Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UTCTimeField and negative value on Windows #4308

Closed
llaubin opened this issue Mar 2, 2024 · 1 comment · Fixed by #4357
Closed

UTCTimeField and negative value on Windows #4308

llaubin opened this issue Mar 2, 2024 · 1 comment · Fixed by #4357
Labels
bug
Milestone
2.6.0

Comments

@llaubin
Copy link

llaubin commented Mar 2, 2024

Brief description

On a Windows, UTCTimeField.i2repr(self, pkt, x) will trigger an error if x is a negative value.

Scapy version

2.5.0

Python version

3.11 (tester on 3.10 also)

Operating system

Windows 10

Additional environment information

This comes from datetime.fromtimestamp(t) which will throw an errror on Windows if t is negative :

In [26]: datetime.fromtimestamp(-1)
---------------------------------------------------------------------------
OSError                                   Traceback (most recent call last)
Cell In[26], line 1
----> 1 datetime.fromtimestamp(-1)

OSError: [Errno 22] Invalid argument

I agree this is not really a Scapy issue. But I think it could be useful to catch errors when creating a datetime from a timestamp.
For example, on every OS, calling datetime.frometimestamp(2**43)will trigger an error. So if a layer contains a UTCTimeField attribute based on a 64 bits value (I don't know if it could happen), this could lead to an error on every OS.

How to reproduce

The following packet will trigger an error when displayed in a Windows environment :

>>> p = Ether(binascii.unhexlify('00155d56b60100155d56b6030800450201246bfe4000800677b90a02010d0a02010a01bdc13df3830c636c7a265c50182003bece0000000000f8fe534d4240000000000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100ff020000071c1e4cf44fa749a15341d7b30ed5cb07000000000080000000800000008000845dc27b5d6bda0100000000000000008000780000000000607606062b0601050502a06c306aa03c303a060a2b06010401823702021e06092a864882f71201020206092a864886f712010202060a2a864886f71201020203060a2b06010401823702020aa32a3028a0261b246e6f745f646566696e65645f696e5f5246433431373840706c656173655f69676e6f7265'))

In this packet, the error comes from the ServerStartTime attribute from the SMB2 Negotiate response which is null.

>>> p[SMB2_Negotiate_Protocol_Response].ServerStartTime
0

Actual result

>>> p.show()
File D:\projets\scapy\scapy\fields.py:3523, in UTCTimeField.i2repr(self, pkt, x)
   3521     x = x / self.custom_scaling
   3522 x += self.delta
-> 3523 t = datetime.fromtimestamp(x).strftime(self.strf)
   3524 return "%s (%d)" % (t, int(x))

OSError: [Errno 22] Invalid argument

Expected result

On Linux, you can see how it is rendered :

>>> p[SMB2_Negotiate_Protocol_Response]
<SMB2_Negotiate_Protocol_Response  ... 
   ServerTime=Thu, 29 Feb 2024 22:20:21 +0000 (1709245221) 
   ServerStartTime=Mon, 01 Jan 1601 00:00:00 +0000 (-11644473600) ..|>

we can see the ServerStartTime attribute being equal to -11644473600, which explains the error on Windows ...

Related resources

No response
@gpotter2 gpotter2 added this to the 2.6.0 milestone Mar 16, 2024
gpotter2 added a commit to gpotter2/scapy that referenced this issue Apr 20, 2024
@gpotter2
Fix UTCTimeField before epoch on Windows
b8f4da2 
This fixes UTCTimeField that have a value before 1970 on Windows.
fixes secdev#4308
@gpotter2 gpotter2 mentioned this issue Apr 20, 2024
Merged
gpotter2 added a commit to gpotter2/scapy that referenced this issue Apr 20, 2024
@gpotter2
Fix UTCTimeField before epoch on Windows
2362250 
This fixes UTCTimeField that have a value before 1970 on Windows.
fixes secdev#4308
@gpotter2
Copy link
Member

Thanks for reporting this. This should be fixed in #4357, feel free to try it out.

@gpotter2 gpotter2 added the bug label Apr 21, 2024
gpotter2 added a commit to gpotter2/scapy that referenced this issue Apr 27, 2024
@gpotter2
Fix UTCTimeField before epoch on Windows
7ec34e5 
This fixes UTCTimeField that have a value before 1970 on Windows.
fixes secdev#4308
gpotter2 added a commit that referenced this issue Apr 27, 2024
@gpotter2
Fix UTCTimeField before epoch on Windows
7ec9023 
This fixes UTCTimeField that have a value before 1970 on Windows.
fixes #4308
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
2.6.0
Development

Successfully merging a pull request may close this issue.

Fix UTCTimeField before epoch on Windows gpotter2/scapy
2 participants
@gpotter2 @llaubin