epan/dissectors/packet-xot.c

   1 /* packet-xot.c
   2  * Routines for X.25 over TCP dissection (RFC 1613)
   3  *
   4  * Copyright 2000, Paul Ionescu <paul@acorp.ro>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #include "config.h"
  14
  15 #include <epan/packet.h>
  16 #include <epan/prefs.h>
  17 #include <epan/conversation.h>
  18
  19 #include "packet-tcp.h"
  20
  21 #define TCP_PORT_XOT 1998
  22 #define XOT_HEADER_LENGTH 4
  23 #define XOT_VERSION 0
  24 #define XOT_PVC_SETUP 0xF5
  25
  26 /* Some X25 macros from packet-x25.c - some adapted code as well below */
  27 #define X25_MIN_HEADER_LENGTH 3
  28 #define X25_MIN_M128_HEADER_LENGTH 4
  29 #define X25_NONDATA_BIT                 0x01
  30 #define PACKET_IS_DATA(type)            (!(type & X25_NONDATA_BIT))
  31 #define X25_MBIT_MOD8                   0x10
  32 #define X25_MBIT_MOD128                 0x01
  33
  34 void proto_register_xot(void);
  35 void proto_reg_handoff_xot(void);
  36
  37 static const value_string vals_x25_type[] = {
  38    { XOT_PVC_SETUP, "PVC Setup" },
  39    { 0,   NULL}
  40 };
  41
  42 static const value_string xot_pvc_status_vals[] = {
  43    { 0x00, "Waiting to connect" },
  44
  45    { 0x08, "Destination disconnected" },
  46    { 0x09, "PVC/TCP connection refused" },
  47    { 0x0A, "PVC/TCP routing error" },
  48    { 0x0B, "PVC/TCP connect timed out" },
  49
  50    { 0x10, "Trying to connect via TCP" },
  51    { 0x11, "Awaiting PVC-SETUP reply" },
  52    { 0x12, "Connected" },
  53    { 0x13, "No such destination interface" },
  54    { 0x14, "Destination interface is not up" },
  55    { 0x15, "Non-X.25 destination interface" },
  56    { 0x16, "No such destination PVC" },
  57    { 0x17, "Destination PVC configuration mismatch" },
  58    { 0x18, "Mismatched flow control values" },
  59    { 0x19, "Can't support flow control values" },
  60    { 0x1A, "PVC setup protocol error" },
  61
  62    { 0,   NULL}
  63 };
  64
  65 static int proto_xot;
  66 static int ett_xot;
  67 static int hf_xot_version;
  68 static int hf_xot_length;
  69
  70 static int hf_x25_gfi;
  71 static int hf_x25_lcn;
  72 static int hf_x25_type;
  73
  74 static int hf_xot_pvc_version;
  75 static int hf_xot_pvc_status;
  76 static int hf_xot_pvc_init_itf_name_len;
  77 static int hf_xot_pvc_init_lcn;
  78 static int hf_xot_pvc_resp_itf_name_len;
  79 static int hf_xot_pvc_resp_lcn;
  80 static int hf_xot_pvc_send_inc_window;
  81 static int hf_xot_pvc_send_out_window;
  82 static int hf_xot_pvc_send_inc_pkt_size;
  83 static int hf_xot_pvc_send_out_pkt_size;
  84 static int hf_xot_pvc_init_itf_name;
  85 static int hf_xot_pvc_resp_itf_name;
  86
  87 static dissector_handle_t xot_handle;
  88 static dissector_handle_t xot_tcp_handle;
  89
  90 static dissector_handle_t x25_handle;
  91
  92 /* desegmentation of X.25 over multiple TCP */
  93 static bool xot_desegment = true;
  94 /* desegmentation of X.25 packet sequences */
  95 static bool x25_desegment;
  96
  97 static unsigned get_xot_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb,
  98                              int offset, void *data _U_)
  99 {
 100    uint16_t plen;
 101    int remain = tvb_captured_length_remaining(tvb, offset);
 102    if ( remain < XOT_HEADER_LENGTH){
 103       /* We did not get the data we asked for, use up what we can */
 104       return remain;
 105    }
 106
 107    /*
 108     * Get the length of the X.25-over-TCP packet.
 109     */
 110    plen = tvb_get_ntohs(tvb, offset + 2);
 111    return XOT_HEADER_LENGTH + plen;
 112 }
 113
 114 static unsigned get_xot_pdu_len_mult(packet_info *pinfo _U_, tvbuff_t *tvb,
 115                                   int offset, void *data _U_)
 116 {
 117    int offset_before = offset; /* offset where we start this test */
 118    int offset_next = offset + XOT_HEADER_LENGTH + X25_MIN_HEADER_LENGTH;
 119    int tvb_len;
 120
 121    while ((tvb_len = tvb_captured_length_remaining(tvb, offset)) > 0){
 122       uint16_t plen = 0;
 123       int modulo;
 124       uint16_t bytes0_1;
 125       uint8_t pkt_type;
 126       bool m_bit_set;
 127       int offset_x25 = offset + XOT_HEADER_LENGTH;
 128
 129       /* Minimum where next starts */
 130       offset_next = offset_x25 + X25_MIN_HEADER_LENGTH;
 131
 132       if (tvb_len < XOT_HEADER_LENGTH) {
 133          return offset_next-offset_before;
 134       }
 135
 136       /*
 137        * Get the length of the current X.25-over-TCP packet.
 138        */
 139       plen = get_xot_pdu_len(pinfo, tvb, offset, NULL);
 140       offset_next = offset + plen;
 141
 142       /* Make sure we have enough data */
 143       if (tvb_len < plen){
 144          return offset_next-offset_before;
 145       }
 146
 147       /*Some minor code copied from packet-x25.c */
 148       bytes0_1 = tvb_get_ntohs(tvb,  offset_x25+0);
 149       pkt_type = tvb_get_uint8(tvb, offset_x25+2);
 150
 151       /* If this is the first packet and it is not data, no sequence needed */
 152       if (offset == offset_before && !PACKET_IS_DATA(pkt_type)) {
 153           return offset_next-offset_before;
 154       }
 155
 156       /* Check for data, there can be X25 control packets in the X25 data */
 157       if (PACKET_IS_DATA(pkt_type)){
 158          modulo = ((bytes0_1 & 0x2000) ? 128 : 8);
 159          if (modulo == 8) {
 160             m_bit_set = pkt_type & X25_MBIT_MOD8;
 161          } else {
 162             m_bit_set = tvb_get_uint8(tvb, offset_x25+3) & X25_MBIT_MOD128;
 163          }
 164
 165          if (!m_bit_set){
 166             /* We are done with this sequence when the mbit is no longer set */
 167             return offset_next-offset_before;
 168          }
 169       }
 170       offset = offset_next;
 171       offset_next += XOT_HEADER_LENGTH + X25_MIN_HEADER_LENGTH;
 172   }
 173
 174   /* not enough data */
 175   pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 176   return offset_next - offset_before;
 177 }
 178
 179 static int dissect_xot_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 180 {
 181    int offset = 0;
 182    uint16_t version;
 183    uint16_t plen;
 184    uint8_t pkt_type;
 185    proto_item *ti = NULL;
 186    proto_tree *xot_tree = NULL;
 187    tvbuff_t   *next_tvb;
 188
 189    /*
 190     * Dissect the X.25-over-TCP packet.
 191     */
 192    col_set_str(pinfo->cinfo, COL_PROTOCOL, "XOT");
 193    version = tvb_get_ntohs(tvb, offset + 0);
 194    plen = tvb_get_ntohs(tvb, offset + 2);
 195    col_add_fstr(pinfo->cinfo, COL_INFO, "XOT Version = %u, size = %u",
 196                 version, plen);
 197    if (offset == 0 &&
 198        tvb_reported_length_remaining(tvb, offset) > XOT_HEADER_LENGTH + plen )
 199       col_append_fstr(pinfo->cinfo, COL_INFO, " TotX25: %d",
 200                       tvb_reported_length_remaining(tvb, offset));
 201
 202    if (tree) {
 203       ti = proto_tree_add_protocol_format(tree, proto_xot, tvb, offset, XOT_HEADER_LENGTH,
 204                                           "X.25 over TCP");
 205       xot_tree = proto_item_add_subtree(ti, ett_xot);
 206
 207       proto_tree_add_uint(xot_tree, hf_xot_version, tvb, offset, 2, version);
 208       proto_tree_add_uint(xot_tree, hf_xot_length, tvb, offset + 2, 2, plen);
 209    }
 210
 211    offset += XOT_HEADER_LENGTH;
 212    /*
 213     * Construct a tvbuff containing the amount of the payload we have
 214     * available.  Make its reported length the amount of data in the
 215     * X.25-over-TCP packet.
 216     */
 217    if (plen >= X25_MIN_HEADER_LENGTH) {
 218       pkt_type = tvb_get_uint8(tvb, offset + 2);
 219       if (pkt_type == XOT_PVC_SETUP) {
 220          unsigned init_itf_name_len, resp_itf_name_len, pkt_size;
 221          int hdr_offset = offset;
 222
 223          col_set_str(pinfo->cinfo, COL_INFO, "XOT PVC Setup");
 224          proto_item_set_len(ti, XOT_HEADER_LENGTH + plen);
 225
 226          /* These fields are in overlay with packet-x25.c */
 227          proto_tree_add_item(xot_tree, hf_x25_gfi, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 228          proto_tree_add_item(xot_tree, hf_x25_lcn, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 229          hdr_offset += 2;
 230          proto_tree_add_item(xot_tree, hf_x25_type, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 231          hdr_offset += 1;
 232
 233          proto_tree_add_item(xot_tree, hf_xot_pvc_version, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 234          hdr_offset += 1;
 235          proto_tree_add_item(xot_tree, hf_xot_pvc_status, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 236          hdr_offset += 1;
 237          proto_tree_add_item(xot_tree, hf_xot_pvc_init_itf_name_len, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 238          init_itf_name_len = tvb_get_uint8(tvb, hdr_offset);
 239          hdr_offset += 1;
 240          proto_tree_add_item(xot_tree, hf_xot_pvc_init_lcn, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 241          hdr_offset += 2;
 242          proto_tree_add_item(xot_tree, hf_xot_pvc_resp_itf_name_len, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 243          resp_itf_name_len = tvb_get_uint8(tvb, hdr_offset);
 244          hdr_offset += 1;
 245          proto_tree_add_item(xot_tree, hf_xot_pvc_resp_lcn, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 246          hdr_offset += 2;
 247          proto_tree_add_item(xot_tree, hf_xot_pvc_send_inc_window, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 248          hdr_offset += 1;
 249          proto_tree_add_item(xot_tree, hf_xot_pvc_send_out_window, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 250          hdr_offset += 1;
 251          pkt_size = tvb_get_uint8(tvb, hdr_offset);
 252          proto_tree_add_uint_format_value(xot_tree, hf_xot_pvc_send_inc_pkt_size, tvb, hdr_offset, 1, pkt_size, "2^%u", pkt_size);
 253          hdr_offset += 1;
 254          pkt_size = tvb_get_uint8(tvb, hdr_offset);
 255          proto_tree_add_uint_format_value(xot_tree, hf_xot_pvc_send_out_pkt_size, tvb, hdr_offset, 1, pkt_size, "2^%u", pkt_size);
 256          hdr_offset += 1;
 257          proto_tree_add_item(xot_tree, hf_xot_pvc_init_itf_name, tvb, hdr_offset, init_itf_name_len, ENC_ASCII);
 258          hdr_offset += init_itf_name_len;
 259          proto_tree_add_item(xot_tree, hf_xot_pvc_resp_itf_name, tvb, hdr_offset, resp_itf_name_len, ENC_ASCII);
 260       } else {
 261          next_tvb = tvb_new_subset_length(tvb, offset, plen);
 262          call_dissector(x25_handle, next_tvb, pinfo, tree);
 263       }
 264    }
 265
 266    return tvb_captured_length(tvb);
 267 }
 268
 269 static int dissect_xot_mult(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 270 {
 271    int offset = 0;
 272    int len = get_xot_pdu_len_mult(pinfo, tvb, offset, NULL);
 273    tvbuff_t   *next_tvb;
 274    int offset_max = offset+MIN(len,tvb_captured_length_remaining(tvb, offset));
 275    proto_item *ti;
 276    proto_tree *xot_tree;
 277
 278    if (tree) {
 279       /* Special header to show segments */
 280       ti = proto_tree_add_protocol_format(tree, proto_xot, tvb, offset, offset_max-offset,
 281                                           "X.25 over TCP - X.25 Sequence");
 282       xot_tree = proto_item_add_subtree(ti, ett_xot);
 283       proto_tree_add_uint(xot_tree, hf_xot_length, tvb, offset, offset_max, len);
 284    }
 285
 286    while (offset <= offset_max - XOT_HEADER_LENGTH){
 287       int plen = get_xot_pdu_len(pinfo, tvb, offset, NULL);
 288       next_tvb = tvb_new_subset_length(tvb, offset, plen);
 289
 290       dissect_xot_pdu(next_tvb, pinfo, tree, data);
 291       offset += plen;
 292    }
 293    return tvb_captured_length(tvb);
 294 }
 295
 296 static int
 297 dissect_xot_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
 298 {
 299    if (!x25_desegment || !xot_desegment){
 300       tcp_dissect_pdus(tvb, pinfo, tree, xot_desegment,
 301                        XOT_HEADER_LENGTH,
 302                        get_xot_pdu_len,
 303                        dissect_xot_pdu, data);
 304    } else {
 305       /* Use length version that "peeks" into X25, possibly several XOT packets */
 306       tcp_dissect_pdus(tvb, pinfo, tree, xot_desegment,
 307                        XOT_HEADER_LENGTH,
 308                        get_xot_pdu_len_mult,
 309                        dissect_xot_mult, data);
 310    }
 311    return tvb_reported_length(tvb);
 312 }
 313
 314 static int dissect_xot_tcp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
 315 {
 316    int tvb_len = tvb_captured_length(tvb);
 317    conversation_t *conversation;
 318
 319    if (tvb_len < 2 || tvb_get_ntohs(tvb, 0) != XOT_VERSION) {
 320       return 0;
 321    }
 322
 323    conversation = find_or_create_conversation(pinfo);
 324    conversation_set_dissector(conversation, xot_tcp_handle);
 325
 326    return dissect_xot_tcp(tvb, pinfo, tree, data);
 327 }
 328
 329 /* Register the protocol with Wireshark */
 330 void
 331 proto_register_xot(void)
 332 {
 333    static hf_register_info hf[] = {
 334       { &hf_xot_version,
 335         { "Version", "xot.version", FT_UINT16, BASE_DEC,
 336           NULL, 0, "Version of X.25 over TCP protocol", HFILL }},
 337
 338       { &hf_xot_length,
 339         { "Length", "xot.length", FT_UINT16, BASE_DEC,
 340           NULL, 0, "Length of X.25 over TCP packet", HFILL }},
 341       /* These fields are in overlay with packet-x25.c */
 342       { &hf_x25_gfi,
 343         { "GFI", "x25.gfi", FT_UINT16, BASE_DEC,
 344           NULL, 0xF000, "General Format Identifier", HFILL }},
 345
 346       { &hf_x25_lcn,
 347         { "Logical Channel", "x25.lcn", FT_UINT16, BASE_DEC,
 348           NULL, 0x0FFF, "Logical Channel Number", HFILL }},
 349
 350       { &hf_x25_type,
 351         { "Packet Type", "x25.type", FT_UINT8, BASE_HEX,
 352           VALS(vals_x25_type), 0x0, NULL, HFILL }},
 353
 354       { &hf_xot_pvc_version,
 355         { "Version", "xot.pvc.version", FT_UINT8, BASE_HEX,
 356           NULL, 0, NULL, HFILL }},
 357
 358       { &hf_xot_pvc_status,
 359         { "Status", "xot.pvc.status", FT_UINT8, BASE_HEX,
 360           VALS(xot_pvc_status_vals), 0, NULL, HFILL }},
 361
 362       { &hf_xot_pvc_init_itf_name_len,
 363         { "Initiator interface name length", "xot.pvc.init_itf_name_len", FT_UINT8, BASE_DEC,
 364           NULL, 0, NULL, HFILL }},
 365
 366       { &hf_xot_pvc_init_lcn,
 367         { "Initiator LCN", "xot.pvc.init_lcn", FT_UINT16, BASE_DEC,
 368           NULL, 0, "Initiator Logical Channel Number", HFILL }},
 369
 370       { &hf_xot_pvc_resp_itf_name_len,
 371         { "Responder interface name length", "xot.pvc.resp_itf_name_len", FT_UINT8, BASE_DEC,
 372           NULL, 0, NULL, HFILL }},
 373
 374       { &hf_xot_pvc_resp_lcn,
 375         { "Responder LCN", "xot.pvc.resp_lcn", FT_UINT16, BASE_DEC,
 376           NULL, 0, "Responder Logical Channel Number", HFILL }},
 377
 378       { &hf_xot_pvc_send_inc_window,
 379         { "Sender incoming window", "xot.pvc.send_inc_window", FT_UINT8, BASE_DEC,
 380           NULL, 0, NULL, HFILL }},
 381
 382       { &hf_xot_pvc_send_out_window,
 383         { "Sender outgoing window", "xot.pvc.send_out_window", FT_UINT8, BASE_DEC,
 384           NULL, 0, NULL, HFILL }},
 385
 386       { &hf_xot_pvc_send_inc_pkt_size,
 387         { "Sender incoming packet size", "xot.pvc.send_inc_pkt_size", FT_UINT8, BASE_DEC,
 388           NULL, 0, NULL, HFILL }},
 389
 390       { &hf_xot_pvc_send_out_pkt_size,
 391         { "Sender outgoing packet size", "xot.pvc.send_out_pkt_size", FT_UINT8, BASE_DEC,
 392           NULL, 0, NULL, HFILL }},
 393
 394       { &hf_xot_pvc_init_itf_name,
 395         { "Initiator interface name", "xot.pvc.init_itf_name", FT_STRING, BASE_NONE,
 396           NULL, 0, NULL, HFILL }},
 397
 398       { &hf_xot_pvc_resp_itf_name,
 399         { "Responder interface name", "xot.pvc.resp_itf_name", FT_STRING, BASE_NONE,
 400           NULL, 0, NULL, HFILL }}
 401    };
 402
 403    static int *ett[] = {
 404       &ett_xot
 405    };
 406    module_t *xot_module;
 407
 408    proto_xot = proto_register_protocol("X.25 over TCP", "XOT", "xot");
 409    proto_register_field_array(proto_xot, hf, array_length(hf));
 410    proto_register_subtree_array(ett, array_length(ett));
 411    xot_handle = register_dissector("xot", dissect_xot_tcp_heur, proto_xot);
 412    xot_tcp_handle = create_dissector_handle(dissect_xot_tcp, proto_xot);
 413    xot_module = prefs_register_protocol(proto_xot, NULL);
 414
 415    prefs_register_bool_preference(xot_module, "desegment",
 416       "Reassemble X.25-over-TCP messages spanning multiple TCP segments",
 417       "Whether the X.25-over-TCP dissector should reassemble messages spanning multiple TCP segments. "
 418       "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings",
 419       &xot_desegment);
 420    prefs_register_bool_preference(xot_module, "x25_desegment",
 421       "Reassemble X.25 packets with More flag to enable safe X.25 reassembly",
 422       "Whether the X.25-over-TCP dissector should reassemble all X.25 packets before calling the X25 dissector. "
 423       "If the TCP packets arrive out-of-order, the X.25 reassembly can otherwise fail. "
 424       "To use this option, you should also enable \"Reassemble X.25-over-TCP messages spanning multiple TCP segments\", \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings and \"Reassemble fragmented X.25 packets\" in the X.25 protocol settings.",
 425       &x25_desegment);
 426
 427 }
 428
 429 void
 430 proto_reg_handoff_xot(void)
 431 {
 432    dissector_add_uint_with_preference("tcp.port", TCP_PORT_XOT, xot_handle);
 433
 434    x25_handle = find_dissector_add_dependency("x.25", proto_xot);
 435 }
 436
 437 /*
 438  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 439  *
 440  * Local Variables:
 441  * c-basic-offset: 3
 442  * tab-width: 8
 443  * indent-tabs-mode: nil
 444  * End:
 445  *
 446  * ex: set shiftwidth=3 tabstop=8 expandtab:
 447  * :indentSize=3:tabSize=8:noTabs=true:
 448  */