packet-ipx.c

   1 /* packet-ipx.c
   2  * Routines for NetWare's IPX
   3  * Gilbert Ramirez <gram@verdict.uthscsa.edu>
   4  *
   5  * $Id: packet-ipx.c,v 1.20 1999/05/10 20:51:36 gram Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@unicom.net>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #ifdef HAVE_SYS_TYPES_H
  32 # include <sys/types.h>
  33 #endif
  34
  35 #include <stdio.h>
  36 #include <glib.h>
  37 #include "packet.h"
  38 #include "packet-ipx.h"
  39 #include "packet-ncp.h"
  40
  41 /* The information in this module (IPX, SPX, NCP) comes from:
  42         NetWare LAN Analysis, Second Edition
  43         Laura A. Chappell and Dan E. Hakes
  44         (c) 1994 Novell, Inc.
  45         Novell Press, San Jose.
  46         ISBN: 0-7821-1362-1
  47
  48   And from the ncpfs source code by Volker Lendecke
  49
  50 */
  51
  52 static void
  53 dissect_spx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data);
  54
  55 static void
  56 dissect_ipxrip(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int
  57 max_data);
  58
  59 static void
  60 dissect_sap(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int
  61 max_data);
  62
  63 struct port_info {
  64         guint16 port;
  65         void    (*func) (const u_char *, int, frame_data *, proto_tree *, int);
  66         char    *text;
  67 };
  68
  69 struct conn_info {
  70         guint8  ctrl;
  71         char    *text;
  72 };
  73
  74 struct server_info {
  75         guint16 type;
  76         char    *text;
  77 };
  78
  79 /* ================================================================= */
  80 /* IPX                                                               */
  81 /* ================================================================= */
  82 static struct port_info ports[] = {
  83         { 0x0451, dissect_ncp,          "NCP" },
  84         { 0x0452, dissect_sap,          "SAP" },
  85         { 0x0453, dissect_ipxrip,       "RIP" },
  86         { 0x0455, NULL,                 "NetBIOS" },
  87         { 0x0456, NULL,                 "Diagnostic" },
  88         { 0x0457, NULL,                 "Serialization" },
  89         { 0x0551, NULL,                 "NWLink SMB Name Query" },
  90         { 0x0553, dissect_nwlink_dg,    "NWLink SMB Datagram" },
  91         { 0x055d, NULL,                 "Attachmate Gateway" },
  92         { 0x4001, NULL,                 "IPX Message" },
  93         { 0x0000, NULL,                 NULL }
  94 };
  95
  96 static char*
  97 port_text(guint16 port) {
  98         int i=0;
  99
 100         while (ports[i].text != NULL) {
 101                 if (ports[i].port == port) {
 102                         return ports[i].text;
 103                 }
 104                 i++;
 105         }
 106         return "Unknown";
 107 }
 108
 109 static void*
 110 port_func(guint16 port) {
 111         int i=0;
 112
 113         while (ports[i].text != NULL) {
 114                 if (ports[i].port == port) {
 115                         return ports[i].func;
 116                 }
 117                 i++;
 118         }
 119         return NULL;
 120 }
 121
 122 char *
 123 ipx_packet_type(u_char val)
 124 {
 125         if (val == 0) {
 126                 return "IPX";
 127         }
 128         else if (val == 5) {
 129                 return "SPX";
 130         }
 131         else if (val == 17) {
 132                 return "NCP";
 133         }
 134         else if (val == 20) {
 135                 return "NetBIOS Broadcast";
 136         }
 137         else if (val >= 16 && val <= 31) {
 138                 return "Experimental Protocol";
 139         }
 140         else {
 141                 return "Unknown";
 142         }
 143 }
 144
 145 gchar*
 146 ipxnet_to_string(const guint8 *ad)
 147 {
 148         static gchar    str[3][12];
 149         static gchar    *cur;
 150
 151         if (cur == &str[0][0]) {
 152                 cur = &str[1][0];
 153         } else if (cur == &str[1][0]) {
 154                 cur = &str[2][0];
 155         } else {
 156                 cur = &str[0][0];
 157         }
 158
 159         sprintf(cur, "%02X %02X %02X %02X", ad[0], ad[1], ad[2], ad[3]);
 160         return cur;
 161 }
 162
 163 gchar*
 164 ipx_addr_to_str(guint32 net, const guint8 *ad)
 165 {
 166         static gchar    str[3][22];
 167         static gchar    *cur;
 168
 169         if (cur == &str[0][0]) {
 170                 cur = &str[1][0];
 171         } else if (cur == &str[1][0]) {
 172                 cur = &str[2][0];
 173         } else {
 174                 cur = &str[0][0];
 175         }
 176
 177         sprintf(cur, "%X.%02x%02x%02x%02x%02x%02x", net,
 178                 ad[0], ad[1], ad[2], ad[3], ad[4], ad[5]);
 179         return cur;
 180 }
 181
 182 void
 183 dissect_ipx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 184
 185         proto_tree      *ipx_tree;
 186         proto_item      *ti;
 187         guint8          ipx_type, ipx_hops;
 188         guint16         ipx_checksum, ipx_length;
 189         guint8          *ipx_snode, *ipx_dnode, *ipx_snet, *ipx_dnet;
 190
 191         gchar           *str_dnet, *str_snet;
 192         guint16         ipx_dsocket, ipx_ssocket;
 193         void            (*dissect) (const u_char *, int, frame_data *, proto_tree *, int);
 194         int             max_data;
 195
 196         /* Calculate here for use in pinfo and in tree */
 197         ipx_dnet = (guint8*)&pd[offset+6];
 198         ipx_snet = (guint8*)&pd[offset+18];
 199         str_dnet = ipxnet_to_string(ipx_dnet);
 200         str_snet = ipxnet_to_string(ipx_snet);
 201         ipx_dsocket = pntohs(&pd[offset+16]);
 202         ipx_ssocket = pntohs(&pd[offset+28]);
 203         ipx_dnode = (guint8*)&pd[offset+10];
 204         ipx_snode = (guint8*)&pd[offset+22];
 205         ipx_type = pd[offset+5];
 206         ipx_length = pntohs(&pd[offset+2]);
 207         max_data = ipx_length - 30;
 208
 209         if (check_col(fd, COL_RES_DL_DST))
 210                 col_add_str(fd, COL_RES_DL_DST,
 211                                 ipx_addr_to_str(pntohl(ipx_dnet), ipx_dnode));
 212         if (check_col(fd, COL_RES_DL_SRC))
 213                 col_add_str(fd, COL_RES_DL_SRC,
 214                                 ipx_addr_to_str(pntohl(ipx_snet), ipx_snode));
 215
 216         if (check_col(fd, COL_PROTOCOL))
 217                 col_add_str(fd, COL_PROTOCOL, "IPX");
 218         if (check_col(fd, COL_INFO))
 219                 col_add_fstr(fd, COL_INFO, "%s (0x%04X)", port_text(ipx_dsocket),
 220                                 ipx_dsocket);
 221
 222         if (tree) {
 223                 ipx_checksum = pntohs(&pd[offset]);
 224                 ipx_hops = pd[offset+4];
 225
 226                 ti = proto_tree_add_item(tree, offset, 30,
 227                         "Internetwork Packet Exchange");
 228                 ipx_tree = proto_tree_new();
 229                 proto_item_add_subtree(ti, ipx_tree, ETT_IPX);
 230                 proto_tree_add_item(ipx_tree, offset,      2, "Checksum: 0x%04x",
 231                                 ipx_checksum);
 232                 proto_tree_add_item(ipx_tree, offset+2,    2, "Length: %d bytes",
 233                                 ipx_length);
 234                 proto_tree_add_item(ipx_tree, offset+4,    1, "Transport Control: %d hops",
 235                                 ipx_hops);
 236                 proto_tree_add_item(ipx_tree, offset+5,    1, "Packet Type: %s",
 237                         ipx_packet_type(ipx_type));
 238                 proto_tree_add_item(ipx_tree, offset+6,    4, "Destination Network: %s",
 239                         str_dnet);
 240                 proto_tree_add_item(ipx_tree, offset+10,   6, "Destination Node: %s",
 241                         ether_to_str(ipx_dnode));
 242                 proto_tree_add_item(ipx_tree, offset+16,   2,
 243                         "Destination Socket: %s (0x%04X)", port_text(ipx_dsocket),
 244                         ipx_dsocket);
 245                 proto_tree_add_item(ipx_tree, offset+18,   4, "Source Network: %s",
 246                         str_snet);
 247                 proto_tree_add_item(ipx_tree, offset+22,   6, "Source Node: %s",
 248                         ether_to_str(ipx_snode));
 249                 proto_tree_add_item(ipx_tree, offset+28,   2,
 250                         "Source Socket: %s (0x%04X)", port_text(ipx_ssocket), ipx_ssocket);
 251         }
 252         offset += 30;
 253
 254         switch (ipx_type) {
 255                 case 5: /* SPX */
 256                         dissect_spx(pd, offset, fd, tree, max_data);
 257                         break;
 258
 259                 case 17: /* NCP */
 260                         if (pntohl(ipx_dnode) == 0 && pntohs(ipx_dnode + 4) == 1)
 261                                 nw_server_address = pntohl(ipx_dnet);
 262                         else if (pntohl(ipx_snode) == 0 && pntohs(ipx_snode + 4) == 1)
 263                                 nw_server_address = pntohl(ipx_snet);
 264                         else
 265                                 nw_server_address = 0;
 266
 267                         dissect_ncp(pd, offset, fd, tree, max_data);
 268                         break;
 269
 270                 case 20: /* NetBIOS */
 271                         if (ipx_dsocket == 0x0455) {
 272                                 dissect_nbipx_ns(pd, offset, fd, tree, max_data);
 273                                 break;
 274                         }
 275                         /* else fall through */
 276
 277                 case 0: /* IPX, fall through to default */
 278                 default:
 279                         dissect = port_func(ipx_dsocket);
 280                         if (dissect) {
 281                                 dissect(pd, offset, fd, tree, max_data);
 282                         }
 283                         else {
 284                                 dissect = port_func(ipx_ssocket);
 285                                 if (dissect) {
 286                                         dissect(pd, offset, fd, tree, max_data);
 287                                 }
 288                                 else {
 289                                         dissect_data(pd, offset, fd, tree);
 290                                 }
 291                         }
 292                         break;
 293         }
 294 }
 295
 296
 297 /* ================================================================= */
 298 /* SPX                                                               */
 299 /* ================================================================= */
 300 static char*
 301 spx_conn_ctrl(u_char ctrl)
 302 {
 303         int i=0;
 304
 305         static struct conn_info conns[] = {
 306                 { 0x10, "End-of-Message" },
 307                 { 0x20, "Attention" },
 308                 { 0x40, "Acknowledgment Required"},
 309                 { 0x80, "System Packet"}
 310         };
 311
 312         while (conns[i].text != NULL) {
 313                 if (conns[i].ctrl == ctrl) {
 314                         return conns[i].text;
 315                 }
 316                 i++;
 317         }
 318         return "Unknown";
 319 }
 320
 321 static char*
 322 spx_datastream(u_char type)
 323 {
 324         switch (type) {
 325                 case 0xfe:
 326                         return "End-of-Connection";
 327                 case 0xff:
 328                         return "End-of-Connection Acknowledgment";
 329                 default:
 330                         return "Client-Defined";
 331         }
 332 }
 333
 334 static void
 335 dissect_spx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int
 336         max_data) {
 337
 338         proto_tree      *spx_tree;
 339         proto_item      *ti;
 340
 341         if (check_col(fd, COL_PROTOCOL))
 342                 col_add_str(fd, COL_PROTOCOL, "SPX");
 343         if (check_col(fd, COL_INFO))
 344                 col_add_str(fd, COL_INFO, "SPX");
 345
 346         if (tree) {
 347                 ti = proto_tree_add_item(tree, offset, 12, "Sequenced Packet Exchange");
 348                 spx_tree = proto_tree_new();
 349                 proto_item_add_subtree(ti, spx_tree, ETT_SPX);
 350
 351                 proto_tree_add_item(spx_tree, offset,      1,
 352                         "Connection Control: %s (0x%02X)",
 353                         spx_conn_ctrl(pd[offset]), pd[offset]);
 354
 355                 proto_tree_add_item(spx_tree, offset+1,     1,
 356                         "Datastream Type: %s (0x%02X)",
 357                         spx_datastream(pd[offset+1]), pd[offset+1]);
 358
 359                 proto_tree_add_item(spx_tree, offset+2,     2,
 360                         "Source Connection ID: %d", pntohs( &pd[offset+2] ) );
 361
 362                 proto_tree_add_item(spx_tree, offset+4,     2,
 363                         "Destination Connection ID: %d", pntohs( &pd[offset+4] ) );
 364
 365                 proto_tree_add_item(spx_tree, offset+6,     2,
 366                         "Sequence Number: %d", pntohs( &pd[offset+6] ) );
 367
 368                 proto_tree_add_item(spx_tree, offset+8,     2,
 369                         "Acknowledgment Number: %d", pntohs( &pd[offset+8] ) );
 370
 371                 proto_tree_add_item(spx_tree, offset+10,     2,
 372                         "Allocation Number: %d", pntohs( &pd[offset+10] ) );
 373
 374                 offset += 12;
 375                 dissect_data(pd, offset, fd, tree);
 376         }
 377 }
 378
 379 /* ================================================================= */
 380 /* IPX RIP                                                           */
 381 /* ================================================================= */
 382 static void
 383 dissect_ipxrip(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,
 384         int max_data) {
 385
 386         proto_tree      *rip_tree;
 387         proto_item      *ti;
 388         guint16         operation;
 389         struct ipx_rt_def route;
 390         int                     cursor;
 391
 392         char            *rip_type[2] = { "Request", "Response" };
 393
 394         operation = pntohs(&pd[offset]) - 1;
 395
 396         if (check_col(fd, COL_PROTOCOL))
 397          col_add_str(fd, COL_PROTOCOL, "IPX RIP");
 398         if (check_col(fd, COL_PROTOCOL)) {
 399          if (operation < 2) {
 400                  col_add_str(fd, COL_INFO, rip_type[operation]);
 401          }
 402          else {
 403                  col_add_str(fd, COL_INFO, "Unknown Packet Type");
 404          }
 405         }
 406
 407         if (tree) {
 408                 ti = proto_tree_add_item(tree, offset, END_OF_FRAME,
 409                         "IPX Routing Information Protocol");
 410                 rip_tree = proto_tree_new();
 411                 proto_item_add_subtree(ti, rip_tree, ETT_IPXRIP);
 412
 413                 if (operation < 2) {
 414                         proto_tree_add_item(rip_tree, offset, 2,
 415                         "RIP packet type: %s", rip_type[operation]);
 416                 }
 417                 else {
 418                         proto_tree_add_item(rip_tree, offset, 2, "Unknown RIP packet type");
 419                 }
 420
 421                 for (cursor = offset + 2; cursor < fd->cap_len; cursor += 8) {
 422                         memcpy(&route.network, &pd[cursor], 4);
 423                         route.hops = pntohs(&pd[cursor+4]);
 424                         route.ticks = pntohs(&pd[cursor+6]);
 425
 426                         if (operation == IPX_RIP_REQUEST - 1) {
 427                                 proto_tree_add_item(rip_tree, cursor,      8,
 428                                         "Route Vector: %s, %d hop%s, %d tick%s",
 429                                         ipxnet_to_string((guint8*)&route.network),
 430                                         route.hops,  route.hops  == 1 ? "" : "s",
 431                                         route.ticks, route.ticks == 1 ? "" : "s");
 432                         }
 433                         else {
 434                                 proto_tree_add_item(rip_tree, cursor,      8,
 435                                         "Route Vector: %s, %d hop%s, %d tick%s (%d ms)",
 436                                         ipxnet_to_string((guint8*)&route.network),
 437                                         route.hops,  route.hops  == 1 ? "" : "s",
 438                                         route.ticks, route.ticks == 1 ? "" : "s",
 439                                         route.ticks * 1000 / 18);
 440                         }
 441                 }
 442         }
 443 }
 444
 445
 446
 447 /* ================================================================= */
 448 /* SAP                                                                                                                           */
 449 /* ================================================================= */
 450 static char*
 451 server_type(guint16 type)
 452 {
 453         int i=0;
 454
 455         /* some of these are from ncpfs, others are from the book */
 456         static struct server_info       servers[] = {
 457                 { 0x0001,       "User" },
 458                 { 0x0002,       "User Group" },
 459                 { 0x0003,       "Print Queue" },
 460                 { 0x0004,       "File server" },
 461                 { 0x0005,       "Job server" },
 462                 { 0x0007,       "Print server" },
 463                 { 0x0008,       "Archive server" },
 464                 { 0x0009,       "Archive server" },
 465                 { 0x000a,       "Job queue" },
 466                 { 0x000b,       "Administration" },
 467                 { 0x0021,       "NAS SNA gateway" },
 468                 { 0x0024,       "Remote bridge" },
 469                 { 0x0026,       "Bridge server" },
 470                 { 0x0027,       "TCP/IP gateway" },
 471                 { 0x002d,       "Time Synchronization VAP" },
 472                 { 0x002e,       "Archive Server Dynamic SAP" },
 473                 { 0x0047,       "Advertising print server" },
 474                 { 0x004b,       "Btrieve VAP 5.0" },
 475                 { 0x004c,       "SQL VAP" },
 476                 { 0x0050,       "Btrieve VAP" },
 477                 { 0x0053,       "Print Queue VAP" },
 478                 { 0x007a,       "TES NetWare for VMS" },
 479                 { 0x0098,       "NetWare access server" },
 480                 { 0x009a,       "Named Pipes server" },
 481                 { 0x009e,       "Portable NetWare Unix" },
 482                 { 0x0107,       "NetWare 386" },
 483                 { 0x0111,       "Test server" },
 484                 { 0x0133,       "NetWare Name Service" },
 485                 { 0x0166,       "NetWare management" },
 486                 { 0x026a,       "NetWare management" },
 487                 { 0x026b,       "Time synchronization" },
 488                 { 0x0278,       "NetWare Directory server" },
 489                 { 0x055d,       "Attachmate SNA gateway" },
 490                 { 0x0000,       NULL }
 491         };
 492
 493         while (servers[i].text != NULL) {
 494                 if (servers[i].type == type) {
 495                         return servers[i].text;
 496                 }
 497                 i++;
 498         }
 499         return "Unknown";
 500 }
 501
 502 static void
 503 dissect_sap(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,
 504         int max_data) {
 505
 506         proto_tree      *sap_tree, *s_tree;
 507         proto_item      *ti;
 508         int                     cursor;
 509         struct sap_query query;
 510         struct sap_server_ident server;
 511
 512         char            *sap_type[4] = { "General Query", "General Response",
 513                 "Nearest Query", "Nearest Response" };
 514
 515         query.query_type = pntohs(&pd[offset]);
 516         query.server_type = pntohs(&pd[offset+2]);
 517
 518         if (check_col(fd, COL_PROTOCOL))
 519                 col_add_str(fd, COL_PROTOCOL, "SAP");
 520         if (check_col(fd, COL_INFO)) {
 521                 if (query.query_type < 4) {
 522                         col_add_str(fd, COL_INFO, sap_type[query.query_type - 1]);
 523                 }
 524                 else {
 525                         col_add_str(fd, COL_INFO, "Unknown Packet Type");
 526                 }
 527         }
 528
 529         if (tree) {
 530                 ti = proto_tree_add_item(tree, offset, END_OF_FRAME,
 531                         "Service Advertising Protocol");
 532                 sap_tree = proto_tree_new();
 533                 proto_item_add_subtree(ti, sap_tree, ETT_IPXSAP);
 534
 535                 if (query.query_type < 4) {
 536                         proto_tree_add_item(sap_tree, offset, 2, sap_type[query.query_type - 1]);
 537                 }
 538                 else {
 539                         proto_tree_add_item(sap_tree, offset, 2,
 540                                         "Unknown SAP Packet Type %d", query.query_type);
 541                 }
 542
 543                 if (query.query_type == IPX_SAP_GENERAL_RESPONSE ||
 544                                 query.query_type == IPX_SAP_NEAREST_RESPONSE) { /* responses */
 545
 546                         for (cursor = offset + 2; (cursor + 64) <= fd->cap_len; cursor += 64) {
 547                                 server.server_type = pntohs(&pd[cursor]);
 548                                 memcpy(server.server_name, &pd[cursor+2], 48);
 549                                 memcpy(&server.server_network, &pd[cursor+50], 4);
 550                                 memcpy(&server.server_node, &pd[cursor+54], 6);
 551                                 server.server_port = pntohs(&pd[cursor+60]);
 552                                 server.intermediate_network = pntohs(&pd[cursor+62]);
 553
 554                                 ti = proto_tree_add_item(sap_tree, cursor+2, 48,
 555                                         "Server Name: %s", server.server_name);
 556                                 s_tree = proto_tree_new();
 557                                 proto_item_add_subtree(ti, s_tree, ETT_IPXSAP_SERVER);
 558
 559                                 proto_tree_add_item(s_tree, cursor, 2, "Server Type: %s (0x%04X)",
 560                                                 server_type(server.server_type), server.server_type);
 561                                 proto_tree_add_item(s_tree, cursor+50, 4, "Network: %s",
 562                                                 ipxnet_to_string((guint8*)&pd[cursor+50]));
 563                                 proto_tree_add_item(s_tree, cursor+54, 6, "Node: %s",
 564                                                 ether_to_str((guint8*)&pd[cursor+54]));
 565                                 proto_tree_add_item(s_tree, cursor+60, 2, "Socket: %s (0x%04X)",
 566                                                 port_text(server.server_port), server.server_port);
 567                                 proto_tree_add_item(s_tree, cursor+62, 2,
 568                                                 "Intermediate Networks: %d",
 569                                                 server.intermediate_network);
 570                         }
 571                 }
 572                 else {  /* queries */
 573                         proto_tree_add_item(sap_tree, offset+2, 2, "Server Type: %s (0x%04X)",
 574                                         server_type(query.server_type), query.server_type);
 575                 }
 576         }
 577 }
 578