aboutsummaryrefslogtreecommitdiffstats
path: root/packet-nbipx.c
blob: 8bb437cddaca6bbca570eeae00fb9f3b271d2516 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
/* packet-nbipx.c
 * Routines for NetBIOS over IPX packet disassembly
 * Gilbert Ramirez <gram@xiexie.org>
 *
 * $Id: packet-nbipx.c,v 1.23 2000/08/13 14:08:30 deniel Exp $
 *
 * Ethereal - Network traffic analyzer
 * By Gerald Combs <gerald@zing.org>
 * Copyright 1998 Gerald Combs
 *
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#ifdef HAVE_SYS_TYPES_H
# include <sys/types.h>
#endif

#include <glib.h>
#include "packet.h"
#include "packet-ipx.h"
#include "packet-netbios.h"
#include "packet-smb.h"

static int proto_nbipx = -1;

static gint ett_nbipx = -1;
static gint ett_nbipx_name_type_flags = -1;

enum nbipx_protocol {
	NETBIOS_NETWARE,
	NETBIOS_NWLINK
};

static void
dissect_nbipx_ns(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,
		int max_data);
static void
dissect_nbipx_dg(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,
		int max_data);

/* There is no RFC or public specification of Netware or Microsoft
 * NetBIOS over IPX packets. I have had to decode the protocol myself,
 * so there are holes and perhaps errors in this code. (gram)
 *
 * A list of "NovelNetBIOS" packet types can be found at
 *
 *	http://www.protocols.com/pbook/novel.htm#NetBIOS
 *
 * and at least some of those packet types appear to match what's in
 * some NBIPX packets.
 *
 * Note, however, that the offset of the packet type in an NBIPX packet
 * *DEPENDS ON THE PACKET TYPE*; "Find name" and "Name recognized" have
 * it at one offset, "Directed datagram" has it at another.  Does the
 * NBIPX code base it on the length, or what?  Non-broadcast directed
 * datagram packets have an IPX type of "IPX", just as "Find name" and
 * "Name recognized" do....  For now, we base it on the length.
 */
#define NBIPX_FIND_NAME		1
#define NBIPX_NAME_RECOGNIZED	2
#define NBIPX_CHECK_NAME	3
#define NBIPX_NAME_IN_USE	4
#define NBIPX_DEREGISTER_NAME	5
#define NBIPX_SESSION_DATA	6
#define NBIPX_SESSION_END	7
#define NBIPX_SESSION_END_ACK	8
#define NBIPX_STATUS_QUERY	9
#define NBIPX_STATUS_RESPONSE	10
#define NBIPX_DIRECTED_DATAGRAM	11

static const value_string nbipx_data_stream_type_vals[] = {
	{NBIPX_FIND_NAME,		"Find name"},
	{NBIPX_NAME_RECOGNIZED,		"Name recognized"},
	{NBIPX_CHECK_NAME,		"Check name"},
	{NBIPX_NAME_IN_USE,		"Name in use"},
	{NBIPX_DEREGISTER_NAME,		"Deregister name"},
	{NBIPX_SESSION_DATA,		"Session data"},
	{NBIPX_SESSION_END,		"Session end"},
	{NBIPX_SESSION_END_ACK,		"Session end ACK"},
	{NBIPX_STATUS_QUERY,		"Status query"},
	{NBIPX_STATUS_RESPONSE,		"Status response"},
	{NBIPX_DIRECTED_DATAGRAM,	"Directed datagram"},
	{0,				NULL}
};

#define NWLINK_NAME_QUERY	1
#define	NWLINK_SMB		2
#define	NWLINK_NETBIOS_DATAGRAM	3

static const value_string nwlink_data_stream_type_vals[] = {
	{NWLINK_NAME_QUERY,		"Name query"},
	{NWLINK_SMB,			"SMB"},
	{NWLINK_NETBIOS_DATAGRAM,	"NetBIOS datagram"},
	{0,				NULL}
};

/* NetWare */
void
dissect_nbipx(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
{
	int	max_data = pi.captured_len - offset;

	OLD_CHECK_DISPLAY_AS_DATA(proto_nbipx, pd, offset, fd, tree);

	if (check_col(fd, COL_PROTOCOL))
		col_add_str(fd, COL_PROTOCOL, "NBIPX");

	/*
	 * As said above, we look at the length of the packet to decide
	 * whether to treat it as a name-service packet or a datagram
	 * (the packet type would tell us, but it's at a *DIFFERENT
	 * LOCATION* in different types of packet...).
	 */
	if (END_OF_FRAME == 50)
		dissect_nbipx_ns(pd, offset, fd, tree, max_data);
	else
		dissect_nbipx_dg(pd, offset, fd, tree, max_data);
}

static void
add_routers(proto_tree *tree, const u_char *pd, int offset)
{
	int		i;
	int		rtr_offset;
	guint32		router;

	/* Eight routers are listed */
	for (i = 0; i < 8; i++) {
		rtr_offset = offset + (i << 2);
		memcpy(&router, &pd[rtr_offset], 4);
		if (router != 0) {
			proto_tree_add_text(tree, NullTVB, rtr_offset, 4, "IPX Network: %s",
					ipxnet_to_string((guint8*)&router));
		}
	}
}

static void
dissect_nbipx_ns(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,
		int max_data)
{
	proto_tree		*nbipx_tree;
	proto_item		*ti;
	guint8			packet_type;
	guint8			name_type_flag;
	proto_tree		*name_type_flag_tree;
	proto_item		*tf;
	char			name[(NETBIOS_NAME_LEN - 1)*4 + 1];
	int			name_type;

	name_type_flag = pd[offset+32];
	packet_type = pd[offset+33];
	name_type = get_netbios_name(pd, offset+34, name);

	if (check_col(fd, COL_INFO)) {
		switch (packet_type) {
		case NBIPX_FIND_NAME:
		case NBIPX_NAME_RECOGNIZED:
		case NBIPX_CHECK_NAME:
		case NBIPX_NAME_IN_USE:
		case NBIPX_DEREGISTER_NAME:
			col_add_fstr(fd, COL_INFO, "%s %s<%02x>",
				val_to_str(packet_type, nbipx_data_stream_type_vals, "Unknown"),
				name, name_type);
			break;

		default:
			col_add_fstr(fd, COL_INFO, "%s",
				val_to_str(packet_type, nbipx_data_stream_type_vals, "Unknown"));
			break;
		}
	}

	if (tree) {
		ti = proto_tree_add_item(tree, proto_nbipx, NullTVB, offset, 50, FALSE);
		nbipx_tree = proto_item_add_subtree(ti, ett_nbipx);

		add_routers(nbipx_tree, pd, offset);

		tf = proto_tree_add_text(nbipx_tree, NullTVB, offset+32, 1,
			"Name type flag: 0x%02x", name_type_flag);
		name_type_flag_tree = proto_item_add_subtree(tf,
				ett_nbipx_name_type_flags);
		proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
		    1, "%s",
		    decode_boolean_bitfield(name_type_flag, 0x80, 8,
		      "Group name", "Unique name"));
		proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
		    1, "%s",
		    decode_boolean_bitfield(name_type_flag, 0x40, 8,
		      "Name in use", "Name not used"));
		proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
		    1, "%s",
		    decode_boolean_bitfield(name_type_flag, 0x04, 8,
		      "Name registered", "Name not registered"));
		proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
		    1, "%s",
		    decode_boolean_bitfield(name_type_flag, 0x02, 8,
		      "Name duplicated", "Name not duplicated"));
		proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
		    1, "%s",
		    decode_boolean_bitfield(name_type_flag, 0x01, 8,
		      "Name deregistered", "Name not deregistered"));

		proto_tree_add_text(nbipx_tree, NullTVB, offset+33, 1,
			"Packet Type: %s (%02X)",
			val_to_str(packet_type, nbipx_data_stream_type_vals, "Unknown"),
			packet_type);

		netbios_add_name("Name", pd, offset + 34,
				nbipx_tree);
	}
}

static void
dissect_nbipx_dg(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,
		int max_data)
{
	proto_tree			*nbipx_tree;
	proto_item			*ti;

	if (check_col(fd, COL_INFO))
		col_add_fstr(fd, COL_INFO, "NetBIOS datagram over NBIPX");

	if (tree) {
		ti = proto_tree_add_item(tree, proto_nbipx, NullTVB, offset,
		    2+NETBIOS_NAME_LEN+NETBIOS_NAME_LEN, FALSE);
		nbipx_tree = proto_item_add_subtree(ti, ett_nbipx);

		proto_tree_add_text(nbipx_tree, NullTVB, offset, 1,
		    "Connection control: 0x%02x", pd[offset]);
		offset += 1;
		max_data -= 1;

		if (!BYTES_ARE_IN_FRAME(offset, 1))
			return;
		proto_tree_add_text(nbipx_tree, NullTVB, offset, 1,
				"Packet Type: %s (%02X)",
				val_to_str(pd[offset], nbipx_data_stream_type_vals, "Unknown"),
				pd[offset]);
		offset += 1;
		max_data -= 1;

		if (!netbios_add_name("Receiver's Name", pd, offset,
		    nbipx_tree))
			return;
		offset += NETBIOS_NAME_LEN;
		max_data -= NETBIOS_NAME_LEN;

		if (!netbios_add_name("Sender's Name", pd, offset,
		    nbipx_tree))
			return;
		offset += NETBIOS_NAME_LEN;
		max_data -= NETBIOS_NAME_LEN;

		if (max_data != 0)
			dissect_smb(pd, offset, fd, tree, max_data);
	}
}

static void
dissect_nwlink_dg(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
{
	int		max_data = pi.captured_len - offset;
	proto_tree	*nbipx_tree;
	proto_item	*ti;
	guint8		packet_type;
	guint8		name_type_flag;
	proto_tree	*name_type_flag_tree;
	proto_item	*tf;
	char		name[(NETBIOS_NAME_LEN - 1)*4 + 1];
	int		name_type;
	char		node_name[(NETBIOS_NAME_LEN - 1)*4 + 1];
	int		node_name_type = 0;

	name_type_flag = pd[offset+32];
	packet_type = pd[offset+33];
	name_type = get_netbios_name(pd, offset+36, name);
	node_name_type = get_netbios_name(pd, offset+52, node_name);

	if (check_col(fd, COL_PROTOCOL))
		col_add_str(fd, COL_PROTOCOL, "NWLink");

	if (check_col(fd, COL_INFO)) {
		/*
		 * XXX - Microsoft Network Monitor thinks that the octet
		 * at 32 is a packet type, e.g. "mailslot write" for
		 * browser announcements, and that the octet at 33 is a
		 * name type, in the sense of the 16th byte of a
		 * NetBIOS name.
		 *
		 * A name type of 2 shows up in a "host announcement",
		 * and a name type of 3 shows up in a "local master
		 * annoumcement", so maybe that field really *is* a
		 * name type - the fact that it's not associated with
		 * any of the NetBIOS names in the packet nonwithstanding.
		 *
		 * I haven't seen any packets with the name type octet
		 * being anything other than 2 or 3, so I don't know
		 * whether those are name service operations; however,
		 * given that NWLink, unlike socket-0x0455 NBIPX,
		 * has separate sockets for name queries and datagrams,
		 * it may be that this really is a name type, and that
		 * these are all datagrams, not name queries.
		 */
		switch (packet_type) {
		case NWLINK_NAME_QUERY:
			col_add_fstr(fd, COL_INFO, "Name Query for %s<%02x>",
					name, name_type);
			break;

		case NWLINK_SMB:
			/* Session? */
			col_add_fstr(fd, COL_INFO, "SMB over NBIPX");
			break;

		case NWLINK_NETBIOS_DATAGRAM:
			/* Datagram? (Where did we see this?) */
			col_add_fstr(fd, COL_INFO, "NetBIOS datagram over NBIPX");
			break;
				
		default:
			col_add_str(fd, COL_INFO, "NetBIOS over IPX (NWLink)");
			break;
		}
	}

	if (tree) {
		ti = proto_tree_add_item(tree, proto_nbipx, NullTVB, offset, 68, FALSE);
		nbipx_tree = proto_item_add_subtree(ti, ett_nbipx);

		add_routers(nbipx_tree, pd, offset);

		/*
		 * XXX - is "packet_type" really a packet type?  See
		 * above.
		 */
		if (packet_type != NWLINK_SMB &&
		      packet_type != NWLINK_NETBIOS_DATAGRAM) {
			tf = proto_tree_add_text(nbipx_tree, NullTVB, offset+32, 1,
				"Name type flag: 0x%02x",
				name_type_flag);
			name_type_flag_tree = proto_item_add_subtree(tf,
					ett_nbipx_name_type_flags);
			proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
			    1, "%s",
			    decode_boolean_bitfield(name_type_flag, 0x80, 8,
			      "Group name", "Unique name"));
			proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
			    1, "%s",
			    decode_boolean_bitfield(name_type_flag, 0x40, 8,
			      "Name in use", "Name not used"));
			proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
			    1, "%s",
			    decode_boolean_bitfield(name_type_flag, 0x04, 8,
			      "Name registered", "Name not registered"));
			proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
			    1, "%s",
			    decode_boolean_bitfield(name_type_flag, 0x02, 8,
			      "Name duplicated", "Name not duplicated"));
			proto_tree_add_text(name_type_flag_tree, NullTVB, offset+32,
			    1, "%s",
			    decode_boolean_bitfield(name_type_flag, 0x01, 8,
			      "Name deregistered", "Name not deregistered"));

			if (!netbios_add_name("Group name", pd, offset+36,
			    nbipx_tree))
				return;
			if (!netbios_add_name("Node name", pd, offset+52,
			    nbipx_tree))
				return;
			proto_tree_add_text(nbipx_tree, NullTVB, offset+33, 1,
			    "Packet Type: %s (%02X)",
			    val_to_str(packet_type, nwlink_data_stream_type_vals, "Unknown"),
			    packet_type);
		} else {
			proto_tree_add_text(nbipx_tree, NullTVB, offset+32, 1,
			    "Packet type: 0x%02x", name_type_flag);
			proto_tree_add_text(nbipx_tree, NullTVB, offset+33, 1,
			    "Name Type: %s (0x%02x)",
			    netbios_name_type_descr(packet_type),
			    packet_type);
			proto_tree_add_text(nbipx_tree, NullTVB, offset+34, 2,
			    "Message ID: 0x%04x", pletohs(&pd[offset+34]));
			if (!netbios_add_name("Requested name", pd, offset+36,
			    nbipx_tree))
				return;
			if (!netbios_add_name("Source name", pd, offset+52,
			    nbipx_tree))
				return;
		}
	}

	offset += 68;
	max_data -= 68;

	if (max_data != 0) {
		switch (packet_type) {
		case NWLINK_SMB:
		case NWLINK_NETBIOS_DATAGRAM:
			dissect_smb(pd, offset, fd, tree, max_data);
			break;
				
		default:
			old_dissect_data(pd, offset, fd, tree);
			break;
		}
	}
}

void
proto_register_nbipx(void)
{
/*        static hf_register_info hf[] = {
                { &variable,
                { "Name",           "nbipx.abbreviation", TYPE, VALS_POINTER }},
        };*/
	static gint *ett[] = {
		&ett_nbipx,
		&ett_nbipx_name_type_flags,
	};

        proto_nbipx = proto_register_protocol("NetBIOS over IPX", "nbipx");
 /*       proto_register_field_array(proto_nbipx, hf, array_length(hf));*/
	proto_register_subtree_array(ett, array_length(ett));
}

void
proto_reg_handoff_nbipx(void)
{
	old_dissector_add("ipx.socket", IPX_SOCKET_NWLINK_SMB_DGRAM, dissect_nwlink_dg);
}