epan/dissectors/packet-yhoo.c

   1 /* packet-yhoo.c
   2  * Routines for yahoo messenger packet dissection
   3  * Copyright 1999, Nathan Neulinger <nneul@umr.edu>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-tftp.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  26  */
  27
  28 #include "config.h"
  29
  30 #include <glib.h>
  31
  32 #include <epan/packet.h>
  33
  34 static int proto_yhoo = -1;
  35 static int hf_yhoo_version = -1;
  36 static int hf_yhoo_len = -1;
  37 static int hf_yhoo_service = -1;
  38 static int hf_yhoo_connection_id = -1;
  39 static int hf_yhoo_magic_id = -1;
  40 static int hf_yhoo_unknown1 = -1;
  41 static int hf_yhoo_msgtype = -1;
  42 static int hf_yhoo_nick1 = -1;
  43 static int hf_yhoo_nick2 = -1;
  44 static int hf_yhoo_content = -1;
  45
  46 static gint ett_yhoo = -1;
  47
  48 #define TCP_PORT_YHOO   5050
  49
  50 /* This is from yahoolib.h from gtkyahoo */
  51
  52 /* Service constants */
  53 #define YAHOO_SERVICE_LOGON                   1
  54 #define YAHOO_SERVICE_LOGOFF                  2
  55 #define YAHOO_SERVICE_ISAWAY                  3
  56 #define YAHOO_SERVICE_ISBACK                  4
  57 #define YAHOO_SERVICE_IDLE                    5
  58 #define YAHOO_SERVICE_MESSAGE                 6
  59 #define YAHOO_SERVICE_IDACT                   7
  60 #define YAHOO_SERVICE_IDDEACT                 8
  61 #define YAHOO_SERVICE_MAILSTAT                9
  62 #define YAHOO_SERVICE_USERSTAT               10
  63 #define YAHOO_SERVICE_NEWMAIL                11
  64 #define YAHOO_SERVICE_CHATINVITE             12
  65 #define YAHOO_SERVICE_CALENDAR               13
  66 #define YAHOO_SERVICE_NEWPERSONALMAIL        14
  67 #define YAHOO_SERVICE_NEWCONTACT             15
  68 #define YAHOO_SERVICE_ADDIDENT               16
  69 #define YAHOO_SERVICE_ADDIGNORE              17
  70 #define YAHOO_SERVICE_PING                   18
  71 #define YAHOO_SERVICE_GROUPRENAME            19
  72 #define YAHOO_SERVICE_SYSMESSAGE             20
  73 #define YAHOO_SERVICE_PASSTHROUGH2           22
  74 #define YAHOO_SERVICE_CONFINVITE             24
  75 #define YAHOO_SERVICE_CONFLOGON              25
  76 #define YAHOO_SERVICE_CONFDECLINE            26
  77 #define YAHOO_SERVICE_CONFLOGOFF             27
  78 #define YAHOO_SERVICE_CONFADDINVITE          28
  79 #define YAHOO_SERVICE_CONFMSG                29
  80 #define YAHOO_SERVICE_CHATLOGON              30
  81 #define YAHOO_SERVICE_CHATLOGOFF             31
  82 #define YAHOO_SERVICE_CHATMSG                32
  83 #define YAHOO_SERVICE_FILETRANSFER           70
  84 #define YAHOO_SERVICE_CHATADDINVITE         157
  85 #define YAHOO_SERVICE_AVATAR                188
  86 #define YAHOO_SERVICE_PICTURE_CHECKSUM      189
  87 #define YAHOO_SERVICE_PICTURE               190
  88 #define YAHOO_SERVICE_PICTURE_UPDATE        193
  89 #define YAHOO_SERVICE_PICTURE_UPLOAD        194
  90 #define YAHOO_SERVICE_YAHOO6_STATUS_UPDATE  198
  91 #define YAHOO_SERVICE_AVATAR_UPDATE         199
  92 #define YAHOO_SERVICE_AUDIBLE               208
  93 #define YAHOO_SERVICE_WEBLOGIN              550
  94 #define YAHOO_SERVICE_SMS_MSG               746
  95
  96
  97 /* Message flags */
  98 #define YAHOO_MSGTYPE_NONE      0
  99 #define YAHOO_MSGTYPE_NORMAL    1
 100 #define YAHOO_MSGTYPE_BOUNCE    2
 101 #define YAHOO_MSGTYPE_STATUS    4
 102 #define YAHOO_MSGTYPE_OFFLINE   1515563606      /* yuck! */
 103
 104 #define YAHOO_RAWPACKET_LEN 105
 105
 106 #if 0
 107 struct yahoo_rawpacket
 108 {
 109         char          version[8];       /* 7 chars and trailing null */
 110         unsigned char len[4];           /* length - little endian */
 111         unsigned char service[4];       /* service - little endian */
 112         unsigned char connection_id[4]; /* connection number - little endian */
 113         unsigned char magic_id[4];      /* magic number used for http session */
 114         unsigned char unknown1[4];
 115         unsigned char msgtype[4];
 116         char          nick1[36];
 117         char          nick2[36];
 118         char          content[1];       /* was zero, had problems with aix xlc */
 119 };
 120 #endif
 121
 122 static const value_string yhoo_service_vals[] = {
 123         {YAHOO_SERVICE_LOGON,                "Pager Logon"},
 124         {YAHOO_SERVICE_LOGOFF,               "Pager Logoff"},
 125         {YAHOO_SERVICE_ISAWAY,               "Is Away"},
 126         {YAHOO_SERVICE_ISBACK,               "Is Back"},
 127         {YAHOO_SERVICE_IDLE,                 "Idle"},
 128         {YAHOO_SERVICE_MESSAGE,              "Message"},
 129         {YAHOO_SERVICE_IDACT,                "Activate Identity"},
 130         {YAHOO_SERVICE_IDDEACT,              "Deactivate Identity"},
 131         {YAHOO_SERVICE_MAILSTAT,             "Mail Status"},
 132         {YAHOO_SERVICE_USERSTAT,             "User Status"},
 133         {YAHOO_SERVICE_NEWMAIL,              "New Mail"},
 134         {YAHOO_SERVICE_CHATINVITE,           "Chat Invitation"},
 135         {YAHOO_SERVICE_CALENDAR,             "Calendar Reminder"},
 136         {YAHOO_SERVICE_NEWPERSONALMAIL,      "New Personals Mail"},
 137         {YAHOO_SERVICE_NEWCONTACT,           "New Friend"},
 138         {YAHOO_SERVICE_GROUPRENAME,          "Group Renamed"},
 139         {YAHOO_SERVICE_ADDIDENT,             "Add Identity"},
 140         {YAHOO_SERVICE_ADDIGNORE,            "Add Ignore"},
 141         {YAHOO_SERVICE_PING,                 "Ping"},
 142         {YAHOO_SERVICE_SYSMESSAGE,           "System Message"},
 143         {YAHOO_SERVICE_CONFINVITE,           "Conference Invitation"},
 144         {YAHOO_SERVICE_CONFLOGON,            "Conference Logon"},
 145         {YAHOO_SERVICE_CONFDECLINE,          "Conference Decline"},
 146         {YAHOO_SERVICE_CONFLOGOFF,           "Conference Logoff"},
 147         {YAHOO_SERVICE_CONFMSG,              "Conference Message"},
 148         {YAHOO_SERVICE_CONFADDINVITE,        "Conference Additional Invitation"},
 149         {YAHOO_SERVICE_CHATLOGON,            "Chat Logon"},
 150         {YAHOO_SERVICE_CHATLOGOFF,           "Chat Logoff"},
 151         {YAHOO_SERVICE_CHATMSG,              "Chat Message"},
 152         {YAHOO_SERVICE_FILETRANSFER,         "File Transfer"},
 153         {YAHOO_SERVICE_PASSTHROUGH2,         "Passthrough 2"},
 154         {YAHOO_SERVICE_CHATADDINVITE,        "Chat add Invite"},
 155         {YAHOO_SERVICE_AVATAR,               "Avatar"},
 156         {YAHOO_SERVICE_PICTURE_CHECKSUM,     "Picture Checksum"},
 157         {YAHOO_SERVICE_PICTURE,              "Picture"},
 158         {YAHOO_SERVICE_PICTURE_UPDATE,       "Picture Update"},
 159         {YAHOO_SERVICE_PICTURE_UPLOAD,       "Picture Upload"},
 160         {YAHOO_SERVICE_YAHOO6_STATUS_UPDATE, "Status update"},
 161         {YAHOO_SERVICE_AUDIBLE,              "Audible"},
 162         {YAHOO_SERVICE_WEBLOGIN,             "Weblogin"},
 163         {YAHOO_SERVICE_SMS_MSG,              "SMS Message"},
 164         {0, NULL}
 165 };
 166
 167 static const value_string yhoo_msgtype_vals[] = {
 168         {YAHOO_MSGTYPE_NONE,                 "None"},
 169         {YAHOO_MSGTYPE_NORMAL,               "Normal"},
 170         {YAHOO_MSGTYPE_BOUNCE,               "Bounce"},
 171         {YAHOO_MSGTYPE_STATUS,               "Status Update"},
 172         {YAHOO_MSGTYPE_OFFLINE,              "Request Offline"},
 173         {0, NULL}
 174 };
 175
 176 static gboolean
 177 dissect_yhoo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 178 {
 179         proto_tree      *yhoo_tree, *ti;
 180         int              offset = 0;
 181
 182         if (pinfo->srcport != TCP_PORT_YHOO && pinfo->destport != TCP_PORT_YHOO) {
 183                 /* Not the Yahoo port - not a Yahoo Messenger packet. */
 184                 return FALSE;
 185         }
 186
 187         /* get at least a full packet structure */
 188         if ( tvb_length(tvb) < YAHOO_RAWPACKET_LEN ) {
 189                 /* Not enough data captured; maybe it is a Yahoo
 190                    Messenger packet, but it contains too little data to
 191                    tell. */
 192                 return FALSE;
 193         }
 194
 195         if (tvb_memeql(tvb, offset, "YPNS", 4) != 0 &&
 196             tvb_memeql(tvb, offset, "YHOO", 4) != 0) {
 197                 /* Not a Yahoo Messenger packet. */
 198                 return FALSE;
 199         }
 200
 201         col_set_str(pinfo->cinfo, COL_PROTOCOL, "YHOO");
 202
 203         if (check_col(pinfo->cinfo, COL_INFO)) {
 204                 col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s",
 205                              ( tvb_memeql(tvb, offset + 0, "YPNS", 4) == 0 ) ? "Request" : "Response",
 206                              val_to_str(tvb_get_letohl(tvb, offset + 12),
 207                                         yhoo_service_vals, "Unknown Service: %u"));
 208         }
 209
 210         if (tree) {
 211                 ti = proto_tree_add_item(tree, proto_yhoo, tvb,
 212                         offset, -1, ENC_NA);
 213                 yhoo_tree = proto_item_add_subtree(ti, ett_yhoo);
 214
 215                 proto_tree_add_item(yhoo_tree, hf_yhoo_version, tvb,
 216                         offset, 8, ENC_ASCII|ENC_NA);
 217                 offset += 8;
 218
 219                 proto_tree_add_item(yhoo_tree, hf_yhoo_len, tvb,
 220                         offset, 4, ENC_LITTLE_ENDIAN);
 221                 offset += 4;
 222
 223                 proto_tree_add_item(yhoo_tree, hf_yhoo_service, tvb,
 224                         offset, 4, ENC_LITTLE_ENDIAN);
 225                 offset += 4;
 226
 227                 proto_tree_add_item(yhoo_tree, hf_yhoo_connection_id, tvb,
 228                         offset, 4, ENC_LITTLE_ENDIAN);
 229                 offset += 4;
 230
 231                 proto_tree_add_item(yhoo_tree, hf_yhoo_magic_id, tvb,
 232                         offset, 4, ENC_LITTLE_ENDIAN);
 233                 offset += 4;
 234
 235                 proto_tree_add_item(yhoo_tree, hf_yhoo_unknown1, tvb,
 236                         offset, 4, ENC_LITTLE_ENDIAN);
 237                 offset += 4;
 238
 239                 proto_tree_add_item(yhoo_tree, hf_yhoo_msgtype, tvb,
 240                         offset, 4, ENC_LITTLE_ENDIAN);
 241                 offset += 4;
 242
 243                 proto_tree_add_item(yhoo_tree, hf_yhoo_nick1, tvb,
 244                         offset, 36, ENC_ASCII|ENC_NA);
 245                 offset += 36;
 246
 247                 proto_tree_add_item(yhoo_tree, hf_yhoo_nick2, tvb,
 248                         offset, 36, ENC_ASCII|ENC_NA);
 249                 offset += 36;
 250
 251                 proto_tree_add_item(yhoo_tree, hf_yhoo_content, tvb, -1,
 252                         offset, ENC_ASCII|ENC_NA);
 253         }
 254
 255         return TRUE;
 256 }
 257
 258 void
 259 proto_register_yhoo(void)
 260 {
 261         static hf_register_info hf[] = {
 262                 { &hf_yhoo_service, {
 263                                 "Service Type", "yhoo.service", FT_UINT32, BASE_DEC,
 264                                 VALS(yhoo_service_vals), 0, NULL, HFILL }},
 265                 { &hf_yhoo_msgtype, {
 266                                 "Message Type", "yhoo.msgtype", FT_UINT32, BASE_DEC,
 267                                 VALS(yhoo_msgtype_vals), 0, "Message Type Flags", HFILL }},
 268                 { &hf_yhoo_connection_id, {
 269                                 "Connection ID", "yhoo.connection_id", FT_UINT32, BASE_HEX,
 270                                 NULL, 0, NULL, HFILL }},
 271                 { &hf_yhoo_magic_id, {
 272                                 "Magic ID", "yhoo.magic_id", FT_UINT32, BASE_HEX,
 273                                 NULL, 0, NULL, HFILL }},
 274                 { &hf_yhoo_unknown1, {
 275                                 "Unknown 1", "yhoo.unknown1", FT_UINT32, BASE_HEX,
 276                                 NULL, 0, NULL, HFILL }},
 277                 { &hf_yhoo_len, {
 278                                 "Packet Length", "yhoo.len", FT_UINT32, BASE_DEC,
 279                                 NULL, 0, NULL, HFILL }},
 280                 { &hf_yhoo_nick1, {
 281                                 "Real Nick (nick1)", "yhoo.nick1", FT_STRING, BASE_NONE,
 282                                 NULL, 0, NULL, HFILL }},
 283                 { &hf_yhoo_nick2, {
 284                                 "Active Nick (nick2)", "yhoo.nick2", FT_STRING, BASE_NONE,
 285                                 NULL, 0, NULL, HFILL }},
 286                 { &hf_yhoo_content, {
 287                                 "Content", "yhoo.content", FT_STRING, BASE_NONE,
 288                                 NULL, 0, "Data portion of the packet", HFILL }},
 289                 { &hf_yhoo_version, {
 290                                 "Version", "yhoo.version", FT_STRING, BASE_NONE,
 291                                 NULL, 0, "Packet version identifier", HFILL }},
 292         };
 293         static gint *ett[] = {
 294                 &ett_yhoo,
 295         };
 296
 297         proto_yhoo = proto_register_protocol("Yahoo Messenger Protocol",
 298             "YHOO", "yhoo");
 299
 300         proto_register_field_array(proto_yhoo, hf, array_length(hf));
 301
 302         proto_register_subtree_array(ett, array_length(ett));
 303 }
 304
 305 void
 306 proto_reg_handoff_yhoo(void)
 307 {
 308         /*
 309          * DO NOT register for port 5050, as that's used by the
 310          * old and new Yahoo messenger protocols.
 311          *
 312          * Just register as a heuristic TCP dissector, and reject stuff
 313          * not to or from that port.
 314          */
 315         heur_dissector_add("tcp", dissect_yhoo, proto_yhoo);
 316 }