/src/libpcap/pcap-util.c

Source
/*
 * Copyright (c) 1993, 1994, 1995, 1996, 1997
 *  The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that: (1) source code distributions
 * retain the above copyright notice and this paragraph in its entirety, (2)
 * distributions including binary code include the above copyright notice and
 * this paragraph in its entirety in the documentation or other materials
 * provided with the distribution, and (3) all advertising materials mentioning
 * features or use of this software display the following acknowledgement:
 * ``This product includes software developed by the University of California,
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
 * the University nor the names of its contributors may be used to endorse
 * or promote products derived from this software without specific prior
 * written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 *
 * pcap-util.c - common code for various files
 */

#include <config.h>

#include <stddef.h>

#include <pcap-types.h>

#include "pcap/can_socketcan.h"
#include "pcap/sll.h"
#include "pcap/usb.h"
#include "pcap/nflog.h"

#include "pcap-int.h"
#include "extract.h"
#include "pcap-usb-linux-common.h"

#include "pcap-util.h"
#include "pflog.h"

/*
 * Most versions of the DLT_PFLOG pseudo-header have UID and PID fields
 * that are saved in host byte order.
 *
 * When reading a DLT_PFLOG packet, we need to convert those fields from
 * the byte order of the host that wrote the file to this host's byte
 * order.
 */
static void
swap_pflog_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
  u_int caplen = hdr->caplen;
  u_int length = hdr->len;
  u_int pfloghdr_length;
  struct pfloghdr *pflhdr = (struct pfloghdr *)buf;

  if (caplen < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid) ||
      length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) {
    /* Not enough data to have the uid field */
    return;
  }

  pfloghdr_length = pflhdr->length;

  if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) {
    /* Header doesn't include uid field */
    return;
  }
  pflhdr->uid = SWAPLONG(pflhdr->uid);

  if (caplen < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid) ||
      length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) {
    /* Not enough data to have the pid field */
    return;
  }
  if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) {
    /* Header doesn't include pid field */
    return;
  }
  pflhdr->pid = SWAPLONG(pflhdr->pid);

  if (caplen < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid) ||
      length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) {
    /* Not enough data to have the rule_uid field */
    return;
  }
  if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) {
    /* Header doesn't include rule_uid field */
    return;
  }
  pflhdr->rule_uid = SWAPLONG(pflhdr->rule_uid);

  if (caplen < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid) ||
      length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) {
    /* Not enough data to have the rule_pid field */
    return;
  }
  if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) {
    /* Header doesn't include rule_pid field */
    return;
  }
  pflhdr->rule_pid = SWAPLONG(pflhdr->rule_pid);
}

/*
 * Linux cooked capture packets with a protocol type of LINUX_SLL_P_CAN or
 * LINUX_SLL_P_CANFD have SocketCAN CAN classic/CAN FD headers in front
 * of the payload,with the CAN ID being in the byte order of the host
 * that wrote the packet, and Linux cooked capture packets with a protocol
 * type of LINUX_SLL_P_CANXL have SocketCAN CAN XL headers in front of the
 * payload with the protocol/VCID field, the payload length, and the
 * acceptance field in the byte order of the host that wrote the packet.
 *
 * When reading a Linux cooked capture packet, we need to check for those
 * packets and, if the byte order host that wrote the packet, as
 * indicated by the byte order of the pcap file or pcapng section
 * containing the packet, is the opposite of our byte order, convert
 * the header files to our byte order by byte-swapping them.
 */
static void
swap_socketcan_header(uint16_t protocol, u_int caplen, u_int length,
    u_char *buf)
{
  pcap_can_socketcan_hdr *hdrp;
  pcap_can_socketcan_xl_hdr *xl_hdrp;

  switch (protocol) {

  case LINUX_SLL_P_CAN:
  case LINUX_SLL_P_CANFD:
    /*
     * CAN classic/CAN FD packet; fix up the packet's header
     * by byte-swapping the CAN ID field.
     */
    hdrp = (pcap_can_socketcan_hdr *)buf;
    if (caplen < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id) ||
        length < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id)) {
      /* Not enough data to have the can_id field */
      return;
    }
    hdrp->can_id = SWAPLONG(hdrp->can_id);
    break;

  case LINUX_SLL_P_CANXL:
    /*
     * CAN XL packet; fix up the packet's header by
     * byte-swapping the priority/VCID field, the
     * payload length, and the acceptance field.
     */
    xl_hdrp = (pcap_can_socketcan_xl_hdr *)buf;
    if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid) ||
        length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid)) {
      /* Not enough data to have the priority_vcid field */
      return;
    }
    xl_hdrp->priority_vcid = SWAPLONG(xl_hdrp->priority_vcid);
    if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length) ||
        length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length)) {
      /* Not enough data to have the payload_length field */
      return;
    }
    xl_hdrp->payload_length = SWAPSHORT(xl_hdrp->payload_length);
    if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field) ||
        length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field)) {
      /* Not enough data to have the acceptance_field field */
      return;
    }
    xl_hdrp->acceptance_field = SWAPLONG(xl_hdrp->acceptance_field);
    break;

  default:
    /*
     * Not a CAN packet; nothing to do.
     */
    break;
  }
}

/*
 * DLT_LINUX_SLL packets with a protocol type of LINUX_SLL_P_CAN or
 * LINUX_SLL_P_CANFD have SocketCAN headers in front of the payload,
 * with the CAN ID being in host byte order.
 *
 * When reading a DLT_LINUX_SLL packet, we need to check for those
 * packets and convert the CAN ID from the byte order of the host that
 * wrote the file to this host's byte order.
 */
static void
swap_linux_sll_socketcan_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
  u_int caplen = hdr->caplen;
  u_int length = hdr->len;
  struct sll_header *shdr = (struct sll_header *)buf;

  if (caplen < (u_int) sizeof(struct sll_header) ||
      length < (u_int) sizeof(struct sll_header)) {
    /* Not enough data to have the protocol field */
    return;
  }

  /*
   * Byte-swap what needs to be byte-swapped.
   */
  swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll_protocol),
      caplen - (u_int) sizeof(struct sll_header),
      length - (u_int) sizeof(struct sll_header),
      buf + sizeof(struct sll_header));
}

/*
 * The same applies for DLT_LINUX_SLL2.
 */
static void
swap_linux_sll2_socketcan_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
  u_int caplen = hdr->caplen;
  u_int length = hdr->len;
  struct sll2_header *shdr = (struct sll2_header *)buf;

  if (caplen < (u_int) sizeof(struct sll2_header) ||
      length < (u_int) sizeof(struct sll2_header)) {
    /* Not enough data to have the protocol field */
    return;
  }

  /*
   * Byte-swap what needs to be byte-swapped.
   */
  swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll2_protocol),
      caplen - (u_int) sizeof(struct sll2_header),
      length - (u_int) sizeof(struct sll2_header),
      buf + sizeof(struct sll2_header));
}

/*
 * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host
 * byte order when capturing (it's supplied directly from a
 * memory-mapped buffer shared by the kernel).
 *
 * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED packet, we
 * need to convert it from the byte order of the host that wrote the
 * file to this host's byte order.
 */
static void
swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
    int header_len_64_bytes)
{
  pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf;
  bpf_u_int32 offset = 0;

  /*
   * "offset" is the offset *past* the field we're swapping;
   * we skip the field *before* checking to make sure
   * the captured data length includes the entire field.
   */

  /*
   * The URB id is a totally opaque value; do we really need to
   * convert it to the reading host's byte order???
   */
  offset += 8;      /* skip past id */
  if (hdr->caplen < offset)
    return;
  uhdr->id = SWAPLL(uhdr->id);

  offset += 4;      /* skip past various 1-byte fields */

  offset += 2;      /* skip past bus_id */
  if (hdr->caplen < offset)
    return;
  uhdr->bus_id = SWAPSHORT(uhdr->bus_id);

  offset += 2;      /* skip past various 1-byte fields */

  offset += 8;      /* skip past ts_sec */
  if (hdr->caplen < offset)
    return;
  uhdr->ts_sec = SWAPLL(uhdr->ts_sec);

  offset += 4;      /* skip past ts_usec */
  if (hdr->caplen < offset)
    return;
  uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);

  offset += 4;      /* skip past status */
  if (hdr->caplen < offset)
    return;
  uhdr->status = SWAPLONG(uhdr->status);

  offset += 4;      /* skip past urb_len */
  if (hdr->caplen < offset)
    return;
  uhdr->urb_len = SWAPLONG(uhdr->urb_len);

  offset += 4;      /* skip past data_len */
  if (hdr->caplen < offset)
    return;
  uhdr->data_len = SWAPLONG(uhdr->data_len);

  if (uhdr->transfer_type == URB_ISOCHRONOUS) {
    offset += 4;      /* skip past s.iso.error_count */
    if (hdr->caplen < offset)
      return;
    uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count);

    offset += 4;      /* skip past s.iso.numdesc */
    if (hdr->caplen < offset)
      return;
    uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc);
  } else
    offset += 8;      /* skip USB setup header */

  /*
   * With the old header, there are no isochronous descriptors
   * after the header.
   *
   * With the new header, the actual number of descriptors in
   * the header is not s.iso.numdesc, it's ndesc - only the
   * first N descriptors, for some value of N, are put into
   * the header, and ndesc is set to the actual number copied.
   * In addition, if s.iso.numdesc is negative, no descriptors
   * are captured, and ndesc is set to 0.
   */
  if (header_len_64_bytes) {
    /*
     * This is either the "version 1" header, with
     * 16 bytes of additional fields at the end, or
     * a "version 0" header from a memory-mapped
     * capture, with 16 bytes of zeroed-out padding
     * at the end.  Byte swap them as if this were
     * a "version 1" header.
     */
    offset += 4;      /* skip past interval */
    if (hdr->caplen < offset)
      return;
    uhdr->interval = SWAPLONG(uhdr->interval);

    offset += 4;      /* skip past start_frame */
    if (hdr->caplen < offset)
      return;
    uhdr->start_frame = SWAPLONG(uhdr->start_frame);

    offset += 4;      /* skip past xfer_flags */
    if (hdr->caplen < offset)
      return;
    uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags);

    offset += 4;      /* skip past ndesc */
    if (hdr->caplen < offset)
      return;
    uhdr->ndesc = SWAPLONG(uhdr->ndesc);

    if (uhdr->transfer_type == URB_ISOCHRONOUS) {
      /* swap the values in struct linux_usb_isodesc */
      usb_isodesc *pisodesc;
      uint32_t i;

      pisodesc = (usb_isodesc *)(void *)(buf+offset);
      for (i = 0; i < uhdr->ndesc; i++) {
        offset += 4;    /* skip past status */
        if (hdr->caplen < offset)
          return;
        pisodesc->status = SWAPLONG(pisodesc->status);

        offset += 4;    /* skip past offset */
        if (hdr->caplen < offset)
          return;
        pisodesc->offset = SWAPLONG(pisodesc->offset);

        offset += 4;    /* skip past len */
        if (hdr->caplen < offset)
          return;
        pisodesc->len = SWAPLONG(pisodesc->len);

        offset += 4;    /* skip past padding */

        pisodesc++;
      }
    }
  }
}

/*
 * The DLT_NFLOG "packets" have a mixture of big-endian and host-byte-order
 * data.  They begin with a fixed-length header with big-endian fields,
 * followed by a set of TLVs, where the type and length are in host
 * byte order but the values are either big-endian or are a raw byte
 * sequence that's the same regardless of the host's byte order.
 *
 * When reading a DLT_NFLOG packet, we need to convert the type and
 * length values from the byte order of the host that wrote the file
 * to the byte order of this host.
 */
static void
swap_nflog_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
  u_char *p = buf;
  nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf;
  nflog_tlv_t *tlv;
  u_int caplen = hdr->caplen;
  u_int length = hdr->len;
  u_int size;

  if (caplen < (u_int) sizeof(nflog_hdr_t) ||
      length < (u_int) sizeof(nflog_hdr_t)) {
    /* Not enough data to have any TLVs. */
    return;
  }

  if (nfhdr->nflog_version != 0) {
    /* Unknown NFLOG version */
    return;
  }

  length -= sizeof(nflog_hdr_t);
  caplen -= sizeof(nflog_hdr_t);
  p += sizeof(nflog_hdr_t);

  while (caplen >= sizeof(nflog_tlv_t)) {
    tlv = (nflog_tlv_t *) p;

    /* Swap the type and length. */
    tlv->tlv_type = SWAPSHORT(tlv->tlv_type);
    tlv->tlv_length = SWAPSHORT(tlv->tlv_length);

    /* Get the length of the TLV. */
    size = tlv->tlv_length;
    if (size % 4 != 0)
      size += 4 - size % 4;

    /* Is the TLV's length less than the minimum? */
    if (size < sizeof(nflog_tlv_t)) {
      /* Yes. Give up now. */
      return;
    }

    /* Do we have enough data for the full TLV? */
    if (caplen < size || length < size) {
      /* No. */
      return;
    }

    /* Skip over the TLV. */
    length -= size;
    caplen -= size;
    p += size;
  }
}

static void
swap_pseudo_headers(int linktype, struct pcap_pkthdr *hdr, u_char *data)
{
  /*
   * Convert pseudo-headers from the byte order of
   * the host on which the file was saved to our
   * byte order, as necessary.
   */
  switch (linktype) {

  case DLT_PFLOG:
    swap_pflog_header(hdr, data);
    break;

  case DLT_LINUX_SLL:
    swap_linux_sll_socketcan_header(hdr, data);
    break;

  case DLT_LINUX_SLL2:
    swap_linux_sll2_socketcan_header(hdr, data);
    break;

  case DLT_USB_LINUX:
    swap_linux_usb_header(hdr, data, 0);
    break;

  case DLT_USB_LINUX_MMAPPED:
    swap_linux_usb_header(hdr, data, 1);
    break;

  case DLT_NFLOG:
    swap_nflog_header(hdr, data);
    break;
  }
}

static inline int
packet_length_might_be_wrong(struct pcap_pkthdr *hdr,
    const pcap_usb_header_mmapped *usb_hdr)
{
  uint32_t old_style_packet_length;

  /*
   * Calculate the packet length the old way.
   * We know that the multiplication won't overflow, but
   * we don't know that the additions won't.  Calculate
   * it with no overflow checks, as that's how it
   * would have been calculated when it was captured.
   */
  old_style_packet_length = iso_pseudo_header_len(usb_hdr) +
      usb_hdr->urb_len;
  return (hdr->len == old_style_packet_length);
}

void
pcapint_post_process(int linktype, int swapped, struct pcap_pkthdr *hdr,
    u_char *data)
{
  if (swapped)
    swap_pseudo_headers(linktype, hdr, data);

  /*
   * Is this a memory-mapped Linux USB capture?
   */
  if (linktype == DLT_USB_LINUX_MMAPPED) {
    /*
     * Yes.
     *
     * In older versions of libpcap, in memory-mapped Linux
     * USB captures, the original length of completion events
     * for incoming isochronous transfers was miscalculated;
     * it needed to be calculated based on the offsets and
     * lengths in the descriptors, not on the raw URB length,
     * but it wasn't.
     *
     * If this packet contains transferred data (yes, data_flag
     * is 0 if we *do* have data), it's a completion event
     * for an incoming isochronous transfer, and the
     * transfer length appears to have been calculated
     * from the raw URB length, fix it.
     *
     * We only do this if we have the full USB pseudo-header,
     * because we will have to look at that header and at
     * all of the isochronous descriptors.
     */
    if (hdr->caplen < sizeof (pcap_usb_header_mmapped)) {
      /*
       * We don't have the full pseudo-header.
       */
      return;
    }

    const pcap_usb_header_mmapped *usb_hdr =
        (const pcap_usb_header_mmapped *) data;

    /*
     * Make sure the number of descriptors is sane.
     *
     * The Linux binary USB monitor code limits the number of
     * isochronous descriptors to 128; if the number in the file
     * is larger than that, either 1) the file's been damaged
     * or 2) the file was produced after the number was raised
     * in the kernel.
     *
     * In case 1), the number can't be trusted, so don't rely on
     * it to attempt to fix the original length field in the pcap
     * or pcapng header.
     *
     * In case 2), the system was probably running a version of
     * libpcap that didn't miscalculate the original length, so
     * it probably doesn't need to be fixed.
     *
     * This avoids the possibility of the product of the number of
     * descriptors and the size of descriptors won't overflow an
     * unsigned 32-bit integer.
     */
    if (usb_hdr->ndesc > USB_MAXDESC)
      return;

    if (!usb_hdr->data_flag &&
        is_isochronous_transfer_completion(usb_hdr) &&
        packet_length_might_be_wrong(hdr, usb_hdr)) {
      u_int len;

      /*
       * Make sure we have all of the descriptors,
       * as we will have to look at all of them.
       *
       * If not, we don't bother trying to fix
       * anything.
       */
      if (hdr->caplen < iso_pseudo_header_len(usb_hdr))
        return;

      /*
       * Calculate what the length should have been.
       */
      len = incoming_isochronous_transfer_completed_len(hdr,
          data);

      /*
       * len is the smaller of UINT_MAX and the total
       * header plus data length.  That's guaranteed
       * to fit in a UINT_MAX.
       *
       * Don't reduce the original length to a value
       * below the captured length, however, as that
       * is bogus.
       */
      if (len >= hdr->caplen)
        hdr->len = len;

      /*
       * If the captured length is greater than the
       * length, use the captured length.
       *
       * For completion events for incoming isochronous
       * transfers, it's based on data_len, which is
       * calculated the same way we calculated
       * pre_truncation_data_len above, except that
       * it has access to all the isochronous descriptors,
       * not just the ones that the kernel were able to
       * provide us or, for a capture file, that weren't
       * sliced off by a snapshot length.
       *
       * However, it might have been reduced by the USB
       * capture mechanism arbitrarily limiting the amount
       * of data it provides to userland, or by the libpcap
       * capture code limiting it to being no more than the
       * snapshot, so we don't want to just use it all the
       * time; we only do so to try to get a better estimate
       * of the actual length - and to make sure the
       * original length is always >= the captured length.
       */
      if (hdr->caplen > hdr->len)
        hdr->len = hdr->caplen;
    }
  }
}

Coverage Report

Created: 2025-12-14 06:20