2 * Routines for UDP packet disassembly
4 * $Id: packet-udp.c,v 1.13 1999/03/01 18:28:12 gram Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
10 * Richard Sharpe, 13-Feb-1999, added dispatch table support and
13 * This program is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU General Public License
15 * as published by the Free Software Foundation; either version 2
16 * of the License, or (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
37 #ifdef HAVE_SYS_TYPES_H
38 # include <sys/types.h>
41 #ifdef HAVE_NETINET_IN_H
42 # include <netinet/in.h>
51 void (*dissect)(const u_char *, int, frame_data *, GtkTree *);
52 struct hash_struct *next;
55 struct hash_struct *hash_table[256];
58 * These routines are for UDP, will be generalized soon: RJS
60 * XXX - note that they should probably check the IP address as well as
61 * the port number, so that we don't mistakenly identify packets as, say,
62 * TFTP, merely because they have a source or destination port number
63 * equal to the port being used by a TFTP daemon on some machine other
64 * than the one they're going to or from.
67 struct hash_struct *udp_find_hash_ent(guint16 proto) {
69 int idx = proto % 256;
70 struct hash_struct *hash_ent = hash_table[idx];
72 while (hash_ent != NULL) {
74 if (hash_ent -> proto == proto)
77 hash_ent = hash_ent -> next;
85 void udp_hash_add(guint16 proto,
86 void (*dissect)(const u_char *, int, frame_data *, GtkTree *)) {
88 int idx = proto % 256; /* Simply take the remainder, hope for no collisions */
89 struct hash_struct *hash_ent = (struct hash_struct *)malloc(sizeof(struct hash_struct));
90 struct hash_struct *hash_ent2;
92 hash_ent -> proto = proto;
93 hash_ent -> dissect = dissect;
94 hash_ent -> next = NULL;
96 if (hash_ent == NULL) {
98 fprintf(stderr, "Could not allocate space for hash structure in dissect_udp\n");
102 if (hash_table[idx]) { /* Something, add on end */
104 hash_ent2 = hash_table[idx];
106 while (hash_ent2 -> next != NULL)
107 hash_ent2 = hash_ent2 -> next;
109 hash_ent2 -> next = hash_ent; /* Bad in pathalogical cases */
114 hash_table[idx] = hash_ent;
120 void init_dissect_udp(void) {
124 for (i = 0; i < 256; i++) {
126 hash_table[i] = NULL;
130 /* Now add the protocols we know about */
132 udp_hash_add(UDP_PORT_BOOTPS, dissect_bootp);
133 udp_hash_add(UDP_PORT_TFTP, dissect_tftp);
138 dissect_udp(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
140 guint16 uh_sport, uh_dport, uh_ulen, uh_sum;
141 struct hash_struct *dissect_routine = NULL;
142 GtkWidget *udp_tree, *ti;
144 /* To do: Check for {cap len,pkt len} < struct len */
145 /* Avoids alignment problems on many architectures. */
146 memcpy(&uh, &pd[offset], sizeof(e_udphdr));
147 uh_sport = ntohs(uh.uh_sport);
148 uh_dport = ntohs(uh.uh_dport);
149 uh_ulen = ntohs(uh.uh_ulen);
150 uh_sum = ntohs(uh.uh_sum);
152 if (check_col(fd, COL_PROTOCOL))
153 col_add_str(fd, COL_PROTOCOL, "UDP");
154 if (check_col(fd, COL_INFO))
155 col_add_fstr(fd, COL_INFO, "Source port: %s Destination port: %s",
156 get_udp_port(uh_sport), get_udp_port(uh_dport));
157 if (check_col(fd, COL_RES_SRC_PORT))
158 col_add_str(fd, COL_RES_SRC_PORT, get_udp_port(uh_sport));
159 if (check_col(fd, COL_UNRES_SRC_PORT))
160 col_add_fstr(fd, COL_UNRES_SRC_PORT, "%u", uh_sport);
161 if (check_col(fd, COL_RES_DST_PORT))
162 col_add_str(fd, COL_RES_DST_PORT, get_udp_port(uh_dport));
163 if (check_col(fd, COL_UNRES_DST_PORT))
164 col_add_fstr(fd, COL_UNRES_DST_PORT, "%u", uh_dport);
167 ti = add_item_to_tree(GTK_WIDGET(tree), offset, 8,
168 "User Datagram Protocol");
169 udp_tree = gtk_tree_new();
170 add_subtree(ti, udp_tree, ETT_UDP);
171 add_item_to_tree(udp_tree, offset, 2, "Source port: %s (%u)",
172 get_udp_port(uh_sport), uh_sport);
173 add_item_to_tree(udp_tree, offset + 2, 2, "Destination port: %s (%u)",
174 get_udp_port(uh_dport), uh_dport);
175 add_item_to_tree(udp_tree, offset + 4, 2, "Length: %u", uh_ulen);
176 add_item_to_tree(udp_tree, offset + 6, 2, "Checksum: 0x%04x", uh_sum);
179 /* Skip over header */
182 /* To do: make sure we aren't screwing ourselves with the MIN call. */
183 switch (MIN(uh_sport, uh_dport)) {
184 case UDP_PORT_BOOTPS:
185 dissect_bootp(pd, offset, fd, tree);
188 dissect_dns(pd, offset, fd, tree);
191 /* we should check the source port too (RIP: UDP src and dst port 520) */
192 dissect_rip(pd, offset, fd, tree);
195 dissect_nbns(pd, offset, fd, tree);
198 dissect_nbdgm(pd, offset, fd, tree);
200 case UDP_PORT_IPX: /* RFC 1234 */
201 dissect_ipx(pd, offset, fd, tree);
204 /* FIXME: AFAIK, src and dst port must be the same */
205 dissect_vines_frp(pd, offset, fd, tree);
208 /* This is the first point of call, but it adds a dynamic call */
209 udp_hash_add(MAX(uh_sport, uh_dport), dissect_tftp); /* Add to table */
210 dissect_tftp(pd, offset, fd, tree);
214 /* OK, find a routine in the table, else use the default */
216 if ((dissect_routine = udp_find_hash_ent(uh_sport))) {
218 struct hash_struct *dr2 = udp_find_hash_ent(uh_dport);
220 if (dr2 == NULL) { /* Not in the table, add */
222 udp_hash_add(uh_dport, dissect_tftp);
226 dissect_routine -> dissect(pd, offset, fd, tree);
228 else if ((dissect_routine = udp_find_hash_ent(uh_dport))) {
230 dissect_routine -> dissect(pd, offset, fd, tree);
235 dissect_data(pd, offset, fd, tree);