Save files

Writing and reading .nto files.

Generated by make docs from the source and GCC's call graph. Back to the Function explorer.

src/save/save_io.c

Byte-level I/O of the save files: big-endian write and read cursors, and the whole-file read and write

put_u8

void put_u8(save_wbuf_t *w, uint8_t v)

src/save/save_io.c:13 · non-static · both builds

src/save/save_io.c (from includes/save_format.h)

Called by: put_u16, put_host, put_mcast, put_l7, put_headers, put_record, put_filter, put_filters, put_local, write_save

put_u16

void put_u16(save_wbuf_t *w, uint16_t v)

src/save/save_io.c:18 · non-static · both builds

Called by: put_u32, put_answers, put_hosts, put_mcast, put_l7, put_headers, put_record, put_filter, put_filters, put_renames, put_local
Calls: put_u8

put_u32

void put_u32(save_wbuf_t *w, uint32_t v)

src/save/save_io.c:24 · non-static · both builds

Called by: put_u64, put_l7, put_headers, write_save
Calls: put_u16

put_u64

void put_u64(save_wbuf_t *w, uint64_t v)

src/save/save_io.c:30 · non-static · both builds

Called by: put_record
Calls: put_u32

put_bytes

void put_bytes(save_wbuf_t *w, const uint8_t *src, uint32_t len)

src/save/save_io.c:36 · non-static · both builds

Called by: put_host, put_mcast, put_l7, put_headers, put_record, put_filter, put_renames, put_local, write_save
Library and system calls: memcpy

get_u8

uint8_t get_u8(save_rbuf_t *r)

src/save/save_io.c:44 · non-static · both builds

Called by: get_u16, get_header_string, load_content, get_l7, get_mcast, get_headers, get_packet_fields, get_payload, get_record, get_ifname, get_filter, load_filters, load_local

get_u16

uint16_t get_u16(save_rbuf_t *r)

src/save/save_io.c:53 · non-static · both builds

Called by: get_u32, load_answers, load_hosts, get_l7, get_mcast, get_headers, get_packet_fields, get_payload, get_record, get_filter, load_filters, get_string, load_renames, load_local
Calls: get_u8

get_u32

uint32_t get_u32(save_rbuf_t *r)

src/save/save_io.c:60 · non-static · both builds

Called by: get_u64, load_records, get_l7, get_headers
Calls: get_u16

get_u64

uint64_t get_u64(save_rbuf_t *r)

src/save/save_io.c:67 · non-static · both builds

Called by: get_packet_fields
Calls: get_u32

get_bytes

const uint8_t *get_bytes(save_rbuf_t *r, uint32_t len)

src/save/save_io.c:74 · non-static · both builds

Points at the next len bytes and skips them. NULL past the end. (from includes/save_format.h)

Called by: get_addr, get_l7, get_headers, get_payload, get_record, get_ifname, get_filter, get_string, load_local

get_addr

int get_addr(save_rbuf_t *r, uint8_t *dest, int addr_len)

src/save/save_io.c:86 · non-static · both builds

An address of addr_len bytes into dest. 0 on success, 1 past the end. (from includes/save_format.h)

Called by: get_mcast
Calls: get_bytes
Library and system calls: memcpy

write_all

int write_all(int fd, const uint8_t *data, uint32_t len)

src/save/save_io.c:96 · non-static · both builds

write() until everything is out. 0 on success, 1 on error. (from includes/save_format.h)

Called by: put_answers, put_hosts, put_filters, put_renames, put_local, write_save
Library and system calls: write

read_file

uint8_t *read_file(int fd, uint32_t *len)

src/save/save_io.c:110 · non-static · both builds

Reads the whole -I file into memory. NULL on error. (from includes/save_format.h)

Called by: load_packets
Library and system calls: free, fstat, malloc, read

src/save/save_load.c

Loading the -I file at startup: header, sections, then the packets (load_packets)

load_error

int load_error(char *msg)

src/save/save_load.c:14 · non-static · both builds

src/save/save_load.c (from includes/save_format.h)

Called by: load_records, get_header_string, load_packets, load_answers, load_hosts, load_filters, load_renames, load_local
Calls: my_putstr

section_ok

static int section_ok(int count, uint32_t *counted)

src/save/save_load.c:21 · static · both builds

One section's count, -1 on error (already printed)

Called by: load_sections

load_sections

static int load_sections(netotter_t *netotter, save_rbuf_t *r, uint32_t counts[SAVE_EXTRA_COUNT])

src/save/save_load.c:31 · static · both builds

The sections between the header and the packets: filters, renamings, own addresses, reverse DNS answers, learned hostnames. Their counts go in counts. 0 on success, 1 on error.

Called by: load_records
Calls: section_ok, load_answers, load_hosts, load_filters, load_renames, load_local

load_records

static int load_records(netotter_t *netotter, save_rbuf_t *r, char *prog_version, char *lib_name)

src/save/save_load.c:47 · static · both builds

Reads every record after the header: the sections (load_sections), then the packets, whose stored payloads go to the store as they are. prog_version is the program version that saved the file, lib_name its OS backend. 0 on success, 1 on error.

Called by: load_content
Calls: get_u32, load_error, load_sections, get_record, print_extra_counts, fpacket_delete, packets_add, limit_message, print_alert, store_flush, my_putunbr, my_putstr

get_header_string

static int get_header_string(save_rbuf_t *r, char *buf)

src/save/save_load.c:95 · static · both builds

A header string: every char up to SAVE_VERSION_END, into buf (SAVE_VERSION_MAX + 1 bytes). Only printable chars: it goes to the terminal. 0 on success, 1 on a corrupted file (printed).

Called by: load_content
Calls: get_u8, load_error

load_content

static int load_content(netotter_t *netotter, save_rbuf_t *r)

src/save/save_load.c:110 · static · both builds

The header after the magic, then the records. Only the current format is read: older ones store the payloads uncompressed.

Called by: load_packets
Calls: get_u8, load_records, get_header_string, my_putunbr, my_putstr

load_packets

int load_packets(netotter_t *netotter)

src/save/save_load.c:130 · non-static · both builds

Loads args.fd_in (-I) into the packet list (from includes/netotter.h)

Called by: netotter
Calls: read_file, load_error, load_content
Library and system calls: free, memcmp

src/save/save_names.c

The names a save carries for its packets' addresses: the reverse DNS answers and the passively learned hostnames

mark_address

static uint16_t mark_address(reverse_t *rv, int1 v6, const uint8_t *ip, uint16_t count)

src/save/save_names.c:14 · static · both builds

Marks the stored answer of one address with the current save mark, counting it the first time. Returns the new count.

Called by: mark_ip
Calls: reverse_answer_find

mark_host

static uint16_t mark_host(hostmap_t *map, int1 v6, const uint8_t *ip, uint16_t count)

src/save/save_names.c:27 · static · both builds

Marks the passive hostname of one address with the current save mark, counting it the first time. Returns the new count.

Called by: mark_ip
Calls: hostmap_find

mark_ip

static void mark_ip(netotter_t *netotter, int1 v6, const uint8_t *ip, save_marks_t *marks)

src/save/save_names.c:40 · static · both builds

Marks the answer and the passive hostname of one address

Called by: mark_packet
Calls: mark_address, mark_host

mark_packet

void mark_packet(netotter_t *netotter, fpacket_t *packet, save_marks_t *marks)

src/save/save_names.c:48 · non-static · both builds

src/save/save_names.c Marks the answers and hostnames for the addresses of one saved packet (the ones lookups and the analysis view name: IPv4 and IPv6 sources and destinations) (from includes/save_format.h)

Called by: save_packets
Calls: mark_ip

put_answers

int put_answers(int fd, save_wbuf_t *w, reverse_t *rv, uint16_t answer_count)

src/save/save_names.c:60 · non-static · both builds

The answer count and the answers marked by this save, after what w already holds. Flushes w to fd when it fills up. 0 on success, 1 if a write fails. (from includes/save_format.h)

Called by: write_save
Calls: reverse_record_put, put_u16, write_all

put_host

static void put_host(save_wbuf_t *w, host_entry_t *entry)

src/save/save_names.c:85 · static · both builds

One hostname: the record of a reverse DNS answer (v6 flag, address, u8 name length + name)

Called by: put_hosts
Calls: put_u8, put_bytes, my_strlen

put_hosts

int put_hosts(int fd, save_wbuf_t *w, hostmap_t *map, uint16_t host_count)

src/save/save_names.c:95 · non-static · both builds

The hostname count and the hostnames marked by this save, after what w already holds. Flushes w to fd when it fills up. 0 on success, 1 if a write fails. (from includes/save_format.h)

Called by: write_save
Calls: put_u16, write_all, put_host

load_answers

int load_answers(netotter_t *netotter, save_rbuf_t *r)

src/save/save_names.c:118 · non-static · both builds

The reverse DNS answers section (format v11 and later), stored unless the address already has one (from the cache file). Returns how many it held, -1 on error. (from includes/save_format.h)

Called by: load_sections
Calls: reverse_record_get, reverse_answer_add, get_u16, load_error

load_hosts

int load_hosts(netotter_t *netotter, save_rbuf_t *r)

src/save/save_names.c:143 · non-static · both builds

The passively learned hostnames section, mapped as they are: nothing relearns names from the loaded packets. Returns how many it holds, -1 on error. (from includes/save_format.h)

Called by: load_sections
Calls: hostmap_set, reverse_record_get, get_u16, load_error

src/save/save_record.c

One packet record, both ways: its fields, its headers by SAVE_HAS_* layer, and its stored payload (never decompressed)

put_mcast

static void put_mcast(save_wbuf_t *w, mcast_header_t *m)

src/save/save_record.c:14 · static · both builds

Called by: put_headers
Calls: put_u8, put_u16, put_bytes

put_l7

static void put_l7(save_wbuf_t *w, const l7_info_t *l7)

src/save/save_record.c:34 · static · both builds

Called by: put_headers
Calls: put_u8, put_u16, put_u32, put_bytes

put_headers

static void put_headers(save_wbuf_t *w, fpacket_t *p)

src/save/save_record.c:65 · static · both builds

Called by: put_record
Calls: put_u8, put_u16, put_u32, put_bytes, put_mcast, put_l7

put_record

int put_record(save_wbuf_t *w, fpacket_t *p, payload_store_t *store)

src/save/save_record.c:122 · non-static · both builds

src/save/save_record.c Serializes one packet into w (emptied first), its payload copied as stored. 0 on success, 1 if it can't be read back. (from includes/save_format.h)

Called by: write_save
Calls: put_u8, put_u16, put_u64, put_bytes, put_headers, store_stored_bytes, my_strlen

alloc_headers

static int alloc_headers(fpacket_t *p, uint8_t layers)

src/save/save_record.c:160 · static · both builds

Allocates the headers announced by layers. 0 on success, 1 if an allocation fails (the packet keeps what was set, fpacket_delete frees it).

Called by: get_packet_fields
Library and system calls: calloc, malloc

get_l7

static void get_l7(save_rbuf_t *r, l7_info_t *l7)

src/save/save_record.c:191 · static · both builds

The application layer facts. A malformed one sets r->err: an unknown kind or method, a status out of range.

Called by: get_headers
Calls: get_u8, get_u16, get_u32, get_bytes
Library and system calls: memcpy

get_mcast

static void get_mcast(save_rbuf_t *r, fpacket_t *p)

src/save/save_record.c:240 · static · both builds

The IGMP / MLD part. A malformed one sets r->err: its IP version must be the packet's, the version in range, and kept within the records.

Called by: get_headers
Calls: get_u8, get_u16, get_addr
Library and system calls: memset

get_headers

static void get_headers(save_rbuf_t *r, fpacket_t *p)

src/save/save_record.c:274 · static · both builds

Called by: get_packet_fields
Calls: get_u8, get_u16, get_u32, get_bytes, get_l7, get_mcast
Library and system calls: memcpy

several_network_layers

static int several_network_layers(uint8_t layers)

src/save/save_record.c:349 · static · both builds

The packet fields after the ifname, up to the payload length (included) 1 if more than one network layer bit is set: a packet has one network header at most

Called by: get_packet_fields

get_packet_fields

static uint16_t get_packet_fields(save_rbuf_t *r, fpacket_t *p, uint8_t *layers)

src/save/save_record.c:357 · static · both builds

Called by: get_record
Calls: get_u8, get_u16, get_u64, alloc_headers, get_headers, several_network_layers

get_payload

static int get_payload(save_rbuf_t *r, fpacket_t *p, payload_store_t *store, uint16_t payload_len)

src/save/save_record.c:395 · static · both builds

The stored payload after the payload length: its stored length, flags and bytes, added to the store as they are (never decompressed here). 0 on success, 1 if they're malformed or can't be stored.

Called by: get_record
Calls: get_u8, get_u16, get_bytes, store_add

get_record

fpacket_t *get_record(save_rbuf_t *r, payload_store_t *store)

src/save/save_record.c:413 · non-static · both builds

Reads one record. NULL if it's malformed or an allocation fails. (from includes/save_format.h)

Called by: load_records
Calls: get_u8, get_u16, get_bytes, get_packet_fields, get_payload, fpacket_new, fpacket_delete
Library and system calls: memcpy

src/save/save_sections.c

The sections before the packets, both ways: active filters, renamings and the machine's own addresses

put_filter

static void put_filter(save_wbuf_t *w, filter_t *f)

src/save/save_sections.c:17 · static · both builds

Writes the file header and every record of pkt_l at the current position of fd. count is the number of records. 0 on success, 1 if a write fails or the record buffer can't be allocated.

Called by: put_filters
Calls: filter_kind, put_u8, put_u16, put_bytes, my_strlen

put_filters

int put_filters(int fd, save_wbuf_t *w, netotter_t *netotter, uint16_t filter_count)

src/save/save_sections.c:45 · non-static · both builds

src/save/save_sections.c The filter count and the first filter_count filters, after what w already holds. Flushes w to fd when it fills up. 0 on success, 1 if a write fails. (from includes/save_format.h)

Called by: write_save
Calls: put_u8, put_u16, write_all, put_filter

count_renames

uint16_t count_renames(rename_t *renames)

src/save/save_sections.c:63 · non-static · both builds

How many renamings get saved: the count is a u16 in the file, past that the rest isn't saved (from includes/save_format.h)

Called by: write_save, save_packets

put_renames

int put_renames(int fd, save_wbuf_t *w, rename_t *renames, uint16_t rename_count)

src/save/save_sections.c:74 · non-static · both builds

The renaming count and every renaming, after what w already holds. Flushes w to fd when it fills up (a renaming comes from one 'n' line, far smaller than the buffer). 0 on success, 1 if a write fails. (from includes/save_format.h)

Called by: write_save
Calls: put_u16, put_bytes, write_all, my_strlen

count_local

uint16_t count_local(local_addr_t *local)

src/save/save_sections.c:100 · non-static · both builds

How many own addresses get saved (a u16 in the file) (from includes/save_format.h)

Called by: write_save, save_packets

put_local

int put_local(int fd, save_wbuf_t *w, local_addr_t *local, uint16_t local_count)

src/save/save_sections.c:109 · non-static · both builds

The own address count and every address, after what w already holds. Flushes w to fd when it fills up. 0 on success, 1 if a write fails. (from includes/save_format.h)

Called by: write_save
Calls: put_u8, put_u16, put_bytes, write_all, my_strlen

get_ifname

static int get_ifname(save_rbuf_t *r, char ifname[16])

src/save/save_sections.c:130 · static · both builds

One saved filter. 0 on success, 1 if it's malformed. An interface name: u8 length (1 to 15) + printable chars, no space. 0 on success, 1 if it's malformed.

Called by: get_filter, load_local
Calls: get_u8, get_bytes

get_filter

static int get_filter(save_rbuf_t *r, filter_t *f)

src/save/save_sections.c:146 · static · both builds

Called by: load_filters
Calls: filter_kind, get_u8, get_u16, get_bytes, get_ifname
Library and system calls: memcpy, memset

load_filters

int load_filters(netotter_t *netotter, save_rbuf_t *r)

src/save/save_sections.c:198 · non-static · both builds

The filter section: restores the saved filters as the active ones, and their mode. Returns how many filters, -1 on error. (from includes/save_format.h)

Called by: load_sections
Calls: filters_append, get_u8, get_u16, load_error, get_filter

get_string

static char *get_string(save_rbuf_t *r)

src/save/save_sections.c:222 · static · both builds

One saved string (u16 length + text), allocated and '\0'-terminated. NULL if it's empty, cut short, holds a '\0' or an allocation fails.

Called by: load_renames
Calls: get_u16, get_bytes
Library and system calls: malloc, memchr, memcpy

load_renames

int load_renames(netotter_t *netotter, save_rbuf_t *r)

src/save/save_sections.c:238 · non-static · both builds

The renamings section (format v5 and later). Returns how many, -1 on error. (from includes/save_format.h)

Called by: load_sections
Calls: rename_set, get_u16, load_error, get_string
Library and system calls: free

load_local

int load_local(netotter_t *netotter, save_rbuf_t *r)

src/save/save_sections.c:260 · non-static · both builds

The own addresses section (format v6 and later): merged into netotter->local, marked as coming from the file. Returns how many it held, -1 on error. (from includes/save_format.h)

Called by: load_sections
Calls: local_add, local_sync_renames, get_u8, get_u16, get_bytes, load_error, get_ifname

src/save/save_write.c

Saving: opens the -O / O file and writes the header, the sections and the packets (save_packets, save_to_file)

save_error

static int save_error(char *msg)

src/save/save_write.c:15 · static · both builds

Called by: save_open, save_packets
Calls: my_putstr

with_save_ext

static char *with_save_ext(char *path)

src/save/save_write.c:23 · static · both builds

path with SAVE_EXT at the end, added when it's missing. Allocated, NULL if the allocation fails.

Called by: save_open
Calls: my_strlen, my_strcpy
Library and system calls: malloc, strcmp

save_open

int save_open(char *path)

src/save/save_write.c:40 · non-static · both builds

Save system (src/save/, format in save_format.h). 0 on success, 1 on error. save_open opens a save file for writing: SAVE_EXT is added to path when missing, the file is created owner-only (captures can hold private data) and isn't truncated, so a run that fails before the save leaves the old content intact. The fd, -1 on error (printed on stderr). (from includes/netotter.h)

Called by: open_save_file, save_to_file
Calls: save_error, with_save_ext, my_putstr
Library and system calls: _errno, close, free, fstat, open, strerror

is_saved

static int is_saved(netotter_t *netotter, fpacket_t *packet, int1 filtered)

src/save/save_write.c:65 · static · both builds

1 if the packet goes in the save: always, or only when the active filters show it if filtered is set

Called by: write_save, save_packets
Calls: filters_match

write_save

static int write_save(int fd, netotter_t *netotter, uint32_t count, uint16_t filter_count, save_marks_t *marks, int1 filtered)

src/save/save_write.c:72 · static · both builds

Called by: save_packets
Calls: put_u8, put_u32, put_bytes, write_all, put_answers, put_hosts, put_record, put_filters, count_renames, put_renames, count_local, put_local, is_saved, my_strlen
Library and system calls: free, malloc

print_extra_counts

void print_extra_counts(const uint32_t counts[SAVE_EXTRA_COUNT])

src/save/save_write.c:113 · non-static · both builds

src/save/save_write.c ", 2 filters, 3 renamings, 12 own addresses, 40 reverse DNS answers and 25 learned hostnames" after the packet count (counts: filters, renamings, own addresses, answers, hostnames): only the non-zero ones, the last one joined with " and " (from includes/save_format.h)

Called by: load_records, save_packets
Calls: my_putunbr, my_putstr

save_packets

int save_packets(netotter_t *netotter, int fd, int1 filtered)

src/save/save_write.c:134 · non-static · both builds

Dumps the packet list into fd (truncated first), used by -O at exit With filtered set, only the packets the active filters show are saved (the 'o' command); the filters themselves are always saved. (from includes/netotter.h)

Called by: start_program, save_to_file
Calls: mark_packet, count_renames, count_local, save_error, is_saved, write_save, print_extra_counts, my_putunbr, my_putstr
Library and system calls: ftruncate, lseek

save_to_file

int save_to_file(netotter_t *netotter, char *path, int1 filtered)

src/save/save_write.c:180 · non-static · both builds

save_open + save_packets + close, used by the 'O' and 'o' commands (from includes/netotter.h)

Called by: save_command
Calls: save_open, save_packets
Library and system calls: close