Changeset f47025d for lib/format_pcapng.c

Timestamp:

01/07/19 10:37:40 (2 years ago)

Author:

Jacob Van Walraven <jcv9@…>

Branches:

develop

Children:

32de4c7, 62b2d97

Parents:

b2e3894

git-author:

Jacob Van Walraven <jcv9@…> (12/19/18 10:29:34)

git-committer:

Jacob Van Walraven <jcv9@…> (01/07/19 10:37:40)

Message:

Improve options/custom options byteswapping

File:

• lib/format_pcapng.c (modified) (20 diffs)

lib/format_pcapng.c

@@ -59 +59 @@
 #define PCAPNG_CUSTOM_OPTION_BIN_NONCOPY 0x4BAD
 
+#define PCAPNG_OPTION_END 0x0000
+
 #define PACKET_IS_ENHANCED (pcapng_get_record_type(packet) == PCAPNG_ENHANCED_PACKET_TYPE)
 
@@ -237 +239 @@
                 uint32_t intid) {
 
-
-        if (intid >= DATA(libtrace)->nextintid) {
-                return NULL;
-        }
-
-        return DATA(libtrace)->interfaces[intid];
-
+        if (intid >= DATA(libtrace)->nextintid) {
+                return NULL;
+        }
+
+        return DATA(libtrace)->interfaces[intid];
 }
 
@@ -249 +249 @@
         uint32_t *btype = (uint32_t *)packet->header;
 
-        /* Can be NULL if trace is a dead trace */
-        if (DATA(packet->trace) == NULL) {
-                return *btype;
-        }
-
-        if (DATA(packet->trace)->byteswapped)
-                return byteswap32(*btype);
+        /* only check for byteswapped if input format is pcapng */
+        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
+                if (DATA(packet->trace)->byteswapped)
+                        return byteswap32(*btype);
+        }
+
         return *btype;
 }
@@ -276 +275 @@
         struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->buffer;
 
-        /* Can be NULL is trace is dead trace */
-        if (DATA(packet->trace) == NULL) {
-                return hdr->blocklen;
-        }
-
-        if (DATA(packet->trace)->byteswapped) {
-                return byteswap32(hdr->blocklen);
-        } else {
-                return hdr->blocklen;
-        }
+        /* only check for byteswapped if input format is pcapng */
+        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
+                if (DATA(packet->trace)->byteswapped)
+                        return byteswap32(hdr->blocklen);
+        }
+
+        return hdr->blocklen;
+
 }
 static inline uint16_t pcapng_get_customdata_len(libtrace_packet_t *packet, char *ptr) {
@@ -331 +328 @@
         void *padding_data;
         uint32_t len = 0;
-        int options = 0;
 
         bodyptr = ptr;
@@ -338 +334 @@
                         &optcode, &optlen, (pcapng_hdr_t *) packet->buffer))) {
 
-                opthdr.optcode = byteswap16(optcode);
-                /* optlen contains the length of the option value without any padding bits,
-                 * it needs to be padded to 32 bits */
-                opthdr.optlen = byteswap16(optlen);
-
+                /* pcapng_parse_next_option byteswaps the opcode and len for us */
+                opthdr.optcode = optcode;
+                opthdr.optlen = optlen;
+
+                /* output the header */
                 wandio_wwrite(DATAOUT(libtrace)->file, &opthdr, sizeof(opthdr));
-                wandio_wwrite(DATAOUT(libtrace)->file, optval, optlen);
+
+                /* If this is a custom option */
+                if (optcode == PCAPNG_CUSTOM_OPTION_UTF8 || PCAPNG_CUSTOM_OPTION_BIN
+                        || PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY || PCAPNG_CUSTOM_OPTION_BIN_NONCOPY) {
+                        /* flip the pen and output the option value */
+                        //uint32_t pen = byteswap32((uint32_t)*optval);
+                        wandio_wwrite(DATAOUT(libtrace)->file, optval, sizeof(uint32_t));
+
+                        /* the len for custom options include pen */
+                        optval += sizeof(uint32_t);
+                        optlen -= sizeof(uint32_t);
+                }
+
+                /* output the rest of the data */
+                wandio_wwrite(DATAOUT(libtrace)->file, &optval, optlen);
 
                 /* calculate any required padding */
@@ -355 +365 @@
 
                 len += sizeof(opthdr) + optlen;
-                options = 1;
-        }
-
-        if (options) {
-                struct pcapng_optheader optftr;
-                optftr.optcode = 0;
-                optftr.optlen = 0;
-                wandio_wwrite(DATAOUT(libtrace)->file, &optftr, sizeof(optftr));
-                len += sizeof(optftr);
         }
 
@@ -373 +374 @@
         char *bodyptr = NULL;
 
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 uint32_t len = pcapng_get_blocklen(packet);
@@ -402 +405 @@
         char *bodyptr = NULL;
 
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 len = pcapng_get_blocklen(packet);
@@ -431 +436 @@
         char *bodyptr = NULL;
 
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 len = pcapng_get_blocklen(packet);
@@ -470 +477 @@
         void *padding_data;
 
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 uint32_t len = pcapng_get_blocklen(packet);
@@ -488 +497 @@
 
         uint16_t record_type = pcapng_get_nrb_record_type(packet, bodyptr);
-        while (record_type == PCAPNG_NRB_RECORD_IP4 ||
-                record_type == PCAPNG_NRB_RECORD_IP6) {
+        while (record_type != PCAPNG_NRB_RECORD_END) {
 
                 struct pcapng_nrb_record nrb;
 
-                /* recordlen contains the total size of the record block */
+                /* recordlen contains only the length of the record value without
+                 * any padding */
                 uint16_t recordlen = pcapng_get_nrb_record_len(packet, bodyptr);
 
@@ -504 +513 @@
 
                 /* output the record data */
-                wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, recordlen - sizeof(nrb));
-                bodyptr += recordlen - sizeof(nrb);
+                wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, recordlen);
+                bodyptr += recordlen;
 
                 /* calculate any required padding. record also contains the 8 byte header
@@ -515 +524 @@
                 wandio_wwrite(DATAOUT(libtrace)->file, padding_data, padding);
                 free(padding_data);
+                bodyptr += padding;
 
                 /* get the next record if it exists */
@@ -526 +536 @@
         nrbftr.recordlen = 0;
         wandio_wwrite(DATAOUT(libtrace)->file, &nrbftr, sizeof(nrbftr));
+        bodyptr += sizeof(nrbftr);
 
         /* output any options if present */
@@ -539 +550 @@
         pcapng_custom_t hdr;
         char *bodyptr = (char *)packet->buffer;
-        int padding;
-        void *padding_data;
-
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 uint32_t len = pcapng_get_blocklen(packet);
@@ -557 +568 @@
         wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
         bodyptr += sizeof(hdr);
-
-        /* get header for custom data ? if it exists */
-        struct pcapng_custom_optheader *copt = (struct pcapng_custom_optheader *)bodyptr;
-
-        uint16_t optcode = pcapng_get_customdata_optcode(packet, bodyptr);
-        while (optcode == PCAPNG_CUSTOM_OPTION_UTF8 || optcode == PCAPNG_CUSTOM_OPTION_BIN ||
-                optcode == PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY ||
-                optcode == PCAPNG_CUSTOM_OPTION_BIN_NONCOPY) {
-
-                struct pcapng_custom_optheader opt;
-                /* get the true value for the custom datas length */
-                uint16_t optlen = pcapng_get_customdata_len(packet, bodyptr);
-
-                opt.optcode = byteswap16(copt->optcode);
-                opt.optlen = byteswap16(copt->optlen);
-                opt.pen = byteswap32(copt->pen);
-
-                /* output the header */
-                wandio_wwrite(DATAOUT(libtrace)->file, &opt, sizeof(opt));
-                bodyptr += sizeof(copt);
-
-                /* output the custom data */
-                wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, optlen - sizeof(opt.pen));
-                /* oplen includes length of pen but we have already accounted for it so we need
-                 * remove it from the bodyptr */
-                bodyptr += optlen - sizeof(opt.pen);
-
-                /* calculate any required padding. optlen also contains the 4 bytes for pen
-                 * but we dont need to subtract them cause they will be removed with % 4 */
-                padding = optlen % 4;
-                if (padding) { padding = 4 - padding; }
-                padding_data = calloc(1, padding);
-                /* output the padding */
-                wandio_wwrite(DATAOUT(libtrace)->file, padding_data, padding);
-                free(padding_data);
-
-                /* get the next custom data? */
-                copt = (struct pcapng_custom_optheader *)bodyptr;
-                /* get the next opcode */
-                optcode = pcapng_get_customdata_optcode(packet, bodyptr);
-        }
 
         /* now print out any options */
@@ -613 +583 @@
         uint32_t len;
 
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 len = pcapng_get_blocklen(packet);
@@ -650 +622 @@
         char *bodyptr = NULL;
 
-        /* If trace is deadtrace or the byte ordering is the same just output it */
-        if ((DATA(packet->trace) == NULL) ||
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
                 (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
                 uint32_t len = pcapng_get_blocklen(packet);
@@ -1055 +1029 @@
                 }
                 case PCAPNG_DECRYPTION_SECRETS_TYPE: {
-                        /* Silently discard these until they are supported */
-                        struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->header;
-                        return hdr->blocklen;
+                        return 0;
+                }
+                case PCAPNG_CUSTOM_NONCOPY_TYPE: {
+                        /* This custom block type is not ment to be copied */
+                        return 0;
                 }
                 default: {