epan/dissectors/packet-tnef.c

   1 /* packet-tnef.c
   2  * Routines for Transport-Neutral Encapsulation Format (TNEF) packet disassembly
   3  *
   4  * $Id$
   5  *
   6  * Copyright (c) 2007 by Graeme Lunt
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1999 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  25  */
  26
  27 #include "config.h"
  28
  29 #include <glib.h>
  30
  31 #include <epan/packet.h>
  32 #include <epan/addr_resolv.h>
  33 #include <epan/expert.h>
  34
  35 #include <wiretap/tnef.h>
  36
  37 #include "packet-dcerpc.h"
  38 #include "packet-dcerpc-nspi.h"
  39 #include "packet-ber.h"
  40
  41 #define PNAME  "Transport-Neutral Encapsulation Format"
  42 #define PSNAME "TNEF"
  43 #define PFNAME "tnef"
  44
  45 #define ATP_TRIPLES   (0x0000)
  46 #define ATP_STRING    (0x0001)
  47 #define ATP_TEXT      (0x0002)
  48 #define ATP_DATE      (0x0003)
  49 #define ATP_SHORT     (0x0004)
  50 #define ATP_LONG      (0x0005)
  51 #define ATP_BYTE      (0x0006)
  52 #define ATP_WORD      (0x0007)
  53 #define ATP_DWORD     (0x0008)
  54 #define ATP_MAX       (0x0009)
  55
  56 #define ATT_OWNER                     (0x00060000) /* handled */
  57 #define ATT_SENT_FOR                  (0x00060001) /* handled */
  58 #define ATT_DELEGATE                  (0x00060002)
  59 #define ATT_DATE_START                (0x00030006) /* handled */
  60 #define ATT_DATE_END                  (0x00030007) /* handled */
  61 #define ATT_AID_OWNER                 (0x00040008)
  62 #define ATT_REQUEST_RES               (0x00040009)
  63
  64 #define ATT_FROM                      (0x00008000)
  65 #define ATT_SUBJECT                   (0x00018004)
  66 #define ATT_DATE_SENT                 (0x00038005) /* handled */
  67 #define ATT_DATE_RECD                 (0x00038006) /* handled */
  68 #define ATT_MESSAGE_STATUS            (0x00068007)
  69 #define ATT_MESSAGE_CLASS             (0x00078008) /* handled */
  70 #define ATT_MESSAGE_ID                (0x00018009)
  71 #define ATT_PARENT_ID                 (0x0001800A) /* handled */
  72 #define ATT_CONVERSATION_ID           (0x0001800B) /* handled */
  73 #define ATT_BODY                      (0x0002800C)
  74 #define ATT_PRIORITY                  (0x0004800D) /* handled */
  75 #define ATT_ATTACH_DATA               (0x0006800F)
  76 #define ATT_ATTACH_TITLE              (0x00018010) /* handled */
  77 #define ATT_ATTACH_META_FILE          (0x00068011)
  78 #define ATT_ATTACH_CREATE_DATE        (0x00038012) /* handled */
  79 #define ATT_ATTACH_MODIFY_DATE        (0x00038013) /* handled */
  80 #define ATT_DATE_MODIFIED             (0x00038020) /* handled */
  81
  82 #define ATT_ATTACH_TRANSPORT_FILENAME (0x00069001)
  83 #define ATT_ATTACH_REND_DATA          (0x00069002)
  84 #define ATT_MAPI_PROPS                (0x00069003) /* handled */
  85 #define ATT_RECIP_TABLE               (0x00069004)
  86 #define ATT_ATTACHMENT                (0x00069005)
  87 #define ATT_TNEF_VERSION              (0x00089006) /* handled */
  88 #define ATT_OEM_CODEPAGE              (0x00069007) /* handled */
  89 #define ATT_ORIGINAL_MESSAGE_CLASS    (0x00079008) /* handled */
  90
  91 static int proto_tnef = -1;
  92
  93 static int hf_tnef_signature = -1;
  94 static int hf_tnef_key = -1;
  95 static int hf_tnef_attribute = -1;
  96 static int hf_tnef_attribute_lvl = -1;
  97 static int hf_tnef_attribute_tag = -1;
  98 static int hf_tnef_attribute_tag_type = -1;
  99 static int hf_tnef_attribute_tag_id = -1;
 100 static int hf_tnef_attribute_length = -1;
 101 static int hf_tnef_attribute_value = -1;
 102 static int hf_tnef_attribute_string = -1;
 103 static int hf_tnef_attribute_date = -1;
 104 static int hf_tnef_attribute_display_name = -1;
 105 static int hf_tnef_attribute_email_address = -1;
 106 static int hf_tnef_attribute_checksum = -1;
 107 static int hf_tnef_mapi_props = -1;
 108 static int hf_tnef_oem_codepage = -1;
 109 static int hf_tnef_version = -1;
 110 static int hf_tnef_message_class = -1;
 111 static int hf_tnef_original_message_class = -1;
 112 static int hf_tnef_priority = -1;
 113 static int hf_tnef_mapi_props_count = -1;
 114
 115 static int hf_tnef_property = -1;
 116 static int hf_tnef_property_tag = -1;
 117 static int hf_tnef_property_tag_type = -1;
 118 static int hf_tnef_property_tag_id = -1;
 119 static int hf_tnef_property_tag_set = -1;
 120 static int hf_tnef_property_tag_kind = -1;
 121 static int hf_tnef_property_tag_name_id = -1;
 122 static int hf_tnef_property_tag_name_length = -1;
 123 static int hf_tnef_property_tag_name_string = -1;
 124 static int hf_tnef_property_padding = -1;
 125 static int hf_tnef_padding = -1;
 126
 127 static int hf_tnef_values_count = -1;
 128 static int hf_tnef_value_length = -1;
 129
 130 static int hf_tnef_attribute_date_year = -1;
 131 static int hf_tnef_attribute_date_month = -1;
 132 static int hf_tnef_attribute_date_day = -1;
 133 static int hf_tnef_attribute_date_hour = -1;
 134 static int hf_tnef_attribute_date_minute = -1;
 135 static int hf_tnef_attribute_date_second = -1;
 136 static int hf_tnef_attribute_date_day_of_week = -1;
 137
 138 static int hf_tnef_PropValue_i = -1;
 139 static int hf_tnef_PropValue_l = -1;
 140 static int hf_tnef_PropValue_b = -1;
 141 static int hf_tnef_PropValue_lpszA = -1;
 142 static int hf_tnef_PropValue_lpszW = -1;
 143 static int hf_tnef_PropValue_lpguid = -1;
 144 static int hf_tnef_PropValue_bin = -1;
 145 static int hf_tnef_PropValue_ft = -1;
 146 static int hf_tnef_PropValue_err = -1;
 147 static int hf_tnef_PropValue_MVi = -1;
 148 static int hf_tnef_PropValue_MVl = -1;
 149 static int hf_tnef_PropValue_MVszA = -1;
 150 static int hf_tnef_PropValue_MVbin = -1;
 151 static int hf_tnef_PropValue_MVguid = -1;
 152 static int hf_tnef_PropValue_MVszW = -1;
 153 static int hf_tnef_PropValue_MVft = -1;
 154 static int hf_tnef_PropValue_null = -1;
 155 static int hf_tnef_PropValue_object = -1;
 156
 157 static int ett_tnef = -1;
 158 static int ett_tnef_attribute = -1;
 159 static int ett_tnef_attribute_tag = -1;
 160 static int ett_tnef_mapi_props = -1;
 161 static int ett_tnef_property = -1;
 162 static int ett_tnef_property_tag = -1;
 163 static int ett_tnef_counted_items = -1;
 164 static int ett_tnef_attribute_date = -1;
 165 static int ett_tnef_attribute_address = -1;
 166
 167 static expert_field ei_tnef_expect_single_item = EI_INIT;
 168 static expert_field ei_tnef_incorrect_signature = EI_INIT;
 169
 170 static dissector_handle_t tnef_handle;
 171
 172 static const value_string tnef_Lvl_vals[] = {
 173    {   1, "LVL-MESSAGE" },
 174    {   2, "LVL-ATTACHMENT" },
 175    { 0, NULL }
 176 };
 177
 178 static const value_string tnef_Priority_vals[] = {
 179    {   1, "Low" },
 180    {   2, "High" },
 181    {   3, "Normal" },
 182    { 0, NULL }
 183 };
 184
 185 static const value_string tnef_Types_vals[] = {
 186          {  ATP_TRIPLES, "Triples" },
 187          {  ATP_STRING,  "String"},
 188          {  ATP_TEXT,    "Text" },
 189          {  ATP_DATE,    "Date"},
 190          {  ATP_SHORT,   "Short"},
 191          {  ATP_LONG,    "Long"},
 192          {  ATP_BYTE,    "Byte"},
 193          {  ATP_WORD,    "Word"},
 194          {  ATP_DWORD,   "DWord"},
 195          {  ATP_MAX,     "Max"},
 196          { 0, NULL }
 197 };
 198
 199 static const value_string weekday_vals[] = {
 200         {0, "Sunday"},
 201         {1, "Monday"},
 202         {2, "Tuesday"},
 203         {3, "Wednesday"},
 204         {4, "Thursday"},
 205         {5, "Friday"},
 206         {6, "Saturday"},
 207         {0, NULL}
 208 };
 209
 210 static const value_string tnef_Attribute_vals[] = {
 211         {  ATT_OWNER, "ATT_OWNER" },
 212         {  ATT_SENT_FOR, "ATT_SENT_FOR" },
 213         {  ATT_DELEGATE, "ATT_DELEGATE" },
 214         {  ATT_OWNER, "ATT_OWNER" },
 215         {  ATT_DATE_START, "ATT_DATE_START" },
 216         {  ATT_DATE_END, "ATT_DATE_END" },
 217         {  ATT_AID_OWNER, "ATT_AID_OWNER" },
 218         {  ATT_REQUEST_RES, "ATT_REQUEST_RES" },
 219         {  ATT_FROM, "ATT_FROM" },
 220         {  ATT_SUBJECT, "ATT_SUBJECT" },
 221         {  ATT_DATE_SENT, "ATT_DATE_SENT" },
 222         {  ATT_DATE_RECD, "ATT_DATE_RECD" },
 223         {  ATT_MESSAGE_STATUS, "ATT_MESSAGE_STATUS" },
 224         {  ATT_MESSAGE_CLASS, "ATT_MESSAGE_CLASS" },
 225         {  ATT_MESSAGE_ID, "ATT_MESSAGE_ID" },
 226         {  ATT_PARENT_ID, "ATT_PARENT_ID" },
 227         {  ATT_CONVERSATION_ID, "ATT_CONVERSATION_ID" },
 228         {  ATT_BODY, "ATT_BODY" },
 229         {  ATT_PRIORITY, "ATT_PRIORITY" },
 230         {  ATT_ATTACH_DATA, "ATT_ATTACH_DATA" },
 231         {  ATT_ATTACH_TITLE, "ATT_ATTACH_TITLE" },
 232         {  ATT_ATTACH_META_FILE, "ATT_ATTACH_META_FILE" },
 233         {  ATT_ATTACH_CREATE_DATE, "ATT_ATTACH_CREATE_DATE" },
 234         {  ATT_ATTACH_MODIFY_DATE, "ATT_ATTACH_MODIFY_DATE" },
 235         {  ATT_DATE_MODIFIED, "ATT_DATE_MODIFIED" },
 236         {  ATT_ATTACH_TRANSPORT_FILENAME, "ATT_ATTACH_TRANSPORT_FILENAME" },
 237         {  ATT_ATTACH_REND_DATA, "ATT_ATTACH_REND_DATA" },
 238         {  ATT_MAPI_PROPS, "ATT_MAPI_PROPS" },
 239         {  ATT_RECIP_TABLE, "ATT_RECIP_TABLE" },
 240         {  ATT_ATTACHMENT, "ATT_ATTACHMENT" },
 241         {  ATT_TNEF_VERSION, "ATT_TNEF_VERSION" },
 242         {  ATT_OEM_CODEPAGE, "ATT_OEM_CODEPAGE" },
 243         {  ATT_ORIGINAL_MESSAGE_CLASS, "ATT_ORIGINAL_MESSAGE_CLASS" },
 244         { 0, NULL }
 245 };
 246
 247 static gint dissect_counted_values(tvbuff_t *tvb, gint offset, int hf_id,  packet_info *pinfo, proto_tree *tree, gboolean single, gboolean unicode, guint encoding)
 248 {
 249          proto_item *item;
 250          guint32 length, count, i;
 251
 252          count = tvb_get_letohl(tvb, offset);
 253          proto_tree_add_item(tree, hf_tnef_values_count, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 254
 255          if(count > 1) {
 256                  if(single) {
 257                          item = proto_tree_add_expert_format(tree, pinfo, &ei_tnef_expect_single_item, tvb, offset, 4,
 258                                                     "Expecting a single item but found %d", count);
 259                          tree = proto_item_add_subtree(item, ett_tnef_counted_items);
 260                  }
 261          }
 262
 263          offset += 4;
 264
 265          for(i = 0; i < count; i++) {
 266
 267                  length = tvb_get_letohl(tvb, offset);
 268                  proto_tree_add_item(tree, hf_tnef_value_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 269                  offset += 4;
 270
 271                  if (unicode) {
 272                          char *unicode_str = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, length, ENC_LITTLE_ENDIAN);
 273                          proto_tree_add_string(tree, hf_id, tvb, offset, length, unicode_str);
 274                  } else {
 275                          proto_tree_add_item(tree, hf_id, tvb, offset, length, encoding);
 276                  }
 277                  offset += length;
 278
 279                  /* XXX: may be padding ? */
 280
 281          }
 282
 283          return offset;
 284 }
 285
 286 static gint dissect_counted_address(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_, proto_tree *tree)
 287 {
 288          guint16 length;
 289
 290          length = tvb_get_letohs(tvb, offset);
 291          proto_tree_add_item(tree, hf_tnef_value_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 292          offset += 2;
 293
 294          proto_tree_add_item(tree, hf_tnef_attribute_display_name, tvb, offset, length, ENC_ASCII|ENC_NA);
 295          offset += length;
 296
 297          length = tvb_get_letohs(tvb, offset);
 298          proto_tree_add_item(tree, hf_tnef_value_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 299          offset += 2;
 300
 301          proto_tree_add_item(tree, hf_tnef_attribute_email_address, tvb, offset, length, ENC_ASCII|ENC_NA);
 302          offset += length;
 303
 304          return offset;
 305 }
 306
 307
 308 static void dissect_DTR(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree)
 309 {
 310         gint offset;
 311
 312         offset = 0;
 313
 314         proto_tree_add_item(tree, hf_tnef_attribute_date_year, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 315         offset +=2;
 316
 317         proto_tree_add_item(tree, hf_tnef_attribute_date_month, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 318         offset +=2;
 319
 320         proto_tree_add_item(tree, hf_tnef_attribute_date_day, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 321         offset +=2;
 322
 323         proto_tree_add_item(tree, hf_tnef_attribute_date_hour, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 324         offset +=2;
 325
 326         proto_tree_add_item(tree, hf_tnef_attribute_date_minute, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 327         offset +=2;
 328
 329         proto_tree_add_item(tree, hf_tnef_attribute_date_second, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 330         offset +=2;
 331
 332         proto_tree_add_item(tree, hf_tnef_attribute_date_day_of_week, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 333         /*offset +=2;*/
 334 }
 335
 336
 337 static void dissect_mapiprops(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 338 {
 339         proto_item *item, *prop_item;
 340         proto_tree *prop_tree, *tag_tree;
 341         guint32     /*count,*/ tag, tag_kind, tag_length;
 342         guint16     padding;
 343         gint        offset, start_offset;
 344
 345         guint8      drep[] = {0x10 /* LE */, /* DCE_RPC_DREP_FP_IEEE */ 0 };
 346         static dcerpc_info di;
 347         static dcerpc_call_value call_data;
 348
 349         offset = 0;
 350
 351         di.conformant_run = 0;
 352         /* we need di->call_data->flags.NDR64 == 0 */
 353         di.call_data = &call_data;
 354
 355         /* first the count */
 356         proto_tree_add_item(tree, hf_tnef_mapi_props_count, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 357         /*count = tvb_get_letohl(tvb, offset);*/
 358
 359         offset += 4;
 360
 361         while(tvb_reported_length_remaining(tvb, offset) > 0 ) {
 362
 363                 start_offset = offset;
 364
 365                 /* get the property tag */
 366
 367                 prop_item = proto_tree_add_item(tree, hf_tnef_property, tvb, offset, -1, ENC_NA);
 368                 prop_tree = proto_item_add_subtree(prop_item, ett_tnef_property);
 369
 370                 item = proto_tree_add_item(prop_tree, hf_tnef_property_tag, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 371                 tag_tree = proto_item_add_subtree(item, ett_tnef_property_tag);
 372
 373                 /* add a nice name to the property */
 374                 tag = tvb_get_letohl(tvb, offset);
 375                 proto_item_append_text(prop_item, " %s", val_to_str(tag, nspi_MAPITAGS_vals, "Unknown tag (0x%08lx)"));
 376
 377                 proto_tree_add_item(tag_tree, hf_tnef_property_tag_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 378                 offset += 2;
 379
 380                 proto_tree_add_item(tag_tree, hf_tnef_property_tag_id, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 381                 offset += 2;
 382
 383                 if(tag & 0x80000000) {
 384
 385                         /* it is a named property */
 386                         proto_tree_add_item(tag_tree, hf_tnef_property_tag_set, tvb, offset, 16, ENC_LITTLE_ENDIAN);
 387                         offset += 16;
 388
 389                         tag_kind = tvb_get_letohl(tvb, offset);
 390                         proto_tree_add_item(tag_tree, hf_tnef_property_tag_kind, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 391                         offset += 4;
 392
 393                         if(tag_kind == 0) {
 394                                 proto_tree_add_item(tag_tree, hf_tnef_property_tag_name_id, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 395                                 offset += 4;
 396
 397                                 proto_item_append_text(prop_item, " [Named Property]");
 398                         } else {
 399                                 char *name_string = NULL;
 400
 401                                 tag_length = tvb_get_letohl(tvb, offset);
 402                                 proto_tree_add_item(tag_tree, hf_tnef_property_tag_name_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 403                                 offset += 4;
 404
 405                                 name_string = tvb_get_unicode_string (wmem_packet_scope(), tvb, offset, tag_length, ENC_LITTLE_ENDIAN);
 406                                 proto_tree_add_string_format_value(tag_tree, hf_tnef_property_tag_name_string, tvb, offset,
 407                                                              tag_length, name_string, "%s", name_string);
 408                                 offset += tag_length;
 409
 410                                 if((padding = (4 - tag_length % 4)) != 4) {
 411                                         proto_tree_add_item(tag_tree, hf_tnef_property_padding, tvb, offset, padding, ENC_NA);
 412                                         offset += padding;
 413                                 }
 414
 415                                 proto_item_append_text(prop_item, " [Named Property: %s]", name_string);
 416
 417                         }
 418                 }
 419
 420                 switch(tag) {
 421                         /* handle any specific tags here */
 422                 default:
 423                         /* otherwise just use the type */
 424                         switch(tag & 0x0000ffff) {
 425                         case PT_I2:
 426                                 offset = PIDL_dissect_uint16(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_i, 0);
 427                                 break;
 428                         case PT_LONG:
 429                                 offset = PIDL_dissect_uint32(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_l, 0);
 430                                 break;
 431                         case PT_BOOLEAN:
 432                                 offset = PIDL_dissect_uint16(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_b, 0);
 433                                 break;
 434                         case PT_STRING8:
 435                                 /* XXX - code page? */
 436                                 offset = dissect_counted_values(tvb, offset, hf_tnef_PropValue_lpszA, pinfo, prop_tree, TRUE, FALSE, ENC_ASCII|ENC_NA);
 437                                 break;
 438                         case PT_BINARY:
 439                                 offset = dissect_counted_values(tvb, offset, hf_tnef_PropValue_bin, pinfo, prop_tree, TRUE, FALSE, ENC_NA);
 440                                 break;
 441                         case PT_UNICODE:
 442                                 /* XXX - UCS-2 and UTF-16 need ENC_ values */
 443                                 offset = dissect_counted_values (tvb, offset, hf_tnef_PropValue_lpszW, pinfo, prop_tree, TRUE, TRUE, ENC_NA);
 444                                 break;
 445                         case PT_CLSID:
 446                                 offset = nspi_dissect_struct_MAPIUID(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_lpguid, 0);
 447                                 break;
 448                         case PT_SYSTIME:
 449                                 offset = nspi_dissect_struct_FILETIME(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_ft,0);
 450                                 break;
 451                         case PT_ERROR:
 452                                 offset = nspi_dissect_enum_MAPISTATUS(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_err, 0);
 453                                 break;
 454                          case PT_MV_I2:
 455                                  offset = nspi_dissect_struct_SShortArray(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVi,0);
 456                                  break;
 457                          case PT_MV_LONG:
 458                                  offset = nspi_dissect_struct_MV_LONG_STRUCT(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVl,0);
 459                                  break;
 460                          case PT_MV_STRING8:
 461                                  offset = nspi_dissect_struct_SLPSTRArray(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVszA,0);
 462                                  break;
 463                          case PT_MV_BINARY:
 464                                  offset = nspi_dissect_struct_SBinaryArray(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVbin,0);
 465                                  break;
 466                          case PT_MV_CLSID:
 467                                  offset = nspi_dissect_struct_SGuidArray(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVguid,0);
 468                                  break;
 469                          case PT_MV_UNICODE:
 470                                  offset = nspi_dissect_struct_MV_UNICODE_STRUCT(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVszW,0);
 471                                  break;
 472                          case PT_MV_SYSTIME:
 473                                  offset = nspi_dissect_struct_SDateTimeArray(tvb,offset,pinfo,prop_tree,&di,drep,hf_tnef_PropValue_MVft,0);
 474                                  break;
 475                          case PT_NULL:
 476                                  offset = PIDL_dissect_uint32(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_null, 0);
 477                                  break;
 478                          case PT_OBJECT:
 479                                  offset = PIDL_dissect_uint32(tvb, offset, pinfo, prop_tree, &di, drep, hf_tnef_PropValue_object, 0);
 480                                  break;
 481                         }
 482                 }
 483
 484                 /* we may need to pad to a 4-byte boundary */
 485                 if((padding = (4 - (offset - start_offset) % 4)) != 4) {
 486
 487                         /* we need to pad */
 488                         proto_tree_add_item(prop_tree, hf_tnef_property_padding, tvb, offset, padding, ENC_NA);
 489
 490                         offset += padding;
 491                 }
 492
 493                 proto_item_set_len(prop_item, offset - start_offset);
 494         }
 495 }
 496
 497
 498 static void dissect_tnef(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 499 {
 500   proto_item  *attr_item, *item;
 501   proto_tree  *attr_tree, *tag_tree, *props_tree, *addr_tree, *date_tree;
 502   guint32     tag, length, signature;
 503   gint        offset, start_offset;
 504   tvbuff_t    *next_tvb;
 505
 506   if(tree){
 507     item = proto_tree_add_item(tree, proto_tnef, tvb, 0, -1, ENC_NA);
 508     tree = proto_item_add_subtree(item, ett_tnef);
 509   }
 510
 511   offset = 0;
 512
 513   /* first the signature */
 514   signature = tvb_get_letohl(tvb, offset);
 515   item = proto_tree_add_item(tree, hf_tnef_signature, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 516   offset += 4;
 517
 518   /* check the signature */
 519   if(signature != TNEF_SIGNATURE) {
 520
 521     expert_add_info_format(pinfo, item, &ei_tnef_incorrect_signature,
 522                " [Incorrect, should be 0x%x. No further dissection possible. Check any Content-Transfer-Encoding has been removed.]", TNEF_SIGNATURE);
 523     return;
 524
 525   } else {
 526
 527     proto_item_append_text(item, " [Correct]");
 528
 529   }
 530
 531   proto_tree_add_item(tree, hf_tnef_key, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 532   offset += 2;
 533
 534   while(tvb_reported_length_remaining(tvb, offset) > 9 ) { /* there must be at least a level (1), tag (4) and length (4) to be valid */
 535
 536     start_offset = offset;
 537
 538     attr_item = proto_tree_add_item(tree, hf_tnef_attribute, tvb, offset, -1, ENC_NA);
 539     attr_tree = proto_item_add_subtree(attr_item, ett_tnef_attribute);
 540
 541     proto_tree_add_item(attr_tree, hf_tnef_attribute_lvl, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 542     offset += 1;
 543
 544     item = proto_tree_add_item(attr_tree, hf_tnef_attribute_tag, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 545     tag_tree = proto_item_add_subtree(item, ett_tnef_attribute_tag);
 546
 547     /* add a nice name to the property */
 548     tag = tvb_get_letohl(tvb, offset);
 549     proto_item_append_text(attr_item, " %s", val_to_str(tag, tnef_Attribute_vals, "Unknown tag (0x%08lx)"));
 550
 551     proto_tree_add_item(tag_tree, hf_tnef_attribute_tag_id, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 552     offset += 2;
 553
 554     proto_tree_add_item(tag_tree, hf_tnef_attribute_tag_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 555     /* remember the type for the value dissection */
 556     offset += 2;
 557
 558     length = tvb_get_letohl(tvb, offset);
 559     proto_tree_add_item(attr_tree, hf_tnef_attribute_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 560     offset += 4;
 561
 562     switch(tag) {
 563     case ATT_OEM_CODEPAGE:
 564             proto_tree_add_item(attr_tree, hf_tnef_oem_codepage, tvb, offset, length, ENC_LITTLE_ENDIAN);
 565             break;
 566     case ATT_TNEF_VERSION:
 567             proto_tree_add_item(attr_tree, hf_tnef_version, tvb, offset, length, ENC_LITTLE_ENDIAN);
 568             break;
 569     case ATT_MESSAGE_CLASS:
 570             proto_tree_add_item(attr_tree, hf_tnef_message_class, tvb, offset, length, ENC_ASCII|ENC_NA);
 571             break;
 572     case ATT_ORIGINAL_MESSAGE_CLASS:
 573             proto_tree_add_item(attr_tree, hf_tnef_original_message_class, tvb, offset, length, ENC_ASCII|ENC_NA);
 574             break;
 575     case ATT_MAPI_PROPS:
 576             item = proto_tree_add_item(attr_tree, hf_tnef_mapi_props, tvb, offset, length, ENC_NA);
 577             props_tree = proto_item_add_subtree(item, ett_tnef_mapi_props);
 578
 579             next_tvb = tvb_new_subset(tvb, offset, length, length);
 580
 581             dissect_mapiprops(next_tvb, pinfo, props_tree);
 582
 583             break;
 584     case ATT_OWNER:
 585     case ATT_SENT_FOR:
 586             addr_tree = proto_item_add_subtree(item, ett_tnef_attribute_address);
 587
 588             (void)dissect_counted_address(tvb, offset, pinfo, addr_tree);
 589
 590             break;
 591     case ATT_PRIORITY:
 592             proto_tree_add_item(attr_tree, hf_tnef_priority, tvb, offset, length, ENC_LITTLE_ENDIAN);
 593             break;
 594     default:
 595             /* just do it on the type */
 596             switch((tag >> 16) & 0xffff) {
 597             case ATP_DATE:
 598                     item = proto_tree_add_item(attr_tree, hf_tnef_attribute_date, tvb, offset, length, ENC_NA);
 599                     date_tree = proto_item_add_subtree(item, ett_tnef_attribute_date);
 600
 601                     next_tvb = tvb_new_subset(tvb, offset, length, length);
 602
 603                     dissect_DTR(next_tvb, pinfo, date_tree);
 604
 605                     break;
 606             case ATP_STRING:
 607                     proto_tree_add_item(attr_tree, hf_tnef_attribute_string, tvb, offset, length, ENC_ASCII|ENC_NA);
 608                     proto_item_append_text(attr_item, " %s", tvb_get_string(wmem_packet_scope(), tvb, offset, length));
 609                     break;
 610             default:
 611                     proto_tree_add_item(attr_tree, hf_tnef_attribute_value, tvb, offset, length, ENC_NA);
 612                     break;
 613             }
 614     }
 615
 616     offset += length;
 617
 618     proto_tree_add_item(attr_tree, hf_tnef_attribute_checksum, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 619     offset += 2;
 620
 621     proto_item_set_len(attr_item, offset - start_offset);
 622   }
 623
 624   /* there may be some padding */
 625   if(tvb_reported_length_remaining(tvb, offset)) /* XXX: Not sure if they is really padding or not */
 626     proto_tree_add_item(tree, hf_tnef_padding, tvb, offset, tvb_reported_length_remaining(tvb, offset), ENC_NA);
 627 }
 628
 629 static void dissect_tnef_file(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 630 {
 631   col_set_str(pinfo->cinfo, COL_PROTOCOL, PSNAME);
 632
 633   col_set_str(pinfo->cinfo, COL_DEF_SRC, PSNAME " encoded file");
 634
 635   col_append_str(pinfo->cinfo, COL_INFO, PNAME);
 636
 637   dissect_tnef(tvb, pinfo, tree);
 638 }
 639
 640 /* Register all the bits needed by the filtering engine */
 641
 642 void
 643 proto_register_tnef(void)
 644 {
 645   static hf_register_info hf[] = {
 646     { &hf_tnef_signature,
 647       { "Signature", "tnef.signature", FT_UINT32,  BASE_HEX, NULL, 0x0,
 648         NULL, HFILL }},
 649     { &hf_tnef_key,
 650       { "Key", "tnef.key", FT_UINT16,  BASE_HEX, NULL, 0x0,
 651         NULL, HFILL }},
 652     { &hf_tnef_attribute,
 653       { "Attribute", "tnef.attribute", FT_NONE,  BASE_NONE, NULL, 0x0,
 654         NULL, HFILL }},
 655     { &hf_tnef_attribute_lvl,
 656       { "Type", "tnef.attribute.lvl", FT_UINT8,  BASE_DEC, VALS(tnef_Lvl_vals), 0x0,
 657         NULL, HFILL }},
 658     { &hf_tnef_attribute_tag,
 659       { "Tag", "tnef.attribute.tag", FT_UINT32,  BASE_HEX, VALS(tnef_Attribute_vals), 0x0,
 660         NULL, HFILL }},
 661     { &hf_tnef_attribute_tag_type,
 662       { "Type", "tnef.attribute.tag.type", FT_UINT16,  BASE_HEX, VALS(tnef_Types_vals), 0x0,
 663         NULL, HFILL }},
 664     { &hf_tnef_attribute_tag_id,
 665       { "Tag", "tnef.attribute.tag.id", FT_UINT16,  BASE_HEX, NULL, 0x0,
 666         NULL, HFILL }},
 667     { &hf_tnef_attribute_length,
 668       { "Length", "tnef.attribute.length", FT_UINT32,  BASE_DEC, NULL, 0x0,
 669         NULL, HFILL }},
 670     { &hf_tnef_attribute_value,
 671       { "Value", "tnef.attribute.value", FT_NONE,  BASE_NONE, NULL, 0x0,
 672         NULL, HFILL }},
 673     { &hf_tnef_attribute_string,
 674       { "String", "tnef.attribute.string", FT_STRING,  BASE_NONE, NULL, 0x0,
 675         NULL, HFILL }},
 676     { &hf_tnef_attribute_date,
 677       { "Date", "tnef.attribute.date", FT_NONE,  BASE_NONE, NULL, 0x0,
 678         NULL, HFILL }},
 679     { &hf_tnef_attribute_display_name,
 680       { "Display Name", "tnef.attribute.display_name", FT_STRING,  BASE_NONE, NULL, 0x0,
 681         NULL, HFILL }},
 682     { &hf_tnef_attribute_email_address,
 683       { "Email Address", "tnef.attribute.email_address", FT_STRING,  BASE_NONE, NULL, 0x0,
 684         NULL, HFILL }},
 685     { &hf_tnef_attribute_date_year,
 686       { "Year", "tnef.attribute.date.year", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 687     { &hf_tnef_attribute_date_month,
 688       { "Month", "tnef.attribute.date.month", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 689     { &hf_tnef_attribute_date_day,
 690       { "Day", "tnef.attribute.date.day", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 691     { &hf_tnef_attribute_date_hour,
 692       { "Hour", "tnef.attribute.date.hour", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 693     { &hf_tnef_attribute_date_minute,
 694       { "Minute", "tnef.attribute.date.minute", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 695     { &hf_tnef_attribute_date_second,
 696       { "Second", "tnef.attribute.date.second", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 697     { &hf_tnef_attribute_date_day_of_week,
 698       { "Day Of Week", "tnef.attribute.date.day_of_week", FT_UINT16, BASE_DEC, VALS(weekday_vals), 0, NULL, HFILL }},
 699     { &hf_tnef_attribute_checksum,
 700       { "Checksum", "tnef.attribute.checksum", FT_UINT16,  BASE_HEX, NULL, 0x0,
 701         NULL, HFILL }},
 702     { &hf_tnef_mapi_props,
 703       { "MAPI Properties", "tnef.mapi_props", FT_NONE,  BASE_NONE, NULL, 0x0,
 704         NULL, HFILL }},
 705     { &hf_tnef_version,
 706       { "Version", "tnef.version", FT_UINT32,  BASE_HEX, NULL, 0x0,
 707         NULL, HFILL }},
 708     { &hf_tnef_oem_codepage,
 709       { "OEM Codepage", "tnef.oem_codepage", FT_UINT64,  BASE_HEX, NULL, 0x0,
 710         NULL, HFILL }},
 711     { &hf_tnef_message_class,
 712       { "Message Class", "tnef.message_class", FT_STRING,  BASE_NONE, NULL, 0x0,
 713         NULL, HFILL }},
 714     { &hf_tnef_original_message_class,
 715       { "Original Message Class", "tnef.message_class.original", FT_STRING,  BASE_NONE, NULL, 0x0,
 716         NULL, HFILL }},
 717     { &hf_tnef_priority,
 718       { "Priority", "tnef.priority", FT_UINT16,  BASE_DEC, VALS(tnef_Priority_vals), 0x0,
 719         NULL, HFILL }},
 720     { &hf_tnef_mapi_props_count,
 721       { "Count", "tnef.mapi_props.count", FT_UINT16,  BASE_DEC, NULL, 0x0,
 722         NULL, HFILL }},
 723     { &hf_tnef_property,
 724       { "Property", "tnef.property", FT_NONE,  BASE_NONE, NULL, 0x0,
 725         NULL, HFILL }},
 726     { &hf_tnef_property_tag,
 727       { "Tag", "tnef.property.tag", FT_UINT32,  BASE_HEX, VALS(nspi_MAPITAGS_vals), 0x0,
 728         NULL, HFILL }},
 729     { &hf_tnef_property_tag_type,
 730       { "Type", "tnef.property.tag.type", FT_UINT16,  BASE_HEX, VALS(nspi_property_types_vals), 0x0,
 731         NULL, HFILL }},
 732     { &hf_tnef_property_tag_id,
 733       { "Tag", "tnef.property.tag.id", FT_UINT16,  BASE_HEX, NULL, 0x0,
 734         NULL, HFILL }},
 735     { &hf_tnef_property_tag_set,
 736       { "Set", "tnef.attribute.tag.set", FT_GUID,  BASE_NONE, NULL, 0x0,
 737         NULL, HFILL }},
 738     { &hf_tnef_property_tag_kind,
 739       { "Kind", "tnef.attribute.tag.kind", FT_UINT32,  BASE_DEC, NULL, 0x0,
 740         NULL, HFILL }},
 741     { &hf_tnef_property_tag_name_id,
 742       { "Name", "tnef.attribute.tag.name.id", FT_UINT32,  BASE_HEX, NULL, 0x0,
 743         NULL, HFILL }},
 744     { &hf_tnef_property_tag_name_length,
 745       { "Length", "tnef.attribute.tag.name.length", FT_UINT32,  BASE_DEC, NULL, 0x0,
 746         NULL, HFILL }},
 747     { &hf_tnef_property_tag_name_string,
 748       { "Name", "tnef.attribute.tag.name.string", FT_STRING,  BASE_NONE, NULL, 0x0,
 749         NULL, HFILL }},
 750     { &hf_tnef_property_padding,
 751       { "Padding", "tnef.property.padding", FT_NONE,  BASE_NONE, NULL, 0x0,
 752         NULL, HFILL }},
 753     { &hf_tnef_padding,
 754       { "Padding", "tnef.padding", FT_NONE,  BASE_NONE, NULL, 0x0,
 755         NULL, HFILL }},
 756     { &hf_tnef_values_count,
 757       { "Count", "tnef.values.count", FT_UINT16,  BASE_DEC, NULL, 0x0,
 758         NULL, HFILL }},
 759     { &hf_tnef_value_length,
 760       { "Length", "tnef.value.length", FT_UINT16,  BASE_DEC, NULL, 0x0,
 761         NULL, HFILL }},
 762     { &hf_tnef_PropValue_i,
 763       { "I", "tnef.PropValue.i", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 764     { &hf_tnef_PropValue_l,
 765       { "L", "tnef.PropValue.l", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 766     { &hf_tnef_PropValue_b,
 767       { "B", "tnef.PropValue.b", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 768     { &hf_tnef_PropValue_lpszA,
 769       { "Lpsza", "tnef.PropValue.lpszA", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 770     { &hf_tnef_PropValue_lpszW,
 771       { "Lpszw", "tnef.PropValue.lpszW", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 772     { &hf_tnef_PropValue_lpguid,
 773       { "Lpguid", "tnef.PropValue.lpguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 774     { &hf_tnef_PropValue_bin,
 775       { "Bin", "tnef.PropValue.bin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 776     { &hf_tnef_PropValue_ft,
 777       { "Ft", "tnef.PropValue.ft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 778     { &hf_tnef_PropValue_err,
 779       { "Err", "tnef.PropValue.err", FT_UINT32, BASE_DEC, VALS(nspi_MAPISTATUS_vals), 0, NULL, HFILL }},
 780     { &hf_tnef_PropValue_MVi,
 781       { "Mvi", "tnef.PropValue.MVi", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 782     { &hf_tnef_PropValue_MVl,
 783       { "Mvl", "tnef.PropValue.MVl", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 784     { &hf_tnef_PropValue_MVszA,
 785       { "Mvsza", "tnef.PropValue.MVszA", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 786     { &hf_tnef_PropValue_MVbin,
 787       { "Mvbin", "tnef.PropValue.MVbin", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 788     { &hf_tnef_PropValue_MVguid,
 789       { "Mvguid", "tnef.PropValue.MVguid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 790     { &hf_tnef_PropValue_MVszW,
 791       { "Mvszw", "tnef.PropValue.MVszW", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 792     { &hf_tnef_PropValue_MVft,
 793       { "Mvft", "tnef.PropValue.MVft", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 794     { &hf_tnef_PropValue_null,
 795       { "Null", "tnef.PropValue.null", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 796     { &hf_tnef_PropValue_object,
 797       { "Object", "tnef.PropValue.object", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 798   };
 799   static gint *ett[] = {
 800     &ett_tnef,
 801     &ett_tnef_attribute,
 802     &ett_tnef_attribute_tag,
 803     &ett_tnef_mapi_props,
 804     &ett_tnef_property,
 805     &ett_tnef_property_tag,
 806     &ett_tnef_counted_items,
 807     &ett_tnef_attribute_date,
 808     &ett_tnef_attribute_address,
 809   };
 810
 811   static ei_register_info ei[] = {
 812      { &ei_tnef_expect_single_item, { "tnef.expect_single_item", PI_MALFORMED, PI_ERROR, "Expected single item", EXPFILL }},
 813      { &ei_tnef_incorrect_signature, { "tnef.signature.incorrect", PI_MALFORMED, PI_WARN, "Incorrect signature", EXPFILL }},
 814   };
 815
 816   expert_module_t* expert_tnef;
 817
 818   proto_tnef = proto_register_protocol(PNAME, PSNAME, PFNAME);
 819
 820   proto_register_field_array(proto_tnef, hf, array_length(hf));
 821   proto_register_subtree_array(ett, array_length(ett));
 822   expert_tnef = expert_register_protocol(proto_tnef);
 823   expert_register_field_array(expert_tnef, ei, array_length(ei));
 824
 825   /* Allow dissector to find be found by name. */
 826   tnef_handle = register_dissector(PFNAME, dissect_tnef, proto_tnef);
 827
 828 }
 829
 830 /* The registration hand-off routine */
 831 void
 832 proto_reg_handoff_tnef(void)
 833 {
 834   dissector_handle_t tnef_file_handle;
 835
 836   tnef_file_handle = create_dissector_handle(dissect_tnef_file, proto_tnef);
 837
 838   dissector_add_string("media_type", "application/ms-tnef", tnef_handle);
 839
 840   /* X.400 file transfer bodypart */
 841   register_ber_oid_dissector_handle("1.2.840.113556.3.10.1", tnef_handle, proto_tnef, "id-et-tnef");
 842
 843   dissector_add_uint("wtap_encap", WTAP_ENCAP_TNEF, tnef_file_handle);
 844 }