epan/dissectors/asn1/snmp/snmp.cnf

   1 # snmp.cnf
   2 # snmp conformation file
   3
   4
   5 #.PDU
   6 SMUX-PDUs
   7
   8 #.NO_EMIT
   9 NotificationName
  10 VarBind
  11
  12 #.TYPE_RENAME
  13 Message/community               Community
  14 Trap-PDU/_untag/generic-trap    GenericTrap
  15 Trap-PDU/_untag/specific-trap   SpecificTrap
  16
  17 #.FIELD_RENAME
  18 Messagev2u/datav2u/plaintext v2u_plaintext
  19 BulkPDU/request-id bulkPDU_request-id
  20
  21 #.FN_HDR SMUX-PDUs
  22
  23         snmp_conv_info_t *snmp_info = snmp_find_conversation_and_get_conv_data(actx->pinfo);
  24
  25         actx->private_data = snmp_info;
  26
  27 #.FN_PARS Version    VAL_PTR = &snmp_version
  28
  29 #.FN_PARS PDUs
  30
  31         VAL_PTR = &pdu_type
  32
  33 #.FN_BODY PDUs
  34         int pdu_type=-1;
  35
  36         snmp_request_response_t *srrp;
  37         snmp_conv_info_t *snmp_info = (snmp_conv_info_t *)actx->private_data;
  38
  39         col_clear(actx->pinfo->cinfo, COL_INFO);
  40
  41 %(DEFAULT_BODY)s
  42         if( (pdu_type!=-1) && snmp_PDUs_vals[pdu_type].strptr ){
  43                 col_prepend_fstr(actx->pinfo->cinfo, COL_INFO, "%%s", snmp_PDUs_vals[pdu_type].strptr);
  44
  45                 /* pdu_type is the index, not the tag so convert it to the tag value */
  46                 pdu_type = snmp_PDUs_vals[pdu_type].value;
  47
  48                 srrp=snmp_match_request_response(tvb, actx->pinfo, tree, RequestID, pdu_type, snmp_info);
  49                 if (srrp) {
  50                         tap_queue_packet(snmp_tap, actx->pinfo, srrp);
  51                 }
  52         }
  53
  54
  55 #.END
  56
  57 #.FN_BODY PDU/request-id VAL_PTR = &RequestID
  58
  59 %(DEFAULT_BODY)s
  60
  61 #.FN_BODY Integer32 VAL_PTR = &RequestID
  62
  63 %(DEFAULT_BODY)s
  64
  65 #.FN_BODY Trap-PDU/_untag
  66         generic_trap = 0;
  67         enterprise_oid = NULL;
  68
  69 %(DEFAULT_BODY)s
  70
  71   if (snmp_version != 0) {
  72     expert_add_info(actx->pinfo, tree, &ei_snmp_trap_pdu_obsolete);
  73   }
  74
  75 #.FN_PARS Trap-PDU/_untag/generic-trap    VAL_PTR = &generic_trap
  76
  77 #.FN_BODY Trap-PDU/_untag/specific-trap   VAL_PTR = &specific_trap
  78   unsigned specific_trap;
  79
  80 %(DEFAULT_BODY)s
  81
  82         if (generic_trap == 6) { /* enterprise specific */
  83                 const char *specific_str = snmp_lookup_specific_trap (specific_trap);
  84                 if (specific_str) {
  85                 proto_item_append_text(actx->created_item, " (%%s)", specific_str);
  86                 }
  87         }
  88 #.END
  89
  90
  91 #.FN_PARS EnterpriseOID  FN_VARIANT = _str  VAL_PTR = &enterprise_oid
  92
  93 #.FN_BODY EnterpriseOID
  94         const char* name;
  95
  96 %(DEFAULT_BODY)s
  97
  98         if (display_oid && enterprise_oid) {
  99                 name = oid_resolved_from_string(actx->pinfo->pool, enterprise_oid);
 100                 if (name) {
 101                 col_append_fstr (actx->pinfo->cinfo, COL_INFO, " %%s", name);
 102                 }
 103         }
 104
 105 #.END
 106
 107 #.FN_PARS HeaderData/msgSecurityModel
 108
 109         VAL_PTR = &MsgSecurityModel
 110
 111 #.FN_PARS UsmSecurityParameters/msgAuthoritativeEngineBoots
 112
 113         VAL_PTR = &usm_p.boots
 114
 115 #.FN_PARS UsmSecurityParameters/msgAuthoritativeEngineTime
 116
 117         VAL_PTR = &usm_p.snmp_time
 118
 119 #.FN_BODY UsmSecurityParameters/msgAuthoritativeEngineID
 120
 121         offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index, &usm_p.engine_tvb);
 122          if (usm_p.engine_tvb) {
 123                 proto_tree* engine_tree = proto_item_add_subtree(%(ACTX)s->created_item,ett_engineid);
 124                 dissect_snmp_engineid(engine_tree, actx->pinfo, usm_p.engine_tvb, 0, tvb_reported_length_remaining(usm_p.engine_tvb,0));
 125         }
 126
 127 #.FN_BODY SnmpEngineID
 128         tvbuff_t* param_tvb = NULL;
 129
 130         offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index, &param_tvb);
 131          if (param_tvb) {
 132                 proto_tree* engine_tree = proto_item_add_subtree(%(ACTX)s->created_item,ett_engineid);
 133                 dissect_snmp_engineid(engine_tree, actx->pinfo, param_tvb, 0, tvb_reported_length_remaining(param_tvb,0));
 134         }
 135
 136 #.FN_PARS UsmSecurityParameters/msgUserName
 137         VAL_PTR = &usm_p.user_tvb
 138
 139 #.FN_BODY UsmSecurityParameters/msgAuthenticationParameters
 140         offset = dissect_ber_octet_string(false, actx, tree, tvb, offset, hf_index, &usm_p.auth_tvb);
 141         if (usm_p.auth_tvb) {
 142                 usm_p.auth_item = %(ACTX)s->created_item;
 143                 usm_p.auth_offset = tvb_offset_from_real_beginning(usm_p.auth_tvb);
 144         }
 145 #.FN_PARS UsmSecurityParameters/msgPrivacyParameters
 146         VAL_PTR = &usm_p.priv_tvb
 147
 148 #.FN_BODY ScopedPduData/encryptedPDU
 149         tvbuff_t* crypt_tvb;
 150         offset = dissect_ber_octet_string(false, actx, tree, tvb, offset, hf_snmp_encryptedPDU, &crypt_tvb);
 151
 152         if( usm_p.encrypted && crypt_tvb
 153                 && usm_p.user_assoc
 154                 && usm_p.user_assoc->user.privProtocol ) {
 155
 156                 const char* error = NULL;
 157                 proto_tree* encryptedpdu_tree = proto_item_add_subtree(%(ACTX)s->created_item,ett_encryptedPDU);
 158                 tvbuff_t* cleartext_tvb = usm_p.user_assoc->user.privProtocol(&usm_p, crypt_tvb, actx->pinfo, &error );
 159
 160                 if (! cleartext_tvb) {
 161                         proto_tree_add_expert_format(encryptedpdu_tree, actx->pinfo, &ei_snmp_failed_decrypted_data_pdu,
 162                                 crypt_tvb, 0, -1, "Failed to decrypt encryptedPDU: %%s", error);
 163
 164                         col_set_str(actx->pinfo->cinfo, COL_INFO, "encryptedPDU: Failed to decrypt");
 165
 166                         return offset;
 167                 } else {
 168                         proto_item* decrypted_item;
 169                         proto_tree* decrypted_tree;
 170
 171                         if (! check_ScopedPdu(cleartext_tvb)) {
 172                                 proto_tree_add_expert(encryptedpdu_tree, actx->pinfo, &ei_snmp_decrypted_data_bad_formatted, cleartext_tvb, 0, -1);
 173
 174                                 col_set_str(actx->pinfo->cinfo, COL_INFO, "encryptedPDU: Decrypted data not formatted as expected");
 175
 176                                 return offset;
 177                         }
 178
 179
 180                         add_new_data_source(actx->pinfo, cleartext_tvb, "Decrypted ScopedPDU");
 181
 182                         decrypted_item = proto_tree_add_item(encryptedpdu_tree, hf_snmp_decryptedPDU,cleartext_tvb,0,-1,ENC_NA);
 183                         decrypted_tree = proto_item_add_subtree(decrypted_item,ett_decrypted);
 184                         dissect_snmp_ScopedPDU(false, cleartext_tvb, 0, actx, decrypted_tree, -1);
 185                         }
 186         } else {
 187                         col_set_str(actx->pinfo->cinfo, COL_INFO, "encryptedPDU: privKey Unknown");
 188         }
 189
 190 #.FN_BODY SNMPv3Message/msgSecurityParameters
 191
 192         switch(MsgSecurityModel){
 193                 case SNMP_SEC_USM:      /* 3 */
 194                         offset = get_ber_identifier(tvb, offset, NULL, NULL, NULL);
 195                         offset = get_ber_length(tvb, offset, NULL, NULL);
 196                         offset = dissect_snmp_UsmSecurityParameters(false, tvb, offset, actx, tree, -1);
 197                         usm_p.user_assoc = get_user_assoc(usm_p.engine_tvb, usm_p.user_tvb, actx->pinfo);
 198                         break;
 199                 case SNMP_SEC_ANY:      /* 0 */
 200                 case SNMP_SEC_V1:       /* 1 */
 201                 case SNMP_SEC_V2C:      /* 2 */
 202                 default:
 203                         %(DEFAULT_BODY)s
 204                         break;
 205         }
 206
 207 #.FN_FTR SNMPv3Message
 208
 209         if( usm_p.authenticated
 210                 && usm_p.user_assoc ) {
 211                 const char* error = NULL;
 212                 proto_item* authen_item;
 213                 proto_tree* authen_tree = proto_item_add_subtree(usm_p.auth_item,ett_authParameters);
 214                 uint8_t* calc_auth = NULL;
 215                 unsigned calc_auth_len = 0;
 216
 217                 usm_p.authOK = snmp_usm_auth(actx->pinfo, usm_p.user_assoc->user.authModel, &usm_p, &calc_auth, &calc_auth_len, &error );
 218
 219                 if (error) {
 220                         expert_add_info_format( actx->pinfo, usm_p.auth_item, &ei_snmp_verify_authentication_error, "Error while verifying Message authenticity: %s", error );
 221                 } else {
 222                         expert_field* expert;
 223
 224                         authen_item = proto_tree_add_boolean(authen_tree, hf_snmp_msgAuthentication, tvb, 0, 0, usm_p.authOK);
 225                         proto_item_set_generated(authen_item);
 226
 227                         if (usm_p.authOK) {
 228                                 expert = &ei_snmp_authentication_ok;
 229                         } else {
 230                                 const char* calc_auth_str = bytes_to_str_punct(actx->pinfo->pool, calc_auth,calc_auth_len,' ');
 231                                 proto_item_append_text(authen_item, " calculated = %s", calc_auth_str);
 232                                 expert = &ei_snmp_authentication_error;
 233                         }
 234
 235                         expert_add_info( actx->pinfo, authen_item, expert);
 236                 }
 237         }
 238
 239 #.END
 240
 241
 242
 243 #.FN_BODY HeaderData/msgFlags  VAL_PTR = &parameter_tvb
 244         tvbuff_t *parameter_tvb = NULL;
 245
 246  %(DEFAULT_BODY)s
 247         if (parameter_tvb){
 248                 uint8_t v3_flags = tvb_get_uint8(parameter_tvb, 0);
 249                 proto_tree* flags_tree = proto_item_add_subtree(%(ACTX)s->created_item,ett_msgFlags);
 250
 251                 proto_tree_add_item(flags_tree, hf_snmp_v3_flags_report, parameter_tvb, 0, 1, ENC_BIG_ENDIAN);
 252                 proto_tree_add_item(flags_tree, hf_snmp_v3_flags_crypt, parameter_tvb, 0, 1, ENC_BIG_ENDIAN);
 253                 proto_tree_add_item(flags_tree, hf_snmp_v3_flags_auth, parameter_tvb, 0, 1, ENC_BIG_ENDIAN);
 254
 255                 usm_p.encrypted = v3_flags & TH_CRYPT ? true : false;
 256                 usm_p.authenticated = v3_flags & TH_AUTH ? true : false;
 257         }
 258
 259
 260 #.TYPE_ATTR
 261 NetworkAddress TYPE = FT_IPv4  DISPLAY = BASE_NONE  STRINGS = NULL
 262 Message/community  TYPE = FT_STRING DISPLAY = BASE_NONE STRINGS = NULL
 263 HeaderData/msgSecurityModel TYPE = FT_UINT32 DISPLAY = BASE_DEC STRINGS = VALS(sec_models)
 264 UsmSecurityParameters/msgUserName TYPE = FT_STRING DISPLAY = BASE_NONE STRINGS = NULL
 265 ScopedPDU/contextName TYPE = FT_STRING DISPLAY = BASE_NONE STRINGS = NULL
 266 #.END