packet-tpkt.c

   1 /* packet-tpkt.c
   2  *
   3  * Routine to check for RFC 1006 TPKT header and to dissect TPKT header
   4  * Copyright 2000, Philips Electronics N.V.
   5  * Andreas Sikkema <andreas.sikkema@philips.com>
   6  *
   7  * Routine to dissect RFC 1006 TPKT packet containing OSI TP PDU
   8  * Copyright 2001, Martin Thomas <Martin_A_Thomas@yahoo.com>
   9  *
  10  * $Id: packet-tpkt.c,v 1.18 2002/03/25 20:17:09 guy Exp $
  11  *
  12  * Ethereal - Network traffic analyzer
  13  * By Gerald Combs <gerald@ethereal.com>
  14  * Copyright 1998 Gerald Combs
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 # include "config.h"
  33 #endif
  34
  35 #include <glib.h>
  36 #include <epan/packet.h>
  37
  38 #ifdef HAVE_SYS_TYPES_H
  39 #  include <sys/types.h>
  40 #endif
  41
  42 #ifdef HAVE_NETINET_IN_H
  43 #  include <netinet/in.h>
  44 #endif
  45
  46 #include <stdio.h>
  47 #include <string.h>
  48
  49 #include "packet-tpkt.h"
  50 #include "packet-frame.h"
  51 #include "prefs.h"
  52
  53 /* TPKT header fields             */
  54 static int proto_tpkt          = -1;
  55 static int hf_tpkt_version     = -1;
  56 static int hf_tpkt_reserved    = -1;
  57 static int hf_tpkt_length      = -1;
  58
  59 /* TPKT fields defining a sub tree */
  60 static gint ett_tpkt           = -1;
  61
  62 /* desegmentation of OSI over TPKT over TCP */
  63 static gboolean tpkt_desegment = TRUE;
  64
  65 #define TCP_PORT_TPKT   102
  66
  67 /* find the dissector for OSI TP (aka COTP) */
  68 static dissector_handle_t osi_tp_handle;
  69
  70 /*
  71  * Check whether this could be a TPKT-encapsulated PDU.
  72  * Returns -1 if it's not, and the PDU length from the TPKT header
  73  * if it is.
  74  */
  75 int
  76 is_tpkt(tvbuff_t *tvb)
  77 {
  78         /*
  79          * If TPKT is disabled, don't dissect it, just return -1, meaning
  80          * "this isn't TPKT".
  81          */
  82         if (!proto_is_protocol_enabled(proto_tpkt))
  83                 return -1;
  84
  85         /* There should at least be 4 bytes left in the frame */
  86         if (!tvb_bytes_exist(tvb, 0, 4))
  87                 return -1;      /* there aren't */
  88
  89         /*
  90          * The first octet should be 3 and the second one should be 0
  91          * The H.323 implementers guide suggests that this might not
  92          * always be the case....
  93          */
  94         if (!(tvb_get_guint8(tvb, 0) == 3 && tvb_get_guint8(tvb, 1) == 0))
  95                 return -1;      /* They're not */
  96
  97         /*
  98          * Return the length from the TPKT header.
  99          */
 100         return tvb_get_ntohs(tvb, 2);
 101 }
 102
 103 /*
 104  * Dissect TPKT-encapsulated data in a TCP stream.
 105  */
 106 void
 107 dissect_tpkt_encap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 108     gboolean desegment, dissector_handle_t subdissector_handle)
 109 {
 110         proto_item *ti = NULL;
 111         proto_tree *tpkt_tree = NULL;
 112         volatile int offset = 0;
 113         int length_remaining;
 114         int data_len;
 115         volatile int length;
 116         tvbuff_t *next_tvb;
 117         const char *saved_proto;
 118
 119         /*
 120          * If we're reassembling segmented TPKT PDUs, empty the COL_INFO
 121          * column, so subdissectors can append information
 122          * without having to worry about emptying the column.
 123          *
 124          * We use "col_add_str()" because the subdissector
 125          * might be appending information to the column, in
 126          * which case we'd have to zero the buffer out explicitly
 127          * anyway.
 128          */
 129         if (tpkt_desegment && check_col(pinfo->cinfo, COL_INFO))
 130                 col_add_str(pinfo->cinfo, COL_INFO, "");
 131
 132         while (tvb_reported_length_remaining(tvb, offset) != 0) {
 133                 length_remaining = tvb_length_remaining(tvb, offset);
 134
 135                 /*
 136                  * Can we do reassembly?
 137                  */
 138                 if (desegment && pinfo->can_desegment) {
 139                         /*
 140                          * Yes - is the TPKT header split across segment
 141                          * boundaries?
 142                          */
 143                         if (length_remaining < 4) {
 144                                 /*
 145                                  * Yes.  Tell the TCP dissector where
 146                                  * the data for this message starts in
 147                                  * the data it handed us, and how many
 148                                  * more bytes we need, and return.
 149                                  */
 150                                 pinfo->desegment_offset = offset;
 151                                 pinfo->desegment_len = 4 - length_remaining;
 152                                 return;
 153                         }
 154                 }
 155
 156                 /*
 157                  * Get the length from the TPKT header.
 158                  */
 159                 data_len = tvb_get_ntohs(tvb, offset + 2);
 160
 161                 /*
 162                  * Can we do reassembly?
 163                  */
 164                 if (desegment && pinfo->can_desegment) {
 165                         /*
 166                          * Yes - is the payload split across segment
 167                          * boundaries?
 168                          */
 169                         if (length_remaining < data_len) {
 170                                 /*
 171                                  * Yes.  Tell the TCP dissector where
 172                                  * the data for this message starts in
 173                                  * the data it handed us, and how many
 174                                  * more bytes we need, and return.
 175                                  */
 176                                 pinfo->desegment_offset = offset;
 177                                 pinfo->desegment_len =
 178                                     data_len - length_remaining;
 179                                 return;
 180                         }
 181                 }
 182
 183                 /*
 184                  * Dissect the TPKT header.
 185                  * Save and restore "pinfo->current_proto".
 186                  */
 187                 saved_proto = pinfo->current_proto;
 188                 pinfo->current_proto = "TPKT";
 189
 190                 if (check_col(pinfo->cinfo, COL_PROTOCOL))
 191                         col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
 192                 /*
 193                  * Don't add the TPKT header information if we're
 194                  * reassembling segmented TPKT PDUs or if this
 195                  * PDU isn't reassembled.
 196                  *
 197                  * XXX - the first is so that subdissectors can append
 198                  * information without getting TPKT stuff in the middle;
 199                  * why the second?
 200                  */
 201                 if (!tpkt_desegment && !pinfo->fragmented
 202                     && check_col(pinfo->cinfo, COL_INFO)) {
 203                         col_add_fstr(pinfo->cinfo, COL_INFO,
 204                             "TPKT Data length = %u", data_len);
 205                 }
 206
 207                 if (tree) {
 208                         ti = proto_tree_add_item(tree, proto_tpkt, tvb,
 209                             offset, 4, FALSE);
 210                         tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);
 211
 212                         /* Version */
 213                         proto_tree_add_item(tpkt_tree, hf_tpkt_version, tvb,
 214                             offset, 1, FALSE);
 215
 216                         /* Reserved octet*/
 217                         proto_tree_add_item(tpkt_tree, hf_tpkt_reserved, tvb,
 218                             offset + 1, 1, FALSE);
 219
 220                         /* Length */
 221                         proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb,
 222                             offset + 2, 2, data_len);
 223                 }
 224                 pinfo->current_proto = saved_proto;
 225
 226                 /* Skip the TPKT header. */
 227                 offset += 4;
 228                 data_len -= 4;
 229
 230                 /*
 231                  * Construct a tvbuff containing the amount of the payload
 232                  * we have available.  Make its reported length the
 233                  * amount of data in this TPKT packet.
 234                  *
 235                  * XXX - if reassembly isn't enabled. the subdissector
 236                  * will throw a BoundsError exception, rather than a
 237                  * ReportedBoundsError exception.  We really want
 238                  * a tvbuff where the length is "length", the reported
 239                  * length is "plen + 2", and the "if the snapshot length
 240                  * were infinite" length were the minimum of the
 241                  * reported length of the tvbuff handed to us and "plen+2",
 242                  * with a new type of exception thrown if the offset is
 243                  * within the reported length but beyond that third length,
 244                  * with that exception getting the "Unreassembled Packet"
 245                  * error.
 246                  */
 247                 length = length_remaining - 4;
 248                 if (length > data_len)
 249                         length = data_len;
 250                 next_tvb = tvb_new_subset(tvb, offset, length, data_len);
 251
 252                 /*
 253                  * Call the subdissector.
 254                  *
 255                  * Catch the ReportedBoundsError exception; if this
 256                  * particular message happens to get a ReportedBoundsError
 257                  * exception, that doesn't mean that we should stop
 258                  * dissecting TPKT messages within this frame or chunk
 259                  * of reassembled data.
 260                  *
 261                  * If it gets a BoundsError, we can stop, as there's nothing
 262                  * more to see, so we just re-throw it.
 263                  */
 264                 TRY {
 265                         call_dissector(subdissector_handle, next_tvb, pinfo,
 266                             tree);
 267                 }
 268                 CATCH(BoundsError) {
 269                         RETHROW;
 270                 }
 271                 CATCH(ReportedBoundsError) {
 272                         show_reported_bounds_error(tvb, pinfo, tree);
 273                 }
 274                 ENDTRY;
 275
 276                 /*
 277                  * Skip the payload.
 278                  */
 279                 offset += length;
 280         }
 281 }
 282
 283 /*
 284  * Dissect RFC 1006 TPKT, which wraps a TPKT header around an OSI TP
 285  * PDU.
 286  */
 287 static void
 288 dissect_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 289 {
 290         dissect_tpkt_encap(tvb, pinfo, tree, tpkt_desegment, osi_tp_handle);
 291 }
 292
 293 void
 294 proto_register_tpkt(void)
 295 {
 296         static hf_register_info hf[] =
 297         {
 298                 {
 299                         &hf_tpkt_version,
 300                         {
 301                                 "Version",
 302                                 "tpkt.version",
 303                                 FT_UINT8,
 304                                 BASE_DEC,
 305                                 NULL,
 306                                 0x0,
 307                                 "", HFILL
 308                         }
 309                 },
 310                 {
 311                         &hf_tpkt_reserved,
 312                         {
 313                                 "Reserved",
 314                                 "tpkt.reserved",
 315                                 FT_UINT8,
 316                                 BASE_DEC,
 317                                 NULL,
 318                                 0x0,
 319                                 "", HFILL
 320                         }
 321                 },
 322                 {
 323                         &hf_tpkt_length,
 324                         {
 325                                 "Length",
 326                                 "tpkt.length",
 327                                 FT_UINT16,
 328                                 BASE_DEC,
 329                                 NULL,
 330                                 0x0,
 331                                 "", HFILL
 332                         }
 333                 },
 334         };
 335
 336         static gint *ett[] =
 337         {
 338                 &ett_tpkt,
 339         };
 340         module_t *tpkt_module;
 341
 342         proto_tpkt = proto_register_protocol("TPKT", "TPKT", "tpkt");
 343         proto_register_field_array(proto_tpkt, hf, array_length(hf));
 344         proto_register_subtree_array(ett, array_length(ett));
 345
 346         tpkt_module = prefs_register_protocol(proto_tpkt, NULL);
 347         prefs_register_bool_preference(tpkt_module, "desegment",
 348             "Desegment all TPKT messages spanning multiple TCP segments",
 349             "Whether the TPKT dissector should desegment all messages spanning multiple TCP segments",
 350             &tpkt_desegment);
 351 }
 352
 353 void
 354 proto_reg_handoff_tpkt(void)
 355 {
 356         dissector_handle_t tpkt_handle;
 357
 358         osi_tp_handle = find_dissector("ositp");
 359         tpkt_handle = create_dissector_handle(dissect_tpkt, proto_tpkt);
 360         dissector_add("tcp.port", TCP_PORT_TPKT, tpkt_handle);
 361 }