epan/decode_as.c

   1 /* decode_as.c
   2  * Routines for dissector Decode As handlers
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #include "config.h"
  12
  13 #include <glib.h>
  14
  15 #include "decode_as.h"
  16 #include "packet.h"
  17 #include "prefs.h"
  18 #include "prefs-int.h"
  19 #include "wsutil/file_util.h"
  20 #include "wsutil/filesystem.h"
  21 #include "epan/dissectors/packet-dcerpc.h"
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include <errno.h>
  25 #include <wsutil/ws_assert.h>
  26
  27 GList *decode_as_list;
  28
  29 void register_decode_as(decode_as_t* reg)
  30 {
  31     dissector_table_t decode_table;
  32
  33     /* Ensure valid functions */
  34     ws_assert(reg->populate_list);
  35     ws_assert(reg->reset_value);
  36     ws_assert(reg->change_value);
  37
  38     decode_table = find_dissector_table(reg->table_name);
  39     if (decode_table != NULL)
  40     {
  41         dissector_table_allow_decode_as(decode_table);
  42     }
  43
  44     decode_as_list = g_list_prepend(decode_as_list, reg);
  45 }
  46
  47 static void next_proto_prompt(packet_info *pinfo _U_, char *result)
  48 {
  49     snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Next level protocol as");
  50 }
  51
  52 static void *next_proto_value(packet_info *pinfo _U_)
  53 {
  54     return 0;
  55 }
  56
  57 static build_valid_func next_proto_values[] = { next_proto_value };
  58 static decode_as_value_t next_proto_da_values =
  59                         { next_proto_prompt, 1, next_proto_values };
  60
  61 dissector_table_t register_decode_as_next_proto(int proto, const char *table_name, const char *ui_name, build_label_func label_func)
  62 {
  63     decode_as_t *da;
  64
  65     dissector_table_t dt = register_dissector_table(table_name, ui_name, proto, FT_NONE, BASE_NONE);
  66
  67     da = wmem_new0(wmem_epan_scope(), decode_as_t);
  68     da->name = wmem_strdup(wmem_epan_scope(), proto_get_protocol_filter_name(proto));
  69     da->table_name = wmem_strdup(wmem_epan_scope(), table_name);
  70     da->num_items = 1;
  71     if (label_func == NULL)
  72     {
  73         da->values = &next_proto_da_values;
  74     }
  75     else
  76     {
  77         da->values = wmem_new(wmem_epan_scope(), decode_as_value_t);
  78         da->values->label_func = label_func;
  79         da->values->num_values = 1;
  80         da->values->build_values = next_proto_values;
  81     }
  82     da->populate_list = decode_as_default_populate_list;
  83     da->reset_value = decode_as_default_reset;
  84     da->change_value = decode_as_default_change;
  85
  86     register_decode_as(da);
  87     return dt;
  88 }
  89
  90 struct decode_as_default_populate
  91 {
  92     decode_as_add_to_list_func add_to_list;
  93     void *ui_element;
  94 };
  95
  96 static void
  97 decode_proto_add_to_list (const char *table_name, void *value, void *user_data)
  98 {
  99     struct decode_as_default_populate* populate = (struct decode_as_default_populate*)user_data;
 100     const char      *dissector_description;
 101     int        i;
 102     dissector_handle_t handle;
 103
 104
 105     handle = (dissector_handle_t)value;
 106     dissector_description = dissector_handle_get_description(handle);
 107
 108     i = dissector_handle_get_protocol_index(handle);
 109     if (i >= 0 && !proto_is_protocol_enabled(find_protocol_by_id(i)))
 110         return;
 111
 112     populate->add_to_list(table_name, dissector_description, value, populate->ui_element);
 113 }
 114
 115 void decode_as_default_populate_list(const char *table_name, decode_as_add_to_list_func add_to_list, void *ui_element)
 116 {
 117     struct decode_as_default_populate populate;
 118
 119     populate.add_to_list = add_to_list;
 120     populate.ui_element = ui_element;
 121
 122     dissector_table_foreach_handle(table_name, decode_proto_add_to_list, &populate);
 123 }
 124
 125 bool decode_as_default_reset(const char *name, const void *pattern)
 126 {
 127     switch (get_dissector_table_selector_type(name)) {
 128     case FT_UINT8:
 129     case FT_UINT16:
 130     case FT_UINT24:
 131     case FT_UINT32:
 132         dissector_reset_uint(name, GPOINTER_TO_UINT(pattern));
 133         return true;
 134     case FT_NONE:
 135         dissector_reset_payload(name);
 136         return true;
 137     case FT_STRING:
 138     case FT_STRINGZ:
 139     case FT_UINT_STRING:
 140     case FT_STRINGZPAD:
 141     case FT_STRINGZTRUNC:
 142         dissector_reset_string(name, (!pattern)?"":(const char *) pattern);
 143         return true;
 144     default:
 145         return false;
 146     };
 147
 148     return true;
 149 }
 150
 151 bool decode_as_default_change(const char *name, const void *pattern, const void *handle, const char *list_name _U_)
 152 {
 153     const dissector_handle_t dissector = (const dissector_handle_t)handle;
 154     switch (get_dissector_table_selector_type(name)) {
 155     case FT_UINT8:
 156     case FT_UINT16:
 157     case FT_UINT24:
 158     case FT_UINT32:
 159         dissector_change_uint(name, GPOINTER_TO_UINT(pattern), dissector);
 160         return true;
 161     case FT_NONE:
 162         dissector_change_payload(name, dissector);
 163         return true;
 164     case FT_STRING:
 165     case FT_STRINGZ:
 166     case FT_UINT_STRING:
 167     case FT_STRINGZPAD:
 168     case FT_STRINGZTRUNC:
 169         dissector_change_string(name, (!pattern)?"":(const char *) pattern, dissector);
 170         return true;
 171     default:
 172         return false;
 173     };
 174
 175     return true;
 176 }
 177
 178 /* Some useful utilities for Decode As */
 179
 180 /*
 181  * A list of dissectors that need to be reset.
 182  */
 183 static GSList *dissector_reset_list;
 184
 185 /*
 186  * A callback function to parse each "decode as" entry in the file and apply the change
 187  */
 188 static prefs_set_pref_e
 189 read_set_decode_as_entries(char *key, const char *value,
 190                            void *user_data,
 191                            bool return_range_errors _U_)
 192 {
 193     char *values[4] = {NULL, NULL, NULL, NULL};
 194     char delimiter[4] = {',', ',', ',','\0'};
 195     char *pch;
 196     unsigned i, j;
 197     GHashTable* processed_entries = (GHashTable*)user_data;
 198     dissector_table_t sub_dissectors;
 199     prefs_set_pref_e retval = PREFS_SET_OK;
 200     bool is_valid = false;
 201
 202     if (strcmp(key, DECODE_AS_ENTRY) == 0) {
 203         /* Parse csv into table, selector, initial, current */
 204         for (i = 0; i < 4; i++) {
 205             pch = strchr(value, delimiter[i]);
 206             if (pch == NULL) {
 207                 for (j = 0; j < i; j++) {
 208                     g_free(values[j]);
 209                 }
 210                 return PREFS_SET_SYNTAX_ERR;
 211             }
 212             values[i] = g_strndup(value, pch - value);
 213             value = pch + 1;
 214         }
 215         sub_dissectors = find_dissector_table(values[0]);
 216         if (sub_dissectors != NULL) {
 217             dissector_handle_t handle;
 218             ftenum_t selector_type;
 219             pref_t* pref_value;
 220             module_t *module;
 221             const char* proto_name;
 222
 223             selector_type = dissector_table_get_type(sub_dissectors);
 224
 225             handle = dissector_table_get_dissector_handle(sub_dissectors, values[3]);
 226             if (handle != NULL || g_ascii_strcasecmp(values[3], DECODE_AS_NONE) == 0) {
 227                 is_valid = true;
 228             }
 229
 230             if (is_valid) {
 231                 if (FT_IS_STRING(selector_type)) {
 232                     dissector_change_string(values[0], values[1], handle);
 233                 } else {
 234                     char *p;
 235                     long long_value;
 236
 237                     long_value = strtol(values[1], &p, 0);
 238                     if (p == values[0] || *p != '\0' || long_value < 0 ||
 239                           (unsigned long)long_value > UINT_MAX) {
 240                         retval = PREFS_SET_SYNTAX_ERR;
 241                         is_valid = false;
 242                     } else {
 243                         dissector_change_uint(values[0], (unsigned)long_value, handle);
 244                     }
 245
 246                     /* Now apply the value data back to dissector table preference */
 247                     if (handle != NULL) {
 248                         proto_name = proto_get_protocol_filter_name(dissector_handle_get_protocol_index(handle));
 249                         module = prefs_find_module(proto_name);
 250                         // values[0] is the dissector table
 251                         char *pref_name = ws_strdup_printf("%s%s", values[0], dissector_handle_get_pref_suffix(handle));
 252                         pref_value = prefs_find_preference(module, pref_name);
 253                         g_free(pref_name);
 254                         if (pref_value != NULL) {
 255                             bool replace = false;
 256                             if (g_hash_table_lookup(processed_entries, proto_name) == NULL) {
 257                                 /* First decode as entry for this protocol, ranges may be replaced */
 258                                 replace = true;
 259
 260                                 /* Remember we've processed this protocol */
 261                                 g_hash_table_insert(processed_entries, (void *)proto_name, (void *)proto_name);
 262                             }
 263
 264                             prefs_add_decode_as_value(pref_value, (unsigned)long_value, replace);
 265                             module->prefs_changed_flags |= prefs_get_effect_flags(pref_value);
 266                         }
 267                     }
 268                 }
 269             }
 270             if (is_valid) {
 271                 decode_build_reset_list(values[0], selector_type, values[1], NULL, NULL);
 272             }
 273         } else {
 274             retval = PREFS_SET_SYNTAX_ERR;
 275         }
 276
 277     } else {
 278         retval = PREFS_SET_NO_SUCH_PREF;
 279     }
 280
 281     for (i = 0; i < 4; i++) {
 282         g_free(values[i]);
 283     }
 284     return retval;
 285 }
 286
 287 void
 288 load_decode_as_entries(void)
 289 {
 290     char   *daf_path;
 291     FILE   *daf;
 292
 293     decode_clear_all();
 294
 295     daf_path = get_persconffile_path(DECODE_AS_ENTRIES_FILE_NAME, true);
 296     if ((daf = ws_fopen(daf_path, "r")) != NULL) {
 297         /* Store saved entries for better range processing */
 298         GHashTable* processed_entries = g_hash_table_new(g_str_hash, g_str_equal);
 299         read_prefs_file(daf_path, daf, read_set_decode_as_entries, processed_entries);
 300         g_hash_table_destroy(processed_entries);
 301         fclose(daf);
 302     }
 303     g_free(daf_path);
 304 }
 305
 306
 307 /* Make a sorted list of the entries as we are fetching them from a hash table. Then write it out from the sorted list */
 308 static void
 309 decode_as_write_entry (const char *table_name, ftenum_t selector_type,
 310                        void *key, void *value, void *user_data)
 311 {
 312     GList **decode_as_rows_list = (GList **)user_data;
 313     dissector_handle_t current, initial;
 314     const char *current_dissector_name, *initial_dissector_name, *decode_as_row;
 315
 316     current = dtbl_entry_get_handle((dtbl_entry_t *)value);
 317     if (current == NULL)
 318         current_dissector_name = DECODE_AS_NONE;
 319     else
 320         current_dissector_name = dissector_handle_get_description(current);
 321     initial = dtbl_entry_get_initial_handle((dtbl_entry_t *)value);
 322     if (initial == NULL)
 323         initial_dissector_name = DECODE_AS_NONE;
 324     else
 325         initial_dissector_name = dissector_handle_get_description(initial);
 326
 327     switch (selector_type) {
 328
 329     case FT_UINT8:
 330     case FT_UINT16:
 331     case FT_UINT24:
 332     case FT_UINT32:
 333         /*
 334          * XXX - write these in decimal, regardless of the base of
 335          * the dissector table's selector, as older versions of
 336          * Wireshark used atoi() when reading this file, and
 337          * failed to handle hex or octal numbers.
 338          *
 339          * That will be fixed in future 1.10 and 1.12 releases,
 340          * but pre-1.10 releases are at end-of-life and won't
 341          * be fixed.
 342          */
 343         decode_as_row = ws_strdup_printf(
 344             DECODE_AS_ENTRY ": %s,%u,%s,%s\n",
 345             table_name, GPOINTER_TO_UINT(key), initial_dissector_name,
 346             current_dissector_name);
 347         break;
 348     case FT_NONE:
 349         /*
 350          * XXX - Just put a placeholder for the key value.  Currently
 351          * FT_NONE dissector table uses a single uint value for
 352          * a placeholder
 353          */
 354         decode_as_row = ws_strdup_printf(
 355             DECODE_AS_ENTRY ": %s,0,%s,%s\n",
 356             table_name, initial_dissector_name,
 357             current_dissector_name);
 358         break;
 359
 360     case FT_STRING:
 361     case FT_STRINGZ:
 362     case FT_UINT_STRING:
 363     case FT_STRINGZPAD:
 364     case FT_STRINGZTRUNC:
 365         decode_as_row = ws_strdup_printf(
 366             DECODE_AS_ENTRY ": %s,%s,%s,%s\n",
 367             table_name, (char *)key, initial_dissector_name,
 368             current_dissector_name);
 369         break;
 370
 371     default:
 372         ws_assert_not_reached();
 373         break;
 374     }
 375
 376     /* Do we need a better sort function ???*/
 377     *decode_as_rows_list = g_list_insert_sorted (*decode_as_rows_list, (void *)decode_as_row,
 378         (GCompareFunc)g_ascii_strcasecmp);
 379
 380 }
 381
 382 /* Print the sorted rows to File */
 383 static void
 384 decode_as_print_rows(void *data, void *user_data)
 385 {
 386     FILE *da_file = (FILE *)user_data;
 387     const char *decode_as_row = (const char *)data;
 388
 389     fprintf(da_file, "%s",decode_as_row);
 390
 391 }
 392 int
 393 save_decode_as_entries(char** err)
 394 {
 395     char *pf_dir_path;
 396     char *daf_path;
 397     FILE *da_file;
 398     GList *decode_as_rows_list = NULL;
 399
 400     if (create_persconffile_dir(&pf_dir_path) == -1) {
 401         *err = ws_strdup_printf("Can't create directory\n\"%s\"\nfor recent file: %s.",
 402                                 pf_dir_path, g_strerror(errno));
 403         g_free(pf_dir_path);
 404         return -1;
 405     }
 406
 407     daf_path = get_persconffile_path(DECODE_AS_ENTRIES_FILE_NAME, true);
 408     if ((da_file = ws_fopen(daf_path, "w")) == NULL) {
 409         *err = ws_strdup_printf("Can't open decode_as_entries file\n\"%s\": %s.",
 410                                 daf_path, g_strerror(errno));
 411         g_free(daf_path);
 412         return -1;
 413     }
 414
 415     fprintf(da_file, "# \"Decode As\" entries file for %s " VERSION ".\n"
 416         "#\n"
 417         "# This file is regenerated each time \"Decode As\" preferences\n"
 418         "# are saved within %s. Making manual changes should be safe,\n"
 419         "# however.\n",
 420         get_configuration_namespace(), get_configuration_namespace());
 421
 422     dissector_all_tables_foreach_changed(decode_as_write_entry, &decode_as_rows_list);
 423
 424     g_list_foreach(decode_as_rows_list, decode_as_print_rows, da_file);
 425
 426     fclose(da_file);
 427     g_free(daf_path);
 428     g_list_free_full(decode_as_rows_list, g_free);
 429
 430     return 0;
 431 }
 432
 433 /*
 434  * Data structure for tracking which dissector need to be reset.  This
 435  * structure is necessary as a hash table entry cannot be removed
 436  * while a g_hash_table_foreach walk is in progress.
 437  */
 438 typedef struct dissector_delete_item {
 439     /* The name of the dissector table */
 440     char *ddi_table_name;
 441     /* The type of the selector in that dissector table */
 442     ftenum_t ddi_selector_type;
 443     /* The selector in the dissector table */
 444     union {
 445         unsigned   sel_uint;
 446         char    *sel_string;
 447     } ddi_selector;
 448 } dissector_delete_item_t;
 449
 450 void
 451 decode_build_reset_list (const char *table_name, ftenum_t selector_type,
 452                          void *key, void *value _U_,
 453                          void *user_data _U_)
 454 {
 455     dissector_delete_item_t *item;
 456
 457     item = g_new(dissector_delete_item_t,1);
 458     item->ddi_table_name = g_strdup(table_name);
 459     item->ddi_selector_type = selector_type;
 460     switch (selector_type) {
 461
 462     case FT_UINT8:
 463     case FT_UINT16:
 464     case FT_UINT24:
 465     case FT_UINT32:
 466         item->ddi_selector.sel_uint = GPOINTER_TO_UINT(key);
 467         break;
 468
 469     case FT_NONE:
 470         /* Not really needed, but prevents the assert */
 471         item->ddi_selector.sel_uint = 0;
 472         break;
 473
 474     case FT_STRING:
 475     case FT_STRINGZ:
 476     case FT_UINT_STRING:
 477     case FT_STRINGZPAD:
 478     case FT_STRINGZTRUNC:
 479         item->ddi_selector.sel_string = g_strdup((char *)key);
 480         break;
 481
 482     default:
 483         ws_assert_not_reached();
 484     }
 485     dissector_reset_list = g_slist_prepend(dissector_reset_list, item);
 486 }
 487
 488 /* clear all settings */
 489 void
 490 decode_clear_all(void)
 491 {
 492     dissector_delete_item_t *item;
 493     GSList *tmp;
 494
 495     dissector_all_tables_foreach_changed(decode_build_reset_list, NULL);
 496
 497     for (tmp = dissector_reset_list; tmp; tmp = g_slist_next(tmp)) {
 498         item = (dissector_delete_item_t *)tmp->data;
 499         switch (item->ddi_selector_type) {
 500
 501         case FT_UINT8:
 502         case FT_UINT16:
 503         case FT_UINT24:
 504         case FT_UINT32:
 505             dissector_reset_uint(item->ddi_table_name,
 506                                  item->ddi_selector.sel_uint);
 507             break;
 508
 509         case FT_NONE:
 510             dissector_reset_payload(item->ddi_table_name);
 511             break;
 512
 513         case FT_STRING:
 514         case FT_STRINGZ:
 515         case FT_UINT_STRING:
 516         case FT_STRINGZPAD:
 517         case FT_STRINGZTRUNC:
 518             dissector_reset_string(item->ddi_table_name,
 519                                    item->ddi_selector.sel_string);
 520             g_free(item->ddi_selector.sel_string);
 521             break;
 522
 523         default:
 524             ws_assert_not_reached();
 525         }
 526         g_free(item->ddi_table_name);
 527         g_free(item);
 528     }
 529     g_slist_free(dissector_reset_list);
 530     dissector_reset_list = NULL;
 531
 532     decode_dcerpc_reset_all();
 533 }
 534
 535 void
 536 decode_cleanup(void)
 537 {
 538     g_list_free(decode_as_list);
 539     decode_as_list = NULL;
 540 }
 541
 542 /*
 543  * Editor modelines
 544  *
 545  * Local Variables:
 546  * c-basic-offset: 4
 547  * tab-width: 8
 548  * indent-tabs-mode: nil
 549  * End:
 550  *
 551  * ex: set shiftwidth=4 tabstop=8 expandtab:
 552  * :indentSize=4:tabSize=8:noTabs=true:
 553  */