packet-tzsp.c

   1 /* packet-tzsp.c
   2  *
   3  * $Id: packet-tzsp.c,v 1.3 2003/10/05 22:44:24 jmayer Exp $
   4  *
   5  * Copyright 2002, Tazmen Technologies Inc
   6  *
   7  * Tazmen Sniffer Protocol for encapsulating the packets across a network
   8  * from a remote packet sniffer. TZSP can encapsulate any other protocol.
   9  *
  10  * Ethereal - Network traffic analyzer
  11  * By Gerald Combs <gerald@ethereal.com>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * This program is free software; you can redistribute it and/or
  15  * modify it under the terms of the GNU General Public License
  16  * as published by the Free Software Foundation; either version 2
  17  * of the License, or (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, write to the Free Software
  26  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  27  */
  28
  29 #ifdef HAVE_CONFIG_H
  30 # include "config.h"
  31 #endif
  32
  33 #ifdef HAVE_SYS_TYPES_H
  34 # include <sys/types.h>
  35 #endif
  36
  37 #include <glib.h>
  38
  39 #include <epan/packet.h>
  40
  41 #define UDP_PORT_TZSP   0x9090
  42
  43 static int proto_tzsp = -1;
  44 static int hf_tzsp_version = -1;
  45 static int hf_tzsp_reserved = -1;
  46 static int hf_tzsp_encap = -1;
  47
  48 static gint ett_tzsp = -1;
  49
  50 static dissector_handle_t data_handle;
  51 static dissector_table_t encap_dissector_table;
  52
  53 /* ************************************************************************* */
  54 /*                WLAN radio header felds                                    */
  55 /* ************************************************************************* */
  56
  57 static int hf_status_field = -1;
  58 static int hf_status_msg_type = -1;
  59 static int hf_status_pcf = -1;
  60 static int hf_status_mac_port = -1;
  61 static int hf_status_undecrypted = -1;
  62 static int hf_status_fcs_error = -1;
  63
  64 static int hf_time = -1;
  65 static int hf_silence = -1;
  66 static int hf_signal = -1;
  67 static int hf_rate = -1;
  68 static int hf_channel = -1;
  69
  70 /* ************************************************************************* */
  71 /*                        Encapsulation type values                          */
  72 /* ************************************************************************* */
  73
  74 #define TZSP_ENCAP_ETHERNET                     1
  75 #define TZSP_ENCAP_TOKEN_RING                   2
  76 #define TZSP_ENCAP_SLIP                         3
  77 #define TZSP_ENCAP_PPP                          4
  78 #define TZSP_ENCAP_FDDI                         5
  79 #define TZSP_ENCAP_FDDI_BITSWAPPED              6
  80 #define TZSP_ENCAP_RAW_IP                       7
  81 #define TZSP_ENCAP_ARCNET                       8
  82 #define TZSP_ENCAP_ATM_RFC1483                  9
  83 #define TZSP_ENCAP_LINUX_ATM_CLIP               10
  84 #define TZSP_ENCAP_LAPB                         11
  85 #define TZSP_ENCAP_NULL                         13
  86 #define TZSP_ENCAP_IP_OVER_FC                   16
  87 #define TZSP_ENCAP_IEEE_802_11                  18
  88 #define TZSP_ENCAP_SLL                          20
  89 #define TZSP_ENCAP_FRELAY                       21
  90 #define TZSP_ENCAP_CHDLC                        22
  91 #define TZSP_ENCAP_LOCALTALK                    24
  92 #define TZSP_ENCAP_PRISM_HEADER                 25
  93 #define TZSP_ENCAP_WLAN_HEADER                  30
  94 #define TZSP_ENCAP_WFLEET_HDLC                  32
  95 #define TZSP_ENCAP_SDLC                         33
  96
  97 /* ************************************************************************* */
  98 /*                          Generic header options                           */
  99 /* ************************************************************************* */
 100
 101 #define TZSP_HDR_PAD 0 /* Pad. */
 102 #define TZSP_HDR_END 1 /* End of the list. */
 103
 104 /* ************************************************************************* */
 105 /*                          Options for 802.11 radios                        */
 106 /* ************************************************************************* */
 107
 108 #define WLAN_RADIO_HDR_SIGNAL 10 /* Signal strength in dBm, signed byte. */
 109 #define WLAN_RADIO_HDR_NOISE 11 /* Noise level in dBm, signed byte. */
 110 #define WLAN_RADIO_HDR_RATE 12 /* Data rate, unsigned byte. */
 111 #define WLAN_RADIO_HDR_TIMESTAMP 13 /* Timestamp in us, unsigned 32-bits network byte order. */
 112 #define WLAN_RADIO_HDR_MSG_TYPE 14 /* Packet type, unsigned byte. */
 113 #define WLAN_RADIO_HDR_CF 15 /* Whether packet arrived during CF period, unsigned byte. */
 114 #define WLAN_RADIO_HDR_UN_DECR 16 /* Whether packet could not be decrypted by MAC, unsigned byte. */
 115 #define WLAN_RADIO_HDR_FCS_ERR 17 /* Whether packet contains an FCS error, unsigned byte. */
 116 #define WLAN_RADIO_HDR_CHANNEL 18 /* Channel number packet was received on, unsigned byte.*/
 117
 118 /* ************************************************************************* */
 119 /*                Add option information to the display                      */
 120 /* ************************************************************************* */
 121
 122 static int
 123 add_option_info(tvbuff_t *tvb, proto_tree *tree, proto_item *ti)
 124 {
 125         guint8 tag, length, fcs_err = 0, encr = 0;
 126         int pos = 0;
 127
 128         /*
 129          * Read all option tags in an endless loop. If the packet is malformed this
 130          * loop might be a problem.
 131          */
 132         while (TRUE) {
 133                 tag = tvb_get_guint8(tvb, pos++);
 134
 135                 switch (tag) {
 136                 case TZSP_HDR_PAD:
 137                         length = 0;
 138                         break;
 139
 140                 case TZSP_HDR_END:
 141                         /* Fill in header with information from other tags. */
 142                         if (tree)
 143                                 proto_item_append_text(ti,"%s", fcs_err?"FCS Error":(encr?"Encrypted":"Good"));
 144                         return pos;
 145
 146                 case WLAN_RADIO_HDR_SIGNAL:
 147                         length = tvb_get_guint8(tvb, pos++);
 148                         if (tree)
 149                                 proto_tree_add_uint_format (tree, hf_signal, tvb, pos-2, 3,
 150                                                   tvb_get_guint8(tvb, pos),
 151                                             "Signal: 0x%02X",
 152                                             tvb_get_guint8(tvb, pos));
 153                         pos += length;
 154                         break;
 155
 156                 case WLAN_RADIO_HDR_NOISE:
 157                         length = tvb_get_guint8(tvb, pos++);
 158                         if (tree)
 159                                 proto_tree_add_uint_format (tree, hf_silence, tvb, pos-2, 3,
 160                                                   tvb_get_guint8(tvb, pos),
 161                                             "Silence: 0x%02X",
 162                                             tvb_get_guint8(tvb, pos));
 163                         pos += length;
 164                         break;
 165
 166                 case WLAN_RADIO_HDR_RATE:
 167                         length = tvb_get_guint8(tvb, pos++);
 168                         if (tree)
 169                                 proto_tree_add_uint (tree, hf_rate, tvb, pos-2, 3,
 170                                                         tvb_get_guint8(tvb, pos));
 171                         pos += length;
 172                         break;
 173
 174                 case WLAN_RADIO_HDR_TIMESTAMP:
 175                         length = tvb_get_guint8(tvb, pos++);
 176                         if (tree)
 177                                 proto_tree_add_uint (tree, hf_time, tvb, pos-2, 6,
 178                                                         tvb_get_ntohl(tvb, pos));
 179                         pos += length;
 180                         break;
 181
 182                 case WLAN_RADIO_HDR_MSG_TYPE:
 183                         length = tvb_get_guint8(tvb, pos++);
 184                         if (tree)
 185                                 proto_tree_add_uint (tree, hf_status_msg_type, tvb, pos-2, 3,
 186                                                 tvb_get_guint8(tvb, pos));
 187                         pos += length;
 188                         break;
 189
 190                 case WLAN_RADIO_HDR_CF:
 191                         length = tvb_get_guint8(tvb, pos++);
 192                         if (tree)
 193                                 proto_tree_add_boolean (tree, hf_status_pcf, tvb, pos-2, 3,
 194                                                 tvb_get_guint8(tvb, pos));
 195                         pos += length;
 196                         break;
 197
 198                 case WLAN_RADIO_HDR_UN_DECR:
 199                         length = tvb_get_guint8(tvb, pos++);
 200                         if (tree)
 201                                 proto_tree_add_boolean (tree, hf_status_undecrypted, tvb, pos-2, 3,
 202                                                 tvb_get_guint8(tvb, pos));
 203                         encr = tvb_get_guint8(tvb, pos);
 204                         pos += length;
 205                         break;
 206
 207                 case WLAN_RADIO_HDR_FCS_ERR:
 208                         length = tvb_get_guint8(tvb, pos++);
 209                         if (tree)
 210                                 proto_tree_add_boolean (tree, hf_status_fcs_error, tvb, pos-2, 3,
 211                                                 tvb_get_guint8(tvb, pos));
 212                         fcs_err = tvb_get_guint8(tvb, pos);
 213                         pos += length;
 214                         break;
 215
 216                 case WLAN_RADIO_HDR_CHANNEL:
 217                         length = tvb_get_guint8(tvb, pos++);
 218                         if (tree)
 219                                 proto_tree_add_uint (tree, hf_channel, tvb, pos-2, 3,
 220                                                         tvb_get_guint8(tvb, pos));
 221                         pos += length;
 222                         break;
 223                 }
 224         }
 225 }
 226
 227 /* ************************************************************************* */
 228 /*        Map TZSP encapsulation types to Wiretap encapsulation types        */
 229 /* ************************************************************************* */
 230 struct encap_map {
 231         guint16 tzsp_encap;
 232         int     wtap_encap;
 233 };
 234
 235 static const struct encap_map map_table[] = {
 236         { TZSP_ENCAP_ETHERNET,          WTAP_ENCAP_ETHERNET },
 237         { TZSP_ENCAP_TOKEN_RING,        WTAP_ENCAP_TOKEN_RING },
 238         { TZSP_ENCAP_SLIP,              WTAP_ENCAP_SLIP },
 239         { TZSP_ENCAP_PPP,               WTAP_ENCAP_PPP },
 240         { TZSP_ENCAP_FDDI,              WTAP_ENCAP_FDDI },
 241         { TZSP_ENCAP_FDDI_BITSWAPPED,   WTAP_ENCAP_FDDI_BITSWAPPED },
 242         { TZSP_ENCAP_RAW_IP,            WTAP_ENCAP_RAW_IP },
 243         { TZSP_ENCAP_ARCNET,            WTAP_ENCAP_ARCNET },
 244         { TZSP_ENCAP_ATM_RFC1483,       WTAP_ENCAP_ATM_RFC1483 },
 245         { TZSP_ENCAP_LINUX_ATM_CLIP,    WTAP_ENCAP_LINUX_ATM_CLIP },
 246         { TZSP_ENCAP_LAPB,              WTAP_ENCAP_LAPB },
 247         { TZSP_ENCAP_NULL,              WTAP_ENCAP_NULL },
 248         { TZSP_ENCAP_IP_OVER_FC,        WTAP_ENCAP_IP_OVER_FC },
 249         { TZSP_ENCAP_IEEE_802_11,       WTAP_ENCAP_IEEE_802_11 },
 250         { TZSP_ENCAP_SLL,               WTAP_ENCAP_SLL },
 251         { TZSP_ENCAP_FRELAY,            WTAP_ENCAP_FRELAY },
 252         { TZSP_ENCAP_CHDLC,             WTAP_ENCAP_CHDLC },
 253         { TZSP_ENCAP_LOCALTALK,         WTAP_ENCAP_LOCALTALK },
 254         { TZSP_ENCAP_PRISM_HEADER,      WTAP_ENCAP_PRISM_HEADER },
 255         { TZSP_ENCAP_WLAN_HEADER,       WTAP_ENCAP_WLAN_HEADER },
 256         { TZSP_ENCAP_WFLEET_HDLC,       WTAP_ENCAP_WFLEET_HDLC },
 257         { TZSP_ENCAP_SDLC,              WTAP_ENCAP_SDLC },
 258         { 0,                            -1 }
 259 };
 260
 261 static int
 262 tzsp_encap_to_wtap_encap(guint16 encap)
 263 {
 264         int i;
 265
 266         for (i = 0; map_table[i].wtap_encap != -1; i++) {
 267                 if (map_table[i].tzsp_encap == encap)
 268                         return map_table[i].wtap_encap;
 269         }
 270         return -1;
 271 }
 272
 273 /* ************************************************************************* */
 274 /*                Dissect a TZSP packet                                      */
 275 /* ************************************************************************* */
 276
 277 static void
 278 dissect_tzsp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 279 {
 280         proto_tree *tzsp_tree = NULL;
 281         proto_item *ti = NULL;
 282         int pos = 0;
 283         tvbuff_t *next_tvb;
 284         guint16 encapsulation = 0;
 285         int wtap_encap;
 286         dissector_handle_t encap_dissector;
 287         char *encap_name;
 288
 289         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 290                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TZSP");
 291
 292         if (check_col(pinfo->cinfo, COL_INFO))
 293                 col_set_str(pinfo->cinfo, COL_INFO, "Tazmen Sniffer Protocol");
 294
 295         /* Find the dissector. */
 296         encapsulation = tvb_get_ntohs(tvb, 2);
 297         wtap_encap = tzsp_encap_to_wtap_encap(encapsulation);
 298         if ( wtap_encap != -1 &&
 299             (encap_dissector = dissector_get_port_handle(encap_dissector_table, wtap_encap)) ) {
 300                 encap_name = dissector_handle_get_short_name(encap_dissector);
 301         }
 302         else {
 303                 encap_name = "UNKNOWN";
 304         }
 305
 306         if (tree) {
 307                 /* Adding TZSP item and subtree */
 308                 ti = proto_tree_add_protocol_format(tree, proto_tzsp, tvb, 0,
 309                     tvb_length(tvb), "TZSP: %s: ", encap_name);
 310                 tzsp_tree = proto_item_add_subtree(ti, ett_tzsp);
 311
 312                 proto_tree_add_uint (tzsp_tree, hf_tzsp_version, tvb, 0, 1,
 313                                         tvb_get_guint8(tvb, 0));
 314                 proto_tree_add_uint_format (tzsp_tree, hf_tzsp_encap, tvb, 2, 2,
 315                                         encapsulation, "Encapsulates: %s (%d)", encap_name, encapsulation);
 316         }
 317
 318         tvb = tvb_new_subset(tvb, 4, -1, -1);
 319         pos = add_option_info(tvb, tzsp_tree, ti);
 320         next_tvb = tvb_new_subset(tvb, pos, -1, -1);
 321
 322         if (wtap_encap == -1
 323             || !dissector_try_port(encap_dissector_table, wtap_encap,
 324                 next_tvb, pinfo, tree)) {
 325
 326                 if (check_col(pinfo->cinfo, COL_PROTOCOL))
 327                         col_set_str(pinfo->cinfo, COL_PROTOCOL, "UNKNOWN");
 328                 if (check_col(pinfo->cinfo, COL_INFO))
 329                         col_add_fstr(pinfo->cinfo, COL_INFO, "TZSP_ENCAP = %u",
 330                             encapsulation);
 331                 call_dissector(data_handle, next_tvb, pinfo, tree);
 332         }
 333 }
 334
 335 /* ************************************************************************* */
 336 /*                Register the TZSP dissector                                */
 337 /* ************************************************************************* */
 338
 339 void
 340 proto_register_tzsp(void)
 341 {
 342
 343   static const value_string msg_type[] = {
 344     {0,     "Normal"},
 345     {1,     "RFC1042 encoded"},
 346     {2,     "Bridge-tunnel encoded"},
 347     {4,     "802.11 management frame"},
 348     {0,     NULL}
 349   };
 350
 351   static const true_false_string pcf_flag = {
 352     "CF: Frame received during CF period",
 353     "Not CF"
 354   };
 355
 356   static const true_false_string undecr_flag = {
 357     "Encrypted frame could not be decrypted",
 358     "Unencrypted"
 359   };
 360
 361   static const true_false_string fcs_err_flag = {
 362     "FCS error, frame is corrupted",
 363     "Frame is valid"
 364   };
 365
 366   static const value_string rates[] = {
 367     {0x0A, "1 Mbit/s"},
 368     {0x14, "2 Mbit/s"},
 369     {0x37, "5.5 Mbit/s"},
 370     {0x6E, "11 Mbit/s"},
 371     {0, NULL}
 372   };
 373
 374         static hf_register_info hf[] = {
 375                 { &hf_tzsp_version, {
 376                         "Version", "tzsp.version", FT_UINT8, BASE_DEC,
 377                         NULL, 0, "Version", HFILL }},
 378                 { &hf_tzsp_reserved, {
 379                         "Reserved", "tzsp.reserved", FT_UINT8, BASE_DEC,
 380                         NULL, 0, "Reserved", HFILL }},
 381                 { &hf_tzsp_encap, {
 382                         "Encapsulation", "tzsp.encap", FT_UINT16, BASE_DEC,
 383                         NULL, 0, "Encapsulation", HFILL }},
 384                 { &hf_status_field, {
 385                         "Status", "tzsp.wlan.status", FT_UINT16, BASE_HEX,
 386                                 NULL, 0, "Status", HFILL }},
 387                 { &hf_status_msg_type, {
 388                         "Type", "tzsp.wlan.status.msg_type", FT_UINT8, BASE_HEX,
 389                         VALS(msg_type), 0, "Message type", HFILL }},
 390                 { &hf_status_mac_port, {
 391                         "Port", "tzsp.wlan.status.mac_port", FT_UINT8, BASE_DEC,
 392                         NULL, 0, "MAC port", HFILL }},
 393                 { &hf_status_pcf, {
 394                         "PCF", "tzsp.wlan.status.pcf", FT_BOOLEAN, BASE_HEX,
 395                         TFS (&pcf_flag), 0, "Point Coordination Function", HFILL }},
 396                 { &hf_status_undecrypted, {
 397                         "Undecrypted", "tzsp.wlan.status.undecrypted", FT_BOOLEAN, BASE_HEX,
 398                         TFS (&undecr_flag), 0, "Undecrypted", HFILL }},
 399                 { &hf_status_fcs_error, {
 400                         "FCS", "tzsp.wlan.status.fcs_err", FT_BOOLEAN, BASE_HEX,
 401                         TFS (&fcs_err_flag), 0, "Frame check sequence", HFILL }},
 402                 { &hf_time, {
 403                         "Time", "tzsp.wlan.time", FT_UINT32, BASE_HEX,
 404                         NULL, 0, "Time", HFILL }},
 405                 { &hf_silence, {
 406                         "Silence", "tzsp.wlan.silence", FT_UINT8, BASE_HEX,
 407                         NULL, 0, "Silence", HFILL }},
 408                 { &hf_signal, {
 409                         "Signal", "tzsp.wlan.signal", FT_UINT8, BASE_HEX,
 410                         NULL, 0, "Signal", HFILL }},
 411                 { &hf_rate, {
 412                         "Rate", "tzsp.wlan.rate", FT_UINT8, BASE_HEX,
 413                         VALS(rates), 0, "Rate", HFILL }},
 414                 { &hf_channel, {
 415                         "Channel", "tzsp.wlan.channel", FT_UINT8, BASE_DEC,
 416                         NULL, 0, "Channel", HFILL }}
 417         };
 418
 419         static gint *ett[] = {
 420                 &ett_tzsp
 421         };
 422
 423         proto_tzsp = proto_register_protocol("Tazmen Sniffer Protocol", "TZSP",
 424             "tzsp");
 425         proto_register_field_array(proto_tzsp, hf, array_length(hf));
 426         proto_register_subtree_array(ett, array_length(ett));
 427
 428 }
 429
 430 void
 431 proto_reg_handoff_tzsp(void)
 432 {
 433         dissector_handle_t tzsp_handle;
 434
 435         tzsp_handle = create_dissector_handle(dissect_tzsp, proto_tzsp);
 436         dissector_add("udp.port", UDP_PORT_TZSP, tzsp_handle);
 437
 438         /* Get the data dissector for handling unknown encapsulation types. */
 439         data_handle = find_dissector("data");
 440
 441         /* Register this protocol as an ecapsulation type. */
 442         dissector_add("wtap_encap", WTAP_ENCAP_TZSP, tzsp_handle);
 443
 444         encap_dissector_table = find_dissector_table("wtap_encap");
 445 }