Lines Matching +full:current +full:- +full:boost +full:- +full:limit
21 * sf-pcapng.c - pcapng-file-format-specific code from savefile.c
26 #include <pcap/pcap-inttypes.h>
34 #include "pcap-int.h"
35 #include "pcap-util.h"
37 #include "pcap-common.h"
40 #include "os-proto.h"
43 #include "sf-pcapng.h"
97 * Byte-order magic value.
102 * Current version number. If major_version isn't PCAP_NG_VERSION_MAJOR,
178 * Block cursor - used when processing the contents of a block.
197 * Per-interface information.
203 uint64_t scale_factor; /* time stamp scale factor for power-of-10 tsresol */
208 * Per-pcap_t private data.
213 * link-layer header types. (Currently, we don't support IDBs with
214 * different link-layer header types, but we will support it in the
215 * future, when we offer file-reading APIs that support it.)
217 * XXX - that's an issue on ILP32 platforms, where the maximum block
218 * size of 2^31-1 would eat all but one byte of the entire address space.
221 * address bits (currently, x86-64 only supports 48 bits of address), 2)
224 * so we impose a limit regardless of the size of a pointer.
242 * as the size of an EPB with a max_snaplen-sized packet and 128KB of
273 return (-1);
288 ps = p->priv;
294 if (p->swapped) {
300 * Is this block "too small" - i.e., is it shorter than a block
309 return (-1);
322 return (-1);
328 if (p->bufsize < bhdr.total_length) {
330 * No - make it big enough, unless it's too big, in
335 if (bhdr.total_length > ps->max_blocksize) {
337 ps->max_blocksize);
338 return (-1);
340 bigger_buffer = realloc(p->buffer, bhdr.total_length);
343 return (-1);
345 p->buffer = bigger_buffer;
352 memcpy(p->buffer, &bhdr, sizeof(bhdr));
353 bdata = (u_char *)p->buffer + sizeof(bhdr);
354 data_remaining = bhdr.total_length - sizeof(bhdr);
355 if (read_bytes(fp, bdata, data_remaining, 1, errbuf) == -1)
356 return (-1);
361 btrlr = (struct block_trailer *)(bdata + data_remaining - sizeof (struct block_trailer));
362 if (p->swapped)
363 btrlr->total_length = SWAPLONG(btrlr->total_length);
369 if (bhdr.total_length != btrlr->total_length) {
375 return (-1);
381 cursor->data = bdata;
382 cursor->data_remaining = data_remaining - sizeof(struct block_trailer);
383 cursor->block_type = bhdr.block_type;
397 if (cursor->data_remaining < chunk_size) {
400 cursor->block_type);
405 * Return the current pointer, and skip past the chunk.
407 data = cursor->data;
408 cursor->data += chunk_size;
409 cursor->data_remaining -= chunk_size;
427 * Byte-swap it if necessary.
429 if (p->swapped) {
430 opthdr->option_code = SWAPSHORT(opthdr->option_code);
431 opthdr->option_length = SWAPSHORT(opthdr->option_length);
444 /* Pad option length to 4-byte boundary */
445 padded_option_len = opthdr->option_length;
471 while (cursor->data_remaining != 0) {
480 return (-1);
492 return (-1);
495 switch (opthdr->option_code) {
498 if (opthdr->option_length != 0) {
501 opthdr->option_length);
502 return (-1);
507 if (opthdr->option_length != 1) {
510 opthdr->option_length);
511 return (-1);
516 return (-1);
528 * Resolution is too high; 2^-{res}
529 * won't fit in a 64-bit value.
532 "Interface Description Block if_tsresol option resolution 2^-%u is too high",
534 return (-1);
544 * Resolution is too high; 2^-{res}
545 * won't fit in a 64-bit value (the
547 * in a 64-bit value is 10^19, as
548 * the largest 64-bit unsigned
552 "Interface Description Block if_tsresol option resolution 10^-%u is too high",
554 return (-1);
564 if (opthdr->option_length != 8) {
567 opthdr->option_length);
568 return (-1);
573 return (-1);
577 if (p->swapped)
599 ps = p->priv;
604 ps->ifcount++;
607 * Grow the array of per-interface information as necessary.
609 if (ps->ifcount > ps->ifaces_size) {
616 if (ps->ifaces_size == 0) {
622 * ps->ifaces_size == 0 if ps->ifaces == NULL,
642 if (ps->ifaces_size * 2 < ps->ifaces_size) {
645 * ps->ifaces_size overflows is the largest
646 * possible 32-bit power of 2, as we do
656 * ps->ifaces_size * 2 doesn't overflow, so it's
659 new_ifaces_size = ps->ifaces_size * 2;
665 * That can happen on 32-bit platforms, with a 32-bit
666 * size_t; it shouldn't happen on 64-bit platforms,
667 * with a 64-bit size_t, as new_ifaces_size is
672 * As this fails only with 32-bit size_t,
673 * the multiplication was 32x32->32, and
674 * the largest 32-bit value that can safely
676 * without overflow is the largest 32-bit
685 new_ifaces = realloc(ps->ifaces, new_ifaces_size * sizeof (struct pcap_ng_if));
693 "out of memory for per-interface information (%u interfaces)",
694 ps->ifcount);
697 ps->ifaces_size = new_ifaces_size;
698 ps->ifaces = new_ifaces;
701 ps->ifaces[ps->ifcount - 1].snaplen = idbp->snaplen;
715 errbuf) == -1)
718 ps->ifaces[ps->ifcount - 1].tsresol = tsresol;
719 ps->ifaces[ps->ifcount - 1].tsoffset = tsoffset;
725 if (tsresol == ps->user_tsresol) {
730 ps->ifaces[ps->ifcount - 1].scale_type = PASS_THROUGH;
731 } else if (tsresol > ps->user_tsresol) {
737 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_BIN;
742 ps->ifaces[ps->ifcount - 1].scale_factor = tsresol/ps->user_tsresol;
743 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_DOWN_DEC;
751 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_BIN;
756 ps->ifaces[ps->ifcount - 1].scale_factor = ps->user_tsresol/tsresol;
757 ps->ifaces[ps->ifcount - 1].scale_type = SCALE_UP_DEC;
796 * XXX - check whether this looks like what the block
799 * does, look for the byte-order magic number in
815 * fixed-length portion of the SHB, and look for the byte-order
885 p->swapped = swapped;
886 ps = p->priv;
894 ps->user_tsresol = 1000000;
898 ps->user_tsresol = 1000000000;
909 p->opt.tstamp_precision = precision;
918 * Packet Block containing a full-size Ethernet frame, and
923 * INITIAL_MAX_BLOCKSIZE; if we see any link-layer header types
925 * block length, we boost the maximum.
927 p->bufsize = 2048;
928 if (p->bufsize < total_length)
929 p->bufsize = total_length;
930 p->buffer = malloc(p->bufsize);
931 if (p->buffer == NULL) {
937 ps->max_blocksize = INITIAL_MAX_BLOCKSIZE;
943 bhdrp = (struct block_header *)p->buffer;
944 shbp = (struct section_header_block *)((u_char *)p->buffer + sizeof(struct block_header));
945 bhdrp->block_type = magic_int;
946 bhdrp->total_length = total_length;
947 shbp->byte_order_magic = byte_order_magic;
949 (u_char *)p->buffer + (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)),
950 total_length - (sizeof(magic_int) + sizeof(total_length) + sizeof(byte_order_magic)),
951 1, errbuf) == -1)
954 if (p->swapped) {
956 * Byte-swap the fields we've read.
958 shbp->major_version = SWAPSHORT(shbp->major_version);
959 shbp->minor_version = SWAPSHORT(shbp->minor_version);
962 * XXX - we don't care about the section length.
967 See the current version of the pcapng specification.
974 XXX - the pcapng specification says that readers should
979 if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR &&
980 (shbp->minor_version == PCAP_NG_VERSION_MINOR ||
981 shbp->minor_version == 2))) {
984 shbp->major_version, shbp->minor_version);
987 p->version_major = shbp->major_version;
988 p->version_minor = shbp->minor_version;
993 p->opt.tstamp_precision = precision;
1004 /* EOF - no IDB in this file */
1009 if (status == -1)
1015 * Get a pointer to the fixed-length portion of the
1024 * Byte-swap it if necessary.
1026 if (p->swapped) {
1027 idbp->linktype = SWAPSHORT(idbp->linktype);
1028 idbp->snaplen = SWAPLONG(idbp->snaplen);
1044 * not valid, as we don't know what link-layer
1060 p->linktype = linktype_to_dlt(idbp->linktype);
1061 p->snapshot = pcapint_adjust_snapshot(p->linktype, idbp->snaplen);
1062 p->linktype_ext = 0;
1066 * snapshot length for this DLT_ is bigger than the current
1069 if (MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype)) > ps->max_blocksize)
1070 ps->max_blocksize = MAX_BLOCKSIZE_FOR_SNAPLEN(max_snaplen_for_dlt(p->linktype));
1072 p->next_packet_op = pcap_ng_next_packet;
1073 p->cleanup_op = pcap_ng_cleanup;
1078 free(ps->ifaces);
1079 free(p->buffer);
1088 struct pcap_ng_sf *ps = p->priv;
1090 free(ps->ifaces);
1097 * if there were no more packets, and -1 on an error.
1102 struct pcap_ng_sf *ps = p->priv;
1111 FILE *fp = p->rfile;
1123 status = read_block(fp, p, &cursor, p->errbuf);
1126 if (status == -1)
1127 return (-1); /* error */
1132 * Get a pointer to the fixed-length portion of the
1136 p->errbuf);
1138 return (-1); /* error */
1141 * Byte-swap it if necessary.
1143 if (p->swapped) {
1145 interface_id = SWAPLONG(epbp->interface_id);
1146 hdr->caplen = SWAPLONG(epbp->caplen);
1147 hdr->len = SWAPLONG(epbp->len);
1148 t = ((uint64_t)SWAPLONG(epbp->timestamp_high)) << 32 |
1149 SWAPLONG(epbp->timestamp_low);
1151 interface_id = epbp->interface_id;
1152 hdr->caplen = epbp->caplen;
1153 hdr->len = epbp->len;
1154 t = ((uint64_t)epbp->timestamp_high) << 32 |
1155 epbp->timestamp_low;
1161 * Get a pointer to the fixed-length portion of the
1165 p->errbuf);
1167 return (-1); /* error */
1176 * Byte-swap it if necessary.
1178 if (p->swapped) {
1180 hdr->len = SWAPLONG(spbp->len);
1182 hdr->len = spbp->len;
1189 hdr->caplen = hdr->len;
1190 if (hdr->caplen > (bpf_u_int32)p->snapshot)
1191 hdr->caplen = p->snapshot;
1197 * Get a pointer to the fixed-length portion of the
1201 p->errbuf);
1203 return (-1); /* error */
1206 * Byte-swap it if necessary.
1208 if (p->swapped) {
1210 interface_id = SWAPSHORT(pbp->interface_id);
1211 hdr->caplen = SWAPLONG(pbp->caplen);
1212 hdr->len = SWAPLONG(pbp->len);
1213 t = ((uint64_t)SWAPLONG(pbp->timestamp_high)) << 32 |
1214 SWAPLONG(pbp->timestamp_low);
1216 interface_id = pbp->interface_id;
1217 hdr->caplen = pbp->caplen;
1218 hdr->len = pbp->len;
1219 t = ((uint64_t)pbp->timestamp_high) << 32 |
1220 pbp->timestamp_low;
1227 * to its fixed-length portion.
1230 p->errbuf);
1232 return (-1); /* error */
1235 * Byte-swap it if necessary.
1237 if (p->swapped) {
1238 idbp->linktype = SWAPSHORT(idbp->linktype);
1239 idbp->snaplen = SWAPLONG(idbp->snaplen);
1243 * If the link-layer type or snapshot length
1247 * XXX - just discard packets from those
1250 if (p->linktype != idbp->linktype) {
1251 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1253 idbp->linktype);
1254 return (-1);
1261 if ((bpf_u_int32)p->snapshot !=
1262 pcapint_adjust_snapshot(p->linktype, idbp->snaplen)) {
1263 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1265 idbp->snaplen);
1266 return (-1);
1272 if (!add_interface(p, idbp, &cursor, p->errbuf))
1273 return (-1);
1279 * to its fixed-length portion.
1282 p->errbuf);
1284 return (-1); /* error */
1291 if (p->swapped) {
1292 shbp->byte_order_magic =
1293 SWAPLONG(shbp->byte_order_magic);
1294 shbp->major_version =
1295 SWAPSHORT(shbp->major_version);
1303 switch (shbp->byte_order_magic) {
1315 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1317 return (-1);
1323 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1325 return (-1);
1332 if (shbp->major_version != PCAP_NG_VERSION_MAJOR) {
1333 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1335 shbp->major_version);
1336 return (-1);
1348 ps->ifcount = 0;
1363 if (interface_id >= ps->ifcount) {
1367 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1370 return (-1);
1373 if (hdr->caplen > (bpf_u_int32)p->snapshot) {
1374 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1376 "snaplen of %d", hdr->caplen, p->snapshot);
1377 return (-1);
1382 * with the fractions being in units of the file-supplied resolution.
1384 sec = t / ps->ifaces[interface_id].tsresol + ps->ifaces[interface_id].tsoffset;
1385 frac = t % ps->ifaces[interface_id].tsresol;
1388 * Convert the fractions from units of the file-supplied resolution
1389 * to units of the user-requested resolution.
1391 switch (ps->ifaces[interface_id].scale_type) {
1405 * the quotient of the user-requested resolution and the
1406 * file-supplied resolution.
1408 * Those resolutions are both powers of 10, and the user-
1409 * requested resolution is greater than the file-supplied
1414 frac *= ps->ifaces[interface_id].scale_factor;
1422 * the quotient of the user-requested resolution and the
1423 * file-supplied resolution.
1425 * The file-supplied resolution is a power of 2, so the
1428 * user-requested resolution and divide by the file-
1431 * XXX - Is there something clever we could do here,
1432 * given that we know that the file-supplied resolution
1435 * two non-simple arithmetic operations.
1437 frac *= ps->user_tsresol;
1438 frac /= ps->ifaces[interface_id].tsresol;
1446 * the quotient of the user-requested resolution and the
1447 * file-supplied resolution.
1449 * Those resolutions are both powers of 10, and the user-
1450 * requested resolution is less than the file-supplied
1457 frac /= ps->ifaces[interface_id].scale_factor;
1466 * quotient of the user-requested resolution and the
1467 * file-supplied resolution. We do that by multiplying
1468 * by the user-requested resolution and dividing by the
1469 * file-supplied resolution, as the quotient might not
1472 * The file-supplied resolution is a power of 2, so the
1475 * integer arithmetic, we multiply by the user-requested
1476 * resolution and divide by the file-supplied resolution.
1478 * XXX - Is there something clever we could do here,
1479 * given that we know that the file-supplied resolution
1482 * two non-simple arithmetic operations.
1484 frac *= ps->user_tsresol;
1485 frac /= ps->ifaces[interface_id].tsresol;
1493 hdr->ts.tv_sec = (long)sec;
1494 hdr->ts.tv_usec = (long)frac;
1498 * suseconds_t in UN*Xes that work the way the current Single
1499 * UNIX Standard specify - but not all older UN*Xes necessarily
1502 hdr->ts.tv_sec = (time_t)sec;
1503 hdr->ts.tv_usec = (int)frac;
1509 *data = get_from_block_data(&cursor, hdr->caplen, p->errbuf);
1511 return (-1);
1513 pcapint_post_process(p->linktype, p->swapped, hdr, *data);