?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / epan / dissectors / packet-edonkey.c
blob010abf8cc50a4a45014cf164a53ad5f3f2b52831
1 /* packet-edonkey.c
2 * Routines for edonkey dissection
3 * Copyright 2003, Xuan Zhang <xz@aemail4u.com>
4 * Copyright 2007, Stefano Picerno <stefano.picerno@gmail.com>
5 * Copyright 2008, Stefan Monhof <stefan.monhof@stud.uni-due.de>
6 *
7 * eDonkey dissector based on protocol descriptions from mldonkey:
8 * ftp://ftp.chatnfiles.com/gnu-mirror/savannah/files/mldonkey/docs/Edonkey-Overnet/edonkey-protocol.txt
9 * ftp://ftp.chatnfiles.com/gnu-mirror/savannah/files/mldonkey/docs/Edonkey-Overnet/overnet-protocol.txt
10 *
11 * Kademlia dissector based on source code inspection of aMule 2.1.3 and eMule 0.48a
12 * Modified and added on the basis of information and names from the eMule 0.50 source code
13 * found at http://www.emule-project.net
14 *
15 * Wireshark - Network traffic analyzer
16 * By Gerald Combs <gerald@wireshark.org>
17 * Copyright 1998 Gerald Combs
18 *
19 * SPDX-License-Identifier: GPL-2.0-or-later
20 */
21
22 #include "config.h"
23
24 #include <stdlib.h>
25
26 #include <epan/packet.h>
27 #include <epan/prefs.h>
28 #include <epan/expert.h>
29 #include "packet-edonkey.h"
30 #include "packet-tcp.h"
31
32 void proto_reg_handoff_edonkey(void);
33
34 static dissector_handle_t edonkey_tcp_handle;
35 static dissector_handle_t edonkey_udp_handle;
36
37 static int proto_edonkey;
38
39 static int hf_edonkey_message;
40 static int hf_edonkey_protocol;
41 static int hf_edonkey_message_length;
42 static int hf_edonkey_message_type;
43 static int hf_edonkey_client_hash;
44 static int hf_edonkey_server_hash;
45 static int hf_edonkey_file_hash;
46 static int hf_edonkey_client_id;
47 static int hf_edonkey_metatag_namesize;
48 static int hf_edonkey_metatag_type;
49 static int hf_edonkey_metatag;
50 static int hf_edonkey_metatag_name;
51 static int hf_edonkey_metatag_id;
52 static int hf_edonkey_ip;
53 static int hf_edonkey_port;
54 static int hf_edonkey_hash;
55 static int hf_edonkey_part_count;
56 static int hf_edonkey_file_status;
57 static int hf_edonkey_directory;
58 static int hf_edonkey_string;
59 static int hf_edonkey_string_length;
60 static int hf_edonkey_fileinfo;
61 static int hf_edonkey_clientinfo;
62 static int hf_edonkey_serverinfo;
63 static int hf_emule_aich_partnum;
64 static int hf_emule_aich_root_hash;
65 static int hf_emule_aich_hash_entry;
66 static int hf_emule_aich_hash_id;
67 static int hf_emule_aich_hash;
68 static int hf_emule_multipacket_entry;
69 static int hf_emule_multipacket_opcode;
70 static int hf_emule_source_count;
71 static int hf_emule_zlib;
72 static int hf_emule_public_key;
73 static int hf_emule_signature;
74 static int hf_emule_sourceOBFU;
75 static int hf_overnet_peer;
76
77 static int hf_edonkey_unparsed_data_length;
78 static int hf_kademlia;
79 static int hf_kademlia_search_condition;
80 static int hf_kademlia_search_condition_argument_uint32;
81 static int hf_kademlia_search_condition_argument_uint64;
82 /* static int hf_kademlia_unparsed_data_length; */
83 static int hf_kademlia_peer;
84 static int hf_kademlia_peer_id;
85 static int hf_kademlia_hash;
86 static int hf_kademlia_file_id;
87 static int hf_kademlia_keyword_hash;
88 static int hf_kademlia_recipients_id;
89 static int hf_kademlia_sender_id;
90 static int hf_kademlia_target_id;
91 static int hf_kademlia_distance;
92 static int hf_kademlia_version;
93 static int hf_kademlia_peertype;
94 static int hf_kademlia_tag_float;
95 static int hf_kademlia_tag_uint64;
96 static int hf_kademlia_tag_uint32;
97 static int hf_kademlia_tag_ipv4;
98 static int hf_kademlia_tag_uint16;
99 static int hf_kademlia_tag_uint8;
100 static int hf_kademlia_tag_hash;
101 static int hf_kademlia_tag_bsob;
102 static int hf_kademlia_tag_string;
103 static int hf_kademlia_udp_port;
104 static int hf_kademlia_tcp_port;
105 static int hf_kademlia_ip;
106 static int hf_kademlia_tag_name;
107 static int hf_kademlia_tag_name_length;
108 static int hf_kademlia_tag_type;
109 static int hf_kademlia_request_type;
110 static int hf_kademlia_search_expression_type;
111 static int hf_kademlia_search_bool_op;
112
113 /* Generated from convert_proto_tree_add_text.pl */
114 static int hf_edonkey_list_size;
115 static int hf_edonkey_meta_tag_value_revision;
116 static int hf_edonkey_meta_tag_value_uint;
117 static int hf_edonkey_boolean_array_length;
118 static int hf_edonkey_blob_length;
119 static int hf_edonkey_kademlia_string;
120 static int hf_emule_public_key_length;
121 static int hf_emule_signature_length;
122 static int hf_edonkey_obfuscation_settings;
123 static int hf_edonkey_start_offset;
124 static int hf_edonkey_start_offset_64;
125 static int hf_edonkey_end_offset;
126 static int hf_edonkey_end_offset_64;
127 static int hf_edonkey_emule_file_length;
128 static int hf_edonkey_overnet_peer_type;
129 static int hf_edonkey_more_search_file_results;
130 static int hf_edonkey_file_size;
131 static int hf_edonkey_large_file_size;
132 static int hf_edonkey_number_of_users;
133 static int hf_edonkey_number_of_files;
134 static int hf_edonkey_message_data;
135 static int hf_edonkey_emule_version;
136 static int hf_edonkey_emule_queue_ranking;
137 static int hf_edonkey_emule_ident_state;
138 static int hf_edonkey_emule_rndchallenge;
139 static int hf_edonkey_emule_sig_ip_used;
140 static int hf_edonkey_packed_length;
141 static int hf_edonkey_compressed_message_data;
142 static int hf_edonkey_challenge;
143 static int hf_edonkey_max_number_of_users;
144 static int hf_edonkey_search_type;
145 static int hf_edonkey_search_range_min;
146 static int hf_edonkey_search_range_max;
147 static int hf_edonkey_kademlia_uload;
148 static int hf_edonkey_kademlia_start_position;
149 static int hf_edonkey_kademlia_filesize;
150 static int hf_edonkey_kademlia_restrictive;
151 static int hf_edonkey_broken_compressed_data;
152 static int hf_edonkey_search_limit;
153 static int hf_edonkey_search_limit_type;
154 static int hf_edonkey_search_ops;
155 static int hf_edonkey_user_hash_length;
156
157 static int ett_kademlia_tag;
158 static int ett_edonkey_listitem;
159 static int ett_kademlia_search_expression;
160 static int ett_edonkey;
161 static int ett_edonkey_message;
162 static int ett_edonkey_metatag;
163 static int ett_edonkey_search;
164 static int ett_edonkey_fileinfo;
165 static int ett_edonkey_serverinfo;
166 static int ett_edonkey_clientinfo;
167 static int ett_emule_aichhash;
168 static int ett_emule_multipacket;
169 static int ett_emule_zlib;
170 static int ett_overnet_peer;
171 static int ett_emule_sourceOBFU;
172
173 static expert_field ei_kademlia_tag_type;
174 static expert_field ei_kademlia_search_expression_type;
175
176 #define EDONKEY_TCP_PORT_RANGE "4661-4663" /* Not IANA registered */
177 #define EDONKEY_UDP_PORT_RANGE "4665,4672" /* Not IANA registered */
178
179 /* desegmentation of eDonkey over TCP */
180 static bool edonkey_desegment = true;
181
182 static const value_string kademlia_msgs[] = {
183 { KADEMLIA2_BOOTSTRAP_REQ ,"KADEMLIA2_BOOTSTRAP_REQ" },
184 { KADEMLIA2_BOOTSTRAP_RES ,"KADEMLIA2_BOOTSTRAP_RES" },
185 { KADEMLIA2_HELLO_REQ ,"KADEMLIA2_HELLO_REQ" },
186 { KADEMLIA2_HELLO_RES ,"KADEMLIA2_HELLO_RES" },
187 { KADEMLIA2_PUBLISH_KEY_REQ ,"KADEMLIA2_PUBLISH_KEY_REQ" },
188 { KADEMLIA2_PUBLISH_NOTES_REQ ,"KADEMLIA2_PUBLISH_NOTES_REQ" },
189 { KADEMLIA2_PUBLISH_RES ,"KADEMLIA2_PUBLISH_RES" },
190 { KADEMLIA2_PUBLISH_SOURCE_REQ ,"KADEMLIA2_PUBLISH_SOURCE_REQ" },
191 { KADEMLIA2_REQ ,"KADEMLIA2_REQ" },
192 { KADEMLIA2_RES ,"KADEMLIA2_RES" },
193 { KADEMLIA2_SEARCH_KEY_REQ ,"KADEMLIA2_SEARCH_KEY_REQ" },
194 { KADEMLIA2_SEARCH_NOTES_REQ ,"KADEMLIA2_SEARCH_NOTES_REQ" },
195 { KADEMLIA2_SEARCH_RES ,"KADEMLIA2_SEARCH_RES" },
196 { KADEMLIA2_SEARCH_SOURCE_REQ ,"KADEMLIA2_SEARCH_SOURCE_REQ" },
197 { KADEMLIA_BOOTSTRAP_REQ ,"KADEMLIA_BOOTSTRAP_REQ" },
198 { KADEMLIA_BOOTSTRAP_RES ,"KADEMLIA_BOOTSTRAP_RES" },
199 { KADEMLIA_CALLBACK_REQ ,"KADEMLIA_CALLBACK_REQ" },
200 { KADEMLIA_FINDBUDDY_REQ ,"KADEMLIA_FINDBUDDY_REQ" },
201 { KADEMLIA_FINDBUDDY_RES ,"KADEMLIA_FINDBUDDY_RES" },
202 { KADEMLIA_FIREWALLED_ACK_RES ,"KADEMLIA_FIREWALLED_ACK_RES" },
203 { KADEMLIA_FIREWALLED_REQ ,"KADEMLIA_FIREWALLED_REQ" },
204 { KADEMLIA_FIREWALLED_RES ,"KADEMLIA_FIREWALLED_RES" },
205 { KADEMLIA_HELLO_REQ ,"KADEMLIA_HELLO_REQ" },
206 { KADEMLIA_HELLO_RES ,"KADEMLIA_HELLO_RES" },
207 { KADEMLIA_PUBLISH_NOTES_REQ ,"KADEMLIA_PUBLISH_NOTES_REQ" },
208 { KADEMLIA_PUBLISH_NOTES_RES ,"KADEMLIA_PUBLISH_NOTES_RES" },
209 { KADEMLIA_PUBLISH_REQ ,"KADEMLIA_PUBLISH_REQ" },
210 { KADEMLIA_PUBLISH_RES ,"KADEMLIA_PUBLISH_RES" },
211 { KADEMLIA_REQ ,"KADEMLIA_REQ" },
212 { KADEMLIA_RES ,"KADEMLIA_RES" },
213 { KADEMLIA_SEARCH_NOTES_REQ ,"KADEMLIA_SEARCH_NOTES_REQ" },
214 { KADEMLIA_SEARCH_NOTES_RES ,"KADEMLIA_SEARCH_NOTES_RES" },
215 { KADEMLIA_SEARCH_REQ ,"KADEMLIA_SEARCH_REQ" },
216 { KADEMLIA_SEARCH_RES ,"KADEMLIA_SEARCH_RES" },
217 { 0, NULL }
218 };
219
220 static const value_string kademlia_tag_types[] = {
221 { KADEMLIA_TAGTYPE_HASH ,"TAGTYPE_HASH" },
222 { KADEMLIA_TAGTYPE_STRING ,"TAGTYPE_STRING" },
223 { KADEMLIA_TAGTYPE_UINT32 ,"TAGTYPE_UINT32" },
224 { KADEMLIA_TAGTYPE_FLOAT32 ,"TAGTYPE_FLOAT32" },
225 { KADEMLIA_TAGTYPE_BOOL ,"TAGTYPE_BOOL" },
226 { KADEMLIA_TAGTYPE_BOOLARRAY ,"TAGTYPE_BOOLARRAY" },
227 { KADEMLIA_TAGTYPE_BLOB ,"TAGTYPE_BLOB" },
228 { KADEMLIA_TAGTYPE_UINT16 ,"TAGTYPE_UINT16" },
229 { KADEMLIA_TAGTYPE_UINT8 ,"TAGTYPE_UINT8" },
230 { KADEMLIA_TAGTYPE_BSOB ,"TAGTYPE_BSOB" },
231 { KADEMLIA_TAGTYPE_UINT64 ,"TAGTYPE_UINT64" },
232
233 { KADEMLIA_TAGTYPE_STR1 ,"TAGTYPE_STR1" },
234 { KADEMLIA_TAGTYPE_STR2 ,"TAGTYPE_STR2" },
235 { KADEMLIA_TAGTYPE_STR3 ,"TAGTYPE_STR3" },
236 { KADEMLIA_TAGTYPE_STR4 ,"TAGTYPE_STR4" },
237 { KADEMLIA_TAGTYPE_STR5 ,"TAGTYPE_STR5" },
238 { KADEMLIA_TAGTYPE_STR6 ,"TAGTYPE_STR6" },
239 { KADEMLIA_TAGTYPE_STR7 ,"TAGTYPE_STR7" },
240 { KADEMLIA_TAGTYPE_STR8 ,"TAGTYPE_STR8" },
241 { KADEMLIA_TAGTYPE_STR9 ,"TAGTYPE_STR9" },
242 { KADEMLIA_TAGTYPE_STR10 ,"TAGTYPE_STR10" },
243 { KADEMLIA_TAGTYPE_STR11 ,"TAGTYPE_STR11" },
244 { KADEMLIA_TAGTYPE_STR12 ,"TAGTYPE_STR12" },
245 { KADEMLIA_TAGTYPE_STR13 ,"TAGTYPE_STR13" },
246 { KADEMLIA_TAGTYPE_STR14 ,"TAGTYPE_STR14" },
247 { KADEMLIA_TAGTYPE_STR15 ,"TAGTYPE_STR15" },
248 { KADEMLIA_TAGTYPE_STR16 ,"TAGTYPE_STR16" },
249 { KADEMLIA_TAGTYPE_STR17 ,"TAGTYPE_STR17" },
250 { KADEMLIA_TAGTYPE_STR18 ,"TAGTYPE_STR18" },
251 { KADEMLIA_TAGTYPE_STR19 ,"TAGTYPE_STR19" },
252 { KADEMLIA_TAGTYPE_STR20 ,"TAGTYPE_STR20" },
253 { KADEMLIA_TAGTYPE_STR21 ,"TAGTYPE_STR21" },
254 { KADEMLIA_TAGTYPE_STR22 ,"TAGTYPE_STR22" },
255 { 0, NULL }
256 };
257
258 static const value_string kademlia_tags[] = {
259 { KADEMLIA_TAG_BUDDYHASH ,"TAG_BUDDYHASH" },
260 { KADEMLIA_TAG_CLIENTLOWID ,"TAG_CLIENTLOWID" },
261 { KADEMLIA_TAG_COLLECTION ,"TAG_COLLECTION" },
262 { KADEMLIA_TAG_COPIED ,"TAG_COPIED" },
263 { KADEMLIA_TAG_DESCRIPTION ,"TAG_DESCRIPTION" },
264 { KADEMLIA_TAG_ENCRYPTION ,"TAG_ENCRYPTION" },
265 { KADEMLIA_TAG_FAIL ,"TAG_FAIL" },
266 { KADEMLIA_TAG_FILECOMMENT ,"TAG_FILECOMMENT" },
267 { KADEMLIA_TAG_FILE_COUNT ,"TAG_FILE_COUNT" },
268 { KADEMLIA_TAG_FILEFORMAT ,"TAG_FILEFORMAT" },
269 { KADEMLIA_TAG_FILENAME ,"TAG_FILENAME" },
270 { KADEMLIA_TAG_FILERATING ,"TAG_FILERATING" },
271 { KADEMLIA_TAG_FILESIZE_HI ,"TAG_FILESIZE_HI" },
272 { KADEMLIA_TAG_FILESIZE ,"TAG_FILESIZE" },
273 { KADEMLIA_TAG_FILETYPE ,"TAG_FILETYPE" },
274 { KADEMLIA_TAG_GAP_END ,"TAG_GAP_END" },
275 { KADEMLIA_TAG_GAP_START ,"TAG_GAP_START" },
276 { KADEMLIA_TAG_IP_ADDRESS ,"TAG_IP_ADDRESS" },
277 { KADEMLIA_TAG_MEDIA_ALBUM ,"TAG_MEDIA_ALBUM" },
278 { KADEMLIA_TAG_MEDIA_ARTIST ,"TAG_MEDIA_ARTIST" },
279 { KADEMLIA_TAG_MEDIA_BITRATE ,"TAG_MEDIA_BITRATE"},
280 { KADEMLIA_TAG_MEDIA_CODEC ,"TAG_MEDIA_CODEC" },
281 { KADEMLIA_TAG_MEDIA_LENGTH ,"TAG_MEDIA_LENGTH" },
282 { KADEMLIA_TAG_MEDIA_TITLE ,"TAG_MEDIA_TITLE" },
283 { KADEMLIA_TAG_PART_HASH ,"TAG_PART_HASH" },
284 { KADEMLIA_TAG_PART_PATH ,"TAG_PART_PATH" },
285 { KADEMLIA_TAG_PARTS ,"TAG_PARTS" },
286 { KADEMLIA_TAG_PERMISSIONS ,"TAG_PERMISSIONS" },
287 { KADEMLIA_TAG_PING ,"TAG_PING" },
288 { KADEMLIA_TAG_PORT ,"TAG_PORT" },
289 { KADEMLIA_TAG_PREFERENCE ,"TAG_PREFERENCE" },
290 { KADEMLIA_TAG_PRIORITY ,"TAG_PRIORITY" },
291 { KADEMLIA_TAG_QTIME ,"TAG_QTIME" },
292 { KADEMLIA_TAG_SERVERIP ,"TAG_SERVERIP" },
293 { KADEMLIA_TAG_SERVERPORT ,"TAG_SERVERPORT" },
294 { KADEMLIA_TAG_SOURCEIP ,"TAG_SOURCEIP" },
295 { KADEMLIA_TAG_SOURCEPORT ,"TAG_SOURCEPORT" },
296 { KADEMLIA_TAG_SOURCES ,"TAG_SOURCES" },
297 { KADEMLIA_TAG_SOURCETYPE ,"TAG_SOURCETYPE" },
298 { KADEMLIA_TAG_SOURCEUPORT ,"TAG_SOURCEUPORT" },
299 { KADEMLIA_TAG_STATUS ,"TAG_STATUS" },
300 { KADEMLIA_TAG_TEMPFILE ,"TAG_TEMPFILE" },
301 { KADEMLIA_TAG_USER_COUNT ,"TAG_USER_COUNT" },
302 { KADEMLIA_TAG_VERSION ,"TAG_VERSION" },
303
304 { 0, NULL }
305 };
306
307 static const value_string edonkey_protocols[] = {
308 { EDONKEY_PROTO_EDONKEY, "eDonkey" },
309 { EDONKEY_PROTO_EMULE_EXT, "eMule Extensions" },
310 { EDONKEY_PROTO_EMULE_COMP, "eMule Compressed" },
311 { EDONKEY_PROTO_KADEMLIA, "Kademlia" },
312 { EDONKEY_PROTO_KADEMLIA_COMP, "Kademlia Compressed" },
313 { EDONKEY_PROTO_ADU_KADEMLIA, "KAdu" },
314 { EDONKEY_PROTO_ADU_KADEMLIA_COMP, "KAdu Compressed" },
315 { 0, NULL }
316 };
317
318 static const value_string edonkey_tcp_msgs[] = {
319 { EDONKEY_MSG_HELLO, "Hello" },
320 { EDONKEY_MSG_BAD_PROTO, "Bad Proto" },
321 { EDONKEY_MSG_GET_SERVER_LIST, "Get Server List" },
322 { EDONKEY_MSG_OFFER_FILES, "Offer Files" },
323 { EDONKEY_MSG_SEARCH_FILES, "Search Files" },
324 { EDONKEY_MSG_DISCONNECT, "Disconnect" },
325 { EDONKEY_MSG_GET_SOURCES, "Get Sources" },
326 { EDONKEY_MSG_GET_SOURCES_OBFU, "Get Sources Obfuscation" },
327 { EDONKEY_MSG_SEARCH_USER, "Search User" },
328 { EDONKEY_MSG_CLIENT_CB_REQ, "Client Callback Request" },
329 { EDONKEY_MSG_MORE_RESULTS, "More Results" },
330 { EDONKEY_MSG_SERVER_LIST, "Server List" },
331 { EDONKEY_MSG_SEARCH_FILE_RESULTS, "Search File Results" },
332 { EDONKEY_MSG_SERVER_STATUS, "Server Status" },
333 { EDONKEY_MSG_SERVER_CB_REQ, "Server Callback Request" },
334 { EDONKEY_MSG_CALLBACK_FAIL, "Callback Fail" },
335 { EDONKEY_MSG_SERVER_MESSAGE, "Server Message" },
336 { EDONKEY_MSG_ID_CHANGE, "ID Change" },
337 { EDONKEY_MSG_SERVER_INFO_DATA, "Server Info Data" },
338 { EDONKEY_MSG_FOUND_SOURCES, "Found Sources" },
339 { EDONKEY_MSG_FOUND_SOURCES_OBFU, "Found Sources Obfuscation"},
340 { EDONKEY_MSG_SEARCH_USER_RESULTS, "Search User Results" },
341 { EDONKEY_MSG_SENDING_PART, "Sending Part" },
342 { EDONKEY_MSG_REQUEST_PARTS, "Request Parts" },
343 { EDONKEY_MSG_NO_SUCH_FILE, "No Such File" },
344 { EDONKEY_MSG_END_OF_DOWNLOAD, "End of Download" },
345 { EDONKEY_MSG_VIEW_FILES, "View Files" },
346 { EDONKEY_MSG_VIEW_FILES_ANSWER, "View Files Answer" },
347 { EDONKEY_MSG_HELLO_ANSWER, "Hello Answer" },
348 { EDONKEY_MSG_NEW_CLIENT_ID, "New Client ID" },
349 { EDONKEY_MSG_CLIENT_MESSAGE, "Client Message" },
350 { EDONKEY_MSG_FILE_STATUS_REQUEST, "File Status Request" },
351 { EDONKEY_MSG_FILE_STATUS, "File Status" },
352 { EDONKEY_MSG_HASHSET_REQUEST, "Hashset Request" },
353 { EDONKEY_MSG_HASHSET_ANSWER, "Hashset Answer" },
354 { EDONKEY_MSG_SLOT_REQUEST, "Slot Request" },
355 { EDONKEY_MSG_SLOT_GIVEN, "Slot Given" },
356 { EDONKEY_MSG_SLOT_RELEASE, "Slot Release" },
357 { EDONKEY_MSG_SLOT_TAKEN, "Slot Taken" },
358 { EDONKEY_MSG_FILE_REQUEST, "File Request" },
359 { EDONKEY_MSG_FILE_REQUEST_ANSWER, "File Request Answer" },
360 { EDONKEY_MSG_GET_SHARED_DIRS, "Get Shared Directories" },
361 { EDONKEY_MSG_GET_SHARED_FILES, "Get Shared Files" },
362 { EDONKEY_MSG_SHARED_DIRS, "Shared Directories" },
363 { EDONKEY_MSG_SHARED_FILES, "Shared Files" },
364 { EDONKEY_MSG_SHARED_DENIED, "Shared Denied" },
365 { 0, NULL }
366 };
367
368 static const value_string emule_tcp_msgs[] = {
369 { EMULE_MSG_HELLO, "Hello" },
370 { EMULE_MSG_HELLO_ANSWER, "Hello Answer" },
371 { EMULE_MSG_DATA_COMPRESSED, "Data Compressed" },
372 { EMULE_MSG_QUEUE_RANKING, "Queue Ranking" },
373 { EMULE_MSG_FILE_DESC, "File Description" },
374 { EMULE_MSG_SOURCES_REQUEST, "Sources Request" },
375 { EMULE_MSG_SOURCES_ANSWER, "Sources Answer" },
376 { EMULE_MSG_SIGNATURE, "Signature" },
377 { EMULE_MSG_PUBLIC_KEY, "Public Key" },
378 { EMULE_MSG_SEC_IDENT_STATE, "Second Identification State" },
379 { EMULE_MSG_MULTIPACKET, "MultiPacket" },
380 { EMULE_MSG_MULTIPACKET_EXT, "MultiPacketExt" },
381 { EMULE_MSG_MULTIPACKET_ANSWER, "MultiPacket Answer" },
382 { EMULE_MSG_CALLBACK, "Callback" },
383 { EMULE_MSG_AICH_REQUEST, "AICH Hashset Request" },
384 { EMULE_MSG_AICH_ANSWER, "AICH Hashset Answer" },
385 { EMULE_MSG_AICHFILEHASH_ANSWER, "AICH Master Hash Request" },
386 { EMULE_MSG_AICHFILEHASH_REQUEST, "AICH Master Hash Answer" },
387 { EMULE_MSG_DATA_COMPRESSED_64, "Data Compressed (64bit)" },
388 { EMULE_MSG_SENDING_PART_64, "Sending Part (64bit)" },
389 { EMULE_MSG_REQUEST_PARTS_64, "Request Parts (64bit)" },
390 { 0, NULL }
391 };
392
393 static const value_string edonkey_udp_msgs[] = {
394 { EDONKEY_MSG_UDP_SERVER_STATUS_REQUEST, "Server Status Request" },
395 { EDONKEY_MSG_UDP_SERVER_STATUS, "Server Status" },
396 { EDONKEY_MSG_UDP_SEARCH_FILE, "Search File" },
397 { EDONKEY_MSG_UDP_SEARCH_FILE_RESULTS, "Search File Results" },
398 { EDONKEY_MSG_UDP_GET_SOURCES, "Get Sources" },
399 { EDONKEY_MSG_UDP_FOUND_SOURCES, "Found Sources" },
400 { EDONKEY_MSG_UDP_CALLBACK_REQUEST, "Callback Request" },
401 { EDONKEY_MSG_UDP_CALLBACK_FAIL, "Callback Fail" },
402 { EDONKEY_MSG_UDP_SERVER_LIST, "Server List" },
403 { EDONKEY_MSG_UDP_GET_SERVER_INFO, "Get Server Info" },
404 { EDONKEY_MSG_UDP_SERVER_INFO, "Server Info" },
405 { EDONKEY_MSG_UDP_GET_SERVER_LIST, "Get Server List" },
406
407 /* eMule Extensions */
408 { EMULE_MSG_UDP_REASKFILEPING, "Reask File Ping" },
409 { EMULE_MSG_UDP_REASKACK, "Reask ACK" },
410 { EMULE_MSG_UDP_FILE_NOT_FOUND, "File not found" },
411 { EMULE_MSG_UDP_QUEUE_FULL, "Queue Full" },
412
413 /* Overnet Extensions */
414 { OVERNET_MSG_UDP_CONNECT, "Connect" },
415 { OVERNET_MSG_UDP_CONNECT_REPLY, "Connect Reply" },
416 { OVERNET_MSG_UDP_PUBLICIZE, "Publicize" },
417 { OVERNET_MSG_UDP_PUBLICIZE_ACK, "Publicize ACK" },
418 { OVERNET_MSG_UDP_SEARCH, "Search" },
419 { OVERNET_MSG_UDP_SEARCH_NEXT, "Search Next" },
420 { OVERNET_MSG_UDP_SEARCH_INFO, "Search Info" },
421 { OVERNET_MSG_UDP_SEARCH_RESULT, "Search Result" },
422 { OVERNET_MSG_UDP_SEARCH_END, "Search End" },
423 { OVERNET_MSG_UDP_PUBLISH, "Publish" },
424 { OVERNET_MSG_UDP_PUBLISH_ACK, "Publish ACK" },
425 { OVERNET_MSG_UDP_IDENTIFY_REPLY, "Identify Reply" },
426 { OVERNET_MSG_UDP_IDENTIFY_ACK, "Identify ACK" },
427 { OVERNET_MSG_UDP_FIREWALL_CONNECTION, "Firewall Connection" },
428 { OVERNET_MSG_UDP_FIREWALL_CONNECTION_ACK, "Firewall Connection ACK" },
429 { OVERNET_MSG_UDP_FIREWALL_CONNECTION_NACK, "Firewall Connection NACK" },
430 { OVERNET_MSG_UDP_IP_QUERY, "IP Query" },
431 { OVERNET_MSG_UDP_IP_QUERY_ANSWER, "IP Query Answer" },
432 { OVERNET_MSG_UDP_IP_QUERY_END, "IP Query End" },
433 { OVERNET_MSG_UDP_IDENTIFY, "Identify" },
434 { 0, NULL }
435 };
436
437 static const value_string edonkey_special_tags[] = {
438 { EDONKEY_STAG_NAME, "Name" },
439 { EDONKEY_STAG_SIZE, "Size" },
440 { EDONKEY_STAG_TYPE, "Type" },
441 { EDONKEY_STAG_FORMAT, "Format" },
442 { EDONKEY_STAG_COLLECTION, "Collection" },
443 { EDONKEY_STAG_PART_PATH, "Part Path" },
444 { EDONKEY_STAG_PART_HASH, "Part Hash" },
445 { EDONKEY_STAG_COPIED, "Copied" },
446 { EDONKEY_STAG_GAP_START, "Gap Start" },
447 { EDONKEY_STAG_GAP_END, "Gap End" },
448 { EDONKEY_STAG_DESCRIPTION, "Description" },
449 { EDONKEY_STAG_PING, "Ping" },
450 { EDONKEY_STAG_FAIL, "Fail" },
451 { EDONKEY_STAG_PREFERENCE, "Preference" },
452 { EDONKEY_STAG_PORT, "Port" },
453 { EDONKEY_STAG_IP, "IP" },
454 { EDONKEY_STAG_VERSION, "Version" },
455 { EDONKEY_STAG_TEMPFILE, "Temporary File" },
456 { EDONKEY_STAG_PRIORITY, "Priority" },
457 { EDONKEY_STAG_STATUS, "Status" },
458 { EDONKEY_STAG_AVAILABILITY, "Availability" },
459 { EDONKEY_STAG_QTIME, "Queue Time" },
460 { EDONKEY_STAG_PARTS, "Parts" },
461 { EDONKEY_STAG_MOD_VERSION, "Mod Version" },
462 { EMULE_STAG_COMPRESSION, "Compression" },
463 { EMULE_STAG_UDP_CLIENT_PORT, "UDP Client Port" },
464 { EMULE_STAG_UDP_VERSION, "UDP Version" },
465 { EMULE_STAG_SOURCE_EXCHANGE, "Source Exchange" },
466 { EMULE_STAG_COMMENTS, "Comments" },
467 { EMULE_STAG_EXTENDED_REQUEST, "Extended Request" },
468 { EMULE_STAG_COMPATIBLE_CLIENT, "Compatible Client" },
469 { EMULE_STAG_COMPLETE_SOURCES, "Complete Sources" },
470 { EMULE_STAG_SIZE_HI, "Size (High Byte)" },
471 { EMULE_STAG_SERVER_VERSION, "Server Version" },
472 { EMULE_STAG_COMPAT_OPTIONS1, "Compatible Options" },
473 { EMULE_STAG_UDPPORTS, "UDP Ports" },
474 { EMULE_STAG_MISCOPTIONS1, "Misc Options 1" },
475 { EMULE_STAG_VERSION, "eMule Version" },
476 { EMULE_STAG_BUDDYIP, "Buddy IP" },
477 { EMULE_STAG_BUDDYUDP, "Buddy UDP" },
478 { EMULE_STAG_MISCOPTIONS2, "Misc Options 2" },
479 { 0, NULL }
480 };
481
482 static const value_string edonkey_search_type_vals[] = {
483 { EDONKEY_SEARCH_BOOL, "Boolean" },
484 { EDONKEY_SEARCH_NAME, "Name" },
485 { EDONKEY_SEARCH_META, "Metadata" },
486 { EDONKEY_SEARCH_LIMIT, "Limit" },
487 { 0, NULL }
488 };
489
490 static const value_string edonkey_search_ext_type_vals[] = {
491 { 0, "BoolOp" },
492 { 1, "String" },
493 { 2, "MetaTag" },
494 { 3, "32bitOp" },
495 { 4, "64bitOp" },
496 { 0, NULL }
497 };
498
499 static const value_string edonkey_search_ops[] = {
500 { EDONKEY_SEARCH_AND, "AND" },
501 { EDONKEY_SEARCH_OR, "OR" },
502 { EDONKEY_SEARCH_ANDNOT, "AND NOT" },
503 { 0, NULL }
504 };
505
506 static const value_string edonkey_search_conds[] = {
507 { EDONKEY_SEARCH_MIN, "MIN" },
508 { EDONKEY_SEARCH_MAX, "MAX" },
509 { 0, NULL }
510 };
511
512 static const value_string kademlia_search_conds[] = {
513 { 0, "=" },
514 { 1, ">" },
515 { 2, "<" },
516 { 3, ">=" },
517 { 4, "<=" },
518 { 5, "<>" },
519 { 0, NULL }
520 };
521
522 static const value_string kademlia_versions[] = {
523 { KADEMLIA_VERSION1_46c, " (eMule <= 0.46c or compatibles)" },
524 { KADEMLIA_VERSION2_47a, " (eMule 0.47a or compatibles)" },
525 { KADEMLIA_VERSION3_47b, " (eMule 0.47b or compatibles)" },
526 { KADEMLIA_VERSION5_48a, " (eMule 0.48a or compatibles)" },
527 { KADEMLIA_VERSION6_49aBETA, " (eMule 0.49aBETA1 or compatibles)" },
528 { KADEMLIA_VERSION7_49a, " (eMule 0.49a or compatibles)" },
529 { 0, NULL }
530 };
531
532 static const value_string kademlia_parameter[] = {
533 { KADEMLIA_FIND_VALUE, " (Find Value)" },
534 { KADEMLIA_STORE, " (Store)" },
535 { KADEMLIA_FIND_NODE, " (Find Node)" },
536 { 0, NULL }
537 };
538
539 static const value_string kademlia_tag_sourcetype[] = {
540 { 1, "HighID Source" },
541 { 3, "Firewalled Kad Source" },
542 { 4, ">4GB file HighID Source" },
543 { 5, ">4GB file Firewalled Kad Source" },
544 { 6, "Firewalled Source with Direct Callback (supports >4GB)" },
545 { 0, NULL }
546 };
547
548 static const value_string kademlia_tag_encryption[] = {
549 { 1, "Supports Crypt Layer" },
550 { 2, "Requests Crypt Layer" },
551 { 3, "Supports & Requests Crypt Layer" },
552 { 4, "Requires Crypt Layer" },
553 { 5, "Supports & Requires Crypt Layer" },
554 { 6, "Requests & Requires Crypt Layer" },
555 { 7, "Supports, Requests & Requires Crypt Layer" },
556 { 8, "Direct UDP Callback" },
557 { 9, "Supports Crypt Layer; Direct UDP Callback" },
558 { 10, "Requests Crypt Layer; Direct UDP Callback" },
559 { 11, "Supports & Requests Crypt Layer; Direct UDP Callback" },
560 { 12, "Requires Crypt Layer; Direct UDP Callback" },
561 { 13, "Supports & Requires Crypt Layer; Direct UDP Callback" },
562 { 14, "Requests & Requires Crypt Layer; Direct UDP Callback" },
563 { 15, "Supports, Requests & Requires Crypt Layer; Direct UDP Callback" },
564 { 0, NULL }
565 };
566
567 static const range_string emule_ident_state_rvals[] = {
568 { 0, 0, "nothing is needed" },
569 { 1, 1, "signature is needed" },
570 { 2, 255, "public key and signature are needed" },
571 { 0, 0, NULL }
572 };
573
574 /* Dissects a generic eDonkey list */
575 static int dissect_edonkey_list(tvbuff_t *tvb, packet_info *pinfo,
576 int offset, proto_tree *tree,
577 int listnum_length, const char* listdesc,
578 int (*item_dissector)(tvbuff_t *, packet_info *, int, proto_tree *))
579 {
580 /* <List> ::= <List Size> <Item>* */
581 uint32_t listnum, i;
582 proto_tree *subtree;
583 proto_item* ti;
584 proto_item* list_ti;
585 int list_start_offset;
586
587 list_start_offset = offset;
588
589 switch (listnum_length) {
590 case -1:
591 case 1:
592 listnum = tvb_get_uint8(tvb, offset);
593 break;
594
595 case -2:
596 listnum = tvb_get_ntohs(tvb, offset);
597 break;
598
599 case 2:
600 listnum = tvb_get_letohs(tvb, offset);
601 break;
602
603 case 4:
604 listnum = tvb_get_letohl(tvb, offset);
605 break;
606
607 case -4:
608 listnum = tvb_get_ntohl(tvb, offset);
609 break;
610
611 default:
612 /* Not Supported */
613 return offset;
614 }
615 if (listnum_length < 0)
616 listnum_length = -listnum_length;
617
618 /* keep the tree item object, its length will be set at the end of the function */
619 list_ti = proto_tree_add_uint_format(tree, hf_edonkey_list_size, tvb, offset, listnum_length, listnum, "%s List Size: %u", listdesc, listnum);
620
621 offset+= listnum_length;
622
623 for (i=0; i<listnum; i++)
624 {
625 int item_start_offset;
626
627 item_start_offset = offset;
628 subtree = proto_tree_add_subtree_format( tree, tvb, item_start_offset, 1, ett_edonkey_listitem, &ti,
629 "%s[%u/%u]", listdesc, i+1, listnum);
630
631 /* dissect one list element */
632 offset = (*item_dissector)(tvb, pinfo, offset, subtree);
633 /* Set the container node length */
634 proto_item_set_len( ti, offset - item_start_offset );
635 }
636
637 /* Set the container node length */
638 proto_item_set_len(list_ti, offset - list_start_offset );
639 return offset;
640 }
641
642 static int lookup_str_index(char* str, int length, const value_string *vs)
643 {
644 int i = 0;
645
646 if (str == NULL) return -1;
647
648 while (vs[i].strptr) {
649 if (g_ascii_strncasecmp(str, vs[i].strptr, length) == 0)
650 return i;
651 i++;
652 }
653
654 return -1;
655 }
656
657 static uint8_t edonkey_metatag_name_get_type(tvbuff_t *tvb, int start, int length, uint8_t special_tagtype)
658 {
659 uint8_t *tag_name;
660
661 if (try_val_to_str(special_tagtype, edonkey_special_tags) == NULL) {
662 int idx;
663 tag_name = tvb_get_string_enc(wmem_packet_scope(), tvb, start, length, ENC_ASCII|ENC_NA);
664 idx = lookup_str_index(tag_name, length, edonkey_special_tags);
665 if (idx < 0)
666 return EDONKEY_STAG_UNKNOWN;
667 else return edonkey_special_tags[idx].value;
668 }
669 else return special_tagtype;
670
671 }
672
673 static proto_item* edonkey_tree_add_metatag_name(proto_tree *tree, tvbuff_t *tvb,
674 int start, int length, uint8_t special_tagtype)
675 {
676 const char *tag_name;
677
678 /*
679 * XXX - what, in the *protocol*, distinguishes integral from string
680 * tag names? Name length > 1 means "string"? Something else?
681 */
682 tag_name = try_val_to_str(special_tagtype, edonkey_special_tags);
683 if (tag_name == NULL) {
684 return proto_tree_add_item(tree, hf_edonkey_metatag_name, tvb, start, length, ENC_ASCII);
685 }
686 else {
687 return proto_tree_add_uint_format(tree, hf_edonkey_metatag_id, tvb, start, length,
688 special_tagtype, "Meta Tag Name: %s (0x%02x)",
689 tag_name, special_tagtype);
690 }
691 }
692
693 static int dissect_kademlia_search_condition_argument_uint64(tvbuff_t *tvb, packet_info *pinfo _U_,
694 int offset, proto_tree *tree)
695 {
696 proto_tree_add_item( tree, hf_kademlia_search_condition_argument_uint64, tvb, offset, 8, ENC_LITTLE_ENDIAN );
697 return offset + 8;
698 }
699
700 static int dissect_kademlia_search_condition_argument_uint32(tvbuff_t *tvb, packet_info *pinfo _U_,
701 int offset, proto_tree *tree)
702 {
703 proto_tree_add_item( tree, hf_kademlia_search_condition_argument_uint32, tvb, offset, 4, ENC_LITTLE_ENDIAN );
704 return offset + 4;
705 }
706
707 static int dissect_kademlia_search_condition(tvbuff_t *tvb, packet_info *pinfo _U_,
708 int offset, proto_tree *tree )
709 {
710 proto_item * ti;
711 uint16_t value = tvb_get_uint8(tvb, offset);
712 ti = proto_tree_add_item( tree, hf_kademlia_search_condition, tvb, offset, 1, ENC_BIG_ENDIAN );
713 proto_item_append_text(ti, " [%s]", val_to_str_const( value, kademlia_search_conds, "Unknown") );
714
715 return offset + 1;
716 }
717
718 /* Dissects the eDonkey meta tag */
719 static int dissect_edonkey_metatag(tvbuff_t *tvb, packet_info *pinfo _U_,
720 int offset, proto_tree *tree)
721 {
722 /* <Meta Tag> ::= <Tag Type (uint8_t)> <Tag Name> <Tag> */
723 /* <Tag Name> ::= <Tag Name Size (uint16_t)> <Special Tag> || <String> */
724 /* <Tag Name> ::= <Special Tag> iff Tag Type had the top bit set */
725 proto_item *ti;
726 proto_tree *metatag_tree;
727 uint8_t real_tag_type, tag_type, special_tagtype, trans_tagtype;
728 uint16_t tag_name_size, string_length, array_length;
729 uint32_t tag_length, blob_length;
730 int tag_offset;
731
732 real_tag_type = tag_type = tvb_get_uint8(tvb, offset);
733 if (tag_type & EDONKEY_MTAG_SHORTNAME) {
734 real_tag_type &= ~EDONKEY_MTAG_SHORTNAME;
735 tag_name_size = 1;
736 special_tagtype = tvb_get_uint8(tvb, offset+1);
737 tag_length = 2;
738 } else {
739 tag_name_size = tvb_get_letohs(tvb, offset+1);
740 special_tagtype = tvb_get_uint8(tvb, offset+3);
741 tag_length = 3 + tag_name_size;
742 }
743
744 tag_offset = offset + tag_length;
745
746 switch (real_tag_type)
747 {
748 case EDONKEY_MTAG_HASH:
749 /* <Tag> ::= HASH */
750 tag_length += 16;
751 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
752 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
753 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
754 if (tag_type==real_tag_type)
755 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
756 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
757 proto_tree_add_item(metatag_tree, hf_edonkey_hash, tvb, tag_offset, 16, ENC_NA);
758 break;
759
760 case EDONKEY_MTAG_STRING:
761 /* <Tag> ::= <Length (uint16_t)> <String> */
762 string_length = tvb_get_letohs(tvb, tag_offset);
763 tag_length += 2+string_length;
764 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
765 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
766 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
767 if (tag_type==real_tag_type)
768 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
769 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
770 proto_tree_add_uint(metatag_tree, hf_edonkey_string_length, tvb, tag_offset, 2, string_length);
771 proto_tree_add_item(metatag_tree, hf_edonkey_string, tvb, tag_offset+2, string_length, ENC_ASCII);
772 break;
773
774 case EDONKEY_MTAG_DWORD:
775 /* <Tag> ::= uint32_t */
776 tag_length += 4;
777 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
778 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
779 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
780 if (tag_type==real_tag_type)
781 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
782 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
783 trans_tagtype = edonkey_metatag_name_get_type(tvb, offset+3, tag_name_size, special_tagtype);
784 if (trans_tagtype == EDONKEY_STAG_IP) {
785 proto_tree_add_item(metatag_tree, hf_edonkey_ip, tvb, tag_offset, 4, ENC_BIG_ENDIAN);
786 }
787 else if (trans_tagtype == EMULE_STAG_SERVER_VERSION) {
788 proto_tree_add_item(metatag_tree, hf_edonkey_meta_tag_value_revision, tvb, tag_offset, 4, ENC_LITTLE_ENDIAN);
789 }
790 else {
791 proto_tree_add_item(metatag_tree, hf_edonkey_meta_tag_value_uint, tvb, tag_offset, 4, ENC_LITTLE_ENDIAN);
792 }
793 break;
794
795 case EDONKEY_MTAG_FLOAT:
796 /* <Tag> ::= 4 byte float */
797 tag_length += 4;
798 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
799 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
800 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
801 if (tag_type==real_tag_type)
802 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
803 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
804 break;
805
806 case EDONKEY_MTAG_WORD:
807 /* <Tag> ::= uint16_t */
808 tag_length += 2;
809 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
810 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
811 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
812 if (tag_type==real_tag_type)
813 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
814 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
815
816 proto_tree_add_item(metatag_tree, hf_edonkey_meta_tag_value_uint, tvb, tag_offset, 2, ENC_LITTLE_ENDIAN);
817 break;
818
819 case EDONKEY_MTAG_BYTE:
820 /* <Tag> ::= uint8_t */
821 tag_length += 1;
822 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
823 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
824 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
825 if (tag_type==real_tag_type)
826 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
827 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
828 proto_tree_add_item(metatag_tree, hf_edonkey_meta_tag_value_uint, tvb, tag_offset, 1, ENC_NA);
829 break;
830
831 case EDONKEY_MTAG_BOOL:
832 /* <Tag> ::= <Bool (uint8_t)> */
833 tag_length += 1;
834 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
835 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
836 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
837 if (tag_type==real_tag_type)
838 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
839 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
840 proto_tree_add_item(metatag_tree, hf_edonkey_meta_tag_value_uint, tvb, tag_offset, 1, ENC_NA);
841 break;
842
843 case EDONKEY_MTAG_BOOL_ARRAY:
844 /* <Tag> ::= <Length (uint16_t)> <BoolArray> */
845 array_length = tvb_get_letohs(tvb, tag_offset);
846 /*
847 * This is allegedly what the protocol uses, rather than the
848 * correct value of (array_length+7)/8
849 * Therefore an extra unused byte is transmitted if the array
850 * is a multiple of 8 longs.
851 */
852 tag_length += 2+(array_length/8)+1;
853 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
854 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
855 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
856 if (tag_type==real_tag_type)
857 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
858 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
859 proto_tree_add_item(metatag_tree, hf_edonkey_boolean_array_length, tvb, tag_offset, 2, ENC_LITTLE_ENDIAN);
860 break;
861
862 case EDONKEY_MTAG_BLOB:
863 /* <Tag> ::= <Length (uint32_t)> <BLOB> */
864 blob_length = tvb_get_letohl(tvb, tag_offset);
865 tag_length += 4+blob_length;
866 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
867 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
868 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
869 if (tag_type==real_tag_type)
870 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
871 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
872 proto_tree_add_item(metatag_tree, hf_edonkey_blob_length, tvb, tag_offset, 2, ENC_LITTLE_ENDIAN);
873 break;
874
875 case EDONKEY_MTAG_BSOB:
876 /* This is possibly a Binary Small OBject, like a BLOB but with an 8 or 16-bit length field */
877 /* That's a complete guess though, so don't handle it yet. */
878 case EDONKEY_MTAG_UNKNOWN:
879 default:
880 if (real_tag_type>=EDONKEY_MTAG_STR1 && real_tag_type<=EDONKEY_MTAG_STR16) {
881 /* <Tag> ::= <String> */
882 string_length = real_tag_type-EDONKEY_MTAG_STR1+1;
883 tag_length += string_length;
884 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
885 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
886 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type);
887 if (real_tag_type==tag_type)
888 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
889 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
890 proto_tree_add_item(metatag_tree, hf_edonkey_string, tvb, tag_offset, string_length, ENC_ASCII);
891
892 } else {
893 /* Unknown tag type - actual tag length is also unknown */
894 ti = proto_tree_add_item(tree, hf_edonkey_metatag, tvb, offset, tag_length, ENC_NA);
895 metatag_tree = proto_item_add_subtree(ti, ett_edonkey_metatag);
896 proto_tree_add_uint_format(metatag_tree, hf_edonkey_metatag_type, tvb, offset, 1, tag_type, "Unknown Meta Tag Type (0x%02x)", tag_type);
897 if (real_tag_type==tag_type)
898 proto_tree_add_uint(metatag_tree, hf_edonkey_metatag_namesize, tvb, offset+1, 2, tag_name_size);
899 edonkey_tree_add_metatag_name(metatag_tree, tvb, tag_offset-tag_name_size, tag_name_size, special_tagtype);
900 }
901 break;
902
903 }
904
905 return offset + tag_length;
906 }
907
908 /* Dissects the eDonkey address */
909 static int dissect_edonkey_address(tvbuff_t *tvb, packet_info *pinfo _U_,
910 int offset, proto_tree *tree)
911 {
912 /* <Address> ::= <IP> <Port> */
913 /* uint32_t ip = tvb_get_letohl(tvb, offset);
914 proto_tree_add_ipv4(tree, hf_edonkey_ip, tvb, offset, 4, ip); */
915 proto_tree_add_item(tree, hf_edonkey_ip, tvb, offset, 4, ENC_BIG_ENDIAN);
916 proto_tree_add_item(tree, hf_edonkey_port, tvb, offset+4, 2, ENC_LITTLE_ENDIAN);
917 return offset+6;
918 }
919
920
921 static int dissect_kademlia_udp_port(tvbuff_t *tvb, packet_info *pinfo _U_,
922 int offset, proto_tree *tree)
923 {
924 proto_tree_add_item(tree, hf_kademlia_udp_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
925 return offset +2;
926 }
927
928 static int dissect_kademlia_tcp_port(tvbuff_t *tvb, packet_info *pinfo _U_,
929 int offset, proto_tree *tree)
930 {
931 proto_tree_add_item(tree, hf_kademlia_tcp_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
932 return offset +2;
933 }
934
935
936 static int dissect_kademlia_ip_address(tvbuff_t *tvb, packet_info *pinfo _U_,
937 int offset, proto_tree *tree)
938 {
939 proto_tree_add_item(tree, hf_kademlia_ip, tvb, offset, 4, ENC_LITTLE_ENDIAN);
940 return offset + 4;
941 }
942
943
944 static int dissect_kademlia_address(tvbuff_t *tvb, packet_info *pinfo,
945 int offset, proto_tree *tree)
946 {
947 /* <Address> ::= <IP> <Port> <Tcp Port>*/
948 offset = dissect_kademlia_ip_address( tvb, pinfo, offset, tree );
949
950 offset = dissect_kademlia_udp_port( tvb, pinfo, offset, tree );
951
952 offset = dissect_kademlia_tcp_port( tvb, pinfo, offset, tree );
953
954 return offset;
955 }
956
957 static int dissect_kademlia_tagname(tvbuff_t *tvb, packet_info *pinfo,
958 int offset, proto_tree *tree, const char** outputTagName, const char** outputExtendedTagName)
959 {
960 /* <String> ::= <String length (uint16_t)> DATA */
961 const char * tagname;
962 const char * tag_full_name = NULL;
963 uint8_t tagname_value;
964 proto_item *ti, *hidden_item;
965
966 uint16_t string_length = tvb_get_letohs(tvb, offset);
967
968 proto_tree_add_uint(tree, hf_kademlia_tag_name_length, tvb, offset, 2, string_length);
969
970 hidden_item = proto_tree_add_uint(tree, hf_edonkey_string_length, tvb, offset, 2, string_length);
971 proto_item_set_hidden(hidden_item);
972
973 tagname = tvb_get_string_enc(pinfo->pool, tvb, offset + 2, string_length, ENC_ASCII|ENC_NA);
974
975 tag_full_name = "UnknownTagName";
976
977 if ( tagname && string_length == 1 ) {
978 tagname_value = *(const uint8_t*)tagname;
979 /* lookup tagname */
980 tag_full_name = val_to_str_const( tagname_value, kademlia_tags, tag_full_name );
981 }
982
983 ti = proto_tree_add_item(tree, hf_kademlia_tag_name, tvb, offset + 2, string_length, ENC_BIG_ENDIAN);
984 proto_item_append_text(ti, " [%s]", tag_full_name);
985
986 if (outputTagName)
987 *outputTagName = tagname;
988
989 if (outputExtendedTagName)
990 *outputExtendedTagName = tag_full_name;
991
992 return offset+2+string_length;
993 }
994
995 static int dissect_kademlia_string(tvbuff_t *tvb, packet_info *pinfo _U_,
996 int offset, proto_tree *tree)
997 {
998 /* <String> ::= <String length (uint16_t)> DATA */
999 uint16_t string_length = tvb_get_letohs(tvb, offset);
1000
1001 proto_tree_add_uint(tree, hf_edonkey_string_length, tvb, offset, 2, string_length);
1002
1003 /* TODO: ASCII or UTF-8? */
1004 proto_tree_add_item(tree, hf_edonkey_kademlia_string, tvb, offset+2, string_length, ENC_ASCII);
1005
1006 return offset+2+string_length;
1007 }
1008
1009 /* Dissects the eDonkey address list */
1010 static int dissect_edonkey_address_list(tvbuff_t *tvb, packet_info *pinfo,
1011 int offset, proto_tree *tree)
1012 {
1013 /* <Address List> ::= <List Size (uint8_t)> <Address>* */
1014 return dissect_edonkey_list(tvb, pinfo, offset, tree, 1, "Address", dissect_edonkey_address);
1015 }
1016
1017 /* Dissects the eDonkey hash */
1018 static int dissect_edonkey_hash(tvbuff_t *tvb, packet_info *pinfo _U_,
1019 int offset, proto_tree *tree)
1020 {
1021 /* <hash> ::= HASH (16 word MD4 digest) */
1022 proto_tree_add_item(tree, hf_edonkey_hash, tvb, offset, 16, ENC_NA);
1023 return offset+16;
1024 }
1025
1026 /* Dissects the eDonkey file hash */
1027 static int dissect_edonkey_file_hash(tvbuff_t *tvb, packet_info *pinfo _U_,
1028 int offset, proto_tree *tree)
1029 {
1030 /* <File hash> ::= HASH (16 word MD4 digest) */
1031 proto_tree_add_item(tree, hf_edonkey_file_hash, tvb, offset, 16, ENC_NA);
1032 return offset+16;
1033 }
1034
1035 /* Dissects the eMule public key */
1036 static int dissect_edonkey_public_key(tvbuff_t *tvb, packet_info *pinfo _U_,
1037 int offset, proto_tree *tree)
1038 {
1039 uint8_t length = tvb_get_uint8(tvb, offset);
1040 proto_tree_add_item(tree, hf_emule_public_key_length, tvb, offset, 1, ENC_NA);
1041 offset++;
1042 proto_tree_add_item(tree, hf_emule_public_key, tvb, offset, length, ENC_NA);
1043 return offset + length;
1044 }
1045
1046 /* Dissects the eMule signature */
1047 static int dissect_edonkey_signature(tvbuff_t *tvb, packet_info *pinfo _U_,
1048 int offset, proto_tree *tree)
1049 {
1050 uint8_t length = tvb_get_uint8(tvb, offset);
1051 proto_tree_add_item(tree, hf_emule_signature_length, tvb, offset, 1, ENC_NA);
1052 offset++;
1053 proto_tree_add_item(tree, hf_emule_signature, tvb, offset, length, ENC_NA);
1054 return offset + length;
1055 }
1056
1057 static const char *kademlia_hash(wmem_allocator_t *scope, tvbuff_t *tvb, int offset) {
1058 uint32_t hash[4];
1059 int i;
1060
1061 for (i = 0; i < 4; i++)
1062 hash[i] = tvb_get_letohl(tvb, offset + i*4);
1063
1064 return wmem_strdup_printf(scope,
1065 "%08X%08X%08X%08X", hash[0], hash[1], hash[2], hash[3]);
1066 }
1067
1068 static int dissect_kademlia_hash_hidden(tvbuff_t *tvb, packet_info *pinfo,
1069 int offset, proto_tree *tree) {
1070 proto_item *hidden_item;
1071 const char *hash;
1072
1073 hash = kademlia_hash(pinfo->pool, tvb, offset);
1074
1075 /* <File hash> ::= HASH (16 word MD4 digest) */
1076 hidden_item = proto_tree_add_string(tree, hf_kademlia_hash, tvb, offset, 16, hash);
1077 proto_item_set_hidden(hidden_item);
1078
1079 return offset+16;
1080 }
1081
1082 /* Dissects the Kademlia hash*/
1083 static int dissect_kademlia_hash(tvbuff_t *tvb, packet_info *pinfo,
1084 int offset, proto_tree *tree, int *value_ptr) {
1085 const char *hash;
1086
1087 hash = kademlia_hash(pinfo->pool, tvb, offset);
1088
1089 /* <File hash> ::= HASH (16 word MD4 digest) */
1090 proto_tree_add_string(tree, *value_ptr, tvb, offset, 16, hash);
1091
1092 return dissect_kademlia_hash_hidden(tvb, pinfo, offset, tree);
1093 }
1094
1095 static int dissect_kademlia_tag_hash_hidden(tvbuff_t *tvb, packet_info *pinfo,
1096 int offset, proto_tree *tree) {
1097 proto_item *hidden_item;
1098 const char *hash;
1099
1100 hash = kademlia_hash(pinfo->pool, tvb, offset);
1101
1102 /* <File hash> ::= HASH (16 word MD4 digest) */
1103 hidden_item = proto_tree_add_string(tree, hf_kademlia_tag_hash, tvb, offset, 16, hash);
1104 proto_item_set_hidden(hidden_item);
1105
1106 return offset+16;
1107 }
1108
1109 static int dissect_kademlia_tag_hash(tvbuff_t *tvb, packet_info *pinfo,
1110 int offset, proto_tree *tree) {
1111 const char *hash;
1112
1113 hash = kademlia_hash(pinfo->pool, tvb, offset);
1114
1115 /* <File hash> ::= HASH (16 word MD4 digest) */
1116 proto_tree_add_string(tree, hf_kademlia_hash, tvb, offset, 16, hash);
1117 return dissect_kademlia_tag_hash_hidden( tvb, pinfo, offset, tree );
1118 }
1119
1120 static int dissect_kademlia_tag_bsob(tvbuff_t *tvb, packet_info *pinfo,
1121 int offset, proto_tree *tree, const char** string_value )
1122 {
1123 uint16_t bsob_length;
1124
1125 bsob_length = tvb_get_uint8(tvb, offset);
1126 *string_value = tvb_bytes_to_str(pinfo->pool, tvb, offset + 1, bsob_length );
1127
1128 proto_tree_add_item(tree, hf_kademlia_tag_bsob, tvb, offset + 1, bsob_length, ENC_NA);
1129 return offset + 1 + bsob_length;
1130 }
1131
1132
1133 static int dissect_kademlia_tag_string(tvbuff_t *tvb, packet_info *pinfo,
1134 int offset, proto_tree *tree, const uint8_t** string_value)
1135 {
1136 proto_item *hidden_item;
1137 uint16_t string_length = tvb_get_letohs(tvb, offset);
1138
1139 hidden_item = proto_tree_add_uint(tree, hf_edonkey_string_length, tvb, offset, 2, string_length);
1140 proto_item_set_hidden(hidden_item);
1141 hidden_item = proto_tree_add_item_ret_string(tree, hf_edonkey_string, tvb, offset + 2, string_length, ENC_ASCII|ENC_NA, pinfo->pool, string_value);
1142 proto_item_set_hidden(hidden_item);
1143
1144 proto_tree_add_item(tree, hf_kademlia_tag_string, tvb, offset + 2, string_length, ENC_ASCII);
1145 return offset + 2 + string_length;
1146 }
1147
1148 /* Dissects the eDonkey hash list */
1149 static int dissect_edonkey_hash_list(tvbuff_t *tvb, packet_info *pinfo,
1150 int offset, proto_tree *tree)
1151 {
1152 /* <Hash List> ::= <File Hash> <List Size (uint16_t)> <Hash>* */
1153 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1154 return dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Hash", dissect_edonkey_hash);
1155 }
1156
1157 /* Dissects the eDonkey meta tag list */
1158 static int dissect_edonkey_metatag_list(tvbuff_t *tvb, packet_info *pinfo,
1159 int offset, proto_tree *tree)
1160 {
1161 /* <Meta Tag List> ::= <List Size (uint32_t)> <Meta tag>* */
1162 return dissect_edonkey_list(tvb, pinfo, offset, tree, 4, "Meta Tag", dissect_edonkey_metatag);
1163 }
1164
1165 /* Dissects the eDonkey String */
1166 static int dissect_edonkey_string(tvbuff_t *tvb, packet_info *pinfo _U_,
1167 int offset, proto_tree *tree)
1168 {
1169 /* <String> ::= <String length (uint16_t)> DATA */
1170 uint16_t string_length = tvb_get_letohs(tvb, offset);
1171 proto_tree_add_uint(tree, hf_edonkey_string_length, tvb, offset, 2, string_length);
1172 proto_tree_add_item(tree, hf_edonkey_string, tvb, offset+2, string_length, ENC_ASCII);
1173 return offset+2+string_length;
1174 }
1175
1176 /* Dissects the eDonkey Directory */
1177 static int dissect_edonkey_directory(tvbuff_t *tvb, packet_info *pinfo _U_,
1178 int offset, proto_tree *tree)
1179 {
1180 /* <Directory> ::= <String> */
1181 uint16_t string_length = tvb_get_letohs(tvb, offset);
1182 proto_tree_add_uint(tree, hf_edonkey_string_length, tvb, offset, 2, string_length);
1183 proto_tree_add_item(tree, hf_edonkey_directory, tvb, offset+2, string_length, ENC_ASCII);
1184 return offset+2+string_length;
1185 }
1186
1187 /* Dissects the eDonkey Filename */
1188 static int dissect_edonkey_file_name(tvbuff_t *tvb, packet_info *pinfo,
1189 int offset, proto_tree *tree)
1190 {
1191 /* <Filename> ::= <String> */
1192 return dissect_edonkey_string(tvb, pinfo, offset, tree);
1193 }
1194
1195 /* Dissects the eDonkey File Status */
1196 static int dissect_edonkey_file_status(tvbuff_t *tvb, packet_info *pinfo _U_,
1197 int offset, proto_tree *tree)
1198 {
1199 uint16_t partcount, arrlen;
1200
1201 /* <File Status> ::= <Part Count> <Part Status> */
1202 partcount = tvb_get_letohs(tvb, offset);
1203 arrlen = (partcount+7)/8;
1204
1205 proto_tree_add_uint(tree, hf_edonkey_part_count, tvb, offset, 2, partcount);
1206 if (partcount>0) {
1207 proto_tree_add_item(tree, hf_edonkey_file_status, tvb, offset+2, arrlen, ENC_NA);
1208 }
1209 return offset+2+arrlen;
1210 }
1211
1212
1213 /* Dissects the eDonkey directory list */
1214 static int dissect_edonkey_directory_list(tvbuff_t *tvb, packet_info *pinfo,
1215 int offset, proto_tree *tree)
1216 {
1217 /* <Directory List> ::= <List Size (uint32_t)> <Directory>* */
1218 return dissect_edonkey_list(tvb, pinfo, offset, tree, 4, "Directory", dissect_edonkey_directory);
1219 }
1220
1221 /* Dissects the eDonkey server hash */
1222 static int dissect_edonkey_server_hash(tvbuff_t *tvb, packet_info *pinfo _U_,
1223 int offset, proto_tree *tree)
1224 {
1225 /* <Server hash> ::= HASH (16 word MD4 digest) */
1226 proto_tree_add_item(tree, hf_edonkey_server_hash, tvb, offset, 16, ENC_NA);
1227 return offset+16;
1228 }
1229
1230 /* Dissects the eDonkey client hash */
1231 static int dissect_edonkey_client_hash(tvbuff_t *tvb, packet_info *pinfo _U_,
1232 int offset, proto_tree *tree)
1233 {
1234 /* <Client hash> ::= HASH (16 word MD4 digest) */
1235 proto_tree_add_item(tree, hf_edonkey_client_hash, tvb, offset, 16, ENC_NA);
1236 return offset+16;
1237 }
1238
1239 /* Dissects the eMule sourceOBFU */
1240 static int dissect_emule_sourceOBFU(tvbuff_t *tvb, packet_info *pinfo,
1241 int offset, proto_tree *tree)
1242 {
1243
1244 proto_item *ti;
1245 proto_tree *sourceOBFU_tree;
1246 uint8_t settings = tvb_get_uint8(tvb, offset+6);
1247 /* Add subtree for client info */
1248 ti = proto_tree_add_item(tree, hf_emule_sourceOBFU, tvb, offset, 7 + ((settings & 0x80) ? 16 : 0), ENC_NA);
1249 sourceOBFU_tree = proto_item_add_subtree(ti, ett_emule_sourceOBFU);
1250
1251 proto_tree_add_item(sourceOBFU_tree, hf_edonkey_ip, tvb, offset, 4, ENC_BIG_ENDIAN);
1252 proto_tree_add_item(sourceOBFU_tree, hf_edonkey_port, tvb, offset+4, 2, ENC_LITTLE_ENDIAN);
1253 proto_tree_add_item(sourceOBFU_tree, hf_edonkey_obfuscation_settings, tvb, offset+6, 1, ENC_NA);
1254 offset += 7;
1255 if (settings & 0x80)
1256 offset = dissect_edonkey_client_hash(tvb, pinfo, offset, sourceOBFU_tree);
1257 return offset;
1258 }
1259
1260
1261 /* Dissects the eMule sourceOBFU list */
1262 static int dissect_emule_sourceOBFU_list(tvbuff_t *tvb, packet_info *pinfo,
1263 int offset, proto_tree *tree)
1264 {
1265 return dissect_edonkey_list(tvb, pinfo, offset, tree, 1, "Sources Obfuscation", dissect_emule_sourceOBFU);
1266 }
1267
1268
1269 /* Dissects the eDonkey client ID */
1270 static int dissect_edonkey_client_id(tvbuff_t *tvb, packet_info *pinfo _U_,
1271 int offset, proto_tree *tree, bool fileinfo)
1272 {
1273 proto_item *ti;
1274 /* <Client ID> ::= uint32_t */
1275 /* uint32_t ip = tvb_get_letohl(tvb, offset);
1276 proto_tree_add_ipv4(tree, hf_edonkey_client_id, tvb, offset, 4, ip); */
1277 ti = proto_tree_add_item(tree, hf_edonkey_client_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1278 if (fileinfo) {
1279 uint32_t ip = tvb_get_letohl(tvb, offset);
1280 uint16_t port = tvb_get_letohs(tvb, offset+4);
1281 if (ip==0xfcfcfcfc && port==0xfcfc) {
1282 proto_item_append_text(ti, " (myself, incomplete file)");
1283 } else if (ip==0xfbfbfbfb && port==0xfbfb) {
1284 proto_item_append_text(ti, " (myself, complete file)");
1285 }
1286 }
1287 return offset+4;
1288 }
1289
1290 /* Dissects the eDonkey port */
1291 static int dissect_edonkey_port(tvbuff_t *tvb, packet_info *pinfo _U_,
1292 int offset, proto_tree *tree)
1293 {
1294 /* <Port> ::= uint16_t */
1295 proto_tree_add_item(tree, hf_edonkey_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1296 return offset+2;
1297 }
1298
1299 /* Dissects the eDonkey start offset */
1300 static int dissect_edonkey_start_offset(tvbuff_t *tvb, packet_info *pinfo _U_,
1301 int offset, proto_tree *tree)
1302 {
1303 /* <Start Offset> ::= uint32_t */
1304 proto_tree_add_item(tree, hf_edonkey_start_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1305 return offset+4;
1306 }
1307
1308 static int dissect_edonkey_start_offset_64(tvbuff_t *tvb, packet_info *pinfo _U_,
1309 int offset, proto_tree *tree)
1310 {
1311 /* <Start Offset> ::= uint64_t */
1312 proto_tree_add_item(tree, hf_edonkey_start_offset_64, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1313 return offset+8;
1314 }
1315
1316 /* Dissects the eDonkey end offset */
1317 static int dissect_edonkey_end_offset(tvbuff_t *tvb, packet_info *pinfo _U_,
1318 int offset, proto_tree *tree)
1319 {
1320 /* <End Offset> ::= uint32_t */
1321 proto_tree_add_item(tree, hf_edonkey_end_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1322 return offset+4;
1323 }
1324
1325 static int dissect_edonkey_end_offset_64(tvbuff_t *tvb, packet_info *pinfo _U_,
1326 int offset, proto_tree *tree)
1327 {
1328 /* <End Offset> ::= uint64_t */
1329 proto_tree_add_item(tree, hf_edonkey_end_offset_64, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1330 return offset+8;
1331 }
1332
1333 /* Dissects the eDonkey client info */
1334 static int dissect_edonkey_client_info(tvbuff_t *tvb, packet_info *pinfo,
1335 int offset, proto_tree *tree)
1336 {
1337 /* <Client info> ::= <Client hash> <Client ID> <Port> <Meta tag list> */
1338 proto_item *ti;
1339 proto_tree *clientinfo_tree;
1340 /* Add subtree for client info */
1341 ti = proto_tree_add_item(tree, hf_edonkey_clientinfo, tvb, offset, 0, ENC_NA);
1342 clientinfo_tree = proto_item_add_subtree(ti, ett_edonkey_clientinfo);
1343 offset = dissect_edonkey_client_hash(tvb, pinfo, offset, clientinfo_tree);
1344 offset = dissect_edonkey_client_id(tvb, pinfo, offset, clientinfo_tree, false);
1345 offset = dissect_edonkey_port(tvb, pinfo, offset, clientinfo_tree);
1346 offset = dissect_edonkey_metatag_list(tvb, pinfo, offset, clientinfo_tree);
1347 return offset;
1348 }
1349
1350 /* Dissects the eDonkey client info list */
1351 static int dissect_edonkey_client_info_list(tvbuff_t *tvb, packet_info *pinfo,
1352 int offset, proto_tree *tree)
1353 {
1354 /* <Client Info List> ::= <List Size (uint32_t)> <Client Info>* */
1355 return dissect_edonkey_list(tvb, pinfo, offset, tree, 4, "Client Info", dissect_edonkey_client_info);
1356 }
1357
1358 /* Dissects the eDonkey server info */
1359 static int dissect_edonkey_server_info(tvbuff_t *tvb, packet_info *pinfo,
1360 int offset, proto_tree *tree)
1361 {
1362 /* <Server info> ::= <Server hash> <Server Address> <Meta tag list> */
1363 proto_item *ti;
1364 proto_tree *serverinfo_tree;
1365 /* Add subtree for server info */
1366 ti = proto_tree_add_item(tree, hf_edonkey_serverinfo, tvb, offset, 0, ENC_NA);
1367 serverinfo_tree = proto_item_add_subtree(ti, ett_edonkey_serverinfo);
1368 offset = dissect_edonkey_server_hash(tvb, pinfo, offset, serverinfo_tree);
1369 offset = dissect_edonkey_address(tvb, pinfo, offset, serverinfo_tree);
1370 offset = dissect_edonkey_metatag_list(tvb, pinfo, offset, serverinfo_tree);
1371 return offset;
1372 }
1373
1374 /* Dissects the eDonkey file info */
1375 static int dissect_edonkey_file_info(tvbuff_t *tvb, packet_info *pinfo,
1376 int offset, proto_tree *tree)
1377 {
1378 /* <File info> ::= <File hash> <Client ID> <Port> <Meta tag list> */
1379 proto_item *ti;
1380 proto_tree *fileinfo_tree;
1381 int startoff;
1382 /* Add subtree for file info */
1383 ti = proto_tree_add_item(tree, hf_edonkey_fileinfo, tvb, offset, 0, ENC_NA);
1384 startoff = offset;
1385 fileinfo_tree = proto_item_add_subtree(ti, ett_edonkey_fileinfo);
1386 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, fileinfo_tree);
1387 offset = dissect_edonkey_client_id(tvb, pinfo, offset, fileinfo_tree, true);
1388 offset = dissect_edonkey_port(tvb, pinfo, offset, fileinfo_tree);
1389 offset = dissect_edonkey_metatag_list(tvb, pinfo, offset, fileinfo_tree);
1390 proto_item_set_len(ti, offset-startoff);
1391 return offset;
1392 }
1393
1394 /* Dissects the eDonkey file info list */
1395 static int dissect_edonkey_file_info_list(tvbuff_t *tvb, packet_info *pinfo,
1396 int offset, proto_tree *tree)
1397 {
1398 /* <File Info List> ::= <List Size (uint32_t)> <File Info>* */
1399 return dissect_edonkey_list(tvb, pinfo, offset, tree, 4, "File Info", dissect_edonkey_file_info);
1400 }
1401
1402
1403 /* Dissects the eMule address list */
1404 static int dissect_emule_address_list(tvbuff_t *tvb, packet_info *pinfo,
1405 int offset, proto_tree *tree)
1406 {
1407 /* <Address List> ::= <List Size (uint16_t)> <Address>* */
1408 return dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Address", dissect_edonkey_address);
1409 }
1410
1411 static int dissect_emule_aich_root_hash(tvbuff_t *tvb, packet_info *pinfo _U_,
1412 int offset, proto_tree *tree)
1413 {
1414 /* <AICH Root Hash> ::= HASH (20 byte SHA1 digest) */
1415 proto_tree_add_item(tree, hf_emule_aich_root_hash, tvb, offset, 20, ENC_NA);
1416 return offset + 20;
1417 }
1418
1419 static int dissect_emule_aich_hash_list_entry(tvbuff_t *tvb, packet_info *pinfo _U_,
1420 int offset, proto_tree *tree)
1421 {
1422 uint16_t hashid;
1423 proto_item *ti;
1424 proto_tree *aichhash_tree;
1425 /* <AICH Hash List Entry> ::= <AICH Hash ID> <AICH Hash> */
1426 ti = proto_tree_add_item(tree, hf_emule_aich_hash_entry, tvb, offset, 22, ENC_NA);
1427 aichhash_tree = proto_item_add_subtree(ti, ett_emule_aichhash);
1428
1429 hashid = tvb_get_letohs(tvb, offset);
1430 proto_tree_add_uint(aichhash_tree, hf_emule_aich_hash_id, tvb, offset, 2, hashid);
1431 proto_tree_add_item(aichhash_tree, hf_emule_aich_hash, tvb, offset+2, 20, ENC_NA);
1432 return offset + 22;
1433 }
1434
1435 static int dissect_emule_aich_hash_list(tvbuff_t *tvb, packet_info *pinfo,
1436 int offset, proto_tree *tree)
1437 {
1438 /* <AICH Hash List> ::= <List Size (uint16_t)> < <AICH Hash ID> <AICH Hash> >* */
1439 return dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "AICH Hash", dissect_emule_aich_hash_list_entry);
1440 }
1441
1442 static int dissect_emule_multipacket(tvbuff_t *tvb, packet_info *pinfo,
1443 int offset, int eoffset, proto_tree *tree, int isext)
1444 {
1445 uint8_t opcode, nextop;
1446 uint16_t namelen, partcount, arrlen, oplen;
1447 uint32_t sourcecount;
1448 proto_item *ti;
1449 proto_tree *mp_tree;
1450
1451 /* <MultiPacket> ::= <File Hash> <Opcodes>* */
1452 /* <MultiPacketExt> ::= <File Hash> <FileLength> <Opcodes>* */
1453 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1454
1455 if (isext) {
1456 proto_tree_add_item(tree, hf_edonkey_emule_file_length, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1457 offset += 8;
1458 }
1459
1460 while (offset<eoffset) {
1461 opcode = tvb_get_uint8(tvb, offset);
1462
1463 switch (opcode) {
1464 case EDONKEY_MSG_FILE_STATUS_REQUEST:
1465 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, 1, ENC_NA);
1466 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1467
1468 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1469 opcode, "File Status Request (0x%02x)", opcode);
1470 offset += 1;
1471 break;
1472 case EDONKEY_MSG_FILE_REQUEST:
1473 partcount = 443; /* Invalid */
1474 sourcecount = 65536; /* Out of range */
1475 arrlen = 0;
1476 oplen = 1;
1477
1478 if (offset+2<eoffset) {
1479 nextop = tvb_get_uint8(tvb, offset+1);
1480 if (nextop!=EDONKEY_MSG_FILE_STATUS_REQUEST &&
1481 nextop!=EMULE_MSG_SOURCES_REQUEST &&
1482 nextop!=EMULE_MSG_AICHFILEHASH_REQUEST) {
1483
1484 partcount = tvb_get_letohs(tvb, offset+1);
1485 if (partcount<=442) {
1486 arrlen = (partcount+7)/8;
1487 oplen += 2+arrlen;
1488
1489 if (offset+2+arrlen+2<eoffset) {
1490 nextop = tvb_get_uint8(tvb, offset+2+arrlen+1);
1491 if (nextop!=EDONKEY_MSG_FILE_STATUS_REQUEST &&
1492 nextop!=EMULE_MSG_SOURCES_REQUEST &&
1493 nextop!=EMULE_MSG_AICHFILEHASH_REQUEST) {
1494
1495 sourcecount = tvb_get_letohs(tvb, offset+2+arrlen+1);
1496 oplen += 2;
1497 }
1498 }
1499 }
1500 }
1501 }
1502
1503 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, oplen, ENC_NA);
1504 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1505
1506 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1507 opcode, "File Name Request (0x%02x)", opcode);
1508 if (partcount<=442) {
1509 dissect_edonkey_file_status(tvb, pinfo, offset+1, mp_tree);
1510 if (sourcecount<65536) {
1511 proto_tree_add_uint(mp_tree, hf_emule_source_count, tvb, offset+3+arrlen, 2, sourcecount);
1512 }
1513 }
1514 offset += oplen;
1515 break;
1516 case EMULE_MSG_SOURCES_REQUEST:
1517 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, 1, ENC_NA);
1518 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1519
1520 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1521 opcode, "Sources Request (0x%02x)", opcode);
1522 offset += 1;
1523 break;
1524 case EMULE_MSG_AICHFILEHASH_REQUEST:
1525 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, 1, ENC_NA);
1526 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1527
1528 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1529 opcode, "AICH Root Hash Request (0x%02x)", opcode);
1530 offset += 1;
1531 break;
1532
1533 case EDONKEY_MSG_FILE_STATUS:
1534 partcount = tvb_get_letohs(tvb, offset+1);
1535 arrlen = (partcount+7)/8;
1536
1537 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, 3+arrlen, ENC_NA);
1538 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1539
1540 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1541 opcode, "File Status (0x%02x)", opcode);
1542 offset = dissect_edonkey_file_status(tvb, pinfo, offset+1, mp_tree);
1543 break;
1544 case EDONKEY_MSG_FILE_REQUEST_ANSWER:
1545 namelen = tvb_get_letohs(tvb, offset+1);
1546
1547 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, 3+namelen, ENC_NA);
1548 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1549
1550 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1551 opcode, "File Name (0x%02x)", opcode);
1552 offset = dissect_edonkey_file_name(tvb, pinfo, offset+1, mp_tree);
1553 break;
1554 case EMULE_MSG_AICHFILEHASH_ANSWER:
1555 ti = proto_tree_add_item(tree, hf_emule_multipacket_entry, tvb, offset, 21, ENC_NA);
1556 mp_tree = proto_item_add_subtree(ti, ett_emule_multipacket);
1557
1558 proto_tree_add_uint_format(mp_tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1559 opcode, "AICH Root Hash (0x%02x)", opcode);
1560 proto_tree_add_item(mp_tree, hf_emule_aich_root_hash, tvb, offset+1, 20, ENC_NA);
1561 offset += 21;
1562 break;
1563
1564 default:
1565 /* Unknown opcode means we can't continue parsing the stream */
1566 proto_tree_add_uint_format(tree, hf_emule_multipacket_opcode, tvb, offset, 1,
1567 opcode, "Unknown MultiPacket opcode (0x%02x)", opcode);
1568 return offset+1;
1569 }
1570 }
1571
1572 return offset;
1573 }
1574
1575 /* Dissects the Overnet peer type */
1576 static int dissect_overnet_peertype(tvbuff_t *tvb, packet_info *pinfo _U_,
1577 int offset, proto_tree *tree)
1578 {
1579 /* <Peer type> ::= uint8_t */
1580 proto_tree_add_item(tree, hf_edonkey_overnet_peer_type, tvb, offset, 1, ENC_NA);
1581 return offset+1;
1582 }
1583
1584 /* Dissects the Overnet peer */
1585 static int dissect_overnet_peer(tvbuff_t *tvb, packet_info *pinfo,
1586 int offset, proto_tree *tree)
1587 {
1588 /* <Peer> ::= <Hash> <Address> <Peer type> */
1589 proto_item *ti;
1590 proto_tree *peer_tree;
1591 ti = proto_tree_add_item(tree, hf_overnet_peer, tvb, offset, 16 + 6 + 1, ENC_NA);
1592 peer_tree = proto_item_add_subtree(ti, ett_overnet_peer);
1593 offset = dissect_edonkey_hash(tvb, pinfo, offset, peer_tree);
1594 offset = dissect_edonkey_address(tvb, pinfo, offset, peer_tree);
1595 offset = dissect_overnet_peertype(tvb, pinfo, offset, peer_tree);
1596 return offset;
1597 }
1598
1599 static int dissect_kademlia_peertype(tvbuff_t *tvb, packet_info *pinfo _U_,
1600 int offset, proto_tree *tree)
1601 {
1602 /* <Peer type> ::= 1bytes */
1603 proto_tree_add_item( tree, hf_kademlia_peertype, tvb, offset, 1, ENC_BIG_ENDIAN );
1604 return offset + 1;
1605 }
1606
1607 /* Dissects the Kademlia peer */
1608 static int dissect_kademlia_peer(tvbuff_t *tvb, packet_info *pinfo,
1609 int offset, proto_tree *tree)
1610 {
1611 /* <Peer> ::= <Hash> <Address> <Peer type> */
1612 proto_item *ti;
1613 proto_tree *peer_tree;
1614
1615 ti = proto_tree_add_item(tree, hf_kademlia_peer, tvb, offset, 16 + 4 + 4 + 1, ENC_NA);
1616
1617 peer_tree = proto_item_add_subtree(ti, ett_overnet_peer);
1618
1619 /* 16 */
1620 offset = dissect_kademlia_hash(tvb, pinfo, offset, peer_tree, &hf_kademlia_peer_id);
1621
1622 /* 8 ( 4 ip + 2 tcp port + 2 udp port ) */
1623 offset = dissect_kademlia_address(tvb, pinfo, offset, peer_tree);
1624
1625 /* 1 */
1626 /* offset = dissect_kademlia_peertype(tvb, pinfo, offset, peer_tree); */
1627 proto_tree_add_item(peer_tree, hf_kademlia_version, tvb, offset, 1, ENC_BIG_ENDIAN);
1628 return offset + 1;
1629 }
1630
1631 /* Dissects the Kademlia2 peer */
1632 static int dissect_kademlia2_peer(tvbuff_t *tvb, packet_info *pinfo,
1633 int offset, proto_tree *tree)
1634 {
1635 /* <Peer> ::= <Hash> <Address> <Peer type> */
1636 proto_item *ti;
1637 proto_tree *peer_tree;
1638
1639 ti = proto_tree_add_item(tree, hf_kademlia_peer, tvb, offset, 16 + 4 + 4 + 1, ENC_NA);
1640
1641 peer_tree = proto_item_add_subtree(ti, ett_overnet_peer);
1642
1643 /* 16 */
1644 offset = dissect_kademlia_hash(tvb, pinfo, offset, peer_tree, &hf_kademlia_peer_id);
1645
1646 /* 8 ( 4 ip + 2 tcp port + 2 udp port ) */
1647 offset = dissect_kademlia_address(tvb, pinfo, offset, peer_tree);
1648
1649 /* 1 */
1650 offset = dissect_kademlia_peertype(tvb, pinfo, offset, peer_tree);
1651 return offset;
1652 }
1653
1654
1655 /* Dissects the eDonkey search query */
1656 // NOLINTNEXTLINE(misc-no-recursion)
1657 static int dissect_edonkey_search_query(tvbuff_t *tvb, packet_info *pinfo,
1658 int offset, proto_tree *tree)
1659 {
1660 /* <Search Query> ::= <Search Type> <Search> */
1661 proto_item *ti;
1662 proto_tree *search_tree;
1663 uint8_t search_type, special_tagtype;
1664 uint16_t tag_name_size, string_length;
1665 uint32_t search_length;
1666 int string_offset, tag_name_offset;
1667
1668 search_type = tvb_get_uint8(tvb, offset);
1669 search_length = 1;
1670 ti = proto_tree_add_uint(tree, hf_edonkey_search_type, tvb, offset, 1, search_type);
1671
1672 increment_dissection_depth(pinfo);
1673 switch (search_type)
1674 {
1675 case EDONKEY_SEARCH_BOOL:
1676 /* <Search> ::= <Operator> <Search Query> <Search Query> */
1677 search_length += 1;
1678
1679 /* Add subtree for search entry */
1680 proto_item_set_len(ti, search_length);
1681 search_tree = proto_item_add_subtree(ti, ett_edonkey_search);
1682
1683 /* Add query info */
1684 proto_tree_add_item(search_tree, hf_edonkey_search_ops, tvb, offset+1, 1, ENC_LITTLE_ENDIAN);
1685
1686 offset+=2;
1687 offset = dissect_edonkey_search_query(tvb, pinfo, offset, search_tree);
1688 offset = dissect_edonkey_search_query(tvb, pinfo, offset, search_tree);
1689 break;
1690
1691 case EDONKEY_SEARCH_NAME:
1692 /* <Search> ::= <String> */
1693 string_offset = offset + search_length;
1694 string_length = tvb_get_letohs(tvb, string_offset);
1695 search_length += 2+string_length;
1696
1697 /* Add subtree for search entry */
1698 proto_item_set_len(ti, search_length);
1699 search_tree = proto_item_add_subtree(ti, ett_edonkey_search);
1700
1701 /* Add query info */
1702 proto_tree_add_uint(search_tree, hf_edonkey_string_length, tvb, string_offset, 2, string_length);
1703 proto_tree_add_item(search_tree, hf_edonkey_string, tvb, string_offset+2, string_length, ENC_ASCII);
1704 offset += search_length;
1705 break;
1706
1707 case EDONKEY_SEARCH_META:
1708 /* <Search> ::= <String> <Meta tag Name> */
1709 string_offset = offset + search_length;
1710 string_length = tvb_get_letohs(tvb, offset+1);
1711 search_length += 2+string_length;
1712
1713 tag_name_offset = offset + search_length;
1714 tag_name_size = tvb_get_letohs(tvb, tag_name_offset);
1715 special_tagtype = tvb_get_uint8(tvb, tag_name_offset+2);
1716 search_length += 2 + tag_name_size;
1717
1718 /* Add subtree for search entry */
1719 proto_item_set_len(ti, search_length);
1720 search_tree = proto_item_add_subtree(ti, ett_edonkey_search);
1721
1722 /* Add query info */
1723 proto_tree_add_uint(search_tree, hf_edonkey_string_length, tvb, string_offset, 2, string_length);
1724 proto_tree_add_item(search_tree, hf_edonkey_string, tvb, string_offset+2, string_length, ENC_ASCII);
1725 proto_tree_add_uint(search_tree, hf_edonkey_metatag_namesize, tvb, tag_name_offset, 2, tag_name_size);
1726 edonkey_tree_add_metatag_name(search_tree, tvb, tag_name_offset+2, tag_name_size, special_tagtype);
1727 offset += search_length;
1728 break;
1729
1730 case EDONKEY_SEARCH_LIMIT:
1731 /* <Search> ::= <Limit (uint32_t)> <Minmax> <Meta tag Name> */
1732 search_length += 5; /* 4 bytes for the limit, one for the minmax */
1733
1734 tag_name_offset = offset + search_length;
1735 tag_name_size = tvb_get_letohs(tvb, tag_name_offset);
1736 special_tagtype = tvb_get_uint8(tvb, tag_name_offset+2);
1737 search_length += 2 + tag_name_size;
1738
1739 /* Add subtree for search entry */
1740 proto_item_set_len(ti, search_length);
1741 search_tree = proto_item_add_subtree(ti, ett_edonkey_search);
1742
1743 /* Add query info */
1744 proto_tree_add_item(search_tree, hf_edonkey_search_limit, tvb, offset+1, 4, ENC_LITTLE_ENDIAN);
1745 proto_tree_add_item(search_tree, hf_edonkey_search_limit_type, tvb, offset+5, 1, ENC_LITTLE_ENDIAN);
1746 proto_tree_add_uint(search_tree, hf_edonkey_metatag_namesize, tvb, tag_name_offset, 2, tag_name_size);
1747 edonkey_tree_add_metatag_name(search_tree, tvb, tag_name_offset+2, tag_name_size, special_tagtype);
1748 offset += search_length;
1749 break;
1750
1751 default:
1752 /* Unknown search type - actual search length is also unknown */
1753 proto_item_set_len(ti, search_length);
1754 offset += search_length;
1755 break;
1756 }
1757 decrement_dissection_depth(pinfo);
1758
1759 return offset;
1760 }
1761
1762 static void dissect_edonkey_tcp_message(uint8_t msg_type,
1763 tvbuff_t *tvb, packet_info *pinfo,
1764 int offset, int length, proto_tree *tree)
1765 {
1766 int msg_end, bytes_remaining;
1767 uint8_t helloClient;
1768
1769 bytes_remaining = tvb_reported_length_remaining(tvb, offset);
1770 if ((length < 0) || (length > bytes_remaining)) length = bytes_remaining;
1771 if (length <= 0) return;
1772
1773 msg_end = offset + length;
1774
1775 switch (msg_type) {
1776 case EDONKEY_MSG_HELLO:
1777 /* Client to Server: <Client Info> */
1778 /* Client to Client: 0x10 <Client Info> <Server address> */
1779 /* If Hello is sent to server 0x10 before UserHash is skipped,
1780 but UserHash might starts with 0x10. To decrease posibility
1781 of mistake, we check also 6th and 15h byte of UserHash -
1782 they have constant value. The best way would be to process
1783 whole packet to check it. */
1784 helloClient = (tvb_get_uint8(tvb, offset) == 0x10 && tvb_get_uint8(tvb, offset + 6) == 0x0E && tvb_get_uint8(tvb, offset + 15) == 0x6F);
1785 if (helloClient) {
1786 proto_tree_add_uint(tree, hf_edonkey_user_hash_length, tvb, offset, 1, 16);
1787 offset += 1;
1788 }
1789 offset = dissect_edonkey_client_info(tvb, pinfo, offset, tree);
1790 if (helloClient) /* User's server ip is sent only to clients. */
1791 offset = dissect_edonkey_address(tvb, pinfo, offset, tree);
1792 break;
1793
1794 case EDONKEY_MSG_HELLO_ANSWER: /* Hello Answer: <Client Info> <Server address> */
1795 offset = dissect_edonkey_client_info(tvb, pinfo, offset, tree);
1796 offset = dissect_edonkey_address(tvb, pinfo, offset, tree);
1797 break;
1798
1799 case EDONKEY_MSG_SERVER_CB_REQ: /* Server Callback Request: <Client address> */
1800 offset = dissect_edonkey_address(tvb, pinfo, offset, tree);
1801 break;
1802
1803 case EDONKEY_MSG_SERVER_INFO_DATA: /* Server Info Data: <Server Info> */
1804 offset = dissect_edonkey_server_info(tvb, pinfo, offset, tree);
1805 break;
1806
1807 case EDONKEY_MSG_SERVER_LIST: /* Server List: <Address List> */
1808 offset = dissect_edonkey_address_list(tvb, pinfo, offset, tree);
1809 break;
1810
1811 case EDONKEY_MSG_OFFER_FILES: /* Offer Files: <File info List> */
1812 case EDONKEY_MSG_VIEW_FILES_ANSWER: /* View Files Answer: <File info list> */
1813 offset = dissect_edonkey_file_info_list(tvb, pinfo, offset, tree);
1814 break;
1815
1816 case EDONKEY_MSG_SEARCH_FILE_RESULTS: /* Search File Results: <File Info list> <More> */
1817 offset = dissect_edonkey_file_info_list(tvb, pinfo, offset, tree);
1818 proto_tree_add_item(tree, hf_edonkey_more_search_file_results, tvb, offset, 1, ENC_NA);
1819 break;
1820
1821 case EDONKEY_MSG_SEARCH_FILES: /* Search File: <Search query> */
1822 case EDONKEY_MSG_SEARCH_USER: /* Search User: <Search query> */
1823 offset = dissect_edonkey_search_query(tvb, pinfo, offset, tree);
1824 break;
1825
1826 case EDONKEY_MSG_GET_SOURCES: /* Get Sources: <File Hash> <Size> <Size 64> */
1827 case EDONKEY_MSG_GET_SOURCES_OBFU: /* Get Sources: <File Hash> <Size> <Size 64> */
1828 {
1829 uint32_t fileSize;
1830 proto_item* ti;
1831 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1832 fileSize = tvb_get_letohl(tvb, offset);
1833 ti = proto_tree_add_uint(tree, hf_edonkey_file_size, tvb, offset, 4, fileSize);
1834 offset += 4;
1835 /* if fileSize = 0 then 64bit file size comes next */
1836 if (fileSize == 0) {
1837 proto_item_append_text(ti, " (64bit file size used)");
1838 proto_tree_add_item(tree, hf_edonkey_large_file_size, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1839 }
1840 }
1841 break;
1842
1843 case EDONKEY_MSG_NO_SUCH_FILE: /* No Such File: <File Hash> */
1844 case EDONKEY_MSG_END_OF_DOWNLOAD: /* End of Download: <File Hash> */
1845 case EDONKEY_MSG_FILE_STATUS_REQUEST: /* File Status Request: <File Hash> */
1846 case EDONKEY_MSG_HASHSET_REQUEST: /* Hashset Request: <File Hash> */
1847 case EDONKEY_MSG_SLOT_REQUEST: /* Slot Request: <File Hash> */
1848 case EDONKEY_MSG_FILE_REQUEST: /* File Request: <File Hash> */
1849 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1850 break;
1851
1852 case EDONKEY_MSG_FOUND_SOURCES_OBFU: /* Found Sources: <File Hash> <SourceOBFU List> */
1853 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1854 offset = dissect_emule_sourceOBFU_list(tvb, pinfo, offset, tree);
1855 break;
1856
1857 case EDONKEY_MSG_FOUND_SOURCES: /* Found Sources: <File Hash> <Address List> */
1858 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1859 offset = dissect_edonkey_address_list(tvb, pinfo, offset, tree);
1860 break;
1861
1862 case EDONKEY_MSG_CLIENT_CB_REQ: /* Client Callback Request: <Client ID> */
1863 case EDONKEY_MSG_CALLBACK_FAIL: /* Callback Fail: <Client ID> */
1864 case EDONKEY_MSG_ID_CHANGE: /* ID Change: <Client ID> */
1865 offset = dissect_edonkey_client_id(tvb, pinfo, offset, tree, false);
1866 break;
1867
1868 case EDONKEY_MSG_NEW_CLIENT_ID: /* New Client ID: <Client ID> <Client ID> */
1869 offset = dissect_edonkey_client_id(tvb, pinfo, offset, tree, false);
1870 offset = dissect_edonkey_client_id(tvb, pinfo, offset, tree, false);
1871 break;
1872
1873 case EDONKEY_MSG_SERVER_MESSAGE: /* Server Message: <String> */
1874 case EDONKEY_MSG_CLIENT_MESSAGE: /* Client Message: <String> */
1875 offset = dissect_edonkey_string(tvb, pinfo, offset, tree);
1876 break;
1877
1878 case EDONKEY_MSG_SERVER_STATUS: /* Server Status: <Nusers> <Nfiles> */
1879 proto_tree_add_item(tree, hf_edonkey_number_of_users, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1880 proto_tree_add_item(tree, hf_edonkey_number_of_files, tvb, offset+4, 4, ENC_LITTLE_ENDIAN);
1881 break;
1882
1883 case EDONKEY_MSG_FILE_STATUS: /* File Status: <File hash> <Part Count> <Part Status>? */
1884 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1885 offset = dissect_edonkey_file_status(tvb, pinfo, offset, tree);
1886 break;
1887
1888 case EDONKEY_MSG_FILE_REQUEST_ANSWER: /* File Request Answer: <File hash> <File name> */
1889 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1890 offset = dissect_edonkey_file_name(tvb, pinfo, offset, tree);
1891 break;
1892
1893 case EDONKEY_MSG_REQUEST_PARTS: /* Request Parts: <File hash> <Start offset>(3) <End offset>(3) */
1894 {
1895 int pairs, count;
1896 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1897 pairs = (msg_end - offset) / 8;
1898
1899 for (count=0; count < pairs; count++)
1900 {
1901 offset = dissect_edonkey_start_offset(tvb, pinfo, offset, tree);
1902 }
1903 for (count=0; count < pairs; count++)
1904 {
1905 offset = dissect_edonkey_end_offset(tvb, pinfo, offset, tree);
1906 }
1907 }
1908 break;
1909
1910 case EDONKEY_MSG_SENDING_PART: /* Sending Part: <File hash> <Start offset> <End offset> DATA */
1911 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1912 offset = dissect_edonkey_start_offset(tvb, pinfo, offset, tree);
1913 offset = dissect_edonkey_end_offset(tvb, pinfo, offset, tree);
1914 if (msg_end > offset) {
1915 bytes_remaining = msg_end - offset;
1916 proto_tree_add_item(tree, hf_edonkey_message_data, tvb, offset, bytes_remaining, ENC_NA);
1917 }
1918 break;
1919
1920
1921 case EDONKEY_MSG_SEARCH_USER_RESULTS: /* Search User Results: <Client info list> */
1922 offset = dissect_edonkey_client_info_list(tvb, pinfo, offset, tree);
1923 break;
1924
1925 case EDONKEY_MSG_GET_SHARED_FILES: /* Get Shared Files: <Directory> */
1926 offset = dissect_edonkey_directory(tvb, pinfo, offset, tree);
1927 break;
1928
1929 case EDONKEY_MSG_SHARED_DIRS: /* Shared Dirs: <Directory List> */
1930 offset = dissect_edonkey_directory_list(tvb, pinfo, offset, tree);
1931 break;
1932
1933 case EDONKEY_MSG_SHARED_FILES: /* Shared Files: <Directory> <File info list> */
1934 offset = dissect_edonkey_directory(tvb, pinfo, offset, tree);
1935 offset = dissect_edonkey_file_info_list(tvb, pinfo, offset, tree);
1936 break;
1937
1938 case EDONKEY_MSG_HASHSET_ANSWER: /* Hashset Answer: <Hash List> */
1939 offset = dissect_edonkey_hash_list(tvb, pinfo, offset, tree);
1940 break;
1941
1942 default:
1943 proto_tree_add_item(tree, hf_edonkey_message_data, tvb, offset, length, ENC_NA);
1944 break;
1945 }
1946
1947 if (offset < msg_end) {
1948 int extra_bytes = msg_end - offset;
1949 /* trailing garbage or broken packet */
1950 proto_tree_add_uint_format(tree, hf_edonkey_unparsed_data_length, tvb, offset, extra_bytes, extra_bytes,
1951 "Trailing/Undecoded data: %d bytes", extra_bytes );
1952 }
1953 return;
1954 }
1955
1956 static void dissect_emule_tcp_message(uint8_t msg_type,
1957 tvbuff_t *tvb, packet_info *pinfo,
1958 int offset, int length, proto_tree *tree)
1959 {
1960 int msg_end, bytes_remaining;
1961 uint16_t partnum;
1962
1963 bytes_remaining = tvb_reported_length_remaining(tvb, offset);
1964 if ((length < 0) || (length > bytes_remaining)) length = bytes_remaining;
1965 if (length <= 0) return;
1966
1967 msg_end = offset + length;
1968
1969 switch (msg_type) {
1970 case EMULE_MSG_HELLO: /* eMule Info: <eMule Version> <Meta tag list> */
1971 case EMULE_MSG_HELLO_ANSWER: /* eMule Info Answer: <eMule Version> <Meta tag list> */
1972 proto_tree_add_item(tree, hf_edonkey_emule_version, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1973 dissect_edonkey_metatag_list(tvb, pinfo, offset+2, tree);
1974 break;
1975
1976 case EMULE_MSG_QUEUE_RANKING: /* eMule Queue Ranking: <eMule Rank (uint16_t)> */
1977 proto_tree_add_item(tree, hf_edonkey_emule_queue_ranking, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1978 break;
1979
1980 case EMULE_MSG_SOURCES_REQUEST: /* Sources Request: <File Hash> */
1981 dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1982 break;
1983
1984 case EMULE_MSG_SOURCES_ANSWER: /* Sources Answer: <File Hash> <Address List> */
1985 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
1986 dissect_emule_address_list(tvb, pinfo, offset, tree);
1987 break;
1988
1989 case EMULE_MSG_SEC_IDENT_STATE:
1990 proto_tree_add_item(tree, hf_edonkey_emule_ident_state, tvb, offset, 1, ENC_NA);
1991 offset++;
1992 proto_tree_add_item(tree, hf_edonkey_emule_rndchallenge, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1993 break;
1994
1995 case EMULE_MSG_PUBLIC_KEY: /* Public Key: <1byte : len> <len bytes: pubkey> */
1996 /* offset =*/ dissect_edonkey_public_key(tvb, pinfo, offset, tree);
1997 /* offset = dissect_emule_publickey(tvb, pinfo, offset, tree); */
1998 break;
1999
2000 case EMULE_MSG_SIGNATURE:
2001 offset = dissect_edonkey_signature(tvb, pinfo, offset, tree);
2002 if (msg_end != offset) {
2003 proto_tree_add_item(tree, hf_edonkey_emule_sig_ip_used, tvb, offset, 1, ENC_NA);
2004 }
2005 break;
2006
2007
2008 /* case EMULE_MSG_SIGNATURE: Public Key: <1byte : len> <len bytes: pubkey> */
2009 /* offset = dissect_emule_publickey(tvb, pinfo, offset, tree); */
2010 /* break; */
2011
2012 /* case EMULE_MSG_SECIDENTSTATE: Public Key: <1byte : len> <len bytes: pubkey> */
2013 /* offset = dissect_emule_secstate(tvb, pinfo, offset, tree); */
2014 /* offset = dissect_emule_challenge(tvb, pinfo, offset, tree); */
2015 /* break; */
2016
2017 case EMULE_MSG_DATA_COMPRESSED: /* Data Compressed: <File Hash> <Start Offset> <Length (uint32_t)> <DATA> */
2018 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2019 offset = dissect_edonkey_start_offset(tvb, pinfo, offset, tree);
2020 proto_tree_add_item(tree, hf_edonkey_packed_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2021 offset += 4;
2022 if (msg_end > offset) {
2023 bytes_remaining = msg_end - offset;
2024 proto_tree_add_item(tree, hf_edonkey_compressed_message_data, tvb, offset, bytes_remaining, ENC_NA);
2025 }
2026 break;
2027
2028 case EMULE_MSG_DATA_COMPRESSED_64: /* Data Compressed: <File Hash> <Start Offset (uint64_t)> <Length (uint32_t)> <DATA> */
2029 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2030 offset = dissect_edonkey_start_offset_64(tvb, pinfo, offset, tree);
2031 proto_tree_add_item(tree, hf_edonkey_packed_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2032 offset += 4;
2033 if (msg_end > offset) {
2034 bytes_remaining = msg_end - offset;
2035 proto_tree_add_item(tree, hf_edonkey_compressed_message_data, tvb, offset, bytes_remaining, ENC_NA);
2036 }
2037 break;
2038
2039 case EMULE_MSG_REQUEST_PARTS_64: /* Request Parts: <File hash> <Start offset>(3) <End offset>(3) */
2040 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2041 offset = dissect_edonkey_start_offset_64(tvb, pinfo, offset, tree);
2042 offset = dissect_edonkey_start_offset_64(tvb, pinfo, offset, tree);
2043 offset = dissect_edonkey_start_offset_64(tvb, pinfo, offset, tree);
2044 offset = dissect_edonkey_end_offset_64(tvb, pinfo, offset, tree);
2045 offset = dissect_edonkey_end_offset_64(tvb, pinfo, offset, tree);
2046 dissect_edonkey_end_offset_64(tvb, pinfo, offset, tree);
2047 break;
2048
2049 case EMULE_MSG_SENDING_PART_64: /* Sending Part: <File hash> <Start offset> <End offset> DATA */
2050 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2051 offset = dissect_edonkey_start_offset_64(tvb, pinfo, offset, tree);
2052 offset = dissect_edonkey_end_offset_64(tvb, pinfo, offset, tree);
2053 if (msg_end > offset) {
2054 bytes_remaining = msg_end - offset;
2055 proto_tree_add_item(tree, hf_edonkey_message_data, tvb, offset, bytes_remaining, ENC_NA);
2056 }
2057 break;
2058
2059 case EMULE_MSG_CALLBACK: /* Callback: < hash ><hash> <uint16> */
2060 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2061 /*offset = */dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2062 /* offset = dissect_edonkey_generic_uint16(tvb, pinfo, offset, tree, "uint16" ); */
2063 break;
2064
2065 case EMULE_MSG_AICH_REQUEST: /* AICH Request: <File Hash> <PartNum> <AICH Hash> */
2066 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2067 partnum = tvb_get_letohs(tvb, offset);
2068 proto_tree_add_uint(tree, hf_emule_aich_partnum, tvb, offset, 2, partnum);
2069 offset += 2;
2070 dissect_emule_aich_root_hash(tvb, pinfo, offset, tree);
2071 break;
2072
2073 case EMULE_MSG_AICH_ANSWER: /* AICH Answer: <File Hash> <PartNum> <AICH Hash> <AICH Hash List> */
2074 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2075 partnum = tvb_get_letohs(tvb, offset);
2076 proto_tree_add_uint(tree, hf_emule_aich_partnum, tvb, offset, 2, partnum);
2077 offset += 2;
2078 offset = dissect_emule_aich_root_hash(tvb, pinfo, offset, tree);
2079 dissect_emule_aich_hash_list(tvb, pinfo, offset, tree);
2080 break;
2081
2082 case EMULE_MSG_MULTIPACKET: /* MultiPacket: <Hash> <Opcodes> */
2083 case EMULE_MSG_MULTIPACKET_ANSWER:
2084 case EMULE_MSG_MULTIPACKET_EXT: /* MultiPacketExt: <Hash> <FileLength> <Opcodes> */
2085 dissect_emule_multipacket(tvb, pinfo, offset, offset+length, tree, msg_type==EMULE_MSG_MULTIPACKET_EXT);
2086 break;
2087
2088 default:
2089 dissect_edonkey_tcp_message(msg_type, tvb, pinfo, offset, length, tree);
2090 break;
2091 }
2092 return;
2093 }
2094
2095 static int dissect_edonkey_udp_message(uint8_t msg_type,
2096 tvbuff_t *tvb, packet_info *pinfo,
2097 int offset, int length, proto_tree *tree)
2098 {
2099 int msg_end, bytes_remaining;
2100 uint16_t ischal;
2101
2102 bytes_remaining = tvb_reported_length_remaining(tvb, offset);
2103 if ((length < 0) || (length > bytes_remaining)) length = bytes_remaining;
2104 if (length <= 0) return offset;
2105
2106 msg_end = offset + length;
2107
2108 switch (msg_type) {
2109 /* EDonkey UDP Messages */
2110 case EDONKEY_MSG_UDP_CALLBACK_REQUEST: /* Callback Request: <Address> <Client ID> */
2111 offset = dissect_edonkey_address(tvb, pinfo, offset, tree);
2112 offset = dissect_edonkey_client_id(tvb, pinfo, offset, tree, false);
2113 break;
2114
2115 case EDONKEY_MSG_UDP_CALLBACK_FAIL: /* Callback Fail: <Client ID> */
2116 offset = dissect_edonkey_client_id(tvb, pinfo, offset, tree, false);
2117 break;
2118
2119 case EDONKEY_MSG_UDP_GET_SERVER_INFO: /* Get Server Info: <Challenge> */
2120 if (length>=2) {
2121 ischal = tvb_get_letohs(tvb, offset);
2122 if (ischal==0xf0ff) {
2123 proto_tree_add_item(tree, hf_edonkey_challenge, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2124 offset += 4;
2125 }
2126 }
2127 break;
2128
2129 case EDONKEY_MSG_UDP_SERVER_INFO: /* Server Info: <String> <String>*/
2130 ischal = tvb_get_letohs(tvb, offset);
2131 if (ischal==0xf0ff) {
2132 proto_tree_add_item(tree, hf_edonkey_challenge, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2133 offset = dissect_edonkey_metatag_list(tvb, pinfo, offset+4, tree);
2134 } else {
2135 offset = dissect_edonkey_string(tvb, pinfo, offset, tree);
2136 offset = dissect_edonkey_string(tvb, pinfo, offset, tree);
2137 }
2138 break;
2139
2140 case EDONKEY_MSG_UDP_SERVER_LIST: /* Server List: <Address List> */
2141 offset = dissect_edonkey_address_list(tvb, pinfo, offset, tree);
2142 break;
2143
2144 case EDONKEY_MSG_UDP_SEARCH_FILE_RESULTS: /* Search File Result: <File Info> */
2145 offset = dissect_edonkey_file_info(tvb, pinfo, offset, tree);
2146 break;
2147
2148 case EDONKEY_MSG_UDP_SEARCH_FILE: /* Search File: <Search query> */
2149 offset = dissect_edonkey_search_query(tvb, pinfo, offset, tree);
2150 break;
2151
2152 case EDONKEY_MSG_UDP_GET_SOURCES: /* Get Sources: <File Hash> */
2153 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2154 break;
2155
2156 case EDONKEY_MSG_UDP_FOUND_SOURCES: /* Found Sources: <File Hash> <Address List> */
2157 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2158 offset = dissect_edonkey_address_list(tvb, pinfo, offset, tree);
2159 break;
2160
2161 case EDONKEY_MSG_UDP_SERVER_STATUS_REQUEST: /* Server Status Request: <uint32_t> */
2162 proto_tree_add_item(tree, hf_edonkey_challenge, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2163 offset += 4;
2164 break;
2165
2166 case EDONKEY_MSG_UDP_SERVER_STATUS: /* Server Status: <uint32_t> <Nusers> <Nfiles> <Nusersmax> */
2167 proto_tree_add_item(tree, hf_edonkey_challenge, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2168 offset += 4;
2169 proto_tree_add_item(tree, hf_edonkey_number_of_users, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2170 proto_tree_add_item(tree, hf_edonkey_number_of_files, tvb, offset+4, 4, ENC_LITTLE_ENDIAN);
2171 offset += 8;
2172 if (offset < msg_end) {
2173 proto_tree_add_item(tree, hf_edonkey_max_number_of_users, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2174 offset += 4;
2175 }
2176 break;
2177
2178 /* Overnet UDP Messages */
2179 case OVERNET_MSG_UDP_CONNECT: /* Connect: <Peer (sender) > */
2180 case OVERNET_MSG_UDP_PUBLICIZE: /* Publicize: <Peer (sender) > */
2181 offset = dissect_overnet_peer(tvb, pinfo, offset, tree);
2182 break;
2183
2184 case OVERNET_MSG_UDP_CONNECT_REPLY: /* Connect Reply: <uint16_t Peer List> */
2185 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Overnet Peer", dissect_overnet_peer);
2186 break;
2187
2188 case OVERNET_MSG_UDP_SEARCH: /* Search: <search type (uint8_t)> <Hash> */
2189 proto_tree_add_item(tree, hf_edonkey_search_type, tvb, offset, 1, ENC_NA);
2190 offset = dissect_edonkey_hash(tvb, pinfo, offset+1, tree);
2191 break;
2192
2193 case OVERNET_MSG_UDP_SEARCH_INFO:
2194 /* Search Info: <Hash> <search type (uint8_t)> <min (uint16_t)> <max (uint16_t)>*/
2195 offset = dissect_edonkey_hash(tvb, pinfo, offset, tree);
2196 proto_tree_add_item(tree, hf_edonkey_search_type, tvb, offset, 1, ENC_NA);
2197 proto_tree_add_item(tree, hf_edonkey_search_range_min, tvb, offset+1, 2, ENC_LITTLE_ENDIAN);
2198 proto_tree_add_item(tree, hf_edonkey_search_range_max, tvb, offset+3, 2, ENC_LITTLE_ENDIAN);
2199 break;
2200
2201 case OVERNET_MSG_UDP_SEARCH_NEXT: /* Search Next: <Hash> <uint8_t Peer List> */
2202 offset = dissect_edonkey_hash(tvb, pinfo, offset, tree);
2203 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 1, "Overnet Peer", dissect_overnet_peer);
2204 break;
2205
2206 case OVERNET_MSG_UDP_SEARCH_RESULT: /* Search Result: <Hash> <Hash> <Meta tag List> */
2207 case OVERNET_MSG_UDP_PUBLISH: /* Publish: <Hash> <Hash> <Meta tag List> */
2208 offset = dissect_edonkey_hash(tvb, pinfo, offset, tree);
2209 offset = dissect_edonkey_hash(tvb, pinfo, offset, tree);
2210 offset = dissect_edonkey_metatag_list(tvb, pinfo, offset, tree);
2211 break;
2212
2213 case OVERNET_MSG_UDP_SEARCH_END: /* Search End: <Hash> */
2214 offset = dissect_edonkey_hash(tvb, pinfo, offset, tree);
2215 break;
2216
2217 case OVERNET_MSG_UDP_PUBLISH_ACK: /* Publish ACK: <File Hash> */
2218 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2219 break;
2220
2221 case OVERNET_MSG_UDP_IP_QUERY: /* IP Query: <TCP Port> */
2222 proto_tree_add_item(tree, hf_edonkey_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2223 break;
2224
2225 case OVERNET_MSG_UDP_IP_QUERY_ANSWER: /* IP Query Answer: <IP> */
2226 offset = dissect_edonkey_client_id(tvb, pinfo, offset, tree, false);
2227 break;
2228
2229 case OVERNET_MSG_UDP_IDENTIFY_REPLY: /* Identify Reply: <Contact (sender)> */
2230 /* <Contact> ::= <Hash> <Address> */
2231 offset = dissect_edonkey_hash(tvb, pinfo, offset, tree);
2232 offset = dissect_edonkey_address(tvb, pinfo, offset, tree);
2233 break;
2234
2235 case OVERNET_MSG_UDP_IDENTIFY_ACK: /* Identify Reply: <TCP Port (sender)> */
2236 proto_tree_add_item(tree, hf_edonkey_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2237 break;
2238
2239 case OVERNET_MSG_UDP_FIREWALL_CONNECTION: /* Firewall Connection Ack: <Hash> <TCP Port> */
2240 offset = dissect_edonkey_client_hash(tvb, pinfo, offset, tree);
2241 proto_tree_add_item(tree, hf_edonkey_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2242 break;
2243
2244 case OVERNET_MSG_UDP_FIREWALL_CONNECTION_ACK: /* Firewall Connection Ack: <Hash> */
2245 case OVERNET_MSG_UDP_FIREWALL_CONNECTION_NACK: /* Firewall Connection NAck: <Hash> */
2246 offset = dissect_edonkey_client_hash(tvb, pinfo, offset, tree);
2247 break;
2248
2249 default:
2250 proto_tree_add_item(tree, hf_edonkey_message_data, tvb, offset, length, ENC_NA);
2251 offset+=length;
2252 break;
2253 }
2254
2255 return offset;
2256 }
2257
2258 static int dissect_emule_udp_message(uint8_t msg_type,
2259 tvbuff_t *tvb, packet_info *pinfo,
2260 int offset, int length, proto_tree *tree)
2261 {
2262 int msg_end, bytes_remaining;
2263
2264 bytes_remaining = tvb_reported_length_remaining(tvb, offset);
2265 if ((length < 0) || (length > bytes_remaining)) length = bytes_remaining;
2266 if (length <= 0) return offset;
2267
2268 msg_end = offset + length;
2269
2270 switch (msg_type) {
2271 case EMULE_MSG_UDP_REASKFILEPING: /* Reask File Ping: <File Hash> */
2272 offset = dissect_edonkey_file_hash(tvb, pinfo, offset, tree);
2273 if ( offset + 2 < msg_end ) {
2274 /* Udp version > 3 */
2275 offset = dissect_edonkey_file_status( tvb, pinfo, offset, tree );
2276 }
2277
2278 if ( msg_end == offset + 2 ) {
2279 /* Udp version > 2 */
2280 proto_tree_add_item( tree, hf_emule_source_count, tvb, offset, 2, ENC_LITTLE_ENDIAN );
2281 offset += 2;
2282 }
2283 break;
2284
2285 case EMULE_MSG_UDP_REASKACK: /* Reask ACK: <eMule Rank> */
2286 if ( offset + 2 < msg_end ) {
2287 /* Udp version > 3 */
2288 offset = dissect_edonkey_file_status( tvb, pinfo, offset, tree );
2289 }
2290
2291 proto_tree_add_item(tree, hf_edonkey_emule_queue_ranking, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2292 offset += 2;
2293 break;
2294
2295 default:
2296 offset = dissect_edonkey_udp_message(msg_type, tvb, pinfo, offset, length,tree);
2297 break;
2298 }
2299 return offset;
2300 }
2301
2302 static int dissect_kademlia_peer_list_2byte(tvbuff_t *tvb, packet_info *pinfo,
2303 int offset, proto_tree *tree)
2304 {
2305 return dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Peer", dissect_kademlia_peer );
2306 }
2307
2308
2309 static int dissect_kademlia_peer_list_1byte(tvbuff_t *tvb, packet_info *pinfo,
2310 int offset, proto_tree *tree)
2311 {
2312 return dissect_edonkey_list(tvb, pinfo, offset, tree, 1, "Peer", dissect_kademlia_peer );
2313 }
2314
2315 static int dissect_kademlia2_peer_list_2byte(tvbuff_t *tvb, packet_info *pinfo,
2316 int offset, proto_tree *tree)
2317 {
2318 return dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Peer", dissect_kademlia2_peer );
2319 }
2320
2321 static int dissect_kademlia2_peer_list_1byte(tvbuff_t *tvb, packet_info *pinfo,
2322 int offset, proto_tree *tree)
2323 {
2324 return dissect_edonkey_list(tvb, pinfo, offset, tree, 1, "Peer", dissect_kademlia2_peer );
2325 }
2326
2327 static int dissect_kademlia_tag(tvbuff_t *tvb, packet_info *pinfo,
2328 int offset, proto_tree *tree)
2329 {
2330 uint8_t type;
2331 uint8_t tag_type;
2332 const char *str_type;
2333 proto_item *ti;
2334 proto_item* tag_node;
2335 proto_tree *subtree;
2336 int item_start_offset;
2337 proto_item * ti_tagtype;
2338
2339 item_start_offset = offset;
2340 /* tag_node length is adjusted at the end of this function */
2341 subtree = proto_tree_add_subtree( tree, tvb, offset, 1, ett_kademlia_tag, &tag_node, "Tag " );
2342
2343 type = tvb_get_uint8( tvb, offset );
2344 str_type = val_to_str_const(type, kademlia_tag_types, "Unknown" );
2345
2346 ti_tagtype = proto_tree_add_item( subtree, hf_kademlia_tag_type, tvb, offset, 1, ENC_LITTLE_ENDIAN );
2347 offset += 1;
2348
2349 {
2350 const char *tagname_string;
2351 const char *tagname_extended_string;
2352
2353 /* Read tagname */
2354 tag_type = tvb_get_uint8( tvb, offset+2 );
2355 offset = dissect_kademlia_tagname( tvb, pinfo, offset, subtree, &tagname_string, &tagname_extended_string );
2356 if ( strlen( tagname_string ) == 1 ) {
2357 const uint8_t tagname_uint = *(const uint8_t*)tagname_string;
2358
2359 proto_item_append_text( tag_node, " 0x%02X [%s] = ", tagname_uint, tagname_extended_string );
2360 }
2361 else
2362 proto_item_append_text( tag_node, " \"%s\" [%s] = ", tagname_string, tagname_extended_string );
2363 }
2364
2365 /* Switch on type */
2366 switch( type )
2367 {
2368 case KADEMLIA_TAGTYPE_HASH:
2369 proto_item_append_text( tag_node, "%s", tvb_bytes_to_str(pinfo->pool, tvb, offset, 16 ));
2370 offset = dissect_kademlia_tag_hash( tvb, pinfo, offset, subtree );
2371 break;
2372 case KADEMLIA_TAGTYPE_STRING:
2373 {
2374 const uint8_t* value;
2375 offset = dissect_kademlia_tag_string( tvb, pinfo, offset, subtree, &value );
2376
2377 proto_item_append_text( tag_node, "\"%s\"", value );
2378 }
2379 break;
2380 case KADEMLIA_TAGTYPE_UINT8:
2381 {
2382 uint8_t value;
2383 ti = proto_tree_add_item( subtree, hf_kademlia_tag_uint8, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2384
2385 value = tvb_get_uint8( tvb, offset );
2386 proto_item_append_text( tag_node, "%u (0x%02X)", value, value );
2387 switch (tag_type) {
2388 case KADEMLIA_TAG_SOURCETYPE:
2389 {
2390 proto_item_append_text(ti," (%s)", val_to_str_const(value, kademlia_tag_sourcetype, "Unknown"));
2391 }
2392 break;
2393 case KADEMLIA_TAG_ENCRYPTION:
2394 proto_item_append_text(ti, " (%s)", val_to_str_const(value, kademlia_tag_encryption, "Unknown"));
2395 break;
2396 }
2397 offset += 1;
2398 }
2399 break;
2400 case KADEMLIA_TAGTYPE_UINT16:
2401 {
2402 uint16_t value;
2403 proto_tree_add_item( subtree, hf_kademlia_tag_uint16, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2404
2405 value = tvb_get_letohs( tvb, offset );
2406 proto_item_append_text( tag_node, "%u (0x%04X)", value, value );
2407
2408 offset += 2;
2409 }
2410 break;
2411 case KADEMLIA_TAGTYPE_UINT64:
2412 {
2413 uint64_t value;
2414 proto_tree_add_item( subtree, hf_kademlia_tag_uint64, tvb, offset, 8, ENC_LITTLE_ENDIAN);
2415
2416 value = tvb_get_letoh64( tvb, offset );
2417 proto_item_append_text( tag_node, "%" PRIu64 " (0x%08" PRIX64 ")", value, value );
2418
2419 offset += 8;
2420 }
2421 break;
2422 case KADEMLIA_TAGTYPE_UINT32:
2423 {
2424 uint32_t value;
2425 /* show ip as dotted decimal */
2426 switch( tag_type) {
2427 case KADEMLIA_TAG_SERVERIP:
2428 case KADEMLIA_TAG_SOURCEIP:
2429 {
2430 int ipa = 0, ipb = 0, ipc = 0, ipd = 0;
2431 proto_tree_add_item( subtree, hf_kademlia_tag_ipv4, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2432 value = tvb_get_letohl( tvb, offset );
2433 ipa = (value / (256*256*256)) % 256;
2434 ipb = (value / (256*256)) % 256;
2435 ipc = (value / 256) % 256;
2436 ipd = value % 256;
2437 proto_item_append_text( tag_node, "%u.%u.%u.%u (0x%02X) ", ipa, ipb, ipc, ipd, value );
2438 }
2439 break;
2440 default:
2441 proto_tree_add_item( subtree, hf_kademlia_tag_uint32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2442 value = tvb_get_letohl( tvb, offset );
2443 proto_item_append_text( tag_node, "%u (0x%02X) ", value, value );
2444 }
2445
2446 offset += 4;
2447 }
2448 break;
2449 case KADEMLIA_TAGTYPE_FLOAT32:
2450 {
2451 float value;
2452 proto_tree_add_item( subtree, hf_kademlia_tag_float, tvb, offset, 4, ENC_LITTLE_ENDIAN);
2453
2454 value = tvb_get_letohieee_float( tvb, offset );
2455 proto_item_append_text( tag_node, "%f", value );
2456
2457 offset += 4;
2458 }
2459 break;
2460 case KADEMLIA_TAGTYPE_BSOB:
2461 {
2462 const char* value;
2463 offset = dissect_kademlia_tag_bsob( tvb, pinfo, offset, subtree, &value );
2464 proto_item_append_text( tag_node, "%s", value );
2465 }
2466 break;
2467 default:
2468 expert_add_info_format(pinfo, ti_tagtype, &ei_kademlia_tag_type, "Tag value not decoded for type: 0x%02X", type );
2469 }
2470
2471 proto_item_append_text( tag_node, " (Type: %s)", str_type );
2472
2473 proto_item_set_len( tag_node, offset - item_start_offset );
2474
2475 return offset;
2476 }
2477
2478 static int dissect_kademlia_taglist(tvbuff_t *tvb, packet_info *pinfo,
2479 int offset, proto_tree *tree)
2480 {
2481 return dissect_edonkey_list(tvb, pinfo, offset, tree, 1, "Tag", dissect_kademlia_tag );
2482 }
2483
2484
2485 static int dissect_kademlia_publish_req_entry_file(tvbuff_t *tvb, packet_info *pinfo,
2486 int offset, proto_tree *tree)
2487 {
2488 /* Get the hash */
2489 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_file_id);
2490 /* Read all the kad tags */
2491 return dissect_kademlia_taglist( tvb, pinfo, offset, tree );
2492 }
2493
2494 static int dissect_kademlia_publish_req_entry_peer(tvbuff_t *tvb, packet_info *pinfo,
2495 int offset, proto_tree *tree)
2496 {
2497 /* Get the hash */
2498 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_peer_id);
2499 /* Read all the kad tags */
2500 return dissect_kademlia_taglist( tvb, pinfo, offset, tree );
2501 }
2502
2503
2504 static int dissect_kademlia_search_result(tvbuff_t *tvb, packet_info *pinfo,
2505 int offset, proto_tree *tree)
2506 {
2507 /* Get the hash */
2508 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_hash);
2509 /* Read all the kad tags */
2510 return dissect_kademlia_taglist( tvb, pinfo, offset, tree );
2511 }
2512
2513 // NOLINTNEXTLINE(misc-no-recursion)
2514 static int dissect_kademlia_search_expression_tree(tvbuff_t *tvb, packet_info *pinfo,
2515 int offset, proto_tree *tree)
2516 {
2517 int op, item_start_offset;
2518 proto_item* ti;
2519
2520 item_start_offset = offset;
2521 op = tvb_get_uint8(tvb, offset);
2522 ti = proto_tree_add_uint(tree, hf_kademlia_search_expression_type, tvb, offset, 1, op);
2523 tree = proto_item_add_subtree( ti, ett_kademlia_search_expression );
2524 ++offset;
2525 increment_dissection_depth(pinfo);
2526 switch( op ) {
2527 case 0: /* Bool op */
2528 proto_tree_add_item(tree, hf_kademlia_search_bool_op, tvb, offset, 1, ENC_NA );
2529 ++offset;
2530
2531 /* Left */
2532 offset = dissect_kademlia_search_expression_tree( tvb, pinfo, offset, tree );
2533 /* Right */
2534 offset = dissect_kademlia_search_expression_tree( tvb, pinfo, offset, tree );
2535 break;
2536
2537 case 1: /* String */
2538 offset = dissect_kademlia_string( tvb, pinfo, offset, tree );
2539 break;
2540 case 2: /* Meta Tag */
2541 /* tag value */
2542 offset = dissect_edonkey_string( tvb, pinfo, offset, tree );
2543 /* tag name */
2544 offset = dissect_kademlia_tagname( tvb, pinfo, offset, tree, NULL, NULL );
2545 break;
2546 case 3: /* Min/Max - 32bit! */
2547 offset = dissect_kademlia_search_condition_argument_uint32( tvb, pinfo, offset, tree );
2548 offset = dissect_kademlia_search_condition( tvb, pinfo, offset, tree );
2549 /* tag name */
2550 offset = dissect_kademlia_tagname( tvb, pinfo, offset, tree, NULL, NULL );
2551 break;
2552 case 8: /* Min/Max - 64bit! */
2553 offset = dissect_kademlia_search_condition_argument_uint64( tvb, pinfo, offset, tree );
2554 offset = dissect_kademlia_search_condition( tvb, pinfo, offset, tree );
2555 /* tag name */
2556 offset = dissect_kademlia_tagname( tvb, pinfo, offset, tree, NULL, NULL );
2557 break;
2558 default:
2559 expert_add_info_format(pinfo, ti, &ei_kademlia_search_expression_type, "NOT DECODED op %x", op );
2560 }
2561 decrement_dissection_depth(pinfo);
2562 proto_item_set_len( ti, offset - item_start_offset );
2563 return offset;
2564 }
2565
2566 static int dissect_kademlia2_prolog( tvbuff_t *tvb, packet_info *pinfo,
2567 int offset, proto_tree *tree)
2568 {
2569 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_peer_id);
2570 offset = dissect_kademlia_tcp_port(tvb, pinfo, offset, tree);
2571
2572 proto_tree_add_item(tree, hf_kademlia_version, tvb, offset, 1, ENC_BIG_ENDIAN);
2573 offset++;
2574
2575 return offset;
2576 }
2577
2578 static int dissect_kademlia_uload( tvbuff_t *tvb, packet_info *pinfo _U_,
2579 int offset, proto_tree *tree)
2580 {
2581 proto_tree_add_item(tree, hf_edonkey_kademlia_uload, tvb, offset, 1, ENC_NA);
2582 return offset +1;
2583
2584 }
2585 static int dissect_kademlia_udp_message(uint8_t msg_type,
2586 tvbuff_t *tvb, packet_info *pinfo,
2587 int offset, int length, proto_tree *tree)
2588 {
2589 int msg_end, bytes_remaining;
2590 proto_item *hidden_item;
2591
2592 bytes_remaining = tvb_reported_length_remaining(tvb, offset);
2593 if ((length < 0) || (length > bytes_remaining)) length = bytes_remaining;
2594 if (length <= 0) return offset;
2595
2596 hidden_item = proto_tree_add_item(tree, hf_kademlia, tvb, offset, 1, ENC_BIG_ENDIAN);
2597 proto_item_set_hidden(hidden_item);
2598
2599 msg_end = offset + length;
2600
2601 switch (msg_type) {
2602 case KADEMLIA_BOOTSTRAP_REQ:/* <PEER [25]> */
2603 case KADEMLIA_HELLO_REQ:
2604 case KADEMLIA_HELLO_RES:
2605 offset = dissect_kademlia_peer(tvb, pinfo, offset, tree);
2606 break;
2607 case KADEMLIA2_BOOTSTRAP_REQ:
2608 offset = dissect_kademlia2_prolog( tvb, pinfo, offset, tree );
2609 break;
2610
2611 case KADEMLIA2_HELLO_REQ:
2612 case KADEMLIA2_HELLO_RES:
2613 offset = dissect_kademlia2_prolog( tvb, pinfo, offset, tree );
2614 offset = dissect_kademlia_taglist( tvb, pinfo, offset, tree );
2615 break;
2616 case KADEMLIA_BOOTSTRAP_RES: /* <CNT [2]> <PEER [25]>*(CNT) */
2617 offset = dissect_kademlia_peer_list_2byte( tvb, pinfo, offset, tree );
2618 break;
2619 case KADEMLIA2_BOOTSTRAP_RES:
2620 offset = dissect_kademlia2_prolog( tvb, pinfo, offset, tree );
2621 offset = dissect_kademlia2_peer_list_2byte( tvb, pinfo, offset, tree );
2622 break;
2623
2624 case KADEMLIA2_SEARCH_SOURCE_REQ:
2625 {
2626 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2627 /* start pos */
2628 proto_tree_add_item(tree, hf_edonkey_kademlia_start_position, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2629 offset +=2;
2630 /* filesize */
2631 proto_tree_add_item(tree, hf_edonkey_kademlia_filesize, tvb, offset, 8, ENC_LITTLE_ENDIAN);
2632 offset +=8;
2633 }
2634 break;
2635
2636 case KADEMLIA_SEARCH_NOTES_REQ: /* <HASH (key) [16]> */
2637 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_hash);
2638 break;
2639
2640 case KADEMLIA2_SEARCH_KEY_REQ:
2641 {
2642 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2643 /* start pos */
2644 proto_tree_add_item(tree, hf_edonkey_kademlia_start_position, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2645 offset += 2;
2646 }
2647 break;
2648 case KADEMLIA2_SEARCH_NOTES_REQ:
2649
2650 case KADEMLIA_PUBLISH_RES:
2651 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2652 if (offset<msg_end) {
2653 offset = dissect_kademlia_uload( tvb, pinfo, offset, tree );
2654 }
2655 break;
2656 case KADEMLIA2_PUBLISH_RES:
2657 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2658 offset = dissect_kademlia_uload( tvb, pinfo, offset, tree );
2659 break;
2660
2661 case KADEMLIA_REQ: /* <TYPE [1]> <HASH (target) [16]> <HASH (receiver) 16> */
2662 case KADEMLIA2_REQ:
2663 {
2664 int type;
2665 uint8_t target_id[16];
2666 uint8_t recipients_id[16];
2667 proto_item *ti;
2668 int i, j, k, l;
2669 char binarray[129];
2670
2671 type = tvb_get_uint8(tvb, offset);
2672 ti = proto_tree_add_uint_format_value(tree, hf_kademlia_request_type, tvb, offset, 1, type, "0x%02x", type );
2673 proto_item_append_text(ti, "%s", val_to_str_const(type, kademlia_parameter, " Unknown"));
2674 offset +=1;
2675
2676 /* get target id */
2677 for (i=0; i<4; i++) {
2678 for (j=3; j>=0; j--) {
2679 l = (j+4*i);
2680 target_id[l] = tvb_get_uint8(tvb, offset + abs(8*i-(l-3)));
2681 }
2682 }
2683
2684 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2685
2686 /* get recipient's id */
2687 for (i=0; i<4; i++) {
2688 for (j=3; j>=0; j--) {
2689 l = (j+4*i);
2690 recipients_id[l] = tvb_get_uint8(tvb, offset + abs(8*i-(l-3)));
2691 }
2692 }
2693
2694 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_recipients_id);
2695
2696 /* target_id XOR recipients_id */
2697 for (i=0; i<16; i++) {
2698 k = 128;
2699 l = target_id[i]^recipients_id[i];
2700 for(j=8*i; j<8*i+8; j++) {
2701 if (l >= k) {
2702 binarray[j] = '1';
2703 l = l-k;
2704 }
2705 else
2706 binarray[j] = '0';
2707 k = k/2;
2708 }
2709 }
2710 binarray[128] = '\0';
2711 proto_tree_add_string(tree, hf_kademlia_distance, tvb, offset, 0, binarray);
2712 }
2713 break;
2714
2715 case KADEMLIA_RES: /* <HASH (target) [16]> <CNT> <PEER [25]>*(CNT) */
2716 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2717 offset = dissect_kademlia_peer_list_1byte( tvb, pinfo, offset, tree );
2718 break;
2719 case KADEMLIA2_RES:
2720 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2721 offset = dissect_kademlia2_peer_list_1byte( tvb, pinfo, offset, tree );
2722 break;
2723
2724 case KADEMLIA_FIREWALLED_RES: /* <IP (sender) [4]> */
2725 offset = dissect_kademlia_ip_address( tvb, pinfo, offset, tree );
2726 break;
2727
2728 case KADEMLIA_FIREWALLED_REQ: /* <TCPPORT (sender) [2]> */
2729 offset = dissect_kademlia_tcp_port( tvb, pinfo, offset, tree );
2730 break;
2731 case KADEMLIA_CALLBACK_REQ:
2732 case KADEMLIA_FINDBUDDY_REQ:
2733 case KADEMLIA_FINDBUDDY_RES:
2734 /* buddy id */
2735 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_hash);
2736 /* userid */
2737 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_hash);
2738 offset = dissect_kademlia_tcp_port( tvb, pinfo, offset, tree );
2739 break;
2740 case KADEMLIA2_PUBLISH_SOURCE_REQ:
2741 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_file_id);
2742 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_peer_id);
2743 offset = dissect_kademlia_taglist( tvb, pinfo, offset, tree );
2744 break;
2745 case KADEMLIA_SEARCH_REQ:
2746 {
2747 int restrictive;
2748 /* Target (16bytes) */
2749 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2750 /* Restrictive (1 byte) 0/1 */
2751 restrictive = tvb_get_uint8(tvb, offset);
2752 proto_tree_add_item(tree, hf_edonkey_kademlia_restrictive, tvb, offset, 1, ENC_NA);
2753 offset +=1;
2754
2755 if ( offset < msg_end && restrictive )
2756 offset = dissect_kademlia_search_expression_tree( tvb, pinfo, offset, tree );
2757 }
2758 break;
2759 case KADEMLIA_SEARCH_RES:
2760 /* Target */
2761 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2762 /* Results list */
2763 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Result", dissect_kademlia_search_result );
2764 break;
2765 case KADEMLIA2_SEARCH_RES:
2766 /* Sender */
2767 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_sender_id);
2768 /* Target */
2769 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_target_id);
2770 /* Results list */
2771 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "Result", dissect_kademlia_search_result );
2772 break;
2773 case KADEMLIA2_PUBLISH_KEY_REQ:
2774 {
2775 /* Keyword Hash */
2776 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_keyword_hash);
2777 /* Results list */
2778 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "StuffToPublish", dissect_kademlia_publish_req_entry_file );
2779 break;
2780 }
2781 case KADEMLIA_PUBLISH_REQ: /* 0x40 // <HASH (key) [16]> <CNT1 [2]> (<HASH (target) [16]> <CNT2 [2]> <META>*(CNT2))*(CNT1) */
2782 {
2783 uint8_t tagname_value=0, taglist_size, type;
2784 int i=1, j=34;
2785
2786 /* check if TAG_SOURCETYPE is set */
2787 taglist_size = tvb_get_uint8(tvb, offset + j);
2788 j++;
2789
2790 while(i <= taglist_size) {
2791 type = tvb_get_uint8(tvb, offset + j);
2792 j +=3;
2793 tagname_value = tvb_get_uint8(tvb, offset + j);
2794 if (tagname_value == 0xff)
2795 i = taglist_size;
2796 j++;
2797 switch(type) {
2798 case KADEMLIA_TAGTYPE_HASH:
2799 j += 16;
2800 break;
2801 case KADEMLIA_TAGTYPE_STRING:
2802 {
2803 uint16_t string_length = tvb_get_letohs(tvb, offset+j);
2804 j += 2 + string_length;
2805 break;
2806 }
2807 case KADEMLIA_TAGTYPE_UINT8:
2808 j += 1;
2809 break;
2810 case KADEMLIA_TAGTYPE_UINT16:
2811 j += 2;
2812 break;
2813 case KADEMLIA_TAGTYPE_UINT32:
2814 case KADEMLIA_TAGTYPE_FLOAT32:
2815 j += 4;
2816 break;
2817 case KADEMLIA_TAGTYPE_UINT64:
2818 j += 8;
2819 break;
2820 case KADEMLIA_TAGTYPE_BSOB:
2821 {
2822 uint16_t bsob_length = tvb_get_uint8(tvb, offset);
2823 j += 1 + bsob_length;
2824 break;
2825 }
2826 }
2827 i++;
2828 }
2829
2830 switch (tagname_value) {
2831 case KADEMLIA_TAG_SOURCETYPE:
2832 {
2833 /* Target */
2834 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_file_id);
2835 /* Results list */
2836 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "StuffToPublish", dissect_kademlia_publish_req_entry_peer);
2837 }
2838 break;
2839 default:
2840 {
2841 /* Target */
2842 offset = dissect_kademlia_hash(tvb, pinfo, offset, tree, &hf_kademlia_keyword_hash);
2843 /* Results list */
2844 offset = dissect_edonkey_list(tvb, pinfo, offset, tree, 2, "StuffToPublish", dissect_kademlia_publish_req_entry_file);
2845 }
2846 }
2847 }
2848 }
2849
2850 return offset;
2851 }
2852
2853 static int dissect_kademlia_udp_compressed_message(uint8_t msg_type,
2854 tvbuff_t *tvb, packet_info *pinfo,
2855 int offset, int length, proto_tree *tree)
2856 {
2857 tvbuff_t *tvbraw = NULL;
2858
2859
2860 tvbraw = tvb_child_uncompress_zlib(tvb, tvb, offset, length);
2861
2862 if (tvbraw) {
2863 uint32_t raw_length;
2864
2865 raw_length = tvb_captured_length( tvbraw );
2866 add_new_data_source(pinfo, tvbraw, "Decompressed Data");
2867
2868 dissect_kademlia_udp_message( msg_type, tvbraw, pinfo, 0, raw_length, tree );
2869 offset += length;
2870 } else {
2871 proto_tree_add_item(tree, hf_edonkey_broken_compressed_data, tvb, offset, length, ENC_NA);
2872 }
2873 return offset;
2874 }
2875
2876
2877 static unsigned get_edonkey_tcp_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb,
2878 int offset, void *data _U_)
2879 {
2880 uint32_t msg_len;
2881
2882 /*
2883 * Get the length of the eDonkey packet.
2884 */
2885 msg_len = tvb_get_letohl(tvb, offset+1);
2886
2887 /*
2888 * That length doesn't include the header; add that in.
2889 * XXX - what if it overflows?
2890 */
2891 return msg_len + EDONKEY_TCP_HEADER_LENGTH;
2892 }
2893
2894 static int dissect_edonkey_tcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
2895 {
2896 proto_item *ti;
2897 proto_tree *edonkey_tree, *edonkey_msg_tree = NULL, *emule_zlib_tree = NULL;
2898 int offset;
2899 uint8_t protocol, msg_type;
2900 uint32_t msg_len;
2901 const char *protocol_name, *message_name;
2902 void (*dissector)(uint8_t, tvbuff_t*, packet_info*, int, int, proto_tree*);
2903 tvbuff_t *tvbraw = NULL;
2904
2905 col_set_str(pinfo->cinfo, COL_PROTOCOL, "eDonkey");
2906
2907 ti = proto_tree_add_item(tree, proto_edonkey, tvb, 0, -1, ENC_NA);
2908 edonkey_tree = proto_item_add_subtree(ti, ett_edonkey);
2909
2910 offset = 0;
2911 protocol = tvb_get_uint8(tvb, offset);
2912 msg_len = tvb_get_letohl(tvb, offset+1);
2913
2914 protocol_name = val_to_str_const(protocol, edonkey_protocols, "Unknown");
2915
2916 col_append_sep_fstr(pinfo->cinfo, COL_INFO, ", ", "%s TCP", protocol_name);
2917
2918 /* Add edonkey message tree */
2919 if (edonkey_tree) {
2920 ti = proto_tree_add_item(edonkey_tree, hf_edonkey_message, tvb,
2921 offset, EDONKEY_TCP_HEADER_LENGTH + msg_len, ENC_NA);
2922 edonkey_msg_tree = proto_item_add_subtree(ti, ett_edonkey_message);
2923
2924 proto_tree_add_uint(edonkey_msg_tree, hf_edonkey_protocol, tvb, offset, 1, protocol);
2925 proto_tree_add_uint(edonkey_msg_tree, hf_edonkey_message_length, tvb, offset+1, 4, msg_len);
2926 }
2927
2928
2929 /* Skip past the EDONKEY Header */
2930 offset += EDONKEY_TCP_HEADER_LENGTH;
2931
2932 msg_type = tvb_get_uint8(tvb, offset);
2933 switch (protocol) {
2934 case EDONKEY_PROTO_EDONKEY:
2935 message_name = val_to_str_const(msg_type, edonkey_tcp_msgs, "Unknown");
2936 dissector = dissect_edonkey_tcp_message;
2937 break;
2938
2939 case EDONKEY_PROTO_EMULE_EXT:
2940 message_name = val_to_str_const(msg_type, emule_tcp_msgs,
2941 val_to_str_const(msg_type, edonkey_tcp_msgs, "Unknown"));
2942 dissector = dissect_emule_tcp_message;
2943 break;
2944
2945 case EDONKEY_PROTO_EMULE_COMP:
2946 /*
2947 * These ought to be exactly the same as standard eDonkey (0xe5) messages,
2948 * except that the payload (after the type byte) is a zlib compressed
2949 * stream.
2950 */
2951 message_name = val_to_str_const(msg_type, edonkey_tcp_msgs, "Unknown");
2952 tvbraw = tvb_child_uncompress_zlib(tvb, tvb, offset+1, msg_len-1);
2953 if (tvbraw) {
2954 dissector = dissect_edonkey_tcp_message;
2955 break;
2956 }
2957 /* FALL THROUGH */
2958 default:
2959 message_name = "Unknown";
2960 dissector = NULL;
2961 break;
2962 }
2963
2964 col_append_fstr(pinfo->cinfo, COL_INFO, ": %s", message_name);
2965
2966 if (edonkey_msg_tree) {
2967 proto_tree_add_uint_format_value(edonkey_msg_tree, hf_edonkey_message_type, tvb, offset, 1, msg_type,
2968 "%s (0x%02x)", message_name, msg_type);
2969 if (dissector && (msg_len > 1)) {
2970 if (!tvbraw) {
2971 (*dissector)(msg_type, tvb, pinfo, offset+1, msg_len-1, edonkey_msg_tree);
2972 } else {
2973 ti = proto_tree_add_item(edonkey_msg_tree, hf_emule_zlib, tvb,
2974 offset+1, msg_len-1, ENC_NA);
2975 emule_zlib_tree = proto_item_add_subtree(ti, ett_emule_zlib);
2976 add_new_data_source(pinfo, tvbraw, "Decompressed Data");
2977 (*dissector)(msg_type, tvbraw, pinfo, 0, tvb_captured_length(tvbraw), emule_zlib_tree);
2978 }
2979 }
2980 }
2981
2982 return tvb_captured_length(tvb);
2983 }
2984
2985 static int dissect_edonkey_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
2986 {
2987 uint8_t protocol;
2988
2989 /* An eDonkey TCP packet is at least 5 bytes long msg type + length */
2990 if (!tvb_bytes_exist(tvb, 0, EDONKEY_TCP_HEADER_LENGTH))
2991 return 0;
2992
2993 protocol = tvb_get_uint8(tvb, 0);
2994 if (try_val_to_str(protocol, edonkey_protocols) == NULL)
2995 return 0; /* Not a known protocol */
2996
2997 col_clear(pinfo->cinfo, COL_INFO);
2998
2999 tcp_dissect_pdus(tvb, pinfo, tree, edonkey_desegment,
3000 EDONKEY_TCP_HEADER_LENGTH, get_edonkey_tcp_pdu_len,
3001 dissect_edonkey_tcp_pdu, data);
3002 return tvb_reported_length(tvb);
3003 }
3004
3005 static int dissect_edonkey_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
3006 {
3007 proto_item *ti;
3008 proto_tree *edonkey_tree = NULL, *edonkey_msg_tree = NULL;
3009 int offset = 0;
3010 uint8_t protocol, msg_type;
3011 const char *protocol_name, *message_name;
3012
3013 /* An eDonkey UDP packet is at least 2 bytes long */
3014 if (!tvb_bytes_exist(tvb, 0, EDONKEY_UDP_HEADER_LENGTH))
3015 return 0;
3016
3017 protocol = tvb_get_uint8(tvb, offset);
3018 if (try_val_to_str(protocol, edonkey_protocols) == NULL)
3019 return 0; /* Not a known protocol */
3020
3021 col_set_str(pinfo->cinfo, COL_PROTOCOL, "eDonkey");
3022
3023 if (tree) {
3024 ti = proto_tree_add_item(tree, proto_edonkey, tvb, 0, -1, ENC_NA);
3025 edonkey_tree = proto_item_add_subtree(ti, ett_edonkey);
3026 }
3027
3028 offset = 0;
3029 /* eDonkey UDP message - Assume that there is one message per packet */
3030 msg_type = tvb_get_uint8(tvb, offset+1);
3031 protocol_name = val_to_str_const(protocol, edonkey_protocols, "Unknown");
3032
3033 if (protocol == EDONKEY_PROTO_KADEMLIA || protocol == EDONKEY_PROTO_KADEMLIA_COMP
3034 || protocol == EDONKEY_PROTO_ADU_KADEMLIA || protocol == EDONKEY_PROTO_ADU_KADEMLIA_COMP)
3035 message_name = val_to_str_const( msg_type, kademlia_msgs, "Unknown");
3036 else
3037 message_name = val_to_str_const(msg_type, edonkey_udp_msgs, "Unknown");
3038
3039 col_add_fstr(pinfo->cinfo, COL_INFO, "%s UDP: %s", protocol_name, message_name);
3040
3041 if (edonkey_tree) {
3042 int remainingLength, extraBytes;
3043
3044 ti = proto_tree_add_item(edonkey_tree, hf_edonkey_message, tvb, offset, -1, ENC_NA);
3045 edonkey_msg_tree = proto_item_add_subtree(ti, ett_edonkey_message);
3046
3047 proto_tree_add_uint(edonkey_msg_tree, hf_edonkey_protocol, tvb, offset, 1, protocol);
3048 proto_tree_add_uint_format_value(edonkey_msg_tree, hf_edonkey_message_type, tvb, offset+1, 1, msg_type,
3049 "%s (0x%02x)", message_name, msg_type);
3050
3051 offset += EDONKEY_UDP_HEADER_LENGTH;
3052 remainingLength = tvb_captured_length_remaining( tvb, offset );
3053
3054 if (remainingLength > 0) {
3055 switch (protocol) {
3056 case EDONKEY_PROTO_EDONKEY:
3057 offset = dissect_edonkey_udp_message(msg_type, tvb, pinfo, offset, remainingLength, edonkey_msg_tree);
3058 break;
3059
3060 case EDONKEY_PROTO_EMULE_EXT:
3061 offset = dissect_emule_udp_message(msg_type, tvb, pinfo, offset, remainingLength, edonkey_msg_tree);
3062 break;
3063
3064 case EDONKEY_PROTO_ADU_KADEMLIA:
3065 case EDONKEY_PROTO_KADEMLIA:
3066 offset = dissect_kademlia_udp_message(msg_type, tvb, pinfo, offset, remainingLength, edonkey_msg_tree);
3067 break;
3068
3069 case EDONKEY_PROTO_ADU_KADEMLIA_COMP:
3070 case EDONKEY_PROTO_KADEMLIA_COMP:
3071 offset = dissect_kademlia_udp_compressed_message(msg_type, tvb, pinfo, offset, remainingLength, edonkey_msg_tree);
3072 break;
3073
3074 default:
3075 break;
3076 }
3077 }
3078
3079 extraBytes = tvb_reported_length_remaining( tvb, offset );
3080
3081 if ( extraBytes > 0 ) {
3082 /* trailing garbage or broken packet */
3083 proto_tree_add_uint_format(tree, hf_edonkey_unparsed_data_length, tvb, offset, extraBytes, extraBytes,
3084 "Trailing/Undecoded data: %d bytes", extraBytes );
3085 }
3086 }
3087
3088 return tvb_reported_length(tvb);
3089 }
3090
3091 static void
3092 edonkey_fmt_revision(char *result, uint32_t revision )
3093 {
3094 snprintf( result, ITEM_LABEL_LENGTH, "%u.%u", (uint16_t)(revision & 0xFFFF), (uint16_t)(( revision & 0xFFFF0000 ) >> 16) );
3095 }
3096
3097 void proto_register_edonkey(void) {
3098
3099 static hf_register_info hf[] = {
3100 { &hf_edonkey_message,
3101 { "eDonkey Message", "edonkey.message",
3102 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3103 { &hf_edonkey_protocol,
3104 { "Protocol", "edonkey.protocol",
3105 FT_UINT8, BASE_HEX, VALS(edonkey_protocols), 0, "eDonkey Protocol", HFILL } },
3106 { &hf_edonkey_message_length,
3107 { "Message Length", "edonkey.message.length",
3108 FT_UINT32, BASE_DEC, NULL, 0, "eDonkey Message Length", HFILL } },
3109 { &hf_edonkey_message_type,
3110 { "Message Type", "edonkey.message.type",
3111 FT_UINT8, BASE_HEX, NULL, 0, "eDonkey Message Type", HFILL } },
3112 { &hf_edonkey_client_hash,
3113 { "Client Hash", "edonkey.client_hash",
3114 FT_BYTES, BASE_NONE, NULL, 0, "eDonkey Client Hash", HFILL } },
3115 { &hf_edonkey_server_hash,
3116 { "Server Hash", "edonkey.server_hash",
3117 FT_BYTES, BASE_NONE, NULL, 0, "eDonkey Server Hash", HFILL } },
3118 { &hf_edonkey_file_hash,
3119 { "File Hash", "edonkey.file_hash",
3120 FT_BYTES, BASE_NONE, NULL, 0, "eDonkey File Hash", HFILL } },
3121 { &hf_edonkey_client_id,
3122 { "Client ID", "edonkey.clientid",
3123 FT_IPv4, BASE_NONE, NULL, 0, "eDonkey Client ID", HFILL } },
3124 { &hf_edonkey_ip,
3125 { "IP", "edonkey.ip",
3126 FT_IPv4, BASE_NONE, NULL, 0, "eDonkey IP", HFILL } },
3127 { &hf_edonkey_port,
3128 { "Port", "edonkey.port",
3129 FT_UINT16, BASE_DEC, NULL, 0, "eDonkey Port", HFILL } },
3130 { &hf_edonkey_metatag,
3131 { "eDonkey Meta Tag", "edonkey.metatag",
3132 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3133 { &hf_edonkey_metatag_type,
3134 { "Meta Tag Type", "edonkey.metatag.type",
3135 FT_UINT8, BASE_HEX, NULL, 0, "eDonkey Meta Tag Type", HFILL } },
3136 { &hf_edonkey_metatag_id,
3137 { "Meta Tag ID", "edonkey.metatag.id",
3138 FT_UINT8, BASE_HEX, NULL, 0, "eDonkey Meta Tag ID", HFILL } },
3139 { &hf_edonkey_metatag_name,
3140 { "Meta Tag Name", "edonkey.metatag.name",
3141 FT_STRING, BASE_NONE, NULL, 0, "eDonkey Meta Tag Name", HFILL } },
3142 { &hf_edonkey_metatag_namesize,
3143 { "Meta Tag Name Size", "edonkey.metatag.namesize",
3144 FT_UINT16, BASE_DEC, NULL, 0, "eDonkey Meta Tag Name Size", HFILL } },
3145 { &hf_edonkey_hash,
3146 { "Hash", "edonkey.hash",
3147 FT_BYTES, BASE_NONE, NULL, 0, "eDonkey Hash", HFILL } },
3148 { &hf_edonkey_string,
3149 { "String", "edonkey.string",
3150 FT_STRING, BASE_NONE, NULL, 0, "eDonkey String", HFILL } },
3151 { &hf_edonkey_string_length,
3152 { "String Length", "edonkey.string_length",
3153 FT_UINT16, BASE_DEC, NULL, 0, "eDonkey String Length", HFILL } },
3154 { &hf_edonkey_part_count,
3155 { "Part Count", "edonkey.part_count",
3156 FT_UINT16, BASE_DEC, NULL, 0, "eDonkey Part Count", HFILL } },
3157 { &hf_edonkey_file_status,
3158 { "File Status", "edonkey.file_status",
3159 FT_BYTES, BASE_NONE, NULL, 0, "eDonkey File Status", HFILL } },
3160 { &hf_edonkey_directory,
3161 { "Directory", "edonkey.directory",
3162 FT_STRING, BASE_NONE, NULL, 0, "eDonkey Directory", HFILL } },
3163 { &hf_edonkey_fileinfo,
3164 { "eDonkey File Info", "edonkey.fileinfo",
3165 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3166 { &hf_edonkey_serverinfo,
3167 { "eDonkey Server Info", "edonkey.serverinfo",
3168 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3169 { &hf_edonkey_clientinfo,
3170 { "eDonkey Client Info", "edonkey.clientinfo",
3171 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3172 { &hf_emule_public_key,
3173 { "Public Key", "edonkey.emule.public_key",
3174 FT_BYTES, BASE_NONE, NULL, 0, "eMule Public Key", HFILL } },
3175 { &hf_emule_signature,
3176 { "Signature", "edonkey.emule.signature",
3177 FT_BYTES, BASE_NONE, NULL, 0, "eMule Signature", HFILL } },
3178 { &hf_emule_aich_partnum,
3179 { "Part Number", "edonkey.emule.aich_partnum",
3180 FT_UINT16, BASE_DEC, NULL, 0, "eMule AICH Part Number", HFILL } },
3181 { &hf_emule_aich_root_hash,
3182 { "AICH Root Hash", "edonkey.emule.aich_root_hash",
3183 FT_BYTES, BASE_NONE, NULL, 0, "eMule AICH Root Hash", HFILL } },
3184 { &hf_emule_aich_hash_entry,
3185 { "AICH Hash Entry", "edonkey.emule.aich_hash_entry",
3186 FT_NONE, BASE_NONE, NULL, 0, "eMule AICH Hash Entry", HFILL } },
3187 { &hf_emule_aich_hash_id,
3188 { "AICH Hash ID", "edonkey.emule.aich_hash_id",
3189 FT_UINT16, BASE_HEX, NULL, 0, "eMule AICH Hash ID", HFILL } },
3190 { &hf_emule_aich_hash,
3191 { "AICH Hash", "edonkey.emule.aich_hash",
3192 FT_BYTES, BASE_NONE, NULL, 0, "eMule AICH Hash", HFILL } },
3193 { &hf_emule_multipacket_entry,
3194 { "eMule MultiPacket Entry", "edonkey.emule.multipacket_entry",
3195 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3196 { &hf_emule_multipacket_opcode,
3197 { "MultiPacket Opcode", "edonkey.emule.multipacket_opcode",
3198 FT_UINT8, BASE_HEX, NULL, 0, "eMule MultiPacket Opcode", HFILL } },
3199 { &hf_emule_sourceOBFU,
3200 {"Source", "edonkey.source",
3201 FT_NONE, BASE_NONE, NULL, 0, "eDonkey File Source", HFILL } },
3202 { &hf_emule_source_count,
3203 { "Completed Sources Count", "edonkey.emule.source_count",
3204 FT_UINT16, BASE_DEC, NULL, 0, "eMule Completed Sources Count", HFILL } },
3205 { &hf_emule_zlib,
3206 { "Compressed Data", "edonkey.emule.zlib",
3207 FT_NONE, BASE_NONE, NULL, 0, "eMule Compressed Data", HFILL } },
3208 { &hf_overnet_peer,
3209 { "Overnet Peer", "edonkey.overnet.peer",
3210 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3211 { &hf_kademlia,
3212 { "Kademlia Packet", "edonkey.kademlia",
3213 FT_UINT8, BASE_HEX, NULL, 0, "Kademlia Packet Type", HFILL } },
3214 { &hf_kademlia_peertype,
3215 { "Peer Type", "edonkey.kademlia.peer.type",
3216 FT_UINT8, BASE_DEC_HEX, NULL, 0, "Kademlia Peer Type", HFILL } },
3217 { &hf_kademlia_peer,
3218 { "Kademlia Peer", "edonkey.kademlia.peer",
3219 FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL } },
3220 { &hf_kademlia_peer_id,
3221 { "Peer ID", "edonkey.kademlia.peer.id",
3222 FT_STRING, BASE_NONE, NULL, 0, "Kademlia Peer ID", HFILL } },
3223 { &hf_kademlia_hash,
3224 { "Kademlia Hash", "edonkey.kademlia.hash",
3225 FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } },
3226 { &hf_kademlia_file_id,
3227 { "File ID", "edonkey.kademlia.file.id",
3228 FT_STRING, BASE_NONE, NULL, 0, "Kademlia File ID", HFILL } },
3229 { &hf_kademlia_keyword_hash,
3230 { "Keyword Hash", "edonkey.kademlia.keyword.hash",
3231 FT_STRING, BASE_NONE, NULL, 0, "Kademlia Keyword Hash", HFILL } },
3232 { &hf_kademlia_recipients_id,
3233 { "Recipient's ID", "edonkey.kademlia.recipients.id",
3234 FT_STRING, BASE_NONE, NULL, 0, "Kademlia Recipient's ID", HFILL } },
3235 { &hf_kademlia_sender_id,
3236 { "Sender ID", "edonkey.kademlia.sender.id",
3237 FT_STRING, BASE_NONE, NULL, 0, "Kademlia Sender ID", HFILL } },
3238 { &hf_kademlia_target_id,
3239 { "Target ID", "edonkey.kademlia.target.id",
3240 FT_STRING, BASE_NONE, NULL, 0, "Kademlia Target ID", HFILL } },
3241 { &hf_kademlia_distance,
3242 { "XOR Distance", "edonkey.kademlia.distance",
3243 FT_STRING, BASE_NONE, NULL, 0, "Kademlia XOR Distance", HFILL } },
3244 { &hf_kademlia_version,
3245 { "Kad Version", "edonkey.kademlia.version",
3246 FT_UINT8, BASE_DEC_HEX, VALS(kademlia_versions), 0, NULL, HFILL } },
3247 { &hf_kademlia_tag_float,
3248 { "Tag Value (Float)", "edonkey.kademlia.tag.value.float",
3249 FT_FLOAT, BASE_NONE, NULL, 0, "Float Tag Value", HFILL } },
3250 { &hf_kademlia_tag_uint64,
3251 { "Tag Value (UINT64)", "edonkey.kademlia.tag.value.uint64",
3252 FT_UINT64, BASE_DEC_HEX, NULL, 0, "UINT64 Tag Value", HFILL } },
3253 { &hf_kademlia_tag_uint32,
3254 { "Tag Value (UINT32)", "edonkey.kademlia.tag.value.uint32",
3255 FT_UINT32, BASE_DEC_HEX, NULL, 0, "UINT32 Tag Value", HFILL } },
3256 { &hf_kademlia_tag_ipv4,
3257 { "Tag Value (IPv4)", "edonkey.kademlia.tag.value.ipv4",
3258 FT_IPv4, BASE_NONE, NULL, 0, "UINT32 Tag Value (IPv4)", HFILL } },
3259 { &hf_kademlia_tag_uint16,
3260 { "Tag Value (UINT16)", "edonkey.kademlia.tag.value.uint16",
3261 FT_UINT16, BASE_DEC_HEX, NULL, 0, "UINT16 Tag Value", HFILL } },
3262 { &hf_kademlia_tag_uint8,
3263 { "Tag Value (UINT8)", "edonkey.kademlia.tag.value.uint8",
3264 FT_UINT8, BASE_DEC_HEX, NULL, 0, "UINT8 Tag Value", HFILL } },
3265 { &hf_kademlia_tag_hash,
3266 { "Tag Value (HASH)", "edonkey.kademlia.tag.value.hash",
3267 FT_STRING, BASE_NONE, NULL, 0, "HASH Tag Value", HFILL } },
3268 { &hf_kademlia_tag_string,
3269 { "Tag Value (String)", "edonkey.kademlia.tag.value.string",
3270 FT_STRING, BASE_NONE, NULL, 0, "String Tag Value", HFILL } },
3271 { &hf_kademlia_tag_bsob,
3272 { "Tag Value (BSOB)", "edonkey.kademlia.tag.value.bsob",
3273 FT_BYTES, BASE_NONE, NULL, 0, "BSOB Tag Value", HFILL } },
3274 { &hf_kademlia_udp_port,
3275 { "UDP Port", "edonkey.kademlia.udp_port",
3276 FT_UINT16, BASE_DEC, NULL, 0, "Kademlia UDP Port", HFILL } },
3277 { &hf_kademlia_ip,
3278 { "IP", "edonkey.kademlia.ip",
3279 FT_IPv4, BASE_NONE, NULL, 0, "eDonkey IP", HFILL } },
3280 { &hf_kademlia_tcp_port,
3281 { "TCP Port", "edonkey.kademlia.tcp_port",
3282 FT_UINT16, BASE_DEC, NULL, 0, "Kademlia TCP Port", HFILL } },
3283 #if 0
3284 { &hf_kademlia_unparsed_data_length,
3285 { "Kademlia unparsed data length", "edonkey.kademlia.unparsed",
3286 FT_UINT16, BASE_DEC, NULL, 0, "Kademlia trailing data length", HFILL } },
3287 #endif
3288 { &hf_kademlia_tag_name,
3289 { "Tag Name", "edonkey.kademlia.tag.name",
3290 FT_UINT8, BASE_HEX, NULL, 0, "Kademlia Tag Name String", HFILL } },
3291 { &hf_kademlia_tag_name_length,
3292 { "Tag Name Length", "edonkey.kademlia.tag.name.length",
3293 FT_UINT16, BASE_DEC, NULL, 0, "Kademlia Tag Name String Length", HFILL } },
3294 { &hf_kademlia_tag_type,
3295 { "Tag Type", "edonkey.kademlia.tag.type",
3296 FT_UINT8, BASE_HEX, VALS(kademlia_tag_types), 0, "Kademlia Tag Type", HFILL } },
3297 { &hf_kademlia_request_type,
3298 { "Request Type", "edonkey.kademlia.request.type",
3299 FT_UINT8, BASE_HEX, NULL, 0, "Kademlia Request Type", HFILL } },
3300 { &hf_kademlia_search_expression_type,
3301 { "SearchExp Type", "edonkey.kademlia.search_expression.type",
3302 FT_UINT8, BASE_HEX, VALS(edonkey_search_ext_type_vals), 0, NULL, HFILL } },
3303 { &hf_kademlia_search_bool_op,
3304 { "Bool op", "edonkey.kademlia.search.bool_op",
3305 FT_UINT8, BASE_HEX, VALS(edonkey_search_ops), 0, NULL, HFILL } },
3306 { &hf_kademlia_search_condition,
3307 { "Search Condition", "edonkey.kademlia.search.condition",
3308 FT_UINT8, BASE_HEX, NULL, 0, "Kademlia Search Condition", HFILL } },
3309 { &hf_kademlia_search_condition_argument_uint32,
3310 { "32bit Argument", "edonkey.kademlia.search.condition.argument.uint32",
3311 FT_UINT32, BASE_DEC_HEX, NULL, 0, "Kademlia Search Condition Argument 32bit Value", HFILL } },
3312 { &hf_kademlia_search_condition_argument_uint64,
3313 { "64bit Argument", "edonkey.kademlia.search.condition.argument.uint64",
3314 FT_UINT64, BASE_DEC_HEX, NULL, 0, "Kademlia Search Condition Argument 64bit Value", HFILL } },
3315 { &hf_edonkey_unparsed_data_length,
3316 { "eDonkey unparsed data length", "edonkey.unparsed",
3317 FT_UINT32, BASE_DEC_HEX, NULL, 0, "eDonkey trailing or unparsed data length", HFILL } },
3318
3319 /* Generated from convert_proto_tree_add_text.pl */
3320 { &hf_edonkey_list_size, { "List Size", "edonkey.list_size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3321 { &hf_edonkey_meta_tag_value_revision, { "Meta Tag Value", "edonkey.meta_tag_value.revision", FT_UINT32, BASE_CUSTOM, CF_FUNC(edonkey_fmt_revision), 0x0, NULL, HFILL }},
3322 { &hf_edonkey_meta_tag_value_uint, { "Meta Tag Value", "edonkey.meta_tag_value.uint", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3323 { &hf_edonkey_boolean_array_length, { "Boolean Array Length", "edonkey.boolean_array_length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3324 { &hf_edonkey_blob_length, { "BLOB Length", "edonkey.blob_length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3325 { &hf_edonkey_kademlia_string, { "String", "edonkey.kademlia_string", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3326 { &hf_emule_public_key_length, { "Public key length", "edonkey.emule.public_key_length", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3327 { &hf_emule_signature_length, { "Signature length", "edonkey.emule.signature_length", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3328 { &hf_edonkey_obfuscation_settings, { "Obfuscation Settings", "edonkey.obfuscation_settings", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3329 { &hf_edonkey_start_offset, { "Start Offset", "edonkey.start_offset", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3330 { &hf_edonkey_start_offset_64, { "Start Offset", "edonkey.start_offset64", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3331 { &hf_edonkey_end_offset, { "End Offset", "edonkey.end_offset", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3332 { &hf_edonkey_end_offset_64, { "End Offset", "edonkey.end_offset64", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3333 { &hf_edonkey_emule_file_length, { "File Length", "edonkey.emule.file_length", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3334 { &hf_edonkey_overnet_peer_type, { "Peer Type", "edonkey.overnet_peer_type", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3335 { &hf_edonkey_more_search_file_results, { "More", "edonkey.more_search_file_results", FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3336 { &hf_edonkey_file_size, { "File size", "edonkey.file_size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3337 { &hf_edonkey_large_file_size, { "Large file size", "edonkey.large_file_size", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3338 { &hf_edonkey_number_of_users, { "Number of Users", "edonkey.number_of_users", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3339 { &hf_edonkey_number_of_files, { "Number of Files", "edonkey.number_of_files", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3340 { &hf_edonkey_message_data, { "Message Data", "edonkey.message_data", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3341 { &hf_edonkey_emule_version, { "Version", "edonkey.emule.version", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3342 { &hf_edonkey_emule_queue_ranking, { "Queue Ranking", "edonkey.emule.queue_ranking", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3343 { &hf_edonkey_emule_ident_state, { "State", "edonkey.emule.state", FT_UINT8, BASE_DEC|BASE_RANGE_STRING, RVALS(emule_ident_state_rvals), 0x0, NULL, HFILL }},
3344 { &hf_edonkey_emule_rndchallenge, { "Rndchallenge", "edonkey.emule.rndchallenge", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3345 { &hf_edonkey_emule_sig_ip_used, { "Sig IP Used", "edonkey.emule.sig_ip_used", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3346 { &hf_edonkey_packed_length, { "Packed Length", "edonkey.emule.packed_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3347 { &hf_edonkey_compressed_message_data, { "Compressed Message Data", "edonkey.emule.compressed_message_data", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3348 { &hf_edonkey_challenge, { "Challenge", "edonkey.challenge", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
3349 { &hf_edonkey_max_number_of_users, { "Max number of Users", "edonkey.max_number_of_users", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3350 { &hf_edonkey_search_type, { "Search Type", "edonkey.search_type", FT_UINT8, BASE_DEC, VALS(edonkey_search_type_vals), 0x0, NULL, HFILL }},
3351 { &hf_edonkey_search_range_min, { "Search Range Min", "edonkey.search_range.min", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3352 { &hf_edonkey_search_range_max, { "Search Range Max", "edonkey.search_range.max", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3353 { &hf_edonkey_kademlia_uload, { "uLoad", "edonkey.kademlia_uload", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3354 { &hf_edonkey_kademlia_start_position, { "Start position", "edonkey.kademlia_start_position", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3355 { &hf_edonkey_kademlia_filesize, { "Filesize", "edonkey.kademlia_filesize", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3356 { &hf_edonkey_kademlia_restrictive, { "Restrictive", "edonkey.kademlia_restrictive", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
3357 { &hf_edonkey_broken_compressed_data, { "Broken Compressed data", "edonkey.broken_compressed_data", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3358 { &hf_edonkey_search_limit, { "Search Limit", "edonkey.search_limit", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3359 { &hf_edonkey_search_limit_type, { "Limit Type", "edonkey.search_limit_type", FT_UINT8, BASE_DEC, VALS(edonkey_search_conds), 0x0, NULL, HFILL }},
3360 { &hf_edonkey_search_ops, { "Search Operator", "edonkey.search_ops", FT_UINT8, BASE_HEX, VALS(edonkey_search_ops), 0x0, NULL, HFILL }},
3361 { &hf_edonkey_user_hash_length, { "User hash length", "edonkey.user_hash_length", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3362 };
3363
3364 static int *ett[] = {
3365 &ett_edonkey,
3366 &ett_edonkey_message,
3367 &ett_edonkey_metatag,
3368 &ett_edonkey_search,
3369 &ett_edonkey_fileinfo,
3370 &ett_edonkey_serverinfo,
3371 &ett_edonkey_clientinfo,
3372 &ett_emule_aichhash,
3373 &ett_emule_multipacket,
3374 &ett_emule_zlib,
3375 &ett_overnet_peer,
3376 &ett_emule_sourceOBFU,
3377 &ett_edonkey_listitem,
3378 &ett_kademlia_search_expression,
3379 &ett_kademlia_tag
3380 };
3381
3382 static ei_register_info ei[] = {
3383 { &ei_kademlia_tag_type, { "edonkey.kademlia.tag.type.undecoded", PI_PROTOCOL, PI_WARN, "Tag value not decoded", EXPFILL }},
3384 { &ei_kademlia_search_expression_type, { "edonkey.kademlia.search_expression.type.undecoded", PI_UNDECODED, PI_WARN, "NOT DECODED op", EXPFILL }},
3385 };
3386
3387 module_t *edonkey_module;
3388 expert_module_t* expert_edonkey;
3389
3390 proto_edonkey = proto_register_protocol("eDonkey Protocol", "EDONKEY", "edonkey");
3391
3392 proto_register_field_array(proto_edonkey, hf, array_length(hf));
3393 proto_register_subtree_array(ett, array_length(ett));
3394 expert_edonkey = expert_register_protocol(proto_edonkey);
3395 expert_register_field_array(expert_edonkey, ei, array_length(ei));
3396
3397 edonkey_tcp_handle = register_dissector("edonkey.tcp", dissect_edonkey_tcp, proto_edonkey);
3398 edonkey_udp_handle = register_dissector("edonkey.udp", dissect_edonkey_udp, proto_edonkey);
3399
3400 edonkey_module = prefs_register_protocol(proto_edonkey, NULL);
3401 prefs_register_bool_preference(edonkey_module, "desegment",
3402 "Reassemble eDonkey messages spanning multiple TCP segments",
3403 "Whether the eDonkey dissector should reassemble messages spanning multiple TCP segments."
3404 " To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
3405 &edonkey_desegment);
3406 }
3407
3408 void proto_reg_handoff_edonkey(void) {
3409
3410 dissector_add_uint_range_with_preference("tcp.port", EDONKEY_TCP_PORT_RANGE, edonkey_tcp_handle);
3411 dissector_add_uint_range_with_preference("udp.port", EDONKEY_UDP_PORT_RANGE, edonkey_udp_handle);
3412 }
3413
3414 /*
3415 * Editor modelines - https://www.wireshark.org/tools/modelines.html
3416 *
3417 * Local variables:
3418 * c-basic-offset: 4
3419 * tab-width: 8
3420 * indent-tabs-mode: nil
3421 * End:
3422 *
3423 * vi: set shiftwidth=4 tabstop=8 expandtab:
3424 * :indentSize=4:tabSize=8:noTabs=true:
3425 */
Metzes wireshark repo