1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
|
/* packet-aim-icq.c
* Routines for AIM Instant Messenger (OSCAR) dissection, SNAC ICQ
* Copyright 2004, Jelmer Vernooij <jelmer@samba.org>
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "config.h"
#include <glib.h>
#include <epan/packet.h>
#include <epan/strutil.h>
#include "packet-aim.h"
void proto_register_aim_icq(void);
void proto_reg_handoff_aim_icq(void);
#define FAMILY_ICQ 0x0015
#define ICQ_CLI_OFFLINE_MESSAGE_REQ 0x003c
#define ICQ_CLI_DELETE_OFFLINE_MSGS 0x003e
#define ICQ_SRV_OFFLINE_MSGS 0x0041
#define ICQ_SRV_END_OF_OFFLINE_MSGS 0x0042
#define ICQ_CLI_META_INFO_REQ 0x07d0
#define ICQ_SRV_META_INFO_REPL 0x07da
static const value_string aim_icq_data_types[] = {
{ ICQ_CLI_OFFLINE_MESSAGE_REQ, "Offline Message Request" },
{ ICQ_SRV_OFFLINE_MSGS, "Offline Messages Reply" },
{ ICQ_SRV_END_OF_OFFLINE_MSGS, "End Of Offline Messages Reply" },
{ ICQ_CLI_DELETE_OFFLINE_MSGS, "Delete Offline Messages Request" },
{ ICQ_CLI_META_INFO_REQ, "Metainfo Request" },
{ ICQ_SRV_META_INFO_REPL, "Metainfo Reply" },
{ 0, NULL }
};
static int dissect_aim_tlv_value_icq(proto_item *ti, guint16 subtype, tvbuff_t *tvb, packet_info *pinfo _U_);
#define TLV_ICQ_META_DATA 0x0001
static const aim_tlv icq_tlv[] = {
{ TLV_ICQ_META_DATA, "Encapsulated ICQ Meta Data", dissect_aim_tlv_value_icq },
{ 0, NULL, NULL },
};
/* Initialize the protocol and registered fields */
static int proto_aim_icq = -1;
/* Initialize the subtree pointers */
static gint ett_aim_icq = -1;
static gint ett_aim_icq_tlv = -1;
static gint hf_icq_tlv_data_chunk_size = -1;
static gint hf_icq_tlv_request_owner_uid = -1;
static gint hf_icq_tlv_request_type = -1;
static gint hf_icq_meta_subtype = -1;
static gint hf_icq_tlv_request_seq_num = -1;
static gint hf_icq_dropped_msg_flag = -1;
static struct
{
guint16 subtype;
const char *name;
int (*dissector) (tvbuff_t *, packet_info *, proto_tree *);
} icq_calls [] = {
{ 0x0001, "Server Error Reply", NULL },
{ 0x0064, "Set User Home Info Reply", NULL },
{ 0x006e, "Set User Work Info Reply", NULL },
{ 0x0078, "Set User More Info Reply", NULL },
{ 0x0082, "Set User Notes Info Reply", NULL },
{ 0x0087, "Set User Email Info Reply", NULL },
{ 0x008c, "Set User Interests Info Reply", NULL },
{ 0x0096, "Set User Affiliations Info Reply", NULL },
{ 0x00a0, "Set User Permissions Reply", NULL },
{ 0x00aa, "Set User Password Reply", NULL },
{ 0x00b4, "Unregister Account Reply", NULL },
{ 0x00be, "Set User Homepage Category Reply", NULL },
{ 0x00c8, "User Basic Info Reply", NULL },
{ 0x00d2, "User Work Info Reply", NULL },
{ 0x00dc, "User More Info Reply", NULL },
{ 0x00e6, "User Notes Info Reply", NULL },
{ 0x00eb, "User Extended Email Reply", NULL },
{ 0x00f0, "User Interests Info Reply", NULL },
{ 0x00fa, "User Affiliations Info Reply", NULL },
{ 0x0104, "Short User Info Reply", NULL },
{ 0x010e, "User Homepage Category Reply", NULL },
{ 0x01a4, "Search: User found", NULL },
{ 0x0302, "Registration Stats Reply", NULL },
{ 0x0366, "Random Search Server Reply", NULL },
{ 0x03ea, "Set User Home Info Request", NULL },
{ 0x03f3, "Set User Work Info Request", NULL },
{ 0x03fd, "Set User More Info Request", NULL },
{ 0x0406, "Set User Notes Request", NULL },
{ 0x040b, "Set User Extended Email Info Request", NULL },
{ 0x0410, "Set User Interests Info Request", NULL },
{ 0x041a, "Set User Affiliations Info Request", NULL },
{ 0x0424, "Set User Permissions Info Request", NULL },
{ 0x042e, "Change User Password Request", NULL },
{ 0x0442, "Set User Homepage Category Request", NULL },
{ 0x04b2, "Fullinfo Request", NULL },
{ 0x04ba, "Short User Info Request", NULL },
{ 0x04c4, "Unregister User Request", NULL },
{ 0x0515, "Search By Details Request", NULL },
{ 0x0569, "Search By UIN Request", NULL },
{ 0x055f, "Whitepages Search Request", NULL },
{ 0x0573, "Search By Email Request", NULL },
{ 0x074e, "Random Chat User Search Request", NULL },
{ 0x0898, "Server Variable Request (XML)", NULL },
{ 0x0aa5, "Registration Report Request", NULL },
{ 0x0aaf, "Shortcut Bar Stats Report Request", NULL },
{ 0x0c3a, "Save Info Request", NULL },
{ 0x1482, "Send SMS Request", NULL },
{ 0x2008, "Spam Report Request", NULL },
{ 0x08a2, "Server Variable Reply (XML)", NULL },
{ 0x0c3f, "Set Fullinfo Reply", NULL },
{ 0x2012, "User Spam Report Reply", NULL },
{ 0, NULL, NULL },
};
static int dissect_aim_tlv_value_icq(proto_item *ti _U_, guint16 subtype _U_, tvbuff_t *tvb _U_, packet_info *pinfo)
{
int offset = 0;
int i;
proto_item *subtype_item;
guint16 req_type, req_subtype;
proto_tree *t = proto_item_add_subtree(ti, ett_aim_icq_tlv);
proto_tree_add_item(t, hf_icq_tlv_data_chunk_size, tvb, offset, 2, ENC_LITTLE_ENDIAN);
offset += 2;
proto_tree_add_item(t, hf_icq_tlv_request_owner_uid, tvb, offset, 4, ENC_LITTLE_ENDIAN);
offset += 4;
proto_tree_add_item(t, hf_icq_tlv_request_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
req_type = tvb_get_letohs(tvb, offset);
offset += 2;
proto_tree_add_item(t, hf_icq_tlv_request_seq_num, tvb, offset, 2, ENC_LITTLE_ENDIAN);
offset += 2;
switch (req_type) {
case ICQ_CLI_OFFLINE_MESSAGE_REQ: return offset;
case ICQ_CLI_DELETE_OFFLINE_MSGS: return offset;
case ICQ_SRV_OFFLINE_MSGS:
/* FIXME */
break;
case ICQ_SRV_END_OF_OFFLINE_MSGS:
proto_tree_add_item(t, hf_icq_dropped_msg_flag, tvb, offset, 1, ENC_LITTLE_ENDIAN);
return offset+1;
case ICQ_CLI_META_INFO_REQ:
case ICQ_SRV_META_INFO_REPL:
req_subtype = tvb_get_letohs(tvb, offset);
subtype_item = proto_tree_add_item(t, hf_icq_meta_subtype, tvb, offset, 2, ENC_LITTLE_ENDIAN); offset+=2;
for (i = 0; icq_calls[i].name; i++) {
if (icq_calls[i].subtype == req_subtype) break;
}
col_set_str(pinfo->cinfo, COL_INFO, icq_calls[i].name?icq_calls[i].name:"Unknown ICQ Meta Call");
proto_item_append_text(subtype_item, " (%s)", icq_calls[i].name?icq_calls[i].name:"Unknown");
if (icq_calls[i].dissector)
return icq_calls[i].dissector(tvb_new_subset_remaining(tvb, offset), pinfo, t);
default:
break;
}
return offset;
}
static int dissect_aim_icq_tlv(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
return dissect_aim_tlv(tvb, pinfo, 0, tree, icq_tlv);
}
static const aim_subtype aim_fnac_family_icq[] = {
{ 0x0001, "Error", dissect_aim_snac_error },
{ 0x0002, "ICQ Request", dissect_aim_icq_tlv },
{ 0x0003, "ICQ Response", dissect_aim_icq_tlv },
{ 0x0006, "Auth Request", NULL },
{ 0x0007, "Auth Response", NULL },
{ 0, NULL, NULL }
};
/* Register the protocol with Wireshark */
void
proto_register_aim_icq(void)
{
/* Setup list of header fields */
static hf_register_info hf[] = {
{ &hf_icq_tlv_data_chunk_size,
{ "Data chunk size", "aim_icq.chunk_size", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL },
},
{ &hf_icq_tlv_request_owner_uid,
{ "Owner UID", "aim_icq.owner_uid", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL},
},
{ &hf_icq_tlv_request_type,
{"Request Type", "aim_icq.request_type", FT_UINT16, BASE_DEC, VALS(aim_icq_data_types), 0x0, NULL, HFILL},
},
{ &hf_icq_tlv_request_seq_num,
{"Request Sequence Number", "aim_icq.request_seq_number", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL},
},
{ &hf_icq_dropped_msg_flag,
{"Dropped messages flag", "aim_icq.offline_msgs.dropped_flag", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL },
},
{ &hf_icq_meta_subtype,
{"Meta Request Subtype", "aim_icq.subtype", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL },
},
};
/* Setup protocol subtree array */
static gint *ett[] = {
&ett_aim_icq,
&ett_aim_icq_tlv
};
/* Register the protocol name and description */
proto_aim_icq = proto_register_protocol("AIM ICQ", "AIM ICQ", "aim_icq");
/* Required function calls to register the header fields and subtrees used */
proto_register_field_array(proto_aim_icq, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
}
void
proto_reg_handoff_aim_icq(void)
{
aim_init_family(proto_aim_icq, ett_aim_icq, FAMILY_ICQ, aim_fnac_family_icq);
}
/*
* Editor modelines - http://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/
|
