Enable exporting objects with tshark

A new "--export-object <protocol>,<destdir>" option is added to tshark.

This required refactoring Export Object behavior in all GUIs to give the
export object handling to the dissector, rather than the ui layer.
Included in the refactoring was fixing some serious memory leaks in Qt
Export Object dialog, crash due to memory scope issues in GTK Export
Object dialog, and addition sorting column feature in Qt dialog (set
up by creating a widget to manage the items that were previously
leaking memory)

Bug: 9319
Ping-Bug: 13174
Change-Id: I515d7662fa1f150f672b1476716f347ec27deb9b
Reviewed-on: https://code.wireshark.org/review/18927
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>

1 files changed, 420 insertions, 3 deletions

diff --git a/epan/dissectors/packet-smb.c b/epan/dissectors/packet-smb.c
index fe9a8a614b..1e16747571 100644
--- a/epan/dissectors/packet-smb.c
+++ b/epan/dissectors/packet-smb.c
@@ -35,6 +35,7 @@
 #include <epan/srt_table.h>
 #include <epan/expert.h>
 #include <epan/to_str.h>
+#include <epan/export_object.h>
 
 #include "packet-windows-common.h"
 #include "packet-smb.h"
@@ -968,6 +969,423 @@ smbstat_packet(void *pss, packet_info *pinfo, epan_dissect_t *edt _U_, const voi
 }
 
 /*
+ * Export object functionality
+ */
+/* These flags show what kind of data the object contains
+   (designed to be or'ed) */
+#define SMB_EO_CONTAINS_NOTHING         0x00
+#define SMB_EO_CONTAINS_READS           0x01
+#define SMB_EO_CONTAINS_WRITES          0x02
+#define SMB_EO_CONTAINS_READSANDWRITES  0x03
+#define LEGAL_FILENAME_CHARS "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_.- /\\{}[]=()&%$!,;.+&%$~#@"
+
+static const value_string smb_eo_contains_string[] = {
+	{SMB_EO_CONTAINS_NOTHING,            ""   },
+	{SMB_EO_CONTAINS_READS,              "R"  },
+	{SMB_EO_CONTAINS_WRITES,             "W"  },
+	{SMB_EO_CONTAINS_READSANDWRITES,     "R&W"},
+	{0, NULL}
+};
+
+/* Strings that describes the SMB object type */
+static const value_string smb_fid_types[] = {
+	{SMB_FID_TYPE_UNKNOWN,"UNKNOWN"},
+	{SMB_FID_TYPE_FILE,"FILE"},
+	{SMB_FID_TYPE_DIR,"DIRECTORY (Not Implemented)"},
+	{SMB_FID_TYPE_PIPE,"PIPE (Not Implemented)"},
+	{0, NULL}
+};
+
+static const value_string smb2_fid_types[] = {
+	{SMB2_FID_TYPE_UNKNOWN,"UNKNOWN"},
+	{SMB2_FID_TYPE_FILE,"FILE"},
+	{SMB2_FID_TYPE_DIR,"DIRECTORY (Not Implemented)"},
+	{SMB2_FID_TYPE_PIPE,"PIPE (Not Implemented)"},
+	{SMB2_FID_TYPE_OTHER,"OTHER (Not Implemented)"},
+	{0, NULL}
+};
+
+
+/* This struct contains the relationship between
+	the row# in the export_object window and the file being captured;
+	the row# in this GSList will match the row# in the entry list */
+
+typedef struct _active_file {
+	guint16   tid, uid, fid;
+	guint64   file_length;      /* The last free reported offset. We treat it as the file length */
+	guint64   data_gathered;    /* The actual total of data gathered */
+	guint8    flag_contains;    /* What kind of data it contains     */
+	GSList   *free_chunk_list;  /* A list of virtual "holes" in the file stream stored in memory */
+	gboolean  is_out_of_memory; /* TRUE if we cannot allocate memory for this file */
+} active_file ;
+
+/* This is the GSList that will contain all the files that we are tracking */
+static GSList    *GSL_active_files = NULL;
+
+/* We define a free chunk in a file as an start offset and end offset
+	Consider a free chunk as a "hole" in a file that we are capturing */
+typedef struct _free_chunk {
+	guint64 start_offset;
+	guint64 end_offset;
+} free_chunk;
+
+/* insert_chunk function will recalculate the free_chunk_list, the data_size,
+	the end_of_file, and the data_gathered as appropriate.
+	It will also insert the data chunk that is coming in the right
+	place of the file in memory.
+	HINTS:
+	file->data_gathered		contains the real data gathered independently from the file length
+	file->file_length		contains the length of the file in memory, i.e.,
+							the last offset captured. In most cases, the real
+							file length would be different.
+*/
+static void
+insert_chunk(active_file   *file, export_object_entry_t *entry, const smb_eo_t *eo_info)
+{
+	gint       nfreechunks      = g_slist_length(file->free_chunk_list);
+	gint       i;
+	free_chunk *current_free_chunk;
+	free_chunk *new_free_chunk;
+	guint64     chunk_offset     = eo_info->smb_file_offset;
+	guint64     chunk_length     = eo_info->payload_len;
+	guint64     chunk_end_offset = chunk_offset + chunk_length-1;
+	/* Size of file in memory */
+	guint64     calculated_size  = chunk_offset + chunk_length;
+	gpointer    dest_memory_addr;
+
+	/* Let's recalculate the file length and data gathered */
+	if ((file->data_gathered == 0) && (nfreechunks == 0)) {
+		/* If this is the first entry for this file, we first create an initial free chunk */
+		new_free_chunk = g_new(free_chunk, 1);
+		new_free_chunk->start_offset = 0;
+		new_free_chunk->end_offset = MAX(file->file_length, chunk_end_offset+1) - 1;
+		file->free_chunk_list = NULL;
+		file->free_chunk_list = g_slist_append(file->free_chunk_list, new_free_chunk);
+		nfreechunks += 1;
+	} else {
+		if (chunk_end_offset > file->file_length-1) {
+			new_free_chunk = g_new(free_chunk, 1);
+			new_free_chunk->start_offset = file->file_length;
+			new_free_chunk->end_offset = chunk_end_offset;
+			file->free_chunk_list = g_slist_append(file->free_chunk_list, new_free_chunk);
+			nfreechunks += 1;
+		}
+	}
+	file->file_length = MAX(file->file_length, chunk_end_offset+1);
+
+	/* Recalculate each free chunk according with the incoming data chunk */
+	for (i=0; i<nfreechunks; i++) {
+		current_free_chunk = (free_chunk *)g_slist_nth_data(file->free_chunk_list, i);
+		/* 1. data chunk before the free chunk? */
+		/* -> free chunk is not altered and no new data gathered */
+		if (chunk_end_offset<current_free_chunk->start_offset) {
+			continue;
+		}
+		/* 2. data chunk overlaps the first part of free_chunk */
+		/* -> free chunk shrinks from the beginning */
+		if (chunk_offset<=current_free_chunk->start_offset && chunk_end_offset>=current_free_chunk->start_offset && chunk_end_offset<current_free_chunk->end_offset) {
+			file->data_gathered += chunk_end_offset-current_free_chunk->start_offset+1;
+			current_free_chunk->start_offset=chunk_end_offset+1;
+			continue;
+		}
+		/* 3. data chunk overlaps completely the free chunk */
+		/* -> free chunk is removed */
+		if (chunk_offset<=current_free_chunk->start_offset && chunk_end_offset>=current_free_chunk->end_offset) {
+			file->data_gathered += current_free_chunk->end_offset-current_free_chunk->start_offset+1;
+			file->free_chunk_list = g_slist_remove(file->free_chunk_list, current_free_chunk);
+			nfreechunks -= 1;
+			if (nfreechunks == 0) { /* The free chunk list is empty */
+				g_slist_free(file->free_chunk_list);
+				file->free_chunk_list = NULL;
+				break;
+			}
+			i--;
+			continue;
+		}
+		/* 4. data chunk is inside the free chunk */
+		/* -> free chunk is split into two */
+		if (chunk_offset>current_free_chunk->start_offset && chunk_end_offset<current_free_chunk->end_offset) {
+			new_free_chunk = g_new(free_chunk, 1);
+			new_free_chunk->start_offset = chunk_end_offset + 1;
+			new_free_chunk->end_offset = current_free_chunk->end_offset;
+			current_free_chunk->end_offset = chunk_offset-1;
+			file->free_chunk_list = g_slist_insert(file->free_chunk_list, new_free_chunk, i + 1);
+			file->data_gathered += chunk_length;
+			continue;
+		}
+		/* 5.- data chunk overlaps the end part of free chunk */
+		/* -> free chunk shrinks from the end */
+		if (chunk_offset>current_free_chunk->start_offset && chunk_offset<=current_free_chunk->end_offset && chunk_end_offset>=current_free_chunk->end_offset) {
+			file->data_gathered += current_free_chunk->end_offset-chunk_offset+1;
+			current_free_chunk->end_offset = chunk_offset-1;
+			continue;
+		}
+		/* 6.- data chunk is after the free chunk */
+		/* -> free chunk is not altered and no new data gathered */
+		if (chunk_offset>current_free_chunk->end_offset) {
+			continue;
+		}
+	}
+
+	/* Now, let's insert the data chunk into memory
+	   ...first, we shall be able to allocate the memory */
+	if (!entry->payload_data) {
+		/* This is a New file */
+		if (calculated_size > G_MAXSIZE) {
+			/*
+			 * The argument to g_try_malloc() is
+			 * a gsize, the maximum value of which is
+			 * G_MAXSIZE.  If the calculated size is
+			 * bigger than that, we just say the attempt
+			 * to allocate memory failed.
+			 */
+			entry->payload_data = NULL;
+		} else {
+			entry->payload_data = (guint8 *)g_try_malloc((gsize)calculated_size);
+			entry->payload_len  = calculated_size;
+		}
+		if (!entry->payload_data) {
+			/* Memory error */
+			file->is_out_of_memory = TRUE;
+		}
+	} else {
+		/* This is an existing file in memory */
+		if (calculated_size > (guint64) entry->payload_len &&
+			!file->is_out_of_memory) {
+			/* We need more memory */
+			if (calculated_size > G_MAXSIZE) {
+				/*
+				 * As for g_try_malloc(), so for
+				 * g_try_realloc().
+				 */
+				dest_memory_addr = NULL;
+			} else {
+				dest_memory_addr = g_try_realloc(
+					entry->payload_data,
+					(gsize)calculated_size);
+			}
+			if (!dest_memory_addr) {
+				/* Memory error */
+				file->is_out_of_memory = TRUE;
+				/* We don't have memory for this file.
+				   Free the current file content from memory */
+				g_free(entry->payload_data);
+				entry->payload_data = NULL;
+				entry->payload_len = 0;
+			} else {
+				entry->payload_data = (guint8 *)dest_memory_addr;
+				entry->payload_len = calculated_size;
+			}
+		}
+	}
+	/* ...then, put the chunk of the file in the right place */
+	if (!file->is_out_of_memory) {
+		dest_memory_addr = entry->payload_data + chunk_offset;
+		memmove(dest_memory_addr, eo_info->payload_data, eo_info->payload_len);
+	}
+}
+
+/* We use this function to obtain the index in the GSL of a given file */
+static int
+find_incoming_file(GSList *GSL_active_files_p, active_file *incoming_file)
+{
+	int          i, row, last;
+	active_file *in_list_file;
+
+	row  = -1;
+	last = g_slist_length(GSL_active_files_p) - 1;
+
+	/* We lookup in reverse order because it is more likely that the file
+		is one of the latest */
+	for (i=last; i>=0; i--) {
+		in_list_file = (active_file *)g_slist_nth_data(GSL_active_files_p, i);
+		/* The best-working criteria of two identical files is that the file
+			that is the same of the file that we are analyzing is the last one
+			in the list that has the same tid and the same fid */
+		/* note that we have excluded in_list_file->uid == incoming_file->uid
+			from the comparison, because a file can be opened by different
+			SMB users and it is still the same file */
+		if (in_list_file->tid == incoming_file->tid &&
+			in_list_file->fid == incoming_file->fid) {
+			row = i;
+			break;
+		}
+	}
+
+	return row;
+}
+
+static gboolean
+smb_eo_packet(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data)
+{
+	export_object_list_t   *object_list = (export_object_list_t *)tapdata;
+	const smb_eo_t         *eo_info     = (const smb_eo_t *)data;
+
+	export_object_entry_t  *entry;
+	export_object_entry_t  *current_entry;
+	active_file             incoming_file;
+	gint                    active_row;
+	active_file            *new_file;
+	active_file            *current_file;
+	guint8                  contains;
+	gboolean                is_supported_filetype;
+	gfloat                  percent;
+
+	gchar                  *aux_smb_fid_type_string;
+
+	if (eo_info->smbversion==1) {
+		/* Is this an eo_smb supported file_type? (right now we only support FILE) */
+		is_supported_filetype = (eo_info->fid_type == SMB_FID_TYPE_FILE);
+		aux_smb_fid_type_string=g_strdup(try_val_to_str(eo_info->fid_type, smb_fid_types));
+
+		/* What kind of data this packet contains? */
+		switch(eo_info->cmd) {
+		case SMB_COM_READ_ANDX:
+		case SMB_COM_READ:
+			contains = SMB_EO_CONTAINS_READS;
+			break;
+		case SMB_COM_WRITE_ANDX:
+		case SMB_COM_WRITE:
+			contains = SMB_EO_CONTAINS_WRITES;
+			break;
+		default:
+			contains = SMB_EO_CONTAINS_NOTHING;
+			break;
+		}
+	} else {
+		/* Is this an eo_smb supported file_type? (right now we only support FILE) */
+		is_supported_filetype = (eo_info->fid_type == SMB2_FID_TYPE_FILE );
+		aux_smb_fid_type_string=g_strdup(try_val_to_str(eo_info->fid_type, smb2_fid_types));
+
+		/* What kind of data this packet contains? */
+		switch(eo_info->cmd) {
+		case SMB2_COM_READ:
+			contains = SMB_EO_CONTAINS_READS;
+			break;
+		case SMB2_COM_WRITE:
+			contains = SMB_EO_CONTAINS_WRITES;
+			break;
+		default:
+			contains = SMB_EO_CONTAINS_NOTHING;
+			break;
+		}
+	}
+
+
+	/* Is this data from an already tracked file or not? */
+	incoming_file.tid = eo_info->tid;
+	incoming_file.uid = eo_info->uid;
+	incoming_file.fid = eo_info->fid;
+	active_row = find_incoming_file(GSL_active_files, &incoming_file);
+
+	if (active_row == -1) { /* This is a new-tracked file */
+		/* Construct the entry in the list of active files */
+		entry = g_new(export_object_entry_t, 1);
+		entry->payload_data = NULL;
+		entry->payload_len = 0;
+		new_file = (active_file *)g_malloc(sizeof(active_file));
+		new_file->tid = incoming_file.tid;
+		new_file->uid = incoming_file.uid;
+		new_file->fid = incoming_file.fid;
+		new_file->file_length = eo_info->end_of_file;
+		new_file->flag_contains = contains;
+		new_file->free_chunk_list = NULL;
+		new_file->data_gathered = 0;
+		new_file->is_out_of_memory = FALSE;
+		entry->pkt_num = pinfo->num;
+
+		entry->hostname=g_filename_display_name(g_strcanon(eo_info->hostname,LEGAL_FILENAME_CHARS,'?'));
+		entry->filename=g_filename_display_name(g_strcanon(eo_info->filename,LEGAL_FILENAME_CHARS,'?'));
+
+		/* Insert the first chunk in the chunk list of this file */
+		if (is_supported_filetype) {
+			insert_chunk(new_file, entry, eo_info);
+		}
+
+		if (new_file->is_out_of_memory) {
+			entry->content_type =
+				g_strdup_printf("%s (%"G_GUINT64_FORMAT"?/%"G_GUINT64_FORMAT") %s [mem!!]",
+								aux_smb_fid_type_string,
+								new_file->data_gathered,
+								new_file->file_length,
+								try_val_to_str(contains, smb_eo_contains_string));
+		} else {
+			if (new_file->file_length > 0) {
+				percent = (gfloat) (100*new_file->data_gathered/new_file->file_length);
+			} else {
+				percent = 0.0f;
+			}
+
+			entry->content_type =
+				g_strdup_printf("%s (%"G_GUINT64_FORMAT"/%"G_GUINT64_FORMAT") %s [%5.2f%%]",
+								aux_smb_fid_type_string,
+								new_file->data_gathered,
+								new_file->file_length,
+								try_val_to_str(contains, smb_eo_contains_string),
+								percent);
+		}
+
+		object_list->add_entry(object_list->gui_data, entry);
+		GSL_active_files = g_slist_append(GSL_active_files, new_file);
+	}
+	else if (is_supported_filetype) {
+		current_file = (active_file *)g_slist_nth_data(GSL_active_files, active_row);
+		/* Recalculate the current file flags */
+		current_file->flag_contains = current_file->flag_contains|contains;
+		current_entry = object_list->get_entry(object_list->gui_data, active_row);
+
+		insert_chunk(current_file, current_entry, eo_info);
+
+		/* Modify the current_entry object_type string */
+		if (current_file->is_out_of_memory) {
+			current_entry->content_type =
+				g_strdup_printf("%s (%"G_GUINT64_FORMAT"?/%"G_GUINT64_FORMAT") %s [mem!!]",
+								aux_smb_fid_type_string,
+								current_file->data_gathered,
+								current_file->file_length,
+								try_val_to_str(current_file->flag_contains, smb_eo_contains_string));
+		} else {
+			percent = (gfloat) (100*current_file->data_gathered/current_file->file_length);
+			current_entry->content_type =
+				g_strdup_printf("%s (%"G_GUINT64_FORMAT"/%"G_GUINT64_FORMAT") %s [%5.2f%%]",
+								aux_smb_fid_type_string,
+								current_file->data_gathered,
+								current_file->file_length,
+								try_val_to_str(current_file->flag_contains, smb_eo_contains_string),
+								percent);
+		}
+	}
+
+	return TRUE; /* State changed - window should be redrawn */
+}
+
+/* This is the eo_reset_cb function that is used in the export_object module
+   to cleanup any previous private data of the export object functionality before perform
+   the eo_reset function or when the window closes */
+void
+smb_eo_cleanup(void)
+{
+	int          i, last;
+	active_file *in_list_file;
+
+	/* Free any previous data structures used in previous invocation to the
+		export_object_smb function */
+	last = g_slist_length(GSL_active_files);
+	if (GSL_active_files) {
+		for (i=last-1; i>=0; i--) {
+			in_list_file = (active_file *)g_slist_nth_data(GSL_active_files, i);
+			if (in_list_file->free_chunk_list) {
+				g_slist_free(in_list_file->free_chunk_list);
+				in_list_file->free_chunk_list = NULL;
+			}
+			g_free(in_list_file);
+		}
+		g_slist_free(GSL_active_files);
+		GSL_active_files = NULL;
+	}
+}
+
+/*
  * Macros for use in the main dissector routines for an SMB.
  */
 
@@ -20621,12 +21039,11 @@ proto_register_smb(void)
 	register_init_routine(smb_trans_reassembly_init);
 	smb_tap = register_tap("smb");
 
-	/* Register the tap for the "Export Object" function */
-	smb_eo_tap = register_tap("smb_eo"); /* SMB Export Object tap */
-
 	register_dissector("smb", dissect_smb, proto_smb);
 
 	register_srt_table(proto_smb, NULL, 3, smbstat_packet, smbstat_init, NULL);
+	/* Register the tap for the "Export Object" function */
+	smb_eo_tap = register_export_object(proto_smb, smb_eo_packet, smb_eo_cleanup);
 }
 
 void