Coverage Report

Created: 2023-09-24 16:01

/src/libpcap/sf-pcapng.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3
 *  The Regents of the University of California.  All rights reserved.
4
 *
5
 * Redistribution and use in source and binary forms, with or without
6
 * modification, are permitted provided that: (1) source code distributions
7
 * retain the above copyright notice and this paragraph in its entirety, (2)
8
 * distributions including binary code include the above copyright notice and
9
 * this paragraph in its entirety in the documentation or other materials
10
 * provided with the distribution, and (3) all advertising materials mentioning
11
 * features or use of this software display the following acknowledgement:
12
 * ``This product includes software developed by the University of California,
13
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14
 * the University nor the names of its contributors may be used to endorse
15
 * or promote products derived from this software without specific prior
16
 * written permission.
17
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20
 *
21
 * sf-pcapng.c - pcapng-file-format-specific code from savefile.c
22
 */
23
24
#ifdef HAVE_CONFIG_H
25
#include <config.h>
26
#endif
27
28
#include <pcap/pcap-inttypes.h>
29
30
#include <errno.h>
31
#include <memory.h>
32
#include <stdio.h>
33
#include <stdlib.h>
34
#include <string.h>
35
36
#include "pcap-int.h"
37
#include "pcap-util.h"
38
39
#include "pcap-common.h"
40
41
#ifdef HAVE_OS_PROTO_H
42
#include "os-proto.h"
43
#endif
44
45
#include "sf-pcapng.h"
46
47
/*
48
 * Block types.
49
 */
50
51
/*
52
 * Common part at the beginning of all blocks.
53
 */
54
struct block_header {
55
  bpf_u_int32 block_type;
56
  bpf_u_int32 total_length;
57
};
58
59
/*
60
 * Common trailer at the end of all blocks.
61
 */
62
struct block_trailer {
63
  bpf_u_int32 total_length;
64
};
65
66
/*
67
 * Common options.
68
 */
69
57
#define OPT_ENDOFOPT  0  /* end of options */
70
#define OPT_COMMENT 1 /* comment string */
71
72
/*
73
 * Option header.
74
 */
75
struct option_header {
76
  u_short   option_code;
77
  u_short   option_length;
78
};
79
80
/*
81
 * Structures for the part of each block type following the common
82
 * part.
83
 */
84
85
/*
86
 * Section Header Block.
87
 */
88
617
#define BT_SHB      0x0A0D0D0A
89
573
#define BT_SHB_INSANE_MAX       1024U*1024U*1U  /* 1MB should be enough */
90
struct section_header_block {
91
  bpf_u_int32 byte_order_magic;
92
  u_short   major_version;
93
  u_short   minor_version;
94
  uint64_t  section_length;
95
  /* followed by options and trailer */
96
};
97
98
/*
99
 * Byte-order magic value.
100
 */
101
881
#define BYTE_ORDER_MAGIC  0x1A2B3C4D
102
103
/*
104
 * Current version number.  If major_version isn't PCAP_NG_VERSION_MAJOR,
105
 * or if minor_version isn't PCAP_NG_VERSION_MINOR or 2, that means that
106
 * this code can't read the file.
107
 */
108
848
#define PCAP_NG_VERSION_MAJOR 1
109
786
#define PCAP_NG_VERSION_MINOR 0
110
111
/*
112
 * Interface Description Block.
113
 */
114
131
#define BT_IDB      0x00000001
115
116
struct interface_description_block {
117
  u_short   linktype;
118
  u_short   reserved;
119
  bpf_u_int32 snaplen;
120
  /* followed by options and trailer */
121
};
122
123
/*
124
 * Options in the IDB.
125
 */
126
#define IF_NAME   2 /* interface name string */
127
#define IF_DESCRIPTION  3 /* interface description string */
128
#define IF_IPV4ADDR 4 /* interface's IPv4 address and netmask */
129
#define IF_IPV6ADDR 5 /* interface's IPv6 address and prefix length */
130
#define IF_MACADDR  6 /* interface's MAC address */
131
#define IF_EUIADDR  7 /* interface's EUI address */
132
#define IF_SPEED  8 /* interface's speed, in bits/s */
133
62
#define IF_TSRESOL  9  /* interface's time stamp resolution */
134
#define IF_TZONE  10  /* interface's time zone */
135
#define IF_FILTER 11  /* filter used when capturing on interface */
136
#define IF_OS   12  /* string OS on which capture on this interface was done */
137
#define IF_FCSLEN 13  /* FCS length for this interface */
138
6
#define IF_TSOFFSET 14  /* time stamp offset for this interface */
139
140
/*
141
 * Enhanced Packet Block.
142
 */
143
6
#define BT_EPB      0x00000006
144
145
struct enhanced_packet_block {
146
  bpf_u_int32 interface_id;
147
  bpf_u_int32 timestamp_high;
148
  bpf_u_int32 timestamp_low;
149
  bpf_u_int32 caplen;
150
  bpf_u_int32 len;
151
  /* followed by packet data, options, and trailer */
152
};
153
154
/*
155
 * Simple Packet Block.
156
 */
157
14
#define BT_SPB      0x00000003
158
159
struct simple_packet_block {
160
  bpf_u_int32 len;
161
  /* followed by packet data and trailer */
162
};
163
164
/*
165
 * Packet Block.
166
 */
167
22
#define BT_PB     0x00000002
168
169
struct packet_block {
170
  u_short   interface_id;
171
  u_short   drops_count;
172
  bpf_u_int32 timestamp_high;
173
  bpf_u_int32 timestamp_low;
174
  bpf_u_int32 caplen;
175
  bpf_u_int32 len;
176
  /* followed by packet data, options, and trailer */
177
};
178
179
/*
180
 * Block cursor - used when processing the contents of a block.
181
 * Contains a pointer into the data being processed and a count
182
 * of bytes remaining in the block.
183
 */
184
struct block_cursor {
185
  u_char    *data;
186
  size_t    data_remaining;
187
  bpf_u_int32 block_type;
188
};
189
190
typedef enum {
191
  PASS_THROUGH,
192
  SCALE_UP_DEC,
193
  SCALE_DOWN_DEC,
194
  SCALE_UP_BIN,
195
  SCALE_DOWN_BIN
196
} tstamp_scale_type_t;
197
198
/*
199
 * Per-interface information.
200
 */
201
struct pcap_ng_if {
202
  uint32_t snaplen;   /* snapshot length */
203
  uint64_t tsresol;   /* time stamp resolution */
204
  tstamp_scale_type_t scale_type; /* how to scale */
205
  uint64_t scale_factor;    /* time stamp scale factor for power-of-10 tsresol */
206
  uint64_t tsoffset;    /* time stamp offset */
207
};
208
209
/*
210
 * Per-pcap_t private data.
211
 *
212
 * max_blocksize is the maximum size of a block that we'll accept.  We
213
 * reject blocks bigger than this, so we don't consume too much memory
214
 * with a truly huge block.  It can change as we see IDBs with different
215
 * link-layer header types.  (Currently, we don't support IDBs with
216
 * different link-layer header types, but we will support it in the
217
 * future, when we offer file-reading APIs that support it.)
218
 *
219
 * XXX - that's an issue on ILP32 platforms, where the maximum block
220
 * size of 2^31-1 would eat all but one byte of the entire address space.
221
 * It's less of an issue on ILP64/LLP64 platforms, but the actual size
222
 * of the address space may be limited by 1) the number of *significant*
223
 * address bits (currently, x86-64 only supports 48 bits of address), 2)
224
 * any limitations imposed by the operating system; 3) any limitations
225
 * imposed by the amount of available backing store for anonymous pages,
226
 * so we impose a limit regardless of the size of a pointer.
227
 */
228
struct pcap_ng_sf {
229
  uint64_t user_tsresol;    /* time stamp resolution requested by the user */
230
  u_int max_blocksize;    /* don't grow buffer size past this */
231
  bpf_u_int32 ifcount;    /* number of interfaces seen in this capture */
232
  bpf_u_int32 ifaces_size;  /* size of array below */
233
  struct pcap_ng_if *ifaces;  /* array of interface information */
234
};
235
236
/*
237
 * The maximum block size we start with; we use an arbitrary value of
238
 * 16 MiB.
239
 */
240
480
#define INITIAL_MAX_BLOCKSIZE (16*1024*1024)
241
242
/*
243
 * Maximum block size for a given maximum snapshot length; we define it
244
 * as the size of an EPB with a max_snaplen-sized packet and 128KB of
245
 * options.
246
 */
247
#define MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen) \
248
65
  (sizeof (struct block_header) + \
249
65
   sizeof (struct enhanced_packet_block) + \
250
65
   (max_snaplen) + 131072 + \
251
65
   sizeof (struct block_trailer))
252
253
static void pcap_ng_cleanup(pcap_t *p);
254
static int pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr,
255
    u_char **data);
256
257
static int
258
read_bytes(FILE *fp, void *buf, size_t bytes_to_read, int fail_on_eof,
259
    char *errbuf)
260
1.42k
{
261
1.42k
  size_t amt_read;
262
263
1.42k
  amt_read = fread(buf, 1, bytes_to_read, fp);
264
1.42k
  if (amt_read != bytes_to_read) {
265
170
    if (ferror(fp)) {
266
0
      pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
267
0
          errno, "error reading dump file");
268
170
    } else {
269
170
      if (amt_read == 0 && !fail_on_eof)
270
24
        return (0);  /* EOF */
271
146
      snprintf(errbuf, PCAP_ERRBUF_SIZE,
272
146
          "truncated pcapng dump file; tried to read %zu bytes, only got %zu",
273
146
          bytes_to_read, amt_read);
274
146
    }
275
146
    return (-1);
276
170
  }
277
1.25k
  return (1);
278
1.42k
}
279
280
static int
281
read_block(FILE *fp, pcap_t *p, struct block_cursor *cursor, char *errbuf)
282
541
{
283
541
  struct pcap_ng_sf *ps;
284
541
  int status;
285
541
  struct block_header bhdr;
286
541
  struct block_trailer *btrlr;
287
541
  u_char *bdata;
288
541
  size_t data_remaining;
289
290
541
  ps = p->priv;
291
292
541
  status = read_bytes(fp, &bhdr, sizeof(bhdr), 0, errbuf);
293
541
  if (status <= 0)
294
55
    return (status);  /* error or EOF */
295
296
486
  if (p->swapped) {
297
280
    bhdr.block_type = SWAPLONG(bhdr.block_type);
298
280
    bhdr.total_length = SWAPLONG(bhdr.total_length);
299
280
  }
300
301
  /*
302
   * Is this block "too small" - i.e., is it shorter than a block
303
   * header plus a block trailer?
304
   */
305
486
  if (bhdr.total_length < sizeof(struct block_header) +
306
486
      sizeof(struct block_trailer)) {
307
30
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
308
30
        "block in pcapng dump file has a length of %u < %zu",
309
30
        bhdr.total_length,
310
30
        sizeof(struct block_header) + sizeof(struct block_trailer));
311
30
    return (-1);
312
30
  }
313
314
  /*
315
   * Is the block total length a multiple of 4?
316
   */
317
456
  if ((bhdr.total_length % 4) != 0) {
318
    /*
319
     * No.  Report that as an error.
320
     */
321
29
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
322
29
        "block in pcapng dump file has a length of %u that is not a multiple of 4",
323
29
        bhdr.total_length);
324
29
    return (-1);
325
29
  }
326
327
  /*
328
   * Is the buffer big enough?
329
   */
330
427
  if (p->bufsize < bhdr.total_length) {
331
    /*
332
     * No - make it big enough, unless it's too big, in
333
     * which case we fail.
334
     */
335
48
    void *bigger_buffer;
336
337
48
    if (bhdr.total_length > ps->max_blocksize) {
338
26
      snprintf(errbuf, PCAP_ERRBUF_SIZE, "pcapng block size %u > maximum %u", bhdr.total_length,
339
26
          ps->max_blocksize);
340
26
      return (-1);
341
26
    }
342
22
    bigger_buffer = realloc(p->buffer, bhdr.total_length);
343
22
    if (bigger_buffer == NULL) {
344
0
      snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
345
0
      return (-1);
346
0
    }
347
22
    p->buffer = bigger_buffer;
348
22
  }
349
350
  /*
351
   * Copy the stuff we've read to the buffer, and read the rest
352
   * of the block.
353
   */
354
401
  memcpy(p->buffer, &bhdr, sizeof(bhdr));
355
401
  bdata = (u_char *)p->buffer + sizeof(bhdr);
356
401
  data_remaining = bhdr.total_length - sizeof(bhdr);
357
401
  if (read_bytes(fp, bdata, data_remaining, 1, errbuf) == -1)
358
59
    return (-1);
359
360
  /*
361
   * Get the block size from the trailer.
362
   */
363
342
  btrlr = (struct block_trailer *)(bdata + data_remaining - sizeof (struct block_trailer));
364
342
  if (p->swapped)
365
204
    btrlr->total_length = SWAPLONG(btrlr->total_length);
366
367
  /*
368
   * Is the total length from the trailer the same as the total
369
   * length from the header?
370
   */
371
342
  if (bhdr.total_length != btrlr->total_length) {
372
    /*
373
     * No.
374
     */
375
49
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
376
49
        "block total length in header and trailer don't match");
377
49
    return (-1);
378
49
  }
379
380
  /*
381
   * Initialize the cursor.
382
   */
383
293
  cursor->data = bdata;
384
293
  cursor->data_remaining = data_remaining - sizeof(struct block_trailer);
385
293
  cursor->block_type = bhdr.block_type;
386
293
  return (1);
387
342
}
388
389
static void *
390
get_from_block_data(struct block_cursor *cursor, size_t chunk_size,
391
    char *errbuf)
392
933
{
393
933
  void *data;
394
395
  /*
396
   * Make sure we have the specified amount of data remaining in
397
   * the block data.
398
   */
399
933
  if (cursor->data_remaining < chunk_size) {
400
32
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
401
32
        "block of type %u in pcapng dump file is too short",
402
32
        cursor->block_type);
403
32
    return (NULL);
404
32
  }
405
406
  /*
407
   * Return the current pointer, and skip past the chunk.
408
   */
409
901
  data = cursor->data;
410
901
  cursor->data += chunk_size;
411
901
  cursor->data_remaining -= chunk_size;
412
901
  return (data);
413
933
}
414
415
static struct option_header *
416
get_opthdr_from_block_data(pcap_t *p, struct block_cursor *cursor, char *errbuf)
417
400
{
418
400
  struct option_header *opthdr;
419
420
400
  opthdr = get_from_block_data(cursor, sizeof(*opthdr), errbuf);
421
400
  if (opthdr == NULL) {
422
    /*
423
     * Option header is cut short.
424
     */
425
0
    return (NULL);
426
0
  }
427
428
  /*
429
   * Byte-swap it if necessary.
430
   */
431
400
  if (p->swapped) {
432
273
    opthdr->option_code = SWAPSHORT(opthdr->option_code);
433
273
    opthdr->option_length = SWAPSHORT(opthdr->option_length);
434
273
  }
435
436
400
  return (opthdr);
437
400
}
438
439
static void *
440
get_optvalue_from_block_data(struct block_cursor *cursor,
441
    struct option_header *opthdr, char *errbuf)
442
400
{
443
400
  size_t padded_option_len;
444
400
  void *optvalue;
445
446
  /* Pad option length to 4-byte boundary */
447
400
  padded_option_len = opthdr->option_length;
448
400
  padded_option_len = ((padded_option_len + 3)/4)*4;
449
450
400
  optvalue = get_from_block_data(cursor, padded_option_len, errbuf);
451
400
  if (optvalue == NULL) {
452
    /*
453
     * Option value is cut short.
454
     */
455
31
    return (NULL);
456
31
  }
457
458
369
  return (optvalue);
459
400
}
460
461
static int
462
process_idb_options(pcap_t *p, struct block_cursor *cursor, uint64_t *tsresol,
463
    uint64_t *tsoffset, int *is_binary, char *errbuf)
464
130
{
465
130
  struct option_header *opthdr;
466
130
  void *optvalue;
467
130
  int saw_tsresol, saw_tsoffset;
468
130
  uint8_t tsresol_opt;
469
130
  u_int i;
470
471
130
  saw_tsresol = 0;
472
130
  saw_tsoffset = 0;
473
421
  while (cursor->data_remaining != 0) {
474
    /*
475
     * Get the option header.
476
     */
477
400
    opthdr = get_opthdr_from_block_data(p, cursor, errbuf);
478
400
    if (opthdr == NULL) {
479
      /*
480
       * Option header is cut short.
481
       */
482
0
      return (-1);
483
0
    }
484
485
    /*
486
     * Get option value.
487
     */
488
400
    optvalue = get_optvalue_from_block_data(cursor, opthdr,
489
400
        errbuf);
490
400
    if (optvalue == NULL) {
491
      /*
492
       * Option value is cut short.
493
       */
494
31
      return (-1);
495
31
    }
496
497
369
    switch (opthdr->option_code) {
498
499
57
    case OPT_ENDOFOPT:
500
57
      if (opthdr->option_length != 0) {
501
14
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
502
14
            "Interface Description Block has opt_endofopt option with length %u != 0",
503
14
            opthdr->option_length);
504
14
        return (-1);
505
14
      }
506
43
      goto done;
507
508
62
    case IF_TSRESOL:
509
62
      if (opthdr->option_length != 1) {
510
5
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
511
5
            "Interface Description Block has if_tsresol option with length %u != 1",
512
5
            opthdr->option_length);
513
5
        return (-1);
514
5
      }
515
57
      if (saw_tsresol) {
516
3
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
517
3
            "Interface Description Block has more than one if_tsresol option");
518
3
        return (-1);
519
3
      }
520
54
      saw_tsresol = 1;
521
54
      memcpy(&tsresol_opt, optvalue, sizeof(tsresol_opt));
522
54
      if (tsresol_opt & 0x80) {
523
        /*
524
         * Resolution is negative power of 2.
525
         */
526
13
        uint8_t tsresol_shift = (tsresol_opt & 0x7F);
527
528
13
        if (tsresol_shift > 63) {
529
          /*
530
           * Resolution is too high; 2^-{res}
531
           * won't fit in a 64-bit value.
532
           */
533
4
          snprintf(errbuf, PCAP_ERRBUF_SIZE,
534
4
              "Interface Description Block if_tsresol option resolution 2^-%u is too high",
535
4
              tsresol_shift);
536
4
          return (-1);
537
4
        }
538
9
        *is_binary = 1;
539
9
        *tsresol = ((uint64_t)1) << tsresol_shift;
540
41
      } else {
541
        /*
542
         * Resolution is negative power of 10.
543
         */
544
41
        if (tsresol_opt > 19) {
545
          /*
546
           * Resolution is too high; 2^-{res}
547
           * won't fit in a 64-bit value (the
548
           * largest power of 10 that fits
549
           * in a 64-bit value is 10^19, as
550
           * the largest 64-bit unsigned
551
           * value is ~1.8*10^19).
552
           */
553
4
          snprintf(errbuf, PCAP_ERRBUF_SIZE,
554
4
              "Interface Description Block if_tsresol option resolution 10^-%u is too high",
555
4
              tsresol_opt);
556
4
          return (-1);
557
4
        }
558
37
        *is_binary = 0;
559
37
        *tsresol = 1;
560
301
        for (i = 0; i < tsresol_opt; i++)
561
264
          *tsresol *= 10;
562
37
      }
563
46
      break;
564
565
46
    case IF_TSOFFSET:
566
6
      if (opthdr->option_length != 8) {
567
5
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
568
5
            "Interface Description Block has if_tsoffset option with length %u != 8",
569
5
            opthdr->option_length);
570
5
        return (-1);
571
5
      }
572
1
      if (saw_tsoffset) {
573
0
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
574
0
            "Interface Description Block has more than one if_tsoffset option");
575
0
        return (-1);
576
0
      }
577
1
      saw_tsoffset = 1;
578
1
      memcpy(tsoffset, optvalue, sizeof(*tsoffset));
579
1
      if (p->swapped)
580
0
        *tsoffset = SWAPLL(*tsoffset);
581
1
      break;
582
583
244
    default:
584
244
      break;
585
369
    }
586
369
  }
587
588
64
done:
589
64
  return (0);
590
130
}
591
592
static int
593
add_interface(pcap_t *p, struct interface_description_block *idbp,
594
    struct block_cursor *cursor, char *errbuf)
595
130
{
596
130
  struct pcap_ng_sf *ps;
597
130
  uint64_t tsresol;
598
130
  uint64_t tsoffset;
599
130
  int is_binary;
600
601
130
  ps = p->priv;
602
603
  /*
604
   * Count this interface.
605
   */
606
130
  ps->ifcount++;
607
608
  /*
609
   * Grow the array of per-interface information as necessary.
610
   */
611
130
  if (ps->ifcount > ps->ifaces_size) {
612
    /*
613
     * We need to grow the array.
614
     */
615
130
    bpf_u_int32 new_ifaces_size;
616
130
    struct pcap_ng_if *new_ifaces;
617
618
130
    if (ps->ifaces_size == 0) {
619
      /*
620
       * It's currently empty.
621
       *
622
       * (The Clang static analyzer doesn't do enough,
623
       * err, umm, dataflow *analysis* to realize that
624
       * ps->ifaces_size == 0 if ps->ifaces == NULL,
625
       * and so complains about a possible zero argument
626
       * to realloc(), so we check for the former
627
       * condition to shut it up.
628
       *
629
       * However, it doesn't complain that one of the
630
       * multiplications below could overflow, which is
631
       * a real, albeit extremely unlikely, problem (you'd
632
       * need a pcapng file with tens of millions of
633
       * interfaces).)
634
       */
635
130
      new_ifaces_size = 1;
636
130
      new_ifaces = malloc(sizeof (struct pcap_ng_if));
637
130
    } else {
638
      /*
639
       * It's not currently empty; double its size.
640
       * (Perhaps overkill once we have a lot of interfaces.)
641
       *
642
       * Check for overflow if we double it.
643
       */
644
0
      if (ps->ifaces_size * 2 < ps->ifaces_size) {
645
        /*
646
         * The maximum number of interfaces before
647
         * ps->ifaces_size overflows is the largest
648
         * possible 32-bit power of 2, as we do
649
         * size doubling.
650
         */
651
0
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
652
0
            "more than %u interfaces in the file",
653
0
            0x80000000U);
654
0
        return (0);
655
0
      }
656
657
      /*
658
       * ps->ifaces_size * 2 doesn't overflow, so it's
659
       * safe to multiply.
660
       */
661
0
      new_ifaces_size = ps->ifaces_size * 2;
662
663
      /*
664
       * Now make sure that's not so big that it overflows
665
       * if we multiply by sizeof (struct pcap_ng_if).
666
       *
667
       * That can happen on 32-bit platforms, with a 32-bit
668
       * size_t; it shouldn't happen on 64-bit platforms,
669
       * with a 64-bit size_t, as new_ifaces_size is
670
       * 32 bits.
671
       */
672
0
      if (new_ifaces_size * sizeof (struct pcap_ng_if) < new_ifaces_size) {
673
        /*
674
         * As this fails only with 32-bit size_t,
675
         * the multiplication was 32x32->32, and
676
         * the largest 32-bit value that can safely
677
         * be multiplied by sizeof (struct pcap_ng_if)
678
         * without overflow is the largest 32-bit
679
         * (unsigned) value divided by
680
         * sizeof (struct pcap_ng_if).
681
         */
682
0
        snprintf(errbuf, PCAP_ERRBUF_SIZE,
683
0
            "more than %u interfaces in the file",
684
0
            0xFFFFFFFFU / ((u_int)sizeof (struct pcap_ng_if)));
685
0
        return (0);
686
0
      }
687
0
      new_ifaces = realloc(ps->ifaces, new_ifaces_size * sizeof (struct pcap_ng_if));
688
0
    }
689
130
    if (new_ifaces == NULL) {
690
      /*
691
       * We ran out of memory.
692
       * Give up.
693
       */
694
0
      snprintf(errbuf, PCAP_ERRBUF_SIZE,
695
0
          "out of memory for per-interface information (%u interfaces)",
696
0
          ps->ifcount);
697
0
      return (0);
698
0
    }
699
130
    ps->ifaces_size = new_ifaces_size;
700
130
    ps->ifaces = new_ifaces;
701
130
  }
702
703
130
  ps->ifaces[ps->ifcount - 1].snaplen = idbp->snaplen;
704
705
  /*
706
   * Set the default time stamp resolution and offset.
707
   */
708
130
  tsresol = 1000000;  /* microsecond resolution */
709
130
  is_binary = 0;    /* which is a power of 10 */
710
130
  tsoffset = 0;   /* absolute timestamps */
711
712
  /*
713
   * Now look for various time stamp options, so we know
714
   * how to interpret the time stamps for this interface.
715
   */
716
130
  if (process_idb_options(p, cursor, &tsresol, &tsoffset, &is_binary,
717
130
      errbuf) == -1)
718
66
    return (0);
719
720
64
  ps->ifaces[ps->ifcount - 1].tsresol = tsresol;
721
64
  ps->ifaces[ps->ifcount - 1].tsoffset = tsoffset;
722
723
  /*
724
   * Determine whether we're scaling up or down or not
725
   * at all for this interface.
726
   */
727
64
  if (tsresol == ps->user_tsresol) {
728
    /*
729
     * The resolution is the resolution the user wants,
730
     * so we don't have to do scaling.
731
     */
732
39
    ps->ifaces[ps->ifcount - 1].scale_type = PASS_THROUGH;
733
39
  } else if (tsresol > ps->user_tsresol) {
734
    /*
735
     * The resolution is greater than what the user wants,
736
     * so we have to scale the timestamps down.
737
     */
738
12
    if (is_binary)
739
4
      ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_BIN;
740
8
    else {
741
      /*
742
       * Calculate the scale factor.
743
       */
744
8
      ps->ifaces[ps->ifcount - 1].scale_factor = tsresol/ps->user_tsresol;
745
8
      ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_DEC;
746
8
    }
747
13
  } else {
748
    /*
749
     * The resolution is less than what the user wants,
750
     * so we have to scale the timestamps up.
751
     */
752
13
    if (is_binary)
753
4
      ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_BIN;
754
9
    else {
755
      /*
756
       * Calculate the scale factor.
757
       */
758
9
      ps->ifaces[ps->ifcount - 1].scale_factor = ps->user_tsresol/tsresol;
759
9
      ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_DEC;
760
9
    }
761
13
  }
762
64
  return (1);
763
130
}
764
765
/*
766
 * Check whether this is a pcapng savefile and, if it is, extract the
767
 * relevant information from the header.
768
 */
769
pcap_t *
770
pcap_ng_check_header(const uint8_t *magic, FILE *fp, u_int precision,
771
    char *errbuf, int *err)
772
617
{
773
617
  bpf_u_int32 magic_int;
774
617
  size_t amt_read;
775
617
  bpf_u_int32 total_length;
776
617
  bpf_u_int32 byte_order_magic;
777
617
  struct block_header *bhdrp;
778
617
  struct section_header_block *shbp;
779
617
  pcap_t *p;
780
617
  int swapped = 0;
781
617
  struct pcap_ng_sf *ps;
782
617
  int status;
783
617
  struct block_cursor cursor;
784
617
  struct interface_description_block *idbp;
785
786
  /*
787
   * Assume no read errors.
788
   */
789
617
  *err = 0;
790
791
  /*
792
   * Check whether the first 4 bytes of the file are the block
793
   * type for a pcapng savefile.
794
   */
795
617
  memcpy(&magic_int, magic, sizeof(magic_int));
796
617
  if (magic_int != BT_SHB) {
797
    /*
798
     * XXX - check whether this looks like what the block
799
     * type would be after being munged by mapping between
800
     * UN*X and DOS/Windows text file format and, if it
801
     * does, look for the byte-order magic number in
802
     * the appropriate place and, if we find it, report
803
     * this as possibly being a pcapng file transferred
804
     * between UN*X and Windows in text file format?
805
     */
806
20
    return (NULL);  /* nope */
807
20
  }
808
809
  /*
810
   * OK, they are.  However, that's just \n\r\r\n, so it could,
811
   * conceivably, be an ordinary text file.
812
   *
813
   * It could not, however, conceivably be any other type of
814
   * capture file, so we can read the rest of the putative
815
   * Section Header Block; put the block type in the common
816
   * header, read the rest of the common header and the
817
   * fixed-length portion of the SHB, and look for the byte-order
818
   * magic value.
819
   */
820
597
  amt_read = fread(&total_length, 1, sizeof(total_length), fp);
821
597
  if (amt_read < sizeof(total_length)) {
822
20
    if (ferror(fp)) {
823
0
      pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
824
0
          errno, "error reading dump file");
825
0
      *err = 1;
826
0
      return (NULL);  /* fail */
827
0
    }
828
829
    /*
830
     * Possibly a weird short text file, so just say
831
     * "not pcapng".
832
     */
833
20
    return (NULL);
834
20
  }
835
577
  amt_read = fread(&byte_order_magic, 1, sizeof(byte_order_magic), fp);
836
577
  if (amt_read < sizeof(byte_order_magic)) {
837
20
    if (ferror(fp)) {
838
0
      pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
839
0
          errno, "error reading dump file");
840
0
      *err = 1;
841
0
      return (NULL);  /* fail */
842
0
    }
843
844
    /*
845
     * Possibly a weird short text file, so just say
846
     * "not pcapng".
847
     */
848
20
    return (NULL);
849
20
  }
850
557
  if (byte_order_magic != BYTE_ORDER_MAGIC) {
851
324
    byte_order_magic = SWAPLONG(byte_order_magic);
852
324
    if (byte_order_magic != BYTE_ORDER_MAGIC) {
853
      /*
854
       * Not a pcapng file.
855
       */
856
20
      return (NULL);
857
20
    }
858
304
    swapped = 1;
859
304
    total_length = SWAPLONG(total_length);
860
304
  }
861
862
  /*
863
   * Check the sanity of the total length.
864
   */
865
537
  if (total_length < sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer) ||
866
537
            (total_length > BT_SHB_INSANE_MAX)) {
867
57
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
868
57
        "Section Header Block in pcapng dump file has invalid length %zu < _%u_ < %u (BT_SHB_INSANE_MAX)",
869
57
        sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer),
870
57
        total_length,
871
57
        BT_SHB_INSANE_MAX);
872
873
57
    *err = 1;
874
57
    return (NULL);
875
57
  }
876
877
  /*
878
   * OK, this is a good pcapng file.
879
   * Allocate a pcap_t for it.
880
   */
881
480
  p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_ng_sf);
882
480
  if (p == NULL) {
883
    /* Allocation failed. */
884
0
    *err = 1;
885
0
    return (NULL);
886
0
  }
887
480
  p->swapped = swapped;
888
480
  ps = p->priv;
889
890
  /*
891
   * What precision does the user want?
892
   */
893
480
  switch (precision) {
894
895
480
  case PCAP_TSTAMP_PRECISION_MICRO:
896
480
    ps->user_tsresol = 1000000;
897
480
    break;
898
899
0
  case PCAP_TSTAMP_PRECISION_NANO:
900
0
    ps->user_tsresol = 1000000000;
901
0
    break;
902
903
0
  default:
904
0
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
905
0
        "unknown time stamp resolution %u", precision);
906
0
    free(p);
907
0
    *err = 1;
908
0
    return (NULL);
909
480
  }
910
911
480
  p->opt.tstamp_precision = precision;
912
913
  /*
914
   * Allocate a buffer into which to read blocks.  We default to
915
   * the maximum of:
916
   *
917
   *  the total length of the SHB for which we read the header;
918
   *
919
   *  2K, which should be more than large enough for an Enhanced
920
   *  Packet Block containing a full-size Ethernet frame, and
921
   *  leaving room for some options.
922
   *
923
   * If we find a bigger block, we reallocate the buffer, up to
924
   * the maximum size.  We start out with a maximum size of
925
   * INITIAL_MAX_BLOCKSIZE; if we see any link-layer header types
926
   * with a maximum snapshot that results in a larger maximum
927
   * block length, we boost the maximum.
928
   */
929
480
  p->bufsize = 2048;
930
480
  if (p->bufsize < total_length)
931
31
    p->bufsize = total_length;
932
480
  p->buffer = malloc(p->bufsize);
933
480
  if (p->buffer == NULL) {
934
0
    snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
935
0
    free(p);
936
0
    *err = 1;
937
0
    return (NULL);
938
0
  }
939
480
  ps->max_blocksize = INITIAL_MAX_BLOCKSIZE;
940
941
  /*
942
   * Copy the stuff we've read to the buffer, and read the rest
943
   * of the SHB.
944
   */
945
480
  bhdrp = (struct block_header *)p->buffer;
946
480
  shbp = (struct section_header_block *)((u_char *)p->buffer + sizeof(struct block_header));
947
480
  bhdrp->block_type = magic_int;
948
480
  bhdrp->total_length = total_length;
949
480
  shbp->byte_order_magic = byte_order_magic;
950
480
  if (read_bytes(fp,
951
480
      (u_char *)p->buffer + (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)),
952
480
      total_length - (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)),
953
480
      1, errbuf) == -1)
954
56
    goto fail;
955
956
424
  if (p->swapped) {
957
    /*
958
     * Byte-swap the fields we've read.
959
     */
960
247
    shbp->major_version = SWAPSHORT(shbp->major_version);
961
247
    shbp->minor_version = SWAPSHORT(shbp->minor_version);
962
963
    /*
964
     * XXX - we don't care about the section length.
965
     */
966
247
  }
967
  /* Currently only SHB versions 1.0 and 1.2 are supported;
968
     version 1.2 is treated as being the same as version 1.0.
969
     See the current version of the pcapng specification.
970
971
     Version 1.2 is written by some programs that write additional
972
     block types (which can be read by any code that handles them,
973
     regardless of whether the minor version if 0 or 2, so that's
974
     not a reason to change the minor version number).
975
976
     XXX - the pcapng specification says that readers should
977
     just ignore sections with an unsupported version number;
978
     presumably they can also report an error if they skip
979
     all the way to the end of the file without finding
980
     any versions that they support. */
981
424
  if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR &&
982
424
         (shbp->minor_version == PCAP_NG_VERSION_MINOR ||
983
393
          shbp->minor_version == 2))) {
984
48
    snprintf(errbuf, PCAP_ERRBUF_SIZE,
985
48
        "unsupported pcapng savefile version %u.%u",
986
48
        shbp->major_version, shbp->minor_version);
987
48
    goto fail;
988
48
  }
989
376
  p->version_major = shbp->major_version;
990
376
  p->version_minor = shbp->minor_version;
991
992
  /*
993
   * Save the time stamp resolution the user requested.
994
   */
995
376
  p->opt.tstamp_precision = precision;
996
997
  /*
998
   * Now start looking for an Interface Description Block.
999
   */
1000
511
  for (;;) {
1001
    /*
1002
     * Read the next block.
1003
     */
1004
511
    status = read_block(fp, p, &cursor, errbuf);
1005
511
    if (status == 0) {
1006
      /* EOF - no IDB in this file */
1007
20
      snprintf(errbuf, PCAP_ERRBUF_SIZE,
1008
20
          "the capture file has no Interface Description Blocks");
1009
20
      goto fail;
1010
20
    }
1011
491
    if (status == -1)
1012
203
      goto fail;  /* error */
1013
288
    switch (cursor.block_type) {
1014
1015
131
    case BT_IDB:
1016
      /*
1017
       * Get a pointer to the fixed-length portion of the
1018
       * IDB.
1019
       */
1020
131
      idbp = get_from_block_data(&cursor, sizeof(*idbp),
1021
131
          errbuf);
1022
131
      if (idbp == NULL)
1023
1
        goto fail;  /* error */
1024
1025
      /*
1026
       * Byte-swap it if necessary.
1027
       */
1028
130
      if (p->swapped) {
1029
89
        idbp->linktype = SWAPSHORT(idbp->linktype);
1030
89
        idbp->snaplen = SWAPLONG(idbp->snaplen);
1031
89
      }
1032
1033
      /*
1034
       * Try to add this interface.
1035
       */
1036
130
      if (!add_interface(p, idbp, &cursor, errbuf))
1037
66
        goto fail;
1038
1039
64
      goto done;
1040
1041
64
    case BT_EPB:
1042
13
    case BT_SPB:
1043
22
    case BT_PB:
1044
      /*
1045
       * Saw a packet before we saw any IDBs.  That's
1046
       * not valid, as we don't know what link-layer
1047
       * encapsulation the packet has.
1048
       */
1049
22
      snprintf(errbuf, PCAP_ERRBUF_SIZE,
1050
22
          "the capture file has a packet block before any Interface Description Blocks");
1051
22
      goto fail;
1052
1053
135
    default:
1054
      /*
1055
       * Just ignore it.
1056
       */
1057
135
      break;
1058
288
    }
1059
288
  }
1060
1061
64
done:
1062
64
  p->linktype = linktype_to_dlt(idbp->linktype);
1063
64
  p->snapshot = pcap_adjust_snapshot(p->linktype, idbp->snaplen);
1064
64
  p->linktype_ext = 0;
1065
1066
  /*
1067
   * If the maximum block size for a packet with the maximum
1068
   * snapshot length for this DLT_ is bigger than the current
1069
   * maximum block size, increase the maximum.
1070
   */
1071
64
  if (MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)) > ps->max_blocksize)
1072
1
    ps->max_blocksize = MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype));
1073
1074
64
  p->next_packet_op = pcap_ng_next_packet;
1075
64
  p->cleanup_op = pcap_ng_cleanup;
1076
1077
64
  return (p);
1078
1079
416
fail:
1080
416
  free(ps->ifaces);
1081
416
  free(p->buffer);
1082
416
  free(p);
1083
416
  *err = 1;
1084
416
  return (NULL);
1085
376
}
1086
1087
static void
1088
pcap_ng_cleanup(pcap_t *p)
1089
64
{
1090
64
  struct pcap_ng_sf *ps = p->priv;
1091
1092
64
  free(ps->ifaces);
1093
64
  sf_cleanup(p);
1094
64
}
1095
1096
/*
1097
 * Read and return the next packet from the savefile.  Return the header
1098
 * in hdr and a pointer to the contents in data.  Return 1 on success, 0
1099
 * if there were no more packets, and -1 on an error.
1100
 */
1101
static int
1102
pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
1103
26
{
1104
26
  struct pcap_ng_sf *ps = p->priv;
1105
26
  struct block_cursor cursor;
1106
26
  int status;
1107
26
  struct enhanced_packet_block *epbp;
1108
26
  struct simple_packet_block *spbp;
1109
26
  struct packet_block *pbp;
1110
26
  bpf_u_int32 interface_id = 0xFFFFFFFF;
1111
26
  struct interface_description_block *idbp;
1112
26
  struct section_header_block *shbp;
1113
26
  FILE *fp = p->rfile;
1114
26
  uint64_t t, sec, frac;
1115
1116
  /*
1117
   * Look for an Enhanced Packet Block, a Simple Packet Block,
1118
   * or a Packet Block.
1119
   */
1120
30
  for (;;) {
1121
    /*
1122
     * Read the block type and length; those are common
1123
     * to all blocks.
1124
     */
1125
30
    status = read_block(fp, p, &cursor, p->errbuf);
1126
30
    if (status == 0)
1127
4
      return (0);  /* EOF */
1128
26
    if (status == -1)
1129
21
      return (-1);  /* error */
1130
5
    switch (cursor.block_type) {
1131
1132
0
    case BT_EPB:
1133
      /*
1134
       * Get a pointer to the fixed-length portion of the
1135
       * EPB.
1136
       */
1137
0
      epbp = get_from_block_data(&cursor, sizeof(*epbp),
1138
0
          p->errbuf);
1139
0
      if (epbp == NULL)
1140
0
        return (-1); /* error */
1141
1142
      /*
1143
       * Byte-swap it if necessary.
1144
       */
1145
0
      if (p->swapped) {
1146
        /* these were written in opposite byte order */
1147
0
        interface_id = SWAPLONG(epbp->interface_id);
1148
0
        hdr->caplen = SWAPLONG(epbp->caplen);
1149
0
        hdr->len = SWAPLONG(epbp->len);
1150
0
        t = ((uint64_t)SWAPLONG(epbp->timestamp_high)) << 32 |
1151
0
            SWAPLONG(epbp->timestamp_low);
1152
0
      } else {
1153
0
        interface_id = epbp->interface_id;
1154
0
        hdr->caplen = epbp->caplen;
1155
0
        hdr->len = epbp->len;
1156
0
        t = ((uint64_t)epbp->timestamp_high) << 32 |
1157
0
            epbp->timestamp_low;
1158
0
      }
1159
0
      goto found;
1160
1161
1
    case BT_SPB:
1162
      /*
1163
       * Get a pointer to the fixed-length portion of the
1164
       * SPB.
1165
       */
1166
1
      spbp = get_from_block_data(&cursor, sizeof(*spbp),
1167
1
          p->errbuf);
1168
1
      if (spbp == NULL)
1169
0
        return (-1); /* error */
1170
1171
      /*
1172
       * SPB packets are assumed to have arrived on
1173
       * the first interface.
1174
       */
1175
1
      interface_id = 0;
1176
1177
      /*
1178
       * Byte-swap it if necessary.
1179
       */
1180
1
      if (p->swapped) {
1181
        /* these were written in opposite byte order */
1182
0
        hdr->len = SWAPLONG(spbp->len);
1183
0
      } else
1184
1
        hdr->len = spbp->len;
1185
1186
      /*
1187
       * The SPB doesn't give the captured length;
1188
       * it's the minimum of the snapshot length
1189
       * and the packet length.
1190
       */
1191
1
      hdr->caplen = hdr->len;
1192
1
      if (hdr->caplen > (bpf_u_int32)p->snapshot)
1193
0
        hdr->caplen = p->snapshot;
1194
1
      t = 0;  /* no time stamps */
1195
1
      goto found;
1196
1197
0
    case BT_PB:
1198
      /*
1199
       * Get a pointer to the fixed-length portion of the
1200
       * PB.
1201
       */
1202
0
      pbp = get_from_block_data(&cursor, sizeof(*pbp),
1203
0
          p->errbuf);
1204
0
      if (pbp == NULL)
1205
0
        return (-1); /* error */
1206
1207
      /*
1208
       * Byte-swap it if necessary.
1209
       */
1210
0
      if (p->swapped) {
1211
        /* these were written in opposite byte order */
1212
0
        interface_id = SWAPSHORT(pbp->interface_id);
1213
0
        hdr->caplen = SWAPLONG(pbp->caplen);
1214
0
        hdr->len = SWAPLONG(pbp->len);
1215
0
        t = ((uint64_t)SWAPLONG(pbp->timestamp_high)) << 32 |
1216
0
            SWAPLONG(pbp->timestamp_low);
1217
0
      } else {
1218
0
        interface_id = pbp->interface_id;
1219
0
        hdr->caplen = pbp->caplen;
1220
0
        hdr->len = pbp->len;
1221
0
        t = ((uint64_t)pbp->timestamp_high) << 32 |
1222
0
            pbp->timestamp_low;
1223
0
      }
1224
0
      goto found;
1225
1226
0
    case BT_IDB:
1227
      /*
1228
       * Interface Description Block.  Get a pointer
1229
       * to its fixed-length portion.
1230
       */
1231
0
      idbp = get_from_block_data(&cursor, sizeof(*idbp),
1232
0
          p->errbuf);
1233
0
      if (idbp == NULL)
1234
0
        return (-1); /* error */
1235
1236
      /*
1237
       * Byte-swap it if necessary.
1238
       */
1239
0
      if (p->swapped) {
1240
0
        idbp->linktype = SWAPSHORT(idbp->linktype);
1241
0
        idbp->snaplen = SWAPLONG(idbp->snaplen);
1242
0
      }
1243
1244
      /*
1245
       * If the link-layer type or snapshot length
1246
       * differ from the ones for the first IDB we
1247
       * saw, quit.
1248
       *
1249
       * XXX - just discard packets from those
1250
       * interfaces?
1251
       */
1252
0
      if (p->linktype != idbp->linktype) {
1253
0
        snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1254
0
            "an interface has a type %u different from the type of the first interface",
1255
0
            idbp->linktype);
1256
0
        return (-1);
1257
0
      }
1258
1259
      /*
1260
       * Check against the *adjusted* value of this IDB's
1261
       * snapshot length.
1262
       */
1263
0
      if ((bpf_u_int32)p->snapshot !=
1264
0
          pcap_adjust_snapshot(p->linktype, idbp->snaplen)) {
1265
0
        snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1266
0
            "an interface has a snapshot length %u different from the snapshot length of the first interface",
1267
0
            idbp->snaplen);
1268
0
        return (-1);
1269
0
      }
1270
1271
      /*
1272
       * Try to add this interface.
1273
       */
1274
0
      if (!add_interface(p, idbp, &cursor, p->errbuf))
1275
0
        return (-1);
1276
0
      break;
1277
1278
0
    case BT_SHB:
1279
      /*
1280
       * Section Header Block.  Get a pointer
1281
       * to its fixed-length portion.
1282
       */
1283
0
      shbp = get_from_block_data(&cursor, sizeof(*shbp),
1284
0
          p->errbuf);
1285
0
      if (shbp == NULL)
1286
0
        return (-1); /* error */
1287
1288
      /*
1289
       * Assume the byte order of this section is
1290
       * the same as that of the previous section.
1291
       * We'll check for that later.
1292
       */
1293
0
      if (p->swapped) {
1294
0
        shbp->byte_order_magic =
1295
0
            SWAPLONG(shbp->byte_order_magic);
1296
0
        shbp->major_version =
1297
0
            SWAPSHORT(shbp->major_version);
1298
0
      }
1299
1300
      /*
1301
       * Make sure the byte order doesn't change;
1302
       * pcap_is_swapped() shouldn't change its
1303
       * return value in the middle of reading a capture.
1304
       */
1305
0
      switch (shbp->byte_order_magic) {
1306
1307
0
      case BYTE_ORDER_MAGIC:
1308
        /*
1309
         * OK.
1310
         */
1311
0
        break;
1312
1313
0
      case SWAPLONG(BYTE_ORDER_MAGIC):
1314
        /*
1315
         * Byte order changes.
1316
         */
1317
0
        snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1318
0
            "the file has sections with different byte orders");
1319
0
        return (-1);
1320
1321
0
      default:
1322
        /*
1323
         * Not a valid SHB.
1324
         */
1325
0
        snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1326
0
            "the file has a section with a bad byte order magic field");
1327
0
        return (-1);
1328
0
      }
1329
1330
      /*
1331
       * Make sure the major version is the version
1332
       * we handle.
1333
       */
1334
0
      if (shbp->major_version != PCAP_NG_VERSION_MAJOR) {
1335
0
        snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1336
0
            "unknown pcapng savefile major version number %u",
1337
0
            shbp->major_version);
1338
0
        return (-1);
1339
0
      }
1340
1341
      /*
1342
       * Reset the interface count; this section should
1343
       * have its own set of IDBs.  If any of them
1344
       * don't have the same interface type, snapshot
1345
       * length, or resolution as the first interface
1346
       * we saw, we'll fail.  (And if we don't see
1347
       * any IDBs, we'll fail when we see a packet
1348
       * block.)
1349
       */
1350
0
      ps->ifcount = 0;
1351
0
      break;
1352
1353
4
    default:
1354
      /*
1355
       * Not a packet block, IDB, or SHB; ignore it.
1356
       */
1357
4
      break;
1358
5
    }
1359
5
  }
1360
1361
1
found:
1362
  /*
1363
   * Is the interface ID an interface we know?
1364
   */
1365
1
  if (interface_id >= ps->ifcount) {
1366
    /*
1367
     * Yes.  Fail.
1368
     */
1369
0
    snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1370
0
        "a packet arrived on interface %u, but there's no Interface Description Block for that interface",
1371
0
        interface_id);
1372
0
    return (-1);
1373
0
  }
1374
1375
1
  if (hdr->caplen > (bpf_u_int32)p->snapshot) {
1376
0
    snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1377
0
        "invalid packet capture length %u, bigger than "
1378
0
        "snaplen of %d", hdr->caplen, p->snapshot);
1379
0
    return (-1);
1380
0
  }
1381
1382
  /*
1383
   * Convert the time stamp to seconds and fractions of a second,
1384
   * with the fractions being in units of the file-supplied resolution.
1385
   */
1386
1
  sec = t / ps->ifaces[interface_id].tsresol + ps->ifaces[interface_id].tsoffset;
1387
1
  frac = t % ps->ifaces[interface_id].tsresol;
1388
1389
  /*
1390
   * Convert the fractions from units of the file-supplied resolution
1391
   * to units of the user-requested resolution.
1392
   */
1393
1
  switch (ps->ifaces[interface_id].scale_type) {
1394
1395
1
  case PASS_THROUGH:
1396
    /*
1397
     * The interface resolution is what the user wants,
1398
     * so we're done.
1399
     */
1400
1
    break;
1401
1402
0
  case SCALE_UP_DEC:
1403
    /*
1404
     * The interface resolution is less than what the user
1405
     * wants; scale the fractional part up to the units of
1406
     * the resolution the user requested by multiplying by
1407
     * the quotient of the user-requested resolution and the
1408
     * file-supplied resolution.
1409
     *
1410
     * Those resolutions are both powers of 10, and the user-
1411
     * requested resolution is greater than the file-supplied
1412
     * resolution, so the quotient in question is an integer.
1413
     * We've calculated that quotient already, so we just
1414
     * multiply by it.
1415
     */
1416
0
    frac *= ps->ifaces[interface_id].scale_factor;
1417
0
    break;
1418
1419
0
  case SCALE_UP_BIN:
1420
    /*
1421
     * The interface resolution is less than what the user
1422
     * wants; scale the fractional part up to the units of
1423
     * the resolution the user requested by multiplying by
1424
     * the quotient of the user-requested resolution and the
1425
     * file-supplied resolution.
1426
     *
1427
     * The file-supplied resolution is a power of 2, so the
1428
     * quotient is not an integer, so, in order to do this
1429
     * entirely with integer arithmetic, we multiply by the
1430
     * user-requested resolution and divide by the file-
1431
     * supplied resolution.
1432
     *
1433
     * XXX - Is there something clever we could do here,
1434
     * given that we know that the file-supplied resolution
1435
     * is a power of 2?  Doing a multiplication followed by
1436
     * a division runs the risk of overflowing, and involves
1437
     * two non-simple arithmetic operations.
1438
     */
1439
0
    frac *= ps->user_tsresol;
1440
0
    frac /= ps->ifaces[interface_id].tsresol;
1441
0
    break;
1442
1443
0
  case SCALE_DOWN_DEC:
1444
    /*
1445
     * The interface resolution is greater than what the user
1446
     * wants; scale the fractional part up to the units of
1447
     * the resolution the user requested by multiplying by
1448
     * the quotient of the user-requested resolution and the
1449
     * file-supplied resolution.
1450
     *
1451
     * Those resolutions are both powers of 10, and the user-
1452
     * requested resolution is less than the file-supplied
1453
     * resolution, so the quotient in question isn't an
1454
     * integer, but its reciprocal is, and we can just divide
1455
     * by the reciprocal of the quotient.  We've calculated
1456
     * the reciprocal of that quotient already, so we must
1457
     * divide by it.
1458
     */
1459
0
    frac /= ps->ifaces[interface_id].scale_factor;
1460
0
    break;
1461
1462
1463
0
  case SCALE_DOWN_BIN:
1464
    /*
1465
     * The interface resolution is greater than what the user
1466
     * wants; convert the fractional part to units of the
1467
     * resolution the user requested by multiplying by the
1468
     * quotient of the user-requested resolution and the
1469
     * file-supplied resolution.  We do that by multiplying
1470
     * by the user-requested resolution and dividing by the
1471
     * file-supplied resolution, as the quotient might not
1472
     * fit in an integer.
1473
     *
1474
     * The file-supplied resolution is a power of 2, so the
1475
     * quotient is not an integer, and neither is its
1476
     * reciprocal, so, in order to do this entirely with
1477
     * integer arithmetic, we multiply by the user-requested
1478
     * resolution and divide by the file-supplied resolution.
1479
     *
1480
     * XXX - Is there something clever we could do here,
1481
     * given that we know that the file-supplied resolution
1482
     * is a power of 2?  Doing a multiplication followed by
1483
     * a division runs the risk of overflowing, and involves
1484
     * two non-simple arithmetic operations.
1485
     */
1486
0
    frac *= ps->user_tsresol;
1487
0
    frac /= ps->ifaces[interface_id].tsresol;
1488
0
    break;
1489
1
  }
1490
#ifdef _WIN32
1491
  /*
1492
   * tv_sec and tv_used in the Windows struct timeval are both
1493
   * longs.
1494
   */
1495
  hdr->ts.tv_sec = (long)sec;
1496
  hdr->ts.tv_usec = (long)frac;
1497
#else
1498
  /*
1499
   * tv_sec in the UN*X struct timeval is a time_t; tv_usec is
1500
   * suseconds_t in UN*Xes that work the way the current Single
1501
   * UNIX Standard specify - but not all older UN*Xes necessarily
1502
   * support that type, so just cast to int.
1503
   */
1504
1
  hdr->ts.tv_sec = (time_t)sec;
1505
1
  hdr->ts.tv_usec = (int)frac;
1506
1
#endif
1507
1508
  /*
1509
   * Get a pointer to the packet data.
1510
   */
1511
1
  *data = get_from_block_data(&cursor, hdr->caplen, p->errbuf);
1512
1
  if (*data == NULL)
1513
0
    return (-1);
1514
1515
1
  pcap_post_process(p->linktype, p->swapped, hdr, *data);
1516
1517
1
  return (1);
1518
1
}