packet-socks.c

   1 /* packet-socks.c
   2  * Routines for socks versions 4 &5  packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * $Id: packet-socks.c,v 1.58 2004/02/12 21:04:05 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  *
  25  *
  26  * The Version 4 decode is based on SOCKS4.protocol and SOCKS4A.protocol.
  27  * The Version 5 decoder is based upon rfc-1928
  28  * The Version 5 User/Password authentication is based on rfc-1929.
  29  *
  30  * See
  31  *
  32  *      http://www.socks.permeo.com/TechnicalResources/ProtocolDocuments.asp
  33  *
  34  * for these and other documents.
  35  *
  36  * Revisions:
  37  *
  38  * 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel
  39  *                      causing heap overflow because of an infinite loop
  40  *                      where the socks dissect was call over and over.
  41  *
  42  *                      Also remove some old code marked with __JUNK__
  43  *
  44  * 2001-01-08 JCFoster Fixed problem with NULL pointer for hash data.
  45  *                      Now test and exit if hash_info is null.
  46  */
  47
  48 /* Possible enhancements -
  49  *
  50  * Add GSS-API authentication per rfc-1961
  51  * Add CHAP authentication
  52  * Decode FLAG bits per
  53  *      http://archive.socks.permeo.com/draft/draft-ietf-aft-socks-pro-v5-04.txt
  54  * In call_next_dissector, could load the destination address into
  55  *      pinfo->src or pinfo->dst structure before calling next dissector.
  56  * remove display_string or at least make it use protocol identifiers
  57  * socks_hash_entry_t needs to handle V5 address type and domain names
  58 */
  59
  60
  61
  62
  63 #ifdef HAVE_CONFIG_H
  64 # include "config.h"
  65 #endif
  66
  67
  68 #include <stdio.h>
  69 #include <string.h>
  70 #include <glib.h>
  71
  72 #include <epan/packet.h>
  73 #include <epan/resolv.h>
  74 #include <epan/conversation.h>
  75
  76 #include "packet-tcp.h"
  77 #include "packet-udp.h"
  78 #include <epan/strutil.h>
  79
  80
  81 #define compare_packet(X) (X == (pinfo->fd->num))
  82 #define get_packet_ptr  (pinfo->fd->num)
  83 #define row_pointer_type guint32
  84
  85 #define TCP_PORT_SOCKS 1080
  86
  87
  88 /**************** Socks commands ******************/
  89
  90 #define CONNECT_COMMAND         1
  91 #define BIND_COMMAND            2
  92 #define UDP_ASSOCIATE_COMMAND   3
  93 #define PING_COMMAND            0x80
  94 #define TRACERT_COMMAND         0x81
  95
  96
  97 /********** V5 Authentication methods *************/
  98
  99 #define NO_AUTHENTICATION       0
 100 #define GSS_API_AUTHENTICATION  1
 101 #define USER_NAME_AUTHENTICATION        2
 102 #define CHAP_AUTHENTICATION     3
 103 #define AUTHENTICATION_FAILED   0xff
 104
 105 /* 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel */
 106
 107 static int in_socks_dissector_flag = 0;         /* set to 1 to avoid recursive overflow */
 108
 109 /*********** Header field identifiers *************/
 110
 111 static int proto_socks = -1;
 112
 113 static int ett_socks = -1;
 114 static int ett_socks_auth = -1;
 115 static int ett_socks_name = -1;
 116
 117 static int hf_socks_ver = -1;
 118 static int hf_socks_ip_dst = -1;
 119 static int hf_socks_ip6_dst = -1;
 120 static int hf_user_name = -1;
 121 static int hf_socks_dstport = -1;
 122 static int hf_socks_cmd = -1;
 123 static int hf_socks_results = -1;
 124 static int hf_socks_results_4 = -1;
 125 static int hf_socks_results_5 = -1;
 126
 127
 128 /************* Dissector handles ***********/
 129
 130 static dissector_handle_t socks_handle;
 131 static dissector_handle_t socks_udp_handle;
 132
 133 /************* State Machine names ***********/
 134
 135 enum SockState {
 136         None = 0,
 137         Connecting,
 138         V4UserNameWait,
 139         V4NameWait,
 140         V5Command,
 141         V5Reply,
 142         V5BindReply,
 143         UserNameAuth,
 144         UserNameAuthReply,
 145         GssApiAuth,
 146         AuthReply,
 147         Done
 148 };
 149
 150
 151
 152 typedef struct {
 153         int             state;
 154         int             version;
 155         int             command;
 156         int             grant;
 157         guint32         port;
 158         guint32         udp_port;
 159         guint32         udp_remote_port;
 160
 161         int             connect_offset;
 162         row_pointer_type        v4_name_row;
 163         row_pointer_type        v4_user_name_row;
 164         row_pointer_type        connect_row;
 165         row_pointer_type        cmd_reply_row;
 166         row_pointer_type        bind_reply_row;
 167         row_pointer_type        command_row;
 168         row_pointer_type        auth_method_row;
 169         row_pointer_type        user_name_auth_row;
 170         row_pointer_type        auth_version;
 171         guint32 start_done_row;
 172
 173         guint32 dst_addr;       /* this needs to handle IPv6 */
 174 }socks_hash_entry_t;
 175
 176
 177
 178
 179 static char *address_type_table[] = {
 180         "Unknown",
 181         "IPv4",
 182         "Unknown",
 183         "Domain Name",
 184         "IPv6",
 185         "Unknown"
 186 };
 187
 188
 189 /* String table for the V4 reply status messages */
 190
 191 static const value_string reply_table_v4[] = {
 192         {90, "Granted"},
 193         {91, "Rejected or Failed"},
 194         {92, "Rejected because SOCKS server cannot connect to identd on the client"},
 195         {93, "Rejected because the client program and identd report different user-ids"},
 196         {0, NULL}
 197 };
 198
 199 /* String table for the V5 reply status messages */
 200
 201 static const value_string reply_table_v5[] = {
 202         {0, "Succeeded"},
 203         {1, "General SOCKS server failure"},
 204         {2, "Connection not allowed by ruleset"},
 205         {3, "Network unreachable"},
 206         {4, "Host unreachable"},
 207         {5, "Connection refused"},
 208         {6, "TTL expired"},
 209         {7, "Command not supported"},
 210         {8, "Address type not supported"},
 211         {0, NULL},
 212 };
 213
 214 static const value_string cmd_strings[] = {
 215         {0, "Unknow"},
 216         {1, "Connect"},
 217         {2, "Bind"},
 218         {3, "UdpAssociate"},
 219         {0x80, "Ping"},
 220         {0x81, "Traceroute"},
 221         {0, NULL}
 222 };
 223
 224 #define socks_hash_init_count 20
 225 #define socks_hash_val_length (sizeof(socks_hash_entry_t))
 226
 227 static GMemChunk *socks_vals = NULL;
 228
 229
 230 /************************* Support routines ***************************/
 231
 232
 233 static int display_string(tvbuff_t *tvb, int offset,
 234         proto_tree *tree, char *label){
 235
 236 /* display a string with a length, characters encoding */
 237 /* they are displayed under a tree with the name in Label variable */
 238 /* return the length of the string and the length byte */
 239
 240
 241         proto_tree      *name_tree;
 242         proto_item      *ti;
 243
 244         char temp[ 256];
 245         int length = tvb_get_guint8(tvb, offset);
 246
 247         tvb_memcpy(tvb, (guint8 *)temp, offset+1, length);
 248         temp[ length ] = 0;
 249
 250         ti = proto_tree_add_text(tree, tvb, offset, length + 1,
 251                 "%s: %s" , label, temp);
 252
 253
 254         name_tree = proto_item_add_subtree(ti, ett_socks_name);
 255
 256         proto_tree_add_text( name_tree, tvb, offset, 1, "Length: %u", length);
 257
 258         ++offset;
 259
 260         proto_tree_add_text( name_tree, tvb, offset, length, "String: %s", temp);
 261
 262         return length + 1;
 263 }
 264
 265
 266
 267 static char *get_auth_method_name( guint Number){
 268
 269 /* return the name of the authenication method */
 270
 271         if ( Number == 0) return "No authentication";
 272         if ( Number == 1) return "GSSAPI";
 273         if ( Number == 2) return "Username/Password";
 274         if ( Number == 3) return "Chap";
 275         if (( Number >= 4) && ( Number <= 0x7f))return "IANA assigned";
 276         if (( Number >= 0x80) && ( Number <= 0xfe)) return "private method";
 277         if ( Number == 0xff) return "no acceptable method";
 278
 279         /* shouldn't reach here */
 280
 281         return "Bad method number (not 0-0xff)";
 282 }
 283
 284
 285 static char *get_command_name( guint Number){
 286
 287 /* return the name of the command as a string */
 288
 289         if ( Number == 0) return "Unknow";
 290         if ( Number == 1) return "Connect";
 291         if ( Number == 2) return "Bind";
 292         if ( Number == 3) return "UdpAssociate";
 293         if ( Number == 0x80) return "Ping";
 294         if ( Number == 0x81) return "Traceroute";
 295         return "Unknown";
 296 }
 297
 298
 299 static int display_address(tvbuff_t *tvb, int offset, proto_tree *tree) {
 300
 301 /* decode and display the v5 address, return offset of next byte */
 302
 303         int a_type = tvb_get_guint8(tvb, offset);
 304
 305         proto_tree_add_text( tree, tvb, offset, 1,
 306                         "Address Type: %d (%s)", a_type,
 307                         address_type_table[ MIN( (guint) a_type,
 308                                 array_length( address_type_table)-1) ]);
 309
 310         ++offset;
 311
 312         if ( a_type == 1){              /* IPv4 address */
 313                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset,
 314                                         4, FALSE);
 315                 offset += 4;
 316         }
 317         else if ( a_type == 3){ /* domain name address */
 318
 319                 offset += display_string(tvb, offset, tree,
 320                         "Remote name");
 321         }
 322         else if ( a_type == 4){ /* IPv6 address */
 323                 proto_tree_add_item( tree, hf_socks_ip6_dst, tvb, offset,
 324                                 16, FALSE);
 325                 offset += 16;
 326         }
 327
 328         return offset;
 329 }
 330
 331
 332 static int get_address_v5(tvbuff_t *tvb, int offset,
 333         socks_hash_entry_t *hash_info) {
 334
 335 /* decode the v5 address and return offset of next byte */
 336 /*XXX this needs to handle IPV6 and domain name addresses */
 337
 338
 339         int a_type = tvb_get_guint8(tvb, offset++);
 340
 341         if ( a_type == 1){              /* IPv4 address */
 342
 343                 if ( hash_info)
 344                         tvb_memcpy(tvb, (guint8 *)&hash_info->dst_addr,
 345                             offset, 4);
 346                 offset += 4;
 347         }
 348
 349         else if ( a_type == 4)          /* IPv6 address */
 350                 offset += 16;
 351
 352         else if ( a_type == 3)  /* domain name address */
 353                 offset += tvb_get_guint8(tvb, offset) + 1;
 354         return offset;
 355 }
 356
 357
 358 /********************* V5 UDP Associate handlers ***********************/
 359
 360 static void
 361 socks_udp_dissector(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
 362
 363 /* Conversation dissector called from UDP dissector. Decode and display */
 364 /* the socks header, the pass the rest of the data to the udp port      */
 365 /* decode routine to  handle the payload.                               */
 366
 367         int offset = 0;
 368         guint32 *ptr;
 369         socks_hash_entry_t *hash_info;
 370         conversation_t *conversation;
 371         proto_tree      *socks_tree;
 372         proto_item      *ti;
 373
 374         conversation = find_conversation( &pinfo->src, &pinfo->dst, pinfo->ptype,
 375                 pinfo->srcport, pinfo->destport, 0);
 376
 377         g_assert( conversation);        /* should always find a conversation */
 378
 379         hash_info = conversation_get_proto_data(conversation, proto_socks);
 380
 381         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 382                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Socks");
 383
 384         if (check_col(pinfo->cinfo, COL_INFO))
 385                 col_add_fstr(pinfo->cinfo, COL_INFO, "Version: 5, UDP Associated packet");
 386
 387         if ( tree) {
 388                 ti = proto_tree_add_protocol_format( tree, proto_socks, tvb,
 389                         offset, -1, "Socks" );
 390
 391                 socks_tree = proto_item_add_subtree(ti, ett_socks);
 392
 393                 proto_tree_add_text( socks_tree, tvb, offset, 2, "Reserved");
 394                 offset += 2;
 395
 396                 proto_tree_add_text( socks_tree, tvb, offset, 1, "Fragment Number: %u", tvb_get_guint8(tvb, offset));
 397                 ++offset;
 398
 399
 400                 offset = display_address( tvb, offset, socks_tree);
 401                 hash_info->udp_remote_port = tvb_get_ntohs(tvb, offset);
 402
 403                 proto_tree_add_uint( socks_tree, hf_socks_dstport, tvb,
 404                         offset, 2, hash_info->udp_remote_port);
 405
 406                 offset += 2;
 407         }
 408         else {          /* no tree, skip past the socks header */
 409                 offset += 3;
 410                 offset = get_address_v5( tvb, offset, 0) + 2;
 411         }
 412
 413
 414 /* set pi src/dst port and call the udp sub-dissector lookup */
 415
 416         if ( pinfo->srcport == hash_info->port)
 417                 ptr = &pinfo->destport;
 418         else
 419                 ptr = &pinfo->srcport;
 420
 421         *ptr = hash_info->udp_remote_port;
 422
 423         decode_udp_ports( tvb, offset, pinfo, tree, pinfo->srcport, pinfo->destport, -1);
 424
 425         *ptr = hash_info->udp_port;
 426
 427 }
 428
 429
 430 static void
 431 new_udp_conversation( socks_hash_entry_t *hash_info, packet_info *pinfo){
 432
 433         conversation_t *conversation = conversation_new( &pinfo->src, &pinfo->dst,  PT_UDP,
 434                         hash_info->udp_port, hash_info->port, 0);
 435
 436         g_assert( conversation);
 437
 438         conversation_add_proto_data(conversation, proto_socks, hash_info);
 439         conversation_set_dissector(conversation, socks_udp_handle);
 440 }
 441
 442
 443
 444
 445 /**************** Protocol Tree Display routines  ******************/
 446
 447 static void
 448 display_socks_v4(tvbuff_t *tvb, int offset, packet_info *pinfo,
 449         proto_tree *tree, socks_hash_entry_t *hash_info) {
 450
 451
 452 /* Display the protocol tree for the V4 version. This routine uses the  */
 453 /* stored conversation information to decide what to do with the row.   */
 454 /* Per packet information would have been better to do this, but we     */
 455 /* didn't have that when I wrote this. And I didn't expect this to get  */
 456 /* so messy.                                                            */
 457
 458
 459         guint command;
 460
 461                                         /* Display command from client */
 462         if (compare_packet( hash_info->connect_row)){
 463
 464                 proto_tree_add_text( tree, tvb, offset, 1,
 465                                 "Version: %u", hash_info->version);
 466                 ++offset;
 467                 command = tvb_get_guint8(tvb, offset);
 468
 469                 proto_tree_add_text( tree, tvb, offset, 1,
 470                         "Command: %u (%s)", command,
 471                                 get_command_name( command));
 472                 ++offset;
 473
 474                                                 /* Do remote port       */
 475                 proto_tree_add_item( tree, hf_socks_dstport, tvb, offset, 2,
 476                                 FALSE);
 477                 offset += 2;
 478
 479                                                 /* Do destination address */
 480                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset,
 481                                 4, FALSE);
 482
 483                 offset += 4;
 484
 485 /*XXX check this, needs to do length checking    */
 486 /* Should perhaps do TCP reassembly as well */
 487                 if ( tvb_offset_exists(tvb, offset)) {
 488                                                 /* display user name    */
 489                         proto_tree_add_string( tree, hf_user_name, tvb, offset,
 490                                 tvb_strsize(tvb, offset),
 491                                 tvb_get_ptr(tvb, offset, -1));
 492                 }
 493
 494         }
 495                                 /*Display command response from server*/
 496
 497         else if ( compare_packet( hash_info->cmd_reply_row)){
 498
 499                 proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1,
 500                                 FALSE);
 501                 ++offset;
 502                                                 /* Do results code      */
 503                 proto_tree_add_item( tree, hf_socks_results_4, tvb, offset, 1, FALSE);
 504                 proto_tree_add_item_hidden(tree, hf_socks_results, tvb, offset, 1, FALSE);
 505
 506                 ++offset;
 507
 508                                                 /* Do remote port       */
 509                 proto_tree_add_item( tree, hf_socks_dstport, tvb, offset, 2,
 510                                 FALSE);
 511                 offset += 2;
 512                                                 /* Do remote address    */
 513                 proto_tree_add_item( tree, hf_socks_ip_dst, tvb, offset, 4,
 514                         FALSE);
 515         }
 516
 517         else if ( compare_packet( hash_info->v4_user_name_row)){
 518
 519 /*XXX check this, needs to do length checking    */
 520 /* Should perhaps do TCP reassembly as well */
 521                 if ( tvb_offset_exists(tvb, offset)) {
 522                         proto_tree_add_text( tree, tvb, offset,
 523                                 tvb_strsize(tvb, offset),
 524                                 "User Name: %s", tvb_get_ptr(tvb, offset, -1));
 525                 }
 526         }
 527 }
 528
 529
 530 static void
 531 display_socks_v5(tvbuff_t *tvb, int offset, packet_info *pinfo,
 532         proto_tree *tree, socks_hash_entry_t *hash_info) {
 533
 534 /* Display the protocol tree for the version. This routine uses the     */
 535 /* stored conversation information to decide what to do with the row.   */
 536 /* Per packet information would have been better to do this, but we     */
 537 /* didn't have that when I wrote this. And I didn't expect this to get  */
 538 /* so messy.                                                            */
 539
 540         unsigned int i, command;
 541         guint temp;
 542         char *AuthMethodStr;
 543         guint8 auth_status;
 544
 545         proto_tree_add_item( tree, hf_socks_ver, tvb, offset, 1, FALSE);
 546         ++offset;
 547
 548         if (compare_packet( hash_info->connect_row)){
 549
 550                 proto_tree      *AuthTree;
 551                 proto_item      *ti;
 552
 553                 temp = tvb_get_guint8(tvb, offset);     /* Get Auth method count */
 554                                                         /* build auth tree */
 555                 ti = proto_tree_add_text( tree, tvb, offset, -1,
 556                                 "Client Authentication Methods");
 557
 558                 AuthTree = proto_item_add_subtree(ti, ett_socks_auth);
 559
 560                 proto_tree_add_text( AuthTree, tvb, offset, 1,
 561                                 "Count: %u", temp);
 562                 ++offset;
 563
 564                 for( i = 0; i  < temp; ++i) {
 565
 566                         AuthMethodStr = get_auth_method_name(
 567                                 tvb_get_guint8( tvb, offset));
 568                         proto_tree_add_text( AuthTree, tvb, offset, 1,
 569                                 "Method[%u]: %u (%s)", i,
 570                                 tvb_get_guint8( tvb, offset), AuthMethodStr);
 571                         ++offset;
 572                 }
 573                 proto_item_set_end( ti, tvb, offset);
 574                 return;
 575         }                                       /* Get accepted auth method */
 576         else if (compare_packet( hash_info->auth_method_row)) {
 577
 578                 proto_tree_add_text( tree, tvb, offset, 1,
 579                         "Accepted Auth Method: 0x%0x (%s)", tvb_get_guint8( tvb, offset),
 580                                 get_auth_method_name( tvb_get_guint8( tvb, offset)));
 581
 582                 return;
 583         }                                       /* handle user/password auth */
 584         else if (compare_packet( hash_info->user_name_auth_row)) {
 585
 586                                                 /* process user name    */
 587                 offset += display_string( tvb, offset, tree,
 588                                 "User name");
 589                                                 /* process password     */
 590                 offset += display_string( tvb, offset, tree,
 591                                 "Password");
 592         }
 593                                         /* command to the server */
 594                                         /* command response from server */
 595         else if (compare_packet( hash_info->auth_version)) {
 596                 auth_status = tvb_get_guint8(tvb, offset);
 597                 if(auth_status != 0)
 598                         proto_tree_add_text( tree, tvb, offset, 1, "Status: %u (failure)", auth_status);
 599                 else
 600                         proto_tree_add_text( tree, tvb, offset, 1, "Status: success");
 601                 offset ++;
 602         }
 603         else if ((compare_packet( hash_info->command_row)) ||
 604                  (compare_packet( hash_info->cmd_reply_row)) ||
 605                  (compare_packet( hash_info->bind_reply_row))){
 606
 607                 command = tvb_get_guint8(tvb, offset);
 608
 609                 if (compare_packet( hash_info->command_row))
 610                         proto_tree_add_uint( tree, hf_socks_cmd, tvb, offset, 1,
 611                             command);
 612
 613                 else {
 614                         proto_tree_add_item( tree, hf_socks_results_5, tvb, offset, 1, FALSE);
 615                         proto_tree_add_item_hidden(tree, hf_socks_results, tvb, offset, 1, FALSE);
 616                 }
 617
 618                 ++offset;
 619
 620                 proto_tree_add_text( tree, tvb, offset, 1,
 621                         "Reserved: 0x%0x (should = 0x00)", tvb_get_guint8(tvb, offset));
 622                 ++offset;
 623
 624                 offset = display_address(tvb, offset, tree);
 625 /*XXX Add remote port for search somehow */
 626                                                 /* Do remote port       */
 627                 proto_tree_add_text( tree, tvb, offset, 2,
 628                                 "%sPort: %u",
 629                                 (compare_packet( hash_info->bind_reply_row) ?
 630                                         "Remote Host " : ""),
 631                                  tvb_get_ntohs(tvb, offset));
 632         }
 633 }
 634
 635
 636
 637 /**************** Decoder State Machines ******************/
 638
 639
 640 static guint
 641 state_machine_v4( socks_hash_entry_t *hash_info, tvbuff_t *tvb,
 642         int offset, packet_info *pinfo) {
 643
 644 /* Decode V4 protocol.  This is done on the first pass through the      */
 645 /* list.  Based upon the current state, decode the packet and determine */
 646 /* what the next state should be.  If we had per packet information,    */
 647 /* this would be the place to load them up.                             */
 648
 649         if ( hash_info->state == None) {                /* new connection */
 650
 651                 if (check_col(pinfo->cinfo, COL_INFO))
 652                         col_append_str(pinfo->cinfo, COL_INFO, " Connect to server request");
 653
 654                 hash_info->state = Connecting;  /* change state         */
 655
 656                 hash_info->command = tvb_get_guint8(tvb, offset + 1);
 657                                                 /* get remote port      */
 658                 if ( hash_info->command == CONNECT_COMMAND)
 659                         hash_info->port =  tvb_get_ntohs(tvb, offset + 2);
 660                                                 /* get remote address   */
 661
 662                 tvb_memcpy(tvb, (guint8 *)&hash_info->dst_addr, offset + 4, 4);
 663
 664                                                 /* save the packet pointer */
 665                 hash_info->connect_row = get_packet_ptr;
 666
 667                                                 /* skip past this stuff */
 668                 hash_info->connect_offset = offset + 8;
 669
 670                 offset += 8;
 671
 672                 if ( !tvb_offset_exists(tvb, offset)) { /* if no user name */
 673                                                         /* change state */
 674                         hash_info->state = V4UserNameWait;
 675                         /*
 676                          * XXX - add 1, or leave it alone?
 677                          * We were adding "strlen(...) + 1".
 678                          */
 679                         hash_info->connect_offset += 1;
 680                 } else {
 681                         /*
 682                          * Add in the length of the user name.
 683                          * XXX - what if the user name is split between
 684                          * TCP segments?
 685                          */
 686                         hash_info->connect_offset += tvb_strsize(tvb, offset);
 687                 }
 688
 689                 if ( !hash_info->dst_addr){             /* if no dest address */
 690                                                         /* if more data */
 691                         if ( tvb_offset_exists(tvb, hash_info->connect_offset)) {
 692 /*XXX copy remote name here ??? */
 693                                 hash_info->state = Connecting;
 694                         }
 695                         else
 696                                 hash_info->state = V4NameWait;
 697                                                 }
 698                                                 /* waiting for V4 user name */
 699         }else if ( hash_info->state == V4UserNameWait){
 700
 701                 if (check_col(pinfo->cinfo, COL_INFO))
 702                         col_append_str(pinfo->cinfo, COL_INFO, " Connect Request (User name)");
 703
 704                 hash_info->v4_user_name_row = get_packet_ptr;
 705 /*XXX may need to check for domain name here */
 706                 hash_info->state = Connecting;
 707         }
 708                                         /* waiting for V4 domain name   */
 709         else if ( hash_info->state == V4NameWait){
 710
 711                 hash_info->v4_name_row = get_packet_ptr;
 712                 hash_info->state = Connecting;
 713
 714         }
 715         else if ( hash_info->state == Connecting){
 716
 717                 if (check_col(pinfo->cinfo, COL_INFO))
 718                         col_append_str(pinfo->cinfo, COL_INFO, " Connect Response");
 719
 720                                                 /* save packet pointer  */
 721                 hash_info->cmd_reply_row = get_packet_ptr;
 722                 hash_info->state = Done;                /* change state         */
 723                 offset = offset + 8;
 724         }
 725
 726         return offset;
 727 }
 728
 729
 730
 731 static void
 732 state_machine_v5( socks_hash_entry_t *hash_info, tvbuff_t *tvb,
 733         int offset, packet_info *pinfo) {
 734
 735 /* Decode V5 protocol.  This is done on the first pass through the      */
 736 /* list.  Based upon the current state, decode the packet and determine */
 737 /* what the next state should be.  If we had per packet information,    */
 738 /* this would be the place to load them up.                             */
 739
 740
 741         int temp;
 742
 743         if ( hash_info->state == None) {
 744
 745                 if (check_col(pinfo->cinfo, COL_INFO))
 746                         col_append_str(pinfo->cinfo, COL_INFO, " Connect to server request");
 747
 748                 hash_info->state = Connecting;  /* change state         */
 749                 hash_info->connect_row = get_packet_ptr;
 750
 751                 temp = tvb_get_guint8(tvb, offset + 1);
 752                                                 /* skip past auth methods */
 753                 offset = hash_info->connect_offset = offset + 1 + temp;
 754         }
 755         else if ( hash_info->state == Connecting){
 756
 757                 guint AuthMethod = tvb_get_guint8(tvb, offset + 1);
 758
 759                 if (check_col(pinfo->cinfo, COL_INFO))
 760                         col_append_str(pinfo->cinfo, COL_INFO, " Connect to server response");
 761
 762                 hash_info->auth_method_row = get_packet_ptr;
 763
 764                 if ( AuthMethod == NO_AUTHENTICATION)
 765                         hash_info->state = V5Command;
 766
 767                 else if ( AuthMethod == USER_NAME_AUTHENTICATION)
 768                         hash_info->state = UserNameAuth;
 769
 770                 else if ( AuthMethod == GSS_API_AUTHENTICATION)
 771 /*XXX should be this            hash_info->state = GssApiAuth; */
 772                         hash_info->state = Done;
 773
 774                 else    hash_info->state = Done;        /*Auth failed or error*/
 775
 776         }
 777
 778         else if ( hash_info->state == V5Command) {      /* Handle V5 Command */
 779
 780                 guint temp;
 781
 782                 hash_info->command = tvb_get_guint8(tvb, offset + 1); /* get command */
 783
 784                 if (check_col(pinfo->cinfo, COL_INFO))
 785                         col_append_fstr(pinfo->cinfo, COL_INFO, " Command Request - %s",
 786                                 get_command_name(hash_info->command));
 787
 788                 hash_info->state = V5Reply;
 789                 hash_info->command_row = get_packet_ptr;
 790
 791                 offset += 3;                    /* skip to address type */
 792
 793                 offset = get_address_v5(tvb, offset, hash_info);
 794
 795                 temp = tvb_get_guint8(tvb, offset);
 796
 797                 if (( hash_info->command == CONNECT_COMMAND) ||
 798                     ( hash_info->command == UDP_ASSOCIATE_COMMAND))
 799                                                 /* get remote port      */
 800                         hash_info->port =  tvb_get_ntohs(tvb, offset);
 801         }
 802
 803         else if ( hash_info->state == V5Reply) {        /* V5 Command Reply */
 804
 805
 806                 if (check_col(pinfo->cinfo, COL_INFO))
 807                         col_append_fstr(pinfo->cinfo, COL_INFO, " Command Response - %s",
 808                                 get_command_name(hash_info->command));
 809
 810                 hash_info->cmd_reply_row = get_packet_ptr;
 811
 812                 if (( hash_info->command == CONNECT_COMMAND) ||
 813                     (hash_info->command == PING_COMMAND) ||
 814                     (hash_info->command == TRACERT_COMMAND))
 815                         hash_info->state = Done;
 816
 817                 else if ( hash_info->command == BIND_COMMAND)
 818                         hash_info->state = V5BindReply;
 819
 820                 else if ( hash_info->command == UDP_ASSOCIATE_COMMAND){
 821                         offset += 3;            /* skip to address type */
 822                         offset = get_address_v5(tvb, offset, hash_info);
 823
 824         /* save server udp port and create udp conversation */
 825                         hash_info->udp_port =  tvb_get_ntohs(tvb, offset);
 826
 827                         if (!pinfo->fd->flags.visited)
 828                                 new_udp_conversation( hash_info, pinfo);
 829
 830 /*XXX may need else statement to handle unknows and generate error message */
 831
 832                 }
 833         }
 834         else if ( hash_info->state == V5BindReply) {    /* V5 Bind Second Reply */
 835
 836                 if (check_col(pinfo->cinfo, COL_INFO))
 837                         col_append_str(pinfo->cinfo, COL_INFO, " Command Response: Bind remote host info");
 838
 839                 hash_info->bind_reply_row = get_packet_ptr;
 840                 hash_info->state = Done;
 841         }
 842         else if ( hash_info->state == UserNameAuth) {   /* Handle V5 User Auth*/
 843                 hash_info->auth_version = get_packet_ptr;
 844                 if (check_col(pinfo->cinfo, COL_INFO))
 845                         col_append_str(pinfo->cinfo, COL_INFO,
 846                                 " User authentication request");
 847
 848                 hash_info->user_name_auth_row = get_packet_ptr;
 849                 hash_info->state = AuthReply;
 850
 851         }
 852         else if ( hash_info->state == AuthReply){       /* V5 User Auth reply */
 853                 hash_info->auth_version = get_packet_ptr;
 854                 if (check_col(pinfo->cinfo, COL_INFO))
 855                         col_append_str(pinfo->cinfo, COL_INFO, " User authentication reply");
 856                 hash_info->state = V5Command;
 857         }
 858 }
 859
 860
 861
 862 static void
 863 display_ping_and_tracert(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, socks_hash_entry_t *hash_info) {
 864
 865 /* Display the ping/trace_route conversation */
 866
 867
 868         const guchar    *data, *dataend;
 869         const guchar   *lineend, *eol;
 870         int             linelen;
 871
 872                                         /* handle the end command */
 873         if ( pinfo->destport == TCP_PORT_SOCKS){
 874                 if (check_col(pinfo->cinfo, COL_INFO))
 875                         col_append_str(pinfo->cinfo, COL_INFO, ", Terminate Request");
 876
 877                 if ( tree)
 878                         proto_tree_add_text(tree, tvb, offset, 1,
 879                                 (hash_info->command  == PING_COMMAND) ?
 880                                 "Ping: End command" :
 881                                 "Traceroute: End command");
 882         }
 883         else{           /* display the PING or Traceroute results */
 884                 if (check_col(pinfo->cinfo, COL_INFO))
 885                         col_append_str(pinfo->cinfo, COL_INFO, ", Results");
 886
 887                 if ( tree){
 888                         proto_tree_add_text(tree, tvb, offset, -1,
 889                                 (hash_info->command  == PING_COMMAND) ?
 890                                 "Ping Results:" :
 891                                 "Traceroute Results");
 892
 893                         data = tvb_get_ptr(tvb, offset, -1);
 894                         dataend = data + tvb_length_remaining(tvb, offset);
 895
 896                         while (data < dataend) {
 897
 898                                 lineend = find_line_end(data, dataend, &eol);
 899                                 linelen = lineend - data;
 900
 901                                 proto_tree_add_text( tree, tvb, offset, linelen,
 902                                         "%s", format_text(data, linelen));
 903                                 offset += linelen;
 904                                 data = lineend;
 905                         }
 906                 }
 907         }
 908 }
 909
 910
 911
 912 static void clear_in_socks_dissector_flag(void *dummy _U_)
 913 {
 914         in_socks_dissector_flag = 0; /* avoid recursive overflow */
 915 }
 916
 917 static void call_next_dissector(tvbuff_t *tvb, int offset, packet_info *pinfo,
 918         proto_tree *tree, proto_tree *socks_tree,
 919         socks_hash_entry_t *hash_info)
 920 {
 921
 922 /* Display the results for PING and TRACERT extensions or               */
 923 /* Call TCP dissector for the port that was passed during the           */
 924 /* connect process                                                      */
 925 /* Load pointer to pinfo->XXXport depending upon the direction,         */
 926 /* change pinfo port to the remote port, call next dissecotr to decode  */
 927 /* the payload, and restore the pinfo port after that is done.          */
 928
 929         guint32 *ptr;
 930         struct tcpinfo *tcpinfo = pinfo->private_data;
 931         guint16 save_can_desegment;
 932
 933         if (( hash_info->command  == PING_COMMAND) ||
 934             ( hash_info->command  == TRACERT_COMMAND))
 935
 936                 display_ping_and_tracert(tvb, offset, pinfo, tree, hash_info);
 937
 938         else {          /* call the tcp port decoder to handle the payload */
 939
 940 /*XXX may want to load dest address here */
 941
 942                 if ( pinfo->destport  == TCP_PORT_SOCKS)
 943                         ptr = &pinfo->destport;
 944                 else
 945                         ptr = &pinfo->srcport;
 946
 947                 *ptr = hash_info->port;
 948
 949 /* 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel */
 950
 951                 in_socks_dissector_flag = 1; /* avoid recursive overflow */
 952                 CLEANUP_PUSH(clear_in_socks_dissector_flag, NULL);
 953
 954                 save_can_desegment = pinfo->can_desegment;
 955                 pinfo->can_desegment = pinfo->saved_can_desegment;
 956                 dissect_tcp_payload(tvb, pinfo, offset, tcpinfo->seq,
 957                     tcpinfo->nxtseq, pinfo->srcport, pinfo->destport,
 958                     tree, socks_tree);
 959                 pinfo->can_desegment = save_can_desegment;
 960
 961                 CLEANUP_CALL_AND_POP;
 962
 963                 *ptr = TCP_PORT_SOCKS;
 964         }
 965 }
 966
 967
 968
 969 static void
 970 dissect_socks(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
 971
 972         int             offset = 0;
 973         proto_tree      *socks_tree = NULL;
 974         proto_item      *ti;
 975         socks_hash_entry_t *hash_info;
 976         conversation_t *conversation;
 977
 978 /* 2003-09-18 JCFoster Fixed problem with socks tunnel in socks tunnel */
 979
 980         /* avoid recursive overflow */
 981
 982         if ( in_socks_dissector_flag) {
 983                 return;
 984         }
 985
 986         conversation = find_conversation( &pinfo->src, &pinfo->dst, pinfo->ptype,
 987                 pinfo->srcport, pinfo->destport, 0);
 988
 989         if ( !conversation){
 990                 conversation = conversation_new( &pinfo->src, &pinfo->dst, pinfo->ptype,
 991                         pinfo->srcport, pinfo->destport, 0);
 992         }
 993         hash_info = conversation_get_proto_data(conversation,proto_socks);
 994         if ( !hash_info){
 995                 hash_info = g_mem_chunk_alloc(socks_vals);
 996                 hash_info->start_done_row = G_MAXINT;
 997                 hash_info->state = None;
 998                 hash_info->port = 0;
 999                 hash_info->version = tvb_get_guint8(tvb, offset); /* get version*/
1000
1001                 if (( hash_info->version != 4) &&       /* error test version */
1002                    ( hash_info->version != 5))
1003                         hash_info->state = Done;
1004
1005                 conversation_add_proto_data(conversation, proto_socks,
1006                         hash_info);
1007
1008                                                 /* set dissector for now */
1009                 conversation_set_dissector(conversation, socks_handle);
1010         }
1011
1012 /* display summary window information  */
1013
1014         if (check_col(pinfo->cinfo, COL_PROTOCOL))
1015                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Socks");
1016
1017         if (check_col(pinfo->cinfo, COL_INFO)){
1018                 if (( hash_info->version == 4) || ( hash_info->version == 5)){
1019                         col_add_fstr(pinfo->cinfo, COL_INFO, "Version: %d",
1020                                 hash_info->version);
1021                 }
1022                 else                    /* unknown version display error */
1023                         col_set_str(pinfo->cinfo, COL_INFO, "Unknown");
1024
1025
1026                 if ( hash_info->command == PING_COMMAND)
1027                         col_append_str(pinfo->cinfo, COL_INFO, ", Ping Req");
1028                 if ( hash_info->command == TRACERT_COMMAND)
1029                         col_append_str(pinfo->cinfo, COL_INFO, ", Traceroute Req");
1030
1031 /*XXX           if ( hash_info->port != -1) */
1032                 if ( hash_info->port != 0)
1033                         col_append_fstr(pinfo->cinfo, COL_INFO, ", Remote Port: %u",
1034                                 hash_info->port);
1035         }
1036
1037
1038 /* run state machine if needed */
1039
1040         if ((hash_info->state != Done) && ( !pinfo->fd->flags.visited)){
1041
1042                 if ( hash_info->version == 4)
1043                         state_machine_v4( hash_info, tvb, offset, pinfo);
1044
1045                 else if ( hash_info->version == 5)
1046                         state_machine_v5( hash_info, tvb, offset, pinfo);
1047
1048                 if (hash_info->state == Done) {         /* if done now  */
1049                         hash_info->start_done_row = pinfo->fd->num;
1050                 }
1051         }
1052
1053 /* if proto tree, decode and display */
1054
1055         if (tree) {
1056                 ti = proto_tree_add_item( tree, proto_socks, tvb, offset, -1,
1057                         FALSE );
1058
1059                 socks_tree = proto_item_add_subtree(ti, ett_socks);
1060
1061                 if ( hash_info->version == 4)
1062                         display_socks_v4(tvb, offset, pinfo, socks_tree,
1063                                 hash_info);
1064
1065                 else if ( hash_info->version == 5)
1066                         display_socks_v5(tvb, offset, pinfo, socks_tree,
1067                                 hash_info);
1068
1069                                 /* if past startup, add the faked stuff */
1070                 if ( pinfo->fd->num >  hash_info->start_done_row){
1071                                                 /*  add info to tree */
1072                         proto_tree_add_text( socks_tree, tvb, offset, 0,
1073                                 "Command: %d (%s)", hash_info->command,
1074                                 get_command_name(hash_info->command));
1075
1076                         proto_tree_add_ipv4( socks_tree, hf_socks_ip_dst, tvb,
1077                                         offset, 0, hash_info->dst_addr);
1078
1079                                 /* no fake address for ping & traceroute */
1080
1081                         if (( hash_info->command != PING_COMMAND) &&
1082                             ( hash_info->command != TRACERT_COMMAND)){
1083                                 proto_tree_add_uint( socks_tree, hf_socks_dstport, tvb,
1084                                         offset, 0, hash_info->port);
1085                         }
1086                 }
1087
1088         }
1089
1090
1091 /* call next dissector if ready */
1092
1093         if ( pinfo->fd->num > hash_info->start_done_row){
1094                 call_next_dissector(tvb, offset, pinfo, tree, socks_tree,
1095                     hash_info);
1096         }
1097 }
1098
1099
1100
1101 static void socks_reinit( void){
1102
1103 /* Do the cleanup work when a new pass through the packet list is       */
1104 /* performed. Reset the highest row seen counter and re-initialize the  */
1105 /* conversation memory chunks.                                          */
1106
1107         if (socks_vals)
1108                 g_mem_chunk_destroy(socks_vals);
1109
1110         socks_vals = g_mem_chunk_new("socks_vals", socks_hash_val_length,
1111                 socks_hash_init_count * socks_hash_val_length,
1112                 G_ALLOC_AND_FREE);
1113 }
1114
1115
1116 void
1117 proto_register_socks( void){
1118
1119 /*** Prep the socks protocol, register it and a initialization routine  */
1120 /*      to clear the hash stuff.                                        */
1121
1122
1123         static gint *ett[] = {
1124                 &ett_socks,
1125                 &ett_socks_auth,
1126                 &ett_socks_name
1127
1128         };
1129
1130         static hf_register_info hf[] = {
1131
1132
1133                 { &hf_socks_ver,
1134                         { "Version", "socks.version", FT_UINT8, BASE_DEC, NULL,
1135                                 0x0, "", HFILL
1136                         }
1137                 },
1138                 { &hf_socks_ip_dst,
1139                         { "Remote Address", "socks.dst", FT_IPv4, BASE_NONE, NULL,
1140                                 0x0, "", HFILL
1141                         }
1142                 },
1143                 { &hf_socks_ip6_dst,
1144                         { "Remote Address(ipv6)", "socks.dstV6", FT_IPv6, BASE_NONE, NULL,
1145                                 0x0, "", HFILL
1146                         }
1147                 },
1148
1149                 { &hf_user_name,
1150                         { "User Name", "socks.username", FT_STRING, BASE_NONE,
1151                                  NULL, 0x0, "", HFILL
1152                         }
1153                 },
1154                 { &hf_socks_dstport,
1155                         { "Remote Port", "socks.dstport", FT_UINT16,
1156                                 BASE_DEC, NULL, 0x0, "", HFILL
1157                         }
1158                 },
1159                 { &hf_socks_cmd,
1160                         { "Command", "socks.command", FT_UINT8,
1161                                 BASE_DEC,  VALS(cmd_strings), 0x0, "", HFILL
1162                         }
1163                 },
1164                 { &hf_socks_results_4,
1165                         { "Results(V4)", "socks.results_v4", FT_UINT8,
1166                                 BASE_DEC, VALS(reply_table_v4), 0x0, "", HFILL
1167                         }
1168                 },
1169                 { &hf_socks_results_5,
1170                         { "Results(V5)", "socks.results_v5", FT_UINT8,
1171                                 BASE_DEC, VALS(reply_table_v5), 0x0, "", HFILL
1172                         }
1173                 },
1174                 { &hf_socks_results,
1175                         { "Results(V5)", "socks.results", FT_UINT8,
1176                                 BASE_DEC, NULL, 0x0, "", HFILL
1177                         }
1178                 }
1179
1180         };
1181
1182
1183         proto_socks = proto_register_protocol (
1184                 "Socks Protocol", "Socks", "socks");
1185
1186         proto_register_field_array(proto_socks, hf, array_length(hf));
1187         proto_register_subtree_array(ett, array_length(ett));
1188
1189         register_init_routine( &socks_reinit);  /* register re-init routine */
1190
1191         socks_udp_handle = create_dissector_handle(socks_udp_dissector,
1192             proto_socks);
1193         socks_handle = create_dissector_handle(dissect_socks, proto_socks);
1194 }
1195
1196
1197 void
1198 proto_reg_handoff_socks(void) {
1199
1200         /* dissector install routine */
1201
1202         dissector_add("tcp.port", TCP_PORT_SOCKS, socks_handle);
1203 }