epan/dissectors/packet-rsync.c

   1 /* packet-rsync.c
   2  * Routines for rsync dissection
   3  * [ very rough, but mininally functional ]
   4  * Copyright 2003, Brad Hards <bradh@frogmouth.net>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12 #include "config.h"
  13
  14
  15 #include <epan/packet.h>
  16 #include <epan/conversation.h>
  17 #include <epan/prefs.h>
  18 #include <epan/proto_data.h>
  19
  20 void proto_register_rsync(void);
  21 void proto_reg_handoff_rsync(void);
  22
  23 #define RSYNCD_MAGIC_HEADER "@RSYNCD:"
  24 #define RSYNCD_MAGIC_HEADER_LEN 8
  25
  26 #define RSYNCD_AUTHREQD "@RSYNCD: AUTHREQD "
  27 #define RSYNCD_AUTHREQD_LEN 18
  28
  29 #define RSYNCD_EXIT "@RSYNCD: EXIT"
  30 #define RSYNCD_EXIT_LEN 13
  31
  32 #define RSYNC_MODULE_LIST_QUERY "\n"
  33 #define RSYNC_MODULE_LIST_QUERY_LEN 1
  34
  35 /* what states make sense here ? */
  36 typedef enum _rsync_state {
  37     RSYNC_INIT         = 0,
  38     RSYNC_SERV_INIT    = 1,
  39     RSYNC_CLIENT_QUERY = 2,
  40     RSYNC_MODULE_LIST  = 4,
  41     RSYNC_COMMAND      = 5,
  42     RSYNC_SERV_MOTD    = 6,
  43     RSYNC_DATA         = 7
  44 } rsync_state_t;
  45
  46 enum rsync_who {
  47     CLIENT,
  48     SERVER
  49 };
  50
  51 static bool rsync_desegment = true;
  52
  53 /* this is a guide to the current conversation state */
  54 struct rsync_conversation_data {
  55     rsync_state_t client_state;
  56     rsync_state_t server_state;
  57 };
  58
  59 struct rsync_frame_data {
  60     rsync_state_t state;
  61 };
  62
  63 static int proto_rsync;
  64
  65 static int hf_rsync_command_string;
  66 static int hf_rsync_data;
  67 static int hf_rsync_hdr_magic;
  68 static int hf_rsync_hdr_version;
  69 static int hf_rsync_module_list_string;
  70 static int hf_rsync_motd_string;
  71 static int hf_rsync_query_string;
  72 static int hf_rsync_rsyncdok_string;
  73
  74 static int ett_rsync;
  75
  76 static dissector_handle_t rsync_handle;
  77
  78
  79 #define TCP_PORT_RSYNC  873
  80
  81 static range_t *glb_rsync_tcp_range;
  82
  83 #define VERSION_LEN     4           /* 2 digits for main version; '.'; 1 digit for sub version */
  84
  85 static void
  86 dissect_rsync_version_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *rsync_tree, enum rsync_who me)
  87 {
  88     int   offset = 0;
  89     uint8_t *version;
  90     unsigned len;
  91
  92     proto_tree_add_item(rsync_tree, hf_rsync_hdr_magic, tvb, offset, RSYNCD_MAGIC_HEADER_LEN, ENC_ASCII);
  93     offset += RSYNCD_MAGIC_HEADER_LEN;
  94     offset += 1; /* skip the space */
  95     proto_tree_add_item(rsync_tree, hf_rsync_hdr_version, tvb, offset, -1, ENC_ASCII);
  96     len = tvb_reported_length_remaining(tvb, offset);
  97     version = tvb_get_string_enc(pinfo->pool, tvb, offset, len, ENC_ASCII|ENC_NA);
  98
  99     /* VERSION string can contain undesirable char (like \n) at the end. Trim it. */
 100     if (len > 0 && version[len - 1] == '\n')
 101         version[len - 1] = 0x0;
 102
 103     col_add_fstr(pinfo->cinfo, COL_INFO, "%s Initialisation (Version %s)", (me == SERVER ? "Server" : "Client"), version);
 104 }
 105
 106 /* Packet dissection routine called by tcp (& udp) when port 873 detected */
 107 static int
 108 dissect_rsync_encap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 109                     bool desegment _U_)
 110 {
 111     conversation_t                 *conversation;
 112     struct rsync_conversation_data *conversation_data;
 113     struct rsync_frame_data        *rsync_frame_data_p;
 114     proto_item                     *ti;
 115     proto_tree                     *rsync_tree;
 116     enum rsync_who                  me;
 117     int                             offset = 0;
 118     unsigned                        buff_length;
 119
 120     col_set_str(pinfo->cinfo, COL_PROTOCOL, "RSYNC");
 121
 122     col_clear(pinfo->cinfo, COL_INFO);
 123
 124     me = value_is_in_range(glb_rsync_tcp_range, pinfo->srcport) ? SERVER : CLIENT;
 125
 126     conversation = find_or_create_conversation(pinfo);
 127
 128     conversation_data = (struct rsync_conversation_data *)conversation_get_proto_data(conversation, proto_rsync);
 129
 130     if (conversation_data == NULL) { /* new conversation */
 131     conversation_data = wmem_new(wmem_file_scope(), struct rsync_conversation_data);
 132     conversation_data->client_state = RSYNC_INIT;
 133     conversation_data->server_state = RSYNC_SERV_INIT;
 134     conversation_add_proto_data(conversation, proto_rsync, conversation_data);
 135     }
 136
 137     conversation_set_dissector(conversation, rsync_handle);
 138
 139     ti = proto_tree_add_item(tree, proto_rsync, tvb, 0, -1, ENC_NA);
 140
 141     rsync_tree = proto_item_add_subtree(ti, ett_rsync);
 142
 143     rsync_frame_data_p = (struct rsync_frame_data *)p_get_proto_data(wmem_file_scope(), pinfo, proto_rsync, 0);
 144     if (!rsync_frame_data_p) {
 145     /* then we haven't seen this frame before */
 146     rsync_frame_data_p = wmem_new(wmem_file_scope(), struct rsync_frame_data);
 147     rsync_frame_data_p->state = (me == SERVER) ? conversation_data->server_state : conversation_data->client_state;
 148     p_add_proto_data(wmem_file_scope(), pinfo, proto_rsync, 0, rsync_frame_data_p);
 149     }
 150
 151     if (me == SERVER) {
 152     switch (rsync_frame_data_p->state) {
 153         case RSYNC_SERV_INIT:
 154             dissect_rsync_version_header(tvb, pinfo, rsync_tree, me);
 155
 156             conversation_data->server_state = RSYNC_SERV_MOTD;
 157
 158             break;
 159
 160         case RSYNC_SERV_MOTD:
 161             proto_tree_add_item(rsync_tree, hf_rsync_motd_string, tvb, offset, -1, ENC_ASCII);
 162
 163             col_set_str(pinfo->cinfo, COL_INFO, "Server MOTD");
 164
 165             conversation_data->server_state = RSYNC_SERV_MOTD;
 166
 167             break;
 168
 169         case RSYNC_MODULE_LIST:
 170             /* there are two cases - file list, or authentication */
 171             if (0 == tvb_strneql(tvb, offset, RSYNCD_AUTHREQD, RSYNCD_AUTHREQD_LEN)) {
 172                 /* matches, so we assume it's an authentication message */
 173                 proto_tree_add_item(rsync_tree, hf_rsync_rsyncdok_string, tvb, offset, -1, ENC_ASCII);
 174
 175                 col_set_str(pinfo->cinfo, COL_INFO, "Authentication");
 176                 conversation_data->server_state = RSYNC_DATA;
 177
 178             } else { /*  it didn't match, so it is probably a module list */
 179
 180                 proto_tree_add_item(rsync_tree, hf_rsync_module_list_string, tvb, offset, -1, ENC_ASCII);
 181
 182                 /* we need to check the end of the buffer for magic string */
 183                 buff_length = tvb_captured_length_remaining(tvb, offset);
 184                 if (buff_length > RSYNCD_EXIT_LEN &&
 185                     0 == tvb_strneql(tvb, buff_length-RSYNCD_EXIT_LEN-1, RSYNCD_EXIT, RSYNCD_EXIT_LEN)) {
 186             /* that's all, folks */
 187             col_set_str(pinfo->cinfo, COL_INFO, "Final module list");
 188             conversation_data->server_state = RSYNC_DATA;
 189                 } else { /* there must be more data */
 190             col_set_str(pinfo->cinfo, COL_INFO, "Module list");
 191             conversation_data->server_state = RSYNC_MODULE_LIST;
 192                 }
 193             }
 194
 195             break;
 196
 197         case RSYNC_DATA:
 198             proto_tree_add_item(rsync_tree, hf_rsync_data, tvb, offset, -1, ENC_NA);
 199
 200             col_set_str(pinfo->cinfo, COL_INFO, "Data");
 201
 202             conversation_data->server_state = RSYNC_DATA;
 203
 204             break;
 205
 206     default:
 207         /* Unknown state */
 208         break;
 209         }
 210     } else { /* me == CLIENT */
 211     switch (rsync_frame_data_p->state) {
 212         case RSYNC_INIT:
 213             dissect_rsync_version_header(tvb, pinfo, rsync_tree, me);
 214
 215             conversation_data->client_state = RSYNC_CLIENT_QUERY;
 216
 217             break;
 218
 219         case RSYNC_CLIENT_QUERY:
 220             proto_tree_add_item(rsync_tree, hf_rsync_query_string, tvb, offset, -1, ENC_ASCII);
 221
 222             col_set_str(pinfo->cinfo, COL_INFO, "Client Query");
 223
 224             conversation_data->client_state = RSYNC_COMMAND;
 225
 226             if (tvb_captured_length(tvb) == RSYNC_MODULE_LIST_QUERY_LEN &&
 227                 0 == tvb_strneql(tvb, offset, RSYNC_MODULE_LIST_QUERY, RSYNC_MODULE_LIST_QUERY_LEN)) {
 228                 conversation_data->server_state = RSYNC_MODULE_LIST;
 229             } else {
 230                 conversation_data->server_state = RSYNC_DATA;
 231             }
 232
 233             break;
 234
 235         case RSYNC_COMMAND:
 236             /* then we are still sending commands */
 237             proto_tree_add_item(rsync_tree, hf_rsync_command_string, tvb, offset, -1, ENC_ASCII);
 238
 239             col_set_str(pinfo->cinfo, COL_INFO, "Client Command");
 240
 241             conversation_data->client_state = RSYNC_COMMAND;
 242
 243             break;
 244
 245         case RSYNC_DATA:
 246             /* then we are still sending commands */
 247             proto_tree_add_item(rsync_tree, hf_rsync_data, tvb, offset, -1, ENC_NA);
 248
 249             col_set_str(pinfo->cinfo, COL_INFO, "Data");
 250
 251             conversation_data->client_state = RSYNC_DATA;
 252
 253             break;
 254
 255     default:
 256         /* Unknown state */
 257         break;
 258         }
 259     }
 260     return tvb_captured_length(tvb);
 261 }
 262
 263 /* Packet dissection routine called by tcp (& udp) when port 873 detected */
 264 static int
 265 dissect_rsync(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 266 {
 267     return dissect_rsync_encap(tvb, pinfo, tree, rsync_desegment);
 268 }
 269
 270 static void
 271 apply_rsync_prefs(void)
 272 {
 273     /* Rsync uses the port preference to determine client/server */
 274     glb_rsync_tcp_range = prefs_get_range_value("rsync", "tcp.port");
 275 }
 276
 277 /* Register protocol with Wireshark. */
 278 void
 279 proto_register_rsync(void)
 280 {
 281     static hf_register_info hf[] = {
 282         { &hf_rsync_hdr_magic,
 283             { "Magic Header", "rsync.hdr_magic",
 284               FT_STRING, BASE_NONE, NULL, 0x0,
 285               NULL, HFILL }
 286         },
 287         { &hf_rsync_hdr_version,
 288             { "Header Version", "rsync.hdr_version",
 289               FT_STRING, BASE_NONE, NULL, 0x0,
 290               NULL, HFILL }
 291         },
 292         { &hf_rsync_query_string,
 293             { "Client Query String", "rsync.query",
 294               FT_STRING, BASE_NONE, NULL, 0x0,
 295               NULL, HFILL }
 296         },
 297         { &hf_rsync_motd_string,
 298             { "Server MOTD String", "rsync.motd",
 299               FT_STRING, BASE_NONE, NULL, 0x0,
 300               NULL, HFILL }
 301         },
 302         { &hf_rsync_module_list_string,
 303             { "Server Module List", "rsync.module_list",
 304               FT_STRING, BASE_NONE, NULL, 0x0,
 305               NULL, HFILL }
 306         },
 307         { &hf_rsync_rsyncdok_string,
 308             { "RSYNCD Response String", "rsync.response",
 309               FT_STRING, BASE_NONE, NULL, 0x0,
 310               NULL, HFILL }
 311         },
 312         { &hf_rsync_command_string,
 313             { "Client Command String", "rsync.command",
 314               FT_STRING, BASE_NONE, NULL, 0x0,
 315               NULL, HFILL }
 316         },
 317         { &hf_rsync_data,
 318             { "rsync data", "rsync.data",
 319               FT_BYTES, BASE_NONE, NULL, 0x0,
 320               NULL, HFILL }
 321         },
 322     };
 323
 324     static int *ett[] = {
 325         &ett_rsync,
 326     };
 327
 328     module_t *rsync_module;
 329
 330     proto_rsync = proto_register_protocol("RSYNC File Synchroniser", "RSYNC", "rsync");
 331     proto_register_field_array(proto_rsync, hf, array_length(hf));
 332     proto_register_subtree_array(ett, array_length(ett));
 333
 334     rsync_module = prefs_register_protocol(proto_rsync, apply_rsync_prefs);
 335     prefs_register_bool_preference(rsync_module, "desegment",
 336                                    "Reassemble RSYNC messages spanning multiple TCP segments",
 337                                    "Whether the RSYNC dissector should reassemble messages spanning multiple TCP segments."
 338                                    " To use this option, you must also enable"
 339                                    " \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
 340                                    &rsync_desegment);
 341
 342     rsync_handle = register_dissector("rsync", dissect_rsync, proto_rsync);
 343 }
 344 void
 345 proto_reg_handoff_rsync(void)
 346 {
 347     dissector_add_uint_with_preference("tcp.port", TCP_PORT_RSYNC, rsync_handle);
 348     apply_rsync_prefs();
 349 }
 350
 351 /*
 352  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 353  *
 354  * Local variables:
 355  * c-basic-offset: 4
 356  * tab-width: 8
 357  * indent-tabs-mode: nil
 358  * End:
 359  *
 360  * vi: set shiftwidth=4 tabstop=8 expandtab:
 361  * :indentSize=4:tabSize=8:noTabs=true:
 362  */