Don't let the user specify a maximum capture file size if they're not
[obnox/wireshark/wip.git] / packet-tacacs.c
1 /* packet-tacacs.c
2  * Routines for cisco tacacs/xtacacs/tacacs+ packet dissection
3  * Copyright 2001, Paul Ionescu <paul@acorp.ro>
4  *
5  * $Id: packet-tacacs.c,v 1.18 2001/12/10 00:25:39 guy Exp $
6  *
7  * Ethereal - Network traffic analyzer
8  * By Gerald Combs <gerald@ethereal.com>
9  * Copyright 1998 Gerald Combs
10  *
11  * Copied from old packet-tacacs.c
12  * 
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  * 
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
21  * GNU General Public License for more details.
22  * 
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software
25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
26  */
27
28
29 /* rfc-1492 for tacacs and xtacacs 
30  * draft-grant-tacacs-00.txt for tacacs+ (tacplus)
31  */
32
33 #ifdef HAVE_CONFIG_H
34 # include "config.h"
35 #endif
36
37 #include <stdio.h>
38
39 #ifdef HAVE_SYS_TYPES_H
40 # include <sys/types.h>
41 #endif
42
43 #ifdef HAVE_NETINET_IN_H
44 # include <netinet/in.h>
45 #endif
46
47 #include <string.h>
48 #include <glib.h>
49 #include "packet.h"
50
51 static int proto_tacacs = -1;
52 static int hf_tacacs_version = -1;
53 static int hf_tacacs_type = -1;
54 static int hf_tacacs_nonce = -1;
55 static int hf_tacacs_userlen = -1;
56 static int hf_tacacs_passlen = -1;
57 static int hf_tacacs_response = -1;
58 static int hf_tacacs_reason = -1;
59 static int hf_tacacs_result1 = -1;
60 static int hf_tacacs_destaddr = -1;
61 static int hf_tacacs_destport = -1;
62 static int hf_tacacs_line = -1;
63 static int hf_tacacs_result2 = -1;
64 static int hf_tacacs_result3 = -1;
65
66 static gint ett_tacacs = -1;
67
68 #define VERSION_TACACS  0x00
69 #define VERSION_XTACACS 0x80
70
71 static const value_string tacacs_version_vals[] = {
72         { VERSION_TACACS,  "TACACS" },
73         { VERSION_XTACACS, "XTACACS" },
74         { 0,               NULL }
75 };
76
77 #define TACACS_LOGIN            1
78 #define TACACS_RESPONSE         2
79 #define TACACS_CHANGE           3
80 #define TACACS_FOLLOW           4
81 #define TACACS_CONNECT          5
82 #define TACACS_SUPERUSER        6
83 #define TACACS_LOGOUT           7
84 #define TACACS_RELOAD           8
85 #define TACACS_SLIP_ON          9
86 #define TACACS_SLIP_OFF         10
87 #define TACACS_SLIP_ADDR        11
88 static const value_string tacacs_type_vals[] = {
89         { TACACS_LOGIN,     "Login" },
90         { TACACS_RESPONSE,  "Response" },
91         { TACACS_CHANGE,    "Change" },
92         { TACACS_FOLLOW,    "Follow" },
93         { TACACS_CONNECT,   "Connect" },
94         { TACACS_SUPERUSER, "Superuser" },
95         { TACACS_LOGOUT,    "Logout" },
96         { TACACS_RELOAD,    "Reload" },
97         { TACACS_SLIP_ON,   "SLIP on" },
98         { TACACS_SLIP_OFF,  "SLIP off" },
99         { TACACS_SLIP_ADDR, "SLIP Addr" },
100         { 0,                NULL }};    
101
102 static const value_string tacacs_reason_vals[] = {
103         { 0  , "none" },
104         { 1  , "expiring" },
105         { 2  , "password" },
106         { 3  , "denied" },
107         { 4  , "quit" },
108         { 5  , "idle" },
109         { 6  , "drop" },
110         { 7  , "bad" },
111         { 0  , NULL }
112 };
113
114 static const value_string tacacs_resp_vals[] = {
115         { 0  , "this is not a response" },
116         { 1  , "accepted" },
117         { 2  , "rejected" },
118         { 0  , NULL }
119 };
120
121 #define TAC_PLUS_AUTHEN 1
122 #define TAC_PLUS_AUTHOR 2
123 #define TAC_PLUS_ACCT   3
124
125 #define UDP_PORT_TACACS 49
126 #define TCP_PORT_TACACS 49
127
128 static void
129 dissect_tacacs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
130 {
131         proto_tree      *tacacs_tree;
132         proto_item      *ti;
133         guint8          txt_buff[256],version,type,userlen,passlen;
134
135         if (check_col(pinfo->cinfo, COL_PROTOCOL))
136                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS");
137         if (check_col(pinfo->cinfo, COL_INFO))
138                 col_clear(pinfo->cinfo, COL_INFO);
139
140         version = tvb_get_guint8(tvb,0);
141         if (version != 0) {
142                 if (check_col(pinfo->cinfo, COL_PROTOCOL))
143                         col_set_str(pinfo->cinfo, COL_PROTOCOL, "XTACACS");
144         }
145
146         type = tvb_get_guint8(tvb,1);
147         if (check_col(pinfo->cinfo, COL_INFO))
148                 col_add_str(pinfo->cinfo, COL_INFO,
149                     val_to_str(type, tacacs_type_vals, "Unknown (0x%02x)"));
150
151         if (tree) 
152         {
153                 ti = proto_tree_add_protocol_format(tree, proto_tacacs,
154                  tvb, 0, tvb_length(tvb), version==0?"TACACS":"XTACACS");
155                 tacacs_tree = proto_item_add_subtree(ti, ett_tacacs);
156
157                 proto_tree_add_uint(tacacs_tree, hf_tacacs_version, tvb, 0, 1,
158                     version);
159                 proto_tree_add_uint(tacacs_tree, hf_tacacs_type, tvb, 1, 1,
160                     type);
161                 proto_tree_add_item(tacacs_tree, hf_tacacs_nonce, tvb, 2, 2,
162                     FALSE);
163
164         if (version==0)
165             {
166             if (type!=TACACS_RESPONSE)
167                 {
168                 userlen=tvb_get_guint8(tvb,4);
169                 proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
170                     userlen);
171                 passlen=tvb_get_guint8(tvb,5);
172                 proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
173                     passlen);
174                 tvb_get_nstringz0(tvb,6,userlen,txt_buff);
175                 proto_tree_add_text(tacacs_tree, tvb, 6, userlen,         "Username: %s",txt_buff);
176                 tvb_get_nstringz0(tvb,6+userlen,passlen,txt_buff);
177                 proto_tree_add_text(tacacs_tree, tvb, 6+userlen, passlen, "Password: %s",txt_buff);
178                 }
179             else
180                 {
181                 proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 4, 1,
182                     FALSE);
183                 proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 5, 1,
184                     FALSE);
185                 }
186             }
187         else
188             {
189             userlen=tvb_get_guint8(tvb,4);
190             proto_tree_add_uint(tacacs_tree, hf_tacacs_userlen, tvb, 4, 1,
191                 userlen);
192             passlen=tvb_get_guint8(tvb,5);
193             proto_tree_add_uint(tacacs_tree, hf_tacacs_passlen, tvb, 5, 1,
194                 passlen);
195             proto_tree_add_item(tacacs_tree, hf_tacacs_response, tvb, 6, 1,
196                 FALSE);
197             proto_tree_add_item(tacacs_tree, hf_tacacs_reason, tvb, 7, 1,
198                 FALSE);
199             proto_tree_add_item(tacacs_tree, hf_tacacs_result1, tvb, 8, 4,
200                 FALSE);
201             proto_tree_add_item(tacacs_tree, hf_tacacs_destaddr, tvb, 12, 4,
202                 FALSE);
203             proto_tree_add_item(tacacs_tree, hf_tacacs_destport, tvb, 16, 2,
204                 FALSE);
205             proto_tree_add_item(tacacs_tree, hf_tacacs_line, tvb, 18, 2,
206                 FALSE);
207             proto_tree_add_item(tacacs_tree, hf_tacacs_result2, tvb, 20, 4,
208                 FALSE);
209             proto_tree_add_item(tacacs_tree, hf_tacacs_result3, tvb, 24, 2,
210                 FALSE);
211             if (type!=TACACS_RESPONSE)
212                 {
213                 tvb_get_nstringz0(tvb,26,userlen,txt_buff);
214                 proto_tree_add_text(tacacs_tree, tvb, 26, userlen,  "Username: %s",txt_buff);
215                 tvb_get_nstringz0(tvb,26+userlen,passlen,txt_buff);
216                 proto_tree_add_text(tacacs_tree, tvb, 26+userlen, passlen, "Password; %s",txt_buff);
217                 }
218             }
219         }
220 }
221
222 void
223 proto_register_tacacs(void)
224 {
225         static hf_register_info hf[] = {
226           { &hf_tacacs_version,
227             { "Version",           "tacacs.version",
228               FT_UINT8, BASE_HEX, VALS(tacacs_version_vals), 0x0,
229               "Version", HFILL }},
230           { &hf_tacacs_type,
231             { "Type",              "tacacs.type",
232               FT_UINT8, BASE_DEC, VALS(tacacs_type_vals), 0x0,
233               "Type", HFILL }},
234           { &hf_tacacs_nonce,
235             { "Nonce",             "tacacs.nonce",
236               FT_UINT16, BASE_HEX, NULL, 0x0,
237               "Nonce", HFILL }},
238           { &hf_tacacs_userlen,
239             { "Username length",   "tacacs.userlen",
240               FT_UINT8, BASE_DEC, NULL, 0x0,
241               "Username length", HFILL }},
242           { &hf_tacacs_passlen,
243             { "Password length",   "tacacs.passlen",
244               FT_UINT8, BASE_DEC, NULL, 0x0,
245               "Password length", HFILL }},
246           { &hf_tacacs_response,
247             { "Response",          "tacacs.response",
248               FT_UINT8, BASE_DEC, VALS(tacacs_resp_vals), 0x0,
249               "Response", HFILL }},
250           { &hf_tacacs_reason,
251             { "Reason",            "tacacs.reason",
252               FT_UINT8, BASE_DEC, VALS(tacacs_reason_vals), 0x0,
253               "Reason", HFILL }},
254           { &hf_tacacs_result1,
255             { "Result 1",          "tacacs.result1",
256               FT_UINT32, BASE_HEX, NULL, 0x0,
257               "Result 1", HFILL }},
258           { &hf_tacacs_destaddr,
259             { "Destination address", "tacacs.destaddr",
260               FT_IPv4, BASE_NONE, NULL, 0x0,
261               "Destination address", HFILL }},
262           { &hf_tacacs_destport,
263             { "Destination port",  "tacacs.destport",
264               FT_UINT16, BASE_DEC, NULL, 0x0,
265               "Destination port", HFILL }},
266           { &hf_tacacs_line,
267             { "Line",              "tacacs.line",
268               FT_UINT16, BASE_DEC, NULL, 0x0,
269               "Line", HFILL }},
270           { &hf_tacacs_result2,
271             { "Result 2",          "tacacs.result2",
272               FT_UINT32, BASE_HEX, NULL, 0x0,
273               "Result 2", HFILL }},
274           { &hf_tacacs_result3,
275             { "Result 3",          "tacacs.result3",
276               FT_UINT16, BASE_HEX, NULL, 0x0,
277               "Result 3", HFILL }},
278         };
279
280         static gint *ett[] = {
281                 &ett_tacacs,
282         };
283         proto_tacacs = proto_register_protocol("TACACS", "TACACS", "tacacs");
284         proto_register_field_array(proto_tacacs, hf, array_length(hf));
285         proto_register_subtree_array(ett, array_length(ett));
286 }
287
288 void
289 proto_reg_handoff_tacacs(void)
290 {
291         dissector_handle_t tacacs_handle;
292
293         tacacs_handle = create_dissector_handle(dissect_tacacs, proto_tacacs);
294         dissector_add("udp.port", UDP_PORT_TACACS, tacacs_handle);
295 }
296
297 static int proto_tacplus = -1;
298 static int hf_tacplus_response = -1;
299 static int hf_tacplus_request = -1;
300 static int hf_tacplus_majvers = -1;
301 static int hf_tacplus_minvers = -1;
302 static int hf_tacplus_type = -1;
303 static int hf_tacplus_seqno = -1;
304 static int hf_tacplus_flags = -1;
305 static int hf_tacplus_flags_payload_type = -1;
306 static int hf_tacplus_flags_connection_type = -1;
307 static int hf_tacplus_session_id = -1;
308 static int hf_tacplus_packet_len = -1;
309
310 static gint ett_tacplus = -1;
311 static gint ett_tacplus_flags = -1;
312
313 static const value_string tacplus_type_vals[] = {
314         { TAC_PLUS_AUTHEN  , "Authentication" },
315         { TAC_PLUS_AUTHOR  , "Authorization" },
316         { TAC_PLUS_ACCT    , "Accounting" },
317         { 0 , NULL }};
318
319 #define FLAGS_UNENCRYPTED       0x01
320
321 static const true_false_string payload_type = {
322   "Unencrypted",
323   "Encrypted"
324 };
325
326 #define FLAGS_SINGLE            0x04
327
328 static const true_false_string connection_type = {
329   "Single",
330   "Multiple"
331 };
332
333 static void
334 dissect_tacplus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
335 {
336         proto_tree      *tacplus_tree;
337         proto_item      *ti;
338         guint8          version,flags;
339         proto_tree      *flags_tree;
340         proto_item      *tf;
341         guint32         len;
342         gboolean        request=(pinfo->match_port == pinfo->destport);
343
344         if (check_col(pinfo->cinfo, COL_PROTOCOL))
345                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TACACS+");
346
347         if (check_col(pinfo->cinfo, COL_INFO))
348         {
349                 col_add_str(pinfo->cinfo, COL_INFO,
350                         request ? "Request" : "Response");        
351         }
352
353         if (tree) 
354         {
355                 ti = proto_tree_add_protocol_format(tree, proto_tacplus,
356                  tvb, 0, tvb_length(tvb), "TACACS+");
357
358                 tacplus_tree = proto_item_add_subtree(ti, ett_tacplus);
359                 if (pinfo->match_port == pinfo->destport)
360                 {
361                         proto_tree_add_boolean_hidden(tacplus_tree,
362                             hf_tacplus_request, tvb, 0, 0, TRUE);
363                 }
364                 else
365                 {
366                         proto_tree_add_boolean_hidden(tacplus_tree,
367                             hf_tacplus_response, tvb, 0, 0, TRUE);
368                 }
369                 version = tvb_get_guint8(tvb,0);
370                 proto_tree_add_uint_format(tacplus_tree, hf_tacplus_majvers, tvb, 0, 1,
371                     version,
372                     "Major version: %s",
373                     (version&0xf0)==0xc0?"TACACS+":"Unknown Version");
374                 proto_tree_add_uint(tacplus_tree, hf_tacplus_minvers, tvb, 0, 1,
375                     version&0xf);
376                 proto_tree_add_item(tacplus_tree, hf_tacplus_type, tvb, 1, 1,
377                     FALSE);
378                 proto_tree_add_item(tacplus_tree, hf_tacplus_seqno, tvb, 2, 1,
379                     FALSE);
380                 flags = tvb_get_guint8(tvb,3);
381                 tf = proto_tree_add_uint_format(tacplus_tree, hf_tacplus_flags,
382                     tvb, 3, 1, flags,
383                     "Flags: %s, %s (0x%02x)",
384                     (flags&FLAGS_UNENCRYPTED) ? "Unencrypted payload" :
385                                                 "Encrypted payload",
386                     (flags&FLAGS_SINGLE) ? "Single connection" :
387                                            "Multiple Connections",
388                     flags);
389                 flags_tree = proto_item_add_subtree(tf, ett_tacplus_flags);
390                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_payload_type,
391                     tvb, 3, 1, flags);
392                 proto_tree_add_boolean(flags_tree, hf_tacplus_flags_connection_type,
393                     tvb, 3, 1, flags);
394                 proto_tree_add_item(tacplus_tree, hf_tacplus_session_id, tvb, 4, 4,
395                     FALSE);
396                 len = tvb_get_ntohl(tvb,8);
397                 proto_tree_add_uint(tacplus_tree, hf_tacplus_packet_len, tvb, 8, 4,
398                     len);
399
400                 if (flags&FLAGS_UNENCRYPTED)
401                         proto_tree_add_text(tacplus_tree, tvb, 12, len, "Payload");
402                 else
403                         proto_tree_add_text(tacplus_tree, tvb, 12, len, "Encrypted payload");
404         }
405 }
406
407 void
408 proto_register_tacplus(void)
409 {
410         static hf_register_info hf[] = {
411           { &hf_tacplus_response,
412             { "Response",           "tacplus.response",
413               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
414               "TRUE if TACACS+ response", HFILL }},
415           { &hf_tacplus_request,
416             { "Request",            "tacplus.request",
417               FT_BOOLEAN, BASE_NONE, NULL, 0x0,
418               "TRUE if TACACS+ request", HFILL }},
419           { &hf_tacplus_majvers,
420             { "Major version",      "tacplus.majvers",
421               FT_UINT8, BASE_DEC, NULL, 0x0,
422               "Major version number", HFILL }},
423           { &hf_tacplus_minvers,
424             { "Minor version",      "tacplus.minvers",
425               FT_UINT8, BASE_DEC, NULL, 0x0,
426               "Minor version number", HFILL }},
427           { &hf_tacplus_type,
428             { "Type",               "tacplus.type",
429               FT_UINT8, BASE_DEC, VALS(tacplus_type_vals), 0x0,
430               "Type", HFILL }},
431           { &hf_tacplus_seqno,
432             { "Sequence number",    "tacplus.seqno",
433               FT_UINT8, BASE_DEC, NULL, 0x0,
434               "Sequence number", HFILL }},
435           { &hf_tacplus_flags,
436             { "Flags",              "tacplus.flags",
437               FT_UINT8, BASE_HEX, NULL, 0x0,
438               "Flags", HFILL }},
439           { &hf_tacplus_flags_payload_type,
440             { "Payload type",       "tacplus.flags.payload_type",
441               FT_BOOLEAN, 8, TFS(&payload_type), FLAGS_UNENCRYPTED,
442               "Payload type (unencrypted or encrypted)", HFILL }},
443           { &hf_tacplus_flags_connection_type,
444             { "Connection type",    "tacplus.flags.connection_type",
445               FT_BOOLEAN, 8, TFS(&connection_type), FLAGS_SINGLE,
446               "Connection type (single or multiple)", HFILL }},
447           { &hf_tacplus_session_id,
448             { "Session ID",         "tacplus.session_id",
449               FT_UINT32, BASE_DEC, NULL, 0x0,
450               "Session ID", HFILL }},
451           { &hf_tacplus_packet_len,
452             { "Packet length",      "tacplus.packet_len",
453               FT_UINT32, BASE_DEC, NULL, 0x0,
454               "Packet length", HFILL }}
455         };
456
457         static gint *ett[] = {
458                 &ett_tacplus,
459                 &ett_tacplus_flags,
460         };
461         proto_tacplus = proto_register_protocol("TACACS+", "TACACS+", "tacplus");
462         proto_register_field_array(proto_tacplus, hf, array_length(hf));
463         proto_register_subtree_array(ett, array_length(ett));
464 }
465
466 void
467 proto_reg_handoff_tacplus(void)
468 {
469         dissector_handle_t tacplus_handle;
470
471         tacplus_handle = create_dissector_handle(dissect_tacplus,
472             proto_tacplus);
473         dissector_add("tcp.port", TCP_PORT_TACACS, tacplus_handle);
474 }