wiretap/mime_file.c

   1 /* mime_file.c
   2  *
   3  * MIME file format decoder for the Wiretap library.
   4  *
   5  * This is for use with Wireshark dissectors that handle file
   6  * formats (e.g., because they handle a particular MIME media type).
   7  * It breaks the file into chunks of at most WTAP_MAX_PACKET_SIZE_STANDARD,
   8  * each of which is reported as a packet, so that files larger than
   9  * WTAP_MAX_PACKET_SIZE_STANDARD can be handled by reassembly.
  10  *
  11  * The "MIME file" dissector does the reassembly, and hands the result
  12  * off to heuristic dissectors to try to identify the file's contents.
  13  *
  14  * Wiretap Library
  15  *
  16  * SPDX-License-Identifier: GPL-2.0-or-later
  17  */
  18
  19 #include "config.h"
  20 #include "mime_file.h"
  21
  22 #include <sys/types.h>
  23
  24 #ifdef HAVE_UNISTD_H
  25 #include <unistd.h>
  26 #endif
  27
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <time.h>
  31
  32 #include "wtap-int.h"
  33 #include "file_wrappers.h"
  34 #include <wsutil/buffer.h>
  35
  36 typedef struct {
  37         const uint8_t *magic;
  38         unsigned magic_len;
  39 } mime_files_t;
  40
  41 /*
  42  * Written by Marton Nemeth <nm127@freemail.hu>
  43  * Copyright 2009 Marton Nemeth
  44  * The JPEG specification can be found at:
  45  *
  46  * https://www.w3.org/Graphics/JPEG/itu-t81.pdf
  47  * https://www.itu.int/rec/T-REC-T.81/en (but you have to pay for it)
  48  *
  49  * and the JFIF specification can be found at:
  50  *
  51  * https://www.itu.int/rec/T-REC-T.871-201105-I/en
  52  * https://www.w3.org/Graphics/JPEG/jfif3.pdf
  53  */
  54 static const uint8_t jpeg_jfif_magic[] = { 0xFF, 0xD8, /* SOF */
  55                                           0xFF        /* start of the next marker */
  56                                         };
  57
  58 /* <?xml */
  59 static const uint8_t xml_magic[]    = { '<', '?', 'x', 'm', 'l' };
  60 static const uint8_t png_magic[]    = { 0x89, 'P', 'N', 'G', '\r', '\n', 0x1A, '\n' };
  61 static const uint8_t gif87a_magic[] = { 'G', 'I', 'F', '8', '7', 'a'};
  62 static const uint8_t gif89a_magic[] = { 'G', 'I', 'F', '8', '9', 'a'};
  63 static const uint8_t elf_magic[]    = { 0x7F, 'E', 'L', 'F'};
  64 static const uint8_t tiff_le_magic[]    = { 'I', 'I', 42, 0 };
  65 static const uint8_t tiff_be_magic[]    = { 'M', 'M', 0, 42 };
  66 static const uint8_t btsnoop_magic[]    = { 'b', 't', 's', 'n', 'o', 'o', 'p', 0};
  67 static const uint8_t pcap_magic[]           = { 0xA1, 0xB2, 0xC3, 0xD4 };
  68 static const uint8_t pcap_swapped_magic[]   = { 0xD4, 0xC3, 0xB2, 0xA1 };
  69 static const uint8_t pcap_nsec_magic[]           = { 0xA1, 0xB2, 0x3C, 0x4D };
  70 static const uint8_t pcap_nsec_swapped_magic[]   = { 0x4D, 0x3C, 0xB2, 0xA1 };
  71 static const uint8_t pcapng_premagic[]      = { 0x0A, 0x0D, 0x0D, 0x0A };
  72 static const uint8_t blf_magic[]                 = { 'L', 'O', 'G', 'G' };
  73 static const uint8_t autosar_dlt_magic[]         = { 'D', 'L', 'T', 0x01 };
  74 static const uint8_t rtpdump_magic[]         = { '#', '!', 'r', 't', 'p', 'p', 'l', 'a', 'y', '1', '.', '0', ' ' };
  75
  76 /* File does not start with it */
  77 static const uint8_t pcapng_xmagic[]         = { 0x1A, 0x2B, 0x3C, 0x4D };
  78 static const uint8_t pcapng_swapped_xmagic[] = { 0x4D, 0x3C, 0x2B, 0x1A };
  79
  80 static const mime_files_t magic_files[] = {
  81         { jpeg_jfif_magic, sizeof(jpeg_jfif_magic) },
  82         { xml_magic, sizeof(xml_magic) },
  83         { png_magic, sizeof(png_magic) },
  84         { gif87a_magic, sizeof(gif87a_magic) },
  85         { gif89a_magic, sizeof(gif89a_magic) },
  86         { elf_magic, sizeof(elf_magic) },
  87         { tiff_le_magic, sizeof(tiff_le_magic) },
  88         { tiff_be_magic, sizeof(tiff_be_magic) },
  89         { btsnoop_magic, sizeof(btsnoop_magic) },
  90         { pcap_magic, sizeof(pcap_magic) },
  91         { pcap_swapped_magic, sizeof(pcap_swapped_magic) },
  92         { pcap_nsec_magic, sizeof(pcap_nsec_magic) },
  93         { pcap_nsec_swapped_magic, sizeof(pcap_nsec_swapped_magic) },
  94         { pcapng_premagic, sizeof(pcapng_premagic) },
  95         { blf_magic, sizeof(blf_magic) },
  96         { autosar_dlt_magic, sizeof(autosar_dlt_magic) },
  97         { rtpdump_magic, sizeof(rtpdump_magic) },
  98 };
  99
 100 #define N_MAGIC_TYPES   array_length(magic_files)
 101
 102 static int mime_file_type_subtype = -1;
 103
 104 void register_mime(void);
 105
 106 wtap_open_return_val
 107 mime_file_open(wtap *wth, int *err, char **err_info)
 108 {
 109         char magic_buf[128]; /* increase buffer size when needed */
 110         int bytes_read;
 111         bool found_file;
 112         /* unsigned file_ok; */
 113         unsigned i;
 114
 115         unsigned read_bytes = 12;
 116
 117         for (i = 0; i < N_MAGIC_TYPES; i++)
 118                 read_bytes = MAX(read_bytes, magic_files[i].magic_len);
 119
 120         read_bytes = (unsigned)MIN(read_bytes, sizeof(magic_buf));
 121         bytes_read = file_read(magic_buf, read_bytes, wth->fh);
 122
 123         if (bytes_read < 0) {
 124                 *err = file_error(wth->fh, err_info);
 125                 return WTAP_OPEN_ERROR;
 126         }
 127         if (bytes_read == 0)
 128                 return WTAP_OPEN_NOT_MINE;
 129
 130         found_file = false;
 131         for (i = 0; i < N_MAGIC_TYPES; i++) {
 132                 if ((unsigned) bytes_read >= magic_files[i].magic_len && !memcmp(magic_buf, magic_files[i].magic, MIN(magic_files[i].magic_len, (unsigned) bytes_read))) {
 133                         if (!found_file) {
 134                                 if (magic_files[i].magic == pcapng_premagic) {
 135                                         if (memcmp(magic_buf + 8, pcapng_xmagic, sizeof(pcapng_xmagic)) &&
 136                                                         memcmp(magic_buf + 8, pcapng_swapped_xmagic, sizeof(pcapng_swapped_xmagic)))
 137                                                 continue;
 138                                 }
 139                                 found_file = true;
 140                         } else
 141                                 return WTAP_OPEN_NOT_MINE;      /* many files matched, bad file */
 142                 }
 143         }
 144
 145         if (!found_file)
 146                 return WTAP_OPEN_NOT_MINE;
 147
 148         if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
 149                 return WTAP_OPEN_ERROR;
 150
 151         wth->file_type_subtype = mime_file_type_subtype;
 152         wth->file_encap = WTAP_ENCAP_MIME;
 153         wth->file_tsprec = WTAP_TSPREC_SEC;
 154         wth->subtype_read = wtap_full_file_read;
 155         wth->subtype_seek_read = wtap_full_file_seek_read;
 156         wth->snapshot_length = 0;
 157
 158         return WTAP_OPEN_MINE;
 159 }
 160
 161 static const struct supported_block_type mime_blocks_supported[] = {
 162         /*
 163          * This is a file format that we dissect, so we provide
 164          * only one "packet" with the file's contents, and don't
 165          * support any options.
 166          */
 167         { WTAP_BLOCK_PACKET, ONE_BLOCK_SUPPORTED, NO_OPTIONS_SUPPORTED }
 168 };
 169
 170 static const struct file_type_subtype_info mime_info = {
 171         "MIME File Format", "mime", NULL, NULL,
 172         false, BLOCKS_SUPPORTED(mime_blocks_supported),
 173         NULL, NULL, NULL
 174 };
 175
 176 /*
 177  * XXX - registered solely for the benefit of Lua scripts that
 178  * look for the file type "JPEG_JFIF"; it may be removed once
 179  * we get rid of wtap_filetypes.
 180  */
 181 static const struct supported_block_type jpeg_jfif_blocks_supported[] = {
 182         /*
 183          * This is a file format that we dissect, so we provide
 184          * only one "packet" with the file's contents, and don't
 185          * support any options.
 186          */
 187         { WTAP_BLOCK_PACKET, ONE_BLOCK_SUPPORTED, NO_OPTIONS_SUPPORTED }
 188 };
 189
 190 static const struct file_type_subtype_info jpeg_jfif_info = {
 191         "JPEG/JFIF", "jpeg", "jpg", "jpeg;jfif",
 192         false, BLOCKS_SUPPORTED(jpeg_jfif_blocks_supported),
 193         NULL, NULL, NULL
 194 };
 195
 196 void register_mime(void)
 197 {
 198         int jpeg_jfif_file_type_subtype;
 199
 200         mime_file_type_subtype = wtap_register_file_type_subtype(&mime_info);
 201
 202         /*
 203          * Obsoleted by "mime", but we want it for the backwards-
 204          * compatibility table for Lua.
 205          */
 206         jpeg_jfif_file_type_subtype = wtap_register_file_type_subtype(&jpeg_jfif_info);
 207
 208         /*
 209          * Register names for backwards compatibility with the
 210          * wtap_filetypes table in Lua.
 211          */
 212         wtap_register_backwards_compatibility_lua_name("MIME",
 213             mime_file_type_subtype);
 214         wtap_register_backwards_compatibility_lua_name("JPEG_JFIF",
 215             jpeg_jfif_file_type_subtype);
 216 }
 217
 218 /*
 219  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 220  *
 221  * Local variables:
 222  * c-basic-offset: 8
 223  * tab-width: 8
 224  * indent-tabs-mode: t
 225  * End:
 226  *
 227  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 228  * :indentSize=8:tabSize=8:noTabs=false:
 229  */