packet-ipx.c

   1 /* packet-ipx.c
   2  * Routines for NetWare's IPX
   3  * Gilbert Ramirez <gram@verdict.uthscsa.edu>
   4  *
   5  * $Id: packet-ipx.c,v 1.14 1998/12/31 20:36:43 gram Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@unicom.net>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #include <gtk/gtk.h>
  32
  33 #include <stdio.h>
  34
  35 #ifdef HAVE_SYS_TYPES_H
  36 # include <sys/types.h>
  37 #endif
  38
  39 #include "ethereal.h"
  40 #include "packet.h"
  41 #include "packet-ipx.h"
  42
  43 /* The information in this module (IPX, SPX, NCP) comes from:
  44         NetWare LAN Analysis, Second Edition
  45         Laura A. Chappell and Dan E. Hakes
  46         (c) 1994 Novell, Inc.
  47         Novell Press, San Jose.
  48         ISBN: 0-7821-1362-1
  49
  50   And from the ncpfs source code by Volker Lendecke
  51
  52 */
  53
  54 static void
  55 dissect_spx(const u_char *pd, int offset, frame_data *fd, GtkTree *tree);
  56
  57 static void
  58 dissect_ipxrip(const u_char *pd, int offset, frame_data *fd, GtkTree *tree);
  59
  60 static void
  61 dissect_sap(const u_char *pd, int offset, frame_data *fd, GtkTree *tree);
  62
  63 struct port_info {
  64         guint16 port;
  65         void    (*func) (const u_char *, int, frame_data *, GtkTree *);
  66         char    *text;
  67 };
  68
  69 struct conn_info {
  70         guint8  ctrl;
  71         char    *text;
  72 };
  73
  74 struct server_info {
  75         guint16 type;
  76         char    *text;
  77 };
  78
  79 /* ================================================================= */
  80 /* IPX                                                               */
  81 /* ================================================================= */
  82 static struct port_info ports[] = {
  83         { 0x0451, dissect_ncp,          "NCP" },
  84         { 0x0452, dissect_sap,          "SAP" },
  85         { 0x0453, dissect_ipxrip,       "RIP" },
  86         { 0x0455, NULL,                         "NetBIOS" },
  87         { 0x0456, NULL,                         "Diagnostic" },
  88         { 0x0457, NULL,                         "Serialization" },
  89         { 0x0551, NULL,                         "NWLink SMB Name Query" },
  90         { 0x0553, dissect_nwlink_dg,"NWLink SMB Datagram" },
  91         { 0x055d, NULL,                         "Attachmate Gateway" },
  92         { 0x4001, NULL,                         "IPX Message" },
  93         { 0x0000, NULL,                         NULL }
  94 };
  95
  96 static char*
  97 port_text(guint16 port) {
  98         int i=0;
  99
 100         while (ports[i].text != NULL) {
 101                 if (ports[i].port == port) {
 102                         return ports[i].text;
 103                 }
 104                 i++;
 105         }
 106         return "Unknown";
 107 }
 108
 109 static void*
 110 port_func(guint16 port) {
 111         int i=0;
 112
 113         while (ports[i].text != NULL) {
 114                 if (ports[i].port == port) {
 115                         return ports[i].func;
 116                 }
 117                 i++;
 118         }
 119         return NULL;
 120 }
 121
 122 char *
 123 ipx_packet_type(u_char val)
 124 {
 125         if (val == 0) {
 126                 return "IPX";
 127         }
 128         else if (val == 5) {
 129                 return "SPX";
 130         }
 131         else if (val == 17) {
 132                 return "NCP";
 133         }
 134         else if (val == 20) {
 135                 return "NetBIOS Broadcast";
 136         }
 137         else if (val >= 16 && val <= 31) {
 138                 return "Experimental Protocol";
 139         }
 140         else {
 141                 return "Unknown";
 142         }
 143 }
 144
 145 gchar*
 146 ipxnet_to_string(const guint8 *ad)
 147 {
 148         static gchar    str[3][12];
 149         static gchar    *cur;
 150
 151         if (cur == &str[0][0]) {
 152                 cur = &str[1][0];
 153         } else if (cur == &str[1][0]) {
 154                 cur = &str[2][0];
 155         } else {
 156                 cur = &str[0][0];
 157         }
 158
 159         sprintf(cur, "%02X %02X %02X %02X", ad[0], ad[1], ad[2], ad[3]);
 160         return cur;
 161 }
 162
 163 void
 164 dissect_ipx(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
 165
 166         GtkWidget       *ipx_tree, *ti;
 167         u_char          ipx_type;
 168
 169         char            *dnet, *snet;
 170         guint16         dsocket, ssocket;
 171         void            (*dissect) (const u_char *, int, frame_data *, GtkTree *);
 172
 173         /* Calculate here for use in pinfo and in tree */
 174         dnet = ipxnet_to_string((guint8*)&pd[offset+6]);
 175         snet = ipxnet_to_string((guint8*)&pd[offset+18]);
 176         dsocket = pntohs(&pd[offset+16]);
 177         ssocket = pntohs(&pd[offset+28]);
 178
 179         if (check_col(fd, COL_PROTOCOL))
 180                 col_add_str(fd, COL_PROTOCOL, "IPX");
 181         if (check_col(fd, COL_INFO))
 182                 col_add_fstr(fd, COL_INFO, "%s (0x%04X)", port_text(dsocket), dsocket);
 183
 184         ipx_type = pd[offset+5];
 185
 186         if (tree) {
 187                 ti = add_item_to_tree(GTK_WIDGET(tree), offset, 30,
 188                         "Internetwork Packet Exchange");
 189                 ipx_tree = gtk_tree_new();
 190                 add_subtree(ti, ipx_tree, ETT_IPX);
 191                 add_item_to_tree(ipx_tree, offset,      2, "Checksum: 0x%04X",
 192                         (pd[offset] << 8) | pd[offset+1]);
 193                 add_item_to_tree(ipx_tree, offset+2,    2, "Length: %d bytes",
 194                         (pd[offset+2] << 8) | pd[offset+3]);
 195                 add_item_to_tree(ipx_tree, offset+4,    1, "Transport Control: %d hops",
 196                         pd[offset+4]);
 197                 add_item_to_tree(ipx_tree, offset+5,    1, "Packet Type: %s",
 198                         ipx_packet_type(ipx_type));
 199                 add_item_to_tree(ipx_tree, offset+6,    4, "Destination Network: %s",
 200                         dnet);
 201                 add_item_to_tree(ipx_tree, offset+10,   6, "Destination Node: %s",
 202                         ether_to_str((guint8*)&pd[offset+10]));
 203                 /*dsocket = ntohs(*((guint16*)&pd[offset+16]));*/
 204                 add_item_to_tree(ipx_tree, offset+16,   2,
 205                         "Destination Socket: %s (0x%04X)", port_text(dsocket), dsocket);
 206                 add_item_to_tree(ipx_tree, offset+18,   4, "Source Network: %s",
 207                         snet);
 208                 add_item_to_tree(ipx_tree, offset+22,   6, "Source Node: %s",
 209                         ether_to_str((guint8*)&pd[offset+22]));
 210                 add_item_to_tree(ipx_tree, offset+28,   2,
 211                         "Source Socket: %s (0x%04X)", port_text(ssocket), ssocket);
 212         }
 213         offset += 30;
 214
 215         switch (ipx_type) {
 216                 case 5: /* SPX */
 217                         dissect_spx(pd, offset, fd, tree);
 218                         break;
 219
 220                 case 17: /* NCP */
 221                         dissect_ncp(pd, offset, fd, tree);
 222                         break;
 223
 224                 case 20: /* NetBIOS */
 225                         if (dsocket == 0x0455) {
 226                                 dissect_nbipx_ns(pd, offset, fd, tree);
 227                                 break;
 228                         }
 229                         /* else fall through */
 230
 231                 case 0: /* IPX, fall through to default */
 232                 default:
 233                         dissect = port_func(dsocket);
 234                         if (dissect) {
 235                                 dissect(pd, offset, fd, tree);
 236                         }
 237                         else {
 238                                 dissect = port_func(ssocket);
 239                                 if (dissect) {
 240                                         dissect(pd, offset, fd, tree);
 241                                 }
 242                                 else {
 243                                         dissect_data(pd, offset, fd, tree);
 244                                 }
 245                         }
 246                         break;
 247         }
 248 }
 249
 250
 251 /* ================================================================= */
 252 /* SPX                                                               */
 253 /* ================================================================= */
 254 static char*
 255 spx_conn_ctrl(u_char ctrl)
 256 {
 257         int i=0;
 258
 259         static struct conn_info conns[] = {
 260                 { 0x10, "End-of-Message" },
 261                 { 0x20, "Attention" },
 262                 { 0x40, "Acknowledgment Required"},
 263                 { 0x80, "System Packet"}
 264         };
 265
 266         while (conns[i].text != NULL) {
 267                 if (conns[i].ctrl == ctrl) {
 268                         return conns[i].text;
 269                 }
 270                 i++;
 271         }
 272         return "Unknown";
 273 }
 274
 275 static char*
 276 datastream(u_char type)
 277 {
 278         switch (type) {
 279                 case 0xfe:
 280                         return "End-of-Connection";
 281                 case 0xff:
 282                         return "End-of-Connection Acknowledgment";
 283                 default:
 284                         return "Client-Defined";
 285         }
 286 }
 287
 288 static void
 289 dissect_spx(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
 290
 291         GtkWidget       *spx_tree, *ti;
 292
 293         if (check_col(fd, COL_PROTOCOL))
 294                 col_add_str(fd, COL_PROTOCOL, "SPX");
 295         if (check_col(fd, COL_INFO))
 296                 col_add_str(fd, COL_INFO, "SPX");
 297
 298         if (tree) {
 299                 ti = add_item_to_tree(GTK_WIDGET(tree), offset, 12,
 300                         "Sequenced Packet Exchange");
 301                 spx_tree = gtk_tree_new();
 302                 add_subtree(ti, spx_tree, ETT_SPX);
 303
 304                 add_item_to_tree(spx_tree, offset,      1,
 305                         "Connection Control: %s (0x%02X)",
 306                         spx_conn_ctrl(pd[offset]), pd[offset]);
 307
 308                 add_item_to_tree(spx_tree, offset+1,     1,
 309                         "Datastream Type: %s (0x%02X)",
 310                         datastream(pd[offset+1]), pd[offset+1]);
 311
 312                 add_item_to_tree(spx_tree, offset+2,     2,
 313                         "Source Connection ID: %d", pntohs( &pd[offset+2] ) );
 314
 315                 add_item_to_tree(spx_tree, offset+4,     2,
 316                         "Destination Connection ID: %d", pntohs( &pd[offset+4] ) );
 317
 318                 add_item_to_tree(spx_tree, offset+6,     2,
 319                         "Sequence Number: %d", pntohs( &pd[offset+6] ) );
 320
 321                 add_item_to_tree(spx_tree, offset+8,     2,
 322                         "Acknowledgment Number: %d", pntohs( &pd[offset+8] ) );
 323
 324                 add_item_to_tree(spx_tree, offset+10,     2,
 325                         "Allocation Number: %d", pntohs( &pd[offset+10] ) );
 326
 327                 offset += 12;
 328                 dissect_data(pd, offset, fd, tree);
 329         }
 330 }
 331
 332 /* ================================================================= */
 333 /* IPX RIP                                                           */
 334 /* ================================================================= */
 335 static void
 336 dissect_ipxrip(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
 337
 338         GtkWidget       *rip_tree, *ti;
 339         guint16         operation;
 340         struct ipx_rt_def route;
 341         int                     cursor;
 342
 343         char            *rip_type[2] = { "Request", "Response" };
 344
 345         operation = pntohs(&pd[offset]) - 1;
 346
 347         if (check_col(fd, COL_PROTOCOL))
 348          col_add_str(fd, COL_PROTOCOL, "IPX RIP");
 349         if (check_col(fd, COL_PROTOCOL)) {
 350          if (operation < 2) {
 351                  col_add_str(fd, COL_INFO, rip_type[operation]);
 352          }
 353          else {
 354                  col_add_str(fd, COL_INFO, "Unknown Packet Type");
 355          }
 356         }
 357
 358         if (tree) {
 359                 ti = add_item_to_tree(GTK_WIDGET(tree), offset, END_OF_FRAME,
 360                         "IPX Routing Information Protocol");
 361                 rip_tree = gtk_tree_new();
 362                 add_subtree(ti, rip_tree, ETT_IPXRIP);
 363
 364                 if (operation < 2) {
 365                         add_item_to_tree(rip_tree, offset, 2,
 366                         "RIP packet type: %s", rip_type[operation]);
 367                 }
 368                 else {
 369                         add_item_to_tree(rip_tree, offset, 2, "Unknown RIP packet type");
 370                 }
 371
 372                 for (cursor = offset + 2; cursor < fd->cap_len; cursor += 8) {
 373                         memcpy(&route.network, &pd[cursor], 4);
 374                         route.hops = pntohs(&pd[cursor+4]);
 375                         route.ticks = pntohs(&pd[cursor+6]);
 376
 377                         if (operation == IPX_RIP_REQUEST - 1) {
 378                                 add_item_to_tree(rip_tree, cursor,      8,
 379                                         "Route Vector: %s, %d hop%s, %d tick%s",
 380                                         ipxnet_to_string((guint8*)&route.network),
 381                                         route.hops,  route.hops  == 1 ? "" : "s",
 382                                         route.ticks, route.ticks == 1 ? "" : "s");
 383                         }
 384                         else {
 385                                 add_item_to_tree(rip_tree, cursor,      8,
 386                                         "Route Vector: %s, %d hop%s, %d tick%s (%d ms)",
 387                                         ipxnet_to_string((guint8*)&route.network),
 388                                         route.hops,  route.hops  == 1 ? "" : "s",
 389                                         route.ticks, route.ticks == 1 ? "" : "s",
 390                                         route.ticks * 1000 / 18);
 391                         }
 392                 }
 393         }
 394 }
 395
 396
 397
 398 /* ================================================================= */
 399 /* SAP                                                                                                                           */
 400 /* ================================================================= */
 401 static char*
 402 server_type(guint16 type)
 403 {
 404         int i=0;
 405
 406         /* some of these are from ncpfs, others are from the book */
 407         static struct server_info       servers[] = {
 408                 { 0x0001,       "User" },
 409                 { 0x0002,       "User Group" },
 410                 { 0x0003,       "Print Queue" },
 411                 { 0x0004,       "File server" },
 412                 { 0x0005,       "Job server" },
 413                 { 0x0007,       "Print server" },
 414                 { 0x0008,       "Archive server" },
 415                 { 0x0009,       "Archive server" },
 416                 { 0x000a,       "Job queue" },
 417                 { 0x000b,       "Administration" },
 418                 { 0x0021,       "NAS SNA gateway" },
 419                 { 0x0024,       "Remote bridge" },
 420                 { 0x0026,       "Bridge server" },
 421                 { 0x0027,       "TCP/IP gateway" },
 422                 { 0x002d,       "Time Synchronization VAP" },
 423                 { 0x002e,       "Archive Server Dynamic SAP" },
 424                 { 0x0047,       "Advertising print server" },
 425                 { 0x004b,       "Btrieve VAP 5.0" },
 426                 { 0x004c,       "SQL VAP" },
 427                 { 0x0050,       "Btrieve VAP" },
 428                 { 0x0053,       "Print Queue VAP" },
 429                 { 0x007a,       "TES NetWare for VMS" },
 430                 { 0x0098,       "NetWare access server" },
 431                 { 0x009a,       "Named Pipes server" },
 432                 { 0x009e,       "Portable NetWare Unix" },
 433                 { 0x0107,       "NetWare 386" },
 434                 { 0x0111,       "Test server" },
 435                 { 0x0133,       "NetWare Name Service" },
 436                 { 0x0166,       "NetWare management" },
 437                 { 0x026a,       "NetWare management" },
 438                 { 0x026b,       "Time synchronization" },
 439                 { 0x0278,       "NetWare Directory server" },
 440                 { 0x055d,       "Attachmate SNA gateway" },
 441                 { 0x0000,       NULL }
 442         };
 443
 444         while (servers[i].text != NULL) {
 445                 if (servers[i].type == type) {
 446                         return servers[i].text;
 447                 }
 448                 i++;
 449         }
 450         return "Unknown";
 451 }
 452
 453 static void
 454 dissect_sap(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) {
 455
 456         GtkWidget       *sap_tree, *s_tree, *ti;
 457         int                     cursor;
 458         struct sap_query query;
 459         struct sap_server_ident server;
 460
 461         char            *sap_type[4] = { "General Query", "General Response",
 462                 "Nearest Query", "Nearest Response" };
 463
 464         query.query_type = pntohs(&pd[offset]);
 465         query.server_type = pntohs(&pd[offset+2]);
 466
 467         if (check_col(fd, COL_PROTOCOL))
 468                 col_add_str(fd, COL_PROTOCOL, "SAP");
 469         if (check_col(fd, COL_INFO)) {
 470                 if (query.query_type < 4) {
 471                         col_add_str(fd, COL_INFO, sap_type[query.query_type - 1]);
 472                 }
 473                 else {
 474                         col_add_str(fd, COL_INFO, "Unknown Packet Type");
 475                 }
 476         }
 477
 478         if (tree) {
 479                 ti = add_item_to_tree(GTK_WIDGET(tree), offset, END_OF_FRAME,
 480                         "Service Advertising Protocol");
 481                 sap_tree = gtk_tree_new();
 482                 add_subtree(ti, sap_tree, ETT_IPXSAP);
 483
 484                 if (query.query_type < 4) {
 485                         add_item_to_tree(sap_tree, offset, 2, sap_type[query.query_type - 1]);
 486                 }
 487                 else {
 488                         add_item_to_tree(sap_tree, offset, 2,
 489                                         "Unknown SAP Packet Type %d", query.query_type);
 490                 }
 491
 492                 if (query.query_type == IPX_SAP_GENERAL_RESPONSE ||
 493                                 query.query_type == IPX_SAP_NEAREST_RESPONSE) { /* responses */
 494
 495                         for (cursor = offset + 2; cursor < fd->cap_len; cursor += 64) {
 496                                 server.server_type = pntohs(&pd[cursor]);
 497                                 memcpy(server.server_name, &pd[cursor+2], 48);
 498                                 memcpy(&server.server_network, &pd[cursor+50], 4);
 499                                 memcpy(&server.server_node, &pd[cursor+54], 6);
 500                                 server.server_port = pntohs(&pd[cursor+60]);
 501                                 server.intermediate_network = pntohs(&pd[cursor+62]);
 502
 503                                 ti = add_item_to_tree(GTK_WIDGET(sap_tree), cursor+2, 48,
 504                                         "Server Name: %s", server.server_name);
 505                                 s_tree = gtk_tree_new();
 506                                 add_subtree(ti, s_tree, ETT_IPXSAP_SERVER);
 507
 508                                 add_item_to_tree(s_tree, cursor, 2, "Server Type: %s (0x%04X)",
 509                                                 server_type(server.server_type), server.server_type);
 510                                 add_item_to_tree(s_tree, cursor+50, 4, "Network: %s",
 511                                                 ipxnet_to_string((guint8*)&pd[cursor+50]));
 512                                 add_item_to_tree(s_tree, cursor+54, 6, "Node: %s",
 513                                                 ether_to_str((guint8*)&pd[cursor+54]));
 514                                 add_item_to_tree(s_tree, cursor+60, 2, "Socket: %s (0x%04X)",
 515                                                 port_text(server.server_port), server.server_port);
 516                                 add_item_to_tree(s_tree, cursor+62, 2,
 517                                                 "Intermediate Networks: %d",
 518                                                 server.intermediate_network);
 519                         }
 520                 }
 521                 else {  /* queries */
 522                         add_item_to_tree(sap_tree, offset+2, 2, "Server Type: %s (0x%04X)",
 523                                         server_type(query.server_type), query.server_type);
 524                 }
 525         }
 526 }
 527