/* packet-ftp.c * Routines for ftp packet dissection * Copyright 1999, Richard Sharpe * * $Id: packet-ftp.c,v 1.25 2001/01/03 06:55:28 guy Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs * Copyright 1998 Gerald Combs * * Copied from packet-pop.c * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ #ifdef HAVE_CONFIG_H # include "config.h" #endif #include #include #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_NETINET_IN_H # include #endif #include #include #include "packet.h" #include "strutil.h" static int proto_ftp = -1; static int proto_ftp_data = -1; static int hf_ftp_response = -1; static int hf_ftp_request = -1; static int hf_ftp_request_command = -1; static int hf_ftp_request_data = -1; static int hf_ftp_response_code = -1; static int hf_ftp_response_data = -1; static gint ett_ftp = -1; static gint ett_ftp_data = -1; #define TCP_PORT_FTPDATA 20 #define TCP_PORT_FTP 21 static void dissect_ftp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { gboolean is_request; proto_tree *ftp_tree; proto_item *ti; gint offset = 0; const u_char *line; gint next_offset; int linelen; int tokenlen; const u_char *next_token; CHECK_DISPLAY_AS_DATA(proto_ftp, tvb, pinfo, tree); if (pinfo->match_port == pinfo->destport) is_request = TRUE; else is_request = FALSE; pinfo->current_proto = "FTP"; if (check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, "FTP"); /* * Find the end of the first line. */ linelen = tvb_find_line_end(tvb, offset, -1, &next_offset); line = tvb_get_ptr(tvb, offset, linelen); if (check_col(pinfo->fd, COL_INFO)) { /* * Put the first line from the buffer into the summary. * (but leave out the line terminator). */ col_add_fstr(pinfo->fd, COL_INFO, "%s: %s", is_request ? "Request" : "Response", format_text(line, linelen)); } if (tree) { ti = proto_tree_add_item(tree, proto_ftp, tvb, offset, tvb_length_remaining(tvb, offset), FALSE); ftp_tree = proto_item_add_subtree(ti, ett_ftp); if (is_request) { proto_tree_add_boolean_hidden(ftp_tree, hf_ftp_request, tvb, 0, 0, TRUE); proto_tree_add_boolean_hidden(ftp_tree, hf_ftp_response, tvb, 0, 0, FALSE); } else { proto_tree_add_boolean_hidden(ftp_tree, hf_ftp_request, tvb, 0, 0, FALSE); proto_tree_add_boolean_hidden(ftp_tree, hf_ftp_response, tvb, 0, 0, TRUE); } /* * Extract the first token, and, if there is a first * token, add it as the request or reply code. */ tokenlen = get_token_len(line, line + linelen, &next_token); if (tokenlen != 0) { if (is_request) { proto_tree_add_string_format(ftp_tree, hf_ftp_request_command, tvb, offset, tokenlen, line, "Request: %s", format_text(line, tokenlen)); } else { proto_tree_add_uint_format(ftp_tree, hf_ftp_response_code, tvb, offset, tokenlen, atoi(line), "Response: %s", format_text(line, tokenlen)); } offset += next_token - line; linelen -= next_token - line; line = next_token; } /* * Add the rest of the first line as request or * reply data. */ if (linelen != 0) { if (is_request) { proto_tree_add_string_format(ftp_tree, hf_ftp_request_data, tvb, offset, linelen, line, "Request Arg: %s", format_text(line, linelen)); } else { proto_tree_add_string_format(ftp_tree, hf_ftp_response_data, tvb, offset, linelen, line, "Response Arg: %s", format_text(line, linelen)); } } offset = next_offset; /* * Show the rest of the request or response as text, * a line at a time. */ while (tvb_offset_exists(tvb, offset)) { /* * Find the end of the line. */ linelen = tvb_find_line_end(tvb, offset, -1, &next_offset); /* * Put this line. */ proto_tree_add_text(ftp_tree, tvb, offset, next_offset - offset, "%s", tvb_format_text(tvb, offset, next_offset - offset)); offset = next_offset; } } } static void dissect_ftpdata(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_tree *ti, *ftp_data_tree; int data_length; CHECK_DISPLAY_AS_DATA(proto_ftp_data, tvb, pinfo, tree); pinfo->current_proto = "FTP-DATA"; if (check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, "FTP-DATA"); if (check_col(pinfo->fd, COL_INFO)) { col_add_fstr(pinfo->fd, COL_INFO, "FTP Data: %u bytes", tvb_length(tvb)); } if (tree) { data_length = tvb_length(tvb); ti = proto_tree_add_item(tree, proto_ftp_data, tvb, 0, data_length, FALSE); ftp_data_tree = proto_item_add_subtree(ti, ett_ftp_data); /* * XXX - if this is binary data, it'll produce * a *really* long line. */ proto_tree_add_text(ftp_data_tree, tvb, 0, data_length, "FTP Data: %s", tvb_format_text(tvb, 0, data_length)); } } void proto_register_ftp(void) { static hf_register_info hf[] = { { &hf_ftp_response, { "Response", "ftp.response", FT_BOOLEAN, BASE_NONE, NULL, 0x0, "TRUE if FTP response" }}, { &hf_ftp_request, { "Request", "ftp.request", FT_BOOLEAN, BASE_NONE, NULL, 0x0, "TRUE if FTP request" }}, { &hf_ftp_request_command, { "Request command", "ftp.request.command", FT_STRING, BASE_NONE, NULL, 0x0, "" }}, { &hf_ftp_request_data, { "Request data", "ftp.request.data", FT_STRING, BASE_NONE, NULL, 0x0, "" }}, { &hf_ftp_response_code, { "Response code", "ftp.response.code", FT_UINT8, BASE_DEC, NULL, 0x0, "" }}, { &hf_ftp_response_data, { "Response data", "ftp.reponse.data", FT_STRING, BASE_NONE, NULL, 0x0, "" }} }; static gint *ett[] = { &ett_ftp, &ett_ftp_data, }; proto_ftp = proto_register_protocol("File Transfer Protocol (FTP)", "FTP", "ftp"); proto_ftp_data = proto_register_protocol("FTP Data", "FTP-DATA", "ftp-data"); proto_register_field_array(proto_ftp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_ftp(void) { dissector_add("tcp.port", TCP_PORT_FTPDATA, &dissect_ftpdata); dissector_add("tcp.port", TCP_PORT_FTP, &dissect_ftp); }