packet-ymsg.c

   1 /* packet-ymsg.c
   2  * Routines for Yahoo Messenger YMSG protocol packet version 9 dissection
   3  * Copyright 2003, Wayne Parrott <wayne_p@pacific.net.au>
   4  * Copied from packet-yhoo.c and updated
   5  *
   6  * $Id: packet-ymsg.c,v 1.4 2004/04/02 07:28:43 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #include <stdio.h>
  32
  33 #include <string.h>
  34 #include <glib.h>
  35 #include <epan/packet.h>
  36
  37 #include "packet-tcp.h"
  38 #include "prefs.h"
  39
  40 static int proto_ymsg = -1;
  41 static int hf_ymsg_version = -1;
  42 static int hf_ymsg_len = -1;
  43 static int hf_ymsg_service = -1;
  44 static int hf_ymsg_status = -1;
  45 static int hf_ymsg_session_id = -1;
  46 static int hf_ymsg_content = -1;
  47
  48 static gint ett_ymsg = -1;
  49 static gint ett_ymsg_content = -1;
  50
  51 #define TCP_PORT_YMSG   23      /* XXX - this is Telnet! */
  52 #define TCP_PORT_YMSG_2 25      /* And this is SMTP! */
  53 #define TCP_PORT_YMSG_3 5050    /* This, however, is regular Yahoo Messenger */
  54
  55 /* desegmentation of YMSG over TCP */
  56 static gboolean ymsg_desegment = TRUE;
  57
  58 /*
  59  * This is from yahoolib2.c from libyahoo2.
  60  *
  61  * See also
  62  *
  63  *      http://libyahoo2.sourceforge.net/ymsg-9.txt
  64  *
  65  * and
  66  *
  67  *      http://www.venkydude.com/articles/yahoo.htm
  68  *
  69  * and
  70  *
  71  *      http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
  72  *
  73  * and
  74  *
  75  *      http://www.geocrawler.com/archives/3/4893/2002/1/0/7459037/
  76  *
  77  * and
  78  *
  79  *      http://www.geocities.com/ziggycubbe/ym.html
  80  */
  81
  82 /* Service constants */
  83 enum yahoo_service { /* these are easier to see in hex */
  84         YAHOO_SERVICE_LOGON = 1,
  85         YAHOO_SERVICE_LOGOFF,
  86         YAHOO_SERVICE_ISAWAY,
  87         YAHOO_SERVICE_ISBACK,
  88         YAHOO_SERVICE_IDLE, /* 5 (placemarker) */
  89         YAHOO_SERVICE_MESSAGE,
  90         YAHOO_SERVICE_IDACT,
  91         YAHOO_SERVICE_IDDEACT,
  92         YAHOO_SERVICE_MAILSTAT,
  93         YAHOO_SERVICE_USERSTAT, /* 0xa */
  94         YAHOO_SERVICE_NEWMAIL,
  95         YAHOO_SERVICE_CHATINVITE,
  96         YAHOO_SERVICE_CALENDAR,
  97         YAHOO_SERVICE_NEWPERSONALMAIL,
  98         YAHOO_SERVICE_NEWCONTACT,
  99         YAHOO_SERVICE_ADDIDENT, /* 0x10 */
 100         YAHOO_SERVICE_ADDIGNORE,
 101         YAHOO_SERVICE_PING,
 102         YAHOO_SERVICE_GOTGROUPRENAME, /* < 1, 36(old), 37(new) */
 103         YAHOO_SERVICE_SYSMESSAGE = 0x14,
 104         YAHOO_SERVICE_PASSTHROUGH2 = 0x16,
 105         YAHOO_SERVICE_CONFINVITE = 0x18,
 106         YAHOO_SERVICE_CONFLOGON,
 107         YAHOO_SERVICE_CONFDECLINE,
 108         YAHOO_SERVICE_CONFLOGOFF,
 109         YAHOO_SERVICE_CONFADDINVITE,
 110         YAHOO_SERVICE_CONFMSG,
 111         YAHOO_SERVICE_CHATLOGON,
 112         YAHOO_SERVICE_CHATLOGOFF,
 113         YAHOO_SERVICE_CHATMSG = 0x20,
 114         YAHOO_SERVICE_GAMELOGON = 0x28,
 115         YAHOO_SERVICE_GAMELOGOFF,
 116         YAHOO_SERVICE_GAMEMSG = 0x2a,
 117         YAHOO_SERVICE_FILETRANSFER = 0x46,
 118         YAHOO_SERVICE_VOICECHAT = 0x4A,
 119         YAHOO_SERVICE_NOTIFY,
 120         YAHOO_SERVICE_VERIFY,
 121         YAHOO_SERVICE_P2PFILEXFER,
 122         YAHOO_SERVICE_PEERTOPEER = 0x4F,        /* Checks if P2P possible */
 123         YAHOO_SERVICE_AUTHRESP = 0x54,
 124         YAHOO_SERVICE_LIST,
 125         YAHOO_SERVICE_AUTH = 0x57,
 126         YAHOO_SERVICE_ADDBUDDY = 0x83,
 127         YAHOO_SERVICE_REMBUDDY,
 128         YAHOO_SERVICE_IGNORECONTACT,    /* > 1, 7, 13 < 1, 66, 13, 0*/
 129         YAHOO_SERVICE_REJECTCONTACT,
 130         YAHOO_SERVICE_GROUPRENAME = 0x89, /* > 1, 65(new), 66(0), 67(old) */
 131         YAHOO_SERVICE_CHATONLINE = 0x96, /* > 109(id), 1, 6(abcde) < 0,1*/
 132         YAHOO_SERVICE_CHATGOTO,
 133         YAHOO_SERVICE_CHATJOIN, /* > 1 104-room 129-1600326591 62-2 */
 134         YAHOO_SERVICE_CHATLEAVE,
 135         YAHOO_SERVICE_CHATEXIT = 0x9b,
 136         YAHOO_SERVICE_CHATLOGOUT = 0xa0,
 137         YAHOO_SERVICE_CHATPING,
 138         YAHOO_SERVICE_COMMENT = 0xa8
 139 };
 140
 141 /* Message flags */
 142 enum yahoo_status {
 143         YAHOO_STATUS_AVAILABLE = 0,
 144         YAHOO_STATUS_BRB,
 145         YAHOO_STATUS_BUSY,
 146         YAHOO_STATUS_NOTATHOME,
 147         YAHOO_STATUS_NOTATDESK,
 148         YAHOO_STATUS_NOTINOFFICE,
 149         YAHOO_STATUS_ONPHONE,
 150         YAHOO_STATUS_ONVACATION,
 151         YAHOO_STATUS_OUTTOLUNCH,
 152         YAHOO_STATUS_STEPPEDOUT,
 153         YAHOO_STATUS_INVISIBLE = 12,
 154         YAHOO_STATUS_CUSTOM = 99,
 155         YAHOO_STATUS_IDLE = 999,
 156         YAHOO_STATUS_OFFLINE = 0x5a55aa56, /* don't ask */
 157         YAHOO_STATUS_TYPING = 0x16
 158 };
 159
 160 struct yahoo_rawpacket
 161 {
 162         char ymsg[4];                   /* Packet identification string (YMSG) */
 163         unsigned char version[4];       /* 4 bytes, little endian? */
 164         unsigned char len[2];           /* length - little endian */
 165         unsigned char service[2];       /* service - little endian */
 166         unsigned char status[4];        /* Status - online, away etc.*/
 167         unsigned char session_id[4];    /* Session ID */
 168         char content[6];                /* 6 is the minimum size of the content */
 169 };
 170
 171 static const value_string ymsg_service_vals[] = {
 172         {YAHOO_SERVICE_LOGON, "Pager Logon"},
 173         {YAHOO_SERVICE_LOGOFF, "Pager Logoff"},
 174         {YAHOO_SERVICE_ISAWAY, "Is Away"},
 175         {YAHOO_SERVICE_ISBACK, "Is Back"},
 176         {YAHOO_SERVICE_IDLE, "Idle"},
 177         {YAHOO_SERVICE_MESSAGE, "Message"},
 178         {YAHOO_SERVICE_IDACT, "Activate Identity"},
 179         {YAHOO_SERVICE_IDDEACT, "Deactivate Identity"},
 180         {YAHOO_SERVICE_MAILSTAT, "Mail Status"},
 181         {YAHOO_SERVICE_USERSTAT, "User Status"},
 182         {YAHOO_SERVICE_NEWMAIL, "New Mail"},
 183         {YAHOO_SERVICE_CHATINVITE, "Chat Invitation"},
 184         {YAHOO_SERVICE_CALENDAR, "Calendar Reminder"},
 185         {YAHOO_SERVICE_NEWPERSONALMAIL, "New Personals Mail"},
 186         {YAHOO_SERVICE_NEWCONTACT, "New Friend"},
 187         {YAHOO_SERVICE_ADDIDENT, "Add Identity"},
 188         {YAHOO_SERVICE_ADDIGNORE, "Add Ignore"},
 189         {YAHOO_SERVICE_PING, "Ping"},
 190         {YAHOO_SERVICE_GOTGROUPRENAME, "YAHOO_SERVICE_GOTGROUPRENAME"},
 191         {YAHOO_SERVICE_SYSMESSAGE, "System Message"},
 192         {YAHOO_SERVICE_PASSTHROUGH2, "Passthrough 2"},
 193         {YAHOO_SERVICE_CONFINVITE, "Conference Invitation"},
 194         {YAHOO_SERVICE_CONFLOGON, "Conference Logon"},
 195         {YAHOO_SERVICE_CONFDECLINE, "Conference Decline"},
 196         {YAHOO_SERVICE_CONFLOGOFF, "Conference Logoff"},
 197         {YAHOO_SERVICE_CONFADDINVITE, "Conference Additional Invitation"},
 198         {YAHOO_SERVICE_CONFMSG, "Conference Message"},
 199         {YAHOO_SERVICE_CHATLOGON, "Chat Logon"},
 200         {YAHOO_SERVICE_CHATLOGOFF, "Chat Logoff"},
 201         {YAHOO_SERVICE_CHATMSG, "Chat Message"},
 202         {YAHOO_SERVICE_GAMELOGON, "Game Logon"},
 203         {YAHOO_SERVICE_GAMELOGOFF, "Game Logoff"},
 204         {YAHOO_SERVICE_GAMEMSG, "Game Message"},
 205         {YAHOO_SERVICE_FILETRANSFER, "File Transfer"},
 206         {YAHOO_SERVICE_VOICECHAT, "Voice Chat"},
 207         {YAHOO_SERVICE_NOTIFY, "YAHOO_SERVICE_NOTIFY"},
 208         {YAHOO_SERVICE_VERIFY, "YAHOO_SERVICE_VERIFY"},
 209         {YAHOO_SERVICE_P2PFILEXFER, "YAHOO_SERVICE_P2PFILEXFER"},
 210         {YAHOO_SERVICE_PEERTOPEER, "YAHOO_SERVICE_PEERTOPEER"},
 211         {YAHOO_SERVICE_AUTHRESP, "YAHOO_SERVICE_AUTHRESP"},
 212         {YAHOO_SERVICE_LIST, "YAHOO_SERVICE_LIST"},
 213         {YAHOO_SERVICE_AUTH, "YAHOO_SERVICE_AUTH"},
 214         {YAHOO_SERVICE_ADDBUDDY, "YAHOO_SERVICE_ADDBUDDY"},
 215         {YAHOO_SERVICE_REMBUDDY, "YAHOO_SERVICE_REMBUDDY"},
 216         {YAHOO_SERVICE_IGNORECONTACT, "YAHOO_SERVICE_IGNORECONTACT"},
 217         {YAHOO_SERVICE_REJECTCONTACT, "YAHOO_SERVICE_REJECTCONTACT"},
 218         {YAHOO_SERVICE_GROUPRENAME, "Group Renamed"},
 219         {YAHOO_SERVICE_CHATONLINE, "YAHOO_SERVICE_CHATONLINE"},
 220         {YAHOO_SERVICE_CHATGOTO, "YAHOO_SERVICE_CHATGOTO"},
 221         {YAHOO_SERVICE_CHATJOIN, "YAHOO_SERVICE_CHATJOIN"},
 222         {YAHOO_SERVICE_CHATLEAVE, "YAHOO_SERVICE_CHATLEAVE"},
 223         {YAHOO_SERVICE_CHATEXIT, "YAHOO_SERVICE_CHATEXIT"},
 224         {YAHOO_SERVICE_CHATLOGOUT, "YAHOO_SERVICE_CHATLOGOUT"},
 225         {YAHOO_SERVICE_CHATPING, "YAHOO_SERVICE_CHATPING"},
 226         {YAHOO_SERVICE_COMMENT, "YAHOO_SERVICE_COMMENT"},
 227         {0, NULL}
 228 };
 229
 230 static const value_string ymsg_status_vals[] = {
 231         {YAHOO_STATUS_AVAILABLE, "YAHOO_STATUS_AVAILABLE"},
 232         {YAHOO_STATUS_BRB, "YAHOO_STATUS_BRB"},
 233         {YAHOO_STATUS_BUSY, "YAHOO_STATUS_BUSY"},
 234         {YAHOO_STATUS_NOTATHOME, "YAHOO_STATUS_NOTATHOME"},
 235         {YAHOO_STATUS_NOTATDESK, "YAHOO_STATUS_NOTATDESK"},
 236         {YAHOO_STATUS_NOTINOFFICE, "YAHOO_STATUS_NOTINOFFICE"},
 237         {YAHOO_STATUS_ONPHONE, "YAHOO_STATUS_ONPHONE"},
 238         {YAHOO_STATUS_ONVACATION, "YAHOO_STATUS_ONVACATION"},
 239         {YAHOO_STATUS_OUTTOLUNCH, "YAHOO_STATUS_OUTTOLUNCH"},
 240         {YAHOO_STATUS_STEPPEDOUT, "YAHOO_STATUS_STEPPEDOUT"},
 241         {YAHOO_STATUS_INVISIBLE, "YAHOO_STATUS_INVISIBLE"},
 242         {YAHOO_STATUS_CUSTOM, "YAHOO_STATUS_CUSTOM"},
 243         {YAHOO_STATUS_IDLE, "YAHOO_STATUS_IDLE"},
 244         {YAHOO_STATUS_OFFLINE, "YAHOO_STATUS_OFFLINE"},
 245         {YAHOO_STATUS_TYPING, "YAHOO_STATUS_TYPING"},
 246         {0, NULL}
 247 };
 248
 249 static guint get_ymsg_pdu_len(tvbuff_t *tvb, int offset);
 250 static void dissect_ymsg_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 251
 252 int
 253 get_content_item_length(tvbuff_t *tvb, int offset) {
 254         int origoffset = offset;
 255         guint16 curdata;
 256         for (;;) {
 257                 curdata = tvb_get_ntohs(tvb, offset);
 258                 if (curdata == 0xc080) {
 259                         break;
 260                 }
 261                 offset++;
 262         }
 263         return offset - origoffset;
 264 }
 265
 266
 267 static gboolean
 268 dissect_ymsg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 269 {
 270
 271   if (tvb_memeql(tvb, 0, "YMSG", 4) == -1) {
 272     /* Not a Yahoo Messenger packet. */
 273     return FALSE;
 274   }
 275
 276   tcp_dissect_pdus(tvb, pinfo, tree, ymsg_desegment, 8, get_ymsg_pdu_len,
 277                    dissect_ymsg_pdu);
 278   return TRUE;
 279 }
 280
 281 static guint
 282 get_ymsg_pdu_len(tvbuff_t *tvb, int offset)
 283 {
 284   guint16 plen;
 285
 286   /*
 287    * Get the length of the YMSG packet.
 288    */
 289   plen = tvb_get_ntohs(tvb, offset + 8);
 290
 291   /*
 292    * That length doesn't include the length of the header itself; add that in.
 293    */
 294   return plen + 20;
 295 }
 296
 297 static void
 298 dissect_ymsg_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 299 {
 300         proto_tree      *ymsg_tree, *ti;
 301         proto_item      *content_item;
 302         proto_tree      *content_tree;
 303         char *keybuf;
 304         char *valbuf;
 305         int headersize = sizeof(struct yahoo_rawpacket)-6;
 306         int keylen = 0;
 307         int vallen = 0;
 308         int offset = 0;
 309         int content_len = 0;
 310
 311         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 312                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "YMSG");
 313
 314         offset = 0;
 315         if (check_col(pinfo->cinfo, COL_INFO)) {
 316                 col_add_fstr(pinfo->cinfo, COL_INFO,
 317                         "%s, %s",
 318                         val_to_str(tvb_get_ntohs(tvb, offset + 10),
 319                                  ymsg_service_vals, "Unknown Service: %u"),
 320                         val_to_str(tvb_get_ntohl(tvb, offset + 12),
 321                                  ymsg_status_vals, "Unknown Status: %u")
 322                 );
 323         }
 324
 325         if (tree) {
 326                 ti = proto_tree_add_item(tree, proto_ymsg, tvb, offset, -1,
 327                                 FALSE);
 328                 ymsg_tree = proto_item_add_subtree(ti, ett_ymsg);
 329
 330                 offset += 4; /* skip the YMSG string */
 331
 332                 proto_tree_add_item(ymsg_tree, hf_ymsg_version, tvb,
 333                         offset, 2, FALSE);
 334                 offset += 2;
 335
 336                 offset += 2;    /* XXX - padding? */
 337
 338                 content_len = tvb_get_ntohs(tvb, offset);
 339                 proto_tree_add_item(ymsg_tree, hf_ymsg_len, tvb,
 340                         offset, 2, FALSE);
 341                 offset += 2;
 342
 343                 proto_tree_add_item(ymsg_tree, hf_ymsg_service, tvb,
 344                         offset, 2, FALSE);
 345                 offset += 2;
 346
 347                 proto_tree_add_item(ymsg_tree, hf_ymsg_status, tvb,
 348                         offset, 4, FALSE);
 349                 offset += 4;
 350
 351                 proto_tree_add_item(ymsg_tree, hf_ymsg_session_id, tvb,
 352                         offset, 4, TRUE);
 353                 offset += 4;
 354
 355                 content_item = proto_tree_add_item(ymsg_tree, hf_ymsg_content, tvb,
 356                                 offset, -1, TRUE);
 357                 content_tree = proto_item_add_subtree(content_item, ett_ymsg_content);
 358
 359                 for (;;) {
 360                         if (offset >= headersize+content_len) {
 361                                 break;
 362                         }
 363                         keylen = get_content_item_length (tvb, offset);
 364                         keybuf = tvb_format_text(tvb, offset, keylen);
 365                         vallen = get_content_item_length (tvb, offset+keylen+2);
 366                         content_item = proto_tree_add_text(content_tree, tvb, offset, keylen+vallen+4, "%s: ", keybuf);
 367                         valbuf = tvb_format_text(tvb, offset+keylen+2, vallen);
 368                         proto_item_append_text(content_item, "%s", valbuf);
 369                         offset += keylen+vallen+4;
 370                 }
 371         }
 372
 373         return;
 374 }
 375
 376 void
 377 proto_register_ymsg(void)
 378 {
 379         static hf_register_info hf[] = {
 380                         { &hf_ymsg_version, {
 381                                 "Version", "ymsg.version", FT_UINT16, BASE_DEC,
 382                                 NULL, 0, "Packet version identifier", HFILL }},
 383                         { &hf_ymsg_len, {
 384                                 "Packet Length", "ymsg.len", FT_UINT16, BASE_DEC,
 385                                 NULL, 0, "Packet Length", HFILL }},
 386                         { &hf_ymsg_service, {
 387                                 "Service", "ymsg.service", FT_UINT16, BASE_DEC,
 388                                 VALS(ymsg_service_vals), 0, "Service Type", HFILL }},
 389                         { &hf_ymsg_status, {
 390                                 "Status", "ymsg.status", FT_UINT32, BASE_DEC,
 391                                 VALS(ymsg_status_vals), 0, "Message Type Flags", HFILL }},
 392                         { &hf_ymsg_session_id, {
 393                                 "Session ID", "ymsg.session_id", FT_UINT32, BASE_HEX,
 394                                 NULL, 0, "Connection ID", HFILL }},
 395                         { &hf_ymsg_content, {
 396                                 "Content", "ymsg.content", FT_STRING, 0,
 397                                 NULL, 0, "Data portion of the packet", HFILL }},
 398         };
 399         static gint *ett[] = {
 400                 &ett_ymsg,
 401                 &ett_ymsg_content,
 402         };
 403         module_t *ymsg_module;
 404
 405         proto_ymsg = proto_register_protocol("Yahoo YMSG Messenger Protocol",
 406             "YMSG", "ymsg");
 407
 408         proto_register_field_array(proto_ymsg, hf, array_length(hf));
 409
 410         proto_register_subtree_array(ett, array_length(ett));
 411
 412         ymsg_module = prefs_register_protocol(proto_ymsg, NULL);
 413         prefs_register_bool_preference(ymsg_module, "desegment",
 414                                        "Desegment all YMSG messages spanning multiple TCP segments",
 415                                        "Whether the YMSG dissector should desegment all messages spanning multiple TCP segments",
 416                                        &ymsg_desegment);
 417 }
 418
 419 void
 420 proto_reg_handoff_ymsg(void)
 421 {
 422         /*
 423          * DO NOT register for port 23, as that's Telnet, or for port
 424          * 25, as that's SMTP.
 425          *
 426          * Also, DO NOT register for port 5050, as that's used by the
 427          * old and new Yahoo messenger protocols.
 428          *
 429          * Just register as a heuristic TCP dissector, and reject stuff
 430          * that doesn't begin with a YMSG signature.
 431          */
 432         heur_dissector_add("tcp", dissect_ymsg, proto_ymsg);
 433 }