epan/dissectors/packet-tacacs.c

   1 /* packet-tacacs.c
   2  * Routines for cisco tacacs/xtacacs/tacacs+ packet dissection
   3  * Copyright 2001, Paul Ionescu <paul@acorp.ro>
   4  *
   5  * Full Tacacs+ parsing with decryption by
   6  *   Emanuele Caratti <wiz@iol.it>
   7  *
   8  * $Id$
   9  *
  10  * Wireshark - Network traffic analyzer
  11  * By Gerald Combs <gerald@wireshark.org>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * Copied from old packet-tacacs.c
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31
  32 /* rfc-1492 for tacacs and xtacacs
  33  * draft-grant-tacacs-02.txt for tacacs+ (tacplus)
  34  * ftp://ftp.cisco.com/pub/rfc/DRAFTS/draft-grant-tacacs-02.txt
  35  */
  36
  37 #ifdef HAVE_CONFIG_H
  38 # include "config.h"
  39 #endif
  40
  41 #include <stdio.h>
  42 #include <string.h>
  43
  44 #include <sys/types.h>
  45 #ifdef HAVE_SYS_SOCKET_H
  46 #include <sys/socket.h>
  47 #endif
  48 #ifdef HAVE_NETINET_IN_H
  49 # include <netinet/in.h>
  50 #endif
  51 #ifdef HAVE_ARPA_INET_H
  52 #include <arpa/inet.h>
  53 #endif
  54
  55 #ifdef HAVE_WINSOCK2_H
  56 #include <winsock2.h>           /* needed to define AF_ values on Windows */
  57 #endif
  58
  59 #ifdef NEED_INET_V6DEFS_H
  60 # include "inet_v6defs.h"
  61 #endif
  62
  63 #include <glib.h>
  64 #include <epan/packet.h>
  65
  66 #include <epan/prefs.h>
  67 #include <epan/crypt-md5.h>
  68 #include <epan/emem.h>
  69 #include "packet-tacacs.h"
  70
  71 static void md5_xor( guint8 *data, const char *key, int data_len, guint8 *session_id, guint8 version, guint8 seq_no );
  72
  73 static int proto_tacacs = -1;
  74 static int hf_tacacs_version = -1;
  75 static int hf_tacacs_type = -1;
  76 static int hf_tacacs_nonce = -1;
  77 static int hf_tacacs_userlen = -1;
  78 static int hf_tacacs_passlen = -1;
  79 static int hf_tacacs_response = -1;
  80 static int hf_tacacs_reason = -1;
  81 static int hf_tacacs_result1 = -1;
  82 static int hf_tacacs_destaddr = -1;
  83 static int hf_tacacs_destport = -1;
  84 static int hf_tacacs_line = -1;
  85 static int hf_tacacs_result2 = -1;
  86 static int hf_tacacs_result3 = -1;
  87
  88 static gint ett_tacacs = -1;
  89
  90 static const char *tacplus_opt_key;
  91 static GSList *tacplus_keys = NULL;
  92
  93 #define VERSION_TACACS  0x00
  94 #define VERSION_XTACACS 0x80
  95
  96 static const value_string tacacs_version_vals[] = {
  97         { VERSION_TACACS,  "TACACS" },
  98         { VERSION_XTACACS, "XTACACS" },
  99         { 0,               NULL }
 100 };
 101
 102 #define TACACS_LOGIN            1
 103 #define TACACS_RESPONSE         2
 104 #define TACACS_CHANGE           3
 105 #define TACACS_FOLLOW           4
 106 #define TACACS_CONNECT          5
 107 #define TACACS_SUPERUSER        6
 108 #define TACACS_LOGOUT           7
 109 #define TACACS_RELOAD           8
 110 #define TACACS_SLIP_ON          9
 111 #define TACACS_SLIP_OFF         10
 112 #define TACACS_SLIP_ADDR        11
 113 static const value_string tacacs_type_vals[] = {
 114         { TACACS_LOGIN,     "Login" },
 115         { TACACS_RESPONSE,  "Response" },
 116         { TACACS_CHANGE,    "Change" },
 117         { TACACS_FOLLOW,    "Follow" },
 118         { TACACS_CONNECT,   "Connect" },
 119         { TACACS_SUPERUSER, "Superuser" },
 120         { TACACS_LOGOUT,    "Logout" },
 121         { TACACS_RELOAD,    "Reload" },
 122         { TACACS_SLIP_ON,   "SLIP on" },
 123         { TACACS_SLIP_OFF,  "SLIP off" },
 124         { TACACS_SLIP_ADDR, "SLIP Addr" },
 125         { 0,                NULL }};
 126
 127 static const value_string tacacs_reason_vals[] = {
 128         { 0  , "none" },
 129         { 1  , "expiring" },
 130         { 2  , "password" },
 131         { 3  , "denied" },
 132         { 4  , "quit" },
 133         { 5  , "idle" },
 134         { 6  , "drop" },
 135         { 7  , "bad" },
 136         { 0  , NULL }
 137 };
 138
 139 static const value_string tacacs_resp_vals[] = {
 140         { 0  , "this is not a response" },
 141         { 1  , "accepted" },
 142         { 2  , "rejected" },
 143         { 0  , NULL }
 144 };
 145
 146 #define UDP_PORT_TACACS 49
 147 #define TCP_PORT_TACACS 49
 148
 149 static void
 150 dissect_tacacs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 151 {
 152         proto_tree      *tacacs_tree;
 153         proto_item      *ti;
 154         guint8          txt_buff[255+1],version,type,userlen,passlen;
 155
 156         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 157                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS");
 158         if (check_col(pinfo->cinfo, COL_INFO))
 159                 col_clear(pinfo->cinfo, COL_INFO);
 160
 161         version = tvb_get_guint8(tvb,0);
 162         if (version != 0) {
 163                 if (check_col(pinfo->cinfo, COL_PROTOCOL))
 164                         col_set_str(pinfo->cinfo, COL_PROTOCOL, "XTACACS");
 165         }
 166
 167         type = tvb_get_guint8(tvb,1);
 168         if (check_col(pinfo->cinfo, COL_INFO))
 169                 col_add_str(pinfo->cinfo, COL_INFO,
 170                     val_to_str(type, tacacs_type_vals, "Unknown (0x%02x)"));
 171
 172         if (tree)
 173         {
 174                 ti = proto_tree_add_protocol_format(tree, proto_tacacs,
 175                  tvb, 0, -1, version==0?"TACACS":"XTACACS");
 176                 tacacs_tree = proto_item_add_subtree(ti, ett_tacacs);
 177
 178                 proto_tree_add_uint(tacacs_tree, hf_tacacs_version, tvb, 0, 1,
 179                     version);
 180                 proto_tree_add_uint(tacacs_tree, hf_tacacs_type, tvb, 1, 1,
 181                     type);
 182                 proto_tree_add_item(tacacs_tree, hf_tacacs_nonce, tvb, 2, 2,
 183                     FALSE);
 184
 185         if (version==0)
 186             {
 187             if (type!=TACACS_RESPONSE)
 188                 {
 189                 userlen=tvb_get_guint8(tvb,4);
 190                 proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
 191                     userlen);
 192                 passlen=tvb_get_guint8(tvb,5);
 193                 proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
 194                     passlen);
 195                 tvb_get_nstringz0(tvb,6,userlen+1,txt_buff);
 196                 proto_tree_add_text(tacacs_tree, tvb, 6, userlen,         "Username: %s",txt_buff);
 197                 tvb_get_nstringz0(tvb,6+userlen,passlen+1,txt_buff);
 198                 proto_tree_add_text(tacacs_tree, tvb, 6+userlen, passlen, "Password: %s",txt_buff);
 199                 }
 200             else
 201                 {
 202                 proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 4, 1,
 203                     FALSE);
 204                 proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 5, 1,
 205                     FALSE);
 206                 }
 207             }
 208         else
 209             {
 210             userlen=tvb_get_guint8(tvb,4);
 211             proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
 212                 userlen);
 213             passlen=tvb_get_guint8(tvb,5);
 214             proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
 215                 passlen);
 216             proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 6, 1,
 217                 FALSE);
 218             proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 7, 1,
 219                 FALSE);
 220             proto_tree_add_item(tacacs_tree, hf_tacacs_result1, tvb, 8, 4,
 221                 FALSE);
 222             proto_tree_add_item(tacacs_tree, hf_tacacs_destaddr, tvb, 12, 4,
 223                 FALSE);
 224             proto_tree_add_item(tacacs_tree, hf_tacacs_destport, tvb, 16, 2,
 225                 FALSE);
 226             proto_tree_add_item(tacacs_tree, hf_tacacs_line, tvb, 18, 2,
 227                 FALSE);
 228             proto_tree_add_item(tacacs_tree, hf_tacacs_result2, tvb, 20, 4,
 229                 FALSE);
 230             proto_tree_add_item(tacacs_tree, hf_tacacs_result3, tvb, 24, 2,
 231                 FALSE);
 232             if (type!=TACACS_RESPONSE)
 233                 {
 234                 tvb_get_nstringz0(tvb,26,userlen+1,txt_buff);
 235                 proto_tree_add_text(tacacs_tree, tvb, 26, userlen,  "Username: %s",txt_buff);
 236                 tvb_get_nstringz0(tvb,26+userlen,passlen+1,txt_buff);
 237                 proto_tree_add_text(tacacs_tree, tvb, 26+userlen, passlen, "Password; %s",txt_buff);
 238                 }
 239             }
 240         }
 241 }
 242
 243 void
 244 proto_register_tacacs(void)
 245 {
 246         static hf_register_info hf[] = {
 247           { &hf_tacacs_version,
 248             { "Version",           "tacacs.version",
 249               FT_UINT8, BASE_HEX, VALS(tacacs_version_vals), 0x0,
 250               "Version", HFILL }},
 251           { &hf_tacacs_type,
 252             { "Type",              "tacacs.type",
 253               FT_UINT8, BASE_DEC, VALS(tacacs_type_vals), 0x0,
 254               "Type", HFILL }},
 255           { &hf_tacacs_nonce,
 256             { "Nonce",             "tacacs.nonce",
 257               FT_UINT16, BASE_HEX, NULL, 0x0,
 258               "Nonce", HFILL }},
 259           { &hf_tacacs_userlen,
 260             { "Username length",   "tacacs.userlen",
 261               FT_UINT8, BASE_DEC, NULL, 0x0,
 262               "Username length", HFILL }},
 263           { &hf_tacacs_passlen,
 264             { "Password length",   "tacacs.passlen",
 265               FT_UINT8, BASE_DEC, NULL, 0x0,
 266               "Password length", HFILL }},
 267           { &hf_tacacs_response,
 268             { "Response",          "tacacs.response",
 269               FT_UINT8, BASE_DEC, VALS(tacacs_resp_vals), 0x0,
 270               "Response", HFILL }},
 271           { &hf_tacacs_reason,
 272             { "Reason",            "tacacs.reason",
 273               FT_UINT8, BASE_DEC, VALS(tacacs_reason_vals), 0x0,
 274               "Reason", HFILL }},
 275           { &hf_tacacs_result1,
 276             { "Result 1",          "tacacs.result1",
 277               FT_UINT32, BASE_HEX, NULL, 0x0,
 278               "Result 1", HFILL }},
 279           { &hf_tacacs_destaddr,
 280             { "Destination address", "tacacs.destaddr",
 281               FT_IPv4, BASE_NONE, NULL, 0x0,
 282               "Destination address", HFILL }},
 283           { &hf_tacacs_destport,
 284             { "Destination port",  "tacacs.destport",
 285               FT_UINT16, BASE_DEC, NULL, 0x0,
 286               "Destination port", HFILL }},
 287           { &hf_tacacs_line,
 288             { "Line",              "tacacs.line",
 289               FT_UINT16, BASE_DEC, NULL, 0x0,
 290               "Line", HFILL }},
 291           { &hf_tacacs_result2,
 292             { "Result 2",          "tacacs.result2",
 293               FT_UINT32, BASE_HEX, NULL, 0x0,
 294               "Result 2", HFILL }},
 295           { &hf_tacacs_result3,
 296             { "Result 3",          "tacacs.result3",
 297               FT_UINT16, BASE_HEX, NULL, 0x0,
 298               "Result 3", HFILL }},
 299         };
 300
 301         static gint *ett[] = {
 302                 &ett_tacacs,
 303         };
 304         proto_tacacs = proto_register_protocol("TACACS", "TACACS", "tacacs");
 305         proto_register_field_array(proto_tacacs, hf, array_length(hf));
 306         proto_register_subtree_array(ett, array_length(ett));
 307 }
 308
 309 void
 310 proto_reg_handoff_tacacs(void)
 311 {
 312         dissector_handle_t tacacs_handle;
 313
 314         tacacs_handle = create_dissector_handle(dissect_tacacs, proto_tacacs);
 315         dissector_add("udp.port", UDP_PORT_TACACS, tacacs_handle);
 316 }
 317
 318 static int proto_tacplus = -1;
 319 static int hf_tacplus_response = -1;
 320 static int hf_tacplus_request = -1;
 321 static int hf_tacplus_majvers = -1;
 322 static int hf_tacplus_minvers = -1;
 323 static int hf_tacplus_type = -1;
 324 static int hf_tacplus_seqno = -1;
 325 static int hf_tacplus_flags = -1;
 326 static int hf_tacplus_flags_payload_type = -1;
 327 static int hf_tacplus_flags_connection_type = -1;
 328 static int hf_tacplus_acct_flags = -1;
 329 static int hf_tacplus_session_id = -1;
 330 static int hf_tacplus_packet_len = -1;
 331
 332 static gint ett_tacplus = -1;
 333 static gint ett_tacplus_body = -1;
 334 static gint ett_tacplus_body_chap = -1;
 335 static gint ett_tacplus_flags = -1;
 336 static gint ett_tacplus_acct_flags = -1;
 337
 338 typedef struct _tacplus_key_entry {
 339         address  *s; /* Server address */
 340         address  *c; /* client address */
 341         char    *k; /* Key */
 342 } tacplus_key_entry;
 343
 344 static gint
 345 tacplus_decrypted_tvb_setup( tvbuff_t *tvb, tvbuff_t **dst_tvb, packet_info *pinfo, guint32 len, guint8 version, const char *key )
 346 {
 347         guint8  *buff;
 348         guint8 session_id[4];
 349
 350         /* TODO Check the possibility to use pinfo->decrypted_data */
 351 /* session_id is in NETWORK Byte Order, and is used as byte array in the md5_xor */
 352
 353         tvb_memcpy(tvb, (guint8*)session_id, 4,4);
 354
 355         buff = tvb_memdup(tvb, TAC_PLUS_HDR_SIZE, len);
 356
 357
 358         md5_xor( buff, key, len, session_id,version, tvb_get_guint8(tvb,2) );
 359
 360         /* Allocate a new tvbuff, referring to the decrypted data. */
 361         *dst_tvb = tvb_new_real_data( buff, len, len );
 362
 363         /* Arrange that the allocated packet data copy be freed when the
 364            tvbuff is freed. */
 365         tvb_set_free_cb( *dst_tvb, g_free );
 366
 367         /* Add the tvbuff to the list of tvbuffs to which the tvbuff we
 368            were handed refers, so it'll get cleaned up when that tvbuff
 369            is cleaned up. */
 370         tvb_set_child_real_data_tvbuff( tvb, *dst_tvb );
 371
 372         /* Add the decrypted data to the data source list. */
 373         add_new_data_source(pinfo, *dst_tvb, "TACACS+ Decrypted");
 374
 375         return 0;
 376 }
 377 static void
 378 dissect_tacplus_args_list( tvbuff_t *tvb, proto_tree *tree, int data_off, int len_off, int arg_cnt )
 379 {
 380         int i;
 381         guint8  buff[257];
 382         for(i=0;i<arg_cnt;i++){
 383                 int len=tvb_get_guint8(tvb,len_off+i);
 384                 proto_tree_add_text( tree, tvb, len_off+i, 1, "Arg[%d] length: %d", i, len );
 385                 tvb_get_nstringz0(tvb, data_off, len+1, buff);
 386                 proto_tree_add_text( tree, tvb, data_off, len, "Arg[%d] value: %s", i, buff );
 387                 data_off+=len;
 388         }
 389 }
 390
 391
 392 static int
 393 proto_tree_add_tacplus_common_fields( tvbuff_t *tvb, proto_tree *tree,  int offset, int var_off )
 394 {
 395         int val;
 396         guint8 buff[257];
 397         /* priv_lvl */
 398         proto_tree_add_text( tree, tvb, offset, 1,
 399                         "Privilege Level: %d", tvb_get_guint8(tvb,offset) );
 400         offset++;
 401
 402         /* authen_type */
 403         val=tvb_get_guint8(tvb,offset);
 404         proto_tree_add_text( tree, tvb, offset, 1,
 405                         "Authentication type: %s",
 406                         val_to_str( val, tacplus_authen_type_vals, "Unknown Packet" ) );
 407         offset++;
 408
 409         /* service */
 410         val=tvb_get_guint8(tvb,offset);
 411         proto_tree_add_text( tree, tvb, offset, 1,
 412                         "Service: %s",
 413                         val_to_str( val, tacplus_authen_service_vals, "Unknown Packet" ) );
 414         offset++;
 415
 416         /* user_len && user */
 417         val=tvb_get_guint8(tvb,offset);
 418         proto_tree_add_text( tree, tvb, offset, 1, "User len: %d", val );
 419         if( val ){
 420                 tvb_get_nstringz0(tvb, var_off, val+1, buff);
 421                 proto_tree_add_text( tree, tvb, var_off, val, "User: %s", buff );
 422                 var_off+=val;
 423         }
 424         offset++;
 425
 426
 427         /* port_len &&  port */
 428         val=tvb_get_guint8(tvb,offset);
 429         proto_tree_add_text( tree, tvb, offset, 1, "Port len: %d", val );
 430         if( val ){
 431                 tvb_get_nstringz0(tvb, var_off, val+1, buff);
 432                 proto_tree_add_text( tree, tvb, var_off, val, "Port: %s", buff );
 433                 var_off+=val;
 434         }
 435         offset++;
 436
 437         /* rem_addr_len && rem_addr */
 438         val=tvb_get_guint8(tvb,offset);
 439         proto_tree_add_text( tree, tvb, offset, 1, "Remaddr len: %d", val );
 440         if( val ){
 441                 tvb_get_nstringz0(tvb, var_off, val+1, buff);
 442                 proto_tree_add_text( tree, tvb, var_off, val, "Remote Address: %s", buff );
 443                 var_off+=val;
 444         }
 445         return var_off;
 446 }
 447
 448 static void
 449 dissect_tacplus_body_authen_req_login( tvbuff_t* tvb, proto_tree *tree, int var_off )
 450 {
 451         guint8 buff[257];
 452         guint8 val;
 453         val=tvb_get_guint8( tvb, AUTHEN_S_DATA_LEN_OFF );
 454
 455         switch ( tvb_get_guint8(tvb, AUTHEN_S_AUTHEN_TYPE_OFF ) ) { /* authen_type */
 456
 457                 case TAC_PLUS_AUTHEN_TYPE_ASCII:
 458                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "Data: %d (not used)", val );
 459                         if( val )
 460                                 proto_tree_add_text( tree, tvb, var_off, val, "Data" );
 461                         break;
 462
 463                 case TAC_PLUS_AUTHEN_TYPE_PAP:
 464                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "Password Length %d", val );
 465                         if( val ) {
 466                                 tvb_get_nstringz0( tvb, var_off, val+1, buff );
 467                                 proto_tree_add_text( tree, tvb, var_off, val, "Password: %s", buff );
 468                         }
 469                         break;
 470
 471                 case TAC_PLUS_AUTHEN_TYPE_CHAP:
 472                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "CHAP Data Length %d", val );
 473                         if( val ) {
 474                                 proto_item      *pi;
 475                                 proto_tree  *pt;
 476                                 guint8 chal_len=val-(1+16); /* Response field alwayes 16 octets */
 477                                 pi = proto_tree_add_text(tree, tvb, var_off, val, "CHAP Data" );
 478                                 pt = proto_item_add_subtree( pi, ett_tacplus_body_chap );
 479                                 val= tvb_get_guint8( tvb, var_off );
 480                                 proto_tree_add_text( pt, tvb, var_off, 1, "ID: %d", val );
 481                                 var_off++;
 482                                 tvb_get_nstringz0( tvb, var_off, chal_len+1, buff );
 483                                 proto_tree_add_text( pt, tvb, var_off, chal_len, "Challenge: %s", buff );
 484                                 var_off+=chal_len;
 485                                 tvb_get_nstringz0( tvb, var_off, 16+1, buff );
 486                                 proto_tree_add_text( pt, tvb, var_off, 16 , "Response: %s", buff );
 487                         }
 488                         break;
 489                 case TAC_PLUS_AUTHEN_TYPE_MSCHAP:
 490                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "MSCHAP Data Length %d", val );
 491                         if( val ) {
 492                                 proto_item      *pi;
 493                                 proto_tree  *pt;
 494                                 guint8 chal_len=val-(1+49);  /* Response field alwayes 49 octets */
 495                                 pi = proto_tree_add_text(tree, tvb, var_off, val, "MSCHAP Data" );
 496                                 pt = proto_item_add_subtree( pi, ett_tacplus_body_chap );
 497                                 val= tvb_get_guint8( tvb, var_off );
 498                                 proto_tree_add_text( pt, tvb, var_off, 1, "ID: %d", val );
 499                                 var_off++;
 500                                 tvb_get_nstringz0( tvb, var_off, chal_len+1, buff );
 501                                 proto_tree_add_text( pt, tvb, var_off, chal_len, "Challenge: %s", buff );
 502                                 var_off+=chal_len;
 503                                 tvb_get_nstringz0( tvb, var_off, 49+1, buff );
 504                                 proto_tree_add_text( pt, tvb, var_off, 49 , "Response: %s", buff );
 505                         }
 506                         break;
 507                 case TAC_PLUS_AUTHEN_TYPE_ARAP:
 508                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "ARAP Data Length %d", val );
 509                         if( val ) {
 510                                 proto_item      *pi;
 511                                 proto_tree  *pt;
 512                                 pi = proto_tree_add_text(tree, tvb, var_off, val, "ARAP Data" );
 513                                 pt = proto_item_add_subtree( pi, ett_tacplus_body_chap );
 514
 515                                 tvb_get_nstringz0( tvb, var_off, 8+1, buff );
 516                                 proto_tree_add_text( pt, tvb, var_off, 8, "Nas Challenge: %s", buff );
 517                                 var_off+=8;
 518                                 tvb_get_nstringz0( tvb, var_off, 8+1, buff );
 519                                 proto_tree_add_text( pt, tvb, var_off, 8, "Remote Challenge: %s", buff );
 520                                 var_off+=8;
 521                                 tvb_get_nstringz0( tvb, var_off, 8+1, buff );
 522                                 proto_tree_add_text( pt, tvb, var_off, 8, "Remote Response: %s", buff );
 523                                 var_off+=8;
 524                         }
 525                         break;
 526
 527                 default: /* Should not be reached */
 528                         proto_tree_add_text( tree, tvb, AUTHEN_S_DATA_LEN_OFF, 1, "Data: %d", val );
 529                         if( val ){
 530                                 proto_tree_add_text( tree, tvb, var_off, val, "Data" );
 531                         }
 532         }
 533 }
 534
 535 static void
 536 dissect_tacplus_body_authen_req( tvbuff_t* tvb, proto_tree *tree )
 537 {
 538         guint8 val;
 539         int var_off=AUTHEN_S_VARDATA_OFF;
 540
 541         /* Action */
 542         val=tvb_get_guint8( tvb, AUTHEN_S_ACTION_OFF );
 543         proto_tree_add_text( tree, tvb,
 544                         AUTHEN_S_ACTION_OFF, 1,
 545                         "Action: %s",
 546                         val_to_str( val, tacplus_authen_action_vals, "Unknown Packet" ) );
 547
 548         var_off=proto_tree_add_tacplus_common_fields( tvb, tree , AUTHEN_S_PRIV_LVL_OFF, AUTHEN_S_VARDATA_OFF );
 549
 550         switch( val ) {
 551                 case TAC_PLUS_AUTHEN_LOGIN:
 552                         dissect_tacplus_body_authen_req_login( tvb, tree, var_off );
 553                         break;
 554                 case TAC_PLUS_AUTHEN_SENDAUTH:
 555                         break;
 556         }
 557 }
 558
 559 static void
 560 dissect_tacplus_body_authen_req_cont( tvbuff_t *tvb, proto_tree *tree )
 561 {
 562         int val;
 563         int var_off=AUTHEN_C_VARDATA_OFF;
 564         guint8 *buff=NULL;
 565
 566         val=tvb_get_guint8( tvb, AUTHEN_C_FLAGS_OFF );
 567         proto_tree_add_text( tree, tvb,
 568                         AUTHEN_R_FLAGS_OFF, 1, "Flags: 0x%02x %s",
 569                         val,
 570                         (val&TAC_PLUS_CONTINUE_FLAG_ABORT?"(Abort)":"") );
 571
 572
 573         val=tvb_get_ntohs( tvb, AUTHEN_C_USER_LEN_OFF );
 574         proto_tree_add_text( tree, tvb, AUTHEN_C_USER_LEN_OFF, 2 , "User length: %d", val );
 575         if( val ){
 576                 buff=tvb_get_ephemeral_string( tvb, var_off, val );
 577                 proto_tree_add_text( tree, tvb, var_off, val, "User: %s", buff );
 578                 var_off+=val;
 579         }
 580
 581         val=tvb_get_ntohs( tvb, AUTHEN_C_DATA_LEN_OFF );
 582         proto_tree_add_text( tree, tvb, AUTHEN_C_DATA_LEN_OFF, 2 ,
 583                         "Data length: %d", val );
 584         if( val ){
 585                 proto_tree_add_text( tree, tvb, var_off, val, "Data" );
 586         }
 587
 588 }
 589
 590 /* Server REPLY */
 591 static void
 592 dissect_tacplus_body_authen_rep( tvbuff_t *tvb, proto_tree *tree )
 593 {
 594         int val;
 595         int var_off=AUTHEN_R_VARDATA_OFF;
 596         guint8 *buff=NULL;
 597
 598         val=tvb_get_guint8( tvb, AUTHEN_R_STATUS_OFF );
 599         proto_tree_add_text(tree, tvb,
 600                         AUTHEN_R_STATUS_OFF, 1, "Status: 0x%01x (%s)", val,
 601                         val_to_str( val, tacplus_reply_status_vals, "Unknown Packet" )  );
 602
 603         val=tvb_get_guint8( tvb, AUTHEN_R_FLAGS_OFF );
 604         proto_tree_add_text(tree, tvb,
 605                         AUTHEN_R_FLAGS_OFF, 1, "Flags: 0x%02x %s",
 606                         val, (val&TAC_PLUS_REPLY_FLAG_NOECHO?"(NoEcho)":"") );
 607
 608
 609         val=tvb_get_ntohs(tvb, AUTHEN_R_SRV_MSG_LEN_OFF );
 610         proto_tree_add_text( tree, tvb, AUTHEN_R_SRV_MSG_LEN_OFF, 2 ,
 611                                 "Server message length: %d", val );
 612         if( val ) {
 613                 buff=tvb_get_ephemeral_string(tvb, var_off, val );
 614                 proto_tree_add_text(tree, tvb, var_off, val, "Server message: %s", buff );
 615                 var_off+=val;
 616         }
 617
 618         val=tvb_get_ntohs(tvb, AUTHEN_R_DATA_LEN_OFF );
 619         proto_tree_add_text( tree, tvb, AUTHEN_R_DATA_LEN_OFF, 2 ,
 620                                 "Data length: %d", val );
 621         if( val ){
 622                 proto_tree_add_text(tree, tvb, var_off, val, "Data" );
 623         }
 624 }
 625
 626 static void
 627 dissect_tacplus_body_author_req( tvbuff_t* tvb, proto_tree *tree )
 628 {
 629         int val;
 630         int var_off;
 631
 632         val=tvb_get_guint8( tvb, AUTHOR_Q_AUTH_METH_OFF ) ;
 633         proto_tree_add_text( tree, tvb, AUTHOR_Q_AUTH_METH_OFF, 1,
 634                         "Auth Method: %s", val_to_str( val, tacplus_authen_method, "Unknown Authen Method" ) );
 635
 636         val=tvb_get_guint8( tvb, AUTHOR_Q_ARGC_OFF );
 637         var_off=proto_tree_add_tacplus_common_fields( tvb, tree ,
 638                         AUTHOR_Q_PRIV_LVL_OFF,
 639                         AUTHOR_Q_VARDATA_OFF + val );
 640
 641         proto_tree_add_text( tree, tvb, AUTHOR_Q_ARGC_OFF, 1, "Arg count: %d", val );
 642
 643 /* var_off points after rem_addr */
 644
 645         dissect_tacplus_args_list( tvb, tree, var_off, AUTHOR_Q_VARDATA_OFF, val );
 646 }
 647
 648 static void
 649 dissect_tacplus_body_author_rep( tvbuff_t* tvb, proto_tree *tree )
 650 {
 651         int offset=AUTHOR_R_VARDATA_OFF;
 652         int val=tvb_get_guint8( tvb, AUTHOR_R_STATUS_OFF        ) ;
 653
 654
 655         proto_tree_add_text( tree, tvb, AUTHOR_R_STATUS_OFF     , 1,
 656                         "Auth Status: 0x%01x (%s)", val,
 657                         val_to_str( val, tacplus_author_status, "Unknown Authorization Status" ));
 658
 659         val=tvb_get_ntohs( tvb, AUTHOR_R_SRV_MSG_LEN_OFF );
 660         offset+=val;
 661         proto_tree_add_text( tree, tvb, AUTHOR_R_SRV_MSG_LEN_OFF, 2, "Server Msg length: %d", val );
 662
 663         val=tvb_get_ntohs( tvb, AUTHOR_R_DATA_LEN_OFF );
 664         offset+=val;
 665         proto_tree_add_text( tree, tvb, AUTHOR_R_DATA_LEN_OFF, 2, "Data length: %d", val );
 666
 667         val=tvb_get_guint8( tvb, AUTHOR_R_ARGC_OFF);
 668         offset+=val;
 669         proto_tree_add_text( tree, tvb, AUTHOR_R_ARGC_OFF, 1, "Arg count: %d", val );
 670
 671         dissect_tacplus_args_list( tvb, tree, offset, AUTHOR_R_VARDATA_OFF, val );
 672 }
 673
 674 static void
 675 dissect_tacplus_body_acct_req( tvbuff_t* tvb, proto_tree *tree )
 676 {
 677         int val, var_off;
 678
 679         proto_item *tf;
 680         proto_tree *flags_tree;
 681
 682         val=tvb_get_guint8( tvb, ACCT_Q_FLAGS_OFF );
 683         tf = proto_tree_add_uint( tree, hf_tacplus_acct_flags, tvb, ACCT_Q_FLAGS_OFF, 1, val );
 684
 685         flags_tree = proto_item_add_subtree( tf, ett_tacplus_acct_flags );
 686         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 687                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_MORE, 8,
 688                                 "More: Set", "More: Not set" ) );
 689         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 690                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_START, 8,
 691                                 "Start: Set", "Start: Not set" ) );
 692         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 693                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_STOP, 8,
 694                                 "Stop: Set", "Stop: Not set" ) );
 695         proto_tree_add_text( flags_tree, tvb, ACCT_Q_FLAGS_OFF, 1, "%s",
 696                         decode_boolean_bitfield( val, TAC_PLUS_ACCT_FLAG_WATCHDOG, 8,
 697                                 "Watchdog: Set", "Watchdog: Not set" ) );
 698
 699         val=tvb_get_guint8( tvb, ACCT_Q_METHOD_OFF );
 700         proto_tree_add_text( tree, tvb, ACCT_Q_METHOD_OFF, 1,
 701                         "Authen Method: 0x%01x (%s)",
 702                         val, val_to_str( val, tacplus_authen_method, "Unknown Authen Method" ) );
 703
 704         val=tvb_get_guint8( tvb, ACCT_Q_ARG_CNT_OFF );
 705
 706         /* authen_type */
 707         var_off=proto_tree_add_tacplus_common_fields( tvb, tree ,
 708                         ACCT_Q_PRIV_LVL_OFF,
 709                         ACCT_Q_VARDATA_OFF+val
 710                         );
 711
 712         proto_tree_add_text( tree, tvb, ACCT_Q_ARG_CNT_OFF, 1,
 713                         "Arg Cnt: %d", val  );
 714
 715         dissect_tacplus_args_list( tvb, tree, var_off, ACCT_Q_VARDATA_OFF, val );
 716
 717
 718 }
 719
 720 static void
 721 dissect_tacplus_body_acct_rep( tvbuff_t* tvb, proto_tree *tree )
 722 {
 723         int val, var_off=ACCT_Q_VARDATA_OFF;
 724
 725         guint8 *buff=NULL;
 726
 727         /* Status */
 728         val=tvb_get_guint8( tvb, ACCT_R_STATUS_OFF );
 729         proto_tree_add_text( tree, tvb, ACCT_R_STATUS_OFF, 1, "Status: 0x%02x (%s)", val,
 730                                 val_to_str( val, tacplus_acct_status, "Bogus status..") );
 731
 732         /* Server Message */
 733         val=tvb_get_ntohs( tvb, ACCT_R_SRV_MSG_LEN_OFF );
 734         proto_tree_add_text( tree, tvb, ACCT_R_SRV_MSG_LEN_OFF, 2 ,
 735                                 "Server message length: %d", val );
 736         if( val ) {
 737                 buff=tvb_get_ephemeral_string( tvb, var_off, val );
 738                 proto_tree_add_text( tree, tvb, var_off,
 739                                 val, "Server message: %s", buff );
 740                 var_off+=val;
 741         }
 742
 743         /*  Data */
 744         val=tvb_get_ntohs( tvb, ACCT_R_DATA_LEN_OFF );
 745         proto_tree_add_text( tree, tvb, ACCT_R_DATA_LEN_OFF, 2 ,
 746                                 "Data length: %d", val );
 747         if( val ) {
 748                 buff= tvb_get_ephemeral_string( tvb, var_off, val );
 749                 proto_tree_add_text( tree, tvb, var_off,
 750                                 val, "Data: %s", buff );
 751         }
 752 }
 753
 754
 755
 756 static void
 757 dissect_tacplus_body(tvbuff_t * hdr_tvb, tvbuff_t * tvb, proto_tree * tree )
 758 {
 759         int type = tvb_get_guint8( hdr_tvb, H_TYPE_OFF );
 760         int seq_no = tvb_get_guint8( hdr_tvb, H_SEQ_NO_OFF );
 761
 762         switch (type) {
 763           case TAC_PLUS_AUTHEN:
 764                 if (  seq_no & 0x01) {
 765                         if ( seq_no == 1 )
 766                                 dissect_tacplus_body_authen_req( tvb, tree );
 767                         else
 768                                 dissect_tacplus_body_authen_req_cont( tvb, tree );
 769                 } else {
 770                         dissect_tacplus_body_authen_rep( tvb, tree );
 771                 }
 772                 return;
 773                 break;
 774           case TAC_PLUS_AUTHOR:
 775                 if ( seq_no & 0x01)
 776                         dissect_tacplus_body_author_req( tvb, tree );
 777                 else
 778                         dissect_tacplus_body_author_rep( tvb, tree );
 779                 return;
 780                 break;
 781           case TAC_PLUS_ACCT:
 782                 if ( seq_no & 0x01)
 783                         dissect_tacplus_body_acct_req( tvb, tree );
 784                 else
 785                         dissect_tacplus_body_acct_rep( tvb, tree );
 786                 return;
 787                 break;
 788         }
 789         proto_tree_add_text( tree, tvb, 0, tvb_length( tvb ), "Bogus..");
 790 }
 791
 792 #ifdef DEB_TACPLUS
 793 static void
 794 tacplus_print_key_entry( gpointer data, gpointer user_data )
 795 {
 796         tacplus_key_entry *tacplus_data=(tacplus_key_entry *)data;
 797         if( user_data ) {
 798                 printf("%s:%s=%s\n", address_to_str( tacplus_data->s ),
 799                                 address_to_str( tacplus_data->c ), tacplus_data->k );
 800         } else {
 801                 printf("%s:%s\n", address_to_str( tacplus_data->s ),
 802                                 address_to_str( tacplus_data->c ) );
 803         }
 804 }
 805 #endif
 806 static int
 807 cmp_conv_address( gconstpointer p1, gconstpointer p2 )
 808 {
 809         const tacplus_key_entry *a1=p1;
 810         const tacplus_key_entry *a2=p2;
 811         gint32  ret;
 812         /*
 813         printf("p1=>");
 814         tacplus_print_key_entry( p1, NULL );
 815         printf("p2=>");
 816         tacplus_print_key_entry( p2, NULL );
 817         */
 818         ret=CMP_ADDRESS( a1->s, a2->s );
 819         if( !ret ) {
 820                 ret=CMP_ADDRESS( a1->c, a2->c );
 821                 /*
 822                 if(ret)
 823                         printf("No Client found!"); */
 824         } else {
 825                 /* printf("No Server found!"); */
 826         }
 827         return ret;
 828 }
 829
 830 static const char*
 831 find_key( address *srv, address *cln )
 832 {
 833         tacplus_key_entry data;
 834         GSList *match;
 835
 836         data.s=srv;
 837         data.c=cln;
 838 /*      printf("Looking for: ");
 839         tacplus_print_key_entry( (gconstpointer)&data, NULL ); */
 840         match=g_slist_find_custom( tacplus_keys, (gpointer)&data, cmp_conv_address );
 841 /*      printf("Finished (%p)\n", match);  */
 842         if( match )
 843                 return ((tacplus_key_entry*)match->data)->k;
 844
 845         return (tacplus_keys?NULL:tacplus_opt_key);
 846 }
 847
 848 static void
 849 mkipv4_address( address **addr, const char *str_addr )
 850 {
 851         char *addr_data;
 852
 853         *addr=g_malloc( sizeof(address) );
 854         addr_data=g_malloc( 4 );
 855         inet_pton( AF_INET, str_addr, addr_data );
 856         (*addr)->type=AT_IPv4;
 857         (*addr)->len=4;
 858         (*addr)->data=addr_data;
 859 }
 860 static void
 861 parse_tuple( char *key_from_option )
 862 {
 863         char *client,*key;
 864         tacplus_key_entry *tacplus_data=g_malloc( sizeof(tacplus_key_entry) );
 865         /*
 866         printf("keys: %s\n", key_from_option );
 867         */
 868         client=strchr(key_from_option,'/');
 869         if(!client)
 870                 return;
 871         *client++='\0';
 872         key=strchr(client,'=');
 873         if(!key)
 874                 return;
 875         *key++='\0';
 876         /*
 877         printf("%s %s => %s\n", key_from_option, client, key );
 878         */
 879         mkipv4_address( &tacplus_data->s, key_from_option );
 880         mkipv4_address( &tacplus_data->c, client );
 881         tacplus_data->k=strdup( key );
 882         tacplus_keys = g_slist_prepend( tacplus_keys, tacplus_data );
 883 }
 884
 885 static
 886 void
 887 free_tacplus_keys( gpointer data, gpointer user_data _U_ )
 888 {
 889         g_free( ((tacplus_key_entry *)data)->k );
 890 }
 891
 892 static
 893 void
 894 parse_tacplus_keys( const char *keys_from_option )
 895 {
 896         char *key_copy,*s,*s1;
 897
 898         /* Drop old keys */
 899         if( tacplus_keys ) {
 900                 g_slist_foreach( tacplus_keys, free_tacplus_keys, NULL );
 901                 g_slist_free( tacplus_keys );
 902                 tacplus_keys=NULL;
 903         }
 904
 905         if( !strchr( keys_from_option, '/' ) ){
 906                 /* option not in client/server=key format */
 907                 return ;
 908         }
 909         key_copy=strdup(keys_from_option);
 910         s=key_copy;
 911         while(s){
 912                 if( (s1=strchr( s, ' ' )) != NULL )
 913                         *s1++='\0';
 914                 parse_tuple( s );
 915                 s=s1;
 916         }
 917         g_free( key_copy );
 918 #ifdef DEB_TACPLUS
 919         g_slist_foreach( tacplus_keys, tacplus_print_key_entry, GINT_TO_POINTER(1) );
 920 #endif
 921 }
 922
 923 static void
 924 dissect_tacplus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 925 {
 926         tvbuff_t        *new_tvb=NULL;
 927         proto_tree      *tacplus_tree;
 928         proto_item      *ti;
 929         guint8          version,flags;
 930         proto_tree      *flags_tree;
 931         proto_item      *tf;
 932         proto_item      *tmp_pi;
 933         guint32         len;
 934         gboolean        request=( pinfo->destport == TCP_PORT_TACACS );
 935         const char      *key=NULL;
 936
 937         if( request ) {
 938                 key=find_key( &pinfo->dst, &pinfo->src );
 939         } else {
 940                 key=find_key(  &pinfo->src, &pinfo->dst );
 941         }
 942         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 943                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS+");
 944
 945         if (check_col(pinfo->cinfo, COL_INFO))
 946         {
 947                 int type = tvb_get_guint8(tvb,1);
 948                 col_add_fstr( pinfo->cinfo, COL_INFO, "%s: %s",
 949                                 request ? "Q" : "R",
 950                                 val_to_str(type, tacplus_type_vals, "Unknown (0x%02x)"));
 951         }
 952
 953         if (tree)
 954         {
 955                 ti = proto_tree_add_protocol_format(tree, proto_tacplus,
 956                  tvb, 0, -1, "TACACS+");
 957
 958                 tacplus_tree = proto_item_add_subtree(ti, ett_tacplus);
 959                 if (pinfo->match_port == pinfo->destport)
 960                 {
 961                         proto_tree_add_boolean_hidden(tacplus_tree,
 962                             hf_tacplus_request, tvb, 0, 0, TRUE);
 963                 }
 964                 else
 965                 {
 966                         proto_tree_add_boolean_hidden(tacplus_tree,
 967                             hf_tacplus_response, tvb, 0, 0, TRUE);
 968                 }
 969                 version = tvb_get_guint8(tvb,0);
 970                 proto_tree_add_uint_format(tacplus_tree, hf_tacplus_majvers, tvb, 0, 1,
 971                     version,
 972                     "Major version: %s",
 973                     (version&0xf0)==0xc0?"TACACS+":"Unknown Version");
 974                 proto_tree_add_uint(tacplus_tree, hf_tacplus_minvers, tvb, 0, 1,
 975                     version&0xf);
 976                 proto_tree_add_item(tacplus_tree, hf_tacplus_type, tvb, 1, 1,
 977                     FALSE);
 978                 proto_tree_add_item(tacplus_tree, hf_tacplus_seqno, tvb, 2, 1,
 979                     FALSE);
 980                 flags = tvb_get_guint8(tvb,3);
 981                 tf = proto_tree_add_uint_format(tacplus_tree, hf_tacplus_flags,
 982                     tvb, 3, 1, flags,
 983                     "Flags: 0x%02x (%s payload, %s)",
 984                         flags,
 985                     (flags&FLAGS_UNENCRYPTED) ? "Unencrypted" :
 986                                                 "Encrypted",
 987                     (flags&FLAGS_SINGLE) ? "Single connection" :
 988                                            "Multiple Connections" );
 989                 flags_tree = proto_item_add_subtree(tf, ett_tacplus_flags);
 990                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_payload_type,
 991                     tvb, 3, 1, flags);
 992                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_connection_type,
 993                     tvb, 3, 1, flags);
 994                 proto_tree_add_item(tacplus_tree, hf_tacplus_session_id, tvb, 4, 4,
 995                     FALSE);
 996                 len = tvb_get_ntohl(tvb,8);
 997                 proto_tree_add_uint(tacplus_tree, hf_tacplus_packet_len, tvb, 8, 4,
 998                     len);
 999
1000                 tmp_pi = proto_tree_add_text(tacplus_tree, tvb, TAC_PLUS_HDR_SIZE, len, "%s%s",
1001                                         ((flags&FLAGS_UNENCRYPTED)?"":"Encrypted "), request?"Request":"Reply" );
1002
1003                 if( flags&FLAGS_UNENCRYPTED ) {
1004                         new_tvb = tvb_new_subset( tvb, TAC_PLUS_HDR_SIZE, len, len );
1005                 }  else {
1006                         new_tvb=NULL;
1007                         if( key && *key ){
1008                                 tacplus_decrypted_tvb_setup( tvb, &new_tvb, pinfo, len, version, key );
1009                         }
1010                 }
1011                 if( new_tvb ) {
1012                         /* Check to see if I've a decrypted tacacs packet */
1013                         if( !(flags&FLAGS_UNENCRYPTED) ){
1014                                 tmp_pi = proto_tree_add_text(tacplus_tree, new_tvb, 0, len, "Decrypted %s",
1015                                                         request?"Request":"Reply" );
1016                         }
1017                         dissect_tacplus_body( tvb, new_tvb, proto_item_add_subtree( tmp_pi, ett_tacplus_body ));
1018                 }
1019         }
1020 }
1021
1022 static void
1023 tacplus_pref_cb(void)
1024 {
1025         parse_tacplus_keys( tacplus_opt_key );
1026 }
1027
1028 void
1029 proto_register_tacplus(void)
1030 {
1031         static hf_register_info hf[] = {
1032           { &hf_tacplus_response,
1033             { "Response",           "tacplus.response",
1034               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1035               "TRUE if TACACS+ response", HFILL }},
1036           { &hf_tacplus_request,
1037             { "Request",            "tacplus.request",
1038               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1039               "TRUE if TACACS+ request", HFILL }},
1040           { &hf_tacplus_majvers,
1041             { "Major version",      "tacplus.majvers",
1042               FT_UINT8, BASE_DEC, NULL, 0x0,
1043               "Major version number", HFILL }},
1044           { &hf_tacplus_minvers,
1045             { "Minor version",      "tacplus.minvers",
1046               FT_UINT8, BASE_DEC, NULL, 0x0,
1047               "Minor version number", HFILL }},
1048           { &hf_tacplus_type,
1049             { "Type",               "tacplus.type",
1050               FT_UINT8, BASE_DEC, VALS(tacplus_type_vals), 0x0,
1051               "Type", HFILL }},
1052           { &hf_tacplus_seqno,
1053             { "Sequence number",    "tacplus.seqno",
1054               FT_UINT8, BASE_DEC, NULL, 0x0,
1055               "Sequence number", HFILL }},
1056           { &hf_tacplus_flags,
1057             { "Flags",              "tacplus.flags",
1058               FT_UINT8, BASE_HEX, NULL, 0x0,
1059               "Flags", HFILL }},
1060           { &hf_tacplus_flags_payload_type,
1061             { "Unencrypted",       "tacplus.flags.unencrypted",
1062               FT_BOOLEAN, 8, TFS(&flags_set_truth), FLAGS_UNENCRYPTED,
1063               "Is payload unencrypted?", HFILL }},
1064           { &hf_tacplus_flags_connection_type,
1065             { "Single Connection",    "tacplus.flags.singleconn",
1066               FT_BOOLEAN, 8, TFS(&flags_set_truth), FLAGS_SINGLE,
1067               "Is this a single connection?", HFILL }},
1068           { &hf_tacplus_acct_flags,
1069             { "Flags",    "tacplus.acct.flags",
1070               FT_UINT8, BASE_HEX, NULL, 0x0,
1071               "Flags", HFILL }},
1072           { &hf_tacplus_session_id,
1073             { "Session ID",         "tacplus.session_id",
1074               FT_UINT32, BASE_DEC, NULL, 0x0,
1075               "Session ID", HFILL }},
1076           { &hf_tacplus_packet_len,
1077             { "Packet length",      "tacplus.packet_len",
1078               FT_UINT32, BASE_DEC, NULL, 0x0,
1079               "Packet length", HFILL }}
1080         };
1081         static gint *ett[] = {
1082                 &ett_tacplus,
1083                 &ett_tacplus_flags,
1084                 &ett_tacplus_acct_flags,
1085                 &ett_tacplus_body,
1086                 &ett_tacplus_body_chap,
1087         };
1088         module_t *tacplus_module;
1089
1090         proto_tacplus = proto_register_protocol("TACACS+", "TACACS+", "tacplus");
1091         proto_register_field_array(proto_tacplus, hf, array_length(hf));
1092         proto_register_subtree_array(ett, array_length(ett));
1093         tacplus_module = prefs_register_protocol (proto_tacplus, tacplus_pref_cb );
1094         prefs_register_string_preference ( tacplus_module, "key",
1095         "TACACS+ Encryption Key", "TACACS+ Encryption Key", &tacplus_opt_key );
1096 }
1097
1098 void
1099 proto_reg_handoff_tacplus(void)
1100 {
1101         dissector_handle_t tacplus_handle;
1102
1103         tacplus_handle = create_dissector_handle(dissect_tacplus,
1104             proto_tacplus);
1105         dissector_add("tcp.port", TCP_PORT_TACACS, tacplus_handle);
1106 }
1107
1108
1109 #define MD5_LEN 16
1110
1111 static void
1112 md5_xor( guint8 *data, const char *key, int data_len, guint8 *session_id, guint8 version, guint8 seq_no )
1113 {
1114         int i,j,md5_len;
1115         md5_byte_t *md5_buff;
1116         md5_byte_t hash[MD5_LEN];                                       /* the md5 hash */
1117         md5_byte_t *mdp;
1118         md5_state_t mdcontext;
1119
1120         md5_len = 4 /* sizeof(session_id) */ + strlen(key)
1121                         + sizeof(version) + sizeof(seq_no);
1122
1123         md5_buff = (md5_byte_t*)ep_alloc(md5_len+MD5_LEN);
1124
1125
1126         mdp = md5_buff;
1127         *(guint32*)mdp = *(guint32*)session_id;
1128         mdp += 4 ;
1129         memcpy(mdp, key, strlen(key));
1130         mdp += strlen(key);
1131         *mdp++ = version;
1132         *mdp++ = seq_no;
1133
1134
1135         md5_init(&mdcontext);
1136         md5_append(&mdcontext, md5_buff, md5_len);
1137         md5_finish(&mdcontext,hash);
1138         md5_len += MD5_LEN;
1139         for (i = 0; i < data_len; i += 16) {
1140
1141                 for (j = 0; j < 16; j++) {
1142                         if ((i + j) >= data_len)  {
1143                                 i = data_len+1; /* To exit from the external loop  */
1144                                 break;
1145                         }
1146                         data[i + j] ^= hash[j];
1147                 }
1148                 memcpy(mdp, hash, MD5_LEN);
1149                 md5_init(&mdcontext);
1150                 md5_append(&mdcontext, md5_buff, md5_len);
1151                 md5_finish(&mdcontext,hash);
1152         }
1153 }