epan/dissectors/packet-tacacs.c

   1 /* packet-tacacs.c
   2  * Routines for cisco tacacs/xtacacs/tacacs+ packet dissection
   3  * Copyright 2001, Paul Ionescu <paul@acorp.ro>
   4  *
   5  * Full Tacacs+ parsing with decryption by
   6  *   Emanuele Caratti <wiz@iol.it>
   7  *
   8  * $Id$
   9  *
  10  * Wireshark - Network traffic analyzer
  11  * By Gerald Combs <gerald@wireshark.org>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * Copied from old packet-tacacs.c
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31
  32 /* rfc-1492 for tacacs and xtacacs
  33  * draft-grant-tacacs-02.txt for tacacs+ (tacplus)
  34  * ftp://ftp.cisco.com/pub/rfc/DRAFTS/draft-grant-tacacs-02.txt
  35  */
  36
  37 #ifdef HAVE_CONFIG_H
  38 # include "config.h"
  39 #endif
  40
  41 #include <stdio.h>
  42 #include <string.h>
  43
  44 #include <sys/types.h>
  45 #ifdef HAVE_SYS_SOCKET_H
  46 #include <sys/socket.h>
  47 #endif
  48 #ifdef HAVE_NETINET_IN_H
  49 # include <netinet/in.h>
  50 #endif
  51 #ifdef HAVE_ARPA_INET_H
  52 #include <arpa/inet.h>
  53 #endif
  54
  55 #ifdef HAVE_WINSOCK2_H
  56 #include <winsock2.h>           /* needed to define AF_ values on Windows */
  57 #endif
  58
  59 #ifdef NEED_INET_V6DEFS_H
  60 # include "inet_v6defs.h"
  61 #endif
  62
  63 #include <glib.h>
  64 #include <epan/packet.h>
  65
  66 #include <epan/prefs.h>
  67 #include <epan/crypt/crypt-md5.h>
  68 #include <epan/emem.h>
  69 #include "packet-tacacs.h"
  70
  71 static void md5_xor( guint8 *data, const char *key, int data_len, guint8 *session_id, guint8 version, guint8 seq_no );
  72
  73 static int proto_tacacs = -1;
  74 static int hf_tacacs_version = -1;
  75 static int hf_tacacs_type = -1;
  76 static int hf_tacacs_nonce = -1;
  77 static int hf_tacacs_userlen = -1;
  78 static int hf_tacacs_passlen = -1;
  79 static int hf_tacacs_response = -1;
  80 static int hf_tacacs_reason = -1;
  81 static int hf_tacacs_result1 = -1;
  82 static int hf_tacacs_destaddr = -1;
  83 static int hf_tacacs_destport = -1;
  84 static int hf_tacacs_line = -1;
  85 static int hf_tacacs_result2 = -1;
  86 static int hf_tacacs_result3 = -1;
  87
  88 static gint ett_tacacs = -1;
  89
  90 static gboolean tacplus_preference_desegment = TRUE;
  91
  92 static const char *tacplus_opt_key;
  93 static GSList *tacplus_keys = NULL;
  94
  95 #define VERSION_TACACS  0x00
  96 #define VERSION_XTACACS 0x80
  97
  98 static const value_string tacacs_version_vals[] = {
  99         { VERSION_TACACS,  "TACACS" },
 100         { VERSION_XTACACS, "XTACACS" },
 101         { 0,               NULL }
 102 };
 103
 104 #define TACACS_LOGIN            1
 105 #define TACACS_RESPONSE         2
 106 #define TACACS_CHANGE           3
 107 #define TACACS_FOLLOW           4
 108 #define TACACS_CONNECT          5
 109 #define TACACS_SUPERUSER        6
 110 #define TACACS_LOGOUT           7
 111 #define TACACS_RELOAD           8
 112 #define TACACS_SLIP_ON          9
 113 #define TACACS_SLIP_OFF         10
 114 #define TACACS_SLIP_ADDR        11
 115 static const value_string tacacs_type_vals[] = {
 116         { TACACS_LOGIN,     "Login" },
 117         { TACACS_RESPONSE,  "Response" },
 118         { TACACS_CHANGE,    "Change" },
 119         { TACACS_FOLLOW,    "Follow" },
 120         { TACACS_CONNECT,   "Connect" },
 121         { TACACS_SUPERUSER, "Superuser" },
 122         { TACACS_LOGOUT,    "Logout" },
 123         { TACACS_RELOAD,    "Reload" },
 124         { TACACS_SLIP_ON,   "SLIP on" },
 125         { TACACS_SLIP_OFF,  "SLIP off" },
 126         { TACACS_SLIP_ADDR, "SLIP Addr" },
 127         { 0,                NULL }};
 128
 129 static const value_string tacacs_reason_vals[] = {
 130         { 0  , "none" },
 131         { 1  , "expiring" },
 132         { 2  , "password" },
 133         { 3  , "denied" },
 134         { 4  , "quit" },
 135         { 5  , "idle" },
 136         { 6  , "drop" },
 137         { 7  , "bad" },
 138         { 0  , NULL }
 139 };
 140
 141 static const value_string tacacs_resp_vals[] = {
 142         { 0  , "this is not a response" },
 143         { 1  , "accepted" },
 144         { 2  , "rejected" },
 145         { 0  , NULL }
 146 };
 147
 148 #define UDP_PORT_TACACS 49
 149 #define TCP_PORT_TACACS 49
 150
 151 static void
 152 dissect_tacacs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 153 {
 154         proto_tree      *tacacs_tree;
 155         proto_item      *ti;
 156         guint8          txt_buff[255+1],version,type,userlen,passlen;
 157
 158         col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS");
 159         col_clear(pinfo->cinfo, COL_INFO);
 160
 161         version = tvb_get_guint8(tvb,0);
 162         if (version != 0) {
 163                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "XTACACS");
 164         }
 165
 166         type = tvb_get_guint8(tvb,1);
 167         if (check_col(pinfo->cinfo, COL_INFO))
 168                 col_add_str(pinfo->cinfo, COL_INFO,
 169                     val_to_str(type, tacacs_type_vals, "Unknown (0x%02x)"));
 170
 171         if (tree)
 172         {
 173                 ti = proto_tree_add_protocol_format(tree, proto_tacacs,
 174                  tvb, 0, -1, version==0?"TACACS":"XTACACS");
 175                 tacacs_tree = proto_item_add_subtree(ti, ett_tacacs);
 176
 177                 proto_tree_add_uint(tacacs_tree, hf_tacacs_version, tvb, 0, 1,
 178                     version);
 179                 proto_tree_add_uint(tacacs_tree, hf_tacacs_type, tvb, 1, 1,
 180                     type);
 181                 proto_tree_add_item(tacacs_tree, hf_tacacs_nonce, tvb, 2, 2,
 182                     FALSE);
 183
 184         if (version==0)
 185             {
 186             if (type!=TACACS_RESPONSE)
 187                 {
 188                 userlen=tvb_get_guint8(tvb,4);
 189                 proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
 190                     userlen);
 191                 passlen=tvb_get_guint8(tvb,5);
 192                 proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
 193                     passlen);
 194                 tvb_get_nstringz0(tvb,6,userlen+1,txt_buff);
 195                 proto_tree_add_text(tacacs_tree, tvb, 6, userlen,         "Username: %s",txt_buff);
 196                 tvb_get_nstringz0(tvb,6+userlen,passlen+1,txt_buff);
 197                 proto_tree_add_text(tacacs_tree, tvb, 6+userlen, passlen, "Password: %s",txt_buff);
 198                 }
 199             else
 200                 {
 201                 proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 4, 1,
 202                     FALSE);
 203                 proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 5, 1,
 204                     FALSE);
 205                 }
 206             }
 207         else
 208             {
 209             userlen=tvb_get_guint8(tvb,4);
 210             proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
 211                 userlen);
 212             passlen=tvb_get_guint8(tvb,5);
 213             proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
 214                 passlen);
 215             proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 6, 1,
 216                 FALSE);
 217             proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 7, 1,
 218                 FALSE);
 219             proto_tree_add_item(tacacs_tree, hf_tacacs_result1, tvb, 8, 4,
 220                 FALSE);
 221             proto_tree_add_item(tacacs_tree, hf_tacacs_destaddr, tvb, 12, 4,
 222                 FALSE);
 223             proto_tree_add_item(tacacs_tree, hf_tacacs_destport, tvb, 16, 2,
 224                 FALSE);
 225             proto_tree_add_item(tacacs_tree, hf_tacacs_line, tvb, 18, 2,
 226                 FALSE);
 227             proto_tree_add_item(tacacs_tree, hf_tacacs_result2, tvb, 20, 4,
 228                 FALSE);
 229             proto_tree_add_item(tacacs_tree, hf_tacacs_result3, tvb, 24, 2,
 230                 FALSE);
 231             if (type!=TACACS_RESPONSE)
 232                 {
 233                 tvb_get_nstringz0(tvb,26,userlen+1,txt_buff);
 234                 proto_tree_add_text(tacacs_tree, tvb, 26, userlen,  "Username: %s",txt_buff);
 235                 tvb_get_nstringz0(tvb,26+userlen,passlen+1,txt_buff);
 236                 proto_tree_add_text(tacacs_tree, tvb, 26+userlen, passlen, "Password; %s",txt_buff);
 237                 }
 238             }
 239         }
 240 }
 241
 242 void
 243 proto_register_tacacs(void)
 244 {
 245         static hf_register_info hf[] = {
 246           { &hf_tacacs_version,
 247             { "Version",           "tacacs.version",
 248               FT_UINT8, BASE_HEX, VALS(tacacs_version_vals), 0x0,
 249               NULL, HFILL }},
 250           { &hf_tacacs_type,
 251             { "Type",              "tacacs.type",
 252               FT_UINT8, BASE_DEC, VALS(tacacs_type_vals), 0x0,
 253               NULL, HFILL }},
 254           { &hf_tacacs_nonce,
 255             { "Nonce",             "tacacs.nonce",
 256               FT_UINT16, BASE_HEX, NULL, 0x0,
 257               NULL, HFILL }},
 258           { &hf_tacacs_userlen,
 259             { "Username length",   "tacacs.userlen",
 260               FT_UINT8, BASE_DEC, NULL, 0x0,
 261               NULL, HFILL }},
 262           { &hf_tacacs_passlen,
 263             { "Password length",   "tacacs.passlen",
 264               FT_UINT8, BASE_DEC, NULL, 0x0,
 265               NULL, HFILL }},
 266           { &hf_tacacs_response,
 267             { "Response",          "tacacs.response",
 268               FT_UINT8, BASE_DEC, VALS(tacacs_resp_vals), 0x0,
 269               NULL, HFILL }},
 270           { &hf_tacacs_reason,
 271             { "Reason",            "tacacs.reason",
 272               FT_UINT8, BASE_DEC, VALS(tacacs_reason_vals), 0x0,
 273               NULL, HFILL }},
 274           { &hf_tacacs_result1,
 275             { "Result 1",          "tacacs.result1",
 276               FT_UINT32, BASE_HEX, NULL, 0x0,
 277               NULL, HFILL }},
 278           { &hf_tacacs_destaddr,
 279             { "Destination address", "tacacs.destaddr",
 280               FT_IPv4, BASE_NONE, NULL, 0x0,
 281               NULL, HFILL }},
 282           { &hf_tacacs_destport,
 283             { "Destination port",  "tacacs.destport",
 284               FT_UINT16, BASE_DEC, NULL, 0x0,
 285               NULL, HFILL }},
 286           { &hf_tacacs_line,
 287             { "Line",              "tacacs.line",
 288               FT_UINT16, BASE_DEC, NULL, 0x0,
 289               NULL, HFILL }},
 290           { &hf_tacacs_result2,
 291             { "Result 2",          "tacacs.result2",
 292               FT_UINT32, BASE_HEX, NULL, 0x0,
 293               NULL, HFILL }},
 294           { &hf_tacacs_result3,
 295             { "Result 3",          "tacacs.result3",
 296               FT_UINT16, BASE_HEX, NULL, 0x0,
 297               NULL, HFILL }},
 298         };
 299
 300         static gint *ett[] = {
 301                 &ett_tacacs,
 302         };
 303         proto_tacacs = proto_register_protocol("TACACS", "TACACS", "tacacs");
 304         proto_register_field_array(proto_tacacs, hf, array_length(hf));
 305         proto_register_subtree_array(ett, array_length(ett));
 306 }
 307
 308 void
 309 proto_reg_handoff_tacacs(void)
 310 {
 311         dissector_handle_t tacacs_handle;
 312
 313         tacacs_handle = create_dissector_handle(dissect_tacacs, proto_tacacs);
 314         dissector_add("udp.port", UDP_PORT_TACACS, tacacs_handle);
 315 }
 316
 317 static int proto_tacplus = -1;
 318 static int hf_tacplus_response = -1;
 319 static int hf_tacplus_request = -1;
 320 static int hf_tacplus_majvers = -1;
 321 static int hf_tacplus_minvers = -1;
 322 static int hf_tacplus_type = -1;
 323 static int hf_tacplus_seqno = -1;
 324 static int hf_tacplus_flags = -1;
 325 static int hf_tacplus_flags_payload_type = -1;
 326 static int hf_tacplus_flags_connection_type = -1;
 327 static int hf_tacplus_acct_flags = -1;
 328 static int hf_tacplus_session_id = -1;
 329 static int hf_tacplus_packet_len = -1;
 330
 331 static gint ett_tacplus = -1;
 332 static gint ett_tacplus_body = -1;
 333 static gint ett_tacplus_body_chap = -1;
 334 static gint ett_tacplus_flags = -1;
 335 static gint ett_tacplus_acct_flags = -1;
 336
 337 typedef struct _tacplus_key_entry {
 338         address  *s; /* Server address */
 339         address  *c; /* client address */
 340         char    *k; /* Key */
 341 } tacplus_key_entry;
 342
 343 static gint
 344 tacplus_decrypted_tvb_setup( tvbuff_t *tvb, tvbuff_t **dst_tvb, packet_info *pinfo, guint32 len, guint8 version, const char *key )
 345 {
 346         guint8  *buff;
 347         guint8 session_id[4];
 348
 349         /* TODO Check the possibility to use pinfo->decrypted_data */
 350 /* session_id is in NETWORK Byte Order, and is used as byte array in the md5_xor */
 351
 352         tvb_memcpy(tvb, session_id, 4,4);
 353
 354         buff = tvb_memdup(tvb, TAC_PLUS_HDR_SIZE, len);
 355
 356
 357         md5_xor( buff, key, len, session_id,version, tvb_get_guint8(tvb,2) );
 358
 359         /* Allocate a new tvbuff, referring to the decrypted data. */
 360         *dst_tvb = tvb_new_child_real_data(tvb,  buff, len, len );
 361
 362         /* Arrange that the allocated packet data copy be freed when the
 363            tvbuff is freed. */
 364         tvb_set_free_cb( *dst_tvb, g_free );
 365
 366         /* Add the decrypted data to the data source list. */
 367         add_new_data_source(pinfo, *dst_tvb, "TACACS+ Decrypted");
 368
 369         return 0;
 370 }
 371 static void
 372 dissect_tacplus_args_list( tvbuff_t *tvb, proto_tree *tree, int data_off, int len_off, int arg_cnt )
 373 {
 374         int i;
 375         guint8  buff[257];
 376         for(i=0;i<arg_cnt;i++){
 377                 int len=tvb_get_guint8(tvb,len_off+i);
 378                 proto_tree_add_text( tree, tvb, len_off+i, 1, "Arg[%d] length: %d", i, len );
 379                 tvb_get_nstringz0(tvb, data_off, len+1, buff);
 380                 proto_tree_add_text( tree, tvb, data_off, len, "Arg[%d] value: %s", i, buff );
 381                 data_off+=len;
 382         }
 383 }
 384
 385
 386 static int
 387 proto_tree_add_tacplus_common_fields( tvbuff_t *tvb, proto_tree *tree,  int offset, int var_off )
 388 {
 389         int val;
 390         guint8 buff[257];
 391         /* priv_lvl */
 392         proto_tree_add_text( tree, tvb, offset, 1,
 393                         "Privilege Level: %d", tvb_get_guint8(tvb,offset) );
 394         offset++;
 395
 396         /* authen_type */
 397         val=tvb_get_guint8(tvb,offset);
 398         proto_tree_add_text( tree, tvb, offset, 1,
 399                         "Authentication type: %s",
 400                         val_to_str( val, tacplus_authen_type_vals, "Unknown Packet" ) );
 401         offset++;
 402
 403         /* service */
 404         val=tvb_get_guint8(tvb,offset);
 405         proto_tree_add_text( tree, tvb, offset, 1,
 406                         "Service: %s",
 407                         val_to_str( val, tacplus_authen_service_vals, "Unknown Packet" ) );
 408         offset++;
 409
 410         /* user_len && user */
 411         val=tvb_get_guint8(tvb,offset);
 412         proto_tree_add_text( tree, tvb, offset, 1, "User len: %d", val );
 413         if( val ){
 414                 tvb_get_nstringz0(tvb, var_off, val+1, buff);
 415                 proto_tree_add_text( tree, tvb, var_off, val, "User: %s", buff );
 416                 var_off+=val;
 417         }
 418         offset++;
 419
 420
 421         /* port_len &&  port */
 422         val=tvb_get_guint8(tvb,offset);
 423         proto_tree_add_text( tree, tvb, offset, 1, "Port len: %d", val );
 424         if( val ){
 425                 tvb_get_nstringz0(tvb, var_off, val+1, buff);
 426                 proto_tree_add_text( tree, tvb, var_off, val, "Port: %s", buff );
 427                 var_off+=val;
 428         }
 429         offset++;
 430
 431         /* rem_addr_len && rem_addr */
 432         val=tvb_get_guint8(tvb,offset);
 433         proto_tree_add_text( tree, tvb, offset, 1, "Remaddr len: %d", val );
 434         if( val ){
 435                 tvb_get_nstringz0(tvb, var_off, val+1, buff);
 436                 proto_tree_add_text( tree, tvb, var_off, val, "Remote Address: %s", buff );
 437                 var_off+=val;
 438         }
 439         return var_off;
 440 }
 441
 442 static void
 443 dissect_tacplus_body_authen_req_login( tvbuff_t* tvb, proto_tree *tree, int var_off )
 444 {
 445         guint8 buff[257];
 446         guint8 val;
 447         val=tvb_get_guint8( tvb, AUTHEN_S_DATA_LEN_OFF );
 448
 449         switch ( tvb_get_guint8(tvb, AUTHEN_S_AUTHEN_TYPE_OFF ) ) { /* authen_type */
 450
 451                 case TAC_PLUS_AUTHEN_TYPE_ASCII:
 452                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "Data: %d (not used)", val );
 453                         if( val )
 454                                 proto_tree_add_text( tree, tvb, var_off, val, "Data" );
 455                         break;
 456
 457                 case TAC_PLUS_AUTHEN_TYPE_PAP:
 458                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "Password Length %d", val );
 459                         if( val ) {
 460                                 tvb_get_nstringz0( tvb, var_off, val+1, buff );
 461                                 proto_tree_add_text( tree, tvb, var_off, val, "Password: %s", buff );
 462                         }
 463                         break;
 464
 465                 case TAC_PLUS_AUTHEN_TYPE_CHAP:
 466                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "CHAP Data Length %d", val );
 467                         if( val ) {
 468                                 proto_item      *pi;
 469                                 proto_tree  *pt;
 470                                 guint8 chal_len=val-(1+16); /* Response field alwayes 16 octets */
 471                                 pi = proto_tree_add_text(tree, tvb, var_off, val, "CHAP Data" );
 472                                 pt = proto_item_add_subtree( pi, ett_tacplus_body_chap );
 473                                 val= tvb_get_guint8( tvb, var_off );
 474                                 proto_tree_add_text( pt, tvb, var_off, 1, "ID: %d", val );
 475                                 var_off++;
 476                                 tvb_get_nstringz0( tvb, var_off, chal_len+1, buff );
 477                                 proto_tree_add_text( pt, tvb, var_off, chal_len, "Challenge: %s", buff );
 478                                 var_off+=chal_len;
 479                                 tvb_get_nstringz0( tvb, var_off, 16+1, buff );
 480                                 proto_tree_add_text( pt, tvb, var_off, 16 , "Response: %s", buff );
 481                         }
 482                         break;
 483                 case TAC_PLUS_AUTHEN_TYPE_MSCHAP:
 484                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "MSCHAP Data Length %d", val );
 485                         if( val ) {
 486                                 proto_item      *pi;
 487                                 proto_tree  *pt;
 488                                 guint8 chal_len=val-(1+49);  /* Response field alwayes 49 octets */
 489                                 pi = proto_tree_add_text(tree, tvb, var_off, val, "MSCHAP Data" );
 490                                 pt = proto_item_add_subtree( pi, ett_tacplus_body_chap );
 491                                 val= tvb_get_guint8( tvb, var_off );
 492                                 proto_tree_add_text( pt, tvb, var_off, 1, "ID: %d", val );
 493                                 var_off++;
 494                                 tvb_get_nstringz0( tvb, var_off, chal_len+1, buff );
 495                                 proto_tree_add_text( pt, tvb, var_off, chal_len, "Challenge: %s", buff );
 496                                 var_off+=chal_len;
 497                                 tvb_get_nstringz0( tvb, var_off, 49+1, buff );
 498                                 proto_tree_add_text( pt, tvb, var_off, 49 , "Response: %s", buff );
 499                         }
 500                         break;
 501                 case TAC_PLUS_AUTHEN_TYPE_ARAP:
 502                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "ARAP Data Length %d", val );
 503                         if( val ) {
 504                                 proto_item      *pi;
 505                                 proto_tree  *pt;
 506                                 pi = proto_tree_add_text(tree, tvb, var_off, val, "ARAP Data" );
 507                                 pt = proto_item_add_subtree( pi, ett_tacplus_body_chap );
 508
 509                                 tvb_get_nstringz0( tvb, var_off, 8+1, buff );
 510                                 proto_tree_add_text( pt, tvb, var_off, 8, "Nas Challenge: %s", buff );
 511                                 var_off+=8;
 512                                 tvb_get_nstringz0( tvb, var_off, 8+1, buff );
 513                                 proto_tree_add_text( pt, tvb, var_off, 8, "Remote Challenge: %s", buff );
 514                                 var_off+=8;
 515                                 tvb_get_nstringz0( tvb, var_off, 8+1, buff );
 516                                 proto_tree_add_text( pt, tvb, var_off, 8, "Remote Response: %s", buff );
 517                                 var_off+=8;
 518                         }
 519                         break;
 520
 521                 default: /* Should not be reached */
 522                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "Data: %d", val );
 523                         if( val ){
 524                                 proto_tree_add_text( tree, tvb, var_off, val, "Data" );
 525                         }
 526         }
 527 }
 528
 529 static void
 530 dissect_tacplus_body_authen_req( tvbuff_t* tvb, proto_tree *tree )
 531 {
 532         guint8 val;
 533         int var_off=AUTHEN_S_VARDATA_OFF;
 534
 535         /* Action */
 536         val=tvb_get_guint8( tvb, AUTHEN_S_ACTION_OFF );
 537         proto_tree_add_text( tree, tvb,
 538                         AUTHEN_S_ACTION_OFF, 1,
 539                         "Action: %s",
 540                         val_to_str( val, tacplus_authen_action_vals, "Unknown Packet" ) );
 541
 542         var_off=proto_tree_add_tacplus_common_fields( tvb, tree , AUTHEN_S_PRIV_LVL_OFF, AUTHEN_S_VARDATA_OFF );
 543
 544         switch( val ) {
 545                 case TAC_PLUS_AUTHEN_LOGIN:
 546                         dissect_tacplus_body_authen_req_login( tvb, tree, var_off );
 547                         break;
 548                 case TAC_PLUS_AUTHEN_SENDAUTH:
 549                         break;
 550         }
 551 }
 552
 553 static void
 554 dissect_tacplus_body_authen_req_cont( tvbuff_t *tvb, proto_tree *tree )
 555 {
 556         int val;
 557         int var_off=AUTHEN_C_VARDATA_OFF;
 558         guint8 *buff=NULL;
 559
 560         val=tvb_get_guint8( tvb, AUTHEN_C_FLAGS_OFF );
 561         proto_tree_add_text( tree, tvb,
 562                         AUTHEN_R_FLAGS_OFF, 1, "Flags: 0x%02x %s",
 563                         val,
 564                         (val&TAC_PLUS_CONTINUE_FLAG_ABORT?"(Abort)":"") );
 565
 566
 567         val=tvb_get_ntohs( tvb, AUTHEN_C_USER_LEN_OFF );
 568         proto_tree_add_text( tree, tvb, AUTHEN_C_USER_LEN_OFF, 2 , "User length: %d", val );
 569         if( val ){
 570                 buff=tvb_get_ephemeral_string( tvb, var_off, val );
 571                 proto_tree_add_text( tree, tvb, var_off, val, "User: %s", buff );
 572                 var_off+=val;
 573         }
 574
 575         val=tvb_get_ntohs( tvb, AUTHEN_C_DATA_LEN_OFF );
 576         proto_tree_add_text( tree, tvb, AUTHEN_C_DATA_LEN_OFF, 2 ,
 577                         "Data length: %d", val );
 578         if( val ){
 579                 proto_tree_add_text( tree, tvb, var_off, val, "Data" );
 580         }
 581
 582 }
 583
 584 /* Server REPLY */
 585 static void
 586 dissect_tacplus_body_authen_rep( tvbuff_t *tvb, proto_tree *tree )
 587 {
 588         int val;
 589         int var_off=AUTHEN_R_VARDATA_OFF;
 590         guint8 *buff=NULL;
 591
 592         val=tvb_get_guint8( tvb, AUTHEN_R_STATUS_OFF );
 593         proto_tree_add_text(tree, tvb,
 594                         AUTHEN_R_STATUS_OFF, 1, "Status: 0x%01x (%s)", val,
 595                         val_to_str( val, tacplus_reply_status_vals, "Unknown Packet" )  );
 596
 597         val=tvb_get_guint8( tvb, AUTHEN_R_FLAGS_OFF );
 598         proto_tree_add_text(tree, tvb,
 599                         AUTHEN_R_FLAGS_OFF, 1, "Flags: 0x%02x %s",
 600                         val, (val&TAC_PLUS_REPLY_FLAG_NOECHO?"(NoEcho)":"") );
 601
 602
 603         val=tvb_get_ntohs(tvb, AUTHEN_R_SRV_MSG_LEN_OFF );
 604         proto_tree_add_text( tree, tvb, AUTHEN_R_SRV_MSG_LEN_OFF, 2 ,
 605                                 "Server message length: %d", val );
 606         if( val ) {
 607                 buff=tvb_get_ephemeral_string(tvb, var_off, val );
 608                 proto_tree_add_text(tree, tvb, var_off, val, "Server message: %s", buff );
 609                 var_off+=val;
 610         }
 611
 612         val=tvb_get_ntohs(tvb, AUTHEN_R_DATA_LEN_OFF );
 613         proto_tree_add_text( tree, tvb, AUTHEN_R_DATA_LEN_OFF, 2 ,
 614                                 "Data length: %d", val );
 615         if( val ){
 616                 proto_tree_add_text(tree, tvb, var_off, val, "Data" );
 617         }
 618 }
 619
 620 static void
 621 dissect_tacplus_body_author_req( tvbuff_t* tvb, proto_tree *tree )
 622 {
 623         int val;
 624         int var_off;
 625
 626         val=tvb_get_guint8( tvb, AUTHOR_Q_AUTH_METH_OFF ) ;
 627         proto_tree_add_text( tree, tvb, AUTHOR_Q_AUTH_METH_OFF, 1,
 628                         "Auth Method: %s", val_to_str( val, tacplus_authen_method, "Unknown Authen Method" ) );
 629
 630         val=tvb_get_guint8( tvb, AUTHOR_Q_ARGC_OFF );
 631         var_off=proto_tree_add_tacplus_common_fields( tvb, tree ,
 632                         AUTHOR_Q_PRIV_LVL_OFF,
 633                         AUTHOR_Q_VARDATA_OFF + val );
 634
 635         proto_tree_add_text( tree, tvb, AUTHOR_Q_ARGC_OFF, 1, "Arg count: %d", val );
 636
 637 /* var_off points after rem_addr */
 638
 639         dissect_tacplus_args_list( tvb, tree, var_off, AUTHOR_Q_VARDATA_OFF, val );
 640 }
 641
 642 static void
 643 dissect_tacplus_body_author_rep( tvbuff_t* tvb, proto_tree *tree )
 644 {
 645         int offset=AUTHOR_R_VARDATA_OFF;
 646         int val=tvb_get_guint8( tvb, AUTHOR_R_STATUS_OFF        ) ;
 647
 648
 649         proto_tree_add_text( tree, tvb, AUTHOR_R_STATUS_OFF     , 1,
 650                         "Auth Status: 0x%01x (%s)", val,
 651                         val_to_str( val, tacplus_author_status, "Unknown Authorization Status" ));
 652
 653         val=tvb_get_ntohs( tvb, AUTHOR_R_SRV_MSG_LEN_OFF );
 654         offset+=val;
 655         proto_tree_add_text( tree, tvb, AUTHOR_R_SRV_MSG_LEN_OFF, 2, "Server Msg length: %d", val );
 656
 657         val=tvb_get_ntohs( tvb, AUTHOR_R_DATA_LEN_OFF );
 658         offset+=val;
 659         proto_tree_add_text( tree, tvb, AUTHOR_R_DATA_LEN_OFF, 2, "Data length: %d", val );
 660
 661         val=tvb_get_guint8( tvb, AUTHOR_R_ARGC_OFF);
 662         offset+=val;
 663         proto_tree_add_text( tree, tvb, AUTHOR_R_ARGC_OFF, 1, "Arg count: %d", val );
 664
 665         dissect_tacplus_args_list( tvb, tree, offset, AUTHOR_R_VARDATA_OFF, val );
 666 }
 667
 668 static void
 669 dissect_tacplus_body_acct_req( tvbuff_t* tvb, proto_tree *tree )
 670 {
 671         int val, var_off;
 672
 673         proto_item *tf;
 674         proto_tree *flags_tree;
 675
 676         val=tvb_get_guint8( tvb, ACCT_Q_FLAGS_OFF );
 677         tf = proto_tree_add_uint( tree, hf_tacplus_acct_flags, tvb, ACCT_Q_FLAGS_OFF, 1, val );
 678
 679         flags_tree = proto_item_add_subtree( tf, ett_tacplus_acct_flags );
 680         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 681                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_MORE, 8,
 682                                 "More: Set", "More: Not set" ) );
 683         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 684                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_START, 8,
 685                                 "Start: Set", "Start: Not set" ) );
 686         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 687                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_STOP, 8,
 688                                 "Stop: Set", "Stop: Not set" ) );
 689         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 690                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_WATCHDOG, 8,
 691                                 "Watchdog: Set", "Watchdog: Not set" ) );
 692
 693         val=tvb_get_guint8( tvb, ACCT_Q_METHOD_OFF );
 694         proto_tree_add_text( tree, tvb, ACCT_Q_METHOD_OFF, 1,
 695                         "Authen Method: 0x%01x (%s)",
 696                         val, val_to_str( val, tacplus_authen_method, "Unknown Authen Method" ) );
 697
 698         val=tvb_get_guint8( tvb, ACCT_Q_ARG_CNT_OFF );
 699
 700         /* authen_type */
 701         var_off=proto_tree_add_tacplus_common_fields( tvb, tree ,
 702                         ACCT_Q_PRIV_LVL_OFF,
 703                         ACCT_Q_VARDATA_OFF+val
 704                         );
 705
 706         proto_tree_add_text( tree, tvb, ACCT_Q_ARG_CNT_OFF, 1,
 707                         "Arg Cnt: %d", val  );
 708
 709         dissect_tacplus_args_list( tvb, tree, var_off, ACCT_Q_VARDATA_OFF, val );
 710
 711
 712 }
 713
 714 static void
 715 dissect_tacplus_body_acct_rep( tvbuff_t* tvb, proto_tree *tree )
 716 {
 717         int val, var_off=ACCT_Q_VARDATA_OFF;
 718
 719         guint8 *buff=NULL;
 720
 721         /* Status */
 722         val=tvb_get_guint8( tvb, ACCT_R_STATUS_OFF );
 723         proto_tree_add_text( tree, tvb, ACCT_R_STATUS_OFF, 1, "Status: 0x%02x (%s)", val,
 724                                 val_to_str( val, tacplus_acct_status, "Bogus status..") );
 725
 726         /* Server Message */
 727         val=tvb_get_ntohs( tvb, ACCT_R_SRV_MSG_LEN_OFF );
 728         proto_tree_add_text( tree, tvb, ACCT_R_SRV_MSG_LEN_OFF, 2 ,
 729                                 "Server message length: %d", val );
 730         if( val ) {
 731                 buff=tvb_get_ephemeral_string( tvb, var_off, val );
 732                 proto_tree_add_text( tree, tvb, var_off,
 733                                 val, "Server message: %s", buff );
 734                 var_off+=val;
 735         }
 736
 737         /*  Data */
 738         val=tvb_get_ntohs( tvb, ACCT_R_DATA_LEN_OFF );
 739         proto_tree_add_text( tree, tvb, ACCT_R_DATA_LEN_OFF, 2 ,
 740                                 "Data length: %d", val );
 741         if( val ) {
 742                 buff= tvb_get_ephemeral_string( tvb, var_off, val );
 743                 proto_tree_add_text( tree, tvb, var_off,
 744                                 val, "Data: %s", buff );
 745         }
 746 }
 747
 748
 749
 750 static void
 751 dissect_tacplus_body(tvbuff_t * hdr_tvb, tvbuff_t * tvb, proto_tree * tree )
 752 {
 753         int type = tvb_get_guint8( hdr_tvb, H_TYPE_OFF );
 754         int seq_no = tvb_get_guint8( hdr_tvb, H_SEQ_NO_OFF );
 755
 756         switch (type) {
 757           case TAC_PLUS_AUTHEN:
 758                 if (  seq_no & 0x01) {
 759                         if ( seq_no == 1 )
 760                                 dissect_tacplus_body_authen_req( tvb, tree );
 761                         else
 762                                 dissect_tacplus_body_authen_req_cont( tvb, tree );
 763                 } else {
 764                         dissect_tacplus_body_authen_rep( tvb, tree );
 765                 }
 766                 break;
 767           case TAC_PLUS_AUTHOR:
 768                 if ( seq_no & 0x01)
 769                         dissect_tacplus_body_author_req( tvb, tree );
 770                 else
 771                         dissect_tacplus_body_author_rep( tvb, tree );
 772                 break;
 773           case TAC_PLUS_ACCT:
 774                 if ( seq_no & 0x01)
 775                         dissect_tacplus_body_acct_req( tvb, tree );
 776                 else
 777                         dissect_tacplus_body_acct_rep( tvb, tree );
 778                 break;
 779           default:
 780                 proto_tree_add_text( tree, tvb, 0, tvb_length( tvb ), "Bogus..");
 781                 break;
 782         }
 783 }
 784
 785 #ifdef DEB_TACPLUS
 786 static void
 787 tacplus_print_key_entry( gpointer data, gpointer user_data )
 788 {
 789         tacplus_key_entry *tacplus_data=(tacplus_key_entry *)data;
 790         if( user_data ) {
 791                 printf("%s:%s=%s\n", address_to_str( tacplus_data->s ),
 792                                 address_to_str( tacplus_data->c ), tacplus_data->k );
 793         } else {
 794                 printf("%s:%s\n", address_to_str( tacplus_data->s ),
 795                                 address_to_str( tacplus_data->c ) );
 796         }
 797 }
 798 #endif
 799 static int
 800 cmp_conv_address( gconstpointer p1, gconstpointer p2 )
 801 {
 802         const tacplus_key_entry *a1=p1;
 803         const tacplus_key_entry *a2=p2;
 804         gint32  ret;
 805         /*
 806         printf("p1=>");
 807         tacplus_print_key_entry( p1, NULL );
 808         printf("p2=>");
 809         tacplus_print_key_entry( p2, NULL );
 810         */
 811         ret=CMP_ADDRESS( a1->s, a2->s );
 812         if( !ret ) {
 813                 ret=CMP_ADDRESS( a1->c, a2->c );
 814                 /*
 815                 if(ret)
 816                         printf("No Client found!"); */
 817         } else {
 818                 /* printf("No Server found!"); */
 819         }
 820         return ret;
 821 }
 822
 823 static const char*
 824 find_key( address *srv, address *cln )
 825 {
 826         tacplus_key_entry data;
 827         GSList *match;
 828
 829         data.s=srv;
 830         data.c=cln;
 831 /*      printf("Looking for: ");
 832         tacplus_print_key_entry( (gconstpointer)&data, NULL ); */
 833         match=g_slist_find_custom( tacplus_keys, (gpointer)&data, cmp_conv_address );
 834 /*      printf("Finished (%p)\n", match);  */
 835         if( match )
 836                 return ((tacplus_key_entry*)match->data)->k;
 837
 838         return (tacplus_keys?NULL:tacplus_opt_key);
 839 }
 840
 841 static void
 842 mkipv4_address( address **addr, const char *str_addr )
 843 {
 844         char *addr_data;
 845
 846         *addr=g_malloc( sizeof(address) );
 847         addr_data=g_malloc( 4 );
 848         inet_pton( AF_INET, str_addr, addr_data );
 849         (*addr)->type=AT_IPv4;
 850         (*addr)->len=4;
 851         (*addr)->data=(guint8*)addr_data;
 852 }
 853 static void
 854 parse_tuple( char *key_from_option )
 855 {
 856         char *client,*key;
 857         tacplus_key_entry *tacplus_data=g_malloc( sizeof(tacplus_key_entry) );
 858         /*
 859         printf("keys: %s\n", key_from_option );
 860         */
 861         client=strchr(key_from_option,'/');
 862         if(!client) {
 863                 g_free(tacplus_data);
 864                 return;
 865         }
 866         *client++='\0';
 867         key=strchr(client,'=');
 868         if(!key) {
 869                 g_free(tacplus_data);
 870                 return;
 871         }
 872         *key++='\0';
 873         /*
 874         printf("%s %s => %s\n", key_from_option, client, key );
 875         */
 876         mkipv4_address( &tacplus_data->s, key_from_option );
 877         mkipv4_address( &tacplus_data->c, client );
 878         tacplus_data->k=g_strdup(key);
 879         tacplus_keys = g_slist_prepend( tacplus_keys, tacplus_data );
 880 }
 881
 882 static
 883 void
 884 parse_tacplus_keys( const char *keys_from_option )
 885 {
 886         char *key_copy,*s,*s1;
 887
 888         /* Drop old keys */
 889         if( tacplus_keys ) {
 890                 g_slist_free( tacplus_keys );
 891                 tacplus_keys=NULL;
 892         }
 893
 894         if( !strchr( keys_from_option, '/' ) ){
 895                 /* option not in client/server=key format */
 896                 return ;
 897         }
 898         key_copy=g_strdup(keys_from_option);
 899         s=key_copy;
 900         while(s){
 901                 if( (s1=strchr( s, ' ' )) != NULL )
 902                         *s1++='\0';
 903                 parse_tuple( s );
 904                 s=s1;
 905         }
 906         g_free( key_copy );
 907 #ifdef DEB_TACPLUS
 908         g_slist_foreach( tacplus_keys, tacplus_print_key_entry, GINT_TO_POINTER(1) );
 909 #endif
 910 }
 911
 912 static void
 913 dissect_tacplus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 914 {
 915         tvbuff_t        *new_tvb=NULL;
 916         proto_tree      *tacplus_tree;
 917         proto_item      *ti, *hidden_item;
 918         guint8          version,flags;
 919         proto_tree      *flags_tree;
 920         proto_item      *tf;
 921         proto_item      *tmp_pi;
 922         guint32         len;
 923         gboolean        request=( pinfo->destport == TCP_PORT_TACACS );
 924         const char      *key=NULL;
 925
 926         len = tvb_get_ntohl(tvb, 8);
 927
 928         if(len > (guint)tvb_length_remaining(tvb, 12) &&
 929            pinfo->can_desegment && tacplus_preference_desegment) {
 930                 pinfo->desegment_offset = 0;
 931                 pinfo->desegment_len = len;
 932                 return;
 933         }
 934
 935         if( request ) {
 936                 key=find_key( &pinfo->dst, &pinfo->src );
 937         } else {
 938                 key=find_key(  &pinfo->src, &pinfo->dst );
 939         }
 940         col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS+");
 941
 942         if (check_col(pinfo->cinfo, COL_INFO))
 943         {
 944                 int type = tvb_get_guint8(tvb,1);
 945                 col_add_fstr( pinfo->cinfo, COL_INFO, "%s: %s",
 946                                 request ? "Q" : "R",
 947                                 val_to_str(type, tacplus_type_vals, "Unknown (0x%02x)"));
 948         }
 949
 950         if (tree)
 951         {
 952                 ti = proto_tree_add_protocol_format(tree, proto_tacplus,
 953                  tvb, 0, -1, "TACACS+");
 954
 955                 tacplus_tree = proto_item_add_subtree(ti, ett_tacplus);
 956                 if (pinfo->match_port == pinfo->destport)
 957                 {
 958                         hidden_item = proto_tree_add_boolean(tacplus_tree,
 959                             hf_tacplus_request, tvb, 0, 0, TRUE);
 960                 }
 961                 else
 962                 {
 963                         hidden_item = proto_tree_add_boolean(tacplus_tree,
 964                             hf_tacplus_response, tvb, 0, 0, TRUE);
 965                 }
 966                 PROTO_ITEM_SET_HIDDEN(hidden_item);
 967
 968                 version = tvb_get_guint8(tvb,0);
 969                 proto_tree_add_uint_format(tacplus_tree, hf_tacplus_majvers, tvb, 0, 1,
 970                     version,
 971                     "Major version: %s",
 972                     (version&0xf0)==0xc0?"TACACS+":"Unknown Version");
 973                 proto_tree_add_uint(tacplus_tree, hf_tacplus_minvers, tvb, 0, 1,
 974                     version&0xf);
 975                 proto_tree_add_item(tacplus_tree, hf_tacplus_type, tvb, 1, 1,
 976                     FALSE);
 977                 proto_tree_add_item(tacplus_tree, hf_tacplus_seqno, tvb, 2, 1,
 978                     FALSE);
 979                 flags = tvb_get_guint8(tvb,3);
 980                 tf = proto_tree_add_uint_format(tacplus_tree, hf_tacplus_flags,
 981                     tvb, 3, 1, flags,
 982                     "Flags: 0x%02x (%s payload, %s)",
 983                         flags,
 984                     (flags&FLAGS_UNENCRYPTED) ? "Unencrypted" :
 985                                                 "Encrypted",
 986                     (flags&FLAGS_SINGLE) ? "Single connection" :
 987                                            "Multiple Connections" );
 988                 flags_tree = proto_item_add_subtree(tf, ett_tacplus_flags);
 989                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_payload_type,
 990                     tvb, 3, 1, flags);
 991                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_connection_type,
 992                     tvb, 3, 1, flags);
 993                 proto_tree_add_item(tacplus_tree, hf_tacplus_session_id, tvb, 4, 4,
 994                     FALSE);
 995
 996                 if ((gint) len < 1) {
 997                         proto_tree_add_text(tacplus_tree, tvb, 8, 4,
 998                                 "Invalid length: %u", len);
 999                         THROW(ReportedBoundsError);
1000                 }
1001                 proto_tree_add_uint(tacplus_tree, hf_tacplus_packet_len, tvb, 8, 4,
1002                     len);
1003
1004                 tmp_pi = proto_tree_add_text(tacplus_tree, tvb, TAC_PLUS_HDR_SIZE, len, "%s%s",
1005                                         ((flags&FLAGS_UNENCRYPTED)?"":"Encrypted "), request?"Request":"Reply" );
1006
1007                 if( flags&FLAGS_UNENCRYPTED ) {
1008                         new_tvb = tvb_new_subset( tvb, TAC_PLUS_HDR_SIZE, len, len );
1009                 }  else {
1010                         new_tvb=NULL;
1011                         if( key && *key ){
1012                                 tacplus_decrypted_tvb_setup( tvb, &new_tvb, pinfo, len, version, key );
1013                         }
1014                 }
1015                 if( new_tvb ) {
1016                         /* Check to see if I've a decrypted tacacs packet */
1017                         if( !(flags&FLAGS_UNENCRYPTED) ){
1018                                 tmp_pi = proto_tree_add_text(tacplus_tree, new_tvb, 0, len, "Decrypted %s",
1019                                                         request?"Request":"Reply" );
1020                         }
1021                         dissect_tacplus_body( tvb, new_tvb, proto_item_add_subtree( tmp_pi, ett_tacplus_body ));
1022                 }
1023         }
1024 }
1025
1026 static void
1027 tacplus_pref_cb(void)
1028 {
1029         parse_tacplus_keys( tacplus_opt_key );
1030 }
1031
1032 void
1033 proto_register_tacplus(void)
1034 {
1035         static hf_register_info hf[] = {
1036           { &hf_tacplus_response,
1037             { "Response",           "tacplus.response",
1038               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1039               "TRUE if TACACS+ response", HFILL }},
1040           { &hf_tacplus_request,
1041             { "Request",            "tacplus.request",
1042               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1043               "TRUE if TACACS+ request", HFILL }},
1044           { &hf_tacplus_majvers,
1045             { "Major version",      "tacplus.majvers",
1046               FT_UINT8, BASE_DEC, NULL, 0x0,
1047               "Major version number", HFILL }},
1048           { &hf_tacplus_minvers,
1049             { "Minor version",      "tacplus.minvers",
1050               FT_UINT8, BASE_DEC, NULL, 0x0,
1051               "Minor version number", HFILL }},
1052           { &hf_tacplus_type,
1053             { "Type",               "tacplus.type",
1054               FT_UINT8, BASE_DEC, VALS(tacplus_type_vals), 0x0,
1055               NULL, HFILL }},
1056           { &hf_tacplus_seqno,
1057             { "Sequence number",    "tacplus.seqno",
1058               FT_UINT8, BASE_DEC, NULL, 0x0,
1059               NULL, HFILL }},
1060           { &hf_tacplus_flags,
1061             { "Flags",              "tacplus.flags",
1062               FT_UINT8, BASE_HEX, NULL, 0x0,
1063               NULL, HFILL }},
1064           { &hf_tacplus_flags_payload_type,
1065             { "Unencrypted",       "tacplus.flags.unencrypted",
1066               FT_BOOLEAN, 8, TFS(&tfs_set_notset), FLAGS_UNENCRYPTED,
1067               "Is payload unencrypted?", HFILL }},
1068           { &hf_tacplus_flags_connection_type,
1069             { "Single Connection",    "tacplus.flags.singleconn",
1070               FT_BOOLEAN, 8, TFS(&tfs_set_notset), FLAGS_SINGLE,
1071               "Is this a single connection?", HFILL }},
1072           { &hf_tacplus_acct_flags,
1073             { "Flags",    "tacplus.acct.flags",
1074               FT_UINT8, BASE_HEX, NULL, 0x0,
1075               NULL, HFILL }},
1076           { &hf_tacplus_session_id,
1077             { "Session ID",         "tacplus.session_id",
1078               FT_UINT32, BASE_DEC, NULL, 0x0,
1079               NULL, HFILL }},
1080           { &hf_tacplus_packet_len,
1081             { "Packet length",      "tacplus.packet_len",
1082               FT_UINT32, BASE_DEC, NULL, 0x0,
1083               NULL, HFILL }}
1084         };
1085         static gint *ett[] = {
1086                 &ett_tacplus,
1087                 &ett_tacplus_flags,
1088                 &ett_tacplus_acct_flags,
1089                 &ett_tacplus_body,
1090                 &ett_tacplus_body_chap,
1091         };
1092         module_t *tacplus_module;
1093
1094         proto_tacplus = proto_register_protocol("TACACS+", "TACACS+", "tacplus");
1095         proto_register_field_array(proto_tacplus, hf, array_length(hf));
1096         proto_register_subtree_array(ett, array_length(ett));
1097         tacplus_module = prefs_register_protocol (proto_tacplus, tacplus_pref_cb );
1098
1099         prefs_register_bool_preference(tacplus_module, "desegment", "Reassemble TACACS+ messages spanning multiple TCP segments.", "Whether the TACACS+ dissector should reassemble messages spanning multiple TCP segments.  To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.", &tacplus_preference_desegment);
1100
1101         prefs_register_string_preference ( tacplus_module, "key",
1102         "TACACS+ Encryption Key", "TACACS+ Encryption Key", &tacplus_opt_key );
1103 }
1104
1105 void
1106 proto_reg_handoff_tacplus(void)
1107 {
1108         dissector_handle_t tacplus_handle;
1109
1110         tacplus_handle = create_dissector_handle(dissect_tacplus,
1111             proto_tacplus);
1112         dissector_add("tcp.port", TCP_PORT_TACACS, tacplus_handle);
1113 }
1114
1115
1116 #define MD5_LEN 16
1117
1118 static void
1119 md5_xor( guint8 *data, const char *key, int data_len, guint8 *session_id, guint8 version, guint8 seq_no )
1120 {
1121         int i,j;
1122         size_t md5_len;
1123         md5_byte_t *md5_buff;
1124         md5_byte_t hash[MD5_LEN];                                       /* the md5 hash */
1125         md5_byte_t *mdp;
1126         md5_state_t mdcontext;
1127
1128         md5_len = 4 /* sizeof(session_id) */ + strlen(key)
1129                         + sizeof(version) + sizeof(seq_no);
1130
1131         md5_buff = (md5_byte_t*)ep_alloc(md5_len+MD5_LEN);
1132
1133
1134         mdp = md5_buff;
1135         memcpy(mdp, session_id, 4);
1136         mdp += 4 ;
1137         memcpy(mdp, key, strlen(key));
1138         mdp += strlen(key);
1139         *mdp++ = version;
1140         *mdp++ = seq_no;
1141
1142
1143         md5_init(&mdcontext);
1144         md5_append(&mdcontext, md5_buff, md5_len);
1145         md5_finish(&mdcontext,hash);
1146         md5_len += MD5_LEN;
1147         for (i = 0; i < data_len; i += 16) {
1148
1149                 for (j = 0; j < 16; j++) {
1150                         if ((i + j) >= data_len)  {
1151                                 i = data_len+1; /* To exit from the external loop  */
1152                                 break;
1153                         }
1154                         data[i + j] ^= hash[j];
1155                 }
1156                 memcpy(mdp, hash, MD5_LEN);
1157                 md5_init(&mdcontext);
1158                 md5_append(&mdcontext, md5_buff, md5_len);
1159                 md5_finish(&mdcontext,hash);
1160         }
1161 }