packet-tacacs.c

   1 /* packet-tacacs.c
   2  * Routines for cisco tacacs/xtacacs/tacacs+ packet dissection
   3  * Copyright 2001, Paul Ionescu <paul@acorp.ro>
   4  *
   5  * $Id: packet-tacacs.c,v 1.21 2002/01/24 09:20:52 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from old packet-tacacs.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28
  29 /* rfc-1492 for tacacs and xtacacs
  30  * draft-grant-tacacs-00.txt for tacacs+ (tacplus)
  31  */
  32
  33 #ifdef HAVE_CONFIG_H
  34 # include "config.h"
  35 #endif
  36
  37 #include <stdio.h>
  38
  39 #ifdef HAVE_SYS_TYPES_H
  40 # include <sys/types.h>
  41 #endif
  42
  43 #ifdef HAVE_NETINET_IN_H
  44 # include <netinet/in.h>
  45 #endif
  46
  47 #include <string.h>
  48 #include <glib.h>
  49 #include <epan/packet.h>
  50
  51 static int proto_tacacs = -1;
  52 static int hf_tacacs_version = -1;
  53 static int hf_tacacs_type = -1;
  54 static int hf_tacacs_nonce = -1;
  55 static int hf_tacacs_userlen = -1;
  56 static int hf_tacacs_passlen = -1;
  57 static int hf_tacacs_response = -1;
  58 static int hf_tacacs_reason = -1;
  59 static int hf_tacacs_result1 = -1;
  60 static int hf_tacacs_destaddr = -1;
  61 static int hf_tacacs_destport = -1;
  62 static int hf_tacacs_line = -1;
  63 static int hf_tacacs_result2 = -1;
  64 static int hf_tacacs_result3 = -1;
  65
  66 static gint ett_tacacs = -1;
  67
  68 #define VERSION_TACACS  0x00
  69 #define VERSION_XTACACS 0x80
  70
  71 static const value_string tacacs_version_vals[] = {
  72         { VERSION_TACACS,  "TACACS" },
  73         { VERSION_XTACACS, "XTACACS" },
  74         { 0,               NULL }
  75 };
  76
  77 #define TACACS_LOGIN            1
  78 #define TACACS_RESPONSE         2
  79 #define TACACS_CHANGE           3
  80 #define TACACS_FOLLOW           4
  81 #define TACACS_CONNECT          5
  82 #define TACACS_SUPERUSER        6
  83 #define TACACS_LOGOUT           7
  84 #define TACACS_RELOAD           8
  85 #define TACACS_SLIP_ON          9
  86 #define TACACS_SLIP_OFF         10
  87 #define TACACS_SLIP_ADDR        11
  88 static const value_string tacacs_type_vals[] = {
  89         { TACACS_LOGIN,     "Login" },
  90         { TACACS_RESPONSE,  "Response" },
  91         { TACACS_CHANGE,    "Change" },
  92         { TACACS_FOLLOW,    "Follow" },
  93         { TACACS_CONNECT,   "Connect" },
  94         { TACACS_SUPERUSER, "Superuser" },
  95         { TACACS_LOGOUT,    "Logout" },
  96         { TACACS_RELOAD,    "Reload" },
  97         { TACACS_SLIP_ON,   "SLIP on" },
  98         { TACACS_SLIP_OFF,  "SLIP off" },
  99         { TACACS_SLIP_ADDR, "SLIP Addr" },
 100         { 0,                NULL }};
 101
 102 static const value_string tacacs_reason_vals[] = {
 103         { 0  , "none" },
 104         { 1  , "expiring" },
 105         { 2  , "password" },
 106         { 3  , "denied" },
 107         { 4  , "quit" },
 108         { 5  , "idle" },
 109         { 6  , "drop" },
 110         { 7  , "bad" },
 111         { 0  , NULL }
 112 };
 113
 114 static const value_string tacacs_resp_vals[] = {
 115         { 0  , "this is not a response" },
 116         { 1  , "accepted" },
 117         { 2  , "rejected" },
 118         { 0  , NULL }
 119 };
 120
 121 #define TAC_PLUS_AUTHEN 1
 122 #define TAC_PLUS_AUTHOR 2
 123 #define TAC_PLUS_ACCT   3
 124
 125 #define UDP_PORT_TACACS 49
 126 #define TCP_PORT_TACACS 49
 127
 128 static void
 129 dissect_tacacs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 130 {
 131         proto_tree      *tacacs_tree;
 132         proto_item      *ti;
 133         guint8          txt_buff[256],version,type,userlen,passlen;
 134
 135         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 136                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS");
 137         if (check_col(pinfo->cinfo, COL_INFO))
 138                 col_clear(pinfo->cinfo, COL_INFO);
 139
 140         version = tvb_get_guint8(tvb,0);
 141         if (version != 0) {
 142                 if (check_col(pinfo->cinfo, COL_PROTOCOL))
 143                         col_set_str(pinfo->cinfo, COL_PROTOCOL, "XTACACS");
 144         }
 145
 146         type = tvb_get_guint8(tvb,1);
 147         if (check_col(pinfo->cinfo, COL_INFO))
 148                 col_add_str(pinfo->cinfo, COL_INFO,
 149                     val_to_str(type, tacacs_type_vals, "Unknown (0x%02x)"));
 150
 151         if (tree)
 152         {
 153                 ti = proto_tree_add_protocol_format(tree, proto_tacacs,
 154                  tvb, 0, -1, version==0?"TACACS":"XTACACS");
 155                 tacacs_tree = proto_item_add_subtree(ti, ett_tacacs);
 156
 157                 proto_tree_add_uint(tacacs_tree, hf_tacacs_version, tvb, 0, 1,
 158                     version);
 159                 proto_tree_add_uint(tacacs_tree, hf_tacacs_type, tvb, 1, 1,
 160                     type);
 161                 proto_tree_add_item(tacacs_tree, hf_tacacs_nonce, tvb, 2, 2,
 162                     FALSE);
 163
 164         if (version==0)
 165             {
 166             if (type!=TACACS_RESPONSE)
 167                 {
 168                 userlen=tvb_get_guint8(tvb,4);
 169                 proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
 170                     userlen);
 171                 passlen=tvb_get_guint8(tvb,5);
 172                 proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
 173                     passlen);
 174                 tvb_get_nstringz0(tvb,6,userlen,txt_buff);
 175                 proto_tree_add_text(tacacs_tree, tvb, 6, userlen,         "Username: %s",txt_buff);
 176                 tvb_get_nstringz0(tvb,6+userlen,passlen,txt_buff);
 177                 proto_tree_add_text(tacacs_tree, tvb, 6+userlen, passlen, "Password: %s",txt_buff);
 178                 }
 179             else
 180                 {
 181                 proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 4, 1,
 182                     FALSE);
 183                 proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 5, 1,
 184                     FALSE);
 185                 }
 186             }
 187         else
 188             {
 189             userlen=tvb_get_guint8(tvb,4);
 190             proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
 191                 userlen);
 192             passlen=tvb_get_guint8(tvb,5);
 193             proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
 194                 passlen);
 195             proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 6, 1,
 196                 FALSE);
 197             proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 7, 1,
 198                 FALSE);
 199             proto_tree_add_item(tacacs_tree, hf_tacacs_result1, tvb, 8, 4,
 200                 FALSE);
 201             proto_tree_add_item(tacacs_tree, hf_tacacs_destaddr, tvb, 12, 4,
 202                 FALSE);
 203             proto_tree_add_item(tacacs_tree, hf_tacacs_destport, tvb, 16, 2,
 204                 FALSE);
 205             proto_tree_add_item(tacacs_tree, hf_tacacs_line, tvb, 18, 2,
 206                 FALSE);
 207             proto_tree_add_item(tacacs_tree, hf_tacacs_result2, tvb, 20, 4,
 208                 FALSE);
 209             proto_tree_add_item(tacacs_tree, hf_tacacs_result3, tvb, 24, 2,
 210                 FALSE);
 211             if (type!=TACACS_RESPONSE)
 212                 {
 213                 tvb_get_nstringz0(tvb,26,userlen,txt_buff);
 214                 proto_tree_add_text(tacacs_tree, tvb, 26, userlen,  "Username: %s",txt_buff);
 215                 tvb_get_nstringz0(tvb,26+userlen,passlen,txt_buff);
 216                 proto_tree_add_text(tacacs_tree, tvb, 26+userlen, passlen, "Password; %s",txt_buff);
 217                 }
 218             }
 219         }
 220 }
 221
 222 void
 223 proto_register_tacacs(void)
 224 {
 225         static hf_register_info hf[] = {
 226           { &hf_tacacs_version,
 227             { "Version",           "tacacs.version",
 228               FT_UINT8, BASE_HEX, VALS(tacacs_version_vals), 0x0,
 229               "Version", HFILL }},
 230           { &hf_tacacs_type,
 231             { "Type",              "tacacs.type",
 232               FT_UINT8, BASE_DEC, VALS(tacacs_type_vals), 0x0,
 233               "Type", HFILL }},
 234           { &hf_tacacs_nonce,
 235             { "Nonce",             "tacacs.nonce",
 236               FT_UINT16, BASE_HEX, NULL, 0x0,
 237               "Nonce", HFILL }},
 238           { &hf_tacacs_userlen,
 239             { "Username length",   "tacacs.userlen",
 240               FT_UINT8, BASE_DEC, NULL, 0x0,
 241               "Username length", HFILL }},
 242           { &hf_tacacs_passlen,
 243             { "Password length",   "tacacs.passlen",
 244               FT_UINT8, BASE_DEC, NULL, 0x0,
 245               "Password length", HFILL }},
 246           { &hf_tacacs_response,
 247             { "Response",          "tacacs.response",
 248               FT_UINT8, BASE_DEC, VALS(tacacs_resp_vals), 0x0,
 249               "Response", HFILL }},
 250           { &hf_tacacs_reason,
 251             { "Reason",            "tacacs.reason",
 252               FT_UINT8, BASE_DEC, VALS(tacacs_reason_vals), 0x0,
 253               "Reason", HFILL }},
 254           { &hf_tacacs_result1,
 255             { "Result 1",          "tacacs.result1",
 256               FT_UINT32, BASE_HEX, NULL, 0x0,
 257               "Result 1", HFILL }},
 258           { &hf_tacacs_destaddr,
 259             { "Destination address", "tacacs.destaddr",
 260               FT_IPv4, BASE_NONE, NULL, 0x0,
 261               "Destination address", HFILL }},
 262           { &hf_tacacs_destport,
 263             { "Destination port",  "tacacs.destport",
 264               FT_UINT16, BASE_DEC, NULL, 0x0,
 265               "Destination port", HFILL }},
 266           { &hf_tacacs_line,
 267             { "Line",              "tacacs.line",
 268               FT_UINT16, BASE_DEC, NULL, 0x0,
 269               "Line", HFILL }},
 270           { &hf_tacacs_result2,
 271             { "Result 2",          "tacacs.result2",
 272               FT_UINT32, BASE_HEX, NULL, 0x0,
 273               "Result 2", HFILL }},
 274           { &hf_tacacs_result3,
 275             { "Result 3",          "tacacs.result3",
 276               FT_UINT16, BASE_HEX, NULL, 0x0,
 277               "Result 3", HFILL }},
 278         };
 279
 280         static gint *ett[] = {
 281                 &ett_tacacs,
 282         };
 283         proto_tacacs = proto_register_protocol("TACACS", "TACACS", "tacacs");
 284         proto_register_field_array(proto_tacacs, hf, array_length(hf));
 285         proto_register_subtree_array(ett, array_length(ett));
 286 }
 287
 288 void
 289 proto_reg_handoff_tacacs(void)
 290 {
 291         dissector_handle_t tacacs_handle;
 292
 293         tacacs_handle = create_dissector_handle(dissect_tacacs, proto_tacacs);
 294         dissector_add("udp.port", UDP_PORT_TACACS, tacacs_handle);
 295 }
 296
 297 static int proto_tacplus = -1;
 298 static int hf_tacplus_response = -1;
 299 static int hf_tacplus_request = -1;
 300 static int hf_tacplus_majvers = -1;
 301 static int hf_tacplus_minvers = -1;
 302 static int hf_tacplus_type = -1;
 303 static int hf_tacplus_seqno = -1;
 304 static int hf_tacplus_flags = -1;
 305 static int hf_tacplus_flags_payload_type = -1;
 306 static int hf_tacplus_flags_connection_type = -1;
 307 static int hf_tacplus_session_id = -1;
 308 static int hf_tacplus_packet_len = -1;
 309
 310 static gint ett_tacplus = -1;
 311 static gint ett_tacplus_flags = -1;
 312
 313 static const value_string tacplus_type_vals[] = {
 314         { TAC_PLUS_AUTHEN  , "Authentication" },
 315         { TAC_PLUS_AUTHOR  , "Authorization" },
 316         { TAC_PLUS_ACCT    , "Accounting" },
 317         { 0 , NULL }};
 318
 319 #define FLAGS_UNENCRYPTED       0x01
 320
 321 static const true_false_string payload_type = {
 322   "Unencrypted",
 323   "Encrypted"
 324 };
 325
 326 #define FLAGS_SINGLE            0x04
 327
 328 static const true_false_string connection_type = {
 329   "Single",
 330   "Multiple"
 331 };
 332
 333 static void
 334 dissect_tacplus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 335 {
 336         proto_tree      *tacplus_tree;
 337         proto_item      *ti;
 338         guint8          version,flags;
 339         proto_tree      *flags_tree;
 340         proto_item      *tf;
 341         guint32         len;
 342         gboolean        request=(pinfo->match_port == pinfo->destport);
 343
 344         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 345                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS+");
 346
 347         if (check_col(pinfo->cinfo, COL_INFO))
 348         {
 349                 col_set_str(pinfo->cinfo, COL_INFO,
 350                         request ? "Request" : "Response");
 351         }
 352
 353         if (tree)
 354         {
 355                 ti = proto_tree_add_protocol_format(tree, proto_tacplus,
 356                  tvb, 0, -1, "TACACS+");
 357
 358                 tacplus_tree = proto_item_add_subtree(ti, ett_tacplus);
 359                 if (pinfo->match_port == pinfo->destport)
 360                 {
 361                         proto_tree_add_boolean_hidden(tacplus_tree,
 362                             hf_tacplus_request, tvb, 0, 0, TRUE);
 363                 }
 364                 else
 365                 {
 366                         proto_tree_add_boolean_hidden(tacplus_tree,
 367                             hf_tacplus_response, tvb, 0, 0, TRUE);
 368                 }
 369                 version = tvb_get_guint8(tvb,0);
 370                 proto_tree_add_uint_format(tacplus_tree, hf_tacplus_majvers, tvb, 0, 1,
 371                     version,
 372                     "Major version: %s",
 373                     (version&0xf0)==0xc0?"TACACS+":"Unknown Version");
 374                 proto_tree_add_uint(tacplus_tree, hf_tacplus_minvers, tvb, 0, 1,
 375                     version&0xf);
 376                 proto_tree_add_item(tacplus_tree, hf_tacplus_type, tvb, 1, 1,
 377                     FALSE);
 378                 proto_tree_add_item(tacplus_tree, hf_tacplus_seqno, tvb, 2, 1,
 379                     FALSE);
 380                 flags = tvb_get_guint8(tvb,3);
 381                 tf = proto_tree_add_uint_format(tacplus_tree, hf_tacplus_flags,
 382                     tvb, 3, 1, flags,
 383                     "Flags: %s, %s (0x%02x)",
 384                     (flags&FLAGS_UNENCRYPTED) ? "Unencrypted payload" :
 385                                                 "Encrypted payload",
 386                     (flags&FLAGS_SINGLE) ? "Single connection" :
 387                                            "Multiple Connections",
 388                     flags);
 389                 flags_tree = proto_item_add_subtree(tf, ett_tacplus_flags);
 390                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_payload_type,
 391                     tvb, 3, 1, flags);
 392                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_connection_type,
 393                     tvb, 3, 1, flags);
 394                 proto_tree_add_item(tacplus_tree, hf_tacplus_session_id, tvb, 4, 4,
 395                     FALSE);
 396                 len = tvb_get_ntohl(tvb,8);
 397                 proto_tree_add_uint(tacplus_tree, hf_tacplus_packet_len, tvb, 8, 4,
 398                     len);
 399
 400                 if (flags&FLAGS_UNENCRYPTED)
 401                         proto_tree_add_text(tacplus_tree, tvb, 12, len, "Payload");
 402                 else
 403                         proto_tree_add_text(tacplus_tree, tvb, 12, len, "Encrypted payload");
 404         }
 405 }
 406
 407 void
 408 proto_register_tacplus(void)
 409 {
 410         static hf_register_info hf[] = {
 411           { &hf_tacplus_response,
 412             { "Response",           "tacplus.response",
 413               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 414               "TRUE if TACACS+ response", HFILL }},
 415           { &hf_tacplus_request,
 416             { "Request",            "tacplus.request",
 417               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 418               "TRUE if TACACS+ request", HFILL }},
 419           { &hf_tacplus_majvers,
 420             { "Major version",      "tacplus.majvers",
 421               FT_UINT8, BASE_DEC, NULL, 0x0,
 422               "Major version number", HFILL }},
 423           { &hf_tacplus_minvers,
 424             { "Minor version",      "tacplus.minvers",
 425               FT_UINT8, BASE_DEC, NULL, 0x0,
 426               "Minor version number", HFILL }},
 427           { &hf_tacplus_type,
 428             { "Type",               "tacplus.type",
 429               FT_UINT8, BASE_DEC, VALS(tacplus_type_vals), 0x0,
 430               "Type", HFILL }},
 431           { &hf_tacplus_seqno,
 432             { "Sequence number",    "tacplus.seqno",
 433               FT_UINT8, BASE_DEC, NULL, 0x0,
 434               "Sequence number", HFILL }},
 435           { &hf_tacplus_flags,
 436             { "Flags",              "tacplus.flags",
 437               FT_UINT8, BASE_HEX, NULL, 0x0,
 438               "Flags", HFILL }},
 439           { &hf_tacplus_flags_payload_type,
 440             { "Payload type",       "tacplus.flags.payload_type",
 441               FT_BOOLEAN, 8, TFS(&payload_type), FLAGS_UNENCRYPTED,
 442               "Payload type (unencrypted or encrypted)", HFILL }},
 443           { &hf_tacplus_flags_connection_type,
 444             { "Connection type",    "tacplus.flags.connection_type",
 445               FT_BOOLEAN, 8, TFS(&connection_type), FLAGS_SINGLE,
 446               "Connection type (single or multiple)", HFILL }},
 447           { &hf_tacplus_session_id,
 448             { "Session ID",         "tacplus.session_id",
 449               FT_UINT32, BASE_DEC, NULL, 0x0,
 450               "Session ID", HFILL }},
 451           { &hf_tacplus_packet_len,
 452             { "Packet length",      "tacplus.packet_len",
 453               FT_UINT32, BASE_DEC, NULL, 0x0,
 454               "Packet length", HFILL }}
 455         };
 456
 457         static gint *ett[] = {
 458                 &ett_tacplus,
 459                 &ett_tacplus_flags,
 460         };
 461         proto_tacplus = proto_register_protocol("TACACS+", "TACACS+", "tacplus");
 462         proto_register_field_array(proto_tacplus, hf, array_length(hf));
 463         proto_register_subtree_array(ett, array_length(ett));
 464 }
 465
 466 void
 467 proto_reg_handoff_tacplus(void)
 468 {
 469         dissector_handle_t tacplus_handle;
 470
 471         tacplus_handle = create_dissector_handle(dissect_tacplus,
 472             proto_tacplus);
 473         dissector_add("tcp.port", TCP_PORT_TACACS, tacplus_handle);
 474 }