2 * Routines for ldap packet dissection
4 * $Id: packet-ldap.c,v 1.17 2000/11/19 08:53:59 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
26 * This is not a complete implementation. It doesn't handle the full version 3, more specifically,
27 * it handles only the commands of version 2, but any additional characteristics of the ver3 command are supported.
28 * It's also missing extensible search filters.
30 * There should probably be alot more error checking, I simply assume that if we have a full packet, it will be a complete
33 * AFAIK, it will handle all messages used by the OpenLDAP 1.2.9 server and libraries which was my goal. I do plan to add
34 * the remaining commands as time permits but this is not a priority to me. Send me an email if you need it and I'll see what
38 * nazard@dragoninc.on.ca
47 #ifdef HAVE_SYS_TYPES_H
48 # include <sys/types.h>
51 #ifdef HAVE_NETINET_IN_H
52 # include <netinet/in.h>
58 #ifdef NEED_SNPRINTF_H
59 # include "snprintf.h"
64 #include "packet-ldap.h"
67 static int proto_ldap = -1;
68 static int hf_ldap_length = -1;
69 static int hf_ldap_message_id = -1;
70 static int hf_ldap_message_type = -1;
71 static int hf_ldap_message_length = -1;
73 static int hf_ldap_message_result = -1;
74 static int hf_ldap_message_result_matcheddn = -1;
75 static int hf_ldap_message_result_errormsg = -1;
76 static int hf_ldap_message_result_referral = -1;
78 static int hf_ldap_message_bind_version = -1;
79 static int hf_ldap_message_bind_dn = -1;
80 static int hf_ldap_message_bind_auth = -1;
81 static int hf_ldap_message_bind_auth_password = -1;
83 static int hf_ldap_message_search_base = -1;
84 static int hf_ldap_message_search_scope = -1;
85 static int hf_ldap_message_search_deref = -1;
86 static int hf_ldap_message_search_sizeLimit = -1;
87 static int hf_ldap_message_search_timeLimit = -1;
88 static int hf_ldap_message_search_typesOnly = -1;
89 static int hf_ldap_message_search_filter = -1;
91 static int hf_ldap_message_dn = -1;
92 static int hf_ldap_message_attribute = -1;
93 static int hf_ldap_message_value = -1;
95 static int hf_ldap_message_modrdn_name = -1;
96 static int hf_ldap_message_modrdn_delete = -1;
97 static int hf_ldap_message_modrdn_superior = -1;
99 static int hf_ldap_message_compare = -1;
101 static int hf_ldap_message_modify_add = -1;
102 static int hf_ldap_message_modify_replace = -1;
103 static int hf_ldap_message_modify_delete = -1;
105 static int hf_ldap_message_abandon_msgid = -1;
107 static gint ett_ldap = -1;
108 static gint ett_ldap_message = -1;
109 static gint ett_ldap_referrals = -1;
110 static gint ett_ldap_attribute = -1;
112 #define TCP_PORT_LDAP 389
114 static value_string msgTypes [] = {
115 {LDAP_REQ_BIND, "Bind Request"},
116 {LDAP_REQ_UNBIND, "Unbind Request"},
117 {LDAP_REQ_SEARCH, "Search Request"},
118 {LDAP_REQ_MODIFY, "Modify Request"},
119 {LDAP_REQ_ADD, "Add Request"},
120 {LDAP_REQ_DELETE, "Delete Request"},
121 {LDAP_REQ_MODRDN, "Modify RDN Request"},
122 {LDAP_REQ_COMPARE, "Compare Request"},
123 {LDAP_REQ_ABANDON, "Abandon Request"},
124 {LDAP_REQ_EXTENDED, "Extended Request"},
126 {LDAP_RES_BIND, "Bind Result"},
127 {LDAP_RES_SEARCH_ENTRY, "Search Entry"},
128 {LDAP_RES_SEARCH_RESULT, "Search Result"},
129 {LDAP_RES_SEARCH_REF, "Search Result Reference"},
130 {LDAP_RES_MODIFY, "Modify Result"},
131 {LDAP_RES_ADD, "Add Result"},
132 {LDAP_RES_DELETE, "Delete Result"},
133 {LDAP_RES_MODRDN, "Modify RDN Result"},
134 {LDAP_RES_COMPARE, "Compare Result"},
135 {LDAP_REQ_EXTENDED, "Extended Response"},
138 static int read_length(ASN1_SCK *a, proto_tree *tree, int hf_id, guint *len)
141 gboolean def = FALSE;
142 const guchar *start = a->pointer;
144 asn1_length_decode(a, &def, &length);
150 proto_tree_add_uint(tree, hf_id, NullTVB, start-a->begin, a->pointer-start, length);
155 static int read_sequence(ASN1_SCK *a, guint *len)
161 if (asn1_header_decode(a, &cls, &con, &tag, &def, &length) != ASN1_ERR_NOERROR)
163 if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SEQ)
172 static int read_set(ASN1_SCK *a, guint *len)
178 if (asn1_header_decode(a, &cls, &con, &tag, &def, &length) != ASN1_ERR_NOERROR)
180 if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SET)
189 static int read_integer_value(ASN1_SCK *a, proto_tree *tree, int hf_id,
190 proto_tree **new_tree, guint *i, const guchar *start, guint length)
194 asn1_uint32_value_decode(a, length, &integer);
201 proto_tree *temp_tree = 0;
202 temp_tree = proto_tree_add_uint(tree, hf_id, NullTVB, start-a->begin, a->pointer-start, integer);
204 *new_tree = temp_tree;
210 static int read_integer(ASN1_SCK *a, proto_tree *tree, int hf_id,
211 proto_tree **new_tree, guint *i, guint expected_tag)
216 const guchar *start = a->pointer;
218 if (asn1_header_decode(a, &cls, &con, &tag, &def, &length) != ASN1_ERR_NOERROR)
220 if (cls != ASN1_UNI || con != ASN1_PRI || tag != expected_tag)
223 return read_integer_value(a, tree, hf_id, new_tree, i, start, length);
226 static int read_boolean_value(ASN1_SCK *a, proto_tree *tree, int hf_id,
227 proto_tree **new_tree, guint *i, const guchar *start, guint length)
231 asn1_uint32_value_decode(a, length, &integer);
238 proto_tree *temp_tree = 0;
239 temp_tree = proto_tree_add_boolean(tree, hf_id, NullTVB, start-a->begin, a->pointer-start, integer);
241 *new_tree = temp_tree;
247 static int read_boolean(ASN1_SCK *a, proto_tree *tree, int hf_id,
248 proto_tree **new_tree, guint *i)
253 const guchar *start = a->pointer;
255 if (asn1_header_decode(a, &cls, &con, &tag, &def, &length) != ASN1_ERR_NOERROR)
257 if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_BOL)
260 return read_boolean_value(a, tree, hf_id, new_tree, i, start, length);
263 static void read_string_value(ASN1_SCK *a, proto_tree *tree, int hf_id,
264 proto_tree **new_tree, char **s, const guchar *start, guint length)
270 asn1_octet_string_value_decode(a, length, &string);
271 string = g_realloc(string, length + 1);
272 string[length] = '\0';
279 proto_tree *temp_tree;
280 temp_tree = proto_tree_add_string(tree, hf_id, NullTVB, start - a->begin, a->pointer - start, string);
282 *new_tree = temp_tree;
291 static int read_string(ASN1_SCK *a, proto_tree *tree, int hf_id,
292 proto_tree **new_tree, char **s, guint expected_cls, guint expected_tag)
297 const guchar *start = a->pointer;
300 ret = asn1_header_decode(a, &cls, &con, &tag, &def, &length);
301 if (ret != ASN1_ERR_NOERROR)
303 if (cls != expected_cls || con != ASN1_PRI || tag != expected_tag)
304 return ASN1_ERR_WRONG_TYPE;
306 read_string_value(a, tree, hf_id, new_tree, s, start, length);
307 return ASN1_ERR_NOERROR;
310 static int parse_filter_strings(ASN1_SCK *a, char **filter, guint *filter_length, const guchar *operation)
315 guint string2_length;
320 ret = asn1_octet_string_decode(a, &string, &string_length, &string_bytes);
321 if (ret != ASN1_ERR_NOERROR)
323 ret = asn1_octet_string_decode(a, &string2, &string2_length, &string_bytes);
324 if (ret != ASN1_ERR_NOERROR)
326 *filter_length += 2 + strlen(operation) + string_length + string2_length;
327 *filter = g_realloc(*filter, *filter_length);
328 filterp = *filter + strlen(*filter);
330 if (string_length != 0) {
331 memcpy(filterp, string, string_length);
332 filterp += string_length;
334 strcpy(filterp, operation);
335 filterp += strlen(operation);
336 if (string2_length != 0) {
337 memcpy(filterp, string2, string2_length);
338 filterp += string2_length;
344 return ASN1_ERR_NOERROR;
347 /* Richard Dawe: To parse substring filters, I added this function. */
348 static int parse_filter_substrings(ASN1_SCK *a, char **filter, guint *filter_length)
359 /* For ASN.1 parsing of octet strings */
365 ret = asn1_octet_string_decode(a, &string, &string_length, &string_bytes);
366 if (ret != ASN1_ERR_NOERROR)
369 ret = asn1_sequence_decode(a, &seq_len, &header_bytes);
370 if (ret != ASN1_ERR_NOERROR)
373 *filter_length += 2 + 1 + string_length;
374 *filter = g_realloc(*filter, *filter_length);
376 filterp = *filter + strlen(*filter);
378 if (string_length != 0) {
379 memcpy(filterp, string, string_length);
380 filterp += string_length;
386 /* Now decode seq_len's worth of octet strings. */
388 end = (guchar *) (a->pointer + seq_len);
390 while (a->pointer < end) {
391 /* Octet strings here are context-specific, which
392 * asn1_octet_string_decode() barfs on. Emulate it, but don't barf. */
393 ret = asn1_header_decode (a, &cls, &con, &tag, &def, &string_length);
394 if (ret != ASN1_ERR_NOERROR)
397 if (cls != ASN1_CTX || con != ASN1_PRI) {
398 /* XXX - handle the constructed encoding? */
399 return ASN1_ERR_WRONG_TYPE;
402 return ASN1_ERR_LENGTH_NOT_DEFINITE;
404 ret = asn1_octet_string_value_decode(a, (int) string_length, &string);
405 if (ret != ASN1_ERR_NOERROR)
408 /* If we have an 'any' component with a string value, we need to append
409 * an extra asterisk before final component. */
410 if ((tag == 1) && (string_length != 0))
413 if ( (tag == 1) || ((tag == 2) && any_valued) )
415 *filter_length += string_length;
416 *filter = g_realloc(*filter, *filter_length);
418 filterp = *filter + strlen(*filter);
419 if ( (tag == 1) || ((tag == 2) && any_valued) )
423 if (string_length != 0) {
424 memcpy(filterp, string, string_length);
425 filterp += string_length;
434 *filter = g_realloc(*filter, *filter_length);
435 filterp = *filter + strlen(*filter);
439 /* NB: Allocated byte for this earlier */
443 return ASN1_ERR_NOERROR;
446 /* Returns -1 if we're at the end, returns an ASN1_ERR value otherwise. */
447 static int parse_filter(ASN1_SCK *a, char **filter, guint *filter_length, const guchar **end)
454 ret = asn1_header_decode(a, &cls, &con, &tag, &def, &length);
455 if (ret != ASN1_ERR_NOERROR)
460 *end = a->pointer + length;
462 *filter = g_malloc0(*filter_length);
465 if (cls == ASN1_CTX) /* XXX - handle other types as errors? */
469 case LDAP_FILTER_AND:
471 const guchar *add_end;
474 return ASN1_ERR_WRONG_TYPE;
475 add_end = a->pointer + length;
477 *filter = g_realloc(*filter, *filter_length);
478 strcat(*filter, "(&");
479 while ((ret = parse_filter(a, filter, filter_length, &add_end))
484 strcat(*filter, ")");
489 const guchar *or_end;
492 return ASN1_ERR_WRONG_TYPE;
493 or_end = a->pointer + length;
495 *filter = g_realloc(*filter, *filter_length);
496 strcat(*filter, "(|");
497 while ((ret = parse_filter(a, filter, filter_length, &or_end))
502 strcat(*filter, ")");
505 case LDAP_FILTER_NOT:
507 const guchar *not_end;
510 return ASN1_ERR_WRONG_TYPE;
511 not_end = a->pointer + length;
513 *filter = g_realloc(*filter, *filter_length);
514 strcat(*filter, "(!");
515 ret = parse_filter(a, filter, filter_length, ¬_end);
516 if (ret != -1 && ret != ASN1_ERR_NOERROR)
518 strcat(*filter, ")");
521 case LDAP_FILTER_EQUALITY:
523 return ASN1_ERR_WRONG_TYPE;
524 ret = parse_filter_strings(a, filter, filter_length, "=");
525 if (ret != -1 && ret != ASN1_ERR_NOERROR)
530 return ASN1_ERR_WRONG_TYPE;
531 ret = parse_filter_strings(a, filter, filter_length, ">=");
532 if (ret != -1 && ret != ASN1_ERR_NOERROR)
537 return ASN1_ERR_WRONG_TYPE;
538 ret = parse_filter_strings(a, filter, filter_length, "<=");
539 if (ret != -1 && ret != ASN1_ERR_NOERROR)
542 case LDAP_FILTER_APPROX:
544 return ASN1_ERR_WRONG_TYPE;
545 ret = parse_filter_strings(a, filter, filter_length, "~=");
546 if (ret != -1 && ret != ASN1_ERR_NOERROR)
549 case LDAP_FILTER_PRESENT:
555 return ASN1_ERR_WRONG_TYPE;
556 ret = asn1_octet_string_value_decode(a, length, &string);
557 if (ret != ASN1_ERR_NOERROR)
559 *filter_length += 4 + length;
560 *filter = g_realloc(*filter, *filter_length);
561 filterp = *filter + strlen(*filter);
564 memcpy(filterp, string, length);
574 case LDAP_FILTER_SUBSTRINGS:
576 return ASN1_ERR_WRONG_TYPE;
577 /* Richard Dawe: Handle substrings */
578 ret = parse_filter_substrings(a, filter, filter_length);
579 if (ret != -1 && ret != ASN1_ERR_NOERROR)
583 return ASN1_ERR_WRONG_TYPE;
587 if (a->pointer == *end)
593 static int read_filter(ASN1_SCK *a, proto_tree *tree, int hf_id)
595 const guchar *start = a->pointer;
597 guint filter_length = 0;
598 const guchar *end = 0;
601 while ((ret = parse_filter(a, &filter, &filter_length, &end))
607 proto_tree_add_text(tree, NullTVB, start-a->begin, 0,
608 "Error parsing filter (%d)", ret);
610 proto_tree_add_string(tree, hf_id, NullTVB, start-a->begin, a->pointer-start, filter);
618 /********************************************************************************************/
620 static int dissect_ldap_result(ASN1_SCK *a, proto_tree *tree)
622 guint resultCode = 0;
624 read_integer(a, tree, hf_ldap_message_result, 0, &resultCode, ASN1_ENUM);
625 read_string(a, tree, hf_ldap_message_result_matcheddn, 0, 0, ASN1_UNI, ASN1_OTS);
626 read_string(a, tree, hf_ldap_message_result_errormsg, 0, 0, ASN1_UNI, ASN1_OTS);
628 if (resultCode == 10) /* Referral */
630 const guchar *start = a->pointer;
633 proto_tree *t, *referralTree;
635 read_sequence(a, &length);
636 t = proto_tree_add_text(tree, NullTVB, start-a->begin, length, "Referral URLs");
637 referralTree = proto_item_add_subtree(t, ett_ldap_referrals);
639 end = a->pointer + length;;
640 while (a->pointer < end)
641 read_string(a, referralTree, hf_ldap_message_result_referral, 0, 0, ASN1_UNI, ASN1_OTS);
647 static int dissect_ldap_request_bind(ASN1_SCK *a, proto_tree *tree)
653 read_integer(a, tree, hf_ldap_message_bind_version, 0, 0, ASN1_INT);
654 read_string(a, tree, hf_ldap_message_bind_dn, 0, 0, ASN1_UNI, ASN1_OTS);
657 if (asn1_header_decode(a, &cls, &con, &tag, &def, &length) != ASN1_ERR_NOERROR)
658 return 1; /* XXX - right return value for an error? */
660 return 1; /* RFCs 1777 and 2251 say these are context-specific types */
661 proto_tree_add_uint(tree, hf_ldap_message_bind_auth, NullTVB, start - a->begin,
662 a->pointer - start, tag);
665 case LDAP_AUTH_SIMPLE:
666 read_string_value(a, tree, hf_ldap_message_bind_auth_password, NULL, NULL,
670 /* For Kerberos V4, dissect it as a ticket. */
671 /* For SASL, dissect it as SaslCredentials. */
677 static int dissect_ldap_response_bind(ASN1_SCK *a, proto_tree *tree)
679 dissect_ldap_result(a, tree);
680 /* FIXME: handle SASL data */
684 static int dissect_ldap_request_search(ASN1_SCK *a, proto_tree *tree)
690 read_string(a, tree, hf_ldap_message_search_base, 0, 0, ASN1_UNI, ASN1_OTS);
691 read_integer(a, tree, hf_ldap_message_search_scope, 0, 0, ASN1_ENUM);
692 read_integer(a, tree, hf_ldap_message_search_deref, 0, 0, ASN1_ENUM);
693 read_integer(a, tree, hf_ldap_message_search_sizeLimit, 0, 0, ASN1_INT);
694 read_integer(a, tree, hf_ldap_message_search_timeLimit, 0, 0, ASN1_INT);
695 read_boolean(a, tree, hf_ldap_message_search_typesOnly, 0, 0);
696 ret = read_filter(a, tree, hf_ldap_message_search_filter);
697 if (ret != ASN1_ERR_NOERROR)
699 read_sequence(a, &seq_length);
700 end = a->pointer + seq_length;
701 while (a->pointer < end) {
702 ret = read_string(a, tree, hf_ldap_message_attribute, 0, 0, ASN1_UNI, ASN1_OTS);
703 if (ret != ASN1_ERR_NOERROR)
706 return ASN1_ERR_NOERROR;
709 static int dissect_ldap_response_search_entry(ASN1_SCK *a, proto_tree *tree)
712 const guchar *end_of_sequence;
714 read_string(a, tree, hf_ldap_message_dn, 0, 0, ASN1_UNI, ASN1_OTS);
715 read_sequence(a, &seq_length);
717 end_of_sequence = a->pointer + seq_length;
718 while (a->pointer < end_of_sequence)
720 proto_tree *t, *attr_tree;
722 const guchar *end_of_set;
725 read_string(a, tree, hf_ldap_message_attribute, &t, 0, ASN1_UNI, ASN1_OTS);
726 attr_tree = proto_item_add_subtree(t, ett_ldap_attribute);
728 read_set(a, &set_length);
729 end_of_set = a->pointer + set_length;
730 while (a->pointer < end_of_set)
731 read_string(a, attr_tree, hf_ldap_message_value, 0, 0, ASN1_UNI, ASN1_OTS);
737 static int dissect_ldap_request_add(ASN1_SCK *a, proto_tree *tree)
740 const guchar *end_of_sequence;
742 read_string(a, tree, hf_ldap_message_dn, 0, 0, ASN1_UNI, ASN1_OTS);
744 read_sequence(a, &seq_length);
745 end_of_sequence = a->pointer + seq_length;
746 while (a->pointer < end_of_sequence)
748 proto_tree *t, *attr_tree;
750 const guchar *end_of_set;
753 read_string(a, tree, hf_ldap_message_attribute, &t, 0, ASN1_UNI, ASN1_OTS);
754 attr_tree = proto_item_add_subtree(t, ett_ldap_attribute);
756 read_set(a, &set_length);
757 end_of_set = a->pointer + set_length;
758 while (a->pointer < end_of_set)
759 read_string(a, attr_tree, hf_ldap_message_value, 0, 0, ASN1_UNI, ASN1_OTS);
765 static int dissect_ldap_request_delete(ASN1_SCK *a, proto_tree *tree,
766 const guchar *start, guint length)
768 read_string_value(a, tree, hf_ldap_message_dn, NULL, NULL, start, length);
772 static int dissect_ldap_request_modifyrdn(ASN1_SCK *a, proto_tree *tree,
775 const guchar *start = a->pointer;
777 read_string(a, tree, hf_ldap_message_dn, 0, 0, ASN1_UNI, ASN1_OTS);
778 read_string(a, tree, hf_ldap_message_modrdn_name, 0, 0, ASN1_UNI, ASN1_OTS);
779 read_boolean(a, tree, hf_ldap_message_modrdn_delete, 0, 0);
781 if (a->pointer < (start + length)) {
782 /* LDAP V3 Modify DN operation, with newSuperior */
783 read_string(a, tree, hf_ldap_message_modrdn_superior, 0, 0, ASN1_UNI, ASN1_OTS);
789 static int dissect_ldap_request_compare(ASN1_SCK *a, proto_tree *tree)
797 read_string(a, tree, hf_ldap_message_dn, 0, 0, ASN1_UNI, ASN1_OTS);
801 read_string(a, 0, -1, 0, &string1, ASN1_UNI, ASN1_OTS);
802 read_string(a, 0, -1, 0, &string2, ASN1_UNI, ASN1_OTS);
804 length = 2 + strlen(string1) + strlen(string2);
805 compare = g_malloc0(length);
806 snprintf(compare, length, "%s=%s", string1, string2);
807 proto_tree_add_string(tree, hf_ldap_message_compare, NullTVB, start-a->begin, a->pointer-start, compare);
816 static int dissect_ldap_request_modify(ASN1_SCK *a, proto_tree *tree)
819 const guchar *end_of_sequence;
821 read_string(a, tree, hf_ldap_message_dn, 0, 0, ASN1_UNI, ASN1_OTS);
822 read_sequence(a, &seq_length);
823 end_of_sequence = a->pointer + seq_length;
824 while (a->pointer < end_of_sequence)
826 proto_tree *t = 0, *attr_tree;
828 const guchar *end_of_set;
832 read_integer(a, 0, -1, 0, &operation, ASN1_ENUM);
838 read_string(a, tree, hf_ldap_message_modify_add, &t, 0, ASN1_UNI, ASN1_OTS);
840 case LDAP_MOD_REPLACE:
841 read_string(a, tree, hf_ldap_message_modify_replace, &t, 0, ASN1_UNI, ASN1_OTS);
843 case LDAP_MOD_DELETE:
844 read_string(a, tree, hf_ldap_message_modify_delete, &t, 0, ASN1_UNI, ASN1_OTS);
847 attr_tree = proto_item_add_subtree(t, ett_ldap_attribute);
849 read_set(a, &set_length);
850 end_of_set = a->pointer + set_length;
851 while (a->pointer < end_of_set)
852 read_string(a, attr_tree, hf_ldap_message_value, 0, 0, ASN1_UNI, ASN1_OTS);
858 static int dissect_ldap_request_abandon(ASN1_SCK *a, proto_tree *tree,
859 const guchar *start, guint length)
861 read_integer_value(a, tree, hf_ldap_message_abandon_msgid, NULL, NULL,
867 dissect_ldap(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
869 proto_tree *ldap_tree = 0, *ti, *msg_tree;
872 guint protocolOpCls, protocolOpCon, protocolOpTag;
880 OLD_CHECK_DISPLAY_AS_DATA(proto_ldap, pd, offset, fd, tree);
884 ti = proto_tree_add_item(tree, proto_ldap, NullTVB, offset, END_OF_FRAME, FALSE);
885 ldap_tree = proto_item_add_subtree(ti, ett_ldap);
888 asn1_open(&a, pd, pi.captured_len);
891 while (a.pointer < a.end)
893 int message_id_start;
894 int message_id_length;
897 message_start = a.pointer - a.begin;
898 if (read_sequence(&a, &messageLength))
901 proto_tree_add_text(ldap_tree, NullTVB, offset, 1, "Invalid LDAP packet");
905 if (messageLength > (a.end - a.pointer))
908 proto_tree_add_text(ldap_tree, NullTVB, message_start, END_OF_FRAME, "Short message! (expected: %u, actual: %u)",
909 messageLength, a.end - a.pointer);
913 message_id_start = a.pointer - a.begin;
914 read_integer(&a, 0, -1, 0, &messageId, ASN1_INT);
915 message_id_length = (a.pointer - a.begin) - message_id_start;
918 asn1_id_decode(&a, &protocolOpCls, &protocolOpCon, &protocolOpTag);
919 if (protocolOpCls != ASN1_APL)
920 typestr = "Bad message type (not Application)";
922 typestr = val_to_str(protocolOpTag, msgTypes, "Bad message type (%u)");
926 if (check_col(fd, COL_PROTOCOL))
927 col_set_str(fd, COL_PROTOCOL, "LDAP");
929 if (check_col(fd, COL_INFO))
930 col_add_fstr(fd, COL_INFO, "MsgId=%u MsgType=%s",
939 proto_tree_add_uint_hidden(ldap_tree, hf_ldap_message_id, NullTVB, message_id_start, message_id_length, messageId);
940 proto_tree_add_uint_hidden(ldap_tree, hf_ldap_message_type, NullTVB,
941 start - a.begin, a.pointer - start, protocolOpTag);
942 ti = proto_tree_add_text(ldap_tree, NullTVB, message_id_start, messageLength, "Message: Id=%u %s", messageId, typestr);
943 msg_tree = proto_item_add_subtree(ti, ett_ldap_message);
945 read_length(&a, msg_tree, hf_ldap_message_length, &opLen);
947 switch (protocolOpTag)
950 dissect_ldap_request_bind(&a, msg_tree);
952 case LDAP_REQ_SEARCH:
953 ret = dissect_ldap_request_search(&a, msg_tree);
954 if (ret != ASN1_ERR_NOERROR)
958 dissect_ldap_request_add(&a, msg_tree);
960 case LDAP_REQ_DELETE:
961 dissect_ldap_request_delete(&a, msg_tree, start, opLen);
963 case LDAP_REQ_MODRDN:
964 dissect_ldap_request_modifyrdn(&a, msg_tree, opLen);
966 case LDAP_REQ_COMPARE:
967 dissect_ldap_request_compare(&a, msg_tree);
969 case LDAP_REQ_MODIFY:
970 dissect_ldap_request_modify(&a, msg_tree);
972 case LDAP_REQ_ABANDON:
973 dissect_ldap_request_abandon(&a, msg_tree, start, opLen);
976 dissect_ldap_response_bind(&a, msg_tree);
978 case LDAP_RES_SEARCH_ENTRY:
979 dissect_ldap_response_search_entry(&a, msg_tree);
981 case LDAP_RES_SEARCH_RESULT:
982 case LDAP_RES_MODIFY:
984 case LDAP_RES_DELETE:
985 case LDAP_RES_MODRDN:
986 case LDAP_RES_COMPARE:
987 dissect_ldap_result(&a, msg_tree);
995 proto_register_ldap(void)
997 static value_string result_codes[] = {
999 {1, "Operations error"},
1000 {2, "Protocol error"},
1001 {3, "Time limit exceeded"},
1002 {4, "Size limit exceeded"},
1003 {5, "Compare false"},
1004 {6, "Compare true"},
1005 {7, "Authentication method not supported"},
1006 {8, "Strong authentication required"},
1008 {11, "Administrative limit exceeded"},
1009 {12, "Unavailable critical extension"},
1010 {13, "Confidentiality required"},
1011 {14, "SASL bind in progress"},
1012 {16, "No such attribute"},
1013 {17, "Undefined attribute type"},
1014 {18, "Inappropriate matching"},
1015 {19, "Constraint violation"},
1016 {20, "Attribute or value exists"},
1017 {21, "Invalid attribute syntax"},
1018 {32, "No such object"},
1019 {33, "Alias problem"},
1020 {34, "Invalid DN syntax"},
1021 {36, "Alias derefetencing problem"},
1022 {48, "Inappropriate authentication"},
1023 {49, "Invalid credentials"},
1024 {50, "Insufficient access rights"},
1026 {52, "Unavailable"},
1027 {53, "Unwilling to perform"},
1028 {54, "Loop detected"},
1029 {64, "Naming violation"},
1030 {65, "Objectclass violation"},
1031 {66, "Not allowed on non-leaf"},
1032 {67, "Not allowed on RDN"},
1033 {68, "Entry already exists"},
1034 {69, "Objectclass modification prohibited"},
1035 {71, "Affects multiple DSAs"},
1039 static value_string auth_types[] = {
1040 {LDAP_AUTH_SIMPLE, "Simple"},
1041 {LDAP_AUTH_KRBV4LDAP, "Kerberos V4 to the LDAP server"},
1042 {LDAP_AUTH_KRBV4DSA, "Kerberos V4 to the DSA"},
1043 {LDAP_AUTH_SASL, "SASL"},
1046 static value_string search_scope[] = {
1052 static value_string search_dereference[] = {
1054 {0x01, "Searching"},
1055 {0x02, "Base Object"},
1059 static hf_register_info hf[] = {
1061 { "Length", "ldap.length",
1062 FT_UINT32, BASE_DEC, NULL, 0x0,
1065 { &hf_ldap_message_id,
1066 { "Message Id", "ldap.message_id",
1067 FT_UINT32, BASE_DEC, NULL, 0x0,
1068 "LDAP Message Id" }},
1069 { &hf_ldap_message_type,
1070 { "Message Type", "ldap.message_type",
1071 FT_UINT8, BASE_HEX, &msgTypes, 0x0,
1072 "LDAP Message Type" }},
1073 { &hf_ldap_message_length,
1074 { "Message Length", "ldap.message_length",
1075 FT_UINT32, BASE_DEC, NULL, 0x0,
1076 "LDAP Message Length" }},
1078 { &hf_ldap_message_result,
1079 { "Result Code", "ldap.result.code",
1080 FT_UINT8, BASE_HEX, result_codes, 0x0,
1081 "LDAP Result Code" }},
1082 { &hf_ldap_message_result_matcheddn,
1083 { "Matched DN", "ldap.result.matcheddn",
1084 FT_STRING, BASE_NONE, NULL, 0x0,
1085 "LDAP Result Matched DN" }},
1086 { &hf_ldap_message_result_errormsg,
1087 { "Error Message", "ldap.result.errormsg",
1088 FT_STRING, BASE_NONE, NULL, 0x0,
1089 "LDAP Result Error Message" }},
1090 { &hf_ldap_message_result_referral,
1091 { "Referral", "ldap.result.referral",
1092 FT_STRING, BASE_NONE, NULL, 0x0,
1093 "LDAP Result Referral URL" }},
1095 { &hf_ldap_message_bind_version,
1096 { "Version", "ldap.bind.version",
1097 FT_UINT32, BASE_DEC, NULL, 0x0,
1098 "LDAP Bind Version" }},
1099 { &hf_ldap_message_bind_dn,
1100 { "DN", "ldap.bind.dn",
1101 FT_STRING, BASE_NONE, NULL, 0x0,
1102 "LDAP Bind Distinguished Name" }},
1103 { &hf_ldap_message_bind_auth,
1104 { "Auth Type", "ldap.bind.auth_type",
1105 FT_UINT8, BASE_HEX, auth_types, 0x0,
1106 "LDAP Bind Auth Type" }},
1107 { &hf_ldap_message_bind_auth_password,
1108 { "Password", "ldap.bind.password",
1109 FT_STRING, BASE_NONE, NULL, 0x0,
1110 "LDAP Bind Password" }},
1112 { &hf_ldap_message_search_base,
1113 { "Base DN", "ldap.search.basedn",
1114 FT_STRING, BASE_NONE, NULL, 0x0,
1115 "LDAP Search Base Distinguished Name" }},
1116 { &hf_ldap_message_search_scope,
1117 { "Scope", "ldap.search.scope",
1118 FT_UINT8, BASE_HEX, search_scope, 0x0,
1119 "LDAP Search Scope" }},
1120 { &hf_ldap_message_search_deref,
1121 { "Dereference", "ldap.search.dereference",
1122 FT_UINT8, BASE_HEX, search_dereference, 0x0,
1123 "LDAP Search Dereference" }},
1124 { &hf_ldap_message_search_sizeLimit,
1125 { "Size Limit", "ldap.search.sizelimit",
1126 FT_UINT32, BASE_DEC, NULL, 0x0,
1127 "LDAP Search Size Limit" }},
1128 { &hf_ldap_message_search_timeLimit,
1129 { "Time Limit", "ldap.search.timelimit",
1130 FT_UINT32, BASE_DEC, NULL, 0x0,
1131 "LDAP Search Time Limit" }},
1132 { &hf_ldap_message_search_typesOnly,
1133 { "Attributes Only", "ldap.search.typesonly",
1134 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1135 "LDAP Search Attributes Only" }},
1136 { &hf_ldap_message_search_filter,
1137 { "Filter", "ldap.search.filter",
1138 FT_STRING, BASE_NONE, NULL, 0x0,
1139 "LDAP Search Filter" }},
1140 { &hf_ldap_message_dn,
1141 { "Distinguished Name", "ldap.dn",
1142 FT_STRING, BASE_NONE, NULL, 0x0,
1143 "LDAP Distinguished Name" }},
1144 { &hf_ldap_message_attribute,
1145 { "Attribute", "ldap.attribute",
1146 FT_STRING, BASE_NONE, NULL, 0x0,
1147 "LDAP Attribute" }},
1148 { &hf_ldap_message_value,
1149 { "Value", "ldap.value",
1150 FT_STRING, BASE_NONE, NULL, 0x0,
1153 { &hf_ldap_message_modrdn_name,
1154 { "New Name", "ldap.modrdn.name",
1155 FT_STRING, BASE_NONE, NULL, 0x0,
1157 { &hf_ldap_message_modrdn_delete,
1158 { "Delete Values", "ldap.modrdn.delete",
1159 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1160 "LDAP Modify RDN - Delete original values" }},
1161 { &hf_ldap_message_modrdn_superior,
1162 { "New Location", "ldap.modrdn.superior",
1163 FT_STRING, BASE_NONE, NULL, 0x0,
1164 "LDAP Modify RDN - New Location" }},
1166 { &hf_ldap_message_compare,
1167 { "Test", "ldap.compare.test",
1168 FT_STRING, BASE_NONE, NULL, 0x0,
1169 "LDAP Compare Test" }},
1171 { &hf_ldap_message_modify_add,
1172 { "Add", "ldap.modify.add",
1173 FT_STRING, BASE_NONE, NULL, 0x0,
1175 { &hf_ldap_message_modify_replace,
1176 { "Replace", "ldap.modify.replace",
1177 FT_STRING, BASE_NONE, NULL, 0x0,
1179 { &hf_ldap_message_modify_delete,
1180 { "Delete", "ldap.modify.delete",
1181 FT_STRING, BASE_NONE, NULL, 0x0,
1184 { &hf_ldap_message_abandon_msgid,
1185 { "Abandon Msg Id", "ldap.abandon.msgid",
1186 FT_UINT32, BASE_DEC, NULL, 0x0,
1187 "LDAP Abandon Msg Id" }},
1190 static gint *ett[] = {
1193 &ett_ldap_referrals,
1197 proto_ldap = proto_register_protocol("Lightweight Directory Access Protocol", "ldap");
1198 proto_register_field_array(proto_ldap, hf, array_length(hf));
1199 proto_register_subtree_array(ett, array_length(ett));
1203 proto_reg_handoff_ldap(void)
1205 old_dissector_add("tcp.port", TCP_PORT_LDAP, dissect_ldap);