2 * Routines for dsi packet dissection
3 * Copyright 2001, Randy McEoin <rmceoin@pe.com>
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
9 * Copied from packet-pop.c
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
28 #include <epan/packet.h>
29 #include <epan/prefs.h>
31 #include "packet-tcp.h"
32 #include "packet-afp.h"
34 /* The information in this module (DSI) comes from:
36 AFP 2.1 & 2.2 documentation, in PDF form, at
38 http://developer.apple.com/DOCUMENTATION/macos8/pdf/ASAppleTalkFiling2.1_2.2.pdf
40 The netatalk source code by Wesley Craig & Adrian Sun
42 The Data Stream Interface description from
43 http://developer.apple.com/documentation/Networking/Conceptual/AFPClient/AFPClient-6.html
45 (no longer available, apparently)
47 Also, AFP 3.3 documents parts of DSI at:
48 http://developer.apple.com/mac/library/documentation/Networking/Conceptual/AFP/Introduction/Introduction.html
50 * What a Data Stream Interface packet looks like:
52 * |-------------------------------|
53 * |flags |command| requestID |
54 * |-------------------------------|
55 * |error code/enclosed data offset|
56 * |-------------------------------|
57 * |total data length |
58 * |-------------------------------|
60 * |-------------------------------|
63 void proto_register_dsi(void);
64 void proto_reg_handoff_dsi(void);
66 static int proto_dsi = -1;
67 static int hf_dsi_flags = -1;
68 static int hf_dsi_command = -1;
69 static int hf_dsi_requestid = -1;
70 static int hf_dsi_offset = -1;
71 static int hf_dsi_error = -1;
72 static int hf_dsi_length = -1;
73 static int hf_dsi_reserved = -1;
75 static gint ett_dsi = -1;
77 static int hf_dsi_open_type = -1;
78 static int hf_dsi_open_len = -1;
79 static int hf_dsi_open_quantum = -1;
80 static int hf_dsi_replay_cache_size = -1;
81 static int hf_dsi_open_option = -1;
83 static int hf_dsi_attn_flag = -1;
84 static int hf_dsi_attn_flag_shutdown = -1;
85 static int hf_dsi_attn_flag_crash = -1;
86 static int hf_dsi_attn_flag_msg = -1;
87 static int hf_dsi_attn_flag_reconnect = -1;
88 static int hf_dsi_attn_flag_time = -1;
89 static int hf_dsi_attn_flag_bitmap = -1;
91 static gint ett_dsi_open = -1;
92 static gint ett_dsi_attn = -1;
93 static gint ett_dsi_attn_flag = -1;
95 static const value_string dsi_attn_flag_vals[] = {
96 {0x0, "Reserved" }, /* 0000 */
97 {0x1, "Reserved" }, /* 0001 */
98 {0x2, "Server message" }, /* 0010 */
99 {0x3, "Server notification, cf. extended bitmap" }, /* 0011 */
100 {0x4, "Server is shutting down, internal error" }, /* 0100 */
101 {0x8, "Server is shutting down" }, /* 1000 */
102 {0x9, "Server disconnects user" }, /* 1001 */
103 {0x10,"Server is shutting down, message" }, /* 1010 */
104 {0x11,"Server is shutting down, message,no reconnect"}, /* 1011 */
106 static value_string_ext dsi_attn_flag_vals_ext = VALUE_STRING_EXT_INIT(dsi_attn_flag_vals);
108 static const value_string dsi_open_type_vals[] = {
109 {0, "Server quantum" },
110 {1, "Attention quantum" },
111 {2, "Replay cache size" },
114 /* desegmentation of DSI */
115 static gboolean dsi_desegment = TRUE;
117 static dissector_handle_t afp_handle;
118 static dissector_handle_t afp_server_status_handle;
120 #define TCP_PORT_DSI 548 /* Not IANA registered */
122 #define DSI_BLOCKSIZ 16
125 #define DSIFL_REQUEST 0x00
126 #define DSIFL_REPLY 0x01
127 #define DSIFL_MAX 0x01
130 #define DSIFUNC_CLOSE 1 /* DSICloseSession */
131 #define DSIFUNC_CMD 2 /* DSICommand */
132 #define DSIFUNC_STAT 3 /* DSIGetStatus */
133 #define DSIFUNC_OPEN 4 /* DSIOpenSession */
134 #define DSIFUNC_TICKLE 5 /* DSITickle */
135 #define DSIFUNC_WRITE 6 /* DSIWrite */
136 #define DSIFUNC_ATTN 8 /* DSIAttention */
137 #define DSIFUNC_MAX 8 /* largest command */
139 static const value_string flag_vals[] = {
140 {DSIFL_REQUEST, "Request" },
141 {DSIFL_REPLY, "Reply" },
144 static const value_string func_vals[] = {
145 {DSIFUNC_CLOSE, "CloseSession" },
146 {DSIFUNC_CMD, "Command" },
147 {DSIFUNC_STAT, "GetStatus" },
148 {DSIFUNC_OPEN, "OpenSession" },
149 {DSIFUNC_TICKLE, "Tickle" },
150 {DSIFUNC_WRITE, "Write" },
152 {DSIFUNC_ATTN, "Attention" },
154 static value_string_ext func_vals_ext = VALUE_STRING_EXT_INIT(func_vals);
157 dissect_dsi_open_session(tvbuff_t *tvb, proto_tree *dsi_tree, gint offset, gint dsi_length)
163 tree = proto_tree_add_subtree(dsi_tree, tvb, offset, -1, ett_dsi_open, NULL, "Open Session");
165 while( dsi_length >2 ) {
167 type = tvb_get_guint8(tvb, offset);
168 proto_tree_add_item(tree, hf_dsi_open_type, tvb, offset, 1, ENC_BIG_ENDIAN);
170 len = tvb_get_guint8(tvb, offset);
171 proto_tree_add_item(tree, hf_dsi_open_len, tvb, offset, 1, ENC_BIG_ENDIAN);
175 proto_tree_add_item(tree, hf_dsi_open_quantum, tvb, offset, 4, ENC_BIG_ENDIAN);
178 proto_tree_add_item(tree, hf_dsi_open_quantum, tvb, offset, 4, ENC_BIG_ENDIAN);
181 proto_tree_add_item(tree, hf_dsi_replay_cache_size, tvb, offset, 4, ENC_BIG_ENDIAN);
184 proto_tree_add_item(tree, hf_dsi_open_option, tvb, offset, len, ENC_NA);
187 dsi_length -= len + 2;
195 dissect_dsi_attention(tvbuff_t *tvb, proto_tree *dsi_tree, gint offset)
201 if (!tvb_reported_length_remaining(tvb,offset))
204 flag = tvb_get_ntohs(tvb, offset);
205 tree = proto_tree_add_subtree(dsi_tree, tvb, offset, -1, ett_dsi_attn, NULL, "Attention");
207 ti = proto_tree_add_item(tree, hf_dsi_attn_flag, tvb, offset, 2, ENC_BIG_ENDIAN);
208 tree = proto_item_add_subtree(ti, ett_dsi_attn_flag);
209 proto_tree_add_item(tree, hf_dsi_attn_flag_shutdown, tvb, offset, 2, ENC_BIG_ENDIAN);
210 proto_tree_add_item(tree, hf_dsi_attn_flag_crash, tvb, offset, 2, ENC_BIG_ENDIAN);
211 proto_tree_add_item(tree, hf_dsi_attn_flag_msg, tvb, offset, 2, ENC_BIG_ENDIAN);
212 proto_tree_add_item(tree, hf_dsi_attn_flag_reconnect, tvb, offset, 2, ENC_BIG_ENDIAN);
214 if ((flag & 0xf000) != 0x3000)
215 proto_tree_add_item(tree, hf_dsi_attn_flag_time, tvb, offset, 2, ENC_BIG_ENDIAN);
217 proto_tree_add_item(tree, hf_dsi_attn_flag_bitmap, tvb, offset, 2, ENC_BIG_ENDIAN);
223 dissect_dsi_packet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
225 proto_tree *dsi_tree;
227 guint8 dsi_flags,dsi_command;
228 guint16 dsi_requestid;
231 guint32 dsi_reserved;
232 struct aspinfo aspinfo;
235 col_set_str(pinfo->cinfo, COL_PROTOCOL, "DSI");
236 col_clear(pinfo->cinfo, COL_INFO);
238 dsi_flags = tvb_get_guint8(tvb, 0);
239 dsi_command = tvb_get_guint8(tvb, 1);
240 dsi_requestid = tvb_get_ntohs(tvb, 2);
241 dsi_code = tvb_get_ntohl(tvb, 4);
242 dsi_length = tvb_get_ntohl(tvb, 8);
243 dsi_reserved = tvb_get_ntohl(tvb, 12);
245 col_add_fstr(pinfo->cinfo, COL_INFO, "%s %s (%u)",
246 val_to_str(dsi_flags, flag_vals,
247 "Unknown flag (0x%02x)"),
248 val_to_str_ext(dsi_command, &func_vals_ext,
249 "Unknown function (0x%02x)"),
252 dsi_ti = proto_tree_add_item(tree, proto_dsi, tvb, 0, -1, ENC_NA);
253 dsi_tree = proto_item_add_subtree(dsi_ti, ett_dsi);
256 proto_tree_add_uint(dsi_tree, hf_dsi_flags, tvb,
258 proto_tree_add_uint(dsi_tree, hf_dsi_command, tvb,
260 proto_tree_add_uint(dsi_tree, hf_dsi_requestid, tvb,
261 2, 2, dsi_requestid);
265 proto_tree_add_int(dsi_tree, hf_dsi_offset, tvb,
270 proto_tree_add_int(dsi_tree, hf_dsi_error, tvb,
274 proto_tree_add_uint_format_value(dsi_tree, hf_dsi_length, tvb,
276 "%u bytes", dsi_length);
277 proto_tree_add_uint(dsi_tree, hf_dsi_reserved, tvb,
278 12, 4, dsi_reserved);
281 switch (dsi_command) {
284 dissect_dsi_open_session(tvb, dsi_tree, DSI_BLOCKSIZ, dsi_length);
289 dissect_dsi_attention(tvb, dsi_tree, DSI_BLOCKSIZ);
293 if (tree && (dsi_flags == DSIFL_REPLY)) {
296 /* XXX - assumes only AFP runs atop DSI */
297 new_tvb = tvb_new_subset_remaining(tvb, DSI_BLOCKSIZ);
298 call_dissector(afp_server_status_handle, new_tvb, pinfo, dsi_tree);
306 aspinfo.reply = (dsi_flags == DSIFL_REPLY);
307 aspinfo.command = dsi_command;
308 aspinfo.seq = dsi_requestid;
309 aspinfo.code = dsi_code;
310 proto_item_set_len(dsi_ti, DSI_BLOCKSIZ);
312 new_tvb = tvb_new_subset_remaining(tvb, DSI_BLOCKSIZ);
313 call_dissector_with_data(afp_handle, new_tvb, pinfo, tree, &aspinfo);
317 call_data_dissector(tvb_new_subset_remaining(tvb, DSI_BLOCKSIZ),
322 return tvb_captured_length(tvb);
326 get_dsi_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)
329 guint8 dsi_flags,dsi_command;
331 dsi_flags = tvb_get_guint8(tvb, offset);
332 dsi_command = tvb_get_guint8(tvb, offset+ 1);
333 if ( dsi_flags > DSIFL_MAX || !dsi_command || dsi_command > DSIFUNC_MAX)
335 /* it's not a known dsi pdu start sequence */
336 return tvb_captured_length_remaining(tvb, offset);
340 * Get the length of the DSI packet.
342 plen = tvb_get_ntohl(tvb, offset+8);
345 * That length doesn't include the length of the header itself;
352 dissect_dsi(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
354 tcp_dissect_pdus(tvb, pinfo, tree, dsi_desegment, 12,
355 get_dsi_pdu_len, dissect_dsi_packet, data);
357 return tvb_captured_length(tvb);
361 proto_register_dsi(void)
364 static hf_register_info hf[] = {
366 { "Flags", "dsi.flags",
367 FT_UINT8, BASE_HEX, VALS(flag_vals), 0x0,
368 "Indicates request or reply.", HFILL }},
371 { "Command", "dsi.command",
372 FT_UINT8, BASE_DEC|BASE_EXT_STRING, &func_vals_ext, 0x0,
373 "Represents a DSI command.", HFILL }},
376 { "Request ID", "dsi.requestid",
377 FT_UINT16, BASE_DEC, NULL, 0x0,
378 "Keeps track of which request this is. Replies must match a Request. IDs must be generated in sequential order.", HFILL }},
381 { "Data offset", "dsi.data_offset",
382 FT_INT32, BASE_DEC, NULL, 0x0,
386 { "Error code", "dsi.error_code",
387 FT_INT32, BASE_DEC|BASE_EXT_STRING, &asp_error_vals_ext, 0x0,
391 { "Length", "dsi.length",
392 FT_UINT32, BASE_DEC, NULL, 0x0,
393 "Total length of the data that follows the DSI header.", HFILL }},
396 { "Reserved", "dsi.reserved",
397 FT_UINT32, BASE_HEX, NULL, 0x0,
398 "Reserved for future use. Should be set to zero.", HFILL }},
401 { "Option", "dsi.open_type",
402 FT_UINT8, BASE_DEC, VALS(dsi_open_type_vals), 0x0,
403 "Open session option type.", HFILL }},
406 { "Length", "dsi.open_len",
407 FT_UINT8, BASE_DEC, NULL, 0x0,
408 "Open session option len", HFILL }},
410 { &hf_dsi_open_quantum,
411 { "Quantum", "dsi.open_quantum",
412 FT_UINT32, BASE_DEC, NULL, 0x0,
413 "Server/Attention quantum", HFILL }},
415 { &hf_dsi_replay_cache_size,
416 { "Replay", "dsi.replay_cache",
417 FT_UINT32, BASE_DEC, NULL, 0x0,
418 "Replay cache size", HFILL }},
420 { &hf_dsi_open_option,
421 { "Option", "dsi.open_option",
422 FT_BYTES, BASE_NONE, NULL, 0x0,
423 "Open session options (undecoded)", HFILL }},
426 { "Flags", "dsi.attn_flag",
427 FT_UINT16, BASE_HEX|BASE_EXT_STRING, &dsi_attn_flag_vals_ext, 0xf000,
428 "Server attention flag", HFILL }},
429 { &hf_dsi_attn_flag_shutdown,
430 { "Shutdown", "dsi.attn_flag.shutdown",
431 FT_BOOLEAN, 16, NULL, 1<<15,
432 "Attention flag, server is shutting down", HFILL }},
433 { &hf_dsi_attn_flag_crash,
434 { "Crash", "dsi.attn_flag.crash",
435 FT_BOOLEAN, 16, NULL, 1<<14,
436 "Attention flag, server crash bit", HFILL }},
437 { &hf_dsi_attn_flag_msg,
438 { "Message", "dsi.attn_flag.msg",
439 FT_BOOLEAN, 16, NULL, 1<<13,
440 "Attention flag, server message bit", HFILL }},
441 { &hf_dsi_attn_flag_reconnect,
442 { "Don't reconnect", "dsi.attn_flag.reconnect",
443 FT_BOOLEAN, 16, NULL, 1<<12,
444 "Attention flag, don't reconnect bit", HFILL }},
445 { &hf_dsi_attn_flag_time,
446 { "Minutes", "dsi.attn_flag.time",
447 FT_UINT16, BASE_DEC, NULL, 0xfff,
448 "Number of minutes", HFILL }},
449 { &hf_dsi_attn_flag_bitmap,
450 { "Bitmap", "dsi.attn_flag.bitmap",
451 FT_UINT16, BASE_HEX, NULL, 0xfff,
452 "Attention extended bitmap", HFILL }},
455 static gint *ett[] = {
461 module_t *dsi_module;
463 proto_dsi = proto_register_protocol("Data Stream Interface", "DSI", "dsi");
464 proto_register_field_array(proto_dsi, hf, array_length(hf));
465 proto_register_subtree_array(ett, array_length(ett));
467 dsi_module = prefs_register_protocol(proto_dsi, NULL);
468 prefs_register_bool_preference(dsi_module, "desegment",
469 "Reassemble DSI messages spanning multiple TCP segments",
470 "Whether the DSI dissector should reassemble messages spanning multiple TCP segments."
471 " To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
476 proto_reg_handoff_dsi(void)
478 dissector_handle_t dsi_handle;
480 dsi_handle = create_dissector_handle(dissect_dsi, proto_dsi);
481 dissector_add_uint_with_preference("tcp.port", TCP_PORT_DSI, dsi_handle);
483 afp_handle = find_dissector_add_dependency("afp", proto_dsi);
484 afp_server_status_handle = find_dissector_add_dependency("afp_server_status", proto_dsi);
488 * Editor modelines - http://www.wireshark.org/tools/modelines.html
493 * indent-tabs-mode: t
496 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
497 * :indentSize=8:tabSize=8:noTabs=false: