epan/dissectors/packet-miop.c

   1 /* packet-miop.c
   2  * Routines for CORBA MIOP packet disassembly
   3  * Significantly based on packet-giop.c
   4  * Copyright 2009 Alvaro Vega Garcia <avega at tid dot es>
   5  *
   6  * According with Unreliable Multicast Draft Adopted Specification
   7  * 2001 October (OMG)
   8  * Chapter 29: Unreliable Multicast Inter-ORB Protocol (MIOP)
   9  * http://www.omg.org/technology/documents/specialized_corba.htm
  10  *
  11  * Wireshark - Network traffic analyzer
  12  * By Gerald Combs <gerald@wireshark.org>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * SPDX-License-Identifier: GPL-2.0-or-later
  16  */
  17
  18
  19 #include "config.h"
  20
  21 #include <epan/packet.h>
  22
  23 #include <epan/expert.h>
  24
  25 #include "packet-giop.h"
  26
  27 void proto_register_miop(void);
  28 void proto_reg_handoff_miop(void);
  29
  30 /*
  31  * Useful visible data/structs
  32  */
  33
  34 #define MIOP_MAX_UNIQUE_ID_LENGTH   252
  35
  36 #define MIOP_HEADER_SIZE 16
  37
  38 /*
  39  * Set to 1 for DEBUG output - TODO make this a runtime option
  40  */
  41
  42 #define DEBUG   0
  43
  44 /*
  45  * ------------------------------------------------------------------------------------------+
  46  *                                 Data/Variables/Structs
  47  * ------------------------------------------------------------------------------------------+
  48  */
  49
  50
  51 static int proto_miop;
  52
  53 /*
  54  * (sub)Tree declares
  55  */
  56
  57
  58 static int hf_miop_magic;
  59 static int hf_miop_hdr_version;
  60 static int hf_miop_flags;
  61 static int hf_miop_packet_length;
  62 static int hf_miop_packet_number;
  63 static int hf_miop_number_of_packets;
  64 static int hf_miop_unique_id_len;
  65 static int hf_miop_unique_id;
  66
  67 static int ett_miop;
  68
  69 static expert_field ei_miop_version_not_supported;
  70 static expert_field ei_miop_unique_id_len_exceed_max_value;
  71
  72 static dissector_handle_t miop_handle;
  73
  74 #define MIOP_MAGIC   0x4d494f50 /* "MIOP" */
  75
  76 static bool
  77 dissect_miop_heur_check (tvbuff_t * tvb, packet_info * pinfo _U_, proto_tree * tree _U_, void * data _U_) {
  78
  79   unsigned tot_len;
  80   uint32_t magic;
  81
  82   /* check magic number and version */
  83
  84
  85   tot_len = tvb_captured_length(tvb);
  86
  87   if (tot_len < MIOP_HEADER_SIZE) /* tot_len < 16 */
  88     {
  89       /* Not enough data captured to hold the GIOP header; don't try
  90          to interpret it as GIOP. */
  91       return false;
  92     }
  93
  94     magic = tvb_get_ntohl(tvb,0);
  95     if(magic != MIOP_MAGIC){
  96         /* Not a MIOP packet. */
  97         return false;
  98     }
  99
 100   return true;
 101 }
 102
 103 /* Main entry point */
 104 static int dissect_miop (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void* data _U_) {
 105   unsigned offset = 0;
 106
 107   proto_tree *miop_tree = NULL;
 108   proto_item *ti;
 109
 110   uint8_t hdr_version;
 111   unsigned version_major;
 112   unsigned version_minor;
 113
 114   uint8_t flags;
 115
 116   uint16_t packet_length;
 117   unsigned packet_number;
 118   unsigned number_of_packets;
 119   unsigned byte_order;
 120
 121   uint32_t unique_id_len;
 122
 123   wmem_strbuf_t *flags_strbuf = wmem_strbuf_create(pinfo->pool);
 124   wmem_strbuf_append(flags_strbuf, "none");
 125
 126   if (!dissect_miop_heur_check(tvb, pinfo, tree, data))
 127       return 0;
 128
 129   col_set_str (pinfo->cinfo, COL_PROTOCOL, "MIOP");
 130   /* Clear out stuff in the info column */
 131   col_clear(pinfo->cinfo, COL_INFO);
 132
 133   /* Extract major and minor version numbers */
 134   hdr_version = tvb_get_uint8(tvb, 4);
 135   version_major = ((hdr_version & 0xf0) >> 4);
 136   version_minor =  (hdr_version & 0x0f);
 137
 138   if (hdr_version != 16)
 139   {
 140       col_add_fstr (pinfo->cinfo, COL_INFO, "Version %u.%u",
 141                     version_major, version_minor);
 142
 143       ti = proto_tree_add_item (tree, proto_miop, tvb, 0, -1, ENC_NA);
 144       miop_tree = proto_item_add_subtree (ti, ett_miop);
 145       proto_tree_add_expert_format(miop_tree, pinfo, &ei_miop_version_not_supported,
 146                                tvb, 0, -1,
 147                                "MIOP version %u.%u not supported",
 148                                version_major, version_minor);
 149       return 5;
 150   }
 151
 152   flags = tvb_get_uint8(tvb, 5);
 153   byte_order = (flags & 0x01) ? ENC_LITTLE_ENDIAN : ENC_BIG_ENDIAN;
 154
 155   if (byte_order == ENC_BIG_ENDIAN) {
 156     packet_length = tvb_get_ntohs(tvb, 6);
 157     packet_number = tvb_get_ntohl(tvb, 8);
 158     number_of_packets = tvb_get_ntohl(tvb, 12);
 159     unique_id_len = tvb_get_ntohl(tvb, 16);
 160   }
 161   else {
 162     packet_length = tvb_get_letohs(tvb, 6);
 163     packet_number = tvb_get_letohl(tvb, 8);
 164     number_of_packets = tvb_get_letohl(tvb, 12);
 165     unique_id_len = tvb_get_letohl(tvb, 16);
 166   }
 167
 168   col_add_fstr (pinfo->cinfo, COL_INFO, "MIOP %u.%u Packet s=%d (%u of %u)",
 169                 version_major, version_minor, packet_length,
 170                 packet_number + 1,
 171                 number_of_packets);
 172
 173   if (tree)
 174     {
 175
 176       ti = proto_tree_add_item (tree, proto_miop, tvb, 0, -1, ENC_NA);
 177       miop_tree = proto_item_add_subtree (ti, ett_miop);
 178
 179       /* XXX - Should we bail out if we don't have the right magic number? */
 180       proto_tree_add_item(miop_tree, hf_miop_magic, tvb, offset, 4, ENC_ASCII);
 181       offset += 4;
 182       proto_tree_add_uint_format_value(miop_tree, hf_miop_hdr_version, tvb, offset, 1, hdr_version,
 183                                  "%u.%u", version_major, version_minor);
 184       offset++;
 185       if (flags & 0x01) {
 186         wmem_strbuf_truncate(flags_strbuf, 0);
 187         wmem_strbuf_append(flags_strbuf, "little-endian");
 188       }
 189       if (flags & 0x02) {
 190         wmem_strbuf_append_printf(flags_strbuf, "%s%s",
 191                                   wmem_strbuf_get_len(flags_strbuf) ? ", " : "", "last message");
 192       }
 193       proto_tree_add_uint_format_value(miop_tree, hf_miop_flags, tvb, offset, 1,
 194                                        flags, "0x%02x (%s)", flags, wmem_strbuf_get_str(flags_strbuf));
 195       offset++;
 196       proto_tree_add_item(miop_tree, hf_miop_packet_length, tvb, offset, 2, byte_order);
 197       offset += 2;
 198       proto_tree_add_item(miop_tree, hf_miop_packet_number, tvb, offset, 4, byte_order);
 199       offset += 4;
 200       proto_tree_add_item(miop_tree, hf_miop_number_of_packets, tvb, offset, 4, byte_order);
 201
 202       offset += 4;
 203       ti = proto_tree_add_item(miop_tree, hf_miop_unique_id_len, tvb, offset, 4, byte_order);
 204
 205       if (unique_id_len >= MIOP_MAX_UNIQUE_ID_LENGTH) {
 206         expert_add_info_format(pinfo, ti, &ei_miop_unique_id_len_exceed_max_value,
 207                        "Unique Id length (%u) exceeds max value (%u)",
 208                        unique_id_len, MIOP_MAX_UNIQUE_ID_LENGTH);
 209         return offset;
 210       }
 211
 212       offset += 4;
 213       proto_tree_add_item(miop_tree, hf_miop_unique_id, tvb, offset, unique_id_len,
 214                           byte_order);
 215
 216       if (packet_number == 0) {
 217         /*  It is the first packet of the collection
 218             We can call to GIOP dissector to show more about this first
 219             uncompleted GIOP message
 220         */
 221         tvbuff_t *payload_tvb;
 222
 223         offset += unique_id_len;
 224         payload_tvb = tvb_new_subset_remaining (tvb, offset);
 225         dissect_giop(payload_tvb, pinfo, tree);
 226       }
 227     }
 228
 229    return tvb_captured_length(tvb);
 230 }
 231
 232 static bool
 233 dissect_miop_heur (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void * data) {
 234
 235   if (!dissect_miop_heur_check(tvb, pinfo, tree, data))
 236       return false;
 237
 238   dissect_miop (tvb, pinfo, tree, data);
 239
 240   /* TODO: make reassembly */
 241   return true;
 242
 243 }
 244
 245 void proto_register_miop (void) {
 246
 247
 248   /* A header field is something you can search/filter on.
 249    *
 250    * We create a structure to register our fields. It consists of an
 251    * array of hf_register_info structures, each of which are of the format
 252    * {&(field id), {name, abbrev, type, display, strings, bitmask, blurb, HFILL}}.
 253    */
 254   static hf_register_info hf[] = {
 255     { &hf_miop_magic,
 256       { "Magic", "miop.magic", FT_STRING, BASE_NONE, NULL, 0x0,
 257         "PacketHeader magic", HFILL }},
 258     { &hf_miop_hdr_version,
 259       { "Version", "miop.hdr_version", FT_UINT8, BASE_HEX, NULL, 0x0,
 260         "PacketHeader hdr_version", HFILL }},
 261     { &hf_miop_flags,
 262       { "Flags", "miop.flags", FT_UINT8, BASE_OCT, NULL, 0x0,
 263         "PacketHeader flags", HFILL }},
 264     { &hf_miop_packet_length,
 265       { "Length", "miop.packet_length", FT_UINT16, BASE_DEC, NULL, 0x0,
 266         "PacketHeader packet_length", HFILL }},
 267     { &hf_miop_packet_number,
 268       { "PacketNumber", "miop.packet_number",  FT_UINT32, BASE_DEC, NULL, 0x0,
 269         "PacketHeader packet_number", HFILL }},
 270     { &hf_miop_number_of_packets,
 271       { "NumberOfPackets", "miop.number_of_packets", FT_UINT32, BASE_DEC, NULL, 0x0,
 272         "PacketHeader number_of_packets", HFILL }},
 273     { &hf_miop_unique_id_len,
 274       { "UniqueIdLength", "miop.unique_id_len", FT_UINT32, BASE_DEC, NULL, 0x0,
 275         "UniqueId length", HFILL }},
 276     { &hf_miop_unique_id,
 277       { "UniqueId", "miop.unique_id", FT_BYTES, BASE_NONE, NULL, 0x0,
 278         "UniqueId id", HFILL }},
 279   };
 280
 281
 282   static int *ett[] = {
 283     &ett_miop
 284   };
 285
 286   static ei_register_info ei[] = {
 287      { &ei_miop_version_not_supported, { "miop.version.not_supported", PI_UNDECODED, PI_WARN, "MIOP version not supported", EXPFILL }},
 288      { &ei_miop_unique_id_len_exceed_max_value, { "miop.unique_id_len.exceed_max_value", PI_MALFORMED, PI_WARN, "Unique Id length exceeds max value", EXPFILL }},
 289   };
 290
 291   expert_module_t* expert_miop;
 292
 293   proto_miop = proto_register_protocol("Unreliable Multicast Inter-ORB Protocol", "MIOP", "miop");
 294   proto_register_field_array (proto_miop, hf, array_length (hf));
 295   proto_register_subtree_array (ett, array_length (ett));
 296   expert_miop = expert_register_protocol(proto_miop);
 297   expert_register_field_array(expert_miop, ei, array_length(ei));
 298
 299   miop_handle = register_dissector("miop", dissect_miop, proto_miop);
 300
 301 }
 302
 303
 304 void proto_reg_handoff_miop (void) {
 305
 306   dissector_add_for_decode_as_with_preference("udp.port", miop_handle);
 307
 308   heur_dissector_add("udp", dissect_miop_heur, "MIOP over UDP", "miop_udp", proto_miop, HEURISTIC_ENABLE);
 309
 310 }
 311
 312 /*
 313  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 314  *
 315  * Local variables:
 316  * c-basic-offset: 2
 317  * tab-width: 8
 318  * indent-tabs-mode: nil
 319  * End:
 320  *
 321  * vi: set shiftwidth=2 tabstop=8 expandtab:
 322  * :indentSize=2:tabSize=8:noTabs=true:
 323  */