[Bug 2054889] [NEW] pcap streams are text files which insert 0xD in Windows version

[Benjamin David Lunt]

Public bug reported:

Since Windows text files use CRLFs for all \n, the Windows version of
QEMU inserts a CR in the PCAP stream when a LF is encountered when using
USB PCAP files.

Starting at line 275 in hw/usb/bus (https://gitlab.com/qemu-
project/qemu/-/blob/master/hw/usb/bus.c?ref_type=heads#L275), the file
is opened as text instead of binary.

I think the following patch would fix the issue:
    if (dev->pcap_filename) {
-       int fd = qemu_open_old(dev->pcap_filename, O_CREAT | O_WRONLY | 
O_TRUNC, 0666);
+       int fd = qemu_open_old(dev->pcap_filename, O_CREAT | O_WRONLY | O_TRUNC 
| O_BINARY, 0666);
        if (fd < 0) {
            error_setg(errp, "open %s failed", dev->pcap_filename);
            usb_qdev_unrealize(qdev);
            return;
        }
-       dev->pcap = fdopen(fd, "w");
+       dev->pcap = fdopen(fd, "wb");
        usb_pcap_init(dev->pcap);
    }

To show an example, when using a very common protocol to USB disks, the
BBB protocol uses a 10-byte command packet. For example, the
READ_CAPACITY(10) command (implemented at https://gitlab.com/qemu-
project/qemu/-/blob/master/hw/scsi/scsi-disk.c#L2068) will have a
command block length of 10 (0xA). When this 10-byte command (part of the
31-byte CBW) is placed into the PCAP file, the Windows file manager
inserts a 0xD before the 0xA, turning the 31-byte CBW into a 32-byte
CBW.

Actual CBW:
  0040   55 53 42 43 01 00 00 00 08 00 00 00 80 00 0a 25   USBC............
  0050   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00      %..............

PCAP CBW
  0040   55 53 42 43 01 00 00 00 08 00 00 00 80 00 0d 0a   USBC............
  0050   25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   %..............

I believe simply opening the PCAP file as BINARY instead of TEXT will
fix this issue.

Thank you.

** Affects: qemu
     Importance: Undecided
         Status: New


** Tags: pcap usb

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/2054889

Title:
  pcap streams are text files which insert 0xD in Windows version

Status in QEMU:
  New

Bug description:
  Since Windows text files use CRLFs for all \n, the Windows version of
  QEMU inserts a CR in the PCAP stream when a LF is encountered when
  using USB PCAP files.

  Starting at line 275 in hw/usb/bus (https://gitlab.com/qemu-
  project/qemu/-/blob/master/hw/usb/bus.c?ref_type=heads#L275), the file
  is opened as text instead of binary.

  I think the following patch would fix the issue:
      if (dev->pcap_filename) {
  -       int fd = qemu_open_old(dev->pcap_filename, O_CREAT | O_WRONLY | 
O_TRUNC, 0666);
  +       int fd = qemu_open_old(dev->pcap_filename, O_CREAT | O_WRONLY | 
O_TRUNC | O_BINARY, 0666);
          if (fd < 0) {
              error_setg(errp, "open %s failed", dev->pcap_filename);
              usb_qdev_unrealize(qdev);
              return;
          }
  -       dev->pcap = fdopen(fd, "w");
  +       dev->pcap = fdopen(fd, "wb");
          usb_pcap_init(dev->pcap);
      }

  To show an example, when using a very common protocol to USB disks,
  the BBB protocol uses a 10-byte command packet. For example, the
  READ_CAPACITY(10) command (implemented at https://gitlab.com/qemu-
  project/qemu/-/blob/master/hw/scsi/scsi-disk.c#L2068) will have a
  command block length of 10 (0xA). When this 10-byte command (part of
  the 31-byte CBW) is placed into the PCAP file, the Windows file
  manager inserts a 0xD before the 0xA, turning the 31-byte CBW into a
  32-byte CBW.

  Actual CBW:
    0040   55 53 42 43 01 00 00 00 08 00 00 00 80 00 0a 25   USBC............
    0050   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00      %..............

  PCAP CBW
    0040   55 53 42 43 01 00 00 00 08 00 00 00 80 00 0d 0a   USBC............
    0050   25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   %..............

  I believe simply opening the PCAP file as BINARY instead of TEXT will
  fix this issue.

  Thank you.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/2054889/+subscriptions