epan/decode_as.c

   1 /* decode_as.c
   2  * Routines for dissector Decode As handlers
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #include "config.h"
  12
  13 #include <glib.h>
  14
  15 #include "decode_as.h"
  16 #include "packet.h"
  17 #include "prefs.h"
  18 #include "prefs-int.h"
  19 #include "wsutil/application_flavor.h"
  20 #include "wsutil/file_util.h"
  21 #include "wsutil/filesystem.h"
  22 #include "epan/dissectors/packet-dcerpc.h"
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <errno.h>
  26 #include <wsutil/ws_assert.h>
  27
  28 GList *decode_as_list;
  29
  30 void register_decode_as(decode_as_t* reg)
  31 {
  32     dissector_table_t decode_table;
  33
  34     /* Ensure valid functions */
  35     ws_assert(reg->populate_list);
  36     ws_assert(reg->reset_value);
  37     ws_assert(reg->change_value);
  38
  39     decode_table = find_dissector_table(reg->table_name);
  40     if (decode_table != NULL)
  41     {
  42         dissector_table_allow_decode_as(decode_table);
  43     }
  44
  45     decode_as_list = g_list_prepend(decode_as_list, reg);
  46 }
  47
  48 static void next_proto_prompt(packet_info *pinfo _U_, char *result)
  49 {
  50     snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Next level protocol as");
  51 }
  52
  53 static void *next_proto_value(packet_info *pinfo _U_)
  54 {
  55     return 0;
  56 }
  57
  58 static build_valid_func next_proto_values[] = { next_proto_value };
  59 static decode_as_value_t next_proto_da_values =
  60                         { next_proto_prompt, 1, next_proto_values };
  61
  62 dissector_table_t register_decode_as_next_proto(int proto, const char *table_name, const char *ui_name, build_label_func label_func)
  63 {
  64     decode_as_t *da;
  65
  66     dissector_table_t dt = register_dissector_table(table_name, ui_name, proto, FT_NONE, BASE_NONE);
  67
  68     da = wmem_new0(wmem_epan_scope(), decode_as_t);
  69     da->name = wmem_strdup(wmem_epan_scope(), proto_get_protocol_filter_name(proto));
  70     da->table_name = wmem_strdup(wmem_epan_scope(), table_name);
  71     da->num_items = 1;
  72     if (label_func == NULL)
  73     {
  74         da->values = &next_proto_da_values;
  75     }
  76     else
  77     {
  78         da->values = wmem_new(wmem_epan_scope(), decode_as_value_t);
  79         da->values->label_func = label_func;
  80         da->values->num_values = 1;
  81         da->values->build_values = next_proto_values;
  82     }
  83     da->populate_list = decode_as_default_populate_list;
  84     da->reset_value = decode_as_default_reset;
  85     da->change_value = decode_as_default_change;
  86
  87     register_decode_as(da);
  88     return dt;
  89 }
  90
  91 struct decode_as_default_populate
  92 {
  93     decode_as_add_to_list_func add_to_list;
  94     void *ui_element;
  95 };
  96
  97 static void
  98 decode_proto_add_to_list (const char *table_name, void *value, void *user_data)
  99 {
 100     struct decode_as_default_populate* populate = (struct decode_as_default_populate*)user_data;
 101     const char      *dissector_description;
 102     int        i;
 103     dissector_handle_t handle;
 104
 105
 106     handle = (dissector_handle_t)value;
 107     dissector_description = dissector_handle_get_description(handle);
 108
 109     i = dissector_handle_get_protocol_index(handle);
 110     if (i >= 0 && !proto_is_protocol_enabled(find_protocol_by_id(i)))
 111         return;
 112
 113     populate->add_to_list(table_name, dissector_description, value, populate->ui_element);
 114 }
 115
 116 void decode_as_default_populate_list(const char *table_name, decode_as_add_to_list_func add_to_list, void *ui_element)
 117 {
 118     struct decode_as_default_populate populate;
 119
 120     populate.add_to_list = add_to_list;
 121     populate.ui_element = ui_element;
 122
 123     dissector_table_foreach_handle(table_name, decode_proto_add_to_list, &populate);
 124 }
 125
 126 bool decode_as_default_reset(const char *name, const void *pattern)
 127 {
 128     switch (get_dissector_table_selector_type(name)) {
 129     case FT_UINT8:
 130     case FT_UINT16:
 131     case FT_UINT24:
 132     case FT_UINT32:
 133         dissector_reset_uint(name, GPOINTER_TO_UINT(pattern));
 134         return true;
 135     case FT_NONE:
 136         dissector_reset_payload(name);
 137         return true;
 138     case FT_STRING:
 139     case FT_STRINGZ:
 140     case FT_UINT_STRING:
 141     case FT_STRINGZPAD:
 142     case FT_STRINGZTRUNC:
 143         dissector_reset_string(name, (!pattern)?"":(const char *) pattern);
 144         return true;
 145     default:
 146         return false;
 147     };
 148
 149     return true;
 150 }
 151
 152 bool decode_as_default_change(const char *name, const void *pattern, const void *handle, const char *list_name _U_)
 153 {
 154     const dissector_handle_t dissector = (const dissector_handle_t)handle;
 155     switch (get_dissector_table_selector_type(name)) {
 156     case FT_UINT8:
 157     case FT_UINT16:
 158     case FT_UINT24:
 159     case FT_UINT32:
 160         dissector_change_uint(name, GPOINTER_TO_UINT(pattern), dissector);
 161         return true;
 162     case FT_NONE:
 163         dissector_change_payload(name, dissector);
 164         return true;
 165     case FT_STRING:
 166     case FT_STRINGZ:
 167     case FT_UINT_STRING:
 168     case FT_STRINGZPAD:
 169     case FT_STRINGZTRUNC:
 170         dissector_change_string(name, (!pattern)?"":(const char *) pattern, dissector);
 171         return true;
 172     default:
 173         return false;
 174     };
 175
 176     return true;
 177 }
 178
 179 /* Some useful utilities for Decode As */
 180
 181 /*
 182  * A list of dissectors that need to be reset.
 183  */
 184 static GSList *dissector_reset_list;
 185
 186 /*
 187  * A callback function to parse each "decode as" entry in the file and apply the change
 188  */
 189 static prefs_set_pref_e
 190 read_set_decode_as_entries(char *key, const char *value,
 191                            void *user_data,
 192                            bool return_range_errors _U_)
 193 {
 194     char *values[4] = {NULL, NULL, NULL, NULL};
 195     char delimiter[4] = {',', ',', ',','\0'};
 196     char *pch;
 197     unsigned i, j;
 198     GHashTable* processed_entries = (GHashTable*)user_data;
 199     dissector_table_t sub_dissectors;
 200     prefs_set_pref_e retval = PREFS_SET_OK;
 201     bool is_valid = false;
 202
 203     if (strcmp(key, DECODE_AS_ENTRY) == 0) {
 204         /* Parse csv into table, selector, initial, current */
 205         for (i = 0; i < 4; i++) {
 206             pch = strchr(value, delimiter[i]);
 207             if (pch == NULL) {
 208                 for (j = 0; j < i; j++) {
 209                     g_free(values[j]);
 210                 }
 211                 return PREFS_SET_SYNTAX_ERR;
 212             }
 213             values[i] = g_strndup(value, pch - value);
 214             value = pch + 1;
 215         }
 216         sub_dissectors = find_dissector_table(values[0]);
 217         if (sub_dissectors != NULL) {
 218             dissector_handle_t handle;
 219             ftenum_t selector_type;
 220             pref_t* pref_value;
 221             module_t *module;
 222             const char* proto_name;
 223
 224             selector_type = dissector_table_get_type(sub_dissectors);
 225
 226             handle = dissector_table_get_dissector_handle(sub_dissectors, values[3]);
 227             if (handle != NULL || g_ascii_strcasecmp(values[3], DECODE_AS_NONE) == 0) {
 228                 is_valid = true;
 229             }
 230
 231             if (is_valid) {
 232                 if (FT_IS_STRING(selector_type)) {
 233                     dissector_change_string(values[0], values[1], handle);
 234                 } else {
 235                     char *p;
 236                     long long_value;
 237
 238                     long_value = strtol(values[1], &p, 0);
 239                     if (p == values[0] || *p != '\0' || long_value < 0 ||
 240                           (unsigned long)long_value > UINT_MAX) {
 241                         retval = PREFS_SET_SYNTAX_ERR;
 242                         is_valid = false;
 243                     } else {
 244                         dissector_change_uint(values[0], (unsigned)long_value, handle);
 245                     }
 246
 247                     /* Now apply the value data back to dissector table preference */
 248                     if (handle != NULL) {
 249                         proto_name = proto_get_protocol_filter_name(dissector_handle_get_protocol_index(handle));
 250                         module = prefs_find_module(proto_name);
 251                         // values[0] is the dissector table
 252                         char *pref_name = ws_strdup_printf("%s%s", values[0], dissector_handle_get_pref_suffix(handle));
 253                         pref_value = prefs_find_preference(module, pref_name);
 254                         g_free(pref_name);
 255                         if (pref_value != NULL) {
 256                             bool replace = false;
 257                             if (g_hash_table_lookup(processed_entries, proto_name) == NULL) {
 258                                 /* First decode as entry for this protocol, ranges may be replaced */
 259                                 replace = true;
 260
 261                                 /* Remember we've processed this protocol */
 262                                 g_hash_table_insert(processed_entries, (void *)proto_name, (void *)proto_name);
 263                             }
 264
 265                             prefs_add_decode_as_value(pref_value, (unsigned)long_value, replace);
 266                             module->prefs_changed_flags |= prefs_get_effect_flags(pref_value);
 267                         }
 268                     }
 269                 }
 270             }
 271             if (is_valid) {
 272                 decode_build_reset_list(values[0], selector_type, values[1], NULL, NULL);
 273             }
 274         } else {
 275             retval = PREFS_SET_SYNTAX_ERR;
 276         }
 277
 278     } else {
 279         retval = PREFS_SET_NO_SUCH_PREF;
 280     }
 281
 282     for (i = 0; i < 4; i++) {
 283         g_free(values[i]);
 284     }
 285     return retval;
 286 }
 287
 288 void
 289 load_decode_as_entries(void)
 290 {
 291     char   *daf_path;
 292     FILE   *daf;
 293
 294     decode_clear_all();
 295
 296     daf_path = get_persconffile_path(DECODE_AS_ENTRIES_FILE_NAME, true);
 297     if ((daf = ws_fopen(daf_path, "r")) != NULL) {
 298         /* Store saved entries for better range processing */
 299         GHashTable* processed_entries = g_hash_table_new(g_str_hash, g_str_equal);
 300         read_prefs_file(daf_path, daf, read_set_decode_as_entries, processed_entries);
 301         g_hash_table_destroy(processed_entries);
 302         fclose(daf);
 303     }
 304     g_free(daf_path);
 305 }
 306
 307
 308 /* Make a sorted list of the entries as we are fetching them from a hash table. Then write it out from the sorted list */
 309 static void
 310 decode_as_write_entry (const char *table_name, ftenum_t selector_type,
 311                        void *key, void *value, void *user_data)
 312 {
 313     GList **decode_as_rows_list = (GList **)user_data;
 314     dissector_handle_t current, initial;
 315     const char *current_dissector_name, *initial_dissector_name, *decode_as_row;
 316
 317     current = dtbl_entry_get_handle((dtbl_entry_t *)value);
 318     if (current == NULL)
 319         current_dissector_name = DECODE_AS_NONE;
 320     else
 321         current_dissector_name = dissector_handle_get_description(current);
 322     initial = dtbl_entry_get_initial_handle((dtbl_entry_t *)value);
 323     if (initial == NULL)
 324         initial_dissector_name = DECODE_AS_NONE;
 325     else
 326         initial_dissector_name = dissector_handle_get_description(initial);
 327
 328     switch (selector_type) {
 329
 330     case FT_UINT8:
 331     case FT_UINT16:
 332     case FT_UINT24:
 333     case FT_UINT32:
 334         /*
 335          * XXX - write these in decimal, regardless of the base of
 336          * the dissector table's selector, as older versions of
 337          * Wireshark used atoi() when reading this file, and
 338          * failed to handle hex or octal numbers.
 339          *
 340          * That will be fixed in future 1.10 and 1.12 releases,
 341          * but pre-1.10 releases are at end-of-life and won't
 342          * be fixed.
 343          */
 344         decode_as_row = ws_strdup_printf(
 345             DECODE_AS_ENTRY ": %s,%u,%s,%s\n",
 346             table_name, GPOINTER_TO_UINT(key), initial_dissector_name,
 347             current_dissector_name);
 348         break;
 349     case FT_NONE:
 350         /*
 351          * XXX - Just put a placeholder for the key value.  Currently
 352          * FT_NONE dissector table uses a single uint value for
 353          * a placeholder
 354          */
 355         decode_as_row = ws_strdup_printf(
 356             DECODE_AS_ENTRY ": %s,0,%s,%s\n",
 357             table_name, initial_dissector_name,
 358             current_dissector_name);
 359         break;
 360
 361     case FT_STRING:
 362     case FT_STRINGZ:
 363     case FT_UINT_STRING:
 364     case FT_STRINGZPAD:
 365     case FT_STRINGZTRUNC:
 366         decode_as_row = ws_strdup_printf(
 367             DECODE_AS_ENTRY ": %s,%s,%s,%s\n",
 368             table_name, (char *)key, initial_dissector_name,
 369             current_dissector_name);
 370         break;
 371
 372     default:
 373         ws_assert_not_reached();
 374         break;
 375     }
 376
 377     /* Do we need a better sort function ???*/
 378     *decode_as_rows_list = g_list_insert_sorted (*decode_as_rows_list, (void *)decode_as_row,
 379         (GCompareFunc)g_ascii_strcasecmp);
 380
 381 }
 382
 383 /* Print the sorted rows to File */
 384 static void
 385 decode_as_print_rows(void *data, void *user_data)
 386 {
 387     FILE *da_file = (FILE *)user_data;
 388     const char *decode_as_row = (const char *)data;
 389
 390     fprintf(da_file, "%s",decode_as_row);
 391
 392 }
 393 int
 394 save_decode_as_entries(char** err)
 395 {
 396     char *pf_dir_path;
 397     char *daf_path;
 398     FILE *da_file;
 399     GList *decode_as_rows_list = NULL;
 400
 401     if (create_persconffile_dir(&pf_dir_path) == -1) {
 402         *err = ws_strdup_printf("Can't create directory\n\"%s\"\nfor recent file: %s.",
 403                                 pf_dir_path, g_strerror(errno));
 404         g_free(pf_dir_path);
 405         return -1;
 406     }
 407
 408     daf_path = get_persconffile_path(DECODE_AS_ENTRIES_FILE_NAME, true);
 409     if ((da_file = ws_fopen(daf_path, "w")) == NULL) {
 410         *err = ws_strdup_printf("Can't open decode_as_entries file\n\"%s\": %s.",
 411                                 daf_path, g_strerror(errno));
 412         g_free(daf_path);
 413         return -1;
 414     }
 415
 416     fprintf(da_file, "# \"Decode As\" entries file for %s " VERSION ".\n"
 417         "#\n"
 418         "# This file is regenerated each time \"Decode As\" preferences\n"
 419         "# are saved within %s. Making manual changes should be safe,\n"
 420         "# however.\n",
 421         application_flavor_name_proper(), application_flavor_name_proper());
 422
 423     dissector_all_tables_foreach_changed(decode_as_write_entry, &decode_as_rows_list);
 424
 425     g_list_foreach(decode_as_rows_list, decode_as_print_rows, da_file);
 426
 427     fclose(da_file);
 428     g_free(daf_path);
 429     g_list_free_full(decode_as_rows_list, g_free);
 430
 431     return 0;
 432 }
 433
 434 /*
 435  * Data structure for tracking which dissector need to be reset.  This
 436  * structure is necessary as a hash table entry cannot be removed
 437  * while a g_hash_table_foreach walk is in progress.
 438  */
 439 typedef struct dissector_delete_item {
 440     /* The name of the dissector table */
 441     char *ddi_table_name;
 442     /* The type of the selector in that dissector table */
 443     ftenum_t ddi_selector_type;
 444     /* The selector in the dissector table */
 445     union {
 446         unsigned   sel_uint;
 447         char    *sel_string;
 448     } ddi_selector;
 449 } dissector_delete_item_t;
 450
 451 void
 452 decode_build_reset_list (const char *table_name, ftenum_t selector_type,
 453                          void *key, void *value _U_,
 454                          void *user_data _U_)
 455 {
 456     dissector_delete_item_t *item;
 457
 458     item = g_new(dissector_delete_item_t,1);
 459     item->ddi_table_name = g_strdup(table_name);
 460     item->ddi_selector_type = selector_type;
 461     switch (selector_type) {
 462
 463     case FT_UINT8:
 464     case FT_UINT16:
 465     case FT_UINT24:
 466     case FT_UINT32:
 467         item->ddi_selector.sel_uint = GPOINTER_TO_UINT(key);
 468         break;
 469
 470     case FT_NONE:
 471         /* Not really needed, but prevents the assert */
 472         item->ddi_selector.sel_uint = 0;
 473         break;
 474
 475     case FT_STRING:
 476     case FT_STRINGZ:
 477     case FT_UINT_STRING:
 478     case FT_STRINGZPAD:
 479     case FT_STRINGZTRUNC:
 480         item->ddi_selector.sel_string = g_strdup((char *)key);
 481         break;
 482
 483     default:
 484         ws_assert_not_reached();
 485     }
 486     dissector_reset_list = g_slist_prepend(dissector_reset_list, item);
 487 }
 488
 489 /* clear all settings */
 490 void
 491 decode_clear_all(void)
 492 {
 493     dissector_delete_item_t *item;
 494     GSList *tmp;
 495
 496     dissector_all_tables_foreach_changed(decode_build_reset_list, NULL);
 497
 498     for (tmp = dissector_reset_list; tmp; tmp = g_slist_next(tmp)) {
 499         item = (dissector_delete_item_t *)tmp->data;
 500         switch (item->ddi_selector_type) {
 501
 502         case FT_UINT8:
 503         case FT_UINT16:
 504         case FT_UINT24:
 505         case FT_UINT32:
 506             dissector_reset_uint(item->ddi_table_name,
 507                                  item->ddi_selector.sel_uint);
 508             break;
 509
 510         case FT_NONE:
 511             dissector_reset_payload(item->ddi_table_name);
 512             break;
 513
 514         case FT_STRING:
 515         case FT_STRINGZ:
 516         case FT_UINT_STRING:
 517         case FT_STRINGZPAD:
 518         case FT_STRINGZTRUNC:
 519             dissector_reset_string(item->ddi_table_name,
 520                                    item->ddi_selector.sel_string);
 521             g_free(item->ddi_selector.sel_string);
 522             break;
 523
 524         default:
 525             ws_assert_not_reached();
 526         }
 527         g_free(item->ddi_table_name);
 528         g_free(item);
 529     }
 530     g_slist_free(dissector_reset_list);
 531     dissector_reset_list = NULL;
 532
 533     decode_dcerpc_reset_all();
 534 }
 535
 536 void
 537 decode_cleanup(void)
 538 {
 539     g_list_free(decode_as_list);
 540     decode_as_list = NULL;
 541 }
 542
 543 /*
 544  * Editor modelines
 545  *
 546  * Local Variables:
 547  * c-basic-offset: 4
 548  * tab-width: 8
 549  * indent-tabs-mode: nil
 550  * End:
 551  *
 552  * ex: set shiftwidth=4 tabstop=8 expandtab:
 553  * :indentSize=4:tabSize=8:noTabs=true:
 554  */