pcap-util.c:EXTRACT_BE_U_2: 78| 373|{ 79| | return ((uint16_t)ntohs(*(const uint16_t *)(p))); 80| 373|} pcap_freecode: 1494| 1.18k|{ 1495| 1.18k| program->bf_len = 0; 1496| 1.18k| if (program->bf_insns != NULL) { ------------------ | Branch (1496:6): [True: 0, False: 1.18k] ------------------ 1497| 0| free((char *)program->bf_insns); 1498| | program->bf_insns = NULL; 1499| 0| } 1500| 1.18k|} linktype_to_dlt: 1494| 1.18k|{ 1495| | /* 1496| | * All values in the low matching range were handed out before 1497| | * assigning DLT_* codes became a free-for-all, so they're the 1498| | * same on all platforms, and are thus used as the LINKTYPE_* 1499| | * codes in capture files. 1500| | */ 1501| 1.18k| if (linktype >= LINKTYPE_LOW_MATCHING_MIN && ------------------ | | 110| 2.36k|#define LINKTYPE_LOW_MATCHING_MIN 0 /* lowest value in this "matching" range */ ------------------ | Branch (1501:6): [True: 1.18k, False: 0] ------------------ 1502| 1.18k| linktype <= LINKTYPE_LOW_MATCHING_MAX) ------------------ | | 123| 1.18k|#define LINKTYPE_LOW_MATCHING_MAX LINKTYPE_FDDI /* highest value in this "matching" range */ | | ------------------ | | | | 121| 1.18k|#define LINKTYPE_FDDI DLT_FDDI | | | | ------------------ | | | | | | 77| 1.18k|#define DLT_FDDI 10 /* FDDI */ | | | | ------------------ | | ------------------ ------------------ | Branch (1502:6): [True: 516, False: 668] ------------------ 1503| 516| return (linktype); 1504| | 1505| |#if LINKTYPE_PFSYNC != DLT_PFSYNC 1506| | /* 1507| | * DLT_PFSYNC has a code on several platforms that's in the 1508| | * non-matching range, a code on FreeBSD that's in the high 1509| | * matching range and that's *not* equal to LINKTYPE_PFSYNC, 1510| | * and has a code on the rmaining platforms that's equal 1511| | * to LINKTYPE_PFSYNC, which is in the high matching range. 1512| | * 1513| | * Map LINKTYPE_PFSYNC to whatever DLT_PFSYNC is on this 1514| | * platform, if the two aren't equal. 1515| | */ 1516| | if (linktype == LINKTYPE_PFSYNC) 1517| | return (DLT_PFSYNC); 1518| |#endif 1519| | 1520| | /* 1521| | * DLT_PKTAP is defined as DLT_USER2 - which is in the high 1522| | * matching range - on Darwin because Apple used DLT_USER2 1523| | * on systems that users ran, not just as an internal thing. 1524| | * 1525| | * We map LINKTYPE_PKTAP to the platform's DLT_PKTAP for 1526| | * the benefit of software that's expecting DLT_PKTAP 1527| | * (even if that's DLT_USER2) for an Apple PKTAP capture. 1528| | * 1529| | * (Yes, this is an annoyance if you want to read a 1530| | * LINKTYPE_USER2 packet as something other than DLT_PKTAP 1531| | * on a Darwin-based OS, as, on that OS, DLT_PKTAP and DLT_USER2 1532| | * are the same. Feel free to complain to Apple about this.) 1533| | */ 1534| |#if LINKTYPE_PKTAP != DLT_PKTAP 1535| | if (linktype == LINKTYPE_PKTAP) 1536| | return (DLT_PKTAP); 1537| |#endif 1538| | 1539| | /* 1540| | * These DLT_* codes have different values on different 1541| | * platforms, so we assigned them LINKTYPE_* codes just 1542| | * below the lower bound of the high matching range; 1543| | * those values should never be equal to any DLT_* 1544| | * code, so that should avoid collisions. 1545| | * 1546| | * That way, for example, "raw IP" packets will have 1547| | * LINKTYPE_RAW as the code in all savefiles for 1548| | * which the code that writes them maps to that 1549| | * value, regardless of the platform on which they 1550| | * were written, so they should be readable on all 1551| | * platforms without having to determine on which 1552| | * platform they were written. 1553| | * 1554| | * We map the LINKTYPE_* codes to the corresponding 1555| | * DLT_* code on this platform. 1556| | */ 1557| 668| if (linktype == LINKTYPE_ATM_RFC1483) ------------------ | | 152| 668|#define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ ------------------ | Branch (1557:6): [True: 3, False: 665] ------------------ 1558| 3| return (DLT_ATM_RFC1483); ------------------ | | 109| 3|#define DLT_ATM_RFC1483 11 /* LLC-encapsulated ATM */ ------------------ 1559| 665| if (linktype == LINKTYPE_RAW) ------------------ | | 153| 665|#define LINKTYPE_RAW 101 /* raw IP */ ------------------ | Branch (1559:6): [True: 4, False: 661] ------------------ 1560| 4| return (DLT_RAW); ------------------ | | 114| 4|#define DLT_RAW 12 /* raw IP */ ------------------ 1561| 661| if (linktype == LINKTYPE_SLIP_BSDOS) ------------------ | | 154| 661|#define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ ------------------ | Branch (1561:6): [True: 1, False: 660] ------------------ 1562| 1| return (DLT_SLIP_BSDOS); ------------------ | | 129| 1|#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ ------------------ 1563| 660| if (linktype == LINKTYPE_PPP_BSDOS) ------------------ | | 155| 660|#define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ ------------------ | Branch (1563:6): [True: 2, False: 658] ------------------ 1564| 2| return (DLT_PPP_BSDOS); ------------------ | | 130| 2|#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ ------------------ 1565| | 1566| | /* 1567| | * These DLT_* codes were originally defined on some platform, 1568| | * and weren't defined on other platforms. 1569| | * 1570| | * At least some of them have values, on at least one platform, 1571| | * that collide with other DLT_* codes on other platforms, e.g. 1572| | * DLT_LOOP, so we don't just define them, on all platforms, 1573| | * as having the same value as on the original platform. 1574| | * 1575| | * Therefore, we assigned new LINKTYPE_* codes to them, and, 1576| | * on the platforms where they weren't originally defined, 1577| | * define the DLT_* codes to have the same value as the 1578| | * corresponding LINKTYPE_* codes. 1579| | * 1580| | * This means that, for capture files with the original 1581| | * platform's DLT_* code rather than the LINKTYPE_* code 1582| | * as a link-layer type, we will recognize those types 1583| | * on that platform, but not on other platforms. 1584| | * 1585| | * We map the LINKTYPE_* codes to the corresponding 1586| | * DLT_* code on platforms where the two codes differ.. 1587| | */ 1588| |#ifdef DLT_FR 1589| | /* BSD/OS Frame Relay */ 1590| | if (linktype == LINKTYPE_FRELAY) 1591| | return (DLT_FR); 1592| |#endif 1593| |#if LINKTYPE_NETBSD_HDLC != DLT_HDLC 1594| | /* NetBSD HDLC */ 1595| | if (linktype == LINKTYPE_NETBSD_HDLC) 1596| | return (DLT_HDLC); 1597| |#endif 1598| |#if LINKTYPE_C_HDLC != DLT_C_HDLC 1599| | /* BSD/OS Cisco HDLC */ 1600| | if (linktype == LINKTYPE_C_HDLC) 1601| | return (DLT_C_HDLC); 1602| |#endif 1603| |#if LINKTYPE_LOOP != DLT_LOOP 1604| | /* OpenBSD DLT_LOOP */ 1605| | if (linktype == LINKTYPE_LOOP) 1606| | return (DLT_LOOP); 1607| |#endif 1608| |#if LINKTYPE_ENC != DLT_ENC 1609| | /* OpenBSD DLT_ENC */ 1610| | if (linktype == LINKTYPE_ENC) 1611| | return (DLT_ENC); 1612| |#endif 1613| | 1614| | /* 1615| | * These DLT_* codes are not on all platforms, but, so far, 1616| | * there don't appear to be any platforms that define 1617| | * other codes with those values; we map them to 1618| | * different LINKTYPE_* values anyway, just in case. 1619| | * 1620| | * LINKTYPE_ATM_CLIP is a special case. DLT_ATM_CLIP is 1621| | * not on all platforms, but, so far, there don't appear 1622| | * to be any platforms that define it as anything other 1623| | * than 19; we define LINKTYPE_ATM_CLIP as something 1624| | * other than 19, just in case. That value is in the 1625| | * high matching range, so we have to check for it. 1626| | */ 1627| | /* Linux ATM Classical IP */ 1628| 658| if (linktype == LINKTYPE_ATM_CLIP) ------------------ | | 171| 658|#define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ ------------------ | Branch (1628:6): [True: 6, False: 652] ------------------ 1629| 6| return (DLT_ATM_CLIP); ------------------ | | 224| 6|#define DLT_ATM_CLIP 19 /* Linux Classical IP over ATM */ ------------------ 1630| | 1631| | /* 1632| | * For all other values, return the linktype code as the 1633| | * DLT_* code. 1634| | * 1635| | * If the code is in the high matching range, the 1636| | * DLT_* code is the same as the LINKTYPE_* code. 1637| | * 1638| | * If the code is greater than the maximum value in 1639| | * the high matching range, it may be a value from 1640| | * a newer version of libpcap; we provide it in case 1641| | * the program' capable of handling it. 1642| | * 1643| | * If the code is less than the minimum value in the 1644| | * high matching range, it might be from a capture 1645| | * written by code that doesn't map non-matching range 1646| | * DLT_* codes to the appropriate LINKTYPE_* code, so 1647| | * we'll just pass it through, so that *if it was written 1648| | * on this platform* it will be interpreted correctly. 1649| | * (We don't know whether it was written on this platform, 1650| | * but at least this way there's *some* chance that it 1651| | * can be read.) 1652| | */ 1653| 652| return linktype; 1654| 658|} max_snaplen_for_dlt: 1675| 22.3k|{ 1676| 22.3k| switch (dlt) { 1677| | 1678| 226| case DLT_DBUS: ------------------ | | 1171| 226|#define DLT_DBUS 231 ------------------ | Branch (1678:2): [True: 226, False: 22.1k] ------------------ 1679| 226| return 128*1024*1024; 1680| | 1681| 300| case DLT_EBHSCR: ------------------ | | 1538| 300|#define DLT_EBHSCR 279 ------------------ | Branch (1681:2): [True: 300, False: 22.0k] ------------------ 1682| 300| return 8*1024*1024; 1683| | 1684| 817| case DLT_USBPCAP: ------------------ | | 1303| 817|#define DLT_USBPCAP 249 ------------------ | Branch (1684:2): [True: 817, False: 21.5k] ------------------ 1685| 817| return 1024*1024; 1686| | 1687| 20.9k| default: ------------------ | Branch (1687:2): [True: 20.9k, False: 1.34k] ------------------ 1688| 20.9k| return MAXIMUM_SNAPLEN; ------------------ | | 156| 20.9k|#define MAXIMUM_SNAPLEN 262144 ------------------ 1689| 22.3k| } 1690| 22.3k|} pcapint_post_process: 508| 21.4k|{ 509| 21.4k| if (swapped) ------------------ | Branch (509:6): [True: 4.55k, False: 16.8k] ------------------ 510| 4.55k| swap_pseudo_headers(linktype, hdr, data); 511| | 512| | /* 513| | * Is this a memory-mapped Linux USB capture? 514| | */ 515| 21.4k| if (linktype == DLT_USB_LINUX_MMAPPED) { ------------------ | | 1034| 21.4k|#define DLT_USB_LINUX_MMAPPED 220 ------------------ | Branch (515:6): [True: 825, False: 20.5k] ------------------ 516| | /* 517| | * Yes. 518| | * 519| | * In older versions of libpcap, in memory-mapped Linux 520| | * USB captures, the original length of completion events 521| | * for incoming isochronous transfers was miscalculated; 522| | * it needed to be calculated based on the offsets and 523| | * lengths in the descriptors, not on the raw URB length, 524| | * but it wasn't. 525| | * 526| | * If this packet contains transferred data (yes, data_flag 527| | * is 0 if we *do* have data), it's a completion event 528| | * for an incoming isochronous transfer, and the 529| | * transfer length appears to have been calculated 530| | * from the raw URB length, fix it. 531| | * 532| | * We only do this if we have the full USB pseudo-header, 533| | * because we will have to look at that header and at 534| | * all of the isochronous descriptors. 535| | */ 536| 825| if (hdr->caplen < sizeof (pcap_usb_header_mmapped)) { ------------------ | Branch (536:7): [True: 825, False: 0] ------------------ 537| | /* 538| | * We don't have the full pseudo-header. 539| | */ 540| 825| return; 541| 825| } 542| | 543| 0| const pcap_usb_header_mmapped *usb_hdr = 544| 0| (const pcap_usb_header_mmapped *) data; 545| | 546| | /* 547| | * Make sure the number of descriptors is sane. 548| | * 549| | * The Linux binary USB monitor code limits the number of 550| | * isochronous descriptors to 128; if the number in the file 551| | * is larger than that, either 1) the file's been damaged 552| | * or 2) the file was produced after the number was raised 553| | * in the kernel. 554| | * 555| | * In case 1), the number can't be trusted, so don't rely on 556| | * it to attempt to fix the original length field in the pcap 557| | * or pcapng header. 558| | * 559| | * In case 2), the system was probably running a version of 560| | * libpcap that didn't miscalculate the original length, so 561| | * it probably doesn't need to be fixed. 562| | * 563| | * This avoids the possibility of the product of the number of 564| | * descriptors and the size of descriptors won't overflow an 565| | * unsigned 32-bit integer. 566| | */ 567| 0| if (usb_hdr->ndesc > USB_MAXDESC) ------------------ | | 132| 0|#define USB_MAXDESC 128 ------------------ | Branch (567:7): [True: 0, False: 0] ------------------ 568| 0| return; 569| | 570| 0| if (!usb_hdr->data_flag && ------------------ | Branch (570:7): [True: 0, False: 0] ------------------ 571| 0| is_isochronous_transfer_completion(usb_hdr) && ------------------ | Branch (571:7): [True: 0, False: 0] ------------------ 572| 0| packet_length_might_be_wrong(hdr, usb_hdr)) { ------------------ | Branch (572:7): [True: 0, False: 0] ------------------ 573| 0| u_int len; 574| | 575| | /* 576| | * Make sure we have all of the descriptors, 577| | * as we will have to look at all of them. 578| | * 579| | * If not, we don't bother trying to fix 580| | * anything. 581| | */ 582| 0| if (hdr->caplen < iso_pseudo_header_len(usb_hdr)) ------------------ | Branch (582:8): [True: 0, False: 0] ------------------ 583| 0| return; 584| | 585| | /* 586| | * Calculate what the length should have been. 587| | */ 588| 0| len = incoming_isochronous_transfer_completed_len(hdr, 589| 0| data); 590| | 591| | /* 592| | * len is the smaller of UINT_MAX and the total 593| | * header plus data length. That's guaranteed 594| | * to fit in a UINT_MAX. 595| | * 596| | * Don't reduce the original length to a value 597| | * below the captured length, however, as that 598| | * is bogus. 599| | */ 600| 0| if (len >= hdr->caplen) ------------------ | Branch (600:8): [True: 0, False: 0] ------------------ 601| 0| hdr->len = len; 602| | 603| | /* 604| | * If the captured length is greater than the 605| | * length, use the captured length. 606| | * 607| | * For completion events for incoming isochronous 608| | * transfers, it's based on data_len, which is 609| | * calculated the same way we calculated 610| | * pre_truncation_data_len above, except that 611| | * it has access to all the isochronous descriptors, 612| | * not just the ones that the kernel were able to 613| | * provide us or, for a capture file, that weren't 614| | * sliced off by a snapshot length. 615| | * 616| | * However, it might have been reduced by the USB 617| | * capture mechanism arbitrarily limiting the amount 618| | * of data it provides to userland, or by the libpcap 619| | * capture code limiting it to being no more than the 620| | * snapshot, so we don't want to just use it all the 621| | * time; we only do so to try to get a better estimate 622| | * of the actual length - and to make sure the 623| | * original length is always >= the captured length. 624| | */ 625| 0| if (hdr->caplen > hdr->len) ------------------ | Branch (625:8): [True: 0, False: 0] ------------------ 626| 0| hdr->len = hdr->caplen; 627| 0| } 628| 0| } 629| 21.4k|} pcap-util.c:swap_pseudo_headers: 453| 4.55k|{ 454| | /* 455| | * Convert pseudo-headers from the byte order of 456| | * the host on which the file was saved to our 457| | * byte order, as necessary. 458| | */ 459| 4.55k| switch (linktype) { ------------------ | Branch (459:10): [True: 4.10k, False: 448] ------------------ 460| | 461| 209| case DLT_PFLOG: ------------------ | | 367| 209|#define DLT_PFLOG 117 ------------------ | Branch (461:2): [True: 209, False: 4.34k] ------------------ 462| 209| swap_pflog_header(hdr, data); 463| 209| break; 464| | 465| 2.50k| case DLT_LINUX_SLL: ------------------ | | 347| 2.50k|#define DLT_LINUX_SLL 113 ------------------ | Branch (465:2): [True: 2.50k, False: 2.04k] ------------------ 466| 2.50k| swap_linux_sll_socketcan_header(hdr, data); 467| 2.50k| break; 468| | 469| 799| case DLT_LINUX_SLL2: ------------------ | | 1510| 799|#define DLT_LINUX_SLL2 276 ------------------ | Branch (469:2): [True: 799, False: 3.75k] ------------------ 470| 799| swap_linux_sll2_socketcan_header(hdr, data); 471| 799| break; 472| | 473| 68| case DLT_USB_LINUX: ------------------ | | 797| 68|#define DLT_USB_LINUX 189 ------------------ | Branch (473:2): [True: 68, False: 4.48k] ------------------ 474| 68| swap_linux_usb_header(hdr, data, 0); 475| 68| break; 476| | 477| 206| case DLT_USB_LINUX_MMAPPED: ------------------ | | 1034| 206|#define DLT_USB_LINUX_MMAPPED 220 ------------------ | Branch (477:2): [True: 206, False: 4.34k] ------------------ 478| 206| swap_linux_usb_header(hdr, data, 1); 479| 206| break; 480| | 481| 314| case DLT_NFLOG: ------------------ | | 1218| 314|#define DLT_NFLOG 239 ------------------ | Branch (481:2): [True: 314, False: 4.23k] ------------------ 482| 314| swap_nflog_header(hdr, data); 483| 314| break; 484| 4.55k| } 485| 4.55k|} pcap-util.c:swap_pflog_header: 52| 209|{ 53| 209| u_int caplen = hdr->caplen; 54| 209| u_int length = hdr->len; 55| 209| u_int pfloghdr_length; 56| 209| struct pfloghdr *pflhdr = (struct pfloghdr *)buf; 57| | 58| 209| if (caplen < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid) || ------------------ | Branch (58:6): [True: 209, False: 0] ------------------ 59| 209| length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) { ------------------ | Branch (59:6): [True: 0, False: 0] ------------------ 60| | /* Not enough data to have the uid field */ 61| 209| return; 62| 209| } 63| | 64| 0| pfloghdr_length = pflhdr->length; 65| | 66| 0| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) { ------------------ | Branch (66:6): [True: 0, False: 0] ------------------ 67| | /* Header doesn't include uid field */ 68| 0| return; 69| 0| } 70| 0| pflhdr->uid = SWAPLONG(pflhdr->uid); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 71| | 72| 0| if (caplen < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid) || ------------------ | Branch (72:6): [True: 0, False: 0] ------------------ 73| 0| length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) { ------------------ | Branch (73:6): [True: 0, False: 0] ------------------ 74| | /* Not enough data to have the pid field */ 75| 0| return; 76| 0| } 77| 0| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) { ------------------ | Branch (77:6): [True: 0, False: 0] ------------------ 78| | /* Header doesn't include pid field */ 79| 0| return; 80| 0| } 81| 0| pflhdr->pid = SWAPLONG(pflhdr->pid); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 82| | 83| 0| if (caplen < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid) || ------------------ | Branch (83:6): [True: 0, False: 0] ------------------ 84| 0| length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) { ------------------ | Branch (84:6): [True: 0, False: 0] ------------------ 85| | /* Not enough data to have the rule_uid field */ 86| 0| return; 87| 0| } 88| 0| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) { ------------------ | Branch (88:6): [True: 0, False: 0] ------------------ 89| | /* Header doesn't include rule_uid field */ 90| 0| return; 91| 0| } 92| 0| pflhdr->rule_uid = SWAPLONG(pflhdr->rule_uid); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 93| | 94| 0| if (caplen < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid) || ------------------ | Branch (94:6): [True: 0, False: 0] ------------------ 95| 0| length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) { ------------------ | Branch (95:6): [True: 0, False: 0] ------------------ 96| | /* Not enough data to have the rule_pid field */ 97| 0| return; 98| 0| } 99| 0| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) { ------------------ | Branch (99:6): [True: 0, False: 0] ------------------ 100| | /* Header doesn't include rule_pid field */ 101| 0| return; 102| 0| } 103| 0| pflhdr->rule_pid = SWAPLONG(pflhdr->rule_pid); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 104| 0|} pcap-util.c:swap_linux_sll_socketcan_header: 191| 2.50k|{ 192| 2.50k| u_int caplen = hdr->caplen; 193| 2.50k| u_int length = hdr->len; 194| 2.50k| struct sll_header *shdr = (struct sll_header *)buf; 195| | 196| 2.50k| if (caplen < (u_int) sizeof(struct sll_header) || ------------------ | Branch (196:6): [True: 1.98k, False: 522] ------------------ 197| 2.19k| length < (u_int) sizeof(struct sll_header)) { ------------------ | Branch (197:6): [True: 205, False: 317] ------------------ 198| | /* Not enough data to have the protocol field */ 199| 2.19k| return; 200| 2.19k| } 201| | 202| | /* 203| | * Byte-swap what needs to be byte-swapped. 204| | */ 205| 317| swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll_protocol), 206| 317| caplen - (u_int) sizeof(struct sll_header), 207| 317| length - (u_int) sizeof(struct sll_header), 208| 317| buf + sizeof(struct sll_header)); 209| 317|} pcap-util.c:swap_socketcan_header: 124| 373|{ 125| 373| pcap_can_socketcan_hdr *hdrp; 126| 373| pcap_can_socketcan_xl_hdr *xl_hdrp; 127| | 128| 373| switch (protocol) { 129| | 130| 22| case LINUX_SLL_P_CAN: ------------------ | | 142| 22|#define LINUX_SLL_P_CAN 0x000C /* CAN frames, with SocketCAN pseudo-headers */ ------------------ | Branch (130:2): [True: 22, False: 351] ------------------ 131| 118| case LINUX_SLL_P_CANFD: ------------------ | | 143| 118|#define LINUX_SLL_P_CANFD 0x000D /* CAN FD frames, with SocketCAN pseudo-headers */ ------------------ | Branch (131:2): [True: 96, False: 277] ------------------ 132| | /* 133| | * CAN classic/CAN FD packet; fix up the packet's header 134| | * by byte-swapping the CAN ID field. 135| | */ 136| 118| hdrp = (pcap_can_socketcan_hdr *)buf; 137| 118| if (caplen < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id) || ------------------ | Branch (137:7): [True: 15, False: 103] ------------------ 138| 103| length < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id)) { ------------------ | Branch (138:7): [True: 1, False: 102] ------------------ 139| | /* Not enough data to have the can_id field */ 140| 16| return; 141| 16| } 142| 102| hdrp->can_id = SWAPLONG(hdrp->can_id); ------------------ | | 54| 102| (((((u_int)(y))&0xff)<<24) | \ | | 55| 102| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 102| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 102| ((((u_int)(y))>>24)&0xff)) ------------------ 143| 102| break; 144| | 145| 189| case LINUX_SLL_P_CANXL: ------------------ | | 144| 189|#define LINUX_SLL_P_CANXL 0x000E /* CAN XL frames, with SocketCAN pseudo-headers */ ------------------ | Branch (145:2): [True: 189, False: 184] ------------------ 146| | /* 147| | * CAN XL packet; fix up the packet's header by 148| | * byte-swapping the priority/VCID field, the 149| | * payload length, and the acceptance field. 150| | */ 151| 189| xl_hdrp = (pcap_can_socketcan_xl_hdr *)buf; 152| 189| if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid) || ------------------ | Branch (152:7): [True: 13, False: 176] ------------------ 153| 176| length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid)) { ------------------ | Branch (153:7): [True: 1, False: 175] ------------------ 154| | /* Not enough data to have the priority_vcid field */ 155| 14| return; 156| 14| } 157| 175| xl_hdrp->priority_vcid = SWAPLONG(xl_hdrp->priority_vcid); ------------------ | | 54| 175| (((((u_int)(y))&0xff)<<24) | \ | | 55| 175| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 175| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 175| ((((u_int)(y))>>24)&0xff)) ------------------ 158| 175| if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length) || ------------------ | Branch (158:7): [True: 5, False: 170] ------------------ 159| 170| length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length)) { ------------------ | Branch (159:7): [True: 1, False: 169] ------------------ 160| | /* Not enough data to have the payload_length field */ 161| 6| return; 162| 6| } 163| 169| xl_hdrp->payload_length = SWAPSHORT(xl_hdrp->payload_length); ------------------ | | 59| 169| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 169| ((((u_int)(y))&0xff00)>>8))) ------------------ 164| 169| if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field) || ------------------ | Branch (164:7): [True: 12, False: 157] ------------------ 165| 157| length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field)) { ------------------ | Branch (165:7): [True: 0, False: 157] ------------------ 166| | /* Not enough data to have the acceptance_field field */ 167| 12| return; 168| 12| } 169| 157| xl_hdrp->acceptance_field = SWAPLONG(xl_hdrp->acceptance_field); ------------------ | | 54| 157| (((((u_int)(y))&0xff)<<24) | \ | | 55| 157| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 157| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 157| ((((u_int)(y))>>24)&0xff)) ------------------ 170| 157| break; 171| | 172| 66| default: ------------------ | Branch (172:2): [True: 66, False: 307] ------------------ 173| | /* 174| | * Not a CAN packet; nothing to do. 175| | */ 176| 66| break; 177| 373| } 178| 373|} pcap-util.c:swap_linux_sll2_socketcan_header: 216| 799|{ 217| 799| u_int caplen = hdr->caplen; 218| 799| u_int length = hdr->len; 219| 799| struct sll2_header *shdr = (struct sll2_header *)buf; 220| | 221| 799| if (caplen < (u_int) sizeof(struct sll2_header) || ------------------ | Branch (221:6): [True: 518, False: 281] ------------------ 222| 743| length < (u_int) sizeof(struct sll2_header)) { ------------------ | Branch (222:6): [True: 225, False: 56] ------------------ 223| | /* Not enough data to have the protocol field */ 224| 743| return; 225| 743| } 226| | 227| | /* 228| | * Byte-swap what needs to be byte-swapped. 229| | */ 230| 56| swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll2_protocol), 231| 56| caplen - (u_int) sizeof(struct sll2_header), 232| 56| length - (u_int) sizeof(struct sll2_header), 233| 56| buf + sizeof(struct sll2_header)); 234| 56|} pcap-util.c:swap_linux_usb_header: 248| 274|{ 249| 274| pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; 250| 274| bpf_u_int32 offset = 0; 251| | 252| | /* 253| | * "offset" is the offset *past* the field we're swapping; 254| | * we skip the field *before* checking to make sure 255| | * the captured data length includes the entire field. 256| | */ 257| | 258| | /* 259| | * The URB id is a totally opaque value; do we really need to 260| | * convert it to the reading host's byte order??? 261| | */ 262| 274| offset += 8; /* skip past id */ 263| 274| if (hdr->caplen < offset) ------------------ | Branch (263:6): [True: 274, False: 0] ------------------ 264| 274| return; 265| 0| uhdr->id = swap_4_byte_aligned_uint64(uhdr->id); 266| | 267| 0| offset += 4; /* skip past various 1-byte fields */ 268| | 269| 0| offset += 2; /* skip past bus_id */ 270| 0| if (hdr->caplen < offset) ------------------ | Branch (270:6): [True: 0, False: 0] ------------------ 271| 0| return; 272| 0| uhdr->bus_id = SWAPSHORT(uhdr->bus_id); ------------------ | | 59| 0| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 0| ((((u_int)(y))&0xff00)>>8))) ------------------ 273| | 274| 0| offset += 2; /* skip past various 1-byte fields */ 275| | 276| 0| offset += 8; /* skip past ts_sec */ 277| 0| if (hdr->caplen < offset) ------------------ | Branch (277:6): [True: 0, False: 0] ------------------ 278| 0| return; 279| 0| uhdr->ts_sec = swap_4_byte_aligned_int64(uhdr->ts_sec); 280| | 281| 0| offset += 4; /* skip past ts_usec */ 282| 0| if (hdr->caplen < offset) ------------------ | Branch (282:6): [True: 0, False: 0] ------------------ 283| 0| return; 284| 0| uhdr->ts_usec = SWAPLONG(uhdr->ts_usec); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 285| | 286| 0| offset += 4; /* skip past status */ 287| 0| if (hdr->caplen < offset) ------------------ | Branch (287:6): [True: 0, False: 0] ------------------ 288| 0| return; 289| 0| uhdr->status = SWAPLONG(uhdr->status); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 290| | 291| 0| offset += 4; /* skip past urb_len */ 292| 0| if (hdr->caplen < offset) ------------------ | Branch (292:6): [True: 0, False: 0] ------------------ 293| 0| return; 294| 0| uhdr->urb_len = SWAPLONG(uhdr->urb_len); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 295| | 296| 0| offset += 4; /* skip past data_len */ 297| 0| if (hdr->caplen < offset) ------------------ | Branch (297:6): [True: 0, False: 0] ------------------ 298| 0| return; 299| 0| uhdr->data_len = SWAPLONG(uhdr->data_len); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 300| | 301| 0| if (uhdr->transfer_type == URB_ISOCHRONOUS) { ------------------ | | 43| 0|#define URB_ISOCHRONOUS 0x0 ------------------ | Branch (301:6): [True: 0, False: 0] ------------------ 302| 0| offset += 4; /* skip past s.iso.error_count */ 303| 0| if (hdr->caplen < offset) ------------------ | Branch (303:7): [True: 0, False: 0] ------------------ 304| 0| return; 305| 0| uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 306| | 307| 0| offset += 4; /* skip past s.iso.numdesc */ 308| 0| if (hdr->caplen < offset) ------------------ | Branch (308:7): [True: 0, False: 0] ------------------ 309| 0| return; 310| 0| uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 311| 0| } else 312| 0| offset += 8; /* skip USB setup header */ 313| | 314| | /* 315| | * With the old header, there are no isochronous descriptors 316| | * after the header. 317| | * 318| | * With the new header, the actual number of descriptors in 319| | * the header is not s.iso.numdesc, it's ndesc - only the 320| | * first N descriptors, for some value of N, are put into 321| | * the header, and ndesc is set to the actual number copied. 322| | * In addition, if s.iso.numdesc is negative, no descriptors 323| | * are captured, and ndesc is set to 0. 324| | */ 325| 0| if (header_len_64_bytes) { ------------------ | Branch (325:6): [True: 0, False: 0] ------------------ 326| | /* 327| | * This is either the "version 1" header, with 328| | * 16 bytes of additional fields at the end, or 329| | * a "version 0" header from a memory-mapped 330| | * capture, with 16 bytes of zeroed-out padding 331| | * at the end. Byte swap them as if this were 332| | * a "version 1" header. 333| | */ 334| 0| offset += 4; /* skip past interval */ 335| 0| if (hdr->caplen < offset) ------------------ | Branch (335:7): [True: 0, False: 0] ------------------ 336| 0| return; 337| 0| uhdr->interval = SWAPLONG(uhdr->interval); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 338| | 339| 0| offset += 4; /* skip past start_frame */ 340| 0| if (hdr->caplen < offset) ------------------ | Branch (340:7): [True: 0, False: 0] ------------------ 341| 0| return; 342| 0| uhdr->start_frame = SWAPLONG(uhdr->start_frame); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 343| | 344| 0| offset += 4; /* skip past xfer_flags */ 345| 0| if (hdr->caplen < offset) ------------------ | Branch (345:7): [True: 0, False: 0] ------------------ 346| 0| return; 347| 0| uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 348| | 349| 0| offset += 4; /* skip past ndesc */ 350| 0| if (hdr->caplen < offset) ------------------ | Branch (350:7): [True: 0, False: 0] ------------------ 351| 0| return; 352| 0| uhdr->ndesc = SWAPLONG(uhdr->ndesc); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 353| | 354| 0| if (uhdr->transfer_type == URB_ISOCHRONOUS) { ------------------ | | 43| 0|#define URB_ISOCHRONOUS 0x0 ------------------ | Branch (354:7): [True: 0, False: 0] ------------------ 355| | /* swap the values in struct linux_usb_isodesc */ 356| 0| usb_isodesc *pisodesc; 357| 0| uint32_t i; 358| | 359| 0| pisodesc = (usb_isodesc *)(void *)(buf+offset); 360| 0| for (i = 0; i < uhdr->ndesc; i++) { ------------------ | Branch (360:16): [True: 0, False: 0] ------------------ 361| 0| offset += 4; /* skip past status */ 362| 0| if (hdr->caplen < offset) ------------------ | Branch (362:9): [True: 0, False: 0] ------------------ 363| 0| return; 364| 0| pisodesc->status = SWAPLONG(pisodesc->status); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 365| | 366| 0| offset += 4; /* skip past offset */ 367| 0| if (hdr->caplen < offset) ------------------ | Branch (367:9): [True: 0, False: 0] ------------------ 368| 0| return; 369| 0| pisodesc->offset = SWAPLONG(pisodesc->offset); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 370| | 371| 0| offset += 4; /* skip past len */ 372| 0| if (hdr->caplen < offset) ------------------ | Branch (372:9): [True: 0, False: 0] ------------------ 373| 0| return; 374| 0| pisodesc->len = SWAPLONG(pisodesc->len); ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ 375| | 376| 0| offset += 4; /* skip past padding */ 377| | 378| 0| pisodesc++; 379| 0| } 380| 0| } 381| 0| } 382| 0|} pcap-util.c:swap_nflog_header: 397| 314|{ 398| 314| u_char *p = buf; 399| 314| nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf; 400| 314| nflog_tlv_t *tlv; 401| 314| u_int caplen = hdr->caplen; 402| 314| u_int length = hdr->len; 403| 314| u_int size; 404| | 405| 314| if (caplen < (u_int) sizeof(nflog_hdr_t) || ------------------ | Branch (405:6): [True: 314, False: 0] ------------------ 406| 314| length < (u_int) sizeof(nflog_hdr_t)) { ------------------ | Branch (406:6): [True: 0, False: 0] ------------------ 407| | /* Not enough data to have any TLVs. */ 408| 314| return; 409| 314| } 410| | 411| 0| if (nfhdr->nflog_version != 0) { ------------------ | Branch (411:6): [True: 0, False: 0] ------------------ 412| | /* Unknown NFLOG version */ 413| 0| return; 414| 0| } 415| | 416| 0| length -= sizeof(nflog_hdr_t); 417| 0| caplen -= sizeof(nflog_hdr_t); 418| 0| p += sizeof(nflog_hdr_t); 419| | 420| 0| while (caplen >= sizeof(nflog_tlv_t)) { ------------------ | Branch (420:9): [True: 0, False: 0] ------------------ 421| 0| tlv = (nflog_tlv_t *) p; 422| | 423| | /* Swap the type and length. */ 424| 0| tlv->tlv_type = SWAPSHORT(tlv->tlv_type); ------------------ | | 59| 0| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 0| ((((u_int)(y))&0xff00)>>8))) ------------------ 425| 0| tlv->tlv_length = SWAPSHORT(tlv->tlv_length); ------------------ | | 59| 0| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 0| ((((u_int)(y))&0xff00)>>8))) ------------------ 426| | 427| | /* Get the length of the TLV. */ 428| 0| size = tlv->tlv_length; 429| 0| if (size % 4 != 0) ------------------ | Branch (429:7): [True: 0, False: 0] ------------------ 430| 0| size += 4 - size % 4; 431| | 432| | /* Is the TLV's length less than the minimum? */ 433| 0| if (size < sizeof(nflog_tlv_t)) { ------------------ | Branch (433:7): [True: 0, False: 0] ------------------ 434| | /* Yes. Give up now. */ 435| 0| return; 436| 0| } 437| | 438| | /* Do we have enough data for the full TLV? */ 439| 0| if (caplen < size || length < size) { ------------------ | Branch (439:7): [True: 0, False: 0] | Branch (439:24): [True: 0, False: 0] ------------------ 440| | /* No. */ 441| 0| return; 442| 0| } 443| | 444| | /* Skip over the TLV. */ 445| 0| length -= size; 446| 0| caplen -= size; 447| 0| p += size; 448| 0| } 449| 0|} pcapint_oneshot: 543| 21.4k|{ 544| 21.4k| struct oneshot_userdata *sp = (struct oneshot_userdata *)user; 545| | 546| 21.4k| *sp->hdr = *h; 547| 21.4k| *sp->pkt = pkt; 548| 21.4k|} pcap_next_ex: 567| 22.6k|{ 568| 22.6k| struct oneshot_userdata s; 569| | 570| 22.6k| s.hdr = &p->pcap_header; 571| 22.6k| s.pkt = pkt_data; 572| 22.6k| s.pd = p; 573| | 574| | /* Saves a pointer to the packet headers */ 575| 22.6k| *pkt_header= &p->pcap_header; 576| | 577| 22.6k| if (p->rfile != NULL) { ------------------ | Branch (577:6): [True: 22.6k, False: 0] ------------------ 578| 22.6k| int status; 579| | 580| | /* We are on an offline capture */ 581| 22.6k| status = pcapint_offline_read(p, 1, p->oneshot_callback, 582| 22.6k| (u_char *)&s); 583| | 584| | /* 585| | * Return codes for pcapint_offline_read() are: 586| | * - 0: EOF 587| | * - -1: error 588| | * - >0: OK - result is number of packets read, so 589| | * it will be 1 in this case, as we've passed 590| | * a maximum packet count of 1 591| | * The first one ('0') conflicts with the return code of 592| | * 0 from pcap_read() meaning "no packets arrived before 593| | * the timeout expired", so we map it to -2 so you can 594| | * distinguish between an EOF from a savefile and a 595| | * "no packets arrived before the timeout expired, try 596| | * again" from a live capture. 597| | */ 598| 22.6k| if (status == 0) ------------------ | Branch (598:7): [True: 16, False: 22.5k] ------------------ 599| 16| return (-2); 600| 22.5k| else 601| 22.5k| return (status); 602| 22.6k| } 603| | 604| | /* 605| | * Return codes for pcap_read() are: 606| | * - 0: timeout 607| | * - -1: error 608| | * - -2: loop was broken out of with pcap_breakloop() 609| | * - >0: OK, result is number of packets captured, so 610| | * it will be 1 in this case, as we've passed 611| | * a maximum packet count of 1 612| | * The first one ('0') conflicts with the return code of 0 from 613| | * pcapint_offline_read() meaning "end of file". 614| | */ 615| 0| return (p->read_op(p, 1, p->oneshot_callback, (u_char *)&s)); 616| 22.6k|} pcapint_open_offline_common: 2932| 1.26k|{ 2933| 1.26k| pcap_t *p; 2934| | 2935| 1.26k| p = pcap_alloc_pcap_t(ebuf, total_size, private_offset); 2936| 1.26k| if (p == NULL) ------------------ | Branch (2936:6): [True: 0, False: 1.26k] ------------------ 2937| 0| return (NULL); 2938| | 2939| 1.26k| p->opt.tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO; ------------------ | | 537| 1.26k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ 2940| | 2941| 1.26k| return (p); 2942| 1.26k|} pcap_datalink: 2991| 1.18k|{ 2992| 1.18k| if (!p->activated) ------------------ | Branch (2992:6): [True: 0, False: 1.18k] ------------------ 2993| 0| return (PCAP_ERROR_NOT_ACTIVATED); ------------------ | | 362| 0|#define PCAP_ERROR_NOT_ACTIVATED -3 /* the capture needs to be activated */ ------------------ 2994| 1.18k| return (p->linktype); 2995| 1.18k|} pcap_datalink_val_to_description: 3431| 1.62k|{ 3432| 1.62k| int i; 3433| | 3434| 76.4k| for (i = 0; dlt_choices[i].name != NULL; i++) { ------------------ | Branch (3434:14): [True: 76.4k, False: 0] ------------------ 3435| 76.4k| if (dlt_choices[i].dlt == dlt) ------------------ | Branch (3435:7): [True: 1.62k, False: 74.8k] ------------------ 3436| 1.62k| return (dlt_choices[i].description); 3437| 76.4k| } 3438| 0| return (NULL); 3439| 1.62k|} pcap_close: 4315| 1.18k|{ 4316| 1.18k| p->cleanup_op(p); 4317| | 4318| | /* 4319| | * Free information set by pcap_create() *after* calling 4320| | * the module's cleanup routine; that routine might have 4321| | * to use p->opt.device (see commit 4322| | * e333a6044f7d2d3225a6a22205b6b7c1e389945f). 4323| | */ 4324| 1.18k| if (p->opt.device != NULL) { ------------------ | Branch (4324:6): [True: 0, False: 1.18k] ------------------ 4325| 0| free(p->opt.device); 4326| | p->opt.device = NULL; 4327| 0| } 4328| 1.18k| free(p); 4329| 1.18k|} pcap.c:pcap_alloc_pcap_t: 2482| 1.26k|{ 2483| 1.26k| char *chunk; 2484| 1.26k| pcap_t *p; 2485| | 2486| | /* 2487| | * total_size is the size of a structure containing a pcap_t 2488| | * followed by a private structure. 2489| | */ 2490| 1.26k| chunk = calloc(total_size, 1); 2491| 1.26k| if (chunk == NULL) { ------------------ | Branch (2491:6): [True: 0, False: 1.26k] ------------------ 2492| 0| pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 2493| 0| errno, "malloc"); 2494| 0| return (NULL); 2495| 0| } 2496| | 2497| | /* 2498| | * Get a pointer to the pcap_t at the beginning. 2499| | */ 2500| 1.26k| p = (pcap_t *)chunk; 2501| | 2502| |#ifdef _WIN32 2503| | p->handle = INVALID_HANDLE_VALUE; /* not opened yet */ 2504| |#else /* _WIN32 */ 2505| 1.26k| p->fd = -1; /* not opened yet */ 2506| 1.26k| p->selectable_fd = -1; 2507| 1.26k| p->required_select_timeout = NULL; 2508| 1.26k|#endif /* _WIN32 */ 2509| | 2510| | /* 2511| | * private_offset is the offset, in bytes, of the private 2512| | * data from the beginning of the structure. 2513| | * 2514| | * Set the pointer to the private data; that's private_offset 2515| | * bytes past the pcap_t. 2516| | */ 2517| 1.26k| p->priv = (void *)(chunk + private_offset); 2518| | 2519| 1.26k| return (p); 2520| 1.26k|} pcapint_sf_cleanup: 238| 1.18k|{ 239| 1.18k| if (p->rfile != stdin) ------------------ | Branch (239:6): [True: 1.18k, False: 0] ------------------ 240| 1.18k| (void)fclose(p->rfile); 241| 1.18k| if (p->buffer != NULL) ------------------ | Branch (241:6): [True: 1.18k, False: 0] ------------------ 242| 1.18k| free(p->buffer); 243| 1.18k| pcap_freecode(&p->fcode); 244| 1.18k|} pcapint_adjust_snapshot: 440| 1.19k|{ 441| 1.19k| if (snaplen == 0 || snaplen > INT_MAX) { ------------------ | Branch (441:6): [True: 107, False: 1.08k] | Branch (441:22): [True: 88, False: 998] ------------------ 442| | /* 443| | * Bogus snapshot length; use the maximum for this 444| | * link-layer type as a fallback. 445| | * 446| | * XXX - we don't clamp snapshot lengths that are 447| | * <= INT_MAX but > max_snaplen_for_dlt(linktype), 448| | * so a capture file could cause us to allocate 449| | * a Really Big Buffer. 450| | */ 451| 195| snaplen = max_snaplen_for_dlt(linktype); 452| 195| } 453| 1.19k| return snaplen; 454| 1.19k|} pcap_fopen_offline_with_tstamp_precision: 469| 1.44k|{ 470| 1.44k| pcap_t *p; 471| 1.44k| uint8_t magic[4]; 472| 1.44k| size_t amt_read; 473| 1.44k| u_int i; 474| 1.44k| int err; 475| | 476| | /* 477| | * Fail if we were passed a NULL fp. 478| | * 479| | * That shouldn't happen if we're opening with a path name, but 480| | * it could happen if buggy code is opening with a FILE * and 481| | * didn't bother to make sure the FILE * isn't null. 482| | */ 483| 1.44k| if (fp == NULL) { ------------------ | Branch (483:6): [True: 0, False: 1.44k] ------------------ 484| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 485| 0| "Null FILE * pointer provided to savefile open routine"); 486| 0| return (NULL); 487| 0| } 488| | 489| | /* 490| | * Read the first 4 bytes of the file; the network analyzer dump 491| | * file formats we support (pcap and pcapng), and several other 492| | * formats we might support in the future (such as snoop, DOS and 493| | * Windows Sniffer, and Microsoft Network Monitor) all have magic 494| | * numbers that are unique in their first 4 bytes. 495| | */ 496| 1.44k| amt_read = fread(&magic, 1, sizeof(magic), fp); 497| 1.44k| if (amt_read != sizeof(magic)) { ------------------ | Branch (497:6): [True: 0, False: 1.44k] ------------------ 498| 0| if (ferror(fp)) { ------------------ | Branch (498:7): [True: 0, False: 0] ------------------ 499| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 500| 0| errno, "error reading dump file"); 501| 0| } else { 502| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 503| 0| "truncated dump file; tried to read %zu file header bytes, only got %zu", 504| 0| sizeof(magic), amt_read); 505| 0| } 506| 0| return (NULL); 507| 0| } 508| | 509| | /* 510| | * Try all file types. 511| | */ 512| 1.84k| for (i = 0; i < N_FILE_TYPES; i++) { ------------------ | | 461| 1.84k|#define N_FILE_TYPES (sizeof check_headers / sizeof check_headers[0]) ------------------ | Branch (512:14): [True: 1.72k, False: 121] ------------------ 513| 1.72k| p = (*check_headers[i])(magic, fp, precision, errbuf, &err); 514| 1.72k| if (p != NULL) { ------------------ | Branch (514:7): [True: 1.18k, False: 541] ------------------ 515| | /* Yup, that's it. */ 516| 1.18k| goto found; 517| 1.18k| } 518| 541| if (err) { ------------------ | Branch (518:7): [True: 142, False: 399] ------------------ 519| | /* 520| | * Error trying to read the header. 521| | */ 522| 142| return (NULL); 523| 142| } 524| 541| } 525| | 526| | /* 527| | * Well, who knows what this mess is.... 528| | */ 529| 121| snprintf(errbuf, PCAP_ERRBUF_SIZE, "unknown file format"); ------------------ | | 149| 121|#define PCAP_ERRBUF_SIZE 256 ------------------ 530| 121| return (NULL); 531| | 532| 1.18k|found: 533| 1.18k| p->rfile = fp; 534| | 535| | /* Padding only needed for live capture fcode */ 536| 1.18k| p->fddipad = 0; 537| | 538| 1.18k|#if !defined(_WIN32) 539| | /* 540| | * You can do "select()" and "poll()" on plain files on most 541| | * platforms, and should be able to do so on pipes. 542| | * 543| | * You can't do "select()" on anything other than sockets in 544| | * Windows, so, on Win32 systems, we don't have "selectable_fd". 545| | */ 546| 1.18k| p->selectable_fd = fileno(fp); 547| 1.18k|#endif 548| | 549| 1.18k| p->can_set_rfmon_op = sf_cant_set_rfmon; 550| 1.18k| p->read_op = pcapint_offline_read; 551| 1.18k| p->inject_op = sf_inject; 552| 1.18k| p->setfilter_op = pcapint_install_bpf_program; 553| 1.18k| p->setdirection_op = sf_setdirection; 554| 1.18k| p->set_datalink_op = NULL; /* we don't support munging link-layer headers */ 555| 1.18k| p->getnonblock_op = sf_getnonblock; 556| 1.18k| p->setnonblock_op = sf_setnonblock; 557| 1.18k| p->stats_op = sf_stats; 558| |#ifdef _WIN32 559| | p->stats_ex_op = sf_stats_ex; 560| | p->setbuff_op = sf_setbuff; 561| | p->setmode_op = sf_setmode; 562| | p->setmintocopy_op = sf_setmintocopy; 563| | p->getevent_op = sf_getevent; 564| | p->oid_get_request_op = sf_oid_get_request; 565| | p->oid_set_request_op = sf_oid_set_request; 566| | p->sendqueue_transmit_op = sf_sendqueue_transmit; 567| | p->setuserbuffer_op = sf_setuserbuffer; 568| | p->live_dump_op = sf_live_dump; 569| | p->live_dump_ended_op = sf_live_dump_ended; 570| |#endif 571| | 572| | /* 573| | * For offline captures, the standard one-shot callback can 574| | * be used for pcap_next()/pcap_next_ex(). 575| | */ 576| 1.18k| p->oneshot_callback = pcapint_oneshot; 577| | 578| | /* 579| | * Default breakloop operation. 580| | */ 581| 1.18k| p->breakloop_op = pcapint_breakloop_common; 582| | 583| | /* 584| | * For link-layer headers in which the packet type is indicated 585| | * by an AF_ value, we don't know what OS generated it, so we 586| | * don't know what numerical value corresponds to AF_INET6, and 587| | * we don't know the byte order of the host that originally 588| | * captured the packets in the file (as opposed to the host 589| | * that *wrote* this file), so we don't know the byte order 590| | * of multi-byte AF_ values. 591| | * 592| | * That requires different filtering code than a live capture. 593| | * 594| | * Savefiles don't require any other special BPF code generation. 595| | */ 596| 1.18k| p->bpf_codegen_flags = BPF_OFFLINE_AF_HANDLING; ------------------ | | 406| 1.18k|#define BPF_OFFLINE_AF_HANDLING 0x00000004 ------------------ 597| | 598| 1.18k| p->activated = 1; 599| | 600| 1.18k| return (p); 601| 1.44k|} pcap_fopen_offline: 611| 1.44k|{ 612| 1.44k| return (pcap_fopen_offline_with_tstamp_precision(fp, 613| 1.44k| PCAP_TSTAMP_PRECISION_MICRO, errbuf)); ------------------ | | 537| 1.44k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ 614| 1.44k|} pcapint_offline_read: 624| 22.6k|{ 625| 22.6k| struct bpf_insn *fcode; 626| 22.6k| int n = 0; 627| 22.6k| u_char *data; 628| | 629| | /* 630| | * This can conceivably process more than INT_MAX packets, 631| | * which would overflow the packet count, causing it either 632| | * to look like a negative number, and thus cause us to 633| | * return a value that looks like an error, or overflow 634| | * back into positive territory, and thus cause us to 635| | * return a too-low count. 636| | * 637| | * Therefore, if the packet count is unlimited, we clip 638| | * it at INT_MAX; this routine is not expected to 639| | * process packets indefinitely, so that's not an issue. 640| | */ 641| 22.6k| if (PACKET_COUNT_IS_UNLIMITED(cnt)) ------------------ | | 431| 22.6k|#define PACKET_COUNT_IS_UNLIMITED(count) ((count) <= 0) | | ------------------ | | | Branch (431:42): [True: 0, False: 22.6k] | | ------------------ ------------------ 642| 0| cnt = INT_MAX; 643| | 644| 22.6k| for (;;) { 645| 22.6k| struct pcap_pkthdr h; 646| 22.6k| int status; 647| | 648| | /* 649| | * Has "pcap_breakloop()" been called? 650| | * If so, return immediately - if we haven't read any 651| | * packets, clear the flag and return -2 to indicate 652| | * that we were told to break out of the loop, otherwise 653| | * leave the flag set, so that the *next* call will break 654| | * out of the loop without having read any packets, and 655| | * return the number of packets we've processed so far. 656| | */ 657| 22.6k| if (p->break_loop) { ------------------ | Branch (657:7): [True: 0, False: 22.6k] ------------------ 658| 0| if (n == 0) { ------------------ | Branch (658:8): [True: 0, False: 0] ------------------ 659| 0| p->break_loop = 0; 660| 0| return (-2); 661| 0| } else 662| 0| return (n); 663| 0| } 664| | 665| 22.6k| status = p->next_packet_op(p, &h, &data); 666| 22.6k| if (status < 0) { ------------------ | Branch (666:7): [True: 1.16k, False: 21.4k] ------------------ 667| | /* 668| | * Error. Pass it back to the caller. 669| | */ 670| 1.16k| return (status); 671| 1.16k| } 672| 21.4k| if (status == 0) { ------------------ | Branch (672:7): [True: 16, False: 21.4k] ------------------ 673| | /* 674| | * EOF. Nothing more to process; 675| | */ 676| 16| break; 677| 16| } 678| | 679| | /* 680| | * OK, we've read a packet; run it through the filter 681| | * and, if it passes, process it. 682| | */ 683| 21.4k| if ((fcode = p->fcode.bf_insns) == NULL || ------------------ | Branch (683:7): [True: 21.4k, False: 0] ------------------ 684| 21.4k| pcapint_filter(fcode, data, h.len, h.caplen)) { ------------------ | Branch (684:7): [True: 0, False: 0] ------------------ 685| 21.4k| (*callback)(user, &h, data); 686| 21.4k| n++; /* count the packet */ 687| 21.4k| if (n >= cnt) ------------------ | Branch (687:8): [True: 21.4k, False: 0] ------------------ 688| 21.4k| break; 689| 21.4k| } 690| 21.4k| } 691| | /*XXX this breaks semantics tcpslice expects */ 692| 21.4k| return (n); 693| 22.6k|} pcap_check_header: 220| 1.44k|{ 221| 1.44k| bpf_u_int32 magic_int; 222| 1.44k| struct pcap_file_header hdr; 223| 1.44k| size_t amt_read; 224| 1.44k| pcap_t *p; 225| 1.44k| int swapped = 0; 226| 1.44k| struct pcap_sf *ps; 227| | 228| | /* 229| | * Assume no read errors. 230| | */ 231| 1.44k| *err = 0; 232| | 233| | /* 234| | * Check whether the first 4 bytes of the file are the magic 235| | * number for a pcap savefile, or for a byte-swapped pcap 236| | * savefile. 237| | */ 238| 1.44k| memcpy(&magic_int, magic, sizeof(magic_int)); 239| 1.44k| if (magic_int != TCPDUMP_MAGIC && ------------------ | | 71| 2.89k|#define TCPDUMP_MAGIC 0xa1b2c3d4 ------------------ | Branch (239:6): [True: 520, False: 927] ------------------ 240| 520| magic_int != KUZNETZOV_TCPDUMP_MAGIC && ------------------ | | 76| 1.96k|#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34 ------------------ | Branch (240:6): [True: 473, False: 47] ------------------ 241| 473| magic_int != NSEC_TCPDUMP_MAGIC) { ------------------ | | 94| 473|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (241:6): [True: 439, False: 34] ------------------ 242| 439| magic_int = SWAPLONG(magic_int); ------------------ | | 54| 439| (((((u_int)(y))&0xff)<<24) | \ | | 55| 439| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 439| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 439| ((((u_int)(y))>>24)&0xff)) ------------------ 243| 439| if (magic_int != TCPDUMP_MAGIC && ------------------ | | 71| 878|#define TCPDUMP_MAGIC 0xa1b2c3d4 ------------------ | Branch (243:7): [True: 361, False: 78] ------------------ 244| 361| magic_int != KUZNETZOV_TCPDUMP_MAGIC && ------------------ | | 76| 800|#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34 ------------------ | Branch (244:7): [True: 299, False: 62] ------------------ 245| 299| magic_int != NSEC_TCPDUMP_MAGIC) ------------------ | | 94| 299|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (245:7): [True: 278, False: 21] ------------------ 246| 278| return (NULL); /* nope */ 247| 161| swapped = 1; 248| 161| } 249| | 250| | /* 251| | * They are. Put the magic number in the header, and read 252| | * the rest of the header. 253| | */ 254| 1.16k| hdr.magic = magic_int; 255| 1.16k| amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1, 256| 1.16k| sizeof(hdr) - sizeof(hdr.magic), fp); 257| 1.16k| if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) { ------------------ | Branch (257:6): [True: 0, False: 1.16k] ------------------ 258| 0| if (ferror(fp)) { ------------------ | Branch (258:7): [True: 0, False: 0] ------------------ 259| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 260| 0| errno, "error reading dump file"); 261| 0| } else { 262| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 263| 0| "truncated dump file; tried to read %zu file header bytes, only got %zu", 264| 0| sizeof(hdr), amt_read); 265| 0| } 266| 0| *err = 1; 267| 0| return (NULL); 268| 0| } 269| | 270| | /* 271| | * If it's a byte-swapped capture file, byte-swap the header. 272| | */ 273| 1.16k| if (swapped) { ------------------ | Branch (273:6): [True: 161, False: 1.00k] ------------------ 274| 161| hdr.version_major = SWAPSHORT(hdr.version_major); ------------------ | | 59| 161| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 161| ((((u_int)(y))&0xff00)>>8))) ------------------ 275| 161| hdr.version_minor = SWAPSHORT(hdr.version_minor); ------------------ | | 59| 161| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 161| ((((u_int)(y))&0xff00)>>8))) ------------------ 276| 161| hdr.thiszone = SWAPLONG(hdr.thiszone); ------------------ | | 54| 161| (((((u_int)(y))&0xff)<<24) | \ | | 55| 161| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 161| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 161| ((((u_int)(y))>>24)&0xff)) ------------------ 277| 161| hdr.sigfigs = SWAPLONG(hdr.sigfigs); ------------------ | | 54| 161| (((((u_int)(y))&0xff)<<24) | \ | | 55| 161| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 161| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 161| ((((u_int)(y))>>24)&0xff)) ------------------ 278| 161| hdr.snaplen = SWAPLONG(hdr.snaplen); ------------------ | | 54| 161| (((((u_int)(y))&0xff)<<24) | \ | | 55| 161| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 161| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 161| ((((u_int)(y))>>24)&0xff)) ------------------ 279| 161| hdr.linktype = SWAPLONG(hdr.linktype); ------------------ | | 54| 161| (((((u_int)(y))&0xff)<<24) | \ | | 55| 161| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 161| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 161| ((((u_int)(y))>>24)&0xff)) ------------------ 280| 161| } 281| | 282| | /* 283| | * currently only versions 2.[0-4] are supported with 284| | * the exception of 543.0 for DG/UX tcpdump. 285| | */ 286| 1.16k| if (! ((hdr.version_major == PCAP_VERSION_MAJOR && ------------------ | | 146| 2.33k|#define PCAP_VERSION_MAJOR 2 ------------------ | Branch (286:10): [True: 1.08k, False: 83] ------------------ 287| 1.08k| hdr.version_minor <= PCAP_VERSION_MINOR) || ------------------ | | 147| 1.08k|#define PCAP_VERSION_MINOR 4 ------------------ | Branch (287:3): [True: 1.07k, False: 9] ------------------ 288| 92| (hdr.version_major == 543 && ------------------ | Branch (288:10): [True: 61, False: 31] ------------------ 289| 61| hdr.version_minor == 0))) { ------------------ | Branch (289:3): [True: 54, False: 7] ------------------ 290| 38| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 38|#define PCAP_ERRBUF_SIZE 256 ------------------ 291| 38| "unsupported pcap savefile version %u.%u", 292| 38| hdr.version_major, hdr.version_minor); 293| 38| *err = 1; 294| 38| return NULL; 295| 38| } 296| | 297| | /* 298| | * Check the main reserved field. 299| | */ 300| 1.13k| if (LT_RESERVED1(hdr.linktype) != 0) { ------------------ | | 267| 1.13k|#define LT_RESERVED1(x) ((x) & 0x03FF0000) ------------------ | Branch (300:6): [True: 10, False: 1.12k] ------------------ 301| 10| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 10|#define PCAP_ERRBUF_SIZE 256 ------------------ 302| 10| "savefile linktype reserved field not zero (0x%08x)", 303| 10| LT_RESERVED1(hdr.linktype)); ------------------ | | 267| 10|#define LT_RESERVED1(x) ((x) & 0x03FF0000) ------------------ 304| 10| *err = 1; 305| 10| return NULL; 306| 10| } 307| | 308| | /* 309| | * OK, this is a good pcap file. 310| | * Allocate a pcap_t for it. 311| | */ 312| 1.12k| p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_sf); ------------------ | | 557| 1.12k| pcapint_open_offline_common(ebuf, \ | | 558| 1.12k| sizeof (struct { pcap_t __common; type __private; }), \ | | 559| 1.12k| offsetof (struct { pcap_t __common; type __private; }, __private)) ------------------ 313| 1.12k| if (p == NULL) { ------------------ | Branch (313:6): [True: 0, False: 1.12k] ------------------ 314| | /* Allocation failed. */ 315| 0| *err = 1; 316| 0| return (NULL); 317| 0| } 318| 1.12k| p->swapped = swapped; 319| 1.12k| p->version_major = hdr.version_major; 320| 1.12k| p->version_minor = hdr.version_minor; 321| 1.12k| p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype)); ------------------ | | 265| 1.12k|#define LT_LINKTYPE(x) ((x) & 0x0000FFFF) ------------------ 322| 1.12k| p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype); ------------------ | | 266| 1.12k|#define LT_LINKTYPE_EXT(x) ((x) & 0xFFFF0000) ------------------ 323| 1.12k| p->snapshot = pcapint_adjust_snapshot(p->linktype, hdr.snaplen); 324| | 325| 1.12k| p->next_packet_op = pcap_next_packet; 326| | 327| 1.12k| ps = p->priv; 328| | 329| 1.12k| p->opt.tstamp_precision = precision; 330| | 331| | /* 332| | * Will we need to scale the timestamps to match what the 333| | * user wants? 334| | */ 335| 1.12k| switch (precision) { 336| | 337| 1.12k| case PCAP_TSTAMP_PRECISION_MICRO: ------------------ | | 537| 1.12k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ | Branch (337:2): [True: 1.12k, False: 0] ------------------ 338| 1.12k| if (magic_int == NSEC_TCPDUMP_MAGIC) { ------------------ | | 94| 1.12k|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (338:7): [True: 48, False: 1.07k] ------------------ 339| | /* 340| | * The file has nanoseconds, the user 341| | * wants microseconds; scale the 342| | * precision down. 343| | */ 344| 48| ps->scale_type = SCALE_DOWN; 345| 1.07k| } else { 346| | /* 347| | * The file has microseconds, the 348| | * user wants microseconds; nothing to do. 349| | */ 350| 1.07k| ps->scale_type = PASS_THROUGH; 351| 1.07k| } 352| 1.12k| break; 353| | 354| 0| case PCAP_TSTAMP_PRECISION_NANO: ------------------ | | 538| 0|#define PCAP_TSTAMP_PRECISION_NANO 1 /* use timestamps with nanosecond precision */ ------------------ | Branch (354:2): [True: 0, False: 1.12k] ------------------ 355| 0| if (magic_int == NSEC_TCPDUMP_MAGIC) { ------------------ | | 94| 0|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (355:7): [True: 0, False: 0] ------------------ 356| | /* 357| | * The file has nanoseconds, the 358| | * user wants nanoseconds; nothing to do. 359| | */ 360| 0| ps->scale_type = PASS_THROUGH; 361| 0| } else { 362| | /* 363| | * The file has microseconds, the user 364| | * wants nanoseconds; scale the 365| | * precision up. 366| | */ 367| 0| ps->scale_type = SCALE_UP; 368| 0| } 369| 0| break; 370| | 371| 0| default: ------------------ | Branch (371:2): [True: 0, False: 1.12k] ------------------ 372| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 373| 0| "unknown time stamp resolution %u", precision); 374| 0| free(p); 375| 0| *err = 1; 376| 0| return (NULL); 377| 1.12k| } 378| | 379| | /* 380| | * We interchanged the caplen and len fields at version 2.3, 381| | * in order to match the bpf header layout. But unfortunately 382| | * some files were written with version 2.3 in their headers 383| | * but without the interchanged fields. 384| | * 385| | * In addition, DG/UX tcpdump writes out files with a version 386| | * number of 543.0, and with the caplen and len fields in the 387| | * pre-2.3 order. 388| | */ 389| 1.12k| switch (hdr.version_major) { 390| | 391| 1.07k| case 2: ------------------ | Branch (391:2): [True: 1.07k, False: 51] ------------------ 392| 1.07k| if (hdr.version_minor < 3) ------------------ | Branch (392:7): [True: 128, False: 942] ------------------ 393| 128| ps->lengths_swapped = SWAPPED; 394| 942| else if (hdr.version_minor == 3) ------------------ | Branch (394:12): [True: 290, False: 652] ------------------ 395| 290| ps->lengths_swapped = MAYBE_SWAPPED; 396| 652| else 397| 652| ps->lengths_swapped = NOT_SWAPPED; 398| 1.07k| break; 399| | 400| 51| case 543: ------------------ | Branch (400:2): [True: 51, False: 1.07k] ------------------ 401| 51| ps->lengths_swapped = SWAPPED; 402| 51| break; 403| | 404| 0| default: ------------------ | Branch (404:2): [True: 0, False: 1.12k] ------------------ 405| 0| ps->lengths_swapped = NOT_SWAPPED; 406| 0| break; 407| 1.12k| } 408| | 409| 1.12k| if (magic_int == KUZNETZOV_TCPDUMP_MAGIC) { ------------------ | | 76| 1.12k|#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34 ------------------ | Branch (409:6): [True: 105, False: 1.01k] ------------------ 410| | /* 411| | * XXX - the patch that's in some versions of libpcap 412| | * changes the packet header but not the magic number, 413| | * and some other versions with this magic number have 414| | * some extra debugging information in the packet header; 415| | * we'd have to use some hacks^H^H^H^H^Hheuristics to 416| | * detect those variants. 417| | * 418| | * Wireshark does that, but it does so by trying to read 419| | * the first two packets of the file with each of the 420| | * record header formats. That currently means it seeks 421| | * backwards and retries the reads, which doesn't work 422| | * on pipes. We want to be able to read from a pipe, so 423| | * that strategy won't work; we'd have to buffer some 424| | * data ourselves and read from that buffer in order to 425| | * make that work. 426| | */ 427| 105| ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr); 428| | 429| 105| if (p->linktype == DLT_EN10MB) { ------------------ | | 68| 105|#define DLT_EN10MB 1 /* Ethernet (10Mb) */ ------------------ | Branch (429:7): [True: 24, False: 81] ------------------ 430| | /* 431| | * This capture might have been done in raw mode 432| | * or cooked mode. 433| | * 434| | * If it was done in cooked mode, p->snapshot was 435| | * passed to recvfrom() as the buffer size, meaning 436| | * that the most packet data that would be copied 437| | * would be p->snapshot. However, a faked Ethernet 438| | * header would then have been added to it, so the 439| | * most data that would be in a packet in the file 440| | * would be p->snapshot + 14. 441| | * 442| | * We can't easily tell whether the capture was done 443| | * in raw mode or cooked mode, so we'll assume it was 444| | * cooked mode, and add 14 to the snapshot length. 445| | * That means that, for a raw capture, the snapshot 446| | * length will be misleading if you use it to figure 447| | * out why a capture doesn't have all the packet data, 448| | * but there's not much we can do to avoid that. 449| | * 450| | * But don't grow the snapshot length past the 451| | * maximum value of an int. 452| | */ 453| 24| if (p->snapshot <= INT_MAX - 14) ------------------ | Branch (453:8): [True: 19, False: 5] ------------------ 454| 19| p->snapshot += 14; 455| 5| else 456| 5| p->snapshot = INT_MAX; 457| 24| } 458| 105| } else 459| 1.01k| ps->hdrsize = sizeof(struct pcap_sf_pkthdr); 460| | 461| | /* 462| | * Allocate a buffer for the packet data. 463| | * Choose the minimum of the file's snapshot length and 2K bytes; 464| | * that should be enough for most network packets - we'll grow it 465| | * if necessary. That way, we don't allocate a huge chunk of 466| | * memory just because there's a huge snapshot length, as the 467| | * snapshot length might be larger than the size of the largest 468| | * packet. 469| | */ 470| 1.12k| p->bufsize = p->snapshot; 471| 1.12k| if (p->bufsize > 2048) ------------------ | Branch (471:6): [True: 973, False: 148] ------------------ 472| 973| p->bufsize = 2048; 473| 1.12k| p->buffer = malloc(p->bufsize); 474| 1.12k| if (p->buffer == NULL) { ------------------ | Branch (474:6): [True: 0, False: 1.12k] ------------------ 475| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 476| 0| free(p); 477| 0| *err = 1; 478| 0| return (NULL); 479| 0| } 480| | 481| 1.12k| p->cleanup_op = pcapint_sf_cleanup; 482| | 483| 1.12k| return (p); 484| 1.12k|} sf-pcap.c:pcap_next_packet: 511| 22.2k|{ 512| 22.2k| struct pcap_sf *ps = p->priv; 513| 22.2k| struct pcap_sf_patched_pkthdr sf_hdr; 514| 22.2k| FILE *fp = p->rfile; 515| 22.2k| size_t amt_read; 516| 22.2k| bpf_u_int32 t; 517| | 518| | /* 519| | * Read the packet header; the structure we use as a buffer 520| | * is the longer structure for files generated by the patched 521| | * libpcap, but if the file has the magic number for an 522| | * unpatched libpcap we only read as many bytes as the regular 523| | * header has. 524| | */ 525| 22.2k| amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp); 526| 22.2k| if (amt_read != ps->hdrsize) { ------------------ | Branch (526:6): [True: 205, False: 22.0k] ------------------ 527| 205| if (ferror(fp)) { ------------------ | Branch (527:7): [True: 0, False: 205] ------------------ 528| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 529| 0| errno, "error reading dump file"); 530| 0| return (-1); 531| 205| } else { 532| 205| if (amt_read != 0) { ------------------ | Branch (532:8): [True: 189, False: 16] ------------------ 533| 189| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 189|#define PCAP_ERRBUF_SIZE 256 ------------------ 534| 189| "truncated dump file; tried to read %zu header bytes, only got %zu", 535| 189| ps->hdrsize, amt_read); 536| 189| return (-1); 537| 189| } 538| | /* EOF */ 539| 16| return (0); 540| 205| } 541| 205| } 542| | 543| 22.0k| if (p->swapped) { ------------------ | Branch (543:6): [True: 4.33k, False: 17.6k] ------------------ 544| | /* these were written in opposite byte order */ 545| 4.33k| hdr->caplen = SWAPLONG(sf_hdr.caplen); ------------------ | | 54| 4.33k| (((((u_int)(y))&0xff)<<24) | \ | | 55| 4.33k| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 4.33k| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 4.33k| ((((u_int)(y))>>24)&0xff)) ------------------ 546| 4.33k| hdr->len = SWAPLONG(sf_hdr.len); ------------------ | | 54| 4.33k| (((((u_int)(y))&0xff)<<24) | \ | | 55| 4.33k| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 4.33k| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 4.33k| ((((u_int)(y))>>24)&0xff)) ------------------ 547| 4.33k| hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec); ------------------ | | 54| 4.33k| (((((u_int)(y))&0xff)<<24) | \ | | 55| 4.33k| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 4.33k| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 4.33k| ((((u_int)(y))>>24)&0xff)) ------------------ 548| 4.33k| hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec); ------------------ | | 54| 4.33k| (((((u_int)(y))&0xff)<<24) | \ | | 55| 4.33k| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 4.33k| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 4.33k| ((((u_int)(y))>>24)&0xff)) ------------------ 549| 17.6k| } else { 550| 17.6k| hdr->caplen = sf_hdr.caplen; 551| 17.6k| hdr->len = sf_hdr.len; 552| 17.6k| hdr->ts.tv_sec = sf_hdr.ts.tv_sec; 553| 17.6k| hdr->ts.tv_usec = sf_hdr.ts.tv_usec; 554| 17.6k| } 555| | 556| 22.0k| switch (ps->scale_type) { ------------------ | Branch (556:10): [True: 22.0k, False: 0] ------------------ 557| | 558| 21.0k| case PASS_THROUGH: ------------------ | Branch (558:2): [True: 21.0k, False: 964] ------------------ 559| | /* 560| | * Just pass the time stamp through. 561| | */ 562| 21.0k| break; 563| | 564| 0| case SCALE_UP: ------------------ | Branch (564:2): [True: 0, False: 22.0k] ------------------ 565| | /* 566| | * File has microseconds, user wants nanoseconds; convert 567| | * it. 568| | */ 569| 0| hdr->ts.tv_usec = hdr->ts.tv_usec * 1000; 570| 0| break; 571| | 572| 964| case SCALE_DOWN: ------------------ | Branch (572:2): [True: 964, False: 21.0k] ------------------ 573| | /* 574| | * File has nanoseconds, user wants microseconds; convert 575| | * it. 576| | */ 577| 964| hdr->ts.tv_usec = hdr->ts.tv_usec / 1000; 578| 964| break; 579| 22.0k| } 580| | 581| | /* Swap the caplen and len fields, if necessary. */ 582| 22.0k| switch (ps->lengths_swapped) { ------------------ | Branch (582:10): [True: 22.0k, False: 0] ------------------ 583| | 584| 11.0k| case NOT_SWAPPED: ------------------ | Branch (584:2): [True: 11.0k, False: 10.9k] ------------------ 585| 11.0k| break; 586| | 587| 6.39k| case MAYBE_SWAPPED: ------------------ | Branch (587:2): [True: 6.39k, False: 15.6k] ------------------ 588| 6.39k| if (hdr->caplen <= hdr->len) { ------------------ | Branch (588:7): [True: 3.90k, False: 2.49k] ------------------ 589| | /* 590| | * The captured length is <= the actual length, 591| | * so presumably they weren't swapped. 592| | */ 593| 3.90k| break; 594| 3.90k| } 595| | /* FALLTHROUGH */ 596| | 597| 7.01k| case SWAPPED: ------------------ | Branch (597:2): [True: 4.52k, False: 17.4k] ------------------ 598| 7.01k| t = hdr->caplen; 599| 7.01k| hdr->caplen = hdr->len; 600| 7.01k| hdr->len = t; 601| 7.01k| break; 602| 22.0k| } 603| | 604| | /* 605| | * Is the packet bigger than we consider sane? 606| | */ 607| 22.0k| if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) { ------------------ | Branch (607:6): [True: 708, False: 21.2k] ------------------ 608| | /* 609| | * Yes. This may be a damaged or fuzzed file. 610| | * 611| | * Is it bigger than the snapshot length? 612| | * (We don't treat that as an error if it's not 613| | * bigger than the maximum we consider sane; see 614| | * below.) 615| | */ 616| 708| if (hdr->caplen > (bpf_u_int32)p->snapshot) { ------------------ | Branch (616:7): [True: 641, False: 67] ------------------ 617| 641| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 641|#define PCAP_ERRBUF_SIZE 256 ------------------ 618| 641| "invalid packet capture length %u, bigger than " 619| 641| "snaplen of %d", hdr->caplen, p->snapshot); 620| 641| } else { 621| 67| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 67|#define PCAP_ERRBUF_SIZE 256 ------------------ 622| 67| "invalid packet capture length %u, bigger than " 623| 67| "maximum of %u", hdr->caplen, 624| 67| max_snaplen_for_dlt(p->linktype)); 625| 67| } 626| 708| return (-1); 627| 708| } 628| | 629| 21.2k| if (hdr->caplen > (bpf_u_int32)p->snapshot) { ------------------ | Branch (629:6): [True: 1.29k, False: 20.0k] ------------------ 630| | /* 631| | * The packet is bigger than the snapshot length 632| | * for this file. 633| | * 634| | * This can happen due to Solaris 2.3 systems tripping 635| | * over the BUFMOD problem and not setting the snapshot 636| | * length correctly in the savefile header. 637| | * 638| | * libpcap 0.4 and later on Solaris 2.3 should set the 639| | * snapshot length correctly in the pcap file header, 640| | * even though they don't set a snapshot length in bufmod 641| | * (the buggy bufmod chops off the *beginning* of the 642| | * packet if a snapshot length is specified); they should 643| | * also reduce the captured length, as supplied to the 644| | * per-packet callback, to the snapshot length if it's 645| | * greater than the snapshot length, so the code using 646| | * libpcap should see the packet cut off at the snapshot 647| | * length, even though the full packet is copied up to 648| | * userland. 649| | * 650| | * However, perhaps some versions of libpcap failed to 651| | * set the snapshot length correctly in the file header 652| | * or the per-packet header, or perhaps this is a 653| | * corrupted savefile or a savefile built/modified by a 654| | * fuzz tester, so we check anyway. We grow the buffer 655| | * to be big enough for the snapshot length, read up 656| | * to the snapshot length, discard the rest of the 657| | * packet, and report the snapshot length as the captured 658| | * length; we don't want to hand our caller a packet 659| | * bigger than the snapshot length, because they might 660| | * be assuming they'll never be handed such a packet, 661| | * and might copy the packet into a snapshot-length- 662| | * sized buffer, assuming it'll fit. 663| | */ 664| 1.29k| size_t bytes_to_discard; 665| 1.29k| size_t bytes_to_read, bytes_read; 666| 1.29k| char discard_buf[4096]; 667| | 668| 1.29k| if (hdr->caplen > p->bufsize) { ------------------ | Branch (668:7): [True: 1.29k, False: 0] ------------------ 669| | /* 670| | * Grow the buffer to the snapshot length. 671| | */ 672| 1.29k| if (!grow_buffer(p, p->snapshot)) ------------------ | Branch (672:8): [True: 0, False: 1.29k] ------------------ 673| 0| return (-1); 674| 1.29k| } 675| | 676| | /* 677| | * Read the first p->snapshot bytes into the buffer. 678| | */ 679| 1.29k| amt_read = fread(p->buffer, 1, p->snapshot, fp); 680| 1.29k| if (amt_read != (bpf_u_int32)p->snapshot) { ------------------ | Branch (680:7): [True: 25, False: 1.26k] ------------------ 681| 25| if (ferror(fp)) { ------------------ | Branch (681:8): [True: 0, False: 25] ------------------ 682| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, 683| 0| PCAP_ERRBUF_SIZE, errno, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 684| 0| "error reading dump file"); 685| 25| } else { 686| | /* 687| | * Yes, this uses hdr->caplen; technically, 688| | * it's true, because we would try to read 689| | * and discard the rest of those bytes, and 690| | * that would fail because we got EOF before 691| | * the read finished. 692| | */ 693| 25| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 25|#define PCAP_ERRBUF_SIZE 256 ------------------ 694| 25| "truncated dump file; tried to read %d captured bytes, only got %zu", 695| 25| p->snapshot, amt_read); 696| 25| } 697| 25| return (-1); 698| 25| } 699| | 700| | /* 701| | * Now read and discard what's left. 702| | */ 703| 1.26k| bytes_to_discard = hdr->caplen - p->snapshot; 704| 1.26k| bytes_read = amt_read; 705| 2.56k| while (bytes_to_discard != 0) { ------------------ | Branch (705:10): [True: 1.33k, False: 1.23k] ------------------ 706| 1.33k| bytes_to_read = bytes_to_discard; 707| 1.33k| if (bytes_to_read > sizeof (discard_buf)) ------------------ | Branch (707:8): [True: 90, False: 1.24k] ------------------ 708| 90| bytes_to_read = sizeof (discard_buf); 709| 1.33k| amt_read = fread(discard_buf, 1, bytes_to_read, fp); 710| 1.33k| bytes_read += amt_read; 711| 1.33k| if (amt_read != bytes_to_read) { ------------------ | Branch (711:8): [True: 34, False: 1.29k] ------------------ 712| 34| if (ferror(fp)) { ------------------ | Branch (712:9): [True: 0, False: 34] ------------------ 713| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, 714| 0| PCAP_ERRBUF_SIZE, errno, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 715| 0| "error reading dump file"); 716| 34| } else { 717| 34| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 34|#define PCAP_ERRBUF_SIZE 256 ------------------ 718| 34| "truncated dump file; tried to read %u captured bytes, only got %zu", 719| 34| hdr->caplen, bytes_read); 720| 34| } 721| 34| return (-1); 722| 34| } 723| 1.29k| bytes_to_discard -= amt_read; 724| 1.29k| } 725| | 726| | /* 727| | * Adjust caplen accordingly, so we don't get confused later 728| | * as to how many bytes we have to play with. 729| | */ 730| 1.23k| hdr->caplen = p->snapshot; 731| 20.0k| } else { 732| | /* 733| | * The packet is within the snapshot length for this file. 734| | */ 735| 20.0k| if (hdr->caplen > p->bufsize) { ------------------ | Branch (735:7): [True: 149, False: 19.8k] ------------------ 736| | /* 737| | * Grow the buffer to the next power of 2, or 738| | * the snaplen, whichever is lower. 739| | */ 740| 149| u_int new_bufsize; 741| | 742| 149| new_bufsize = hdr->caplen; 743| | /* 744| | * https://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2 745| | */ 746| 149| new_bufsize--; 747| 149| new_bufsize |= new_bufsize >> 1; 748| 149| new_bufsize |= new_bufsize >> 2; 749| 149| new_bufsize |= new_bufsize >> 4; 750| 149| new_bufsize |= new_bufsize >> 8; 751| 149| new_bufsize |= new_bufsize >> 16; 752| 149| new_bufsize++; 753| | 754| 149| if (new_bufsize > (u_int)p->snapshot) ------------------ | Branch (754:8): [True: 0, False: 149] ------------------ 755| 0| new_bufsize = p->snapshot; 756| | 757| 149| if (!grow_buffer(p, new_bufsize)) ------------------ | Branch (757:8): [True: 0, False: 149] ------------------ 758| 0| return (-1); 759| 149| } 760| | 761| | /* read the packet itself */ 762| 20.0k| amt_read = fread(p->buffer, 1, hdr->caplen, fp); 763| 20.0k| if (amt_read != hdr->caplen) { ------------------ | Branch (763:7): [True: 144, False: 19.8k] ------------------ 764| 144| if (ferror(fp)) { ------------------ | Branch (764:8): [True: 0, False: 144] ------------------ 765| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, 766| 0| PCAP_ERRBUF_SIZE, errno, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 767| 0| "error reading dump file"); 768| 144| } else { 769| 144| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 144|#define PCAP_ERRBUF_SIZE 256 ------------------ 770| 144| "truncated dump file; tried to read %u captured bytes, only got %zu", 771| 144| hdr->caplen, amt_read); 772| 144| } 773| 144| return (-1); 774| 144| } 775| 20.0k| } 776| 21.0k| *data = p->buffer; 777| | 778| 21.0k| pcapint_post_process(p->linktype, p->swapped, hdr, *data); 779| | 780| 21.0k| return (1); 781| 21.2k|} sf-pcap.c:grow_buffer: 491| 1.44k|{ 492| 1.44k| void *bigger_buffer; 493| | 494| 1.44k| bigger_buffer = realloc(p->buffer, bufsize); 495| 1.44k| if (bigger_buffer == NULL) { ------------------ | Branch (495:6): [True: 0, False: 1.44k] ------------------ 496| 0| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 497| 0| return (0); 498| 0| } 499| 1.44k| p->buffer = bigger_buffer; 500| 1.44k| p->bufsize = bufsize; 501| 1.44k| return (1); 502| 1.44k|} pcap_ng_check_header: 771| 278|{ 772| 278| bpf_u_int32 magic_int; 773| 278| size_t amt_read; 774| 278| bpf_u_int32 total_length; 775| 278| bpf_u_int32 byte_order_magic; 776| 278| struct block_header *bhdrp; 777| 278| struct section_header_block *shbp; 778| 278| pcap_t *p; 779| 278| int swapped = 0; 780| 278| struct pcap_ng_sf *ps; 781| 278| int status; 782| 278| struct block_cursor cursor; 783| 278| struct interface_description_block *idbp; 784| | 785| | /* 786| | * Assume no read errors. 787| | */ 788| 278| *err = 0; 789| | 790| | /* 791| | * Check whether the first 4 bytes of the file are the block 792| | * type for a pcapng savefile. 793| | */ 794| 278| memcpy(&magic_int, magic, sizeof(magic_int)); 795| 278| if (magic_int != BT_SHB) { ------------------ | | 86| 278|#define BT_SHB 0x0A0D0D0A ------------------ | Branch (795:6): [True: 97, False: 181] ------------------ 796| | /* 797| | * XXX - check whether this looks like what the block 798| | * type would be after being munged by mapping between 799| | * UN*X and DOS/Windows text file format and, if it 800| | * does, look for the byte-order magic number in 801| | * the appropriate place and, if we find it, report 802| | * this as possibly being a pcapng file transferred 803| | * between UN*X and Windows in text file format? 804| | */ 805| 97| return (NULL); /* nope */ 806| 97| } 807| | 808| | /* 809| | * OK, they are. However, that's just \n\r\r\n, so it could, 810| | * conceivably, be an ordinary text file. 811| | * 812| | * It could not, however, conceivably be any other type of 813| | * capture file, so we can read the rest of the putative 814| | * Section Header Block; put the block type in the common 815| | * header, read the rest of the common header and the 816| | * fixed-length portion of the SHB, and look for the byte-order 817| | * magic value. 818| | */ 819| 181| amt_read = fread(&total_length, 1, sizeof(total_length), fp); 820| 181| if (amt_read < sizeof(total_length)) { ------------------ | Branch (820:6): [True: 0, False: 181] ------------------ 821| 0| if (ferror(fp)) { ------------------ | Branch (821:7): [True: 0, False: 0] ------------------ 822| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 823| 0| errno, "error reading dump file"); 824| 0| *err = 1; 825| 0| return (NULL); /* fail */ 826| 0| } 827| | 828| | /* 829| | * Possibly a weird short text file, so just say 830| | * "not pcapng". 831| | */ 832| 0| return (NULL); 833| 0| } 834| 181| amt_read = fread(&byte_order_magic, 1, sizeof(byte_order_magic), fp); 835| 181| if (amt_read < sizeof(byte_order_magic)) { ------------------ | Branch (835:6): [True: 0, False: 181] ------------------ 836| 0| if (ferror(fp)) { ------------------ | Branch (836:7): [True: 0, False: 0] ------------------ 837| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 838| 0| errno, "error reading dump file"); 839| 0| *err = 1; 840| 0| return (NULL); /* fail */ 841| 0| } 842| | 843| | /* 844| | * Possibly a weird short text file, so just say 845| | * "not pcapng". 846| | */ 847| 0| return (NULL); 848| 0| } 849| 181| if (byte_order_magic != BYTE_ORDER_MAGIC) { ------------------ | | 99| 181|#define BYTE_ORDER_MAGIC 0x1A2B3C4D ------------------ | Branch (849:6): [True: 157, False: 24] ------------------ 850| 157| byte_order_magic = SWAPLONG(byte_order_magic); ------------------ | | 54| 157| (((((u_int)(y))&0xff)<<24) | \ | | 55| 157| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 157| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 157| ((((u_int)(y))>>24)&0xff)) ------------------ 851| 157| if (byte_order_magic != BYTE_ORDER_MAGIC) { ------------------ | | 99| 157|#define BYTE_ORDER_MAGIC 0x1A2B3C4D ------------------ | Branch (851:7): [True: 24, False: 133] ------------------ 852| | /* 853| | * Not a pcapng file. 854| | */ 855| 24| return (NULL); 856| 24| } 857| 133| swapped = 1; 858| 133| total_length = SWAPLONG(total_length); ------------------ | | 54| 133| (((((u_int)(y))&0xff)<<24) | \ | | 55| 133| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 133| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 133| ((((u_int)(y))>>24)&0xff)) ------------------ 859| 133| } 860| | 861| | /* 862| | * Check the sanity of the total length. 863| | */ 864| 157| if (total_length < sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer) || ------------------ | Branch (864:6): [True: 1, False: 156] ------------------ 865| 156| (total_length > BT_SHB_INSANE_MAX)) { ------------------ | | 87| 156|#define BT_SHB_INSANE_MAX 1024U*1024U*1U /* 1MB should be enough */ ------------------ | Branch (865:13): [True: 10, False: 146] ------------------ 866| 11| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 11|#define PCAP_ERRBUF_SIZE 256 ------------------ 867| 11| "Section Header Block in pcapng dump file has invalid length %zu < _%u_ < %u (BT_SHB_INSANE_MAX)", 868| 11| sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer), 869| 11| total_length, 870| 11| BT_SHB_INSANE_MAX); ------------------ | | 87| 11|#define BT_SHB_INSANE_MAX 1024U*1024U*1U /* 1MB should be enough */ ------------------ 871| | 872| 11| *err = 1; 873| 11| return (NULL); 874| 11| } 875| | 876| | /* 877| | * OK, this is a good pcapng file. 878| | * Allocate a pcap_t for it. 879| | */ 880| 146| p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_ng_sf); ------------------ | | 557| 146| pcapint_open_offline_common(ebuf, \ | | 558| 146| sizeof (struct { pcap_t __common; type __private; }), \ | | 559| 146| offsetof (struct { pcap_t __common; type __private; }, __private)) ------------------ 881| 146| if (p == NULL) { ------------------ | Branch (881:6): [True: 0, False: 146] ------------------ 882| | /* Allocation failed. */ 883| 0| *err = 1; 884| 0| return (NULL); 885| 0| } 886| 146| p->swapped = swapped; 887| 146| ps = p->priv; 888| | 889| | /* 890| | * What precision does the user want? 891| | */ 892| 146| switch (precision) { 893| | 894| 146| case PCAP_TSTAMP_PRECISION_MICRO: ------------------ | | 537| 146|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ | Branch (894:2): [True: 146, False: 0] ------------------ 895| 146| ps->user_tsresol = 1000000; 896| 146| break; 897| | 898| 0| case PCAP_TSTAMP_PRECISION_NANO: ------------------ | | 538| 0|#define PCAP_TSTAMP_PRECISION_NANO 1 /* use timestamps with nanosecond precision */ ------------------ | Branch (898:2): [True: 0, False: 146] ------------------ 899| 0| ps->user_tsresol = 1000000000; 900| 0| break; 901| | 902| 0| default: ------------------ | Branch (902:2): [True: 0, False: 146] ------------------ 903| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 904| 0| "unknown time stamp resolution %u", precision); 905| 0| free(p); 906| 0| *err = 1; 907| 0| return (NULL); 908| 146| } 909| | 910| 146| p->opt.tstamp_precision = precision; 911| | 912| | /* 913| | * Allocate a buffer into which to read blocks. We default to 914| | * the maximum of: 915| | * 916| | * the total length of the SHB for which we read the header; 917| | * 918| | * 2K, which should be more than large enough for an Enhanced 919| | * Packet Block containing a full-size Ethernet frame, and 920| | * leaving room for some options. 921| | * 922| | * If we find a bigger block, we reallocate the buffer, up to 923| | * the maximum size. We start out with a maximum size of 924| | * INITIAL_MAX_BLOCKSIZE; if we see any link-layer header types 925| | * with a maximum snapshot that results in a larger maximum 926| | * block length, we boost the maximum. 927| | */ 928| 146| p->bufsize = 2048; 929| 146| if (p->bufsize < total_length) ------------------ | Branch (929:6): [True: 6, False: 140] ------------------ 930| 6| p->bufsize = total_length; 931| 146| p->buffer = malloc(p->bufsize); 932| 146| if (p->buffer == NULL) { ------------------ | Branch (932:6): [True: 0, False: 146] ------------------ 933| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 934| 0| free(p); 935| 0| *err = 1; 936| 0| return (NULL); 937| 0| } 938| 146| ps->max_blocksize = INITIAL_MAX_BLOCKSIZE; ------------------ | | 238| 146|#define INITIAL_MAX_BLOCKSIZE (16*1024*1024) ------------------ 939| | 940| | /* 941| | * Copy the stuff we've read to the buffer, and read the rest 942| | * of the SHB. 943| | */ 944| 146| bhdrp = (struct block_header *)p->buffer; 945| 146| shbp = (struct section_header_block *)(p->buffer + sizeof(struct block_header)); 946| 146| bhdrp->block_type = magic_int; 947| 146| bhdrp->total_length = total_length; 948| 146| shbp->byte_order_magic = byte_order_magic; 949| 146| if (read_bytes(fp, ------------------ | Branch (949:6): [True: 10, False: 136] ------------------ 950| 146| p->buffer + (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)), 951| 146| total_length - (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)), 952| 146| 1, errbuf) == -1) 953| 10| goto fail; 954| | 955| 136| if (p->swapped) { ------------------ | Branch (955:6): [True: 120, False: 16] ------------------ 956| | /* 957| | * Byte-swap the fields we've read. 958| | */ 959| 120| shbp->major_version = SWAPSHORT(shbp->major_version); ------------------ | | 59| 120| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 120| ((((u_int)(y))&0xff00)>>8))) ------------------ 960| 120| shbp->minor_version = SWAPSHORT(shbp->minor_version); ------------------ | | 59| 120| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 120| ((((u_int)(y))&0xff00)>>8))) ------------------ 961| | 962| | /* 963| | * XXX - we don't care about the section length. 964| | */ 965| 120| } 966| | /* Currently only SHB versions 1.0 and 1.2 are supported; 967| | version 1.2 is treated as being the same as version 1.0. 968| | See the current version of the pcapng specification. 969| | 970| | Version 1.2 is written by some programs that write additional 971| | block types (which can be read by any code that handles them, 972| | regardless of whether the minor version if 0 or 2, so that's 973| | not a reason to change the minor version number). 974| | 975| | XXX - the pcapng specification says that readers should 976| | just ignore sections with an unsupported version number; 977| | presumably they can also report an error if they skip 978| | all the way to the end of the file without finding 979| | any versions that they support. */ 980| 136| if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR && ------------------ | | 106| 272|#define PCAP_NG_VERSION_MAJOR 1 ------------------ | Branch (980:9): [True: 129, False: 7] ------------------ 981| 129| (shbp->minor_version == PCAP_NG_VERSION_MINOR || ------------------ | | 107| 258|#define PCAP_NG_VERSION_MINOR 0 ------------------ | Branch (981:10): [True: 122, False: 7] ------------------ 982| 13| shbp->minor_version == 2))) { ------------------ | Branch (982:10): [True: 1, False: 6] ------------------ 983| 13| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 13|#define PCAP_ERRBUF_SIZE 256 ------------------ 984| 13| "unsupported pcapng savefile version %u.%u", 985| 13| shbp->major_version, shbp->minor_version); 986| 13| goto fail; 987| 13| } 988| 123| p->version_major = shbp->major_version; 989| 123| p->version_minor = shbp->minor_version; 990| | 991| | /* 992| | * Save the time stamp resolution the user requested. 993| | */ 994| 123| p->opt.tstamp_precision = precision; 995| | 996| | /* 997| | * Now start looking for an Interface Description Block. 998| | */ 999| 135| for (;;) { 1000| | /* 1001| | * Read the next block. 1002| | */ 1003| 135| status = read_block(fp, p, &cursor, errbuf); 1004| 135| if (status == 0) { ------------------ | Branch (1004:7): [True: 1, False: 134] ------------------ 1005| | /* EOF - no IDB in this file */ 1006| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 1007| 1| "the capture file has no Interface Description Blocks"); 1008| 1| goto fail; 1009| 1| } 1010| 134| if (status == -1) ------------------ | Branch (1010:7): [True: 46, False: 88] ------------------ 1011| 46| goto fail; /* error */ 1012| 88| switch (cursor.block_type) { 1013| | 1014| 75| case BT_IDB: ------------------ | | 112| 75|#define BT_IDB 0x00000001 ------------------ | Branch (1014:3): [True: 75, False: 13] ------------------ 1015| | /* 1016| | * Get a pointer to the fixed-length portion of the 1017| | * IDB. 1018| | */ 1019| 75| idbp = get_from_block_data(&cursor, sizeof(*idbp), 1020| 75| errbuf); 1021| 75| if (idbp == NULL) ------------------ | Branch (1021:8): [True: 0, False: 75] ------------------ 1022| 0| goto fail; /* error */ 1023| | 1024| | /* 1025| | * Byte-swap it if necessary. 1026| | */ 1027| 75| if (p->swapped) { ------------------ | Branch (1027:8): [True: 75, False: 0] ------------------ 1028| 75| idbp->linktype = SWAPSHORT(idbp->linktype); ------------------ | | 59| 75| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 75| ((((u_int)(y))&0xff00)>>8))) ------------------ 1029| 75| idbp->snaplen = SWAPLONG(idbp->snaplen); ------------------ | | 54| 75| (((((u_int)(y))&0xff)<<24) | \ | | 55| 75| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 75| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 75| ((((u_int)(y))>>24)&0xff)) ------------------ 1030| 75| } 1031| | 1032| | /* 1033| | * Try to add this interface. 1034| | */ 1035| 75| if (!add_interface(p, idbp, &cursor, errbuf)) ------------------ | Branch (1035:8): [True: 12, False: 63] ------------------ 1036| 12| goto fail; 1037| | 1038| 63| goto done; 1039| | 1040| 63| case BT_EPB: ------------------ | | 141| 0|#define BT_EPB 0x00000006 ------------------ | Branch (1040:3): [True: 0, False: 88] ------------------ 1041| 0| case BT_SPB: ------------------ | | 155| 0|#define BT_SPB 0x00000003 ------------------ | Branch (1041:3): [True: 0, False: 88] ------------------ 1042| 1| case BT_PB: ------------------ | | 165| 1|#define BT_PB 0x00000002 ------------------ | Branch (1042:3): [True: 1, False: 87] ------------------ 1043| | /* 1044| | * Saw a packet before we saw any IDBs. That's 1045| | * not valid, as we don't know what link-layer 1046| | * encapsulation the packet has. 1047| | */ 1048| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 1049| 1| "the capture file has a packet block before any Interface Description Blocks"); 1050| 1| goto fail; 1051| | 1052| 12| default: ------------------ | Branch (1052:3): [True: 12, False: 76] ------------------ 1053| | /* 1054| | * Just ignore it. 1055| | */ 1056| 12| break; 1057| 88| } 1058| 88| } 1059| | 1060| 63|done: 1061| 63| p->linktype = linktype_to_dlt(idbp->linktype); 1062| 63| p->snapshot = pcapint_adjust_snapshot(p->linktype, idbp->snaplen); 1063| 63| p->linktype_ext = 0; 1064| | 1065| | /* 1066| | * If the maximum block size for a packet with the maximum 1067| | * snapshot length for this DLT_ is bigger than the current 1068| | * maximum block size, increase the maximum. 1069| | */ 1070| 63| if (MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)) > ps->max_blocksize) ------------------ | | 246| 63| (sizeof (struct block_header) + \ | | 247| 63| sizeof (struct enhanced_packet_block) + \ | | 248| 63| (max_snaplen) + 131072 + \ | | 249| 63| sizeof (struct block_trailer)) ------------------ | Branch (1070:6): [True: 1, False: 62] ------------------ 1071| 1| ps->max_blocksize = MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)); ------------------ | | 246| 1| (sizeof (struct block_header) + \ | | 247| 1| sizeof (struct enhanced_packet_block) + \ | | 248| 1| (max_snaplen) + 131072 + \ | | 249| 1| sizeof (struct block_trailer)) ------------------ 1072| | 1073| 63| p->next_packet_op = pcap_ng_next_packet; 1074| 63| p->cleanup_op = pcap_ng_cleanup; 1075| | 1076| 63| return (p); 1077| | 1078| 83|fail: 1079| 83| free(ps->ifaces); 1080| 83| free(p->buffer); 1081| 83| free(p); 1082| 83| *err = 1; 1083| | return (NULL); 1084| 123|} sf-pcapng.c:read_bytes: 258| 1.29k|{ 259| 1.29k| size_t amt_read; 260| | 261| 1.29k| amt_read = fread(buf, 1, bytes_to_read, fp); 262| 1.29k| if (amt_read != bytes_to_read) { ------------------ | Branch (262:6): [True: 44, False: 1.24k] ------------------ 263| 44| if (ferror(fp)) { ------------------ | Branch (263:7): [True: 0, False: 44] ------------------ 264| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 265| 0| errno, "error reading dump file"); 266| 44| } else { 267| 44| if (amt_read == 0 && !fail_on_eof) ------------------ | Branch (267:8): [True: 1, False: 43] | Branch (267:25): [True: 1, False: 0] ------------------ 268| 1| return (0); /* EOF */ 269| 43| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 43|#define PCAP_ERRBUF_SIZE 256 ------------------ 270| 43| "truncated pcapng dump file; tried to read %zu bytes, only got %zu", 271| 43| bytes_to_read, amt_read); 272| 43| } 273| 43| return (-1); 274| 44| } 275| 1.24k| return (1); 276| 1.29k|} sf-pcapng.c:read_block: 280| 596|{ 281| 596| struct pcap_ng_sf *ps; 282| 596| int status; 283| 596| struct block_header bhdr; 284| 596| struct block_trailer *btrlr; 285| 596| u_char *bdata; 286| 596| size_t data_remaining; 287| | 288| 596| ps = p->priv; 289| | 290| 596| status = read_bytes(fp, &bhdr, sizeof(bhdr), 0, errbuf); 291| 596| if (status <= 0) ------------------ | Branch (291:6): [True: 9, False: 587] ------------------ 292| 9| return (status); /* error or EOF */ 293| | 294| 587| if (p->swapped) { ------------------ | Branch (294:6): [True: 577, False: 10] ------------------ 295| 577| bhdr.block_type = SWAPLONG(bhdr.block_type); ------------------ | | 54| 577| (((((u_int)(y))&0xff)<<24) | \ | | 55| 577| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 577| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 577| ((((u_int)(y))>>24)&0xff)) ------------------ 296| 577| bhdr.total_length = SWAPLONG(bhdr.total_length); ------------------ | | 54| 577| (((((u_int)(y))&0xff)<<24) | \ | | 55| 577| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 577| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 577| ((((u_int)(y))>>24)&0xff)) ------------------ 297| 577| } 298| | 299| | /* 300| | * Is this block "too small" - i.e., is it shorter than a block 301| | * header plus a block trailer? 302| | */ 303| 587| if (bhdr.total_length < sizeof(struct block_header) + ------------------ | Branch (303:6): [True: 6, False: 581] ------------------ 304| 587| sizeof(struct block_trailer)) { 305| 6| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 6|#define PCAP_ERRBUF_SIZE 256 ------------------ 306| 6| "block in pcapng dump file has a length of %u < %zu", 307| 6| bhdr.total_length, 308| 6| sizeof(struct block_header) + sizeof(struct block_trailer)); 309| 6| return (-1); 310| 6| } 311| | 312| | /* 313| | * Is the block total length a multiple of 4? 314| | */ 315| 581| if ((bhdr.total_length % 4) != 0) { ------------------ | Branch (315:6): [True: 18, False: 563] ------------------ 316| | /* 317| | * No. Report that as an error. 318| | */ 319| 18| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 18|#define PCAP_ERRBUF_SIZE 256 ------------------ 320| 18| "block in pcapng dump file has a length of %u that is not a multiple of 4", 321| 18| bhdr.total_length); 322| 18| return (-1); 323| 18| } 324| | 325| | /* 326| | * Is the buffer big enough? 327| | */ 328| 563| if (p->bufsize < bhdr.total_length) { ------------------ | Branch (328:6): [True: 36, False: 527] ------------------ 329| | /* 330| | * No - make it big enough, unless it's too big, in 331| | * which case we fail. 332| | */ 333| 36| void *bigger_buffer; 334| | 335| 36| if (bhdr.total_length > ps->max_blocksize) { ------------------ | Branch (335:7): [True: 12, False: 24] ------------------ 336| 12| snprintf(errbuf, PCAP_ERRBUF_SIZE, "pcapng block size %u > maximum %u", bhdr.total_length, ------------------ | | 149| 12|#define PCAP_ERRBUF_SIZE 256 ------------------ 337| 12| ps->max_blocksize); 338| 12| return (-1); 339| 12| } 340| 24| bigger_buffer = realloc(p->buffer, bhdr.total_length); 341| 24| if (bigger_buffer == NULL) { ------------------ | Branch (341:7): [True: 0, False: 24] ------------------ 342| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 343| 0| return (-1); 344| 0| } 345| 24| p->buffer = bigger_buffer; 346| 24| } 347| | 348| | /* 349| | * Copy the stuff we've read to the buffer, and read the rest 350| | * of the block. 351| | */ 352| 551| memcpy(p->buffer, &bhdr, sizeof(bhdr)); 353| 551| bdata = p->buffer + sizeof(bhdr); 354| 551| data_remaining = bhdr.total_length - sizeof(bhdr); 355| 551| if (read_bytes(fp, bdata, data_remaining, 1, errbuf) == -1) ------------------ | Branch (355:6): [True: 25, False: 526] ------------------ 356| 25| return (-1); 357| | 358| | /* 359| | * Get the block size from the trailer. 360| | */ 361| 526| btrlr = (struct block_trailer *)(bdata + data_remaining - sizeof (struct block_trailer)); 362| 526| if (p->swapped) ------------------ | Branch (362:6): [True: 523, False: 3] ------------------ 363| 523| btrlr->total_length = SWAPLONG(btrlr->total_length); ------------------ | | 54| 523| (((((u_int)(y))&0xff)<<24) | \ | | 55| 523| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 523| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 523| ((((u_int)(y))>>24)&0xff)) ------------------ 364| | 365| | /* 366| | * Is the total length from the trailer the same as the total 367| | * length from the header? 368| | */ 369| 526| if (bhdr.total_length != btrlr->total_length) { ------------------ | Branch (369:6): [True: 22, False: 504] ------------------ 370| | /* 371| | * No. 372| | */ 373| 22| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 22|#define PCAP_ERRBUF_SIZE 256 ------------------ 374| 22| "block total length in header %u and trailer %u don't match", 375| 22| bhdr.total_length, btrlr->total_length); 376| 22| return (-1); 377| 22| } 378| | 379| | /* 380| | * Initialize the cursor. 381| | */ 382| 504| cursor->data = bdata; 383| 504| cursor->data_remaining = data_remaining - sizeof(struct block_trailer); 384| 504| cursor->block_type = bhdr.block_type; 385| 504| return (1); 386| 526|} sf-pcapng.c:get_from_block_data: 391| 1.15k|{ 392| 1.15k| void *data; 393| | 394| | /* 395| | * Make sure we have the specified amount of data remaining in 396| | * the block data. 397| | */ 398| 1.15k| if (cursor->data_remaining < chunk_size) { ------------------ | Branch (398:6): [True: 9, False: 1.14k] ------------------ 399| 9| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 9|#define PCAP_ERRBUF_SIZE 256 ------------------ 400| 9| "block of type %u in pcapng dump file is too short", 401| 9| cursor->block_type); 402| 9| return (NULL); 403| 9| } 404| | 405| | /* 406| | * Return the current pointer, and skip past the chunk. 407| | */ 408| 1.14k| data = cursor->data; 409| 1.14k| cursor->data += chunk_size; 410| 1.14k| cursor->data_remaining -= chunk_size; 411| 1.14k| return (data); 412| 1.15k|} sf-pcapng.c:add_interface: 594| 82|{ 595| 82| struct pcap_ng_sf *ps; 596| 82| uint64_t tsresol; 597| 82| int64_t tsoffset; 598| 82| int is_binary; 599| | 600| 82| ps = p->priv; 601| | 602| | /* 603| | * Count this interface. 604| | */ 605| 82| ps->ifcount++; 606| | 607| | /* 608| | * Grow the array of per-interface information as necessary. 609| | */ 610| 82| if (ps->ifcount > ps->ifaces_size) { ------------------ | Branch (610:6): [True: 81, False: 1] ------------------ 611| | /* 612| | * We need to grow the array. 613| | */ 614| 81| bpf_u_int32 new_ifaces_size; 615| 81| struct pcap_ng_if *new_ifaces; 616| | 617| 81| if (ps->ifaces_size == 0) { ------------------ | Branch (617:7): [True: 75, False: 6] ------------------ 618| | /* 619| | * It's currently empty. 620| | * 621| | * (The Clang static analyzer doesn't do enough, 622| | * err, umm, dataflow *analysis* to realize that 623| | * ps->ifaces_size == 0 if ps->ifaces == NULL, 624| | * and so complains about a possible zero argument 625| | * to realloc(), so we check for the former 626| | * condition to shut it up. 627| | * 628| | * However, it doesn't complain that one of the 629| | * multiplications below could overflow, which is 630| | * a real, albeit extremely unlikely, problem (you'd 631| | * need a pcapng file with tens of millions of 632| | * interfaces).) 633| | */ 634| 75| new_ifaces_size = 1; 635| 75| new_ifaces = malloc(sizeof (struct pcap_ng_if)); 636| 75| } else { 637| | /* 638| | * It's not currently empty; double its size. 639| | * (Perhaps overkill once we have a lot of interfaces.) 640| | * 641| | * Check for overflow if we double it. 642| | */ 643| 6| if (ps->ifaces_size * 2 < ps->ifaces_size) { ------------------ | Branch (643:8): [True: 0, False: 6] ------------------ 644| | /* 645| | * The maximum number of interfaces before 646| | * ps->ifaces_size overflows is the largest 647| | * possible 32-bit power of 2, as we do 648| | * size doubling. 649| | */ 650| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 651| 0| "more than %u interfaces in the file", 652| 0| 0x80000000U); 653| 0| return (0); 654| 0| } 655| | 656| | /* 657| | * ps->ifaces_size * 2 doesn't overflow, so it's 658| | * safe to multiply. 659| | */ 660| 6| new_ifaces_size = ps->ifaces_size * 2; 661| | 662| | /* 663| | * Now make sure that's not so big that it overflows 664| | * if we multiply by sizeof (struct pcap_ng_if). 665| | * 666| | * That can happen on 32-bit platforms, with a 32-bit 667| | * size_t; it shouldn't happen on 64-bit platforms, 668| | * with a 64-bit size_t, as new_ifaces_size is 669| | * 32 bits. 670| | */ 671| 6| if (new_ifaces_size * sizeof (struct pcap_ng_if) < new_ifaces_size) { ------------------ | Branch (671:8): [True: 0, False: 6] ------------------ 672| | /* 673| | * As this fails only with 32-bit size_t, 674| | * the multiplication was 32x32->32, and 675| | * the largest 32-bit value that can safely 676| | * be multiplied by sizeof (struct pcap_ng_if) 677| | * without overflow is the largest 32-bit 678| | * (unsigned) value divided by 679| | * sizeof (struct pcap_ng_if). 680| | */ 681| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 682| 0| "more than %u interfaces in the file", 683| 0| 0xFFFFFFFFU / ((u_int)sizeof (struct pcap_ng_if))); 684| 0| return (0); 685| 0| } 686| 6| new_ifaces = realloc(ps->ifaces, new_ifaces_size * sizeof (struct pcap_ng_if)); 687| 6| } 688| 81| if (new_ifaces == NULL) { ------------------ | Branch (688:7): [True: 0, False: 81] ------------------ 689| | /* 690| | * We ran out of memory. 691| | * Give up. 692| | */ 693| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 694| 0| "out of memory for per-interface information (%u interfaces)", 695| 0| ps->ifcount); 696| 0| return (0); 697| 0| } 698| 81| ps->ifaces_size = new_ifaces_size; 699| 81| ps->ifaces = new_ifaces; 700| 81| } 701| | 702| 82| ps->ifaces[ps->ifcount - 1].snaplen = idbp->snaplen; 703| | 704| | /* 705| | * Set the default time stamp resolution and offset. 706| | */ 707| 82| tsresol = 1000000; /* microsecond resolution */ 708| 82| is_binary = 0; /* which is a power of 10 */ 709| 82| tsoffset = 0; /* absolute timestamps */ 710| | 711| | /* 712| | * Now look for various time stamp options, so we know 713| | * how to interpret the time stamps for this interface. 714| | */ 715| 82| if (process_idb_options(p, cursor, &tsresol, &tsoffset, &is_binary, ------------------ | Branch (715:6): [True: 13, False: 69] ------------------ 716| 82| errbuf) == -1) 717| 13| return (0); 718| | 719| 69| ps->ifaces[ps->ifcount - 1].tsresol = tsresol; 720| 69| ps->ifaces[ps->ifcount - 1].tsoffset = tsoffset; 721| | 722| | /* 723| | * Determine whether we're scaling up or down or not 724| | * at all for this interface. 725| | */ 726| 69| if (tsresol == ps->user_tsresol) { ------------------ | Branch (726:6): [True: 65, False: 4] ------------------ 727| | /* 728| | * The resolution is the resolution the user wants, 729| | * so we don't have to do scaling. 730| | */ 731| 65| ps->ifaces[ps->ifcount - 1].scale_type = PASS_THROUGH; 732| 65| } else if (tsresol > ps->user_tsresol) { ------------------ | Branch (732:13): [True: 2, False: 2] ------------------ 733| | /* 734| | * The resolution is greater than what the user wants, 735| | * so we have to scale the timestamps down. 736| | */ 737| 2| if (is_binary) ------------------ | Branch (737:7): [True: 1, False: 1] ------------------ 738| 1| ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_BIN; 739| 1| else { 740| | /* 741| | * Calculate the scale factor. 742| | */ 743| 1| ps->ifaces[ps->ifcount - 1].scale_factor = tsresol/ps->user_tsresol; 744| 1| ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_DEC; 745| 1| } 746| 2| } else { 747| | /* 748| | * The resolution is less than what the user wants, 749| | * so we have to scale the timestamps up. 750| | */ 751| 2| if (is_binary) ------------------ | Branch (751:7): [True: 1, False: 1] ------------------ 752| 1| ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_BIN; 753| 1| else { 754| | /* 755| | * Calculate the scale factor. 756| | */ 757| 1| ps->ifaces[ps->ifcount - 1].scale_factor = ps->user_tsresol/tsresol; 758| 1| ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_DEC; 759| 1| } 760| 2| } 761| 69| return (1); 762| 82|} sf-pcapng.c:process_idb_options: 463| 82|{ 464| 82| struct option_header *opthdr; 465| 82| void *optvalue; 466| 82| int saw_tsresol, saw_tsoffset; 467| 82| uint8_t tsresol_opt; 468| 82| u_int i; 469| | 470| 82| saw_tsresol = 0; 471| 82| saw_tsoffset = 0; 472| 195| while (cursor->data_remaining != 0) { ------------------ | Branch (472:9): [True: 195, False: 0] ------------------ 473| | /* 474| | * Get the option header. 475| | */ 476| 195| opthdr = get_opthdr_from_block_data(p, cursor, errbuf); 477| 195| if (opthdr == NULL) { ------------------ | Branch (477:7): [True: 0, False: 195] ------------------ 478| | /* 479| | * Option header is cut short. 480| | */ 481| 0| return (-1); 482| 0| } 483| | 484| | /* 485| | * Get option value. 486| | */ 487| 195| optvalue = get_optvalue_from_block_data(cursor, opthdr, 488| 195| errbuf); 489| 195| if (optvalue == NULL) { ------------------ | Branch (489:7): [True: 6, False: 189] ------------------ 490| | /* 491| | * Option value is cut short. 492| | */ 493| 6| return (-1); 494| 6| } 495| | 496| 189| switch (opthdr->option_code) { 497| | 498| 71| case OPT_ENDOFOPT: ------------------ | | 67| 71|#define OPT_ENDOFOPT 0 /* end of options */ ------------------ | Branch (498:3): [True: 71, False: 118] ------------------ 499| 71| if (opthdr->option_length != 0) { ------------------ | Branch (499:8): [True: 2, False: 69] ------------------ 500| 2| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 2|#define PCAP_ERRBUF_SIZE 256 ------------------ 501| 2| "Interface Description Block has opt_endofopt option with length %u != 0", 502| 2| opthdr->option_length); 503| 2| return (-1); 504| 2| } 505| 69| goto done; 506| | 507| 69| case IF_TSRESOL: ------------------ | | 131| 10|#define IF_TSRESOL 9 /* interface's time stamp resolution */ ------------------ | Branch (507:3): [True: 10, False: 179] ------------------ 508| 10| if (opthdr->option_length != 1) { ------------------ | Branch (508:8): [True: 0, False: 10] ------------------ 509| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 510| 0| "Interface Description Block has if_tsresol option with length %u != 1", 511| 0| opthdr->option_length); 512| 0| return (-1); 513| 0| } 514| 10| if (saw_tsresol) { ------------------ | Branch (514:8): [True: 0, False: 10] ------------------ 515| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 516| 0| "Interface Description Block has more than one if_tsresol option"); 517| 0| return (-1); 518| 0| } 519| 10| saw_tsresol = 1; 520| 10| memcpy(&tsresol_opt, optvalue, sizeof(tsresol_opt)); 521| 10| if (tsresol_opt & 0x80) { ------------------ | Branch (521:8): [True: 6, False: 4] ------------------ 522| | /* 523| | * Resolution is negative power of 2. 524| | */ 525| 6| uint8_t tsresol_shift = (tsresol_opt & 0x7F); 526| | 527| 6| if (tsresol_shift > 63) { ------------------ | Branch (527:9): [True: 3, False: 3] ------------------ 528| | /* 529| | * Resolution is too high; 2^-{res} 530| | * won't fit in a 64-bit value. 531| | */ 532| 3| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 3|#define PCAP_ERRBUF_SIZE 256 ------------------ 533| 3| "Interface Description Block if_tsresol option resolution 2^-%u is too high", 534| 3| tsresol_shift); 535| 3| return (-1); 536| 3| } 537| 3| *is_binary = 1; 538| 3| *tsresol = ((uint64_t)1) << tsresol_shift; 539| 4| } else { 540| | /* 541| | * Resolution is negative power of 10. 542| | */ 543| 4| if (tsresol_opt > 19) { ------------------ | Branch (543:9): [True: 1, False: 3] ------------------ 544| | /* 545| | * Resolution is too high; 2^-{res} 546| | * won't fit in a 64-bit value (the 547| | * largest power of 10 that fits 548| | * in a 64-bit value is 10^19, as 549| | * the largest 64-bit unsigned 550| | * value is ~1.8*10^19). 551| | */ 552| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 553| 1| "Interface Description Block if_tsresol option resolution 10^-%u is too high", 554| 1| tsresol_opt); 555| 1| return (-1); 556| 1| } 557| 3| *is_binary = 0; 558| 3| *tsresol = 1; 559| 19| for (i = 0; i < tsresol_opt; i++) ------------------ | Branch (559:17): [True: 16, False: 3] ------------------ 560| 16| *tsresol *= 10; 561| 3| } 562| 6| break; 563| | 564| 6| case IF_TSOFFSET: ------------------ | | 136| 1|#define IF_TSOFFSET 14 /* time stamp offset for this interface */ ------------------ | Branch (564:3): [True: 1, False: 188] ------------------ 565| 1| if (opthdr->option_length != 8) { ------------------ | Branch (565:8): [True: 1, False: 0] ------------------ 566| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 567| 1| "Interface Description Block has if_tsoffset option with length %u != 8", 568| 1| opthdr->option_length); 569| 1| return (-1); 570| 1| } 571| 0| if (saw_tsoffset) { ------------------ | Branch (571:8): [True: 0, False: 0] ------------------ 572| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 573| 0| "Interface Description Block has more than one if_tsoffset option"); 574| 0| return (-1); 575| 0| } 576| 0| saw_tsoffset = 1; 577| 0| memcpy(tsoffset, optvalue, sizeof(*tsoffset)); 578| 0| if (p->swapped) ------------------ | Branch (578:8): [True: 0, False: 0] ------------------ 579| 0| *tsoffset = SWAPLL(*tsoffset); ------------------ | | 45| 0|#define SWAPLL(y) ((((uint64_t)(y) & 0xff00000000000000ULL) >> 56) | \ | | 46| 0| (((uint64_t)(y) & 0x00ff000000000000ULL) >> 40) | \ | | 47| 0| (((uint64_t)(y) & 0x0000ff0000000000ULL) >> 24) | \ | | 48| 0| (((uint64_t)(y) & 0x000000ff00000000ULL) >> 8) | \ | | 49| 0| (((uint64_t)(y) & 0x00000000ff000000ULL) << 8) | \ | | 50| 0| (((uint64_t)(y) & 0x0000000000ff0000ULL) << 24) | \ | | 51| 0| (((uint64_t)(y) & 0x000000000000ff00ULL) << 40) | \ | | 52| 0| (((uint64_t)(y) & 0x00000000000000ffULL) << 56)) ------------------ 580| 0| break; 581| | 582| 107| default: ------------------ | Branch (582:3): [True: 107, False: 82] ------------------ 583| 107| break; 584| 189| } 585| 189| } 586| | 587| 69|done: 588| 69| return (0); 589| 82|} sf-pcapng.c:get_opthdr_from_block_data: 416| 195|{ 417| 195| struct option_header *opthdr; 418| | 419| 195| opthdr = get_from_block_data(cursor, sizeof(*opthdr), errbuf); 420| 195| if (opthdr == NULL) { ------------------ | Branch (420:6): [True: 0, False: 195] ------------------ 421| | /* 422| | * Option header is cut short. 423| | */ 424| 0| return (NULL); 425| 0| } 426| | 427| | /* 428| | * Byte-swap it if necessary. 429| | */ 430| 195| if (p->swapped) { ------------------ | Branch (430:6): [True: 195, False: 0] ------------------ 431| 195| opthdr->option_code = SWAPSHORT(opthdr->option_code); ------------------ | | 59| 195| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 195| ((((u_int)(y))&0xff00)>>8))) ------------------ 432| 195| opthdr->option_length = SWAPSHORT(opthdr->option_length); ------------------ | | 59| 195| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 195| ((((u_int)(y))&0xff00)>>8))) ------------------ 433| 195| } 434| | 435| 195| return (opthdr); 436| 195|} sf-pcapng.c:get_optvalue_from_block_data: 441| 195|{ 442| 195| size_t padded_option_len; 443| 195| void *optvalue; 444| | 445| | /* Pad option length to 4-byte boundary */ 446| 195| padded_option_len = opthdr->option_length; 447| 195| padded_option_len = ((padded_option_len + 3)/4)*4; 448| | 449| 195| optvalue = get_from_block_data(cursor, padded_option_len, errbuf); 450| 195| if (optvalue == NULL) { ------------------ | Branch (450:6): [True: 6, False: 189] ------------------ 451| | /* 452| | * Option value is cut short. 453| | */ 454| 6| return (NULL); 455| 6| } 456| | 457| 189| return (optvalue); 458| 195|} sf-pcapng.c:pcap_ng_cleanup: 1088| 63|{ 1089| 63| struct pcap_ng_sf *ps = p->priv; 1090| | 1091| 63| free(ps->ifaces); 1092| 63| pcapint_sf_cleanup(p); 1093| 63|} sf-pcapng.c:pcap_ng_next_packet: 1102| 395|{ 1103| 395| struct pcap_ng_sf *ps = p->priv; 1104| 395| struct block_cursor cursor; 1105| 395| int status; 1106| 395| struct enhanced_packet_block *epbp; 1107| 395| struct simple_packet_block *spbp; 1108| 395| struct packet_block *pbp; 1109| 395| bpf_u_int32 interface_id = 0xFFFFFFFF; 1110| 395| struct interface_description_block *idbp; 1111| 395| struct section_header_block *shbp; 1112| 395| FILE *fp = p->rfile; 1113| 395| uint64_t t, sec, frac; 1114| | 1115| | /* 1116| | * Look for an Enhanced Packet Block, a Simple Packet Block, 1117| | * or a Packet Block. 1118| | */ 1119| 461| for (;;) { 1120| | /* 1121| | * Read the block type and length; those are common 1122| | * to all blocks. 1123| | */ 1124| 461| status = read_block(fp, p, &cursor, p->errbuf); 1125| 461| if (status == 0) ------------------ | Branch (1125:7): [True: 0, False: 461] ------------------ 1126| 0| return (0); /* EOF */ 1127| 461| if (status == -1) ------------------ | Branch (1127:7): [True: 45, False: 416] ------------------ 1128| 45| return (-1); /* error */ 1129| 416| switch (cursor.block_type) { 1130| | 1131| 11| case BT_EPB: ------------------ | | 141| 11|#define BT_EPB 0x00000006 ------------------ | Branch (1131:3): [True: 11, False: 405] ------------------ 1132| | /* 1133| | * Get a pointer to the fixed-length portion of the 1134| | * EPB. 1135| | */ 1136| 11| epbp = get_from_block_data(&cursor, sizeof(*epbp), 1137| 11| p->errbuf); 1138| 11| if (epbp == NULL) ------------------ | Branch (1138:8): [True: 0, False: 11] ------------------ 1139| 0| return (-1); /* error */ 1140| | 1141| | /* 1142| | * Byte-swap it if necessary. 1143| | */ 1144| 11| if (p->swapped) { ------------------ | Branch (1144:8): [True: 11, False: 0] ------------------ 1145| | /* these were written in opposite byte order */ 1146| 11| interface_id = SWAPLONG(epbp->interface_id); ------------------ | | 54| 11| (((((u_int)(y))&0xff)<<24) | \ | | 55| 11| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 11| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 11| ((((u_int)(y))>>24)&0xff)) ------------------ 1147| 11| hdr->caplen = SWAPLONG(epbp->caplen); ------------------ | | 54| 11| (((((u_int)(y))&0xff)<<24) | \ | | 55| 11| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 11| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 11| ((((u_int)(y))>>24)&0xff)) ------------------ 1148| 11| hdr->len = SWAPLONG(epbp->len); ------------------ | | 54| 11| (((((u_int)(y))&0xff)<<24) | \ | | 55| 11| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 11| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 11| ((((u_int)(y))>>24)&0xff)) ------------------ 1149| 11| t = ((uint64_t)SWAPLONG(epbp->timestamp_high)) << 32 | ------------------ | | 54| 11| (((((u_int)(y))&0xff)<<24) | \ | | 55| 11| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 11| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 11| ((((u_int)(y))>>24)&0xff)) ------------------ 1150| 11| SWAPLONG(epbp->timestamp_low); ------------------ | | 54| 11| (((((u_int)(y))&0xff)<<24) | \ | | 55| 11| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 11| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 11| ((((u_int)(y))>>24)&0xff)) ------------------ 1151| 11| } else { 1152| 0| interface_id = epbp->interface_id; 1153| 0| hdr->caplen = epbp->caplen; 1154| 0| hdr->len = epbp->len; 1155| 0| t = ((uint64_t)epbp->timestamp_high) << 32 | 1156| 0| epbp->timestamp_low; 1157| 0| } 1158| 11| goto found; 1159| | 1160| 325| case BT_SPB: ------------------ | | 155| 325|#define BT_SPB 0x00000003 ------------------ | Branch (1160:3): [True: 325, False: 91] ------------------ 1161| | /* 1162| | * Get a pointer to the fixed-length portion of the 1163| | * SPB. 1164| | */ 1165| 325| spbp = get_from_block_data(&cursor, sizeof(*spbp), 1166| 325| p->errbuf); 1167| 325| if (spbp == NULL) ------------------ | Branch (1167:8): [True: 0, False: 325] ------------------ 1168| 0| return (-1); /* error */ 1169| | 1170| | /* 1171| | * SPB packets are assumed to have arrived on 1172| | * the first interface. 1173| | */ 1174| 325| interface_id = 0; 1175| | 1176| | /* 1177| | * Byte-swap it if necessary. 1178| | */ 1179| 325| if (p->swapped) { ------------------ | Branch (1179:8): [True: 325, False: 0] ------------------ 1180| | /* these were written in opposite byte order */ 1181| 325| hdr->len = SWAPLONG(spbp->len); ------------------ | | 54| 325| (((((u_int)(y))&0xff)<<24) | \ | | 55| 325| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 325| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 325| ((((u_int)(y))>>24)&0xff)) ------------------ 1182| 325| } else 1183| 0| hdr->len = spbp->len; 1184| | 1185| | /* 1186| | * The SPB doesn't give the captured length; 1187| | * it's the minimum of the snapshot length 1188| | * and the packet length. 1189| | */ 1190| 325| hdr->caplen = hdr->len; 1191| 325| if (hdr->caplen > (bpf_u_int32)p->snapshot) ------------------ | Branch (1191:8): [True: 2, False: 323] ------------------ 1192| 2| hdr->caplen = p->snapshot; 1193| 325| t = 0; /* no time stamps */ 1194| 325| goto found; 1195| | 1196| 6| case BT_PB: ------------------ | | 165| 6|#define BT_PB 0x00000002 ------------------ | Branch (1196:3): [True: 6, False: 410] ------------------ 1197| | /* 1198| | * Get a pointer to the fixed-length portion of the 1199| | * PB. 1200| | */ 1201| 6| pbp = get_from_block_data(&cursor, sizeof(*pbp), 1202| 6| p->errbuf); 1203| 6| if (pbp == NULL) ------------------ | Branch (1203:8): [True: 0, False: 6] ------------------ 1204| 0| return (-1); /* error */ 1205| | 1206| | /* 1207| | * Byte-swap it if necessary. 1208| | */ 1209| 6| if (p->swapped) { ------------------ | Branch (1209:8): [True: 6, False: 0] ------------------ 1210| | /* these were written in opposite byte order */ 1211| 6| interface_id = SWAPSHORT(pbp->interface_id); ------------------ | | 59| 6| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 6| ((((u_int)(y))&0xff00)>>8))) ------------------ 1212| 6| hdr->caplen = SWAPLONG(pbp->caplen); ------------------ | | 54| 6| (((((u_int)(y))&0xff)<<24) | \ | | 55| 6| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 6| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 6| ((((u_int)(y))>>24)&0xff)) ------------------ 1213| 6| hdr->len = SWAPLONG(pbp->len); ------------------ | | 54| 6| (((((u_int)(y))&0xff)<<24) | \ | | 55| 6| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 6| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 6| ((((u_int)(y))>>24)&0xff)) ------------------ 1214| 6| t = ((uint64_t)SWAPLONG(pbp->timestamp_high)) << 32 | ------------------ | | 54| 6| (((((u_int)(y))&0xff)<<24) | \ | | 55| 6| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 6| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 6| ((((u_int)(y))>>24)&0xff)) ------------------ 1215| 6| SWAPLONG(pbp->timestamp_low); ------------------ | | 54| 6| (((((u_int)(y))&0xff)<<24) | \ | | 55| 6| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 6| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 6| ((((u_int)(y))>>24)&0xff)) ------------------ 1216| 6| } else { 1217| 0| interface_id = pbp->interface_id; 1218| 0| hdr->caplen = pbp->caplen; 1219| 0| hdr->len = pbp->len; 1220| 0| t = ((uint64_t)pbp->timestamp_high) << 32 | 1221| 0| pbp->timestamp_low; 1222| 0| } 1223| 6| goto found; 1224| | 1225| 9| case BT_IDB: ------------------ | | 112| 9|#define BT_IDB 0x00000001 ------------------ | Branch (1225:3): [True: 9, False: 407] ------------------ 1226| | /* 1227| | * Interface Description Block. Get a pointer 1228| | * to its fixed-length portion. 1229| | */ 1230| 9| idbp = get_from_block_data(&cursor, sizeof(*idbp), 1231| 9| p->errbuf); 1232| 9| if (idbp == NULL) ------------------ | Branch (1232:8): [True: 0, False: 9] ------------------ 1233| 0| return (-1); /* error */ 1234| | 1235| | /* 1236| | * Byte-swap it if necessary. 1237| | */ 1238| 9| if (p->swapped) { ------------------ | Branch (1238:8): [True: 9, False: 0] ------------------ 1239| 9| idbp->linktype = SWAPSHORT(idbp->linktype); ------------------ | | 59| 9| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 9| ((((u_int)(y))&0xff00)>>8))) ------------------ 1240| 9| idbp->snaplen = SWAPLONG(idbp->snaplen); ------------------ | | 54| 9| (((((u_int)(y))&0xff)<<24) | \ | | 55| 9| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 9| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 9| ((((u_int)(y))>>24)&0xff)) ------------------ 1241| 9| } 1242| | 1243| | /* 1244| | * If the link-layer type or snapshot length 1245| | * differ from the ones for the first IDB we 1246| | * saw, quit. 1247| | * 1248| | * XXX - just discard packets from those 1249| | * interfaces? 1250| | */ 1251| 9| if (p->linktype != idbp->linktype) { ------------------ | Branch (1251:8): [True: 0, False: 9] ------------------ 1252| 0| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 1253| 0| "an interface has a type %u different from the type of the first interface", 1254| 0| idbp->linktype); 1255| 0| return (-1); 1256| 0| } 1257| | 1258| | /* 1259| | * Check against the *adjusted* value of this IDB's 1260| | * snapshot length. 1261| | */ 1262| 9| if ((bpf_u_int32)p->snapshot != ------------------ | Branch (1262:8): [True: 2, False: 7] ------------------ 1263| 9| pcapint_adjust_snapshot(p->linktype, idbp->snaplen)) { 1264| 2| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 2|#define PCAP_ERRBUF_SIZE 256 ------------------ 1265| 2| "an interface has a snapshot length %u different from the snapshot length of the first interface", 1266| 2| idbp->snaplen); 1267| 2| return (-1); 1268| 2| } 1269| | 1270| | /* 1271| | * Try to add this interface. 1272| | */ 1273| 7| if (!add_interface(p, idbp, &cursor, p->errbuf)) ------------------ | Branch (1273:8): [True: 1, False: 6] ------------------ 1274| 1| return (-1); 1275| 6| break; 1276| | 1277| 6| case BT_SHB: ------------------ | | 86| 5|#define BT_SHB 0x0A0D0D0A ------------------ | Branch (1277:3): [True: 5, False: 411] ------------------ 1278| | /* 1279| | * Section Header Block. Get a pointer 1280| | * to its fixed-length portion. 1281| | */ 1282| 5| shbp = get_from_block_data(&cursor, sizeof(*shbp), 1283| 5| p->errbuf); 1284| 5| if (shbp == NULL) ------------------ | Branch (1284:8): [True: 0, False: 5] ------------------ 1285| 0| return (-1); /* error */ 1286| | 1287| | /* 1288| | * Assume the byte order of this section is 1289| | * the same as that of the previous section. 1290| | * We'll check for that later. 1291| | */ 1292| 5| if (p->swapped) { ------------------ | Branch (1292:8): [True: 5, False: 0] ------------------ 1293| 5| shbp->byte_order_magic = 1294| 5| SWAPLONG(shbp->byte_order_magic); ------------------ | | 54| 5| (((((u_int)(y))&0xff)<<24) | \ | | 55| 5| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 5| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 5| ((((u_int)(y))>>24)&0xff)) ------------------ 1295| 5| shbp->major_version = 1296| 5| SWAPSHORT(shbp->major_version); ------------------ | | 59| 5| ((u_short)(((((u_int)(y))&0xff)<<8) | \ | | 60| 5| ((((u_int)(y))&0xff00)>>8))) ------------------ 1297| 5| } 1298| | 1299| | /* 1300| | * Make sure the byte order doesn't change; 1301| | * pcap_is_swapped() shouldn't change its 1302| | * return value in the middle of reading a capture. 1303| | */ 1304| 5| switch (shbp->byte_order_magic) { 1305| | 1306| 0| case BYTE_ORDER_MAGIC: ------------------ | | 99| 0|#define BYTE_ORDER_MAGIC 0x1A2B3C4D ------------------ | Branch (1306:4): [True: 0, False: 5] ------------------ 1307| | /* 1308| | * OK. 1309| | */ 1310| 0| break; 1311| | 1312| 0| case SWAPLONG(BYTE_ORDER_MAGIC): ------------------ | | 54| 0| (((((u_int)(y))&0xff)<<24) | \ | | 55| 0| ((((u_int)(y))&0xff00)<<8) | \ | | 56| 0| ((((u_int)(y))&0xff0000)>>8) | \ | | 57| 0| ((((u_int)(y))>>24)&0xff)) ------------------ | Branch (1312:4): [True: 0, False: 5] ------------------ 1313| | /* 1314| | * Byte order changes. 1315| | */ 1316| 0| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 1317| 0| "the file has sections with different byte orders"); 1318| 0| return (-1); 1319| | 1320| 5| default: ------------------ | Branch (1320:4): [True: 5, False: 0] ------------------ 1321| | /* 1322| | * Not a valid SHB. 1323| | */ 1324| 5| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 5|#define PCAP_ERRBUF_SIZE 256 ------------------ 1325| 5| "the file has a section with a bad byte order magic field"); 1326| 5| return (-1); 1327| 5| } 1328| | 1329| | /* 1330| | * Make sure the major version is the version 1331| | * we handle. 1332| | */ 1333| 0| if (shbp->major_version != PCAP_NG_VERSION_MAJOR) { ------------------ | | 106| 0|#define PCAP_NG_VERSION_MAJOR 1 ------------------ | Branch (1333:8): [True: 0, False: 0] ------------------ 1334| 0| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 1335| 0| "unknown pcapng savefile major version number %u", 1336| 0| shbp->major_version); 1337| 0| return (-1); 1338| 0| } 1339| | 1340| | /* 1341| | * Reset the interface count; this section should 1342| | * have its own set of IDBs. If any of them 1343| | * don't have the same interface type, snapshot 1344| | * length, or resolution as the first interface 1345| | * we saw, we'll fail. (And if we don't see 1346| | * any IDBs, we'll fail when we see a packet 1347| | * block.) 1348| | */ 1349| 0| ps->ifcount = 0; 1350| 0| break; 1351| | 1352| 60| default: ------------------ | Branch (1352:3): [True: 60, False: 356] ------------------ 1353| | /* 1354| | * Not a packet block, IDB, or SHB; ignore it. 1355| | */ 1356| 60| break; 1357| 416| } 1358| 416| } 1359| | 1360| 342|found: 1361| | /* 1362| | * Is the interface ID an interface we know? 1363| | */ 1364| 342| if (interface_id >= ps->ifcount) { ------------------ | Branch (1364:6): [True: 5, False: 337] ------------------ 1365| | /* 1366| | * Yes. Fail. 1367| | */ 1368| 5| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 5|#define PCAP_ERRBUF_SIZE 256 ------------------ 1369| 5| "a packet arrived on interface %u, but there's no Interface Description Block for that interface", 1370| 5| interface_id); 1371| 5| return (-1); 1372| 5| } 1373| | 1374| 337| if (hdr->caplen > (bpf_u_int32)p->snapshot) { ------------------ | Branch (1374:6): [True: 2, False: 335] ------------------ 1375| 2| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 2|#define PCAP_ERRBUF_SIZE 256 ------------------ 1376| 2| "invalid packet capture length %u, bigger than " 1377| 2| "snaplen of %d", hdr->caplen, p->snapshot); 1378| 2| return (-1); 1379| 2| } 1380| | 1381| | /* 1382| | * Convert the time stamp to seconds and fractions of a second, 1383| | * with the fractions being in units of the file-supplied resolution. 1384| | */ 1385| 335| sec = t / ps->ifaces[interface_id].tsresol + ps->ifaces[interface_id].tsoffset; 1386| 335| frac = t % ps->ifaces[interface_id].tsresol; 1387| | 1388| | /* 1389| | * Convert the fractions from units of the file-supplied resolution 1390| | * to units of the user-requested resolution. 1391| | */ 1392| 335| switch (ps->ifaces[interface_id].scale_type) { ------------------ | Branch (1392:10): [True: 335, False: 0] ------------------ 1393| | 1394| 335| case PASS_THROUGH: ------------------ | Branch (1394:2): [True: 335, False: 0] ------------------ 1395| | /* 1396| | * The interface resolution is what the user wants, 1397| | * so we're done. 1398| | */ 1399| 335| break; 1400| | 1401| 0| case SCALE_UP_DEC: ------------------ | Branch (1401:2): [True: 0, False: 335] ------------------ 1402| | /* 1403| | * The interface resolution is less than what the user 1404| | * wants; scale the fractional part up to the units of 1405| | * the resolution the user requested by multiplying by 1406| | * the quotient of the user-requested resolution and the 1407| | * file-supplied resolution. 1408| | * 1409| | * Those resolutions are both powers of 10, and the user- 1410| | * requested resolution is greater than the file-supplied 1411| | * resolution, so the quotient in question is an integer. 1412| | * We've calculated that quotient already, so we just 1413| | * multiply by it. 1414| | */ 1415| 0| frac *= ps->ifaces[interface_id].scale_factor; 1416| 0| break; 1417| | 1418| 0| case SCALE_UP_BIN: ------------------ | Branch (1418:2): [True: 0, False: 335] ------------------ 1419| | /* 1420| | * The interface resolution is less than what the user 1421| | * wants; scale the fractional part up to the units of 1422| | * the resolution the user requested by multiplying by 1423| | * the quotient of the user-requested resolution and the 1424| | * file-supplied resolution. 1425| | * 1426| | * The file-supplied resolution is a power of 2, so the 1427| | * quotient is not an integer, so, in order to do this 1428| | * entirely with integer arithmetic, we multiply by the 1429| | * user-requested resolution and divide by the file- 1430| | * supplied resolution. 1431| | * 1432| | * XXX - Is there something clever we could do here, 1433| | * given that we know that the file-supplied resolution 1434| | * is a power of 2? Doing a multiplication followed by 1435| | * a division runs the risk of overflowing, and involves 1436| | * two non-simple arithmetic operations. 1437| | */ 1438| 0| frac *= ps->user_tsresol; 1439| 0| frac /= ps->ifaces[interface_id].tsresol; 1440| 0| break; 1441| | 1442| 0| case SCALE_DOWN_DEC: ------------------ | Branch (1442:2): [True: 0, False: 335] ------------------ 1443| | /* 1444| | * The interface resolution is greater than what the user 1445| | * wants; scale the fractional part up to the units of 1446| | * the resolution the user requested by multiplying by 1447| | * the quotient of the user-requested resolution and the 1448| | * file-supplied resolution. 1449| | * 1450| | * Those resolutions are both powers of 10, and the user- 1451| | * requested resolution is less than the file-supplied 1452| | * resolution, so the quotient in question isn't an 1453| | * integer, but its reciprocal is, and we can just divide 1454| | * by the reciprocal of the quotient. We've calculated 1455| | * the reciprocal of that quotient already, so we must 1456| | * divide by it. 1457| | */ 1458| 0| frac /= ps->ifaces[interface_id].scale_factor; 1459| 0| break; 1460| | 1461| | 1462| 0| case SCALE_DOWN_BIN: ------------------ | Branch (1462:2): [True: 0, False: 335] ------------------ 1463| | /* 1464| | * The interface resolution is greater than what the user 1465| | * wants; convert the fractional part to units of the 1466| | * resolution the user requested by multiplying by the 1467| | * quotient of the user-requested resolution and the 1468| | * file-supplied resolution. We do that by multiplying 1469| | * by the user-requested resolution and dividing by the 1470| | * file-supplied resolution, as the quotient might not 1471| | * fit in an integer. 1472| | * 1473| | * The file-supplied resolution is a power of 2, so the 1474| | * quotient is not an integer, and neither is its 1475| | * reciprocal, so, in order to do this entirely with 1476| | * integer arithmetic, we multiply by the user-requested 1477| | * resolution and divide by the file-supplied resolution. 1478| | * 1479| | * XXX - Is there something clever we could do here, 1480| | * given that we know that the file-supplied resolution 1481| | * is a power of 2? Doing a multiplication followed by 1482| | * a division runs the risk of overflowing, and involves 1483| | * two non-simple arithmetic operations. 1484| | */ 1485| 0| frac *= ps->user_tsresol; 1486| 0| frac /= ps->ifaces[interface_id].tsresol; 1487| 0| break; 1488| 335| } 1489| |#ifdef _WIN32 1490| | /* 1491| | * tv_sec and tv_usec in the Windows struct timeval are both 1492| | * longs. 1493| | */ 1494| | hdr->ts.tv_sec = (long)sec; 1495| | hdr->ts.tv_usec = (long)frac; 1496| |#else 1497| | /* 1498| | * tv_sec in the UN*X struct timeval is a time_t; tv_usec is 1499| | * suseconds_t in UN*Xes that work the way the current Single 1500| | * UNIX Standard specify - but not all older UN*Xes necessarily 1501| | * support that type, so just cast to int. 1502| | */ 1503| 335| hdr->ts.tv_sec = (time_t)sec; 1504| 335| hdr->ts.tv_usec = (int)frac; 1505| 335|#endif 1506| | 1507| | /* 1508| | * Get a pointer to the packet data. 1509| | */ 1510| 335| *data = get_from_block_data(&cursor, hdr->caplen, p->errbuf); 1511| 335| if (*data == NULL) ------------------ | Branch (1511:6): [True: 3, False: 332] ------------------ 1512| 3| return (-1); 1513| | 1514| 332| pcapint_post_process(p->linktype, p->swapped, hdr, *data); 1515| | 1516| 332| return (1); 1517| 335|} parse_mpls: 89| 1.13k|{ 90| 1.13k| const u_char *mpls_label; /* byte cursor, not a struct pointer - see below */ 91| 1.13k| const u_char *end_ptr = pktdata + datalen; 92| 1.13k| u_char first_nibble; 93| 1.13k| eth_hdr_t *eth_hdr; 94| 1.13k| bool bos = false; 95| 1.13k| uint32_t label; 96| 1.13k| int len; 97| | 98| 1.13k| assert(next_protocol); ------------------ | Branch (98:5): [True: 0, False: 1.13k] | Branch (98:5): [True: 1.13k, False: 0] ------------------ 99| 1.13k| assert(l2len); ------------------ | Branch (99:5): [True: 0, False: 1.13k] | Branch (99:5): [True: 1.13k, False: 0] ------------------ 100| 1.13k| assert(l2offset); ------------------ | Branch (100:5): [True: 0, False: 1.13k] | Branch (100:5): [True: 1.13k, False: 0] ------------------ 101| | 102| 1.13k| len = (int)*l2len; 103| | 104| | /* 105| | * An MPLS label is four bytes at whatever offset the encapsulation puts 106| | * it, which is not guaranteed to be 4-byte aligned. Casting that to a 107| | * struct tcpr_mpls_label and reading ->entry is undefined behaviour, and 108| | * UBSan says so: 109| | * 110| | * get.c:115: member access within misaligned address ... for type 111| | * 'struct tcpr_mpls_label', which requires 4 byte alignment 112| | * 113| | * x86 does not care, which is why this went unnoticed - but docs/INSTALL 114| | * lists Solaris and the BSDs, where a misaligned load faults or is fixed 115| | * up in the trap handler (#1100). Copy the four bytes out instead, and 116| | * keep the cursor as a plain byte pointer so no misaligned struct pointer 117| | * is ever formed. 118| | */ 119| 6.59k| while (!bos) { ------------------ | Branch (119:12): [True: 5.54k, False: 1.05k] ------------------ 120| 5.54k| uint32_t entry; 121| | 122| 5.54k| if (pktdata + len + sizeof(entry) > end_ptr) { ------------------ | Branch (122:13): [True: 49, False: 5.49k] ------------------ 123| 49| warnx("parse_mpls: Need at least %zu bytes for MPLS header but only %u available", ------------------ | | 123| 49|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 124| 49| sizeof(entry) + len, 125| 49| datalen); 126| 49| return -1; 127| 49| } 128| | 129| 5.49k| mpls_label = pktdata + len; 130| 5.49k| memcpy(&entry, mpls_label, sizeof(entry)); 131| 5.49k| len += sizeof(entry); 132| | 133| 5.49k| entry = ntohl(entry); 134| 5.49k| bos = (entry & MPLS_LS_S_MASK) != 0; ------------------ | | 1701| 5.49k|#define MPLS_LS_S_MASK 0x00000100 ------------------ 135| 5.49k| label = entry >> MPLS_LS_LABEL_SHIFT; ------------------ | | 1692| 5.49k|#define MPLS_LS_LABEL_SHIFT 12 ------------------ 136| 5.49k| if (label == MPLS_LABEL_GACH) { ------------------ | | 1685| 5.49k|#define MPLS_LABEL_GACH 13 ------------------ | Branch (136:13): [True: 31, False: 5.46k] ------------------ 137| | /* Generic Associated Channel Header */ 138| 31| warn("GACH MPLS label not supported at this time"); ------------------ | | 121| 31|#define warn(x) fprintf(stderr, "Warning: %s\n", x) ------------------ 139| 31| return -1; 140| 31| } 141| 5.49k| } 142| | 143| | /* mpls_label is now a byte cursor, so step past the 4-byte label directly */ 144| 1.05k| if (mpls_label + sizeof(uint32_t) + 1 > end_ptr) { ------------------ | Branch (144:9): [True: 22, False: 1.02k] ------------------ 145| 22| warnx("parse_mpls: Need at least %zu bytes for MPLS label but only %u available", ------------------ | | 123| 22|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 146| 22| sizeof(uint32_t) + 1, 147| 22| datalen); 148| 22| return -1; 149| 22| } 150| | 151| 1.02k| first_nibble = *(mpls_label + sizeof(uint32_t)) >> 4; 152| 1.02k| switch (first_nibble) { 153| 56| case 4: ------------------ | Branch (153:5): [True: 56, False: 973] ------------------ 154| 56| *next_protocol = ETHERTYPE_IP; 155| 56| break; 156| 416| case 6: ------------------ | Branch (156:5): [True: 416, False: 613] ------------------ 157| 416| *next_protocol = ETHERTYPE_IP6; ------------------ | | 534| 416|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ 158| 416| break; 159| 431| case 0: ------------------ | Branch (159:5): [True: 431, False: 598] ------------------ 160| | /* EoMPLS - jump over PW Ethernet Control Word and handle 161| | * inner Ethernet header 162| | */ 163| 431| if (pktdata + len + 4 + sizeof(*eth_hdr) > end_ptr) { ------------------ | Branch (163:13): [True: 21, False: 410] ------------------ 164| 21| warnx("parse_mpls: Need at least %zu bytes for EoMPLS header but only %u available", ------------------ | | 123| 21|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 165| 21| sizeof(*eth_hdr) + len + 4, 166| 21| datalen); 167| 21| return -1; 168| 21| } 169| | 170| 410| len += 4; 171| 410| *l2offset = len; 172| 410| eth_hdr = (eth_hdr_t *)(pktdata + len); 173| 410| len += sizeof(*eth_hdr); 174| 410| *next_protocol = ntohs(eth_hdr->ether_type); 175| 410| break; 176| 126| default: ------------------ | Branch (176:5): [True: 126, False: 903] ------------------ 177| 126| warn("parse_mpls:suspect Generic Associated Channel Header"); ------------------ | | 121| 126|#define warn(x) fprintf(stderr, "Warning: %s\n", x) ------------------ 178| 126| return -1; 179| 1.02k| } 180| | 181| 882| *l2len = (uint32_t)len; 182| 882| return 0; 183| 1.02k|} parse_vlan: 198| 197|{ 199| 197| vlan_hdr_t *vlan_hdr; 200| 197| if ((size_t)datalen < *l2len + sizeof(*vlan_hdr)) { ------------------ | Branch (200:9): [True: 33, False: 164] ------------------ 201| 33| warnx("parse_vlan: Need at least %zu bytes for VLAN header but only %u available", sizeof(*vlan_hdr), datalen); ------------------ | | 123| 33|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 202| 33| return -1; 203| 33| } 204| 164| vlan_hdr = (vlan_hdr_t *)(pktdata + *l2len); 205| 164| *next_protocol = ntohs(vlan_hdr->vlan_tpid); 206| 164| *l2len += sizeof(vlan_hdr_t); 207| | 208| 164| return 0; 209| 197|} get_l2len_protocol: 290| 12.7k|{ 291| 12.7k| assert(protocol); ------------------ | Branch (291:5): [True: 0, False: 12.7k] | Branch (291:5): [True: 12.7k, False: 0] ------------------ 292| 12.7k| assert(l2len); ------------------ | Branch (292:5): [True: 0, False: 12.7k] | Branch (292:5): [True: 12.7k, False: 0] ------------------ 293| 12.7k| assert(l2offset); ------------------ | Branch (293:5): [True: 0, False: 12.7k] | Branch (293:5): [True: 12.7k, False: 0] ------------------ 294| 12.7k| assert(vlan_offset); ------------------ | Branch (294:5): [True: 0, False: 12.7k] | Branch (294:5): [True: 12.7k, False: 0] ------------------ 295| | 296| 12.7k| if (!pktdata || !datalen) { ------------------ | Branch (296:9): [True: 0, False: 12.7k] | Branch (296:21): [True: 0, False: 12.7k] ------------------ 297| 0| err_no_exitx("get_l2len_protocol: invalid L2 parameters: pktdata=0x%p len=%d", pktdata, datalen); ------------------ | | 142| 0|#define err_no_exitx(y, ...) do {\ | | 143| 0| fprintf(stderr, "\nFatal Error: " y "\n", __VA_ARGS__); \ | | 144| 0| fflush(NULL); \ | | 145| 0| } while (0) | | ------------------ | | | Branch (145:14): [Folded, False: 0] | | ------------------ ------------------ 298| 0| return -1; 299| 0| } 300| | 301| 12.7k| *protocol = 0; 302| 12.7k| *l2len = 0; 303| 12.7k| *l2offset = 0; 304| 12.7k| *vlan_offset = 0; 305| | 306| 12.7k| switch (datalink) { 307| 2.69k| case DLT_NULL: ------------------ | Branch (307:5): [True: 2.69k, False: 10.0k] ------------------ 308| 3.43k| case DLT_RAW: ------------------ | Branch (308:5): [True: 739, False: 12.0k] ------------------ 309| 3.43k| if ((pktdata[0] >> 4) == 4) ------------------ | Branch (309:13): [True: 302, False: 3.12k] ------------------ 310| 302| *protocol = ETHERTYPE_IP; 311| 3.12k| else if ((pktdata[0] >> 4) == 6) ------------------ | Branch (311:18): [True: 2.51k, False: 610] ------------------ 312| 2.51k| *protocol = ETHERTYPE_IP6; ------------------ | | 534| 2.51k|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ 313| 3.43k| break; 314| 363| case DLT_JUNIPER_ETHER: ------------------ | Branch (314:5): [True: 363, False: 12.4k] ------------------ 315| 363| if (datalen < 4) { ------------------ | Branch (315:13): [True: 102, False: 261] ------------------ 316| 102| warnx("%s (0x%x): Need at least 4 bytes for DLT_JUNIPER_ETHER but only %u available", ------------------ | | 123| 102|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 317| 102| pcap_datalink_val_to_description(datalink), 318| 102| datalink, 319| 102| datalen); 320| 102| return -1; 321| 102| } 322| | 323| 261| if (memcmp(pktdata, JUNIPER_PCAP_MAGIC, 3) != 0) { ------------------ | | 39| 261|#define JUNIPER_PCAP_MAGIC "MGC" ------------------ | Branch (323:13): [True: 217, False: 44] ------------------ 324| 217| warnx("%s (0x%x): No JUNIPER_PCAP_MAGIC Magic Number found during protocol lookup", ------------------ | | 123| 217|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 325| 217| pcap_datalink_val_to_description(datalink), 326| 217| datalink); 327| 217| return -1; 328| 217| } 329| | 330| 44| if ((pktdata[3] & JUNIPER_FLAG_EXT) == JUNIPER_FLAG_EXT) { ------------------ | | 38| 44|#define JUNIPER_FLAG_EXT 0x80 /* Juniper extensions present */ ------------------ if ((pktdata[3] & JUNIPER_FLAG_EXT) == JUNIPER_FLAG_EXT) { ------------------ | | 38| 44|#define JUNIPER_FLAG_EXT 0x80 /* Juniper extensions present */ ------------------ | Branch (330:13): [True: 6, False: 38] ------------------ 331| 6| if (datalen < 6) { ------------------ | Branch (331:17): [True: 2, False: 4] ------------------ 332| 2| warnx("%s (0x%x): Need at least 6 bytes for JUNIPER_FLAG_EXT but only %u available", ------------------ | | 123| 2|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 333| 2| pcap_datalink_val_to_description(datalink), 334| 2| datalink, 335| 2| datalen); 336| 2| return -1; 337| 2| } 338| | 339| 4| *l2offset = ntohs(*((uint16_t *)&pktdata[4])); 340| 4| *l2offset += 6; /* MGC + flags + ext_total_len */ 341| 38| } else { 342| 38| *l2offset = 4; /* MGC + flags (no header extensions) */ 343| 38| } 344| | 345| 42| if ((pktdata[3] & JUNIPER_FLAG_NO_L2) == JUNIPER_FLAG_NO_L2) { ------------------ | | 37| 42|#define JUNIPER_FLAG_NO_L2 0x02 /* L2 header */ ------------------ if ((pktdata[3] & JUNIPER_FLAG_NO_L2) == JUNIPER_FLAG_NO_L2) { ------------------ | | 37| 42|#define JUNIPER_FLAG_NO_L2 0x02 /* L2 header */ ------------------ | Branch (345:13): [True: 23, False: 19] ------------------ 346| | /* no L2 header present - *l2offset is actually IP offset */ 347| 23| uint32_t ip_hdr_offset = *l2offset; 348| 23| uint32_t hdrSpaceNeeded = ip_hdr_offset + 1; 349| 23| if (datalen < hdrSpaceNeeded) { ------------------ | Branch (349:17): [True: 2, False: 21] ------------------ 350| 2| warnx("%s (0x%x): Need at least %u bytes for JUNIPER_FLAG_NO_L2 but only %u available", ------------------ | | 123| 2|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 351| 2| pcap_datalink_val_to_description(datalink), 352| 2| hdrSpaceNeeded, 353| 2| datalink, 354| 2| datalen); 355| 2| return -1; 356| 2| } 357| | 358| 21| if ((pktdata[ip_hdr_offset] >> 4) == 4) ------------------ | Branch (358:17): [True: 10, False: 11] ------------------ 359| 10| *protocol = ETHERTYPE_IP; 360| 11| else if ((pktdata[ip_hdr_offset] >> 4) == 6) ------------------ | Branch (360:22): [True: 10, False: 1] ------------------ 361| 10| *protocol = ETHERTYPE_IP6; ------------------ | | 534| 10|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ 362| | 363| 21| return 0; 364| 23| } 365| | 366| | /* fall through */ 367| 6.09k| case DLT_EN10MB: { ------------------ | Branch (367:5): [True: 6.07k, False: 6.70k] ------------------ 368| 6.09k| eth_hdr_t *eth_hdr; 369| 6.09k| uint16_t ether_type; 370| 6.09k| uint32_t l2_net_off = sizeof(*eth_hdr) + *l2offset; 371| | 372| 6.09k| if (datalen <= l2_net_off + 4) { ------------------ | Branch (372:13): [True: 313, False: 5.78k] ------------------ 373| 313| warnx("%s (0x%x): Need at least %u bytes for DLT_EN10MB but only %u available", ------------------ | | 123| 313|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 374| 313| pcap_datalink_val_to_description(datalink), 375| 313| datalink, 376| 313| l2_net_off + 4, 377| 313| datalen); 378| 313| return -1; 379| 313| } 380| | 381| 5.78k| eth_hdr = (eth_hdr_t *)(pktdata + *l2offset); 382| 5.78k| ether_type = ntohs(eth_hdr->ether_type); 383| 5.78k| if (parse_metadata(pktdata, datalen, ðer_type, &l2_net_off, l2offset, vlan_offset)) ------------------ | Branch (383:13): [True: 282, False: 5.50k] ------------------ 384| 282| return -1; 385| | 386| 5.50k| *l2len = l2_net_off; 387| 5.50k| if (ether_type >= 1536) { ------------------ | Branch (387:13): [True: 5.17k, False: 325] ------------------ 388| | /* Ethernet II frame - return in host order */ 389| 5.17k| *protocol = ether_type; 390| 5.17k| } else if (ether_type > 1500) { ------------------ | Branch (390:20): [True: 135, False: 190] ------------------ 391| 135| warnx("%s (0x%x): unsupported 802.3 length %u", ------------------ | | 123| 135|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 392| 135| pcap_datalink_val_to_description(datalink), 393| 135| datalink, 394| 135| ether_type); 395| 135| return -1; 396| 190| } else { 397| | /* 803.3 frame */ 398| | /* we don't modify 802.3 protocols */ 399| 190| return -1; 400| 190| } 401| 5.17k| break; 402| 5.50k| } 403| 5.17k| case DLT_PPP_SERIAL: ------------------ | Branch (403:5): [True: 593, False: 12.1k] ------------------ 404| 593| if ((size_t)datalen < sizeof(struct tcpr_pppserial_hdr)) { ------------------ | Branch (404:13): [True: 152, False: 441] ------------------ 405| 152| warnx("%s (0x%x): Need at least %zu bytes for DLT_PPP_SERIAL but only %u available", ------------------ | | 123| 152|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 406| 152| pcap_datalink_val_to_description(datalink), 407| 152| datalink, 408| 152| sizeof(struct tcpr_pppserial_hdr), 409| 152| datalen); 410| 152| return -1; 411| 152| } 412| | 413| 441| struct tcpr_pppserial_hdr *ppp = (struct tcpr_pppserial_hdr *)pktdata; 414| 441| *l2len = sizeof(*ppp); 415| 441| if (ntohs(ppp->protocol) == 0x0021) ------------------ | Branch (415:13): [True: 52, False: 389] ------------------ 416| 52| *protocol = ETHERTYPE_IP; 417| 389| else 418| 389| *protocol = ntohs(ppp->protocol); 419| | 420| 441| break; 421| 433| case DLT_C_HDLC: ------------------ | Branch (421:5): [True: 433, False: 12.3k] ------------------ 422| 433| if (datalen < CISCO_HDLC_LEN) { ------------------ | | 28| 433|#define CISCO_HDLC_LEN 4 ------------------ | Branch (422:13): [True: 82, False: 351] ------------------ 423| 82| warnx("%s (0x%x): Need at least %u bytes for DLT_C_HDLC but only %u available", ------------------ | | 123| 82|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 424| 82| pcap_datalink_val_to_description(datalink), 425| 82| datalink, 426| 82| CISCO_HDLC_LEN, 427| 82| datalen); 428| 82| return -1; 429| 82| } 430| | 431| 351| hdlc_hdr_t *hdlc_hdr = (hdlc_hdr_t *)pktdata; 432| 351| *l2len = sizeof(*hdlc_hdr); 433| 351| *protocol = ntohs(hdlc_hdr->protocol); 434| 351| break; 435| 1.16k| case DLT_LINUX_SLL: ------------------ | Branch (435:5): [True: 1.16k, False: 11.6k] ------------------ 436| 1.16k| if (datalen < SLL_HDR_LEN) { ------------------ | | 86| 1.16k|#define SLL_HDR_LEN 16 /* total header length */ ------------------ | Branch (436:13): [True: 334, False: 829] ------------------ 437| 334| warnx("%s (0x%x): Need at least %u bytes for DLT_LINUX_SLL but only %u available", ------------------ | | 123| 334|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 438| 334| pcap_datalink_val_to_description(datalink), 439| 334| datalink, 440| 334| SLL_HDR_LEN, 441| 334| datalen); 442| 334| return -1; 443| 334| } 444| | 445| 829| *l2len = SLL_HDR_LEN; ------------------ | | 86| 829|#define SLL_HDR_LEN 16 /* total header length */ ------------------ 446| 829| sll_hdr_t *sll_hdr = (sll_hdr_t *)pktdata; 447| 829| *protocol = ntohs(sll_hdr->sll_protocol); 448| 829| break; 449| 719| case DLT_LINUX_SLL2: ------------------ | Branch (449:5): [True: 719, False: 12.0k] ------------------ 450| 719| if (datalen < SLL2_HDR_LEN) { ------------------ | | 100| 719|#define SLL2_HDR_LEN 20 /* total header length */ ------------------ | Branch (450:13): [True: 289, False: 430] ------------------ 451| 289| warnx("%s (0x%x): Need at least %u bytes for DLT_LINUX_SLL2 but only %u available", ------------------ | | 123| 289|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 452| 289| pcap_datalink_val_to_description(datalink), 453| 289| datalink, 454| 289| SLL2_HDR_LEN, 455| 289| datalen); 456| 289| return -1; 457| 289| } 458| | 459| 430| *l2len = SLL2_HDR_LEN; ------------------ | | 100| 430|#define SLL2_HDR_LEN 20 /* total header length */ ------------------ 460| 430| sll2_hdr_t *sll2_hdr = (sll2_hdr_t *)pktdata; 461| 430| *protocol = ntohs(sll2_hdr->sll2_protocol); 462| 430| break; 463| 0| default: ------------------ | Branch (463:5): [True: 0, False: 12.7k] ------------------ 464| 0| errx(-1, ------------------ | | 131| 0|#define errx(x, y, ...) do {\ | | 132| 0| fprintf(stderr, "\nFatal Error: " y "\n", __VA_ARGS__); \ | | 133| 0| fflush(NULL); \ | | 134| 0| exit(x); \ | | 135| 0| } while (0) | | ------------------ | | | Branch (135:14): [Folded, False: 0] | | ------------------ ------------------ 465| 12.7k| "Unable to process unsupported DLT type: %s (0x%x)", 466| 12.7k| pcap_datalink_val_to_description(datalink), 467| 12.7k| datalink); 468| 12.7k| } 469| | 470| 10.6k| return 0; 471| 12.7k|} get_layer4_v4: 633| 3.38k|{ 634| 3.38k| void *ptr; 635| | 636| 3.38k| assert(ip_hdr); ------------------ | Branch (636:5): [True: 0, False: 3.38k] | Branch (636:5): [True: 3.38k, False: 0] ------------------ 637| 3.38k| assert(end_ptr); ------------------ | Branch (637:5): [True: 0, False: 3.38k] | Branch (637:5): [True: 3.38k, False: 0] ------------------ 638| | 639| 3.38k| ptr = (u_char *)ip_hdr + (ip_hdr->ip_hl << 2); 640| | /* make sure we don't jump over the end of the buffer */ 641| 3.38k| if ((u_char *)ptr > end_ptr) ------------------ | Branch (641:9): [True: 32, False: 3.35k] ------------------ 642| 32| return NULL; 643| | 644| 3.35k| return ((void *)ptr); 645| 3.38k|} get_layer4_v6: 668| 10.5k|{ 669| 10.5k| struct tcpr_ipv6_ext_hdr_base *next, *exthdr; 670| 10.5k| bool done = false; 671| 10.5k| uint8_t proto; 672| | 673| 10.5k| assert(ip6_hdr); ------------------ | Branch (673:5): [True: 0, False: 10.5k] | Branch (673:5): [True: 10.5k, False: 0] ------------------ 674| 10.5k| assert(end_ptr); ------------------ | Branch (674:5): [True: 0, False: 10.5k] | Branch (674:5): [True: 10.5k, False: 0] ------------------ 675| | 676| | /* jump to the end of the IPv6 header */ 677| 10.5k| next = (struct tcpr_ipv6_ext_hdr_base *)((u_char *)ip6_hdr + TCPR_IPV6_H); ------------------ | | 97| 10.5k|#define TCPR_IPV6_H 0x28 /**< IPv6 header: 40 bytes */ ------------------ 678| 10.5k| if ((u_char *)next > end_ptr) ------------------ | Branch (678:9): [True: 163, False: 10.3k] ------------------ 679| 163| return NULL; 680| | 681| 10.3k| proto = ip6_hdr->ip_nh; 682| 30.0k| while (!done) { ------------------ | Branch (682:12): [True: 20.2k, False: 9.80k] ------------------ 683| 20.2k| dbgx(3, "Processing proto: 0x%hx", (uint16_t)proto); ------------------ | | 119| 20.2k|#define dbgx(x, y, ...) { } ------------------ 684| | 685| 20.2k| switch (proto) { 686| | /* recurse due to v6-in-v6, need to recast next as an IPv6 Header */ 687| 7.48k| case TCPR_IPV6_NH_IPV6: ------------------ | | 788| 7.48k|#define TCPR_IPV6_NH_IPV6 41 ------------------ | Branch (687:9): [True: 7.48k, False: 12.7k] ------------------ 688| 7.48k| dbg(3, "recursing due to v6-in-v6"); ------------------ | | 118| 7.48k|#define dbg(x, y) { } ------------------ 689| 7.48k| next = get_layer4_v6((ipv6_hdr_t *)next, end_ptr); 690| 7.48k| break; 691| | 692| | /* loop again */ 693| 427| case TCPR_IPV6_NH_AH: ------------------ | | 790| 427|#define TCPR_IPV6_NH_AH 51 ------------------ | Branch (693:9): [True: 427, False: 19.8k] ------------------ 694| 767| case TCPR_IPV6_NH_ROUTING: ------------------ | | 810| 767|#define TCPR_IPV6_NH_ROUTING 43 ------------------ | Branch (694:9): [True: 340, False: 19.9k] ------------------ 695| 1.41k| case TCPR_IPV6_NH_DESTOPTS: ------------------ | | 824| 1.41k|#define TCPR_IPV6_NH_DESTOPTS 60 ------------------ | Branch (695:9): [True: 646, False: 19.6k] ------------------ 696| 7.95k| case TCPR_IPV6_NH_HBH: ------------------ | | 836| 7.95k|#define TCPR_IPV6_NH_HBH 0 ------------------ | Branch (696:9): [True: 6.53k, False: 13.7k] ------------------ 697| 7.95k| dbgx(3, "Going deeper due to extension header 0x%02X", proto); ------------------ | | 119| 7.95k|#define dbgx(x, y, ...) { } ------------------ 698| 7.95k| exthdr = get_ipv6_next(next, end_ptr); 699| 7.95k| if (!ipv6_exthdr_fits(exthdr, end_ptr)) { ------------------ | Branch (699:17): [True: 1.12k, False: 6.82k] ------------------ 700| 1.12k| next = NULL; 701| 1.12k| done = true; 702| 1.12k| break; 703| 1.12k| } 704| 6.82k| proto = exthdr->ip_nh; 705| 6.82k| next = exthdr; 706| 6.82k| break; 707| | 708| | /* 709| | * handle (unparsable) IPv6 fragment data 710| | */ 711| 1.50k| case TCPR_IPV6_NH_FRAGMENT: ------------------ | | 797| 1.50k|#define TCPR_IPV6_NH_FRAGMENT 44 ------------------ | Branch (711:9): [True: 1.50k, False: 18.7k] ------------------ 712| | // next points to l4 data 713| 1.50k| dbgx(3, "Go deeper due to fragment extension header 0x%02X", proto); ------------------ | | 119| 1.50k|#define dbgx(x, y, ...) { } ------------------ 714| 1.50k| exthdr = get_ipv6_next(next, end_ptr); 715| 1.50k| if (!ipv6_exthdr_fits(exthdr, end_ptr)) { ------------------ | Branch (715:17): [True: 728, False: 778] ------------------ 716| 728| next = NULL; 717| 728| done = true; 718| 728| break; 719| 728| } 720| 778| proto = exthdr->ip_nh; 721| 778| next = exthdr; 722| | // done = true; 723| 778| break; 724| | 725| | /* 726| | * Can't handle. Unparsable IPv6 encrypted data 727| | */ 728| 26| case TCPR_IPV6_NH_ESP: ------------------ | | 789| 26|#define TCPR_IPV6_NH_ESP 50 ------------------ | Branch (728:9): [True: 26, False: 20.2k] ------------------ 729| 26| next = NULL; 730| 26| done = true; 731| 26| break; 732| | 733| | /* 734| | * no further processing, either TCP, UDP, ICMP, etc... 735| | */ 736| 3.30k| default: ------------------ | Branch (736:9): [True: 3.30k, False: 16.9k] ------------------ 737| 3.30k| if (proto != ip6_hdr->ip_nh && next) { ------------------ | Branch (737:17): [True: 1.19k, False: 2.10k] | Branch (737:44): [True: 1.19k, False: 0] ------------------ 738| | /* reading next->ip_len needs the base header to be present */ 739| 1.19k| if (!ipv6_exthdr_fits(next, end_ptr)) { ------------------ | Branch (739:21): [True: 0, False: 1.19k] ------------------ 740| 0| return NULL; 741| 0| } 742| | 743| 1.19k| dbgx(3, "Returning byte offset of this ext header: %u", IPV6_EXTLEN_TO_BYTES(next->ip_len)); ------------------ | | 119| 1.19k|#define dbgx(x, y, ...) { } ------------------ 744| 1.19k| next = (void *)((u_char *)next + IPV6_EXTLEN_TO_BYTES(next->ip_len)); ------------------ | | 292| 1.19k|#define IPV6_EXTLEN_TO_BYTES(x) ((x * 4) + 8) ------------------ 745| 1.19k| if ((u_char*)next > end_ptr) ------------------ | Branch (745:21): [True: 548, False: 649] ------------------ 746| 548| return NULL; 747| 2.10k| } else { 748| 2.10k| dbgx(3, "%s", "Returning end of IPv6 Header"); ------------------ | | 119| 2.10k|#define dbgx(x, y, ...) { } ------------------ 749| 2.10k| } 750| | 751| 2.75k| done = true; 752| 20.2k| } /* switch */ 753| | 754| 19.7k| if (next == NULL) ------------------ | Branch (754:13): [True: 7.05k, False: 12.6k] ------------------ 755| 7.05k| done = true; 756| 19.7k| } /* while */ 757| | 758| 9.80k| return next; 759| 10.3k|} get_ipv6_l4proto: 828| 5.89k|{ 829| 5.89k| u_char *ptr = (u_char *)ip6_hdr + TCPR_IPV6_H; /* jump to the end of the IPv6 header */ ------------------ | | 97| 5.89k|#define TCPR_IPV6_H 0x28 /**< IPv6 header: 40 bytes */ ------------------ 830| 5.89k| uint8_t proto; 831| 5.89k| struct tcpr_ipv6_ext_hdr_base *exthdr = NULL; 832| | 833| 5.89k| assert(ip6_hdr); ------------------ | Branch (833:5): [True: 0, False: 5.89k] | Branch (833:5): [True: 5.89k, False: 0] ------------------ 834| | 835| 5.89k| if (ptr > end_ptr) ------------------ | Branch (835:9): [True: 73, False: 5.82k] ------------------ 836| 73| return TCPR_IPV6_NH_NO_NEXT; ------------------ | | 787| 73|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ 837| | 838| 5.82k| proto = ip6_hdr->ip_nh; 839| 8.44k| while (TRUE) { ------------------ | Branch (839:12): [True: 8.44k, Folded] ------------------ 840| 8.44k| dbgx(3, "Processing next proto 0x%02X", proto); ------------------ | | 119| 8.44k|#define dbgx(x, y, ...) { } ------------------ 841| 8.44k| switch (proto) { 842| | /* no further processing for IPV6 types with nothing beyond them */ 843| 0| case TCPR_IPV6_NH_NO_NEXT: ------------------ | | 787| 0|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ | Branch (843:9): [True: 0, False: 8.44k] ------------------ 844| 872| case TCPR_IPV6_NH_FRAGMENT: ------------------ | | 797| 872|#define TCPR_IPV6_NH_FRAGMENT 44 ------------------ | Branch (844:9): [True: 872, False: 7.56k] ------------------ 845| 893| case TCPR_IPV6_NH_ESP: ------------------ | | 789| 893|#define TCPR_IPV6_NH_ESP 50 ------------------ | Branch (845:9): [True: 21, False: 8.42k] ------------------ 846| 893| dbg(3, "No-Next or ESP... can't go any further..."); ------------------ | | 118| 893|#define dbg(x, y) { } ------------------ 847| 893| return proto; 848| | 849| | /* recurse */ 850| 2.86k| case TCPR_IPV6_NH_IPV6: ------------------ | | 788| 2.86k|#define TCPR_IPV6_NH_IPV6 41 ------------------ | Branch (850:9): [True: 2.86k, False: 5.57k] ------------------ 851| 2.86k| dbg(3, "Recursing due to v6 in v6"); ------------------ | | 118| 2.86k|#define dbg(x, y) { } ------------------ 852| 2.86k| return get_ipv6_l4proto((ipv6_hdr_t *)ptr, end_ptr); 853| | 854| | /* loop again */ 855| 110| case TCPR_IPV6_NH_AH: ------------------ | | 790| 110|#define TCPR_IPV6_NH_AH 51 ------------------ | Branch (855:9): [True: 110, False: 8.33k] ------------------ 856| 290| case TCPR_IPV6_NH_ROUTING: ------------------ | | 810| 290|#define TCPR_IPV6_NH_ROUTING 43 ------------------ | Branch (856:9): [True: 180, False: 8.26k] ------------------ 857| 738| case TCPR_IPV6_NH_DESTOPTS: ------------------ | | 824| 738|#define TCPR_IPV6_NH_DESTOPTS 60 ------------------ | Branch (857:9): [True: 448, False: 7.99k] ------------------ 858| 3.67k| case TCPR_IPV6_NH_HBH: ------------------ | | 836| 3.67k|#define TCPR_IPV6_NH_HBH 0 ------------------ | Branch (858:9): [True: 2.93k, False: 5.50k] ------------------ 859| 3.67k| dbgx(3, "Jumping to next extension header (0x%hhx)", proto); ------------------ | | 119| 3.67k|#define dbgx(x, y, ...) { } ------------------ 860| 3.67k| exthdr = get_ipv6_next((struct tcpr_ipv6_ext_hdr_base *)ptr, end_ptr); 861| 3.67k| if (exthdr == NULL || (u_char *)exthdr + sizeof(*exthdr) > end_ptr) ------------------ | Branch (861:17): [True: 639, False: 3.03k] | Branch (861:35): [True: 420, False: 2.61k] ------------------ 862| 1.05k| return TCPR_IPV6_NH_NO_NEXT; ------------------ | | 787| 1.05k|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ 863| 2.61k| proto = exthdr->ip_nh; 864| 2.61k| ptr = (u_char *)exthdr; 865| 2.61k| break; 866| | 867| | /* should be TCP, UDP or the like */ 868| 1.00k| default: ------------------ | Branch (868:9): [True: 1.00k, False: 7.43k] ------------------ 869| 1.00k| dbgx(3, "Selecting next L4 Proto as: 0x%02x", proto); ------------------ | | 119| 1.00k|#define dbgx(x, y, ...) { } ------------------ 870| 1.00k| return proto; 871| 8.44k| } /* switch */ 872| 8.44k| } /* while */ 873| 5.82k|} get.c:parse_metadata: 230| 5.78k|{ 231| 5.78k| bool done = false; 232| 5.78k| assert(next_protocol); ------------------ | Branch (232:5): [True: 0, False: 5.78k] | Branch (232:5): [True: 5.78k, False: 0] ------------------ 233| 5.78k| assert(l2len); ------------------ | Branch (233:5): [True: 0, False: 5.78k] | Branch (233:5): [True: 5.78k, False: 0] ------------------ 234| 5.78k| assert(l2offset); ------------------ | Branch (234:5): [True: 0, False: 5.78k] | Branch (234:5): [True: 5.78k, False: 0] ------------------ 235| 5.78k| assert(vlan_offset); ------------------ | Branch (235:5): [True: 0, False: 5.78k] | Branch (235:5): [True: 5.78k, False: 0] ------------------ 236| | 237| 5.78k| if (!pktdata || !datalen) ------------------ | Branch (237:9): [True: 0, False: 5.78k] | Branch (237:21): [True: 0, False: 5.78k] ------------------ 238| 0| errx(-1, "parse_metadata: invalid L2 parameters: pktdata=0x%p len=%d", pktdata, datalen); ------------------ | | 131| 0|#define errx(x, y, ...) do {\ | | 132| 0| fprintf(stderr, "\nFatal Error: " y "\n", __VA_ARGS__); \ | | 133| 0| fflush(NULL); \ | | 134| 0| exit(x); \ | | 135| 0| } while (0) | | ------------------ | | | Branch (135:14): [Folded, False: 0] | | ------------------ ------------------ 239| | 240| 12.3k| while (!done) { ------------------ | Branch (240:12): [True: 6.82k, False: 5.50k] ------------------ 241| 6.82k| switch (*next_protocol) { 242| 25| case ETHERTYPE_VLAN: ------------------ | Branch (242:9): [True: 25, False: 6.80k] ------------------ 243| 127| case ETHERTYPE_Q_IN_Q: ------------------ | | 537| 127|#define ETHERTYPE_Q_IN_Q 0x88A8 /* 802.1ad Service VLAN */ ------------------ | Branch (243:9): [True: 102, False: 6.72k] ------------------ 244| 197| case ETHERTYPE_8021QINQ: ------------------ | | 540| 197|#define ETHERTYPE_8021QINQ 0x9100 /* 802.1Q in Q VLAN */ ------------------ | Branch (244:9): [True: 70, False: 6.75k] ------------------ 245| 197| if (*vlan_offset == 0) ------------------ | Branch (245:17): [True: 121, False: 76] ------------------ 246| 121| *vlan_offset = *l2len; 247| | 248| 197| if (parse_vlan(pktdata, datalen, next_protocol, l2len)) ------------------ | Branch (248:17): [True: 33, False: 164] ------------------ 249| 33| return -1; 250| | 251| 164| break; 252| 1.09k| case ETHERTYPE_MPLS: ------------------ | | 528| 1.09k|#define ETHERTYPE_MPLS 0x8847 /* MPLS */ ------------------ | Branch (252:9): [True: 1.09k, False: 5.73k] ------------------ 253| 1.13k| case ETHERTYPE_MPLS_MULTI: ------------------ | | 543| 1.13k|#define ETHERTYPE_MPLS_MULTI 0x8848 /* MPLS multicast packet */ ------------------ | Branch (253:9): [True: 40, False: 6.78k] ------------------ 254| 1.13k| if (parse_mpls(pktdata, datalen, next_protocol, l2len, l2offset)) ------------------ | Branch (254:17): [True: 249, False: 882] ------------------ 255| 249| return -1; 256| | 257| 882| break; 258| 5.50k| default: ------------------ | Branch (258:9): [True: 5.50k, False: 1.32k] ------------------ 259| 5.50k| done = true; 260| 6.82k| } 261| 6.82k| } 262| | 263| 5.50k| return 0; 264| 5.78k|} get.c:ipv6_exthdr_fits: 657| 10.6k|{ 658| 10.6k| return hdr != NULL && (const u_char *)hdr + sizeof(*hdr) <= end_ptr; ------------------ | Branch (658:12): [True: 9.23k, False: 1.42k] | Branch (658:27): [True: 8.80k, False: 426] ------------------ 659| 10.6k|} get.c:get_ipv6_next: 767| 13.1k|{ 768| 13.1k| uint8_t extlen; 769| 13.1k| u_char *ptr; 770| 13.1k| assert(exthdr); ------------------ | Branch (770:5): [True: 0, False: 13.1k] | Branch (770:5): [True: 13.1k, False: 0] ------------------ 771| | 772| 13.1k| if ((u_char *)exthdr + sizeof(*exthdr) > end_ptr) ------------------ | Branch (772:9): [True: 133, False: 12.9k] ------------------ 773| 133| return NULL; 774| | 775| 12.9k| dbgx(3, "Jumping to next IPv6 header. Processing 0x%02x", exthdr->ip_nh); ------------------ | | 119| 12.9k|#define dbgx(x, y, ...) { } ------------------ 776| 12.9k| switch (exthdr->ip_nh) { 777| | /* no further processing */ 778| 341| case TCPR_IPV6_NH_NO_NEXT: ------------------ | | 787| 341|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ | Branch (778:5): [True: 341, False: 12.6k] ------------------ 779| 441| case TCPR_IPV6_NH_ESP: ------------------ | | 789| 441|#define TCPR_IPV6_NH_ESP 50 ------------------ | Branch (779:5): [True: 100, False: 12.8k] ------------------ 780| 441| dbg(3, "No-Next or ESP... can't go any further..."); ------------------ | | 118| 441|#define dbg(x, y) { } ------------------ 781| 441| return NULL; 782| | 783| | /* 784| | * fragment header is fixed size 785| | * FIXME: Frag header has further ext headers (has a ip_nh field) 786| | * but I don't support it because there's never a full L4 + payload beyond. 787| | */ 788| 2.44k| case TCPR_IPV6_NH_FRAGMENT: ------------------ | | 797| 2.44k|#define TCPR_IPV6_NH_FRAGMENT 44 ------------------ | Branch (788:5): [True: 2.44k, False: 10.5k] ------------------ 789| 2.44k| dbg(3, "Looks like were a fragment header. Returning some frag'd data."); ------------------ | | 118| 2.44k|#define dbg(x, y) { } ------------------ 790| 2.44k| ptr = (void *)((u_char *)exthdr + sizeof(struct tcpr_ipv6_frag_hdr)); 791| 2.44k| if (ptr > end_ptr) ------------------ | Branch (791:13): [True: 69, False: 2.37k] ------------------ 792| 69| return NULL; 793| 2.37k| return (void *)ptr; 794| | 795| | /* all the rest require us to go deeper using the ip_len field */ 796| 343| case TCPR_IPV6_NH_IPV6: ------------------ | | 788| 343|#define TCPR_IPV6_NH_IPV6 41 ------------------ | Branch (796:5): [True: 343, False: 12.6k] ------------------ 797| 830| case TCPR_IPV6_NH_ROUTING: ------------------ | | 810| 830|#define TCPR_IPV6_NH_ROUTING 43 ------------------ | Branch (797:5): [True: 487, False: 12.5k] ------------------ 798| 1.95k| case TCPR_IPV6_NH_DESTOPTS: ------------------ | | 824| 1.95k|#define TCPR_IPV6_NH_DESTOPTS 60 ------------------ | Branch (798:5): [True: 1.12k, False: 11.8k] ------------------ 799| 8.01k| case TCPR_IPV6_NH_HBH: ------------------ | | 836| 8.01k|#define TCPR_IPV6_NH_HBH 0 ------------------ | Branch (799:5): [True: 6.05k, False: 6.94k] ------------------ 800| 9.00k| case TCPR_IPV6_NH_AH: ------------------ | | 790| 9.00k|#define TCPR_IPV6_NH_AH 51 ------------------ | Branch (800:5): [True: 993, False: 12.0k] ------------------ 801| 9.00k| extlen = IPV6_EXTLEN_TO_BYTES(exthdr->ip_len); ------------------ | | 292| 9.00k|#define IPV6_EXTLEN_TO_BYTES(x) ((x * 4) + 8) ------------------ 802| 9.00k| if (extlen == 0) { ------------------ | Branch (802:13): [True: 331, False: 8.67k] ------------------ 803| 331| dbg(3, "Malformed IPv6 extension header..."); ------------------ | | 118| 331|#define dbg(x, y) { } ------------------ 804| 331| return NULL; 805| 331| } 806| 8.67k| dbgx(3, ------------------ | | 119| 8.67k|#define dbgx(x, y, ...) { } ------------------ 807| 8.67k| "Looks like we're an ext header (0x%hhx). Jumping %u bytes" 808| 8.67k| " to the next", 809| 8.67k| exthdr->ip_nh, 810| 8.67k| extlen); 811| 8.67k| ptr = (u_char *)exthdr + extlen; 812| 8.67k| if (ptr > end_ptr) ------------------ | Branch (812:13): [True: 1.08k, False: 7.58k] ------------------ 813| 1.08k| return NULL; 814| 7.58k| return (void *)ptr; 815| | 816| 1.10k| default: ------------------ | Branch (816:5): [True: 1.10k, False: 11.8k] ------------------ 817| 1.10k| dbg(3, "Must not be a v6 extension header... returning self"); ------------------ | | 118| 1.10k|#define dbg(x, y) { } ------------------ 818| 1.10k| return (void *)exthdr; 819| 12.9k| } 820| 12.9k|} LLVMFuzzerTestOneInput: 53| 1.45k|{ 54| 1.45k| FILE *fp; 55| 1.45k| pcap_t *pcap; 56| 1.45k| char errbuf[PCAP_ERRBUF_SIZE]; 57| 1.45k| struct pcap_pkthdr *pkthdr; 58| 1.45k| const u_char *pktdata; 59| 1.45k| int datalink; 60| 1.45k| int rc; 61| 1.45k| unsigned int packets = 0; 62| | 63| | /* a pcap file header is 24 bytes; below that there is nothing to open */ 64| 1.45k| if (size < 24) ------------------ | Branch (64:9): [True: 8, False: 1.44k] ------------------ 65| 8| return 0; 66| | 67| | /* 68| | * fmemopen wants a writable pointer but libpcap only reads. Casting away 69| | * const on the fuzzer's buffer is not on - copy it. 70| | */ 71| 1.44k| void *copy = malloc(size); 72| 1.44k| if (copy == NULL) ------------------ | Branch (72:9): [True: 0, False: 1.44k] ------------------ 73| 0| return 0; 74| 1.44k| memcpy(copy, data, size); 75| | 76| 1.44k| fp = fmemopen(copy, size, "rb"); 77| 1.44k| if (fp == NULL) { ------------------ | Branch (77:9): [True: 0, False: 1.44k] ------------------ 78| 0| free(copy); 79| 0| return 0; 80| 0| } 81| | 82| 1.44k| pcap = pcap_fopen_offline(fp, errbuf); 83| 1.44k| if (pcap == NULL) { ------------------ | Branch (83:9): [True: 263, False: 1.18k] ------------------ 84| | /* malformed header: libpcap rejected it, which is the correct outcome */ 85| 263| fclose(fp); 86| 263| free(copy); 87| 263| return 0; 88| 263| } 89| | /* from here on the pcap_t owns fp and closes it in pcap_close() - closing 90| | * it again here is a double free, and it is the harness that would be 91| | * wrong, not libpcap */ 92| | 93| 1.18k| datalink = pcap_datalink(pcap); 94| | 95| 22.6k| while ((rc = pcap_next_ex(pcap, &pkthdr, &pktdata)) == 1) { ------------------ | Branch (95:12): [True: 21.4k, False: 1.17k] ------------------ 96| 21.4k| uint16_t ethertype; 97| 21.4k| uint32_t l2len, l2offset, vlan_offset; 98| | 99| | /* 100| | * Cap the work per input. A crafted pcap can claim an enormous packet 101| | * count, and the fuzzer's time is better spent on new shapes than on 102| | * one pathological file. 103| | */ 104| 21.4k| if (++packets > 512) ------------------ | Branch (104:13): [True: 5, False: 21.4k] ------------------ 105| 5| break; 106| | 107| 21.4k| if (pkthdr->caplen == 0) ------------------ | Branch (107:13): [True: 8.63k, False: 12.7k] ------------------ 108| 8.63k| continue; 109| | 110| | /* 111| | * The parsers take an end pointer computed from caplen. Deliberately 112| | * use caplen, not len: the gap between them is what GHSA-m6w7-8497-g9c9 113| | * was about, and a harness that papered over it would hide the bug 114| | * class it exists to find. 115| | */ 116| 12.7k| if (get_l2len_protocol(pktdata, ------------------ | Branch (116:13): [True: 2.10k, False: 10.6k] ------------------ 117| 12.7k| pkthdr->caplen, 118| 12.7k| datalink, 119| 12.7k| ðertype, 120| 12.7k| &l2len, 121| 12.7k| &l2offset, 122| 12.7k| &vlan_offset) < 0) 123| 2.10k| continue; 124| | 125| 10.6k| if (l2len > pkthdr->caplen) ------------------ | Branch (125:13): [True: 0, False: 10.6k] ------------------ 126| 0| continue; 127| | 128| 10.6k| switch (ethertype) { 129| 3.65k| case ETHERTYPE_IP: { ------------------ | Branch (129:9): [True: 3.65k, False: 7.02k] ------------------ 130| 3.65k| ipv4_hdr_t *ip_hdr = (ipv4_hdr_t *)(pktdata + l2len); 131| | 132| 3.65k| if (pkthdr->caplen < l2len + sizeof(ipv4_hdr_t)) ------------------ | Branch (132:17): [True: 269, False: 3.38k] ------------------ 133| 269| break; 134| | 135| 3.38k| (void)get_layer4_v4(ip_hdr, pktdata + pkthdr->caplen - 1); 136| 3.38k| break; 137| 3.65k| } 138| | 139| 3.12k| case ETHERTYPE_IP6: { ------------------ | | 534| 3.12k|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ | Branch (139:9): [True: 3.12k, False: 7.55k] ------------------ 140| 3.12k| ipv6_hdr_t *ip6_hdr = (ipv6_hdr_t *)(pktdata + l2len); 141| | 142| 3.12k| if (pkthdr->caplen < l2len + sizeof(ipv6_hdr_t)) ------------------ | Branch (142:17): [True: 89, False: 3.03k] ------------------ 143| 89| break; 144| | 145| | /* GHSA-jj65-mrgg-f5fx */ 146| 3.03k| (void)get_layer4_v6(ip6_hdr, pktdata + pkthdr->caplen - 1); 147| 3.03k| (void)get_ipv6_l4proto(ip6_hdr, pktdata + pkthdr->caplen - 1); 148| 3.03k| break; 149| 3.12k| } 150| | 151| 3.90k| default: ------------------ | Branch (151:9): [True: 3.90k, False: 6.77k] ------------------ 152| 3.90k| break; 153| 10.6k| } 154| 10.6k| } 155| | 156| 1.18k| pcap_close(pcap); 157| 1.18k| free(copy); 158| 1.18k| return 0; 159| 1.18k|}