2 * Routines for Appletalk packet disassembly (DDP, currently).
4 * $Id: packet-atalk.c,v 1.30 1999/12/09 17:06:37 nneul Exp $
6 * Simon Wilkinson <sxw@dcs.ed.ac.uk>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 #ifdef HAVE_SYS_TYPES_H
28 # include <sys/types.h>
31 #ifdef HAVE_NETINET_IN_H
32 # include <netinet/in.h>
37 #include "packet-atalk.h"
39 static int proto_ddp = -1;
40 static int hf_ddp_hopcount = -1;
41 static int hf_ddp_len = -1;
42 static int hf_ddp_checksum = -1;
43 static int hf_ddp_dst_net = -1;
44 static int hf_ddp_src_net = -1;
45 static int hf_ddp_dst_node = -1;
46 static int hf_ddp_src_node = -1;
47 static int hf_ddp_dst_socket = -1;
48 static int hf_ddp_src_socket = -1;
49 static int hf_ddp_type = -1;
51 static int proto_nbp = -1;
52 static int hf_nbp_op = -1;
53 static int hf_nbp_info = -1;
54 static int hf_nbp_count = -1;
55 static int hf_nbp_tid = -1;
57 static int hf_nbp_node_net = -1;
58 static int hf_nbp_node_port = -1;
59 static int hf_nbp_node_node = -1;
60 static int hf_nbp_node_enum = -1;
61 static int hf_nbp_node_object = -1;
62 static int hf_nbp_node_type = -1;
63 static int hf_nbp_node_zone = -1;
65 static int proto_rtmp = -1;
66 static int hf_rtmp_tuple_net = -1;
67 static int hf_rtmp_tuple_dist = -1;
68 static int hf_rtmp_net = -1;
69 static int hf_rtmp_node_len = -1;
70 static int hf_rtmp_node = -1;
72 static gint ett_nbp = -1;
73 static gint ett_nbp_info = -1;
74 static gint ett_nbp_node = -1;
75 static gint ett_rtmp = -1;
76 static gint ett_rtmp_tuple = -1;
77 static gint ett_ddp = -1;
78 static gint ett_pstring = -1;
80 /* P = Padding, H = Hops, L = Len */
81 #if BYTE_ORDER == BIG_ENDIAN
82 /* PPHHHHLL LLLLLLLL */
83 # define ddp_hops(x) ( ( x >> 10) & 0x3C )
84 # define ddp_len(x) ( x & 0x03ff )
86 /* LLLLLLLL PPHHHHLL*/
87 # define ddp_hops(x) ( x & 0x3C )
88 # define ddp_len(x) ( ntohs(x) & 0x03ff )
90 typedef struct _e_ddp {
91 guint16 hops_len; /* combines pad, hops, and len */
92 guint16 sum,dnet,snet;
98 #define DDP_RTMPDATA 0x01
102 #define DDP_RTMPREQ 0x05
104 #define DDP_ADSP 0x07
105 #define DDP_HEADER_SIZE 13
108 atalk_addr_to_str(const struct atalk_ddp_addr *addrp)
110 static gchar str[3][14];
113 if (cur == &str[0][0]) {
115 } else if (cur == &str[1][0]) {
121 sprintf(cur, "%u.%u:%u", addrp->net, addrp->node, addrp->port);
125 static const value_string op_vals[] = {
126 {DDP_RTMPDATA, "AppleTalk Routing Table response or data" },
127 {DDP_NBP, "AppleTalk Name Binding Protocol packet"},
128 {DDP_ATP, "AppleTalk Transaction Protocol packet"},
129 {DDP_AEP, "AppleTalk Echo Protocol packet"},
130 {DDP_RTMPREQ, "AppleTalk Routing Table request"},
131 {DDP_ZIP, "AppleTalk Zone Information Protocol packet"},
132 {DDP_ADSP, "AppleTalk Data Stream Protocol"},
137 #define NBP_FORWARD 4
140 static const value_string nbp_op_vals[] = {
141 {NBP_LOOKUP, "lookup"},
142 {NBP_FORWARD, "forward request"},
143 {NBP_REPLY, "reply"},
147 int dissect_pascal_string(const u_char *pd, int offset, frame_data *fd,
148 proto_tree *tree, int hf_index)
152 if ( ! BYTES_ARE_IN_FRAME(offset,1) ) {
153 dissect_data(pd,offset,fd,tree);
158 if ( ! BYTES_ARE_IN_FRAME(offset,len) ) {
159 dissect_data(pd,offset,fd,tree);
170 tmp = g_malloc( len+1 );
171 memcpy(tmp, &pd[offset], len);
173 item = proto_tree_add_item(tree, hf_index, offset-1, len+1, tmp);
175 subtree = proto_item_add_subtree(item, ett_pstring);
176 proto_tree_add_text(subtree, offset-1, 1, "Length: %d", len);
177 proto_tree_add_text(subtree, offset, len, "Data: %s", tmp);
187 dissect_rtmp_request(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
188 dissect_data(pd, offset, fd, tree);
193 dissect_rtmp_data(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
194 proto_tree *rtmp_tree;
197 guint8 nodelen,nodelen_bits;
198 guint16 node; /* might be more than 8 bits */
201 if (!BYTES_ARE_IN_FRAME(offset, 3)) {
202 dissect_data(pd, offset, fd, tree);
206 net = pntohs(&pd[offset]);
207 nodelen_bits = pd[offset+2];
208 if ( nodelen_bits <= 8 ) {
212 node = pntohs(&pd[offset]);
216 if (check_col(fd, COL_PROTOCOL))
217 col_add_str(fd, COL_PROTOCOL, "RTMP");
219 if (check_col(fd, COL_INFO))
220 col_add_fstr(fd, COL_INFO, "Net: %d Node Len: %d Node: %d",
221 net, nodelen_bits, node);
224 ti = proto_tree_add_item(tree, proto_rtmp, offset, END_OF_FRAME, NULL);
225 rtmp_tree = proto_item_add_subtree(ti, ett_rtmp);
227 proto_tree_add_item(rtmp_tree, hf_rtmp_net, offset, 2, net);
228 proto_tree_add_item(rtmp_tree, hf_rtmp_node_len, offset+2, 1, nodelen_bits);
229 proto_tree_add_item(rtmp_tree, hf_rtmp_node, offset+3, nodelen, nodelen);
230 offset += 3 + nodelen;
233 while ( BYTES_ARE_IN_FRAME(offset, 1) )
235 proto_tree *tuple_item, *tuple_tree;
236 guint16 tuple_net, tuple_net2;
237 guint8 tuple_dist, tuple_dist2;
239 if ( ! BYTES_ARE_IN_FRAME(offset, 3) )
241 dissect_data(pd,offset,fd,rtmp_tree);
245 tuple_net = pntohs(&pd[offset]);
246 tuple_dist = pd[offset+2];
248 tuple_item = proto_tree_add_text(rtmp_tree, offset, 3,
249 "Tuple %d: Net: %d Dist: %d",
250 i, tuple_net, tuple_dist);
251 tuple_tree = proto_item_add_subtree(tuple_item, ett_rtmp_tuple);
253 proto_tree_add_item(tuple_tree, hf_rtmp_tuple_net, offset, 2,
255 proto_tree_add_item(tuple_tree, hf_rtmp_tuple_dist, offset+2, 1,
258 if ( tuple_dist == 0 || tuple_dist & 0x80 ) /* phase 1/2 */
260 if ( ! BYTES_ARE_IN_FRAME(offset+3, 3) )
262 dissect_data(pd,offset,fd,rtmp_tree);
266 tuple_net2 = pntohs(&pd[offset+3]);
267 tuple_dist2 = pd[offset+5];
269 proto_tree_add_item(tuple_tree, hf_rtmp_tuple_net, offset, 2,
271 proto_tree_add_item(tuple_tree, hf_rtmp_tuple_dist, offset+2, 1,
274 proto_item_set_len(tuple_item, 6);
277 else /* screwy gatorbox/etc. */
290 dissect_nbp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
291 proto_tree *nbp_tree;
292 proto_tree *nbp_info_tree;
293 proto_item *ti, *info_item;
297 if (!BYTES_ARE_IN_FRAME(offset, 2)) {
298 dissect_data(pd, offset, fd, tree);
302 op = pd[offset] >> 4;
303 count = pd[offset] & 0x0F;
305 if (check_col(fd, COL_PROTOCOL))
306 col_add_str(fd, COL_PROTOCOL, "NBP");
308 if (check_col(fd, COL_INFO))
309 col_add_fstr(fd, COL_INFO, "Op: %s Count: %d",
310 val_to_str(op, nbp_op_vals, "unknown (%1x)"), count);
313 ti = proto_tree_add_item(tree, proto_nbp, offset, END_OF_FRAME, NULL);
314 nbp_tree = proto_item_add_subtree(ti, ett_nbp);
316 info_item = proto_tree_add_item_format(nbp_tree, hf_nbp_info, offset, 1,
318 "Info: 0x%01X Operation: %s Count: %d", pd[offset],
319 val_to_str(op, nbp_op_vals, "unknown"),
321 nbp_info_tree = proto_item_add_subtree(info_item, ett_nbp_info);
322 proto_tree_add_item(nbp_info_tree, hf_nbp_op, offset, 1, pd[offset]);
323 proto_tree_add_item(nbp_info_tree, hf_nbp_count, offset, 1, pd[offset]);
324 proto_tree_add_item(nbp_tree, hf_nbp_tid, offset+1, 1, pd[offset+1]);
327 for (i=0; i<count; i++) {
328 struct atalk_ddp_addr addr;
329 proto_tree *node_item,*node_tree;
330 int soffset = offset;
332 if ( !BYTES_ARE_IN_FRAME(offset, 6) ) {
333 dissect_data(pd,offset,fd,nbp_tree);
337 node_item = proto_tree_add_text(nbp_tree, offset, 4,
339 node_tree = proto_item_add_subtree(node_item, ett_nbp_node);
341 addr.net = pntohs(&pd[offset]);
342 addr.node = pd[offset+2];
343 addr.port = pd[offset+3];
345 /* note, this is probably wrong, I need to look at my info at work
346 tomorrow to straighten it out */
348 proto_tree_add_item(node_tree, hf_nbp_node_net, offset, 2, addr.net);
350 proto_tree_add_item(node_tree, hf_nbp_node_node, offset, 1, addr.node);
352 proto_tree_add_item(node_tree, hf_nbp_node_port, offset, 1, addr.port);
354 proto_tree_add_item(node_tree, hf_nbp_node_enum, offset, 1, pd[offset]);
357 offset = dissect_pascal_string(pd,offset,fd,node_tree,hf_nbp_node_object);
358 offset = dissect_pascal_string(pd,offset,fd,node_tree,hf_nbp_node_type);
359 offset = dissect_pascal_string(pd,offset,fd,node_tree,hf_nbp_node_zone);
361 proto_item_set_len(node_item, offset-soffset);
369 dissect_ddp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
371 proto_tree *ddp_tree;
373 static struct atalk_ddp_addr src, dst;
375 if (!BYTES_ARE_IN_FRAME(offset, DDP_HEADER_SIZE)) {
376 dissect_data(pd, offset, fd, tree);
380 memcpy(&ddp, &pd[offset], sizeof(e_ddp));
381 ddp.dnet=ntohs(ddp.dnet);
382 ddp.snet=ntohs(ddp.snet);
383 ddp.sum=ntohs(ddp.sum);
386 src.node = ddp.snode;
387 src.port = ddp.sport;
389 dst.node = ddp.dnode;
390 dst.port = ddp.dport;
391 SET_ADDRESS(&pi.net_src, AT_ATALK, sizeof src, (guint8 *)&src);
392 SET_ADDRESS(&pi.src, AT_ATALK, sizeof src, (guint8 *)&src);
393 SET_ADDRESS(&pi.net_dst, AT_ATALK, sizeof dst, (guint8 *)&dst);
394 SET_ADDRESS(&pi.dst, AT_ATALK, sizeof dst, (guint8 *)&dst);
396 if (check_col(fd, COL_PROTOCOL))
397 col_add_str(fd, COL_PROTOCOL, "DDP");
398 if (check_col(fd, COL_INFO))
399 col_add_str(fd, COL_INFO,
400 val_to_str(ddp.type, op_vals, "Unknown DDP protocol (%02x)"));
403 ti = proto_tree_add_item(tree, proto_ddp, offset, DDP_HEADER_SIZE, NULL);
404 ddp_tree = proto_item_add_subtree(ti, ett_ddp);
405 proto_tree_add_item(ddp_tree, hf_ddp_hopcount, offset, 1,
406 ddp_hops(ddp.hops_len));
407 proto_tree_add_item(ddp_tree, hf_ddp_len, offset, 2,
408 ddp_len(ddp.hops_len));
409 proto_tree_add_item(ddp_tree, hf_ddp_checksum, offset + 2, 2, ddp.sum);
410 proto_tree_add_item(ddp_tree, hf_ddp_dst_net, offset + 4, 2, ddp.dnet);
411 proto_tree_add_item(ddp_tree, hf_ddp_src_net, offset + 6, 2, ddp.snet);
412 proto_tree_add_item(ddp_tree, hf_ddp_dst_node, offset + 8, 1, ddp.dnode);
413 proto_tree_add_item(ddp_tree, hf_ddp_src_node, offset + 9, 1, ddp.snode);
414 proto_tree_add_item(ddp_tree, hf_ddp_dst_socket, offset + 10, 1, ddp.dport);
415 proto_tree_add_item(ddp_tree, hf_ddp_src_socket, offset + 11, 1, ddp.sport);
416 proto_tree_add_item(ddp_tree, hf_ddp_type, offset + 12, 1, ddp.type);
419 offset += DDP_HEADER_SIZE;
421 switch ( ddp.type ) {
423 dissect_nbp(pd, offset, fd, tree);
426 dissect_rtmp_request(pd, offset, fd, tree);
429 dissect_rtmp_data(pd, offset, fd, tree);
432 dissect_data(pd, offset, fd, tree);
438 proto_register_atalk(void)
440 static hf_register_info hf_ddp[] = {
442 { "Hop count", "ddp.hopcount", FT_UINT8, BASE_DEC, NULL, 0x0,
446 { "Datagram length", "ddp.len", FT_UINT16, BASE_DEC, NULL, 0x0,
450 { "Checksum", "ddp.checksum", FT_UINT16, BASE_DEC, NULL, 0x0,
454 { "Destination Net", "ddp.dst.net", FT_UINT16, BASE_DEC, NULL, 0x0,
458 { "Source Net", "ddp.src.net", FT_UINT16, BASE_DEC, NULL, 0x0,
462 { "Destination Node", "ddp.dst.node", FT_UINT8, BASE_DEC, NULL, 0x0,
466 { "Source Node", "ddp.src.node", FT_UINT8, BASE_DEC, NULL, 0x0,
469 { &hf_ddp_dst_socket,
470 { "Destination Socket", "ddp.dst.socket", FT_UINT8, BASE_DEC, NULL, 0x0,
473 { &hf_ddp_src_socket,
474 { "Source Socket", "ddp.src.socket", FT_UINT8, BASE_DEC, NULL, 0x0,
478 { "Protocol type", "ddp.type", FT_UINT8, BASE_DEC, VALS(op_vals), 0x0,
482 static hf_register_info hf_nbp[] = {
484 { "Operation", "nbp.op", FT_UINT8, BASE_DEC,
485 VALS(nbp_op_vals), 0xF0, "Operation" }},
487 { "Info", "nbp.info", FT_UINT8, BASE_HEX,
488 NULL, 0x0, "Info" }},
490 { "Count", "nbp.count", FT_UINT8, BASE_DEC,
491 NULL, 0x0F, "Count" }},
493 { "Network", "nbp.net", FT_UINT16, BASE_DEC,
494 NULL, 0x0, "Network" }},
496 { "Node", "nbp.node", FT_UINT8, BASE_DEC,
497 NULL, 0x0, "Node" }},
499 { "Port", "nbp.port", FT_UINT8, BASE_DEC,
500 NULL, 0x0, "Port" }},
502 { "Enumerator", "nbp.enum", FT_UINT8, BASE_DEC,
503 NULL, 0x0, "Enumerator" }},
504 { &hf_nbp_node_object,
505 { "Object", "nbp.object", FT_STRING, BASE_DEC,
506 NULL, 0x0, "Object" }},
508 { "Type", "nbp.type", FT_STRING, BASE_DEC,
509 NULL, 0x0, "Type" }},
511 { "Zone", "nbp.zone", FT_STRING, BASE_DEC,
512 NULL, 0x0, "Zone" }},
514 { "Transaction ID", "nbp.tid", FT_UINT8, BASE_DEC,
515 NULL, 0x0, "Transaction ID" }}
518 static hf_register_info hf_rtmp[] = {
520 { "Net", "rtmp.net", FT_UINT16, BASE_DEC,
523 { "Node", "nbp.nodeid", FT_UINT8, BASE_DEC,
524 NULL, 0x0, "Node" }},
526 { "Node Length", "nbp.nodeid.length", FT_UINT8, BASE_DEC,
527 NULL, 0x0, "Node Length" }},
528 { &hf_rtmp_tuple_net,
529 { "Net", "rtmp.tuple.net", FT_UINT16, BASE_DEC,
531 { &hf_rtmp_tuple_dist,
532 { "Distance", "rtmp.tuple.dist", FT_UINT16, BASE_DEC,
533 NULL, 0x0, "Distance" }}
537 static gint *ett[] = {
547 proto_ddp = proto_register_protocol("Datagram Delivery Protocol", "ddp");
548 proto_register_field_array(proto_ddp, hf_ddp, array_length(hf_ddp));
550 proto_nbp = proto_register_protocol("Name Binding Protocol", "nbp");
551 proto_register_field_array(proto_nbp, hf_nbp, array_length(hf_nbp));
553 proto_rtmp = proto_register_protocol("Routing Table", "rtmp");
554 proto_register_field_array(proto_rtmp, hf_rtmp, array_length(hf_rtmp));
556 proto_register_subtree_array(ett, array_length(ett));