packet-tzsp.c

   1 /* packet-tzsp.c
   2  *
   3  * $Id: packet-tzsp.c,v 1.5 2003/12/15 00:08:57 guy Exp $
   4  *
   5  * Copyright 2002, Tazmen Technologies Inc
   6  *
   7  * Tazmen Sniffer Protocol for encapsulating the packets across a network
   8  * from a remote packet sniffer. TZSP can encapsulate any other protocol.
   9  *
  10  * Ethereal - Network traffic analyzer
  11  * By Gerald Combs <gerald@ethereal.com>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * This program is free software; you can redistribute it and/or
  15  * modify it under the terms of the GNU General Public License
  16  * as published by the Free Software Foundation; either version 2
  17  * of the License, or (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, write to the Free Software
  26  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  27  */
  28
  29 #ifdef HAVE_CONFIG_H
  30 # include "config.h"
  31 #endif
  32
  33 #ifdef HAVE_SYS_TYPES_H
  34 # include <sys/types.h>
  35 #endif
  36
  37 #include <glib.h>
  38
  39 #include <epan/packet.h>
  40
  41 #define UDP_PORT_TZSP   0x9090
  42
  43 static int proto_tzsp = -1;
  44 static int hf_tzsp_version = -1;
  45 static int hf_tzsp_type = -1;
  46 static int hf_tzsp_encap = -1;
  47
  48 static const value_string tzsp_type[] = {
  49         {0,     "Received tag list"},
  50         {1,     "Packet for transmit"},
  51         {2,     "Reserved"},
  52         {3,     "Configuration"},
  53         {4,     "Keepalive"},
  54         {5,     "Port opener"},
  55         {0,     NULL}
  56 };
  57
  58 static gint ett_tzsp = -1;
  59
  60 static dissector_handle_t data_handle;
  61 static dissector_table_t encap_dissector_table;
  62
  63 /* ************************************************************************* */
  64 /*                WLAN radio header felds                                    */
  65 /* ************************************************************************* */
  66
  67 static int hf_status_field = -1;
  68 static int hf_status_msg_type = -1;
  69 static int hf_status_pcf = -1;
  70 static int hf_status_mac_port = -1;
  71 static int hf_status_undecrypted = -1;
  72 static int hf_status_fcs_error = -1;
  73
  74 static int hf_time = -1;
  75 static int hf_silence = -1;
  76 static int hf_signal = -1;
  77 static int hf_rate = -1;
  78 static int hf_channel = -1;
  79 static int hf_unknown = -1;
  80 static int hf_original_length = -1;
  81 static int hf_sensormac = -1;
  82
  83 /* ************************************************************************* */
  84 /*                        Encapsulation type values                          */
  85 /* ************************************************************************* */
  86
  87 #define TZSP_ENCAP_ETHERNET                     1
  88 #define TZSP_ENCAP_IEEE_802_11                  18
  89 #define TZSP_ENCAP_PRISM_HEADER                 119
  90 #define TZSP_ENCAP_WLAN_HEADER                  127
  91
  92 /* ************************************************************************* */
  93 /*                          Generic header options                           */
  94 /* ************************************************************************* */
  95
  96 #define TZSP_HDR_PAD 0 /* Pad. */
  97 #define TZSP_HDR_END 1 /* End of the list. */
  98 #define TZSP_HDR_ORIGINAL_LENGTH 41 /* Length of the packet before slicing. 2 bytes. */
  99 #define TZSP_HDR_SENSOR 60 /* Sensor MAC address packet was received on, 6 byte ethernet address.*/
 100
 101 /* ************************************************************************* */
 102 /*                          Options for 802.11 radios                        */
 103 /* ************************************************************************* */
 104
 105 #define WLAN_RADIO_HDR_SIGNAL 10 /* Signal strength in dBm, signed byte. */
 106 #define WLAN_RADIO_HDR_NOISE 11 /* Noise level in dBm, signed byte. */
 107 #define WLAN_RADIO_HDR_RATE 12 /* Data rate, unsigned byte. */
 108 #define WLAN_RADIO_HDR_TIMESTAMP 13 /* Timestamp in us, unsigned 32-bits network byte order. */
 109 #define WLAN_RADIO_HDR_MSG_TYPE 14 /* Packet type, unsigned byte. */
 110 #define WLAN_RADIO_HDR_CF 15 /* Whether packet arrived during CF period, unsigned byte. */
 111 #define WLAN_RADIO_HDR_UN_DECR 16 /* Whether packet could not be decrypted by MAC, unsigned byte. */
 112 #define WLAN_RADIO_HDR_FCS_ERR 17 /* Whether packet contains an FCS error, unsigned byte. */
 113 #define WLAN_RADIO_HDR_CHANNEL 18 /* Channel number packet was received on, unsigned byte.*/
 114
 115 /* ************************************************************************* */
 116 /*                Add option information to the display                      */
 117 /* ************************************************************************* */
 118
 119 static int
 120 add_option_info(tvbuff_t *tvb, int pos, proto_tree *tree, proto_item *ti)
 121 {
 122         guint8 tag, length, fcs_err = 0, encr = 0, seen_fcs_err = 0;
 123
 124         /*
 125          * Read all option tags in an endless loop. If the packet is malformed this
 126          * loop might be a problem.
 127          */
 128         while (TRUE) {
 129                 tag = tvb_get_guint8(tvb, pos++);
 130
 131                 switch (tag) {
 132                 case TZSP_HDR_PAD:
 133                         length = 0;
 134                         break;
 135
 136                 case TZSP_HDR_END:
 137                         /* Fill in header with information from other tags. */
 138                         if (seen_fcs_err) {
 139                                 if (tree)
 140                                         proto_item_append_text(ti,"%s", fcs_err?"FCS Error":(encr?"Encrypted":"Good"));
 141                         }
 142                         return pos;
 143
 144                 case TZSP_HDR_ORIGINAL_LENGTH:
 145                         length = tvb_get_guint8(tvb, pos++);
 146                         if (tree)
 147                                 proto_tree_add_int (tree, hf_original_length, tvb, pos-2, 4,
 148                                                 tvb_get_ntohs(tvb, pos));
 149                         pos += length;
 150                         break;
 151
 152                 case WLAN_RADIO_HDR_SIGNAL:
 153                         length = tvb_get_guint8(tvb, pos++);
 154                         if (tree)
 155                                 proto_tree_add_int (tree, hf_signal, tvb, pos-2, 3,
 156                                                 tvb_get_ntohs(tvb, pos));
 157                         pos += length;
 158                         break;
 159
 160                 case WLAN_RADIO_HDR_NOISE:
 161                         length = tvb_get_guint8(tvb, pos++);
 162                         if (tree)
 163                                 proto_tree_add_int (tree, hf_silence, tvb, pos-2, 3,
 164                                                 tvb_get_ntohs(tvb, pos));
 165                         pos += length;
 166                         break;
 167
 168                 case WLAN_RADIO_HDR_RATE:
 169                         length = tvb_get_guint8(tvb, pos++);
 170                         if (tree)
 171                                 proto_tree_add_uint (tree, hf_rate, tvb, pos-2, 3,
 172                                                         tvb_get_guint8(tvb, pos));
 173                         pos += length;
 174                         break;
 175
 176                 case WLAN_RADIO_HDR_TIMESTAMP:
 177                         length = tvb_get_guint8(tvb, pos++);
 178                         if (tree)
 179                                 proto_tree_add_uint (tree, hf_time, tvb, pos-2, 6,
 180                                                         tvb_get_ntohl(tvb, pos));
 181                         pos += length;
 182                         break;
 183
 184                 case WLAN_RADIO_HDR_MSG_TYPE:
 185                         length = tvb_get_guint8(tvb, pos++);
 186                         if (tree)
 187                                 proto_tree_add_uint (tree, hf_status_msg_type, tvb, pos-2, 3,
 188                                                 tvb_get_guint8(tvb, pos));
 189                         pos += length;
 190                         break;
 191
 192                 case WLAN_RADIO_HDR_CF:
 193                         length = tvb_get_guint8(tvb, pos++);
 194                         if (tree)
 195                                 proto_tree_add_boolean (tree, hf_status_pcf, tvb, pos-2, 3,
 196                                                 tvb_get_guint8(tvb, pos));
 197                         pos += length;
 198                         break;
 199
 200                 case WLAN_RADIO_HDR_UN_DECR:
 201                         length = tvb_get_guint8(tvb, pos++);
 202                         if (tree)
 203                                 proto_tree_add_boolean (tree, hf_status_undecrypted, tvb, pos-2, 3,
 204                                                 tvb_get_guint8(tvb, pos));
 205                         encr = tvb_get_guint8(tvb, pos);
 206                         pos += length;
 207                         break;
 208
 209                 case WLAN_RADIO_HDR_FCS_ERR:
 210                         seen_fcs_err = 1;
 211                         length = tvb_get_guint8(tvb, pos++);
 212                         if (tree)
 213                                 proto_tree_add_boolean (tree, hf_status_fcs_error, tvb, pos-2, 3,
 214                                                 tvb_get_guint8(tvb, pos));
 215                         fcs_err = tvb_get_guint8(tvb, pos);
 216                         pos += length;
 217                         break;
 218
 219                 case WLAN_RADIO_HDR_CHANNEL:
 220                         length = tvb_get_guint8(tvb, pos++);
 221                         if (tree)
 222                                 proto_tree_add_uint (tree, hf_channel, tvb, pos-2, 3,
 223                                                         tvb_get_guint8(tvb, pos));
 224                         pos += length;
 225                         break;
 226
 227                 case TZSP_HDR_SENSOR:
 228                         length = tvb_get_guint8(tvb, pos++);
 229                         if (tree)
 230                                 proto_tree_add_ether(tree, hf_sensormac, tvb, pos-2, 6,
 231                                                         tvb_get_ptr (tvb, pos, 6));
 232                         pos += length;
 233                         break;
 234
 235                 default:
 236                         length = tvb_get_guint8(tvb, pos++);
 237                         if (tree)
 238                                 proto_tree_add_bytes(tree, hf_unknown, tvb, pos-2, length+2,
 239                                                         tvb_get_ptr(tvb, pos, length));
 240                         pos += length;
 241                         break;
 242                 }
 243         }
 244 }
 245
 246 /* ************************************************************************* */
 247 /*        Map TZSP encapsulation types to Wiretap encapsulation types        */
 248 /* ************************************************************************* */
 249 struct encap_map {
 250         guint16 tzsp_encap;
 251         int     wtap_encap;
 252 };
 253
 254 static const struct encap_map map_table[] = {
 255         { TZSP_ENCAP_ETHERNET,          WTAP_ENCAP_ETHERNET },
 256         { TZSP_ENCAP_PRISM_HEADER,      WTAP_ENCAP_PRISM_HEADER },
 257         { TZSP_ENCAP_WLAN_HEADER,       WTAP_ENCAP_WLAN_HEADER },
 258         { TZSP_ENCAP_IEEE_802_11,       WTAP_ENCAP_IEEE_802_11 },
 259         { 0,                            -1 }
 260 };
 261
 262 static int
 263 tzsp_encap_to_wtap_encap(guint16 encap)
 264 {
 265         int i;
 266
 267         for (i = 0; map_table[i].wtap_encap != -1; i++) {
 268                 if (map_table[i].tzsp_encap == encap)
 269                         return map_table[i].wtap_encap;
 270         }
 271         return -1;
 272 }
 273
 274 /* ************************************************************************* */
 275 /*                Dissect a TZSP packet                                      */
 276 /* ************************************************************************* */
 277
 278 static void
 279 dissect_tzsp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 280 {
 281         proto_tree *tzsp_tree = NULL;
 282         proto_item *ti = NULL;
 283         int pos = 0;
 284         tvbuff_t *next_tvb;
 285         guint16 encapsulation = 0;
 286         int wtap_encap;
 287         dissector_handle_t encap_dissector;
 288         char *encap_name, *info;
 289         guint8 type;
 290
 291         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 292                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TZSP");
 293         if (check_col(pinfo->cinfo, COL_INFO))
 294                 col_clear(pinfo->cinfo, COL_INFO);
 295
 296         type = tvb_get_guint8(tvb, 1);
 297
 298         /* Find the dissector. */
 299         encapsulation = tvb_get_ntohs(tvb, 2);
 300         if (encapsulation != 0) {
 301                 wtap_encap = tzsp_encap_to_wtap_encap(encapsulation);
 302                 if (wtap_encap != -1 &&
 303                     (encap_dissector = dissector_get_port_handle(encap_dissector_table, wtap_encap))) {
 304                         encap_name = dissector_handle_get_short_name(encap_dissector);
 305                 }
 306                 else {
 307                         encap_name = "Unknown";
 308                 }
 309                 info = encap_name;
 310         }
 311         else {
 312                 wtap_encap = -1;
 313                 encap_name = "Nothing";
 314                 info = tzsp_type[type].strptr;
 315         }
 316
 317         if (check_col(pinfo->cinfo, COL_INFO))
 318                 col_set_str(pinfo->cinfo, COL_INFO, info);
 319
 320         if (tree) {
 321                 /* Adding TZSP item and subtree */
 322                 ti = proto_tree_add_protocol_format(tree, proto_tzsp, tvb, 0,
 323                     -1, "TZSP: %s: ", info);
 324                 tzsp_tree = proto_item_add_subtree(ti, ett_tzsp);
 325
 326                 proto_tree_add_item (tzsp_tree, hf_tzsp_version, tvb, 0, 1,
 327                                         FALSE);
 328                 proto_tree_add_uint (tzsp_tree, hf_tzsp_type, tvb, 1, 1,
 329                                         type);
 330                 proto_tree_add_uint_format (tzsp_tree, hf_tzsp_encap, tvb, 2, 2,
 331                                         encapsulation, "Encapsulates: %s (%d)",
 332                                         encap_name, encapsulation);
 333         }
 334
 335         if (type != 4 && type != 5) {
 336                 pos = add_option_info(tvb, 4, tzsp_tree, ti);
 337
 338                 if (tree)
 339                         proto_item_set_end(ti, tvb, pos);
 340                 next_tvb = tvb_new_subset(tvb, pos, -1, -1);
 341                 if (encapsulation != 0
 342                     && (wtap_encap == -1
 343                         || !dissector_try_port(encap_dissector_table, wtap_encap,
 344                                 next_tvb, pinfo, tree))) {
 345
 346                         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 347                                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "UNKNOWN");
 348                         if (check_col(pinfo->cinfo, COL_INFO))
 349                                 col_add_fstr(pinfo->cinfo, COL_INFO, "TZSP_ENCAP = %u",
 350                                     encapsulation);
 351                         call_dissector(data_handle, next_tvb, pinfo, tree);
 352                 }
 353         }
 354 }
 355
 356 /* ************************************************************************* */
 357 /*                Register the TZSP dissector                                */
 358 /* ************************************************************************* */
 359
 360 void
 361 proto_register_tzsp(void)
 362 {
 363         static const value_string msg_type[] = {
 364                 {0,     "Normal"},
 365                 {1,     "RFC1042 encoded"},
 366                 {2,     "Bridge-tunnel encoded"},
 367                 {4,     "802.11 management frame"},
 368                 {0,     NULL}
 369         };
 370
 371         static const true_false_string pcf_flag = {
 372                 "CF: Frame received during CF period",
 373                 "Not CF"
 374         };
 375
 376         static const true_false_string undecr_flag = {
 377                 "Encrypted frame could not be decrypted",
 378                 "Unencrypted"
 379         };
 380
 381         static const true_false_string fcs_err_flag = {
 382                 "FCS error, frame is corrupted",
 383                 "Frame is valid"
 384         };
 385
 386         static const value_string channels[] = {
 387                 /* 802.11b/g */
 388                 {1, "1 (2.412 GHz)"},
 389                 {2, "2 (2.417 GHz)"},
 390                 {3, "3 (2.422 GHz)"},
 391                 {4, "4 (2.427 GHz)"},
 392                 {5, "5 (2.432 GHz)"},
 393                 {6, "6 (2.437 GHz)"},
 394                 {7, "7 (2.442 GHz)"},
 395                 {8, "8 (2.447 GHz)"},
 396                 {9, "9 (2.452 GHz)"},
 397                 {10, "10 (2.457 GHz)"},
 398                 {11, "11 (2.462 GHz)"},
 399                 {12, "12 (2.467 GHz)"},
 400                 {13, "13 (2.472 GHz)"},
 401                 {14, "14 (2.484 GHz)"},
 402                 /* 802.11a */
 403                 {36, "36 (5.180 GHz)"},
 404                 {40, "40 (5.200 GHz)"},
 405                 {44, "44 (5.220 GHz)"},
 406                 {48, "48 (5.240 GHz)"},
 407                 {52, "52 (5.260 GHz)"},
 408                 {56, "56 (5.280 GHz)"},
 409                 {60, "60 (5.300 GHz)"},
 410                 {64, "64 (5.320 GHz)"},
 411                 {149, "149 (5.745 GHz)"},
 412                 {153, "153 (5.765 GHz)"},
 413                 {157, "157 (5.785 GHz)"},
 414                 {161, "161 (5.805 GHz)"},
 415                 {0, NULL}
 416         };
 417
 418         static const value_string rates[] = {
 419                 /* Old PRISM rates */
 420                 {0x0A, "1 Mbit/s"},
 421                 {0x14, "2 Mbit/s"},
 422                 {0x37, "5.5 Mbit/s"},
 423                 {0x6E, "11 Mbit/s"},
 424                 /* MicroAP rates */
 425                 {2, "1 Mbit/s"},
 426                 {4, "2 Mbit/s"},
 427                 {11, "5.5 Mbit/s"},
 428                 {12, "6 Mbit/s"},
 429                 {18, "9 Mbit/s"},
 430                 {22, "11 Mbit/s"},
 431                 {24, "12 Mbit/s"},
 432                 {36, "18 Mbit/s"},
 433                 {48, "24 Mbit/s"},
 434                 {72, "36 Mbit/s"},
 435                 {96, "48 Mbit/s"},
 436                 {108, "54 Mbit/s"},
 437                 {0, NULL}
 438         };
 439
 440         static hf_register_info hf[] = {
 441                 { &hf_tzsp_version, {
 442                         "Version", "tzsp.version", FT_UINT8, BASE_DEC,
 443                         NULL, 0, "Version", HFILL }},
 444                 { &hf_tzsp_type, {
 445                         "Type", "tzsp.type", FT_UINT8, BASE_DEC,
 446                         VALS(tzsp_type), 0, "Type", HFILL }},
 447                 { &hf_tzsp_encap, {
 448                         "Encapsulation", "tzsp.encap", FT_UINT16, BASE_DEC,
 449                         NULL, 0, "Encapsulation", HFILL }},
 450                 { &hf_status_field, {
 451                         "Status", "tzsp.wlan.status", FT_UINT16, BASE_HEX,
 452                                 NULL, 0, "Status", HFILL }},
 453                 { &hf_status_msg_type, {
 454                         "Type", "tzsp.wlan.status.msg_type", FT_UINT8, BASE_HEX,
 455                         VALS(msg_type), 0, "Message type", HFILL }},
 456                 { &hf_status_mac_port, {
 457                         "Port", "tzsp.wlan.status.mac_port", FT_UINT8, BASE_DEC,
 458                         NULL, 0, "MAC port", HFILL }},
 459                 { &hf_status_pcf, {
 460                         "PCF", "tzsp.wlan.status.pcf", FT_BOOLEAN, BASE_HEX,
 461                         TFS (&pcf_flag), 0, "Point Coordination Function", HFILL }},
 462                 { &hf_status_undecrypted, {
 463                         "Undecrypted", "tzsp.wlan.status.undecrypted", FT_BOOLEAN, BASE_HEX,
 464                         TFS (&undecr_flag), 0, "Undecrypted", HFILL }},
 465                 { &hf_status_fcs_error, {
 466                         "FCS", "tzsp.wlan.status.fcs_err", FT_BOOLEAN, BASE_HEX,
 467                         TFS (&fcs_err_flag), 0, "Frame check sequence", HFILL }},
 468                 { &hf_time, {
 469                         "Time", "tzsp.wlan.time", FT_UINT32, BASE_HEX,
 470                         NULL, 0, "Time", HFILL }},
 471                 { &hf_silence, {
 472                         "Silence", "tzsp.wlan.silence", FT_INT8, BASE_HEX,
 473                         NULL, 0, "Silence", HFILL }},
 474                 { &hf_original_length, {
 475                         "Original Length", "tzsp.original_length", FT_INT16, BASE_DEC,
 476                         NULL, 0, "OrigLength", HFILL }},
 477                 { &hf_signal, {
 478                         "Signal", "tzsp.wlan.signal", FT_INT8, BASE_HEX,
 479                         NULL, 0, "Signal", HFILL }},
 480                 { &hf_rate, {
 481                         "Rate", "tzsp.wlan.rate", FT_UINT8, BASE_HEX,
 482                         VALS(rates), 0, "Rate", HFILL }},
 483                 { &hf_channel, {
 484                         "Channel", "tzsp.wlan.channel", FT_UINT8, BASE_DEC,
 485                         VALS(channels), 0, "Channel", HFILL }},
 486                 { &hf_unknown, {
 487                         "Unknown tag", "tzsp.unknown", FT_BYTES, BASE_HEX,
 488                         NULL, 0, "Unknown", HFILL }},
 489                 { &hf_sensormac, {
 490                         "Sensor Address", "tzsp.sensormac", FT_ETHER, BASE_HEX,
 491                         NULL, 0, "Sensor MAC", HFILL }}
 492         };
 493
 494         static gint *ett[] = {
 495                 &ett_tzsp
 496         };
 497
 498         proto_tzsp = proto_register_protocol("Tazmen Sniffer Protocol", "TZSP",
 499             "tzsp");
 500         proto_register_field_array(proto_tzsp, hf, array_length(hf));
 501         proto_register_subtree_array(ett, array_length(ett));
 502
 503 }
 504
 505 void
 506 proto_reg_handoff_tzsp(void)
 507 {
 508         dissector_handle_t tzsp_handle;
 509
 510         tzsp_handle = create_dissector_handle(dissect_tzsp, proto_tzsp);
 511         dissector_add("udp.port", UDP_PORT_TZSP, tzsp_handle);
 512
 513         /* Get the data dissector for handling unknown encapsulation types. */
 514         data_handle = find_dissector("data");
 515
 516         /* Register this protocol as an ecapsulation type. */
 517         dissector_add("wtap_encap", WTAP_ENCAP_TZSP, tzsp_handle);
 518
 519         encap_dissector_table = find_dissector_table("wtap_encap");
 520 }