Fixup indentation in init_linktype().

[libpcap] / pcap-util.c

/*
 * Copyright (c) 1993, 1994, 1995, 1996, 1997
 *      The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that: (1) source code distributions
 * retain the above copyright notice and this paragraph in its entirety, (2)
 * distributions including binary code include the above copyright notice and
 * this paragraph in its entirety in the documentation or other materials
 * provided with the distribution, and (3) all advertising materials mentioning
 * features or use of this software display the following acknowledgement:
 * ``This product includes software developed by the University of California,
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
 * the University nor the names of its contributors may be used to endorse
 * or promote products derived from this software without specific prior
 * written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 *
 * pcap-util.c - common code for various files
 */

#include <config.h>

#include <pcap-types.h>

#include "pcap/can_socketcan.h"
#include "pcap/sll.h"
#include "pcap/usb.h"
#include "pcap/nflog.h"

#include "pcap-int.h"
#include "extract.h"
#include "pcap-usb-linux-common.h"

#include "pcap-util.h"
#include "pflog.h"

/*
 * Most versions of the DLT_PFLOG pseudo-header have UID and PID fields
 * that are saved in host byte order.
 *
 * When reading a DLT_PFLOG packet, we need to convert those fields from
 * the byte order of the host that wrote the file to this host's byte
 * order.
 */
static void
swap_pflog_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
        u_int caplen = hdr->caplen;
        u_int length = hdr->len;
        u_int pfloghdr_length;
        struct pfloghdr *pflhdr = (struct pfloghdr *)buf;

        if (caplen < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid) ||
            length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) {
                /* Not enough data to have the uid field */
                return;
        }

        pfloghdr_length = pflhdr->length;

        if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, uid) + sizeof pflhdr->uid)) {
                /* Header doesn't include uid field */
                return;
        }
        pflhdr->uid = SWAPLONG(pflhdr->uid);

        if (caplen < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid) ||
            length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) {
                /* Not enough data to have the pid field */
                return;
        }
        if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, pid) + sizeof pflhdr->pid)) {
                /* Header doesn't include pid field */
                return;
        }
        pflhdr->pid = SWAPLONG(pflhdr->pid);

        if (caplen < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid) ||
            length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) {
                /* Not enough data to have the rule_uid field */
                return;
        }
        if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_uid) + sizeof pflhdr->rule_uid)) {
                /* Header doesn't include rule_uid field */
                return;
        }
        pflhdr->rule_uid = SWAPLONG(pflhdr->rule_uid);

        if (caplen < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid) ||
            length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) {
                /* Not enough data to have the rule_pid field */
                return;
        }
        if (pfloghdr_length < (u_int) (offsetof(struct pfloghdr, rule_pid) + sizeof pflhdr->rule_pid)) {
                /* Header doesn't include rule_pid field */
                return;
        }
        pflhdr->rule_pid = SWAPLONG(pflhdr->rule_pid);
}

/*
 * Linux cooked capture packets with a protocol type of LINUX_SLL_P_CAN or
 * LINUX_SLL_P_CANFD have SocketCAN CAN classic/CAN FD headers in front
 * of the payload,with the CAN ID being in the byte order of the host
 * that wrote the packet, and Linux cooked capture packets with a protocol
 * type of LINUX_SLL_P_CANXL have SocketCAN CAN XL headers in front of the
 * payload with the protocol/VCID field, the payload length, and the
 * acceptance field in the byte order of the host that wrote the packet.
 *
 * When reading a Linux cooked capture packet, we need to check for those
 * packets and, if the byte order host that wrote the packet, as
 * indicated by the byte order of the pcap file or pcapng section
 * containing the packet, is the opposite of our byte order, convert
 * the header files to our byte order by byte-swapping them.
 */
static void
swap_socketcan_header(uint16_t protocol, u_int caplen, u_int length,
    u_char *buf)
{
        pcap_can_socketcan_hdr *hdrp;
        pcap_can_socketcan_xl_hdr *xl_hdrp;

        switch (protocol) {

        case LINUX_SLL_P_CAN:
        case LINUX_SLL_P_CANFD:
                /*
                 * CAN classic/CAN FD packet; fix up the packet's header
                 * by byte-swapping the CAN ID field.
                 */
                hdrp = (pcap_can_socketcan_hdr *)buf;
                if (caplen < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id) ||
                    length < (u_int) (offsetof(pcap_can_socketcan_hdr, can_id) + sizeof hdrp->can_id)) {
                        /* Not enough data to have the can_id field */
                        return;
                }
                hdrp->can_id = SWAPLONG(hdrp->can_id);
                break;

        case LINUX_SLL_P_CANXL:
                /*
                 * CAN XL packet; fix up the packet's header by
                 * byte-swapping the priority/VCID field, the
                 * payload length, and the acceptance field.
                 */
                xl_hdrp = (pcap_can_socketcan_xl_hdr *)buf;
                if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid) ||
                    length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, priority_vcid) + sizeof xl_hdrp->priority_vcid)) {
                        /* Not enough data to have the priority_vcid field */
                        return;
                }
                xl_hdrp->priority_vcid = SWAPLONG(xl_hdrp->priority_vcid);
                if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length) ||
                    length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, payload_length) + sizeof xl_hdrp->payload_length)) {
                        /* Not enough data to have the payload_length field */
                        return;
                }
                xl_hdrp->payload_length = SWAPSHORT(xl_hdrp->payload_length);
                if (caplen < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field) ||
                    length < (u_int) (offsetof(pcap_can_socketcan_xl_hdr, acceptance_field) + sizeof xl_hdrp->acceptance_field)) {
                        /* Not enough data to have the acceptance_field field */
                        return;
                }
                xl_hdrp->acceptance_field = SWAPLONG(xl_hdrp->acceptance_field);
                break;

        default:
                /*
                 * Not a CAN packet; nothing to do.
                 */
                break;
        }
}

/*
 * DLT_LINUX_SLL packets with a protocol type of LINUX_SLL_P_CAN or
 * LINUX_SLL_P_CANFD have SocketCAN headers in front of the payload,
 * with the CAN ID being in host byte order.
 *
 * When reading a DLT_LINUX_SLL packet, we need to check for those
 * packets and convert the CAN ID from the byte order of the host that
 * wrote the file to this host's byte order.
 */
static void
swap_linux_sll_socketcan_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
        u_int caplen = hdr->caplen;
        u_int length = hdr->len;
        struct sll_header *shdr = (struct sll_header *)buf;

        if (caplen < (u_int) sizeof(struct sll_header) ||
            length < (u_int) sizeof(struct sll_header)) {
                /* Not enough data to have the protocol field */
                return;
        }

        /*
         * Byte-swap what needs to be byte-swapped.
         */
        swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll_protocol),
            caplen - (u_int) sizeof(struct sll_header),
            length - (u_int) sizeof(struct sll_header),
            buf + sizeof(struct sll_header));
}

/*
 * The same applies for DLT_LINUX_SLL2.
 */
static void
swap_linux_sll2_socketcan_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
        u_int caplen = hdr->caplen;
        u_int length = hdr->len;
        struct sll2_header *shdr = (struct sll2_header *)buf;

        if (caplen < (u_int) sizeof(struct sll2_header) ||
            length < (u_int) sizeof(struct sll2_header)) {
                /* Not enough data to have the protocol field */
                return;
        }

        /*
         * Byte-swap what needs to be byte-swapped.
         */
        swap_socketcan_header(EXTRACT_BE_U_2(&shdr->sll2_protocol),
            caplen - (u_int) sizeof(struct sll2_header),
            length - (u_int) sizeof(struct sll2_header),
            buf + sizeof(struct sll2_header));
}

/*
 * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host
 * byte order when capturing (it's supplied directly from a
 * memory-mapped buffer shared by the kernel).
 *
 * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED packet, we
 * need to convert it from the byte order of the host that wrote the
 * file to this host's byte order.
 */
static void
swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
    int header_len_64_bytes)
{
        pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf;
        bpf_u_int32 offset = 0;

        /*
         * "offset" is the offset *past* the field we're swapping;
         * we skip the field *before* checking to make sure
         * the captured data length includes the entire field.
         */

        /*
         * The URB id is a totally opaque value; do we really need to
         * convert it to the reading host's byte order???
         */
        offset += 8;                    /* skip past id */
        if (hdr->caplen < offset)
                return;
        uhdr->id = SWAPLL(uhdr->id);

        offset += 4;                    /* skip past various 1-byte fields */

        offset += 2;                    /* skip past bus_id */
        if (hdr->caplen < offset)
                return;
        uhdr->bus_id = SWAPSHORT(uhdr->bus_id);

        offset += 2;                    /* skip past various 1-byte fields */

        offset += 8;                    /* skip past ts_sec */
        if (hdr->caplen < offset)
                return;
        uhdr->ts_sec = SWAPLL(uhdr->ts_sec);

        offset += 4;                    /* skip past ts_usec */
        if (hdr->caplen < offset)
                return;
        uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);

        offset += 4;                    /* skip past status */
        if (hdr->caplen < offset)
                return;
        uhdr->status = SWAPLONG(uhdr->status);

        offset += 4;                    /* skip past urb_len */
        if (hdr->caplen < offset)
                return;
        uhdr->urb_len = SWAPLONG(uhdr->urb_len);

        offset += 4;                    /* skip past data_len */
        if (hdr->caplen < offset)
                return;
        uhdr->data_len = SWAPLONG(uhdr->data_len);

        if (uhdr->transfer_type == URB_ISOCHRONOUS) {
                offset += 4;                    /* skip past s.iso.error_count */
                if (hdr->caplen < offset)
                        return;
                uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count);

                offset += 4;                    /* skip past s.iso.numdesc */
                if (hdr->caplen < offset)
                        return;
                uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc);
        } else
                offset += 8;                    /* skip USB setup header */

        /*
         * With the old header, there are no isochronous descriptors
         * after the header.
         *
         * With the new header, the actual number of descriptors in
         * the header is not s.iso.numdesc, it's ndesc - only the
         * first N descriptors, for some value of N, are put into
         * the header, and ndesc is set to the actual number copied.
         * In addition, if s.iso.numdesc is negative, no descriptors
         * are captured, and ndesc is set to 0.
         */
        if (header_len_64_bytes) {
                /*
                 * This is either the "version 1" header, with
                 * 16 bytes of additional fields at the end, or
                 * a "version 0" header from a memory-mapped
                 * capture, with 16 bytes of zeroed-out padding
                 * at the end.  Byte swap them as if this were
                 * a "version 1" header.
                 */
                offset += 4;                    /* skip past interval */
                if (hdr->caplen < offset)
                        return;
                uhdr->interval = SWAPLONG(uhdr->interval);

                offset += 4;                    /* skip past start_frame */
                if (hdr->caplen < offset)
                        return;
                uhdr->start_frame = SWAPLONG(uhdr->start_frame);

                offset += 4;                    /* skip past xfer_flags */
                if (hdr->caplen < offset)
                        return;
                uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags);

                offset += 4;                    /* skip past ndesc */
                if (hdr->caplen < offset)
                        return;
                uhdr->ndesc = SWAPLONG(uhdr->ndesc);

                if (uhdr->transfer_type == URB_ISOCHRONOUS) {
                        /* swap the values in struct linux_usb_isodesc */
                        usb_isodesc *pisodesc;
                        uint32_t i;

                        pisodesc = (usb_isodesc *)(void *)(buf+offset);
                        for (i = 0; i < uhdr->ndesc; i++) {
                                offset += 4;            /* skip past status */
                                if (hdr->caplen < offset)
                                        return;
                                pisodesc->status = SWAPLONG(pisodesc->status);

                                offset += 4;            /* skip past offset */
                                if (hdr->caplen < offset)
                                        return;
                                pisodesc->offset = SWAPLONG(pisodesc->offset);

                                offset += 4;            /* skip past len */
                                if (hdr->caplen < offset)
                                        return;
                                pisodesc->len = SWAPLONG(pisodesc->len);

                                offset += 4;            /* skip past padding */

                                pisodesc++;
                        }
                }
        }
}

/*
 * The DLT_NFLOG "packets" have a mixture of big-endian and host-byte-order
 * data.  They begin with a fixed-length header with big-endian fields,
 * followed by a set of TLVs, where the type and length are in host
 * byte order but the values are either big-endian or are a raw byte
 * sequence that's the same regardless of the host's byte order.
 *
 * When reading a DLT_NFLOG packet, we need to convert the type and
 * length values from the byte order of the host that wrote the file
 * to the byte order of this host.
 */
static void
swap_nflog_header(const struct pcap_pkthdr *hdr, u_char *buf)
{
        u_char *p = buf;
        nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf;
        nflog_tlv_t *tlv;
        u_int caplen = hdr->caplen;
        u_int length = hdr->len;
        u_int size;

        if (caplen < (u_int) sizeof(nflog_hdr_t) ||
            length < (u_int) sizeof(nflog_hdr_t)) {
                /* Not enough data to have any TLVs. */
                return;
        }

        if (nfhdr->nflog_version != 0) {
                /* Unknown NFLOG version */
                return;
        }

        length -= sizeof(nflog_hdr_t);
        caplen -= sizeof(nflog_hdr_t);
        p += sizeof(nflog_hdr_t);

        while (caplen >= sizeof(nflog_tlv_t)) {
                tlv = (nflog_tlv_t *) p;

                /* Swap the type and length. */
                tlv->tlv_type = SWAPSHORT(tlv->tlv_type);
                tlv->tlv_length = SWAPSHORT(tlv->tlv_length);

                /* Get the length of the TLV. */
                size = tlv->tlv_length;
                if (size % 4 != 0)
                        size += 4 - size % 4;

                /* Is the TLV's length less than the minimum? */
                if (size < sizeof(nflog_tlv_t)) {
                        /* Yes. Give up now. */
                        return;
                }

                /* Do we have enough data for the full TLV? */
                if (caplen < size || length < size) {
                        /* No. */
                        return;
                }

                /* Skip over the TLV. */
                length -= size;
                caplen -= size;
                p += size;
        }
}

static void
swap_pseudo_headers(int linktype, struct pcap_pkthdr *hdr, u_char *data)
{
        /*
         * Convert pseudo-headers from the byte order of
         * the host on which the file was saved to our
         * byte order, as necessary.
         */
        switch (linktype) {

        case DLT_PFLOG:
                swap_pflog_header(hdr, data);
                break;

        case DLT_LINUX_SLL:
                swap_linux_sll_socketcan_header(hdr, data);
                break;

        case DLT_LINUX_SLL2:
                swap_linux_sll2_socketcan_header(hdr, data);
                break;

        case DLT_USB_LINUX:
                swap_linux_usb_header(hdr, data, 0);
                break;

        case DLT_USB_LINUX_MMAPPED:
                swap_linux_usb_header(hdr, data, 1);
                break;

        case DLT_NFLOG:
                swap_nflog_header(hdr, data);
                break;
        }
}

static inline int
packet_length_might_be_wrong(struct pcap_pkthdr *hdr,
    const pcap_usb_header_mmapped *usb_hdr)
{
        uint32_t old_style_packet_length;

        /*
         * Calculate the packet length the old way.
         * We know that the multiplication won't overflow, but
         * we don't know that the additions won't.  Calculate
         * it with no overflow checks, as that's how it
         * would have been calculated when it was captured.
         */
        old_style_packet_length = iso_pseudo_header_len(usb_hdr) +
            usb_hdr->urb_len;
        return (hdr->len == old_style_packet_length);
}

void
pcapint_post_process(int linktype, int swapped, struct pcap_pkthdr *hdr,
    u_char *data)
{
        if (swapped)
                swap_pseudo_headers(linktype, hdr, data);

        /*
         * Is this a memory-mapped Linux USB capture?
         */
        if (linktype == DLT_USB_LINUX_MMAPPED) {
                /*
                 * Yes.
                 *
                 * In older versions of libpcap, in memory-mapped Linux
                 * USB captures, the original length of completion events
                 * for incoming isochronous transfers was miscalculated;
                 * it needed to be calculated based on the offsets and
                 * lengths in the descriptors, not on the raw URB length,
                 * but it wasn't.
                 *
                 * If this packet contains transferred data (yes, data_flag
                 * is 0 if we *do* have data), it's a completion event
                 * for an incoming isochronous transfer, and the
                 * transfer length appears to have been calculated
                 * from the raw URB length, fix it.
                 *
                 * We only do this if we have the full USB pseudo-header,
                 * because we will have to look at that header and at
                 * all of the isochronous descriptors.
                 */
                if (hdr->caplen < sizeof (pcap_usb_header_mmapped)) {
                        /*
                         * We don't have the full pseudo-header.
                         */
                        return;
                }

                const pcap_usb_header_mmapped *usb_hdr =
                    (const pcap_usb_header_mmapped *) data;

                /*
                 * Make sure the number of descriptors is sane.
                 *
                 * The Linux binary USB monitor code limits the number of
                 * isochronous descriptors to 128; if the number in the file
                 * is larger than that, either 1) the file's been damaged
                 * or 2) the file was produced after the number was raised
                 * in the kernel.
                 *
                 * In case 1), the number can't be trusted, so don't rely on
                 * it to attempt to fix the original length field in the pcap
                 * or pcapng header.
                 *
                 * In case 2), the system was probably running a version of
                 * libpcap that didn't miscalculate the original length, so
                 * it probably doesn't need to be fixed.
                 *
                 * This avoids the possibility of the product of the number of
                 * descriptors and the size of descriptors won't overflow an
                 * unsigned 32-bit integer.
                 */
                if (usb_hdr->ndesc > USB_MAXDESC)
                        return;

                if (!usb_hdr->data_flag &&
                    is_isochronous_transfer_completion(usb_hdr) &&
                    packet_length_might_be_wrong(hdr, usb_hdr)) {
                        u_int len;

                        /*
                         * Make sure we have all of the descriptors,
                         * as we will have to look at all of them.
                         *
                         * If not, we don't bother trying to fix
                         * anything.
                         */
                        if (hdr->caplen < iso_pseudo_header_len(usb_hdr))
                                return;

                        /*
                         * Calculate what the length should have been.
                         */
                        len = incoming_isochronous_transfer_completed_len(hdr,
                            data);

                        /*
                         * len is the smaller of UINT_MAX and the total
                         * header plus data length.  That's guaranteed
                         * to fit in a UINT_MAX.
                         *
                         * Don't reduce the original length to a value
                         * below the captured length, however, as that
                         * is bogus.
                         */
                        if (len >= hdr->caplen)
                                hdr->len = len;

                        /*
                         * If the captured length is greater than the
                         * length, use the captured length.
                         *
                         * For completion events for incoming isochronous
                         * transfers, it's based on data_len, which is
                         * calculated the same way we calculated
                         * pre_truncation_data_len above, except that
                         * it has access to all the isochronous descriptors,
                         * not just the ones that the kernel were able to
                         * provide us or, for a capture file, that weren't
                         * sliced off by a snapshot length.
                         *
                         * However, it might have been reduced by the USB
                         * capture mechanism arbitrarily limiting the amount
                         * of data it provides to userland, or by the libpcap
                         * capture code limiting it to being no more than the
                         * snapshot, so we don't want to just use it all the
                         * time; we only do so to try to get a better estimate
                         * of the actual length - and to make sure the
                         * original length is always >= the captured length.
                         */
                        if (hdr->caplen > hdr->len)
                                hdr->len = hdr->caplen;
                }
        }
}