diff options
author | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2001-07-10 21:06:53 +0000 |
---|---|---|
committer | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2001-07-10 21:06:53 +0000 |
commit | 7412cabd103197251658164315ab550e26e00384 (patch) | |
tree | 7b14b41d4ebcce672d4394343f668883b122c994 /packet-tacacs.c | |
parent | 85987ec36ba434c9ba73367ecac6e5d3782cb945 (diff) |
From Paul Ionescu: fleshed out TACACS/XTACACS/TACACS+ dissector.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@3679 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'packet-tacacs.c')
-rw-r--r-- | packet-tacacs.c | 196 |
1 files changed, 132 insertions, 64 deletions
diff --git a/packet-tacacs.c b/packet-tacacs.c index aebd3c3e06..f5c9315564 100644 --- a/packet-tacacs.c +++ b/packet-tacacs.c @@ -1,13 +1,14 @@ /* packet-tacacs.c - * Routines for cisco tacacs/tacplus/AAA packet dissection + * Routines for cisco tacacs/xtacacs/tacacs+ packet dissection + * Copyright 2001, Paul Ionescu <paul@acorp.ro> * - * $Id: packet-tacacs.c,v 1.12 2001/06/18 02:17:53 guy Exp $ + * $Id: packet-tacacs.c,v 1.13 2001/07/10 21:06:53 guy Exp $ * * Ethereal - Network traffic analyzer - * By Gerald Combs <gerald@zing.org> + * By Gerald Combs <gerald@ethereal.com> * Copyright 1998 Gerald Combs * - * Copied from packet-tftp.c + * Copied from old packet-tacacs.c * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License @@ -24,6 +25,11 @@ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ + +/* rfc-1492 for tacacs and xtacacs + * draft-grant-tacacs-00.txt for tacacs+ (tacplus) + */ + #ifdef HAVE_CONFIG_H # include "config.h" #endif @@ -43,12 +49,48 @@ #include "packet.h" static int proto_tacacs = -1; -static int hf_tacacs_request = -1; -static int hf_tacacs_response = -1; -static int hf_tacacs_version = -1; static gint ett_tacacs = -1; +static const value_string tacacs_type_vals[] = { + { 1 , "Login" }, + { 2 , "Response" }, + { 3 , "Change" }, + { 4 , "Follow" }, + { 5 , "Connect" }, + { 6 , "Superuser" }, + { 7 , "Logout" }, + { 8 , "Reload" }, + { 9 , "SLIP on" }, + { 10 , "SLIP off" }, + { 11 , "SLIP Addr" }, + { 0 , NULL }}; + +static const value_string tacacs_reason_vals[] = { + { 0 , "none" }, + { 1 , "expiring" }, + { 2 , "password" }, + { 3 , "denied" }, + { 4 , "quit" }, + { 5 , "idle" }, + { 6 , "drop" }, + { 7 , "bad" }}; + +static const value_string tacacs_resp_vals[] = { + { 0 , "this is not a response" }, + { 1 , "accepted" }, + { 2 , "rejected" }}; + +#define TAC_PLUS_AUTHEN 1 +#define TAC_PLUS_AUTHOR 2 +#define TAC_PLUS_ACCT 3 + +static const value_string tacplus_type_vals[] = { + { TAC_PLUS_AUTHEN , "Authentication" }, + { TAC_PLUS_AUTHOR , "Authorization" }, + { TAC_PLUS_ACCT , "Accounting" }, + { 0 , NULL }}; + #define UDP_PORT_TACACS 49 #define TCP_PORT_TACACS 49 @@ -56,39 +98,73 @@ static void dissect_tacacs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_tree *tacacs_tree, *ti; + guint8 txt_buff[256],version,type,userlen,passlen; + version = tvb_get_guint8(tvb,0); + type = tvb_get_guint8(tvb,1); + if (check_col(pinfo->fd, COL_PROTOCOL)) - col_set_str(pinfo->fd, COL_PROTOCOL, "TACACS"); + col_set_str(pinfo->fd, COL_PROTOCOL, version==0 ? "TACACS":"XTACACS"); if (check_col(pinfo->fd, COL_INFO)) - { - col_add_str(pinfo->fd, COL_INFO, - (pinfo->match_port == pinfo->destport) ? "Request" : "Response"); - } + col_add_str(pinfo->fd, COL_INFO, val_to_str(type, tacacs_type_vals, "Unknown Type")); if (tree) { - ti = proto_tree_add_item(tree, proto_tacacs, tvb, 0, - tvb_length(tvb), FALSE); + ti = proto_tree_add_protocol_format(tree, proto_tacacs, + tvb, 0, tvb_length(tvb), version==0?"TACACS":"XTACACS"); tacacs_tree = proto_item_add_subtree(ti, ett_tacacs); - proto_tree_add_string(tacacs_tree, hf_tacacs_version, tvb, - 0, 0, "XTacacs"); - - if (pinfo->match_port == pinfo->destport) - { - proto_tree_add_boolean_hidden(tacacs_tree, hf_tacacs_request, tvb, - 0, tvb_length(tvb), TRUE); - proto_tree_add_text(tacacs_tree, tvb, 0, - tvb_length(tvb), "Request: <opaque data>" ); + proto_tree_add_text(tacacs_tree, tvb, 0, 1, "Version = %s ",version==0?"TACACS":"XTACACS" ); + proto_tree_add_text(tacacs_tree, tvb, 1, 1, "Type = %s ",val_to_str(type, tacacs_type_vals, "Unknown Type")); + proto_tree_add_text(tacacs_tree, tvb, 2, 2, "Nonce = 0x%04X ",tvb_get_ntohs(tvb,2)); + + if (version==0) + { + if (type!=2) + { + userlen=tvb_get_guint8(tvb,4); + passlen=tvb_get_guint8(tvb,5); + proto_tree_add_text(tacacs_tree, tvb, 4, 1, "Username length = %d ",userlen); + proto_tree_add_text(tacacs_tree, tvb, 5, 1, "Password length = %d ",passlen); + tvb_get_nstringz0(tvb,6,userlen,txt_buff); + proto_tree_add_text(tacacs_tree, tvb, 6, userlen, "User = %s ",txt_buff); + tvb_get_nstringz0(tvb,6+userlen,passlen,txt_buff); + proto_tree_add_text(tacacs_tree, tvb, 6+userlen, passlen, "Password = %s ",txt_buff); } - else - { - proto_tree_add_boolean_hidden(tacacs_tree, hf_tacacs_response, tvb, - 0, tvb_length(tvb), TRUE); - proto_tree_add_text(tacacs_tree, tvb, 0, - tvb_length(tvb), "Response: <opaque data>"); + else + { + proto_tree_add_text(tacacs_tree, tvb, 4, 1, "Response = %s", + val_to_str(tvb_get_guint8(tvb,4), tacacs_resp_vals, "Unknown Response")); + proto_tree_add_text(tacacs_tree, tvb, 5, 1, "Reason = %s", + val_to_str(tvb_get_guint8(tvb,5), tacacs_reason_vals, "Unknown Reason")); } + } + else + { + userlen=tvb_get_guint8(tvb,4); + passlen=tvb_get_guint8(tvb,5); + proto_tree_add_text(tacacs_tree, tvb, 4, 1, "Username length = %d ",userlen); + proto_tree_add_text(tacacs_tree, tvb, 5, 1, "Password length = %d ",passlen); + proto_tree_add_text(tacacs_tree, tvb, 6, 1, "Response = %s", + val_to_str(tvb_get_guint8(tvb,6), tacacs_resp_vals, "Unknown Response")); + proto_tree_add_text(tacacs_tree, tvb, 7, 1, "Reason = %s", + val_to_str(tvb_get_guint8(tvb,7), tacacs_reason_vals, "Unknown Reason")); + proto_tree_add_text(tacacs_tree, tvb, 8, 4, "Result1 = 0x%08X ",tvb_get_ntohl(tvb,8)); + tvb_memcpy(tvb,txt_buff,12,4); + proto_tree_add_text(tacacs_tree, tvb, 12, 4, "IP addr = %s ",ip_to_str(txt_buff)); + proto_tree_add_text(tacacs_tree, tvb, 16, 2, "Dst port = %d ",tvb_get_ntohs(tvb,16)); + proto_tree_add_text(tacacs_tree, tvb, 18, 2, "Line = tty%d ",tvb_get_ntohs(tvb,18)); + proto_tree_add_text(tacacs_tree, tvb, 20, 4, "Result2 = 0x%08X ",tvb_get_ntohl(tvb,20)); + proto_tree_add_text(tacacs_tree, tvb, 24, 2, "Result3 = 0x%04X ",tvb_get_ntohs(tvb,24)); + if (type!=2) + { + tvb_get_nstringz0(tvb,26,userlen,txt_buff); + proto_tree_add_text(tacacs_tree, tvb, 26, userlen, "User = %s ",txt_buff); + tvb_get_nstringz0(tvb,26+userlen,passlen,txt_buff); + proto_tree_add_text(tacacs_tree, tvb, 26+userlen, passlen, "Password = %s ",txt_buff); + } + } } } @@ -96,64 +172,56 @@ static void dissect_tacplus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_tree *tacacs_tree, *ti; + guint8 version,type,seq_no,flags; + guint32 len; + gboolean request=(pinfo->match_port == pinfo->destport); if (check_col(pinfo->fd, COL_PROTOCOL)) - col_set_str(pinfo->fd, COL_PROTOCOL, "TACACS"); + col_set_str(pinfo->fd, COL_PROTOCOL, "TACACS+"); if (check_col(pinfo->fd, COL_INFO)) { col_add_str(pinfo->fd, COL_INFO, - (pinfo->match_port == pinfo->destport) ? "Request" : "Response"); + request ? "Request" : "Response"); } if (tree) { - ti = proto_tree_add_item(tree, proto_tacacs, tvb, 0, - tvb_length(tvb), FALSE); - tacacs_tree = proto_item_add_subtree(ti, ett_tacacs); + ti = proto_tree_add_protocol_format(tree, proto_tacacs, + tvb, 0, tvb_length(tvb), "TACACS+"); - proto_tree_add_string(tacacs_tree, hf_tacacs_version, tvb, 0, 0, "Tacacs+"); + version = tvb_get_guint8(tvb,0); + type = tvb_get_guint8(tvb,1); + seq_no = tvb_get_guint8(tvb,2); + flags = tvb_get_guint8(tvb,3); + len = tvb_get_ntohl(tvb,8); - if (pinfo->match_port == pinfo->destport) - { - proto_tree_add_boolean_hidden(tacacs_tree, hf_tacacs_request, tvb, - 0, tvb_length(tvb), TRUE); - proto_tree_add_text(tacacs_tree, tvb, 0, - tvb_length(tvb), "Request: <opaque data>" ); - } + tacacs_tree = proto_item_add_subtree(ti, ett_tacacs); + proto_tree_add_text(tacacs_tree, tvb, 0, 1, "Major version = %s ",(version&0xf0)==0xc0?"TACACS+":"Unknown Version" ); + proto_tree_add_text(tacacs_tree, tvb, 0, 1, "Minor version = %d ",version&0xf); + proto_tree_add_text(tacacs_tree, tvb, 1, 1, "Type = %s ",val_to_str(type, tacplus_type_vals, "Unknown Type")); + proto_tree_add_text(tacacs_tree, tvb, 2, 1, "Seq. no = %d ",tvb_get_guint8(tvb,2)); + proto_tree_add_text(tacacs_tree, tvb, 3, 1, "Flags = %s, %s ", + (flags&1)==0?"Encripted payload":"Unencripted payload",(flags&4)==0?"Multiple Connections":"Single connection"); + proto_tree_add_text(tacacs_tree, tvb, 4, 4, "Session ID = %d ",tvb_get_ntohl(tvb,4)); + proto_tree_add_text(tacacs_tree, tvb, 8, 4, "Packet len = %d ",len); + + if ((flags&1)==0) + proto_tree_add_text(tacacs_tree, tvb, 12, len, "Encripted payload"); else - { - proto_tree_add_boolean_hidden(tacacs_tree, hf_tacacs_response, tvb, - 0, tvb_length(tvb), TRUE); - proto_tree_add_text(tacacs_tree, tvb, 0, - tvb_length(tvb), "Response: <opaque data>"); - } + proto_tree_add_text(tacacs_tree, tvb, 12, len, "Payload"); + + } } void proto_register_tacacs(void) { - static hf_register_info hf[] = { - { &hf_tacacs_version, - { "Tacacs Version", "tacacs.version", - FT_STRING, BASE_NONE, NULL, 0x0, - "xtacacs or tacplus", HFILL }}, - { &hf_tacacs_response, - { "Response", "tacacs.response", - FT_BOOLEAN, BASE_NONE, NULL, 0x0, - "TRUE if TACACS response", HFILL }}, - { &hf_tacacs_request, - { "Request", "tacacs.request", - FT_BOOLEAN, BASE_NONE, NULL, 0x0, - "TRUE if TACACS request", HFILL }} - }; - static gint *ett[] = { &ett_tacacs, }; proto_tacacs = proto_register_protocol("TACACS", "TACACS", "tacacs"); - proto_register_field_array(proto_tacacs, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); } |