);
490b00ab754SHans Petter Selasky if (optvalue == NULL) {
491b00ab754SHans Petter Selasky /*
492b00ab754SHans Petter Selasky * Option value is cut short.
493b00ab754SHans Petter Selasky */
494b00ab754SHans Petter Selasky return (-1);
495b00ab754SHans Petter Selasky }
496b00ab754SHans Petter Selasky
497b00ab754SHans Petter Selasky switch (opthdr->option_code) {
498b00ab754SHans Petter Selasky
499b00ab754SHans Petter Selasky case OPT_ENDOFOPT:
500b00ab754SHans Petter Selasky if (opthdr->option_length != 0) {
501*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
502b00ab754SHans Petter Selasky "Interface Description Block has opt_endofopt option with length %u != 0",
503b00ab754SHans Petter Selasky opthdr->option_length);
504b00ab754SHans Petter Selasky return (-1);
505b00ab754SHans Petter Selasky }
506b00ab754SHans Petter Selasky goto done;
507b00ab754SHans Petter Selasky
508b00ab754SHans Petter Selasky case IF_TSRESOL:
509b00ab754SHans Petter Selasky if (opthdr->option_length != 1) {
510*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
511b00ab754SHans Petter Selasky "Interface Description Block has if_tsresol option with length %u != 1",
512b00ab754SHans Petter Selasky opthdr->option_length);
513b00ab754SHans Petter Selasky return (-1);
514b00ab754SHans Petter Selasky }
515b00ab754SHans Petter Selasky if (saw_tsresol) {
516*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
517b00ab754SHans Petter Selasky "Interface Description Block has more than one if_tsresol option");
518b00ab754SHans Petter Selasky return (-1);
519b00ab754SHans Petter Selasky }
520b00ab754SHans Petter Selasky saw_tsresol = 1;
521b00ab754SHans Petter Selasky memcpy(&tsresol_opt, optvalue, sizeof(tsresol_opt));
522b00ab754SHans Petter Selasky if (tsresol_opt & 0x80) {
523b00ab754SHans Petter Selasky /*
524b00ab754SHans Petter Selasky * Resolution is negative power of 2.
525b00ab754SHans Petter Selasky */
52657e22627SCy Schubert uint8_t tsresol_shift = (tsresol_opt & 0x7F);
52757e22627SCy Schubert
52857e22627SCy Schubert if (tsresol_shift > 63) {
52957e22627SCy Schubert /*
53057e22627SCy Schubert * Resolution is too high; 2^-{res}
53157e22627SCy Schubert * won't fit in a 64-bit value.
53257e22627SCy Schubert */
533*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
53457e22627SCy Schubert "Interface Description Block if_tsresol option resolution 2^-%u is too high",
53557e22627SCy Schubert tsresol_shift);
53657e22627SCy Schubert return (-1);
53757e22627SCy Schubert }
538b00ab754SHans Petter Selasky *is_binary = 1;
53957e22627SCy Schubert *tsresol = ((uint64_t)1) << tsresol_shift;
540b00ab754SHans Petter Selasky } else {
541b00ab754SHans Petter Selasky /*
542b00ab754SHans Petter Selasky * Resolution is negative power of 10.
543b00ab754SHans Petter Selasky */
54457e22627SCy Schubert if (tsresol_opt > 19) {
54557e22627SCy Schubert /*
54657e22627SCy Schubert * Resolution is too high; 2^-{res}
54757e22627SCy Schubert * won't fit in a 64-bit value (the
54857e22627SCy Schubert * largest power of 10 that fits
54957e22627SCy Schubert * in a 64-bit value is 10^19, as
55057e22627SCy Schubert * the largest 64-bit unsigned
55157e22627SCy Schubert * value is ~1.8*10^19).
55257e22627SCy Schubert */
553*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
55457e22627SCy Schubert "Interface Description Block if_tsresol option resolution 10^-%u is too high",
55557e22627SCy Schubert tsresol_opt);
55657e22627SCy Schubert return (-1);
55757e22627SCy Schubert }
558b00ab754SHans Petter Selasky *is_binary = 0;
559b00ab754SHans Petter Selasky *tsresol = 1;
560b00ab754SHans Petter Selasky for (i = 0; i < tsresol_opt; i++)
561b00ab754SHans Petter Selasky *tsresol *= 10;
562b00ab754SHans Petter Selasky }
563b00ab754SHans Petter Selasky break;
564b00ab754SHans Petter Selasky
565b00ab754SHans Petter Selasky case IF_TSOFFSET:
566b00ab754SHans Petter Selasky if (opthdr->option_length != 8) {
567*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
568b00ab754SHans Petter Selasky "Interface Description Block has if_tsoffset option with length %u != 8",
569b00ab754SHans Petter Selasky opthdr->option_length);
570b00ab754SHans Petter Selasky return (-1);
571b00ab754SHans Petter Selasky }
572b00ab754SHans Petter Selasky if (saw_tsoffset) {
573*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
574b00ab754SHans Petter Selasky "Interface Description Block has more than one if_tsoffset option");
575b00ab754SHans Petter Selasky return (-1);
576b00ab754SHans Petter Selasky }
577b00ab754SHans Petter Selasky saw_tsoffset = 1;
578b00ab754SHans Petter Selasky memcpy(tsoffset, optvalue, sizeof(*tsoffset));
579b00ab754SHans Petter Selasky if (p->swapped)
580b00ab754SHans Petter Selasky *tsoffset = SWAPLL(*tsoffset);
581b00ab754SHans Petter Selasky break;
582b00ab754SHans Petter Selasky
583b00ab754SHans Petter Selasky default:
584b00ab754SHans Petter Selasky break;
585b00ab754SHans Petter Selasky }
586b00ab754SHans Petter Selasky }
587b00ab754SHans Petter Selasky
588b00ab754SHans Petter Selasky done:
589b00ab754SHans Petter Selasky return (0);
590b00ab754SHans Petter Selasky }
591b00ab754SHans Petter Selasky
592b00ab754SHans Petter Selasky static int
add_interface(pcap_t * p,struct interface_description_block * idbp,struct block_cursor * cursor,char * errbuf)593*6f9cba8fSJoseph Mingrone add_interface(pcap_t *p, struct interface_description_block *idbp,
594*6f9cba8fSJoseph Mingrone struct block_cursor *cursor, char *errbuf)
595b00ab754SHans Petter Selasky {
596b00ab754SHans Petter Selasky struct pcap_ng_sf *ps;
59757e22627SCy Schubert uint64_t tsresol;
598b00ab754SHans Petter Selasky uint64_t tsoffset;
599b00ab754SHans Petter Selasky int is_binary;
600b00ab754SHans Petter Selasky
601b00ab754SHans Petter Selasky ps = p->priv;
602b00ab754SHans Petter Selasky
603b00ab754SHans Petter Selasky /*
604b00ab754SHans Petter Selasky * Count this interface.
605b00ab754SHans Petter Selasky */
606b00ab754SHans Petter Selasky ps->ifcount++;
607b00ab754SHans Petter Selasky
608b00ab754SHans Petter Selasky /*
609b00ab754SHans Petter Selasky * Grow the array of per-interface information as necessary.
610b00ab754SHans Petter Selasky */
611b00ab754SHans Petter Selasky if (ps->ifcount > ps->ifaces_size) {
612b00ab754SHans Petter Selasky /*
613b00ab754SHans Petter Selasky * We need to grow the array.
614b00ab754SHans Petter Selasky */
615b00ab754SHans Petter Selasky bpf_u_int32 new_ifaces_size;
616b00ab754SHans Petter Selasky struct pcap_ng_if *new_ifaces;
617b00ab754SHans Petter Selasky
618b00ab754SHans Petter Selasky if (ps->ifaces_size == 0) {
619b00ab754SHans Petter Selasky /*
620b00ab754SHans Petter Selasky * It's currently empty.
621b00ab754SHans Petter Selasky *
622b00ab754SHans Petter Selasky * (The Clang static analyzer doesn't do enough,
623b00ab754SHans Petter Selasky * err, umm, dataflow *analysis* to realize that
624b00ab754SHans Petter Selasky * ps->ifaces_size == 0 if ps->ifaces == NULL,
625b00ab754SHans Petter Selasky * and so complains about a possible zero argument
626b00ab754SHans Petter Selasky * to realloc(), so we check for the former
627b00ab754SHans Petter Selasky * condition to shut it up.
628b00ab754SHans Petter Selasky *
629b00ab754SHans Petter Selasky * However, it doesn't complain that one of the
630b00ab754SHans Petter Selasky * multiplications below could overflow, which is
631b00ab754SHans Petter Selasky * a real, albeit extremely unlikely, problem (you'd
632b00ab754SHans Petter Selasky * need a pcapng file with tens of millions of
633b00ab754SHans Petter Selasky * interfaces).)
634b00ab754SHans Petter Selasky */
635b00ab754SHans Petter Selasky new_ifaces_size = 1;
636b00ab754SHans Petter Selasky new_ifaces = malloc(sizeof (struct pcap_ng_if));
637b00ab754SHans Petter Selasky } else {
638b00ab754SHans Petter Selasky /*
639b00ab754SHans Petter Selasky * It's not currently empty; double its size.
640b00ab754SHans Petter Selasky * (Perhaps overkill once we have a lot of interfaces.)
641b00ab754SHans Petter Selasky *
642b00ab754SHans Petter Selasky * Check for overflow if we double it.
643b00ab754SHans Petter Selasky */
644b00ab754SHans Petter Selasky if (ps->ifaces_size * 2 < ps->ifaces_size) {
645b00ab754SHans Petter Selasky /*
646b00ab754SHans Petter Selasky * The maximum number of interfaces before
647b00ab754SHans Petter Selasky * ps->ifaces_size overflows is the largest
648b00ab754SHans Petter Selasky * possible 32-bit power of 2, as we do
649b00ab754SHans Petter Selasky * size doubling.
650b00ab754SHans Petter Selasky */
651*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
652b00ab754SHans Petter Selasky "more than %u interfaces in the file",
653b00ab754SHans Petter Selasky 0x80000000U);
654b00ab754SHans Petter Selasky return (0);
655b00ab754SHans Petter Selasky }
656b00ab754SHans Petter Selasky
657b00ab754SHans Petter Selasky /*
658b00ab754SHans Petter Selasky * ps->ifaces_size * 2 doesn't overflow, so it's
659b00ab754SHans Petter Selasky * safe to multiply.
660b00ab754SHans Petter Selasky */
661b00ab754SHans Petter Selasky new_ifaces_size = ps->ifaces_size * 2;
662b00ab754SHans Petter Selasky
663b00ab754SHans Petter Selasky /*
664b00ab754SHans Petter Selasky * Now make sure that's not so big that it overflows
665b00ab754SHans Petter Selasky * if we multiply by sizeof (struct pcap_ng_if).
666b00ab754SHans Petter Selasky *
667b00ab754SHans Petter Selasky * That can happen on 32-bit platforms, with a 32-bit
668b00ab754SHans Petter Selasky * size_t; it shouldn't happen on 64-bit platforms,
669b00ab754SHans Petter Selasky * with a 64-bit size_t, as new_ifaces_size is
670b00ab754SHans Petter Selasky * 32 bits.
671b00ab754SHans Petter Selasky */
672b00ab754SHans Petter Selasky if (new_ifaces_size * sizeof (struct pcap_ng_if) < new_ifaces_size) {
673b00ab754SHans Petter Selasky /*
674b00ab754SHans Petter Selasky * As this fails only with 32-bit size_t,
675b00ab754SHans Petter Selasky * the multiplication was 32x32->32, and
676b00ab754SHans Petter Selasky * the largest 32-bit value that can safely
677b00ab754SHans Petter Selasky * be multiplied by sizeof (struct pcap_ng_if)
678b00ab754SHans Petter Selasky * without overflow is the largest 32-bit
679b00ab754SHans Petter Selasky * (unsigned) value divided by
680b00ab754SHans Petter Selasky * sizeof (struct pcap_ng_if).
681b00ab754SHans Petter Selasky */
682*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
683b00ab754SHans Petter Selasky "more than %u interfaces in the file",
684b00ab754SHans Petter Selasky 0xFFFFFFFFU / ((u_int)sizeof (struct pcap_ng_if)));
685b00ab754SHans Petter Selasky return (0);
686b00ab754SHans Petter Selasky }
687b00ab754SHans Petter Selasky new_ifaces = realloc(ps->ifaces, new_ifaces_size * sizeof (struct pcap_ng_if));
688b00ab754SHans Petter Selasky }
689b00ab754SHans Petter Selasky if (new_ifaces == NULL) {
690b00ab754SHans Petter Selasky /*
691b00ab754SHans Petter Selasky * We ran out of memory.
692b00ab754SHans Petter Selasky * Give up.
693b00ab754SHans Petter Selasky */
694*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
695b00ab754SHans Petter Selasky "out of memory for per-interface information (%u interfaces)",
696b00ab754SHans Petter Selasky ps->ifcount);
697b00ab754SHans Petter Selasky return (0);
698b00ab754SHans Petter Selasky }
699b00ab754SHans Petter Selasky ps->ifaces_size = new_ifaces_size;
700b00ab754SHans Petter Selasky ps->ifaces = new_ifaces;
701b00ab754SHans Petter Selasky }
702b00ab754SHans Petter Selasky
703*6f9cba8fSJoseph Mingrone ps->ifaces[ps->ifcount - 1].snaplen = idbp->snaplen;
704*6f9cba8fSJoseph Mingrone
705b00ab754SHans Petter Selasky /*
706b00ab754SHans Petter Selasky * Set the default time stamp resolution and offset.
707b00ab754SHans Petter Selasky */
708b00ab754SHans Petter Selasky tsresol = 1000000; /* microsecond resolution */
709b00ab754SHans Petter Selasky is_binary = 0; /* which is a power of 10 */
710b00ab754SHans Petter Selasky tsoffset = 0; /* absolute timestamps */
711b00ab754SHans Petter Selasky
712b00ab754SHans Petter Selasky /*
713b00ab754SHans Petter Selasky * Now look for various time stamp options, so we know
714b00ab754SHans Petter Selasky * how to interpret the time stamps for this interface.
715b00ab754SHans Petter Selasky */
716b00ab754SHans Petter Selasky if (process_idb_options(p, cursor, &tsresol, &tsoffset, &is_binary,
717b00ab754SHans Petter Selasky errbuf) == -1)
718b00ab754SHans Petter Selasky return (0);
719b00ab754SHans Petter Selasky
720b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].tsresol = tsresol;
721b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].tsoffset = tsoffset;
722b00ab754SHans Petter Selasky
723b00ab754SHans Petter Selasky /*
724b00ab754SHans Petter Selasky * Determine whether we're scaling up or down or not
725b00ab754SHans Petter Selasky * at all for this interface.
726b00ab754SHans Petter Selasky */
727b00ab754SHans Petter Selasky if (tsresol == ps->user_tsresol) {
728b00ab754SHans Petter Selasky /*
729b00ab754SHans Petter Selasky * The resolution is the resolution the user wants,
730b00ab754SHans Petter Selasky * so we don't have to do scaling.
731b00ab754SHans Petter Selasky */
732b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_type = PASS_THROUGH;
733b00ab754SHans Petter Selasky } else if (tsresol > ps->user_tsresol) {
734b00ab754SHans Petter Selasky /*
735b00ab754SHans Petter Selasky * The resolution is greater than what the user wants,
736b00ab754SHans Petter Selasky * so we have to scale the timestamps down.
737b00ab754SHans Petter Selasky */
738b00ab754SHans Petter Selasky if (is_binary)
739b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_BIN;
740b00ab754SHans Petter Selasky else {
741b00ab754SHans Petter Selasky /*
742b00ab754SHans Petter Selasky * Calculate the scale factor.
743b00ab754SHans Petter Selasky */
744b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_factor = tsresol/ps->user_tsresol;
745b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_DEC;
746b00ab754SHans Petter Selasky }
747b00ab754SHans Petter Selasky } else {
748b00ab754SHans Petter Selasky /*
749b00ab754SHans Petter Selasky * The resolution is less than what the user wants,
750b00ab754SHans Petter Selasky * so we have to scale the timestamps up.
751b00ab754SHans Petter Selasky */
752b00ab754SHans Petter Selasky if (is_binary)
753b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_BIN;
754b00ab754SHans Petter Selasky else {
755b00ab754SHans Petter Selasky /*
756b00ab754SHans Petter Selasky * Calculate the scale factor.
757b00ab754SHans Petter Selasky */
758b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_factor = ps->user_tsresol/tsresol;
759b00ab754SHans Petter Selasky ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_DEC;
760b00ab754SHans Petter Selasky }
761b00ab754SHans Petter Selasky }
762b00ab754SHans Petter Selasky return (1);
763b00ab754SHans Petter Selasky }
764b00ab754SHans Petter Selasky
765b00ab754SHans Petter Selasky /*
766b00ab754SHans Petter Selasky * Check whether this is a pcapng savefile and, if it is, extract the
767b00ab754SHans Petter Selasky * relevant information from the header.
768b00ab754SHans Petter Selasky */
769b00ab754SHans Petter Selasky pcap_t *
pcap_ng_check_header(const uint8_t * magic,FILE * fp,u_int precision,char * errbuf,int * err)77057e22627SCy Schubert pcap_ng_check_header(const uint8_t *magic, FILE *fp, u_int precision,
77157e22627SCy Schubert char *errbuf, int *err)
772b00ab754SHans Petter Selasky {
77357e22627SCy Schubert bpf_u_int32 magic_int;
774b00ab754SHans Petter Selasky size_t amt_read;
775b00ab754SHans Petter Selasky bpf_u_int32 total_length;
776b00ab754SHans Petter Selasky bpf_u_int32 byte_order_magic;
777b00ab754SHans Petter Selasky struct block_header *bhdrp;
778b00ab754SHans Petter Selasky struct section_header_block *shbp;
779b00ab754SHans Petter Selasky pcap_t *p;
780b00ab754SHans Petter Selasky int swapped = 0;
781b00ab754SHans Petter Selasky struct pcap_ng_sf *ps;
782b00ab754SHans Petter Selasky int status;
783b00ab754SHans Petter Selasky struct block_cursor cursor;
784b00ab754SHans Petter Selasky struct interface_description_block *idbp;
785b00ab754SHans Petter Selasky
786b00ab754SHans Petter Selasky /*
787b00ab754SHans Petter Selasky * Assume no read errors.
788b00ab754SHans Petter Selasky */
789b00ab754SHans Petter Selasky *err = 0;
790b00ab754SHans Petter Selasky
791b00ab754SHans Petter Selasky /*
792b00ab754SHans Petter Selasky * Check whether the first 4 bytes of the file are the block
793b00ab754SHans Petter Selasky * type for a pcapng savefile.
794b00ab754SHans Petter Selasky */
79557e22627SCy Schubert memcpy(&magic_int, magic, sizeof(magic_int));
79657e22627SCy Schubert if (magic_int != BT_SHB) {
797b00ab754SHans Petter Selasky /*
798b00ab754SHans Petter Selasky * XXX - check whether this looks like what the block
799b00ab754SHans Petter Selasky * type would be after being munged by mapping between
800b00ab754SHans Petter Selasky * UN*X and DOS/Windows text file format and, if it
801b00ab754SHans Petter Selasky * does, look for the byte-order magic number in
802b00ab754SHans Petter Selasky * the appropriate place and, if we find it, report
803b00ab754SHans Petter Selasky * this as possibly being a pcapng file transferred
804b00ab754SHans Petter Selasky * between UN*X and Windows in text file format?
805b00ab754SHans Petter Selasky */
806b00ab754SHans Petter Selasky return (NULL); /* nope */
807b00ab754SHans Petter Selasky }
808b00ab754SHans Petter Selasky
809b00ab754SHans Petter Selasky /*
810b00ab754SHans Petter Selasky * OK, they are. However, that's just \n\r\r\n, so it could,
811b00ab754SHans Petter Selasky * conceivably, be an ordinary text file.
812b00ab754SHans Petter Selasky *
813b00ab754SHans Petter Selasky * It could not, however, conceivably be any other type of
814b00ab754SHans Petter Selasky * capture file, so we can read the rest of the putative
815b00ab754SHans Petter Selasky * Section Header Block; put the block type in the common
816b00ab754SHans Petter Selasky * header, read the rest of the common header and the
817b00ab754SHans Petter Selasky * fixed-length portion of the SHB, and look for the byte-order
818b00ab754SHans Petter Selasky * magic value.
819b00ab754SHans Petter Selasky */
820b00ab754SHans Petter Selasky amt_read = fread(&total_length, 1, sizeof(total_length), fp);
821b00ab754SHans Petter Selasky if (amt_read < sizeof(total_length)) {
822b00ab754SHans Petter Selasky if (ferror(fp)) {
823b00ab754SHans Petter Selasky pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
824b00ab754SHans Petter Selasky errno, "error reading dump file");
825b00ab754SHans Petter Selasky *err = 1;
826b00ab754SHans Petter Selasky return (NULL); /* fail */
827b00ab754SHans Petter Selasky }
828b00ab754SHans Petter Selasky
829b00ab754SHans Petter Selasky /*
830b00ab754SHans Petter Selasky * Possibly a weird short text file, so just say
831b00ab754SHans Petter Selasky * "not pcapng".
832b00ab754SHans Petter Selasky */
833b00ab754SHans Petter Selasky return (NULL);
834b00ab754SHans Petter Selasky }
835b00ab754SHans Petter Selasky amt_read = fread(&byte_order_magic, 1, sizeof(byte_order_magic), fp);
836b00ab754SHans Petter Selasky if (amt_read < sizeof(byte_order_magic)) {
837b00ab754SHans Petter Selasky if (ferror(fp)) {
838b00ab754SHans Petter Selasky pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
839b00ab754SHans Petter Selasky errno, "error reading dump file");
840b00ab754SHans Petter Selasky *err = 1;
841b00ab754SHans Petter Selasky return (NULL); /* fail */
842b00ab754SHans Petter Selasky }
843b00ab754SHans Petter Selasky
844b00ab754SHans Petter Selasky /*
845b00ab754SHans Petter Selasky * Possibly a weird short text file, so just say
846b00ab754SHans Petter Selasky * "not pcapng".
847b00ab754SHans Petter Selasky */
848b00ab754SHans Petter Selasky return (NULL);
849b00ab754SHans Petter Selasky }
850b00ab754SHans Petter Selasky if (byte_order_magic != BYTE_ORDER_MAGIC) {
851b00ab754SHans Petter Selasky byte_order_magic = SWAPLONG(byte_order_magic);
852b00ab754SHans Petter Selasky if (byte_order_magic != BYTE_ORDER_MAGIC) {
853b00ab754SHans Petter Selasky /*
854b00ab754SHans Petter Selasky * Not a pcapng file.
855b00ab754SHans Petter Selasky */
856b00ab754SHans Petter Selasky return (NULL);
857b00ab754SHans Petter Selasky }
858b00ab754SHans Petter Selasky swapped = 1;
859b00ab754SHans Petter Selasky total_length = SWAPLONG(total_length);
860b00ab754SHans Petter Selasky }
861b00ab754SHans Petter Selasky
862b00ab754SHans Petter Selasky /*
863b00ab754SHans Petter Selasky * Check the sanity of the total length.
864b00ab754SHans Petter Selasky */
86557e22627SCy Schubert if (total_length < sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer) ||
86657e22627SCy Schubert (total_length > BT_SHB_INSANE_MAX)) {
867*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
868*6f9cba8fSJoseph Mingrone "Section Header Block in pcapng dump file has invalid length %zu < _%u_ < %u (BT_SHB_INSANE_MAX)",
86957e22627SCy Schubert sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer),
870b00ab754SHans Petter Selasky total_length,
87157e22627SCy Schubert BT_SHB_INSANE_MAX);
87257e22627SCy Schubert
873b00ab754SHans Petter Selasky *err = 1;
874b00ab754SHans Petter Selasky return (NULL);
875b00ab754SHans Petter Selasky }
876b00ab754SHans Petter Selasky
877b00ab754SHans Petter Selasky /*
878b00ab754SHans Petter Selasky * OK, this is a good pcapng file.
879b00ab754SHans Petter Selasky * Allocate a pcap_t for it.
880b00ab754SHans Petter Selasky */
881*6f9cba8fSJoseph Mingrone p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_ng_sf);
882b00ab754SHans Petter Selasky if (p == NULL) {
883b00ab754SHans Petter Selasky /* Allocation failed. */
884b00ab754SHans Petter Selasky *err = 1;
885b00ab754SHans Petter Selasky return (NULL);
886b00ab754SHans Petter Selasky }
887b00ab754SHans Petter Selasky p->swapped = swapped;
888b00ab754SHans Petter Selasky ps = p->priv;
889b00ab754SHans Petter Selasky
890b00ab754SHans Petter Selasky /*
891b00ab754SHans Petter Selasky * What precision does the user want?
892b00ab754SHans Petter Selasky */
893b00ab754SHans Petter Selasky switch (precision) {
894b00ab754SHans Petter Selasky
895b00ab754SHans Petter Selasky case PCAP_TSTAMP_PRECISION_MICRO:
896b00ab754SHans Petter Selasky ps->user_tsresol = 1000000;
897b00ab754SHans Petter Selasky break;
898b00ab754SHans Petter Selasky
899b00ab754SHans Petter Selasky case PCAP_TSTAMP_PRECISION_NANO:
900b00ab754SHans Petter Selasky ps->user_tsresol = 1000000000;
901b00ab754SHans Petter Selasky break;
902b00ab754SHans Petter Selasky
903b00ab754SHans Petter Selasky default:
904*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
905b00ab754SHans Petter Selasky "unknown time stamp resolution %u", precision);
906b00ab754SHans Petter Selasky free(p);
907b00ab754SHans Petter Selasky *err = 1;
908b00ab754SHans Petter Selasky return (NULL);
909b00ab754SHans Petter Selasky }
910b00ab754SHans Petter Selasky
911b00ab754SHans Petter Selasky p->opt.tstamp_precision = precision;
912b00ab754SHans Petter Selasky
913b00ab754SHans Petter Selasky /*
914b00ab754SHans Petter Selasky * Allocate a buffer into which to read blocks. We default to
915b00ab754SHans Petter Selasky * the maximum of:
916b00ab754SHans Petter Selasky *
917b00ab754SHans Petter Selasky * the total length of the SHB for which we read the header;
918b00ab754SHans Petter Selasky *
919b00ab754SHans Petter Selasky * 2K, which should be more than large enough for an Enhanced
920b00ab754SHans Petter Selasky * Packet Block containing a full-size Ethernet frame, and
921b00ab754SHans Petter Selasky * leaving room for some options.
922b00ab754SHans Petter Selasky *
923b00ab754SHans Petter Selasky * If we find a bigger block, we reallocate the buffer, up to
92457e22627SCy Schubert * the maximum size. We start out with a maximum size of
92557e22627SCy Schubert * INITIAL_MAX_BLOCKSIZE; if we see any link-layer header types
92657e22627SCy Schubert * with a maximum snapshot that results in a larger maximum
92757e22627SCy Schubert * block length, we boost the maximum.
928b00ab754SHans Petter Selasky */
929b00ab754SHans Petter Selasky p->bufsize = 2048;
930b00ab754SHans Petter Selasky if (p->bufsize < total_length)
931b00ab754SHans Petter Selasky p->bufsize = total_length;
932b00ab754SHans Petter Selasky p->buffer = malloc(p->bufsize);
933b00ab754SHans Petter Selasky if (p->buffer == NULL) {
934*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
935b00ab754SHans Petter Selasky free(p);
936b00ab754SHans Petter Selasky *err = 1;
937b00ab754SHans Petter Selasky return (NULL);
938b00ab754SHans Petter Selasky }
93957e22627SCy Schubert ps->max_blocksize = INITIAL_MAX_BLOCKSIZE;
940b00ab754SHans Petter Selasky
941b00ab754SHans Petter Selasky /*
942b00ab754SHans Petter Selasky * Copy the stuff we've read to the buffer, and read the rest
943b00ab754SHans Petter Selasky * of the SHB.
944b00ab754SHans Petter Selasky */
945b00ab754SHans Petter Selasky bhdrp = (struct block_header *)p->buffer;
946b00ab754SHans Petter Selasky shbp = (struct section_header_block *)((u_char *)p->buffer + sizeof(struct block_header));
94757e22627SCy Schubert bhdrp->block_type = magic_int;
948b00ab754SHans Petter Selasky bhdrp->total_length = total_length;
949b00ab754SHans Petter Selasky shbp->byte_order_magic = byte_order_magic;
950b00ab754SHans Petter Selasky if (read_bytes(fp,
95157e22627SCy Schubert (u_char *)p->buffer + (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)),
95257e22627SCy Schubert total_length - (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)),
953b00ab754SHans Petter Selasky 1, errbuf) == -1)
954b00ab754SHans Petter Selasky goto fail;
955b00ab754SHans Petter Selasky
956b00ab754SHans Petter Selasky if (p->swapped) {
957b00ab754SHans Petter Selasky /*
958b00ab754SHans Petter Selasky * Byte-swap the fields we've read.
959b00ab754SHans Petter Selasky */
960b00ab754SHans Petter Selasky shbp->major_version = SWAPSHORT(shbp->major_version);
961b00ab754SHans Petter Selasky shbp->minor_version = SWAPSHORT(shbp->minor_version);
962b00ab754SHans Petter Selasky
963b00ab754SHans Petter Selasky /*
964b00ab754SHans Petter Selasky * XXX - we don't care about the section length.
965b00ab754SHans Petter Selasky */
966b00ab754SHans Petter Selasky }
967*6f9cba8fSJoseph Mingrone /* Currently only SHB versions 1.0 and 1.2 are supported;
968*6f9cba8fSJoseph Mingrone version 1.2 is treated as being the same as version 1.0.
969*6f9cba8fSJoseph Mingrone See the current version of the pcapng specification.
970*6f9cba8fSJoseph Mingrone
971*6f9cba8fSJoseph Mingrone Version 1.2 is written by some programs that write additional
972*6f9cba8fSJoseph Mingrone block types (which can be read by any code that handles them,
973*6f9cba8fSJoseph Mingrone regardless of whether the minor version if 0 or 2, so that's
974*6f9cba8fSJoseph Mingrone not a reason to change the minor version number).
975*6f9cba8fSJoseph Mingrone
976*6f9cba8fSJoseph Mingrone XXX - the pcapng specification says that readers should
977*6f9cba8fSJoseph Mingrone just ignore sections with an unsupported version number;
978*6f9cba8fSJoseph Mingrone presumably they can also report an error if they skip
979*6f9cba8fSJoseph Mingrone all the way to the end of the file without finding
980*6f9cba8fSJoseph Mingrone any versions that they support. */
981b00ab754SHans Petter Selasky if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR &&
982*6f9cba8fSJoseph Mingrone (shbp->minor_version == PCAP_NG_VERSION_MINOR ||
983*6f9cba8fSJoseph Mingrone shbp->minor_version == 2))) {
984*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
985b00ab754SHans Petter Selasky "unsupported pcapng savefile version %u.%u",
986b00ab754SHans Petter Selasky shbp->major_version, shbp->minor_version);
987b00ab754SHans Petter Selasky goto fail;
988b00ab754SHans Petter Selasky }
989b00ab754SHans Petter Selasky p->version_major = shbp->major_version;
990b00ab754SHans Petter Selasky p->version_minor = shbp->minor_version;
991b00ab754SHans Petter Selasky
992b00ab754SHans Petter Selasky /*
993b00ab754SHans Petter Selasky * Save the time stamp resolution the user requested.
994b00ab754SHans Petter Selasky */
995b00ab754SHans Petter Selasky p->opt.tstamp_precision = precision;
996b00ab754SHans Petter Selasky
997b00ab754SHans Petter Selasky /*
998b00ab754SHans Petter Selasky * Now start looking for an Interface Description Block.
999b00ab754SHans Petter Selasky */
1000b00ab754SHans Petter Selasky for (;;) {
1001b00ab754SHans Petter Selasky /*
1002b00ab754SHans Petter Selasky * Read the next block.
1003b00ab754SHans Petter Selasky */
1004b00ab754SHans Petter Selasky status = read_block(fp, p, &cursor, errbuf);
1005b00ab754SHans Petter Selasky if (status == 0) {
1006b00ab754SHans Petter Selasky /* EOF - no IDB in this file */
1007*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
1008b00ab754SHans Petter Selasky "the capture file has no Interface Description Blocks");
1009b00ab754SHans Petter Selasky goto fail;
1010b00ab754SHans Petter Selasky }
1011b00ab754SHans Petter Selasky if (status == -1)
1012b00ab754SHans Petter Selasky goto fail; /* error */
1013b00ab754SHans Petter Selasky switch (cursor.block_type) {
1014b00ab754SHans Petter Selasky
1015b00ab754SHans Petter Selasky case BT_IDB:
1016b00ab754SHans Petter Selasky /*
1017b00ab754SHans Petter Selasky * Get a pointer to the fixed-length portion of the
1018b00ab754SHans Petter Selasky * IDB.
1019b00ab754SHans Petter Selasky */
1020b00ab754SHans Petter Selasky idbp = get_from_block_data(&cursor, sizeof(*idbp),
1021b00ab754SHans Petter Selasky errbuf);
1022b00ab754SHans Petter Selasky if (idbp == NULL)
1023b00ab754SHans Petter Selasky goto fail; /* error */
1024b00ab754SHans Petter Selasky
1025b00ab754SHans Petter Selasky /*
1026b00ab754SHans Petter Selasky * Byte-swap it if necessary.
1027b00ab754SHans Petter Selasky */
1028b00ab754SHans Petter Selasky if (p->swapped) {
1029b00ab754SHans Petter Selasky idbp->linktype = SWAPSHORT(idbp->linktype);
1030b00ab754SHans Petter Selasky idbp->snaplen = SWAPLONG(idbp->snaplen);
1031b00ab754SHans Petter Selasky }
1032b00ab754SHans Petter Selasky
1033b00ab754SHans Petter Selasky /*
1034b00ab754SHans Petter Selasky * Try to add this interface.
1035b00ab754SHans Petter Selasky */
1036*6f9cba8fSJoseph Mingrone if (!add_interface(p, idbp, &cursor, errbuf))
1037b00ab754SHans Petter Selasky goto fail;
1038b00ab754SHans Petter Selasky
1039b00ab754SHans Petter Selasky goto done;
1040b00ab754SHans Petter Selasky
1041b00ab754SHans Petter Selasky case BT_EPB:
1042b00ab754SHans Petter Selasky case BT_SPB:
1043b00ab754SHans Petter Selasky case BT_PB:
1044b00ab754SHans Petter Selasky /*
1045b00ab754SHans Petter Selasky * Saw a packet before we saw any IDBs. That's
1046b00ab754SHans Petter Selasky * not valid, as we don't know what link-layer
1047b00ab754SHans Petter Selasky * encapsulation the packet has.
1048b00ab754SHans Petter Selasky */
1049*6f9cba8fSJoseph Mingrone snprintf(errbuf, PCAP_ERRBUF_SIZE,
1050b00ab754SHans Petter Selasky "the capture file has a packet block before any Interface Description Blocks");
1051b00ab754SHans Petter Selasky goto fail;
1052b00ab754SHans Petter Selasky
1053b00ab754SHans Petter Selasky default:
1054b00ab754SHans Petter Selasky /*
1055b00ab754SHans Petter Selasky * Just ignore it.
1056b00ab754SHans Petter Selasky */
1057b00ab754SHans Petter Selasky break;
1058b00ab754SHans Petter Selasky }
1059b00ab754SHans Petter Selasky }
1060b00ab754SHans Petter Selasky
1061b00ab754SHans Petter Selasky done:
1062b00ab754SHans Petter Selasky p->linktype = linktype_to_dlt(idbp->linktype);
106357e22627SCy Schubert p->snapshot = pcap_adjust_snapshot(p->linktype, idbp->snaplen);
1064b00ab754SHans Petter Selasky p->linktype_ext = 0;
1065b00ab754SHans Petter Selasky
1066b00ab754SHans Petter Selasky /*
1067b00ab754SHans Petter Selasky * If the maximum block size for a packet with the maximum
1068b00ab754SHans Petter Selasky * snapshot length for this DLT_ is bigger than the current
1069b00ab754SHans Petter Selasky * maximum block size, increase the maximum.
1070b00ab754SHans Petter Selasky */
107157e22627SCy Schubert if (MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)) > ps->max_blocksize)
107257e22627SCy Schubert ps->max_blocksize = MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype));
1073b00ab754SHans Petter Selasky
1074b00ab754SHans Petter Selasky p->next_packet_op = pcap_ng_next_packet;
1075b00ab754SHans Petter Selasky p->cleanup_op = pcap_ng_cleanup;
1076b00ab754SHans Petter Selasky
1077b00ab754SHans Petter Selasky return (p);
1078b00ab754SHans Petter Selasky
1079b00ab754SHans Petter Selasky fail:
1080b00ab754SHans Petter Selasky free(ps->ifaces);
1081b00ab754SHans Petter Selasky free(p->buffer);
1082b00ab754SHans Petter Selasky free(p);
1083b00ab754SHans Petter Selasky *err = 1;
1084b00ab754SHans Petter Selasky return (NULL);
1085b00ab754SHans Petter Selasky }
1086b00ab754SHans Petter Selasky
1087b00ab754SHans Petter Selasky static void
pcap_ng_cleanup(pcap_t * p)1088b00ab754SHans Petter Selasky pcap_ng_cleanup(pcap_t *p)
1089b00ab754SHans Petter Selasky {
1090b00ab754SHans Petter Selasky struct pcap_ng_sf *ps = p->priv;
1091b00ab754SHans Petter Selasky
1092b00ab754SHans Petter Selasky free(ps->ifaces);
1093b00ab754SHans Petter Selasky sf_cleanup(p);
1094b00ab754SHans Petter Selasky }
1095b00ab754SHans Petter Selasky
1096b00ab754SHans Petter Selasky /*
1097b00ab754SHans Petter Selasky * Read and return the next packet from the savefile. Return the header
1098*6f9cba8fSJoseph Mingrone * in hdr and a pointer to the contents in data. Return 1 on success, 0
1099b00ab754SHans Petter Selasky * if there were no more packets, and -1 on an error.
1100b00ab754SHans Petter Selasky */
1101b00ab754SHans Petter Selasky static int
pcap_ng_next_packet(pcap_t * p,struct pcap_pkthdr * hdr,u_char ** data)1102b00ab754SHans Petter Selasky pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
1103b00ab754SHans Petter Selasky {
1104b00ab754SHans Petter Selasky struct pcap_ng_sf *ps = p->priv;
1105b00ab754SHans Petter Selasky struct block_cursor cursor;
1106b00ab754SHans Petter Selasky int status;
1107b00ab754SHans Petter Selasky struct enhanced_packet_block *epbp;
1108b00ab754SHans Petter Selasky struct simple_packet_block *spbp;
1109b00ab754SHans Petter Selasky struct packet_block *pbp;
1110b00ab754SHans Petter Selasky bpf_u_int32 interface_id = 0xFFFFFFFF;
1111b00ab754SHans Petter Selasky struct interface_description_block *idbp;
1112b00ab754SHans Petter Selasky struct section_header_block *shbp;
1113b00ab754SHans Petter Selasky FILE *fp = p->rfile;
1114b00ab754SHans Petter Selasky uint64_t t, sec, frac;
1115b00ab754SHans Petter Selasky
1116b00ab754SHans Petter Selasky /*
1117b00ab754SHans Petter Selasky * Look for an Enhanced Packet Block, a Simple Packet Block,
1118b00ab754SHans Petter Selasky * or a Packet Block.
1119b00ab754SHans Petter Selasky */
1120b00ab754SHans Petter Selasky for (;;) {
1121b00ab754SHans Petter Selasky /*
1122b00ab754SHans Petter Selasky * Read the block type and length; those are common
1123b00ab754SHans Petter Selasky * to all blocks.
1124b00ab754SHans Petter Selasky */
1125b00ab754SHans Petter Selasky status = read_block(fp, p, &cursor, p->errbuf);
1126b00ab754SHans Petter Selasky if (status == 0)
1127*6f9cba8fSJoseph Mingrone return (0); /* EOF */
1128b00ab754SHans Petter Selasky if (status == -1)
1129b00ab754SHans Petter Selasky return (-1); /* error */
1130b00ab754SHans Petter Selasky switch (cursor.block_type) {
1131b00ab754SHans Petter Selasky
1132b00ab754SHans Petter Selasky case BT_EPB:
1133b00ab754SHans Petter Selasky /*
1134b00ab754SHans Petter Selasky * Get a pointer to the fixed-length portion of the
1135b00ab754SHans Petter Selasky * EPB.
1136b00ab754SHans Petter Selasky */
1137b00ab754SHans Petter Selasky epbp = get_from_block_data(&cursor, sizeof(*epbp),
1138b00ab754SHans Petter Selasky p->errbuf);
1139b00ab754SHans Petter Selasky if (epbp == NULL)
1140b00ab754SHans Petter Selasky return (-1); /* error */
1141b00ab754SHans Petter Selasky
1142b00ab754SHans Petter Selasky /*
1143b00ab754SHans Petter Selasky * Byte-swap it if necessary.
1144b00ab754SHans Petter Selasky */
1145b00ab754SHans Petter Selasky if (p->swapped) {
1146b00ab754SHans Petter Selasky /* these were written in opposite byte order */
1147b00ab754SHans Petter Selasky interface_id = SWAPLONG(epbp->interface_id);
1148b00ab754SHans Petter Selasky hdr->caplen = SWAPLONG(epbp->caplen);
1149b00ab754SHans Petter Selasky hdr->len = SWAPLONG(epbp->len);
1150b00ab754SHans Petter Selasky t = ((uint64_t)SWAPLONG(epbp->timestamp_high)) << 32 |
1151b00ab754SHans Petter Selasky SWAPLONG(epbp->timestamp_low);
1152b00ab754SHans Petter Selasky } else {
1153b00ab754SHans Petter Selasky interface_id = epbp->interface_id;
1154b00ab754SHans Petter Selasky hdr->caplen = epbp->caplen;
1155b00ab754SHans Petter Selasky hdr->len = epbp->len;
1156b00ab754SHans Petter Selasky t = ((uint64_t)epbp->timestamp_high) << 32 |
1157b00ab754SHans Petter Selasky epbp->timestamp_low;
1158b00ab754SHans Petter Selasky }
1159b00ab754SHans Petter Selasky goto found;
1160b00ab754SHans Petter Selasky
1161b00ab754SHans Petter Selasky case BT_SPB:
1162b00ab754SHans Petter Selasky /*
1163b00ab754SHans Petter Selasky * Get a pointer to the fixed-length portion of the
1164b00ab754SHans Petter Selasky * SPB.
1165b00ab754SHans Petter Selasky */
1166b00ab754SHans Petter Selasky spbp = get_from_block_data(&cursor, sizeof(*spbp),
1167b00ab754SHans Petter Selasky p->errbuf);
1168b00ab754SHans Petter Selasky if (spbp == NULL)
1169b00ab754SHans Petter Selasky return (-1); /* error */
1170b00ab754SHans Petter Selasky
1171b00ab754SHans Petter Selasky /*
1172b00ab754SHans Petter Selasky * SPB packets are assumed to have arrived on
1173b00ab754SHans Petter Selasky * the first interface.
1174b00ab754SHans Petter Selasky */
1175b00ab754SHans Petter Selasky interface_id = 0;
1176b00ab754SHans Petter Selasky
1177b00ab754SHans Petter Selasky /*
1178b00ab754SHans Petter Selasky * Byte-swap it if necessary.
1179b00ab754SHans Petter Selasky */
1180b00ab754SHans Petter Selasky if (p->swapped) {
1181b00ab754SHans Petter Selasky /* these were written in opposite byte order */
1182b00ab754SHans Petter Selasky hdr->len = SWAPLONG(spbp->len);
1183b00ab754SHans Petter Selasky } else
1184b00ab754SHans Petter Selasky hdr->len = spbp->len;
1185b00ab754SHans Petter Selasky
1186b00ab754SHans Petter Selasky /*
1187b00ab754SHans Petter Selasky * The SPB doesn't give the captured length;
1188b00ab754SHans Petter Selasky * it's the minimum of the snapshot length
1189b00ab754SHans Petter Selasky * and the packet length.
1190b00ab754SHans Petter Selasky */
1191b00ab754SHans Petter Selasky hdr->caplen = hdr->len;
1192b00ab754SHans Petter Selasky if (hdr->caplen > (bpf_u_int32)p->snapshot)
1193b00ab754SHans Petter Selasky hdr->caplen = p->snapshot;
1194b00ab754SHans Petter Selasky t = 0; /* no time stamps */
1195b00ab754SHans Petter Selasky goto found;
1196b00ab754SHans Petter Selasky
1197b00ab754SHans Petter Selasky case BT_PB:
1198b00ab754SHans Petter Selasky /*
1199b00ab754SHans Petter Selasky * Get a pointer to the fixed-length portion of the
1200b00ab754SHans Petter Selasky * PB.
1201b00ab754SHans Petter Selasky */
1202b00ab754SHans Petter Selasky pbp = get_from_block_data(&cursor, sizeof(*pbp),
1203b00ab754SHans Petter Selasky p->errbuf);
1204b00ab754SHans Petter Selasky if (pbp == NULL)
1205b00ab754SHans Petter Selasky return (-1); /* error */
1206b00ab754SHans Petter Selasky
1207b00ab754SHans Petter Selasky /*
1208b00ab754SHans Petter Selasky * Byte-swap it if necessary.
1209b00ab754SHans Petter Selasky */
1210b00ab754SHans Petter Selasky if (p->swapped) {
1211b00ab754SHans Petter Selasky /* these were written in opposite byte order */
1212b00ab754SHans Petter Selasky interface_id = SWAPSHORT(pbp->interface_id);
1213b00ab754SHans Petter Selasky hdr->caplen = SWAPLONG(pbp->caplen);
1214b00ab754SHans Petter Selasky hdr->len = SWAPLONG(pbp->len);
1215b00ab754SHans Petter Selasky t = ((uint64_t)SWAPLONG(pbp->timestamp_high)) << 32 |
1216b00ab754SHans Petter Selasky SWAPLONG(pbp->timestamp_low);
1217b00ab754SHans Petter Selasky } else {
1218b00ab754SHans Petter Selasky interface_id = pbp->interface_id;
1219b00ab754SHans Petter Selasky hdr->caplen = pbp->caplen;
1220b00ab754SHans Petter Selasky hdr->len = pbp->len;
1221b00ab754SHans Petter Selasky t = ((uint64_t)pbp->timestamp_high) << 32 |
1222b00ab754SHans Petter Selasky pbp->timestamp_low;
1223b00ab754SHans Petter Selasky }
1224b00ab754SHans Petter Selasky goto found;
1225b00ab754SHans Petter Selasky
1226b00ab754SHans Petter Selasky case BT_IDB:
1227b00ab754SHans Petter Selasky /*
1228b00ab754SHans Petter Selasky * Interface Description Block. Get a pointer
1229b00ab754SHans Petter Selasky * to its fixed-length portion.
1230b00ab754SHans Petter Selasky */
1231b00ab754SHans Petter Selasky idbp = get_from_block_data(&cursor, sizeof(*idbp),
1232b00ab754SHans Petter Selasky p->errbuf);
1233b00ab754SHans Petter Selasky if (idbp == NULL)
1234b00ab754SHans Petter Selasky return (-1); /* error */
1235b00ab754SHans Petter Selasky
1236b00ab754SHans Petter Selasky /*
1237b00ab754SHans Petter Selasky * Byte-swap it if necessary.
1238b00ab754SHans Petter Selasky */
1239b00ab754SHans Petter Selasky if (p->swapped) {
1240b00ab754SHans Petter Selasky idbp->linktype = SWAPSHORT(idbp->linktype);
1241b00ab754SHans Petter Selasky idbp->snaplen = SWAPLONG(idbp->snaplen);
1242b00ab754SHans Petter Selasky }
1243b00ab754SHans Petter Selasky
1244b00ab754SHans Petter Selasky /*
1245b00ab754SHans Petter Selasky * If the link-layer type or snapshot length
1246b00ab754SHans Petter Selasky * differ from the ones for the first IDB we
1247b00ab754SHans Petter Selasky * saw, quit.
1248b00ab754SHans Petter Selasky *
1249b00ab754SHans Petter Selasky * XXX - just discard packets from those
1250b00ab754SHans Petter Selasky * interfaces?
1251b00ab754SHans Petter Selasky */
1252b00ab754SHans Petter Selasky if (p->linktype != idbp->linktype) {
1253*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1254b00ab754SHans Petter Selasky "an interface has a type %u different from the type of the first interface",
1255b00ab754SHans Petter Selasky idbp->linktype);
1256b00ab754SHans Petter Selasky return (-1);
1257b00ab754SHans Petter Selasky }
125857e22627SCy Schubert
125957e22627SCy Schubert /*
126057e22627SCy Schubert * Check against the *adjusted* value of this IDB's
126157e22627SCy Schubert * snapshot length.
126257e22627SCy Schubert */
126357e22627SCy Schubert if ((bpf_u_int32)p->snapshot !=
126457e22627SCy Schubert pcap_adjust_snapshot(p->linktype, idbp->snaplen)) {
1265*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1266*6f9cba8fSJoseph Mingrone "an interface has a snapshot length %u different from the snapshot length of the first interface",
1267b00ab754SHans Petter Selasky idbp->snaplen);
1268b00ab754SHans Petter Selasky return (-1);
1269b00ab754SHans Petter Selasky }
1270b00ab754SHans Petter Selasky
1271b00ab754SHans Petter Selasky /*
1272b00ab754SHans Petter Selasky * Try to add this interface.
1273b00ab754SHans Petter Selasky */
1274*6f9cba8fSJoseph Mingrone if (!add_interface(p, idbp, &cursor, p->errbuf))
1275b00ab754SHans Petter Selasky return (-1);
1276b00ab754SHans Petter Selasky break;
1277b00ab754SHans Petter Selasky
1278b00ab754SHans Petter Selasky case BT_SHB:
1279b00ab754SHans Petter Selasky /*
1280b00ab754SHans Petter Selasky * Section Header Block. Get a pointer
1281b00ab754SHans Petter Selasky * to its fixed-length portion.
1282b00ab754SHans Petter Selasky */
1283b00ab754SHans Petter Selasky shbp = get_from_block_data(&cursor, sizeof(*shbp),
1284b00ab754SHans Petter Selasky p->errbuf);
1285b00ab754SHans Petter Selasky if (shbp == NULL)
1286b00ab754SHans Petter Selasky return (-1); /* error */
1287b00ab754SHans Petter Selasky
1288b00ab754SHans Petter Selasky /*
1289b00ab754SHans Petter Selasky * Assume the byte order of this section is
1290b00ab754SHans Petter Selasky * the same as that of the previous section.
1291b00ab754SHans Petter Selasky * We'll check for that later.
1292b00ab754SHans Petter Selasky */
1293b00ab754SHans Petter Selasky if (p->swapped) {
1294b00ab754SHans Petter Selasky shbp->byte_order_magic =
1295b00ab754SHans Petter Selasky SWAPLONG(shbp->byte_order_magic);
1296b00ab754SHans Petter Selasky shbp->major_version =
1297b00ab754SHans Petter Selasky SWAPSHORT(shbp->major_version);
1298b00ab754SHans Petter Selasky }
1299b00ab754SHans Petter Selasky
1300b00ab754SHans Petter Selasky /*
1301b00ab754SHans Petter Selasky * Make sure the byte order doesn't change;
1302b00ab754SHans Petter Selasky * pcap_is_swapped() shouldn't change its
1303b00ab754SHans Petter Selasky * return value in the middle of reading a capture.
1304b00ab754SHans Petter Selasky */
1305b00ab754SHans Petter Selasky switch (shbp->byte_order_magic) {
1306b00ab754SHans Petter Selasky
1307b00ab754SHans Petter Selasky case BYTE_ORDER_MAGIC:
1308b00ab754SHans Petter Selasky /*
1309b00ab754SHans Petter Selasky * OK.
1310b00ab754SHans Petter Selasky */
1311b00ab754SHans Petter Selasky break;
1312b00ab754SHans Petter Selasky
1313b00ab754SHans Petter Selasky case SWAPLONG(BYTE_ORDER_MAGIC):
1314b00ab754SHans Petter Selasky /*
1315b00ab754SHans Petter Selasky * Byte order changes.
1316b00ab754SHans Petter Selasky */
1317*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1318b00ab754SHans Petter Selasky "the file has sections with different byte orders");
1319b00ab754SHans Petter Selasky return (-1);
1320b00ab754SHans Petter Selasky
1321b00ab754SHans Petter Selasky default:
1322b00ab754SHans Petter Selasky /*
1323b00ab754SHans Petter Selasky * Not a valid SHB.
1324b00ab754SHans Petter Selasky */
1325*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1326b00ab754SHans Petter Selasky "the file has a section with a bad byte order magic field");
1327b00ab754SHans Petter Selasky return (-1);
1328b00ab754SHans Petter Selasky }
1329b00ab754SHans Petter Selasky
1330b00ab754SHans Petter Selasky /*
1331b00ab754SHans Petter Selasky * Make sure the major version is the version
1332b00ab754SHans Petter Selasky * we handle.
1333b00ab754SHans Petter Selasky */
1334b00ab754SHans Petter Selasky if (shbp->major_version != PCAP_NG_VERSION_MAJOR) {
1335*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1336b00ab754SHans Petter Selasky "unknown pcapng savefile major version number %u",
1337b00ab754SHans Petter Selasky shbp->major_version);
1338b00ab754SHans Petter Selasky return (-1);
1339b00ab754SHans Petter Selasky }
1340b00ab754SHans Petter Selasky
1341b00ab754SHans Petter Selasky /*
1342b00ab754SHans Petter Selasky * Reset the interface count; this section should
1343b00ab754SHans Petter Selasky * have its own set of IDBs. If any of them
1344b00ab754SHans Petter Selasky * don't have the same interface type, snapshot
1345b00ab754SHans Petter Selasky * length, or resolution as the first interface
1346b00ab754SHans Petter Selasky * we saw, we'll fail. (And if we don't see
1347b00ab754SHans Petter Selasky * any IDBs, we'll fail when we see a packet
1348b00ab754SHans Petter Selasky * block.)
1349b00ab754SHans Petter Selasky */
1350b00ab754SHans Petter Selasky ps->ifcount = 0;
1351b00ab754SHans Petter Selasky break;
1352b00ab754SHans Petter Selasky
1353b00ab754SHans Petter Selasky default:
1354b00ab754SHans Petter Selasky /*
1355b00ab754SHans Petter Selasky * Not a packet block, IDB, or SHB; ignore it.
1356b00ab754SHans Petter Selasky */
1357b00ab754SHans Petter Selasky break;
1358b00ab754SHans Petter Selasky }
1359b00ab754SHans Petter Selasky }
1360b00ab754SHans Petter Selasky
1361b00ab754SHans Petter Selasky found:
1362b00ab754SHans Petter Selasky /*
1363b00ab754SHans Petter Selasky * Is the interface ID an interface we know?
1364b00ab754SHans Petter Selasky */
1365b00ab754SHans Petter Selasky if (interface_id >= ps->ifcount) {
1366b00ab754SHans Petter Selasky /*
1367b00ab754SHans Petter Selasky * Yes. Fail.
1368b00ab754SHans Petter Selasky */
1369*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1370b00ab754SHans Petter Selasky "a packet arrived on interface %u, but there's no Interface Description Block for that interface",
1371b00ab754SHans Petter Selasky interface_id);
1372b00ab754SHans Petter Selasky return (-1);
1373b00ab754SHans Petter Selasky }
1374b00ab754SHans Petter Selasky
1375b00ab754SHans Petter Selasky if (hdr->caplen > (bpf_u_int32)p->snapshot) {
1376*6f9cba8fSJoseph Mingrone snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1377b00ab754SHans Petter Selasky "invalid packet capture length %u, bigger than "
1378b00ab754SHans Petter Selasky "snaplen of %d", hdr->caplen, p->snapshot);
1379b00ab754SHans Petter Selasky return (-1);
1380b00ab754SHans Petter Selasky }
1381b00ab754SHans Petter Selasky
1382b00ab754SHans Petter Selasky /*
1383b00ab754SHans Petter Selasky * Convert the time stamp to seconds and fractions of a second,
1384b00ab754SHans Petter Selasky * with the fractions being in units of the file-supplied resolution.
1385b00ab754SHans Petter Selasky */
1386b00ab754SHans Petter Selasky sec = t / ps->ifaces[interface_id].tsresol + ps->ifaces[interface_id].tsoffset;
1387b00ab754SHans Petter Selasky frac = t % ps->ifaces[interface_id].tsresol;
1388b00ab754SHans Petter Selasky
1389b00ab754SHans Petter Selasky /*
1390b00ab754SHans Petter Selasky * Convert the fractions from units of the file-supplied resolution
1391b00ab754SHans Petter Selasky * to units of the user-requested resolution.
1392b00ab754SHans Petter Selasky */
1393b00ab754SHans Petter Selasky switch (ps->ifaces[interface_id].scale_type) {
1394b00ab754SHans Petter Selasky
1395b00ab754SHans Petter Selasky case PASS_THROUGH:
1396b00ab754SHans Petter Selasky /*
1397b00ab754SHans Petter Selasky * The interface resolution is what the user wants,
1398b00ab754SHans Petter Selasky * so we're done.
1399b00ab754SHans Petter Selasky */
1400b00ab754SHans Petter Selasky break;
1401b00ab754SHans Petter Selasky
1402b00ab754SHans Petter Selasky case SCALE_UP_DEC:
1403b00ab754SHans Petter Selasky /*
1404b00ab754SHans Petter Selasky * The interface resolution is less than what the user
1405b00ab754SHans Petter Selasky * wants; scale the fractional part up to the units of
1406b00ab754SHans Petter Selasky * the resolution the user requested by multiplying by
1407b00ab754SHans Petter Selasky * the quotient of the user-requested resolution and the
1408b00ab754SHans Petter Selasky * file-supplied resolution.
1409b00ab754SHans Petter Selasky *
1410b00ab754SHans Petter Selasky * Those resolutions are both powers of 10, and the user-
1411b00ab754SHans Petter Selasky * requested resolution is greater than the file-supplied
1412b00ab754SHans Petter Selasky * resolution, so the quotient in question is an integer.
1413b00ab754SHans Petter Selasky * We've calculated that quotient already, so we just
1414b00ab754SHans Petter Selasky * multiply by it.
1415b00ab754SHans Petter Selasky */
1416b00ab754SHans Petter Selasky frac *= ps->ifaces[interface_id].scale_factor;
1417b00ab754SHans Petter Selasky break;
1418b00ab754SHans Petter Selasky
1419b00ab754SHans Petter Selasky case SCALE_UP_BIN:
1420b00ab754SHans Petter Selasky /*
1421b00ab754SHans Petter Selasky * The interface resolution is less than what the user
1422b00ab754SHans Petter Selasky * wants; scale the fractional part up to the units of
1423b00ab754SHans Petter Selasky * the resolution the user requested by multiplying by
1424b00ab754SHans Petter Selasky * the quotient of the user-requested resolution and the
1425b00ab754SHans Petter Selasky * file-supplied resolution.
1426b00ab754SHans Petter Selasky *
1427b00ab754SHans Petter Selasky * The file-supplied resolution is a power of 2, so the
1428b00ab754SHans Petter Selasky * quotient is not an integer, so, in order to do this
1429b00ab754SHans Petter Selasky * entirely with integer arithmetic, we multiply by the
1430b00ab754SHans Petter Selasky * user-requested resolution and divide by the file-
1431b00ab754SHans Petter Selasky * supplied resolution.
1432b00ab754SHans Petter Selasky *
1433b00ab754SHans Petter Selasky * XXX - Is there something clever we could do here,
1434b00ab754SHans Petter Selasky * given that we know that the file-supplied resolution
1435b00ab754SHans Petter Selasky * is a power of 2? Doing a multiplication followed by
1436b00ab754SHans Petter Selasky * a division runs the risk of overflowing, and involves
1437b00ab754SHans Petter Selasky * two non-simple arithmetic operations.
1438b00ab754SHans Petter Selasky */
1439b00ab754SHans Petter Selasky frac *= ps->user_tsresol;
1440b00ab754SHans Petter Selasky frac /= ps->ifaces[interface_id].tsresol;
1441b00ab754SHans Petter Selasky break;
1442b00ab754SHans Petter Selasky
1443b00ab754SHans Petter Selasky case SCALE_DOWN_DEC:
1444b00ab754SHans Petter Selasky /*
1445b00ab754SHans Petter Selasky * The interface resolution is greater than what the user
1446b00ab754SHans Petter Selasky * wants; scale the fractional part up to the units of
1447b00ab754SHans Petter Selasky * the resolution the user requested by multiplying by
1448b00ab754SHans Petter Selasky * the quotient of the user-requested resolution and the
1449b00ab754SHans Petter Selasky * file-supplied resolution.
1450b00ab754SHans Petter Selasky *
1451b00ab754SHans Petter Selasky * Those resolutions are both powers of 10, and the user-
1452b00ab754SHans Petter Selasky * requested resolution is less than the file-supplied
1453b00ab754SHans Petter Selasky * resolution, so the quotient in question isn't an
1454b00ab754SHans Petter Selasky * integer, but its reciprocal is, and we can just divide
1455b00ab754SHans Petter Selasky * by the reciprocal of the quotient. We've calculated
1456b00ab754SHans Petter Selasky * the reciprocal of that quotient already, so we must
1457b00ab754SHans Petter Selasky * divide by it.
1458b00ab754SHans Petter Selasky */
1459b00ab754SHans Petter Selasky frac /= ps->ifaces[interface_id].scale_factor;
1460b00ab754SHans Petter Selasky break;
1461b00ab754SHans Petter Selasky
1462b00ab754SHans Petter Selasky
1463b00ab754SHans Petter Selasky case SCALE_DOWN_BIN:
1464b00ab754SHans Petter Selasky /*
1465b00ab754SHans Petter Selasky * The interface resolution is greater than what the user
1466b00ab754SHans Petter Selasky * wants; convert the fractional part to units of the
1467b00ab754SHans Petter Selasky * resolution the user requested by multiplying by the
1468b00ab754SHans Petter Selasky * quotient of the user-requested resolution and the
1469b00ab754SHans Petter Selasky * file-supplied resolution. We do that by multiplying
1470b00ab754SHans Petter Selasky * by the user-requested resolution and dividing by the
1471b00ab754SHans Petter Selasky * file-supplied resolution, as the quotient might not
1472b00ab754SHans Petter Selasky * fit in an integer.
1473b00ab754SHans Petter Selasky *
1474b00ab754SHans Petter Selasky * The file-supplied resolution is a power of 2, so the
1475b00ab754SHans Petter Selasky * quotient is not an integer, and neither is its
1476b00ab754SHans Petter Selasky * reciprocal, so, in order to do this entirely with
1477b00ab754SHans Petter Selasky * integer arithmetic, we multiply by the user-requested
1478b00ab754SHans Petter Selasky * resolution and divide by the file-supplied resolution.
1479b00ab754SHans Petter Selasky *
1480b00ab754SHans Petter Selasky * XXX - Is there something clever we could do here,
1481b00ab754SHans Petter Selasky * given that we know that the file-supplied resolution
1482b00ab754SHans Petter Selasky * is a power of 2? Doing a multiplication followed by
1483b00ab754SHans Petter Selasky * a division runs the risk of overflowing, and involves
1484b00ab754SHans Petter Selasky * two non-simple arithmetic operations.
1485b00ab754SHans Petter Selasky */
1486b00ab754SHans Petter Selasky frac *= ps->user_tsresol;
1487b00ab754SHans Petter Selasky frac /= ps->ifaces[interface_id].tsresol;
1488b00ab754SHans Petter Selasky break;
1489b00ab754SHans Petter Selasky }
1490b00ab754SHans Petter Selasky #ifdef _WIN32
1491b00ab754SHans Petter Selasky /*
1492b00ab754SHans Petter Selasky * tv_sec and tv_used in the Windows struct timeval are both
1493b00ab754SHans Petter Selasky * longs.
1494b00ab754SHans Petter Selasky */
1495b00ab754SHans Petter Selasky hdr->ts.tv_sec = (long)sec;
1496b00ab754SHans Petter Selasky hdr->ts.tv_usec = (long)frac;
1497b00ab754SHans Petter Selasky #else
1498b00ab754SHans Petter Selasky /*
1499b00ab754SHans Petter Selasky * tv_sec in the UN*X struct timeval is a time_t; tv_usec is
1500b00ab754SHans Petter Selasky * suseconds_t in UN*Xes that work the way the current Single
1501b00ab754SHans Petter Selasky * UNIX Standard specify - but not all older UN*Xes necessarily
1502b00ab754SHans Petter Selasky * support that type, so just cast to int.
1503b00ab754SHans Petter Selasky */
1504b00ab754SHans Petter Selasky hdr->ts.tv_sec = (time_t)sec;
1505b00ab754SHans Petter Selasky hdr->ts.tv_usec = (int)frac;
1506b00ab754SHans Petter Selasky #endif
1507b00ab754SHans Petter Selasky
1508b00ab754SHans Petter Selasky /*
1509b00ab754SHans Petter Selasky * Get a pointer to the packet data.
1510b00ab754SHans Petter Selasky */
1511b00ab754SHans Petter Selasky *data = get_from_block_data(&cursor, hdr->caplen, p->errbuf);
1512b00ab754SHans Petter Selasky if (*data == NULL)
1513b00ab754SHans Petter Selasky return (-1);
1514b00ab754SHans Petter Selasky
1515*6f9cba8fSJoseph Mingrone pcap_post_process(p->linktype, p->swapped, hdr, *data);
1516b00ab754SHans Petter Selasky
1517*6f9cba8fSJoseph Mingrone return (1);
1518b00ab754SHans Petter Selasky }
1519