epan/dissectors/packet-ncp-nmas.c

   1 /* packet-ncp-nmas.c
   2  * Routines for Novell Modular Authentication Service
   3  * Greg Morris <gmorris@novell.com>
   4  * Copyright (c) Novell, Inc. 2002-2004
   5  *
   6  * $Id$
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  25  */
  26
  27 #include "config.h"
  28
  29 #include <glib.h>
  30 #include <epan/packet.h>
  31 #include <epan/wmem/wmem.h>
  32 #include "packet-ncp-int.h"
  33 #include "packet-ncp-nmas.h"
  34
  35 static gint ett_nmas = -1;
  36
  37 static int proto_nmas = -1;
  38 /* static int hf_func = -1; */
  39 /* static int hf_subfunc = -1; */
  40 static int hf_ping_version = -1;
  41 static int hf_ping_flags = -1;
  42 static int hf_frag_handle = -1;
  43 static int hf_length = -1;
  44 static int hf_subverb = -1;
  45 static int hf_tree = -1;
  46 static int hf_user = -1;
  47 static int hf_nmas_version = -1;
  48 static int hf_msg_version = -1;
  49 static int hf_session_ident = -1;
  50 static int hf_msg_verb = -1;
  51 /* static int hf_attribute = -1; */
  52 static int hf_clearance = -1;
  53 static int hf_login_sequence = -1;
  54 static int hf_opaque = -1;
  55 static int hf_data = -1;
  56 static int hf_return_code = -1;
  57 static int hf_lsm_verb = -1;
  58 static int hf_squeue_bytes = -1;
  59 static int hf_cqueue_bytes = -1;
  60 static int hf_num_creds = -1;
  61 static int hf_cred_type = -1;
  62 static int hf_login_state = -1;
  63 static int hf_enc_cred = -1;
  64 static int hf_enc_data = -1;
  65 static int hf_reply_buffer_size = -1;
  66 static int hf_encrypt_error = -1;
  67
  68 static expert_field ei_encrypt_error = EI_INIT;
  69 static expert_field ei_return_error = EI_INIT;
  70
  71 static const value_string nmas_func_enum[] = {
  72     { 0x01, "Ping" },
  73     { 0x02, "Fragment" },
  74     { 0x03, "Abort" },
  75     { 0,    NULL }
  76 };
  77
  78 static const value_string nmas_subverb_enum[] = {
  79     { 0, "Fragmented Ping" },
  80     { 2, "Client Put Data" },
  81     { 4, "Client Get Data" },
  82     { 6, "Client Get User NDS Credentials" },
  83     { 8, "Login Store Management" },
  84     { 10, "Writable Object Check" },
  85     { 1242, "Message Handler" },
  86     { 0,          NULL }
  87 };
  88
  89 static const value_string nmas_msgverb_enum[] = {
  90     { 1, "Echo Data" },
  91     { 3, "Start Session" },
  92     { 5, "Client Write Data" },
  93     { 7, "Client Read Data" },
  94     { 9, "End Session" },
  95     { 0,          NULL }
  96 };
  97
  98 #if 0
  99 static const value_string nmas_attribute_enum[] = {
 100     { 1, "User Name" },
 101     { 2, "Tree Name" },
 102     { 4, "Clearance" },
 103     { 11, "Login Sequence" },
 104     { 0,          NULL }
 105 };
 106 #endif
 107
 108 static const value_string nmas_lsmverb_enum[] = {
 109     { 1, "Put Login Configuration" },
 110     { 2, "Get Login Configuration" },
 111     { 3, "Get All Configurations" },
 112     { 4, "Delete Login Configuration" },
 113     { 5, "Put Login Secret" },
 114     { 6, "Delete Login Secret" },
 115     { 7, "Set Password" },
 116     { 8, "Change Password" },
 117     { 9, "Delete Password" },
 118     { 10, "Get Password" },
 119     { 11, "Check Password Policy" },
 120     { 0,          NULL }
 121 };
 122
 123 static const value_string nmas_errors_enum[] = {
 124     { 0xFFFFF9A1, "(-1631) FRAGMENT FAILURE" },
 125     { 0xFFFFF9A0, "(-1632) BAD REQUEST SYNTAX" },
 126     { 0xFFFFF99F, "(-1633) BUFFER OVERFLOW" },
 127     { 0xFFFFF99E, "(-1634) SYSTEM RESOURCES" },
 128     { 0xFFFFF99D, "(-1635) INSUFFICIENT MEMORY" },
 129     { 0xFFFFF99C, "(-1636) NOT SUPPORTED" },
 130     { 0xFFFFF99B, "(-1637) BUFFER UNDERFLOW" },
 131     { 0xFFFFF99A, "(-1638) NOT FOUND" },
 132     { 0xFFFFF999, "(-1639) INVALID OPERATION" },
 133     { 0xFFFFF998, "(-1640) ASN1 DECODE" },
 134     { 0xFFFFF997, "(-1641) ASN1 ENCODE" },
 135     { 0xFFFFF996, "(-1642) LOGIN FAILED" },
 136     { 0xFFFFF995, "(-1643) INVALID PARAMETER" },
 137     { 0xFFFFF994, "(-1644) TIMED OUT RECOVERABLE" },
 138     { 0xFFFFF993, "(-1645) TIMED OUT NOT RECOVERABLE" },
 139     { 0xFFFFF992, "(-1646) TIMED OUT UNKNOWN" },
 140     { 0xFFFFF991, "(-1647) AUTHORIZATION FAILURE" },
 141     { 0xFFFFF990, "(-1648) INVALID DISTINGUISHED NAME" },
 142     { 0xFFFFF98F, "(-1649) CANNOT RESOLVE DISTINGUISHED NAME" },
 143     { 0xFFFFF98E, "(-1650) CANNOT RESOLVE CONNECTION" },
 144     { 0xFFFFF98D, "(-1651) NO CRYPTOGRAPHY" },
 145     { 0xFFFFF98C, "(-1652) INVALID VERSION" },
 146     { 0xFFFFF98B, "(-1653) SYNC NEEDED" },
 147     { 0xFFFFF98A, "(-1654) PROTOCOL STATE" },
 148     { 0xFFFFF989, "(-1655) INVALID HANDLE" },
 149     { 0xFFFFF988, "(-1656) INVALID METHOD" },
 150     { 0xFFFFF987, "(-1657) DEVELOPMENT VERSION" },
 151     { 0xFFFFF986, "(-1658) MISSING KEY" },
 152     { 0xFFFFF985, "(-1659) ACCESS NOT ALLOWED" },
 153     { 0xFFFFF984, "(-1660) SEQUENCE NOT FOUND" },
 154     { 0xFFFFF983, "(-1661) CLEARANCE NOT FOUND" },
 155     { 0xFFFFF982, "(-1662) LOGIN SERVER METHOD NOT FOUND" },
 156     { 0xFFFFF981, "(-1663) LOGIN CLIENT METHOD NOT FOUND" },
 157     { 0xFFFFF980, "(-1664) SERVER NOT FOUND" },
 158     { 0xFFFFF97F, "(-1665) LOGIN ATTRIBUTE NOT FOUND" },
 159     { 0xFFFFF97E, "(-1666) LEGACY INVALID PASSWORD" },
 160     { 0xFFFFF97D, "(-1667) ACCOUNT DISABLED" },
 161     { 0xFFFFF97C, "(-1668) ACCOUNT LOCKED" },
 162     { 0xFFFFF97B, "(-1669) ADDRESS RESTRICTION" },
 163     { 0xFFFFF97A, "(-1670) CONNECTION CLEARED" },
 164     { 0xFFFFF979, "(-1671) TIME RESTRICTION" },
 165     { 0xFFFFF978, "(-1672) SHORT TERM SECRET" },
 166     { 0xFFFFF977, "(-1673) NO NMAS ON TREE" },
 167     { 0xFFFFF976, "(-1674) NO NMAS ON SERVER" },
 168     { 0xFFFFF975, "(-1675) REQUEST CHALLENGED" },
 169     { 0xFFFFF974, "(-1676) LOGIN CANCELED" },
 170     { 0xFFFFF973, "(-1677) LOCAL CREDENTIAL STORE" },
 171     { 0xFFFFF972, "(-1678) REMOTE CREDENTIAL STORE" },
 172     { 0xFFFFF971, "(-1679) SMC NICM" },
 173     { 0xFFFFF970, "(-1680) SEQUENCE NOT AUTHORIZED" },
 174     { 0xFFFFF96F, "(-1681) TRANSPORT" },
 175     { 0xFFFFF96E, "(-1682) CRYPTO FAILED INIT" },
 176     { 0xFFFFF96D, "(-1683) DOUBLEBYTE FAILED INIT" },
 177     { 0xFFFFF96C, "(-1684) CODEPAGE FAILED INIT" },
 178     { 0xFFFFF96B, "(-1685) UNICODE FAILED INIT" },
 179     { 0xFFFFF96A, "(-1686) DLL FAILED LOADING" },
 180     { 0xFFFFF969, "(-1687) EVALUATION VERSION WARNING" },
 181     { 0xFFFFF968, "(-1688) CONCURRENT LOGIN" },
 182     { 0xFFFFF969, "(-1689) THREAD CREATE" },
 183     { 0xFFFFF96A, "(-1690) SECURE CHANNEL REQUIRED" },
 184     { 0xFFFFF96B, "(-1691) NO DEFAULT USER SEQUENCE" },
 185     { 0xFFFFF96C, "(-1692) NO TREENAME" },
 186     { 0xFFFFF96D, "(-1693) MECHANISM NOT FOUND" },
 187     { 0,          NULL }
 188 };
 189
 190 #if 0
 191 static int
 192 align_4(tvbuff_t *tvb, int aoffset)
 193 {
 194     if (tvb_length_remaining(tvb, aoffset) > 4 ) {
 195         return (aoffset%4);
 196     }
 197     return 0;
 198 }
 199 #endif
 200
 201 static int
 202 nmas_string(tvbuff_t* tvb, int hfinfo, proto_tree *nmas_tree, int offset, gboolean little)
 203 {
 204     int     foffset = offset;
 205     guint32 str_length;
 206     char    *buffer;
 207     guint32 i;
 208     guint16 c_char;
 209     guint32 length_remaining = 0;
 210
 211     buffer = (char *)wmem_alloc(wmem_packet_scope(), ITEM_LABEL_LENGTH+1);
 212     if (little) {
 213         str_length = tvb_get_letohl(tvb, foffset);
 214     } else {
 215         str_length = tvb_get_ntohl(tvb, foffset);
 216     }
 217     foffset += 4;
 218     if (str_length >= ITEM_LABEL_LENGTH) {
 219         proto_tree_add_string(nmas_tree, hfinfo, tvb, foffset,
 220             length_remaining + 4, "<String too long to process>");
 221         foffset += length_remaining;
 222         return foffset;
 223     }
 224     if (str_length == 0) {
 225         proto_tree_add_string(nmas_tree, hfinfo, tvb, offset, 4,
 226             "<Not Specified>");
 227         return foffset;
 228     }
 229     /*
 230      * XXX - other than the special-casing of null bytes,
 231      * we could just use "proto_tree_add_item()", as for
 232      * FT_STRING, FT_STRINGZ, and FT_UINT_STRING fields,
 233      * the display representation of an item is generated
 234      * using "format_text()", so it handles non-printable
 235      * characters.
 236      */
 237     for ( i = 0; i < str_length; i++ ) {
 238         c_char = tvb_get_guint8(tvb, foffset );
 239         if (c_char<0x20 || c_char>0x7e) {
 240             if (c_char != 0x00) {
 241                 c_char = 0x2e;
 242                 buffer[i] = c_char & 0xff;
 243             } else {
 244                 i--;
 245                 str_length--;
 246             }
 247         } else {
 248             buffer[i] = c_char & 0xff;
 249         }
 250         foffset++;
 251         length_remaining--;
 252
 253         if (length_remaining==1) {
 254             i++;
 255             break;
 256         }
 257     }
 258     buffer[i] = '\0';
 259
 260     if (little) {
 261         str_length = tvb_get_letohl(tvb, offset);
 262     } else {
 263         str_length = tvb_get_ntohl(tvb, offset);
 264     }
 265     proto_tree_add_string(nmas_tree, hfinfo, tvb, offset+4, str_length, buffer);
 266     return foffset;
 267 }
 268
 269 void
 270 dissect_nmas_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ncp_tree, ncp_req_hash_value *request_value)
 271 {
 272     guint8              /*func,*/ subfunc;
 273     guint32             msg_length=0, cur_string_len=0;
 274     guint32             foffset;
 275     guint32             subverb=0;
 276     guint32             attribute=0;
 277     guint8              msgverb=0;
 278     proto_tree          *atree;
 279     proto_item          *aitem;
 280
 281     foffset = 6;
 282     /*func = tvb_get_guint8(tvb, foffset);*/
 283     foffset += 1;
 284     subfunc = tvb_get_guint8(tvb, foffset);
 285     foffset += 1;
 286
 287     /* Fill in the INFO column. */
 288     col_set_str(pinfo->cinfo, COL_PROTOCOL, "NMAS");
 289     col_add_fstr(pinfo->cinfo, COL_INFO, "C NMAS - %s",
 290         val_to_str(subfunc, nmas_func_enum, "Unknown (0x%02x)"));
 291
 292     aitem = proto_tree_add_text(ncp_tree, tvb, foffset, -1, "Packet Type: %s",
 293         val_to_str(subfunc, nmas_func_enum, "Unknown (0x%02x)"));
 294     atree = proto_item_add_subtree(aitem, ett_nmas);
 295     switch (subfunc) {
 296     case 1:
 297         proto_tree_add_item(atree, hf_ping_version, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 298         foffset += 4;
 299         proto_tree_add_item(atree, hf_ping_flags, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 300         /*foffset += 4;*/
 301         break;
 302     case 2:
 303         proto_tree_add_item(atree, hf_frag_handle, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 304         /* Check for Fragment packet */
 305         if (tvb_get_letohl(tvb, foffset)!=0xffffffff) {
 306             break;
 307         }
 308         foffset += 4;
 309         foffset += 4; /* Dont know what this is */
 310         proto_tree_add_item(atree, hf_length, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 311         msg_length = tvb_get_letohl(tvb, foffset);
 312         foffset += 4;
 313         foffset += 12;
 314         msg_length -= 16;
 315         proto_tree_add_item(atree, hf_subverb, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 316         subverb = tvb_get_letohl(tvb, foffset);
 317         if (request_value) {
 318             request_value->req_nds_flags=subverb; /* Store the NMAS fragment verb */
 319         }
 320         foffset += 4;
 321         msg_length -= 4;
 322         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 323             val_to_str(subverb, nmas_subverb_enum, "Unknown subverb (%u)"));
 324         switch (subverb) {
 325         case 0:             /* Fragmented Ping */
 326             proto_tree_add_item(atree, hf_ping_version, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 327             foffset += 4;
 328             proto_tree_add_item(atree, hf_ping_flags, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 329             /*foffset += 4;*/
 330             break;
 331         case 2:             /* Client Put Data */
 332             proto_tree_add_item(atree, hf_opaque, tvb, foffset, msg_length, ENC_NA);
 333             /*foffset += msg_length;*/
 334             break;
 335         case 4:             /* Client Get Data */
 336         case 6:             /* Client Get User NDS Credentials */
 337             /* No Op */
 338             break;
 339         case 8:             /* Login Store Management */
 340             proto_tree_add_item(atree, hf_reply_buffer_size, tvb, foffset, 1, ENC_LITTLE_ENDIAN);
 341             foffset += 4;
 342             msgverb = tvb_get_guint8(tvb, foffset);
 343             if (request_value) {
 344                 request_value->nds_request_verb=msgverb; /* Use nds_request_verb for passed subverb */
 345             }
 346             proto_tree_add_item(atree, hf_lsm_verb, tvb, foffset, 1, ENC_LITTLE_ENDIAN);
 347             /*foffset += 4;*/
 348             col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 349                 val_to_str(msgverb, nmas_lsmverb_enum, "Unknown (%u)"));
 350
 351             switch (msgverb) {
 352             case 1:
 353                 break;
 354             case 2:
 355                 break;
 356             case 4:
 357                 break;
 358             case 5:
 359                 break;
 360             case 6:
 361                 break;
 362             default:
 363                 break;
 364             }
 365             break;
 366         case 10:            /* Writable Object Check */
 367             /* The first GUINT32 value is the len of the header? */
 368             foffset += 4;
 369             /* The next two GUINT32 values are reserved and always 0 */
 370             foffset += 8;
 371             foffset = nmas_string(tvb, hf_tree, atree, foffset, TRUE);
 372             /*foffset = */nmas_string(tvb, hf_user, atree, foffset, TRUE);
 373             break;
 374         case 1242:          /* Message Handler */
 375             foffset += 4;
 376             proto_tree_add_item(atree, hf_msg_version, tvb, foffset, 4, ENC_BIG_ENDIAN);
 377             foffset += 4;
 378             proto_tree_add_item(atree, hf_session_ident, tvb, foffset, 4, ENC_BIG_ENDIAN);
 379             foffset += 4;
 380             foffset += 3;
 381             msgverb = tvb_get_guint8(tvb, foffset);
 382             if (request_value) {
 383                 request_value->nds_request_verb=msgverb; /* Use nds_request_verb for passed verb */
 384             }
 385             proto_tree_add_item(atree, hf_msg_verb, tvb, foffset, 1, ENC_BIG_ENDIAN);
 386             foffset += 1;
 387             /*msg_length -= 12;*/
 388             col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 389                 val_to_str(msgverb, nmas_msgverb_enum, "Unknown (%u)"));
 390
 391             switch(msgverb) {
 392             case 1:
 393                 msg_length = tvb_get_ntohl(tvb, foffset);
 394                 proto_tree_add_item(atree, hf_length, tvb, foffset, 4, ENC_BIG_ENDIAN);
 395                 foffset += 4;
 396                 proto_tree_add_item(atree, hf_data, tvb, foffset, msg_length, ENC_NA);
 397                 /*foffset += msg_length;*/
 398                 break;
 399             case 3:
 400                 msg_length = tvb_get_ntohl(tvb, foffset);
 401                 msg_length -= 4;
 402                 proto_tree_add_item(atree, hf_length, tvb, foffset, 4, ENC_BIG_ENDIAN);
 403                 foffset += 4;
 404                 while (msg_length > 0) {
 405                     attribute = tvb_get_ntohl(tvb, foffset);
 406                     foffset += 4;
 407                     cur_string_len=tvb_get_ntohl(tvb, foffset);
 408                     switch (attribute) {
 409                     case 1:
 410                         foffset = nmas_string(tvb, hf_user, atree, foffset, FALSE);
 411                         break;
 412                     case 2:
 413                         foffset = nmas_string(tvb, hf_tree, atree, foffset, FALSE);
 414                         break;
 415                     case 4:
 416                         foffset = nmas_string(tvb, hf_clearance, atree, foffset, FALSE);
 417                         break;
 418                     case 11:
 419                         foffset = nmas_string(tvb, hf_login_sequence, atree, foffset, FALSE);
 420                         break;
 421                     default:
 422                         break;
 423                     }
 424                     msg_length -= cur_string_len;
 425                     if (tvb_reported_length_remaining(tvb, foffset)<5) {
 426                         break;
 427                     }
 428                 }
 429                 break;
 430             case 5:
 431                 proto_tree_add_item(atree, hf_opaque, tvb, foffset,
 432                     tvb_reported_length_remaining(tvb, foffset), ENC_NA);
 433                 /*foffset += msg_length;*/
 434                 break;
 435             case 7:
 436             case 9:
 437                 /* No Op */
 438                 break;
 439             default:
 440                 break;
 441             }
 442             break;
 443         default:
 444             break;
 445         }
 446         break;
 447     case 3:
 448         /* No Op */
 449         break;
 450     default:
 451         break;
 452     }
 453 }
 454
 455 void
 456 dissect_nmas_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ncp_tree, guint8 func _U_, guint8 subfunc, ncp_req_hash_value *request_value)
 457 {
 458     guint32             foffset=0, roffset=0;
 459     guint32             subverb=0;
 460     guint8              msgverb=0;
 461     guint32             msg_length=0;
 462     guint32             return_code=0, encrypt_error=0;
 463     proto_tree          *atree;
 464     proto_item          *aitem;
 465     proto_item          *expert_item;
 466     const gchar         *str;
 467
 468
 469     foffset = 8;
 470     if (request_value) {
 471         subverb = request_value->req_nds_flags;
 472         msgverb = request_value->nds_request_verb;
 473     }
 474     col_set_str(pinfo->cinfo, COL_PROTOCOL, "NMAS");
 475     if (tvb_reported_length_remaining(tvb, foffset)<4) {
 476         return;
 477     }
 478
 479     aitem = proto_tree_add_text(ncp_tree, tvb, foffset, -1, "Packet Type: %s",
 480         val_to_str(subfunc, nmas_func_enum, "Unknown (0x%02x)"));
 481     atree = proto_item_add_subtree(aitem, ett_nmas);
 482     switch (subfunc) {
 483     case 1:
 484         proto_tree_add_item(atree, hf_ping_flags, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 485         foffset += 4;
 486         proto_tree_add_item(atree, hf_nmas_version, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 487         /*foffset += 4;*/
 488         break;
 489     case 2:
 490         proto_tree_add_text(atree, tvb, foffset, -1, "Verb: %s",
 491             val_to_str(subverb, nmas_subverb_enum, "Unknown (%u)"));
 492         proto_tree_add_item(atree, hf_length, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 493         msg_length = tvb_get_letohl(tvb, foffset);
 494         foffset +=4;
 495         proto_tree_add_item(atree, hf_frag_handle, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 496         /* Check for a fragment packet */
 497         if (tvb_get_letohl(tvb, foffset)!=0xffffffff) {
 498             break;
 499         }
 500         foffset += 4;
 501         return_code = tvb_get_letohl(tvb, foffset);
 502         roffset = foffset;
 503         foffset += 4;
 504         msg_length -= 8;
 505         if (return_code == 0 && msg_length > 0) {
 506             switch (subverb) {
 507             case 0:             /* Fragmented Ping */
 508                 proto_tree_add_item(atree, hf_session_ident, tvb, foffset, 4, ENC_BIG_ENDIAN);
 509                 /*foffset += 4;*/
 510                 /*proto_tree_add_item(atree, hf_nmas_version, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 511                 foffset += 4;*/
 512                 break;
 513             case 2:             /* Client Put Data */
 514                 proto_tree_add_item(atree, hf_squeue_bytes, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 515                 foffset += 4;
 516                 proto_tree_add_item(atree, hf_cqueue_bytes, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 517                 /*foffset += 4;*/
 518                 break;
 519             case 4:             /* Client Get Data */
 520                 proto_tree_add_item(atree, hf_opaque, tvb, foffset, msg_length, ENC_NA);
 521                 /*foffset += msg_length;*/
 522                 break;
 523             case 6:             /* Client Get User NDS Credentials */
 524                 proto_tree_add_item(atree, hf_num_creds, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 525                 foffset += 4;
 526                 proto_tree_add_item(atree, hf_cred_type, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 527                 foffset += 4;
 528                 proto_tree_add_item(atree, hf_login_state, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 529                 foffset += 4;
 530                 msg_length -= 12;
 531                 proto_tree_add_item(atree, hf_enc_cred, tvb, foffset, msg_length, ENC_NA);
 532                 /*foffset += msg_length;*/
 533                 break;
 534             case 8:             /* Login Store Management */
 535                 proto_tree_add_text(atree, tvb, foffset, -1, "Subverb: %s",
 536                     val_to_str(msgverb, nmas_lsmverb_enum, "Unknown (%u)"));
 537                 switch(msgverb) {
 538                     /* The data within these structures is all encrypted. */
 539                 case 1:
 540                 case 3:
 541                 case 5:
 542                 case 7:
 543                 case 9:
 544                     proto_tree_add_item(atree, hf_enc_data, tvb, foffset, msg_length, ENC_NA);
 545                     /*foffset += msg_length;*/
 546                     break;
 547                 default:
 548                     break;
 549                 }
 550                 break;
 551             case 10:            /* Writable Object Check */
 552                 proto_tree_add_item(atree, hf_nmas_version, tvb, foffset, 4, ENC_LITTLE_ENDIAN);
 553                 /*foffset += 4;*/
 554                 break;
 555             case 1242:          /* Message Handler */
 556                 proto_tree_add_text(atree, tvb, foffset, -1, "Subverb: %s",
 557                                     val_to_str(msgverb, nmas_msgverb_enum, "Unknown (%u)"));
 558                 switch(msgverb) {
 559                 case 1:
 560                     msg_length = tvb_get_ntohl(tvb, foffset);
 561                     proto_tree_add_item(atree, hf_length, tvb, foffset, 4, ENC_BIG_ENDIAN);
 562                     foffset += 4;
 563                     proto_tree_add_item(atree, hf_data, tvb, foffset, msg_length, ENC_NA);
 564                     /*foffset += msg_length;*/
 565                     break;
 566                 case 3:
 567                     proto_tree_add_item(atree, hf_session_ident, tvb, foffset, 4, ENC_BIG_ENDIAN);
 568                     /*foffset += 4;*/
 569                     break;
 570                 case 5:
 571                     /* No Op */
 572                     break;
 573                 case 7:
 574                     encrypt_error = tvb_get_ntohl(tvb, foffset);
 575                     str = try_val_to_str(encrypt_error, nmas_errors_enum);
 576                     if (str) {
 577                         col_add_fstr(pinfo->cinfo, COL_INFO, "R Payload Error - %s", str);
 578                         expert_item = proto_tree_add_item(atree, hf_encrypt_error, tvb, foffset, 4, ENC_BIG_ENDIAN);
 579                         expert_add_info_format(pinfo, expert_item, &ei_encrypt_error, "NMAS Payload Error: %s", str);
 580                     } else {
 581                         proto_tree_add_item(atree, hf_opaque, tvb, foffset, msg_length, ENC_NA);
 582                     }
 583                     /*foffset += msg_length;*/
 584                     break;
 585                 case 9:
 586                     /* No Op */
 587                     break;
 588                 default:
 589                     break;
 590                 }
 591                 break;
 592             default:
 593                 break;
 594             }
 595         }
 596         str = try_val_to_str(return_code, nmas_errors_enum);
 597         if (str) {
 598             expert_item = proto_tree_add_item(atree, hf_return_code, tvb, roffset, 4, ENC_LITTLE_ENDIAN);
 599             expert_add_info_format(pinfo, expert_item, &ei_return_error, "NMAS Error: 0x%08x %s", return_code, str);
 600             col_add_fstr(pinfo->cinfo, COL_INFO, "R Error - %s", str);
 601         } else {
 602             if (return_code!=0) {
 603                 expert_item = proto_tree_add_item(atree, hf_return_code, tvb, roffset, 4, ENC_LITTLE_ENDIAN);
 604                 expert_add_info_format(pinfo, expert_item, &ei_return_error, "NMAS Error: 0x%08x is unknown", return_code);
 605                 col_add_fstr(pinfo->cinfo, COL_INFO, "R Unknown NMAS Error - 0x%08x", return_code);
 606             }
 607         }
 608
 609         if (return_code == 0) {
 610             proto_tree_add_text(atree, tvb, roffset, 4, "Return Code: Success (0x00000000)");
 611         }
 612         break;
 613     case 3:
 614         break;
 615     default:
 616         break;
 617     }
 618 }
 619
 620 void
 621 proto_register_nmas(void)
 622 {
 623     static hf_register_info hf_nmas[] = {
 624 #if 0
 625         { &hf_func,
 626         { "Function", "nmas.func",
 627             FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 628 #endif
 629
 630 #if 0
 631         { &hf_subfunc,
 632         { "Subfunction", "nmas.subfunc",
 633             FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 634 #endif
 635
 636         { &hf_ping_version,
 637         { "Ping Version", "nmas.ping_version",
 638             FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 639
 640         { &hf_ping_flags,
 641         { "Flags", "nmas.ping_flags",
 642             FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 643
 644         { &hf_frag_handle,
 645         { "Fragment Handle", "nmas.frag_handle",
 646             FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 647
 648         { &hf_length,
 649         { "Length", "nmas.length",
 650             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 651
 652         { &hf_subverb,
 653         { "Sub Verb", "nmas.subverb",
 654             FT_UINT32, BASE_HEX, VALS(nmas_subverb_enum), 0x0, NULL, HFILL }},
 655
 656         { &hf_tree,
 657         { "Tree", "nmas.tree",
 658             FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 659
 660         { &hf_user,
 661         { "User", "nmas.user",
 662             FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 663
 664         { &hf_nmas_version,
 665         { "NMAS Protocol Version", "nmas.version",
 666             FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 667
 668         { &hf_msg_version,
 669         { "Message Version", "nmas.msg_version",
 670             FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 671
 672         { &hf_session_ident,
 673         { "Session Identifier", "nmas.session_ident",
 674             FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 675
 676         { &hf_msg_verb,
 677         { "Message Verb", "nmas.msg_verb",
 678             FT_UINT8, BASE_HEX, VALS(nmas_msgverb_enum), 0x0, NULL, HFILL }},
 679
 680 #if 0
 681         { &hf_attribute,
 682         { "Attribute Type", "nmas.attribute",
 683             FT_UINT32, BASE_DEC, VALS(nmas_attribute_enum), 0x0, NULL, HFILL }},
 684 #endif
 685
 686         { &hf_clearance,
 687         { "Requested Clearance", "nmas.clearance",
 688             FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 689
 690         { &hf_login_sequence,
 691         { "Requested Login Sequence", "nmas.login_seq",
 692             FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 693
 694         { &hf_opaque,
 695         { "Opaque Data", "nmas.opaque",
 696             FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 697
 698         { &hf_data,
 699         { "Data", "nmas.data",
 700             FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 701
 702         { &hf_return_code,
 703         { "Return Code", "nmas.return_code",
 704             FT_UINT32, BASE_HEX, VALS(nmas_errors_enum), 0x0, NULL, HFILL }},
 705
 706         { &hf_lsm_verb,
 707         { "Login Store Message Verb", "nmas.lsm_verb",
 708             FT_UINT8, BASE_HEX, VALS(nmas_lsmverb_enum), 0x0, NULL, HFILL }},
 709
 710         { &hf_squeue_bytes,
 711         { "Server Queue Number of Bytes", "nmas.squeue_bytes",
 712             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 713
 714         { &hf_cqueue_bytes,
 715         { "Client Queue Number of Bytes", "nmas.cqueue_bytes",
 716             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 717
 718         { &hf_num_creds,
 719         { "Number of Credentials", "nmas.num_creds",
 720             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 721
 722         { &hf_cred_type,
 723         { "Credential Type", "nmas.cred_type",
 724             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 725
 726         { &hf_login_state,
 727         { "Login State", "nmas.login_state",
 728             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 729
 730         { &hf_enc_cred,
 731         { "Encrypted Credential", "nmas.enc_cred",
 732           FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 733
 734         { &hf_enc_data,
 735         { "Encrypted Data", "nmas.enc_data",
 736           FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 737
 738         { &hf_reply_buffer_size,
 739         { "Reply Buffer Size", "nmas.buf_size",
 740             FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 741
 742         { &hf_encrypt_error,
 743         { "Payload Error", "nmas.encrypt_error",
 744             FT_UINT32, BASE_HEX, VALS(nmas_errors_enum), 0x0,
 745             "Payload/Encryption Return Code", HFILL }}
 746     };
 747
 748     static gint *ett[] = {
 749         &ett_nmas
 750     };
 751
 752     static ei_register_info ei[] = {
 753         { &ei_encrypt_error, { "nmas.encrypt_error.expert", PI_RESPONSE_CODE, PI_NOTE, "NMAS Payload Erro", EXPFILL }},
 754         { &ei_return_error, { "nmas.return_code.expert", PI_RESPONSE_CODE, PI_NOTE, "NMAS Error", EXPFILL }},
 755     };
 756
 757     expert_module_t* expert_nmas;
 758
 759     proto_nmas = proto_register_protocol("Novell Modular Authentication Service", "NMAS", "nmas");
 760     proto_register_field_array(proto_nmas, hf_nmas, array_length(hf_nmas));
 761     proto_register_subtree_array(ett, array_length(ett));
 762     expert_nmas = expert_register_protocol(proto_nmas);
 763     expert_register_field_array(expert_nmas, ei, array_length(ei));
 764 }
 765
 766 /*
 767  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 768  *
 769  * Local variables:
 770  * c-basic-offset: 4
 771  * tab-width: 4
 772  * indent-tabs-mode: nil
 773  * End:
 774  *
 775  * vi: set shiftwidth=4 tabstop=4 expandtab:
 776  * :indentSize=4:tabSize=4:noTabs=true:
 777  */