ui/gtk/follow_ssl.c

   1 /* follow_ssl.c
   2  * SSL specific routines for following traffic streams
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  23  * USA.
  24  */
  25
  26 #include "config.h"
  27 #include <stdio.h>
  28 #include <string.h>
  29
  30
  31 #ifdef HAVE_UNISTD_H
  32 #include <unistd.h>
  33 #endif
  34
  35 #include <ctype.h>
  36
  37 #include <gtk/gtk.h>
  38
  39 #include <epan/follow.h>
  40 #include <epan/dissectors/packet-ipv6.h>
  41 #include <epan/prefs.h>
  42 #include <epan/addr_resolv.h>
  43 #include <epan/epan_dissect.h>
  44 #include <epan/filesystem.h>
  45 #include <epan/tap.h>
  46
  47 #include <ui/alert_box.h>
  48 #include <ui/simple_dialog.h>
  49 #include <ui/utf8_entities.h>
  50 #include <ui/util.h>
  51
  52 #include "gtkglobals.h"
  53 #include "ui/gtk/color_utils.h"
  54 #include "ui/gtk/main.h"
  55 #include "ui/gtk/dlg_utils.h"
  56 #include "ui/gtk/file_dlg.h"
  57 #include "ui/gtk/keys.h"
  58 #include "ui/gtk/gui_utils.h"
  59 #include "ui/gtk/font_utils.h"
  60 #include "ui/follow.h"
  61 #include "ui/gtk/follow_ssl.h"
  62 #include "ui/gtk/follow_stream.h"
  63
  64 #ifdef SSL_PLUGIN
  65 #include "packet-ssl-utils.h"
  66 #else
  67 #include <epan/dissectors/packet-ssl-utils.h>
  68 #endif
  69
  70 static int
  71 ssl_queue_packet_data(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *ssl)
  72 {
  73     follow_info_t *      follow_info = (follow_info_t*) tapdata;
  74     SslDecryptedRecord * rec = NULL;
  75     SslDataInfo *        appl_data = NULL;
  76     int                  proto_ssl = GPOINTER_TO_INT(ssl);
  77     SslPacketInfo *      pi = NULL;
  78     show_stream_t        from = FROM_CLIENT;
  79
  80     /* Skip packets without decrypted payload data. */
  81     pi = (SslPacketInfo*) p_get_proto_data(pinfo->fd, proto_ssl, 0);
  82     if (!pi || !pi->appl_data) return 0;
  83
  84     /* Compute the packet's sender. */
  85     if (follow_info->client_port == 0) {
  86         follow_info->client_port = pinfo->srcport;
  87         COPY_ADDRESS(&follow_info->client_ip, &pinfo->src);
  88     }
  89     if (ADDRESSES_EQUAL(&follow_info->client_ip, &pinfo->src) &&
  90             follow_info->client_port == pinfo->srcport) {
  91         from = FROM_CLIENT;
  92     } else {
  93         from = FROM_SERVER;
  94     }
  95
  96     for (appl_data = pi->appl_data; appl_data != NULL; appl_data = appl_data->next) {
  97
  98         /* TCP segments that contain the end of two or more SSL PDUs will be
  99            queued to SSL taps for each of those PDUs. Therefore a single
 100            packet could be processed by this SSL tap listener multiple times.
 101            The following test handles that scenario by treating the
 102            follow_info->bytes_written[] values as the next expected
 103            appl_data->seq. Any appl_data instances that fall below that have
 104            already been processed and must be skipped. */
 105         if (appl_data->seq < follow_info->bytes_written[from]) continue;
 106
 107         /* Allocate a SslDecryptedRecord to hold the current appl_data
 108            instance's decrypted data. Even though it would be possible to
 109            consolidate multiple appl_data instances into a single rec, it is
 110            beneficial to use a one-to-one mapping. This affords the Follow
 111            Stream dialog view modes (ASCII, EBCDIC, Hex Dump, C Arrays, Raw)
 112            the opportunity to accurately reflect SSL PDU boundaries. Currently
 113            the Hex Dump view does by starting a new line, and the C Arrays
 114            view does by starting a new array declaration. */
 115         rec = (SslDecryptedRecord*) g_malloc(sizeof(SslDecryptedRecord) + appl_data->plain_data.data_len);
 116         rec->is_from_server = from == FROM_SERVER;
 117         rec->data.data = (guchar*) (rec + 1);
 118         rec->data.data_len = appl_data->plain_data.data_len;
 119         memcpy(rec->data.data, appl_data->plain_data.data, appl_data->plain_data.data_len);
 120
 121         /* Append the record to the follow_info structure. */
 122         follow_info->payload = g_list_append(follow_info->payload, rec);
 123         follow_info->bytes_written[from] += rec->data.data_len;
 124     }
 125
 126     return 0;
 127 }
 128 /* Follow the SSL stream, if any, to which the last packet that we called
 129    a dissection routine on belongs (this might be the most recently
 130    selected packet, or it might be the last packet in the file). */
 131 void
 132 follow_ssl_stream_cb(GtkWidget * w _U_, gpointer data _U_)
 133 {
 134     GtkWidget *     filter_te;
 135     GtkWidget *     filter_cm;
 136     gchar *         follow_filter;
 137     const gchar *   previous_filter;
 138     int             filter_out_filter_len;
 139     int             previous_filter_len;
 140     const char *    hostname0;
 141     const char *    hostname1;
 142     const char *    port0;
 143     const char *    port1;
 144     const char *    client_hostname;
 145     const char *    server_hostname;
 146     const char *    client_port;
 147     const char *    server_port;
 148     gchar *         server_to_client_string = NULL;
 149     gchar *         client_to_server_string = NULL;
 150     gchar *         both_directions_string = NULL;
 151     const gchar *   single_direction_format = NULL;
 152     follow_stats_t  stats;
 153     follow_info_t * follow_info;
 154     GString *       msg;
 155
 156     /* we got ssl so we can follow */
 157     if (!epan_dissect_packet_contains_field(cfile.edt, "ssl")) {
 158         simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 159                       "Error following stream.  Please make\n"
 160                       "sure you have an SSL packet selected.");
 161         return;
 162     }
 163
 164     follow_info = g_new0(follow_info_t, 1);
 165     follow_info->follow_type = FOLLOW_SSL;
 166
 167     /* Create a new filter that matches all packets in the SSL stream,
 168        and set the display filter entry accordingly */
 169     reset_tcp_reassembly();
 170     follow_filter = build_follow_conv_filter(&cfile.edt->pi);
 171     if (!follow_filter)
 172     {
 173         simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 174                       "Error creating filter for this stream.\n"
 175                       "A network layer header is needed");
 176         g_free(follow_info);
 177         return;
 178     }
 179
 180     /* Set the display filter entry accordingly */
 181     filter_cm = (GtkWidget *)g_object_get_data(G_OBJECT(top_level), E_DFILTER_CM_KEY);
 182     filter_te = gtk_bin_get_child(GTK_BIN(filter_cm));
 183
 184     /* needed in follow_filter_out_stream(), is there a better way? */
 185     follow_info->filter_te = filter_te;
 186
 187     /* save previous filter, const since we're not supposed to alter */
 188     previous_filter =
 189         (const gchar *)gtk_entry_get_text(GTK_ENTRY(filter_te));
 190
 191     /* allocate our new filter. API claims g_malloc terminates program on failure */
 192     /* my calc for max alloc needed is really +10 but when did a few extra bytes hurt ? */
 193     previous_filter_len = previous_filter?(int)strlen(previous_filter):0;
 194     filter_out_filter_len = (int)strlen(follow_filter) + previous_filter_len + 16;
 195     follow_info->filter_out_filter = (gchar *)g_malloc(filter_out_filter_len);
 196
 197     /* append the negation */
 198     if(previous_filter_len) {
 199         g_snprintf(follow_info->filter_out_filter, filter_out_filter_len,
 200         "%s and !(%s)", previous_filter, follow_filter);
 201     } else {
 202         g_snprintf(follow_info->filter_out_filter, filter_out_filter_len,
 203         "!(%s)", follow_filter);
 204     }
 205
 206     /* data will be passed via tap callback*/
 207     msg = register_tap_listener("ssl", follow_info, follow_filter, 0,
 208         NULL, ssl_queue_packet_data, NULL);
 209     if (msg)
 210     {
 211         simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 212             "Can't register ssl tap: %s\n",msg->str);
 213         g_free(follow_info->filter_out_filter);
 214         g_free(follow_info);
 215         g_free(follow_filter);
 216         return;
 217     }
 218     gtk_entry_set_text(GTK_ENTRY(filter_te), follow_filter);
 219
 220     /* Run the display filter so it goes in effect - even if it's the
 221        same as the previous display filter. */
 222     main_filter_packets(&cfile, follow_filter, TRUE);
 223
 224     /* Free the filter string, as we're done with it. */
 225     g_free(follow_filter);
 226
 227     remove_tap_listener(follow_info);
 228
 229     /* Stream to show */
 230     follow_stats(&stats);
 231
 232     if (stats.is_ipv6) {
 233         struct e_in6_addr ipaddr;
 234         memcpy(&ipaddr, stats.ip_address[0], 16);
 235         hostname0 = get_hostname6(&ipaddr);
 236         memcpy(&ipaddr, stats.ip_address[0], 16);
 237         hostname1 = get_hostname6(&ipaddr);
 238     } else {
 239         guint32 ipaddr;
 240         memcpy(&ipaddr, stats.ip_address[0], 4);
 241         hostname0 = get_hostname(ipaddr);
 242         memcpy(&ipaddr, stats.ip_address[1], 4);
 243         hostname1 = get_hostname(ipaddr);
 244     }
 245
 246     port0 = get_tcp_port(stats.port[0]);
 247     port1 = get_tcp_port(stats.port[1]);
 248
 249     follow_info->is_ipv6 = stats.is_ipv6;
 250
 251     /* Generate the strings for the follow stream dialog's combo box,
 252        starting with both directions... */
 253     both_directions_string = g_strdup_printf("Entire conversation (%u bytes)", follow_info->bytes_written[0] + follow_info->bytes_written[1]);
 254
 255     /* ...and then the server-to-client and client-to-server directions. */
 256     if (follow_info->client_port == stats.port[0]) {
 257         server_hostname = hostname1;
 258         server_port = port1;
 259         client_hostname = hostname0;
 260         client_port = port0;
 261     } else {
 262         server_hostname = hostname0;
 263         server_port = port0;
 264         client_hostname = hostname1;
 265         client_port = port1;
 266     }
 267
 268     single_direction_format = "%s:%s " UTF8_RIGHTWARDS_ARROW " %s:%s (%u bytes)";
 269     server_to_client_string = g_strdup_printf(single_direction_format,
 270         server_hostname, server_port,
 271         client_hostname, client_port,
 272         follow_info->bytes_written[0]);
 273     client_to_server_string = g_strdup_printf(single_direction_format,
 274         client_hostname, client_port,
 275         server_hostname, server_port,
 276         follow_info->bytes_written[1]);
 277
 278     /* Invoke the dialog. */
 279     follow_stream("Follow SSL Stream", follow_info, both_directions_string,
 280                     server_to_client_string, client_to_server_string);
 281
 282     g_free(both_directions_string);
 283     g_free(server_to_client_string);
 284     g_free(client_to_server_string);
 285 }
 286
 287 #define FLT_BUF_SIZE 1024
 288
 289 /*
 290  * XXX - the routine pointed to by "print_line_fcn_p" doesn't get handed lines,
 291  * it gets handed bufferfuls.  That's fine for "follow_write_raw()"
 292  * and "follow_add_to_gtk_text()", but, as "follow_print_text()" calls
 293  * the "print_line()" routine from "print.c", and as that routine might
 294  * genuinely expect to be handed a line (if, for example, it's using
 295  * some OS or desktop environment's printing API, and that API expects
 296  * to be handed lines), "follow_print_text()" should probably accumulate
 297  * lines in a buffer and hand them "print_line()".  (If there's a
 298  * complete line in a buffer - i.e., there's nothing of the line in
 299  * the previous buffer or the next buffer - it can just hand that to
 300  * "print_line()" after filtering out non-printables, as an
 301  * optimization.)
 302  *
 303  * This might or might not be the reason why C arrays display
 304  * correctly but get extra blank lines very other line when printed.
 305  */
 306 frs_return_t
 307 follow_read_ssl_stream(follow_info_t *follow_info,
 308                gboolean (*print_line_fcn_p)(char *, size_t, gboolean, void *),
 309                void *arg)
 310 {
 311     guint32      global_client_pos = 0, global_server_pos = 0;
 312     guint32      server_packet_count = 0;
 313     guint32      client_packet_count = 0;
 314     guint32 *    global_pos;
 315     GList *      cur;
 316     frs_return_t frs_return;
 317
 318     for (cur = follow_info->payload; cur; cur = g_list_next(cur)) {
 319         SslDecryptedRecord * rec = (SslDecryptedRecord*) cur->data;
 320         gboolean             include_rec = FALSE;
 321
 322         if (rec->is_from_server) {
 323             global_pos = &global_server_pos;
 324             include_rec = (follow_info->show_stream == BOTH_HOSTS) ||
 325                 (follow_info->show_stream == FROM_SERVER);
 326         } else {
 327             global_pos = &global_client_pos;
 328             include_rec = (follow_info->show_stream == BOTH_HOSTS) ||
 329                 (follow_info->show_stream == FROM_CLIENT);
 330         }
 331
 332         if (include_rec) {
 333             size_t nchars = rec->data.data_len;
 334             gchar *buffer = (gchar *)g_memdup(rec->data.data, (guint) nchars);
 335
 336             frs_return = follow_show(follow_info, print_line_fcn_p, buffer, nchars,
 337                 rec->is_from_server, arg, global_pos,
 338                 &server_packet_count, &client_packet_count);
 339             g_free(buffer);
 340             if (frs_return == FRS_PRINT_ERROR)
 341                 return frs_return;
 342         }
 343     }
 344
 345     return FRS_OK;
 346 }
 347
 348 /*
 349  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 350  *
 351  * Local variables:
 352  * c-basic-offset: 4
 353  * tab-width: 8
 354  * indent-tabs-mode: nil
 355  * End:
 356  *
 357  * vi: set shiftwidth=4 tabstop=8 expandtab:
 358  * :indentSize=4:tabSize=8:noTabs=true:
 359  */