diff options
| -rw-r--r-- | Makefile.am | 3 | ||||
| -rw-r--r-- | packet-qllc.c | 191 | ||||
| -rw-r--r-- | packet-sna.c | 3 | ||||
| -rw-r--r-- | packet-x25.c | 98 |
4 files changed, 263 insertions, 32 deletions
diff --git a/Makefile.am b/Makefile.am index 1cb71bc72f..5947633cdd 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,7 +1,7 @@ # Makefile.am # Automake file for Ethereal # -# $Id: Makefile.am,v 1.380 2001/11/15 20:35:23 gram Exp $ +# $Id: Makefile.am,v 1.381 2001/11/15 21:11:01 gram Exp $ # # Ethereal - Network traffic analyzer # By Gerald Combs <gerald@ethereal.com> @@ -211,6 +211,7 @@ DISSECTOR_SRC = \ packet-pptp.c \ packet-q2931.c \ packet-q931.c \ + packet-qllc.c \ packet-quake.c \ packet-quakeworld.c \ packet-quake2.c \ diff --git a/packet-qllc.c b/packet-qllc.c new file mode 100644 index 0000000000..27e064b24a --- /dev/null +++ b/packet-qllc.c @@ -0,0 +1,191 @@ +/* packet-qllc.c + * Routines for QLLC protocol - Qualified? LLC + * Gilbert Ramirez <gram@alumni.rice.edu> + * + * $Id: packet-qllc.c,v 1.1 2001/11/15 21:11:01 gram Exp $ + * + * Ethereal - Network traffic analyzer + * By Gerald Combs <gerald@zing.org> + * Copyright 2001 Gerald Combs + * + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif + +#ifdef HAVE_SYS_TYPES_H +# include <sys/types.h> +#endif + +#include <glib.h> +#include "packet.h" + + +static int proto_qllc = -1; +static int hf_qllc_address = -1; +static int hf_qllc_control = -1; + +static gint ett_qllc = -1; + +#define QSM 0x93 +#define QDISC 0x53 +#define QXID 0xbf +#define QTEST 0xf3 +#define QRR 0xf1 +#define QRD 0x53 +#define QUA 0x73 +#define QDM 0x1f +#define QFRMR 0x97 +#define QUI 0x03 +#define QUI_NO_REPLY 0x13 +#define QSIM 0x17 + +#define QRD_QDISC_VALUE 0x53 +#define QDISC_TEXT "QDISC" +#define QRD_TEXT "QRD" + +/* Control Field */ +static const value_string qllc_control_vals[] = { + { QUI, "QUI" }, + { QUI_NO_REPLY, "QUI - reply required" }, + { QSIM, "QSIM" }, + { QDM, "QDM" }, + { QUA, "QUA" }, + { QSM, "QSM" }, + { QFRMR, "QFRMR" }, + { QXID, "QXID" }, + { QRR, "QRR" }, + { QTEST, "QTEST" }, + { QDISC, QDISC_TEXT }, + { QRD, QRD_TEXT }, + { 0x00, NULL }, +}; + + +static void +dissect_qllc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) +{ + proto_tree *qllc_tree = NULL; + proto_item *qllc_ti = NULL; + guint8 address, ctrl; + gboolean command = FALSE; + + /* Summary information */ + if (check_col(pinfo->fd, COL_PROTOCOL)) + col_set_str(pinfo->fd, COL_PROTOCOL, "QLLC"); + if (check_col(pinfo->fd, COL_INFO)) + col_clear(pinfo->fd, COL_INFO); + + if (tree) { + qllc_ti = proto_tree_add_item(tree, proto_qllc, tvb, 0, + tvb_length(tvb), FALSE); + qllc_tree = proto_item_add_subtree(qllc_ti, ett_qllc); + + } + + /* Get the address; we need it to determine if this is a + * COMMAND or a RESPONSE */ + address = tvb_get_guint8(tvb, 0); + if (tree) { + proto_tree_add_item(qllc_tree, hf_qllc_address, tvb, 0, 1, FALSE); + } + + /* The address field equals X'FF' in commands (except QRR) + * and anything in responses. */ + ctrl = tvb_get_guint8(tvb, 1); + if (ctrl != QRR && address == 0xff) { + command = TRUE; + } + + + /* Disambiguate QRD_QDISC_VALUE, based on whether this packet is + * a COMMAND or RESPONSE. */ + if (ctrl == QRD_QDISC_VALUE) { + if (command) { + if (check_col(pinfo->fd, COL_INFO)) { + col_set_str(pinfo->fd, COL_INFO, QDISC_TEXT); + } + if (tree) { + proto_tree_add_text(qllc_tree, tvb, + 1, 1, "Control Field: %s (0x%02x)", QDISC_TEXT, ctrl); + } + } + else { + if (check_col(pinfo->fd, COL_INFO)) { + col_set_str(pinfo->fd, COL_INFO, QRD_TEXT); + } + if (tree) { + proto_tree_add_text(qllc_tree, tvb, + 1, 1, "Control Field: %s (0x%02x)", QRD_TEXT, ctrl); + } + } + + /* Add the field for filtering purposes */ + if (tree) { + proto_tree_add_uint_hidden(qllc_tree, hf_qllc_control, tvb, + 1, 1, ctrl); + } + } + else { + /* Non-ambiguous control field value */ + if (check_col(pinfo->fd, COL_INFO)) { + col_set_str(pinfo->fd, COL_INFO, + val_to_str(ctrl, qllc_control_vals, + "Control Field: 0x%02x (unknown)")); + } + if (tree) { + proto_tree_add_uint(qllc_tree, hf_qllc_control, tvb, + 1, 1, ctrl); + } + } + + /* Do we have an I field ? */ + /* XXX - I field exists for QUI too, but only for subarea nodes. + * Need to test for this. */ + if (ctrl == QXID || ctrl == QTEST || ctrl == QFRMR) { + /* yes */ + } + +} + + +void +proto_register_qllc(void) +{ + static hf_register_info hf[] = { + { &hf_qllc_address, + { "Address Field", "qllc.address", FT_UINT8, BASE_HEX, NULL, 0x0, + "", HFILL }}, + + { &hf_qllc_control, + { "Control Field", "qllc.control", FT_UINT8, BASE_HEX, + VALS(qllc_control_vals), 0x0, "", HFILL }}, + + }; + + static gint *ett[] = { + &ett_qllc, + }; + + proto_qllc = proto_register_protocol("Qualified Logical Link Control", + "QLLC", "qllc"); + proto_register_field_array(proto_qllc, hf, array_length(hf)); + proto_register_subtree_array(ett, array_length(ett)); + register_dissector("qllc", dissect_qllc, proto_qllc); +} + diff --git a/packet-sna.c b/packet-sna.c index 40d2020c37..f4bc0bc1fd 100644 --- a/packet-sna.c +++ b/packet-sna.c @@ -2,7 +2,7 @@ * Routines for SNA * Gilbert Ramirez <gram@alumni.rice.edu> * - * $Id: packet-sna.c,v 1.32 2001/11/13 23:55:30 gram Exp $ + * $Id: packet-sna.c,v 1.33 2001/11/15 21:11:01 gram Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@ethereal.com> @@ -1191,6 +1191,7 @@ proto_register_sna(void) "SNA", "sna"); proto_register_field_array(proto_sna, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + register_dissector("sna", dissect_sna, proto_sna); } void diff --git a/packet-x25.c b/packet-x25.c index 01f71eb1f9..bd84405d38 100644 --- a/packet-x25.c +++ b/packet-x25.c @@ -2,7 +2,7 @@ * Routines for x25 packet disassembly * Olivier Abad <oabad@cybercable.fr> * - * $Id: packet-x25.c,v 1.53 2001/07/18 15:49:29 oabad Exp $ + * $Id: packet-x25.c,v 1.54 2001/11/15 21:11:01 gram Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@zing.org> @@ -38,6 +38,7 @@ #include <string.h> #include "llcsaps.h" #include "packet.h" +#include "prefs.h" #include "nlpid.h" #define FROM_DCE 0x80 @@ -155,6 +156,11 @@ static const value_string vals_x25_type[] = { static dissector_handle_t ip_handle; static dissector_handle_t ositp_handle; +static dissector_handle_t sna_handle; +static dissector_handle_t qllc_handle; + +/* Preferences */ +static gboolean non_q_bit_is_sna = FALSE; /* * each vc_info node contains : @@ -1482,6 +1488,7 @@ dissect_x25(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) guint16 bytes0_1; guint8 pkt_type; tvbuff_t *next_tvb; + gboolean q_bit_set = FALSE; if (check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, "X.25"); @@ -1508,24 +1515,32 @@ dissect_x25(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) pkt_type = tvb_get_guint8(tvb, 2); if (tree) { - ti = proto_tree_add_item(tree, proto_x25, tvb, 0, x25_pkt_len, FALSE); - x25_tree = proto_item_add_subtree(ti, ett_x25); - ti = proto_tree_add_item(x25_tree, hf_x25_gfi, tvb, 0, 2, FALSE); - gfi_tree = proto_item_add_subtree(ti, ett_x25_gfi); - if ((pkt_type & 0x01) == X25_DATA) - proto_tree_add_boolean(gfi_tree, hf_x25_qbit, tvb, 0, 2, - bytes0_1); - else if (pkt_type == X25_CALL_REQUEST || - pkt_type == X25_CALL_ACCEPTED || - pkt_type == X25_CLEAR_REQUEST || - pkt_type == X25_CLEAR_CONFIRMATION) - proto_tree_add_boolean(gfi_tree, hf_x25_abit, tvb, 0, 2, - bytes0_1); - if (pkt_type == X25_CALL_REQUEST || pkt_type == X25_CALL_ACCEPTED || - (pkt_type & 0x01) == X25_DATA) - proto_tree_add_boolean(gfi_tree, hf_x25_dbit, tvb, 0, 2, - bytes0_1); - proto_tree_add_uint(gfi_tree, hf_x25_mod, tvb, 0, 2, bytes0_1); + ti = proto_tree_add_item(tree, proto_x25, tvb, 0, x25_pkt_len, FALSE); + x25_tree = proto_item_add_subtree(ti, ett_x25); + ti = proto_tree_add_item(x25_tree, hf_x25_gfi, tvb, 0, 2, FALSE); + gfi_tree = proto_item_add_subtree(ti, ett_x25_gfi); + + if ((pkt_type & 0x01) == X25_DATA) { + proto_tree_add_boolean(gfi_tree, hf_x25_qbit, tvb, 0, 2, + bytes0_1); + if (bytes0_1 & 0x8000) { + q_bit_set = TRUE; + } + } + else if (pkt_type == X25_CALL_REQUEST || + pkt_type == X25_CALL_ACCEPTED || + pkt_type == X25_CLEAR_REQUEST || + pkt_type == X25_CLEAR_CONFIRMATION) { + proto_tree_add_boolean(gfi_tree, hf_x25_abit, tvb, 0, 2, + bytes0_1); + } + + if (pkt_type == X25_CALL_REQUEST || pkt_type == X25_CALL_ACCEPTED || + (pkt_type & 0x01) == X25_DATA) { + proto_tree_add_boolean(gfi_tree, hf_x25_dbit, tvb, 0, 2, + bytes0_1); + } + proto_tree_add_uint(gfi_tree, hf_x25_mod, tvb, 0, 2, bytes0_1); } switch (pkt_type) { @@ -1989,19 +2004,33 @@ dissect_x25(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) if (localoffset >= tvb_reported_length(tvb)) return; next_tvb = tvb_new_subset(tvb, localoffset, -1, -1); + + /* QLLC ? */ + if (q_bit_set) { + call_dissector(qllc_handle, next_tvb, pinfo, tree); + return; + } + /* search the dissector in the hash table */ - if ((dissect = x25_hash_get_dissect(pinfo->fd->abs_secs, pinfo->fd->abs_usecs, vc))) - call_dissector(dissect, next_tvb, pinfo, tree); + if ((dissect = x25_hash_get_dissect(pinfo->fd->abs_secs, pinfo->fd->abs_usecs, vc))) { + call_dissector(dissect, next_tvb, pinfo, tree); + } else { - /* If the Call Req. has not been captured, assume these packets carry IP */ - if (tvb_get_guint8(tvb, localoffset) == 0x45) { - x25_hash_add_proto_start(vc, pinfo->fd->abs_secs, - pinfo->fd->abs_usecs, ip_handle); - call_dissector(ip_handle, next_tvb, pinfo, tree); - } - else { - dissect_data(next_tvb, 0, pinfo, tree); - } + /* Did the user suggest SNA-over-X.25? */ + if (non_q_bit_is_sna) { + x25_hash_add_proto_start(vc, pinfo->fd->abs_secs, + pinfo->fd->abs_usecs, sna_handle); + call_dissector(sna_handle, next_tvb, pinfo, tree); + } + /* If the Call Req. has not been captured, assume these packets carry IP */ + else if (tvb_get_guint8(tvb, localoffset) == 0x45) { + x25_hash_add_proto_start(vc, pinfo->fd->abs_secs, + pinfo->fd->abs_usecs, ip_handle); + call_dissector(ip_handle, next_tvb, pinfo, tree); + } + else { + dissect_data(next_tvb, 0, pinfo, tree); + } } } @@ -2074,6 +2103,7 @@ proto_register_x25(void) &ett_x25_fac_call_deflect, &ett_x25_fac_priority }; + module_t *x25_module; proto_x25 = proto_register_protocol ("X.25", "X.25", "x.25"); proto_register_field_array (proto_x25, hf, array_length(hf)); @@ -2081,6 +2111,12 @@ proto_register_x25(void) register_init_routine(&reinit_x25_hashtable); register_dissector("x.25", dissect_x25, proto_x25); + + /* Preferences */ + x25_module = prefs_register_protocol(proto_x25, NULL); + prefs_register_bool_preference(x25_module, "non_q_bit_is_sna", + "When Q-bit is 0, payload is SNA", "When Q-bit is 0, payload is SNA", + &non_q_bit_is_sna); } void @@ -2091,6 +2127,8 @@ proto_reg_handoff_x25(void) */ ip_handle = find_dissector("ip"); ositp_handle = find_dissector("ositp"); + sna_handle = find_dissector("sna"); + qllc_handle = find_dissector("qllc"); dissector_add("llc.dsap", SAP_X25, dissect_x25, proto_x25); } |