epan/dissectors/packet-xot.c

   1 /* packet-xot.c
   2  * Routines for X.25 over TCP dissection (RFC 1613)
   3  *
   4  * Copyright 2000, Paul Ionescu <paul@acorp.ro>
   5  *
   6  * $Id$
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  25  */
  26
  27 #include "config.h"
  28
  29 #include <glib.h>
  30
  31 #include <epan/packet.h>
  32 #include "packet-tcp.h"
  33 #include <epan/prefs.h>
  34
  35 #define TCP_PORT_XOT 1998
  36 #define XOT_HEADER_LENGTH 4
  37 #define XOT_VERSION 0
  38 #define XOT_PVC_SETUP 0xF5
  39
  40 /* Some X25 macros from packet-x25.c - some adapted code as well below */
  41 #define X25_MIN_HEADER_LENGTH 3
  42 #define X25_MIN_M128_HEADER_LENGTH 4
  43 #define X25_NONDATA_BIT                 0x01
  44 #define PACKET_IS_DATA(type)            (!(type & X25_NONDATA_BIT))
  45 #define X25_MBIT_MOD8                   0x10
  46 #define X25_MBIT_MOD128                 0x01
  47
  48 static const value_string vals_x25_type[] = {
  49    { XOT_PVC_SETUP, "PVC Setup" },
  50    { 0,   NULL}
  51 };
  52
  53 static const value_string xot_pvc_status_vals[] = {
  54    { 0x00, "Waiting to connect" },
  55
  56    { 0x08, "Destination disconnected" },
  57    { 0x09, "PVC/TCP connection refused" },
  58    { 0x0A, "PVC/TCP routing error" },
  59    { 0x0B, "PVC/TCP connect timed out" },
  60
  61    { 0x10, "Trying to connect via TCP" },
  62    { 0x11, "Awaiting PVC-SETUP reply" },
  63    { 0x12, "Connected" },
  64    { 0x13, "No such destination interface" },
  65    { 0x14, "Destination interface is not up" },
  66    { 0x15, "Non-X.25 destination interface" },
  67    { 0x16, "No such destination PVC" },
  68    { 0x17, "Destination PVC configuration mismatch" },
  69    { 0x18, "Mismatched flow control values" },
  70    { 0x19, "Can't support flow control values" },
  71    { 0x1A, "PVC setup protocol error" },
  72
  73    { 0,   NULL}
  74 };
  75
  76 static gint proto_xot = -1;
  77 static gint ett_xot = -1;
  78 static gint hf_xot_version = -1;
  79 static gint hf_xot_length = -1;
  80
  81 static gint hf_x25_gfi = -1;
  82 static gint hf_x25_lcn = -1;
  83 static gint hf_x25_type = -1;
  84
  85 static gint hf_xot_pvc_version = -1;
  86 static gint hf_xot_pvc_status = -1;
  87 static gint hf_xot_pvc_init_itf_name_len = -1;
  88 static gint hf_xot_pvc_init_lcn = -1;
  89 static gint hf_xot_pvc_resp_itf_name_len = -1;
  90 static gint hf_xot_pvc_resp_lcn = -1;
  91 static gint hf_xot_pvc_send_inc_window = -1;
  92 static gint hf_xot_pvc_send_out_window = -1;
  93 static gint hf_xot_pvc_send_inc_pkt_size = -1;
  94 static gint hf_xot_pvc_send_out_pkt_size = -1;
  95 static gint hf_xot_pvc_init_itf_name = -1;
  96 static gint hf_xot_pvc_resp_itf_name = -1;
  97
  98 static dissector_handle_t xot_handle;
  99
 100 static dissector_handle_t x25_handle;
 101
 102 /* desegmentation of X.25 over multiple TCP */
 103 static gboolean xot_desegment = TRUE;
 104 /* desegmentation of X.25 packet sequences */
 105 static gboolean x25_desegment = FALSE;
 106
 107 static guint get_xot_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
 108 {
 109    guint16 plen;
 110    int remain = tvb_length_remaining(tvb, offset);
 111    if ( remain < XOT_HEADER_LENGTH){
 112       /* We did not get the data we asked for, use up what we can */
 113       return remain;
 114    }
 115
 116    /*
 117     * Get the length of the X.25-over-TCP packet.
 118     */
 119    plen = tvb_get_ntohs(tvb, offset + 2);
 120    return XOT_HEADER_LENGTH + plen;
 121 }
 122
 123 static guint get_xot_pdu_len_mult(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
 124 {
 125    int offset_before = offset; /* offset where we start this test */
 126    int offset_next = offset + XOT_HEADER_LENGTH + X25_MIN_HEADER_LENGTH;
 127    int tvb_len;
 128
 129    while (tvb_len = tvb_length_remaining(tvb, offset), tvb_len>0){
 130       guint16 plen = 0;
 131       int modulo;
 132       guint16 bytes0_1;
 133       guint8 pkt_type;
 134       gboolean m_bit_set;
 135       int offset_x25 = offset + XOT_HEADER_LENGTH;
 136
 137       /* Minimum where next starts */
 138       offset_next = offset_x25 + X25_MIN_HEADER_LENGTH;
 139
 140       if (tvb_len < XOT_HEADER_LENGTH) {
 141          return offset_next-offset_before;
 142       }
 143
 144       /*
 145        * Get the length of the current X.25-over-TCP packet.
 146        */
 147       plen = get_xot_pdu_len(pinfo, tvb, offset);
 148       offset_next = offset + plen;
 149
 150       /* Make sure we have enough data */
 151       if (tvb_len < plen){
 152          return offset_next-offset_before;
 153       }
 154
 155       /*Some minor code copied from packet-x25.c */
 156       bytes0_1 = tvb_get_ntohs(tvb,  offset_x25+0);
 157       pkt_type = tvb_get_guint8(tvb, offset_x25+2);
 158
 159       /* If this is the first packet and it is not data, no sequence needed */
 160       if (offset == offset_before && !PACKET_IS_DATA(pkt_type)) {
 161           return offset_next-offset_before;
 162       }
 163
 164       /* Check for data, there can be X25 control packets in the X25 data */
 165       if (PACKET_IS_DATA(pkt_type)){
 166          modulo = ((bytes0_1 & 0x2000) ? 128 : 8);
 167          if (modulo == 8) {
 168             m_bit_set = pkt_type & X25_MBIT_MOD8;
 169          } else {
 170             m_bit_set = tvb_get_guint8(tvb, offset_x25+3) & X25_MBIT_MOD128;
 171          }
 172
 173          if (!m_bit_set){
 174             /* We are done with this sequence when the mbit is no longer set */
 175             return offset_next-offset_before;
 176          }
 177       }
 178       offset = offset_next;
 179       offset_next += XOT_HEADER_LENGTH + X25_MIN_HEADER_LENGTH;
 180   }
 181
 182   /* not enough data */
 183   pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 184   return offset_next - offset_before;
 185 }
 186
 187 static int dissect_xot_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 188 {
 189   int offset = 0;
 190   guint16 version;
 191   guint16 plen;
 192   guint8 pkt_type;
 193   proto_item *ti = NULL;
 194   proto_tree *xot_tree = NULL;
 195   tvbuff_t   *next_tvb;
 196
 197   /*
 198    * Dissect the X.25-over-TCP packet.
 199    */
 200      col_set_str(pinfo->cinfo, COL_PROTOCOL, "XOT");
 201      version = tvb_get_ntohs(tvb, offset + 0);
 202      plen = tvb_get_ntohs(tvb, offset + 2);
 203      col_add_fstr(pinfo->cinfo, COL_INFO, "XOT Version = %u, size = %u",
 204                     version, plen);
 205      if (offset == 0 &&
 206          tvb_length_remaining(tvb, offset) > XOT_HEADER_LENGTH + plen )
 207         col_append_fstr(pinfo->cinfo, COL_INFO, " TotX25: %d",
 208                         tvb_length_remaining(tvb, offset));
 209
 210      if (tree) {
 211         ti = proto_tree_add_protocol_format(tree, proto_xot, tvb, offset, XOT_HEADER_LENGTH,
 212                                             "X.25 over TCP");
 213         xot_tree = proto_item_add_subtree(ti, ett_xot);
 214
 215         proto_tree_add_uint(xot_tree, hf_xot_version, tvb, offset, 2, version);
 216         proto_tree_add_uint(xot_tree, hf_xot_length, tvb, offset + 2, 2, plen);
 217      }
 218
 219      offset += XOT_HEADER_LENGTH;
 220      /*
 221       * Construct a tvbuff containing the amount of the payload we have
 222       * available.  Make its reported length the amount of data in the
 223       * X.25-over-TCP packet.
 224       */
 225      if (plen >= X25_MIN_HEADER_LENGTH) {
 226         pkt_type = tvb_get_guint8(tvb, offset + 2);
 227         if (pkt_type == XOT_PVC_SETUP) {
 228            guint init_itf_name_len, resp_itf_name_len, pkt_size;
 229            gint hdr_offset = offset;
 230
 231            col_set_str(pinfo->cinfo, COL_INFO, "XOT PVC Setup");
 232            proto_item_set_len(ti, XOT_HEADER_LENGTH + plen);
 233
 234            /* These fields are in overlay with packet-x25.c */
 235            proto_tree_add_item(xot_tree, hf_x25_gfi, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 236            proto_tree_add_item(xot_tree, hf_x25_lcn, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 237            hdr_offset += 2;
 238            proto_tree_add_item(xot_tree, hf_x25_type, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 239            hdr_offset += 1;
 240
 241            proto_tree_add_item(xot_tree, hf_xot_pvc_version, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 242            hdr_offset += 1;
 243            proto_tree_add_item(xot_tree, hf_xot_pvc_status, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 244            hdr_offset += 1;
 245            proto_tree_add_item(xot_tree, hf_xot_pvc_init_itf_name_len, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 246            init_itf_name_len = tvb_get_guint8(tvb, hdr_offset);
 247            hdr_offset += 1;
 248            proto_tree_add_item(xot_tree, hf_xot_pvc_init_lcn, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 249            hdr_offset += 2;
 250            proto_tree_add_item(xot_tree, hf_xot_pvc_resp_itf_name_len, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 251            resp_itf_name_len = tvb_get_guint8(tvb, hdr_offset);
 252            hdr_offset += 1;
 253            proto_tree_add_item(xot_tree, hf_xot_pvc_resp_lcn, tvb, hdr_offset, 2, ENC_BIG_ENDIAN);
 254            hdr_offset += 2;
 255            proto_tree_add_item(xot_tree, hf_xot_pvc_send_inc_window, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 256            hdr_offset += 1;
 257            proto_tree_add_item(xot_tree, hf_xot_pvc_send_out_window, tvb, hdr_offset, 1, ENC_BIG_ENDIAN);
 258            hdr_offset += 1;
 259            pkt_size = 1 << tvb_get_guint8(tvb, hdr_offset);
 260            proto_tree_add_uint(xot_tree, hf_xot_pvc_send_inc_pkt_size, tvb, hdr_offset, 1, pkt_size);
 261            hdr_offset += 1;
 262            pkt_size = 1 << tvb_get_guint8(tvb, hdr_offset);
 263            proto_tree_add_uint(xot_tree, hf_xot_pvc_send_out_pkt_size, tvb, hdr_offset, 1, pkt_size);
 264            hdr_offset += 1;
 265            proto_tree_add_item(xot_tree, hf_xot_pvc_init_itf_name, tvb, hdr_offset, init_itf_name_len, ENC_ASCII|ENC_NA);
 266            hdr_offset += init_itf_name_len;
 267            proto_tree_add_item(xot_tree, hf_xot_pvc_resp_itf_name, tvb, hdr_offset, resp_itf_name_len, ENC_ASCII|ENC_NA);
 268         } else {
 269            next_tvb = tvb_new_subset(tvb, offset,
 270                                   MIN(plen, tvb_length_remaining(tvb, offset)), plen);
 271            call_dissector(x25_handle, next_tvb, pinfo, tree);
 272         }
 273      }
 274
 275      return tvb_length(tvb);
 276 }
 277
 278 static int dissect_xot_mult(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 279 {
 280    int offset = 0;
 281    int len = get_xot_pdu_len_mult(pinfo, tvb, offset);
 282    tvbuff_t   *next_tvb;
 283    int offset_max = offset+MIN(len,tvb_length_remaining(tvb, offset));
 284    proto_item *ti;
 285    proto_tree *xot_tree;
 286
 287    if (tree) {
 288       /* Special header to show segments */
 289       ti = proto_tree_add_protocol_format(tree, proto_xot, tvb, offset, offset_max-offset,
 290                                           "X.25 over TCP - X.25 Sequence");
 291       xot_tree = proto_item_add_subtree(ti, ett_xot);
 292       proto_tree_add_uint(xot_tree, hf_xot_length, tvb, offset, offset_max, len);
 293    }
 294
 295    while (offset <= offset_max - XOT_HEADER_LENGTH){
 296       int plen = get_xot_pdu_len(pinfo, tvb, offset);
 297       next_tvb = tvb_new_subset(tvb, offset,plen, plen);
 298                                 /*MIN(plen,tvb_length_remaining(tvb, offset)),plen*/
 299
 300       dissect_xot_pdu(next_tvb, pinfo, tree, data);
 301       offset += plen;
 302    }
 303    return tvb_length(tvb);
 304 }
 305 static int dissect_xot_tcp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
 306 {
 307    int tvb_len = tvb_length(tvb);
 308    int len = 0;
 309
 310    if (tvb_len >= 2 && tvb_get_ntohs(tvb,0) != XOT_VERSION) {
 311       return 0;
 312    }
 313
 314    if (!x25_desegment || !xot_desegment){
 315       tcp_dissect_pdus(tvb, pinfo, tree, xot_desegment,
 316                        XOT_HEADER_LENGTH,
 317                        get_xot_pdu_len,
 318                        dissect_xot_pdu, data);
 319       len=get_xot_pdu_len(pinfo, tvb, 0);
 320    } else {
 321       /* Use length version that "peeks" into X25, possibly several XOT packets */
 322       tcp_dissect_pdus(tvb, pinfo, tree, xot_desegment,
 323                        XOT_HEADER_LENGTH,
 324                        get_xot_pdu_len_mult,
 325                        dissect_xot_mult, data);
 326       len=get_xot_pdu_len_mult(pinfo, tvb, 0);
 327    }
 328    /*As tcp_dissect_pdus will not report the success/failure, we have to compute
 329      again */
 330    if (len < XOT_HEADER_LENGTH) {
 331       /* TCP has reported bounds error */
 332       len = 0;
 333    } else if (tvb_len < XOT_HEADER_LENGTH) {
 334       pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 335       len=tvb_len - XOT_HEADER_LENGTH; /* bytes missing */
 336    } else if (tvb_len < len) {
 337       if (x25_desegment){
 338          /* As the "fixed_len" is not fixed here, just request new segments */
 339          pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 340       } else {
 341          pinfo->desegment_len = len - tvb_len;
 342       }
 343       len=tvb_len - len; /* bytes missing */
 344    }
 345    return len;
 346 }
 347
 348 /* Register the protocol with Wireshark */
 349 void
 350 proto_register_xot(void)
 351 {
 352         static hf_register_info hf[] = {
 353                 { &hf_xot_version,
 354                         { "Version", "xot.version", FT_UINT16, BASE_DEC,
 355                         NULL, 0, "Version of X.25 over TCP protocol", HFILL }},
 356
 357                 { &hf_xot_length,
 358                         { "Length", "xot.length", FT_UINT16, BASE_DEC,
 359                         NULL, 0, "Length of X.25 over TCP packet", HFILL }},
 360                 /* These fields are in overlay with packet-x25.c */
 361                 { &hf_x25_gfi,
 362                         { "GFI", "x25.gfi", FT_UINT16, BASE_DEC,
 363                         NULL, 0xF000, "General Format Identifier", HFILL }},
 364
 365                 { &hf_x25_lcn,
 366                         { "Logical Channel", "x25.lcn", FT_UINT16, BASE_DEC,
 367                         NULL, 0x0FFF, "Logical Channel Number", HFILL }},
 368
 369                 { &hf_x25_type,
 370                         { "Packet Type", "x25.type", FT_UINT8, BASE_HEX,
 371                         VALS(vals_x25_type), 0x0, NULL, HFILL }},
 372
 373                 { &hf_xot_pvc_version,
 374                         { "Version", "xot.pvc.version", FT_UINT8, BASE_HEX,
 375                         NULL, 0, NULL, HFILL }},
 376
 377                 { &hf_xot_pvc_status,
 378                         { "Status", "xot.pvc.status", FT_UINT8, BASE_HEX,
 379                         VALS(xot_pvc_status_vals), 0, NULL, HFILL }},
 380
 381                 { &hf_xot_pvc_init_itf_name_len,
 382                         { "Initiator interface name length", "xot.pvc.init_itf_name_len", FT_UINT8, BASE_DEC,
 383                         NULL, 0, NULL, HFILL }},
 384
 385                 { &hf_xot_pvc_init_lcn,
 386                         { "Initiator LCN", "xot.pvc.init_lcn", FT_UINT8, BASE_DEC,
 387                         NULL, 0, "Initiator Logical Channel Number", HFILL }},
 388
 389                 { &hf_xot_pvc_resp_itf_name_len,
 390                         { "Responder interface name length", "xot.pvc.resp_itf_name_len", FT_UINT8, BASE_DEC,
 391                         NULL, 0, NULL, HFILL }},
 392
 393                 { &hf_xot_pvc_resp_lcn,
 394                         { "Responder LCN", "xot.pvc.resp_lcn", FT_UINT16, BASE_DEC,
 395                         NULL, 0, "Responder Logical Channel Number", HFILL }},
 396
 397                 { &hf_xot_pvc_send_inc_window,
 398                         { "Sender incoming window", "xot.pvc.send_inc_window", FT_UINT8, BASE_DEC,
 399                         NULL, 0, NULL, HFILL }},
 400
 401                 { &hf_xot_pvc_send_out_window,
 402                         { "Sender outgoing window", "xot.pvc.send_out_window", FT_UINT8, BASE_DEC,
 403                         NULL, 0, NULL, HFILL }},
 404
 405                 { &hf_xot_pvc_send_inc_pkt_size,
 406                         { "Sender incoming packet size", "xot.pvc.send_inc_pkt_size", FT_UINT8, BASE_DEC,
 407                         NULL, 0, NULL, HFILL }},
 408
 409                 { &hf_xot_pvc_send_out_pkt_size,
 410                         { "Sender outgoing packet size", "xot.pvc.send_out_pkt_size", FT_UINT8, BASE_DEC,
 411                         NULL, 0, NULL, HFILL }},
 412
 413                 { &hf_xot_pvc_init_itf_name,
 414                         { "Initiator interface name", "xot.pvc.init_itf_name", FT_STRING, BASE_NONE,
 415                         NULL, 0, NULL, HFILL }},
 416
 417                 { &hf_xot_pvc_resp_itf_name,
 418                         { "Responder interface name", "xot.pvc.resp_itf_name", FT_STRING, BASE_NONE,
 419                         NULL, 0, NULL, HFILL }}
 420         };
 421
 422         static gint *ett[] = {
 423                 &ett_xot
 424         };
 425         module_t *xot_module;
 426
 427         proto_xot = proto_register_protocol("X.25 over TCP", "XOT", "xot");
 428         proto_register_field_array(proto_xot, hf, array_length(hf));
 429         proto_register_subtree_array(ett, array_length(ett));
 430         xot_handle = new_register_dissector("xot", dissect_xot_tcp_heur, proto_xot);
 431         xot_module = prefs_register_protocol(proto_xot, NULL);
 432
 433         prefs_register_bool_preference(xot_module, "desegment",
 434             "Reassemble X.25-over-TCP messages spanning multiple TCP segments",
 435             "Whether the X.25-over-TCP dissector should reassemble messages spanning multiple TCP segments. "
 436             "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings",
 437             &xot_desegment);
 438         prefs_register_bool_preference(xot_module, "x25_desegment",
 439             "Reassemble X.25 packets with More flag to enable safe X.25 reassembly",
 440             "Whether the X.25-over-TCP dissector should reassemble all X.25 packets before calling the X25 dissector. "
 441             "If the TCP packets arrive out-of-order, the X.25 reassembly can otherwise fail. "
 442             "To use this option, you should also enable \"Reassemble X.25-over-TCP messages spanning multiple TCP segments\", \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings and \"Reassemble fragmented X.25 packets\" in the X.25 protocol settings.",
 443             &x25_desegment);
 444
 445 }
 446
 447 void
 448 proto_reg_handoff_xot(void)
 449 {
 450   dissector_add_uint("tcp.port", TCP_PORT_XOT, xot_handle);
 451
 452   x25_handle = find_dissector("x.25");
 453 }