| blob | 0f88071e2093ea0b16de4bf5409dd6722d08093c |
1 /* packet-pnrp.c
2 * Routines for Peer Name Resolution Protocol (PNRP) dissection
3 *
4 * Copyright 2010, Jan Gerbecks <jan.gerbecks@stud.uni-due.de>
5 *
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
9 *
10 * SPDX-License-Identifier: GPL-2.0-or-later
11 */
13 /* The official Documentation for the Peer Name Resolution Protocol
14 * ([MS-PNRP]) can be found at
15 *
16 * https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pnrp
17 *
18 * This dissector is based on Revision 6.1.2
19 */
23 #include <epan/packet.h>
24 #include <epan/exceptions.h>
25 #include <epan/reassemble.h>
31 #define PNRP_PORT 3540
33 #define FIELDID_LENGTH = 2
34 #define LENGTH_FIELD = 2
36 /* Define all FieldIDs here, so we can use them later on in switch statement etc */
37 #define PNRP_HEADER 0x0010
38 #define PNRP_HEADER_ACKED 0x0018
39 #define PNRP_ID 0x0030
40 #define TARGET_PNRP_ID 0x0038
41 #define VALIDATE_PNRP_ID 0x0039
42 #define FLAGS_FIELD 0x0040
43 #define FLOOD_CONTROLS 0x0043
44 #define SOLICIT_CONTROLS 0x0044
45 #define LOOKUP_CONTROLS 0x0045
46 #define EXTENDED_PAYLOAD 0x005A
47 #define PNRP_ID_ARRAY 0x0060
48 #define CERT_CHAIN 0x0080
49 #define WCHAR 0x0084
50 #define CLASSIFIER 0x0085
51 #define HASHED_NONCE 0x0092
52 #define NONCE 0x0093
53 #define SPLIT_CONTROLS 0x0098
54 #define ROUTING_ENTRY 0x009A
55 #define VALIDATE_CPA 0x009B
56 #define REVOKE_CPA 0x009C
57 #define IPV6_ENDPOINT 0x009D
58 #define IPV6_ENDPOINT_ARRAY 0x009E
60 /* Define all message types */
61 #define SOLICIT 0x01
62 #define ADVERTISE 0x02
63 #define REQUEST 0x03
64 #define FLOOD 0x04
65 #define INQUIRE 0x07
66 #define AUTHORITY 0x08
67 #define ACK 0x09
68 #define LOOKUP 0x0B
70 /* Define flags mask fields */
71 #define FLAGS_INQUIRE_RESERVED1 0xFFE0
72 #define FLAGS_INQUIRE_A 0x0010
73 #define FLAGS_INQUIRE_X 0x0008
74 #define FLAGS_INQUIRE_C 0x0004
75 #define FLAGS_INQUIRE_RESERVED2 0x0003
77 #define FLAGS_AUTHORITY_RESERVED1 0xFC00
78 #define FLAGS_AUTHORITY_L 0x0200
79 #define FLAGS_AUTHORITY_RESERVED2 0x01F0
80 #define FLAGS_AUTHORITY_B 0x0008
81 #define FLAGS_AUTHORITY_RESERVED3 0x0006
82 #define FLAGS_AUTHORITY_N 0x0001
84 #define FLAGS_LOOKUPCONTROLS_RESERVED 0xFFFC
85 #define FLAGS_LOOKUPCONTROLS_A 0x0002
86 #define FLAGS_LOOKUPCONTROLS_0 0x0001
88 #define FLAGS_ENCODED_CPA_RESERVED 0xC0
89 #define FLAGS_ENCODED_CPA_X 0x20
90 #define FLAGS_ENCODED_CPA_U 0x02
91 #define FLAGS_ENCODED_CPA_R 0x01
92 #define FLAGS_ENCODED_CPA_A 0x04
93 #define FLAGS_ENCODED_CPA_C 0x08
94 #define FLAGS_ENCODED_CPA_F 0x10
101 /* Define all helper methods */
105 static void dissect_ipv6_endpoint_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree);
106 static void dissect_encodedCPA_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree);
108 static void dissect_publicKey_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree);
109 static void dissect_signature_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree);
111 /* Define global variables
112 ----------------------------*/
115 /* Define FieldIDs */
140 };
142 /* Define Packetnames */
153 };
154 /* Define Solicit Type */
159 };
160 /* Define Resolve Criteria for Lookup Controls */
168 };
169 /* Define Reason Code for Lookup Controls */
176 };
178 /* Define IDs for subcomponents */
179 /* Message Header */
188 /* Message Body */
192 static int hf_pnrp_message_pnrpID; /* Generic variable to display pnrp ID in various situations */
193 /* Inquire Message Flags */
209 NULL
210 };
212 /* Classifier */
217 /* ACK Message Flags */
220 /* SplitControls */
222 /* IPv6 Endpoint Array */
226 /* AUTHORITY Message Flags */
242 NULL
243 };
245 /* Flood Control Flags */
249 /* PNRP ID Array */
261 /* Encoded CPA */
282 NULL
283 };
290 /* Lookup Controls */
299 NULL
300 };
305 /* Dissect Route Entry */
310 /* Public Key Structure */
314 /* Signature Structure */
317 /* Generated from convert_proto_tree_add_text.pl */
342 /* Reassembly */
356 /* Define variables to reference subtrees */
387 "PNRP fragments"
388 };
390 /* Do actual dissection work */
392 {
393 /* Variable declaration */
406 /*----------------------------------------
407 * Validate if it is really a PNRP Packet
408 *----------------------------------------*/
409 /* Check that there's enough data */
412 /* Shortest Message is ACK -> 12 Bytes for Header plus 8 Bytes for Data */
414 {
416 }
418 /* Check some values from the packet header */
419 /* First 2 bytes must be 0x0010 */
421 {
423 }
424 /* Length of Header must be 0x000C = 12 */
427 }
428 /* Identifier must 0x51 */
431 }
434 /* Assign Values to Variables */
435 /* Use to track data */
437 /* Get the message Information beforehand */
441 /* Simply Display the Protocol Name in the INFO column */
443 /* Clear out stuff in the info column */
448 /* Lets add a subtree to our dissection to display the info */
452 /* Get a main tree for the whole protocol */
455 /*-------------------------------
456 *--Add all Header Fields
457 *------------------------------*/
458 /* Get a subtree for the Header */
462 /* Add Field ID should be 0c0010 */
465 /* Add Length should be 0x000C */
468 /* Add Ident should be 0x51 */
471 /* Add Major Version */
474 /* Add Minor Version */
477 /* Add Message Type */
480 /* Add Message ID */
481 proto_tree_add_item_ret_uint(pnrp_header_tree,hf_pnrp_header_messageID,tvb,offset,4,ENC_BIG_ENDIAN,&msg_id);
485 /*-------------------------------
486 *--Add all Message Fields
487 *------------------------------*/
489 /* The following part has dynamic length depending on message type */
492 /* Determine the Field Type */
494 /* Determine length of this message */
497 /* Length must be at least 4, because field_type and data_length are part of data_length information */
500 pnrp_message_tree = proto_tree_add_subtree_format(pnrp_tree, tvb, offset, 4, ett_pnrp_message, NULL,
503 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
504 }
506 /* Don't continue parsing this message segment */
508 }
509 /* Actual Parsing of the message Type */
511 /* First Field in ACK Message */
517 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
518 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_headerack, tvb, offset + 4, data_length -4, ENC_BIG_ENDIAN);
520 }
524 /* A validate pnrp id follows as found in FLOOD */
530 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
531 /* We can have a large number of pnrp IDs here */
534 }
538 /* The Flags have different meaning, depending on the message */
544 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
545 }
548 proto_tree_add_bitmask(pnrp_message_tree, tvb, offset+4, hf_pnrp_message_inquire_flags, ett_pnrp_message_inquire_flags, inquire_flags, ENC_BIG_ENDIAN);
555 /* Reserved 0 - 14 bits */
556 proto_tree_add_bits_item(pnrp_message_tree, hf_pnrp_message_ack_flags_reserved, tvb, (offset + 4)*8, 15, ENC_BIG_ENDIAN);
557 /* N - Bit */
558 proto_tree_add_bits_item(pnrp_message_tree, hf_pnrp_message_ack_flags_Nbit, tvb,((offset + 4)*8)+15, 1, ENC_BIG_ENDIAN);
562 proto_tree_add_bitmask(pnrp_message_tree, tvb, offset+4, hf_pnrp_message_authority_flags, ett_pnrp_message_authority_flags, authority_flags, ENC_BIG_ENDIAN);
563 /* Check if the Flags Field is the last message part. If so, no padding of 2 bytes is added */
565 {
567 }
570 proto_tree_add_item(pnrp_message_tree, hf_pnrp_padding, tvb, offset + 6, padding_bytes, ENC_NA);
572 }
576 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_flags, tvb, offset + 4, data_length -4, ENC_BIG_ENDIAN);
579 }
582 /* Flood controls found in FLOOD Message */
588 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
589 /* Reserved 1 - 15 bits */
590 proto_tree_add_bits_item(pnrp_message_tree, hf_pnrp_message_flood_flags_reserved1, tvb, (offset + 4)*8, 15, ENC_BIG_ENDIAN);
591 /* D - Bit */
592 proto_tree_add_bits_item(pnrp_message_tree, hf_pnrp_message_flood_flags_Dbit, tvb,((offset + 4)*8)+15, 1, ENC_BIG_ENDIAN);
593 /* Reserved 2 */
595 /* Padding 1 */
597 }
602 /* Solicit Controls found in SOLICIT Message */
608 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
610 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_solicitType, tvb, offset + 5, 1, ENC_BIG_ENDIAN);
611 proto_tree_add_item(pnrp_message_tree, hf_pnrp_reserved16, tvb, offset + 6, 2, ENC_LITTLE_ENDIAN);
612 }
615 /* Lookup controls found in LOOKUP Message */
621 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
622 /* 2 Bytes of Flags */
623 proto_tree_add_bitmask(pnrp_message_tree, tvb, offset+4, hf_pnrp_message_lookupControls_flags, ett_pnrp_message_lookupControls_flags, lookupControls_flags, ENC_BIG_ENDIAN);
624 /* Precision Bytes */
625 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_lookupControls_precision, tvb, offset + 6, 2, ENC_BIG_ENDIAN);
626 /* Resolve Criteria */
627 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_lookupControls_resolveCriteria, tvb, offset + 8, 1, ENC_BIG_ENDIAN);
628 /* Reason Code */
629 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_lookupControls_reasonCode, tvb, offset + 9, 1, ENC_BIG_ENDIAN);
630 /* Reserved */
631 proto_tree_add_item(pnrp_message_tree, hf_pnrp_reserved16, tvb, offset + 10, 2, ENC_LITTLE_ENDIAN);
633 }
637 /* Target PNRP ID found in Lookup Message */
643 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
645 }
650 /* Extended Payload found in AUTHORITY Message */
656 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
657 /* TODO: Do actual parsing */
658 }
662 /* Pnrp id Array as found in REQUEST & ADVERTISE Message */
668 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
669 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_idArray_NumEntries, tvb, offset + 4, 2, ENC_BIG_ENDIAN);
670 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_idArray_Length, tvb, offset + 6, 2, ENC_BIG_ENDIAN);
671 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_ElementFieldType, tvb, offset + 8, 2, ENC_BIG_ENDIAN);
672 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_idarray_Entrylength, tvb, offset + 10, 2, ENC_BIG_ENDIAN);
674 }
678 /* Cert Chain follows as found in AUTHORITY */
684 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
685 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_certChain, tvb, offset + 4, data_length-4, ENC_NA);
686 }
688 /* There might be padding, so fill up to the next byte */
691 data_length++;
692 padding_bytes++;
693 }
694 /* Check if we actually had some padding bytes */
696 proto_tree_add_item(pnrp_message_tree, hf_pnrp_padding, tvb, offset + data_length-padding_bytes, padding_bytes, ENC_NA);
697 }
700 /* classifier: A classifier string follows as found in AUTHORITY */
706 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
707 /* NumEntries */
708 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_classifier_unicodeCount, tvb, offset + 4, 2, ENC_BIG_ENDIAN);
709 /* Array Length: 8+(NumEntries*EntryLength */
710 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_classifier_arrayLength, tvb, offset + 6, 2, ENC_BIG_ENDIAN);
711 /* Element Field Type: WCHAR */
712 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_type, tvb, offset+8 , 2, ENC_BIG_ENDIAN);
713 /* Entry Length: Must be 0x0002 */
714 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_classifier_entryLength, tvb, offset + 10, 2, ENC_BIG_ENDIAN);
715 /* The actual classifier String */
716 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_classifier_string, tvb, offset + 12, tvb_get_ntohs(tvb,offset+6)-8, ENC_UTF_16|ENC_BIG_ENDIAN);
717 }
719 /* There might be padding, so fill up to the next byte */
722 data_length++;
723 padding_bytes++;
724 }
725 /* Check if we actually had some padding bytes */
727 proto_tree_add_item(pnrp_message_tree, hf_pnrp_padding, tvb, offset + data_length-padding_bytes, padding_bytes, ENC_NA);
728 }
731 /* A hashed nonce follows as found in ADVERTISE & SOLICIT */
737 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
738 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_hashednonce, tvb, offset + 4, data_length-4, ENC_NA);
740 }
745 /* A nonce follows as found in REQUEST & INQUIRE */
751 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
752 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_nonce, tvb, offset + 4, data_length-4, ENC_NA);
753 }
758 /* split controls as found in AUTHORITY */
760 {
769 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
770 }
771 /* Size of Authority Buffer */
774 /* Byte offset */
792 }
794 }
796 /* routing entry: A route entry follows as found in ADVERTISE, INQUIRE, LOOKUP & AUTHORITY */
802 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
804 }
806 /* There might be padding, so fill up to the next byte */
809 data_length++;
810 padding_bytes++;
811 }
812 /* Check if we actually had some padding bytes */
814 proto_tree_add_item(pnrp_message_tree, hf_pnrp_padding, tvb, offset + data_length-padding_bytes, padding_bytes, ENC_NA);
815 }
819 /* validate cpa: an encoded CPA structure follows as found in AUTHORITY */
825 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
826 /* Do the actual parsing in own method */
829 }
835 /* IPV6 Endpoint: an ipv6 endpoint array structure follows as found in LOOKUP */
841 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
842 /* Number of route entries */
843 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_ipv6EndpointArray_NumberOfEntries, tvb, offset + 4, 2, ENC_BIG_ENDIAN);
844 /* Array length */
845 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_ipv6EndpointArray_ArrayLength, tvb, offset + 6, 2, ENC_BIG_ENDIAN);
846 /* Element Field Type */
847 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_type, tvb, offset+8 , 2, ENC_BIG_ENDIAN);
848 /* Entry Length: must be 0x0012 (18 bytes) */
849 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_ipv6EndpointArray_EntryLength, tvb, offset + 10, 2, ENC_BIG_ENDIAN);
850 /* Flagged Path */
851 dissect_ipv6_endpoint_structure(tvb, offset+12, tvb_get_ntohs(tvb,offset+6)-8,pnrp_message_tree);
852 }
863 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
865 {
866 proto_tree_add_item(pnrp_message_tree, hf_pnrp_message_data, tvb, offset + 4, data_length -4, ENC_NA);
867 }
870 }
871 }
874 }
875 // SPLIT_CONTROLS might reset our offset.
878 }
879 }
882 }
884 /*--------------------------------------------------------------*
885 * Dissecting helper methods *
886 *--------------------------------------------------------------*/
889 {
894 }
896 }
899 {
901 /* Check if we don't run out of data */
904 /* First, we have a 32 Bit long PNRP ID */
907 /* Add PNRP Major Version */
910 /* Add Minor Version */
913 /* Port Number */
914 proto_tree_add_item(tree,hf_pnrp_message_routeEntry_portNumber,tvb,offset+tmp_offset,2,ENC_BIG_ENDIAN);
916 /* Flags */
917 proto_tree_add_item(tree,hf_pnrp_message_routeEntry_flags,tvb,offset+tmp_offset,1,ENC_BIG_ENDIAN);
919 /* Address count */
920 proto_tree_add_item(tree,hf_pnrp_message_routeEntry_addressCount,tvb,offset+tmp_offset,1,ENC_BIG_ENDIAN);
922 /* IPv6 Addresses */
924 }
925 }
927 static void dissect_ipv6_endpoint_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
928 {
929 /* Check if we don't run out of data */
931 /* Port Number */
933 /* IPv6 Addresses */
937 }
938 }
941 {
946 }
947 }
949 static void dissect_encodedCPA_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
950 {
951 /* Check if we don't run out of data */
954 /* Add a new subtree */
957 pnrp_encodedCPA_item = proto_tree_add_item(tree, hf_pnrp_encodedCPA, tvb, offset,length,ENC_NA);
958 pnrp_encodedCPA_tree = proto_item_add_subtree(pnrp_encodedCPA_item, ett_pnrp_message_encodedCPA);
960 /* Length information */
961 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_length, tvb, offset, 2, ENC_BIG_ENDIAN);
962 /* CPA Minor Version */
963 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_minorVersion, tvb, offset+2, 1, ENC_BIG_ENDIAN);
964 /* CPA Major Version */
965 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_majorVersion, tvb, offset+3, 1, ENC_BIG_ENDIAN);
966 /* PNRP Minor Version */
967 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_header_versionMinor, tvb, offset+4, 1, ENC_BIG_ENDIAN);
968 /* PNRP Major Version */
969 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_header_versionMajor, tvb, offset+5, 1, ENC_BIG_ENDIAN);
970 /* Flags Field */
971 proto_tree_add_bitmask(pnrp_encodedCPA_tree, tvb, offset+6, hf_pnrp_encodedCPA_flags, ett_pnrp_message_encodedCPA_flags, encodedCPA_flags, ENC_BIG_ENDIAN);
973 /* Reserved */
975 /* Not After */
976 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_notAfter, tvb, offset+8, 8, ENC_BIG_ENDIAN);
977 /* Service Location */
978 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_serviceLocation, tvb, offset+16, 16, ENC_NA);
980 /* now, the structure is variable, so add bytes to offset */
983 /* Check if R Flag is set */
985 /* Nonce follows */
988 }
989 /* Check if A Flag is set */
991 /* Binary authority */
992 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_binaryAuthority, tvb, offset, 20, ENC_NA);
994 }
995 /* Check if C Flag is set */
997 /* Classifier Hash */
998 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_classifierHash, tvb, offset, 20, ENC_NA);
1000 }
1001 /* Check if F Flag is set */
1003 /* Friendly Name Length */
1004 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_friendlyName_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1005 /* Friendly Name */
1006 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_friendlyName, tvb, offset+2, tvb_get_letohs(tvb,offset), ENC_ASCII);
1008 }
1009 /* Service Address List */
1010 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_number_of_service_addresses, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1012 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_service_address_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1014 /* A list of IPV6_Endpoint Structures follows */
1015 dissect_ipv6_endpoint_structure(tvb, offset,tvb_get_letohs(tvb,offset-4)*tvb_get_letohs(tvb,offset-2) , pnrp_encodedCPA_tree);
1017 /* A number of Payload Structures */
1018 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_number_of_payload_structures, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1020 proto_tree_add_item(pnrp_encodedCPA_tree, hf_pnrp_encodedCPA_total_bytes_of_payload, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1024 /* Public Key */
1027 /* Signature */
1029 /*offset += tvb_get_letohs(tvb,offset);*/
1030 }
1031 }
1033 {
1035 /* Add a new Subtree */
1037 /* Check if we actually should display something */
1041 pnrp_payload_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_pnrp_message_payloadStructure, NULL, "Payload Structure");
1043 /* Dissect the Payload Structure */
1044 /* Payload Type */
1045 proto_tree_add_item(pnrp_payload_tree, hf_pnrp_payload_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1047 /* Data Length */
1049 proto_tree_add_item(pnrp_payload_tree, hf_pnrp_length_of_data, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1051 /* IPV6_APP_ENDPOINT Structure */
1055 proto_tree_add_item(pnrp_payload_tree, hf_pnrp_payload_port, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1057 proto_tree_add_item(pnrp_payload_tree, hf_pnrp_payload_iana_proto, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1060 }
1061 }
1063 static void dissect_publicKey_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
1064 {
1067 /* Add a new Subtree */
1069 /* Check if we can safely parse Data */
1071 pnrp_publicKey_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_pnrp_message_publicKeyStructure, NULL, "CPA Public Key Structure");
1072 /* Parsing of Data */
1073 /* Field Length of Structure */
1074 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_length_of_structure, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1076 /* ObjID length */
1078 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_size_of_algorithm_oid, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1080 /* Reserved */
1081 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_reserved, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1083 /* Public Key cbData Length */
1085 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_size_of_cbdata, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1087 /* Unused Bits, actually only 7... */
1088 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_unused_bits, tvb, offset, 1, ENC_NA);
1090 /* Algorithm ObjID */
1091 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_objID, tvb, offset, objIDLength, ENC_ASCII);
1093 /* Public Key Data */
1094 proto_tree_add_item(pnrp_publicKey_tree, hf_pnrp_publicKey_publicKeyData, tvb, offset, cbDataLength, ENC_ASCII);
1095 }
1096 }
1097 static void dissect_signature_structure(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
1098 {
1100 /* Add a new Subtree */
1103 /* Check if we can safely parse Data */
1105 pnrp_signature_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_pnrp_message_signatureStructure, NULL, "Signature Structure");
1106 /* Parsing of Data */
1107 /* Field Length of Structure */
1108 proto_tree_add_item(pnrp_signature_tree, hf_pnrp_signature_structure_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1110 /* Signature Length */
1112 proto_tree_add_item(pnrp_signature_tree, hf_pnrp_signature_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
1114 /* Hash Algorithm Identifier */
1115 proto_tree_add_item(pnrp_signature_tree, hf_pnrp_signature_hash_id, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1117 /* Signature Data */
1118 proto_tree_add_item(pnrp_signature_tree, hf_pnrp_signature_signatureData, tvb, offset, signatureLength, ENC_NA);
1119 }
1120 }
1122 /* Register the protocol */
1124 {
1125 /* A header field is something you can search/filter on.
1126 *
1127 * We create a structure to register our fields. It consists of an
1128 * array of hf_register_info structures, each of which are of the format
1129 * {&(field id), {name, abbrev, type, display, strings, bitmask, blurb, HFILL}}.
1130 */
1168 /* Inquire Flags */
1173 { "Reserved 1", "pnrp.segment.inquire.flags.reserved1", FT_UINT16, BASE_HEX, NULL, FLAGS_INQUIRE_RESERVED1,
1176 { "CPA should (a)ppear in response", "pnrp.segment.inquire.flags.Abit", FT_UINT16, BASE_HEX, NULL, FLAGS_INQUIRE_A,
1179 { "E(X)tended Payload sent in Authority response", "pnrp.segment.inquire.flags.Xbit", FT_UINT16, BASE_HEX, NULL, FLAGS_INQUIRE_X,
1182 { "(C)ertificate Chain sent in Authority response", "pnrp.segment.inquire.flags.Cbit", FT_UINT16, BASE_HEX, NULL, FLAGS_INQUIRE_C,
1185 { "Reserved 2", "pnrp.segment.inquire.flags.reserved2", FT_UINT16, BASE_HEX, NULL, FLAGS_INQUIRE_RESERVED2,
1190 /* Classifier */
1192 { "Number of Unicode Characters", "pnrp.segment.classifier.unicodeCount", FT_UINT16, BASE_DEC, NULL, 0x0,
1203 /* Ack Flags */
1210 /* Authority Flags */
1215 { "Reserved 1", "pnrp.segment.authority.flags.reserved1", FT_UINT16, BASE_HEX, NULL, FLAGS_AUTHORITY_RESERVED1,
1218 { "(L)eaf Set", "pnrp.segment.authority.flags.Lbit", FT_UINT16, BASE_HEX, NULL, FLAGS_AUTHORITY_L,
1221 { "Reserved 2", "pnrp.segment.authority.flags.reserved2", FT_UINT16, BASE_HEX, NULL, FLAGS_AUTHORITY_RESERVED2,
1227 { "Reserved 3", "pnrp.segment.authority.flags.reserved3", FT_UINT16, BASE_HEX, NULL, FLAGS_AUTHORITY_RESERVED3,
1230 { "(N)ot found", "pnrp.segment.authority.flags.Nbit", FT_UINT16, BASE_HEX, NULL, FLAGS_AUTHORITY_N,
1232 /* Flood Control Flags */
1239 /* Split Controls */
1241 { "Authority Buffer Size", "pnrp.segment.splitControls.authorityBuffer", FT_UINT16, BASE_DEC, NULL, 0x0,
1243 /* IPv6 Endpoint Array */
1245 { "Number of Entries", "pnrp.segment.ipv6EndpointArray.NumberOfEntries", FT_UINT16, BASE_DEC, NULL, 0x0,
1248 { "Array Length", "pnrp.segment.ipv6EndpointArray.ArrayLength", FT_UINT16, BASE_DEC, NULL, 0x0,
1251 { "Entry Length", "pnrp.segment.ipv6EndpointArray.EntryLength", FT_UINT16, BASE_DEC, NULL, 0x0,
1253 /* Encoded CPA structrue */
1266 /* Encoded CPA flags */
1271 { "Reserved", "pnrp.encodedCPA.flags.reserved", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_RESERVED,
1274 { "CPA has E(X)tended Payload", "pnrp.encodedCPA.flags.xbit", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_X,
1277 { "CPA contains (F)riendly Name", "pnrp.encodedCPA.flags.fbit", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_F,
1280 { "CPA contains (C)lassifier Hash", "pnrp.encodedCPA.flags.cbit", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_C,
1283 { "CPA contains Binary (A)uthority field", "pnrp.encodedCPA.flags.abit", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_A,
1286 { "Friendly Name in (U)TF-8", "pnrp.encodedCPA.flags.ubit", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_U,
1289 { "This is a (r)evoke CPA", "pnrp.encodedCPA.flags.rbit", FT_UINT8, BASE_HEX, NULL, FLAGS_ENCODED_CPA_R,
1291 /* TODO: Find correct way to Display Time */
1307 /* Lookup Controls */
1312 { "Reserved", "pnrp.lookupControls.flags.reserved", FT_UINT16, BASE_HEX, NULL, FLAGS_LOOKUPCONTROLS_RESERVED,
1315 { "A bit", "pnrp.lookupControls.flags.Abit", FT_UINT16, BASE_HEX, NULL, FLAGS_LOOKUPCONTROLS_A,
1316 "Sender is willing to accept returned nodes that are not closer to the target ID than the Validate PNRP ID", HFILL }},
1318 { "0 bit - reserved", "pnrp.lookupControls.flags.0bit", FT_UINT16, BASE_HEX, NULL, FLAGS_LOOKUPCONTROLS_0,
1324 { "Resolve Criteria", "pnrp.lookupControls.resolveCriteria", FT_UINT8, BASE_HEX, VALS(resolveCriteria), 0x0,
1329 /* Public Key Structure */
1336 /* Signature Structure */
1341 /* Route Entry */
1364 { "Type of Array Entry", "pnrp.segment.ElementFieldType", FT_UINT16, BASE_HEX, VALS(fieldID), 0x0,
1367 { "Length of each Array Entry", "pnrp.segment.idArray.Entrylength", FT_UINT16, BASE_DEC, NULL, 0x0,
1371 "A Certificate Chain, containing the public key used to sign the CPA and its Certificate Chain", HFILL }},
1385 { "Fragment Overlap", "pnrp.segment.splitControls.fragment_overlap", FT_BOOLEAN, BASE_NONE, NULL, 0,
1388 { "Fragment Overlap Conflict", "pnrp.segment.splitControls.fragment_overlap_conflict", FT_BOOLEAN, BASE_NONE, NULL, 0,
1391 { "Fragment Multiple Tails", "pnrp.segment.splitControls.fragment_multiple_tails", FT_BOOLEAN, BASE_NONE, NULL, 0,
1394 { "Too Long Fragment", "pnrp.segment.splitControls.fragment_too_long_fragment", FT_BOOLEAN, BASE_NONE, NULL, 0,
1397 { "Fragment Error", "pnrp.segment.splitControls.fragment_error", FT_FRAMENUM, BASE_NONE, NULL, 0,
1403 { "Reassembled In", "pnrp.segment.splitControls.reassembled_in", FT_FRAMENUM, BASE_NONE, NULL, 0,
1406 { "Reassembled Length", "pnrp.segment.splitControls.reassembled_length", FT_UINT32, BASE_DEC, NULL, 0,
1409 { "Reassembled Data", "pnrp.segment.splitControls.reassembled_data", FT_BYTES, BASE_NONE, NULL, 0,
1412 { "Fragmented Payload", "pnrp.segment.splitControls.fragmented_payload", FT_BYTES, BASE_NONE, NULL, 0,
1415 /* Generated from convert_proto_tree_add_text.pl */
1416 { &hf_pnrp_message_flags, { "Flags", "pnrp.segment.flags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1417 { &hf_pnrp_reserved8, { "Reserved", "pnrp.reserved", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1418 { &hf_pnrp_reserved16, { "Reserved", "pnrp.reserved", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1419 { &hf_pnrp_message_offset, { "Offset", "pnrp.segment.offset", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1420 { &hf_pnrp_message_data, { "Data", "pnrp.segment.data", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1421 { &hf_pnrp_message_port_number, { "Port Number", "pnrp.segment.port_number", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1422 { &hf_pnrp_encodedCPA_friendlyName_length, { "Length of Friendly name", "pnrp.encodedCPA.friendlyName.length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1423 { &hf_pnrp_encodedCPA_number_of_service_addresses, { "Number of Service Addresses", "pnrp.encodedCPA.number_of_service_addresses", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1424 { &hf_pnrp_encodedCPA_service_address_length, { "Service Address Length", "pnrp.encodedCPA.service_address_length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1425 { &hf_pnrp_encodedCPA_number_of_payload_structures, { "Number of Payload Structures", "pnrp.encodedCPA.number_of_payload_structures", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1426 { &hf_pnrp_encodedCPA_total_bytes_of_payload, { "Total Bytes of Payload", "pnrp.encodedCPA.total_bytes_of_payload", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1427 { &hf_pnrp_payload_type, { "Payload Type", "pnrp.payload.type", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1428 { &hf_pnrp_length_of_data, { "Length of Data", "pnrp.payload.length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1429 { &hf_pnrp_payload_port, { "Port Number", "pnrp.payload.port", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1430 { &hf_pnrp_payload_iana_proto, { "IANA Protocol Number", "pnrp.payload.iana_proto", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1431 { &hf_pnrp_publicKey_length_of_structure, { "Length of Structure", "pnrp.publicKey.structure_length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1432 { &hf_pnrp_publicKey_size_of_algorithm_oid, { "Size of Algorithm OID", "pnrp.publicKey.algorithm_oid_size", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1433 { &hf_pnrp_publicKey_reserved, { "Reserved", "pnrp.publicKey.reserved", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1434 { &hf_pnrp_publicKey_size_of_cbdata, { "Size of cbData", "pnrp.publicKey.cbdata_size", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1435 { &hf_pnrp_publicKey_unused_bits, { "Unused Bits", "pnrp.publicKey.unused_bits", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1436 { &hf_pnrp_signature_structure_length, { "Length of Structure", "pnrp.signature.structure_length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1437 { &hf_pnrp_signature_length, { "Length of Signature", "pnrp.signature.length", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1438 { &hf_pnrp_signature_hash_id, { "Hash Algorithm Identifier", "pnrp.signature.hash_id", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1440 };
1442 /* Protocol subtree array */
1456 &ett_pnrp_fragments
1457 };
1458 /* Register the Dissector with Wireshark */
1468 }
1470 /* Initialise the dissector */
1472 {
1474 }
1476 /*
1477 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1478 *
1479 * Local variables:
1480 * c-basic-offset: 4
1481 * tab-width: 8
1482 * indent-tabs-mode: nil
1483 * End:
1484 *
1485 * vi: set shiftwidth=4 tabstop=8 expandtab:
1486 * :indentSize=4:tabSize=8:noTabs=true:
1487 */