packet-tacacs.h

   1 /* packet-tacacs.h
   2  * Routines for cisco tacplus packet dissection
   3  * Copyright 2000, Emanuele Caratti <wiz@iol.it>
   4  *
   5  * $Id: packet-tacacs.h,v 1.3 2003/09/20 09:41:48 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifndef __PACKET_TACACS_H__
  27 #define __PACKET_TACACS_H__
  28
  29 #define TAC_PLUS_HDR_SIZE 12
  30
  31 #define MD5_LEN           16
  32 #define MSCHAP_DIGEST_LEN 49
  33
  34 /* Tacacs+ packet type */
  35 enum
  36 {
  37         TAC_PLUS_AUTHEN = 0x01,         /* Authentication */
  38         TAC_PLUS_AUTHOR = 0x02,         /* Authorization  */
  39         TAC_PLUS_ACCT = 0x03            /* Accounting     */
  40 };
  41
  42 /* Flags */
  43 #define TAC_PLUS_ENCRYPTED 0x0
  44 #define TAC_PLUS_CLEAR     0x1
  45
  46 /* Authentication action to perform */
  47 enum
  48 {
  49         TAC_PLUS_AUTHEN_LOGIN = 0x01,
  50         TAC_PLUS_AUTHEN_CHPASS = 0x02,
  51         TAC_PLUS_AUTHEN_SENDPASS = 0x03,        /* deprecated */
  52         TAC_PLUS_AUTHEN_SENDAUTH = 0x04
  53 };
  54
  55 /* Authentication priv_levels */
  56 enum
  57 {
  58         TAC_PLUS_PRIV_LVL_MAX   = 0x0f,
  59         TAC_PLUS_PRIV_LVL_ROOT  = 0x0f,
  60         TAC_PLUS_PRIV_LVL_USER  = 0x01,
  61         TAC_PLUS_PRIV_LVL_MIN   = 0x00,
  62 };
  63
  64 /* authen types */
  65 enum
  66 {
  67         TAC_PLUS_AUTHEN_TYPE_ASCII              = 0x01, /*  ascii  */
  68         TAC_PLUS_AUTHEN_TYPE_PAP                = 0x02, /*  pap    */
  69         TAC_PLUS_AUTHEN_TYPE_CHAP               = 0x03, /*  chap   */
  70         TAC_PLUS_AUTHEN_TYPE_ARAP               = 0x04, /*  arap   */
  71         TAC_PLUS_AUTHEN_TYPE_MSCHAP     = 0x05  /*  mschap */
  72 };
  73
  74 /* authen services */
  75 enum
  76 {
  77         TAC_PLUS_AUTHEN_SVC_NONE        = 0x00,
  78         TAC_PLUS_AUTHEN_SVC_LOGIN       = 0x01,
  79         TAC_PLUS_AUTHEN_SVC_ENABLE      = 0x02,
  80         TAC_PLUS_AUTHEN_SVC_PPP         = 0x03,
  81         TAC_PLUS_AUTHEN_SVC_ARAP        = 0x04,
  82         TAC_PLUS_AUTHEN_SVC_PT          = 0x05,
  83         TAC_PLUS_AUTHEN_SVC_RCMD        = 0x06,
  84         TAC_PLUS_AUTHEN_SVC_X25         = 0x07,
  85         TAC_PLUS_AUTHEN_SVC_NASI        = 0x08,
  86         TAC_PLUS_AUTHEN_SVC_FWPROXY     = 0x09
  87 };
  88
  89 /* status of reply packet, that client get from server in authen */
  90 enum
  91 {
  92         TAC_PLUS_AUTHEN_STATUS_PASS             = 0x01,
  93         TAC_PLUS_AUTHEN_STATUS_FAIL             = 0x02,
  94         TAC_PLUS_AUTHEN_STATUS_GETDATA  = 0x03,
  95         TAC_PLUS_AUTHEN_STATUS_GETUSER  = 0x04,
  96         TAC_PLUS_AUTHEN_STATUS_GETPASS  = 0x05,
  97         TAC_PLUS_AUTHEN_STATUS_RESTART  = 0x06,
  98         TAC_PLUS_AUTHEN_STATUS_ERROR    = 0x07,
  99         TAC_PLUS_AUTHEN_STATUS_FOLLOW   = 0x21
 100 };
 101
 102 /* Authen reply Flags */
 103 #define TAC_PLUS_REPLY_FLAG_NOECHO              0x01
 104 /* Authen continue Flags */
 105 #define TAC_PLUS_CONTINUE_FLAG_ABORT    0x01
 106
 107 /* methods of authentication */
 108 enum {
 109         TAC_PLUS_AUTHEN_METH_NOT_SET    = 0x00,
 110         TAC_PLUS_AUTHEN_METH_NONE               = 0x01,
 111         TAC_PLUS_AUTHEN_METH_KRB5               = 0x03,
 112         TAC_PLUS_AUTHEN_METH_LINE               = 0x03,
 113         TAC_PLUS_AUTHEN_METH_ENABLE             = 0x04,
 114         TAC_PLUS_AUTHEN_METH_LOCAL              = 0x05,
 115         TAC_PLUS_AUTHEN_METH_TACACSPLUS = 0x06,
 116         TAC_PLUS_AUTHEN_METH_GUEST              = 0x08,
 117         TAC_PLUS_AUTHEN_METH_RADIUS             = 0x10,
 118         TAC_PLUS_AUTHEN_METH_KRB4               = 0x11,
 119         TAC_PLUS_AUTHEN_METH_RCMD               = 0x20
 120 };
 121
 122 /* authorization status */
 123 enum
 124 {
 125         TAC_PLUS_AUTHOR_STATUS_PASS_ADD         = 0x01,
 126         TAC_PLUS_AUTHOR_STATUS_PASS_REPL        = 0x02,
 127         TAC_PLUS_AUTHOR_STATUS_FAIL                     = 0x10,
 128         TAC_PLUS_AUTHOR_STATUS_ERROR            = 0x11,
 129         TAC_PLUS_AUTHOR_STATUS_FOLLOW           = 0x21
 130 };
 131
 132 /* accounting flag */
 133
 134 enum
 135 {
 136         TAC_PLUS_ACCT_FLAG_MORE         = 0x1, /* deprecated */
 137         TAC_PLUS_ACCT_FLAG_START        = 0x2,
 138         TAC_PLUS_ACCT_FLAG_STOP         = 0x4,
 139         TAC_PLUS_ACCT_FLAG_WATCHDOG     = 0x8
 140 };
 141 /* accounting status */
 142 enum {
 143         TAC_PLUS_ACCT_STATUS_SUCCESS    = 0x01,
 144         TAC_PLUS_ACCT_STATUS_ERROR              = 0x02,
 145         TAC_PLUS_ACCT_STATUS_FOLLOW             = 0x21
 146 };
 147
 148 /* Header offsets */
 149 #define H_VER_OFF                       (0)
 150 #define H_TYPE_OFF                      (H_VER_OFF+1)
 151 #define H_SEQ_NO_OFF            (H_TYPE_OFF+1)
 152 #define H_FLAGS_OFF                     (H_SEQ_NO_OFF+1)
 153 #define H_SESSION_ID_OFF        (H_FLAGS_OFF+1)
 154 #define H_LENGTH_OFF            (H_SESSION_ID_OFF+4)
 155
 156 #define TACPLUS_BODY_OFF                0
 157 /* authen START offsets */
 158 #define AUTHEN_S_ACTION_OFF                     (TACPLUS_BODY_OFF)
 159 #define AUTHEN_S_PRIV_LVL_OFF           (AUTHEN_S_ACTION_OFF+1)
 160 #define AUTHEN_S_AUTHEN_TYPE_OFF        (AUTHEN_S_PRIV_LVL_OFF+1)
 161 #define AUTHEN_S_SERVICE_OFF            (AUTHEN_S_AUTHEN_TYPE_OFF+1)
 162 #define AUTHEN_S_USER_LEN_OFF           (AUTHEN_S_SERVICE_OFF+1)
 163 #define AUTHEN_S_PORT_LEN_OFF           (AUTHEN_S_USER_LEN_OFF+1)
 164 #define AUTHEN_S_REM_ADDR_LEN_OFF       (AUTHEN_S_PORT_LEN_OFF+1)
 165 #define AUTHEN_S_DATA_LEN_OFF           (AUTHEN_S_REM_ADDR_LEN_OFF+1)
 166 #define AUTHEN_S_VARDATA_OFF            (AUTHEN_S_DATA_LEN_OFF+1) /* variable data offset (user, port, etc ) */
 167
 168 /* authen REPLY fields offset */
 169 #define AUTHEN_R_STATUS_OFF                     (TACPLUS_BODY_OFF)
 170 #define AUTHEN_R_FLAGS_OFF                      (AUTHEN_R_STATUS_OFF+1)
 171 #define AUTHEN_R_SRV_MSG_LEN_OFF        (AUTHEN_R_FLAGS_OFF+1)
 172 #define AUTHEN_R_DATA_LEN_OFF           (AUTHEN_R_SRV_MSG_LEN_OFF+2)
 173 #define AUTHEN_R_VARDATA_OFF            (AUTHEN_R_DATA_LEN_OFF+2)
 174
 175 /* authen CONTINUE fields offset */
 176 #define AUTHEN_C_USER_LEN_OFF           (TACPLUS_BODY_OFF)
 177 #define AUTHEN_C_DATA_LEN_OFF           (AUTHEN_C_USER_LEN_OFF+2)
 178 #define AUTHEN_C_FLAGS_OFF                      (AUTHEN_C_DATA_LEN_OFF+2)
 179 #define AUTHEN_C_VARDATA_OFF            (AUTHEN_C_FLAGS_OFF+1)
 180
 181 /* acct REQUEST fields offsets */
 182 #define ACCT_Q_FLAGS_OFF                        (TACPLUS_BODY_OFF)
 183 #define ACCT_Q_METHOD_OFF                       (ACCT_Q_FLAGS_OFF+1)
 184 #define ACCT_Q_PRIV_LVL_OFF                     (ACCT_Q_METHOD_OFF+1)
 185 #define ACCT_Q_AUTHEN_TYPE_OFF          (ACCT_Q_PRIV_LVL_OFF+1)
 186 #define ACCT_Q_SERVICE_OFF                      (ACCT_Q_AUTHEN_TYPE_OFF+1)
 187 #define ACCT_Q_USER_LEN_OFF                     (ACCT_Q_SERVICE_OFF+1)
 188 #define ACCT_Q_PORT_LEN_OFF                     (ACCT_Q_USER_LEN_OFF+1)
 189 #define ACCT_Q_REM_ADDR_LEN_OFF         (ACCT_Q_PORT_LEN_OFF+1)
 190 #define ACCT_Q_ARG_CNT_OFF                      (ACCT_Q_REM_ADDR_LEN_OFF+1)
 191 #define ACCT_Q_VARDATA_OFF                      (ACCT_Q_ARG_CNT_OFF+1)
 192
 193 /* acct REPLY fields offsets */
 194 #define ACCT_R_SRV_MSG_LEN_OFF          (TACPLUS_BODY_OFF)
 195 #define ACCT_R_DATA_LEN_OFF                     (ACCT_R_SRV_MSG_LEN_OFF+2)
 196 #define ACCT_R_STATUS_OFF                       (ACCT_R_DATA_LEN_OFF+2)
 197 #define ACCT_R_VARDATA_OFF                      (ACCT_R_STATUS_OFF+1)
 198
 199 /* AUTHORIZATION */
 200 /* Request */
 201 #define AUTHOR_Q_AUTH_METH_OFF          (TACPLUS_BODY_OFF)
 202 #define AUTHOR_Q_PRIV_LVL_OFF           (AUTHOR_Q_AUTH_METH_OFF+1)
 203 #define AUTHOR_Q_AUTHEN_TYPE_OFF        (AUTHOR_Q_PRIV_LVL_OFF+1)
 204 #define AUTHOR_Q_SERVICE_OFF            (AUTHOR_Q_AUTHEN_TYPE_OFF+1)
 205 #define AUTHOR_Q_USER_LEN_OFF           (AUTHOR_Q_SERVICE_OFF+1)
 206 #define AUTHOR_Q_PORT_LEN_OFF           (AUTHOR_Q_USER_LEN_OFF+1)
 207 #define AUTHOR_Q_REM_ADDR_LEN_OFF       (AUTHOR_Q_PORT_LEN_OFF+1)
 208 #define AUTHOR_Q_ARGC_OFF                       (AUTHOR_Q_REM_ADDR_LEN_OFF+1)
 209 #define AUTHOR_Q_VARDATA_OFF            (AUTHOR_Q_ARGC_OFF+1)
 210
 211 /* Reply */
 212 #define AUTHOR_R_STATUS_OFF                     (TACPLUS_BODY_OFF)
 213 #define AUTHOR_R_ARGC_OFF                       (AUTHOR_R_STATUS_OFF+1)
 214 #define AUTHOR_R_SRV_MSG_LEN_OFF        (AUTHOR_R_ARGC_OFF+1)
 215 #define AUTHOR_R_DATA_LEN_OFF           (AUTHOR_R_SRV_MSG_LEN_OFF+2)
 216 #define AUTHOR_R_VARDATA_OFF            (AUTHOR_R_DATA_LEN_OFF+2)
 217
 218
 219 #if 0
 220 /* Packet structures */
 221 typedef struct  {
 222         u_char version;
 223         u_char type;
 224         u_char seq_no;
 225         u_char flags;
 226         guint32 session_id;
 227         guint32 length;
 228 } tacplus_pkt_hdr;
 229
 230 /* Authentication START packet */
 231 typedef struct {
 232         u_char  action;
 233         u_char  priv_lvl;
 234         u_char  authen_type;
 235         u_char  service;
 236         u_char  user_len;
 237         u_char  port_len;
 238         u_char  rem_addr_len;
 239         u_char  data_len;
 240         u_char  vardata[1];
 241 } tacplus_authen_start ;
 242
 243 /* Authentication CONTINUE packet */
 244 typedef struct {
 245         guint16 user_len;
 246         guint16 data_len;
 247         u_char  flags;
 248         u_char  vardata[1];
 249 } tacplus_authen_continue ;
 250
 251 /* Authentication REPLY packet */
 252 typedef struct {
 253         u_char  status;
 254         u_char  flags;
 255         guint16 srv_msg_len;
 256         guint16 data_len;
 257         u_char  vardata[1];
 258 } tacplus_authen_reply;
 259
 260
 261 /* Authentication sub-PACKET */
 262 typedef union {
 263         tacplus_authen_start    s; /* start */
 264         tacplus_authen_continue c; /* continue */
 265         tacplus_authen_reply    r; /* reply (from srv) */
 266 } tacplus_authen_pkt;
 267
 268 /* AUTHORIZATION request */
 269
 270 typedef struct {
 271         u_char  authen_method;
 272         u_char  priv_lvl;
 273         u_char  authen_type;
 274         u_char  authen_service;
 275         u_char  user_len;
 276         u_char  port_len;
 277         u_char  rem_addr_len;
 278         u_char  arg_cnt;
 279         u_char  vardata[1];
 280 } tacplus_author_request;
 281
 282 typedef struct {
 283         u_char  status;
 284         u_char  arg_cnt;
 285         guint16 srv_msg_len;
 286         guint16 data_len;
 287         u_char  vardata[1];
 288 } tacplus_author_reply;
 289
 290 typedef union {
 291         tacplus_author_request  q;
 292         tacplus_author_reply    r;
 293 } tacplus_author_pkt;
 294
 295 /* ACCOUNTING request */
 296 typedef struct {
 297         u_char  flags;
 298         u_char  authen_method;
 299         u_char  priv_lvl;
 300         u_char  authen_type;
 301         u_char  authen_service;
 302         u_char  user_len;
 303         u_char  port_len;
 304         u_char  rem_addr_len;
 305         u_char  arg_cnt;
 306         u_char  vardata[1];
 307 } tacplus_account_request;
 308
 309 typedef struct {
 310         guint16 srv_msg_len;
 311         guint16 data_len;
 312         u_char  status;
 313         u_char  vardata[1];
 314 } tacplus_account_reply;
 315
 316 typedef union {
 317         tacplus_account_request q; /* Request */
 318         tacplus_account_reply   r; /* Reply */
 319 } tacplus_account_pkt;
 320
 321 /* TACACS+ Packet */
 322 typedef struct {
 323         tacplus_pkt_hdr hdr;
 324         union {
 325                 tacplus_authen_pkt authen;
 326                 tacplus_author_pkt author;
 327                 tacplus_account_pkt acct;
 328         } body;
 329 } tacplus_pkt;
 330
 331 #endif
 332
 333 /* From my old tacacs dissector */
 334 static value_string tacplus_type_vals[] = {
 335         {TAC_PLUS_AUTHEN,       "Authentication"},
 336         {TAC_PLUS_AUTHOR,       "Authorization" },
 337         {TAC_PLUS_ACCT,         "Accounting"    },
 338         {0, NULL}};
 339
 340 static value_string tacplus_authen_action_vals[] = {
 341         {TAC_PLUS_AUTHEN_LOGIN,                 "Inbound Login"},
 342         {TAC_PLUS_AUTHEN_CHPASS,                "Change password request"},
 343         {TAC_PLUS_AUTHEN_SENDPASS,              "Send password request"},
 344         {TAC_PLUS_AUTHEN_SENDAUTH,              "Outbound Request (SENDAUTH)"},
 345         {0, NULL}};
 346
 347 #if 0
 348 static value_string tacplus_authen_priv_lvl_vals[] = {
 349         {TAC_PLUS_PRIV_LVL_MAX,                 "LVL_MAX"},
 350         {TAC_PLUS_PRIV_LVL_ROOT,                "LVL_ROOT"},
 351         {TAC_PLUS_PRIV_LVL_USER,                "LVL_USER"},
 352         {TAC_PLUS_PRIV_LVL_MIN,                 "LVL_MIN"},
 353         {0, NULL}};
 354 #endif
 355
 356 static value_string tacplus_authen_type_vals[] = {
 357         {TAC_PLUS_AUTHEN_TYPE_ASCII,    "ASCII"},
 358         {TAC_PLUS_AUTHEN_TYPE_PAP,              "PAP"},
 359         {TAC_PLUS_AUTHEN_TYPE_CHAP,             "CHAP"},
 360         {TAC_PLUS_AUTHEN_TYPE_ARAP,             "ARAP"},
 361         {TAC_PLUS_AUTHEN_TYPE_MSCHAP,   "MS-CHAP"},
 362         {0, NULL}};
 363
 364 static value_string tacplus_authen_service_vals[] = {
 365         {TAC_PLUS_AUTHEN_SVC_NONE,              "TAC_PLUS_AUTHEN_SVC_NONE"},
 366         {TAC_PLUS_AUTHEN_SVC_LOGIN,             "Login" },
 367         {TAC_PLUS_AUTHEN_SVC_ENABLE,    "ENABLE"},
 368         {TAC_PLUS_AUTHEN_SVC_PPP,               "PPP"   },
 369         {TAC_PLUS_AUTHEN_SVC_ARAP,              "ARAP"  },
 370         {TAC_PLUS_AUTHEN_SVC_PT,                "TAC_PLUS_AUTHEN_SVC_PT"},
 371         {TAC_PLUS_AUTHEN_SVC_RCMD,              "TAC_PLUS_AUTHEN_SVC_RCMD"},
 372         {TAC_PLUS_AUTHEN_SVC_X25,               "TAC_PLUS_AUTHEN_SVC_X25"},
 373         {TAC_PLUS_AUTHEN_SVC_NASI,              "TAC_PLUS_AUTHEN_SVC_NASI"},
 374         {TAC_PLUS_AUTHEN_SVC_FWPROXY,   "TAC_PLUS_AUTHEN_SVC_FWPROXY"},
 375         {0, NULL}};
 376
 377 static value_string tacplus_reply_status_vals[] = {
 378         {TAC_PLUS_AUTHEN_STATUS_PASS,           "Authentication Passed"},
 379         {TAC_PLUS_AUTHEN_STATUS_FAIL,           "Authentication Failed"},
 380         {TAC_PLUS_AUTHEN_STATUS_GETDATA,        "Send Data"},
 381         {TAC_PLUS_AUTHEN_STATUS_GETUSER,        "Send Username"},
 382         {TAC_PLUS_AUTHEN_STATUS_GETPASS,        "Send Password"},
 383         {TAC_PLUS_AUTHEN_STATUS_RESTART,        "Restart Authentication Sequence"},
 384         {TAC_PLUS_AUTHEN_STATUS_ERROR,          "Unrecoverable Error"},
 385         {TAC_PLUS_AUTHEN_STATUS_FOLLOW,         "Use Alternate Server"},
 386         {0, NULL}};
 387
 388
 389 static value_string tacplus_authen_method[] = {
 390         {TAC_PLUS_AUTHEN_METH_NOT_SET,          "NOT_SET"},
 391         {TAC_PLUS_AUTHEN_METH_NONE,                     "NONE"},
 392         {TAC_PLUS_AUTHEN_METH_KRB5,                     "KRB5"},
 393         {TAC_PLUS_AUTHEN_METH_LINE,                     "LINE"},
 394         {TAC_PLUS_AUTHEN_METH_ENABLE,           "ENABLE"},
 395         {TAC_PLUS_AUTHEN_METH_LOCAL,            "LOCAL"},
 396         {TAC_PLUS_AUTHEN_METH_TACACSPLUS,       "TACACSPLUS"},
 397         {TAC_PLUS_AUTHEN_METH_GUEST,            "GUEST"},
 398         {TAC_PLUS_AUTHEN_METH_RADIUS,           "RADIUS"},
 399         {TAC_PLUS_AUTHEN_METH_KRB4,                     "KRB4"},
 400         {TAC_PLUS_AUTHEN_METH_RCMD,                     "RCMD"},
 401         {0, NULL}};
 402
 403 static value_string tacplus_author_status[] = {
 404         {TAC_PLUS_AUTHOR_STATUS_PASS_ADD,               "PASS_ADD"},
 405         {TAC_PLUS_AUTHOR_STATUS_PASS_REPL,              "PASS_REPL"},
 406         {TAC_PLUS_AUTHOR_STATUS_FAIL,           "FAIL"},
 407         {TAC_PLUS_AUTHOR_STATUS_ERROR,          "ERROR"},
 408         {TAC_PLUS_AUTHOR_STATUS_FOLLOW,         "FOLLOW"},
 409         {0, NULL}};
 410
 411 static value_string tacplus_acct_status[] = {
 412         {TAC_PLUS_ACCT_STATUS_SUCCESS,  "Success"},
 413         {TAC_PLUS_ACCT_STATUS_ERROR,    "Error"},
 414         {TAC_PLUS_ACCT_STATUS_FOLLOW,   "Follow"},
 415         {0, NULL}};
 416
 417 static value_string tacplus_acct_flags[] = {
 418         {TAC_PLUS_ACCT_FLAG_MORE,       "More (deprecated)"},
 419         {TAC_PLUS_ACCT_FLAG_START,      "Start"},
 420         {TAC_PLUS_ACCT_FLAG_STOP,       "Stop"},
 421         {TAC_PLUS_ACCT_FLAG_WATCHDOG,"Update"},
 422         {0, NULL}};
 423
 424 #endif   /* __PACKET_TACACS_H__ */