aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netscaler.c
AgeCommit message (Collapse)AuthorFilesLines
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris1-55/+56
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-16Remove incorrectly-inserted "return FALSE;".Guy Harris1-1/+0
That made PACKET_DESCRIBE() do nothing, causing warnings from the Clang Static Humiliator. Change-Id: I6f433cd193b6398d89038e95c7bf5deb24aa186d Reviewed-on: https://code.wireshark.org/review/32437 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-16Fix up the checks in nspm_signature_version().Guy Harris1-36/+93
Move the read out of nspm_signature_version(), to make it a bit clearer what file I/O we do in the open process; have nspm_signature_version() just look for a signature in a single page. In the loop in nspm_signature_version(), make sure we have enough of the record header to look at the type and length fields in that header before looking at them and, when we can look at them, make sure the length of the record 1) fits in what remains of the page we're looking at and 2) is big enough to be the length of a signature record. Change-Id: I7d625859136e6f39c40b166067fc7efea806d9b0 Reviewed-on: https://code.wireshark.org/review/32426 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-15netscaler: add more sanity checks.Dario Lombardo1-0/+4
Fix more crashes found in the provided bug report. Bug: 15497 Change-Id: If84498fa879ad56c8677f8c1442a8dc0e5906003 Reviewed-on: https://code.wireshark.org/review/32333 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-14Ask, in a comment, whether we should do an exact match on signatures.Guy Harris1-0/+2
Change-Id: I3c6e904a2e8cc843687b69f633fd0dfbf0ec7937 Reviewed-on: https://code.wireshark.org/review/32407 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-14Fix the test for a NetScaler trace file.Guy Harris1-7/+21
When testing the signature field against a given version's signature: we require that the signature field's size (size, not C null-terminated string length) be at least the size of the signature string (otherwise, it can't possibly match); we check to make sure that the first N bytes of the signature field, where N is the size of the version's signature string (not including any terminating '\0' in that string), match the version's signature string. I.e., we require that the version's signature string is a prefix of the signature string in the file. This does not require that the signature string in the file be null-terminated. It also doesn't allow the file's signature string to be a substring of the version's signature string, as that's *NOT* sufficient to identify the file as a NetScaler trace file, especially if we forcibly null-terminate the file's signature string and we trucate it to be zero-length, as, in that case, it's *always* a prefix of the version's signature string, and the file is incorrectly identified as a NetScaler trace file. (While we're at it, we make the nspm_signature_isvXXX() routines return true if it *is* and false if it *isn't*, rather than the reverse; having a routine with a name containing "is", and not "isnt", return true if it *isn't* is confusing.) Change-Id: I3694773a71b8b63d280e42f146698c82a0f0c332 Ping-Bug: 15601 Reviewed-on: https://code.wireshark.org/review/32403 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-02-26netscaler: fix multiple out-of-bounds reads.Dario Lombardo1-6/+60
Multiple bugs have been found in the provided bug. Some of them have been fixed in gefe920a, others here. The main problem is when malformed files give wrong lenghts to the code, that casts and dereference it without checking, causing oob reads. The fix introduces a check function that prevents to go beyond the limits, early returning with a malformed file message. Other bugs have been fixed by forcing the string terminator that allows the use of strlen() and MIN() that prevent wrong reads. Bug: 15497 Change-Id: I8411208b5ea0f1a0720a17b882f704d03296d1c4 Reviewed-on: https://code.wireshark.org/review/32194 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-02-20netscaler: fix crash when reading malformed packets.Dario Lombardo1-0/+6
When reading a malformed packet, it can occur that we go close to the end of the buffer. We need to check if we have 2 bytes before reading a uint16. Bug: 15497 Change-Id: I2b00f44933ca11b925ffbf05b9855684feebcda5 Reviewed-on: https://code.wireshark.org/review/32028 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-274/+278
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-20wiretap: use SPDX identifiers (partial work).Dario Lombardo1-13/+1
Change-Id: I28436e003ce7fe31d53e6663f3cc7aca00845e4b Reviewed-on: https://code.wireshark.org/review/25392 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-4/+4
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-29Fix problem found by Coverity.Guy Harris1-1/+5
The loop was using bytes_read, but wasn't setting it. Go back to something similar to the previous loop condition, but don't lose the error tests. Fixes Coverity CID 1403388. Change-Id: I557cbfa6e9ad81491af4fc90e85ce87c71fec8aa Reviewed-on: https://code.wireshark.org/review/20776 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-27netscaler.c: use dynamic memory for temporary buffer in nstrace_read_v30.Michael Mann1-1/+9
Makes Windows vscodeanalysis a little happier. Change-Id: Ie744e91ab3f2a9744ae21c932ab6ea25467ad2fa Reviewed-on: https://code.wireshark.org/review/20724 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-12Catch read errors and zero-length records, as opposed to short reads/EOF.Guy Harris1-22/+50
Also, if we return WTAP_OPEN_ERROR from an open routine after we've set our close routine, that routine is called, which frees up our private data structures; don't free them ourselves before returning WTAP_OPEN_ERROR. Change-Id: I03eebe1a1677e2161fdacec8de14668093cf03a3 Reviewed-on: https://code.wireshark.org/review/20522 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-12netscaler: Sanity check record sizeMichael Mann1-1/+5
Bug: 13478 Change-Id: I6be2972979ff7cabf27e70d236c581d539d6ddac Reviewed-on: https://code.wireshark.org/review/20515 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-10Don't cast to a too-large size.Guy Harris1-1/+1
The maximum record length is 255*128 + 127 = 32767; that fits in a guint32, which is large enough to support the biggest packet we'd ever support without stretching several size values to 64 bits. It's not a size of an object in memory, so it doesn't have to be a size_t, and a size_t could be too large to fit in the record sizes we're using. Just cast to guint32. Change-Id: Ie664fda3ce9945893fd992bbb9a81a5d632a3fcb Reviewed-on: https://code.wireshark.org/review/20479 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-10nstrace: fix size of vmnamesAnil Kumar1-2/+2
When vmnames are included in the header of a netscaler packet trace, number of bytes equal to the size of vmnames is omitted from the packet, by the dissector. Bug: 13459 Change-Id: I0f907e9c2e08c1cbebd47f7e50d8284a6aaade59 Reviewed-on: https://code.wireshark.org/review/20446 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-02Make sure nspr_getv20recordsize() returns an unsigned value.Guy Harris1-1/+1
The record size fields are guint8, but NSPR_V20RECORDSIZE_2BYTES was 0x80, which has type int, promoting the result to int. Make it 0x80U, which means everything is unsigned. This squelches a compiler warning. Change-Id: I1c63e485352a90c7f675ab0dacaaeba794235b35 Reviewed-on: https://code.wireshark.org/review/20344 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-02Do more record length checks.Guy Harris1-15/+45
Do the check early in the process of processing the record, and do it for all record types. Bug: 13429 Change-Id: Id7f4d12415c6740241850d8f873cff52909e7110 Reviewed-on: https://code.wireshark.org/review/20330 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-02Don't go past the end of a page in a NetScaler file.Guy Harris1-16/+69
Records in a properly formatted NetScaler file shouldn't go past the end of a page, but nothing guarantees that a NetScaler file will be properly formatted. NetScaler 3.x files allow record bodies to go past the end of a page, but 1.x and 2.x files don't, so treat record headers that go past the end of a page, and record bodies in 1.x and 2.x files that go past the end of a page, as errors. Clean up some stuff while we're at it. Bug: 13430 Change-Id: I3b1d56086e3bb14b246406f306e3d730df337561 Reviewed-on: https://code.wireshark.org/review/20326 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-04-30Note some cases where we don't need to check the packet length.Guy Harris1-0/+13
These file formats have 16-bit packet lengths, so, even with some extra metadata added, the packet data length will never be bigger than WTAP_MAX_PACKET_SIZE. (No, we won't ever reduce WTAP_MAX_PACKET_SIZE.) Change-Id: I9e1b1d90971f91cc6e5d66d0aa93841445b2bc22 Reviewed-on: https://code.wireshark.org/review/15186 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-03-06Fix indentation.Guy Harris1-23/+23
Change-Id: I78fd1d8e91443fa878e6c4ae05839d8a49849830 Reviewed-on: https://code.wireshark.org/review/14367 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-11nstrace: Allow opening of files that are not multiples of 16kBanilkumar9111-5/+14
in size. Wireshark/Tshark hangs when netscaler trace file smaller than 16KB is opened. It also hangs when a gzipped trace file is opened. With this fix, Files with sizes that are not multiple of 16KB and gzipped files can be opened. Bug: 12083 Change-Id: I26b2fc406edafcb2f1f6161d69064ba5662ddf29 Reviewed-on: https://code.wireshark.org/review/13721 Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-12-18Removed local definitions of offsetof().Stig Bjørlykke1-4/+2
The offsetof() macro is an ANSI C library feature. Change-Id: I2ac91b0b4c94c6f6baf14133b076fdc5ed2e182b Reviewed-on: https://code.wireshark.org/review/12707 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-06-03Netscaler: Fix issue where packets were lost when selected packets were exportedanilkumar9111-5/+21
Only this issue with a netscaler trace file Bug: 11248 Change-Id: I2bc2cae5c988eeff7bdd08471bf421faafcd4e73 Reviewed-on: https://code.wireshark.org/review/8672 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-04-13Support for new netscaler 3.5 trace format.anilkumar9111-5/+121
Change-Id: Ica74f3f9239a96486967cf248feb4313bc390734 Reviewed-on: https://code.wireshark.org/review/7751 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-03-01Call TIMEDEFVn macros in all PACKET_DESCRIBE() macros.Guy Harris1-46/+70
Create TIMEDEFV10() and, for it and for V20, V21, and V22, undefine the ones used for the read routine and define dummy ones for the read-seek routines (as those record formats have relative, not absolute, times). Have all of them set presence_flags. That way: 1) if we *can* set the time stamps in the seek-read routine, we do; 2) we always set presence_flags in read and seek-read routines. Change-Id: I837507245e8a0cbc68c7c5fd8365f474d085488e Reviewed-on: https://code.wireshark.org/review/7445 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Make the V10 path a bit more like the other paths.Guy Harris1-13/+17
Provide {FULL,PART}SIZEDEFV10 macros, similar to what's provided for the other versions, containing the code to set the packet length and captured data length, and use the TRACE_V10_REC_LEN_OFF() macro directly after that to set the various length and offset values in the pseudo-header. Change-Id: I3513371057601b44821d89ebaa7565ab370a67f5 Reviewed-on: https://code.wireshark.org/review/7393 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Make the _offset values static constants.Guy Harris1-5/+5
No need to export them outside this file, and making them constants might convince the compiler not to bother fetching their values from memory when referring to them. Change-Id: Ib8605bf0bb9091721a51827c45fe75d19a15ba26 Reviewed-on: https://code.wireshark.org/review/7378 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Have a PACKET_DESCRIBE() for V30's seek-read routine.Guy Harris1-4/+13
That way it'll set the captured length and reported length the same way it's done in the read routine. Change-Id: I8b1f2d0d8fa688f44b6f61f16dc2e21b5648fc12 Reviewed-on: https://code.wireshark.org/review/7376 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Make the V10 PACKET_DESCRIBE() macro a little more like the others.Guy Harris1-20/+18
Rename the V10 PACKET_DESCRIBE()'s "fpp" argument to "type", and have it declare the pointer variable. Change-Id: I3ac52ebdef0aec7bc95052277537185132886b57 Reviewed-on: https://code.wireshark.org/review/7374 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Rename the "type" argument to V10's PACKET_DESCRIBE() to "ver".Guy Harris1-10/+10
Move it in the argument list, and use it instead of a hard-coded 10 (even though it's always passed as 10), to match the other PACKET_DESCRIBE() macros. Change-Id: Idd0a23a58cc6bb0d2de799b039db776d279cc03e Reviewed-on: https://code.wireshark.org/review/7372 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Call the version-number argument to GENERATE_CASE_xxx() "ver".Guy Harris1-73/+73
The name "type" is thrown around to mean both a version number and a part of a structure member, and some other macros use "ver" for the version number; try to make things a little less inconsistent. Change-Id: I61405cf41cca43fe607154af7498944c5ec0ef11 Reviewed-on: https://code.wireshark.org/review/7370 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Use FULL/PART as an argument to all PACKET_DESCRIBE() macros.Guy Harris1-30/+30
Makes the various flavors of that macro more similar. Change-Id: Ie95ee8db0b226458146b055b54b7d61835f1e508 Reviewed-on: https://code.wireshark.org/review/7368 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Get rid of an unused argument to PACKET_DESCRIBE().Guy Harris1-12/+12
Change-Id: Ic2037f5bf7eb43f93ba39f91bca3fc267c8fb850 Reviewed-on: https://code.wireshark.org/review/7366 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Give all PACKET_DESCRIBE() macros a HEADERVER argument.Guy Harris1-3/+3
A bit of regularization. Change-Id: I60e0bd50891e1ba3e9c40f8d1d14d63534e08138 Reviewed-on: https://code.wireshark.org/review/7364 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-25Call header version arguments HEADERVER.Guy Harris1-34/+34
Use that rather than TYPE or acttype (to indicate that it's a header version number to use as the "xxx" in NSPR_HEADER_VERSIONxxx, and to use the same name throughout). Change-Id: I14cfc819e44ce4388c27d521a1256dec8d80df2e Reviewed-on: https://code.wireshark.org/review/7361 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24More indentation cleanups.Guy Harris1-36/+36
Change-Id: Ia448727e6340723800d92097f0ef7f3582ef6340 Reviewed-on: https://code.wireshark.org/review/7359 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24Clean up indentation.Guy Harris1-1/+1
Change-Id: I80f8c5c642ebc1fe0169e39c1af9584cfbb89d1a Reviewed-on: https://code.wireshark.org/review/7357 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24Pull more into PACKET_DESCRIBE() for the V10 seek-read routine.Guy Harris1-17/+16
Just like the read routine. Change-Id: If6bd98bea15f1c8dc7454a5dac0ea57920bddc8c Reviewed-on: https://code.wireshark.org/review/7355 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24Swallow up more V10 stuff into PACKET_DESCRIBE().Guy Harris1-39/+24
That makes it even more like V2x and V3x and slightly less unclear. Change-Id: I798ead123ba6418be0252067773a951390e26ce8 Reviewed-on: https://code.wireshark.org/review/7353 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24Have PACKET_DESCRIBE() for V10.Guy Harris1-5/+21
Have it set the record type and initialize the presence bits. That makes it a bit more like V2x and V3x, and makes the code slightly less unclear. Change-Id: Ibfbe2143b24a68c3fa3f576616fde81918b01feb Reviewed-on: https://code.wireshark.org/review/7351 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24Move the setting of rec_type.Guy Harris1-5/+2
This makes the code slightly less unclear. (You are in a maze of twisty little C macros, all different.) Change-Id: I9f1bcc7a9a1a7afe87ede8b1ba513e3d8e53845c Reviewed-on: https://code.wireshark.org/review/7349 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-24NS Trace (NetScaler Trace) file format is not able to export specified packetsranushekhar1-0/+1
Bug: 10998 Change-Id: Ic2c5ad5b01be3e0c39b1e93badcc4f2246c420fe Reviewed-on: https://code.wireshark.org/review/7327 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-1/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-0/+13
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-27Get rid of packet data members of header structures.Guy Harris1-43/+26
Instead, have a special macro using the size of the header structure to find the offset of the packet data. This means that: 1) you don't have to throw "-{size of data member}" into the macros that calculate the sizes of the header structures; 2) you don't have a bunch of randomly-chosen data field sizes; 3) you don't have sizes of 0, which cause problems with compilers that don't support zero-length arrays; 4) you don't have some apparently-incorrect "-{size of data member}" values (if they're correct, please fix the structure definitions). Change-Id: Iea368b83fa2d184bd6df453d51756e4749714e2c Reviewed-on: https://code.wireshark.org/review/6082 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.Guy Harris1-1/+1
That indicates that it's a problem specific to *writing* capture files; we've already converted some errors to that style, and added a new one in that style. Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d Reviewed-on: https://code.wireshark.org/review/5826 Reviewed-by: Guy Harris <guy@alum.mit.edu>