Stuart Stanley's ISIS dissection support.
[obnox/wireshark/wip.git] / packet-who.c
1 /* packet-who.c
2  * Routines for who protocol (see man rwhod)
3  * Gilbert Ramirez <gram@xiexie.org>
4  *
5  * $Id: packet-who.c,v 1.2 1999/12/12 06:59:24 gram Exp $
6  *
7  * Ethereal - Network traffic analyzer
8  * By Gerald Combs <gerald@unicom.net>
9  * Copyright 1998 Gerald Combs
10  *
11  * 
12  * This program is free software; you can redistribute it and/or
13  * modify it under the terms of the GNU General Public License
14  * as published by the Free Software Foundation; either version 2
15  * of the License, or (at your option) any later version.
16  * 
17  * This program is distributed in the hope that it will be useful,
18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20  * GNU General Public License for more details.
21  * 
22  * You should have received a copy of the GNU General Public License
23  * along with this program; if not, write to the Free Software
24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
25  */
26
27 #ifdef HAVE_CONFIG_H
28 # include "config.h"
29 #endif
30
31 #ifdef HAVE_SYS_TYPES_H
32 # include <sys/types.h>
33 #endif
34
35 #include <time.h>
36 #include <glib.h>
37 #include "packet.h"
38
39
40 /*
41  *
42 RWHOD(8)                 UNIX System Manager's Manual                 RWHOD(8)
43
44
45      The messages sent and received, are of the form:
46
47            struct  outmp {
48 0                   char    out_line[8];             tty name 
49 8                   char    out_name[8];             user id 
50 16                   long    out_time;               time on 
51            };
52
53            struct  whod {
54  0                   char    wd_vers;
55  1                   char    wd_type;
56  2                   char    wd_fill[2];
57  4                   int     wd_sendtime;
58  8                   int     wd_recvtime;
59 12                   char    wd_hostname[32];
60 44                   int     wd_loadav[3];
61 56                   int     wd_boottime;
62 60                   struct  whoent {
63                            struct  outmp we_utmp;
64 (20 each)                  int     we_idle;
65                    } wd_we[1024 / sizeof (struct whoent)];
66            };
67
68  Linux 2.0                       May 13, 1997                                2
69
70  *
71  */
72
73 static int proto_who = -1;
74 static int hf_who_vers = -1;
75 static int hf_who_type = -1;
76 static int hf_who_sendtime = -1;
77 static int hf_who_recvtime = -1;
78 static int hf_who_hostname = -1;
79 static int hf_who_loadav_5 = -1;
80 static int hf_who_loadav_10 = -1;
81 static int hf_who_loadav_15 = -1;
82 static int hf_who_boottime = -1;
83 static int hf_who_whoent = -1;
84 static int hf_who_tty = -1;
85 static int hf_who_uid = -1;
86 static int hf_who_timeon = -1;
87 static int hf_who_idle = -1;
88
89 static gint ett_who = -1;
90 static gint ett_whoent = -1;
91
92
93 static void dissect_whoent(const u_char *pd, int offset, frame_data *fd, proto_tree *tree);
94
95 void
96 dissect_who(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
97 {
98
99         proto_tree      *who_tree = NULL;
100         proto_item      *who_ti = NULL;
101         gchar           server_name[33];
102         double          loadav_5 = 0.0, loadav_10 = 0.0, loadav_15 = 0.0;
103
104         /* Summary information */
105         if (check_col(fd, COL_PROTOCOL))
106                 col_add_str(fd, COL_PROTOCOL, "WHO");
107
108         /* Figure out if we have enough bytes in the packet
109          * to retrieve the data that we want to put into the summary
110          * line: hostname and load average
111          */
112         if ( BYTES_ARE_IN_FRAME(offset, 60) ) {
113
114                 memcpy(server_name, &pd[offset + 12], 32);
115                 server_name[32] = '\0';
116
117                 loadav_5  = (double) pntohl(&pd[offset+44]) / 100.0;
118                 loadav_10 = (double) pntohl(&pd[offset+48]) / 100.0;
119                 loadav_15 = (double) pntohl(&pd[offset+52]) / 100.0;
120
121                 /* Summary information */
122                 if (check_col(fd, COL_INFO))
123                         col_add_fstr(fd, COL_INFO, "%s: %.02f %.02f %.02f",
124                                         server_name, loadav_5, loadav_10, loadav_15);
125         }
126         else {
127                 return;
128         }
129
130
131         if (tree) {
132                 struct timeval tv;
133
134                 tv.tv_usec = 0;
135
136                 /* We already know that the packet has enough data to fill in
137                  * the summary info. Retrieve that data */
138
139                 who_ti = proto_tree_add_item(tree, proto_who, offset, END_OF_FRAME, NULL);
140                 who_tree = proto_item_add_subtree(who_ti, ett_who);
141
142                 proto_tree_add_item(who_tree, hf_who_vers, offset, 1, pd[offset]);
143                 offset += 1;
144
145
146                 proto_tree_add_item(who_tree, hf_who_type, offset, 1, pd[offset]);
147                 offset += 1;
148
149                 /* 2 filler bytes */
150                 offset += 2;
151
152                 tv.tv_sec = pntohl(&pd[offset]);
153                 proto_tree_add_item(who_tree, hf_who_sendtime, offset, 4, &tv);
154                 offset += 4;
155
156                 tv.tv_sec = pntohl(&pd[offset]);
157                 proto_tree_add_item(who_tree, hf_who_recvtime, offset, 4, &tv);
158                 offset += 4;
159
160                 proto_tree_add_item(who_tree, hf_who_hostname, offset, 32, server_name);
161                 offset += 32;
162
163                 proto_tree_add_item(who_tree, hf_who_loadav_5, offset, 4, loadav_5);
164                 offset += 4;
165
166                 proto_tree_add_item(who_tree, hf_who_loadav_10, offset, 4, loadav_10);
167                 offset += 4;
168
169                 proto_tree_add_item(who_tree, hf_who_loadav_15, offset, 4, loadav_15);
170                 offset += 4;
171
172                 tv.tv_sec = pntohl(&pd[offset]);
173                 proto_tree_add_item(who_tree, hf_who_boottime, offset, 4, &tv);
174                 offset += 4;
175
176                 dissect_whoent(pd, offset, fd, who_tree);
177         }
178 }
179
180 /* The man page says that (1024 / sizeof(struct whoent)) is the maximum number
181  * of whoent structures in the packet. */
182 #define SIZE_OF_WHOENT  24
183 #define MAX_NUM_WHOENTS (1024 / SIZE_OF_WHOENT)
184
185 static void
186 dissect_whoent(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
187 {
188         proto_tree      *whoent_tree = NULL;
189         proto_item      *whoent_ti = NULL;
190         int             line_offset = offset;
191         gchar           out_line[9];    
192         gchar           out_name[9];    
193         struct timeval  tv;
194         int             whoent_num = 0;
195         guint32         idle_secs; /* say that out loud... */
196
197         tv.tv_usec = 0;
198         out_line[8] = '\0';
199         out_name[8] = '\0';
200
201         while (BYTES_ARE_IN_FRAME(line_offset, SIZE_OF_WHOENT) && whoent_num < MAX_NUM_WHOENTS) {
202                 memcpy(out_line, &pd[line_offset], 8);
203                 memcpy(out_name, &pd[line_offset+8], 8);
204
205                 whoent_ti = proto_tree_add_item(tree, hf_who_whoent, line_offset, SIZE_OF_WHOENT, NULL);
206                 whoent_tree = proto_item_add_subtree(whoent_ti, ett_whoent);
207
208                 proto_tree_add_item(whoent_tree, hf_who_tty, line_offset, 8, out_line);
209                 line_offset += 8;
210
211                 proto_tree_add_item(whoent_tree, hf_who_uid, line_offset, 8, out_name);
212                 line_offset += 8;
213
214                 tv.tv_sec = pntohl(&pd[line_offset]);
215                 proto_tree_add_item(whoent_tree, hf_who_timeon, line_offset, 4, &tv);
216                 line_offset += 4;
217
218                 idle_secs = pntohl(&pd[line_offset]);
219                 proto_tree_add_item_format(whoent_tree, hf_who_idle, line_offset, 4, idle_secs,
220                                 "Idle: %s", time_secs_to_str(idle_secs));
221                 line_offset += 4;
222
223                 whoent_num++;
224         }
225 }
226
227 void
228 proto_register_who(void)
229 {
230         static hf_register_info hf[] = {
231                 { &hf_who_vers,
232                 { "Version",    "who.vers", FT_UINT8, BASE_DEC, NULL, 0x0,
233                         "" }},
234
235                 { &hf_who_type,
236                 { "Type",       "who.type", FT_UINT8, BASE_DEC, NULL, 0x0,
237                         "" }},
238
239                 { &hf_who_sendtime,
240                 { "Send Time",  "who.sendtime", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
241                         "" }},
242
243                 { &hf_who_recvtime,
244                 { "Receive Time", "who.recvtime", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
245                         "" }},
246
247                 { &hf_who_hostname,
248                 { "Hostname", "who.hostname", FT_STRING, BASE_NONE, NULL, 0x0,
249                         "" }},
250
251                 { &hf_who_loadav_5,
252                 { "Load Average Over Past  5 Minutes", "who.loadav_5", FT_DOUBLE, BASE_NONE, NULL, 0x0,
253                         "" }},
254
255                 { &hf_who_loadav_10,
256                 { "Load Average Over Past 10 Minutes", "who.loadav_10", FT_DOUBLE, BASE_NONE, NULL, 0x0,
257                         "" }},
258
259                 { &hf_who_loadav_15,
260                 { "Load Average Over Past 15 Minutes", "who.loadav_15", FT_DOUBLE, BASE_NONE, NULL, 0x0,
261                         "" }},
262
263                 { &hf_who_boottime,
264                 { "Boot Time", "who.boottime", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
265                         "" }},
266
267                 { &hf_who_whoent,
268                 { "Who utmp Entry", "who.whoent", FT_NONE, BASE_NONE, NULL, 0x0,
269                         "" }},
270
271                 { &hf_who_tty,
272                 { "TTY Name", "who.tty", FT_STRING, BASE_NONE, NULL, 0x0,
273                         "" }},
274
275                 { &hf_who_uid,
276                 { "User ID", "who.uid", FT_STRING, BASE_NONE, NULL, 0x0,
277                         "" }},
278
279                 { &hf_who_timeon,
280                 { "Time On", "who.timeon", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
281                         "" }},
282
283                 { &hf_who_idle,
284                 { "Time Idle", "who.idle", FT_UINT32, BASE_NONE, NULL, 0x0,
285                         "" }},
286         };
287
288         static gint *ett[] = {
289                 &ett_who,
290                 &ett_whoent,
291         };
292
293         proto_who = proto_register_protocol("Who", "who");
294         proto_register_field_array(proto_who, hf, array_length(hf));
295         proto_register_subtree_array(ett, array_length(ett));
296 }
297