packet-portmap.c

   1 /* packet-portmap.c
   2  * Routines for portmap dissection
   3  *
   4  * $Id: packet-portmap.c,v 1.12 2000/01/22 05:49:06 guy Exp $
   5  *
   6  * Ethereal - Network traffic analyzer
   7  * By Gerald Combs <gerald@zing.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * Copied from packet-smb.c
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31
  32 #ifdef HAVE_SYS_TYPES_H
  33 #include <sys/types.h>
  34 #endif
  35
  36
  37 #include "packet-rpc.h"
  38 #include "packet-portmap.h"
  39
  40
  41 static int proto_portmap = -1;
  42 static int hf_portmap_proto = -1;
  43 static int hf_portmap_prog = -1;
  44 static int hf_portmap_proc = -1;
  45 static int hf_portmap_version = -1;
  46 static int hf_portmap_port = -1;
  47 static int hf_portmap_answer = -1;
  48 static int hf_portmap_rpcb = -1;
  49 static int hf_portmap_rpcb_prog = -1;
  50 static int hf_portmap_rpcb_version = -1;
  51 static int hf_portmap_rpcb_netid = -1;
  52 static int hf_portmap_rpcb_addr = -1;
  53 static int hf_portmap_rpcb_owner = -1;
  54 static int hf_portmap_uaddr = -1;
  55 static int hf_portmap_value_follows = -1;
  56
  57
  58 static gint ett_portmap = -1;
  59 static gint ett_portmap_rpcb = -1;
  60 static gint ett_portmap_entry = -1;
  61
  62
  63 static struct true_false_string yesno = { "Yes", "No" };
  64
  65
  66 /* Dissect a getport call */
  67 int dissect_getport_call(const u_char *pd, int offset, frame_data *fd,
  68         proto_tree *tree)
  69 {
  70         guint32 proto;
  71         guint32 prog;
  72         if ( !BYTES_ARE_IN_FRAME(offset, 16)) return offset;
  73
  74         if ( tree )
  75         {
  76                 prog = pntohl(&pd[offset+0]);
  77                 proto_tree_add_item_format(tree, hf_portmap_prog,
  78                         offset, 4, prog, "Program: %s (%u)",
  79                         rpc_prog_name(prog), prog);
  80                 proto_tree_add_item(tree, hf_portmap_version,
  81                         offset+4, 4, pntohl(&pd[offset+4]));
  82
  83                 proto = pntohl(&pd[offset+8]);
  84                 proto_tree_add_item_format(tree, hf_portmap_proto,
  85                         offset+8, 4, proto, "Proto: %s (%u)", ipprotostr(proto), proto);
  86
  87                 proto_tree_add_item(tree, hf_portmap_port,
  88                         offset+12, 4, pntohl(&pd[offset+12]));
  89         }
  90
  91         return offset+16;
  92 }
  93
  94 int dissect_getport_reply(const u_char *pd, int offset, frame_data *fd,
  95         proto_tree *tree)
  96 {
  97         if ( !BYTES_ARE_IN_FRAME(offset, 4)) return offset;
  98         if ( tree )
  99         {
 100                 proto_tree_add_item(tree, hf_portmap_port,
 101                         offset, 4, pntohl(&pd[offset+0]));
 102         }
 103     return offset+=4;
 104 }
 105
 106 /* Dissect a 'set' call */
 107 int dissect_set_call(const u_char *pd, int offset, frame_data *fd,
 108         proto_tree *tree)
 109 {
 110         guint32 proto;
 111         guint32 prog;
 112         if ( !BYTES_ARE_IN_FRAME(offset, 16)) return offset;
 113
 114         if ( tree )
 115         {
 116                 prog = pntohl(&pd[offset+0]);
 117                 proto_tree_add_item_format(tree, hf_portmap_prog,
 118                         offset, 4, prog, "Program: %s (%d)",
 119                         rpc_prog_name(prog), prog);
 120                 proto_tree_add_item(tree, hf_portmap_version,
 121                         offset+4, 4, pntohl(&pd[offset+4]));
 122
 123                 proto = pntohl(&pd[offset+8]);
 124                 proto_tree_add_item_format(tree, hf_portmap_proto,
 125                         offset+8, 4, proto, "Proto: %s (%d)", ipprotostr(proto), proto);
 126
 127                 proto_tree_add_item(tree, hf_portmap_port,
 128                         offset+12, 4, pntohl(&pd[offset+12]));
 129         }
 130
 131         return offset+16;
 132 }
 133
 134 /* Dissect a 'unset' call */
 135 int dissect_unset_call(const u_char *pd, int offset, frame_data *fd,
 136         proto_tree *tree)
 137 {
 138         guint32 proto;
 139         guint32 prog;
 140         if ( !BYTES_ARE_IN_FRAME(offset, 16)) return offset;
 141
 142         if ( tree )
 143         {
 144                 prog = pntohl(&pd[offset+0]);
 145                 proto_tree_add_item_format(tree, hf_portmap_prog,
 146                         offset, 4, prog, "Program: %s (%d)",
 147                         rpc_prog_name(prog), prog);
 148                 proto_tree_add_item(tree, hf_portmap_version,
 149                         offset+4, 4, pntohl(&pd[offset+4]));
 150
 151                 proto = pntohl(&pd[offset+8]);
 152                 proto_tree_add_item(tree, hf_portmap_proto,
 153                         offset+8, 4, proto);
 154
 155                 proto_tree_add_item(tree, hf_portmap_port,
 156                         offset+12, 4, pntohl(&pd[offset+12]));
 157         }
 158
 159         return offset+16;
 160 }
 161
 162 int dissect_set_reply(const u_char *pd, int offset, frame_data *fd,
 163         proto_tree *tree)
 164 {
 165         if ( tree )
 166         {
 167                 if ( !BYTES_ARE_IN_FRAME(offset, 4)) return offset;
 168
 169                 proto_tree_add_item(tree, hf_portmap_answer,
 170                         offset, 4, pntohl(&pd[offset+0]));
 171                 offset += 4;
 172         }
 173     return offset;
 174 }
 175
 176 int dissect_dump_reply(const u_char *pd, int offset, frame_data *fd,
 177         proto_tree *tree)
 178 {
 179         int prog, version, proto, port, value_follows;
 180         proto_item *ti, *subtree;
 181
 182         while ( BYTES_ARE_IN_FRAME(offset, 4) )
 183         {
 184                 value_follows = pntohl(&pd[offset+0]);
 185                 if ( tree )
 186                 {
 187                         proto_tree_add_item(tree, hf_portmap_value_follows,
 188                                 offset, 4, value_follows);
 189                 }
 190                 offset += 4;
 191
 192                 if ( value_follows )
 193                 {
 194                         if ( ! BYTES_ARE_IN_FRAME(offset, 16) )
 195                         {
 196                                 break;
 197                         }
 198                         prog = pntohl(&pd[offset+0]);
 199                         version = pntohl(&pd[offset+4]);
 200                         proto = pntohl(&pd[offset+8]);
 201                         port = pntohl(&pd[offset+12]);
 202
 203                         if ( tree )
 204                         {
 205                                 ti = proto_tree_add_text(tree, offset, 16, "Map Entry: %s (%u) V%d",
 206                                         rpc_prog_name(prog), prog, version);
 207                                 subtree = proto_item_add_subtree(ti, ett_portmap_entry);
 208
 209                                 proto_tree_add_item_format(subtree, hf_portmap_prog,
 210                                         offset+0, 4, prog,
 211                                         "Program: %s (%u)", rpc_prog_name(prog), prog);
 212                                 proto_tree_add_item(subtree, hf_portmap_version,
 213                                         offset+4, 4, version);
 214                                 proto_tree_add_item_format(subtree, hf_portmap_proto,
 215                                         offset+8, 4, proto,
 216                                         "Protocol: %s (0x%02x)", ipprotostr(proto), proto);
 217                                 proto_tree_add_item(subtree, hf_portmap_port,
 218                                         offset+12, 4, port);
 219                         }
 220                         offset += 16;
 221                 }
 222         }
 223         return offset;
 224 }
 225
 226 /* proc number, "proc name", dissect_request, dissect_reply */
 227 /* NULL as function pointer means: take the generic one. */
 228 const vsff portmap1_proc[] = {
 229         { PORTMAPPROC_NULL,     "NULL",         NULL,                           NULL },
 230         { PORTMAPPROC_SET,      "SET",          NULL,                           NULL },
 231         { PORTMAPPROC_UNSET,    "UNSET",                NULL,                           NULL },
 232         { PORTMAPPROC_GETPORT,  "GETPORT",              NULL,                           NULL },
 233         { PORTMAPPROC_DUMP,     "DUMP",         NULL,                           NULL },
 234         { PORTMAPPROC_CALLIT,   "CALLIT",               NULL,                           NULL },
 235         { 0,    NULL,           NULL,                           NULL }
 236 };
 237 /* end of Portmap version 1 */
 238
 239 const vsff portmap2_proc[] = {
 240         { PORTMAPPROC_NULL, "NULL",
 241                 NULL, NULL },
 242         { PORTMAPPROC_SET, "SET",
 243                 dissect_set_call, dissect_set_reply },
 244         { PORTMAPPROC_UNSET, "UNSET",
 245                 dissect_unset_call, dissect_set_reply },
 246         { PORTMAPPROC_GETPORT,  "GETPORT",
 247                 dissect_getport_call, dissect_getport_reply },
 248         { PORTMAPPROC_DUMP, "DUMP",
 249                 NULL, dissect_dump_reply },
 250         { PORTMAPPROC_CALLIT, "CALLIT",
 251                 NULL, NULL },
 252     { 0, NULL, NULL, NULL }
 253 };
 254 /* end of Portmap version 2 */
 255
 256
 257 /* RFC 1833, Page 3 */
 258 int dissect_rpcb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int hfindex)
 259 {
 260         proto_item* rpcb_item = NULL;
 261         proto_tree* rpcb_tree = NULL;
 262         int old_offset = offset;
 263         guint32 prog;
 264         guint32 version;
 265
 266         if (tree) {
 267                 rpcb_item = proto_tree_add_item(tree, hfindex,
 268                         offset+0, END_OF_FRAME, NULL);
 269                 if (rpcb_item)
 270                         rpcb_tree = proto_item_add_subtree(rpcb_item, ett_portmap_rpcb);
 271         }
 272
 273         if (!BYTES_ARE_IN_FRAME(offset, 4)) return offset;
 274         prog = EXTRACT_UINT(pd, offset + 0);
 275         if (rpcb_tree)
 276                 proto_tree_add_item_format(rpcb_tree, hf_portmap_rpcb_prog,
 277                         offset+0, 4, prog,
 278                         "Program: %s (%u)", rpc_prog_name(prog), prog);
 279         offset += 4;
 280
 281         if (!BYTES_ARE_IN_FRAME(offset, 4)) return offset;
 282         version = EXTRACT_UINT(pd, offset + 0);
 283         if (rpcb_tree)
 284                 proto_tree_add_item(rpcb_tree, hf_portmap_rpcb_version,
 285                         offset+0, 4, version);
 286         offset += 4;
 287
 288         offset = dissect_rpc_string(pd, offset, fd, rpcb_tree, hf_portmap_rpcb_netid,NULL);
 289         offset = dissect_rpc_string(pd, offset, fd, rpcb_tree, hf_portmap_rpcb_addr,NULL);
 290         offset = dissect_rpc_string(pd, offset, fd, rpcb_tree, hf_portmap_rpcb_owner,NULL);
 291
 292         /* now we know, that rpcb is shorter */
 293         if (rpcb_item) {
 294                 proto_item_set_len(rpcb_item, offset - old_offset);
 295         }
 296
 297         return offset;
 298 }
 299
 300
 301
 302 /* RFC 1833, Page 7 */
 303 int dissect_rpcb3_getaddr_call(const u_char *pd, int offset, frame_data *fd,
 304         proto_tree *tree)
 305 {
 306         offset = dissect_rpcb(pd, offset, fd, tree, hf_portmap_rpcb);
 307
 308         return offset;
 309 }
 310
 311
 312 /* RFC 1833, Page 7 */
 313 int dissect_rpcb3_getaddr_reply(const u_char *pd, int offset, frame_data *fd,
 314         proto_tree *tree)
 315 {
 316         offset = dissect_rpc_string(pd, offset, fd, tree, hf_portmap_uaddr,NULL);
 317
 318         return offset;
 319 }
 320
 321
 322 /* RFC 1833, Page 7 */
 323 int dissect_rpcb3_dump_reply(const u_char *pd, int offset, frame_data *fd,
 324         proto_tree *tree)
 325 {
 326         guint32 value_follows;
 327
 328         while (1) {
 329                 if (!BYTES_ARE_IN_FRAME(offset,4)) break;
 330                 value_follows = EXTRACT_UINT(pd, offset+0);
 331                 proto_tree_add_item(tree,hf_portmap_value_follows,
 332                         offset+0, 4, value_follows);
 333                 offset += 4;
 334                 if (value_follows == 1) {
 335                         offset = dissect_rpcb(pd, offset, fd, tree, hf_portmap_rpcb);
 336                 }
 337                 else {
 338                         break;
 339                 }
 340         }
 341
 342         return offset;
 343 }
 344
 345
 346 /* Portmapper version 3, RFC 1833, Page 7 */
 347 const vsff portmap3_proc[] = {
 348         { RPCBPROC_NULL,        "NULL",
 349                 NULL, NULL },
 350         { RPCBPROC_SET,         "SET",
 351                 NULL, NULL },
 352         { RPCBPROC_UNSET,       "UNSET",
 353                 NULL, NULL },
 354         { RPCBPROC_GETADDR,     "GETADDR",
 355                 dissect_rpcb3_getaddr_call, dissect_rpcb3_getaddr_reply},
 356         { RPCBPROC_DUMP,        "DUMP",
 357                 NULL, dissect_rpcb3_dump_reply },
 358         { RPCBPROC_CALLIT,      "CALLIT",
 359                 NULL, NULL },
 360         { RPCBPROC_GETTIME,     "GETTIME",
 361                 NULL, NULL },
 362         { RPCBPROC_UADDR2TADDR, "UADDR2TADDR",
 363                 NULL, NULL },
 364         { RPCBPROC_TADDR2UADDR, "TADDR2UADDR",
 365                 NULL, NULL },
 366         { 0, NULL, NULL, NULL }
 367 };
 368 /* end of Portmap version 3 */
 369
 370
 371 /* Portmapper version 4, RFC 1833, Page 8 */
 372 const vsff portmap4_proc[] = {
 373         { RPCBPROC_NULL,        "NULL",
 374                 NULL, NULL },
 375         { RPCBPROC_SET,         "SET",
 376                 NULL, NULL },
 377         { RPCBPROC_UNSET,       "UNSET",
 378                 NULL, NULL },
 379         { RPCBPROC_GETADDR,     "GETADDR",
 380                 dissect_rpcb3_getaddr_call, dissect_rpcb3_getaddr_reply},
 381         { RPCBPROC_DUMP,        "DUMP",
 382                 NULL, dissect_rpcb3_dump_reply },
 383         { RPCBPROC_BCAST,       "BCAST",
 384                 NULL, NULL },
 385         { RPCBPROC_GETTIME,     "GETTIME",
 386                 NULL, NULL },
 387         { RPCBPROC_UADDR2TADDR, "UADDR2TADDR",
 388                 NULL, NULL },
 389         { RPCBPROC_TADDR2UADDR, "TADDR2UADDR",
 390                 NULL, NULL },
 391         { RPCBPROC_GETVERSADDR, "GETVERSADDR",
 392                 NULL, NULL },
 393         { RPCBPROC_INDIRECT,    "INDIRECT",
 394                 NULL, NULL },
 395         { RPCBPROC_GETADDRLIST, "GETADDRLIST",
 396                 NULL, NULL },
 397         { RPCBPROC_GETSTAT,     "GETSTAT",
 398                 NULL, NULL },
 399         { 0, NULL, NULL, NULL }
 400 };
 401 /* end of Portmap version 4 */
 402
 403 void
 404 proto_register_portmap(void)
 405 {
 406         static hf_register_info hf[] = {
 407                 { &hf_portmap_prog, {
 408                         "Program", "portmap.prog", FT_UINT32, BASE_DEC,
 409                         NULL, 0, "Program" }},
 410                 { &hf_portmap_port, {
 411                         "Port", "portmap.port", FT_UINT32, BASE_DEC,
 412                         NULL, 0, "Port" }},
 413                 { &hf_portmap_proc, {
 414                         "Procedure", "portmap.proc", FT_UINT32, BASE_DEC,
 415                         NULL, 0, "Procedure" }},
 416                 { &hf_portmap_proto, {
 417                         "Protocol", "portmap.proto", FT_UINT32, BASE_DEC,
 418                         NULL, 0, "Protocol" }},
 419                 { &hf_portmap_version, {
 420                         "Version", "portmap.version", FT_UINT32, BASE_DEC,
 421                         NULL, 0, "Version" }},
 422                 { &hf_portmap_answer, {
 423                         "Answer", "portmap.answer", FT_BOOLEAN, BASE_DEC,
 424                         NULL, 0, "Answer" }},
 425                 { &hf_portmap_rpcb, {
 426                         "RPCB", "portmap.rpcb", FT_NONE, 0,
 427                         NULL, 0, "RPCB" }},
 428                 { &hf_portmap_rpcb_prog, {
 429                         "Program", "portmap.rpcb.prog", FT_UINT32, BASE_DEC,
 430                         NULL, 0, "Program" }},
 431                 { &hf_portmap_rpcb_version, {
 432                         "Version", "portmap.rpcb.version", FT_UINT32, BASE_DEC,
 433                         NULL, 0, "Version" }},
 434                 { &hf_portmap_rpcb_netid, {
 435                         "Network Id", "portmap.rpcb.netid", FT_STRING, BASE_DEC,
 436                         NULL, 0, "Network Id" }},
 437                 { &hf_portmap_rpcb_addr, {
 438                         "Universal Address", "portmap.rpcb.addr", FT_STRING, BASE_DEC,
 439                         NULL, 0, "Universal Address" }},
 440                 { &hf_portmap_rpcb_owner, {
 441                         "Owner of this Service", "portmap.rpcb.owner", FT_STRING, BASE_DEC,
 442                         NULL, 0, "Owner of this Service" }},
 443                 { &hf_portmap_uaddr, {
 444                         "Universal Address", "portmap.uaddr", FT_STRING, BASE_DEC,
 445                         NULL, 0, "Universal Address" }},
 446                 { &hf_portmap_value_follows, {
 447                         "Value Follows", "portmap.value_follows", FT_BOOLEAN, BASE_NONE,
 448                         &yesno, 0, "Value Follows" }},
 449         };
 450         static gint *ett[] = {
 451                 &ett_portmap,
 452                 &ett_portmap_rpcb,
 453                 &ett_portmap_entry
 454         };
 455
 456         proto_portmap = proto_register_protocol("Portmap", "portmap");
 457         proto_register_field_array(proto_portmap, hf, array_length(hf));
 458         proto_register_subtree_array(ett, array_length(ett));
 459
 460         /* Register the protocol as RPC */
 461         rpc_init_prog(proto_portmap, PORTMAP_PROGRAM, ett_portmap);
 462         /* Register the procedure tables */
 463         rpc_init_proc_table(PORTMAP_PROGRAM, 1, portmap1_proc);
 464         rpc_init_proc_table(PORTMAP_PROGRAM, 2, portmap2_proc);
 465         rpc_init_proc_table(PORTMAP_PROGRAM, 3, portmap3_proc);
 466         rpc_init_proc_table(PORTMAP_PROGRAM, 4, portmap4_proc);
 467 }