epan/dissectors/packet-hpfeeds.c

   1 /* packet-hpfeeds.c
   2  * Routines for Honeypot Protocol Feeds packet disassembly
   3  * Copyright 2013, Sebastiano DI PAOLA - <sebastiano.dipaola@gmail.com>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12
  13 /*
  14  * Additional information regarding hpfeeds protocol can be found here
  15  * https://redmine.honeynet.org/projects/hpfeeds/wiki
  16 */
  17
  18 #include "config.h"
  19
  20 #include <epan/packet.h>
  21 #include <epan/prefs.h>
  22 #include <epan/expert.h>
  23 #include <epan/tap.h>
  24 #include <epan/stats_tree.h>
  25 #include <epan/wmem_scopes.h>
  26
  27 #include "packet-tcp.h"
  28
  29 struct HpfeedsTap {
  30     unsigned payload_size;
  31     uint8_t* channel;
  32     uint8_t opcode;
  33 };
  34
  35 static int hpfeeds_tap;
  36
  37 static const char* st_str_channels_payload = "Payload size per channel";
  38 static const char* st_str_opcodes = "Opcodes";
  39
  40 static int st_node_channels_payload = -1;
  41 static int st_node_opcodes = -1;
  42
  43 static wmem_list_t* channels_list;
  44
  45 struct channel_node {
  46     uint8_t* channel;
  47     unsigned st_node_channel_payload;
  48 };
  49
  50 void proto_register_hpfeeds(void);
  51 void proto_reg_handoff_hpfeeds(void);
  52
  53 static dissector_handle_t hpfeeds_handle;
  54
  55 static heur_dissector_list_t heur_subdissector_list;
  56
  57 /* Preferences */
  58 static bool hpfeeds_desegment = true;
  59 static bool try_heuristic = true;
  60
  61 static int proto_hpfeeds;
  62
  63 static int hf_hpfeeds_opcode;
  64 static int hf_hpfeeds_msg_length;
  65 static int hf_hpfeeds_nonce;
  66 static int hf_hpfeeds_secret;
  67 static int hf_hpfeeds_payload;
  68 static int hf_hpfeeds_server_len;
  69 static int hf_hpfeeds_server;
  70 static int hf_hpfeeds_ident_len;
  71 static int hf_hpfeeds_ident;
  72 static int hf_hpfeeds_channel;
  73 static int hf_hpfeeds_chan_len;
  74 static int hf_hpfeeds_errmsg;
  75
  76 static int ett_hpfeeds;
  77
  78 static expert_field ei_hpfeeds_opcode_unknown;
  79
  80 /* OPCODE */
  81 #define OP_ERROR       0         /* error message*/
  82 #define OP_INFO        1         /* server name, nonce */
  83 #define OP_AUTH        2         /* client id, sha1(nonce+authkey) */
  84 #define OP_PUBLISH     3         /* client id, channelname, payload */
  85 #define OP_SUBSCRIBE   4         /* client id, channelname*/
  86
  87 /* OFFSET FOR HEADER */
  88 #define HPFEEDS_HDR_LEN  5
  89
  90 static const value_string opcode_vals[] = {
  91     { OP_ERROR,      "Error" },
  92     { OP_INFO,       "Info" },
  93     { OP_AUTH,       "Auth" },
  94     { OP_PUBLISH,    "Publish" },
  95     { OP_SUBSCRIBE,  "Subscribe" },
  96     { 0,              NULL },
  97 };
  98
  99 static void
 100 dissect_hpfeeds_error_pdu(tvbuff_t *tvb, proto_tree *tree, unsigned offset)
 101 {
 102     proto_tree_add_item(tree, hf_hpfeeds_errmsg, tvb, offset, -1, ENC_ASCII);
 103 }
 104
 105 static void
 106 dissect_hpfeeds_info_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset)
 107 {
 108     uint8_t len = 0;
 109     proto_tree *data_subtree;
 110     uint8_t *strptr = NULL;
 111
 112     len = tvb_get_uint8(tvb, offset);
 113     /* don't move the offset yet as we need to get data after this operation */
 114     strptr = tvb_get_string_enc(pinfo->pool, tvb, offset + 1, len, ENC_ASCII);
 115     data_subtree = proto_tree_add_subtree_format(tree, tvb, offset, -1, ett_hpfeeds, NULL, "Broker: %s", strptr);
 116
 117     proto_tree_add_item(data_subtree, hf_hpfeeds_server_len, tvb, offset, 1,
 118         ENC_BIG_ENDIAN);
 119     offset += 1;
 120
 121     proto_tree_add_item(data_subtree, hf_hpfeeds_server, tvb, offset, len,
 122         ENC_ASCII);
 123     offset += len;
 124
 125     proto_tree_add_item(data_subtree, hf_hpfeeds_nonce, tvb, offset, -1,
 126         ENC_NA);
 127 }
 128
 129 static void
 130 dissect_hpfeeds_auth_pdu(tvbuff_t *tvb, proto_tree *tree, unsigned offset)
 131 {
 132     uint8_t len = 0;
 133
 134     len = tvb_get_uint8(tvb, offset);
 135     proto_tree_add_item(tree, hf_hpfeeds_ident_len, tvb,
 136                     offset, 1, ENC_BIG_ENDIAN);
 137     offset += 1;
 138     proto_tree_add_item(tree, hf_hpfeeds_ident, tvb,
 139                     offset, len, ENC_ASCII);
 140     offset += len;
 141
 142     proto_tree_add_item(tree, hf_hpfeeds_secret, tvb,
 143                     offset, -1, ENC_NA);
 144 }
 145
 146 static uint8_t*
 147 hpfeeds_get_channel_name(tvbuff_t* tvb, unsigned offset)
 148 {
 149     uint8_t len = tvb_get_uint8(tvb, offset);
 150     offset += len + 1;
 151     len = tvb_get_uint8(tvb, offset);
 152     offset += 1;
 153     return tvb_get_string_enc(wmem_file_scope(), tvb, offset, len, ENC_ASCII);
 154 }
 155
 156 static unsigned
 157 hpfeeds_get_payload_size(tvbuff_t* tvb, unsigned offset)
 158 {
 159     unsigned message_len = tvb_get_ntohl(tvb, offset);
 160     unsigned ident_len = tvb_get_uint8(tvb, offset + 5);
 161     unsigned channel_len = tvb_get_uint8(tvb, offset + 6 + ident_len);
 162     return (message_len - 2 - ident_len - 1 - channel_len);
 163 }
 164
 165 static void
 166 dissect_hpfeeds_publish_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 167     unsigned offset)
 168 {
 169     uint8_t len = 0;
 170     heur_dtbl_entry_t *hdtbl_entry;
 171     tvbuff_t *next_tvb;
 172     const uint8_t *channelname = NULL;
 173     const char* save_match_string = NULL;
 174
 175     len = tvb_get_uint8(tvb, offset);
 176     proto_tree_add_item(tree, hf_hpfeeds_ident_len, tvb, offset, 1, ENC_BIG_ENDIAN);
 177     offset += 1;
 178     proto_tree_add_item(tree, hf_hpfeeds_ident, tvb, offset, len, ENC_ASCII);
 179     offset += len;
 180     len = tvb_get_uint8(tvb, offset);
 181     proto_tree_add_item(tree, hf_hpfeeds_chan_len, tvb, offset, 1, ENC_BIG_ENDIAN);
 182     offset += 1;
 183
 184     /* get the channel name as ephemeral string to pass it to the heuristic decoders */
 185     proto_tree_add_item_ret_string(tree, hf_hpfeeds_channel, tvb, offset, len, ENC_ASCII|ENC_NA,
 186         pinfo->pool, &channelname);
 187     offset += len;
 188
 189     /* try the heuristic dissectors */
 190     if (try_heuristic) {
 191         /* save the current match_string before calling the subdissectors */
 192         if (pinfo->match_string)
 193             save_match_string = pinfo->match_string;
 194         pinfo->match_string = (const char*)channelname;
 195
 196         next_tvb = tvb_new_subset_remaining(tvb, offset);
 197
 198         if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree, &hdtbl_entry, NULL)) {
 199             return;
 200         }
 201
 202         pinfo->match_string = save_match_string;
 203     }
 204
 205     /* heuristic failed. Print remaining bytes as flat payload */
 206     proto_tree_add_item(tree, hf_hpfeeds_payload, tvb, offset, -1, ENC_NA);
 207 }
 208
 209 static void hpfeeds_stats_tree_init(stats_tree* st)
 210 {
 211     st_node_channels_payload = stats_tree_create_node(st, st_str_channels_payload, 0, STAT_DT_INT, true);
 212     st_node_opcodes = stats_tree_create_pivot(st, st_str_opcodes, 0);
 213
 214     channels_list = wmem_list_new(wmem_epan_scope());
 215 }
 216
 217 static tap_packet_status hpfeeds_stats_tree_packet(stats_tree* st _U_, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p, tap_flags_t flags _U_)
 218 {
 219     const struct HpfeedsTap *pi = (const struct HpfeedsTap *)p;
 220     wmem_list_frame_t* head = wmem_list_head(channels_list);
 221     wmem_list_frame_t* cur = head;
 222     struct channel_node* ch_node;
 223
 224     if (pi->opcode == OP_PUBLISH) {
 225         /* search an existing channel node and create it if it does not */
 226         while(cur != NULL) {
 227             ch_node = (struct channel_node*)wmem_list_frame_data(cur);
 228             if (strncmp((char*)ch_node->channel, (char*)pi->channel, strlen((char*)pi->channel)) == 0) {
 229                 break;
 230             }
 231             cur = wmem_list_frame_next(cur);
 232         }
 233
 234         if (cur == NULL) {
 235             ch_node = wmem_new0(wmem_file_scope(), struct channel_node);
 236             ch_node->channel = (unsigned char*)wmem_strdup(wmem_file_scope(), (char*)pi->channel);
 237             ch_node->st_node_channel_payload = stats_tree_create_node(st, (char*)ch_node->channel,
 238                 st_node_channels_payload, STAT_DT_INT, false);
 239             wmem_list_append(channels_list, ch_node);
 240         }
 241
 242         avg_stat_node_add_value_int(st, st_str_channels_payload, 0, false, pi->payload_size);
 243         avg_stat_node_add_value_int(st, (char*)ch_node->channel, 0, false, pi->payload_size);
 244     }
 245
 246     stats_tree_tick_pivot(st, st_node_opcodes,
 247             val_to_str(pi->opcode, opcode_vals, "Unknown opcode (%d)"));
 248     return TAP_PACKET_REDRAW;
 249 }
 250
 251 static void
 252 dissect_hpfeeds_subscribe_pdu(tvbuff_t *tvb, proto_tree *tree, unsigned offset)
 253 {
 254     uint8_t len = 0;
 255     /* get length of ident field */
 256     len = tvb_get_uint8(tvb, offset);
 257     proto_tree_add_item(tree, hf_hpfeeds_ident_len, tvb, offset, 1,
 258         ENC_BIG_ENDIAN);
 259     offset += 1;
 260
 261     proto_tree_add_item(tree, hf_hpfeeds_ident, tvb, offset, len,
 262         ENC_ASCII);
 263     /* move forward inside data */
 264     offset += len;
 265     proto_tree_add_item(tree, hf_hpfeeds_channel, tvb, offset, -1,
 266         ENC_ASCII);
 267 }
 268
 269 /*
 270  * Get the length of the HPFEED message, including header
 271  * This is a trivial function, but it's mandatory as it is used as a callback
 272  * by the routine to re-assemble the protocol spread on multiple TCP packets
 273  */
 274 static unsigned
 275 get_hpfeeds_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)
 276 {
 277     return tvb_get_ntohl(tvb, offset + 0);
 278 }
 279
 280 static int
 281 dissect_hpfeeds_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 282 {
 283     struct HpfeedsTap *hpfeeds_stats;
 284
 285     /* We have already parsed msg length we need to skip to opcode offset */
 286     unsigned offset = 0;
 287
 288     uint8_t opcode;
 289     proto_item *ti;
 290     proto_tree *hpfeeds_tree, *data_subtree;
 291
 292     col_set_str(pinfo->cinfo, COL_PROTOCOL, "HPFEEDS");
 293
 294     ti = proto_tree_add_item(tree, proto_hpfeeds, tvb, 0, -1, ENC_NA);
 295     hpfeeds_tree = proto_item_add_subtree(ti, ett_hpfeeds);
 296     proto_tree_add_item(hpfeeds_tree, hf_hpfeeds_msg_length, tvb, offset,
 297         4, ENC_BIG_ENDIAN);
 298     offset += 4;
 299
 300     /* Get opcode and write it */
 301     opcode = tvb_get_uint8(tvb, offset);
 302
 303     /* Clear out stuff in the info column */
 304     col_add_fstr(pinfo->cinfo, COL_INFO, "Type %s",
 305         val_to_str(opcode, opcode_vals, "Unknown (0x%02x)"));
 306
 307     ti = proto_tree_add_item(hpfeeds_tree, hf_hpfeeds_opcode, tvb, offset,
 308             1, ENC_BIG_ENDIAN);
 309     data_subtree = proto_item_add_subtree(ti, ett_hpfeeds);
 310     offset += 1;
 311
 312     if (opcode >= array_length(opcode_vals) - 1) {
 313         expert_add_info_format(pinfo, ti, &ei_hpfeeds_opcode_unknown,
 314                 "Unknown value %02x for opcode field", opcode);
 315     }
 316
 317     if (tree) { /* we are being asked for details */
 318         switch (opcode) {
 319             case OP_ERROR:
 320                 dissect_hpfeeds_error_pdu(tvb, data_subtree, offset);
 321             break;
 322             case OP_INFO:
 323                 dissect_hpfeeds_info_pdu(tvb, pinfo, data_subtree, offset);
 324             break;
 325             case OP_AUTH:
 326                 dissect_hpfeeds_auth_pdu(tvb, data_subtree, offset);
 327             break;
 328             case OP_PUBLISH:
 329                 dissect_hpfeeds_publish_pdu(tvb, pinfo, data_subtree, offset);
 330             break;
 331             case OP_SUBSCRIBE:
 332                 dissect_hpfeeds_subscribe_pdu(tvb, data_subtree, offset);
 333             break;
 334             /* No need for a default, we check that outside the if(tree)
 335              * block earlier */
 336         }
 337     }
 338
 339     /* In publish, generate stats every packet, even not in tree */
 340     hpfeeds_stats = wmem_new0(wmem_file_scope(), struct HpfeedsTap);
 341     if (opcode == OP_PUBLISH) {
 342         hpfeeds_stats->channel = hpfeeds_get_channel_name(tvb, offset);
 343         hpfeeds_stats->payload_size = hpfeeds_get_payload_size(tvb, 0);
 344     }
 345
 346     hpfeeds_stats->opcode = opcode;
 347     tap_queue_packet(hpfeeds_tap, pinfo, hpfeeds_stats);
 348     return tvb_captured_length(tvb);
 349 }
 350
 351 static int
 352 dissect_hpfeeds(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 353 {
 354     tcp_dissect_pdus(tvb, pinfo, tree, hpfeeds_desegment, HPFEEDS_HDR_LEN,
 355         get_hpfeeds_pdu_len, dissect_hpfeeds_pdu, data);
 356     return tvb_captured_length(tvb);
 357 }
 358
 359 void
 360 proto_register_hpfeeds(void)
 361 {
 362     static hf_register_info hf[] = {
 363
 364         { &hf_hpfeeds_opcode,
 365             { "Opcode", "hpfeeds.opcode",
 366             FT_UINT8, BASE_DEC_HEX,
 367             VALS(opcode_vals), 0x0,
 368             NULL, HFILL }
 369         },
 370         { &hf_hpfeeds_msg_length,
 371             { "Message Length", "hpfeeds.msglen",
 372             FT_UINT32, BASE_DEC_HEX,
 373             NULL, 0x0,
 374             NULL, HFILL }
 375         },
 376         { &hf_hpfeeds_nonce,
 377             { "Nonce", "hpfeeds.nonce",
 378             FT_BYTES, BASE_NONE,
 379             NULL, 0x0,
 380             NULL, HFILL }
 381         },
 382         { &hf_hpfeeds_secret,
 383             { "Secret", "hpfeeds.secret",
 384             FT_BYTES, BASE_NONE,
 385             NULL, 0x0,
 386             NULL, HFILL }
 387         },
 388         { &hf_hpfeeds_payload,
 389             { "Payload", "hpfeeds.payload",
 390             FT_BYTES, BASE_NONE,
 391             NULL, 0x0,
 392             NULL, HFILL }
 393         },
 394         { &hf_hpfeeds_server,
 395             { "Server", "hpfeeds.server",
 396             FT_STRING, BASE_NONE,
 397             NULL, 0x0,
 398             NULL, HFILL }
 399         },
 400         { &hf_hpfeeds_ident,
 401             { "Ident", "hpfeeds.ident",
 402             FT_STRING, BASE_NONE,
 403             NULL, 0x0,
 404             NULL, HFILL }
 405         },
 406         { &hf_hpfeeds_channel,
 407             { "Channel", "hpfeeds.channel",
 408             FT_STRING, BASE_NONE,
 409             NULL, 0x0,
 410             NULL, HFILL }
 411         },
 412         { &hf_hpfeeds_chan_len,
 413             { "Channel length", "hpfeeds.channel_len",
 414             FT_UINT8, BASE_DEC,
 415             NULL, 0x0,
 416             NULL, HFILL }
 417         },
 418         { &hf_hpfeeds_ident_len,
 419             { "Ident length", "hpfeeds.ident_len",
 420             FT_UINT8, BASE_DEC,
 421             NULL, 0x0,
 422             NULL, HFILL }
 423         },
 424         { &hf_hpfeeds_errmsg,
 425             { "Error message", "hpfeeds.errmsg",
 426             FT_STRING, BASE_NONE,
 427             NULL, 0x0,
 428             NULL, HFILL }
 429         },
 430         { &hf_hpfeeds_server_len,
 431             { "Server length", "hpfeeds.server_len",
 432             FT_UINT8, BASE_DEC,
 433             NULL, 0x0,
 434             NULL, HFILL }
 435         },
 436     };
 437
 438
 439     /* Setup protocol subtree array */
 440     static int *ett[] = {
 441         &ett_hpfeeds
 442     };
 443
 444     static ei_register_info ei[] = {
 445         { &ei_hpfeeds_opcode_unknown, { "hpfeeds.opcode.unknown", PI_PROTOCOL, PI_WARN, "Unknown value for opcode field", EXPFILL }},
 446     };
 447
 448     module_t *hpfeeds_module;
 449     expert_module_t* expert_hpfeeds;
 450
 451     proto_hpfeeds = proto_register_protocol (
 452         "HPFEEDS HoneyPot Feeds Protocol", /* name */
 453         "HPFEEDS",      /* short name */
 454         "hpfeeds"       /* abbrev     */
 455         );
 456
 457     heur_subdissector_list = register_heur_dissector_list_with_description("hpfeeds", "HPFEEDS Publish payload", proto_hpfeeds);
 458
 459     proto_register_field_array(proto_hpfeeds, hf, array_length(hf));
 460     proto_register_subtree_array(ett, array_length(ett));
 461     expert_hpfeeds = expert_register_protocol(proto_hpfeeds);
 462     expert_register_field_array(expert_hpfeeds, ei, array_length(ei));
 463
 464     hpfeeds_handle = register_dissector("hpfeeds", dissect_hpfeeds, proto_hpfeeds);
 465
 466     hpfeeds_module = prefs_register_protocol(proto_hpfeeds, NULL);
 467     prefs_register_bool_preference(hpfeeds_module, "desegment_hpfeeds_messages",
 468         "Reassemble HPFEEDS messages spanning multiple TCP segments",
 469         "Whether the HPFEEDS dissector should reassemble messages spanning "
 470         "multiple TCP segments. "
 471         "To use this option, you must also enable \"Allow subdissectors to "
 472         "reassemble TCP streams\" in the TCP protocol settings.",
 473         &hpfeeds_desegment);
 474
 475     prefs_register_bool_preference(hpfeeds_module, "try_heuristic",
 476         "Try heuristic sub-dissectors",
 477         "Try to decode the payload using an heuristic sub-dissector",
 478         &try_heuristic);
 479
 480     hpfeeds_tap = register_tap("hpfeeds");
 481 }
 482
 483 void
 484 proto_reg_handoff_hpfeeds(void)
 485 {
 486     stats_tree_register("hpfeeds", "hpfeeds", "HPFEEDS", 0, hpfeeds_stats_tree_packet, hpfeeds_stats_tree_init, NULL);
 487
 488     dissector_add_for_decode_as_with_preference("tcp.port", hpfeeds_handle);
 489 }
 490
 491 /*
 492  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 493  *
 494  * Local variables:
 495  * c-basic-offset: 4
 496  * tab-width: 8
 497  * indent-tabs-mode: nil
 498  * End:
 499  *
 500  * vi: set shiftwidth=4 tabstop=8 expandtab:
 501  * :indentSize=4:tabSize=8:noTabs=true:
 502  */