epan/dissectors/packet-epmd.c

   1 /* packet-epmd.c
   2  * dissector for EPMD (Erlang Port Mapper Daemon) messages;
   3  * this are the messages sent between Erlang nodes and
   4  * the empd process.
   5  * The message formats are derived from the
   6  * lib/kernel/src/erl_epmd.* files as part of the Erlang
   7  * distribution available from http://www.erlang.org/
   8  *
   9  * (c) 2007 Joost Yervante Damad <joost[AT]teluna.org>
  10  *
  11  * $Id$
  12  *
  13  * Wireshark - Network traffic analyzer
  14  * By Gerald Combs <gerald[AT]wireshark.org>
  15  * Copyright 1998 Gerald Combs
  16  *
  17  * Copied from packet-time.c
  18  *
  19  * This program is free software; you can redistribute it and/or
  20  * modify it under the terms of the GNU General Public License
  21  * as published by the Free Software Foundation; either version 2
  22  * of the License, or (at your option) any later version.
  23  *
  24  * This program is distributed in the hope that it will be useful,
  25  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  * GNU General Public License for more details.
  28  *
  29  * You should have received a copy of the GNU General Public License
  30  * along with this program; if not, write to the Free Software
  31  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  32  */
  33
  34 #include "config.h"
  35
  36 #include <epan/packet.h>
  37 #include <epan/conversation.h>
  38
  39 #define PNAME  "Erlang Port Mapper Daemon"
  40 #define PSNAME "EPMD"
  41 #define PFNAME "epmd"
  42
  43 void proto_register_epmd(void);
  44 void proto_reg_handoff_epmd(void);
  45
  46 static int proto_epmd = -1;
  47 static int hf_epmd_len = -1;
  48 static int hf_epmd_type = -1;
  49 static int hf_epmd_port_no = -1;
  50 static int hf_epmd_node_type = -1;
  51 static int hf_epmd_protocol = -1;
  52 static int hf_epmd_dist_high = -1;
  53 static int hf_epmd_dist_low = -1;
  54 static int hf_epmd_name_len = -1;
  55 static int hf_epmd_name = -1;
  56 static int hf_epmd_elen = -1;
  57 static int hf_epmd_edata = -1;
  58 static int hf_epmd_names = -1;
  59 static int hf_epmd_result = -1;
  60 static int hf_epmd_creation = -1;
  61
  62 static gint ett_epmd = -1;
  63
  64 /* Other dissectors */
  65 static dissector_handle_t edp_handle = NULL;
  66
  67 #define EPMD_PORT 4369
  68
  69 /* Definitions of message codes */
  70 #define EPMD_ALIVE_REQ     'a'
  71 #define EPMD_ALIVE_OK_RESP 'Y'
  72 #define EPMD_PORT_REQ      'p'
  73 #define EPMD_NAMES_REQ     'n'
  74 #define EPMD_DUMP_REQ      'd'
  75 #define EPMD_KILL_REQ      'k'
  76 #define EPMD_STOP_REQ      's'
  77 /* New epmd messages */
  78 #define EPMD_ALIVE2_REQ    'x' /* 120 */
  79 #define EPMD_PORT2_REQ     'z' /* 122 */
  80 #define EPMD_ALIVE2_RESP   'y' /* 121 */
  81 #define EPMD_PORT2_RESP    'w' /* 119 */
  82
  83 static const value_string message_types[] = {
  84     { EPMD_ALIVE_REQ    , "EPMD_ALIVE_REQ"     },
  85     { EPMD_ALIVE_OK_RESP, "EPMD_ALIVE_OK_RESP" },
  86     { EPMD_PORT_REQ     , "EPMD_PORT_REQ"      },
  87     { EPMD_NAMES_REQ    , "EPMD_NAMES_REQ"     },
  88     { EPMD_DUMP_REQ     , "EPMD_DUMP_REQ"      },
  89     { EPMD_KILL_REQ     , "EPMD_KILL_REQ"      },
  90     { EPMD_STOP_REQ     , "EPMD_STOP_REQ"      },
  91     { EPMD_ALIVE2_REQ   , "EPMD_ALIVE2_REQ"    },
  92     { EPMD_PORT2_REQ    , "EPMD_PORT2_REQ"     },
  93     { EPMD_ALIVE2_RESP  , "EPMD_ALIVE2_RESP"   },
  94     { EPMD_PORT2_RESP   , "EPMD_PORT2_RESP"    },
  95     {  0, NULL }
  96 };
  97
  98 static const value_string node_type_vals[] = {
  99     {  72 , "R3 hidden node" },
 100     {  77 , "R3 erlang node" },
 101     { 104 , "R4 hidden node" },
 102     { 109 , "R4 erlang node" },
 103     { 110 , "R6 nodes" },
 104     {  0, NULL }
 105 };
 106
 107 static const value_string protocol_vals[] = {
 108     {  0 , "tcp/ip-v4" },
 109     {  0, NULL }
 110 };
 111
 112 const value_string epmd_version_vals[] = {
 113     {  0 , "R3"     },
 114     {  1 , "R4"     },
 115     {  2 , "R5"     },
 116     {  3 , "R5C"    },
 117     {  4 , "R6 dev" },
 118     {  5 , "R6"     },
 119     {  0, NULL }
 120 };
 121
 122 static void
 123 dissect_epmd_request(packet_info *pinfo, tvbuff_t *tvb, gint offset, proto_tree *tree) {
 124     guint8       type;
 125     guint16      name_length = 0;
 126     const gchar *name        = NULL;
 127
 128     proto_tree_add_item(tree, hf_epmd_len, tvb, offset, 2, ENC_BIG_ENDIAN);
 129     offset += 2;
 130     type = tvb_get_guint8(tvb, offset);
 131     proto_tree_add_item(tree, hf_epmd_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 132     offset++;
 133     col_add_str(pinfo->cinfo, COL_INFO, val_to_str(type, VALS(message_types), "unknown (0x%02X)"));
 134
 135     switch (type) {
 136         case EPMD_ALIVE2_REQ:
 137             proto_tree_add_item(tree, hf_epmd_port_no, tvb, offset, 2, ENC_BIG_ENDIAN);
 138             offset += 2;
 139             proto_tree_add_item(tree, hf_epmd_node_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 140             offset++;
 141             proto_tree_add_item(tree, hf_epmd_protocol, tvb, offset, 1, ENC_BIG_ENDIAN);
 142             offset++;
 143             proto_tree_add_item(tree, hf_epmd_dist_high, tvb, offset, 2, ENC_BIG_ENDIAN);
 144             offset += 2;
 145             proto_tree_add_item(tree, hf_epmd_dist_low, tvb, offset, 2, ENC_BIG_ENDIAN);
 146             offset += 2;
 147             name_length = tvb_get_ntohs(tvb, offset);
 148             proto_tree_add_item(tree, hf_epmd_name_len, tvb, offset, 2, ENC_BIG_ENDIAN);
 149             proto_tree_add_item(tree, hf_epmd_name, tvb, offset + 2, name_length, ENC_ASCII|ENC_NA);
 150             name = tvb_get_string(wmem_packet_scope(), tvb, offset + 2, name_length);
 151             offset += 2 + name_length;
 152             if (tvb_length_remaining(tvb, offset) >= 2) {
 153                 guint16 elen=0;
 154                 elen = tvb_get_ntohs(tvb, offset);
 155                 proto_tree_add_item(tree, hf_epmd_elen, tvb, offset, 2, ENC_BIG_ENDIAN);
 156                 if (elen > 0)
 157                     proto_tree_add_item(tree, hf_epmd_edata, tvb, offset + 2, elen, ENC_NA);
 158                 /*offset += 2 + elen;*/
 159             }
 160             break;
 161
 162         case EPMD_PORT_REQ:
 163         case EPMD_PORT2_REQ:
 164             name_length = tvb_length_remaining(tvb, offset);
 165             proto_tree_add_item(tree, hf_epmd_name, tvb, offset, name_length, ENC_ASCII|ENC_NA);
 166             name = tvb_get_string(wmem_packet_scope(), tvb, offset, name_length);
 167             break;
 168
 169         case EPMD_ALIVE_REQ:
 170             proto_tree_add_item(tree, hf_epmd_port_no, tvb, offset, 2, ENC_BIG_ENDIAN);
 171             offset += 2;
 172             name_length = tvb_length_remaining(tvb, offset);
 173             proto_tree_add_item(tree, hf_epmd_name, tvb, offset, name_length, ENC_ASCII|ENC_NA);
 174             name = tvb_get_string(wmem_packet_scope(), tvb, offset, name_length);
 175             break;
 176
 177         case EPMD_NAMES_REQ:
 178             break;
 179
 180     }
 181
 182     if (name) {
 183         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", name);
 184     }
 185
 186 }
 187
 188 static void
 189 dissect_epmd_response_names(packet_info *pinfo _U_, tvbuff_t *tvb, gint offset, proto_tree *tree) {
 190     proto_tree_add_item(tree, hf_epmd_port_no, tvb, offset, 2, ENC_BIG_ENDIAN);
 191     offset += 2;
 192     proto_tree_add_item(tree, hf_epmd_names, tvb, offset, -1, ENC_NA);
 193 }
 194
 195 static int
 196 dissect_epmd_response(packet_info *pinfo, tvbuff_t *tvb, gint offset, proto_tree *tree) {
 197     guint8          type, result;
 198     guint32         port;
 199     guint16         name_length = 0;
 200     const gchar    *name        = NULL;
 201     conversation_t *conv        = NULL;
 202
 203     port = tvb_get_ntohl(tvb, offset);
 204     if (port == EPMD_PORT) {
 205         dissect_epmd_response_names(pinfo, tvb, offset, tree);
 206         return 0;
 207     }
 208
 209     type = tvb_get_guint8(tvb, offset);
 210     proto_tree_add_item(tree, hf_epmd_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 211     offset++;
 212     col_add_str(pinfo->cinfo, COL_INFO, val_to_str(type, VALS(message_types), "unknown (0x%02X)"));
 213
 214     switch (type) {
 215         case EPMD_ALIVE_OK_RESP:
 216         case EPMD_ALIVE2_RESP:
 217             result = tvb_get_guint8(tvb, offset);
 218             proto_tree_add_item(tree, hf_epmd_result, tvb, offset, 1, ENC_BIG_ENDIAN);
 219             offset++;
 220             proto_tree_add_item(tree, hf_epmd_creation, tvb, offset, 2, ENC_BIG_ENDIAN);
 221             offset += 2;
 222             if (!result) {
 223                 col_append_str(pinfo->cinfo, COL_INFO, " OK");
 224             } else {
 225                 col_append_fstr(pinfo->cinfo, COL_INFO, " ERROR 0x%02X", result);
 226             }
 227             break;
 228
 229         case EPMD_PORT2_RESP:
 230             result = tvb_get_guint8(tvb, offset);
 231             proto_tree_add_item(tree, hf_epmd_result, tvb, offset, 1, ENC_BIG_ENDIAN);
 232             offset++;
 233             if (!result) {
 234                 col_append_str(pinfo->cinfo, COL_INFO, " OK");
 235             } else {
 236                 col_append_fstr(pinfo->cinfo, COL_INFO, " ERROR 0x%02X", result);
 237                 break;
 238             }
 239             port = tvb_get_ntohs(tvb, offset);
 240             proto_tree_add_item(tree, hf_epmd_port_no, tvb, offset, 2, ENC_BIG_ENDIAN);
 241             offset += 2;
 242             proto_tree_add_item(tree, hf_epmd_node_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 243             offset++;
 244             proto_tree_add_item(tree, hf_epmd_protocol, tvb, offset, 1, ENC_BIG_ENDIAN);
 245             offset++;
 246             proto_tree_add_item(tree, hf_epmd_dist_high, tvb, offset, 2, ENC_BIG_ENDIAN);
 247             offset += 2;
 248             proto_tree_add_item(tree, hf_epmd_dist_low, tvb, offset, 2, ENC_BIG_ENDIAN);
 249             offset += 2;
 250             name_length = tvb_get_ntohs(tvb, offset);
 251             proto_tree_add_item(tree, hf_epmd_name_len, tvb, offset, 2, ENC_BIG_ENDIAN);
 252             proto_tree_add_item(tree, hf_epmd_name, tvb, offset + 2, name_length, ENC_ASCII|ENC_NA);
 253             name = tvb_get_string(wmem_packet_scope(), tvb, offset + 2, name_length);
 254             offset += 2 + name_length;
 255             if (tvb_length_remaining(tvb, offset) >= 2) {
 256                 guint16 elen=0;
 257                 elen = tvb_get_ntohs(tvb, offset);
 258                 proto_tree_add_item(tree, hf_epmd_elen, tvb, offset, 2, ENC_BIG_ENDIAN);
 259                 if (elen > 0)
 260                     proto_tree_add_item(tree, hf_epmd_edata, tvb, offset + 2, elen, ENC_NA);
 261                 offset += 2 + elen;
 262             }
 263             col_append_fstr(pinfo->cinfo, COL_INFO, " %s port=%d", name, port);
 264             if (!pinfo->fd->flags.visited) {
 265                 conv = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, PT_TCP, port, 0, NO_PORT2);
 266                 conversation_set_dissector(conv, edp_handle);
 267             }
 268             break;
 269     }
 270     return offset;
 271 }
 272
 273 static gboolean
 274 check_epmd(tvbuff_t *tvb) {
 275     guint8 type;
 276
 277     /* simple heuristic:
 278      *
 279      * just check if the type is one of the EPMD
 280      * command types
 281      *
 282      * It's possible to start checking lengths but imho that
 283      * doesn't bring very much.
 284      */
 285     if (tvb_length(tvb) < 3)
 286         return (FALSE);
 287
 288     type = tvb_get_guint8(tvb, 0);
 289     switch (type) {
 290         case EPMD_ALIVE_OK_RESP:
 291         case EPMD_ALIVE2_RESP:
 292         case EPMD_PORT2_RESP:
 293             return (TRUE);
 294         default:
 295             break;
 296     }
 297
 298     type = tvb_get_guint8(tvb, 2);
 299     switch (type) {
 300         case EPMD_ALIVE_REQ:
 301         case EPMD_ALIVE2_REQ:
 302         case EPMD_PORT_REQ:
 303         case EPMD_PORT2_REQ:
 304         case EPMD_NAMES_REQ:
 305             return (TRUE);
 306         default:
 307             break;
 308     }
 309
 310     return (FALSE);
 311 }
 312
 313 static int
 314 dissect_epmd(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) {
 315     proto_tree *epmd_tree;
 316     proto_item *ti;
 317
 318     if (!check_epmd(tvb))
 319         return (0);
 320
 321     col_set_str(pinfo->cinfo, COL_PROTOCOL, PSNAME);
 322
 323     ti = proto_tree_add_item(tree, proto_epmd, tvb, 0, -1, ENC_NA);
 324     epmd_tree = proto_item_add_subtree(ti, ett_epmd);
 325
 326     if (pinfo->match_uint == pinfo->destport) {
 327         dissect_epmd_request(pinfo, tvb, 0, epmd_tree);
 328     } else {
 329         dissect_epmd_response(pinfo, tvb, 0, epmd_tree);
 330     }
 331
 332     return (tvb_length(tvb));
 333 }
 334
 335 void
 336 proto_register_epmd(void)
 337 {
 338     static hf_register_info hf[] = {
 339         { &hf_epmd_len,
 340           { "Length", "epmd.len",
 341             FT_UINT16, BASE_DEC, NULL, 0x0,
 342             "Message Length", HFILL }},
 343
 344         { &hf_epmd_type,
 345           { "Type", "epmd.type",
 346             FT_UINT8, BASE_DEC, VALS(message_types), 0x0,
 347             "Message Type", HFILL }},
 348
 349         { &hf_epmd_result,
 350           { "Result", "epmd.result",
 351             FT_UINT8, BASE_DEC, NULL, 0x0,
 352             NULL, HFILL }},
 353
 354         { &hf_epmd_port_no,
 355           { "Port No", "epmd.port_no",
 356             FT_UINT16, BASE_DEC, NULL, 0x0,
 357             NULL, HFILL }},
 358
 359         { &hf_epmd_node_type,
 360           { "Node Type", "epmd.node_type",
 361             FT_UINT8, BASE_DEC, VALS(node_type_vals), 0x0,
 362             NULL, HFILL }},
 363
 364         { &hf_epmd_protocol,
 365           { "Protocol", "epmd.protocol",
 366             FT_UINT8, BASE_DEC, VALS(protocol_vals), 0x0,
 367             NULL, HFILL }},
 368
 369         { &hf_epmd_creation,
 370           { "Creation", "epmd.creation",
 371             FT_UINT16, BASE_DEC, NULL, 0x0,
 372             NULL, HFILL }},
 373
 374         { &hf_epmd_dist_high,
 375           { "Highest Version", "epmd.dist_high",
 376             FT_UINT16, BASE_DEC, VALS(epmd_version_vals), 0x0,
 377             NULL, HFILL }},
 378
 379         { &hf_epmd_dist_low,
 380           { "Lowest Version", "epmd.dist_low",
 381             FT_UINT16, BASE_DEC, VALS(epmd_version_vals), 0x0,
 382             NULL, HFILL }},
 383
 384         { &hf_epmd_name_len,
 385           { "Name Length", "epmd.name_len",
 386             FT_UINT16, BASE_DEC, NULL, 0x0,
 387             NULL, HFILL }},
 388
 389         { &hf_epmd_name,
 390           { "Node Name", "epmd.name",
 391             FT_STRING, BASE_NONE, NULL, 0x0,
 392             NULL, HFILL }},
 393
 394         { &hf_epmd_elen,
 395           { "Elen", "epmd.elen",
 396             FT_UINT16, BASE_DEC, NULL, 0x0,
 397             "Extra Length", HFILL }},
 398
 399         { &hf_epmd_edata,
 400           { "Edata", "epmd.edata",
 401             FT_BYTES, BASE_NONE, NULL, 0x0,
 402             "Extra Data", HFILL }},
 403
 404         { &hf_epmd_names,
 405           { "Names", "epmd.names",
 406             FT_BYTES, BASE_NONE, NULL, 0x0,
 407             "List of names", HFILL }}
 408     };
 409
 410     static gint *ett[] = {
 411         &ett_epmd,
 412     };
 413
 414     proto_epmd = proto_register_protocol(PNAME, PSNAME, PFNAME);
 415     proto_register_field_array(proto_epmd, hf, array_length(hf));
 416     proto_register_subtree_array(ett, array_length(ett));
 417     new_register_dissector(PFNAME, dissect_epmd, proto_epmd);
 418 }
 419
 420 void
 421 proto_reg_handoff_epmd(void) {
 422     dissector_handle_t epmd_handle;
 423
 424     epmd_handle = find_dissector("epmd");
 425     edp_handle = find_dissector("erldp");
 426
 427     dissector_add_uint("tcp.port", EPMD_PORT, epmd_handle);
 428 }