pcap-util.c:EXTRACT_BE_U_2: 78| 5.42k|{ 79| | return ((uint16_t)ntohs(*(const uint16_t *)(p))); 80| 5.42k|} pcap_freecode: 1620| 4.96k|{ 1621| 4.96k| program->bf_len = 0; 1622| 4.96k| if (program->bf_insns != NULL) { ------------------ | Branch (1622:6): [True: 0, False: 4.96k] ------------------ 1623| 0| free(program->bf_insns); 1624| | program->bf_insns = NULL; 1625| 0| } 1626| 4.96k|} linktype_to_dlt: 1494| 4.96k|{ 1495| | /* 1496| | * All values in the low matching range were handed out before 1497| | * assigning DLT_* codes became a free-for-all, so they're the 1498| | * same on all platforms, and are thus used as the LINKTYPE_* 1499| | * codes in capture files. 1500| | */ 1501| 4.96k| if (linktype >= LINKTYPE_LOW_MATCHING_MIN && ------------------ | | 110| 9.92k|#define LINKTYPE_LOW_MATCHING_MIN 0 /* lowest value in this "matching" range */ ------------------ | Branch (1501:6): [True: 4.96k, False: 0] ------------------ 1502| 4.96k| linktype <= LINKTYPE_LOW_MATCHING_MAX) ------------------ | | 123| 4.96k|#define LINKTYPE_LOW_MATCHING_MAX LINKTYPE_FDDI /* highest value in this "matching" range */ | | ------------------ | | | | 121| 4.96k|#define LINKTYPE_FDDI DLT_FDDI | | | | ------------------ | | | | | | 77| 4.96k|#define DLT_FDDI 10 /* FDDI */ | | | | ------------------ | | ------------------ ------------------ | Branch (1502:6): [True: 1.08k, False: 3.87k] ------------------ 1503| 1.08k| return (linktype); 1504| | 1505| |#if LINKTYPE_PFSYNC != DLT_PFSYNC 1506| | /* 1507| | * DLT_PFSYNC has a code on several platforms that's in the 1508| | * non-matching range, a code on FreeBSD that's in the high 1509| | * matching range and that's *not* equal to LINKTYPE_PFSYNC, 1510| | * and has a code on the rmaining platforms that's equal 1511| | * to LINKTYPE_PFSYNC, which is in the high matching range. 1512| | * 1513| | * Map LINKTYPE_PFSYNC to whatever DLT_PFSYNC is on this 1514| | * platform, if the two aren't equal. 1515| | */ 1516| | if (linktype == LINKTYPE_PFSYNC) 1517| | return (DLT_PFSYNC); 1518| |#endif 1519| | 1520| | /* 1521| | * DLT_PKTAP is defined as DLT_USER2 - which is in the high 1522| | * matching range - on Darwin because Apple used DLT_USER2 1523| | * on systems that users ran, not just as an internal thing. 1524| | * 1525| | * We map LINKTYPE_PKTAP to the platform's DLT_PKTAP for 1526| | * the benefit of software that's expecting DLT_PKTAP 1527| | * (even if that's DLT_USER2) for an Apple PKTAP capture. 1528| | * 1529| | * (Yes, this is an annoyance if you want to read a 1530| | * LINKTYPE_USER2 packet as something other than DLT_PKTAP 1531| | * on a Darwin-based OS, as, on that OS, DLT_PKTAP and DLT_USER2 1532| | * are the same. Feel free to complain to Apple about this.) 1533| | */ 1534| |#if LINKTYPE_PKTAP != DLT_PKTAP 1535| | if (linktype == LINKTYPE_PKTAP) 1536| | return (DLT_PKTAP); 1537| |#endif 1538| | 1539| | /* 1540| | * These DLT_* codes have different values on different 1541| | * platforms, so we assigned them LINKTYPE_* codes just 1542| | * below the lower bound of the high matching range; 1543| | * those values should never be equal to any DLT_* 1544| | * code, so that should avoid collisions. 1545| | * 1546| | * That way, for example, "raw IP" packets will have 1547| | * LINKTYPE_RAW as the code in all savefiles for 1548| | * which the code that writes them maps to that 1549| | * value, regardless of the platform on which they 1550| | * were written, so they should be readable on all 1551| | * platforms without having to determine on which 1552| | * platform they were written. 1553| | * 1554| | * We map the LINKTYPE_* codes to the corresponding 1555| | * DLT_* code on this platform. 1556| | */ 1557| 3.87k| if (linktype == LINKTYPE_ATM_RFC1483) ------------------ | | 152| 3.87k|#define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ ------------------ | Branch (1557:6): [True: 2, False: 3.87k] ------------------ 1558| 2| return (DLT_ATM_RFC1483); ------------------ | | 109| 2|#define DLT_ATM_RFC1483 11 /* LLC-encapsulated ATM */ ------------------ 1559| 3.87k| if (linktype == LINKTYPE_RAW) ------------------ | | 153| 3.87k|#define LINKTYPE_RAW 101 /* raw IP */ ------------------ | Branch (1559:6): [True: 43, False: 3.82k] ------------------ 1560| 43| return (DLT_RAW); ------------------ | | 114| 43|#define DLT_RAW 12 /* raw IP */ ------------------ 1561| 3.82k| if (linktype == LINKTYPE_SLIP_BSDOS) ------------------ | | 154| 3.82k|#define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ ------------------ | Branch (1561:6): [True: 2, False: 3.82k] ------------------ 1562| 2| return (DLT_SLIP_BSDOS); ------------------ | | 130| 2|#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ ------------------ 1563| 3.82k| if (linktype == LINKTYPE_PPP_BSDOS) ------------------ | | 155| 3.82k|#define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ ------------------ | Branch (1563:6): [True: 2, False: 3.82k] ------------------ 1564| 2| return (DLT_PPP_BSDOS); ------------------ | | 131| 2|#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ ------------------ 1565| | 1566| | /* 1567| | * These DLT_* codes were originally defined on some platform, 1568| | * and weren't defined on other platforms. 1569| | * 1570| | * At least some of them have values, on at least one platform, 1571| | * that collide with other DLT_* codes on other platforms, e.g. 1572| | * DLT_LOOP, so we don't just define them, on all platforms, 1573| | * as having the same value as on the original platform. 1574| | * 1575| | * Therefore, we assigned new LINKTYPE_* codes to them, and, 1576| | * on the platforms where they weren't originally defined, 1577| | * define the DLT_* codes to have the same value as the 1578| | * corresponding LINKTYPE_* codes. 1579| | * 1580| | * This means that, for capture files with the original 1581| | * platform's DLT_* code rather than the LINKTYPE_* code 1582| | * as a link-layer type, we will recognize those types 1583| | * on that platform, but not on other platforms. 1584| | * 1585| | * We map the LINKTYPE_* codes to the corresponding 1586| | * DLT_* code on platforms where the two codes differ.. 1587| | */ 1588| |#ifdef DLT_FR 1589| | /* BSD/OS Frame Relay */ 1590| | if (linktype == LINKTYPE_FRELAY) 1591| | return (DLT_FR); 1592| |#endif 1593| |#if LINKTYPE_NETBSD_HDLC != DLT_HDLC 1594| | /* NetBSD HDLC */ 1595| | if (linktype == LINKTYPE_NETBSD_HDLC) 1596| | return (DLT_HDLC); 1597| |#endif 1598| |#if LINKTYPE_C_HDLC != DLT_C_HDLC 1599| | /* BSD/OS Cisco HDLC */ 1600| | if (linktype == LINKTYPE_C_HDLC) 1601| | return (DLT_C_HDLC); 1602| |#endif 1603| |#if LINKTYPE_LOOP != DLT_LOOP 1604| | /* OpenBSD DLT_LOOP */ 1605| | if (linktype == LINKTYPE_LOOP) 1606| | return (DLT_LOOP); 1607| |#endif 1608| |#if LINKTYPE_ENC != DLT_ENC 1609| | /* OpenBSD DLT_ENC */ 1610| | if (linktype == LINKTYPE_ENC) 1611| | return (DLT_ENC); 1612| |#endif 1613| | 1614| | /* 1615| | * These DLT_* codes are not on all platforms, but, so far, 1616| | * there don't appear to be any platforms that define 1617| | * other codes with those values; we map them to 1618| | * different LINKTYPE_* values anyway, just in case. 1619| | * 1620| | * LINKTYPE_ATM_CLIP is a special case. DLT_ATM_CLIP is 1621| | * not on all platforms, but, so far, there don't appear 1622| | * to be any platforms that define it as anything other 1623| | * than 19; we define LINKTYPE_ATM_CLIP as something 1624| | * other than 19, just in case. That value is in the 1625| | * high matching range, so we have to check for it. 1626| | */ 1627| | /* Linux ATM Classical IP */ 1628| 3.82k| if (linktype == LINKTYPE_ATM_CLIP) ------------------ | | 171| 3.82k|#define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ ------------------ | Branch (1628:6): [True: 1, False: 3.82k] ------------------ 1629| 1| return (DLT_ATM_CLIP); ------------------ | | 229| 1|#define DLT_ATM_CLIP 19 /* Linux Classical IP over ATM */ ------------------ 1630| | 1631| | /* 1632| | * For all other values, return the linktype code as the 1633| | * DLT_* code. 1634| | * 1635| | * If the code is in the high matching range, the 1636| | * DLT_* code is the same as the LINKTYPE_* code. 1637| | * 1638| | * If the code is greater than the maximum value in 1639| | * the high matching range, it may be a value from 1640| | * a newer version of libpcap; we provide it in case 1641| | * the program' capable of handling it. 1642| | * 1643| | * If the code is less than the minimum value in the 1644| | * high matching range, it might be from a capture 1645| | * written by code that doesn't map non-matching range 1646| | * DLT_* codes to the appropriate LINKTYPE_* code, so 1647| | * we'll just pass it through, so that *if it was written 1648| | * on this platform* it will be interpreted correctly. 1649| | * (We don't know whether it was written on this platform, 1650| | * but at least this way there's *some* chance that it 1651| | * can be read.) 1652| | */ 1653| 3.82k| return linktype; 1654| 3.82k|} max_snaplen_for_dlt: 1675| 44.0k|{ 1676| 44.0k| switch (dlt) { 1677| | 1678| 2.43k| case DLT_DBUS: ------------------ | | 1179| 2.43k|#define DLT_DBUS 231 ------------------ | Branch (1678:2): [True: 2.43k, False: 41.6k] ------------------ 1679| 2.43k| return 128*1024*1024; 1680| | 1681| 357| case DLT_EBHSCR: ------------------ | | 1558| 357|#define DLT_EBHSCR 279 ------------------ | Branch (1681:2): [True: 357, False: 43.6k] ------------------ 1682| 357| return 8*1024*1024; 1683| | 1684| 1.54k| case DLT_USBPCAP: ------------------ | | 1323| 1.54k|#define DLT_USBPCAP 249 ------------------ | Branch (1684:2): [True: 1.54k, False: 42.4k] ------------------ 1685| 1.54k| return 1024*1024; 1686| | 1687| 39.7k| default: ------------------ | Branch (1687:2): [True: 39.7k, False: 4.33k] ------------------ 1688| 39.7k| return MAXIMUM_SNAPLEN; ------------------ | | 158| 39.7k|#define MAXIMUM_SNAPLEN 262144 ------------------ 1689| 44.0k| } 1690| 44.0k|} pcap-util.c:is_isochronous_transfer_completion: 43| 2.53k|{ 44| 2.53k| return (hdr->transfer_type == URB_ISOCHRONOUS && ------------------ | | 43| 5.07k|#define URB_ISOCHRONOUS 0x0 ------------------ | Branch (44:10): [True: 2.32k, False: 213] ------------------ 45| 2.32k| hdr->event_type == URB_COMPLETE && ------------------ | | 52| 4.85k|#define URB_COMPLETE 'C' ------------------ | Branch (45:6): [True: 2.09k, False: 232] ------------------ 46| 2.09k| (hdr->endpoint_number & URB_TRANSFER_IN)); ------------------ | | 42| 2.09k|#define URB_TRANSFER_IN 0x80 ------------------ | Branch (46:6): [True: 2.08k, False: 7] ------------------ 47| 2.53k|} pcap-util.c:iso_pseudo_header_len: 55| 4.81k|{ 56| 4.81k| return (sizeof(pcap_usb_header_mmapped) + 57| 4.81k| usb_hdr->ndesc * sizeof (usb_isodesc)); 58| 4.81k|} pcap-util.c:incoming_isochronous_transfer_completed_len: 71| 1.10k|{ 72| 1.10k| const pcap_usb_header_mmapped *hdr; 73| 1.10k| u_int bytes_left; 74| 1.10k| const usb_isodesc *descs; 75| 1.10k| u_int pre_truncation_data_len; 76| | 77| | /* 78| | * All callers of this routine must ensure that pkth->caplen is 79| | * >= sizeof (pcap_usb_header_mmapped). 80| | */ 81| 1.10k| bytes_left = phdr->caplen; 82| 1.10k| bytes_left -= sizeof (pcap_usb_header_mmapped); 83| | 84| 1.10k| hdr = (const pcap_usb_header_mmapped *) bp; 85| 1.10k| descs = (const usb_isodesc *) (bp + sizeof(pcap_usb_header_mmapped)); 86| | 87| | /* 88| | * Find the end of the last chunk of data in the buffer 89| | * referred to by the isochronous descriptors; that indicates 90| | * how far into the buffer the data would have gone. 91| | * 92| | * Make sure we don't run past the end of the captured data 93| | * while processing the isochronous descriptors. 94| | */ 95| 1.10k| pre_truncation_data_len = 0; 96| 1.10k| for (uint32_t desc = 0; 97| 3.75k| desc < hdr->ndesc && bytes_left >= sizeof (usb_isodesc); ------------------ | Branch (97:6): [True: 2.64k, False: 1.10k] | Branch (97:27): [True: 2.64k, False: 0] ------------------ 98| 2.64k| desc++, bytes_left -= sizeof (usb_isodesc)) { 99| 2.64k| u_int desc_end; 100| | 101| 2.64k| if (descs[desc].len != 0) { ------------------ | Branch (101:7): [True: 2.01k, False: 630] ------------------ 102| | /* 103| | * Compute the end offset of the data 104| | * for this descriptor, i.e. the offset 105| | * of the byte after the data. Clamp 106| | * the sum at UINT_MAX, so that it fits 107| | * in a u_int. 108| | */ 109| 2.01k| desc_end = u_int_sum(descs[desc].offset, 110| 2.01k| descs[desc].len); 111| 2.01k| if (desc_end > pre_truncation_data_len) ------------------ | Branch (111:8): [True: 862, False: 1.15k] ------------------ 112| 862| pre_truncation_data_len = desc_end; 113| 2.01k| } 114| 2.64k| } 115| | 116| | /* 117| | * Return the sum of the total header length (memory-mapped 118| | * header and ISO descriptors) and the data length, clamped 119| | * to UINT_MAX. 120| | * 121| | * We've made sure that the number of descriptors is 122| | * <= USB_MAXDESC, so we know that the total size, 123| | * in bytes, of the descriptors fits in a 32-bit 124| | * integer. 125| | */ 126| 1.10k| return (u_int_sum(iso_pseudo_header_len(hdr), pre_truncation_data_len)); 127| 1.10k|} pcap-util.c:u_int_sum: 34| 3.12k|{ 35| 3.12k| return (((b) <= UINT_MAX - (a)) ? (a) + (b) : UINT_MAX); ------------------ | Branch (35:10): [True: 2.17k, False: 948] ------------------ 36| 3.12k|} pcapint_post_process: 508| 42.0k|{ 509| 42.0k| if (swapped) ------------------ | Branch (509:6): [True: 31.0k, False: 11.0k] ------------------ 510| 31.0k| swap_pseudo_headers(linktype, hdr, data); 511| | 512| | /* 513| | * Is this a memory-mapped Linux USB capture? 514| | */ 515| 42.0k| if (linktype == DLT_USB_LINUX_MMAPPED) { ------------------ | | 1042| 42.0k|#define DLT_USB_LINUX_MMAPPED 220 ------------------ | Branch (515:6): [True: 7.56k, False: 34.4k] ------------------ 516| | /* 517| | * Yes. 518| | * 519| | * In older versions of libpcap, in memory-mapped Linux 520| | * USB captures, the original length of completion events 521| | * for incoming isochronous transfers was miscalculated; 522| | * it needed to be calculated based on the offsets and 523| | * lengths in the descriptors, not on the raw URB length, 524| | * but it wasn't. 525| | * 526| | * If this packet contains transferred data (yes, data_flag 527| | * is 0 if we *do* have data), it's a completion event 528| | * for an incoming isochronous transfer, and the 529| | * transfer length appears to have been calculated 530| | * from the raw URB length, fix it. 531| | * 532| | * We only do this if we have the full USB pseudo-header, 533| | * because we will have to look at that header and at 534| | * all of the isochronous descriptors. 535| | */ 536| 7.56k| if (hdr->caplen < sizeof (pcap_usb_header_mmapped)) { ------------------ | Branch (536:7): [True: 4.02k, False: 3.54k] ------------------ 537| | /* 538| | * We don't have the full pseudo-header. 539| | */ 540| 4.02k| return; 541| 4.02k| } 542| | 543| 3.54k| const pcap_usb_header_mmapped *usb_hdr = 544| 3.54k| (const pcap_usb_header_mmapped *) data; 545| | 546| | /* 547| | * Make sure the number of descriptors is sane. 548| | * 549| | * The Linux binary USB monitor code limits the number of 550| | * isochronous descriptors to 128; if the number in the file 551| | * is larger than that, either 1) the file's been damaged 552| | * or 2) the file was produced after the number was raised 553| | * in the kernel. 554| | * 555| | * In case 1), the number can't be trusted, so don't rely on 556| | * it to attempt to fix the original length field in the pcap 557| | * or pcapng header. 558| | * 559| | * In case 2), the system was probably running a version of 560| | * libpcap that didn't miscalculate the original length, so 561| | * it probably doesn't need to be fixed. 562| | * 563| | * This avoids the possibility of the product of the number of 564| | * descriptors and the size of descriptors won't overflow an 565| | * unsigned 32-bit integer. 566| | */ 567| 3.54k| if (usb_hdr->ndesc > USB_MAXDESC) ------------------ | | 132| 3.54k|#define USB_MAXDESC 128 ------------------ | Branch (567:7): [True: 749, False: 2.79k] ------------------ 568| 749| return; 569| | 570| 2.79k| if (!usb_hdr->data_flag && ------------------ | Branch (570:7): [True: 2.53k, False: 257] ------------------ 571| 2.53k| is_isochronous_transfer_completion(usb_hdr) && ------------------ | Branch (571:7): [True: 2.08k, False: 452] ------------------ 572| 2.08k| packet_length_might_be_wrong(hdr, usb_hdr)) { ------------------ | Branch (572:7): [True: 1.63k, False: 454] ------------------ 573| 1.63k| u_int len; 574| | 575| | /* 576| | * Make sure we have all of the descriptors, 577| | * as we will have to look at all of them. 578| | * 579| | * If not, we don't bother trying to fix 580| | * anything. 581| | */ 582| 1.63k| if (hdr->caplen < iso_pseudo_header_len(usb_hdr)) ------------------ | Branch (582:8): [True: 526, False: 1.10k] ------------------ 583| 526| return; 584| | 585| | /* 586| | * Calculate what the length should have been. 587| | */ 588| 1.10k| len = incoming_isochronous_transfer_completed_len(hdr, 589| 1.10k| data); 590| | 591| | /* 592| | * len is the smaller of UINT_MAX and the total 593| | * header plus data length. That's guaranteed 594| | * to fit in a UINT_MAX. 595| | * 596| | * Don't reduce the original length to a value 597| | * below the captured length, however, as that 598| | * is bogus. 599| | */ 600| 1.10k| if (len >= hdr->caplen) ------------------ | Branch (600:8): [True: 867, False: 237] ------------------ 601| 867| hdr->len = len; 602| | 603| | /* 604| | * If the captured length is greater than the 605| | * length, use the captured length. 606| | * 607| | * For completion events for incoming isochronous 608| | * transfers, it's based on data_len, which is 609| | * calculated the same way we calculated 610| | * pre_truncation_data_len above, except that 611| | * it has access to all the isochronous descriptors, 612| | * not just the ones that the kernel were able to 613| | * provide us or, for a capture file, that weren't 614| | * sliced off by a snapshot length. 615| | * 616| | * However, it might have been reduced by the USB 617| | * capture mechanism arbitrarily limiting the amount 618| | * of data it provides to userland, or by the libpcap 619| | * capture code limiting it to being no more than the 620| | * snapshot, so we don't want to just use it all the 621| | * time; we only do so to try to get a better estimate 622| | * of the actual length - and to make sure the 623| | * original length is always >= the captured length. 624| | */ 625| 1.10k| if (hdr->caplen > hdr->len) ------------------ | Branch (625:8): [True: 217, False: 887] ------------------ 626| 217| hdr->len = hdr->caplen; 627| 1.10k| } 628| 2.79k| } 629| 42.0k|} pcap-util.c:swap_pseudo_headers: 453| 31.0k|{ 454| | /* 455| | * Convert pseudo-headers from the byte order of 456| | * the host on which the file was saved to our 457| | * byte order, as necessary. 458| | */ 459| 31.0k| switch (linktype) { ------------------ | Branch (459:10): [True: 20.0k, False: 10.9k] ------------------ 460| | 461| 2.58k| case DLT_PFLOG: ------------------ | | 372| 2.58k|#define DLT_PFLOG 117 ------------------ | Branch (461:2): [True: 2.58k, False: 28.4k] ------------------ 462| 2.58k| swap_pflog_header(hdr, data); 463| 2.58k| break; 464| | 465| 3.28k| case DLT_LINUX_SLL: ------------------ | | 352| 3.28k|#define DLT_LINUX_SLL 113 ------------------ | Branch (465:2): [True: 3.28k, False: 27.7k] ------------------ 466| 3.28k| swap_linux_sll_socketcan_header(hdr, data); 467| 3.28k| break; 468| | 469| 3.29k| case DLT_LINUX_SLL2: ------------------ | | 1530| 3.29k|#define DLT_LINUX_SLL2 276 ------------------ | Branch (469:2): [True: 3.29k, False: 27.7k] ------------------ 470| 3.29k| swap_linux_sll2_socketcan_header(hdr, data); 471| 3.29k| break; 472| | 473| 2.40k| case DLT_USB_LINUX: ------------------ | | 805| 2.40k|#define DLT_USB_LINUX 189 ------------------ | Branch (473:2): [True: 2.40k, False: 28.5k] ------------------ 474| 2.40k| swap_linux_usb_header(hdr, data, 0); 475| 2.40k| break; 476| | 477| 6.84k| case DLT_USB_LINUX_MMAPPED: ------------------ | | 1042| 6.84k|#define DLT_USB_LINUX_MMAPPED 220 ------------------ | Branch (477:2): [True: 6.84k, False: 24.1k] ------------------ 478| 6.84k| swap_linux_usb_header(hdr, data, 1); 479| 6.84k| break; 480| | 481| 1.58k| case DLT_NFLOG: ------------------ | | 1226| 1.58k|#define DLT_NFLOG 239 ------------------ | Branch (481:2): [True: 1.58k, False: 29.4k] ------------------ 482| 1.58k| swap_nflog_header(hdr, data); 483| 1.58k| break; 484| 31.0k| } 485| 31.0k|} pcap-util.c:swap_pflog_header: 52| 2.58k|{ 53| 2.58k| u_int caplen = hdr->caplen; 54| 2.58k| u_int length = hdr->len; 55| 2.58k| u_int pfloghdr_length; 56| 2.58k| struct pfloghdr *pflhdr = (struct pfloghdr *)buf; 57| | 58| 2.58k| if (caplen < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid) || ------------------ | Branch (58:6): [True: 396, False: 2.19k] ------------------ 59| 2.19k| length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) { ------------------ | Branch (59:6): [True: 202, False: 1.99k] ------------------ 60| | /* Not enough data to have the uid field */ 61| 598| return; 62| 598| } 63| | 64| 1.99k| pfloghdr_length = pflhdr->length; 65| | 66| 1.99k| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) { ------------------ | Branch (66:6): [True: 221, False: 1.77k] ------------------ 67| | /* Header doesn't include uid field */ 68| 221| return; 69| 221| } 70| 1.77k| pflhdr->uid = PCAP_BSWAP_32(pflhdr->uid); ------------------ | | 78| 1.77k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 71| | 72| 1.77k| if (caplen < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid) || ------------------ | Branch (72:6): [True: 217, False: 1.55k] ------------------ 73| 1.55k| length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) { ------------------ | Branch (73:6): [True: 69, False: 1.48k] ------------------ 74| | /* Not enough data to have the pid field */ 75| 286| return; 76| 286| } 77| 1.48k| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) { ------------------ | Branch (77:6): [True: 208, False: 1.27k] ------------------ 78| | /* Header doesn't include pid field */ 79| 208| return; 80| 208| } 81| 1.27k| pflhdr->pid = PCAP_BSWAP_32(pflhdr->pid); ------------------ | | 78| 1.27k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 82| | 83| 1.27k| if (caplen < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid) || ------------------ | Branch (83:6): [True: 260, False: 1.01k] ------------------ 84| 1.01k| length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) { ------------------ | Branch (84:6): [True: 66, False: 950] ------------------ 85| | /* Not enough data to have the rule_uid field */ 86| 326| return; 87| 326| } 88| 950| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) { ------------------ | Branch (88:6): [True: 204, False: 746] ------------------ 89| | /* Header doesn't include rule_uid field */ 90| 204| return; 91| 204| } 92| 746| pflhdr->rule_uid = PCAP_BSWAP_32(pflhdr->rule_uid); ------------------ | | 78| 746|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 93| | 94| 746| if (caplen < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid) || ------------------ | Branch (94:6): [True: 228, False: 518] ------------------ 95| 518| length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) { ------------------ | Branch (95:6): [True: 68, False: 450] ------------------ 96| | /* Not enough data to have the rule_pid field */ 97| 296| return; 98| 296| } 99| 450| if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) { ------------------ | Branch (99:6): [True: 203, False: 247] ------------------ 100| | /* Header doesn't include rule_pid field */ 101| 203| return; 102| 203| } 103| 247| pflhdr->rule_pid = PCAP_BSWAP_32(pflhdr->rule_pid); ------------------ | | 78| 247|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 104| 247|} pcap-util.c:swap_linux_sll_socketcan_header: 191| 3.28k|{ 192| 3.28k| u_int caplen = hdr->caplen; 193| 3.28k| u_int length = hdr->len; 194| 3.28k| struct sll_header *shdr = (struct sll_header *)buf; 195| | 196| 3.28k| if (caplen < (u_int) sizeof(struct sll_header) || ------------------ | Branch (196:6): [True: 453, False: 2.83k] ------------------ 197| 2.83k| length < (u_int) sizeof(struct sll_header)) { ------------------ | Branch (197:6): [True: 197, False: 2.63k] ------------------ 198| | /* Not enough data to have the protocol field */ 199| 650| return; 200| 650| } 201| | 202| | /* 203| | * Byte-swap what needs to be byte-swapped. 204| | */ 205| 2.63k| swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll_protocol), 206| 2.63k| caplen - (u_int) sizeof(struct sll_header), 207| 2.63k| length - (u_int) sizeof(struct sll_header), 208| 2.63k| buf + sizeof(struct sll_header)); 209| 2.63k|} pcap-util.c:swap_socketcan_header: 124| 5.42k|{ 125| 5.42k| pcap_can_socketcan_hdr *hdrp; 126| 5.42k| pcap_can_socketcan_xl_hdr *xl_hdrp; 127| | 128| 5.42k| switch (protocol) { 129| | 130| 888| case LINUX_SLL_P_CAN: ------------------ | | 142| 888|#define LINUX_SLL_P_CAN 0x000C /* CAN frames, with SocketCAN pseudo-headers */ ------------------ | Branch (130:2): [True: 888, False: 4.53k] ------------------ 131| 1.83k| case LINUX_SLL_P_CANFD: ------------------ | | 143| 1.83k|#define LINUX_SLL_P_CANFD 0x000D /* CAN FD frames, with SocketCAN pseudo-headers */ ------------------ | Branch (131:2): [True: 948, False: 4.47k] ------------------ 132| | /* 133| | * CAN classic/CAN FD packet; fix up the packet's header 134| | * by byte-swapping the CAN ID field. 135| | */ 136| 1.83k| hdrp = (pcap_can_socketcan_hdr *)buf; 137| 1.83k| if (caplen < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id) || ------------------ | Branch (137:7): [True: 794, False: 1.04k] ------------------ 138| 1.25k| length < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id)) { ------------------ | Branch (138:7): [True: 457, False: 585] ------------------ 139| | /* Not enough data to have the can_id field */ 140| 1.25k| return; 141| 1.25k| } 142| 585| hdrp->can_id = PCAP_BSWAP_32(hdrp->can_id); ------------------ | | 78| 585|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 143| 585| break; 144| | 145| 3.10k| case LINUX_SLL_P_CANXL: ------------------ | | 144| 3.10k|#define LINUX_SLL_P_CANXL 0x000E /* CAN XL frames, with SocketCAN pseudo-headers */ ------------------ | Branch (145:2): [True: 3.10k, False: 2.32k] ------------------ 146| | /* 147| | * CAN XL packet; fix up the packet's header by 148| | * byte-swapping the priority/VCID field, the 149| | * payload length, and the acceptance field. 150| | */ 151| 3.10k| xl_hdrp = (pcap_can_socketcan_xl_hdr *)buf; 152| 3.10k| if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid) || ------------------ | Branch (152:7): [True: 412, False: 2.69k] ------------------ 153| 2.69k| length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid)) { ------------------ | Branch (153:7): [True: 406, False: 2.28k] ------------------ 154| | /* Not enough data to have the priority_vcid field */ 155| 818| return; 156| 818| } 157| 2.28k| xl_hdrp->priority_vcid = PCAP_BSWAP_32(xl_hdrp->priority_vcid); ------------------ | | 78| 2.28k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 158| 2.28k| if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length) || ------------------ | Branch (158:7): [True: 463, False: 1.82k] ------------------ 159| 1.82k| length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length)) { ------------------ | Branch (159:7): [True: 392, False: 1.42k] ------------------ 160| | /* Not enough data to have the payload_length field */ 161| 855| return; 162| 855| } 163| 1.42k| xl_hdrp->payload_length = PCAP_BSWAP_16(xl_hdrp->payload_length); ------------------ | | 88| 1.42k|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 164| 1.42k| if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field) || ------------------ | Branch (164:7): [True: 485, False: 944] ------------------ 165| 944| length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field)) { ------------------ | Branch (165:7): [True: 393, False: 551] ------------------ 166| | /* Not enough data to have the acceptance_field field */ 167| 878| return; 168| 878| } 169| 551| xl_hdrp->acceptance_field = PCAP_BSWAP_32(xl_hdrp->acceptance_field); ------------------ | | 78| 551|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 170| 551| break; 171| | 172| 488| default: ------------------ | Branch (172:2): [True: 488, False: 4.93k] ------------------ 173| | /* 174| | * Not a CAN packet; nothing to do. 175| | */ 176| 488| break; 177| 5.42k| } 178| 5.42k|} pcap-util.c:swap_linux_sll2_socketcan_header: 216| 3.29k|{ 217| 3.29k| u_int caplen = hdr->caplen; 218| 3.29k| u_int length = hdr->len; 219| 3.29k| struct sll2_header *shdr = (struct sll2_header *)buf; 220| | 221| 3.29k| if (caplen < (u_int) sizeof(struct sll2_header) || ------------------ | Branch (221:6): [True: 303, False: 2.98k] ------------------ 222| 2.98k| length < (u_int) sizeof(struct sll2_header)) { ------------------ | Branch (222:6): [True: 201, False: 2.78k] ------------------ 223| | /* Not enough data to have the protocol field */ 224| 504| return; 225| 504| } 226| | 227| | /* 228| | * Byte-swap what needs to be byte-swapped. 229| | */ 230| 2.78k| swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll2_protocol), 231| 2.78k| caplen - (u_int) sizeof(struct sll2_header), 232| 2.78k| length - (u_int) sizeof(struct sll2_header), 233| 2.78k| buf + sizeof(struct sll2_header)); 234| 2.78k|} pcap-util.c:swap_linux_usb_header: 248| 9.25k|{ 249| 9.25k| pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; 250| 9.25k| bpf_u_int32 offset = 0; 251| | 252| | /* 253| | * "offset" is the offset *past* the field we're swapping; 254| | * we skip the field *before* checking to make sure 255| | * the captured data length includes the entire field. 256| | */ 257| | 258| | /* 259| | * The URB id is a totally opaque value; do we really need to 260| | * convert it to the reading host's byte order??? 261| | */ 262| 9.25k| offset += 8; /* skip past id */ 263| 9.25k| if (hdr->caplen < offset) ------------------ | Branch (263:6): [True: 1.45k, False: 7.80k] ------------------ 264| 1.45k| return; 265| 7.80k| uhdr->id = swap_4_byte_aligned_uint64(uhdr->id); 266| | 267| 7.80k| offset += 4; /* skip past various 1-byte fields */ 268| | 269| 7.80k| offset += 2; /* skip past bus_id */ 270| 7.80k| if (hdr->caplen < offset) ------------------ | Branch (270:6): [True: 407, False: 7.39k] ------------------ 271| 407| return; 272| 7.39k| uhdr->bus_id = PCAP_BSWAP_16(uhdr->bus_id); ------------------ | | 88| 7.39k|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 273| | 274| 7.39k| offset += 2; /* skip past various 1-byte fields */ 275| | 276| 7.39k| offset += 8; /* skip past ts_sec */ 277| 7.39k| if (hdr->caplen < offset) ------------------ | Branch (277:6): [True: 404, False: 6.99k] ------------------ 278| 404| return; 279| 6.99k| uhdr->ts_sec = swap_4_byte_aligned_int64(uhdr->ts_sec); 280| | 281| 6.99k| offset += 4; /* skip past ts_usec */ 282| 6.99k| if (hdr->caplen < offset) ------------------ | Branch (282:6): [True: 416, False: 6.57k] ------------------ 283| 416| return; 284| 6.57k| uhdr->ts_usec = PCAP_BSWAP_32(uhdr->ts_usec); ------------------ | | 78| 6.57k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 285| | 286| 6.57k| offset += 4; /* skip past status */ 287| 6.57k| if (hdr->caplen < offset) ------------------ | Branch (287:6): [True: 394, False: 6.18k] ------------------ 288| 394| return; 289| 6.18k| uhdr->status = PCAP_BSWAP_32(uhdr->status); ------------------ | | 78| 6.18k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 290| | 291| 6.18k| offset += 4; /* skip past urb_len */ 292| 6.18k| if (hdr->caplen < offset) ------------------ | Branch (292:6): [True: 416, False: 5.76k] ------------------ 293| 416| return; 294| 5.76k| uhdr->urb_len = PCAP_BSWAP_32(uhdr->urb_len); ------------------ | | 78| 5.76k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 295| | 296| 5.76k| offset += 4; /* skip past data_len */ 297| 5.76k| if (hdr->caplen < offset) ------------------ | Branch (297:6): [True: 393, False: 5.37k] ------------------ 298| 393| return; 299| 5.37k| uhdr->data_len = PCAP_BSWAP_32(uhdr->data_len); ------------------ | | 78| 5.37k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 300| | 301| 5.37k| if (uhdr->transfer_type == URB_ISOCHRONOUS) { ------------------ | | 43| 5.37k|#define URB_ISOCHRONOUS 0x0 ------------------ | Branch (301:6): [True: 3.85k, False: 1.51k] ------------------ 302| 3.85k| offset += 4; /* skip past s.iso.error_count */ 303| 3.85k| if (hdr->caplen < offset) ------------------ | Branch (303:7): [True: 265, False: 3.59k] ------------------ 304| 265| return; 305| 3.59k| uhdr->s.iso.error_count = PCAP_BSWAP_32(uhdr->s.iso.error_count); ------------------ | | 78| 3.59k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 306| | 307| 3.59k| offset += 4; /* skip past s.iso.numdesc */ 308| 3.59k| if (hdr->caplen < offset) ------------------ | Branch (308:7): [True: 395, False: 3.19k] ------------------ 309| 395| return; 310| 3.19k| uhdr->s.iso.numdesc = PCAP_BSWAP_32(uhdr->s.iso.numdesc); ------------------ | | 78| 3.19k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 311| 3.19k| } else 312| 1.51k| offset += 8; /* skip USB setup header */ 313| | 314| | /* 315| | * With the old header, there are no isochronous descriptors 316| | * after the header. 317| | * 318| | * With the new header, the actual number of descriptors in 319| | * the header is not s.iso.numdesc, it's ndesc - only the 320| | * first N descriptors, for some value of N, are put into 321| | * the header, and ndesc is set to the actual number copied. 322| | * In addition, if s.iso.numdesc is negative, no descriptors 323| | * are captured, and ndesc is set to 0. 324| | */ 325| 4.71k| if (header_len_64_bytes) { ------------------ | Branch (325:6): [True: 4.21k, False: 501] ------------------ 326| | /* 327| | * This is either the "version 1" header, with 328| | * 16 bytes of additional fields at the end, or 329| | * a "version 0" header from a memory-mapped 330| | * capture, with 16 bytes of zeroed-out padding 331| | * at the end. Byte swap them as if this were 332| | * a "version 1" header. 333| | */ 334| 4.21k| offset += 4; /* skip past interval */ 335| 4.21k| if (hdr->caplen < offset) ------------------ | Branch (335:7): [True: 404, False: 3.80k] ------------------ 336| 404| return; 337| 3.80k| uhdr->interval = PCAP_BSWAP_32(uhdr->interval); ------------------ | | 78| 3.80k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 338| | 339| 3.80k| offset += 4; /* skip past start_frame */ 340| 3.80k| if (hdr->caplen < offset) ------------------ | Branch (340:7): [True: 196, False: 3.61k] ------------------ 341| 196| return; 342| 3.61k| uhdr->start_frame = PCAP_BSWAP_32(uhdr->start_frame); ------------------ | | 78| 3.61k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 343| | 344| 3.61k| offset += 4; /* skip past xfer_flags */ 345| 3.61k| if (hdr->caplen < offset) ------------------ | Branch (345:7): [True: 197, False: 3.41k] ------------------ 346| 197| return; 347| 3.41k| uhdr->xfer_flags = PCAP_BSWAP_32(uhdr->xfer_flags); ------------------ | | 78| 3.41k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 348| | 349| 3.41k| offset += 4; /* skip past ndesc */ 350| 3.41k| if (hdr->caplen < offset) ------------------ | Branch (350:7): [True: 197, False: 3.21k] ------------------ 351| 197| return; 352| 3.21k| uhdr->ndesc = PCAP_BSWAP_32(uhdr->ndesc); ------------------ | | 78| 3.21k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 353| | 354| 3.21k| if (uhdr->transfer_type == URB_ISOCHRONOUS) { ------------------ | | 43| 3.21k|#define URB_ISOCHRONOUS 0x0 ------------------ | Branch (354:7): [True: 2.63k, False: 589] ------------------ 355| | /* swap the values in struct linux_usb_isodesc */ 356| 2.63k| usb_isodesc *pisodesc; 357| 2.63k| uint32_t i; 358| | 359| 2.63k| pisodesc = (usb_isodesc *)(void *)(buf+offset); 360| 229k| for (i = 0; i < uhdr->ndesc; i++) { ------------------ | Branch (360:16): [True: 228k, False: 1.42k] ------------------ 361| 228k| offset += 4; /* skip past status */ 362| 228k| if (hdr->caplen < offset) ------------------ | Branch (362:9): [True: 576, False: 227k] ------------------ 363| 576| return; 364| 227k| pisodesc->status = PCAP_BSWAP_32(pisodesc->status); ------------------ | | 78| 227k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 365| | 366| 227k| offset += 4; /* skip past offset */ 367| 227k| if (hdr->caplen < offset) ------------------ | Branch (367:9): [True: 270, False: 227k] ------------------ 368| 270| return; 369| 227k| pisodesc->offset = PCAP_BSWAP_32(pisodesc->offset); ------------------ | | 78| 227k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 370| | 371| 227k| offset += 4; /* skip past len */ 372| 227k| if (hdr->caplen < offset) ------------------ | Branch (372:9): [True: 359, False: 227k] ------------------ 373| 359| return; 374| 227k| pisodesc->len = PCAP_BSWAP_32(pisodesc->len); ------------------ | | 78| 227k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 375| | 376| 227k| offset += 4; /* skip past padding */ 377| | 378| 227k| pisodesc++; 379| 227k| } 380| 2.63k| } 381| 3.21k| } 382| 4.71k|} pcap-util.c:swap_nflog_header: 397| 1.58k|{ 398| 1.58k| u_char *p = buf; 399| 1.58k| nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf; 400| 1.58k| nflog_tlv_t *tlv; 401| 1.58k| u_int caplen = hdr->caplen; 402| 1.58k| u_int length = hdr->len; 403| 1.58k| u_int size; 404| | 405| 1.58k| if (caplen < (u_int) sizeof(nflog_hdr_t) || ------------------ | Branch (405:6): [True: 347, False: 1.24k] ------------------ 406| 1.24k| length < (u_int) sizeof(nflog_hdr_t)) { ------------------ | Branch (406:6): [True: 196, False: 1.04k] ------------------ 407| | /* Not enough data to have any TLVs. */ 408| 543| return; 409| 543| } 410| | 411| 1.04k| if (nfhdr->nflog_version != 0) { ------------------ | Branch (411:6): [True: 233, False: 811] ------------------ 412| | /* Unknown NFLOG version */ 413| 233| return; 414| 233| } 415| | 416| 811| length -= sizeof(nflog_hdr_t); 417| 811| caplen -= sizeof(nflog_hdr_t); 418| 811| p += sizeof(nflog_hdr_t); 419| | 420| 2.02k| while (caplen >= sizeof(nflog_tlv_t)) { ------------------ | Branch (420:9): [True: 1.55k, False: 466] ------------------ 421| 1.55k| tlv = (nflog_tlv_t *) p; 422| | 423| | /* Swap the type and length. */ 424| 1.55k| tlv->tlv_type = PCAP_BSWAP_16(tlv->tlv_type); ------------------ | | 88| 1.55k|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 425| 1.55k| tlv->tlv_length = PCAP_BSWAP_16(tlv->tlv_length); ------------------ | | 88| 1.55k|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 426| | 427| | /* Get the length of the TLV. */ 428| 1.55k| size = tlv->tlv_length; 429| 1.55k| if (size % 4 != 0) ------------------ | Branch (429:7): [True: 1.02k, False: 532] ------------------ 430| 1.02k| size += 4 - size % 4; 431| | 432| | /* Is the TLV's length less than the minimum? */ 433| 1.55k| if (size < sizeof(nflog_tlv_t)) { ------------------ | Branch (433:7): [True: 119, False: 1.44k] ------------------ 434| | /* Yes. Give up now. */ 435| 119| return; 436| 119| } 437| | 438| | /* Do we have enough data for the full TLV? */ 439| 1.44k| if (caplen < size || length < size) { ------------------ | Branch (439:7): [True: 226, False: 1.21k] | Branch (439:24): [True: 0, False: 1.21k] ------------------ 440| | /* No. */ 441| 226| return; 442| 226| } 443| | 444| | /* Skip over the TLV. */ 445| 1.21k| length -= size; 446| 1.21k| caplen -= size; 447| 1.21k| p += size; 448| 1.21k| } 449| 811|} pcap-util.c:packet_length_might_be_wrong: 490| 2.08k|{ 491| 2.08k| uint32_t old_style_packet_length; 492| | 493| | /* 494| | * Calculate the packet length the old way. 495| | * We know that the multiplication won't overflow, but 496| | * we don't know that the additions won't. Calculate 497| | * it with no overflow checks, as that's how it 498| | * would have been calculated when it was captured. 499| | */ 500| 2.08k| old_style_packet_length = iso_pseudo_header_len(usb_hdr) + 501| 2.08k| usb_hdr->urb_len; 502| 2.08k| return (hdr->len == old_style_packet_length); 503| 2.08k|} pcap-util.c:swap_4_byte_aligned_uint64: 99| 7.80k|{ 100| 7.80k| return (pcap_4_byte_aligned_uint64){.halves[0] = PCAP_BSWAP_32(val.halves[1]), .halves[1] = PCAP_BSWAP_32(val.halves[0])}; ------------------ | | 78| 15.6k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ return (pcap_4_byte_aligned_uint64){.halves[0] = PCAP_BSWAP_32(val.halves[1]), .halves[1] = PCAP_BSWAP_32(val.halves[0])}; ------------------ | | 78| 7.80k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 101| 7.80k|} pcap-util.c:swap_4_byte_aligned_int64: 107| 6.99k|{ 108| 6.99k| return (pcap_4_byte_aligned_int64){.halves[0] = PCAP_BSWAP_32(val.halves[1]), .halves[1] = PCAP_BSWAP_32(val.halves[0])}; ------------------ | | 78| 13.9k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ return (pcap_4_byte_aligned_int64){.halves[0] = PCAP_BSWAP_32(val.halves[1]), .halves[1] = PCAP_BSWAP_32(val.halves[0])}; ------------------ | | 78| 6.99k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 109| 6.99k|} pcapint_grow_buffer: 550| 3.08k|{ 551| 3.08k| void *bigger_buffer; 552| | 553| 3.08k| bigger_buffer = realloc(p->buffer, bufsize); 554| 3.08k| if (bigger_buffer == NULL) { ------------------ | Branch (554:6): [True: 0, False: 3.08k] ------------------ 555| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 556| 0| return (0); 557| 0| } 558| 3.08k| p->buffer = bigger_buffer; 559| 3.08k| p->bufsize = bufsize; 560| 3.08k| return (1); 561| 3.08k|} pcapint_oneshot: 570| 42.0k|{ 571| 42.0k| struct oneshot_userdata *sp = (struct oneshot_userdata *)user; 572| | 573| 42.0k| *sp->hdr = *h; 574| 42.0k| *sp->pkt = pkt; 575| 42.0k|} pcap_next_ex: 594| 47.0k|{ 595| 47.0k| struct oneshot_userdata s; 596| | 597| 47.0k| s.hdr = &p->pcap_header; 598| 47.0k| s.pkt = pkt_data; 599| 47.0k| s.pd = p; 600| | 601| | /* Saves a pointer to the packet headers */ 602| 47.0k| *pkt_header= &p->pcap_header; 603| | 604| 47.0k| if (p->rfile != NULL) { ------------------ | Branch (604:6): [True: 47.0k, False: 0] ------------------ 605| 47.0k| int status; 606| | 607| | /* We are on an offline capture */ 608| 47.0k| status = pcapint_offline_read(p, 1, p->oneshot_callback, 609| 47.0k| (u_char *)&s); 610| | 611| | /* 612| | * Return codes for pcapint_offline_read() are: 613| | * - 0: EOF 614| | * - -1: error 615| | * - >0: OK - result is number of packets read, so 616| | * it will be 1 in this case, as we've passed 617| | * a maximum packet count of 1 618| | * The first one ('0') conflicts with the return code of 619| | * 0 from pcap_read() meaning "no packets arrived before 620| | * the timeout expired", so we map it to -2 so you can 621| | * distinguish between an EOF from a savefile and a 622| | * "no packets arrived before the timeout expired, try 623| | * again" from a live capture. 624| | */ 625| 47.0k| if (status == 0) ------------------ | Branch (625:7): [True: 4.02k, False: 43.0k] ------------------ 626| 4.02k| return (-2); 627| 43.0k| else 628| 43.0k| return (status); 629| 47.0k| } 630| | 631| | /* 632| | * Return codes for pcap_read() are: 633| | * - 0: timeout 634| | * - -1: error 635| | * - -2: loop was broken out of with pcap_breakloop() 636| | * - >0: OK, result is number of packets captured, so 637| | * it will be 1 in this case, as we've passed 638| | * a maximum packet count of 1 639| | * The first one ('0') conflicts with the return code of 0 from 640| | * pcapint_offline_read() meaning "end of file". 641| | */ 642| 0| return (p->read_op(p, 1, p->oneshot_callback, (u_char *)&s)); 643| 47.0k|} pcapint_open_offline_common: 2958| 5.32k|{ 2959| 5.32k| pcap_t *p; 2960| | 2961| 5.32k| p = pcap_alloc_pcap_t(ebuf, total_size, private_offset); 2962| 5.32k| if (p == NULL) ------------------ | Branch (2962:6): [True: 0, False: 5.32k] ------------------ 2963| 0| return (NULL); 2964| | 2965| 5.32k| p->opt.tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO; ------------------ | | 539| 5.32k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ 2966| | 2967| 5.32k| return (p); 2968| 5.32k|} pcap_datalink: 3017| 4.96k|{ 3018| 4.96k| if (!p->activated) ------------------ | Branch (3018:6): [True: 0, False: 4.96k] ------------------ 3019| 0| return (PCAP_ERROR_NOT_ACTIVATED); ------------------ | | 364| 0|#define PCAP_ERROR_NOT_ACTIVATED -3 /* the capture needs to be activated */ ------------------ 3020| 4.96k| return (p->linktype); 3021| 4.96k|} pcap_datalink_val_to_description: 3457| 14.8k|{ 3458| 14.8k| int i; 3459| | 3460| 1.13M| for (i = 0; dlt_choices[i].name != NULL; i++) { ------------------ | Branch (3460:14): [True: 1.13M, False: 469] ------------------ 3461| 1.13M| if (dlt_choices[i].dlt == dlt) ------------------ | Branch (3461:7): [True: 14.3k, False: 1.12M] ------------------ 3462| 14.3k| return (dlt_choices[i].description); 3463| 1.13M| } 3464| 469| return (NULL); 3465| 14.8k|} pcap_close: 4354| 4.96k|{ 4355| 4.96k| p->cleanup_op(p); 4356| | 4357| | /* 4358| | * Free information set by pcap_create() *after* calling 4359| | * the module's cleanup routine; that routine might have 4360| | * to use p->opt.device (see commit 4361| | * e333a6044f7d2d3225a6a22205b6b7c1e389945f). 4362| | */ 4363| 4.96k| if (p->opt.device != NULL) { ------------------ | Branch (4363:6): [True: 0, False: 4.96k] ------------------ 4364| 0| free(p->opt.device); 4365| | p->opt.device = NULL; 4366| 0| } 4367| 4.96k| free(p); 4368| 4.96k|} pcap.c:pcap_alloc_pcap_t: 2508| 5.32k|{ 2509| 5.32k| char *chunk; 2510| 5.32k| pcap_t *p; 2511| | 2512| | /* 2513| | * total_size is the size of a structure containing a pcap_t 2514| | * followed by a private structure. 2515| | */ 2516| 5.32k| chunk = calloc(total_size, 1); 2517| 5.32k| if (chunk == NULL) { ------------------ | Branch (2517:6): [True: 0, False: 5.32k] ------------------ 2518| 0| pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 2519| 0| errno, "malloc"); 2520| 0| return (NULL); 2521| 0| } 2522| | 2523| | /* 2524| | * Get a pointer to the pcap_t at the beginning. 2525| | */ 2526| 5.32k| p = (pcap_t *)chunk; 2527| | 2528| |#ifdef _WIN32 2529| | p->handle = INVALID_HANDLE_VALUE; /* not opened yet */ 2530| |#else /* _WIN32 */ 2531| 5.32k| p->fd = -1; /* not opened yet */ 2532| 5.32k| p->selectable_fd = -1; 2533| 5.32k| p->required_select_timeout = NULL; 2534| 5.32k|#endif /* _WIN32 */ 2535| | 2536| | /* 2537| | * private_offset is the offset, in bytes, of the private 2538| | * data from the beginning of the structure. 2539| | * 2540| | * Set the pointer to the private data; that's private_offset 2541| | * bytes past the pcap_t. 2542| | */ 2543| 5.32k| p->priv = (void *)(chunk + private_offset); 2544| | 2545| 5.32k| return (p); 2546| 5.32k|} pcapint_sf_cleanup: 238| 4.96k|{ 239| 4.96k| if (p->rfile != stdin) ------------------ | Branch (239:6): [True: 4.96k, False: 0] ------------------ 240| 4.96k| (void)fclose(p->rfile); 241| 4.96k| if (p->buffer != NULL) ------------------ | Branch (241:6): [True: 4.96k, False: 0] ------------------ 242| 4.96k| free(p->buffer); 243| 4.96k| pcap_freecode(&p->fcode); 244| 4.96k|} pcapint_adjust_snapshot: 440| 7.88k|{ 441| 7.88k| if (snaplen == 0 || snaplen > INT_MAX) { ------------------ | Branch (441:6): [True: 1.24k, False: 6.63k] | Branch (441:22): [True: 1.85k, False: 4.78k] ------------------ 442| | /* 443| | * Bogus snapshot length; use the maximum for this 444| | * link-layer type as a fallback. 445| | * 446| | * XXX - we don't clamp snapshot lengths that are 447| | * <= INT_MAX but > max_snaplen_for_dlt(linktype), 448| | * so a capture file could cause us to allocate 449| | * a Really Big Buffer. 450| | */ 451| 3.10k| snaplen = max_snaplen_for_dlt(linktype); 452| 3.10k| } 453| 7.88k| return snaplen; 454| 7.88k|} pcap_fopen_offline_with_tstamp_precision: 469| 5.74k|{ 470| 5.74k| pcap_t *p; 471| 5.74k| uint8_t magic[4]; 472| 5.74k| size_t amt_read; 473| 5.74k| u_int i; 474| 5.74k| int err; 475| | 476| | /* 477| | * Fail if we were passed a NULL fp. 478| | * 479| | * That shouldn't happen if we're opening with a path name, but 480| | * it could happen if buggy code is opening with a FILE * and 481| | * didn't bother to make sure the FILE * isn't null. 482| | */ 483| 5.74k| if (fp == NULL) { ------------------ | Branch (483:6): [True: 0, False: 5.74k] ------------------ 484| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 485| 0| "Null FILE * pointer provided to savefile open routine"); 486| 0| return (NULL); 487| 0| } 488| | 489| | /* 490| | * Read the first 4 bytes of the file; the network analyzer dump 491| | * file formats we support (pcap and pcapng), and several other 492| | * formats we might support in the future (such as snoop, DOS and 493| | * Windows Sniffer, and Microsoft Network Monitor) all have magic 494| | * numbers that are unique in their first 4 bytes. 495| | */ 496| 5.74k| amt_read = fread(&magic, 1, sizeof(magic), fp); 497| 5.74k| if (amt_read != sizeof(magic)) { ------------------ | Branch (497:6): [True: 0, False: 5.74k] ------------------ 498| 0| if (ferror(fp)) { ------------------ | Branch (498:7): [True: 0, False: 0] ------------------ 499| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 500| 0| errno, "error reading dump file"); 501| 0| } else { 502| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 503| 0| "truncated dump file; tried to read %zu file header bytes, only got %zu", 504| 0| sizeof(magic), amt_read); 505| 0| } 506| 0| return (NULL); 507| 0| } 508| | 509| | /* 510| | * Try all file types. 511| | */ 512| 7.58k| for (i = 0; i < N_FILE_TYPES; i++) { ------------------ | | 461| 7.58k|#define N_FILE_TYPES (sizeof check_headers / sizeof check_headers[0]) ------------------ | Branch (512:14): [True: 7.28k, False: 305] ------------------ 513| 7.28k| p = (*check_headers[i])(magic, fp, precision, errbuf, &err); 514| 7.28k| if (p != NULL) { ------------------ | Branch (514:7): [True: 4.96k, False: 2.32k] ------------------ 515| | /* Yup, that's it. */ 516| 4.96k| goto found; 517| 4.96k| } 518| 2.32k| if (err) { ------------------ | Branch (518:7): [True: 479, False: 1.84k] ------------------ 519| | /* 520| | * Error trying to read the header. 521| | */ 522| 479| return (NULL); 523| 479| } 524| 2.32k| } 525| | 526| | /* 527| | * Well, who knows what this mess is.... 528| | */ 529| 305| snprintf(errbuf, PCAP_ERRBUF_SIZE, "unknown file format"); ------------------ | | 149| 305|#define PCAP_ERRBUF_SIZE 256 ------------------ 530| 305| return (NULL); 531| | 532| 4.96k|found: 533| 4.96k| p->rfile = fp; 534| | 535| | /* Padding only needed for live capture fcode */ 536| 4.96k| p->fddipad = 0; 537| | 538| 4.96k|#if !defined(_WIN32) 539| | /* 540| | * You can do "select()" and "poll()" on plain files on most 541| | * platforms, and should be able to do so on pipes. 542| | * 543| | * You can't do "select()" on anything other than sockets in 544| | * Windows, so, on Win32 systems, we don't have "selectable_fd". 545| | */ 546| 4.96k| p->selectable_fd = fileno(fp); 547| 4.96k|#endif 548| | 549| 4.96k| p->can_set_rfmon_op = sf_cant_set_rfmon; 550| 4.96k| p->read_op = pcapint_offline_read; 551| 4.96k| p->inject_op = sf_inject; 552| 4.96k| p->setfilter_op = pcapint_install_bpf_program; 553| 4.96k| p->setdirection_op = sf_setdirection; 554| 4.96k| p->set_datalink_op = NULL; /* we don't support munging link-layer headers */ 555| 4.96k| p->getnonblock_op = sf_getnonblock; 556| 4.96k| p->setnonblock_op = sf_setnonblock; 557| 4.96k| p->stats_op = sf_stats; 558| |#ifdef _WIN32 559| | p->stats_ex_op = sf_stats_ex; 560| | p->setbuff_op = sf_setbuff; 561| | p->setmode_op = sf_setmode; 562| | p->setmintocopy_op = sf_setmintocopy; 563| | p->getevent_op = sf_getevent; 564| | p->oid_get_request_op = sf_oid_get_request; 565| | p->oid_set_request_op = sf_oid_set_request; 566| | p->sendqueue_transmit_op = sf_sendqueue_transmit; 567| | p->setuserbuffer_op = sf_setuserbuffer; 568| | p->live_dump_op = sf_live_dump; 569| | p->live_dump_ended_op = sf_live_dump_ended; 570| |#endif 571| | 572| | /* 573| | * For offline captures, the standard one-shot callback can 574| | * be used for pcap_next()/pcap_next_ex(). 575| | */ 576| 4.96k| p->oneshot_callback = pcapint_oneshot; 577| | 578| | /* 579| | * Default breakloop operation. 580| | */ 581| 4.96k| p->breakloop_op = pcapint_breakloop_common; 582| | 583| | /* 584| | * For link-layer headers in which the packet type is indicated 585| | * by an AF_ value, we don't know what OS generated it, so we 586| | * don't know what numerical value corresponds to AF_INET6, and 587| | * we don't know the byte order of the host that originally 588| | * captured the packets in the file (as opposed to the host 589| | * that *wrote* this file), so we don't know the byte order 590| | * of multi-byte AF_ values. 591| | * 592| | * That requires different filtering code than a live capture. 593| | * 594| | * Savefiles don't require any other special BPF code generation. 595| | */ 596| 4.96k| p->bpf_codegen_flags = BPF_OFFLINE_AF_HANDLING; ------------------ | | 408| 4.96k|#define BPF_OFFLINE_AF_HANDLING 0x00000004 ------------------ 597| | 598| 4.96k| p->activated = 1; 599| | 600| 4.96k| return (p); 601| 5.74k|} pcap_fopen_offline: 611| 5.74k|{ 612| 5.74k| return (pcap_fopen_offline_with_tstamp_precision(fp, 613| 5.74k| PCAP_TSTAMP_PRECISION_MICRO, errbuf)); ------------------ | | 539| 5.74k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ 614| 5.74k|} pcapint_offline_read: 624| 47.0k|{ 625| 47.0k| int n = 0; 626| 47.0k| u_char *data; 627| | 628| | /* 629| | * This can conceivably process more than INT_MAX packets, 630| | * which would overflow the packet count, causing it either 631| | * to look like a negative number, and thus cause us to 632| | * return a value that looks like an error, or overflow 633| | * back into positive territory, and thus cause us to 634| | * return a too-low count. 635| | * 636| | * Therefore, if the packet count is unlimited, we clip 637| | * it at INT_MAX; this routine is not expected to 638| | * process packets indefinitely, so that's not an issue. 639| | */ 640| 47.0k| if (PACKET_COUNT_IS_UNLIMITED(cnt)) ------------------ | | 444| 47.0k|#define PACKET_COUNT_IS_UNLIMITED(count) ((count) <= 0) | | ------------------ | | | Branch (444:42): [True: 0, False: 47.0k] | | ------------------ ------------------ 641| 0| cnt = INT_MAX; 642| | 643| 47.0k| for (;;) { 644| 47.0k| struct pcap_pkthdr h; 645| 47.0k| int status; 646| | 647| | /* 648| | * Has "pcap_breakloop()" been called? 649| | * If so, return immediately - if we haven't read any 650| | * packets, clear the flag and return -2 to indicate 651| | * that we were told to break out of the loop, otherwise 652| | * leave the flag set, so that the *next* call will break 653| | * out of the loop without having read any packets, and 654| | * return the number of packets we've processed so far. 655| | */ 656| 47.0k| if (p->break_loop) { ------------------ | Branch (656:7): [True: 0, False: 47.0k] ------------------ 657| 0| if (n == 0) { ------------------ | Branch (657:8): [True: 0, False: 0] ------------------ 658| 0| p->break_loop = 0; 659| 0| return (-2); 660| 0| } else 661| 0| return (n); 662| 0| } 663| | 664| 47.0k| status = p->next_packet_op(p, &h, &data); 665| 47.0k| if (status < 0) { ------------------ | Branch (665:7): [True: 938, False: 46.0k] ------------------ 666| | /* 667| | * Error. Pass it back to the caller. 668| | */ 669| 938| return (status); 670| 938| } 671| 46.0k| if (status == 0) { ------------------ | Branch (671:7): [True: 4.02k, False: 42.0k] ------------------ 672| | /* 673| | * EOF. Nothing more to process; 674| | */ 675| 4.02k| break; 676| 4.02k| } 677| | 678| | /* 679| | * OK, we've read a packet; run it through the filter 680| | * and, if it passes, process it. 681| | */ 682| 42.0k| if (p->fcode.bf_insns == NULL || ------------------ | Branch (682:7): [True: 42.0k, False: 0] ------------------ 683| 0| pcapint_filter(p->fcode.bf_insns, p->fcode.bf_len, ------------------ | Branch (683:7): [True: 0, False: 0] ------------------ 684| 42.0k| data, h.len, h.caplen)) { 685| 42.0k| (*callback)(user, &h, data); 686| 42.0k| n++; /* count the packet */ 687| 42.0k| if (n >= cnt) ------------------ | Branch (687:8): [True: 42.0k, False: 0] ------------------ 688| 42.0k| break; 689| 42.0k| } 690| 42.0k| } 691| | /*XXX this breaks semantics tcpslice expects */ 692| 46.0k| return (n); 693| 47.0k|} pcap_check_header: 220| 5.74k|{ 221| 5.74k| bpf_u_int32 magic_int; 222| 5.74k| struct pcap_file_header hdr; 223| 5.74k| size_t amt_read; 224| 5.74k| pcap_t *p; 225| 5.74k| int swapped = 0; 226| 5.74k| struct pcap_sf *ps; 227| | 228| | /* 229| | * Assume no read errors. 230| | */ 231| 5.74k| *err = 0; 232| | 233| | /* 234| | * Check whether the first 4 bytes of the file are the magic 235| | * number for a pcap savefile, or for a byte-swapped pcap 236| | * savefile. 237| | */ 238| 5.74k| memcpy(&magic_int, magic, sizeof(magic_int)); 239| 5.74k| if (magic_int != TCPDUMP_MAGIC && ------------------ | | 71| 11.4k|#define TCPDUMP_MAGIC 0xa1b2c3d4 ------------------ | Branch (239:6): [True: 4.98k, False: 755] ------------------ 240| 4.98k| magic_int != KUZNETZOV_TCPDUMP_MAGIC && ------------------ | | 76| 10.7k|#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34 ------------------ | Branch (240:6): [True: 4.93k, False: 54] ------------------ 241| 4.93k| magic_int != NSEC_TCPDUMP_MAGIC) { ------------------ | | 94| 4.93k|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (241:6): [True: 4.89k, False: 41] ------------------ 242| 4.89k| magic_int = PCAP_BSWAP_32(magic_int); ------------------ | | 78| 4.89k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 243| 4.89k| if (magic_int != TCPDUMP_MAGIC && ------------------ | | 71| 9.78k|#define TCPDUMP_MAGIC 0xa1b2c3d4 ------------------ | Branch (243:7): [True: 2.52k, False: 2.36k] ------------------ 244| 2.52k| magic_int != KUZNETZOV_TCPDUMP_MAGIC && ------------------ | | 76| 7.42k|#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34 ------------------ | Branch (244:7): [True: 2.48k, False: 40] ------------------ 245| 2.48k| magic_int != NSEC_TCPDUMP_MAGIC) ------------------ | | 94| 2.48k|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (245:7): [True: 1.53k, False: 953] ------------------ 246| 1.53k| return (NULL); /* nope */ 247| 3.35k| swapped = 1; 248| 3.35k| } 249| | 250| | /* 251| | * They are. Put the magic number in the header, and read 252| | * the rest of the header. 253| | */ 254| 4.20k| hdr.magic = magic_int; 255| 4.20k| amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1, 256| 4.20k| sizeof(hdr) - sizeof(hdr.magic), fp); 257| 4.20k| if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) { ------------------ | Branch (257:6): [True: 0, False: 4.20k] ------------------ 258| 0| if (ferror(fp)) { ------------------ | Branch (258:7): [True: 0, False: 0] ------------------ 259| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 260| 0| errno, "error reading dump file"); 261| 0| } else { 262| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 263| 0| "truncated dump file; tried to read %zu file header bytes, only got %zu", 264| 0| sizeof(hdr), amt_read); 265| 0| } 266| 0| *err = 1; 267| 0| return (NULL); 268| 0| } 269| | 270| | /* 271| | * If it's a byte-swapped capture file, byte-swap the header. 272| | */ 273| 4.20k| if (swapped) { ------------------ | Branch (273:6): [True: 3.35k, False: 850] ------------------ 274| 3.35k| hdr.version_major = PCAP_BSWAP_16(hdr.version_major); ------------------ | | 88| 3.35k|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 275| 3.35k| hdr.version_minor = PCAP_BSWAP_16(hdr.version_minor); ------------------ | | 88| 3.35k|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 276| 3.35k| hdr.thiszone = PCAP_BSWAP_32(hdr.thiszone); ------------------ | | 78| 3.35k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 277| 3.35k| hdr.sigfigs = PCAP_BSWAP_32(hdr.sigfigs); ------------------ | | 78| 3.35k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 278| 3.35k| hdr.snaplen = PCAP_BSWAP_32(hdr.snaplen); ------------------ | | 78| 3.35k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 279| 3.35k| hdr.linktype = PCAP_BSWAP_32(hdr.linktype); ------------------ | | 78| 3.35k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 280| 3.35k| } 281| | 282| | /* 283| | * currently only versions 2.[0-4] are supported with 284| | * the exception of 543.0 for DG/UX tcpdump. 285| | */ 286| 4.20k| if (! ((hdr.version_major == PCAP_VERSION_MAJOR && ------------------ | | 146| 8.41k|#define PCAP_VERSION_MAJOR 2 ------------------ | Branch (286:10): [True: 3.43k, False: 771] ------------------ 287| 3.43k| hdr.version_minor <= PCAP_VERSION_MINOR) || ------------------ | | 147| 3.43k|#define PCAP_VERSION_MINOR 4 ------------------ | Branch (287:3): [True: 3.42k, False: 14] ------------------ 288| 785| (hdr.version_major == 543 && ------------------ | Branch (288:10): [True: 743, False: 42] ------------------ 289| 743| hdr.version_minor == 0))) { ------------------ | Branch (289:3): [True: 727, False: 16] ------------------ 290| 58| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 58|#define PCAP_ERRBUF_SIZE 256 ------------------ 291| 58| "unsupported pcap savefile version %u.%u", 292| 58| hdr.version_major, hdr.version_minor); 293| 58| *err = 1; 294| 58| return NULL; 295| 58| } 296| | 297| | /* 298| | * Check the main reserved field. 299| | */ 300| 4.15k| if (LT_RESERVED1(hdr.linktype) != 0) { ------------------ | | 267| 4.15k|#define LT_RESERVED1(x) ((x) & 0x03FF0000) ------------------ | Branch (300:6): [True: 11, False: 4.13k] ------------------ 301| 11| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 11|#define PCAP_ERRBUF_SIZE 256 ------------------ 302| 11| "savefile linktype reserved field not zero (0x%08x)", 303| 11| LT_RESERVED1(hdr.linktype)); ------------------ | | 267| 11|#define LT_RESERVED1(x) ((x) & 0x03FF0000) ------------------ 304| 11| *err = 1; 305| 11| return NULL; 306| 11| } 307| | 308| | /* 309| | * OK, this is a good pcap file. 310| | * Allocate a pcap_t for it. 311| | */ 312| 4.13k| p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_sf); ------------------ | | 570| 4.13k| pcapint_open_offline_common(ebuf, \ | | 571| 4.13k| sizeof (struct { pcap_t __common; type __private; }), \ | | 572| 4.13k| offsetof (struct { pcap_t __common; type __private; }, __private)) ------------------ 313| 4.13k| if (p == NULL) { ------------------ | Branch (313:6): [True: 0, False: 4.13k] ------------------ 314| | /* Allocation failed. */ 315| 0| *err = 1; 316| 0| return (NULL); 317| 0| } 318| 4.13k| p->swapped = swapped; 319| 4.13k| p->version_major = hdr.version_major; 320| 4.13k| p->version_minor = hdr.version_minor; 321| 4.13k| p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype)); ------------------ | | 265| 4.13k|#define LT_LINKTYPE(x) ((x) & 0x0000FFFF) ------------------ 322| 4.13k| p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype); ------------------ | | 266| 4.13k|#define LT_LINKTYPE_EXT(x) ((x) & 0xFFFF0000) ------------------ 323| 4.13k| p->snapshot = pcapint_adjust_snapshot(p->linktype, hdr.snaplen); 324| | 325| 4.13k| p->next_packet_op = pcap_next_packet; 326| | 327| 4.13k| ps = p->priv; 328| | 329| 4.13k| p->opt.tstamp_precision = precision; 330| | 331| | /* 332| | * Will we need to scale the timestamps to match what the 333| | * user wants? 334| | */ 335| 4.13k| switch (precision) { 336| | 337| 4.13k| case PCAP_TSTAMP_PRECISION_MICRO: ------------------ | | 539| 4.13k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ | Branch (337:2): [True: 4.13k, False: 0] ------------------ 338| 4.13k| if (magic_int == NSEC_TCPDUMP_MAGIC) { ------------------ | | 94| 4.13k|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (338:7): [True: 967, False: 3.17k] ------------------ 339| | /* 340| | * The file has nanoseconds, the user 341| | * wants microseconds; scale the 342| | * precision down. 343| | */ 344| 967| ps->scale_type = SCALE_DOWN; 345| 3.17k| } else { 346| | /* 347| | * The file has microseconds, the 348| | * user wants microseconds; nothing to do. 349| | */ 350| 3.17k| ps->scale_type = PASS_THROUGH; 351| 3.17k| } 352| 4.13k| break; 353| | 354| 0| case PCAP_TSTAMP_PRECISION_NANO: ------------------ | | 540| 0|#define PCAP_TSTAMP_PRECISION_NANO 1 /* use timestamps with nanosecond precision */ ------------------ | Branch (354:2): [True: 0, False: 4.13k] ------------------ 355| 0| if (magic_int == NSEC_TCPDUMP_MAGIC) { ------------------ | | 94| 0|#define NSEC_TCPDUMP_MAGIC 0xa1b23c4d ------------------ | Branch (355:7): [True: 0, False: 0] ------------------ 356| | /* 357| | * The file has nanoseconds, the 358| | * user wants nanoseconds; nothing to do. 359| | */ 360| 0| ps->scale_type = PASS_THROUGH; 361| 0| } else { 362| | /* 363| | * The file has microseconds, the user 364| | * wants nanoseconds; scale the 365| | * precision up. 366| | */ 367| 0| ps->scale_type = SCALE_UP; 368| 0| } 369| 0| break; 370| | 371| 0| default: ------------------ | Branch (371:2): [True: 0, False: 4.13k] ------------------ 372| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 373| 0| "unknown time stamp resolution %u", precision); 374| 0| free(p); 375| 0| *err = 1; 376| 0| return (NULL); 377| 4.13k| } 378| | 379| | /* 380| | * We interchanged the caplen and len fields at version 2.3, 381| | * in order to match the bpf header layout. But unfortunately 382| | * some files were written with version 2.3 in their headers 383| | * but without the interchanged fields. 384| | * 385| | * In addition, DG/UX tcpdump writes out files with a version 386| | * number of 543.0, and with the caplen and len fields in the 387| | * pre-2.3 order. 388| | */ 389| 4.13k| switch (hdr.version_major) { 390| | 391| 3.41k| case 2: ------------------ | Branch (391:2): [True: 3.41k, False: 726] ------------------ 392| 3.41k| if (hdr.version_minor < 3) ------------------ | Branch (392:7): [True: 1.34k, False: 2.07k] ------------------ 393| 1.34k| ps->lengths_swapped = SWAPPED; 394| 2.07k| else if (hdr.version_minor == 3) ------------------ | Branch (394:12): [True: 1.44k, False: 625] ------------------ 395| 1.44k| ps->lengths_swapped = MAYBE_SWAPPED; 396| 625| else 397| 625| ps->lengths_swapped = NOT_SWAPPED; 398| 3.41k| break; 399| | 400| 726| case 543: ------------------ | Branch (400:2): [True: 726, False: 3.41k] ------------------ 401| 726| ps->lengths_swapped = SWAPPED; 402| 726| break; 403| | 404| 0| default: ------------------ | Branch (404:2): [True: 0, False: 4.13k] ------------------ 405| 0| ps->lengths_swapped = NOT_SWAPPED; 406| 0| break; 407| 4.13k| } 408| | 409| 4.13k| if (magic_int == KUZNETZOV_TCPDUMP_MAGIC) { ------------------ | | 76| 4.13k|#define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34 ------------------ | Branch (409:6): [True: 88, False: 4.05k] ------------------ 410| | /* 411| | * XXX - the patch that's in some versions of libpcap 412| | * changes the packet header but not the magic number, 413| | * and some other versions with this magic number have 414| | * some extra debugging information in the packet header; 415| | * we'd have to use some hacks^H^H^H^H^Hheuristics to 416| | * detect those variants. 417| | * 418| | * Wireshark does that, but it does so by trying to read 419| | * the first two packets of the file with each of the 420| | * record header formats. That currently means it seeks 421| | * backwards and retries the reads, which doesn't work 422| | * on pipes. We want to be able to read from a pipe, so 423| | * that strategy won't work; we'd have to buffer some 424| | * data ourselves and read from that buffer in order to 425| | * make that work. 426| | */ 427| 88| ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr); 428| | 429| 88| if (p->linktype == DLT_EN10MB) { ------------------ | | 68| 88|#define DLT_EN10MB 1 /* Ethernet (10Mb) */ ------------------ | Branch (429:7): [True: 61, False: 27] ------------------ 430| | /* 431| | * This capture might have been done in raw mode 432| | * or cooked mode. 433| | * 434| | * If it was done in cooked mode, p->snapshot was 435| | * passed to recvfrom() as the buffer size, meaning 436| | * that the most packet data that would be copied 437| | * would be p->snapshot. However, a faked Ethernet 438| | * header would then have been added to it, so the 439| | * most data that would be in a packet in the file 440| | * would be p->snapshot + 14. 441| | * 442| | * We can't easily tell whether the capture was done 443| | * in raw mode or cooked mode, so we'll assume it was 444| | * cooked mode, and add 14 to the snapshot length. 445| | * That means that, for a raw capture, the snapshot 446| | * length will be misleading if you use it to figure 447| | * out why a capture doesn't have all the packet data, 448| | * but there's not much we can do to avoid that. 449| | * 450| | * But don't grow the snapshot length past the 451| | * maximum value of an int. 452| | */ 453| 61| if (p->snapshot <= INT_MAX - 14) ------------------ | Branch (453:8): [True: 59, False: 2] ------------------ 454| 59| p->snapshot += 14; 455| 2| else 456| 2| p->snapshot = INT_MAX; 457| 61| } 458| 88| } else 459| 4.05k| ps->hdrsize = sizeof(struct pcap_sf_pkthdr); 460| | 461| | /* 462| | * Allocate a buffer for the packet data. 463| | * Choose the minimum of the file's snapshot length and 2K bytes; 464| | * that should be enough for most network packets - we'll grow it 465| | * if necessary. That way, we don't allocate a huge chunk of 466| | * memory just because there's a huge snapshot length, as the 467| | * snapshot length might be larger than the size of the largest 468| | * packet. 469| | */ 470| 4.13k| p->bufsize = p->snapshot; 471| 4.13k| if (p->bufsize > 2048) ------------------ | Branch (471:6): [True: 3.85k, False: 288] ------------------ 472| 3.85k| p->bufsize = 2048; 473| 4.13k| p->buffer = malloc(p->bufsize); 474| 4.13k| if (p->buffer == NULL) { ------------------ | Branch (474:6): [True: 0, False: 4.13k] ------------------ 475| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 476| 0| free(p); 477| 0| *err = 1; 478| 0| return (NULL); 479| 0| } 480| | 481| 4.13k| p->cleanup_op = pcapint_sf_cleanup; 482| | 483| 4.13k| return (p); 484| 4.13k|} sf-pcap.c:pcap_next_packet: 493| 43.8k|{ 494| 43.8k| struct pcap_sf *ps = p->priv; 495| 43.8k| struct pcap_sf_patched_pkthdr sf_hdr; 496| 43.8k| FILE *fp = p->rfile; 497| 43.8k| size_t amt_read; 498| 43.8k| bpf_u_int32 t; 499| | 500| | /* 501| | * Read the packet header; the structure we use as a buffer 502| | * is the longer structure for files generated by the patched 503| | * libpcap, but if the file has the magic number for an 504| | * unpatched libpcap we only read as many bytes as the regular 505| | * header has. 506| | */ 507| 43.8k| amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp); 508| 43.8k| if (amt_read != ps->hdrsize) { ------------------ | Branch (508:6): [True: 3.82k, False: 40.0k] ------------------ 509| 3.82k| if (ferror(fp)) { ------------------ | Branch (509:7): [True: 0, False: 3.82k] ------------------ 510| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 511| 0| errno, "error reading dump file"); 512| 0| return (-1); 513| 3.82k| } else { 514| 3.82k| if (amt_read != 0) { ------------------ | Branch (514:8): [True: 154, False: 3.66k] ------------------ 515| 154| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 154|#define PCAP_ERRBUF_SIZE 256 ------------------ 516| 154| "truncated dump file; tried to read %zu header bytes, only got %zu", 517| 154| ps->hdrsize, amt_read); 518| 154| return (-1); 519| 154| } 520| | /* EOF */ 521| 3.66k| return (0); 522| 3.82k| } 523| 3.82k| } 524| | 525| 40.0k| if (p->swapped) { ------------------ | Branch (525:6): [True: 30.0k, False: 10.0k] ------------------ 526| | /* these were written in opposite byte order */ 527| 30.0k| hdr->caplen = PCAP_BSWAP_32(sf_hdr.caplen); ------------------ | | 78| 30.0k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 528| 30.0k| hdr->len = PCAP_BSWAP_32(sf_hdr.len); ------------------ | | 78| 30.0k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 529| 30.0k| hdr->ts.tv_sec = PCAP_BSWAP_32(sf_hdr.ts.tv_sec); ------------------ | | 78| 30.0k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 530| 30.0k| hdr->ts.tv_usec = PCAP_BSWAP_32(sf_hdr.ts.tv_usec); ------------------ | | 78| 30.0k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 531| 30.0k| } else { 532| 10.0k| hdr->caplen = sf_hdr.caplen; 533| 10.0k| hdr->len = sf_hdr.len; 534| 10.0k| hdr->ts.tv_sec = sf_hdr.ts.tv_sec; 535| 10.0k| hdr->ts.tv_usec = sf_hdr.ts.tv_usec; 536| 10.0k| } 537| | 538| 40.0k| switch (ps->scale_type) { ------------------ | Branch (538:10): [True: 40.0k, False: 0] ------------------ 539| | 540| 29.7k| case PASS_THROUGH: ------------------ | Branch (540:2): [True: 29.7k, False: 10.2k] ------------------ 541| | /* 542| | * Just pass the time stamp through. 543| | */ 544| 29.7k| break; 545| | 546| 0| case SCALE_UP: ------------------ | Branch (546:2): [True: 0, False: 40.0k] ------------------ 547| | /* 548| | * File has microseconds, user wants nanoseconds; convert 549| | * it. 550| | */ 551| 0| hdr->ts.tv_usec = hdr->ts.tv_usec * 1000; 552| 0| break; 553| | 554| 10.2k| case SCALE_DOWN: ------------------ | Branch (554:2): [True: 10.2k, False: 29.7k] ------------------ 555| | /* 556| | * File has nanoseconds, user wants microseconds; convert 557| | * it. 558| | */ 559| 10.2k| hdr->ts.tv_usec = hdr->ts.tv_usec / 1000; 560| 10.2k| break; 561| 40.0k| } 562| | 563| | /* Swap the caplen and len fields, if necessary. */ 564| 40.0k| switch (ps->lengths_swapped) { ------------------ | Branch (564:10): [True: 40.0k, False: 0] ------------------ 565| | 566| 5.92k| case NOT_SWAPPED: ------------------ | Branch (566:2): [True: 5.92k, False: 34.1k] ------------------ 567| 5.92k| break; 568| | 569| 18.2k| case MAYBE_SWAPPED: ------------------ | Branch (569:2): [True: 18.2k, False: 21.8k] ------------------ 570| 18.2k| if (hdr->caplen <= hdr->len) { ------------------ | Branch (570:7): [True: 10.9k, False: 7.25k] ------------------ 571| | /* 572| | * The captured length is <= the actual length, 573| | * so presumably they weren't swapped. 574| | */ 575| 10.9k| break; 576| 10.9k| } 577| | /* FALLTHROUGH */ 578| | 579| 23.1k| case SWAPPED: ------------------ | Branch (579:2): [True: 15.9k, False: 24.1k] ------------------ 580| 23.1k| t = hdr->caplen; 581| 23.1k| hdr->caplen = hdr->len; 582| 23.1k| hdr->len = t; 583| 23.1k| break; 584| 40.0k| } 585| | 586| | /* 587| | * Is the packet bigger than we consider sane? 588| | */ 589| 40.0k| if (hdr->caplen > max_snaplen_for_dlt(p->linktype)) { ------------------ | Branch (589:6): [True: 97, False: 39.9k] ------------------ 590| | /* 591| | * Yes. This may be a damaged or fuzzed file. 592| | * 593| | * Is it bigger than the snapshot length? 594| | * (We don't treat that as an error if it's not 595| | * bigger than the maximum we consider sane; see 596| | * below.) 597| | */ 598| 97| if (hdr->caplen > (bpf_u_int32)p->snapshot) { ------------------ | Branch (598:7): [True: 78, False: 19] ------------------ 599| 78| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 78|#define PCAP_ERRBUF_SIZE 256 ------------------ 600| 78| "invalid packet capture length %u, bigger than " 601| 78| "snaplen of %d", hdr->caplen, p->snapshot); 602| 78| } else { 603| 19| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 19|#define PCAP_ERRBUF_SIZE 256 ------------------ 604| 19| "invalid packet capture length %u, bigger than " 605| 19| "maximum of %u", hdr->caplen, 606| 19| max_snaplen_for_dlt(p->linktype)); 607| 19| } 608| 97| return (-1); 609| 97| } 610| | 611| 39.9k| if (hdr->caplen > (bpf_u_int32)p->snapshot) { ------------------ | Branch (611:6): [True: 2.55k, False: 37.3k] ------------------ 612| | /* 613| | * The packet is bigger than the snapshot length 614| | * for this file. 615| | * 616| | * This can happen due to Solaris 2.3 systems tripping 617| | * over the BUFMOD problem and not setting the snapshot 618| | * length correctly in the savefile header. 619| | * 620| | * libpcap 0.4 and later on Solaris 2.3 should set the 621| | * snapshot length correctly in the pcap file header, 622| | * even though they don't set a snapshot length in bufmod 623| | * (the buggy bufmod chops off the *beginning* of the 624| | * packet if a snapshot length is specified); they should 625| | * also reduce the captured length, as supplied to the 626| | * per-packet callback, to the snapshot length if it's 627| | * greater than the snapshot length, so the code using 628| | * libpcap should see the packet cut off at the snapshot 629| | * length, even though the full packet is copied up to 630| | * userland. 631| | * 632| | * However, perhaps some versions of libpcap failed to 633| | * set the snapshot length correctly in the file header 634| | * or the per-packet header, or perhaps this is a 635| | * corrupted savefile or a savefile built/modified by a 636| | * fuzz tester, so we check anyway. We grow the buffer 637| | * to be big enough for the snapshot length, read up 638| | * to the snapshot length, discard the rest of the 639| | * packet, and report the snapshot length as the captured 640| | * length; we don't want to hand our caller a packet 641| | * bigger than the snapshot length, because they might 642| | * be assuming they'll never be handed such a packet, 643| | * and might copy the packet into a snapshot-length- 644| | * sized buffer, assuming it'll fit. 645| | */ 646| 2.55k| size_t bytes_to_discard; 647| 2.55k| size_t bytes_to_read, bytes_read; 648| 2.55k| char discard_buf[4096]; 649| | 650| 2.55k| if (hdr->caplen > p->bufsize) { ------------------ | Branch (650:7): [True: 2.55k, False: 0] ------------------ 651| | /* 652| | * Grow the buffer to the snapshot length. 653| | */ 654| 2.55k| if (!pcapint_grow_buffer(p, p->snapshot, p->errbuf)) ------------------ | Branch (654:8): [True: 0, False: 2.55k] ------------------ 655| 0| return (-1); 656| 2.55k| } 657| | 658| | /* 659| | * Read the first p->snapshot bytes into the buffer. 660| | */ 661| 2.55k| amt_read = fread(p->buffer, 1, p->snapshot, fp); 662| 2.55k| if (amt_read != (bpf_u_int32)p->snapshot) { ------------------ | Branch (662:7): [True: 56, False: 2.50k] ------------------ 663| 56| if (ferror(fp)) { ------------------ | Branch (663:8): [True: 0, False: 56] ------------------ 664| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, 665| 0| PCAP_ERRBUF_SIZE, errno, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 666| 0| "error reading dump file"); 667| 56| } else { 668| | /* 669| | * Yes, this uses hdr->caplen; technically, 670| | * it's true, because we would try to read 671| | * and discard the rest of those bytes, and 672| | * that would fail because we got EOF before 673| | * the read finished. 674| | */ 675| 56| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 56|#define PCAP_ERRBUF_SIZE 256 ------------------ 676| 56| "truncated dump file; tried to read %d captured bytes, only got %zu", 677| 56| p->snapshot, amt_read); 678| 56| } 679| 56| return (-1); 680| 56| } 681| | 682| | /* 683| | * Now read and discard what's left. 684| | */ 685| 2.50k| bytes_to_discard = hdr->caplen - p->snapshot; 686| 2.50k| bytes_read = amt_read; 687| 5.41k| while (bytes_to_discard != 0) { ------------------ | Branch (687:10): [True: 2.97k, False: 2.44k] ------------------ 688| 2.97k| bytes_to_read = bytes_to_discard; 689| 2.97k| if (bytes_to_read > sizeof (discard_buf)) ------------------ | Branch (689:8): [True: 502, False: 2.47k] ------------------ 690| 502| bytes_to_read = sizeof (discard_buf); 691| 2.97k| amt_read = fread(discard_buf, 1, bytes_to_read, fp); 692| 2.97k| bytes_read += amt_read; 693| 2.97k| if (amt_read != bytes_to_read) { ------------------ | Branch (693:8): [True: 57, False: 2.91k] ------------------ 694| 57| if (ferror(fp)) { ------------------ | Branch (694:9): [True: 0, False: 57] ------------------ 695| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, 696| 0| PCAP_ERRBUF_SIZE, errno, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 697| 0| "error reading dump file"); 698| 57| } else { 699| 57| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 57|#define PCAP_ERRBUF_SIZE 256 ------------------ 700| 57| "truncated dump file; tried to read %u captured bytes, only got %zu", 701| 57| hdr->caplen, bytes_read); 702| 57| } 703| 57| return (-1); 704| 57| } 705| 2.91k| bytes_to_discard -= amt_read; 706| 2.91k| } 707| | 708| | /* 709| | * Adjust caplen accordingly, so we don't get confused later 710| | * as to how many bytes we have to play with. 711| | */ 712| 2.44k| hdr->caplen = p->snapshot; 713| 37.3k| } else { 714| | /* 715| | * The packet is within the snapshot length for this file. 716| | */ 717| 37.3k| if (hdr->caplen > p->bufsize) { ------------------ | Branch (717:7): [True: 456, False: 36.9k] ------------------ 718| | /* 719| | * Grow the buffer to the next power of 2, or 720| | * the snaplen, whichever is lower. 721| | */ 722| 456| u_int new_bufsize; 723| | 724| 456| new_bufsize = hdr->caplen; 725| | /* 726| | * https://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2 727| | */ 728| 456| new_bufsize--; 729| 456| new_bufsize |= new_bufsize >> 1; 730| 456| new_bufsize |= new_bufsize >> 2; 731| 456| new_bufsize |= new_bufsize >> 4; 732| 456| new_bufsize |= new_bufsize >> 8; 733| 456| new_bufsize |= new_bufsize >> 16; 734| 456| new_bufsize++; 735| | 736| 456| if (new_bufsize > (u_int)p->snapshot) ------------------ | Branch (736:8): [True: 34, False: 422] ------------------ 737| 34| new_bufsize = p->snapshot; 738| | 739| 456| if (!pcapint_grow_buffer(p, new_bufsize, p->errbuf)) ------------------ | Branch (739:8): [True: 0, False: 456] ------------------ 740| 0| return (-1); 741| 456| } 742| | 743| | /* read the packet itself */ 744| 37.3k| amt_read = fread(p->buffer, 1, hdr->caplen, fp); 745| 37.3k| if (amt_read != hdr->caplen) { ------------------ | Branch (745:7): [True: 108, False: 37.2k] ------------------ 746| 108| if (ferror(fp)) { ------------------ | Branch (746:8): [True: 0, False: 108] ------------------ 747| 0| pcapint_fmt_errmsg_for_errno(p->errbuf, 748| 0| PCAP_ERRBUF_SIZE, errno, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 749| 0| "error reading dump file"); 750| 108| } else { 751| 108| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 108|#define PCAP_ERRBUF_SIZE 256 ------------------ 752| 108| "truncated dump file; tried to read %u captured bytes, only got %zu", 753| 108| hdr->caplen, amt_read); 754| 108| } 755| 108| return (-1); 756| 108| } 757| 37.3k| } 758| 39.7k| *data = p->buffer; 759| | 760| 39.7k| pcapint_post_process(p->linktype, p->swapped, hdr, *data); 761| | 762| 39.7k| return (1); 763| 39.9k|} pcap_ng_check_header: 778| 1.53k|{ 779| 1.53k| bpf_u_int32 magic_int; 780| 1.53k| size_t amt_read; 781| 1.53k| bpf_u_int32 total_length; 782| 1.53k| bpf_u_int32 byte_order_magic; 783| 1.53k| struct block_header *bhdrp; 784| 1.53k| struct section_header_block *shbp; 785| 1.53k| pcap_t *p; 786| 1.53k| int swapped = 0; 787| 1.53k| struct pcap_ng_sf *ps; 788| 1.53k| int status; 789| 1.53k| struct block_cursor cursor; 790| 1.53k| struct interface_description_block *idbp; 791| | 792| | /* 793| | * Assume no read errors. 794| | */ 795| 1.53k| *err = 0; 796| | 797| | /* 798| | * Check whether the first 4 bytes of the file are the block 799| | * type for a pcapng savefile. 800| | */ 801| 1.53k| memcpy(&magic_int, magic, sizeof(magic_int)); 802| 1.53k| if (magic_int != BT_SHB) { ------------------ | | 86| 1.53k|#define BT_SHB 0x0A0D0D0A ------------------ | Branch (802:6): [True: 211, False: 1.32k] ------------------ 803| | /* 804| | * XXX - check whether this looks like what the block 805| | * type would be after being munged by mapping between 806| | * UN*X and DOS/Windows text file format and, if it 807| | * does, look for the byte-order magic number in 808| | * the appropriate place and, if we find it, report 809| | * this as possibly being a pcapng file transferred 810| | * between UN*X and Windows in text file format? 811| | */ 812| 211| return (NULL); /* nope */ 813| 211| } 814| | 815| | /* 816| | * OK, they are. However, that's just \n\r\r\n, so it could, 817| | * conceivably, be an ordinary text file. 818| | * 819| | * It could not, however, conceivably be any other type of 820| | * capture file, so we can read the rest of the putative 821| | * Section Header Block; put the block type in the common 822| | * header, read the rest of the common header and the 823| | * fixed-length portion of the SHB, and look for the byte-order 824| | * magic value. 825| | */ 826| 1.32k| amt_read = fread(&total_length, 1, sizeof(total_length), fp); 827| 1.32k| if (amt_read < sizeof(total_length)) { ------------------ | Branch (827:6): [True: 0, False: 1.32k] ------------------ 828| 0| if (ferror(fp)) { ------------------ | Branch (828:7): [True: 0, False: 0] ------------------ 829| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 830| 0| errno, "error reading dump file"); 831| 0| *err = 1; 832| 0| return (NULL); /* fail */ 833| 0| } 834| | 835| | /* 836| | * Possibly a weird short text file, so just say 837| | * "not pcapng". 838| | */ 839| 0| return (NULL); 840| 0| } 841| 1.32k| amt_read = fread(&byte_order_magic, 1, sizeof(byte_order_magic), fp); 842| 1.32k| if (amt_read < sizeof(byte_order_magic)) { ------------------ | Branch (842:6): [True: 0, False: 1.32k] ------------------ 843| 0| if (ferror(fp)) { ------------------ | Branch (843:7): [True: 0, False: 0] ------------------ 844| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 845| 0| errno, "error reading dump file"); 846| 0| *err = 1; 847| 0| return (NULL); /* fail */ 848| 0| } 849| | 850| | /* 851| | * Possibly a weird short text file, so just say 852| | * "not pcapng". 853| | */ 854| 0| return (NULL); 855| 0| } 856| 1.32k| if (byte_order_magic != BYTE_ORDER_MAGIC) { ------------------ | | 99| 1.32k|#define BYTE_ORDER_MAGIC 0x1A2B3C4D ------------------ | Branch (856:6): [True: 504, False: 821] ------------------ 857| 504| byte_order_magic = PCAP_BSWAP_32(byte_order_magic); ------------------ | | 78| 504|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 858| 504| if (byte_order_magic != BYTE_ORDER_MAGIC) { ------------------ | | 99| 504|#define BYTE_ORDER_MAGIC 0x1A2B3C4D ------------------ | Branch (858:7): [True: 94, False: 410] ------------------ 859| | /* 860| | * Not a pcapng file. 861| | */ 862| 94| return (NULL); 863| 94| } 864| 410| swapped = 1; 865| 410| total_length = PCAP_BSWAP_32(total_length); ------------------ | | 78| 410|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 866| 410| } 867| | 868| | /* 869| | * Check the sanity of the total length. 870| | */ 871| 1.23k| if (total_length < sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer) || ------------------ | Branch (871:6): [True: 6, False: 1.22k] ------------------ 872| 1.22k| (total_length > BT_SHB_INSANE_MAX)) { ------------------ | | 87| 1.22k|#define BT_SHB_INSANE_MAX 1024U*1024U*1U /* 1MB should be enough */ ------------------ | Branch (872:13): [True: 43, False: 1.18k] ------------------ 873| 49| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 49|#define PCAP_ERRBUF_SIZE 256 ------------------ 874| 49| "Section Header Block in pcapng dump file has invalid length %zu < _%u_ < %u (BT_SHB_INSANE_MAX)", 875| 49| sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer), 876| 49| total_length, 877| 49| BT_SHB_INSANE_MAX); ------------------ | | 87| 49|#define BT_SHB_INSANE_MAX 1024U*1024U*1U /* 1MB should be enough */ ------------------ 878| | 879| 49| *err = 1; 880| 49| return (NULL); 881| 49| } 882| | 883| | /* 884| | * OK, this is a good pcapng file. 885| | * Allocate a pcap_t for it. 886| | */ 887| 1.18k| p = PCAP_OPEN_OFFLINE_COMMON(errbuf, struct pcap_ng_sf); ------------------ | | 570| 1.18k| pcapint_open_offline_common(ebuf, \ | | 571| 1.18k| sizeof (struct { pcap_t __common; type __private; }), \ | | 572| 1.18k| offsetof (struct { pcap_t __common; type __private; }, __private)) ------------------ 888| 1.18k| if (p == NULL) { ------------------ | Branch (888:6): [True: 0, False: 1.18k] ------------------ 889| | /* Allocation failed. */ 890| 0| *err = 1; 891| 0| return (NULL); 892| 0| } 893| 1.18k| p->swapped = swapped; 894| 1.18k| ps = p->priv; 895| | 896| | /* 897| | * What precision does the user want? 898| | */ 899| 1.18k| switch (precision) { 900| | 901| 1.18k| case PCAP_TSTAMP_PRECISION_MICRO: ------------------ | | 539| 1.18k|#define PCAP_TSTAMP_PRECISION_MICRO 0 /* use timestamps with microsecond precision, default */ ------------------ | Branch (901:2): [True: 1.18k, False: 0] ------------------ 902| 1.18k| ps->user_tsresol = 1000000; 903| 1.18k| break; 904| | 905| 0| case PCAP_TSTAMP_PRECISION_NANO: ------------------ | | 540| 0|#define PCAP_TSTAMP_PRECISION_NANO 1 /* use timestamps with nanosecond precision */ ------------------ | Branch (905:2): [True: 0, False: 1.18k] ------------------ 906| 0| ps->user_tsresol = 1000000000; 907| 0| break; 908| | 909| 0| default: ------------------ | Branch (909:2): [True: 0, False: 1.18k] ------------------ 910| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 911| 0| "unknown time stamp resolution %u", precision); 912| 0| free(p); 913| 0| *err = 1; 914| 0| return (NULL); 915| 1.18k| } 916| | 917| 1.18k| p->opt.tstamp_precision = precision; 918| | 919| | /* 920| | * Allocate a buffer into which to read blocks. We default to 921| | * the maximum of: 922| | * 923| | * the total length of the SHB for which we read the header; 924| | * 925| | * 2K, which should be more than large enough for an Enhanced 926| | * Packet Block containing a full-size Ethernet frame, and 927| | * leaving room for some options. 928| | * 929| | * If we find a bigger block, we reallocate the buffer, up to 930| | * the maximum size. We start out with a maximum size of 931| | * INITIAL_MAX_BLOCKSIZE; if we see any link-layer header types 932| | * with a maximum snapshot that results in a larger maximum 933| | * block length, we boost the maximum. 934| | */ 935| 1.18k| p->bufsize = 2048; 936| 1.18k| if (p->bufsize < total_length) ------------------ | Branch (936:6): [True: 37, False: 1.14k] ------------------ 937| 37| p->bufsize = total_length; 938| 1.18k| p->buffer = malloc(p->bufsize); 939| 1.18k| if (p->buffer == NULL) { ------------------ | Branch (939:6): [True: 0, False: 1.18k] ------------------ 940| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory"); ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 941| 0| free(p); 942| 0| *err = 1; 943| 0| return (NULL); 944| 0| } 945| 1.18k| ps->max_blocksize = INITIAL_MAX_BLOCKSIZE; ------------------ | | 238| 1.18k|#define INITIAL_MAX_BLOCKSIZE (16*1024*1024) ------------------ 946| | 947| | /* 948| | * Copy the stuff we've read to the buffer, and read the rest 949| | * of the SHB. 950| | */ 951| 1.18k| bhdrp = (struct block_header *)p->buffer; 952| 1.18k| shbp = (struct section_header_block *)(p->buffer + sizeof(struct block_header)); 953| 1.18k| bhdrp->block_type = magic_int; 954| 1.18k| bhdrp->total_length = total_length; 955| 1.18k| shbp->byte_order_magic = byte_order_magic; 956| 1.18k| if (read_bytes(fp, ------------------ | Branch (956:6): [True: 52, False: 1.13k] ------------------ 957| 1.18k| p->buffer + (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)), 958| 1.18k| total_length - (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)), 959| 1.18k| 1, errbuf) == -1) 960| 52| goto fail; 961| | 962| 1.13k| if (p->swapped) { ------------------ | Branch (962:6): [True: 391, False: 739] ------------------ 963| | /* 964| | * Byte-swap the fields we've read. 965| | */ 966| 391| shbp->major_version = PCAP_BSWAP_16(shbp->major_version); ------------------ | | 88| 391|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 967| 391| shbp->minor_version = PCAP_BSWAP_16(shbp->minor_version); ------------------ | | 88| 391|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 968| | 969| | /* 970| | * XXX - we don't care about the section length. 971| | */ 972| 391| } 973| | /* Currently only SHB versions 1.0 and 1.2 are supported; 974| | version 1.2 is treated as being the same as version 1.0. 975| | See the current version of the pcapng specification. 976| | 977| | Version 1.2 is written by some programs that write additional 978| | block types (which can be read by any code that handles them, 979| | regardless of whether the minor version if 0 or 2, so that's 980| | not a reason to change the minor version number). 981| | 982| | XXX - the pcapng specification says that readers should 983| | just ignore sections with an unsupported version number; 984| | presumably they can also report an error if they skip 985| | all the way to the end of the file without finding 986| | any versions that they support. */ 987| 1.13k| if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR && ------------------ | | 106| 2.26k|#define PCAP_NG_VERSION_MAJOR 1 ------------------ | Branch (987:9): [True: 1.11k, False: 16] ------------------ 988| 1.11k| (shbp->minor_version == PCAP_NG_VERSION_MINOR || ------------------ | | 107| 2.22k|#define PCAP_NG_VERSION_MINOR 0 ------------------ | Branch (988:10): [True: 1.05k, False: 60] ------------------ 989| 60| shbp->minor_version == 2))) { ------------------ | Branch (989:10): [True: 38, False: 22] ------------------ 990| 38| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 38|#define PCAP_ERRBUF_SIZE 256 ------------------ 991| 38| "unsupported pcapng savefile version %u.%u", 992| 38| shbp->major_version, shbp->minor_version); 993| 38| goto fail; 994| 38| } 995| 1.09k| p->version_major = shbp->major_version; 996| 1.09k| p->version_minor = shbp->minor_version; 997| | 998| | /* 999| | * Save the time stamp resolution the user requested. 1000| | */ 1001| 1.09k| p->opt.tstamp_precision = precision; 1002| | 1003| | /* 1004| | * Now start looking for an Interface Description Block. 1005| | */ 1006| 1.85k| for (;;) { 1007| | /* 1008| | * Read the next block. 1009| | */ 1010| 1.85k| status = read_block(fp, p, &cursor, errbuf); 1011| 1.85k| if (status == 0) { ------------------ | Branch (1011:7): [True: 16, False: 1.83k] ------------------ 1012| | /* EOF - no IDB in this file */ 1013| 16| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 16|#define PCAP_ERRBUF_SIZE 256 ------------------ 1014| 16| "the capture file has no Interface Description Blocks"); 1015| 16| goto fail; 1016| 16| } 1017| 1.83k| if (status == -1) ------------------ | Branch (1017:7): [True: 165, False: 1.66k] ------------------ 1018| 165| goto fail; /* error */ 1019| 1.66k| switch (cursor.block_type) { 1020| | 1021| 908| case BT_IDB: ------------------ | | 112| 908|#define BT_IDB 0x00000001 ------------------ | Branch (1021:3): [True: 908, False: 761] ------------------ 1022| | /* 1023| | * Get a pointer to the fixed-length portion of the 1024| | * IDB. 1025| | */ 1026| 908| idbp = get_from_block_data(&cursor, sizeof(*idbp), 1027| 908| errbuf); 1028| 908| if (idbp == NULL) ------------------ | Branch (1028:8): [True: 2, False: 906] ------------------ 1029| 2| goto fail; /* error */ 1030| | 1031| | /* 1032| | * Byte-swap it if necessary. 1033| | */ 1034| 906| if (p->swapped) { ------------------ | Branch (1034:8): [True: 323, False: 583] ------------------ 1035| 323| idbp->linktype = PCAP_BSWAP_16(idbp->linktype); ------------------ | | 88| 323|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 1036| 323| idbp->snaplen = PCAP_BSWAP_32(idbp->snaplen); ------------------ | | 78| 323|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1037| 323| } 1038| | 1039| | /* 1040| | * Try to add this interface. 1041| | */ 1042| 906| if (!add_interface(p, idbp, &cursor, errbuf)) ------------------ | Branch (1042:8): [True: 85, False: 821] ------------------ 1043| 85| goto fail; 1044| | 1045| 821| goto done; 1046| | 1047| 821| case BT_EPB: ------------------ | | 141| 1|#define BT_EPB 0x00000006 ------------------ | Branch (1047:3): [True: 1, False: 1.66k] ------------------ 1048| 2| case BT_SPB: ------------------ | | 155| 2|#define BT_SPB 0x00000003 ------------------ | Branch (1048:3): [True: 1, False: 1.66k] ------------------ 1049| 3| case BT_PB: ------------------ | | 165| 3|#define BT_PB 0x00000002 ------------------ | Branch (1049:3): [True: 1, False: 1.66k] ------------------ 1050| | /* 1051| | * Saw a packet before we saw any IDBs. That's 1052| | * not valid, as we don't know what link-layer 1053| | * encapsulation the packet has. 1054| | */ 1055| 3| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 3|#define PCAP_ERRBUF_SIZE 256 ------------------ 1056| 3| "the capture file has a packet block before any Interface Description Blocks"); 1057| 3| goto fail; 1058| | 1059| 758| default: ------------------ | Branch (1059:3): [True: 758, False: 911] ------------------ 1060| | /* 1061| | * Just ignore it. 1062| | */ 1063| 758| break; 1064| 1.66k| } 1065| 1.66k| } 1066| | 1067| 821|done: 1068| 821| p->linktype = linktype_to_dlt(idbp->linktype); 1069| 821| p->snapshot = pcapint_adjust_snapshot(p->linktype, idbp->snaplen); 1070| 821| p->linktype_ext = 0; 1071| | 1072| | /* 1073| | * If the maximum block size for a packet with the maximum 1074| | * snapshot length for this DLT_ is bigger than the current 1075| | * maximum block size, increase the maximum. 1076| | */ 1077| 821| if (MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)) > ps->max_blocksize) ------------------ | | 246| 821| (sizeof (struct block_header) + \ | | 247| 821| sizeof (struct enhanced_packet_block) + \ | | 248| 821| (max_snaplen) + 131072 + \ | | 249| 821| sizeof (struct block_trailer)) ------------------ | Branch (1077:6): [True: 51, False: 770] ------------------ 1078| 51| ps->max_blocksize = MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)); ------------------ | | 246| 51| (sizeof (struct block_header) + \ | | 247| 51| sizeof (struct enhanced_packet_block) + \ | | 248| 51| (max_snaplen) + 131072 + \ | | 249| 51| sizeof (struct block_trailer)) ------------------ 1079| | 1080| 821| p->next_packet_op = pcap_ng_next_packet; 1081| 821| p->cleanup_op = pcap_ng_cleanup; 1082| | 1083| 821| return (p); 1084| | 1085| 361|fail: 1086| 361| free(ps->ifaces); 1087| 361| free(p->buffer); 1088| 361| free(p); 1089| 361| *err = 1; 1090| | return (NULL); 1091| 1.09k|} sf-pcapng.c:read_bytes: 258| 17.9k|{ 259| 17.9k| size_t amt_read; 260| | 261| 17.9k| amt_read = fread(buf, 1, bytes_to_read, fp); 262| 17.9k| if (amt_read != bytes_to_read) { ------------------ | Branch (262:6): [True: 515, False: 17.4k] ------------------ 263| 515| if (ferror(fp)) { ------------------ | Branch (263:7): [True: 0, False: 515] ------------------ 264| 0| pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 265| 0| errno, "error reading dump file"); 266| 515| } else { 267| 515| if (amt_read == 0 && !fail_on_eof) ------------------ | Branch (267:8): [True: 409, False: 106] | Branch (267:25): [True: 371, False: 38] ------------------ 268| 371| return (0); /* EOF */ 269| 144| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 144|#define PCAP_ERRBUF_SIZE 256 ------------------ 270| 144| "truncated pcapng dump file; tried to read %zu bytes, only got %zu", 271| 144| bytes_to_read, amt_read); 272| 144| } 273| 144| return (-1); 274| 515| } 275| 17.4k| return (1); 276| 17.9k|} sf-pcapng.c:read_block: 280| 8.63k|{ 281| 8.63k| struct pcap_ng_sf *ps; 282| 8.63k| int status; 283| 8.63k| struct block_header bhdr; 284| 8.63k| struct block_trailer *btrlr; 285| 8.63k| u_char *bdata; 286| 8.63k| size_t data_remaining; 287| | 288| 8.63k| ps = p->priv; 289| | 290| 8.63k| status = read_bytes(fp, &bhdr, sizeof(bhdr), 0, errbuf); 291| 8.63k| if (status <= 0) ------------------ | Branch (291:6): [True: 413, False: 8.22k] ------------------ 292| 413| return (status); /* error or EOF */ 293| | 294| 8.22k| if (p->swapped) { ------------------ | Branch (294:6): [True: 3.41k, False: 4.81k] ------------------ 295| 3.41k| bhdr.block_type = PCAP_BSWAP_32(bhdr.block_type); ------------------ | | 78| 3.41k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 296| 3.41k| bhdr.total_length = PCAP_BSWAP_32(bhdr.total_length); ------------------ | | 78| 3.41k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 297| 3.41k| } 298| | 299| | /* 300| | * Is this block "too small" - i.e., is it shorter than a block 301| | * header plus a block trailer? 302| | */ 303| 8.22k| if (bhdr.total_length < sizeof(struct block_header) + ------------------ | Branch (303:6): [True: 7, False: 8.21k] ------------------ 304| 8.22k| sizeof(struct block_trailer)) { 305| 7| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 7|#define PCAP_ERRBUF_SIZE 256 ------------------ 306| 7| "block in pcapng dump file has a length of %u < %zu", 307| 7| bhdr.total_length, 308| 7| sizeof(struct block_header) + sizeof(struct block_trailer)); 309| 7| return (-1); 310| 7| } 311| | 312| | /* 313| | * Is the block total length a multiple of 4? 314| | */ 315| 8.21k| if ((bhdr.total_length % 4) != 0) { ------------------ | Branch (315:6): [True: 17, False: 8.19k] ------------------ 316| | /* 317| | * No. Report that as an error. 318| | */ 319| 17| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 17|#define PCAP_ERRBUF_SIZE 256 ------------------ 320| 17| "block in pcapng dump file has a length of %u that is not a multiple of 4", 321| 17| bhdr.total_length); 322| 17| return (-1); 323| 17| } 324| | 325| | /* 326| | * Is the buffer big enough? 327| | */ 328| 8.19k| if (p->bufsize < bhdr.total_length) { ------------------ | Branch (328:6): [True: 125, False: 8.07k] ------------------ 329| | /* 330| | * No - make it big enough, unless it's too big, in 331| | * which case we fail. 332| | */ 333| 125| if (bhdr.total_length > ps->max_blocksize) { ------------------ | Branch (333:7): [True: 51, False: 74] ------------------ 334| 51| snprintf(errbuf, PCAP_ERRBUF_SIZE, "pcapng block size %u > maximum %u", bhdr.total_length, ------------------ | | 149| 51|#define PCAP_ERRBUF_SIZE 256 ------------------ 335| 51| ps->max_blocksize); 336| 51| return (-1); 337| 51| } 338| 74| if (!pcapint_grow_buffer(p, bhdr.total_length, errbuf)) ------------------ | Branch (338:7): [True: 0, False: 74] ------------------ 339| 0| return (-1); 340| 74| } 341| | 342| | /* 343| | * Copy the stuff we've read to the buffer, and read the rest 344| | * of the block. 345| | */ 346| 8.14k| memcpy(p->buffer, &bhdr, sizeof(bhdr)); 347| 8.14k| bdata = p->buffer + sizeof(bhdr); 348| 8.14k| data_remaining = bhdr.total_length - sizeof(bhdr); 349| 8.14k| if (read_bytes(fp, bdata, data_remaining, 1, errbuf) == -1) ------------------ | Branch (349:6): [True: 50, False: 8.09k] ------------------ 350| 50| return (-1); 351| | 352| | /* 353| | * Get the block size from the trailer. 354| | */ 355| 8.09k| btrlr = (struct block_trailer *)(bdata + data_remaining - sizeof (struct block_trailer)); 356| 8.09k| if (p->swapped) ------------------ | Branch (356:6): [True: 3.37k, False: 4.72k] ------------------ 357| 3.37k| btrlr->total_length = PCAP_BSWAP_32(btrlr->total_length); ------------------ | | 78| 3.37k|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 358| | 359| | /* 360| | * Is the total length from the trailer the same as the total 361| | * length from the header? 362| | */ 363| 8.09k| if (bhdr.total_length != btrlr->total_length) { ------------------ | Branch (363:6): [True: 54, False: 8.04k] ------------------ 364| | /* 365| | * No. 366| | */ 367| 54| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 54|#define PCAP_ERRBUF_SIZE 256 ------------------ 368| 54| "block total length in header %u and trailer %u don't match", 369| 54| bhdr.total_length, btrlr->total_length); 370| 54| return (-1); 371| 54| } 372| | 373| | /* 374| | * Initialize the cursor. 375| | */ 376| 8.04k| cursor->data = bdata; 377| 8.04k| cursor->data_remaining = data_remaining - sizeof(struct block_trailer); 378| 8.04k| cursor->block_type = bhdr.block_type; 379| 8.04k| return (1); 380| 8.09k|} sf-pcapng.c:get_from_block_data: 385| 15.2k|{ 386| 15.2k| void *data; 387| | 388| | /* 389| | * Make sure we have the specified amount of data remaining in 390| | * the block data. 391| | */ 392| 15.2k| if (cursor->data_remaining < chunk_size) { ------------------ | Branch (392:6): [True: 145, False: 15.0k] ------------------ 393| 145| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 145|#define PCAP_ERRBUF_SIZE 256 ------------------ 394| 145| "block of type %u in pcapng dump file is too short", 395| 145| cursor->block_type); 396| 145| return (NULL); 397| 145| } 398| | 399| | /* 400| | * Return the current pointer, and skip past the chunk. 401| | */ 402| 15.0k| data = cursor->data; 403| 15.0k| cursor->data += chunk_size; 404| 15.0k| cursor->data_remaining -= chunk_size; 405| 15.0k| return (data); 406| 15.2k|} sf-pcapng.c:add_interface: 588| 3.77k|{ 589| 3.77k| struct pcap_ng_sf *ps; 590| 3.77k| bpf_u_int32 new_ifcount; 591| 3.77k| bpf_u_int32 new_if_index; 592| 3.77k| uint64_t tsresol; 593| 3.77k| int64_t tsoffset; 594| 3.77k| int is_binary; 595| | 596| 3.77k| ps = p->priv; 597| | 598| | /* 599| | * Count this interface. 600| | */ 601| 3.77k| new_ifcount = ps->ifcount + 1; 602| | 603| | /* 604| | * The array of interfaces is 0-based, so the current number of 605| | * interfaces will be the index of the new interface. 606| | */ 607| 3.77k| new_if_index = ps->ifcount; 608| | 609| | /* 610| | * Grow the array of per-interface information as necessary. 611| | */ 612| 3.77k| if (new_ifcount > ps->ifaces_size) { ------------------ | Branch (612:6): [True: 1.29k, False: 2.48k] ------------------ 613| | /* 614| | * We need to grow the array. 615| | */ 616| 1.29k| bpf_u_int32 new_ifaces_size; 617| 1.29k| struct pcap_ng_if *new_ifaces; 618| | 619| 1.29k| if (ps->ifaces_size == 0) { ------------------ | Branch (619:7): [True: 906, False: 392] ------------------ 620| | /* 621| | * It's currently empty. 622| | * 623| | * (The Clang static analyzer doesn't do enough, 624| | * err, umm, dataflow *analysis* to realize that 625| | * ps->ifaces_size == 0 if ps->ifaces == NULL, 626| | * and so complains about a possible zero argument 627| | * to realloc(), so we check for the former 628| | * condition to shut it up. 629| | * 630| | * However, it doesn't complain that one of the 631| | * multiplications below could overflow, which is 632| | * a real, albeit extremely unlikely, problem (you'd 633| | * need a pcapng file with tens of millions of 634| | * interfaces).) 635| | */ 636| 906| new_ifaces_size = 1; 637| 906| new_ifaces = malloc(sizeof (struct pcap_ng_if)); 638| 906| } else { 639| | /* 640| | * It's not currently empty; double its size. 641| | * (Perhaps overkill once we have a lot of interfaces.) 642| | * 643| | * Check for overflow if we double it. 644| | */ 645| 392| if (ps->ifaces_size * 2 < ps->ifaces_size) { ------------------ | Branch (645:8): [True: 0, False: 392] ------------------ 646| | /* 647| | * The maximum number of interfaces before 648| | * ps->ifaces_size overflows is the largest 649| | * possible 32-bit power of 2, as we do 650| | * size doubling. 651| | */ 652| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 653| 0| "more than %u interfaces in the file", 654| 0| 0x80000000U); 655| 0| return (0); 656| 0| } 657| | 658| | /* 659| | * ps->ifaces_size * 2 doesn't overflow, so it's 660| | * safe to multiply. 661| | */ 662| 392| new_ifaces_size = ps->ifaces_size * 2; 663| | 664| | /* 665| | * Now make sure that's not so big that it overflows 666| | * if we multiply by sizeof (struct pcap_ng_if). 667| | * 668| | * That can happen on 32-bit platforms, with a 32-bit 669| | * size_t; it shouldn't happen on 64-bit platforms, 670| | * with a 64-bit size_t, as new_ifaces_size is 671| | * 32 bits. 672| | */ 673| 392| if (new_ifaces_size * sizeof (struct pcap_ng_if) < new_ifaces_size) { ------------------ | Branch (673:8): [True: 0, False: 392] ------------------ 674| | /* 675| | * As this fails only with 32-bit size_t, 676| | * the multiplication was 32x32->32, and 677| | * the largest 32-bit value that can safely 678| | * be multiplied by sizeof (struct pcap_ng_if) 679| | * without overflow is the largest 32-bit 680| | * (unsigned) value divided by 681| | * sizeof (struct pcap_ng_if). 682| | */ 683| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 684| 0| "more than %u interfaces in the file", 685| 0| 0xFFFFFFFFU / ((u_int)sizeof (struct pcap_ng_if))); 686| 0| return (0); 687| 0| } 688| 392| new_ifaces = realloc(ps->ifaces, new_ifaces_size * sizeof (struct pcap_ng_if)); 689| 392| } 690| 1.29k| if (new_ifaces == NULL) { ------------------ | Branch (690:7): [True: 0, False: 1.29k] ------------------ 691| | /* 692| | * We ran out of memory. 693| | * Give up. 694| | */ 695| 0| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 0|#define PCAP_ERRBUF_SIZE 256 ------------------ 696| 0| "out of memory for per-interface information (%u interfaces)", 697| 0| new_ifcount); 698| 0| return (0); 699| 0| } 700| 1.29k| ps->ifaces_size = new_ifaces_size; 701| 1.29k| ps->ifaces = new_ifaces; 702| 1.29k| } 703| | 704| 3.77k| ps->ifaces[new_if_index].snaplen = idbp->snaplen; 705| | 706| | /* 707| | * Set the default time stamp resolution and offset. 708| | */ 709| 3.77k| tsresol = 1000000; /* microsecond resolution */ 710| 3.77k| is_binary = 0; /* which is a power of 10 */ 711| 3.77k| tsoffset = 0; /* absolute timestamps */ 712| | 713| | /* 714| | * Now look for various time stamp options, so we know 715| | * how to interpret the time stamps for this interface. 716| | */ 717| 3.77k| if (process_idb_options(p, cursor, &tsresol, &tsoffset, &is_binary, ------------------ | Branch (717:6): [True: 87, False: 3.69k] ------------------ 718| 3.77k| errbuf) == -1) 719| 87| return (0); 720| | 721| 3.69k| ps->ifaces[new_if_index].tsresol = tsresol; 722| 3.69k| ps->ifaces[new_if_index].tsoffset = tsoffset; 723| | 724| | /* 725| | * Determine whether we're scaling up or down or not 726| | * at all for this interface. 727| | */ 728| 3.69k| if (tsresol == ps->user_tsresol) { ------------------ | Branch (728:6): [True: 2.48k, False: 1.20k] ------------------ 729| | /* 730| | * The resolution is the resolution the user wants, 731| | * so we don't have to do scaling. 732| | */ 733| 2.48k| ps->ifaces[new_if_index].scale_type = PASS_THROUGH; 734| 2.48k| } else if (tsresol > ps->user_tsresol) { ------------------ | Branch (734:13): [True: 578, False: 630] ------------------ 735| | /* 736| | * The resolution is greater than what the user wants, 737| | * so we have to scale the timestamps down. 738| | */ 739| 578| if (is_binary) ------------------ | Branch (739:7): [True: 265, False: 313] ------------------ 740| 265| ps->ifaces[new_if_index].scale_type = SCALE_DOWN_BIN; 741| 313| else { 742| | /* 743| | * Calculate the scale factor. 744| | */ 745| 313| ps->ifaces[new_if_index].scale_factor = tsresol/ps->user_tsresol; 746| 313| ps->ifaces[new_if_index].scale_type = SCALE_DOWN_DEC; 747| 313| } 748| 630| } else { 749| | /* 750| | * The resolution is less than what the user wants, 751| | * so we have to scale the timestamps up. 752| | */ 753| 630| if (is_binary) ------------------ | Branch (753:7): [True: 209, False: 421] ------------------ 754| 209| ps->ifaces[new_if_index].scale_type = SCALE_UP_BIN; 755| 421| else { 756| | /* 757| | * Calculate the scale factor. 758| | */ 759| 421| ps->ifaces[new_if_index].scale_factor = ps->user_tsresol/tsresol; 760| 421| ps->ifaces[new_if_index].scale_type = SCALE_UP_DEC; 761| 421| } 762| 630| } 763| | 764| | /* 765| | * We've succeeded, so update the interface count. 766| | */ 767| 3.69k| ps->ifcount = new_ifcount; 768| 3.69k| return (1); 769| 3.77k|} sf-pcapng.c:process_idb_options: 457| 3.77k|{ 458| 3.77k| struct option_header *opthdr; 459| 3.77k| void *optvalue; 460| 3.77k| int saw_tsresol, saw_tsoffset; 461| 3.77k| uint8_t tsresol_opt; 462| 3.77k| u_int i; 463| | 464| 3.77k| saw_tsresol = 0; 465| 3.77k| saw_tsoffset = 0; 466| 6.37k| while (cursor->data_remaining != 0) { ------------------ | Branch (466:9): [True: 2.93k, False: 3.43k] ------------------ 467| | /* 468| | * Get the option header. 469| | */ 470| 2.93k| opthdr = get_opthdr_from_block_data(p, cursor, errbuf); 471| 2.93k| if (opthdr == NULL) { ------------------ | Branch (471:7): [True: 0, False: 2.93k] ------------------ 472| | /* 473| | * Option header is cut short. 474| | */ 475| 0| return (-1); 476| 0| } 477| | 478| | /* 479| | * Get option value. 480| | */ 481| 2.93k| optvalue = get_optvalue_from_block_data(cursor, opthdr, 482| 2.93k| errbuf); 483| 2.93k| if (optvalue == NULL) { ------------------ | Branch (483:7): [True: 30, False: 2.90k] ------------------ 484| | /* 485| | * Option value is cut short. 486| | */ 487| 30| return (-1); 488| 30| } 489| | 490| 2.90k| switch (opthdr->option_code) { 491| | 492| 280| case OPT_ENDOFOPT: ------------------ | | 67| 280|#define OPT_ENDOFOPT 0 /* end of options */ ------------------ | Branch (492:3): [True: 280, False: 2.62k] ------------------ 493| 280| if (opthdr->option_length != 0) { ------------------ | Branch (493:8): [True: 25, False: 255] ------------------ 494| 25| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 25|#define PCAP_ERRBUF_SIZE 256 ------------------ 495| 25| "Interface Description Block has opt_endofopt option with length %u != 0", 496| 25| opthdr->option_length); 497| 25| return (-1); 498| 25| } 499| 255| goto done; 500| | 501| 1.22k| case IF_TSRESOL: ------------------ | | 131| 1.22k|#define IF_TSRESOL 9 /* interface's time stamp resolution */ ------------------ | Branch (501:3): [True: 1.22k, False: 1.67k] ------------------ 502| 1.22k| if (opthdr->option_length != 1) { ------------------ | Branch (502:8): [True: 8, False: 1.22k] ------------------ 503| 8| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 8|#define PCAP_ERRBUF_SIZE 256 ------------------ 504| 8| "Interface Description Block has if_tsresol option with length %u != 1", 505| 8| opthdr->option_length); 506| 8| return (-1); 507| 8| } 508| 1.22k| if (saw_tsresol) { ------------------ | Branch (508:8): [True: 1, False: 1.22k] ------------------ 509| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 510| 1| "Interface Description Block has more than one if_tsresol option"); 511| 1| return (-1); 512| 1| } 513| 1.22k| saw_tsresol = 1; 514| 1.22k| memcpy(&tsresol_opt, optvalue, sizeof(tsresol_opt)); 515| 1.22k| if (tsresol_opt & 0x80) { ------------------ | Branch (515:8): [True: 482, False: 738] ------------------ 516| | /* 517| | * Resolution is negative power of 2. 518| | */ 519| 482| uint8_t tsresol_shift = (tsresol_opt & 0x7F); 520| | 521| 482| if (tsresol_shift > 63) { ------------------ | Branch (521:9): [True: 7, False: 475] ------------------ 522| | /* 523| | * Resolution is too high; 2^-{res} 524| | * won't fit in a 64-bit value. 525| | */ 526| 7| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 7|#define PCAP_ERRBUF_SIZE 256 ------------------ 527| 7| "Interface Description Block if_tsresol option resolution 2^-%u is too high", 528| 7| tsresol_shift); 529| 7| return (-1); 530| 7| } 531| 475| *is_binary = 1; 532| 475| *tsresol = ((uint64_t)1) << tsresol_shift; 533| 738| } else { 534| | /* 535| | * Resolution is negative power of 10. 536| | */ 537| 738| if (tsresol_opt > 19) { ------------------ | Branch (537:9): [True: 1, False: 737] ------------------ 538| | /* 539| | * Resolution is too high; 2^-{res} 540| | * won't fit in a 64-bit value (the 541| | * largest power of 10 that fits 542| | * in a 64-bit value is 10^19, as 543| | * the largest 64-bit unsigned 544| | * value is ~1.8*10^19). 545| | */ 546| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 547| 1| "Interface Description Block if_tsresol option resolution 10^-%u is too high", 548| 1| tsresol_opt); 549| 1| return (-1); 550| 1| } 551| 737| *is_binary = 0; 552| 737| *tsresol = 1; 553| 5.34k| for (i = 0; i < tsresol_opt; i++) ------------------ | Branch (553:17): [True: 4.61k, False: 737] ------------------ 554| 4.61k| *tsresol *= 10; 555| 737| } 556| 1.21k| break; 557| | 558| 1.21k| case IF_TSOFFSET: ------------------ | | 136| 408|#define IF_TSOFFSET 14 /* time stamp offset for this interface */ ------------------ | Branch (558:3): [True: 408, False: 2.49k] ------------------ 559| 408| if (opthdr->option_length != 8) { ------------------ | Branch (559:8): [True: 14, False: 394] ------------------ 560| 14| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 14|#define PCAP_ERRBUF_SIZE 256 ------------------ 561| 14| "Interface Description Block has if_tsoffset option with length %u != 8", 562| 14| opthdr->option_length); 563| 14| return (-1); 564| 14| } 565| 394| if (saw_tsoffset) { ------------------ | Branch (565:8): [True: 1, False: 393] ------------------ 566| 1| snprintf(errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 567| 1| "Interface Description Block has more than one if_tsoffset option"); 568| 1| return (-1); 569| 1| } 570| 393| saw_tsoffset = 1; 571| 393| memcpy(tsoffset, optvalue, sizeof(*tsoffset)); 572| 393| if (p->swapped) ------------------ | Branch (572:8): [True: 197, False: 196] ------------------ 573| 197| *tsoffset = PCAP_BSWAP_64(*tsoffset); ------------------ | | 64| 197|#define PCAP_BSWAP_64(y) __builtin_bswap64((uint64_t)(y)) ------------------ 574| 393| break; 575| | 576| 986| default: ------------------ | Branch (576:3): [True: 986, False: 1.91k] ------------------ 577| 986| break; 578| 2.90k| } 579| 2.90k| } 580| | 581| 3.69k|done: 582| 3.69k| return (0); 583| 3.77k|} sf-pcapng.c:get_opthdr_from_block_data: 410| 2.93k|{ 411| 2.93k| struct option_header *opthdr; 412| | 413| 2.93k| opthdr = get_from_block_data(cursor, sizeof(*opthdr), errbuf); 414| 2.93k| if (opthdr == NULL) { ------------------ | Branch (414:6): [True: 0, False: 2.93k] ------------------ 415| | /* 416| | * Option header is cut short. 417| | */ 418| 0| return (NULL); 419| 0| } 420| | 421| | /* 422| | * Byte-swap it if necessary. 423| | */ 424| 2.93k| if (p->swapped) { ------------------ | Branch (424:6): [True: 977, False: 1.95k] ------------------ 425| 977| opthdr->option_code = PCAP_BSWAP_16(opthdr->option_code); ------------------ | | 88| 977|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 426| 977| opthdr->option_length = PCAP_BSWAP_16(opthdr->option_length); ------------------ | | 88| 977|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 427| 977| } 428| | 429| 2.93k| return (opthdr); 430| 2.93k|} sf-pcapng.c:get_optvalue_from_block_data: 435| 2.93k|{ 436| 2.93k| size_t padded_option_len; 437| 2.93k| void *optvalue; 438| | 439| | /* Pad option length to 4-byte boundary */ 440| 2.93k| padded_option_len = opthdr->option_length; 441| 2.93k| padded_option_len = ((padded_option_len + 3)/4)*4; 442| | 443| 2.93k| optvalue = get_from_block_data(cursor, padded_option_len, errbuf); 444| 2.93k| if (optvalue == NULL) { ------------------ | Branch (444:6): [True: 30, False: 2.90k] ------------------ 445| | /* 446| | * Option value is cut short. 447| | */ 448| 30| return (NULL); 449| 30| } 450| | 451| 2.90k| return (optvalue); 452| 2.93k|} sf-pcapng.c:pcap_ng_cleanup: 1095| 821|{ 1096| 821| struct pcap_ng_sf *ps = p->priv; 1097| | 1098| 821| free(ps->ifaces); 1099| 821| pcapint_sf_cleanup(p); 1100| 821|} sf-pcapng.c:pcap_ng_next_packet: 1109| 3.15k|{ 1110| 3.15k| struct pcap_ng_sf *ps = p->priv; 1111| 3.15k| struct block_cursor cursor; 1112| 3.15k| int status; 1113| 3.15k| struct enhanced_packet_block *epbp; 1114| 3.15k| struct simple_packet_block *spbp; 1115| 3.15k| struct packet_block *pbp; 1116| 3.15k| bpf_u_int32 interface_id = 0xFFFFFFFF; 1117| 3.15k| struct interface_description_block *idbp; 1118| 3.15k| struct section_header_block *shbp; 1119| 3.15k| FILE *fp = p->rfile; 1120| 3.15k| uint64_t t, sec, frac; 1121| | 1122| | /* 1123| | * Look for an Enhanced Packet Block, a Simple Packet Block, 1124| | * or a Packet Block. 1125| | */ 1126| 6.78k| for (;;) { 1127| | /* 1128| | * Read the block type and length; those are common 1129| | * to all blocks. 1130| | */ 1131| 6.78k| status = read_block(fp, p, &cursor, p->errbuf); 1132| 6.78k| if (status == 0) ------------------ | Branch (1132:7): [True: 355, False: 6.42k] ------------------ 1133| 355| return (0); /* EOF */ 1134| 6.42k| if (status == -1) ------------------ | Branch (1134:7): [True: 56, False: 6.37k] ------------------ 1135| 56| return (-1); /* error */ 1136| 6.37k| switch (cursor.block_type) { 1137| | 1138| 475| case BT_EPB: ------------------ | | 141| 475|#define BT_EPB 0x00000006 ------------------ | Branch (1138:3): [True: 475, False: 5.89k] ------------------ 1139| | /* 1140| | * Get a pointer to the fixed-length portion of the 1141| | * EPB. 1142| | */ 1143| 475| epbp = get_from_block_data(&cursor, sizeof(*epbp), 1144| 475| p->errbuf); 1145| 475| if (epbp == NULL) ------------------ | Branch (1145:8): [True: 4, False: 471] ------------------ 1146| 4| return (-1); /* error */ 1147| | 1148| | /* 1149| | * Byte-swap it if necessary. 1150| | */ 1151| 471| if (p->swapped) { ------------------ | Branch (1151:8): [True: 226, False: 245] ------------------ 1152| | /* these were written in opposite byte order */ 1153| 226| interface_id = PCAP_BSWAP_32(epbp->interface_id); ------------------ | | 78| 226|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1154| 226| hdr->caplen = PCAP_BSWAP_32(epbp->caplen); ------------------ | | 78| 226|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1155| 226| hdr->len = PCAP_BSWAP_32(epbp->len); ------------------ | | 78| 226|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1156| 226| t = ((uint64_t)PCAP_BSWAP_32(epbp->timestamp_high)) << 32 | ------------------ | | 78| 226|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1157| 226| PCAP_BSWAP_32(epbp->timestamp_low); ------------------ | | 78| 226|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1158| 245| } else { 1159| 245| interface_id = epbp->interface_id; 1160| 245| hdr->caplen = epbp->caplen; 1161| 245| hdr->len = epbp->len; 1162| 245| t = ((uint64_t)epbp->timestamp_high) << 32 | 1163| 245| epbp->timestamp_low; 1164| 245| } 1165| 471| goto found; 1166| | 1167| 1.59k| case BT_SPB: ------------------ | | 155| 1.59k|#define BT_SPB 0x00000003 ------------------ | Branch (1167:3): [True: 1.59k, False: 4.77k] ------------------ 1168| | /* 1169| | * Get a pointer to the fixed-length portion of the 1170| | * SPB. 1171| | */ 1172| 1.59k| spbp = get_from_block_data(&cursor, sizeof(*spbp), 1173| 1.59k| p->errbuf); 1174| 1.59k| if (spbp == NULL) ------------------ | Branch (1174:8): [True: 1, False: 1.59k] ------------------ 1175| 1| return (-1); /* error */ 1176| | 1177| | /* 1178| | * SPB packets are assumed to have arrived on 1179| | * the first interface. 1180| | */ 1181| 1.59k| interface_id = 0; 1182| | 1183| | /* 1184| | * Byte-swap it if necessary. 1185| | */ 1186| 1.59k| if (p->swapped) { ------------------ | Branch (1186:8): [True: 910, False: 687] ------------------ 1187| | /* these were written in opposite byte order */ 1188| 910| hdr->len = PCAP_BSWAP_32(spbp->len); ------------------ | | 78| 910|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1189| 910| } else 1190| 687| hdr->len = spbp->len; 1191| | 1192| | /* 1193| | * The SPB doesn't give the captured length; 1194| | * it's the minimum of the snapshot length 1195| | * and the packet length. 1196| | */ 1197| 1.59k| hdr->caplen = hdr->len; 1198| 1.59k| if (hdr->caplen > (bpf_u_int32)p->snapshot) ------------------ | Branch (1198:8): [True: 556, False: 1.04k] ------------------ 1199| 556| hdr->caplen = p->snapshot; 1200| 1.59k| t = 0; /* no time stamps */ 1201| 1.59k| goto found; 1202| | 1203| 470| case BT_PB: ------------------ | | 165| 470|#define BT_PB 0x00000002 ------------------ | Branch (1203:3): [True: 470, False: 5.90k] ------------------ 1204| | /* 1205| | * Get a pointer to the fixed-length portion of the 1206| | * PB. 1207| | */ 1208| 470| pbp = get_from_block_data(&cursor, sizeof(*pbp), 1209| 470| p->errbuf); 1210| 470| if (pbp == NULL) ------------------ | Branch (1210:8): [True: 4, False: 466] ------------------ 1211| 4| return (-1); /* error */ 1212| | 1213| | /* 1214| | * Byte-swap it if necessary. 1215| | */ 1216| 466| if (p->swapped) { ------------------ | Branch (1216:8): [True: 205, False: 261] ------------------ 1217| | /* these were written in opposite byte order */ 1218| 205| interface_id = PCAP_BSWAP_16(pbp->interface_id); ------------------ | | 88| 205|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 1219| 205| hdr->caplen = PCAP_BSWAP_32(pbp->caplen); ------------------ | | 78| 205|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1220| 205| hdr->len = PCAP_BSWAP_32(pbp->len); ------------------ | | 78| 205|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1221| 205| t = ((uint64_t)PCAP_BSWAP_32(pbp->timestamp_high)) << 32 | ------------------ | | 78| 205|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1222| 205| PCAP_BSWAP_32(pbp->timestamp_low); ------------------ | | 78| 205|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1223| 261| } else { 1224| 261| interface_id = pbp->interface_id; 1225| 261| hdr->caplen = pbp->caplen; 1226| 261| hdr->len = pbp->len; 1227| 261| t = ((uint64_t)pbp->timestamp_high) << 32 | 1228| 261| pbp->timestamp_low; 1229| 261| } 1230| 466| goto found; 1231| | 1232| 2.93k| case BT_IDB: ------------------ | | 112| 2.93k|#define BT_IDB 0x00000001 ------------------ | Branch (1232:3): [True: 2.93k, False: 3.44k] ------------------ 1233| | /* 1234| | * Interface Description Block. Get a pointer 1235| | * to its fixed-length portion. 1236| | */ 1237| 2.93k| idbp = get_from_block_data(&cursor, sizeof(*idbp), 1238| 2.93k| p->errbuf); 1239| 2.93k| if (idbp == NULL) ------------------ | Branch (1239:8): [True: 1, False: 2.92k] ------------------ 1240| 1| return (-1); /* error */ 1241| | 1242| | /* 1243| | * Byte-swap it if necessary. 1244| | */ 1245| 2.92k| if (p->swapped) { ------------------ | Branch (1245:8): [True: 922, False: 2.00k] ------------------ 1246| 922| idbp->linktype = PCAP_BSWAP_16(idbp->linktype); ------------------ | | 88| 922|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 1247| 922| idbp->snaplen = PCAP_BSWAP_32(idbp->snaplen); ------------------ | | 78| 922|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1248| 922| } 1249| | 1250| | /* 1251| | * If the link-layer type or snapshot length 1252| | * differ from the ones for the first IDB we 1253| | * saw, quit. 1254| | * 1255| | * XXX - just discard packets from those 1256| | * interfaces? 1257| | */ 1258| 2.92k| if (p->linktype != idbp->linktype) { ------------------ | Branch (1258:8): [True: 2, False: 2.92k] ------------------ 1259| 2| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 2|#define PCAP_ERRBUF_SIZE 256 ------------------ 1260| 2| "an interface has a type %u different from the type of the first interface", 1261| 2| idbp->linktype); 1262| 2| return (-1); 1263| 2| } 1264| | 1265| | /* 1266| | * Check against the *adjusted* value of this IDB's 1267| | * snapshot length. 1268| | */ 1269| 2.92k| if ((bpf_u_int32)p->snapshot != ------------------ | Branch (1269:8): [True: 54, False: 2.87k] ------------------ 1270| 2.92k| pcapint_adjust_snapshot(p->linktype, idbp->snaplen)) { 1271| 54| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 54|#define PCAP_ERRBUF_SIZE 256 ------------------ 1272| 54| "an interface has a snapshot length %u different from the snapshot length of the first interface", 1273| 54| idbp->snaplen); 1274| 54| return (-1); 1275| 54| } 1276| | 1277| | /* 1278| | * Try to add this interface. 1279| | */ 1280| 2.87k| if (!add_interface(p, idbp, &cursor, p->errbuf)) ------------------ | Branch (1280:8): [True: 2, False: 2.87k] ------------------ 1281| 2| return (-1); 1282| 2.87k| break; 1283| | 1284| 2.87k| case BT_SHB: ------------------ | | 86| 559|#define BT_SHB 0x0A0D0D0A ------------------ | Branch (1284:3): [True: 559, False: 5.81k] ------------------ 1285| | /* 1286| | * Section Header Block. Get a pointer 1287| | * to its fixed-length portion. 1288| | */ 1289| 559| shbp = get_from_block_data(&cursor, sizeof(*shbp), 1290| 559| p->errbuf); 1291| 559| if (shbp == NULL) ------------------ | Branch (1291:8): [True: 3, False: 556] ------------------ 1292| 3| return (-1); /* error */ 1293| | 1294| | /* 1295| | * Assume the byte order of this section is 1296| | * the same as that of the previous section. 1297| | * We'll check for that later. 1298| | */ 1299| 556| if (p->swapped) { ------------------ | Branch (1299:8): [True: 231, False: 325] ------------------ 1300| 231| shbp->byte_order_magic = 1301| 231| PCAP_BSWAP_32(shbp->byte_order_magic); ------------------ | | 78| 231|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ 1302| 231| shbp->major_version = 1303| 231| PCAP_BSWAP_16(shbp->major_version); ------------------ | | 88| 231|#define PCAP_BSWAP_16(y) __builtin_bswap16((uint16_t)(y)) ------------------ 1304| 231| } 1305| | 1306| | /* 1307| | * Make sure the byte order doesn't change; 1308| | * pcap_is_swapped() shouldn't change its 1309| | * return value in the middle of reading a capture. 1310| | */ 1311| 556| switch (shbp->byte_order_magic) { 1312| | 1313| 431| case BYTE_ORDER_MAGIC: ------------------ | | 99| 431|#define BYTE_ORDER_MAGIC 0x1A2B3C4D ------------------ | Branch (1313:4): [True: 431, False: 125] ------------------ 1314| | /* 1315| | * OK. 1316| | */ 1317| 431| break; 1318| | 1319| 1| case PCAP_BSWAP_32(BYTE_ORDER_MAGIC): ------------------ | | 78| 1|#define PCAP_BSWAP_32(y) __builtin_bswap32((uint32_t)(y)) ------------------ | Branch (1319:4): [True: 1, False: 555] ------------------ 1320| | /* 1321| | * Byte order changes. 1322| | */ 1323| 1| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 1|#define PCAP_ERRBUF_SIZE 256 ------------------ 1324| 1| "the file has sections with different byte orders"); 1325| 1| return (-1); 1326| | 1327| 124| default: ------------------ | Branch (1327:4): [True: 124, False: 432] ------------------ 1328| | /* 1329| | * Not a valid SHB. 1330| | */ 1331| 124| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 124|#define PCAP_ERRBUF_SIZE 256 ------------------ 1332| 124| "the file has a section with a bad byte order magic field"); 1333| 124| return (-1); 1334| 556| } 1335| | 1336| | /* 1337| | * Make sure the major version is the version 1338| | * we handle. 1339| | */ 1340| 431| if (shbp->major_version != PCAP_NG_VERSION_MAJOR) { ------------------ | | 106| 431|#define PCAP_NG_VERSION_MAJOR 1 ------------------ | Branch (1340:8): [True: 17, False: 414] ------------------ 1341| 17| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 17|#define PCAP_ERRBUF_SIZE 256 ------------------ 1342| 17| "unknown pcapng savefile major version number %u", 1343| 17| shbp->major_version); 1344| 17| return (-1); 1345| 17| } 1346| | 1347| | /* 1348| | * Reset the interface count; this section should 1349| | * have its own set of IDBs. If any of them 1350| | * don't have the same interface type, snapshot 1351| | * length, or resolution as the first interface 1352| | * we saw, we'll fail. (And if we don't see 1353| | * any IDBs, we'll fail when we see a packet 1354| | * block.) 1355| | */ 1356| 414| ps->ifcount = 0; 1357| 414| break; 1358| | 1359| 340| default: ------------------ | Branch (1359:3): [True: 340, False: 6.03k] ------------------ 1360| | /* 1361| | * Not a packet block, IDB, or SHB; ignore it. 1362| | */ 1363| 340| break; 1364| 6.37k| } 1365| 6.37k| } 1366| | 1367| 2.53k|found: 1368| | /* 1369| | * Is the interface ID an interface we know? 1370| | */ 1371| 2.53k| if (interface_id >= ps->ifcount) { ------------------ | Branch (1371:6): [True: 60, False: 2.47k] ------------------ 1372| | /* 1373| | * Yes. Fail. 1374| | */ 1375| 60| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 60|#define PCAP_ERRBUF_SIZE 256 ------------------ 1376| 60| "a packet arrived on interface %u, but there's no Interface Description Block for that interface", 1377| 60| interface_id); 1378| 60| return (-1); 1379| 60| } 1380| | 1381| 2.47k| if (hdr->caplen > (bpf_u_int32)p->snapshot) { ------------------ | Branch (1381:6): [True: 37, False: 2.43k] ------------------ 1382| 37| snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ------------------ | | 149| 37|#define PCAP_ERRBUF_SIZE 256 ------------------ 1383| 37| "invalid packet capture length %u, bigger than " 1384| 37| "snaplen of %d", hdr->caplen, p->snapshot); 1385| 37| return (-1); 1386| 37| } 1387| | 1388| | /* 1389| | * Convert the time stamp to seconds and fractions of a second, 1390| | * with the fractions being in units of the file-supplied resolution. 1391| | */ 1392| 2.43k| sec = t / ps->ifaces[interface_id].tsresol + ps->ifaces[interface_id].tsoffset; 1393| 2.43k| frac = t % ps->ifaces[interface_id].tsresol; 1394| | 1395| | /* 1396| | * Convert the fractions from units of the file-supplied resolution 1397| | * to units of the user-requested resolution. 1398| | */ 1399| 2.43k| switch (ps->ifaces[interface_id].scale_type) { ------------------ | Branch (1399:10): [True: 2.43k, False: 0] ------------------ 1400| | 1401| 1.13k| case PASS_THROUGH: ------------------ | Branch (1401:2): [True: 1.13k, False: 1.29k] ------------------ 1402| | /* 1403| | * The interface resolution is what the user wants, 1404| | * so we're done. 1405| | */ 1406| 1.13k| break; 1407| | 1408| 613| case SCALE_UP_DEC: ------------------ | Branch (1408:2): [True: 613, False: 1.82k] ------------------ 1409| | /* 1410| | * The interface resolution is less than what the user 1411| | * wants; scale the fractional part up to the units of 1412| | * the resolution the user requested by multiplying by 1413| | * the quotient of the user-requested resolution and the 1414| | * file-supplied resolution. 1415| | * 1416| | * Those resolutions are both powers of 10, and the user- 1417| | * requested resolution is greater than the file-supplied 1418| | * resolution, so the quotient in question is an integer. 1419| | * We've calculated that quotient already, so we just 1420| | * multiply by it. 1421| | */ 1422| 613| frac *= ps->ifaces[interface_id].scale_factor; 1423| 613| break; 1424| | 1425| 224| case SCALE_UP_BIN: ------------------ | Branch (1425:2): [True: 224, False: 2.21k] ------------------ 1426| | /* 1427| | * The interface resolution is less than what the user 1428| | * wants; scale the fractional part up to the units of 1429| | * the resolution the user requested by multiplying by 1430| | * the quotient of the user-requested resolution and the 1431| | * file-supplied resolution. 1432| | * 1433| | * The file-supplied resolution is a power of 2, so the 1434| | * quotient is not an integer, so, in order to do this 1435| | * entirely with integer arithmetic, we multiply by the 1436| | * user-requested resolution and divide by the file- 1437| | * supplied resolution. 1438| | * 1439| | * XXX - Is there something clever we could do here, 1440| | * given that we know that the file-supplied resolution 1441| | * is a power of 2? Doing a multiplication followed by 1442| | * a division runs the risk of overflowing, and involves 1443| | * two non-simple arithmetic operations. 1444| | */ 1445| 224| frac *= ps->user_tsresol; 1446| 224| frac /= ps->ifaces[interface_id].tsresol; 1447| 224| break; 1448| | 1449| 199| case SCALE_DOWN_DEC: ------------------ | Branch (1449:2): [True: 199, False: 2.23k] ------------------ 1450| | /* 1451| | * The interface resolution is greater than what the user 1452| | * wants; scale the fractional part up to the units of 1453| | * the resolution the user requested by multiplying by 1454| | * the quotient of the user-requested resolution and the 1455| | * file-supplied resolution. 1456| | * 1457| | * Those resolutions are both powers of 10, and the user- 1458| | * requested resolution is less than the file-supplied 1459| | * resolution, so the quotient in question isn't an 1460| | * integer, but its reciprocal is, and we can just divide 1461| | * by the reciprocal of the quotient. We've calculated 1462| | * the reciprocal of that quotient already, so we must 1463| | * divide by it. 1464| | */ 1465| 199| frac /= ps->ifaces[interface_id].scale_factor; 1466| 199| break; 1467| | 1468| | 1469| 262| case SCALE_DOWN_BIN: ------------------ | Branch (1469:2): [True: 262, False: 2.17k] ------------------ 1470| | /* 1471| | * The interface resolution is greater than what the user 1472| | * wants; convert the fractional part to units of the 1473| | * resolution the user requested by multiplying by the 1474| | * quotient of the user-requested resolution and the 1475| | * file-supplied resolution. We do that by multiplying 1476| | * by the user-requested resolution and dividing by the 1477| | * file-supplied resolution, as the quotient might not 1478| | * fit in an integer. 1479| | * 1480| | * The file-supplied resolution is a power of 2, so the 1481| | * quotient is not an integer, and neither is its 1482| | * reciprocal, so, in order to do this entirely with 1483| | * integer arithmetic, we multiply by the user-requested 1484| | * resolution and divide by the file-supplied resolution. 1485| | * 1486| | * XXX - Is there something clever we could do here, 1487| | * given that we know that the file-supplied resolution 1488| | * is a power of 2? Doing a multiplication followed by 1489| | * a division runs the risk of overflowing, and involves 1490| | * two non-simple arithmetic operations. 1491| | */ 1492| 262| frac *= ps->user_tsresol; 1493| 262| frac /= ps->ifaces[interface_id].tsresol; 1494| 262| break; 1495| 2.43k| } 1496| |#ifdef _WIN32 1497| | /* 1498| | * tv_sec and tv_usec in the Windows struct timeval are both 1499| | * longs. 1500| | */ 1501| | hdr->ts.tv_sec = (long)sec; 1502| | hdr->ts.tv_usec = (long)frac; 1503| |#else 1504| | /* 1505| | * tv_sec in the UN*X struct timeval is a time_t; tv_usec is 1506| | * suseconds_t in UN*Xes that work the way the current Single 1507| | * UNIX Standard specify - but not all older UN*Xes necessarily 1508| | * support that type, so just cast to int. 1509| | */ 1510| 2.43k| hdr->ts.tv_sec = (time_t)sec; 1511| 2.43k| hdr->ts.tv_usec = (int)frac; 1512| 2.43k|#endif 1513| | 1514| | /* 1515| | * Get a pointer to the packet data. 1516| | */ 1517| 2.43k| *data = get_from_block_data(&cursor, hdr->caplen, p->errbuf); 1518| 2.43k| if (*data == NULL) ------------------ | Branch (1518:6): [True: 100, False: 2.33k] ------------------ 1519| 100| return (-1); 1520| | 1521| 2.33k| pcapint_post_process(p->linktype, p->swapped, hdr, *data); 1522| | 1523| 2.33k| return (1); 1524| 2.43k|} parse_mpls: 89| 2.38k|{ 90| 2.38k| const u_char *mpls_label; /* byte cursor, not a struct pointer - see below */ 91| 2.38k| const u_char *end_ptr = pktdata + datalen; 92| 2.38k| u_char first_nibble; 93| 2.38k| eth_hdr_t *eth_hdr; 94| 2.38k| bool bos = false; 95| 2.38k| uint32_t label; 96| 2.38k| int len; 97| | 98| 2.38k| assert(next_protocol); ------------------ | Branch (98:5): [True: 0, False: 2.38k] | Branch (98:5): [True: 2.38k, False: 0] ------------------ 99| 2.38k| assert(l2len); ------------------ | Branch (99:5): [True: 0, False: 2.38k] | Branch (99:5): [True: 2.38k, False: 0] ------------------ 100| 2.38k| assert(l2offset); ------------------ | Branch (100:5): [True: 0, False: 2.38k] | Branch (100:5): [True: 2.38k, False: 0] ------------------ 101| | 102| 2.38k| len = (int)*l2len; 103| | 104| | /* 105| | * An MPLS label is four bytes at whatever offset the encapsulation puts 106| | * it, which is not guaranteed to be 4-byte aligned. Casting that to a 107| | * struct tcpr_mpls_label and reading ->entry is undefined behaviour, and 108| | * UBSan says so: 109| | * 110| | * get.c:115: member access within misaligned address ... for type 111| | * 'struct tcpr_mpls_label', which requires 4 byte alignment 112| | * 113| | * x86 does not care, which is why this went unnoticed - but docs/INSTALL 114| | * lists Solaris and the BSDs, where a misaligned load faults or is fixed 115| | * up in the trap handler (#1100). Copy the four bytes out instead, and 116| | * keep the cursor as a plain byte pointer so no misaligned struct pointer 117| | * is ever formed. 118| | */ 119| 38.4k| while (!bos) { ------------------ | Branch (119:12): [True: 36.7k, False: 1.72k] ------------------ 120| 36.7k| uint32_t entry; 121| | 122| 36.7k| if (pktdata + len + sizeof(entry) > end_ptr) { ------------------ | Branch (122:13): [True: 407, False: 36.3k] ------------------ 123| 407| warnx("parse_mpls: Need at least %zu bytes for MPLS header but only %u available", ------------------ | | 123| 407|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 124| 407| sizeof(entry) + len, 125| 407| datalen); 126| 407| return -1; 127| 407| } 128| | 129| 36.3k| mpls_label = pktdata + len; 130| 36.3k| memcpy(&entry, mpls_label, sizeof(entry)); 131| 36.3k| len += sizeof(entry); 132| | 133| 36.3k| entry = ntohl(entry); 134| 36.3k| bos = (entry & MPLS_LS_S_MASK) != 0; ------------------ | | 1701| 36.3k|#define MPLS_LS_S_MASK 0x00000100 ------------------ 135| 36.3k| label = entry >> MPLS_LS_LABEL_SHIFT; ------------------ | | 1692| 36.3k|#define MPLS_LS_LABEL_SHIFT 12 ------------------ 136| 36.3k| if (label == MPLS_LABEL_GACH) { ------------------ | | 1685| 36.3k|#define MPLS_LABEL_GACH 13 ------------------ | Branch (136:13): [True: 252, False: 36.1k] ------------------ 137| | /* Generic Associated Channel Header */ 138| 252| warn("GACH MPLS label not supported at this time"); ------------------ | | 121| 252|#define warn(x) fprintf(stderr, "Warning: %s\n", x) ------------------ 139| 252| return -1; 140| 252| } 141| 36.3k| } 142| | 143| | /* mpls_label is now a byte cursor, so step past the 4-byte label directly */ 144| 1.72k| if (mpls_label + sizeof(uint32_t) + 1 > end_ptr) { ------------------ | Branch (144:9): [True: 70, False: 1.65k] ------------------ 145| 70| warnx("parse_mpls: Need at least %zu bytes for MPLS label but only %u available", ------------------ | | 123| 70|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 146| 70| sizeof(uint32_t) + 1, 147| 70| datalen); 148| 70| return -1; 149| 70| } 150| | 151| 1.65k| first_nibble = *(mpls_label + sizeof(uint32_t)) >> 4; 152| 1.65k| switch (first_nibble) { 153| 366| case 4: ------------------ | Branch (153:5): [True: 366, False: 1.28k] ------------------ 154| 366| *next_protocol = ETHERTYPE_IP; 155| 366| break; 156| 286| case 6: ------------------ | Branch (156:5): [True: 286, False: 1.36k] ------------------ 157| 286| *next_protocol = ETHERTYPE_IP6; ------------------ | | 534| 286|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ 158| 286| break; 159| 781| case 0: ------------------ | Branch (159:5): [True: 781, False: 871] ------------------ 160| | /* EoMPLS - jump over PW Ethernet Control Word and handle 161| | * inner Ethernet header 162| | */ 163| 781| if (pktdata + len + 4 + sizeof(*eth_hdr) > end_ptr) { ------------------ | Branch (163:13): [True: 216, False: 565] ------------------ 164| 216| warnx("parse_mpls: Need at least %zu bytes for EoMPLS header but only %u available", ------------------ | | 123| 216|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 165| 216| sizeof(*eth_hdr) + len + 4, 166| 216| datalen); 167| 216| return -1; 168| 216| } 169| | 170| 565| len += 4; 171| 565| *l2offset = len; 172| 565| eth_hdr = (eth_hdr_t *)(pktdata + len); 173| 565| len += sizeof(*eth_hdr); 174| 565| *next_protocol = ntohs(eth_hdr->ether_type); 175| 565| break; 176| 219| default: ------------------ | Branch (176:5): [True: 219, False: 1.43k] ------------------ 177| 219| warn("parse_mpls:suspect Generic Associated Channel Header"); ------------------ | | 121| 219|#define warn(x) fprintf(stderr, "Warning: %s\n", x) ------------------ 178| 219| return -1; 179| 1.65k| } 180| | 181| 1.21k| *l2len = (uint32_t)len; 182| 1.21k| return 0; 183| 1.65k|} parse_vlan: 198| 1.44k|{ 199| 1.44k| vlan_hdr_t *vlan_hdr; 200| 1.44k| if ((size_t)datalen < *l2len + sizeof(*vlan_hdr)) { ------------------ | Branch (200:9): [True: 309, False: 1.13k] ------------------ 201| 309| warnx("parse_vlan: Need at least %zu bytes for VLAN header but only %u available", sizeof(*vlan_hdr), datalen); ------------------ | | 123| 309|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 202| 309| return -1; 203| 309| } 204| 1.13k| vlan_hdr = (vlan_hdr_t *)(pktdata + *l2len); 205| 1.13k| *next_protocol = ntohs(vlan_hdr->vlan_tpid); 206| 1.13k| *l2len += sizeof(vlan_hdr_t); 207| | 208| 1.13k| return 0; 209| 1.44k|} get_l2len_protocol: 290| 31.9k|{ 291| 31.9k| assert(protocol); ------------------ | Branch (291:5): [True: 0, False: 31.9k] | Branch (291:5): [True: 31.9k, False: 0] ------------------ 292| 31.9k| assert(l2len); ------------------ | Branch (292:5): [True: 0, False: 31.9k] | Branch (292:5): [True: 31.9k, False: 0] ------------------ 293| 31.9k| assert(l2offset); ------------------ | Branch (293:5): [True: 0, False: 31.9k] | Branch (293:5): [True: 31.9k, False: 0] ------------------ 294| 31.9k| assert(vlan_offset); ------------------ | Branch (294:5): [True: 0, False: 31.9k] | Branch (294:5): [True: 31.9k, False: 0] ------------------ 295| | 296| 31.9k| if (!pktdata || !datalen) { ------------------ | Branch (296:9): [True: 0, False: 31.9k] | Branch (296:21): [True: 0, False: 31.9k] ------------------ 297| 0| err_no_exitx("get_l2len_protocol: invalid L2 parameters: pktdata=0x%p len=%d", pktdata, datalen); ------------------ | | 142| 0|#define err_no_exitx(y, ...) do {\ | | 143| 0| fprintf(stderr, "\nFatal Error: " y "\n", __VA_ARGS__); \ | | 144| 0| fflush(NULL); \ | | 145| 0| } while (0) | | ------------------ | | | Branch (145:14): [Folded, False: 0] | | ------------------ ------------------ 298| 0| return -1; 299| 0| } 300| | 301| 31.9k| *protocol = 0; 302| 31.9k| *l2len = 0; 303| 31.9k| *l2offset = 0; 304| 31.9k| *vlan_offset = 0; 305| | 306| 31.9k| switch (datalink) { 307| 5.74k| case DLT_NULL: ------------------ | Branch (307:5): [True: 5.74k, False: 26.1k] ------------------ 308| 6.87k| case DLT_RAW: ------------------ | Branch (308:5): [True: 1.12k, False: 30.7k] ------------------ 309| 6.87k| if ((pktdata[0] >> 4) == 4) ------------------ | Branch (309:13): [True: 458, False: 6.41k] ------------------ 310| 458| *protocol = ETHERTYPE_IP; 311| 6.41k| else if ((pktdata[0] >> 4) == 6) ------------------ | Branch (311:18): [True: 5.78k, False: 632] ------------------ 312| 5.78k| *protocol = ETHERTYPE_IP6; ------------------ | | 534| 5.78k|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ 313| 6.87k| break; 314| 1.82k| case DLT_JUNIPER_ETHER: ------------------ | Branch (314:5): [True: 1.82k, False: 30.0k] ------------------ 315| 1.82k| if (datalen < 4) { ------------------ | Branch (315:13): [True: 195, False: 1.62k] ------------------ 316| 195| warnx("%s (0x%x): Need at least 4 bytes for DLT_JUNIPER_ETHER but only %u available", ------------------ | | 123| 195|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 317| 195| pcap_datalink_val_to_description(datalink), 318| 195| datalink, 319| 195| datalen); 320| 195| return -1; 321| 195| } 322| | 323| 1.62k| if (memcmp(pktdata, JUNIPER_PCAP_MAGIC, 3) != 0) { ------------------ | | 39| 1.62k|#define JUNIPER_PCAP_MAGIC "MGC" ------------------ | Branch (323:13): [True: 261, False: 1.36k] ------------------ 324| 261| warnx("%s (0x%x): No JUNIPER_PCAP_MAGIC Magic Number found during protocol lookup", ------------------ | | 123| 261|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 325| 261| pcap_datalink_val_to_description(datalink), 326| 261| datalink); 327| 261| return -1; 328| 261| } 329| | 330| 1.36k| if ((pktdata[3] & JUNIPER_FLAG_EXT) == JUNIPER_FLAG_EXT) { ------------------ | | 38| 1.36k|#define JUNIPER_FLAG_EXT 0x80 /* Juniper extensions present */ ------------------ if ((pktdata[3] & JUNIPER_FLAG_EXT) == JUNIPER_FLAG_EXT) { ------------------ | | 38| 1.36k|#define JUNIPER_FLAG_EXT 0x80 /* Juniper extensions present */ ------------------ | Branch (330:13): [True: 506, False: 861] ------------------ 331| 506| if (datalen < 6) { ------------------ | Branch (331:17): [True: 203, False: 303] ------------------ 332| 203| warnx("%s (0x%x): Need at least 6 bytes for JUNIPER_FLAG_EXT but only %u available", ------------------ | | 123| 203|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 333| 203| pcap_datalink_val_to_description(datalink), 334| 203| datalink, 335| 203| datalen); 336| 203| return -1; 337| 203| } 338| | 339| 303| *l2offset = ntohs(*((uint16_t *)&pktdata[4])); 340| 303| *l2offset += 6; /* MGC + flags + ext_total_len */ 341| 861| } else { 342| 861| *l2offset = 4; /* MGC + flags (no header extensions) */ 343| 861| } 344| | 345| 1.16k| if ((pktdata[3] & JUNIPER_FLAG_NO_L2) == JUNIPER_FLAG_NO_L2) { ------------------ | | 37| 1.16k|#define JUNIPER_FLAG_NO_L2 0x02 /* L2 header */ ------------------ if ((pktdata[3] & JUNIPER_FLAG_NO_L2) == JUNIPER_FLAG_NO_L2) { ------------------ | | 37| 1.16k|#define JUNIPER_FLAG_NO_L2 0x02 /* L2 header */ ------------------ | Branch (345:13): [True: 945, False: 219] ------------------ 346| | /* no L2 header present - *l2offset is actually IP offset */ 347| 945| uint32_t ip_hdr_offset = *l2offset; 348| 945| uint32_t hdrSpaceNeeded = ip_hdr_offset + 1; 349| 945| if (datalen < hdrSpaceNeeded) { ------------------ | Branch (349:17): [True: 301, False: 644] ------------------ 350| 301| warnx("%s (0x%x): Need at least %u bytes for JUNIPER_FLAG_NO_L2 but only %u available", ------------------ | | 123| 301|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 351| 301| pcap_datalink_val_to_description(datalink), 352| 301| hdrSpaceNeeded, 353| 301| datalink, 354| 301| datalen); 355| 301| return -1; 356| 301| } 357| | 358| 644| if ((pktdata[ip_hdr_offset] >> 4) == 4) ------------------ | Branch (358:17): [True: 204, False: 440] ------------------ 359| 204| *protocol = ETHERTYPE_IP; 360| 440| else if ((pktdata[ip_hdr_offset] >> 4) == 6) ------------------ | Branch (360:22): [True: 233, False: 207] ------------------ 361| 233| *protocol = ETHERTYPE_IP6; ------------------ | | 534| 233|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ 362| | 363| 644| return 0; 364| 945| } 365| | 366| | /* fall through */ 367| 3.52k| case DLT_EN10MB: { ------------------ | Branch (367:5): [True: 3.31k, False: 28.5k] ------------------ 368| 3.52k| eth_hdr_t *eth_hdr; 369| 3.52k| uint16_t ether_type; 370| 3.52k| uint32_t l2_net_off = sizeof(*eth_hdr) + *l2offset; 371| | 372| 3.52k| if (datalen <= l2_net_off + 4) { ------------------ | Branch (372:13): [True: 413, False: 3.11k] ------------------ 373| 413| warnx("%s (0x%x): Need at least %u bytes for DLT_EN10MB but only %u available", ------------------ | | 123| 413|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 374| 413| pcap_datalink_val_to_description(datalink), 375| 413| datalink, 376| 413| l2_net_off + 4, 377| 413| datalen); 378| 413| return -1; 379| 413| } 380| | 381| 3.11k| eth_hdr = (eth_hdr_t *)(pktdata + *l2offset); 382| 3.11k| ether_type = ntohs(eth_hdr->ether_type); 383| 3.11k| if (parse_metadata(pktdata, datalen, ðer_type, &l2_net_off, l2offset, vlan_offset)) ------------------ | Branch (383:13): [True: 1.47k, False: 1.64k] ------------------ 384| 1.47k| return -1; 385| | 386| 1.64k| *l2len = l2_net_off; 387| 1.64k| if (ether_type >= 1536) { ------------------ | Branch (387:13): [True: 1.06k, False: 578] ------------------ 388| | /* Ethernet II frame - return in host order */ 389| 1.06k| *protocol = ether_type; 390| 1.06k| } else if (ether_type > 1500) { ------------------ | Branch (390:20): [True: 197, False: 381] ------------------ 391| 197| warnx("%s (0x%x): unsupported 802.3 length %u", ------------------ | | 123| 197|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 392| 197| pcap_datalink_val_to_description(datalink), 393| 197| datalink, 394| 197| ether_type); 395| 197| return -1; 396| 381| } else { 397| | /* 803.3 frame */ 398| | /* we don't modify 802.3 protocols */ 399| 381| return -1; 400| 381| } 401| 1.06k| break; 402| 1.64k| } 403| 1.06k| case DLT_PPP_SERIAL: ------------------ | Branch (403:5): [True: 657, False: 31.2k] ------------------ 404| 657| if ((size_t)datalen < sizeof(struct tcpr_pppserial_hdr)) { ------------------ | Branch (404:13): [True: 197, False: 460] ------------------ 405| 197| warnx("%s (0x%x): Need at least %zu bytes for DLT_PPP_SERIAL but only %u available", ------------------ | | 123| 197|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 406| 197| pcap_datalink_val_to_description(datalink), 407| 197| datalink, 408| 197| sizeof(struct tcpr_pppserial_hdr), 409| 197| datalen); 410| 197| return -1; 411| 197| } 412| | 413| 460| struct tcpr_pppserial_hdr *ppp = (struct tcpr_pppserial_hdr *)pktdata; 414| 460| *l2len = sizeof(*ppp); 415| 460| if (ntohs(ppp->protocol) == 0x0021) ------------------ | Branch (415:13): [True: 194, False: 266] ------------------ 416| 194| *protocol = ETHERTYPE_IP; 417| 266| else 418| 266| *protocol = ntohs(ppp->protocol); 419| | 420| 460| break; 421| 636| case DLT_C_HDLC: ------------------ | Branch (421:5): [True: 636, False: 31.2k] ------------------ 422| 636| if (datalen < CISCO_HDLC_LEN) { ------------------ | | 28| 636|#define CISCO_HDLC_LEN 4 ------------------ | Branch (422:13): [True: 278, False: 358] ------------------ 423| 278| warnx("%s (0x%x): Need at least %u bytes for DLT_C_HDLC but only %u available", ------------------ | | 123| 278|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 424| 278| pcap_datalink_val_to_description(datalink), 425| 278| datalink, 426| 278| CISCO_HDLC_LEN, 427| 278| datalen); 428| 278| return -1; 429| 278| } 430| | 431| 358| hdlc_hdr_t *hdlc_hdr = (hdlc_hdr_t *)pktdata; 432| 358| *l2len = sizeof(*hdlc_hdr); 433| 358| *protocol = ntohs(hdlc_hdr->protocol); 434| 358| break; 435| 3.20k| case DLT_LINUX_SLL: ------------------ | Branch (435:5): [True: 3.20k, False: 28.6k] ------------------ 436| 3.20k| if (datalen < SLL_HDR_LEN) { ------------------ | | 86| 3.20k|#define SLL_HDR_LEN 16 /* total header length */ ------------------ | Branch (436:13): [True: 373, False: 2.83k] ------------------ 437| 373| warnx("%s (0x%x): Need at least %u bytes for DLT_LINUX_SLL but only %u available", ------------------ | | 123| 373|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 438| 373| pcap_datalink_val_to_description(datalink), 439| 373| datalink, 440| 373| SLL_HDR_LEN, 441| 373| datalen); 442| 373| return -1; 443| 373| } 444| | 445| 2.83k| *l2len = SLL_HDR_LEN; ------------------ | | 86| 2.83k|#define SLL_HDR_LEN 16 /* total header length */ ------------------ 446| 2.83k| sll_hdr_t *sll_hdr = (sll_hdr_t *)pktdata; 447| 2.83k| *protocol = ntohs(sll_hdr->sll_protocol); 448| 2.83k| break; 449| 3.26k| case DLT_LINUX_SLL2: ------------------ | Branch (449:5): [True: 3.26k, False: 28.6k] ------------------ 450| 3.26k| if (datalen < SLL2_HDR_LEN) { ------------------ | | 100| 3.26k|#define SLL2_HDR_LEN 20 /* total header length */ ------------------ | Branch (450:13): [True: 275, False: 2.98k] ------------------ 451| 275| warnx("%s (0x%x): Need at least %u bytes for DLT_LINUX_SLL2 but only %u available", ------------------ | | 123| 275|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 452| 275| pcap_datalink_val_to_description(datalink), 453| 275| datalink, 454| 275| SLL2_HDR_LEN, 455| 275| datalen); 456| 275| return -1; 457| 275| } 458| | 459| 2.98k| *l2len = SLL2_HDR_LEN; ------------------ | | 100| 2.98k|#define SLL2_HDR_LEN 20 /* total header length */ ------------------ 460| 2.98k| sll2_hdr_t *sll2_hdr = (sll2_hdr_t *)pktdata; 461| 2.98k| *protocol = ntohs(sll2_hdr->sll2_protocol); 462| 2.98k| break; 463| 12.1k| default: ------------------ | Branch (463:5): [True: 12.1k, False: 19.7k] ------------------ 464| 12.1k| warnx("Unable to process unsupported DLT type: %s (0x%x)", ------------------ | | 123| 12.1k|#define warnx(x, ...) fprintf(stderr, "Warning: " x "\n", __VA_ARGS__) ------------------ 465| 12.1k| pcap_datalink_val_to_description(datalink), 466| 12.1k| datalink); 467| 12.1k| return -1; 468| 31.9k| } 469| | 470| 14.5k| return 0; 471| 31.9k|} get_layer4_v4: 633| 540|{ 634| 540| void *ptr; 635| | 636| 540| assert(ip_hdr); ------------------ | Branch (636:5): [True: 0, False: 540] | Branch (636:5): [True: 540, False: 0] ------------------ 637| 540| assert(end_ptr); ------------------ | Branch (637:5): [True: 0, False: 540] | Branch (637:5): [True: 540, False: 0] ------------------ 638| | 639| 540| ptr = (u_char *)ip_hdr + (ip_hdr->ip_hl << 2); 640| | /* make sure we don't jump over the end of the buffer */ 641| 540| if ((u_char *)ptr > end_ptr) ------------------ | Branch (641:9): [True: 258, False: 282] ------------------ 642| 258| return NULL; 643| | 644| 282| return ((void *)ptr); 645| 540|} get_layer4_v6: 668| 85.6k|{ 669| 85.6k| struct tcpr_ipv6_ext_hdr_base *next, *exthdr; 670| 85.6k| bool done = false; 671| 85.6k| uint8_t proto; 672| | 673| 85.6k| assert(ip6_hdr); ------------------ | Branch (673:5): [True: 0, False: 85.6k] | Branch (673:5): [True: 85.6k, False: 0] ------------------ 674| 85.6k| assert(end_ptr); ------------------ | Branch (674:5): [True: 0, False: 85.6k] | Branch (674:5): [True: 85.6k, False: 0] ------------------ 675| | 676| | /* jump to the end of the IPv6 header */ 677| 85.6k| next = (struct tcpr_ipv6_ext_hdr_base *)((u_char *)ip6_hdr + TCPR_IPV6_H); ------------------ | | 97| 85.6k|#define TCPR_IPV6_H 0x28 /**< IPv6 header: 40 bytes */ ------------------ 678| 85.6k| if ((u_char *)next > end_ptr) ------------------ | Branch (678:9): [True: 386, False: 85.2k] ------------------ 679| 386| return NULL; 680| | 681| 85.2k| proto = ip6_hdr->ip_nh; 682| 181k| while (!done) { ------------------ | Branch (682:12): [True: 96.8k, False: 84.4k] ------------------ 683| 96.8k| dbgx(3, "Processing proto: 0x%hx", (uint16_t)proto); ------------------ | | 119| 96.8k|#define dbgx(x, y, ...) { } ------------------ 684| | 685| 96.8k| switch (proto) { 686| | /* recurse due to v6-in-v6, need to recast next as an IPv6 Header */ 687| 79.9k| case TCPR_IPV6_NH_IPV6: ------------------ | | 788| 79.9k|#define TCPR_IPV6_NH_IPV6 41 ------------------ | Branch (687:9): [True: 79.9k, False: 16.8k] ------------------ 688| 79.9k| dbg(3, "recursing due to v6-in-v6"); ------------------ | | 118| 79.9k|#define dbg(x, y) { } ------------------ 689| 79.9k| next = get_layer4_v6((ipv6_hdr_t *)next, end_ptr); 690| 79.9k| break; 691| | 692| | /* loop again */ 693| 666| case TCPR_IPV6_NH_AH: ------------------ | | 790| 666|#define TCPR_IPV6_NH_AH 51 ------------------ | Branch (693:9): [True: 666, False: 96.1k] ------------------ 694| 1.53k| case TCPR_IPV6_NH_ROUTING: ------------------ | | 810| 1.53k|#define TCPR_IPV6_NH_ROUTING 43 ------------------ | Branch (694:9): [True: 870, False: 95.9k] ------------------ 695| 1.83k| case TCPR_IPV6_NH_DESTOPTS: ------------------ | | 824| 1.83k|#define TCPR_IPV6_NH_DESTOPTS 60 ------------------ | Branch (695:9): [True: 298, False: 96.5k] ------------------ 696| 10.1k| case TCPR_IPV6_NH_HBH: ------------------ | | 836| 10.1k|#define TCPR_IPV6_NH_HBH 0 ------------------ | Branch (696:9): [True: 8.28k, False: 88.5k] ------------------ 697| 10.1k| dbgx(3, "Going deeper due to extension header 0x%02X", proto); ------------------ | | 119| 10.1k|#define dbgx(x, y, ...) { } ------------------ 698| 10.1k| exthdr = get_ipv6_next(next, end_ptr); 699| 10.1k| if (!ipv6_exthdr_fits(exthdr, end_ptr)) { ------------------ | Branch (699:17): [True: 2.19k, False: 7.92k] ------------------ 700| 2.19k| next = NULL; 701| 2.19k| done = true; 702| 2.19k| break; 703| 2.19k| } 704| 7.92k| proto = exthdr->ip_nh; 705| 7.92k| next = exthdr; 706| 7.92k| break; 707| | 708| | /* 709| | * handle (unparsable) IPv6 fragment data 710| | */ 711| 3.09k| case TCPR_IPV6_NH_FRAGMENT: ------------------ | | 797| 3.09k|#define TCPR_IPV6_NH_FRAGMENT 44 ------------------ | Branch (711:9): [True: 3.09k, False: 93.7k] ------------------ 712| | // next points to l4 data 713| 3.09k| dbgx(3, "Go deeper due to fragment extension header 0x%02X", proto); ------------------ | | 119| 3.09k|#define dbgx(x, y, ...) { } ------------------ 714| 3.09k| exthdr = get_ipv6_next(next, end_ptr); 715| 3.09k| if (!ipv6_exthdr_fits(exthdr, end_ptr)) { ------------------ | Branch (715:17): [True: 2.07k, False: 1.01k] ------------------ 716| 2.07k| next = NULL; 717| 2.07k| done = true; 718| 2.07k| break; 719| 2.07k| } 720| 1.01k| proto = exthdr->ip_nh; 721| 1.01k| next = exthdr; 722| | // done = true; 723| 1.01k| break; 724| | 725| | /* 726| | * Can't handle. Unparsable IPv6 encrypted data 727| | */ 728| 205| case TCPR_IPV6_NH_ESP: ------------------ | | 789| 205|#define TCPR_IPV6_NH_ESP 50 ------------------ | Branch (728:9): [True: 205, False: 96.6k] ------------------ 729| 205| next = NULL; 730| 205| done = true; 731| 205| break; 732| | 733| | /* 734| | * no further processing, either TCP, UDP, ICMP, etc... 735| | */ 736| 3.48k| default: ------------------ | Branch (736:9): [True: 3.48k, False: 93.3k] ------------------ 737| 3.48k| if (proto != ip6_hdr->ip_nh && next) { ------------------ | Branch (737:17): [True: 1.39k, False: 2.08k] | Branch (737:44): [True: 1.39k, False: 0] ------------------ 738| | /* reading next->ip_len needs the base header to be present */ 739| 1.39k| if (!ipv6_exthdr_fits(next, end_ptr)) { ------------------ | Branch (739:21): [True: 0, False: 1.39k] ------------------ 740| 0| return NULL; 741| 0| } 742| | 743| 1.39k| dbgx(3, "Returning byte offset of this ext header: %u", IPV6_EXTLEN_TO_BYTES(next->ip_len)); ------------------ | | 119| 1.39k|#define dbgx(x, y, ...) { } ------------------ 744| 1.39k| next = (void *)((u_char *)next + IPV6_EXTLEN_TO_BYTES(next->ip_len)); ------------------ | | 292| 1.39k|#define IPV6_EXTLEN_TO_BYTES(x) ((x * 4) + 8) ------------------ 745| 1.39k| if ((u_char*)next > end_ptr) ------------------ | Branch (745:21): [True: 750, False: 644] ------------------ 746| 750| return NULL; 747| 2.08k| } else { 748| 2.08k| dbgx(3, "%s", "Returning end of IPv6 Header"); ------------------ | | 119| 2.08k|#define dbgx(x, y, ...) { } ------------------ 749| 2.08k| } 750| | 751| 2.73k| done = true; 752| 96.8k| } /* switch */ 753| | 754| 96.0k| if (next == NULL) ------------------ | Branch (754:13): [True: 81.7k, False: 14.3k] ------------------ 755| 81.7k| done = true; 756| 96.0k| } /* while */ 757| | 758| 84.4k| return next; 759| 85.2k|} get_ipv6_l4proto: 828| 11.3k|{ 829| 11.3k| u_char *ptr = (u_char *)ip6_hdr + TCPR_IPV6_H; /* jump to the end of the IPv6 header */ ------------------ | | 97| 11.3k|#define TCPR_IPV6_H 0x28 /**< IPv6 header: 40 bytes */ ------------------ 830| 11.3k| uint8_t proto; 831| 11.3k| struct tcpr_ipv6_ext_hdr_base *exthdr = NULL; 832| | 833| 11.3k| assert(ip6_hdr); ------------------ | Branch (833:5): [True: 0, False: 11.3k] | Branch (833:5): [True: 11.3k, False: 0] ------------------ 834| | 835| 11.3k| if (ptr > end_ptr) ------------------ | Branch (835:9): [True: 319, False: 11.0k] ------------------ 836| 319| return TCPR_IPV6_NH_NO_NEXT; ------------------ | | 787| 319|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ 837| | 838| 11.0k| proto = ip6_hdr->ip_nh; 839| 12.7k| while (TRUE) { ------------------ | Branch (839:12): [True: 12.7k, Folded] ------------------ 840| 12.7k| dbgx(3, "Processing next proto 0x%02X", proto); ------------------ | | 119| 12.7k|#define dbgx(x, y, ...) { } ------------------ 841| 12.7k| switch (proto) { 842| | /* no further processing for IPV6 types with nothing beyond them */ 843| 2| case TCPR_IPV6_NH_NO_NEXT: ------------------ | | 787| 2|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ | Branch (843:9): [True: 2, False: 12.7k] ------------------ 844| 2.61k| case TCPR_IPV6_NH_FRAGMENT: ------------------ | | 797| 2.61k|#define TCPR_IPV6_NH_FRAGMENT 44 ------------------ | Branch (844:9): [True: 2.61k, False: 10.1k] ------------------ 845| 2.81k| case TCPR_IPV6_NH_ESP: ------------------ | | 789| 2.81k|#define TCPR_IPV6_NH_ESP 50 ------------------ | Branch (845:9): [True: 203, False: 12.5k] ------------------ 846| 2.81k| dbg(3, "No-Next or ESP... can't go any further..."); ------------------ | | 118| 2.81k|#define dbg(x, y) { } ------------------ 847| 2.81k| return proto; 848| | 849| | /* recurse */ 850| 5.63k| case TCPR_IPV6_NH_IPV6: ------------------ | | 788| 5.63k|#define TCPR_IPV6_NH_IPV6 41 ------------------ | Branch (850:9): [True: 5.63k, False: 7.13k] ------------------ 851| 5.63k| dbg(3, "Recursing due to v6 in v6"); ------------------ | | 118| 5.63k|#define dbg(x, y) { } ------------------ 852| 5.63k| return get_ipv6_l4proto((ipv6_hdr_t *)ptr, end_ptr); 853| | 854| | /* loop again */ 855| 660| case TCPR_IPV6_NH_AH: ------------------ | | 790| 660|#define TCPR_IPV6_NH_AH 51 ------------------ | Branch (855:9): [True: 660, False: 12.1k] ------------------ 856| 1.47k| case TCPR_IPV6_NH_ROUTING: ------------------ | | 810| 1.47k|#define TCPR_IPV6_NH_ROUTING 43 ------------------ | Branch (856:9): [True: 810, False: 11.9k] ------------------ 857| 1.73k| case TCPR_IPV6_NH_DESTOPTS: ------------------ | | 824| 1.73k|#define TCPR_IPV6_NH_DESTOPTS 60 ------------------ | Branch (857:9): [True: 263, False: 12.5k] ------------------ 858| 3.82k| case TCPR_IPV6_NH_HBH: ------------------ | | 836| 3.82k|#define TCPR_IPV6_NH_HBH 0 ------------------ | Branch (858:9): [True: 2.09k, False: 10.6k] ------------------ 859| 3.82k| dbgx(3, "Jumping to next extension header (0x%hhx)", proto); ------------------ | | 119| 3.82k|#define dbgx(x, y, ...) { } ------------------ 860| 3.82k| exthdr = get_ipv6_next((struct tcpr_ipv6_ext_hdr_base *)ptr, end_ptr); 861| 3.82k| if (exthdr == NULL || (u_char *)exthdr + sizeof(*exthdr) > end_ptr) ------------------ | Branch (861:17): [True: 1.82k, False: 2.00k] | Branch (861:35): [True: 231, False: 1.76k] ------------------ 862| 2.05k| return TCPR_IPV6_NH_NO_NEXT; ------------------ | | 787| 2.05k|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ 863| 1.76k| proto = exthdr->ip_nh; 864| 1.76k| ptr = (u_char *)exthdr; 865| 1.76k| break; 866| | 867| | /* should be TCP, UDP or the like */ 868| 492| default: ------------------ | Branch (868:9): [True: 492, False: 12.2k] ------------------ 869| 492| dbgx(3, "Selecting next L4 Proto as: 0x%02x", proto); ------------------ | | 119| 492|#define dbgx(x, y, ...) { } ------------------ 870| 492| return proto; 871| 12.7k| } /* switch */ 872| 12.7k| } /* while */ 873| 11.0k|} get.c:parse_metadata: 230| 3.11k|{ 231| 3.11k| bool done = false; 232| 3.11k| assert(next_protocol); ------------------ | Branch (232:5): [True: 0, False: 3.11k] | Branch (232:5): [True: 3.11k, False: 0] ------------------ 233| 3.11k| assert(l2len); ------------------ | Branch (233:5): [True: 0, False: 3.11k] | Branch (233:5): [True: 3.11k, False: 0] ------------------ 234| 3.11k| assert(l2offset); ------------------ | Branch (234:5): [True: 0, False: 3.11k] | Branch (234:5): [True: 3.11k, False: 0] ------------------ 235| 3.11k| assert(vlan_offset); ------------------ | Branch (235:5): [True: 0, False: 3.11k] | Branch (235:5): [True: 3.11k, False: 0] ------------------ 236| | 237| 3.11k| if (!pktdata || !datalen) ------------------ | Branch (237:9): [True: 0, False: 3.11k] | Branch (237:21): [True: 0, False: 3.11k] ------------------ 238| 0| errx(-1, "parse_metadata: invalid L2 parameters: pktdata=0x%p len=%d", pktdata, datalen); ------------------ | | 131| 0|#define errx(x, y, ...) do {\ | | 132| 0| fprintf(stderr, "\nFatal Error: " y "\n", __VA_ARGS__); \ | | 133| 0| fflush(NULL); \ | | 134| 0| exit(x); \ | | 135| 0| } while (0) | | ------------------ | | | Branch (135:14): [Folded, False: 0] | | ------------------ ------------------ 239| | 240| 7.11k| while (!done) { ------------------ | Branch (240:12): [True: 5.46k, False: 1.64k] ------------------ 241| 5.46k| switch (*next_protocol) { 242| 337| case ETHERTYPE_VLAN: ------------------ | Branch (242:9): [True: 337, False: 5.13k] ------------------ 243| 1.10k| case ETHERTYPE_Q_IN_Q: ------------------ | | 537| 1.10k|#define ETHERTYPE_Q_IN_Q 0x88A8 /* 802.1ad Service VLAN */ ------------------ | Branch (243:9): [True: 764, False: 4.70k] ------------------ 244| 1.44k| case ETHERTYPE_8021QINQ: ------------------ | | 540| 1.44k|#define ETHERTYPE_8021QINQ 0x9100 /* 802.1Q in Q VLAN */ ------------------ | Branch (244:9): [True: 344, False: 5.12k] ------------------ 245| 1.44k| if (*vlan_offset == 0) ------------------ | Branch (245:17): [True: 595, False: 850] ------------------ 246| 595| *vlan_offset = *l2len; 247| | 248| 1.44k| if (parse_vlan(pktdata, datalen, next_protocol, l2len)) ------------------ | Branch (248:17): [True: 309, False: 1.13k] ------------------ 249| 309| return -1; 250| | 251| 1.13k| break; 252| 1.75k| case ETHERTYPE_MPLS: ------------------ | | 528| 1.75k|#define ETHERTYPE_MPLS 0x8847 /* MPLS */ ------------------ | Branch (252:9): [True: 1.75k, False: 3.71k] ------------------ 253| 2.38k| case ETHERTYPE_MPLS_MULTI: ------------------ | | 543| 2.38k|#define ETHERTYPE_MPLS_MULTI 0x8848 /* MPLS multicast packet */ ------------------ | Branch (253:9): [True: 629, False: 4.84k] ------------------ 254| 2.38k| if (parse_mpls(pktdata, datalen, next_protocol, l2len, l2offset)) ------------------ | Branch (254:17): [True: 1.16k, False: 1.21k] ------------------ 255| 1.16k| return -1; 256| | 257| 1.21k| break; 258| 1.64k| default: ------------------ | Branch (258:9): [True: 1.64k, False: 3.82k] ------------------ 259| 1.64k| done = true; 260| 5.46k| } 261| 5.46k| } 262| | 263| 1.64k| return 0; 264| 3.11k|} get.c:ipv6_exthdr_fits: 657| 14.6k|{ 658| 14.6k| return hdr != NULL && (const u_char *)hdr + sizeof(*hdr) <= end_ptr; ------------------ | Branch (658:12): [True: 10.6k, False: 3.98k] | Branch (658:27): [True: 10.3k, False: 287] ------------------ 659| 14.6k|} get.c:get_ipv6_next: 767| 17.0k|{ 768| 17.0k| uint8_t extlen; 769| 17.0k| u_char *ptr; 770| 17.0k| assert(exthdr); ------------------ | Branch (770:5): [True: 0, False: 17.0k] | Branch (770:5): [True: 17.0k, False: 0] ------------------ 771| | 772| 17.0k| if ((u_char *)exthdr + sizeof(*exthdr) > end_ptr) ------------------ | Branch (772:9): [True: 993, False: 16.0k] ------------------ 773| 993| return NULL; 774| | 775| 16.0k| dbgx(3, "Jumping to next IPv6 header. Processing 0x%02x", exthdr->ip_nh); ------------------ | | 119| 16.0k|#define dbgx(x, y, ...) { } ------------------ 776| 16.0k| switch (exthdr->ip_nh) { 777| | /* no further processing */ 778| 718| case TCPR_IPV6_NH_NO_NEXT: ------------------ | | 787| 718|#define TCPR_IPV6_NH_NO_NEXT 59 ------------------ | Branch (778:5): [True: 718, False: 15.3k] ------------------ 779| 1.54k| case TCPR_IPV6_NH_ESP: ------------------ | | 789| 1.54k|#define TCPR_IPV6_NH_ESP 50 ------------------ | Branch (779:5): [True: 827, False: 15.2k] ------------------ 780| 1.54k| dbg(3, "No-Next or ESP... can't go any further..."); ------------------ | | 118| 1.54k|#define dbg(x, y) { } ------------------ 781| 1.54k| return NULL; 782| | 783| | /* 784| | * fragment header is fixed size 785| | * FIXME: Frag header has further ext headers (has a ip_nh field) 786| | * but I don't support it because there's never a full L4 + payload beyond. 787| | */ 788| 1.77k| case TCPR_IPV6_NH_FRAGMENT: ------------------ | | 797| 1.77k|#define TCPR_IPV6_NH_FRAGMENT 44 ------------------ | Branch (788:5): [True: 1.77k, False: 14.2k] ------------------ 789| 1.77k| dbg(3, "Looks like were a fragment header. Returning some frag'd data."); ------------------ | | 118| 1.77k|#define dbg(x, y) { } ------------------ 790| 1.77k| ptr = (void *)((u_char *)exthdr + sizeof(struct tcpr_ipv6_frag_hdr)); 791| 1.77k| if (ptr > end_ptr) ------------------ | Branch (791:13): [True: 619, False: 1.15k] ------------------ 792| 619| return NULL; 793| 1.15k| return (void *)ptr; 794| | 795| | /* all the rest require us to go deeper using the ip_len field */ 796| 1.16k| case TCPR_IPV6_NH_IPV6: ------------------ | | 788| 1.16k|#define TCPR_IPV6_NH_IPV6 41 ------------------ | Branch (796:5): [True: 1.16k, False: 14.8k] ------------------ 797| 1.97k| case TCPR_IPV6_NH_ROUTING: ------------------ | | 810| 1.97k|#define TCPR_IPV6_NH_ROUTING 43 ------------------ | Branch (797:5): [True: 810, False: 15.2k] ------------------ 798| 2.84k| case TCPR_IPV6_NH_DESTOPTS: ------------------ | | 824| 2.84k|#define TCPR_IPV6_NH_DESTOPTS 60 ------------------ | Branch (798:5): [True: 873, False: 15.1k] ------------------ 799| 10.6k| case TCPR_IPV6_NH_HBH: ------------------ | | 836| 10.6k|#define TCPR_IPV6_NH_HBH 0 ------------------ | Branch (799:5): [True: 7.85k, False: 8.19k] ------------------ 800| 11.4k| case TCPR_IPV6_NH_AH: ------------------ | | 790| 11.4k|#define TCPR_IPV6_NH_AH 51 ------------------ | Branch (800:5): [True: 778, False: 15.2k] ------------------ 801| 11.4k| extlen = IPV6_EXTLEN_TO_BYTES(exthdr->ip_len); ------------------ | | 292| 11.4k|#define IPV6_EXTLEN_TO_BYTES(x) ((x * 4) + 8) ------------------ 802| 11.4k| if (extlen == 0) { ------------------ | Branch (802:13): [True: 906, False: 10.5k] ------------------ 803| 906| dbg(3, "Malformed IPv6 extension header..."); ------------------ | | 118| 906|#define dbg(x, y) { } ------------------ 804| 906| return NULL; 805| 906| } 806| 10.5k| dbgx(3, ------------------ | | 119| 10.5k|#define dbgx(x, y, ...) { } ------------------ 807| 10.5k| "Looks like we're an ext header (0x%hhx). Jumping %u bytes" 808| 10.5k| " to the next", 809| 10.5k| exthdr->ip_nh, 810| 10.5k| extlen); 811| 10.5k| ptr = (u_char *)exthdr + extlen; 812| 10.5k| if (ptr > end_ptr) ------------------ | Branch (812:13): [True: 1.74k, False: 8.82k] ------------------ 813| 1.74k| return NULL; 814| 8.82k| return (void *)ptr; 815| | 816| 1.25k| default: ------------------ | Branch (816:5): [True: 1.25k, False: 14.7k] ------------------ 817| 1.25k| dbg(3, "Must not be a v6 extension header... returning self"); ------------------ | | 118| 1.25k|#define dbg(x, y) { } ------------------ 818| 1.25k| return (void *)exthdr; 819| 16.0k| } 820| 16.0k|} LLVMFuzzerTestOneInput: 53| 5.75k|{ 54| 5.75k| FILE *fp; 55| 5.75k| pcap_t *pcap; 56| 5.75k| char errbuf[PCAP_ERRBUF_SIZE]; 57| 5.75k| struct pcap_pkthdr *pkthdr; 58| 5.75k| const u_char *pktdata; 59| 5.75k| int datalink; 60| 5.75k| int rc; 61| 5.75k| unsigned int packets = 0; 62| | 63| | /* a pcap file header is 24 bytes; below that there is nothing to open */ 64| 5.75k| if (size < 24) ------------------ | Branch (64:9): [True: 8, False: 5.74k] ------------------ 65| 8| return 0; 66| | 67| | /* 68| | * fmemopen wants a writable pointer but libpcap only reads. Casting away 69| | * const on the fuzzer's buffer is not on - copy it. 70| | */ 71| 5.74k| void *copy = malloc(size); 72| 5.74k| if (copy == NULL) ------------------ | Branch (72:9): [True: 0, False: 5.74k] ------------------ 73| 0| return 0; 74| 5.74k| memcpy(copy, data, size); 75| | 76| 5.74k| fp = fmemopen(copy, size, "rb"); 77| 5.74k| if (fp == NULL) { ------------------ | Branch (77:9): [True: 0, False: 5.74k] ------------------ 78| 0| free(copy); 79| 0| return 0; 80| 0| } 81| | 82| 5.74k| pcap = pcap_fopen_offline(fp, errbuf); 83| 5.74k| if (pcap == NULL) { ------------------ | Branch (83:9): [True: 784, False: 4.96k] ------------------ 84| | /* malformed header: libpcap rejected it, which is the correct outcome */ 85| 784| fclose(fp); 86| 784| free(copy); 87| 784| return 0; 88| 784| } 89| | /* from here on the pcap_t owns fp and closes it in pcap_close() - closing 90| | * it again here is a double free, and it is the harness that would be 91| | * wrong, not libpcap */ 92| | 93| 4.96k| datalink = pcap_datalink(pcap); 94| | 95| 47.0k| while ((rc = pcap_next_ex(pcap, &pkthdr, &pktdata)) == 1) { ------------------ | Branch (95:12): [True: 42.0k, False: 4.95k] ------------------ 96| 42.0k| uint16_t ethertype; 97| 42.0k| uint32_t l2len, l2offset, vlan_offset; 98| | 99| | /* 100| | * Cap the work per input. A crafted pcap can claim an enormous packet 101| | * count, and the fuzzer's time is better spent on new shapes than on 102| | * one pathological file. 103| | */ 104| 42.0k| if (++packets > 512) ------------------ | Branch (104:13): [True: 1, False: 42.0k] ------------------ 105| 1| break; 106| | 107| 42.0k| if (pkthdr->caplen == 0) ------------------ | Branch (107:13): [True: 10.1k, False: 31.9k] ------------------ 108| 10.1k| continue; 109| | 110| | /* 111| | * The parsers take an end pointer computed from caplen. Deliberately 112| | * use caplen, not len: the gap between them is what GHSA-m6w7-8497-g9c9 113| | * was about, and a harness that papered over it would hide the bug 114| | * class it exists to find. 115| | */ 116| 31.9k| if (get_l2len_protocol(pktdata, ------------------ | Branch (116:13): [True: 16.6k, False: 15.2k] ------------------ 117| 31.9k| pkthdr->caplen, 118| 31.9k| datalink, 119| 31.9k| ðertype, 120| 31.9k| &l2len, 121| 31.9k| &l2offset, 122| 31.9k| &vlan_offset) < 0) 123| 16.6k| continue; 124| | 125| 15.2k| if (l2len > pkthdr->caplen) ------------------ | Branch (125:13): [True: 0, False: 15.2k] ------------------ 126| 0| continue; 127| | 128| 15.2k| switch (ethertype) { 129| 1.39k| case ETHERTYPE_IP: { ------------------ | Branch (129:9): [True: 1.39k, False: 13.8k] ------------------ 130| 1.39k| ipv4_hdr_t *ip_hdr = (ipv4_hdr_t *)(pktdata + l2len); 131| | 132| 1.39k| if (pkthdr->caplen < l2len + sizeof(ipv4_hdr_t)) ------------------ | Branch (132:17): [True: 855, False: 540] ------------------ 133| 855| break; 134| | 135| 540| (void)get_layer4_v4(ip_hdr, pktdata + pkthdr->caplen - 1); 136| 540| break; 137| 1.39k| } 138| | 139| 6.30k| case ETHERTYPE_IP6: { ------------------ | | 534| 6.30k|#define ETHERTYPE_IP6 0x86DD /* IPv6 */ ------------------ | Branch (139:9): [True: 6.30k, False: 8.92k] ------------------ 140| 6.30k| ipv6_hdr_t *ip6_hdr = (ipv6_hdr_t *)(pktdata + l2len); 141| | 142| 6.30k| if (pkthdr->caplen < l2len + sizeof(ipv6_hdr_t)) ------------------ | Branch (142:17): [True: 617, False: 5.68k] ------------------ 143| 617| break; 144| | 145| | /* GHSA-jj65-mrgg-f5fx */ 146| 5.68k| (void)get_layer4_v6(ip6_hdr, pktdata + pkthdr->caplen - 1); 147| 5.68k| (void)get_ipv6_l4proto(ip6_hdr, pktdata + pkthdr->caplen - 1); 148| 5.68k| break; 149| 6.30k| } 150| | 151| 7.52k| default: ------------------ | Branch (151:9): [True: 7.52k, False: 7.69k] ------------------ 152| 7.52k| break; 153| 15.2k| } 154| 15.2k| } 155| | 156| 4.96k| pcap_close(pcap); 157| 4.96k| free(copy); 158| 4.96k| return 0; 159| 4.96k|}