packet-ipx.c

   1 /* packet-ipx.c
   2  * Routines for NetWare's IPX
   3  * Gilbert Ramirez <gram@verdict.uthscsa.edu>
   4  *
   5  * $Id: packet-ipx.c,v 1.45 2000/01/07 22:05:31 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@zing.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #ifdef HAVE_SYS_TYPES_H
  32 # include <sys/types.h>
  33 #endif
  34
  35 #include <stdio.h>
  36 #include <glib.h>
  37 #include "packet.h"
  38 #include "packet-ipx.h"
  39 #include "packet-ncp.h"
  40 #include "resolv.h"
  41
  42 #include "packet-snmp.h"
  43
  44 /* The information in this module (IPX, SPX, NCP) comes from:
  45         NetWare LAN Analysis, Second Edition
  46         Laura A. Chappell and Dan E. Hakes
  47         (c) 1994 Novell, Inc.
  48         Novell Press, San Jose.
  49         ISBN: 0-7821-1362-1
  50
  51   And from the ncpfs source code by Volker Lendecke
  52
  53 */
  54
  55 static int proto_ipx = -1;
  56 static int hf_ipx_checksum = -1;
  57 static int hf_ipx_len = -1;
  58 static int hf_ipx_hops = -1;
  59 static int hf_ipx_packet_type = -1;
  60 static int hf_ipx_dnet = -1;
  61 static int hf_ipx_dnode = -1;
  62 static int hf_ipx_dsocket = -1;
  63 static int hf_ipx_snet = -1;
  64 static int hf_ipx_snode = -1;
  65 static int hf_ipx_ssocket = -1;
  66
  67 static gint ett_ipx = -1;
  68
  69 static int proto_spx = -1;
  70 static int hf_spx_connection_control = -1;
  71 static int hf_spx_datastream_type = -1;
  72 static int hf_spx_src_id = -1;
  73 static int hf_spx_dst_id = -1;
  74 static int hf_spx_seq_nr = -1;
  75 static int hf_spx_ack_nr = -1;
  76 static int hf_spx_all_nr = -1;
  77
  78 static gint ett_spx = -1;
  79
  80 static int proto_ipxrip = -1;
  81 static int hf_ipxrip_request = -1;
  82 static int hf_ipxrip_response = -1;
  83
  84 static gint ett_ipxrip = -1;
  85
  86 static int proto_sap = -1;
  87 static int hf_sap_request = -1;
  88 static int hf_sap_response = -1;
  89
  90 static gint ett_ipxsap = -1;
  91 static gint ett_ipxsap_server = -1;
  92
  93 static gint ett_ipxmsg = -1;
  94 static int proto_ipxmsg = -1;
  95 static int hf_msg_conn = -1;
  96 static int hf_msg_sigchar = -1;
  97
  98 static void
  99 dissect_spx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree);
 100
 101 static void
 102 dissect_ipxrip(const u_char *pd, int offset, frame_data *fd, proto_tree *tree);
 103
 104 static void
 105 dissect_ipxsap(const u_char *pd, int offset, frame_data *fd, proto_tree *tree);
 106
 107 static void
 108 dissect_ipxmsg(const u_char *pd, int offset, frame_data *fd, proto_tree *tree);
 109
 110 typedef void    (dissect_func_t)(const u_char *, int, frame_data *, proto_tree *);
 111
 112 struct port_info {
 113         guint16 port;
 114         dissect_func_t *func;
 115         char    *text;
 116 };
 117
 118 struct conn_info {
 119         guint8  ctrl;
 120         char    *text;
 121 };
 122
 123 struct server_info {
 124         guint16 type;
 125         char    *text;
 126 };
 127
 128 /* ================================================================= */
 129 /* IPX                                                               */
 130 /* ================================================================= */
 131
 132 /* info on these sockets can be found in this listing from Novell:
 133
 134         http://developer.novell.com/engsup/sample/tids/dsoc1b/dsoc1b.htm
 135 */
 136
 137 #define IPX_SOCKET_NCP                  0x0451
 138 #define IPX_SOCKET_SAP                  0x0452
 139 #define IPX_SOCKET_IPXRIP               0x0453
 140 #define IPX_SOCKET_NETBIOS              0x0455
 141 #define IPX_SOCKET_DIAGNOSTIC           0x0456
 142 #define IPX_SOCKET_SERIALIZATION        0x0457
 143 #define IPX_SOCKET_NWLINK_SMB_NAMEQUERY 0x0551
 144 #define IPX_SOCKET_NWLINK_SMB_DGRAM     0x0553
 145 #define IPX_SOCKET_NWLINK_SMB_BROWSE    0x0555 /* ? not sure on this
 146         but I guessed based on the content of the packet I saw */
 147 #define IPX_SOCKET_ATTACHMATE_GW        0x055d
 148 #define IPX_SOCKET_IPX_MESSAGE          0x4001
 149 #define IPX_SOCKET_ADSM                 0x8522 /* www.tivoli.com */
 150 #define IPX_SOCKET_WIDE_AREA_ROUTER     0x9001
 151 #define IPX_SOCKET_SNMP_AGENT           0x900F /* RFC 1906 */
 152 #define IPX_SOCKET_SNMP_SINK            0x9010 /* RFC 1906 */
 153 #define IPX_SOCKET_TCP_TUNNEL           0x9091 /* RFC 1791 */
 154 #define IPX_SOCKET_UDP_TUNNEL           0x9092 /* RFC 1791 */
 155
 156 static struct port_info ports[] = {
 157         { IPX_SOCKET_NCP,                       dissect_ncp,
 158                                 "NCP" },
 159         { IPX_SOCKET_SAP,                       dissect_ipxsap,
 160                                 "SAP" },
 161         { IPX_SOCKET_IPXRIP,                    dissect_ipxrip,
 162                                 "RIP" },
 163         { IPX_SOCKET_NETBIOS,                   NULL,
 164                                 "NetBIOS" },
 165         { IPX_SOCKET_DIAGNOSTIC,                NULL,
 166                                 "Diagnostic" },
 167         { IPX_SOCKET_SERIALIZATION,             NULL,
 168                                 "Serialization" },
 169         { IPX_SOCKET_NWLINK_SMB_NAMEQUERY,      NULL,
 170                                 "NWLink SMB Name Query" },
 171         { IPX_SOCKET_NWLINK_SMB_DGRAM,          dissect_nwlink_dg,
 172                 "NWLink SMB Datagram" },
 173         { IPX_SOCKET_NWLINK_SMB_BROWSE, NULL, "NWLink SMB Browse" },
 174         { IPX_SOCKET_ATTACHMATE_GW,             NULL, "Attachmate Gateway" },
 175         { IPX_SOCKET_IPX_MESSAGE, dissect_ipxmsg, "IPX Message" },
 176         { IPX_SOCKET_SNMP_AGENT, dissect_snmp, "SNMP Agent" },
 177         { IPX_SOCKET_SNMP_SINK, dissect_snmp, "SNMP Sink" },
 178
 179         { IPX_SOCKET_UDP_TUNNEL, NULL, "UDP Tunnel" },
 180         { IPX_SOCKET_TCP_TUNNEL, NULL, "TCP Tunnel" },
 181         { IPX_SOCKET_TCP_TUNNEL, NULL, "TCP Tunnel" },
 182         { IPX_SOCKET_ADSM, NULL, "ADSM" },
 183         { IPX_SOCKET_WIDE_AREA_ROUTER, NULL, "Wide Area Router" },
 184         { 0x0000,                               NULL,
 185                                 NULL }
 186 };
 187
 188 static char*
 189 port_text(guint16 port) {
 190         int i=0;
 191
 192         while (ports[i].text != NULL) {
 193                 if (ports[i].port == port) {
 194                         return ports[i].text;
 195                 }
 196                 i++;
 197         }
 198         return "Unknown";
 199 }
 200
 201 static dissect_func_t*
 202 port_func(guint16 port) {
 203         int i=0;
 204
 205         while (ports[i].text != NULL) {
 206                 if (ports[i].port == port) {
 207                         return ports[i].func;
 208                 }
 209                 i++;
 210         }
 211         return NULL;
 212 }
 213
 214 /*
 215  * From:
 216  *
 217  *      http://alr.base2co.com:457/netguide/dipxD.ipx_packet_struct.html
 218  *
 219  * which is part of SCO's "Network Programmer's Guide and Reference".
 220  *
 221  * It calls type 20 "NetBIOS name packet".  Microsoft Network Monitor
 222  * calls it "WAN Broadcast"; it's also used for SMB browser announcements,
 223  * i.e. NetBIOS (broadcast) datagrams.
 224  */
 225 #define IPX_PACKET_TYPE_IPX             0
 226 #define IPX_PACKET_TYPE_RIP             1
 227 #define IPX_PACKET_TYPE_ECHO            2
 228 #define IPX_PACKET_TYPE_ERROR           3
 229 #define IPX_PACKET_TYPE_PEP             4
 230 #define IPX_PACKET_TYPE_SPX             5
 231 #define IPX_PACKET_TYPE_NCP             17
 232 #define IPX_PACKET_TYPE_WANBCAST        20      /* propagated NetBIOS packet? */
 233
 234 static const value_string ipx_packet_type_vals[] = {
 235         { IPX_PACKET_TYPE_IPX,          "IPX" },
 236         { IPX_PACKET_TYPE_RIP,          "RIP" },
 237         { IPX_PACKET_TYPE_ECHO,         "Echo" },
 238         { IPX_PACKET_TYPE_ERROR,        "Error" },
 239         { IPX_PACKET_TYPE_PEP,          "PEP" }, /* Packet Exchange Packet */
 240         { IPX_PACKET_TYPE_SPX,          "SPX" },
 241         { 16,                           "Experimental Protocol" },
 242         { IPX_PACKET_TYPE_NCP,          "NCP" },
 243         { 18,                           "Experimental Protocol" },
 244         { 19,                           "Experimental Protocol" },
 245         { IPX_PACKET_TYPE_WANBCAST,     "NetBIOS Broadcast" },
 246         { 21,                           "Experimental Protocol" },
 247         { 22,                           "Experimental Protocol" },
 248         { 23,                           "Experimental Protocol" },
 249         { 24,                           "Experimental Protocol" },
 250         { 25,                           "Experimental Protocol" },
 251         { 26,                           "Experimental Protocol" },
 252         { 27,                           "Experimental Protocol" },
 253         { 28,                           "Experimental Protocol" },
 254         { 29,                           "Experimental Protocol" },
 255         { 30,                           "Experimental Protocol" },
 256         { 31,                           "Experimental Protocol" },
 257         { 0,                            NULL }
 258 };
 259
 260 static const value_string ipxmsg_sigchar_vals[] = {
 261         { '?', "Poll inactive station" },
 262         { 0, NULL }
 263 };
 264
 265 gchar*
 266 ipxnet_to_string(const guint8 *ad)
 267 {
 268         guint32 addr = pntohl(ad);
 269         return ipxnet_to_str_punct(addr, ' ');
 270 }
 271
 272 /* We use a different representation of hardware addresses
 273  * than ether_to_str(); we don't put punctuation between the hex
 274  * digits.
 275  */
 276
 277 gchar*
 278 ipx_addr_to_str(guint32 net, const guint8 *ad)
 279 {
 280         static gchar    str[3][8+1+MAXNAMELEN+1]; /* 8 digits, 1 period, NAME, 1 null */
 281         static gchar    *cur;
 282         char            *name;
 283
 284         if (cur == &str[0][0]) {
 285                 cur = &str[1][0];
 286         } else if (cur == &str[1][0]) {
 287                 cur = &str[2][0];
 288         } else {
 289                 cur = &str[0][0];
 290         }
 291
 292         name = get_ether_name_if_known(ad);
 293
 294         if (name) {
 295                 sprintf(cur, "%s.%s", get_ipxnet_name(net), name);
 296         }
 297         else {
 298                 sprintf(cur, "%s.%s", get_ipxnet_name(net), ether_to_str_punct(ad, '\0'));
 299         }
 300         return cur;
 301 }
 302
 303 gchar *
 304 ipxnet_to_str_punct(const guint32 ad, char punct) {
 305   static gchar  str[3][12];
 306   static gchar *cur;
 307   gchar        *p;
 308   int          i;
 309   guint32      octet;
 310   static const gchar hex_digits[16] = "0123456789ABCDEF";
 311   static const guint32  octet_mask[4] =
 312           { 0xff000000 , 0x00ff0000, 0x0000ff00, 0x000000ff };
 313
 314   if (cur == &str[0][0]) {
 315     cur = &str[1][0];
 316   } else if (cur == &str[1][0]) {
 317     cur = &str[2][0];
 318   } else {
 319     cur = &str[0][0];
 320   }
 321   p = &cur[12];
 322   *--p = '\0';
 323   i = 3;
 324   for (;;) {
 325     octet = (ad & octet_mask[i]) >> ((3 - i) * 8);
 326     *--p = hex_digits[octet&0xF];
 327     octet >>= 4;
 328     *--p = hex_digits[octet&0xF];
 329     if (i == 0)
 330       break;
 331     if (punct)
 332       *--p = punct;
 333     i--;
 334   }
 335   return p;
 336 }
 337
 338 void
 339 capture_ipx(const u_char *pd, int offset, guint32 cap_len, packet_counts *ld)
 340 {
 341         ld->ipx++;
 342 }
 343
 344 void
 345 dissect_ipx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 346
 347         proto_tree      *ipx_tree;
 348         proto_item      *ti;
 349         guint8          ipx_type, ipx_hops;
 350         guint16         ipx_checksum, ipx_length;
 351         int             len;
 352         guint8          *ipx_snode, *ipx_dnode, *ipx_snet, *ipx_dnet;
 353
 354         guint16         ipx_dsocket, ipx_ssocket;
 355         dissect_func_t  *dissect;
 356         guint32         ipx_dnet_val, ipx_snet_val;
 357
 358         /* Calculate here for use in pinfo and in tree */
 359         ipx_dnet = (guint8*)&pd[offset+6];
 360         ipx_snet = (guint8*)&pd[offset+18];
 361         ipx_dnet_val = pntohl(ipx_dnet);
 362         ipx_snet_val = pntohl(ipx_snet);
 363         ipx_dsocket = pntohs(&pd[offset+16]);
 364         ipx_ssocket = pntohs(&pd[offset+28]);
 365         ipx_dnode = (guint8*)&pd[offset+10];
 366         ipx_snode = (guint8*)&pd[offset+22];
 367         ipx_type = pd[offset+5];
 368         ipx_length = pntohs(&pd[offset+2]);
 369
 370         /* Length of IPX datagram plus headers above it. */
 371         len = ipx_length + offset;
 372
 373         /* Set the payload and captured-payload lengths to the minima of
 374            (the IPX length plus the length of the headers above it) and
 375            the frame lengths. */
 376         if (pi.len > len)
 377                 pi.len = len;
 378         if (pi.captured_len > len)
 379                 pi.captured_len = len;
 380
 381         SET_ADDRESS(&pi.net_src, AT_IPX, 10, &pd[offset+18]);
 382         SET_ADDRESS(&pi.src, AT_IPX, 10, &pd[offset+18]);
 383         SET_ADDRESS(&pi.net_dst, AT_IPX, 10, &pd[offset+6]);
 384         SET_ADDRESS(&pi.dst, AT_IPX, 10, &pd[offset+6]);
 385
 386         if (check_col(fd, COL_PROTOCOL))
 387                 col_add_str(fd, COL_PROTOCOL, "IPX");
 388         if (check_col(fd, COL_INFO))
 389                 col_add_fstr(fd, COL_INFO, "%s (0x%04X)", port_text(ipx_dsocket),
 390                                 ipx_dsocket);
 391
 392         if (tree) {
 393                 ipx_checksum = pntohs(&pd[offset]);
 394                 ipx_hops = pd[offset+4];
 395
 396                 ti = proto_tree_add_item(tree, proto_ipx, offset, 30, NULL);
 397                 ipx_tree = proto_item_add_subtree(ti, ett_ipx);
 398                 proto_tree_add_item(ipx_tree, hf_ipx_checksum, offset, 2, ipx_checksum);
 399                 proto_tree_add_item_format(ipx_tree, hf_ipx_len, offset+2, 2, ipx_length,
 400                         "Length: %d bytes", ipx_length);
 401                 proto_tree_add_item_format(ipx_tree, hf_ipx_hops, offset+4, 1, ipx_hops,
 402                         "Transport Control: %d hops", ipx_hops);
 403                 proto_tree_add_item(ipx_tree, hf_ipx_packet_type, offset+5, 1, ipx_type);
 404                 proto_tree_add_item(ipx_tree, hf_ipx_dnet, offset+6, 4, ipx_dnet_val);
 405                 proto_tree_add_item(ipx_tree, hf_ipx_dnode, offset+10, 6, ipx_dnode);
 406                 proto_tree_add_item_format(ipx_tree, hf_ipx_dsocket, offset+16, 2,
 407                         ipx_dsocket, "Destination Socket: %s (0x%04X)",
 408                         port_text(ipx_dsocket), ipx_dsocket);
 409                 proto_tree_add_item(ipx_tree, hf_ipx_snet, offset+18, 4, ipx_snet_val);
 410                 proto_tree_add_item(ipx_tree, hf_ipx_snode, offset+22, 6, ipx_snode);
 411                 proto_tree_add_item_format(ipx_tree, hf_ipx_ssocket, offset+28, 2,
 412                         ipx_ssocket, "Source Socket: %s (0x%04X)", port_text(ipx_ssocket),
 413                         ipx_ssocket);
 414         }
 415         offset += 30;
 416
 417         switch (ipx_type) {
 418                 case IPX_PACKET_TYPE_SPX:
 419                         dissect_spx(pd, offset, fd, tree);
 420                         break;
 421
 422                 case IPX_PACKET_TYPE_NCP:
 423                         /* Is the destination node 00:00:00:00:00:01 ? */
 424                         if (pntohl(ipx_dnode) == 0 && pntohs(ipx_dnode + 4) == 1)
 425                                 nw_server_address = pntohl(ipx_dnet);
 426
 427                         /* Is the source node 00:00:00:00:00:01 ? */
 428                         else if (pntohl(ipx_snode) == 0 && pntohs(ipx_snode + 4) == 1)
 429                                 nw_server_address = pntohl(ipx_snet);
 430                         else
 431                                 nw_server_address = 0;
 432
 433                         dissect_ncp(pd, offset, fd, tree);
 434                         break;
 435
 436                 case IPX_PACKET_TYPE_WANBCAST:
 437                 case IPX_PACKET_TYPE_PEP:
 438                         if (ipx_dsocket == IPX_SOCKET_NETBIOS) {
 439                                 dissect_nbipx(pd, offset, fd, tree);
 440                                 break;
 441                         }
 442                         /* else fall through */
 443
 444                 case 0: /* IPX, fall through to default */
 445                         /* XXX - should type 0's be dissected as NBIPX
 446                            if they're aimed at the NetBIOS socket? */
 447                 default:
 448                         dissect = port_func(ipx_dsocket);
 449                         if (dissect) {
 450                                 dissect(pd, offset, fd, tree);
 451                         }
 452                         else {
 453                                 dissect = port_func(ipx_ssocket);
 454                                 if (dissect) {
 455                                         dissect(pd, offset, fd, tree);
 456                                 }
 457                                 else {
 458                                         dissect_data(pd, offset, fd, tree);
 459                                 }
 460                         }
 461                         break;
 462         }
 463 }
 464
 465
 466 /* ================================================================= */
 467 /* SPX                                                               */
 468 /* ================================================================= */
 469 static char*
 470 spx_conn_ctrl(u_char ctrl)
 471 {
 472         int i=0;
 473
 474         static struct conn_info conns[] = {
 475                 { 0x10, "End-of-Message" },
 476                 { 0x20, "Attention" },
 477                 { 0x40, "Acknowledgment Required"},
 478                 { 0x80, "System Packet"},
 479                 { 0x00, NULL }
 480         };
 481
 482         while (conns[i].text != NULL) {
 483                 if (conns[i].ctrl == ctrl) {
 484                         return conns[i].text;
 485                 }
 486                 i++;
 487         }
 488         return "Unknown";
 489 }
 490
 491 static char*
 492 spx_datastream(u_char type)
 493 {
 494         switch (type) {
 495                 case 0xfe:
 496                         return "End-of-Connection";
 497                 case 0xff:
 498                         return "End-of-Connection Acknowledgment";
 499                 default:
 500                         return "Client-Defined";
 501         }
 502 }
 503
 504 static void
 505 dissect_spx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 506         proto_tree      *spx_tree;
 507         proto_item      *ti;
 508
 509         if (check_col(fd, COL_PROTOCOL))
 510                 col_add_str(fd, COL_PROTOCOL, "SPX");
 511         if (check_col(fd, COL_INFO))
 512                 col_add_str(fd, COL_INFO, "SPX");
 513
 514         if (tree) {
 515                 ti = proto_tree_add_item(tree, proto_spx, offset, 12, NULL);
 516                 spx_tree = proto_item_add_subtree(ti, ett_spx);
 517
 518                 proto_tree_add_item_format(spx_tree, hf_spx_connection_control,
 519                                            offset,      1,
 520                                            pd[offset],
 521                                            "Connection Control: %s (0x%02X)",
 522                                            spx_conn_ctrl(pd[offset]),
 523                                            pd[offset]);
 524
 525                 proto_tree_add_item_format(spx_tree, hf_spx_datastream_type,
 526                                            offset+1,     1,
 527                                            pd[offset+1],
 528                                            "Datastream Type: %s (0x%02X)",
 529                                            spx_datastream(pd[offset+1]),
 530                                            pd[offset+1]);
 531
 532                 proto_tree_add_item(spx_tree, hf_spx_src_id,
 533                                     offset+2,     2,
 534                                     pntohs( &pd[offset+2] ));
 535
 536                 proto_tree_add_item(spx_tree, hf_spx_dst_id,
 537                                     offset+4,     2,
 538                                     pntohs( &pd[offset+4] ));
 539
 540                 proto_tree_add_item(spx_tree, hf_spx_seq_nr,
 541                                     offset+6,     2,
 542                                     pntohs( &pd[offset+6] ) );
 543
 544                 proto_tree_add_item(spx_tree, hf_spx_ack_nr,
 545                                     offset+8,     2,
 546                                     pntohs( &pd[offset+8] ) );
 547
 548                 proto_tree_add_item(spx_tree, hf_spx_all_nr,
 549                                     offset+10,     2,
 550                                     pntohs( &pd[offset+10] ) );
 551
 552                 offset += 12;
 553                 dissect_data(pd, offset, fd, tree);
 554         }
 555 }
 556
 557 /* ================================================================= */
 558 /* IPX Message                                                           */
 559 /* ================================================================= */
 560 static void
 561 dissect_ipxmsg(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 562         proto_tree      *msg_tree;
 563         proto_item      *ti;
 564         u_char conn_number, sig_char;
 565
 566         if ( ! BYTES_ARE_IN_FRAME(offset,2) )
 567         {
 568                 return;
 569         }
 570
 571         conn_number = pd[offset];
 572         sig_char = pd[offset+1];
 573
 574         if (check_col(fd, COL_PROTOCOL))
 575          col_add_str(fd, COL_PROTOCOL, "IPX MSG");
 576         if (check_col(fd, COL_PROTOCOL)) {
 577                 col_add_fstr(fd, COL_INFO,
 578                         "%s, Connection %d",
 579                         val_to_str(sig_char, ipxmsg_sigchar_vals, "Unknown Signature Char"), conn_number);
 580         }
 581
 582         if (tree) {
 583                 ti = proto_tree_add_item(tree, proto_ipxmsg, offset, END_OF_FRAME, NULL);
 584                 msg_tree = proto_item_add_subtree(ti, ett_ipxmsg);
 585
 586                 proto_tree_add_item(msg_tree, hf_msg_conn, offset, 1, conn_number);
 587                 proto_tree_add_item(msg_tree, hf_msg_sigchar, offset+1, 1, sig_char);
 588         }
 589 }
 590
 591
 592 /* ================================================================= */
 593 /* IPX RIP                                                           */
 594 /* ================================================================= */
 595 static void
 596 dissect_ipxrip(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 597         proto_tree      *rip_tree;
 598         proto_item      *ti;
 599         guint16         operation;
 600         struct ipx_rt_def route;
 601         int             cursor;
 602
 603         char            *rip_type[2] = { "Request", "Response" };
 604
 605         operation = pntohs(&pd[offset]) - 1;
 606
 607         if (check_col(fd, COL_PROTOCOL))
 608          col_add_str(fd, COL_PROTOCOL, "IPX RIP");
 609         if (check_col(fd, COL_PROTOCOL)) {
 610          if (operation < 2) {
 611                  col_add_str(fd, COL_INFO, rip_type[operation]);
 612          }
 613          else {
 614                  col_add_str(fd, COL_INFO, "Unknown Packet Type");
 615          }
 616         }
 617
 618         if (tree) {
 619                 ti = proto_tree_add_item(tree, proto_ipxrip, offset, END_OF_FRAME, NULL);
 620                 rip_tree = proto_item_add_subtree(ti, ett_ipxrip);
 621
 622                 if (operation < 2) {
 623                         proto_tree_add_text(rip_tree, offset, 2,
 624                         "RIP packet type: %s", rip_type[operation]);
 625
 626                         if (operation == 0) {
 627                           proto_tree_add_item_hidden(rip_tree,
 628                                                      hf_ipxrip_request,
 629                                                      offset, 2, 1);
 630                         } else {
 631                           proto_tree_add_item_hidden(rip_tree,
 632                                                      hf_ipxrip_response,
 633                                                      offset, 2, 1);
 634                         }
 635
 636                 }
 637                 else {
 638                         proto_tree_add_text(rip_tree, offset, 2, "Unknown RIP packet type");
 639                 }
 640
 641                 for (cursor = offset + 2; cursor < fd->cap_len; cursor += 8) {
 642                         memcpy(&route.network, &pd[cursor], 4);
 643                         route.hops = pntohs(&pd[cursor+4]);
 644                         route.ticks = pntohs(&pd[cursor+6]);
 645
 646                         if (operation == IPX_RIP_REQUEST - 1) {
 647                                 proto_tree_add_text(rip_tree, cursor,      8,
 648                                         "Route Vector: %s, %d hop%s, %d tick%s",
 649                                         ipxnet_to_string((guint8*)&route.network),
 650                                         route.hops,  route.hops  == 1 ? "" : "s",
 651                                         route.ticks, route.ticks == 1 ? "" : "s");
 652                         }
 653                         else {
 654                                 proto_tree_add_text(rip_tree, cursor,      8,
 655                                         "Route Vector: %s, %d hop%s, %d tick%s (%d ms)",
 656                                         ipxnet_to_string((guint8*)&route.network),
 657                                         route.hops,  route.hops  == 1 ? "" : "s",
 658                                         route.ticks, route.ticks == 1 ? "" : "s",
 659                                         route.ticks * 1000 / 18);
 660                         }
 661                 }
 662         }
 663 }
 664
 665
 666
 667 /* ================================================================= */
 668 /* SAP                                                                                                                           */
 669 /* ================================================================= */
 670 static char*
 671 server_type(guint16 type)
 672 {
 673         int i=0;
 674
 675         /* some of these are from ncpfs, others are from the book */
 676         static struct server_info       servers[] = {
 677                 { 0x0001,       "User" },
 678                 { 0x0002,       "User Group" },
 679                 { 0x0003,       "Print Queue" },
 680                 { 0x0004,       "File server" },
 681                 { 0x0005,       "Job server" },
 682                 { 0x0007,       "Print server" },
 683                 { 0x0008,       "Archive server" },
 684                 { 0x0009,       "Archive server" },
 685                 { 0x000a,       "Job queue" },
 686                 { 0x000b,       "Administration" },
 687                 { 0x0021,       "NAS SNA gateway" },
 688                 { 0x0024,       "Remote bridge" },
 689                 { 0x0026,       "Bridge server" },
 690                 { 0x0027,       "TCP/IP gateway" },
 691                 { 0x002d,       "Time Synchronization VAP" },
 692                 { 0x002e,       "Archive Server Dynamic SAP" },
 693                 { 0x0047,       "Advertising print server" },
 694                 { 0x004b,       "Btrieve VAP 5.0" },
 695                 { 0x004c,       "SQL VAP" },
 696                 { 0x0050,       "Btrieve VAP" },
 697                 { 0x0053,       "Print Queue VAP" },
 698                 { 0x007a,       "TES NetWare for VMS" },
 699                 { 0x0098,       "NetWare access server" },
 700                 { 0x009a,       "Named Pipes server" },
 701                 { 0x009e,       "Portable NetWare Unix" },
 702                 { 0x0107,       "NetWare 386" },
 703                 { 0x0111,       "Test server" },
 704                 { 0x0133,       "NetWare Name Service" },
 705                 { 0x0166,       "NetWare management" },
 706                 { 0x023f,       "SMS Testing and Development" },
 707                 { 0x026a,       "NetWare management" },
 708                 { 0x026b,       "Time synchronization" },
 709                 { 0x027b,       "NetWare Management Agent" },
 710                 { 0x0278,       "NetWare Directory server" },
 711                 { 0x030c,       "HP LaserJet / Quick Silver" },
 712                 { 0x0355,       "Arcada Software" },
 713                 { 0x0361,       "NETINELO" },
 714                 { 0x037e,       "Powerchute UPS Monitoring" },
 715                 { 0x03e1,       "UnixWare Application Server" },
 716                 { 0x044c,       "Archive" },
 717                 { 0x055d,       "Attachmate SNA gateway" },
 718                 { 0x0610,       "Adaptec SCSI Management" },
 719                 { 0x0640,       "NT Server-RPC/GW for NW/Win95 User Level Sec" },
 720                 { 0x064e,       "NT Server-IIS" },
 721                 { 0x0810,       "ELAN License Server Demo" },
 722                 { 0x8002,       "Intel NetPort Print Server" },
 723
 724 /* For any unidentified ones, I found a really big list of them at: */
 725 /*    http://www.inpnet.org/cnpweb/saplist.txt */
 726 /*    http://www.isi.edu/in-notes/iana/assignments/novell-sap-numbers */
 727
 728                 { 0x0000,       NULL }
 729         };
 730
 731         while (servers[i].text != NULL) {
 732                 if (servers[i].type == type) {
 733                         return servers[i].text;
 734                 }
 735                 i++;
 736         }
 737         return "Unknown";
 738 }
 739
 740 static void
 741 dissect_ipxsap(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 742
 743         proto_tree      *sap_tree, *s_tree;
 744         proto_item      *ti;
 745         int             cursor;
 746         struct sap_query query;
 747         struct sap_server_ident server;
 748
 749         char            *sap_type[4] = { "General Query", "General Response",
 750                 "Nearest Query", "Nearest Response" };
 751
 752         query.query_type = pntohs(&pd[offset]);
 753         query.server_type = pntohs(&pd[offset+2]);
 754
 755         if (check_col(fd, COL_PROTOCOL))
 756                 col_add_str(fd, COL_PROTOCOL, "SAP");
 757         if (check_col(fd, COL_INFO)) {
 758                 if (query.query_type >= 1 && query.query_type <= 4) {
 759                         col_add_str(fd, COL_INFO, sap_type[query.query_type - 1]);
 760                 }
 761                 else {
 762                         col_add_str(fd, COL_INFO, "Unknown Packet Type");
 763                 }
 764         }
 765
 766         if (tree) {
 767                 ti = proto_tree_add_item(tree, proto_sap, offset, END_OF_FRAME, NULL);
 768                 sap_tree = proto_item_add_subtree(ti, ett_ipxsap);
 769
 770                 if (query.query_type >= 1 && query.query_type <= 4) {
 771                         proto_tree_add_text(sap_tree, offset, 2, sap_type[query.query_type - 1]);
 772                         if ((query.query_type - 1) % 2) {
 773                           proto_tree_add_item_hidden(sap_tree,
 774                                                      hf_sap_response,
 775                                                      offset, 2, 1);
 776                         } else {
 777                           proto_tree_add_item_hidden(sap_tree,
 778                                                      hf_sap_request,
 779                                                      offset, 2, 1);
 780                         }
 781                 }
 782                 else {
 783                         proto_tree_add_text(sap_tree, offset, 2,
 784                                         "Unknown SAP Packet Type %d", query.query_type);
 785                 }
 786
 787                 if (query.query_type == IPX_SAP_GENERAL_RESPONSE ||
 788                                 query.query_type == IPX_SAP_NEAREST_RESPONSE) { /* responses */
 789
 790                         for (cursor = offset + 2; (cursor + 64) <= fd->cap_len; cursor += 64) {
 791                                 server.server_type = pntohs(&pd[cursor]);
 792                                 memcpy(server.server_name, &pd[cursor+2], 48);
 793                                 memcpy(&server.server_network, &pd[cursor+50], 4);
 794                                 memcpy(&server.server_node, &pd[cursor+54], 6);
 795                                 server.server_port = pntohs(&pd[cursor+60]);
 796                                 server.intermediate_network = pntohs(&pd[cursor+62]);
 797
 798                                 ti = proto_tree_add_text(sap_tree, cursor+2, 48,
 799                                         "Server Name: %s", server.server_name);
 800                                 s_tree = proto_item_add_subtree(ti, ett_ipxsap_server);
 801
 802                                 proto_tree_add_text(s_tree, cursor, 2, "Server Type: %s (0x%04X)",
 803                                                 server_type(server.server_type), server.server_type);
 804                                 proto_tree_add_text(s_tree, cursor+50, 4, "Network: %s",
 805                                                 ipxnet_to_string((guint8*)&pd[cursor+50]));
 806                                 proto_tree_add_text(s_tree, cursor+54, 6, "Node: %s",
 807                                                 ether_to_str((guint8*)&pd[cursor+54]));
 808                                 proto_tree_add_text(s_tree, cursor+60, 2, "Socket: %s (0x%04X)",
 809                                                 port_text(server.server_port), server.server_port);
 810                                 proto_tree_add_text(s_tree, cursor+62, 2,
 811                                                 "Intermediate Networks: %d",
 812                                                 server.intermediate_network);
 813                         }
 814                 }
 815                 else {  /* queries */
 816                         proto_tree_add_text(sap_tree, offset+2, 2, "Server Type: %s (0x%04X)",
 817                                         server_type(query.server_type), query.server_type);
 818                 }
 819         }
 820 }
 821
 822
 823 void
 824 proto_register_ipx(void)
 825 {
 826         static hf_register_info hf_ipx[] = {
 827                 { &hf_ipx_checksum,
 828                 { "Checksum",           "ipx.checksum", FT_UINT16, BASE_HEX, NULL, 0x0,
 829                         "" }},
 830
 831                 { &hf_ipx_len,
 832                 { "Length",             "ipx.len", FT_UINT16, BASE_DEC, NULL, 0x0,
 833                         "" }},
 834
 835                 { &hf_ipx_hops,
 836                 { "Transport Control (Hops)", "ipx.hops", FT_UINT8, BASE_DEC, NULL, 0x0,
 837                         "" }},
 838
 839                 { &hf_ipx_packet_type,
 840                 { "Packet Type",        "ipx.packet_type", FT_UINT8, BASE_HEX, VALS(ipx_packet_type_vals),
 841                         0x0,
 842                         "" }},
 843
 844                 { &hf_ipx_dnet,
 845                 { "Destination Network","ipx.dst.net", FT_IPXNET, BASE_NONE, NULL, 0x0,
 846                         "" }},
 847
 848                 { &hf_ipx_dnode,
 849                 { "Destination Node",   "ipx.dst.node", FT_ETHER, BASE_NONE, NULL, 0x0,
 850                         "" }},
 851
 852                 { &hf_ipx_dsocket,
 853                 { "Destination Socket", "ipx.dst.socket", FT_UINT16, BASE_HEX, NULL, 0x0,
 854                         "" }},
 855
 856                 { &hf_ipx_snet,
 857                 { "Source Network","ipx.src.net", FT_IPXNET, BASE_NONE, NULL, 0x0,
 858                         "" }},
 859
 860                 { &hf_ipx_snode,
 861                 { "Source Node",        "ipx.src.node", FT_ETHER, BASE_NONE, NULL, 0x0,
 862                         "" }},
 863
 864                 { &hf_ipx_ssocket,
 865                 { "Source Socket",      "ipx.src.socket", FT_UINT16, BASE_HEX, NULL, 0x0,
 866                         "" }},
 867         };
 868
 869         static hf_register_info hf_spx[] = {
 870                 { &hf_spx_connection_control,
 871                 { "Connection Control",         "spx.ctl",
 872                   FT_UINT8,     BASE_HEX,       NULL,   0x0,
 873                   "" }},
 874
 875                 { &hf_spx_datastream_type,
 876                 { "Datastream type",            "spx.type",
 877                   FT_UINT8,     BASE_HEX,       NULL,   0x0,
 878                   "" }},
 879
 880                 { &hf_spx_src_id,
 881                 { "Source Connection ID",       "spx.src",
 882                   FT_UINT16,    BASE_DEC,       NULL,   0x0,
 883                   "" }},
 884
 885                 { &hf_spx_dst_id,
 886                 { "Destination Connection ID",  "spx.dst",
 887                   FT_UINT16,    BASE_DEC,       NULL,   0x0,
 888                   "" }},
 889
 890                 { &hf_spx_seq_nr,
 891                 { "Sequence Number",            "spx.seq",
 892                   FT_UINT16,    BASE_DEC,       NULL,   0x0,
 893                   "" }},
 894
 895                 { &hf_spx_ack_nr,
 896                 { "Acknowledgment Number",      "spx.ack",
 897                   FT_UINT16,    BASE_DEC,       NULL,   0x0,
 898                   "" }},
 899
 900                 { &hf_spx_all_nr,
 901                 { "Allocation Number",          "spx.alloc",
 902                   FT_UINT16,    BASE_DEC,       NULL,   0x0,
 903                   "" }}
 904         };
 905
 906         static hf_register_info hf_ipxrip[] = {
 907                 { &hf_ipxrip_request,
 908                 { "Request",                    "ipxrip.request",
 909                   FT_BOOLEAN,   BASE_NONE,      NULL,   0x0,
 910                   "TRUE if IPX RIP request" }},
 911
 912                 { &hf_ipxrip_response,
 913                 { "Response",                   "ipxrip.response",
 914                   FT_BOOLEAN,   BASE_NONE,      NULL,   0x0,
 915                   "TRUE if IPX RIP response" }}
 916         };
 917
 918         static hf_register_info hf_sap[] = {
 919                 { &hf_sap_request,
 920                 { "Request",                    "sap.request",
 921                   FT_BOOLEAN,   BASE_NONE,      NULL,   0x0,
 922                   "TRUE if SAP request" }},
 923
 924                 { &hf_sap_response,
 925                 { "Response",                   "sap.response",
 926                   FT_BOOLEAN,   BASE_NONE,      NULL,   0x0,
 927                   "TRUE if SAP response" }}
 928         };
 929
 930         static hf_register_info hf_ipxmsg[] = {
 931                 { &hf_msg_conn,
 932                 { "Connection Number",                  "ipxmsg.conn",
 933                   FT_UINT8,     BASE_NONE,      NULL,   0x0,
 934                   "Connection Number" }},
 935
 936                 { &hf_msg_sigchar,
 937                 { "Signature Char",                     "ipxmsg.sigchar",
 938                   FT_UINT8,     BASE_NONE,      VALS(ipxmsg_sigchar_vals),      0x0,
 939                   "Signature Char" }}
 940         };
 941
 942         static gint *ett[] = {
 943                 &ett_ipx,
 944                 &ett_spx,
 945                 &ett_ipxmsg,
 946                 &ett_ipxrip,
 947                 &ett_ipxsap,
 948                 &ett_ipxsap_server,
 949         };
 950
 951         proto_ipx = proto_register_protocol ("Internetwork Packet eXchange", "ipx");
 952         proto_register_field_array(proto_ipx, hf_ipx, array_length(hf_ipx));
 953
 954         proto_spx = proto_register_protocol ("Sequenced Packet eXchange", "spx");
 955         proto_register_field_array(proto_spx, hf_spx, array_length(hf_spx));
 956
 957         proto_ipxrip = proto_register_protocol ("IPX Routing Information Protocol", "ipxrip");
 958         proto_register_field_array(proto_ipxrip, hf_ipxrip, array_length(hf_ipxrip));
 959
 960         proto_ipxmsg = proto_register_protocol ("IPX Message", "ipxmsg");
 961         proto_register_field_array(proto_ipxmsg, hf_ipxmsg, array_length(hf_ipxmsg));
 962
 963         proto_sap = proto_register_protocol ("Service Advertisement Protocol", "sap");
 964         proto_register_field_array(proto_sap, hf_sap, array_length(hf_sap));
 965
 966         proto_register_subtree_array(ett, array_length(ett));
 967 }