packet-socks.c

   1 /* packet-socks.c
   2  * Routines for socks versions 4 &5  packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * $Id: packet-socks.c,v 1.8 2000/08/07 03:21:12 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@zing.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  *
  26  *
  27  * The Version 4 decode is based on SOCKS4.protocol and SOCKS4A.protocol.
  28  * The Version 5 decoder is based upon rfc-1928
  29  * The Version 5 User/Password authentication is based on rfc-1929.
  30  *
  31  * See http://www.socks.nec.com/socksprot.html for these and other documents
  32  *
  33  */
  34
  35 /* Possible enhancements -
  36  *
  37  * Add GSS-API authentication per rfc-1961
  38  * Add CHAP authentication
  39  * Decode FLAG bits per
  40  *       http://www.socks.nec.com/draft/draft-ietf-aft-socks-pro-v-04.txt
  41  * In call_next_dissector, could load the destination address into the
  42  *      pi structure before calling next dissector.
  43  * remove display_string or at least make it use protocol identifiers
  44  * socks_hash_entry_t needs to handle V5 address type and domain names
  45 */
  46
  47
  48
  49
  50 #ifdef HAVE_CONFIG_H
  51 # include "config.h"
  52 #endif
  53
  54
  55 #ifdef HAVE_SYS_TYPES_H
  56 # include <sys/types.h>
  57 #endif
  58
  59 #ifdef HAVE_NETINET_IN_H
  60 # include <netinet/in.h>
  61 #endif
  62
  63 #include <stdio.h>
  64 #include <string.h>
  65 #include <glib.h>
  66 #include "packet.h"
  67 #include "resolv.h"
  68 #include "globals.h"
  69 #include "alignment.h"
  70 #include "conversation.h"
  71
  72 #include "packet-tcp.h"
  73 #include "packet-udp.h"
  74
  75 #ifdef NEED_SNPRINTF_H
  76 # ifdef HAVE_STDARG_H
  77 #  include <stdarg.h>
  78 # else
  79 #  include <varargs.h>
  80 # endif
  81 # include "snprintf.h"
  82 #endif
  83
  84
  85
  86 #define CHECK_PACKET_LENGTH(X) if (!BYTES_ARE_IN_FRAME(offset, X)){  \
  87         proto_tree_add_text(tree, NullTVB, offset, 0, "*** FRAME TOO SHORT ***"); \
  88         return; }
  89
  90 #define compare_packet(X) (X == (fd->num))
  91 #define get_packet_ptr  (fd->num)
  92 #define row_pointer_type guint32
  93
  94 #define TCP_PORT_SOCKS 1080
  95
  96
  97 /**************** Socks commands ******************/
  98
  99 #define CONNECT_COMMAND         1
 100 #define BIND_COMMAND            2
 101 #define UDP_ASSOCIATE_COMMAND   3
 102 #define PING_COMMAND            0x80
 103 #define TRACERT_COMMAND         0x81
 104
 105
 106 /********** V5 Authentication methods *************/
 107
 108 #define NO_AUTHENTICATION       0
 109 #define GSS_API_AUTHENTICATION  1
 110 #define USER_NAME_AUTHENTICATION        2
 111 #define CHAP_AUTHENTICATION     3
 112 #define AUTHENTICATION_FAILED   0xff
 113
 114
 115 /*********** Header field identifiers *************/
 116
 117 static int proto_socks = -1;
 118
 119 static int ett_socks = -1;
 120 static int ett_socks_auth = -1;
 121 static int ett_socks_name = -1;
 122
 123 static int hf_socks_ver = -1;
 124 static int hf_socks_ip_dst = -1;
 125 static int hf_socks_ip6_dst = -1;
 126 static int hf_user_name = -1;
 127 static int hf_socks_dstport = -1;
 128 static int hf_socks_command = -1;
 129
 130
 131 /************* State Machine names ***********/
 132
 133 enum SockState {
 134         None = 0,
 135         Connecting,
 136         V4UserNameWait,
 137         V4NameWait,
 138         V5Command,
 139         V5Reply,
 140         V5BindReply,
 141         UserNameAuth,
 142         GssApiAuth,
 143         AuthReply,
 144         Done
 145 };
 146
 147
 148
 149 typedef struct {
 150         int     state;
 151         int     version;
 152         int     command;
 153         int     grant;
 154         gint32  port;
 155         gint32  udp_port;
 156         gint32  udp_remote_port;
 157
 158         int     connect_offset;
 159         row_pointer_type        v4_name_row;
 160         row_pointer_type        v4_user_name_row;
 161         row_pointer_type        connect_row;
 162         row_pointer_type        cmd_reply_row;
 163         row_pointer_type        bind_reply_row;
 164         row_pointer_type        command_row;
 165         row_pointer_type        auth_method_row;
 166         row_pointer_type        user_name_auth_row;
 167         guint32 start_done_row;
 168
 169         guint32 dst_addr;       /* this needs to handle IPv6 */
 170 }socks_hash_entry_t;
 171
 172
 173
 174
 175 static char *address_type_table[] = {
 176         "Unknown",
 177         "IPv4",
 178         "Unknown",
 179         "Domain Name",
 180         "IPv6",
 181         "Unknown"
 182 };
 183
 184
 185 /* String table for the V4 reply status messages */
 186
 187 static char *reply_table_v4[] = {
 188         "Granted",
 189         "Rejected or Failed",
 190         "Rejected because SOCKS server cannot connect to identd on the client",
 191         "Rejected because the client program and identd report different user-ids",
 192         "Unknown"
 193 };
 194
 195
 196 /* String table for the V5 reply status messages */
 197
 198 static char *reply_table_v5[] = {
 199         "Succeeded",
 200         "General SOCKS server failure",
 201         "Connection not allowed by ruleset",
 202         "Network unreachable",
 203         "Host unreachable",
 204         "Connection refused",
 205         "TTL expired",
 206         "Command not supported",
 207         "Address type not supported",
 208         "Unknown"
 209 };
 210
 211
 212 #define socks_hash_init_count 20
 213 #define socks_hash_val_length (sizeof(socks_hash_entry_t))
 214
 215 static GMemChunk *socks_vals = NULL;
 216
 217
 218 /************************* Support routines ***************************/
 219
 220
 221 static int display_string( const u_char *pd, int offset, frame_data *fd,
 222         proto_tree *tree, char *label){
 223
 224 /* display a string with a length, characters encoding */
 225 /* they are displayed under a tree with the name in Label variable */
 226 /* return the length of the string and the length byte */
 227
 228
 229         proto_tree      *name_tree;
 230         proto_item      *ti;
 231
 232
 233         char temp[ 256];
 234         int length = GBYTE( pd, offset);
 235
 236         if (!BYTES_ARE_IN_FRAME(offset, 8)){
 237                 proto_tree_add_text(tree, NullTVB, offset, 0, "*** FRAME TOO SHORT ***");
 238                 return 0;
 239         }
 240
 241         strncpy( temp, &pd[ offset + 1], length);
 242         temp[ length ] = 0;
 243
 244         ti = proto_tree_add_text(tree, NullTVB, offset, length + 1,
 245                 "%s: %s" , label, temp);
 246
 247
 248         name_tree = proto_item_add_subtree(ti, ett_socks_name);
 249
 250         proto_tree_add_text( name_tree, NullTVB, offset, 1, "Length: %d", length);
 251
 252         ++offset;
 253
 254         proto_tree_add_text( name_tree, NullTVB, offset, length, "String: %s", temp);
 255
 256         return length + 1;
 257 }
 258
 259
 260
 261 static char *get_auth_method_name( guint Number){
 262
 263 /* return the name of the authenication method */
 264
 265         if ( Number == 0) return "No authentication";
 266         if ( Number == 1) return "GSSAPI";
 267         if ( Number == 2) return "Username/Password";
 268         if ( Number == 3) return "Chap";
 269         if (( Number >= 4) && ( Number <= 0x7f))return "IANA assigned";
 270         if (( Number >= 0x80) && ( Number <= 0xfe)) return "private method";
 271         if ( Number == 0xff) return "no acceptable method";
 272
 273         /* shouldn't reach here */
 274
 275         return "Bad method number (not 0-0xff)";
 276 }
 277
 278
 279 static char *get_command_name( guint Number){
 280
 281 /* return the name of the command as a string */
 282
 283         if ( Number == 0) return "Unknow";
 284         if ( Number == 1) return "Connect";
 285         if ( Number == 2) return "Bind";
 286         if ( Number == 3) return "UdpAssociate";
 287         if ( Number == 0x80) return "Ping";
 288         if ( Number == 0x81) return "Traceroute";
 289         return "Unknown";
 290 }
 291
 292
 293 static int display_address( const u_char *pd, int offset,
 294                 frame_data *fd, proto_tree *tree) {
 295
 296 /* decode and display the v5 address, return offset of next byte */
 297
 298         int a_type = GBYTE( pd, offset);
 299
 300         proto_tree_add_text( tree, NullTVB, offset, 1,
 301                         "Address Type: %d (%s)", a_type,
 302                         address_type_table[ MAX( 0, MIN( a_type,
 303                                 array_length( address_type_table)-1))]);
 304
 305         ++offset;
 306
 307         if ( a_type == 1){              /* IPv4 address */
 308                 if (!BYTES_ARE_IN_FRAME(offset, 4))
 309                         proto_tree_add_text(tree, NullTVB, offset, 0, "*** FRAME TOO SHORT ***");
 310
 311                 proto_tree_add_ipv4( tree, hf_socks_ip_dst, NullTVB, offset,
 312                                         4, GWORD( pd, offset));
 313                 offset += 4;
 314         }
 315         else if ( a_type == 3){ /* domain name address */
 316
 317                 offset += display_string( pd, offset, fd, tree,
 318                         "Remote name");
 319         }
 320         else if ( a_type == 4){ /* IPv6 address */
 321                 if (!BYTES_ARE_IN_FRAME(offset, 16))
 322                         proto_tree_add_text(tree, NullTVB, offset, 0, "*** FRAME TOO SHORT ***");
 323
 324                 proto_tree_add_ipv6( tree, hf_socks_ip6_dst, NullTVB, offset,
 325                                 4, &pd[offset]);
 326                 offset += 16;
 327         }
 328
 329         return offset;
 330 }
 331
 332
 333 static int get_address_v5( const u_char *pd, int offset,
 334         socks_hash_entry_t *hash_info) {
 335
 336 /* decode the v5 address and return offset of next byte */
 337 /*$$$ this needs to handle IPV6 and domain name addresses */
 338
 339
 340         int a_type = GBYTE( pd, offset++);
 341
 342         if ( a_type == 1){              /* IPv4 address */
 343
 344                 if ( hash_info)
 345                         hash_info->dst_addr = GWORD( pd, offset);
 346                 offset += 4;
 347         }
 348
 349         else if ( a_type == 4)          /* IPv6 address */
 350                 offset += 16;
 351
 352         else if ( a_type == 3)  /* domain name address */
 353                 offset += GBYTE( pd, offset) + 1;
 354
 355         return offset;
 356 }
 357
 358
 359 /********************* V5 UDP Associate handlers ***********************/
 360
 361 static void socks_udp_dissector( const u_char *pd, int offset, frame_data *fd,
 362                 proto_tree *tree) {
 363
 364 /* Conversation dissector called from UDP dissector. Decode and display */
 365 /* the socks header, the pass the rest of the data to the udp port      */
 366 /* decode routine to  handle the payload.                               */
 367
 368         guint32 *ptr;
 369         socks_hash_entry_t *hash_info;
 370         conversation_t *conversation;
 371         proto_tree      *socks_tree;
 372         proto_item      *ti;
 373
 374         conversation = find_conversation( &pi.src, &pi.dst, pi.ptype,
 375                 pi.srcport, pi.destport);
 376
 377         g_assert( conversation);        /* should always find a conversation */
 378
 379         hash_info = (socks_hash_entry_t*)conversation->data;
 380
 381         if (check_col(fd, COL_PROTOCOL))
 382                 col_add_str(fd, COL_PROTOCOL, "Socks");
 383
 384         if (check_col(fd, COL_INFO))
 385                 col_add_fstr(fd, COL_INFO, "Version: 5, UDP Associated packet");
 386
 387         if ( tree) {
 388                 ti = proto_tree_add_protocol_format( tree, proto_socks, NullTVB, offset,
 389                         END_OF_FRAME, "Socks" );
 390
 391                 socks_tree = proto_item_add_subtree(ti, ett_socks);
 392
 393                 CHECK_PACKET_LENGTH( 3);
 394
 395                 proto_tree_add_text( socks_tree, NullTVB, offset, 2, "Reserved");
 396                 offset += 2;
 397
 398                 proto_tree_add_text( socks_tree, NullTVB, offset, 1, "Fragment Number: %d", GBYTE( pd,offset));
 399                 ++offset;
 400
 401
 402                 offset = display_address( pd, offset, fd, socks_tree);
 403                 hash_info->udp_remote_port = pntohs( &pd[ offset]);
 404
 405                 CHECK_PACKET_LENGTH( 2);
 406                 proto_tree_add_uint( socks_tree, hf_socks_dstport, NullTVB,
 407                         offset, 2, hash_info->udp_remote_port);
 408
 409                 offset += 2;
 410         }
 411         else {          /* no tree, skip past the socks header */
 412                 CHECK_PACKET_LENGTH( 3);
 413                 offset += 3;
 414                 offset = get_address_v5( pd,offset, 0) + 2;
 415         }
 416
 417
 418 /* set pi src/dst port and call the udp sub-dissector lookup */
 419
 420         if ( pi.srcport == hash_info->port)
 421                 ptr = &pi.destport;
 422         else
 423                 ptr = &pi.srcport;
 424
 425         *ptr = hash_info->udp_remote_port;
 426
 427         decode_udp_ports( pd, offset, fd, tree, pi.srcport, pi.destport);
 428
 429         *ptr = hash_info->udp_port;
 430
 431 }
 432
 433
 434 void new_udp_conversation( socks_hash_entry_t *hash_info){
 435
 436         conversation_t *conversation = conversation_new( &pi.src, &pi.dst,  PT_UDP,
 437                         hash_info->udp_port, hash_info->port, hash_info);
 438
 439         g_assert( conversation);
 440
 441         conversation->is_old_dissector = TRUE;
 442         conversation->dissector.old = socks_udp_dissector;
 443 }
 444
 445
 446
 447
 448 /**************** Protocol Tree Display routines  ******************/
 449
 450
 451 void display_socks_v4( const u_char *pd, int offset, frame_data *fd,
 452         proto_tree *parent, proto_tree *tree, socks_hash_entry_t *hash_info) {
 453
 454
 455 /* Display the protocol tree for the V5 version. This routine uses the  */
 456 /* stored conversation information to decide what to do with the row.   */
 457 /* Per packet information would have been better to do this, but we     */
 458 /* didn't have that when I wrote this. And I didn't expect this to get  */
 459 /* so messy.                                                            */
 460
 461
 462         int command;
 463
 464                                         /* Display command from client */
 465         if (compare_packet( hash_info->connect_row)){
 466
 467                 CHECK_PACKET_LENGTH( 8);
 468                 proto_tree_add_text( tree, NullTVB, offset, 1,
 469                                 "Version: %u ", hash_info->version);
 470                 ++offset;
 471                 command = GBYTE( pd, offset);
 472
 473                 proto_tree_add_text( tree, NullTVB, offset, 1,
 474                         "Command: %u (%s)", command,
 475                                 get_command_name( command));
 476                 ++offset;
 477
 478                                                 /* Do remote port       */
 479                 proto_tree_add_uint( tree, hf_socks_dstport, NullTVB, offset, 2,
 480                                 pntohs( &pd[ offset]));
 481                 offset += 2;
 482
 483                                                 /* Do destination address */
 484                 proto_tree_add_ipv4( tree, hf_socks_ip_dst, NullTVB, offset,
 485                                 4, GWORD( pd, offset));
 486
 487                 offset += 4;
 488
 489 /*$$ check this, needs to do length checking     */
 490                                                 /* display user name    */
 491                         proto_tree_add_string( tree, hf_user_name, NullTVB, offset,
 492                                 strlen( &pd[offset]) + 1,
 493                                 &pd[offset]);
 494
 495         }
 496                                 /*Display command response from server*/
 497
 498         else if ( compare_packet( hash_info->cmd_reply_row)){
 499
 500                 CHECK_PACKET_LENGTH( 8);
 501                 proto_tree_add_text( tree, NullTVB, offset, 1,
 502                         "Version: %u (should be 0) ", GBYTE( pd, offset));
 503                 ++offset;
 504                                                 /* Do results code      */
 505                 proto_tree_add_text( tree, NullTVB, offset, 1,
 506                         "Result Code: %u (%s)", GBYTE( pd, offset) ,
 507                         reply_table_v4[ MAX(0, MIN( GBYTE( pd, offset) - 90, 4))]);
 508                 ++offset;
 509
 510                                                 /* Do remote port       */
 511                 proto_tree_add_uint( tree, hf_socks_dstport, NullTVB, offset, 2,
 512                                 pntohs( &pd[ offset]));
 513                 offset += 2;;
 514                                                 /* Do remote address    */
 515                 proto_tree_add_ipv4( tree, hf_socks_ip_dst, NullTVB, offset, 4,
 516                         GWORD( pd, offset));
 517         }
 518
 519         else if ( compare_packet( hash_info->v4_user_name_row)){
 520
 521 /*$$ check this, needs to do length checking     */
 522                 proto_tree_add_text( tree, NullTVB, offset, strlen( &pd[offset]),
 523                                 "User Name: %s", &pd[offset]);
 524         }
 525 }
 526
 527
 528
 529 void display_socks_v5( const u_char *pd, int offset, frame_data *fd,
 530         proto_tree *parent, proto_tree *tree, socks_hash_entry_t *hash_info) {
 531
 532 /* Display the protocol tree for the version. This routine uses the     */
 533 /* stored conversation information to decide what to do with the row.   */
 534 /* Per packet information would have been better to do this, but we     */
 535 /* didn't have that when I wrote this. And I didn't expect this to get  */
 536 /* so messy.                                                            */
 537
 538         int i, command;
 539         guint temp;
 540         char *AuthMethodStr;
 541
 542
 543         if (compare_packet( hash_info->connect_row)){
 544
 545                 proto_tree      *AuthTree;
 546                 proto_item      *ti;
 547
 548                 CHECK_PACKET_LENGTH( 2);
 549                                                 /* Do version   */
 550                 proto_tree_add_uint( tree, hf_socks_ver, NullTVB, offset, 1,
 551                                 hash_info->version);
 552                 ++offset;
 553
 554                 temp = GBYTE( pd, offset);      /* Get Auth method count */
 555                                                         /* build auth tree */
 556                 ti = proto_tree_add_text( tree, NullTVB, offset, 1,
 557                                 "Client Authentication Methods");
 558
 559                 AuthTree = proto_item_add_subtree(ti, ett_socks_auth);
 560
 561                 proto_tree_add_text( AuthTree, NullTVB, offset, 1,
 562                                 "Count: %u ", temp);
 563                 ++offset;
 564
 565                 CHECK_PACKET_LENGTH( temp);
 566
 567                 for( i = 0; i  < temp; ++i) {
 568
 569                         AuthMethodStr = get_auth_method_name(
 570                                 GBYTE( pd, offset + i));
 571                         proto_tree_add_text( AuthTree, NullTVB, offset + i, 1,
 572                                 "Method[%d]: %u (%s)", i,
 573                                 GBYTE( pd, offset + i), AuthMethodStr);
 574                 }
 575                 return;
 576         }                                       /* Get accepted auth method */
 577         else if (compare_packet( hash_info->auth_method_row)) {
 578
 579                 ++offset;
 580                 CHECK_PACKET_LENGTH( 1);
 581
 582                 proto_tree_add_text( tree, NullTVB, offset, 1,
 583                         "Accepted Auth Method: 0x%0x (%s)", GBYTE( pd, offset),
 584                                 get_auth_method_name( GBYTE( pd, offset)));
 585
 586                 return;
 587         }                                       /* handle user/password auth */
 588         else if (compare_packet( hash_info->user_name_auth_row)) {
 589
 590                 proto_tree_add_text( tree, NullTVB, offset, 1,
 591                                 "Version: %u ", hash_info->version);
 592                 ++offset;
 593                                                 /* process user name    */
 594                 offset += display_string( pd, offset, fd, tree,
 595                                 "User name");
 596                                                 /* process password     */
 597                 offset += display_string( pd, offset, fd, tree,
 598                                 "Password");
 599         }
 600                                         /* command to the server */
 601                                         /* command response from server */
 602         else if ((compare_packet( hash_info->command_row)) ||
 603                  (compare_packet( hash_info->cmd_reply_row)) ||
 604                  (compare_packet( hash_info->bind_reply_row))){
 605
 606                 proto_tree_add_text( tree, NullTVB, offset, 1,
 607                         "Version: %u ", hash_info->version);
 608
 609                 CHECK_PACKET_LENGTH( 1);
 610
 611                 ++offset;
 612
 613                 command = GBYTE( pd, offset);
 614
 615                 if (compare_packet( hash_info->command_row))
 616                         proto_tree_add_text( tree, NullTVB, offset, 1, "Command: %u (%s)",
 617                                 command,  get_command_name( command));
 618                 else
 619                         proto_tree_add_text( tree, NullTVB, offset, 1, "Status: %d (%s)",
 620                                 GBYTE( pd, offset), reply_table_v5[ MAX( 0,
 621                                 MIN(GBYTE( pd, offset) - 90, 9))]);
 622                 ++offset;
 623
 624                 proto_tree_add_text( tree, NullTVB, offset, 1,
 625                         "Reserved: 0x%0x (should = 0x00)", GBYTE( pd, offset));
 626                 ++offset;
 627
 628                 offset = display_address( pd, offset, fd, tree);
 629
 630                 CHECK_PACKET_LENGTH( 2);
 631                                                 /* Do remote port       */
 632                 proto_tree_add_text( tree, NullTVB, offset, 2,
 633                                 "%sPort: %d",
 634                                 (compare_packet( hash_info->bind_reply_row) ?
 635                                         "Remote Host " : ""),
 636                                  pntohs( &pd[ offset]));
 637         }
 638 }
 639
 640
 641
 642 /**************** Decoder State Machines ******************/
 643
 644
 645 static guint state_machine_v4( socks_hash_entry_t *hash_info, const u_char *pd,
 646         int offset, frame_data *fd) {
 647
 648 /* Decode V4 protocol.  This is done on the first pass through the      */
 649 /* list.  Based upon the current state, decode the packet and determine */
 650 /* what the next state should be.  If we had per packet information,    */
 651 /* this would be the place to load them up.                             */
 652
 653         if ( hash_info->state == None) {                /* new connection */
 654
 655                 if (check_col(fd, COL_INFO))
 656                         col_append_str(fd, COL_INFO, " Connect to server request");
 657
 658                 hash_info->state = Connecting;  /* change state         */
 659
 660                 hash_info->command = GBYTE( pd, offset + 1);
 661                                                 /* get remote port      */
 662                 if ( hash_info->command == CONNECT_COMMAND)
 663                         hash_info->port =  pntohs( &pd[ offset + 2]);
 664                                                 /* get remote address   */
 665                 hash_info->dst_addr = GWORD( pd, offset + 4);
 666
 667                                                 /* save the packet pointer */
 668                 hash_info->connect_row = get_packet_ptr;
 669
 670                                                 /* skip past this stuff */
 671                 hash_info->connect_offset = offset + 8;
 672
 673                 offset += 8;
 674
 675                 if ( offset == pi.len)          /* if no user name      */
 676                                                 /* change state         */
 677                         hash_info->state = V4UserNameWait;
 678
 679
 680                 hash_info->connect_offset += strlen( &pd[ offset]) + 1;
 681
 682                 if ( !hash_info->dst_addr){             /* if no dest address */
 683                                                         /* if more data */
 684                         if ( hash_info->connect_offset < pi.len ) {
 685 /*$$$ copy remote name here ??? */
 686                                 hash_info->state = Connecting;
 687                         }
 688                         else
 689                                 hash_info->state = V4NameWait;
 690                                                 }
 691                                                 /* waiting for V4 user name */
 692         }else if ( hash_info->state == V4UserNameWait){
 693
 694                 if (check_col(fd, COL_INFO))
 695                         col_append_str(fd, COL_INFO, " Connect Request (User name)");
 696
 697                 hash_info->v4_user_name_row = get_packet_ptr;
 698 /*$$$ may need to check for domain name here */
 699                 hash_info->state = Connecting;
 700         }
 701                                         /* waiting for V4 domain name   */
 702         else if ( hash_info->state == V4NameWait){
 703
 704                 hash_info->v4_name_row = get_packet_ptr;
 705                 hash_info->state = Connecting;
 706
 707         }
 708         else if ( hash_info->state == Connecting){
 709
 710                 if (check_col(fd, COL_INFO))
 711                         col_append_str(fd, COL_INFO, " Connect Response");
 712
 713                                                 /* save packet pointer  */
 714                 hash_info->cmd_reply_row = get_packet_ptr;
 715                 hash_info->state = Done;                /* change state         */
 716                 offset = offset + 8;
 717         }
 718
 719         return offset;
 720 }
 721
 722
 723
 724 static void state_machine_v5( socks_hash_entry_t *hash_info, const u_char *pd,
 725         int offset, frame_data *fd) {
 726
 727 /* Decode V5 protocol.  This is done on the first pass through the      */
 728 /* list.  Based upon the current state, decode the packet and determine */
 729 /* what the next state should be.  If we had per packet information,    */
 730 /* this would be the place to load them up.                             */
 731
 732
 733         int temp;
 734
 735         if ( hash_info->state == None) {
 736
 737                 if (check_col(fd, COL_INFO))
 738                         col_append_str(fd, COL_INFO, " Connect to server request");
 739
 740                 hash_info->state = Connecting;  /* change state         */
 741                 hash_info->connect_row = get_packet_ptr;
 742
 743                 if (!BYTES_ARE_IN_FRAME(offset, 1)){
 744                         hash_info->state = Done;        /* change state         */
 745                         return;
 746                 }
 747
 748                 temp = GBYTE( pd, offset + 1);
 749                                                 /* skip past auth methods */
 750                 offset = hash_info->connect_offset = offset + 1 + temp;
 751         }
 752         else if ( hash_info->state == Connecting){
 753
 754                 guint AuthMethod = GBYTE( pd, offset + 1);
 755
 756                 if (check_col(fd, COL_INFO))
 757                         col_append_str(fd, COL_INFO, " Connect to server response");
 758
 759                 hash_info->auth_method_row = get_packet_ptr;
 760
 761                 if ( AuthMethod == NO_AUTHENTICATION)
 762                         hash_info->state = V5Command;
 763
 764                 else if ( AuthMethod == USER_NAME_AUTHENTICATION)
 765                         hash_info->state = UserNameAuth;
 766
 767                 else if ( AuthMethod == GSS_API_AUTHENTICATION)
 768 /*$$$ should be this            hash_info->state = GssApiAuth; */
 769                         hash_info->state = Done;
 770
 771                 else    hash_info->state = Done;        /*Auth failed or error*/
 772
 773         }
 774
 775         else if ( hash_info->state == V5Command) {      /* Handle V5 Command */
 776
 777                 guint temp;
 778
 779                 if (!BYTES_ARE_IN_FRAME(offset, 1)){
 780                         hash_info->state = Done;        /* change state         */
 781                         return;
 782                 }
 783
 784                 hash_info->command = GBYTE( pd, offset + 1); /* get command */
 785
 786                 if (check_col(fd, COL_INFO))
 787                         col_append_fstr(fd, COL_INFO, " Command Request - %s",
 788                                 get_command_name(hash_info->command));
 789
 790                 hash_info->state = V5Reply;
 791                 hash_info->command_row = get_packet_ptr;
 792
 793                 offset += 3;                    /* skip to address type */
 794
 795                 offset = get_address_v5( pd, offset, hash_info);
 796
 797                 if (!BYTES_ARE_IN_FRAME(offset, 1)){
 798                         hash_info->state = Done;
 799                         return;
 800                 }
 801                 temp = GBYTE( pd, offset);
 802
 803                 if (( hash_info->command == CONNECT_COMMAND) ||
 804                     ( hash_info->command == UDP_ASSOCIATE_COMMAND))
 805                                                 /* get remote port      */
 806                         hash_info->port =  pntohs( &pd[ offset]);
 807         }
 808
 809         else if ( hash_info->state == V5Reply) {        /* V5 Command Reply */
 810
 811
 812                 if (check_col(fd, COL_INFO))
 813                         col_append_fstr(fd, COL_INFO, " Command Response - %s",
 814                                 get_command_name(hash_info->command));
 815
 816                 hash_info->cmd_reply_row = get_packet_ptr;
 817
 818                 if (( hash_info->command == CONNECT_COMMAND) ||
 819                     (hash_info->command == PING_COMMAND) ||
 820                     (hash_info->command == TRACERT_COMMAND))
 821                         hash_info->state = Done;
 822
 823                 else if ( hash_info->command == BIND_COMMAND)
 824                         hash_info->state = V5BindReply;
 825
 826                 else if ( hash_info->command == UDP_ASSOCIATE_COMMAND){
 827                         offset += 3;            /* skip to address type */
 828                         offset = get_address_v5( pd, offset, hash_info);
 829
 830         /* save server udp port and create upd conversation */
 831                         if (!BYTES_ARE_IN_FRAME(offset, 2)){
 832                                 hash_info->state = Done;
 833                                 return;
 834                         }
 835                         hash_info->udp_port =  pntohs( &pd[ offset]);
 836
 837                         new_udp_conversation( hash_info);
 838
 839 /*$$ may need else statement to handle unknows and generate error message */
 840
 841                 }
 842         }
 843         else if ( hash_info->state == V5BindReply) {    /* V5 Bind Second Reply */
 844
 845                 if (check_col(fd, COL_INFO))
 846                         col_append_str(fd, COL_INFO, " Command Response: Bind remote host info");
 847
 848                 hash_info->bind_reply_row = get_packet_ptr;
 849                 hash_info->state = Done;
 850         }
 851         else if ( hash_info->state == UserNameAuth) {   /* Handle V5 User Auth*/
 852                 if (check_col(fd, COL_INFO))
 853                         col_append_str(fd, COL_INFO,
 854                                 " User authentication response");
 855
 856                 hash_info->user_name_auth_row = get_packet_ptr;
 857                 hash_info->state = AuthReply;
 858
 859         }
 860         else if ( hash_info->state == AuthReply){       /* V5 User Auth reply */
 861                 hash_info->cmd_reply_row = get_packet_ptr;
 862                 if (check_col(fd, COL_INFO))
 863                         col_append_str(fd, COL_INFO, " User authentication reply");
 864                 hash_info->state = V5Command;
 865         }
 866 }
 867
 868
 869
 870 static void display_ping_and_tracert( const u_char *pd, int offset,
 871         frame_data *fd, proto_tree *tree, socks_hash_entry_t *hash_info) {
 872
 873 /* Display the ping/trace_route conversation */
 874
 875
 876         const u_char    *data, *dataend;
 877         const u_char   *lineend, *eol;
 878         int             linelen;
 879
 880                                         /* handle the end command */
 881         if ( pi.destport == TCP_PORT_SOCKS){
 882                 if (check_col(fd, COL_INFO))
 883                         col_append_str(fd, COL_INFO, ", Terminate Request");
 884
 885                 if ( tree)
 886                         proto_tree_add_text(tree, NullTVB, offset, 1,
 887                                 (hash_info->command  == PING_COMMAND) ?
 888                                 "Ping: End command" :
 889                                 "Traceroute: End command");
 890         }
 891         else{           /* display the PING or Traceroute results */
 892                 if (check_col(fd, COL_INFO))
 893                         col_append_str(fd, COL_INFO, ", Results");
 894
 895                 if ( tree){
 896                         proto_tree_add_text(tree, NullTVB, offset, END_OF_FRAME,
 897                                 (hash_info->command  == PING_COMMAND) ?
 898                                 "Ping Results:" :
 899                                 "Traceroute Results");
 900
 901                         data = &pd[offset];
 902                         dataend = data + END_OF_FRAME;
 903
 904                         while (data < dataend) {
 905
 906                                 lineend = find_line_end(data, dataend, &eol);
 907                                 linelen = lineend - data;
 908
 909                                 proto_tree_add_text( tree, NullTVB, offset, linelen,
 910                                         format_text(data, linelen));
 911                                 offset += linelen;
 912                                 data = lineend;
 913                         }
 914                 }
 915         }
 916 }
 917
 918
 919
 920 static void call_next_dissector( const u_char *pd, int offset, frame_data *fd,
 921         proto_tree *tree, socks_hash_entry_t *hash_info) {
 922
 923 /* Display the results for PING and TRACERT extensions or               */
 924 /* Call TCP  dissector for the port that was passed during the          */
 925 /* connect process                                                      */
 926 /* Load pointer to pi.XXXport depending upon the direction, change      */
 927 /* pi port to the remote port, call next dissecotr to decode the        */
 928 /* payload, and restore the pi port after that is done.                 */
 929
 930         guint32 *ptr;
 931
 932         if (( hash_info->command  == PING_COMMAND) ||
 933             ( hash_info->command  == TRACERT_COMMAND))
 934
 935                 display_ping_and_tracert( pd, offset, fd, tree, hash_info);
 936
 937         else {          /* call the tcp port decoder to handle the payload */
 938
 939 /*$$$ may want to load dest address here */
 940
 941                 if ( pi.destport  == TCP_PORT_SOCKS)
 942                         ptr = &pi.destport;
 943                 else
 944                         ptr = &pi.srcport;
 945
 946                 *ptr = hash_info->port;
 947                 decode_tcp_ports( pd, offset, fd, tree, pi.srcport, pi.destport);
 948                 *ptr = TCP_PORT_SOCKS;
 949         }
 950 }
 951
 952
 953
 954 static void
 955 dissect_socks(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 956
 957         proto_tree      *socks_tree;
 958         proto_item      *ti;
 959         socks_hash_entry_t *hash_info;
 960         conversation_t *conversation;
 961
 962
 963         conversation = find_conversation( &pi.src, &pi.dst, pi.ptype,
 964                 pi.srcport, pi.destport);
 965
 966         if ( conversation)                      /* conversation found */
 967                 hash_info = conversation->data;
 968
 969                         /* new conversation create local data structure */
 970         else {
 971                 hash_info = g_mem_chunk_alloc(socks_vals);
 972                 hash_info->start_done_row = G_MAXINT;
 973                 hash_info->state = None;
 974                 hash_info->port = -1;
 975                 hash_info->version = GBYTE( pd, offset); /* get version*/
 976
 977                 if (( hash_info->version != 4) &&       /* error test version */
 978                    ( hash_info->version != 5))
 979                         hash_info->state = Done;
 980
 981                 conversation_new( &pi.src, &pi.dst, pi.ptype,
 982                         pi.srcport, pi.destport, hash_info);
 983         }
 984
 985 /* display summary window information  */
 986
 987         if (check_col(fd, COL_PROTOCOL))
 988                 col_add_str(fd, COL_PROTOCOL, "Socks");
 989
 990         if (check_col(fd, COL_INFO)){
 991                 if (( hash_info->version == 4) || ( hash_info->version == 5)){
 992                         col_add_fstr(fd, COL_INFO, "Version: %d",
 993                                 hash_info->version);
 994                 }
 995                 else                    /* unknown version display error */
 996                         col_add_str(fd, COL_INFO, "Unknown");
 997
 998
 999                 if ( hash_info->command == PING_COMMAND)
1000                         col_append_str(fd, COL_INFO, ", Ping Req");
1001                 if ( hash_info->command == TRACERT_COMMAND)
1002                         col_append_str(fd, COL_INFO, ", Traceroute Req");
1003
1004                 if ( hash_info->port != -1)
1005                         col_append_fstr(fd, COL_INFO, ", Remote Port: %d",
1006                                 hash_info->port);
1007         }
1008
1009
1010 /* run state machine if needed */
1011
1012         if ((hash_info->state != Done) && ( !fd->flags.visited)){
1013
1014                 if ( hash_info->version == 4)
1015                         state_machine_v4( hash_info, pd, offset, fd);
1016
1017                 else if ( hash_info->version == 5)
1018                         state_machine_v5( hash_info, pd, offset, fd);
1019
1020                 if (hash_info->state == Done) {         /* if done now  */
1021                         hash_info->start_done_row = fd->num;
1022                 }
1023         }
1024
1025 /* if proto tree, decode and display */
1026
1027         if (tree) {
1028                 ti = proto_tree_add_item( tree, proto_socks, NullTVB, offset,
1029                         END_OF_FRAME, FALSE );
1030
1031                 socks_tree = proto_item_add_subtree(ti, ett_socks);
1032
1033                 if ( hash_info->version == 4)
1034                         display_socks_v4( pd, offset, fd, tree, socks_tree,
1035                                 hash_info);
1036
1037                 else if ( hash_info->version == 5)
1038                         display_socks_v5( pd, offset, fd, tree, socks_tree,
1039                                 hash_info);
1040
1041                                 /* if past startup, add the faked stuff */
1042                 if ( fd->num >  hash_info->start_done_row){
1043                                                 /*  add info to tree */
1044                         proto_tree_add_text( socks_tree, NullTVB, offset, 0,
1045                                 "Command: %d (%s)", hash_info->command,
1046                                 get_command_name(hash_info->command));
1047
1048                         proto_tree_add_ipv4( socks_tree, hf_socks_ip_dst, NullTVB,
1049                                         offset, 0, hash_info->dst_addr);
1050
1051                                 /* no fake address for ping & traceroute */
1052
1053                         if (( hash_info->command != PING_COMMAND) &&
1054                             ( hash_info->command != TRACERT_COMMAND)){
1055                                 proto_tree_add_uint( socks_tree, hf_socks_dstport, NullTVB,
1056                                         offset, 0, hash_info->port);
1057                         }
1058                 }
1059
1060         }
1061
1062
1063 /* call next dissector if ready */
1064
1065         if ( fd->num > hash_info->start_done_row){
1066                 call_next_dissector( pd, offset, fd, tree, hash_info);
1067         }
1068 }
1069
1070
1071
1072 static void socks_reinit( void){
1073
1074 /* Do the cleanup work when a new pass through the packet list is       */
1075 /* performed. Reset the highest row seen counter and re-initialize the  */
1076 /* conversation memory chunks.                                          */
1077
1078         if (socks_vals)
1079                 g_mem_chunk_destroy(socks_vals);
1080
1081         socks_vals = g_mem_chunk_new("socks_vals", socks_hash_val_length,
1082                 socks_hash_init_count * socks_hash_val_length,
1083                 G_ALLOC_AND_FREE);
1084 }
1085
1086
1087 void
1088 proto_register_socks( void){
1089
1090 /*** Prep the socks protocol, register it and a initialization routine  */
1091 /*      to clear the hash stuff.                                        */
1092
1093
1094         static gint *ett[] = {
1095                 &ett_socks,
1096                 &ett_socks_auth,
1097                 &ett_socks_name
1098
1099         };
1100
1101         static hf_register_info hf[] = {
1102
1103
1104                 { &hf_socks_ver,
1105                         { "Version", "socks.ver", FT_UINT8, BASE_NONE, NULL,
1106                                 0x0, ""
1107                         }
1108                 },
1109                 { &hf_socks_ip_dst,
1110                         { "Remote Address", "socks.dst", FT_IPv4, BASE_NONE, NULL,
1111                                 0x0, ""
1112                         }
1113                 },
1114                 { &hf_socks_ip6_dst,
1115                         { "Remote Address", "socks.dstV6", FT_IPv6, BASE_NONE, NULL,
1116                                 0x0, ""
1117                         }
1118                 },
1119
1120                 { &hf_user_name,
1121                         { "User Name", "socks.username", FT_STRING, BASE_NONE,
1122                                  NULL, 0x0, ""
1123                         }
1124                 },
1125                 { &hf_socks_dstport,
1126                         { "Remote Port", "socks.dstport", FT_UINT16,
1127                                 BASE_DEC, NULL, 0x0, ""
1128                         }
1129                 },
1130                 { &hf_socks_command,
1131                         { "Command", "socks.command", FT_UINT16,
1132                                 BASE_DEC, NULL, 0x0, ""
1133                         }
1134                 }
1135
1136         };
1137
1138
1139         proto_socks = proto_register_protocol (
1140                 "Socks Protocol", "socks");
1141
1142         proto_register_field_array(proto_socks, hf, array_length(hf));
1143         proto_register_subtree_array(ett, array_length(ett));
1144
1145         register_init_routine( &socks_reinit);  /* register re-init routine */
1146 }
1147
1148
1149 void
1150 proto_reg_handoff_socks(void) {
1151
1152         /* dissector install routine */
1153
1154         old_dissector_add("tcp.port", TCP_PORT_SOCKS, dissect_socks);
1155 }