diff options
Diffstat (limited to 'wiretap/pcapng.c')
| -rw-r--r-- | wiretap/pcapng.c | 592 |
1 files changed, 436 insertions, 156 deletions
diff --git a/wiretap/pcapng.c b/wiretap/pcapng.c index 96a487825b..6eb84c2a43 100644 --- a/wiretap/pcapng.c +++ b/wiretap/pcapng.c @@ -25,6 +25,8 @@ /* File format reference: * http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html + * Related Wiki page: + * http://wiki.wireshark.org/Development/PcapNg */ #ifdef HAVE_CONFIG_H @@ -102,12 +104,19 @@ typedef struct pcapng_enhanced_packet_block_s { /* ... Options ... */ } pcapng_enhanced_packet_block_t; +/* pcapng: simple packet block */ +typedef struct pcapng_simple_packet_block_s { + guint32 packet_len; + /* ... Packet Data ... */ + /* ... Padding ... */ +} pcapng_simple_packet_block_t; + /* pcapng: common option header for every option type */ typedef struct pcapng_option_header_s { guint16 option_code; guint16 option_length; - /* x bytes option_body */ - /* alignment to 32 bits */ + /* ... x bytes Option Body ... */ + /* ... Padding ... */ } pcapng_option_header_t; /* Block types */ @@ -158,17 +167,25 @@ typedef struct wtapng_packet_s { /* mandatory */ guint32 ts_high; /* seconds since 1.1.1970 */ guint32 ts_low; /* fraction of seconds, depends on if_tsaccur */ - guint32 cap_len; - guint32 packet_len; + guint32 cap_len; /* data length in the file */ + guint32 packet_len; /* data length on the wire */ /* options */ gchar *opt_comment; /* NULL if not available */ guint64 drop_count; /* 0xFFFFFFFF if unknown */ - /* pack_flags */ + guint32 pack_flags; /* XXX - 0 for now (any value for "we don't have it"?) */ /* pack_hash */ /* XXX - put the packet data / pseudo_header here as well? */ } wtapng_packet_t; +/* Simple Packets */ +typedef struct wtapng_simple_packet_s { + /* mandatory */ + guint32 cap_len; /* data length in the file */ + guint32 packet_len; /* data length on the wire */ + /* XXX - put the packet data / pseudo_header here as well? */ +} wtapng_simple_packet_t; + /* Name Resolution */ typedef struct wtapng_name_res_s { /* options */ @@ -199,11 +216,12 @@ typedef struct wtapng_if_stats_s { typedef struct wtapng_block_s { guint32 type; /* block_type as defined by pcapng */ union { - wtapng_section_t section; - wtapng_if_descr_t if_descr; - wtapng_packet_t packet; - wtapng_name_res_t name_res; - wtapng_if_stats_t if_stats; + wtapng_section_t section; + wtapng_if_descr_t if_descr; + wtapng_packet_t packet; + wtapng_simple_packet_t simple_packet; + wtapng_name_res_t name_res; + wtapng_if_stats_t if_stats; } data; /* XXX - currently don't know how to handle these! */ @@ -213,12 +231,72 @@ typedef struct wtapng_block_s { static int +pcapng_read_option(FILE_T fh, pcapng_t *pn, pcapng_option_header_t *oh, char *content, int len, int *err, gchar **err_info _U_) +{ + int bytes_read; + int block_read; + guint64 file_offset64; + + + /* read option header */ + errno = WTAP_ERR_CANT_READ; + bytes_read = file_read(oh, 1, sizeof oh, fh); + if (bytes_read != sizeof oh) { + g_warning("pcapng_read_option: failed to read option"); + *err = file_error(fh); + if (*err != 0) + return -1; + return 0; + } + block_read = sizeof oh; + if(pn->byte_swapped) { + oh->option_code = BSWAP16(oh->option_code); + oh->option_length = BSWAP32(oh->option_length); + } + + /* sanity check: option length */ + if (oh->option_length > len) { + g_warning("pcapng_read_option: option_length %u larger than buffer (%u)", + oh->option_length, len); + return 0; + } + + /* read option content */ + errno = WTAP_ERR_CANT_READ; + bytes_read = file_read(content, 1, oh->option_length, fh); + if (bytes_read != oh->option_length) { + g_warning("pcapng_read_if_descr_block: failed to read content of option %u", oh->option_code); + *err = file_error(fh); + if (*err != 0) + return -1; + return 0; + } + block_read += oh->option_length; + + /* jump over potential padding bytes at end of option */ + if( (oh->option_length % 4) != 0) { + file_offset64 = file_seek(fh, 4 - (oh->option_length % 4), SEEK_CUR, err); + if (file_offset64 <= 0) { + if (*err != 0) + return -1; + return 0; + } + block_read += 4 - (oh->option_length % 4); + } + + return block_read; +} + + +static int pcapng_read_section_header_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wtapng_block_t *wblock, int *err, gchar **err_info _U_) { int bytes_read; + int block_read; int to_read; pcapng_section_header_block_t shb; - guint64 file_offset64; + pcapng_option_header_t oh; + char option_content[100]; /* XXX - size might need to be increased, if we see longer options */ /* read block content */ @@ -230,6 +308,7 @@ pcapng_read_section_header_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t return -1; return 0; } + block_read = bytes_read; /* is the magic number one we expect? */ switch(shb.magic) { @@ -270,24 +349,76 @@ pcapng_read_section_header_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t /* XXX - no proper way to read/swap 64 bit values -> so ignore the 64bit section_length for now! */ wblock->data.section.section_length = -1; /* shb.section_length */ - /* XXX - we ignore SHB options for now */ - /* "Section Header Block" jump over the Options (and the repeated block length at the end) */ - errno = WTAP_ERR_CANT_READ; - to_read = bh->block_total_length - sizeof(pcapng_block_header_t) - sizeof (pcapng_section_header_block_t); - file_offset64 = file_seek(fh, to_read, SEEK_CUR, err); - if (file_offset64 <= 0) { - if (*err != 0) - return -1; - return 0; - } - - /* options */ + /* Option defaults */ wblock->data.section.opt_comment = NULL; wblock->data.section.shb_hardware = NULL; wblock->data.section.shb_os = NULL; wblock->data.section.shb_user_appl = NULL; - return bytes_read + to_read; + /* Options */ + errno = WTAP_ERR_CANT_READ; + to_read = bh->block_total_length + - sizeof(pcapng_block_header_t) + - sizeof (pcapng_section_header_block_t) + - sizeof(bh->block_total_length); + while(to_read > 0) { + /* read option */ + bytes_read = pcapng_read_option(fh, pn, &oh, option_content, sizeof(option_content), err, err_info); + if (bytes_read <= 0) { + g_warning("pcapng_read_section_header_block: failed to read option"); + return bytes_read; + } + block_read += bytes_read; + to_read -= bytes_read; + + /* handle option content */ + switch(oh.option_code) { + case(0): /* opt_endofopt */ + if(to_read != 0) { + g_warning("pcapng_read_section_header_block: %u bytes after opt_endofopt", to_read); + } + /* padding should be ok here, just get out of this */ + to_read = 0; + break; + case(1): /* opt_comment */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.section.opt_comment = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_section_header_block: opt_comment %s", wblock->data.section.opt_comment); + } else { + g_warning("pcapng_read_section_header_block: opt_comment length %u seems strange", oh.option_length); + } + break; + case(2): /* shb_hardware */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.section.shb_hardware = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_section_header_block: shb_hardware %s", wblock->data.section.shb_hardware); + } else { + g_warning("pcapng_read_section_header_block: shb_hardware length %u seems strange", oh.option_length); + } + break; + case(3): /* shb_os */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.section.shb_os = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_section_header_block: shb_os %s", wblock->data.section.shb_os); + } else { + g_warning("pcapng_read_section_header_block: shb_os length %u seems strange", oh.option_length); + } + break; + case(4): /* shb_userappl */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.section.shb_user_appl = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_section_header_block: shb_userappl %s", wblock->data.section.shb_user_appl); + } else { + g_warning("pcapng_read_section_header_block: shb_userappl length %u seems strange", oh.option_length); + } + break; + default: + g_warning("pcapng_read_section_header_block: unknown option %u - ignoring %u bytes", + oh.option_code, oh.option_length); + } + } + + return block_read; } @@ -298,10 +429,9 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, w int bytes_read; int block_read; int to_read; - guint64 file_offset64; pcapng_interface_description_block_t idb; pcapng_option_header_t oh; - char option_content[100]; + char option_content[100]; /* XXX - size might need to be increased, if we see longer options */ /* read block content */ @@ -316,7 +446,7 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, w } block_read = bytes_read; - /* mandatory value */ + /* mandatory values */ if(pn->byte_swapped) { wblock->data.if_descr.link_type = BSWAP16(idb.linktype); wblock->data.if_descr.snap_len = BSWAP32(idb.snaplen); @@ -330,7 +460,7 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, w /* XXX - sanity check of snapshot length */ /* XXX - while a very big snapshot length is valid, it's more likely that it's a bug in the file */ - /* XXX - so do a sanity check for now, it's likely a byte swap order problem */ + /* XXX - so do a sanity check for now, it's likely e.g. a byte swap order problem */ if(wblock->data.if_descr.snap_len > 65535) { g_warning("pcapng_read_if_descr_block: snapshot length %u unrealistic", wblock->data.if_descr.snap_len); @@ -338,7 +468,7 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, w return 0; } - /* default values for IDB options */ + /* Option defaults */ wblock->data.if_descr.opt_comment = NULL; wblock->data.if_descr.if_name = NULL; wblock->data.if_descr.if_description = NULL; @@ -354,56 +484,67 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, w /* XXX: guint64 if_tsoffset; */ - /* IDB options */ + /* Options */ errno = WTAP_ERR_CANT_READ; - to_read = bh->block_total_length - sizeof(pcapng_block_header_t) - sizeof (pcapng_interface_description_block_t); + to_read = bh->block_total_length + - sizeof(pcapng_block_header_t) + - sizeof (pcapng_interface_description_block_t) + - sizeof(bh->block_total_length); while(to_read > 0) { - /* read option header */ - errno = WTAP_ERR_CANT_READ; - bytes_read = file_read(&oh, 1, sizeof oh, fh); - if (bytes_read != sizeof oh) { - g_warning("pcapng_read_if_descr_block: failed to read option"); - *err = file_error(fh); - if (*err != 0) - return -1; - return 0; + /* read option */ + bytes_read = pcapng_read_option(fh, pn, &oh, option_content, sizeof(option_content), err, err_info); + if (bytes_read <= 0) { + g_warning("pcapng_read_if_descr_block: failed to read option"); + return bytes_read; } - block_read += sizeof oh; - to_read -= sizeof oh; - if(pn->byte_swapped) { - oh.option_code = BSWAP16(oh.option_code); - oh.option_length = BSWAP32(oh.option_length); - } - - /* sanity check: option length */ - /* XXX - might need to be increased, if we see longer options */ - if (oh.option_length > sizeof option_content) { - g_warning("pcapng_read_if_descr_block: option_length %u seems pretty large", oh.option_length); - return 0; - } - - /* read option content */ - errno = WTAP_ERR_CANT_READ; - bytes_read = file_read(option_content, 1, oh.option_length, fh); - if (bytes_read != oh.option_length) { - g_warning("pcapng_read_if_descr_block: failed to read content of option %u", oh.option_code); - *err = file_error(fh); - if (*err != 0) - return -1; - return 0; - } - block_read += oh.option_length; - to_read -= oh.option_length; + block_read += bytes_read; + to_read -= bytes_read; /* handle option content */ switch(oh.option_code) { case(0): /* opt_endofopt */ - if(to_read != 4) { - g_warning("pcapng_read_if_descr_block: %u bytes after opt_endofopt", to_read - 4); + if(to_read != 0) { + g_warning("pcapng_read_if_descr_block: %u bytes after opt_endofopt", to_read); } /* padding should be ok here, just get out of this */ to_read = 0; break; + case(1): /* opt_comment */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.section.opt_comment = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_if_descr_block: opt_comment %s", wblock->data.section.opt_comment); + } else { + g_warning("pcapng_read_if_descr_block: opt_comment length %u seems strange", oh.option_length); + } + break; + case(2): /* if_name */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.if_descr.if_name = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_if_descr_block: if_name %s", wblock->data.if_descr.if_name); + } else { + g_warning("pcapng_read_if_descr_block: if_name length %u seems strange", oh.option_length); + } + break; + case(3): /* if_description */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.if_descr.if_description = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_if_descr_block: if_description %s", wblock->data.if_descr.if_description); + } else { + g_warning("pcapng_read_if_descr_block: if_description length %u seems strange", oh.option_length); + } + break; + case(8): /* if_speed */ + if(oh.option_length == 8) { + wblock->data.if_descr.if_speed = *((guint64 *)option_content); + /* XXX - need 64 bit byte swap */ + /*if(pn->byte_swapped) + wblock->data.if_descr.if_speed = BSWAP64(wblock->data.if_descr.if_speed);*/ + + g_warning("pcapng_read_if_descr_block: if_speed %u (bps)", wblock->data.if_descr.if_speed); + } else { + g_warning("pcapng_read_if_descr_block: if_speed length %u not 8 as expected", oh.option_length); + } + break; case(9): /* if_tsaccur */ if(oh.option_length == 1) { wblock->data.if_descr.if_tsaccur = option_content[0]; @@ -426,31 +567,8 @@ pcapng_read_if_descr_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, w g_warning("pcapng_read_if_descr_block: unknown option %u - ignoring %u bytes", oh.option_code, oh.option_length); } - - /* jump over potential padding bytes at end of option */ - if( (oh.option_length % 4) != 0) { - file_offset64 = file_seek(fh, 4 - (oh.option_length % 4), SEEK_CUR, err); - if (file_offset64 <= 0) { - if (*err != 0) - return -1; - return 0; - } - block_read += 4 - (oh.option_length % 4); - to_read -= 4 - (oh.option_length % 4); - } - } - /* jump over the repeated block length at the end of the block */ - /* XXX - add a sanity check here? */ - file_offset64 = file_seek(fh, 4, SEEK_CUR, err); - if (file_offset64 <= 0) { - if (*err != 0) - return -1; - return 0; - } - block_read += 4; - return block_read; } @@ -459,14 +577,16 @@ static int pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wtapng_block_t *wblock,int *err, gchar **err_info _U_) { int bytes_read; - guint64 bytes_read64; + int block_read; int to_read; + guint64 file_offset64; pcapng_enhanced_packet_block_t epb; - int read_len = 0; guint32 block_total_length; + pcapng_option_header_t oh; + char option_content[100]; /* XXX - size might need to be increased, if we see longer options */ - /* "(Enhanced) Packet Block" read content */ + /* "(Enhanced) Packet Block" read fixed part */ errno = WTAP_ERR_CANT_READ; bytes_read = file_read(&epb, 1, sizeof epb, fh); if (bytes_read != sizeof epb) { @@ -474,8 +594,7 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta *err = file_error(fh); return 0; } - - read_len += sizeof epb; + block_read = bytes_read; /* XXX - as we currently ignore the interface id, both packet blocks are the same for us */ if(pn->byte_swapped) { @@ -501,9 +620,10 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta /* Ethernet FCS length, might be overwritten by "per packet" options */ ((union wtap_pseudo_header *) wblock->pseudo_header)->eth.fcs_len = pn->if_fcslen; + /* "(Enhanced) Packet Block" read capture data */ errno = WTAP_ERR_CANT_READ; bytes_read = file_read((guchar *) (wblock->frame_buffer), 1, wblock->data.packet.cap_len, fh); - if (bytes_read != (int) wblock->data.packet.cap_len) { + if (bytes_read != wblock->data.packet.cap_len) { *err = file_error(fh); g_warning("pcapng_read_packet_block: couldn't read %u bytes of captured data", wblock->data.packet.cap_len); @@ -511,69 +631,201 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta *err = WTAP_ERR_SHORT_READ; return FALSE; } - read_len += wblock->data.packet.cap_len; - - /* XXX - ignore Packet options for now */ - /* Packet jump over the Options (and the repeated block length at the end) */ + block_read += bytes_read; + + /* jump over potential padding bytes at end of the packet data */ + if( (wblock->data.packet.cap_len % 4) != 0) { + file_offset64 = file_seek(fh, 4 - (wblock->data.packet.cap_len % 4), SEEK_CUR, err); + if (file_offset64 <= 0) { + if (*err != 0) + return -1; + return 0; + } + block_read += 4 - (wblock->data.packet.cap_len % 4); + } - /* XXX - the "block total length" of some example files don't contain the padding bytes! */ + /* add padding bytes to "block total length" */ + /* (the "block total length" of some example files don't contain the packet data padding bytes!) */ if(bh->block_total_length % 4) { block_total_length = bh->block_total_length + 4 - (bh->block_total_length % 4); } else { block_total_length = bh->block_total_length; } - to_read = block_total_length - sizeof(pcapng_block_header_t) - sizeof (pcapng_enhanced_packet_block_t) - wblock->data.packet.cap_len; + /* Option defaults */ + wblock->data.packet.opt_comment = NULL; + wblock->data.packet.drop_count = -1; + wblock->data.packet.pack_flags = 0; /* XXX - is 0 ok to signal "not used"? */ - /* jump over the data padding and the Options, but not the repeated block length */ - to_read -= 4; + /* Options */ errno = WTAP_ERR_CANT_READ; - bytes_read64 = file_seek(fh, to_read, SEEK_CUR, err); - if (bytes_read64 <= 0) { - return 0; /* Seek error */ - } + to_read = block_total_length + - sizeof(pcapng_block_header_t) + - block_read /* fixed and variable part, including padding */ + - sizeof(bh->block_total_length); + while(to_read > 0) { + /* read option */ + bytes_read = pcapng_read_option(fh, pn, &oh, option_content, sizeof(option_content), err, err_info); + if (bytes_read <= 0) { + g_warning("pcapng_read_packet_block: failed to read option"); + return bytes_read; + } + block_read += bytes_read; + to_read -= bytes_read; - /* sanity check: first and second block lengths must match */ - /* XXX - move this out of the individual blocks into some common place? */ + /* handle option content */ + switch(oh.option_code) { + case(0): /* opt_endofopt */ + if(to_read != 0) { + g_warning("pcapng_read_packet_block: %u bytes after opt_endofopt", to_read); + } + /* padding should be ok here, just get out of this */ + to_read = 0; + break; + case(1): /* opt_comment */ + if(oh.option_length > 0 && oh.option_length < sizeof(option_content)) { + wblock->data.section.opt_comment = g_strndup(option_content, sizeof(option_content)); + g_warning("pcapng_read_packet_block: opt_comment %s", wblock->data.section.opt_comment); + } else { + g_warning("pcapng_read_packet_block: opt_comment length %u seems strange", oh.option_length); + } + break; + case(2): /* pack_flags / epb_flags */ + if(oh.option_length == 4) { + wblock->data.packet.pack_flags = *((guint32 *)option_content); + if(pn->byte_swapped) + wblock->data.packet.pack_flags = BSWAP32(wblock->data.packet.pack_flags); + g_warning("pcapng_read_if_descr_block: pack_flags %u (ignored)", wblock->data.packet.pack_flags); + } else { + g_warning("pcapng_read_if_descr_block: pack_flags length %u not 4 as expected", oh.option_length); + } + break; + default: + g_warning("pcapng_read_packet_block: unknown option %u - ignoring %u bytes", + oh.option_code, oh.option_length); + } + } + + return block_read; +} + + +static int +pcapng_read_simple_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wtapng_block_t *wblock,int *err, gchar **err_info _U_) +{ + int bytes_read; + int block_read; + guint64 file_offset64; + pcapng_simple_packet_block_t spb; + + + /* "Simple Packet Block" read fixed part */ errno = WTAP_ERR_CANT_READ; - bytes_read = file_read(&block_total_length, 1, sizeof block_total_length, fh); - if (bytes_read != sizeof block_total_length) { + bytes_read = file_read(&spb, 1, sizeof spb, fh); + if (bytes_read != sizeof spb) { + g_warning("pcapng_read_simple_packet_block: failed to read packet data"); *err = file_error(fh); return 0; } - if( !(block_total_length == bh->block_total_length) && - !((BSWAP32(block_total_length)) == bh->block_total_length) ) { - g_warning("pcapng_read_packet_block: total block lengths (first %u and second %u) don't match", - bh->block_total_length, block_total_length); - return 0; + block_read = bytes_read; + + if(pn->byte_swapped) { + wblock->data.simple_packet.packet_len = BSWAP32(spb.packet_len); + } else { + wblock->data.simple_packet.packet_len = spb.packet_len; + } + + wblock->data.simple_packet.cap_len = bh->block_total_length + - sizeof(pcapng_simple_packet_block_t) + - sizeof(bh->block_total_length); + + /*g_warning("pcapng_read_simple_packet_block: packet data: packet_len %u", + wblock->data.simple_packet.packet_len);*/ + + /* XXX - implement other linktypes then Ethernet */ + /* (or even better share the code with libpcap.c) */ + + /* Ethernet FCS length, might be overwritten by "per packet" options */ + ((union wtap_pseudo_header *) wblock->pseudo_header)->eth.fcs_len = pn->if_fcslen; + + /* "Simple Packet Block" read capture data */ + errno = WTAP_ERR_CANT_READ; + bytes_read = file_read((guchar *) (wblock->frame_buffer), 1, wblock->data.simple_packet.cap_len, fh); + if (bytes_read != wblock->data.simple_packet.cap_len) { + *err = file_error(fh); + g_warning("pcapng_read_simple_packet_block: couldn't read %u bytes of captured data", + wblock->data.simple_packet.cap_len); + if (*err == 0) + *err = WTAP_ERR_SHORT_READ; + return FALSE; } + block_read += bytes_read; + + /* jump over potential padding bytes at end of the packet data */ + if( (wblock->data.simple_packet.cap_len % 4) != 0) { + file_offset64 = file_seek(fh, 4 - (wblock->data.simple_packet.cap_len % 4), SEEK_CUR, err); + if (file_offset64 <= 0) { + if (*err != 0) + return -1; + return 0; + } + block_read += 4 - (wblock->data.simple_packet.cap_len % 4); + } - /* We read the packet successfully. */ - return read_len + to_read + 4; + return block_read; } +static int +pcapng_read_unknown_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wtapng_block_t *wblock,int *err, gchar **err_info _U_) +{ + int block_read; + guint64 file_offset64; + guint32 block_total_length; + + + /* add padding bytes to "block total length" */ + /* (the "block total length" of some example files don't contain any padding bytes!) */ + if(bh->block_total_length % 4) { + block_total_length = bh->block_total_length + 4 - (bh->block_total_length % 4); + } else { + block_total_length = bh->block_total_length; + } + + block_read = block_total_length - sizeof(bh->block_total_length); + + /* jump over this unknown block */ + file_offset64 = file_seek(fh, block_read, SEEK_CUR, err); + if (file_offset64 <= 0) { + if (*err != 0) + return -1; + return 0; + } + + return block_read; +} static int pcapng_read_block(FILE_T fh, pcapng_t *pn, wtapng_block_t *wblock, int *err, gchar **err_info) { - int bytes_read_header; - int bytes_read_content; + int block_read; + int bytes_read; pcapng_block_header_t bh; + guint32 block_total_length; /* Try to read the (next) block header */ errno = WTAP_ERR_CANT_READ; - bytes_read_header = file_read(&bh, 1, sizeof bh, fh); - if (bytes_read_header != sizeof bh) { - g_warning("pcapng_read_block: no more bytes"); + bytes_read = file_read(&bh, 1, sizeof bh, fh); + if (bytes_read != sizeof bh) { + g_warning("pcapng_read_block: end of file"); *err = file_error(fh); if (*err != 0) return -1; return 0; } - + block_read = bytes_read; if(pn->byte_swapped) { bh.block_type = BSWAP32(bh.block_type); bh.block_total_length = BSWAP32(bh.block_total_length); @@ -585,23 +837,49 @@ pcapng_read_block(FILE_T fh, pcapng_t *pn, wtapng_block_t *wblock, int *err, gch switch(bh.block_type) { case(BLOCK_TYPE_SHB): - bytes_read_content = pcapng_read_section_header_block(fh, &bh, pn, wblock, err, err_info); + bytes_read = pcapng_read_section_header_block(fh, &bh, pn, wblock, err, err_info); break; case(BLOCK_TYPE_IDB): - bytes_read_content = pcapng_read_if_descr_block(fh, &bh, pn, wblock, err, err_info); + bytes_read = pcapng_read_if_descr_block(fh, &bh, pn, wblock, err, err_info); break; case(BLOCK_TYPE_PB): - bytes_read_content = pcapng_read_packet_block(fh, &bh, pn, wblock, err, err_info); + bytes_read = pcapng_read_packet_block(fh, &bh, pn, wblock, err, err_info); + break; + case(BLOCK_TYPE_SPB): + bytes_read = pcapng_read_simple_packet_block(fh, &bh, pn, wblock, err, err_info); break; case(BLOCK_TYPE_EPB): - bytes_read_content = pcapng_read_packet_block(fh, &bh, pn, wblock, err, err_info); + bytes_read = pcapng_read_packet_block(fh, &bh, pn, wblock, err, err_info); break; default: - g_warning("pcapng_read_block: Unknown block_type: 0x%x", bh.block_type); - bytes_read_content = 0; + g_warning("pcapng_read_block: Unknown block_type: 0x%x (block ignored)", bh.block_type); + bytes_read = pcapng_read_unknown_block(fh, &bh, pn, wblock, err, err_info); + } + if(bytes_read <= 0) { + return bytes_read; + } + block_read += bytes_read; + + /* sanity check: first and second block lengths must match */ + errno = WTAP_ERR_CANT_READ; + bytes_read = file_read(&block_total_length, 1, sizeof block_total_length, fh); + if (bytes_read != sizeof block_total_length) { + g_warning("pcapng_read_block: couldn't read second block length"); + *err = file_error(fh); + return 0; } + block_read += bytes_read; + + if(pn->byte_swapped) + block_total_length = BSWAP32(block_total_length); - return (bytes_read_content == 0) ? 0 : bytes_read_header + bytes_read_content; + if( !(block_total_length == bh.block_total_length) ) { + g_warning("pcapng_read_block: total block lengths (first %u and second %u) don't match", + bh.block_total_length, block_total_length); + return 0; + } + + return block_read; } @@ -624,6 +902,7 @@ pcapng_open(wtap *wth, int *err, gchar **err_info) wblock.frame_buffer = NULL; wblock.pseudo_header = NULL; + /* read first block */ bytes_read = pcapng_read_block(wth->fh, &pn, &wblock, err, err_info); if (bytes_read <= 0) { @@ -709,33 +988,34 @@ pcapng_read(wtap *wth, int *err, gchar **err_info, wblock.pseudo_header = &wth->pseudo_header; /* read next block */ - bytes_read = pcapng_read_block(wth->fh, wth->capture.pcapng, &wblock, err, err_info); - if (bytes_read <= 0) { - *err = file_error(wth->fh); - /*g_warning("pcapng_read: couldn't read packet block");*/ - if (*err != 0) - return -1; - return 0; - } + while(1) { + bytes_read = pcapng_read_block(wth->fh, wth->capture.pcapng, &wblock, err, err_info); + if (bytes_read <= 0) { + *err = file_error(wth->fh); + /*g_warning("pcapng_read: couldn't read packet block");*/ + if (*err != 0) + return -1; + return 0; + } - /* block must be a "Packet Block" or an "Enhanced Packet Block" */ - if(wblock.type != BLOCK_TYPE_PB && wblock.type != BLOCK_TYPE_EPB) { + /* block must be a "Packet Block" or an "Enhanced Packet Block" -> otherwise continue */ + if(wblock.type == BLOCK_TYPE_PB || wblock.type == BLOCK_TYPE_EPB) { + break; + } + + /* XXX - improve handling of "unknown" blocks */ g_warning("pcapng_read: block type 0x%x not PB/EPB", wblock.type); - return 0; - } + } - if(bytes_read > 0) { - wth->phdr.caplen = wblock.data.packet.cap_len; - wth->phdr.len = wblock.data.packet.packet_len; - wth->phdr.ts.secs = wblock.data.packet.ts_high; - wth->phdr.ts.nsecs = wblock.data.packet.ts_low; + wth->phdr.caplen = wblock.data.packet.cap_len; + wth->phdr.len = wblock.data.packet.packet_len; + wth->phdr.ts.secs = wblock.data.packet.ts_high; + wth->phdr.ts.nsecs = wblock.data.packet.ts_low; - /*g_warning("Read length: %u Packet length: %u", bytes_read, wth->phdr.caplen);*/ - wth->data_offset += bytes_read; - return TRUE; - } else { - return FALSE; - } + /*g_warning("Read length: %u Packet length: %u", bytes_read, wth->phdr.caplen);*/ + wth->data_offset += bytes_read; + + return TRUE; } |