packet-socks.c

   1 /* packet-socks.c
   2  * Routines for socks versions 4 &5  packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * $Id: packet-socks.c,v 1.43 2002/08/28 21:00:35 jmayer Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  *
  25  *
  26  * The Version 4 decode is based on SOCKS4.protocol and SOCKS4A.protocol.
  27  * The Version 5 decoder is based upon rfc-1928
  28  * The Version 5 User/Password authentication is based on rfc-1929.
  29  *
  30  * See http://www.socks.nec.com/socksprot.html for these and other documents
  31  *
  32  * Revisions:
  33  *
  34  * 2001-01-08 JCFoster Fixed problem with NULL pointer for hash data.
  35  *                      Now test and exit if hash_info is null.
  36  */
  37
  38 /* Possible enhancements -
  39  *
  40  * Add GSS-API authentication per rfc-1961
  41  * Add CHAP authentication
  42  * Decode FLAG bits per
  43  *       http://www.socks.nec.com/draft/draft-ietf-aft-socks-pro-v-04.txt
  44  * In call_next_dissector, could load the destination address into the
  45  *      pi structure before calling next dissector.
  46  * remove display_string or at least make it use protocol identifiers
  47  * socks_hash_entry_t needs to handle V5 address type and domain names
  48 */
  49
  50
  51
  52
  53 #ifdef HAVE_CONFIG_H
  54 # include "config.h"
  55 #endif
  56
  57
  58 #include <stdio.h>
  59 #include <string.h>
  60 #include <glib.h>
  61
  62 #include <epan/packet.h>
  63 #include <epan/resolv.h>
  64 #include "alignment.h"
  65 #include <epan/conversation.h>
  66
  67 #include "packet-tcp.h"
  68 #include "packet-udp.h"
  69 #include <epan/strutil.h>
  70
  71
  72 #define compare_packet(X) (X == (pinfo->fd->num))
  73 #define get_packet_ptr  (pinfo->fd->num)
  74 #define row_pointer_type guint32
  75
  76 #define TCP_PORT_SOCKS 1080
  77
  78
  79 /**************** Socks commands ******************/
  80
  81 #define CONNECT_COMMAND         1
  82 #define BIND_COMMAND            2
  83 #define UDP_ASSOCIATE_COMMAND   3
  84 #define PING_COMMAND            0x80
  85 #define TRACERT_COMMAND         0x81
  86
  87
  88 /********** V5 Authentication methods *************/
  89
  90 #define NO_AUTHENTICATION       0
  91 #define GSS_API_AUTHENTICATION  1
  92 #define USER_NAME_AUTHENTICATION        2
  93 #define CHAP_AUTHENTICATION     3
  94 #define AUTHENTICATION_FAILED   0xff
  95
  96
  97 /*********** Header field identifiers *************/
  98
  99 static int proto_socks = -1;
 100
 101 static int ett_socks = -1;
 102 static int ett_socks_auth = -1;
 103 static int ett_socks_name = -1;
 104
 105 static int hf_socks_ver = -1;
 106 static int hf_socks_ip_dst = -1;
 107 static int hf_socks_ip6_dst = -1;
 108 static int hf_user_name = -1;
 109 static int hf_socks_dstport = -1;
 110 static int hf_socks_cmd = -1;
 111 static int hf_socks_results = -1;
 112 static int hf_socks_results_4 = -1;
 113 static int hf_socks_results_5 = -1;
 114
 115
 116 /************* Dissector handles ***********/
 117
 118 static dissector_handle_t socks_handle;
 119 static dissector_handle_t socks_udp_handle;
 120
 121 /************* State Machine names ***********/
 122
 123 enum SockState {
 124         None = 0,
 125         Connecting,
 126         V4UserNameWait,
 127         V4NameWait,
 128         V5Command,
 129         V5Reply,
 130         V5BindReply,
 131         UserNameAuth,
 132         GssApiAuth,
 133         AuthReply,
 134         Done
 135 };
 136
 137
 138
 139 typedef struct {
 140         int             state;
 141         int             version;
 142         int             command;
 143         int             grant;
 144         guint32         port;
 145         guint32         udp_port;
 146         guint32         udp_remote_port;
 147
 148         int             connect_offset;
 149         row_pointer_type        v4_name_row;
 150         row_pointer_type        v4_user_name_row;
 151         row_pointer_type        connect_row;
 152         row_pointer_type        cmd_reply_row;
 153         row_pointer_type        bind_reply_row;
 154         row_pointer_type        command_row;
 155         row_pointer_type        auth_method_row;
 156         row_pointer_type        user_name_auth_row;
 157         guint32 start_done_row;
 158
 159         guint32 dst_addr;       /* this needs to handle IPv6 */
 160 }socks_hash_entry_t;
 161
 162
 163
 164
 165 static char *address_type_table[] = {
 166         "Unknown",
 167         "IPv4",
 168         "Unknown",
 169         "Domain Name",
 170         "IPv6",
 171         "Unknown"
 172 };
 173
 174
 175 /* String table for the V4 reply status messages */
 176
 177 #ifdef __JUNK__
 178 static char *reply_table_v4[] = {
 179         "Granted",
 180         "Rejected or Failed",
 181         "Rejected because SOCKS server cannot connect to identd on the client",
 182         "Rejected because the client program and identd report different user-ids",
 183         "Unknown"
 184 };
 185 #endif
 186
 187 static const value_string reply_table_v4[] = {
 188         {90, "Granted"},
 189         {91, "Rejected or Failed"},
 190         {92, "Rejected because SOCKS server cannot connect to identd on the client"},
 191         {93, "Rejected because the client program and identd report different user-ids"},
 192         {0, NULL}
 193 };
 194
 195 /* String table for the V5 reply status messages */
 196
 197 #ifdef __JUNK__
 198 static char *reply_table_v5[] = {
 199         "Succeeded",
 200         "General SOCKS server failure",
 201         "Connection not allowed by ruleset",
 202         "Network unreachable",
 203         "Host unreachable",
 204         "Connection refused",
 205         "TTL expired",
 206         "Command not supported",
 207         "Address type not supported",
 208         "Unknown"
 209 };
 210 #endif
 211
 212 static const value_string reply_table_v5[] = {
 213         {0, "Succeeded"},
 214         {1, "General SOCKS server failure"},
 215         {2, "Connection not allowed by ruleset"},
 216         {3, "Network unreachable"},
 217         {4, "Host unreachable"},
 218         {5, "Connection refused"},
 219         {6, "TTL expired"},
 220         {7, "Command not supported"},
 221         {8, "Address type not supported"}
 222 };
 223
 224 static const value_string cmd_strings[] = {
 225         {0, "Unknow"},
 226         {1, "Connect"},
 227         {2, "Bind"},
 228         {3, "UdpAssociate"},
 229         {0x80, "Ping"},
 230         {0x81, "Traceroute"},
 231         {0, NULL}
 232 };
 233
 234 #define socks_hash_init_count 20
 235 #define socks_hash_val_length (sizeof(socks_hash_entry_t))
 236
 237 static GMemChunk *socks_vals = NULL;
 238
 239
 240 /************************* Support routines ***************************/
 241
 242
 243 static int display_string(tvbuff_t *tvb, int offset,
 244         proto_tree *tree, char *label){
 245
 246 /* display a string with a length, characters encoding */
 247 /* they are displayed under a tree with the name in Label variable */
 248 /* return the length of the string and the length byte */
 249
 250
 251         proto_tree      *name_tree;
 252         proto_item      *ti;
 253
 254         char temp[ 256];
 255         int length = tvb_get_guint8(tvb, offset);
 256
 257         tvb_memcpy(tvb, (guint8 *)temp, offset+1, length);
 258         temp[ length ] = 0;
 259
 260         ti = proto_tree_add_text(tree, tvb, offset, length + 1,
 261                 "%s: %s" , label, temp);
 262
 263
 264         name_tree = proto_item_add_subtree(ti, ett_socks_name);
 265
 266         proto_tree_add_text( name_tree, tvb, offset, 1, "Length: %u", length);
 267
 268         ++offset;
 269
 270         proto_tree_add_text( name_tree, tvb, offset, length, "String: %s", temp);
 271
 272         return length + 1;
 273 }
 274
 275
 276
 277 static char *get_auth_method_name( guint Number){
 278
 279 /* return the name of the authenication method */
 280
 281         if ( Number == 0) return "No authentication";
 282         if ( Number == 1) return "GSSAPI";
 283         if ( Number == 2) return "Username/Password";
 284         if ( Number == 3) return "Chap";
 285         if (( Number >= 4) && ( Number <= 0x7f))return "IANA assigned";
 286         if (( Number >= 0x80) && ( Number <= 0xfe)) return "private method";
 287         if ( Number == 0xff) return "no acceptable method";
 288
 289         /* shouldn't reach here */
 290
 291         return "Bad method number (not 0-0xff)";
 292 }
 293
 294
 295 static char *get_command_name( guint Number){
 296
 297 /* return the name of the command as a string */
 298
 299         if ( Number == 0) return "Unknow";
 300         if ( Number == 1) return "Connect";
 301         if ( Number == 2) return "Bind";
 302         if ( Number == 3) return "UdpAssociate";
 303         if ( Number == 0x80) return "Ping";
 304         if ( Number == 0x81) return "Traceroute";
 305         return "Unknown";
 306 }
 307
 308
 309 static int display_address(tvbuff_t *tvb, int offset, proto_tree *tree) {
 310
 311 /* decode and display the v5 address, return offset of next byte */
 312
 313         int a_type = tvb_get_guint8(tvb, offset);
 314
 315         proto_tree_add_text( tree, tvb, offset, 1,
 316                         "Address Type: %d (%s)", a_type,
 317                         address_type_table[ MIN( (guint) a_type,
 318                                 array_length( address_type_table)-1) ]);
 319
 320         ++offset;
 321
 322         if ( a_type == 1){              /* IPv4 address */
 323                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset,
 324                                         4, FALSE);
 325                 offset += 4;
 326         }
 327         else if ( a_type == 3){ /* domain name address */
 328
 329                 offset += display_string(tvb, offset, tree,
 330                         "Remote name");
 331         }
 332         else if ( a_type == 4){ /* IPv6 address */
 333                 proto_tree_add_item( tree, hf_socks_ip6_dst, tvb, offset,
 334                                 16, FALSE);
 335                 offset += 16;
 336         }
 337
 338         return offset;
 339 }
 340
 341
 342 static int get_address_v5(tvbuff_t *tvb, int offset,
 343         socks_hash_entry_t *hash_info) {
 344
 345 /* decode the v5 address and return offset of next byte */
 346 /*XXX this needs to handle IPV6 and domain name addresses */
 347
 348
 349         int a_type = tvb_get_guint8(tvb, offset++);
 350
 351         if ( a_type == 1){              /* IPv4 address */
 352
 353                 if ( hash_info)
 354                         tvb_memcpy(tvb, (guint8 *)&hash_info->dst_addr,
 355                             offset, 4);
 356                 offset += 4;
 357         }
 358
 359         else if ( a_type == 4)          /* IPv6 address */
 360                 offset += 16;
 361
 362         else if ( a_type == 3)  /* domain name address */
 363                 offset += tvb_get_guint8(tvb, offset) + 1;
 364         return offset;
 365 }
 366
 367
 368 /********************* V5 UDP Associate handlers ***********************/
 369
 370 static void
 371 socks_udp_dissector(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
 372
 373 /* Conversation dissector called from UDP dissector. Decode and display */
 374 /* the socks header, the pass the rest of the data to the udp port      */
 375 /* decode routine to  handle the payload.                               */
 376
 377         int offset = 0;
 378         guint32 *ptr;
 379         socks_hash_entry_t *hash_info;
 380         conversation_t *conversation;
 381         proto_tree      *socks_tree;
 382         proto_item      *ti;
 383
 384         conversation = find_conversation( &pinfo->src, &pinfo->dst, pinfo->ptype,
 385                 pinfo->srcport, pinfo->destport, 0);
 386
 387         g_assert( conversation);        /* should always find a conversation */
 388
 389         hash_info = conversation_get_proto_data(conversation, proto_socks);
 390
 391         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 392                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Socks");
 393
 394         if (check_col(pinfo->cinfo, COL_INFO))
 395                 col_add_fstr(pinfo->cinfo, COL_INFO, "Version: 5, UDP Associated packet");
 396
 397         if ( tree) {
 398                 ti = proto_tree_add_protocol_format( tree, proto_socks, tvb,
 399                         offset, -1, "Socks" );
 400
 401                 socks_tree = proto_item_add_subtree(ti, ett_socks);
 402
 403                 proto_tree_add_text( socks_tree, tvb, offset, 2, "Reserved");
 404                 offset += 2;
 405
 406                 proto_tree_add_text( socks_tree, tvb, offset, 1, "Fragment Number: %d", tvb_get_guint8(tvb, offset));
 407                 ++offset;
 408
 409
 410                 offset = display_address( tvb, offset, socks_tree);
 411                 hash_info->udp_remote_port = tvb_get_ntohs(tvb, offset);
 412
 413                 proto_tree_add_uint( socks_tree, hf_socks_dstport, tvb,
 414                         offset, 2, hash_info->udp_remote_port);
 415
 416                 offset += 2;
 417         }
 418         else {          /* no tree, skip past the socks header */
 419                 offset += 3;
 420                 offset = get_address_v5( tvb, offset, 0) + 2;
 421         }
 422
 423
 424 /* set pi src/dst port and call the udp sub-dissector lookup */
 425
 426         if ( pinfo->srcport == hash_info->port)
 427                 ptr = &pinfo->destport;
 428         else
 429                 ptr = &pinfo->srcport;
 430
 431         *ptr = hash_info->udp_remote_port;
 432
 433         decode_udp_ports( tvb, offset, pinfo, tree, pinfo->srcport, pinfo->destport);
 434
 435         *ptr = hash_info->udp_port;
 436
 437 }
 438
 439
 440 static void
 441 new_udp_conversation( socks_hash_entry_t *hash_info, packet_info *pinfo){
 442
 443         conversation_t *conversation = conversation_new( &pinfo->src, &pinfo->dst,  PT_UDP,
 444                         hash_info->udp_port, hash_info->port, 0);
 445
 446         g_assert( conversation);
 447
 448         conversation_add_proto_data(conversation, proto_socks, hash_info);
 449         conversation_set_dissector(conversation, socks_udp_handle);
 450 }
 451
 452
 453
 454
 455 /**************** Protocol Tree Display routines  ******************/
 456
 457 static void
 458 display_socks_v4(tvbuff_t *tvb, int offset, packet_info *pinfo,
 459         proto_tree *tree, socks_hash_entry_t *hash_info) {
 460
 461
 462 /* Display the protocol tree for the V4 version. This routine uses the  */
 463 /* stored conversation information to decide what to do with the row.   */
 464 /* Per packet information would have been better to do this, but we     */
 465 /* didn't have that when I wrote this. And I didn't expect this to get  */
 466 /* so messy.                                                            */
 467
 468
 469         guint command;
 470
 471                                         /* Display command from client */
 472         if (compare_packet( hash_info->connect_row)){
 473
 474                 proto_tree_add_text( tree, tvb, offset, 1,
 475                                 "Version: %u ", hash_info->version);
 476                 ++offset;
 477                 command = tvb_get_guint8(tvb, offset);
 478
 479                 proto_tree_add_text( tree, tvb, offset, 1,
 480                         "Command: %u (%s)", command,
 481                                 get_command_name( command));
 482                 ++offset;
 483
 484                                                 /* Do remote port       */
 485                 proto_tree_add_item( tree, hf_socks_dstport, tvb, offset, 2,
 486                                 FALSE);
 487                 offset += 2;
 488
 489                                                 /* Do destination address */
 490                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset,
 491                                 4, FALSE);
 492
 493                 offset += 4;
 494
 495 /*XXX check this, needs to do length checking    */
 496 /* Should perhaps do TCP reassembly as well */
 497                 if ( tvb_offset_exists(tvb, offset)) {
 498                                                 /* display user name    */
 499                         proto_tree_add_string( tree, hf_user_name, tvb, offset,
 500                                 tvb_strsize(tvb, offset),
 501                                 tvb_get_ptr(tvb, offset, -1));
 502                 }
 503
 504         }
 505                                 /*Display command response from server*/
 506
 507         else if ( compare_packet( hash_info->cmd_reply_row)){
 508
 509                 proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1,
 510                                 FALSE);
 511                 ++offset;
 512                                                 /* Do results code      */
 513                 proto_tree_add_item( tree, hf_socks_results_4, tvb, offset, 1, FALSE);
 514                 proto_tree_add_item_hidden(tree, hf_socks_results, tvb, offset, 1, FALSE);
 515
 516                 ++offset;
 517
 518                                                 /* Do remote port       */
 519                 proto_tree_add_item( tree, hf_socks_dstport, tvb, offset, 2,
 520                                 FALSE);
 521                 offset += 2;
 522                                                 /* Do remote address    */
 523                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset, 4,
 524                         FALSE);
 525         }
 526
 527         else if ( compare_packet( hash_info->v4_user_name_row)){
 528
 529 /*XXX check this, needs to do length checking    */
 530 /* Should perhaps do TCP reassembly as well */
 531                 if ( tvb_offset_exists(tvb, offset)) {
 532                         proto_tree_add_text( tree, tvb, offset,
 533                                 tvb_strsize(tvb, offset),
 534                                 "User Name: %s", tvb_get_ptr(tvb, offset, -1));
 535                 }
 536         }
 537 }
 538
 539
 540 static void
 541 display_socks_v5(tvbuff_t *tvb, int offset, packet_info *pinfo,
 542         proto_tree *tree, socks_hash_entry_t *hash_info) {
 543
 544 /* Display the protocol tree for the version. This routine uses the     */
 545 /* stored conversation information to decide what to do with the row.   */
 546 /* Per packet information would have been better to do this, but we     */
 547 /* didn't have that when I wrote this. And I didn't expect this to get  */
 548 /* so messy.                                                            */
 549
 550         unsigned int i, command;
 551         guint temp;
 552         char *AuthMethodStr;
 553
 554
 555         if (compare_packet( hash_info->connect_row)){
 556
 557                 proto_tree      *AuthTree;
 558                 proto_item      *ti;
 559
 560                                                 /* Do version   */
 561                 proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1,
 562                                 hash_info->version);
 563                 ++offset;
 564
 565                 temp = tvb_get_guint8(tvb, offset);     /* Get Auth method count */
 566                                                         /* build auth tree */
 567                 ti = proto_tree_add_text( tree, tvb, offset, 1,
 568                                 "Client Authentication Methods");
 569
 570                 AuthTree = proto_item_add_subtree(ti, ett_socks_auth);
 571
 572                 proto_tree_add_text( AuthTree, tvb, offset, 1,
 573                                 "Count: %u ", temp);
 574                 ++offset;
 575
 576                 for( i = 0; i  < temp; ++i) {
 577
 578                         AuthMethodStr = get_auth_method_name(
 579                                 tvb_get_guint8( tvb, offset + i));
 580                         proto_tree_add_text( AuthTree, tvb, offset + i, 1,
 581                                 "Method[%d]: %u (%s)", i,
 582                                 tvb_get_guint8( tvb, offset + i), AuthMethodStr);
 583                 }
 584                 return;
 585         }                                       /* Get accepted auth method */
 586         else if (compare_packet( hash_info->auth_method_row)) {
 587
 588                 ++offset;
 589
 590                 proto_tree_add_text( tree, tvb, offset, 1,
 591                         "Accepted Auth Method: 0x%0x (%s)", tvb_get_guint8( tvb, offset),
 592                                 get_auth_method_name( tvb_get_guint8( tvb, offset)));
 593
 594                 return;
 595         }                                       /* handle user/password auth */
 596         else if (compare_packet( hash_info->user_name_auth_row)) {
 597
 598                 proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1, FALSE);
 599                 ++offset;
 600                                                 /* process user name    */
 601                 offset += display_string( tvb, offset, tree,
 602                                 "User name");
 603                                                 /* process password     */
 604                 offset += display_string( tvb, offset, tree,
 605                                 "Password");
 606         }
 607                                         /* command to the server */
 608                                         /* command response from server */
 609         else if ((compare_packet( hash_info->command_row)) ||
 610                  (compare_packet( hash_info->cmd_reply_row)) ||
 611                  (compare_packet( hash_info->bind_reply_row))){
 612
 613                 proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1, FALSE);
 614
 615                 ++offset;
 616
 617                 command = tvb_get_guint8(tvb, offset);
 618
 619                 if (compare_packet( hash_info->command_row))
 620                         proto_tree_add_uint( tree, hf_socks_cmd, tvb, offset, 1,
 621                             command);
 622
 623                 else {
 624                         proto_tree_add_item( tree, hf_socks_results_5, tvb, offset, 1, FALSE);
 625                         proto_tree_add_item_hidden(tree, hf_socks_results, tvb, offset, 1, FALSE);
 626                 }
 627
 628                 ++offset;
 629
 630                 proto_tree_add_text( tree, tvb, offset, 1,
 631                         "Reserved: 0x%0x (should = 0x00)", tvb_get_guint8(tvb, offset));
 632                 ++offset;
 633
 634                 offset = display_address(tvb, offset, tree);
 635 /*XXX Add remote port for search somehow */
 636                                                 /* Do remote port       */
 637                 proto_tree_add_text( tree, tvb, offset, 2,
 638                                 "%sPort: %d",
 639                                 (compare_packet( hash_info->bind_reply_row) ?
 640                                         "Remote Host " : ""),
 641                                  tvb_get_ntohs(tvb, offset));
 642         }
 643 }
 644
 645
 646
 647 /**************** Decoder State Machines ******************/
 648
 649
 650 static guint
 651 state_machine_v4( socks_hash_entry_t *hash_info, tvbuff_t *tvb,
 652         int offset, packet_info *pinfo) {
 653
 654 /* Decode V4 protocol.  This is done on the first pass through the      */
 655 /* list.  Based upon the current state, decode the packet and determine */
 656 /* what the next state should be.  If we had per packet information,    */
 657 /* this would be the place to load them up.                             */
 658
 659         if ( hash_info->state == None) {                /* new connection */
 660
 661                 if (check_col(pinfo->cinfo, COL_INFO))
 662                         col_append_str(pinfo->cinfo, COL_INFO, " Connect to server request");
 663
 664                 hash_info->state = Connecting;  /* change state         */
 665
 666                 hash_info->command = tvb_get_guint8(tvb, offset + 1);
 667                                                 /* get remote port      */
 668                 if ( hash_info->command == CONNECT_COMMAND)
 669                         hash_info->port =  tvb_get_ntohs(tvb, offset + 2);
 670                                                 /* get remote address   */
 671
 672                 tvb_memcpy(tvb, (guint8 *)&hash_info->dst_addr, offset + 4, 4);
 673
 674                                                 /* save the packet pointer */
 675                 hash_info->connect_row = get_packet_ptr;
 676
 677                                                 /* skip past this stuff */
 678                 hash_info->connect_offset = offset + 8;
 679
 680                 offset += 8;
 681
 682                 if ( !tvb_offset_exists(tvb, offset)) { /* if no user name */
 683                                                         /* change state */
 684                         hash_info->state = V4UserNameWait;
 685                         /*
 686                          * XXX - add 1, or leave it alone?
 687                          * We were adding "strlen(...) + 1".
 688                          */
 689                         hash_info->connect_offset += 1;
 690                 } else {
 691                         /*
 692                          * Add in the length of the user name.
 693                          * XXX - what if the user name is split between
 694                          * TCP segments?
 695                          */
 696                         hash_info->connect_offset += tvb_strsize(tvb, offset);
 697                 }
 698
 699                 if ( !hash_info->dst_addr){             /* if no dest address */
 700                                                         /* if more data */
 701                         if ( tvb_offset_exists(tvb, hash_info->connect_offset)) {
 702 /*XXX copy remote name here ??? */
 703                                 hash_info->state = Connecting;
 704                         }
 705                         else
 706                                 hash_info->state = V4NameWait;
 707                                                 }
 708                                                 /* waiting for V4 user name */
 709         }else if ( hash_info->state == V4UserNameWait){
 710
 711                 if (check_col(pinfo->cinfo, COL_INFO))
 712                         col_append_str(pinfo->cinfo, COL_INFO, " Connect Request (User name)");
 713
 714                 hash_info->v4_user_name_row = get_packet_ptr;
 715 /*XXX may need to check for domain name here */
 716                 hash_info->state = Connecting;
 717         }
 718                                         /* waiting for V4 domain name   */
 719         else if ( hash_info->state == V4NameWait){
 720
 721                 hash_info->v4_name_row = get_packet_ptr;
 722                 hash_info->state = Connecting;
 723
 724         }
 725         else if ( hash_info->state == Connecting){
 726
 727                 if (check_col(pinfo->cinfo, COL_INFO))
 728                         col_append_str(pinfo->cinfo, COL_INFO, " Connect Response");
 729
 730                                                 /* save packet pointer  */
 731                 hash_info->cmd_reply_row = get_packet_ptr;
 732                 hash_info->state = Done;                /* change state         */
 733                 offset = offset + 8;
 734         }
 735
 736         return offset;
 737 }
 738
 739
 740
 741 static void
 742 state_machine_v5( socks_hash_entry_t *hash_info, tvbuff_t *tvb,
 743         int offset, packet_info *pinfo) {
 744
 745 /* Decode V5 protocol.  This is done on the first pass through the      */
 746 /* list.  Based upon the current state, decode the packet and determine */
 747 /* what the next state should be.  If we had per packet information,    */
 748 /* this would be the place to load them up.                             */
 749
 750
 751         int temp;
 752
 753         if ( hash_info->state == None) {
 754
 755                 if (check_col(pinfo->cinfo, COL_INFO))
 756                         col_append_str(pinfo->cinfo, COL_INFO, " Connect to server request");
 757
 758                 hash_info->state = Connecting;  /* change state         */
 759                 hash_info->connect_row = get_packet_ptr;
 760
 761                 temp = tvb_get_guint8(tvb, offset + 1);
 762                                                 /* skip past auth methods */
 763                 offset = hash_info->connect_offset = offset + 1 + temp;
 764         }
 765         else if ( hash_info->state == Connecting){
 766
 767                 guint AuthMethod = tvb_get_guint8(tvb, offset + 1);
 768
 769                 if (check_col(pinfo->cinfo, COL_INFO))
 770                         col_append_str(pinfo->cinfo, COL_INFO, " Connect to server response");
 771
 772                 hash_info->auth_method_row = get_packet_ptr;
 773
 774                 if ( AuthMethod == NO_AUTHENTICATION)
 775                         hash_info->state = V5Command;
 776
 777                 else if ( AuthMethod == USER_NAME_AUTHENTICATION)
 778                         hash_info->state = UserNameAuth;
 779
 780                 else if ( AuthMethod == GSS_API_AUTHENTICATION)
 781 /*XXX should be this            hash_info->state = GssApiAuth; */
 782                         hash_info->state = Done;
 783
 784                 else    hash_info->state = Done;        /*Auth failed or error*/
 785
 786         }
 787
 788         else if ( hash_info->state == V5Command) {      /* Handle V5 Command */
 789
 790                 guint temp;
 791
 792                 hash_info->command = tvb_get_guint8(tvb, offset + 1); /* get command */
 793
 794                 if (check_col(pinfo->cinfo, COL_INFO))
 795                         col_append_fstr(pinfo->cinfo, COL_INFO, " Command Request - %s",
 796                                 get_command_name(hash_info->command));
 797
 798                 hash_info->state = V5Reply;
 799                 hash_info->command_row = get_packet_ptr;
 800
 801                 offset += 3;                    /* skip to address type */
 802
 803                 offset = get_address_v5(tvb, offset, hash_info);
 804
 805                 temp = tvb_get_guint8(tvb, offset);
 806
 807                 if (( hash_info->command == CONNECT_COMMAND) ||
 808                     ( hash_info->command == UDP_ASSOCIATE_COMMAND))
 809                                                 /* get remote port      */
 810                         hash_info->port =  tvb_get_ntohs(tvb, offset);
 811         }
 812
 813         else if ( hash_info->state == V5Reply) {        /* V5 Command Reply */
 814
 815
 816                 if (check_col(pinfo->cinfo, COL_INFO))
 817                         col_append_fstr(pinfo->cinfo, COL_INFO, " Command Response - %s",
 818                                 get_command_name(hash_info->command));
 819
 820                 hash_info->cmd_reply_row = get_packet_ptr;
 821
 822                 if (( hash_info->command == CONNECT_COMMAND) ||
 823                     (hash_info->command == PING_COMMAND) ||
 824                     (hash_info->command == TRACERT_COMMAND))
 825                         hash_info->state = Done;
 826
 827                 else if ( hash_info->command == BIND_COMMAND)
 828                         hash_info->state = V5BindReply;
 829
 830                 else if ( hash_info->command == UDP_ASSOCIATE_COMMAND){
 831                         offset += 3;            /* skip to address type */
 832                         offset = get_address_v5(tvb, offset, hash_info);
 833
 834         /* save server udp port and create udp conversation */
 835                         hash_info->udp_port =  tvb_get_ntohs(tvb, offset);
 836
 837                         if (!pinfo->fd->flags.visited)
 838                                 new_udp_conversation( hash_info, pinfo);
 839
 840 /*XXX may need else statement to handle unknows and generate error message */
 841
 842                 }
 843         }
 844         else if ( hash_info->state == V5BindReply) {    /* V5 Bind Second Reply */
 845
 846                 if (check_col(pinfo->cinfo, COL_INFO))
 847                         col_append_str(pinfo->cinfo, COL_INFO, " Command Response: Bind remote host info");
 848
 849                 hash_info->bind_reply_row = get_packet_ptr;
 850                 hash_info->state = Done;
 851         }
 852         else if ( hash_info->state == UserNameAuth) {   /* Handle V5 User Auth*/
 853                 if (check_col(pinfo->cinfo, COL_INFO))
 854                         col_append_str(pinfo->cinfo, COL_INFO,
 855                                 " User authentication response");
 856
 857                 hash_info->user_name_auth_row = get_packet_ptr;
 858                 hash_info->state = AuthReply;
 859
 860         }
 861         else if ( hash_info->state == AuthReply){       /* V5 User Auth reply */
 862                 hash_info->cmd_reply_row = get_packet_ptr;
 863                 if (check_col(pinfo->cinfo, COL_INFO))
 864                         col_append_str(pinfo->cinfo, COL_INFO, " User authentication reply");
 865                 hash_info->state = V5Command;
 866         }
 867 }
 868
 869
 870
 871 static void
 872 display_ping_and_tracert(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, socks_hash_entry_t *hash_info) {
 873
 874 /* Display the ping/trace_route conversation */
 875
 876
 877         const guchar    *data, *dataend;
 878         const guchar   *lineend, *eol;
 879         int             linelen;
 880
 881                                         /* handle the end command */
 882         if ( pinfo->destport == TCP_PORT_SOCKS){
 883                 if (check_col(pinfo->cinfo, COL_INFO))
 884                         col_append_str(pinfo->cinfo, COL_INFO, ", Terminate Request");
 885
 886                 if ( tree)
 887                         proto_tree_add_text(tree, tvb, offset, 1,
 888                                 (hash_info->command  == PING_COMMAND) ?
 889                                 "Ping: End command" :
 890                                 "Traceroute: End command");
 891         }
 892         else{           /* display the PING or Traceroute results */
 893                 if (check_col(pinfo->cinfo, COL_INFO))
 894                         col_append_str(pinfo->cinfo, COL_INFO, ", Results");
 895
 896                 if ( tree){
 897                         proto_tree_add_text(tree, tvb, offset, -1,
 898                                 (hash_info->command  == PING_COMMAND) ?
 899                                 "Ping Results:" :
 900                                 "Traceroute Results");
 901
 902                         data = tvb_get_ptr(tvb, offset, -1);
 903                         dataend = data + tvb_length_remaining(tvb, offset);
 904
 905                         while (data < dataend) {
 906
 907                                 lineend = find_line_end(data, dataend, &eol);
 908                                 linelen = lineend - data;
 909
 910                                 proto_tree_add_text( tree, tvb, offset, linelen,
 911                                         format_text(data, linelen));
 912                                 offset += linelen;
 913                                 data = lineend;
 914                         }
 915                 }
 916         }
 917 }
 918
 919
 920
 921 static void call_next_dissector(tvbuff_t *tvb, int offset, packet_info *pinfo,
 922         proto_tree *tree, socks_hash_entry_t *hash_info) {
 923
 924 /* Display the results for PING and TRACERT extensions or               */
 925 /* Call TCP dissector for the port that was passed during the           */
 926 /* connect process                                                      */
 927 /* Load pointer to pinfo->XXXport depending upon the direction,         */
 928 /* change pinfo port to the remote port, call next dissecotr to decode  */
 929 /* the payload, and restore the pinfo port after that is done.          */
 930
 931         guint32 *ptr;
 932
 933         if (( hash_info->command  == PING_COMMAND) ||
 934             ( hash_info->command  == TRACERT_COMMAND))
 935
 936                 display_ping_and_tracert(tvb, offset, pinfo, tree, hash_info);
 937
 938         else {          /* call the tcp port decoder to handle the payload */
 939
 940 /*XXX may want to load dest address here */
 941
 942                 if ( pinfo->destport  == TCP_PORT_SOCKS)
 943                         ptr = &pinfo->destport;
 944                 else
 945                         ptr = &pinfo->srcport;
 946
 947                 *ptr = hash_info->port;
 948                 decode_tcp_ports( tvb, offset, pinfo, tree, pinfo->srcport, pinfo->destport);
 949                 *ptr = TCP_PORT_SOCKS;
 950         }
 951 }
 952
 953
 954
 955 static void
 956 dissect_socks(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
 957
 958         int             offset = 0;
 959         proto_tree      *socks_tree;
 960         proto_item      *ti;
 961         socks_hash_entry_t *hash_info;
 962         conversation_t *conversation;
 963
 964         conversation = find_conversation( &pinfo->src, &pinfo->dst, pinfo->ptype,
 965                 pinfo->srcport, pinfo->destport, 0);
 966
 967         if ( !conversation){
 968                 conversation = conversation_new( &pinfo->src, &pinfo->dst, pinfo->ptype,
 969                         pinfo->srcport, pinfo->destport, 0);
 970         }
 971         hash_info = conversation_get_proto_data(conversation,proto_socks);
 972         if ( !hash_info){
 973                 hash_info = g_mem_chunk_alloc(socks_vals);
 974                 hash_info->start_done_row = G_MAXINT;
 975                 hash_info->state = None;
 976                 hash_info->port = 0;
 977                 hash_info->version = tvb_get_guint8(tvb, offset); /* get version*/
 978
 979                 if (( hash_info->version != 4) &&       /* error test version */
 980                    ( hash_info->version != 5))
 981                         hash_info->state = Done;
 982
 983                 conversation_add_proto_data(conversation, proto_socks,
 984                         hash_info);
 985
 986                                                 /* set dissector for now */
 987                 conversation_set_dissector(conversation, socks_handle);
 988         }
 989
 990 /* display summary window information  */
 991
 992         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 993                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Socks");
 994
 995         if (check_col(pinfo->cinfo, COL_INFO)){
 996                 if (( hash_info->version == 4) || ( hash_info->version == 5)){
 997                         col_add_fstr(pinfo->cinfo, COL_INFO, "Version: %d",
 998                                 hash_info->version);
 999                 }
1000                 else                    /* unknown version display error */
1001                         col_set_str(pinfo->cinfo, COL_INFO, "Unknown");
1002
1003
1004                 if ( hash_info->command == PING_COMMAND)
1005                         col_append_str(pinfo->cinfo, COL_INFO, ", Ping Req");
1006                 if ( hash_info->command == TRACERT_COMMAND)
1007                         col_append_str(pinfo->cinfo, COL_INFO, ", Traceroute Req");
1008
1009 /*XXX           if ( hash_info->port != -1) */
1010                 if ( hash_info->port != 0)
1011                         col_append_fstr(pinfo->cinfo, COL_INFO, ", Remote Port: %d",
1012                                 hash_info->port);
1013         }
1014
1015
1016 /* run state machine if needed */
1017
1018         if ((hash_info->state != Done) && ( !pinfo->fd->flags.visited)){
1019
1020                 if ( hash_info->version == 4)
1021                         state_machine_v4( hash_info, tvb, offset, pinfo);
1022
1023                 else if ( hash_info->version == 5)
1024                         state_machine_v5( hash_info, tvb, offset, pinfo);
1025
1026                 if (hash_info->state == Done) {         /* if done now  */
1027                         hash_info->start_done_row = pinfo->fd->num;
1028                 }
1029         }
1030
1031 /* if proto tree, decode and display */
1032
1033         if (tree) {
1034                 ti = proto_tree_add_item( tree, proto_socks, tvb, offset, -1,
1035                         FALSE );
1036
1037                 socks_tree = proto_item_add_subtree(ti, ett_socks);
1038
1039                 if ( hash_info->version == 4)
1040                         display_socks_v4(tvb, offset, pinfo, socks_tree,
1041                                 hash_info);
1042
1043                 else if ( hash_info->version == 5)
1044                         display_socks_v5(tvb, offset, pinfo, socks_tree,
1045                                 hash_info);
1046
1047                                 /* if past startup, add the faked stuff */
1048                 if ( pinfo->fd->num >  hash_info->start_done_row){
1049                                                 /*  add info to tree */
1050                         proto_tree_add_text( socks_tree, tvb, offset, 0,
1051                                 "Command: %d (%s)", hash_info->command,
1052                                 get_command_name(hash_info->command));
1053
1054                         proto_tree_add_ipv4( socks_tree, hf_socks_ip_dst, tvb,
1055                                         offset, 0, hash_info->dst_addr);
1056
1057                                 /* no fake address for ping & traceroute */
1058
1059                         if (( hash_info->command != PING_COMMAND) &&
1060                             ( hash_info->command != TRACERT_COMMAND)){
1061                                 proto_tree_add_uint( socks_tree, hf_socks_dstport, tvb,
1062                                         offset, 0, hash_info->port);
1063                         }
1064                 }
1065
1066         }
1067
1068
1069 /* call next dissector if ready */
1070
1071         if ( pinfo->fd->num > hash_info->start_done_row){
1072                 call_next_dissector(tvb, offset, pinfo, tree, hash_info);
1073         }
1074 }
1075
1076
1077
1078 static void socks_reinit( void){
1079
1080 /* Do the cleanup work when a new pass through the packet list is       */
1081 /* performed. Reset the highest row seen counter and re-initialize the  */
1082 /* conversation memory chunks.                                          */
1083
1084         if (socks_vals)
1085                 g_mem_chunk_destroy(socks_vals);
1086
1087         socks_vals = g_mem_chunk_new("socks_vals", socks_hash_val_length,
1088                 socks_hash_init_count * socks_hash_val_length,
1089                 G_ALLOC_AND_FREE);
1090 }
1091
1092
1093 void
1094 proto_register_socks( void){
1095
1096 /*** Prep the socks protocol, register it and a initialization routine  */
1097 /*      to clear the hash stuff.                                        */
1098
1099
1100         static gint *ett[] = {
1101                 &ett_socks,
1102                 &ett_socks_auth,
1103                 &ett_socks_name
1104
1105         };
1106
1107         static hf_register_info hf[] = {
1108
1109
1110                 { &hf_socks_ver,
1111                         { "Version", "socks.version", FT_UINT8, BASE_DEC, NULL,
1112                                 0x0, "", HFILL
1113                         }
1114                 },
1115                 { &hf_socks_ip_dst,
1116                         { "Remote Address", "socks.dst", FT_IPv4, BASE_NONE, NULL,
1117                                 0x0, "", HFILL
1118                         }
1119                 },
1120                 { &hf_socks_ip6_dst,
1121                         { "Remote Address(ipv6)", "socks.dstV6", FT_IPv6, BASE_NONE, NULL,
1122                                 0x0, "", HFILL
1123                         }
1124                 },
1125
1126                 { &hf_user_name,
1127                         { "User Name", "socks.username", FT_STRING, BASE_NONE,
1128                                  NULL, 0x0, "", HFILL
1129                         }
1130                 },
1131                 { &hf_socks_dstport,
1132                         { "Remote Port", "socks.dstport", FT_UINT16,
1133                                 BASE_DEC, NULL, 0x0, "", HFILL
1134                         }
1135                 },
1136                 { &hf_socks_cmd,
1137                         { "Command", "socks.command", FT_UINT8,
1138                                 BASE_DEC,  VALS(cmd_strings), 0x0, "", HFILL
1139                         }
1140                 },
1141                 { &hf_socks_results_4,
1142                         { "Results(V4)", "socks.results_v4", FT_UINT8,
1143                                 BASE_DEC, VALS(reply_table_v4), 0x0, "", HFILL
1144                         }
1145                 },
1146                 { &hf_socks_results_5,
1147                         { "Results(V5)", "socks.results_v5", FT_UINT8,
1148                                 BASE_DEC, VALS(reply_table_v5), 0x0, "", HFILL
1149                         }
1150                 },
1151                 { &hf_socks_results,
1152                         { "Results(V5)", "socks.results", FT_UINT8,
1153                                 BASE_DEC, NULL, 0x0, "", HFILL
1154                         }
1155                 }
1156
1157         };
1158
1159
1160         proto_socks = proto_register_protocol (
1161                 "Socks Protocol", "Socks", "socks");
1162
1163         proto_register_field_array(proto_socks, hf, array_length(hf));
1164         proto_register_subtree_array(ett, array_length(ett));
1165
1166         register_init_routine( &socks_reinit);  /* register re-init routine */
1167
1168         socks_udp_handle = create_dissector_handle(socks_udp_dissector,
1169             proto_socks);
1170         socks_handle = create_dissector_handle(dissect_socks, proto_socks);
1171 }
1172
1173
1174 void
1175 proto_reg_handoff_socks(void) {
1176
1177         /* dissector install routine */
1178
1179         dissector_add("tcp.port", TCP_PORT_SOCKS, socks_handle);
1180 }