packet-portmap.c

   1 /* packet-portmap.c
   2  * Routines for portmap dissection
   3  *
   4  * $Id: packet-portmap.c,v 1.9 1999/11/22 03:32:55 nneul Exp $
   5  *
   6  * Ethereal - Network traffic analyzer
   7  * By Gerald Combs <gerald@unicom.net>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * Copied from packet-smb.c
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31
  32 #ifdef HAVE_SYS_TYPES_H
  33 #include <sys/types.h>
  34 #endif
  35
  36
  37 #include "packet-rpc.h"
  38 #include "packet-portmap.h"
  39
  40
  41 static int proto_portmap = -1;
  42 static int hf_portmap_proto = -1;
  43 static int hf_portmap_prog = -1;
  44 static int hf_portmap_proc = -1;
  45 static int hf_portmap_version = -1;
  46 static int hf_portmap_port = -1;
  47 static int hf_portmap_answer = -1;
  48 static int hf_portmap_rpcb = -1;
  49 static int hf_portmap_rpcb_prog = -1;
  50 static int hf_portmap_rpcb_version = -1;
  51 static int hf_portmap_rpcb_netid = -1;
  52 static int hf_portmap_rpcb_addr = -1;
  53 static int hf_portmap_rpcb_owner = -1;
  54 static int hf_portmap_uaddr = -1;
  55 static int hf_portmap_value_follows = -1;
  56
  57
  58 static gint ett_portmap = -1;
  59 static gint ett_portmap_rpcb = -1;
  60 static gint ett_portmap_entry = -1;
  61
  62
  63 static struct true_false_string yesno = { "Yes", "No" };
  64
  65
  66 /* Dissect a getport call */
  67 int dissect_getport_call(const u_char *pd, int offset, frame_data *fd,
  68         proto_tree *tree)
  69 {
  70         guint32 proto;
  71         guint32 prog;
  72         if ( !BYTES_ARE_IN_FRAME(offset, 16)) return offset;
  73
  74         if ( tree )
  75         {
  76                 prog = pntohl(&pd[offset+0]);
  77                 proto_tree_add_item_format(tree, hf_portmap_prog,
  78                         offset, 4, prog, "Program: %s (%u)",
  79                         rpc_prog_name(prog), prog);
  80                 proto_tree_add_item(tree, hf_portmap_version,
  81                         offset+4, 4, pntohl(&pd[offset+4]));
  82
  83                 proto = pntohl(&pd[offset+8]);
  84                 proto_tree_add_item_format(tree, hf_portmap_proto,
  85                         offset+8, 4, proto, "Proto: %s (%u)", ipprotostr(proto), proto);
  86
  87                 proto_tree_add_item(tree, hf_portmap_port,
  88                         offset+12, 4, pntohl(&pd[offset+12]));
  89         }
  90
  91         return offset+16;
  92 }
  93
  94 int dissect_getport_reply(const u_char *pd, int offset, frame_data *fd,
  95         proto_tree *tree)
  96 {
  97         if ( !BYTES_ARE_IN_FRAME(offset, 4)) return offset;
  98         if ( tree )
  99         {
 100                 proto_tree_add_item(tree, hf_portmap_port,
 101                         offset, 4, pntohl(&pd[offset+0]));
 102         }
 103     return offset+=4;
 104 }
 105
 106 /* Dissect a 'set' call */
 107 int dissect_set_call(const u_char *pd, int offset, frame_data *fd,
 108         proto_tree *tree)
 109 {
 110         guint32 proto;
 111         guint32 prog;
 112         if ( !BYTES_ARE_IN_FRAME(offset, 16)) return offset;
 113
 114         if ( tree )
 115         {
 116                 prog = pntohl(&pd[offset+0]);
 117                 proto_tree_add_item_format(tree, hf_portmap_prog,
 118                         offset, 4, prog, "Program: %s (%d)",
 119                         rpc_prog_name(prog), prog);
 120                 proto_tree_add_item(tree, hf_portmap_version,
 121                         offset+4, 4, pntohl(&pd[offset+4]));
 122
 123                 proto = pntohl(&pd[offset+8]);
 124                 proto_tree_add_item_format(tree, hf_portmap_proto,
 125                         offset+8, 4, proto, "Proto: %s (%d)", ipprotostr(proto), proto);
 126
 127                 proto_tree_add_item(tree, hf_portmap_port,
 128                         offset+12, 4, pntohl(&pd[offset+12]));
 129         }
 130
 131         return offset+16;
 132 }
 133
 134 /* Dissect a 'unset' call */
 135 int dissect_unset_call(const u_char *pd, int offset, frame_data *fd,
 136         proto_tree *tree)
 137 {
 138         guint32 proto;
 139         guint32 prog;
 140         if ( !BYTES_ARE_IN_FRAME(offset, 16)) return offset;
 141
 142         if ( tree )
 143         {
 144                 prog = pntohl(&pd[offset+0]);
 145                 proto_tree_add_item_format(tree, hf_portmap_prog,
 146                         offset, 4, prog, "Program: %s (%d)",
 147                         rpc_prog_name(prog), prog);
 148                 proto_tree_add_item(tree, hf_portmap_version,
 149                         offset+4, 4, pntohl(&pd[offset+4]));
 150
 151                 proto = pntohl(&pd[offset+8]);
 152                 proto_tree_add_item(tree, hf_portmap_proto,
 153                         offset+8, 4, proto);
 154
 155                 proto_tree_add_item(tree, hf_portmap_port,
 156                         offset+12, 4, pntohl(&pd[offset+12]));
 157         }
 158
 159         return offset+16;
 160 }
 161
 162 int dissect_set_reply(const u_char *pd, int offset, frame_data *fd,
 163         proto_tree *tree)
 164 {
 165         if ( tree )
 166         {
 167                 if ( !BYTES_ARE_IN_FRAME(offset, 4)) return offset;
 168
 169                 proto_tree_add_item(tree, hf_portmap_answer,
 170                         offset, 4, pntohl(&pd[offset+0]));
 171                 offset += 4;
 172         }
 173     return offset;
 174 }
 175
 176 int dissect_dump_reply(const u_char *pd, int offset, frame_data *fd,
 177         proto_tree *tree)
 178 {
 179         int prog, version, proto, port, value_follows;
 180         proto_item *ti, *subtree;
 181
 182         while ( BYTES_ARE_IN_FRAME(offset, 4) )
 183         {
 184                 value_follows = pntohl(&pd[offset+0]);
 185                 if ( tree )
 186                 {
 187                         proto_tree_add_item(tree, hf_portmap_value_follows,
 188                                 offset, 4, value_follows);
 189                 }
 190                 offset += 4;
 191
 192                 if ( value_follows )
 193                 {
 194                         if ( ! BYTES_ARE_IN_FRAME(offset, 16) )
 195                         {
 196                                 break;
 197                         }
 198                         prog = pntohl(&pd[offset+0]);
 199                         version = pntohl(&pd[offset+4]);
 200                         proto = pntohl(&pd[offset+8]);
 201                         port = pntohl(&pd[offset+12]);
 202
 203                         if ( tree )
 204                         {
 205                                 ti = proto_tree_add_text(tree, offset, 16, "Map Entry: %s (%d) V%d",
 206                                         rpc_prog_name(prog), prog, version);
 207                                 subtree = proto_item_add_subtree(ti, ett_portmap_entry);
 208
 209                                 proto_tree_add_item(subtree, hf_portmap_prog,
 210                                         offset+0, 4, prog);
 211                                 proto_tree_add_item(subtree, hf_portmap_version,
 212                                         offset+4, 4, version);
 213                                 proto_tree_add_item(subtree, hf_portmap_proto,
 214                                         offset+8, 4, proto);
 215                                 proto_tree_add_item(subtree, hf_portmap_port,
 216                                         offset+12, 4, port);
 217                         }
 218                         offset += 16;
 219                 }
 220         }
 221         return offset;
 222 }
 223
 224 /* proc number, "proc name", dissect_request, dissect_reply */
 225 /* NULL as function pointer means: take the generic one. */
 226 const vsff portmap1_proc[] = {
 227         { PORTMAPPROC_NULL,     "NULL",         NULL,                           NULL },
 228         { PORTMAPPROC_SET,      "SET",          NULL,                           NULL },
 229         { PORTMAPPROC_UNSET,    "UNSET",                NULL,                           NULL },
 230         { PORTMAPPROC_GETPORT,  "GETPORT",              NULL,                           NULL },
 231         { PORTMAPPROC_DUMP,     "DUMP",         NULL,                           NULL },
 232         { PORTMAPPROC_CALLIT,   "CALLIT",               NULL,                           NULL },
 233         { 0,    NULL,           NULL,                           NULL }
 234 };
 235 /* end of Portmap version 1 */
 236
 237 const vsff portmap2_proc[] = {
 238         { PORTMAPPROC_NULL, "NULL",
 239                 NULL, NULL },
 240         { PORTMAPPROC_SET, "SET",
 241                 dissect_set_call, dissect_set_reply },
 242         { PORTMAPPROC_UNSET, "UNSET",
 243                 dissect_unset_call, dissect_set_reply },
 244         { PORTMAPPROC_GETPORT,  "GETPORT",
 245                 dissect_getport_call, dissect_getport_reply },
 246         { PORTMAPPROC_DUMP, "DUMP",
 247                 NULL, dissect_dump_reply },
 248         { PORTMAPPROC_CALLIT, "CALLIT",
 249                 NULL, NULL },
 250     { 0, NULL, NULL, NULL }
 251 };
 252 /* end of Portmap version 2 */
 253
 254
 255 /* RFC 1833, Page 3 */
 256 int dissect_rpcb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int hfindex)
 257 {
 258         proto_item* rpcb_item = NULL;
 259         proto_tree* rpcb_tree = NULL;
 260         int old_offset = offset;
 261         guint32 prog;
 262         guint32 version;
 263
 264         if (tree) {
 265                 rpcb_item = proto_tree_add_item(tree, hfindex,
 266                         offset+0, END_OF_FRAME, NULL);
 267                 if (rpcb_item)
 268                         rpcb_tree = proto_item_add_subtree(rpcb_item, ett_portmap_rpcb);
 269         }
 270
 271         if (!BYTES_ARE_IN_FRAME(offset, 4)) return offset;
 272         prog = EXTRACT_UINT(pd, offset + 0);
 273         if (rpcb_tree)
 274                 proto_tree_add_item_format(rpcb_tree, hf_portmap_rpcb_prog,
 275                         offset+0, 4, prog,
 276                         "Program: %s (%u)", rpc_prog_name(prog), prog);
 277         offset += 4;
 278
 279         if (!BYTES_ARE_IN_FRAME(offset, 4)) return offset;
 280         version = EXTRACT_UINT(pd, offset + 0);
 281         if (rpcb_tree)
 282                 proto_tree_add_item(rpcb_tree, hf_portmap_rpcb_version,
 283                         offset+0, 4, version);
 284         offset += 4;
 285
 286         offset = dissect_rpc_string(pd, offset, fd, rpcb_tree, hf_portmap_rpcb_netid);
 287         offset = dissect_rpc_string(pd, offset, fd, rpcb_tree, hf_portmap_rpcb_addr);
 288         offset = dissect_rpc_string(pd, offset, fd, rpcb_tree, hf_portmap_rpcb_owner);
 289
 290         /* now we know, that rpcb is shorter */
 291         if (rpcb_item) {
 292                 proto_item_set_len(rpcb_item, offset - old_offset);
 293         }
 294
 295         return offset;
 296 }
 297
 298
 299
 300 /* RFC 1833, Page 7 */
 301 int dissect_rpcb3_getaddr_call(const u_char *pd, int offset, frame_data *fd,
 302         proto_tree *tree)
 303 {
 304         offset = dissect_rpcb(pd, offset, fd, tree, hf_portmap_rpcb);
 305
 306         return offset;
 307 }
 308
 309
 310 /* RFC 1833, Page 7 */
 311 int dissect_rpcb3_getaddr_reply(const u_char *pd, int offset, frame_data *fd,
 312         proto_tree *tree)
 313 {
 314         offset = dissect_rpc_string(pd, offset, fd, tree, hf_portmap_uaddr);
 315
 316         return offset;
 317 }
 318
 319
 320 /* RFC 1833, Page 7 */
 321 int dissect_rpcb3_dump_reply(const u_char *pd, int offset, frame_data *fd,
 322         proto_tree *tree)
 323 {
 324         guint32 value_follows;
 325
 326         while (1) {
 327                 if (!BYTES_ARE_IN_FRAME(offset,4)) break;
 328                 value_follows = EXTRACT_UINT(pd, offset+0);
 329                 proto_tree_add_item(tree,hf_portmap_value_follows,
 330                         offset+0, 4, value_follows);
 331                 offset += 4;
 332                 if (value_follows == 1) {
 333                         offset = dissect_rpcb(pd, offset, fd, tree, hf_portmap_rpcb);
 334                 }
 335                 else {
 336                         break;
 337                 }
 338         }
 339
 340         return offset;
 341 }
 342
 343
 344 /* Portmapper version 3, RFC 1833, Page 7 */
 345 const vsff portmap3_proc[] = {
 346         { RPCBPROC_NULL,        "NULL",
 347                 NULL, NULL },
 348         { RPCBPROC_SET,         "SET",
 349                 NULL, NULL },
 350         { RPCBPROC_UNSET,       "UNSET",
 351                 NULL, NULL },
 352         { RPCBPROC_GETADDR,     "GETADDR",
 353                 dissect_rpcb3_getaddr_call, dissect_rpcb3_getaddr_reply},
 354         { RPCBPROC_DUMP,        "DUMP",
 355                 NULL, dissect_rpcb3_dump_reply },
 356         { RPCBPROC_CALLIT,      "CALLIT",
 357                 NULL, NULL },
 358         { RPCBPROC_GETTIME,     "GETTIME",
 359                 NULL, NULL },
 360         { RPCBPROC_UADDR2TADDR, "UADDR2TADDR",
 361                 NULL, NULL },
 362         { RPCBPROC_TADDR2UADDR, "TADDR2UADDR",
 363                 NULL, NULL },
 364         { 0, NULL, NULL, NULL }
 365 };
 366 /* end of Portmap version 3 */
 367
 368
 369 /* Portmapper version 4, RFC 1833, Page 8 */
 370 const vsff portmap4_proc[] = {
 371         { RPCBPROC_NULL,        "NULL",
 372                 NULL, NULL },
 373         { RPCBPROC_SET,         "SET",
 374                 NULL, NULL },
 375         { RPCBPROC_UNSET,       "UNSET",
 376                 NULL, NULL },
 377         { RPCBPROC_GETADDR,     "GETADDR",
 378                 dissect_rpcb3_getaddr_call, dissect_rpcb3_getaddr_reply},
 379         { RPCBPROC_DUMP,        "DUMP",
 380                 NULL, dissect_rpcb3_dump_reply },
 381         { RPCBPROC_BCAST,       "BCAST",
 382                 NULL, NULL },
 383         { RPCBPROC_GETTIME,     "GETTIME",
 384                 NULL, NULL },
 385         { RPCBPROC_UADDR2TADDR, "UADDR2TADDR",
 386                 NULL, NULL },
 387         { RPCBPROC_TADDR2UADDR, "TADDR2UADDR",
 388                 NULL, NULL },
 389         { RPCBPROC_GETVERSADDR, "GETVERSADDR",
 390                 NULL, NULL },
 391         { RPCBPROC_INDIRECT,    "INDIRECT",
 392                 NULL, NULL },
 393         { RPCBPROC_GETADDRLIST, "GETADDRLIST",
 394                 NULL, NULL },
 395         { RPCBPROC_GETSTAT,     "GETSTAT",
 396                 NULL, NULL },
 397         { 0, NULL, NULL, NULL }
 398 };
 399 /* end of Portmap version 4 */
 400
 401 void
 402 proto_register_portmap(void)
 403 {
 404         static hf_register_info hf[] = {
 405                 { &hf_portmap_prog, {
 406                         "Program", "portmap.prog", FT_UINT32, BASE_DEC,
 407                         NULL, 0, "Program" }},
 408                 { &hf_portmap_port, {
 409                         "Port", "portmap.port", FT_UINT32, BASE_DEC,
 410                         NULL, 0, "Port" }},
 411                 { &hf_portmap_proc, {
 412                         "Procedure", "portmap.proc", FT_UINT32, BASE_DEC,
 413                         NULL, 0, "Procedure" }},
 414                 { &hf_portmap_proto, {
 415                         "Protocol", "portmap.proto", FT_UINT32, BASE_DEC,
 416                         NULL, 0, "Protocol" }},
 417                 { &hf_portmap_version, {
 418                         "Version", "portmap.version", FT_UINT32, BASE_DEC,
 419                         NULL, 0, "Version" }},
 420                 { &hf_portmap_answer, {
 421                         "Answer", "portmap.answer", FT_BOOLEAN, BASE_DEC,
 422                         NULL, 0, "Answer" }},
 423                 { &hf_portmap_rpcb, {
 424                         "RPCB", "portmap.rpcb", FT_NONE, 0,
 425                         NULL, 0, "RPCB" }},
 426                 { &hf_portmap_rpcb_prog, {
 427                         "Program", "portmap.rpcb.prog", FT_UINT32, BASE_DEC,
 428                         NULL, 0, "Program" }},
 429                 { &hf_portmap_rpcb_version, {
 430                         "Version", "portmap.rpcb.version", FT_UINT32, BASE_DEC,
 431                         NULL, 0, "Version" }},
 432                 { &hf_portmap_rpcb_netid, {
 433                         "Network Id", "portmap.rpcb.netid", FT_STRING, BASE_DEC,
 434                         NULL, 0, "Network Id" }},
 435                 { &hf_portmap_rpcb_addr, {
 436                         "Universal Address", "portmap.rpcb.addr", FT_STRING, BASE_DEC,
 437                         NULL, 0, "Universal Address" }},
 438                 { &hf_portmap_rpcb_owner, {
 439                         "Owner of this Service", "portmap.rpcb.owner", FT_STRING, BASE_DEC,
 440                         NULL, 0, "Owner of this Service" }},
 441                 { &hf_portmap_uaddr, {
 442                         "Universal Address", "portmap.uaddr", FT_STRING, BASE_DEC,
 443                         NULL, 0, "Universal Address" }},
 444                 { &hf_portmap_value_follows, {
 445                         "Value Follows", "portmap.value_follows", FT_BOOLEAN, BASE_NONE,
 446                         &yesno, 0, "Value Follows" }},
 447         };
 448         static gint *ett[] = {
 449                 &ett_portmap,
 450                 &ett_portmap_rpcb,
 451                 &ett_portmap_entry
 452         };
 453
 454         proto_portmap = proto_register_protocol("Portmap", "portmap");
 455         proto_register_field_array(proto_portmap, hf, array_length(hf));
 456         proto_register_subtree_array(ett, array_length(ett));
 457
 458         /* Register the protocol as RPC */
 459         rpc_init_prog(proto_portmap, PORTMAP_PROGRAM, ett_portmap);
 460         /* Register the procedure tables */
 461         rpc_init_proc_table(PORTMAP_PROGRAM, 1, portmap1_proc);
 462         rpc_init_proc_table(PORTMAP_PROGRAM, 2, portmap2_proc);
 463         rpc_init_proc_table(PORTMAP_PROGRAM, 3, portmap3_proc);
 464         rpc_init_proc_table(PORTMAP_PROGRAM, 4, portmap4_proc);
 465 }