epan/dissectors/packet-yhoo.c

   1 /* packet-yhoo.c
   2  * Routines for yahoo messenger packet dissection
   3  * Copyright 1999, Nathan Neulinger <nneul@umr.edu>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * Copied from packet-tftp.c
  10  *
  11  * SPDX-License-Identifier: GPL-2.0-or-later
  12  */
  13
  14 #include "config.h"
  15
  16 #include <epan/packet.h>
  17
  18 void proto_register_yhoo(void);
  19 void proto_reg_handoff_yhoo(void);
  20
  21 static int proto_yhoo;
  22 static int hf_yhoo_version;
  23 static int hf_yhoo_len;
  24 static int hf_yhoo_service;
  25 static int hf_yhoo_connection_id;
  26 static int hf_yhoo_magic_id;
  27 static int hf_yhoo_unknown1;
  28 static int hf_yhoo_msgtype;
  29 static int hf_yhoo_nick1;
  30 static int hf_yhoo_nick2;
  31 static int hf_yhoo_content;
  32
  33 static int ett_yhoo;
  34
  35 #define TCP_PORT_YHOO   5050
  36
  37 /* This is from yahoolib.h from gtkyahoo */
  38
  39 /* Service constants */
  40 #define YAHOO_SERVICE_LOGON                   1
  41 #define YAHOO_SERVICE_LOGOFF                  2
  42 #define YAHOO_SERVICE_ISAWAY                  3
  43 #define YAHOO_SERVICE_ISBACK                  4
  44 #define YAHOO_SERVICE_IDLE                    5
  45 #define YAHOO_SERVICE_MESSAGE                 6
  46 #define YAHOO_SERVICE_IDACT                   7
  47 #define YAHOO_SERVICE_IDDEACT                 8
  48 #define YAHOO_SERVICE_MAILSTAT                9
  49 #define YAHOO_SERVICE_USERSTAT               10
  50 #define YAHOO_SERVICE_NEWMAIL                11
  51 #define YAHOO_SERVICE_CHATINVITE             12
  52 #define YAHOO_SERVICE_CALENDAR               13
  53 #define YAHOO_SERVICE_NEWPERSONALMAIL        14
  54 #define YAHOO_SERVICE_NEWCONTACT             15
  55 #define YAHOO_SERVICE_ADDIDENT               16
  56 #define YAHOO_SERVICE_ADDIGNORE              17
  57 #define YAHOO_SERVICE_PING                   18
  58 #define YAHOO_SERVICE_GROUPRENAME            19
  59 #define YAHOO_SERVICE_SYSMESSAGE             20
  60 #define YAHOO_SERVICE_PASSTHROUGH2           22
  61 #define YAHOO_SERVICE_CONFINVITE             24
  62 #define YAHOO_SERVICE_CONFLOGON              25
  63 #define YAHOO_SERVICE_CONFDECLINE            26
  64 #define YAHOO_SERVICE_CONFLOGOFF             27
  65 #define YAHOO_SERVICE_CONFADDINVITE          28
  66 #define YAHOO_SERVICE_CONFMSG                29
  67 #define YAHOO_SERVICE_CHATLOGON              30
  68 #define YAHOO_SERVICE_CHATLOGOFF             31
  69 #define YAHOO_SERVICE_CHATMSG                32
  70 #define YAHOO_SERVICE_FILETRANSFER           70
  71 #define YAHOO_SERVICE_CHATADDINVITE         157
  72 #define YAHOO_SERVICE_AVATAR                188
  73 #define YAHOO_SERVICE_PICTURE_CHECKSUM      189
  74 #define YAHOO_SERVICE_PICTURE               190
  75 #define YAHOO_SERVICE_PICTURE_UPDATE        193
  76 #define YAHOO_SERVICE_PICTURE_UPLOAD        194
  77 #define YAHOO_SERVICE_YAHOO6_STATUS_UPDATE  198
  78 #define YAHOO_SERVICE_AVATAR_UPDATE         199
  79 #define YAHOO_SERVICE_AUDIBLE               208
  80 #define YAHOO_SERVICE_WEBLOGIN              550
  81 #define YAHOO_SERVICE_SMS_MSG               746
  82
  83
  84 /* Message flags */
  85 #define YAHOO_MSGTYPE_NONE      0
  86 #define YAHOO_MSGTYPE_NORMAL    1
  87 #define YAHOO_MSGTYPE_BOUNCE    2
  88 #define YAHOO_MSGTYPE_STATUS    4
  89 #define YAHOO_MSGTYPE_OFFLINE   1515563606      /* yuck! */
  90
  91 #define YAHOO_RAWPACKET_LEN 105
  92
  93 #if 0
  94 struct yahoo_rawpacket
  95 {
  96         char          version[8];       /* 7 chars and trailing null */
  97         unsigned char len[4];           /* length - little endian */
  98         unsigned char service[4];       /* service - little endian */
  99         unsigned char connection_id[4]; /* connection number - little endian */
 100         unsigned char magic_id[4];      /* magic number used for http session */
 101         unsigned char unknown1[4];
 102         unsigned char msgtype[4];
 103         char          nick1[36];
 104         char          nick2[36];
 105         char          content[1];       /* was zero, had problems with aix xlc */
 106 };
 107 #endif
 108
 109 static const value_string yhoo_service_vals[] = {
 110         {YAHOO_SERVICE_LOGON,                "Pager Logon"},
 111         {YAHOO_SERVICE_LOGOFF,               "Pager Logoff"},
 112         {YAHOO_SERVICE_ISAWAY,               "Is Away"},
 113         {YAHOO_SERVICE_ISBACK,               "Is Back"},
 114         {YAHOO_SERVICE_IDLE,                 "Idle"},
 115         {YAHOO_SERVICE_MESSAGE,              "Message"},
 116         {YAHOO_SERVICE_IDACT,                "Activate Identity"},
 117         {YAHOO_SERVICE_IDDEACT,              "Deactivate Identity"},
 118         {YAHOO_SERVICE_MAILSTAT,             "Mail Status"},
 119         {YAHOO_SERVICE_USERSTAT,             "User Status"},
 120         {YAHOO_SERVICE_NEWMAIL,              "New Mail"},
 121         {YAHOO_SERVICE_CHATINVITE,           "Chat Invitation"},
 122         {YAHOO_SERVICE_CALENDAR,             "Calendar Reminder"},
 123         {YAHOO_SERVICE_NEWPERSONALMAIL,      "New Personals Mail"},
 124         {YAHOO_SERVICE_NEWCONTACT,           "New Friend"},
 125         {YAHOO_SERVICE_GROUPRENAME,          "Group Renamed"},
 126         {YAHOO_SERVICE_ADDIDENT,             "Add Identity"},
 127         {YAHOO_SERVICE_ADDIGNORE,            "Add Ignore"},
 128         {YAHOO_SERVICE_PING,                 "Ping"},
 129         {YAHOO_SERVICE_SYSMESSAGE,           "System Message"},
 130         {YAHOO_SERVICE_CONFINVITE,           "Conference Invitation"},
 131         {YAHOO_SERVICE_CONFLOGON,            "Conference Logon"},
 132         {YAHOO_SERVICE_CONFDECLINE,          "Conference Decline"},
 133         {YAHOO_SERVICE_CONFLOGOFF,           "Conference Logoff"},
 134         {YAHOO_SERVICE_CONFMSG,              "Conference Message"},
 135         {YAHOO_SERVICE_CONFADDINVITE,        "Conference Additional Invitation"},
 136         {YAHOO_SERVICE_CHATLOGON,            "Chat Logon"},
 137         {YAHOO_SERVICE_CHATLOGOFF,           "Chat Logoff"},
 138         {YAHOO_SERVICE_CHATMSG,              "Chat Message"},
 139         {YAHOO_SERVICE_FILETRANSFER,         "File Transfer"},
 140         {YAHOO_SERVICE_PASSTHROUGH2,         "Passthrough 2"},
 141         {YAHOO_SERVICE_CHATADDINVITE,        "Chat add Invite"},
 142         {YAHOO_SERVICE_AVATAR,               "Avatar"},
 143         {YAHOO_SERVICE_PICTURE_CHECKSUM,     "Picture Checksum"},
 144         {YAHOO_SERVICE_PICTURE,              "Picture"},
 145         {YAHOO_SERVICE_PICTURE_UPDATE,       "Picture Update"},
 146         {YAHOO_SERVICE_PICTURE_UPLOAD,       "Picture Upload"},
 147         {YAHOO_SERVICE_YAHOO6_STATUS_UPDATE, "Status update"},
 148         {YAHOO_SERVICE_AUDIBLE,              "Audible"},
 149         {YAHOO_SERVICE_WEBLOGIN,             "Weblogin"},
 150         {YAHOO_SERVICE_SMS_MSG,              "SMS Message"},
 151         {0, NULL}
 152 };
 153
 154 static const value_string yhoo_msgtype_vals[] = {
 155         {YAHOO_MSGTYPE_NONE,                 "None"},
 156         {YAHOO_MSGTYPE_NORMAL,               "Normal"},
 157         {YAHOO_MSGTYPE_BOUNCE,               "Bounce"},
 158         {YAHOO_MSGTYPE_STATUS,               "Status Update"},
 159         {YAHOO_MSGTYPE_OFFLINE,              "Request Offline"},
 160         {0, NULL}
 161 };
 162
 163 static bool
 164 dissect_yhoo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 165 {
 166         proto_tree      *yhoo_tree, *ti;
 167         int              offset = 0;
 168
 169         if (pinfo->srcport != TCP_PORT_YHOO && pinfo->destport != TCP_PORT_YHOO) {
 170                 /* Not the Yahoo port - not a Yahoo Messenger packet. */
 171                 return false;
 172         }
 173
 174         /* get at least a full packet structure */
 175         if ( tvb_captured_length(tvb) < YAHOO_RAWPACKET_LEN ) {
 176                 /* Not enough data captured; maybe it is a Yahoo
 177                    Messenger packet, but it contains too little data to
 178                    tell. */
 179                 return false;
 180         }
 181
 182         if (tvb_memeql(tvb, offset, (const uint8_t*)"YPNS", 4) != 0 &&
 183             tvb_memeql(tvb, offset, (const uint8_t*)"YHOO", 4) != 0) {
 184                 /* Not a Yahoo Messenger packet. */
 185                 return false;
 186         }
 187
 188         col_set_str(pinfo->cinfo, COL_PROTOCOL, "YHOO");
 189
 190         col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s",
 191                              ( tvb_memeql(tvb, offset + 0, (const uint8_t*)"YPNS", 4) == 0 ) ? "Request" : "Response",
 192                              val_to_str(tvb_get_letohl(tvb, offset + 12),
 193                                         yhoo_service_vals, "Unknown Service: %u"));
 194
 195         if (tree) {
 196                 ti = proto_tree_add_item(tree, proto_yhoo, tvb,
 197                         offset, -1, ENC_NA);
 198                 yhoo_tree = proto_item_add_subtree(ti, ett_yhoo);
 199
 200                 proto_tree_add_item(yhoo_tree, hf_yhoo_version, tvb,
 201                         offset, 8, ENC_ASCII);
 202                 offset += 8;
 203
 204                 proto_tree_add_item(yhoo_tree, hf_yhoo_len, tvb,
 205                         offset, 4, ENC_LITTLE_ENDIAN);
 206                 offset += 4;
 207
 208                 proto_tree_add_item(yhoo_tree, hf_yhoo_service, tvb,
 209                         offset, 4, ENC_LITTLE_ENDIAN);
 210                 offset += 4;
 211
 212                 proto_tree_add_item(yhoo_tree, hf_yhoo_connection_id, tvb,
 213                         offset, 4, ENC_LITTLE_ENDIAN);
 214                 offset += 4;
 215
 216                 proto_tree_add_item(yhoo_tree, hf_yhoo_magic_id, tvb,
 217                         offset, 4, ENC_LITTLE_ENDIAN);
 218                 offset += 4;
 219
 220                 proto_tree_add_item(yhoo_tree, hf_yhoo_unknown1, tvb,
 221                         offset, 4, ENC_LITTLE_ENDIAN);
 222                 offset += 4;
 223
 224                 proto_tree_add_item(yhoo_tree, hf_yhoo_msgtype, tvb,
 225                         offset, 4, ENC_LITTLE_ENDIAN);
 226                 offset += 4;
 227
 228                 proto_tree_add_item(yhoo_tree, hf_yhoo_nick1, tvb,
 229                         offset, 36, ENC_ASCII);
 230                 offset += 36;
 231
 232                 proto_tree_add_item(yhoo_tree, hf_yhoo_nick2, tvb,
 233                         offset, 36, ENC_ASCII);
 234                 offset += 36;
 235
 236                 proto_tree_add_item(yhoo_tree, hf_yhoo_content, tvb, -1,
 237                         offset, ENC_ASCII);
 238         }
 239
 240         return true;
 241 }
 242
 243 void
 244 proto_register_yhoo(void)
 245 {
 246         static hf_register_info hf[] = {
 247                 { &hf_yhoo_service, {
 248                                 "Service Type", "yhoo.service", FT_UINT32, BASE_DEC,
 249                                 VALS(yhoo_service_vals), 0, NULL, HFILL }},
 250                 { &hf_yhoo_msgtype, {
 251                                 "Message Type", "yhoo.msgtype", FT_UINT32, BASE_DEC,
 252                                 VALS(yhoo_msgtype_vals), 0, "Message Type Flags", HFILL }},
 253                 { &hf_yhoo_connection_id, {
 254                                 "Connection ID", "yhoo.connection_id", FT_UINT32, BASE_HEX,
 255                                 NULL, 0, NULL, HFILL }},
 256                 { &hf_yhoo_magic_id, {
 257                                 "Magic ID", "yhoo.magic_id", FT_UINT32, BASE_HEX,
 258                                 NULL, 0, NULL, HFILL }},
 259                 { &hf_yhoo_unknown1, {
 260                                 "Unknown 1", "yhoo.unknown1", FT_UINT32, BASE_HEX,
 261                                 NULL, 0, NULL, HFILL }},
 262                 { &hf_yhoo_len, {
 263                                 "Packet Length", "yhoo.len", FT_UINT32, BASE_DEC,
 264                                 NULL, 0, NULL, HFILL }},
 265                 { &hf_yhoo_nick1, {
 266                                 "Real Nick (nick1)", "yhoo.nick1", FT_STRING, BASE_NONE,
 267                                 NULL, 0, NULL, HFILL }},
 268                 { &hf_yhoo_nick2, {
 269                                 "Active Nick (nick2)", "yhoo.nick2", FT_STRING, BASE_NONE,
 270                                 NULL, 0, NULL, HFILL }},
 271                 { &hf_yhoo_content, {
 272                                 "Content", "yhoo.content", FT_STRING, BASE_NONE,
 273                                 NULL, 0, "Data portion of the packet", HFILL }},
 274                 { &hf_yhoo_version, {
 275                                 "Version", "yhoo.version", FT_STRING, BASE_NONE,
 276                                 NULL, 0, "Packet version identifier", HFILL }},
 277         };
 278         static int *ett[] = {
 279                 &ett_yhoo,
 280         };
 281
 282         proto_yhoo = proto_register_protocol("Yahoo Messenger Protocol",
 283             "YHOO", "yhoo");
 284
 285         proto_register_field_array(proto_yhoo, hf, array_length(hf));
 286
 287         proto_register_subtree_array(ett, array_length(ett));
 288 }
 289
 290 void
 291 proto_reg_handoff_yhoo(void)
 292 {
 293         /*
 294          * DO NOT register for port 5050, as that's used by the
 295          * old and new Yahoo messenger protocols.
 296          *
 297          * Just register as a heuristic TCP dissector, and reject stuff
 298          * not to or from that port.
 299          */
 300         heur_dissector_add("tcp", dissect_yhoo, "Yahoo Messenger over TCP", "yhoo_tcp", proto_yhoo, HEURISTIC_ENABLE);
 301 }
 302
 303 /*
 304  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 305  *
 306  * Local variables:
 307  * c-basic-offset: 8
 308  * tab-width: 8
 309  * indent-tabs-mode: t
 310  * End:
 311  *
 312  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 313  * :indentSize=8:tabSize=8:noTabs=false:
 314  */