[prev in list] [next in list] [prev in thread] [next in thread]
List: wireshark-bugs
Subject: [Wireshark-bugs] [Bug 14026] New: tshark json output for USB interfaces invalid
From: bugzilla-daemon () wireshark ! org
Date: 2017-08-31 2:25:14
Message-ID: bug-14026-15 () https ! bugs ! wireshark ! org/bugzilla/
[Download RAW message or body]
--15041463140.26f7C467.26706
Date: Thu, 31 Aug 2017 02:25:14 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugs.wireshark.org/bugzilla/
Auto-Submitted: auto-generated
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14026
Bug ID: 14026
Summary: tshark json output for USB interfaces invalid
Product: Wireshark
Version: 2.4.1
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: Normal
Priority: Low
Component: TShark
Assignee: bugzilla-admin@wireshark.org
Reporter: whootandahalf@gmail.com
Target Milestone: ---
Created attachment 15812
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=15812&action=edit
Example PCAP with USB
Build Information:
TShark (Wireshark) 2.4.1 (v2.4.1)
Copyright 1998-2017 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with
GLib 2.52.0, with zlib 1.2.11, without SMI, without c-ares, without Lua,
without
GnuTLS, with Gcrypt 1.7.6-beta, without Kerberos, without GeoIP, without
nghttp2, without LZ4, without Snappy, with libxml2 2.9.4.
Running on Linux 4.10.0-32-generic, with Intel(R) Core(TM) i7-3632QM CPU
@
2.20GHz (with SSE4.2), with 7850 MB of physical memory, with locale
en_US.UTF-8,
with libpcap version 1.8.1, with Gcrypt 1.7.6-beta, with zlib 1.2.11.
Built using gcc 6.3.0 20170406.
--
So I first noticed this issue with the version of tshark that comes with Ubuntu
(2.2.6). I then compiled the latest version (2.4.1 as of writing) and the bug
persists.
The issue is in how json is being crafted for USB response fields.
Specifically, the "HID DESCRIPTOR" and "ENDPOINT DESCRIPTOR". For USB
Configurations with multiple interfaces, these fields are NOT being given
unique names, and thus are overwriting each other and data is being lost by
processing this json.
Example:
/home/user/opt/wireshark-2.4.1/wireshark-2.4.1/tshark -r ./task.pcap -T json
<clipped>
{
"_index": "packets-2017-08-30",
"_type": "pcap_file",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "152",
"frame.time": "Aug 22, 2017 15:03:00.758200000 EDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "1503428580.758200000",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "5.850000000",
"frame.number": "273",
"frame.len": "87",
"frame.cap_len": "87",
"frame.marked": "0",
"frame.ignored": "0",
"frame.protocols": "usb:usbhid:usbhid"
},
"usb": {
"usb.src": "1.3.0",
"usb.addr": "1.3.0",
"usb.dst": "host",
"usb.addr": "host",
"usb.usbpcap_header_len": "28",
"usb.irp_id": "0xffffffff84bada68",
"usb.usbd_status": "0",
"usb.function": "8",
"usb.irp_info": "0x00000001",
"usb.irp_info_tree": {
"usb.irp_info.reserved": "0x00000000",
"usb.irp_info.direction": "0x00000001"
},
"usb.bus_id": "1",
"usb.device_address": "3",
"usb.endpoint_address": "0x00000080",
"usb.endpoint_address_tree": {
"usb.endpoint_address.direction": "1",
"usb.endpoint_address.number": "0"
},
"usb.transfer_type": "0x00000002",
"usb.data_len": "59",
"usb.request_in": "272",
"usb.time": "0.000000000",
"usb.control_stage": "1"
},
"CONFIGURATION DESCRIPTOR": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000002",
"usb.wTotalLength": "59",
"usb.bNumInterfaces": "2",
"usb.bConfigurationValue": "1",
"usb.iConfiguration": "0",
"usb.configuration.bmAttributes": "0x00000080",
"usb.configuration.bmAttributes_tree": {
"usb.configuration.legacy10buspowered": "1",
"usb.configuration.selfpowered": "0",
"usb.configuration.remotewakeup": "0"
},
"usb.bMaxPower": "10"
},
"INTERFACE DESCRIPTOR (0.0): class HID": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000004",
"usb.bInterfaceNumber": "0",
"usb.bAlternateSetting": "0",
"usb.bNumEndpoints": "1",
"usb.bInterfaceClass": "3",
"usb.bInterfaceSubClass": "1",
"usb.bInterfaceProtocol": "1",
"usb.iInterface": "0"
},
"HID DESCRIPTOR": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000021",
"usbhid.descriptor.hid.bcdHID": "0x00000111",
"usbhid.descriptor.hid.bCountryCode": "0x0000000d",
"usbhid.descriptor.hid.bNumDescriptors": "1",
"usbhid.descriptor.hid.bDescriptorType": "34",
"usbhid.descriptor.hid.wDescriptorLength": "75"
},
"ENDPOINT DESCRIPTOR": {
"usb.bLength": "7",
"usb.bDescriptorType": "0x00000005",
"usb.bEndpointAddress": "0x00000081",
"usb.bEndpointAddress_tree": {
"usb.bEndpointAddress.direction": "1",
"usb.bEndpointAddress.number": "0x00000001"
},
"usb.bmAttributes": "0x00000003",
"usb.bmAttributes_tree": {
"usb.bmAttributes.transfer": "0x00000003"
"usb.bmAttributes.transfer": "0x00000003"
},
"usb.wMaxPacketSize": "8",
"usb.wMaxPacketSize_tree": {
"usb.wMaxPacketSize.slots": "0",
"usb.wMaxPacketSize.size": "8"
},
"usb.bInterval": "10"
},
"INTERFACE DESCRIPTOR (1.0): class HID": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000004",
"usb.bInterfaceNumber": "1",
"usb.bAlternateSetting": "0",
"usb.bNumEndpoints": "1",
"usb.bInterfaceClass": "3",
"usb.bInterfaceSubClass": "0",
"usb.bInterfaceProtocol": "0x00000000",
"usb.iInterface": "0"
},
"HID DESCRIPTOR": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000021",
"usbhid.descriptor.hid.bcdHID": "0x00000111",
"usbhid.descriptor.hid.bCountryCode": "0x00000000",
"usbhid.descriptor.hid.bNumDescriptors": "1",
"usbhid.descriptor.hid.bDescriptorType": "34",
"usbhid.descriptor.hid.wDescriptorLength": "47"
},
"ENDPOINT DESCRIPTOR": {
"usb.bLength": "7",
"usb.bDescriptorType": "0x00000005",
"usb.bEndpointAddress": "0x00000082",
"usb.bEndpointAddress_tree": {
"usb.bEndpointAddress.direction": "1",
"usb.bEndpointAddress.number": "0x00000002"
},
"usb.bmAttributes": "0x00000003",
"usb.bmAttributes_tree": {
"usb.bmAttributes.transfer": "0x00000003"
},
"usb.wMaxPacketSize": "1",
"usb.wMaxPacketSize_tree": {
"usb.wMaxPacketSize.slots": "0",
"usb.wMaxPacketSize.size": "1"
},
"usb.bInterval": "10"
}
}
}
}
Note that, in the above example, HID DESCRIPTOR and ENDPOINT DESCRIPTOR are
defined twice each (one for each INTERFACE DESCRIPTOR). However, since they are
not uniquely defined, interface zero's data is overwritten by interface 1's.
I am attaching the example pcap, but any pcap of USB connection with multiple
interfaces will exercise this bug.
--
You are receiving this mail because:
You are watching all bug changes.
--15041463140.26f7C467.26706
Date: Thu, 31 Aug 2017 02:25:14 +0000
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugs.wireshark.org/bugzilla/
Auto-Submitted: auto-generated
<html>
<head>
<base href="https://bugs.wireshark.org/bugzilla/" />
<style>
body, th, td {
font-size: 12px;
font-family: Arial, Helvetica, sans-serif; }
p, pre { margin-top: 1em; }
pre {
font-family: Bitstream Vera Sans Mono, Consolas, Lucida Console, \
monospace; white-space: pre-wrap;
}
table { border: 0; border-spacing: 0; border-collapse: collapse; }
th, td {
padding: 0.25em;
padding-left: 0.5em;
padding-right: 0.5em;
}
th { background: rgb(240, 240, 240); }
th.th_top { border-bottom: 1px solid rgb(116, 126, 147); }
th.th_left { border-right: 1px solid rgb(116, 126, 147); }
td.removed { background-color: #ffcccc; }
td.added { background-color: #e4ffc7; }
</style>
</head>
<body><table>
<tr>
<th class="th_left">Bug ID</th>
<td><a class="bz_bug_link
bz_status_UNCONFIRMED "
title="UNCONFIRMED - tshark json output for USB interfaces invalid"
href="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14026">14026</a>
</td>
</tr>
<tr>
<th class="th_left">Summary</th>
<td>tshark json output for USB interfaces invalid
</td>
</tr>
<tr>
<th class="th_left">Product</th>
<td>Wireshark
</td>
</tr>
<tr>
<th class="th_left">Version</th>
<td>2.4.1
</td>
</tr>
<tr>
<th class="th_left">Hardware</th>
<td>x86
</td>
</tr>
<tr>
<th class="th_left">OS</th>
<td>Linux
</td>
</tr>
<tr>
<th class="th_left">Status</th>
<td>UNCONFIRMED
</td>
</tr>
<tr>
<th class="th_left">Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th class="th_left">Priority</th>
<td>Low
</td>
</tr>
<tr>
<th class="th_left">Component</th>
<td>TShark
</td>
</tr>
<tr>
<th class="th_left">Assignee</th>
<td>bugzilla-admin@wireshark.org
</td>
</tr>
<tr>
<th class="th_left">Reporter</th>
<td>whootandahalf@gmail.com
</td>
</tr>
<tr>
<th class="th_left">Target Milestone</th>
<td>---
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=15812" \
name="attach_15812" title="Example PCAP with USB">attachment 15812</a> <a \
href="attachment.cgi?id=15812&action=edit" title="Example PCAP with \
USB">[details]</a></span> Example PCAP with USB
Build Information:
TShark (Wireshark) 2.4.1 (v2.4.1)
Copyright 1998-2017 Gerald Combs <<a \
href="mailto:gerald@wireshark.org">gerald@wireshark.org</a>> and \
contributors. License GPLv2+: GNU GPL version 2 or later
<<a href="http://www.gnu.org/licenses/old-licenses/gpl-2.0.html">http://www.gnu.org/licenses/old-licenses/gpl-2.0.html</a>>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with
GLib 2.52.0, with zlib 1.2.11, without SMI, without c-ares, without Lua,
without
GnuTLS, with Gcrypt 1.7.6-beta, without Kerberos, without GeoIP, without
nghttp2, without LZ4, without Snappy, with libxml2 2.9.4.
Running on Linux 4.10.0-32-generic, with Intel(R) Core(TM) i7-3632QM CPU
@
2.20GHz (with SSE4.2), with 7850 MB of physical memory, with locale
en_US.UTF-8,
with libpcap version 1.8.1, with Gcrypt 1.7.6-beta, with zlib 1.2.11.
Built using gcc 6.3.0 20170406.
--
So I first noticed this issue with the version of tshark that comes with Ubuntu
(2.2.6). I then compiled the latest version (2.4.1 as of writing) and the bug
persists.
The issue is in how json is being crafted for USB response fields.
Specifically, the "HID DESCRIPTOR" and "ENDPOINT DESCRIPTOR". For \
USB Configurations with multiple interfaces, these fields are NOT being given
unique names, and thus are overwriting each other and data is being lost by
processing this json.
Example:
/home/user/opt/wireshark-2.4.1/wireshark-2.4.1/tshark -r ./task.pcap -T json
<clipped>
{
"_index": "packets-2017-08-30",
"_type": "pcap_file",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "152",
"frame.time": "Aug 22, 2017 15:03:00.758200000 EDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "1503428580.758200000",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "5.850000000",
"frame.number": "273",
"frame.len": "87",
"frame.cap_len": "87",
"frame.marked": "0",
"frame.ignored": "0",
"frame.protocols": "usb:usbhid:usbhid"
},
"usb": {
"usb.src": "1.3.0",
"usb.addr": "1.3.0",
"usb.dst": "host",
"usb.addr": "host",
"usb.usbpcap_header_len": "28",
"usb.irp_id": "0xffffffff84bada68",
"usb.usbd_status": "0",
"usb.function": "8",
"usb.irp_info": "0x00000001",
"usb.irp_info_tree": {
"usb.irp_info.reserved": "0x00000000",
"usb.irp_info.direction": "0x00000001"
},
"usb.bus_id": "1",
"usb.device_address": "3",
"usb.endpoint_address": "0x00000080",
"usb.endpoint_address_tree": {
"usb.endpoint_address.direction": "1",
"usb.endpoint_address.number": "0"
},
"usb.transfer_type": "0x00000002",
"usb.data_len": "59",
"usb.request_in": "272",
"usb.time": "0.000000000",
"usb.control_stage": "1"
},
"CONFIGURATION DESCRIPTOR": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000002",
"usb.wTotalLength": "59",
"usb.bNumInterfaces": "2",
"usb.bConfigurationValue": "1",
"usb.iConfiguration": "0",
"usb.configuration.bmAttributes": "0x00000080",
"usb.configuration.bmAttributes_tree": {
"usb.configuration.legacy10buspowered": "1",
"usb.configuration.selfpowered": "0",
"usb.configuration.remotewakeup": "0"
},
"usb.bMaxPower": "10"
},
"INTERFACE DESCRIPTOR (0.0): class HID": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000004",
"usb.bInterfaceNumber": "0",
"usb.bAlternateSetting": "0",
"usb.bNumEndpoints": "1",
"usb.bInterfaceClass": "3",
"usb.bInterfaceSubClass": "1",
"usb.bInterfaceProtocol": "1",
"usb.iInterface": "0"
},
"HID DESCRIPTOR": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000021",
"usbhid.descriptor.hid.bcdHID": "0x00000111",
"usbhid.descriptor.hid.bCountryCode": "0x0000000d",
"usbhid.descriptor.hid.bNumDescriptors": "1",
"usbhid.descriptor.hid.bDescriptorType": "34",
"usbhid.descriptor.hid.wDescriptorLength": "75"
},
"ENDPOINT DESCRIPTOR": {
"usb.bLength": "7",
"usb.bDescriptorType": "0x00000005",
"usb.bEndpointAddress": "0x00000081",
"usb.bEndpointAddress_tree": {
"usb.bEndpointAddress.direction": "1",
"usb.bEndpointAddress.number": "0x00000001"
},
"usb.bmAttributes": "0x00000003",
"usb.bmAttributes_tree": {
"usb.bmAttributes.transfer": "0x00000003"
"usb.bmAttributes.transfer": "0x00000003"
},
"usb.wMaxPacketSize": "8",
"usb.wMaxPacketSize_tree": {
"usb.wMaxPacketSize.slots": "0",
"usb.wMaxPacketSize.size": "8"
},
"usb.bInterval": "10"
},
"INTERFACE DESCRIPTOR (1.0): class HID": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000004",
"usb.bInterfaceNumber": "1",
"usb.bAlternateSetting": "0",
"usb.bNumEndpoints": "1",
"usb.bInterfaceClass": "3",
"usb.bInterfaceSubClass": "0",
"usb.bInterfaceProtocol": "0x00000000",
"usb.iInterface": "0"
},
"HID DESCRIPTOR": {
"usb.bLength": "9",
"usb.bDescriptorType": "0x00000021",
"usbhid.descriptor.hid.bcdHID": "0x00000111",
"usbhid.descriptor.hid.bCountryCode": "0x00000000",
"usbhid.descriptor.hid.bNumDescriptors": "1",
"usbhid.descriptor.hid.bDescriptorType": "34",
"usbhid.descriptor.hid.wDescriptorLength": "47"
},
"ENDPOINT DESCRIPTOR": {
"usb.bLength": "7",
"usb.bDescriptorType": "0x00000005",
"usb.bEndpointAddress": "0x00000082",
"usb.bEndpointAddress_tree": {
"usb.bEndpointAddress.direction": "1",
"usb.bEndpointAddress.number": "0x00000002"
},
"usb.bmAttributes": "0x00000003",
"usb.bmAttributes_tree": {
"usb.bmAttributes.transfer": "0x00000003"
},
"usb.wMaxPacketSize": "1",
"usb.wMaxPacketSize_tree": {
"usb.wMaxPacketSize.slots": "0",
"usb.wMaxPacketSize.size": "1"
},
"usb.bInterval": "10"
}
}
}
}
Note that, in the above example, HID DESCRIPTOR and ENDPOINT DESCRIPTOR are
defined twice each (one for each INTERFACE DESCRIPTOR). However, since they are
not uniquely defined, interface zero's data is overwritten by interface 1's.
I am attaching the example pcap, but any pcap of USB connection with multiple
interfaces will exercise this bug.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>
--15041463140.26f7C467.26706--
[Attachment #3 (text/plain)]
___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-request@wireshark.org?subject=unsubscribe
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic