epan/dissectors/packet-socks.c

   1 /* packet-socks.c
   2  * Routines for socks versions 4 &5  packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  * Copyright 2008, Jelmer Vernooij <jelmer@samba.org>
   5  *
   6  * $Id$
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  *
  26  *
  27  * The Version 4 decode is based on SOCKS4.protocol and SOCKS4A.protocol.
  28  * The Version 5 decoder is based upon rfc-1928
  29  * The Version 5 User/Password authentication is based on rfc-1929.
  30  *
  31  * See
  32  *
  33  *      http://www.socks.permeo.com/TechnicalResources/ProtocolDocuments.asp
  34  *
  35  * for these and other documents.  See
  36  *
  37  *      http://www.socks.nec.com/protocol/socks4a.protocol
  38  *
  39  * for information on SOCKS version 4a.
  40  *
  41  * Revisions:
  42  *
  43  * 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel
  44  *                      causing heap overflow because of an infinite loop
  45  *                      where the socks dissect was call over and over.
  46  *
  47  *                      Also remove some old code marked with __JUNK__
  48  *
  49  * 2001-01-08 JCFoster Fixed problem with NULL pointer for hash data.
  50  *                      Now test and exit if hash_info is null.
  51  */
  52
  53 /* Possible enhancements -
  54  *
  55  * Add GSS-API authentication per rfc-1961
  56  * Add CHAP authentication
  57  * Decode FLAG bits per
  58  *      http://archive.socks.permeo.com/draft/draft-ietf-aft-socks-pro-v5-04.txt
  59  * In call_next_dissector, could load the destination address into
  60  *      pinfo->src or pinfo->dst structure before calling next dissector.
  61  * remove display_string or at least make it use protocol identifiers
  62  * socks_hash_entry_t needs to handle V5 address type and domain names
  63 */
  64
  65
  66
  67
  68 #ifdef HAVE_CONFIG_H
  69 # include "config.h"
  70 #endif
  71
  72
  73 #include <stdio.h>
  74 #include <string.h>
  75 #include <glib.h>
  76
  77 #include <epan/packet.h>
  78 #include <epan/addr_resolv.h>
  79 #include <epan/conversation.h>
  80
  81 #include <epan/emem.h>
  82 #include "packet-tcp.h"
  83 #include "packet-udp.h"
  84 #include <epan/strutil.h>
  85
  86
  87 #define compare_packet(X) (X == (pinfo->fd->num))
  88 #define get_packet_ptr  (pinfo->fd->num)
  89 #define row_pointer_type guint32
  90
  91 #define TCP_PORT_SOCKS 1080
  92
  93
  94 /**************** Socks commands ******************/
  95
  96 #define CONNECT_COMMAND         1
  97 #define BIND_COMMAND            2
  98 #define UDP_ASSOCIATE_COMMAND   3
  99 #define PING_COMMAND            0x80
 100 #define TRACERT_COMMAND         0x81
 101
 102
 103 /********** V5 Authentication methods *************/
 104
 105 #define NO_AUTHENTICATION       0
 106 #define GSS_API_AUTHENTICATION  1
 107 #define USER_NAME_AUTHENTICATION        2
 108 #define CHAP_AUTHENTICATION     3
 109 #define AUTHENTICATION_FAILED   0xff
 110
 111 /* 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel */
 112
 113 static int in_socks_dissector_flag = 0;         /* set to 1 to avoid recursive overflow */
 114
 115 /*********** Header field identifiers *************/
 116
 117 static int proto_socks = -1;
 118
 119 static int ett_socks = -1;
 120 static int ett_socks_auth = -1;
 121 static int ett_socks_name = -1;
 122
 123 static int hf_socks_ver = -1;
 124 static int hf_socks_ip_dst = -1;
 125 static int hf_socks_ip6_dst = -1;
 126 static int hf_user_name = -1;
 127 static int hf_gssapi_payload = -1;
 128 static int hf_gssapi_command = -1;
 129 static int hf_gssapi_length = -1;
 130 static int hf_v4a_dns_name = -1;
 131 static int hf_socks_dstport = -1;
 132 static int hf_socks_cmd = -1;
 133 static int hf_socks_results = -1;
 134 static int hf_socks_results_4 = -1;
 135 static int hf_socks_results_5 = -1;
 136
 137
 138 /************* Dissector handles ***********/
 139
 140 static dissector_handle_t socks_handle;
 141 static dissector_handle_t socks_udp_handle;
 142
 143 /************* State Machine names ***********/
 144
 145 enum SockState {
 146         None = 0,
 147         Connecting,
 148         V4UserNameWait,
 149         V4NameWait,
 150         V5Command,
 151         V5Reply,
 152         V5BindReply,
 153         UserNameAuth,
 154         UserNameAuthReply,
 155         GssApiAuth,
 156         GssApiAuthReply,
 157         Done
 158 };
 159
 160
 161
 162 typedef struct {
 163         int             state;
 164         int             version;
 165         int             command;
 166         int             grant;
 167         guint32         port;
 168         guint32         udp_port;
 169         guint32         udp_remote_port;
 170
 171         int             connect_offset;
 172         row_pointer_type        v4_name_row;
 173         row_pointer_type        v4_user_name_row;
 174         row_pointer_type        connect_row;
 175         row_pointer_type        cmd_reply_row;
 176         row_pointer_type        bind_reply_row;
 177         row_pointer_type        command_row;
 178         row_pointer_type        auth_method_row;
 179         row_pointer_type        user_name_auth_row;
 180         row_pointer_type        auth_version;
 181         row_pointer_type        gssapi_auth_row;
 182         row_pointer_type        gssapi_auth_reply_row;
 183         row_pointer_type        gssapi_auth_failure_row;
 184         guint32 start_done_row;
 185
 186         guint32 dst_addr;       /* this needs to handle IPv6 */
 187 }socks_hash_entry_t;
 188
 189
 190
 191
 192 static const char *address_type_table[] = {
 193         "Unknown",
 194         "IPv4",
 195         "Unknown",
 196         "Domain Name",
 197         "IPv6",
 198         "Unknown"
 199 };
 200
 201
 202 /* String table for the V4 reply status messages */
 203
 204 static const value_string reply_table_v4[] = {
 205         {90, "Granted"},
 206         {91, "Rejected or Failed"},
 207         {92, "Rejected because SOCKS server cannot connect to identd on the client"},
 208         {93, "Rejected because the client program and identd report different user-ids"},
 209         {0, NULL}
 210 };
 211
 212 /* String table for the V5 reply status messages */
 213
 214 static const value_string reply_table_v5[] = {
 215         {0, "Succeeded"},
 216         {1, "General SOCKS server failure"},
 217         {2, "Connection not allowed by ruleset"},
 218         {3, "Network unreachable"},
 219         {4, "Host unreachable"},
 220         {5, "Connection refused"},
 221         {6, "TTL expired"},
 222         {7, "Command not supported"},
 223         {8, "Address type not supported"},
 224         {0, NULL},
 225 };
 226
 227 static const value_string cmd_strings[] = {
 228         {0, "Unknown"},
 229         {1, "Connect"},
 230         {2, "Bind"},
 231         {3, "UdpAssociate"},
 232         {0x80, "Ping"},
 233         {0x81, "Traceroute"},
 234         {0, NULL}
 235 };
 236
 237 static const value_string gssapi_command_table[] = {
 238         { 1, "Authentication" },
 239         { 0xFF, "Failure" },
 240         { 0, NULL }
 241 };
 242
 243
 244 /************************* Support routines ***************************/
 245
 246
 247 static int display_string(tvbuff_t *tvb, int offset,
 248         proto_tree *tree, const char *label){
 249
 250 /* display a string with a length, characters encoding */
 251 /* they are displayed under a tree with the name in Label variable */
 252 /* return the length of the string and the length byte */
 253
 254
 255         proto_tree      *name_tree;
 256         proto_item      *ti;
 257
 258         char temp[ 256];
 259         int length = tvb_get_guint8(tvb, offset);
 260
 261         tvb_memcpy(tvb, (guint8 *)temp, offset+1, length);
 262         temp[ length ] = 0;
 263
 264         ti = proto_tree_add_text(tree, tvb, offset, length + 1,
 265                 "%s: %s" , label, temp);
 266
 267
 268         name_tree = proto_item_add_subtree(ti, ett_socks_name);
 269
 270         proto_tree_add_text( name_tree, tvb, offset, 1, "Length: %u", length);
 271
 272         ++offset;
 273
 274         proto_tree_add_text( name_tree, tvb, offset, length, "String: %s", temp);
 275
 276         return length + 1;
 277 }
 278
 279
 280
 281 static const char *get_auth_method_name( guint Number){
 282
 283 /* return the name of the authenication method */
 284
 285         if ( Number == 0) return "No authentication";
 286         if ( Number == 1) return "GSSAPI";
 287         if ( Number == 2) return "Username/Password";
 288         if ( Number == 3) return "Chap";
 289         if (( Number >= 4) && ( Number <= 0x7f))return "IANA assigned";
 290         if (( Number >= 0x80) && ( Number <= 0xfe)) return "private method";
 291         if ( Number == 0xff) return "no acceptable method";
 292
 293         /* shouldn't reach here */
 294
 295         return "Bad method number (not 0-0xff)";
 296 }
 297
 298
 299 static const char *get_command_name( guint Number){
 300
 301 /* return the name of the command as a string */
 302
 303         if ( Number == 0) return "Unknown";
 304         if ( Number == 1) return "Connect";
 305         if ( Number == 2) return "Bind";
 306         if ( Number == 3) return "UdpAssociate";
 307         if ( Number == 0x80) return "Ping";
 308         if ( Number == 0x81) return "Traceroute";
 309         return "Unknown";
 310 }
 311
 312
 313 static int display_address(tvbuff_t *tvb, int offset, proto_tree *tree) {
 314
 315 /* decode and display the v5 address, return offset of next byte */
 316
 317         int a_type = tvb_get_guint8(tvb, offset);
 318
 319         proto_tree_add_text( tree, tvb, offset, 1,
 320                         "Address Type: %d (%s)", a_type,
 321                         address_type_table[ MIN( (guint) a_type,
 322                                 array_length( address_type_table)-1) ]);
 323
 324         ++offset;
 325
 326         if ( a_type == 1){              /* IPv4 address */
 327                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset,
 328                                         4, FALSE);
 329                 offset += 4;
 330         }
 331         else if ( a_type == 3){ /* domain name address */
 332
 333                 offset += display_string(tvb, offset, tree,
 334                         "Remote name");
 335         }
 336         else if ( a_type == 4){ /* IPv6 address */
 337                 proto_tree_add_item( tree, hf_socks_ip6_dst, tvb, offset,
 338                                 16, FALSE);
 339                 offset += 16;
 340         }
 341
 342         return offset;
 343 }
 344
 345
 346 static int get_address_v5(tvbuff_t *tvb, int offset,
 347         socks_hash_entry_t *hash_info) {
 348
 349 /* decode the v5 address and return offset of next byte */
 350 /*XXX this needs to handle IPV6 and domain name addresses */
 351
 352
 353         int a_type = tvb_get_guint8(tvb, offset++);
 354
 355         if ( a_type == 1){              /* IPv4 address */
 356
 357                 if ( hash_info)
 358                         hash_info->dst_addr = tvb_get_ipv4(tvb, offset);
 359                 offset += 4;
 360         }
 361
 362         else if ( a_type == 4)          /* IPv6 address */
 363                 offset += 16;
 364
 365         else if ( a_type == 3)  /* domain name address */
 366                 offset += tvb_get_guint8(tvb, offset) + 1;
 367         return offset;
 368 }
 369
 370
 371 /********************* V5 UDP Associate handlers ***********************/
 372
 373 static void
 374 socks_udp_dissector(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
 375
 376 /* Conversation dissector called from UDP dissector. Decode and display */
 377 /* the socks header, the pass the rest of the data to the udp port      */
 378 /* decode routine to  handle the payload.                               */
 379
 380         int offset = 0;
 381         guint32 *ptr;
 382         socks_hash_entry_t *hash_info;
 383         conversation_t *conversation;
 384         proto_tree      *socks_tree;
 385         proto_item      *ti;
 386
 387         conversation = find_conversation( pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype,
 388                 pinfo->srcport, pinfo->destport, 0);
 389
 390         DISSECTOR_ASSERT( conversation);        /* should always find a conversation */
 391
 392         hash_info = conversation_get_proto_data(conversation, proto_socks);
 393
 394         col_set_str(pinfo->cinfo, COL_PROTOCOL, "Socks");
 395
 396         if (check_col(pinfo->cinfo, COL_INFO))
 397                 col_set_str(pinfo->cinfo, COL_INFO, "Version: 5, UDP Associated packet");
 398
 399         if ( tree) {
 400                 ti = proto_tree_add_protocol_format( tree, proto_socks, tvb,
 401                         offset, -1, "Socks" );
 402
 403                 socks_tree = proto_item_add_subtree(ti, ett_socks);
 404
 405                 proto_tree_add_text( socks_tree, tvb, offset, 2, "Reserved");
 406                 offset += 2;
 407
 408                 proto_tree_add_text( socks_tree, tvb, offset, 1, "Fragment Number: %u", tvb_get_guint8(tvb, offset));
 409                 ++offset;
 410
 411
 412                 offset = display_address( tvb, offset, socks_tree);
 413                 hash_info->udp_remote_port = tvb_get_ntohs(tvb, offset);
 414
 415                 proto_tree_add_uint( socks_tree, hf_socks_dstport, tvb,
 416                         offset, 2, hash_info->udp_remote_port);
 417
 418                 offset += 2;
 419         }
 420         else {          /* no tree, skip past the socks header */
 421                 offset += 3;
 422                 offset = get_address_v5( tvb, offset, 0) + 2;
 423         }
 424
 425
 426 /* set pi src/dst port and call the udp sub-dissector lookup */
 427
 428         if ( pinfo->srcport == hash_info->port)
 429                 ptr = &pinfo->destport;
 430         else
 431                 ptr = &pinfo->srcport;
 432
 433         *ptr = hash_info->udp_remote_port;
 434
 435         decode_udp_ports( tvb, offset, pinfo, tree, pinfo->srcport, pinfo->destport, -1);
 436
 437         *ptr = hash_info->udp_port;
 438
 439 }
 440
 441
 442 static void
 443 new_udp_conversation( socks_hash_entry_t *hash_info, packet_info *pinfo){
 444
 445         conversation_t *conversation = conversation_new( pinfo->fd->num, &pinfo->src, &pinfo->dst,  PT_UDP,
 446                         hash_info->udp_port, hash_info->port, 0);
 447
 448         DISSECTOR_ASSERT( conversation);
 449
 450         conversation_add_proto_data(conversation, proto_socks, hash_info);
 451         conversation_set_dissector(conversation, socks_udp_handle);
 452 }
 453
 454
 455
 456
 457 /**************** Protocol Tree Display routines  ******************/
 458
 459 static void
 460 display_socks_v4(tvbuff_t *tvb, int offset, packet_info *pinfo,
 461         proto_tree *tree, socks_hash_entry_t *hash_info) {
 462
 463
 464 /* Display the protocol tree for the V4 version. This routine uses the  */
 465 /* stored conversation information to decide what to do with the row.   */
 466 /* Per packet information would have been better to do this, but we     */
 467 /* didn't have that when I wrote this. And I didn't expect this to get  */
 468 /* so messy.                                                            */
 469
 470
 471         proto_item *hidden_item;
 472         guint command;
 473         unsigned char ipaddr[4];
 474         guint username_len, domainname_len;
 475
 476                                         /* Display command from client */
 477         if (compare_packet( hash_info->connect_row)){
 478
 479                 proto_tree_add_text( tree, tvb, offset, 1,
 480                                 "Version: %u", hash_info->version);
 481                 ++offset;
 482                 command = tvb_get_guint8(tvb, offset);
 483
 484                 proto_tree_add_text( tree, tvb, offset, 1,
 485                         "Command: %u (%s)", command,
 486                                 get_command_name( command));
 487                 ++offset;
 488
 489                                                 /* Do remote port       */
 490                 proto_tree_add_item( tree, hf_socks_dstport, tvb, offset, 2,
 491                                 FALSE);
 492                 offset += 2;
 493
 494                                                 /* Do destination address */
 495                 tvb_memcpy(tvb, ipaddr, offset, 4);
 496                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset,
 497                                 4, FALSE);
 498
 499                 offset += 4;
 500
 501 /*XXX check this, needs to do length checking    */
 502 /* Should perhaps do TCP reassembly as well */
 503                 if ( tvb_offset_exists(tvb, offset)) {
 504                                                 /* display user name    */
 505                         username_len = tvb_strsize(tvb, offset);
 506                         proto_tree_add_item( tree, hf_user_name, tvb, offset,
 507                                 username_len, FALSE);
 508                         offset += username_len;
 509                         if ( ipaddr[0] == 0 && ipaddr[1] == 0 &&
 510                              ipaddr[2] == 0 && ipaddr[3] != 0) {
 511                                 /* 0.0.0.x , where x!=0 means v4a support */
 512                                 domainname_len = tvb_strsize(tvb, offset);
 513                                 proto_tree_add_item( tree, hf_v4a_dns_name,
 514                                         tvb, offset, domainname_len,
 515                                         FALSE);
 516                         }
 517                 }
 518
 519         }
 520                                 /*Display command response from server*/
 521
 522         else if ( compare_packet( hash_info->cmd_reply_row)){
 523
 524                 proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1,
 525                                 FALSE);
 526                 ++offset;
 527                                                 /* Do results code      */
 528                 proto_tree_add_item( tree, hf_socks_results_4, tvb, offset, 1, FALSE);
 529                 hidden_item = proto_tree_add_item(tree, hf_socks_results, tvb, offset, 1, FALSE);
 530                 PROTO_ITEM_SET_HIDDEN(hidden_item);
 531
 532                 ++offset;
 533
 534                                                 /* Do remote port       */
 535                 proto_tree_add_item( tree, hf_socks_dstport, tvb, offset, 2,
 536                                 FALSE);
 537                 offset += 2;
 538                                                 /* Do remote address    */
 539                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset, 4,
 540                         FALSE);
 541         }
 542
 543         else if ( compare_packet( hash_info->v4_user_name_row)){
 544
 545 /*XXX check this, needs to do length checking    */
 546 /* Should perhaps do TCP reassembly as well */
 547                 if ( tvb_offset_exists(tvb, offset)) {
 548                         proto_tree_add_text( tree, tvb, offset,
 549                                 tvb_strsize(tvb, offset),
 550                                 "User Name: %s", tvb_get_ptr(tvb, offset, -1));
 551                 }
 552         }
 553 }
 554
 555
 556 static void
 557 display_socks_v5(tvbuff_t *tvb, int offset, packet_info *pinfo,
 558         proto_tree *tree, socks_hash_entry_t *hash_info) {
 559
 560 /* Display the protocol tree for the version. This routine uses the     */
 561 /* stored conversation information to decide what to do with the row.   */
 562 /* Per packet information would have been better to do this, but we     */
 563 /* didn't have that when I wrote this. And I didn't expect this to get  */
 564 /* so messy.                                                            */
 565
 566         unsigned int i, command;
 567         guint temp;
 568         const char *AuthMethodStr;
 569         guint8 auth_status;
 570
 571         proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1, FALSE);
 572         ++offset;
 573
 574         if (compare_packet( hash_info->connect_row)){
 575
 576                 proto_tree      *AuthTree;
 577                 proto_item      *ti;
 578
 579                 temp = tvb_get_guint8(tvb, offset);     /* Get Auth method count */
 580                                                         /* build auth tree */
 581                 ti = proto_tree_add_text( tree, tvb, offset, -1,
 582                                 "Client Authentication Methods");
 583
 584                 AuthTree = proto_item_add_subtree(ti, ett_socks_auth);
 585
 586                 proto_tree_add_text( AuthTree, tvb, offset, 1,
 587                                 "Count: %u", temp);
 588                 ++offset;
 589
 590                 for( i = 0; i  < temp; ++i) {
 591
 592                         AuthMethodStr = get_auth_method_name(
 593                                 tvb_get_guint8( tvb, offset));
 594                         proto_tree_add_text( AuthTree, tvb, offset, 1,
 595                                 "Method[%u]: %u (%s)", i,
 596                                 tvb_get_guint8( tvb, offset), AuthMethodStr);
 597                         ++offset;
 598                 }
 599                 proto_item_set_end( ti, tvb, offset);
 600                 return;
 601         }                                       /* Get accepted auth method */
 602         else if (compare_packet( hash_info->auth_method_row)) {
 603
 604                 proto_tree_add_text( tree, tvb, offset, 1,
 605                         "Accepted Auth Method: 0x%0x (%s)", tvb_get_guint8( tvb, offset),
 606                                 get_auth_method_name( tvb_get_guint8( tvb, offset)));
 607
 608                 return;
 609         }                                       /* handle user/password auth */
 610         else if (compare_packet( hash_info->user_name_auth_row)) {
 611
 612                                                 /* process user name    */
 613                 offset += display_string( tvb, offset, tree,
 614                                 "User name");
 615                                                 /* process password     */
 616                 offset += display_string( tvb, offset, tree,
 617                                 "Password");
 618         }
 619                                         /* command to the server */
 620                                         /* command response from server */
 621         else if (compare_packet( hash_info->auth_version)) {
 622                 auth_status = tvb_get_guint8(tvb, offset);
 623                 if(auth_status != 0)
 624                         proto_tree_add_text( tree, tvb, offset, 1, "Status: %u (failure)", auth_status);
 625                 else
 626                         proto_tree_add_text( tree, tvb, offset, 1, "Status: success");
 627                 offset ++;
 628         }
 629         else if (compare_packet( hash_info->gssapi_auth_row)) {
 630                 guint16 len;
 631                 proto_tree_add_item( tree, hf_gssapi_command, tvb, offset, 1, FALSE);
 632                 proto_tree_add_item( tree, hf_gssapi_length, tvb, offset+1, 2, FALSE);
 633                 len = tvb_get_ntohs(tvb, offset+1);
 634                 if (len > 0)
 635                         proto_tree_add_item( tree, hf_gssapi_payload, tvb, offset+3, len, FALSE);
 636         }
 637         else if (compare_packet( hash_info->gssapi_auth_failure_row)) {
 638                 proto_tree_add_item( tree, hf_gssapi_command, tvb, offset, 1, FALSE);
 639         }
 640         else if (compare_packet( hash_info->gssapi_auth_reply_row)) {
 641                 guint16 len;
 642                 proto_tree_add_item( tree, hf_gssapi_command, tvb, offset, 1, FALSE);
 643                 proto_tree_add_item( tree, hf_gssapi_length, tvb, offset+1, 2, FALSE);
 644                 len = tvb_get_ntohs(tvb, offset+1);
 645                 if (len > 0)
 646                         proto_tree_add_item( tree, hf_gssapi_payload, tvb, offset+3, len, FALSE);
 647         }
 648         else if ((compare_packet( hash_info->command_row)) ||
 649                  (compare_packet( hash_info->cmd_reply_row)) ||
 650                  (compare_packet( hash_info->bind_reply_row))){
 651
 652                 command = tvb_get_guint8(tvb, offset);
 653
 654                 if (compare_packet( hash_info->command_row))
 655                         proto_tree_add_uint( tree, hf_socks_cmd, tvb, offset, 1,
 656                             command);
 657
 658                 else {
 659                         proto_item *hidden_item;
 660                         proto_tree_add_item( tree, hf_socks_results_5, tvb, offset, 1, FALSE);
 661                         hidden_item = proto_tree_add_item(tree, hf_socks_results, tvb, offset, 1, FALSE);
 662                         PROTO_ITEM_SET_HIDDEN(hidden_item);
 663                 }
 664
 665                 ++offset;
 666
 667                 proto_tree_add_text( tree, tvb, offset, 1,
 668                         "Reserved: 0x%0x (should = 0x00)", tvb_get_guint8(tvb, offset));
 669                 ++offset;
 670
 671                 offset = display_address(tvb, offset, tree);
 672 /*XXX Add remote port for search somehow */
 673                                                 /* Do remote port       */
 674                 proto_tree_add_text( tree, tvb, offset, 2,
 675                                 "%sPort: %u",
 676                                 (compare_packet( hash_info->bind_reply_row) ?
 677                                         "Remote Host " : ""),
 678                                  tvb_get_ntohs(tvb, offset));
 679         }
 680 }
 681
 682
 683
 684 /**************** Decoder State Machines ******************/
 685
 686
 687 static guint
 688 state_machine_v4( socks_hash_entry_t *hash_info, tvbuff_t *tvb,
 689         int offset, packet_info *pinfo) {
 690
 691 /* Decode V4 protocol.  This is done on the first pass through the      */
 692 /* list.  Based upon the current state, decode the packet and determine */
 693 /* what the next state should be.  If we had per packet information,    */
 694 /* this would be the place to load them up.                             */
 695
 696         if ( hash_info->state == None) {                /* new connection */
 697
 698                 col_append_str(pinfo->cinfo, COL_INFO, " Connect to server request");
 699
 700                 hash_info->state = Connecting;  /* change state         */
 701
 702                 hash_info->command = tvb_get_guint8(tvb, offset + 1);
 703                                                 /* get remote port      */
 704                 if ( hash_info->command == CONNECT_COMMAND)
 705                         hash_info->port =  tvb_get_ntohs(tvb, offset + 2);
 706                                                 /* get remote address   */
 707
 708                 hash_info->dst_addr = tvb_get_ipv4(tvb, offset + 4);
 709
 710                                                 /* save the packet pointer */
 711                 hash_info->connect_row = get_packet_ptr;
 712
 713                                                 /* skip past this stuff */
 714                 hash_info->connect_offset = offset + 8;
 715
 716                 offset += 8;
 717
 718                 if ( !tvb_offset_exists(tvb, offset)) { /* if no user name */
 719                                                         /* change state */
 720                         hash_info->state = V4UserNameWait;
 721                         /*
 722                          * XXX - add 1, or leave it alone?
 723                          * We were adding "strlen(...) + 1".
 724                          */
 725                         hash_info->connect_offset += 1;
 726                 } else {
 727                         /*
 728                          * Add in the length of the user name.
 729                          * XXX - what if the user name is split between
 730                          * TCP segments?
 731                          */
 732                         hash_info->connect_offset += tvb_strsize(tvb, offset);
 733                 }
 734
 735                 if ( !hash_info->dst_addr){             /* if no dest address */
 736                                                         /* if more data */
 737                         if ( tvb_offset_exists(tvb, hash_info->connect_offset)) {
 738 /*XXX copy remote name here ??? */
 739                                 hash_info->state = Connecting;
 740                         }
 741                         else
 742                                 hash_info->state = V4NameWait;
 743                                                 }
 744                                                 /* waiting for V4 user name */
 745         }else if ( hash_info->state == V4UserNameWait){
 746
 747                 col_append_str(pinfo->cinfo, COL_INFO, " Connect Request (User name)");
 748
 749                 hash_info->v4_user_name_row = get_packet_ptr;
 750 /*XXX may need to check for domain name here */
 751                 hash_info->state = Connecting;
 752         }
 753                                         /* waiting for V4 domain name   */
 754         else if ( hash_info->state == V4NameWait){
 755
 756                 hash_info->v4_name_row = get_packet_ptr;
 757                 hash_info->state = Connecting;
 758
 759         }
 760         else if ( hash_info->state == Connecting){
 761
 762                 col_append_str(pinfo->cinfo, COL_INFO, " Connect Response");
 763
 764                                                 /* save packet pointer  */
 765                 hash_info->cmd_reply_row = get_packet_ptr;
 766                 hash_info->state = Done;                /* change state         */
 767                 offset = offset + 8;
 768         }
 769
 770         return offset;
 771 }
 772
 773
 774
 775 static void
 776 state_machine_v5( socks_hash_entry_t *hash_info, tvbuff_t *tvb,
 777         int offset, packet_info *pinfo) {
 778
 779 /* Decode V5 protocol.  This is done on the first pass through the      */
 780 /* list.  Based upon the current state, decode the packet and determine */
 781 /* what the next state should be.  If we had per packet information,    */
 782 /* this would be the place to load them up.                             */
 783
 784
 785         int temp;
 786
 787         if ( hash_info->state == None) {
 788
 789                 col_append_str(pinfo->cinfo, COL_INFO, " Connect to server request");
 790
 791                 hash_info->state = Connecting;  /* change state         */
 792                 hash_info->connect_row = get_packet_ptr;
 793
 794                 temp = tvb_get_guint8(tvb, offset + 1);
 795                                                 /* skip past auth methods */
 796                 offset = hash_info->connect_offset = offset + 1 + temp;
 797         }
 798         else if ( hash_info->state == Connecting){
 799
 800                 guint AuthMethod = tvb_get_guint8(tvb, offset + 1);
 801
 802                 col_append_str(pinfo->cinfo, COL_INFO, " Connect to server response");
 803
 804                 hash_info->auth_method_row = get_packet_ptr;
 805
 806                 if ( AuthMethod == NO_AUTHENTICATION)
 807                         hash_info->state = V5Command;
 808
 809                 else if ( AuthMethod == USER_NAME_AUTHENTICATION)
 810                         hash_info->state = UserNameAuth;
 811
 812                 else if ( AuthMethod == GSS_API_AUTHENTICATION)
 813                         hash_info->state = GssApiAuth;
 814
 815                 else    hash_info->state = Done;        /*Auth failed or error*/
 816
 817         }
 818
 819         else if ( hash_info->state == V5Command) {      /* Handle V5 Command */
 820
 821                 guint temp;
 822
 823                 hash_info->command = tvb_get_guint8(tvb, offset + 1); /* get command */
 824
 825                 if (check_col(pinfo->cinfo, COL_INFO))
 826                         col_append_fstr(pinfo->cinfo, COL_INFO, " Command Request - %s",
 827                                 get_command_name(hash_info->command));
 828
 829                 hash_info->state = V5Reply;
 830                 hash_info->command_row = get_packet_ptr;
 831
 832                 offset += 3;                    /* skip to address type */
 833
 834                 offset = get_address_v5(tvb, offset, hash_info);
 835
 836                 temp = tvb_get_guint8(tvb, offset);
 837
 838                 if (( hash_info->command == CONNECT_COMMAND) ||
 839                     ( hash_info->command == UDP_ASSOCIATE_COMMAND))
 840                                                 /* get remote port      */
 841                         hash_info->port =  tvb_get_ntohs(tvb, offset);
 842         }
 843
 844         else if ( hash_info->state == V5Reply) {        /* V5 Command Reply */
 845
 846
 847                 if (check_col(pinfo->cinfo, COL_INFO))
 848                         col_append_fstr(pinfo->cinfo, COL_INFO, " Command Response - %s",
 849                                 get_command_name(hash_info->command));
 850
 851                 hash_info->cmd_reply_row = get_packet_ptr;
 852
 853                 if (( hash_info->command == CONNECT_COMMAND) ||
 854                     (hash_info->command == PING_COMMAND) ||
 855                     (hash_info->command == TRACERT_COMMAND))
 856                         hash_info->state = Done;
 857
 858                 else if ( hash_info->command == BIND_COMMAND)
 859                         hash_info->state = V5BindReply;
 860
 861                 else if ( hash_info->command == UDP_ASSOCIATE_COMMAND){
 862                         offset += 3;            /* skip to address type */
 863                         offset = get_address_v5(tvb, offset, hash_info);
 864
 865         /* save server udp port and create udp conversation */
 866                         hash_info->udp_port =  tvb_get_ntohs(tvb, offset);
 867
 868                         if (!pinfo->fd->flags.visited)
 869                                 new_udp_conversation( hash_info, pinfo);
 870
 871 /*XXX may need else statement to handle unknowns and generate error message */
 872
 873                 }
 874         }
 875         else if ( hash_info->state == V5BindReply) {    /* V5 Bind Second Reply */
 876
 877                 col_append_str(pinfo->cinfo, COL_INFO, " Command Response: Bind remote host info");
 878
 879                 hash_info->bind_reply_row = get_packet_ptr;
 880                 hash_info->state = Done;
 881         }
 882         else if ( hash_info->state == UserNameAuth) {   /* Handle V5 User Auth*/
 883                 col_append_str(pinfo->cinfo, COL_INFO,
 884                                 " User authentication request");
 885
 886                 hash_info->user_name_auth_row = get_packet_ptr;
 887                 hash_info->state = UserNameAuthReply;
 888
 889         }
 890         else if ( hash_info->state == GssApiAuth) {
 891                 col_append_str(pinfo->cinfo, COL_INFO,
 892                                                    " GSSAPI Authentication request");
 893                 hash_info->gssapi_auth_row = get_packet_ptr;
 894                 hash_info->state = GssApiAuthReply;
 895         }
 896         else if ( hash_info->state == GssApiAuthReply) {
 897                 if (tvb_get_guint8(tvb, offset+1) == 0xFF) {
 898                         col_append_str(pinfo->cinfo, COL_INFO,
 899                                                            " GSSAPI Authentication failure");
 900                         hash_info->gssapi_auth_failure_row = get_packet_ptr;
 901                 } else {
 902                         col_append_str(pinfo->cinfo, COL_INFO,
 903                                                            " GSSAPI Authentication reply");
 904                         if (tvb_get_ntohs(tvb, offset+2) == 0)
 905                                 hash_info->state = V5Command;
 906                         else
 907                                 hash_info->state = GssApiAuth;
 908                         hash_info->gssapi_auth_reply_row = get_packet_ptr;
 909                 }
 910         }
 911         else if ( hash_info->state == UserNameAuthReply){       /* V5 User Auth reply */
 912                 hash_info->auth_version = get_packet_ptr;
 913                 col_append_str(pinfo->cinfo, COL_INFO, " User authentication reply");
 914                 hash_info->state = V5Command;
 915         }
 916 }
 917
 918
 919
 920 static void
 921 display_ping_and_tracert(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, socks_hash_entry_t *hash_info) {
 922
 923 /* Display the ping/trace_route conversation */
 924
 925
 926         const guchar    *data, *dataend;
 927         const guchar   *lineend, *eol;
 928         int             linelen;
 929
 930                                         /* handle the end command */
 931         if ( pinfo->destport == TCP_PORT_SOCKS){
 932                 col_append_str(pinfo->cinfo, COL_INFO, ", Terminate Request");
 933
 934                 if ( tree)
 935                         proto_tree_add_text(tree, tvb, offset, 1,
 936                                 (hash_info->command  == PING_COMMAND) ?
 937                                 "Ping: End command" :
 938                                 "Traceroute: End command");
 939         }
 940         else{           /* display the PING or Traceroute results */
 941                 col_append_str(pinfo->cinfo, COL_INFO, ", Results");
 942
 943                 if ( tree){
 944                         proto_tree_add_text(tree, tvb, offset, -1,
 945                                 (hash_info->command  == PING_COMMAND) ?
 946                                 "Ping Results:" :
 947                                 "Traceroute Results");
 948
 949                         data = tvb_get_ptr(tvb, offset, -1);
 950                         dataend = data + tvb_length_remaining(tvb, offset);
 951
 952                         while (data < dataend) {
 953
 954                                 lineend = find_line_end(data, dataend, &eol);
 955                                 linelen = (int)(lineend - data);
 956
 957                                 proto_tree_add_text( tree, tvb, offset, linelen,
 958                                         "%s", format_text(data, linelen));
 959                                 offset += linelen;
 960                                 data = lineend;
 961                         }
 962                 }
 963         }
 964 }
 965
 966
 967
 968 static void clear_in_socks_dissector_flag(void *dummy _U_)
 969 {
 970         in_socks_dissector_flag = 0; /* avoid recursive overflow */
 971 }
 972
 973 static void call_next_dissector(tvbuff_t *tvb, int offset, packet_info *pinfo,
 974         proto_tree *tree, proto_tree *socks_tree,
 975         socks_hash_entry_t *hash_info)
 976 {
 977
 978 /* Display the results for PING and TRACERT extensions or               */
 979 /* Call TCP dissector for the port that was passed during the           */
 980 /* connect process                                                      */
 981 /* Load pointer to pinfo->XXXport depending upon the direction,         */
 982 /* change pinfo port to the remote port, call next dissecotr to decode  */
 983 /* the payload, and restore the pinfo port after that is done.          */
 984
 985         guint32 *ptr;
 986         struct tcpinfo *tcpinfo = pinfo->private_data;
 987         guint16 save_can_desegment;
 988         struct tcp_analysis *tcpd=NULL;
 989
 990         tcpd=get_tcp_conversation_data(NULL,pinfo);
 991
 992         if (( hash_info->command  == PING_COMMAND) ||
 993             ( hash_info->command  == TRACERT_COMMAND))
 994
 995                 display_ping_and_tracert(tvb, offset, pinfo, tree, hash_info);
 996
 997         else {          /* call the tcp port decoder to handle the payload */
 998
 999 /*XXX may want to load dest address here */
1000
1001                 if ( pinfo->destport  == TCP_PORT_SOCKS)
1002                         ptr = &pinfo->destport;
1003                 else
1004                         ptr = &pinfo->srcport;
1005
1006                 *ptr = hash_info->port;
1007
1008 /* 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel */
1009
1010                 in_socks_dissector_flag = 1; /* avoid recursive overflow */
1011                 CLEANUP_PUSH(clear_in_socks_dissector_flag, NULL);
1012
1013                 save_can_desegment = pinfo->can_desegment;
1014                 pinfo->can_desegment = pinfo->saved_can_desegment;
1015                 dissect_tcp_payload(tvb, pinfo, offset, tcpinfo->seq,
1016                     tcpinfo->nxtseq, pinfo->srcport, pinfo->destport,
1017                     tree, socks_tree, tcpd);
1018                 pinfo->can_desegment = save_can_desegment;
1019
1020                 CLEANUP_CALL_AND_POP;
1021
1022                 *ptr = TCP_PORT_SOCKS;
1023         }
1024 }
1025
1026
1027
1028 static void
1029 dissect_socks(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
1030
1031         int             offset = 0;
1032         proto_tree      *socks_tree = NULL;
1033         proto_item      *ti;
1034         socks_hash_entry_t *hash_info;
1035         conversation_t *conversation;
1036
1037 /* 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel */
1038
1039         /* avoid recursive overflow */
1040
1041         if ( in_socks_dissector_flag) {
1042                 return;
1043         }
1044
1045         conversation = find_conversation( pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype,
1046                 pinfo->srcport, pinfo->destport, 0);
1047
1048         if ( !conversation){
1049                 conversation = conversation_new( pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype,
1050                         pinfo->srcport, pinfo->destport, 0);
1051         }
1052         hash_info = conversation_get_proto_data(conversation,proto_socks);
1053         if ( !hash_info){
1054                 hash_info = se_alloc(sizeof(socks_hash_entry_t));
1055                 hash_info->start_done_row = G_MAXINT;
1056                 hash_info->state = None;
1057                 hash_info->port = 0;
1058                 hash_info->version = tvb_get_guint8(tvb, offset); /* get version*/
1059
1060                 if (( hash_info->version != 4) &&       /* error test version */
1061                    ( hash_info->version != 5))
1062                         hash_info->state = Done;
1063
1064                 conversation_add_proto_data(conversation, proto_socks,
1065                         hash_info);
1066
1067                                                 /* set dissector for now */
1068                 conversation_set_dissector(conversation, socks_handle);
1069         }
1070
1071 /* display summary window information  */
1072
1073         col_set_str(pinfo->cinfo, COL_PROTOCOL, "Socks");
1074
1075         if (check_col(pinfo->cinfo, COL_INFO)){
1076                 if (( hash_info->version == 4) || ( hash_info->version == 5)){
1077                         col_add_fstr(pinfo->cinfo, COL_INFO, "Version: %d",
1078                                 hash_info->version);
1079                 }
1080                 else                    /* unknown version display error */
1081                         col_set_str(pinfo->cinfo, COL_INFO, "Unknown");
1082
1083
1084                 if ( hash_info->command == PING_COMMAND)
1085                         col_append_str(pinfo->cinfo, COL_INFO, ", Ping Req");
1086                 if ( hash_info->command == TRACERT_COMMAND)
1087                         col_append_str(pinfo->cinfo, COL_INFO, ", Traceroute Req");
1088
1089 /*XXX           if ( hash_info->port != -1) */
1090                 if ( hash_info->port != 0)
1091                         col_append_fstr(pinfo->cinfo, COL_INFO, ", Remote Port: %u",
1092                                 hash_info->port);
1093         }
1094
1095
1096 /* run state machine if needed */
1097
1098         if ((hash_info->state != Done) && ( !pinfo->fd->flags.visited)){
1099
1100                 if ( hash_info->version == 4)
1101                         state_machine_v4( hash_info, tvb, offset, pinfo);
1102
1103                 else if ( hash_info->version == 5)
1104                         state_machine_v5( hash_info, tvb, offset, pinfo);
1105
1106                 if (hash_info->state == Done) {         /* if done now  */
1107                         hash_info->start_done_row = pinfo->fd->num;
1108                 }
1109         }
1110
1111 /* if proto tree, decode and display */
1112
1113         if (tree) {
1114                 ti = proto_tree_add_item( tree, proto_socks, tvb, offset, -1,
1115                         FALSE );
1116
1117                 socks_tree = proto_item_add_subtree(ti, ett_socks);
1118
1119                 if ( hash_info->version == 4)
1120                         display_socks_v4(tvb, offset, pinfo, socks_tree,
1121                                 hash_info);
1122
1123                 else if ( hash_info->version == 5)
1124                         display_socks_v5(tvb, offset, pinfo, socks_tree,
1125                                 hash_info);
1126
1127                                 /* if past startup, add the faked stuff */
1128                 if ( pinfo->fd->num >  hash_info->start_done_row){
1129                                                 /*  add info to tree */
1130                         proto_tree_add_text( socks_tree, tvb, offset, 0,
1131                                 "Command: %d (%s)", hash_info->command,
1132                                 get_command_name(hash_info->command));
1133
1134                         proto_tree_add_ipv4( socks_tree, hf_socks_ip_dst, tvb,
1135                                         offset, 0, hash_info->dst_addr);
1136
1137                                 /* no fake address for ping & traceroute */
1138
1139                         if (( hash_info->command != PING_COMMAND) &&
1140                             ( hash_info->command != TRACERT_COMMAND)){
1141                                 proto_tree_add_uint( socks_tree, hf_socks_dstport, tvb,
1142                                         offset, 0, hash_info->port);
1143                         }
1144                 }
1145
1146         }
1147
1148
1149 /* call next dissector if ready */
1150
1151         if ( pinfo->fd->num > hash_info->start_done_row){
1152                 call_next_dissector(tvb, offset, pinfo, tree, socks_tree,
1153                     hash_info);
1154         }
1155 }
1156
1157
1158
1159 void
1160 proto_register_socks( void){
1161
1162 /*** Prep the socks protocol, register it and a initialization routine  */
1163 /*      to clear the hash stuff.                                        */
1164
1165
1166         static gint *ett[] = {
1167                 &ett_socks,
1168                 &ett_socks_auth,
1169                 &ett_socks_name
1170
1171         };
1172
1173         static hf_register_info hf[] = {
1174
1175
1176                 { &hf_socks_ver,
1177                         { "Version", "socks.version", FT_UINT8, BASE_DEC, NULL,
1178                                 0x0, NULL, HFILL
1179                         }
1180                 },
1181                 { &hf_socks_ip_dst,
1182                         { "Remote Address", "socks.dst", FT_IPv4, BASE_NONE, NULL,
1183                                 0x0, NULL, HFILL
1184                         }
1185                 },
1186                 { &hf_socks_ip6_dst,
1187                         { "Remote Address(ipv6)", "socks.dstV6", FT_IPv6, BASE_NONE, NULL,
1188                                 0x0, NULL, HFILL
1189                         }
1190                 },
1191                 { &hf_user_name,
1192                         { "User Name", "socks.username", FT_STRINGZ, BASE_NONE, NULL,
1193                                 0x0, NULL, HFILL
1194                         }
1195                 },
1196                 { &hf_gssapi_payload,
1197                         { "GSSAPI data", "socks.gssapi.data", FT_BYTES, BASE_NONE, NULL,
1198                                 0x0, NULL, HFILL
1199                         }
1200                 },
1201                 { &hf_gssapi_command,
1202                         { "SOCKS/GSSAPI command", "socks.gssapi.command", FT_UINT8, BASE_DEC,
1203                                 VALS(gssapi_command_table), 0x0, NULL, HFILL
1204                         }
1205                 },
1206                 { &hf_gssapi_length,
1207                         { "SOCKS/GSSAPI data length", "socks.gssapi.length", FT_UINT16, BASE_DEC, NULL,
1208                                 0x0, NULL, HFILL
1209                         }
1210                 },
1211                 { &hf_v4a_dns_name,
1212                         { "SOCKS v4a Remote Domain Name", "socks.v4a_dns_name", FT_STRINGZ, BASE_NONE,
1213                                 NULL, 0x0, NULL, HFILL
1214                         }
1215                 },
1216                 { &hf_socks_dstport,
1217                         { "Remote Port", "socks.dstport", FT_UINT16,
1218                                 BASE_DEC, NULL, 0x0, NULL, HFILL
1219                         }
1220                 },
1221                 { &hf_socks_cmd,
1222                         { "Command", "socks.command", FT_UINT8,
1223                                 BASE_DEC,  VALS(cmd_strings), 0x0, NULL, HFILL
1224                         }
1225                 },
1226                 { &hf_socks_results_4,
1227                         { "Results(V4)", "socks.results_v4", FT_UINT8,
1228                                 BASE_DEC, VALS(reply_table_v4), 0x0, NULL, HFILL
1229                         }
1230                 },
1231                 { &hf_socks_results_5,
1232                         { "Results(V5)", "socks.results_v5", FT_UINT8,
1233                                 BASE_DEC, VALS(reply_table_v5), 0x0, NULL, HFILL
1234                         }
1235                 },
1236                 { &hf_socks_results,
1237                         { "Results(V5)", "socks.results", FT_UINT8,
1238                                 BASE_DEC, NULL, 0x0, NULL, HFILL
1239                         }
1240                 }
1241
1242         };
1243
1244
1245         proto_socks = proto_register_protocol (
1246                 "Socks Protocol", "Socks", "socks");
1247
1248         proto_register_field_array(proto_socks, hf, array_length(hf));
1249         proto_register_subtree_array(ett, array_length(ett));
1250 }
1251
1252
1253 void
1254 proto_reg_handoff_socks(void) {
1255
1256         /* dissector install routine */
1257         socks_udp_handle = create_dissector_handle(socks_udp_dissector, proto_socks);
1258         socks_handle = create_dissector_handle(dissect_socks, proto_socks);
1259
1260         dissector_add("tcp.port", TCP_PORT_SOCKS, socks_handle);
1261 }