diff options
Diffstat (limited to 'epan/dissectors/packet-tpkt.c')
| -rw-r--r-- | epan/dissectors/packet-tpkt.c | 686 |
1 files changed, 349 insertions, 337 deletions
diff --git a/epan/dissectors/packet-tpkt.c b/epan/dissectors/packet-tpkt.c index 13265a3e0a..fe4900ebbb 100644 --- a/epan/dissectors/packet-tpkt.c +++ b/epan/dissectors/packet-tpkt.c @@ -43,12 +43,12 @@ void proto_register_tpkt(void); void proto_reg_handoff_tpkt(void); /* TPKT header fields */ -static int proto_tpkt = -1; +static int proto_tpkt = -1; static protocol_t *proto_tpkt_ptr; -static int hf_tpkt_version = -1; -static int hf_tpkt_reserved = -1; -static int hf_tpkt_length = -1; -static int hf_tpkt_continuation_data = -1; +static int hf_tpkt_version = -1; +static int hf_tpkt_reserved = -1; +static int hf_tpkt_length = -1; +static int hf_tpkt_continuation_data = -1; /* TPKT fields defining a sub tree */ @@ -57,7 +57,7 @@ static gint ett_tpkt = -1; /* desegmentation of OSI over TPKT over TCP */ static gboolean tpkt_desegment = TRUE; -#define TCP_PORT_TPKT 102 +#define TCP_PORT_TPKT 102 /* find the dissector for OSI TP (aka COTP) */ static dissector_handle_t osi_tp_handle; @@ -74,39 +74,39 @@ static dissector_handle_t osi_tp_handle; int is_tpkt(tvbuff_t *tvb, int min_len) { - guint16 pkt_len; - - /* - * If TPKT is disabled, don't dissect it, just return -1, meaning - * "this isn't TPKT". - */ - if (!proto_is_protocol_enabled(proto_tpkt_ptr)) - return -1; - - /* There should at least be 4 bytes left in the frame */ - if (tvb_length(tvb) < 4) - return -1; /* there aren't */ - - /* - * The first octet should be 3 and the second one should be 0 - * The H.323 implementers guide suggests that this might not - * always be the case.... - */ - if (!(tvb_get_guint8(tvb, 0) == 3 && tvb_get_guint8(tvb, 1) == 0)) - return -1; /* they're not */ - - /* - * Get the length from the TPKT header. Make sure it's large - * enough. - */ - pkt_len = tvb_get_ntohs(tvb, 2); - if (pkt_len < 4 + min_len) - return -1; /* it's not */ - - /* - * Return the length from the header. - */ - return pkt_len; + guint16 pkt_len; + + /* + * If TPKT is disabled, don't dissect it, just return -1, meaning + * "this isn't TPKT". + */ + if (!proto_is_protocol_enabled(proto_tpkt_ptr)) + return -1; + + /* There should at least be 4 bytes left in the frame */ + if (tvb_length(tvb) < 4) + return -1; /* there aren't */ + + /* + * The first octet should be 3 and the second one should be 0 + * The H.323 implementers guide suggests that this might not + * always be the case.... + */ + if (!(tvb_get_guint8(tvb, 0) == 3 && tvb_get_guint8(tvb, 1) == 0)) + return -1; /* they're not */ + + /* + * Get the length from the TPKT header. Make sure it's large + * enough. + */ + pkt_len = tvb_get_ntohs(tvb, 2); + if (pkt_len < 4 + min_len) + return -1; /* it's not */ + + /* + * Return the length from the header. + */ + return pkt_len; } guint16 is_asciitpkt(tvbuff_t *tvb) @@ -207,7 +207,7 @@ parseReservedText ( guint8* pTpktData ) */ void dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, - dissector_handle_t subdissector_handle) + dissector_handle_t subdissector_handle) { proto_item *ti = NULL; proto_tree *tpkt_tree = NULL; @@ -252,7 +252,7 @@ dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, col_set_str(pinfo->cinfo, COL_INFO, "Continuation"); if (tree) { ti = proto_tree_add_item(tree, proto_tpkt, tvb, - offset, -1, ENC_NA); + offset, -1, ENC_NA); tpkt_tree = proto_item_add_subtree(ti, ett_tpkt); proto_tree_add_item(tpkt_tree, hf_tpkt_continuation_data, tvb, offset, -1, ENC_NA); @@ -293,26 +293,26 @@ dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, */ if (!tpkt_desegment && !pinfo->fragmented) { col_add_fstr(pinfo->cinfo, COL_INFO, - "TPKT Data length = %u", data_len); + "TPKT Data length = %u", data_len); } if (tree) { ti = proto_tree_add_item(tree, proto_tpkt, tvb, - offset, 8, ENC_NA); + offset, 8, ENC_NA); tpkt_tree = proto_item_add_subtree(ti, ett_tpkt); proto_item_set_text(ti, "TPKT"); /* Version */ proto_tree_add_uint(tpkt_tree, hf_tpkt_version, tvb, - offset, 2, mgcp_version); + offset, 2, mgcp_version); /* Reserved octet*/ proto_tree_add_uint(tpkt_tree, hf_tpkt_reserved, tvb, - offset + 2, 2, mgcp_reserved); + offset + 2, 2, mgcp_reserved); /* Length */ proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb, - offset + 4, 4, mgcp_packet_len); + offset + 4, 4, mgcp_packet_len); } pinfo->current_proto = saved_proto; @@ -336,17 +336,17 @@ dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, * we should stop dissecting TPKT messages within this frame * or chunk of reassembled data. */ - pd_save = pinfo->private_data; + pd_save = pinfo->private_data; TRY { call_dissector(subdissector_handle, next_tvb, pinfo, - tree); + tree); } CATCH_NONFATAL_ERRORS { - /* Restore the private_data structure in case one of the - * called dissectors modified it (and, due to the exception, - * was unable to restore it). - */ - pinfo->private_data = pd_save; + /* Restore the private_data structure in case one of the + * called dissectors modified it (and, due to the exception, + * was unable to restore it). + */ + pinfo->private_data = pd_save; show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE); } @@ -364,211 +364,211 @@ dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, */ void dissect_tpkt_encap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, - gboolean desegment, dissector_handle_t subdissector_handle) + gboolean desegment, dissector_handle_t subdissector_handle) { - proto_item *ti = NULL; - proto_tree *tpkt_tree = NULL; - volatile int offset = 0; - int length_remaining; - int data_len; - volatile int length; - tvbuff_t *volatile next_tvb; - const char *saved_proto; - void *pd_save; - - /* - * If we're reassembling segmented TPKT PDUs, empty the COL_INFO - * column, so subdissectors can append information - * without having to worry about emptying the column. - * - * We use "col_add_str()" because the subdissector - * might be appending information to the column, in - * which case we'd have to zero the buffer out explicitly - * anyway. - */ - if (desegment) - col_set_str(pinfo->cinfo, COL_INFO, ""); - - while (tvb_reported_length_remaining(tvb, offset) != 0) { - /* - * Is the first byte of this putative TPKT header - * a valid TPKT version number, i.e. 3? - */ - if (tvb_get_guint8(tvb, offset) != 3) { - /* - * No, so don't assume this is a TPKT header; - * we might be in the middle of TPKT data, - * so don't get the length and don't try to - * do reassembly. - */ - col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT"); - col_set_str(pinfo->cinfo, COL_INFO, "Continuation"); - if (tree) { - ti = proto_tree_add_item(tree, proto_tpkt, tvb, - offset, -1, ENC_NA); - tpkt_tree = proto_item_add_subtree(ti, ett_tpkt); - - proto_tree_add_item(tpkt_tree, hf_tpkt_continuation_data, tvb, offset, -1, ENC_NA); - } - return; - } - - length_remaining = tvb_length_remaining(tvb, offset); - - /* - * Can we do reassembly? - */ - if (desegment && pinfo->can_desegment) { - /* - * Yes - is the TPKT header split across segment - * boundaries? - */ - if (length_remaining < 4) { - /* - * Yes. Tell the TCP dissector where the data - * for this message starts in the data it - * handed us and that we need "some more data." - * Don't tell it exactly how many bytes we need - * because if/when we ask for even more (after - * the header) that will break reassembly. - */ - pinfo->desegment_offset = offset; - pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT; - return; - } - } - - /* - * Get the length from the TPKT header. - */ - data_len = tvb_get_ntohs(tvb, offset + 2); - - /* - * Can we do reassembly? - */ - if (desegment && pinfo->can_desegment) { - /* - * Yes - is the payload split across segment - * boundaries? - */ - if (length_remaining < data_len) { - /* - * Yes. Tell the TCP dissector where - * the data for this message starts in - * the data it handed us, and how many - * more bytes we need, and return. - */ - pinfo->desegment_offset = offset; - pinfo->desegment_len = - data_len - length_remaining; - return; - } - } - - /* - * Dissect the TPKT header. - * Save and restore "pinfo->current_proto". - */ - saved_proto = pinfo->current_proto; - pinfo->current_proto = "TPKT"; - - col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT"); - /* - * Don't add the TPKT header information if we're - * reassembling segmented TPKT PDUs or if this - * PDU isn't reassembled. - * - * XXX - the first is so that subdissectors can append - * information without getting TPKT stuff in the middle; - * why the second? - */ - if (!desegment && !pinfo->fragmented) { - col_add_fstr(pinfo->cinfo, COL_INFO, - "TPKT Data length = %u", data_len); - } - - if (tree) { - ti = proto_tree_add_item(tree, proto_tpkt, tvb, - offset, 4, ENC_NA); - tpkt_tree = proto_item_add_subtree(ti, ett_tpkt); - proto_item_set_text(ti, "TPKT"); - - /* Version */ - proto_tree_add_item(tpkt_tree, hf_tpkt_version, tvb, - offset, 1, ENC_BIG_ENDIAN); - proto_item_append_text(ti, ", Version: 3"); - - /* Reserved octet*/ - proto_tree_add_item(tpkt_tree, hf_tpkt_reserved, tvb, - offset + 1, 1, ENC_BIG_ENDIAN); - - /* Length */ - proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb, - offset + 2, 2, data_len); - proto_item_append_text(ti, ", Length: %u", data_len); - } - pinfo->current_proto = saved_proto; - - /* Skip the TPKT header. */ - offset += 4; - data_len -= 4; - - /* - * Construct a tvbuff containing the amount of the payload - * we have available. Make its reported length the - * amount of data in this TPKT packet. - * - * XXX - if reassembly isn't enabled. the subdissector - * will throw a BoundsError exception, rather than a - * ReportedBoundsError exception. We really want - * a tvbuff where the length is "length", the reported - * length is "plen + 2", and the "if the snapshot length - * were infinite" length were the minimum of the - * reported length of the tvbuff handed to us and "plen+2", - * with a new type of exception thrown if the offset is - * within the reported length but beyond that third length, - * with that exception getting the "Unreassembled Packet" - * error. - */ - length = length_remaining - 4; - if (length > data_len) - length = data_len; - next_tvb = tvb_new_subset(tvb, offset, length, data_len); - - /* - * Call the subdissector. - * - * If it gets an error that means there's no point in - * dissecting any more TPKT messages, rethrow the - * exception in question. - * - * If it gets any other error, report it and continue, - * as that means that TPKT message got an error, but - * that doesn't mean we should stop dissecting TPKT - * messages within this frame or chunk of reassembled - * data. - */ - pd_save = pinfo->private_data; - TRY { - call_dissector(subdissector_handle, next_tvb, pinfo, - tree); - } - CATCH_NONFATAL_ERRORS { - /* Restore the private_data structure in case one of the - * called dissectors modified it (and, due to the exception, - * was unable to restore it). - */ - pinfo->private_data = pd_save; - - show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE); - } - ENDTRY; - - /* - * Skip the payload. - */ - offset += length; - } + proto_item *ti = NULL; + proto_tree *tpkt_tree = NULL; + volatile int offset = 0; + int length_remaining; + int data_len; + volatile int length; + tvbuff_t *volatile next_tvb; + const char *saved_proto; + void *pd_save; + + /* + * If we're reassembling segmented TPKT PDUs, empty the COL_INFO + * column, so subdissectors can append information + * without having to worry about emptying the column. + * + * We use "col_add_str()" because the subdissector + * might be appending information to the column, in + * which case we'd have to zero the buffer out explicitly + * anyway. + */ + if (desegment) + col_set_str(pinfo->cinfo, COL_INFO, ""); + + while (tvb_reported_length_remaining(tvb, offset) != 0) { + /* + * Is the first byte of this putative TPKT header + * a valid TPKT version number, i.e. 3? + */ + if (tvb_get_guint8(tvb, offset) != 3) { + /* + * No, so don't assume this is a TPKT header; + * we might be in the middle of TPKT data, + * so don't get the length and don't try to + * do reassembly. + */ + col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT"); + col_set_str(pinfo->cinfo, COL_INFO, "Continuation"); + if (tree) { + ti = proto_tree_add_item(tree, proto_tpkt, tvb, + offset, -1, ENC_NA); + tpkt_tree = proto_item_add_subtree(ti, ett_tpkt); + + proto_tree_add_item(tpkt_tree, hf_tpkt_continuation_data, tvb, offset, -1, ENC_NA); + } + return; + } + + length_remaining = tvb_length_remaining(tvb, offset); + + /* + * Can we do reassembly? + */ + if (desegment && pinfo->can_desegment) { + /* + * Yes - is the TPKT header split across segment + * boundaries? + */ + if (length_remaining < 4) { + /* + * Yes. Tell the TCP dissector where the data + * for this message starts in the data it + * handed us and that we need "some more data." + * Don't tell it exactly how many bytes we need + * because if/when we ask for even more (after + * the header) that will break reassembly. + */ + pinfo->desegment_offset = offset; + pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT; + return; + } + } + + /* + * Get the length from the TPKT header. + */ + data_len = tvb_get_ntohs(tvb, offset + 2); + + /* + * Can we do reassembly? + */ + if (desegment && pinfo->can_desegment) { + /* + * Yes - is the payload split across segment + * boundaries? + */ + if (length_remaining < data_len) { + /* + * Yes. Tell the TCP dissector where + * the data for this message starts in + * the data it handed us, and how many + * more bytes we need, and return. + */ + pinfo->desegment_offset = offset; + pinfo->desegment_len = + data_len - length_remaining; + return; + } + } + + /* + * Dissect the TPKT header. + * Save and restore "pinfo->current_proto". + */ + saved_proto = pinfo->current_proto; + pinfo->current_proto = "TPKT"; + + col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT"); + /* + * Don't add the TPKT header information if we're + * reassembling segmented TPKT PDUs or if this + * PDU isn't reassembled. + * + * XXX - the first is so that subdissectors can append + * information without getting TPKT stuff in the middle; + * why the second? + */ + if (!desegment && !pinfo->fragmented) { + col_add_fstr(pinfo->cinfo, COL_INFO, + "TPKT Data length = %u", data_len); + } + + if (tree) { + ti = proto_tree_add_item(tree, proto_tpkt, tvb, + offset, 4, ENC_NA); + tpkt_tree = proto_item_add_subtree(ti, ett_tpkt); + proto_item_set_text(ti, "TPKT"); + + /* Version */ + proto_tree_add_item(tpkt_tree, hf_tpkt_version, tvb, + offset, 1, ENC_BIG_ENDIAN); + proto_item_append_text(ti, ", Version: 3"); + + /* Reserved octet*/ + proto_tree_add_item(tpkt_tree, hf_tpkt_reserved, tvb, + offset + 1, 1, ENC_BIG_ENDIAN); + + /* Length */ + proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb, + offset + 2, 2, data_len); + proto_item_append_text(ti, ", Length: %u", data_len); + } + pinfo->current_proto = saved_proto; + + /* Skip the TPKT header. */ + offset += 4; + data_len -= 4; + + /* + * Construct a tvbuff containing the amount of the payload + * we have available. Make its reported length the + * amount of data in this TPKT packet. + * + * XXX - if reassembly isn't enabled. the subdissector + * will throw a BoundsError exception, rather than a + * ReportedBoundsError exception. We really want + * a tvbuff where the length is "length", the reported + * length is "plen + 2", and the "if the snapshot length + * were infinite" length were the minimum of the + * reported length of the tvbuff handed to us and "plen+2", + * with a new type of exception thrown if the offset is + * within the reported length but beyond that third length, + * with that exception getting the "Unreassembled Packet" + * error. + */ + length = length_remaining - 4; + if (length > data_len) + length = data_len; + next_tvb = tvb_new_subset(tvb, offset, length, data_len); + + /* + * Call the subdissector. + * + * If it gets an error that means there's no point in + * dissecting any more TPKT messages, rethrow the + * exception in question. + * + * If it gets any other error, report it and continue, + * as that means that TPKT message got an error, but + * that doesn't mean we should stop dissecting TPKT + * messages within this frame or chunk of reassembled + * data. + */ + pd_save = pinfo->private_data; + TRY { + call_dissector(subdissector_handle, next_tvb, pinfo, + tree); + } + CATCH_NONFATAL_ERRORS { + /* Restore the private_data structure in case one of the + * called dissectors modified it (and, due to the exception, + * was unable to restore it). + */ + pinfo->private_data = pd_save; + + show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE); + } + ENDTRY; + + /* + * Skip the payload. + */ + offset += length; + } } /* @@ -578,7 +578,7 @@ dissect_tpkt_encap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, static void dissect_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { - dissect_tpkt_encap(tvb, pinfo, tree, tpkt_desegment, osi_tp_handle); + dissect_tpkt_encap(tvb, pinfo, tree, tpkt_desegment, osi_tp_handle); } /* @@ -589,97 +589,109 @@ dissect_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) static void dissect_ascii_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { - dissect_asciitpkt(tvb, pinfo, tree, osi_tp_handle); + dissect_asciitpkt(tvb, pinfo, tree, osi_tp_handle); } #endif void proto_register_tpkt(void) { - static hf_register_info hf[] = - { - { - &hf_tpkt_version, - { - "Version", - "tpkt.version", - FT_UINT8, - BASE_DEC, - NULL, - 0x0, - "Version, only version 3 is defined", HFILL - } - }, - { - &hf_tpkt_reserved, - { - "Reserved", - "tpkt.reserved", - FT_UINT8, - BASE_DEC, - NULL, - 0x0, - "Reserved, should be 0", HFILL - } - }, - { - &hf_tpkt_length, - { - "Length", - "tpkt.length", - FT_UINT16, - BASE_DEC, - NULL, - 0x0, - "Length of data unit, including this header", HFILL - } - }, - { - &hf_tpkt_continuation_data, - { - "Continuation data", - "tpkt.continuation_data", - FT_BYTES, - BASE_NONE, - NULL, - 0x0, - NULL, HFILL - } - }, - }; - - static gint *ett[] = - { - &ett_tpkt, - }; - module_t *tpkt_module; - - proto_tpkt = proto_register_protocol("TPKT - ISO on TCP - RFC1006", "TPKT", "tpkt"); - proto_tpkt_ptr = find_protocol_by_id(proto_tpkt); - proto_register_field_array(proto_tpkt, hf, array_length(hf)); - proto_register_subtree_array(ett, array_length(ett)); - register_dissector("tpkt", dissect_tpkt, proto_tpkt); - - tpkt_module = prefs_register_protocol(proto_tpkt, NULL); - prefs_register_bool_preference(tpkt_module, "desegment", - "Reassemble TPKT messages spanning multiple TCP segments", - "Whether the TPKT dissector should reassemble messages spanning multiple TCP segments. " - "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.", - &tpkt_desegment); + static hf_register_info hf[] = { + { + &hf_tpkt_version, + { + "Version", + "tpkt.version", + FT_UINT8, + BASE_DEC, + NULL, + 0x0, + "Version, only version 3 is defined", HFILL + } + }, + { + &hf_tpkt_reserved, + { + "Reserved", + "tpkt.reserved", + FT_UINT8, + BASE_DEC, + NULL, + 0x0, + "Reserved, should be 0", HFILL + } + }, + { + &hf_tpkt_length, + { + "Length", + "tpkt.length", + FT_UINT16, + BASE_DEC, + NULL, + 0x0, + "Length of data unit, including this header", HFILL + } + }, + { + &hf_tpkt_continuation_data, + { + "Continuation data", + "tpkt.continuation_data", + FT_BYTES, + BASE_NONE, + NULL, + 0x0, + NULL, HFILL + } + }, + }; + + static gint *ett[] = + { + &ett_tpkt, + }; + module_t *tpkt_module; + + proto_tpkt = proto_register_protocol("TPKT - ISO on TCP - RFC1006", "TPKT", "tpkt"); + proto_tpkt_ptr = find_protocol_by_id(proto_tpkt); + proto_register_field_array(proto_tpkt, hf, array_length(hf)); + proto_register_subtree_array(ett, array_length(ett)); + register_dissector("tpkt", dissect_tpkt, proto_tpkt); + + tpkt_module = prefs_register_protocol(proto_tpkt, NULL); + prefs_register_bool_preference(tpkt_module, "desegment", + "Reassemble TPKT messages spanning multiple TCP segments", + "Whether the TPKT dissector should reassemble messages spanning multiple TCP segments. " + "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.", + &tpkt_desegment); } void proto_reg_handoff_tpkt(void) { - dissector_handle_t tpkt_handle; + dissector_handle_t tpkt_handle; - osi_tp_handle = find_dissector("ositp"); - tpkt_handle = find_dissector("tpkt"); - dissector_add_uint("tcp.port", TCP_PORT_TPKT, tpkt_handle); + osi_tp_handle = find_dissector("ositp"); + tpkt_handle = find_dissector("tpkt"); + dissector_add_uint("tcp.port", TCP_PORT_TPKT, tpkt_handle); - /* - tpkt_ascii_handle = create_dissector_handle(dissect_ascii_tpkt, proto_tpkt); - dissector_add_uint("tcp.port", TCP_PORT_TPKT, tpkt_ascii_handle); - */ + /* + tpkt_ascii_handle = create_dissector_handle(dissect_ascii_tpkt, proto_tpkt); + dissector_add_uint("tcp.port", TCP_PORT_TPKT, tpkt_ascii_handle); + */ } + +/* + * Editor modelines - http://www.wireshark.org/tools/modelines.html + * + * Local variables: + * c-basic-offset: 4 + * tab-width: 8 + * indent-tabs-mode: nil + * End: + * + * vi: set shiftwidth=4 tabstop=8 expandtab: + * :indentSize=4:tabSize=8:noTabs=true: + */ |