2003-01-25 00:22:50 +00:00
|
|
|
/* packet-ssh.c
|
|
|
|
* Routines for ssh packet dissection
|
|
|
|
*
|
|
|
|
* Huagang XIE <huagang@intruvert.com>
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
2003-01-25 00:22:50 +00:00
|
|
|
*
|
|
|
|
* Ethereal - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* Copied from packet-mysql.c
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*
|
|
|
|
*
|
2003-01-28 16:21:26 +00:00
|
|
|
* Note: support SSH v1 and v2 now.
|
2003-01-25 00:22:50 +00:00
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <glib.h>
|
|
|
|
#include <epan/packet.h>
|
|
|
|
#include <epan/conversation.h>
|
|
|
|
|
|
|
|
#include "packet-tcp.h"
|
|
|
|
#include "reassemble.h"
|
|
|
|
#include "prefs.h"
|
|
|
|
|
|
|
|
/* get from openssh ssh2.h */
|
|
|
|
#define SSH2_MSG_DISCONNECT 1
|
|
|
|
#define SSH2_MSG_IGNORE 2
|
|
|
|
#define SSH2_MSG_UNIMPLEMENTED 3
|
|
|
|
#define SSH2_MSG_DEBUG 4
|
|
|
|
#define SSH2_MSG_SERVICE_REQUEST 5
|
|
|
|
#define SSH2_MSG_SERVICE_ACCEPT 6
|
|
|
|
|
|
|
|
/* transport layer: alg negotiation */
|
|
|
|
|
|
|
|
#define SSH2_MSG_KEXINIT 20
|
|
|
|
#define SSH2_MSG_NEWKEYS 21
|
|
|
|
|
|
|
|
/* transport layer: kex specific messages, can be reused */
|
|
|
|
|
|
|
|
#define SSH2_MSG_KEXDH_INIT 30
|
|
|
|
#define SSH2_MSG_KEXDH_REPLY 31
|
|
|
|
|
|
|
|
/*
|
|
|
|
#define SSH2_MSG_KEX_DH_GEX_REQUEST_OLD 30
|
|
|
|
#define SSH2_MSG_KEX_DH_GEX_GROUP 31
|
|
|
|
*/
|
|
|
|
#define SSH2_MSG_KEX_DH_GEX_INIT 32
|
|
|
|
#define SSH2_MSG_KEX_DH_GEX_REPLY 33
|
|
|
|
#define SSH2_MSG_KEX_DH_GEX_REQUEST 34
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
/* SSH Version 1 definition , from openssh ssh1.h */
|
|
|
|
|
|
|
|
#define SSH_MSG_NONE 0 /* no message */
|
|
|
|
#define SSH_MSG_DISCONNECT 1 /* cause (string) */
|
|
|
|
#define SSH_SMSG_PUBLIC_KEY 2 /* ck,msk,srvk,hostk */
|
|
|
|
#define SSH_CMSG_SESSION_KEY 3 /* key (BIGNUM) */
|
|
|
|
#define SSH_CMSG_USER 4 /* user (string) */
|
|
|
|
|
|
|
|
|
2003-01-27 19:40:55 +00:00
|
|
|
#define SSH_VERSION_UNKNOWN 0
|
|
|
|
#define SSH_VERSION_1 1
|
|
|
|
#define SSH_VERSION_2 2
|
|
|
|
|
2003-01-25 00:22:50 +00:00
|
|
|
/* proto data */
|
|
|
|
|
|
|
|
struct ssh_pdu_data{
|
|
|
|
guint counter;
|
|
|
|
guint number;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct ssh_flow_data {
|
|
|
|
guint req_counter;
|
|
|
|
guint rsp_counter;
|
2003-01-27 19:40:55 +00:00
|
|
|
guint version;
|
2003-01-25 00:22:50 +00:00
|
|
|
};
|
|
|
|
static GMemChunk *ssh_this_data=NULL;
|
|
|
|
static GMemChunk *ssh_global_data = NULL;
|
|
|
|
|
|
|
|
static int proto_ssh = -1;
|
|
|
|
static int hf_ssh_packet_length= -1;
|
|
|
|
static int hf_ssh_padding_length= -1;
|
|
|
|
static int hf_ssh_payload= -1;
|
|
|
|
static int hf_ssh_protocol= -1;
|
|
|
|
static int hf_ssh_encrypted_packet= -1;
|
|
|
|
static int hf_ssh_padding_string= -1;
|
|
|
|
static int hf_ssh_mac_string= -1;
|
|
|
|
static int hf_ssh_msg_code = -1;
|
|
|
|
static int hf_ssh_cookie = -1;
|
|
|
|
static int hf_ssh_kex_algorithms = -1;
|
|
|
|
static int hf_ssh_server_host_key_algorithms = -1;
|
|
|
|
static int hf_ssh_encryption_algorithms_client_to_server = -1;
|
|
|
|
static int hf_ssh_encryption_algorithms_server_to_client = -1;
|
|
|
|
static int hf_ssh_mac_algorithms_client_to_server=-1;
|
|
|
|
static int hf_ssh_mac_algorithms_server_to_client=-1;
|
|
|
|
static int hf_ssh_compression_algorithms_client_to_server=-1;
|
|
|
|
static int hf_ssh_compression_algorithms_server_to_client=-1;
|
|
|
|
static int hf_ssh_languages_client_to_server=-1;
|
|
|
|
static int hf_ssh_languages_server_to_client=-1;
|
|
|
|
static int hf_ssh_kex_algorithms_length= -1;
|
|
|
|
static int hf_ssh_server_host_key_algorithms_length= -1;
|
|
|
|
static int hf_ssh_encryption_algorithms_client_to_server_length= -1;
|
|
|
|
static int hf_ssh_encryption_algorithms_server_to_client_length= -1;
|
|
|
|
static int hf_ssh_mac_algorithms_client_to_server_length= -1;
|
|
|
|
static int hf_ssh_mac_algorithms_server_to_client_length= -1;
|
|
|
|
static int hf_ssh_compression_algorithms_client_to_server_length= -1;
|
|
|
|
static int hf_ssh_compression_algorithms_server_to_client_length= -1;
|
|
|
|
static int hf_ssh_languages_client_to_server_length= -1;
|
|
|
|
static int hf_ssh_languages_server_to_client_length= -1;
|
|
|
|
|
|
|
|
static gint ett_ssh = -1;
|
|
|
|
static gint ett_key_exchange= -1;
|
|
|
|
static gint ett_key_init= -1;
|
2003-01-28 16:21:26 +00:00
|
|
|
static gint ett_ssh1= -1;
|
2003-01-29 07:03:39 +00:00
|
|
|
static gint ett_ssh2= -1;
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
static gboolean ssh_desegment = TRUE;
|
|
|
|
|
|
|
|
#define TCP_PORT_SSH 22
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
static const value_string ssh2_msg_vals[] = {
|
2003-01-25 00:22:50 +00:00
|
|
|
{SSH2_MSG_DISCONNECT, "Disconnect"},
|
|
|
|
{SSH2_MSG_IGNORE, "Ignore"},
|
|
|
|
{SSH2_MSG_UNIMPLEMENTED, "Unimplemented"},
|
2003-03-08 22:15:41 +00:00
|
|
|
{SSH2_MSG_DEBUG, "Debug"},
|
|
|
|
{SSH2_MSG_SERVICE_REQUEST, "Service Request"},
|
|
|
|
{SSH2_MSG_SERVICE_ACCEPT, "Service Accept"},
|
|
|
|
{SSH2_MSG_KEXINIT, "Key Exchange Init"},
|
|
|
|
{SSH2_MSG_NEWKEYS, "New Keys"},
|
|
|
|
{SSH2_MSG_KEXDH_INIT, "Diffie-Hellman Key Exchange Init"},
|
|
|
|
{SSH2_MSG_KEXDH_REPLY, "Diffie-Hellman Key Exchange Reply"},
|
|
|
|
{SSH2_MSG_KEX_DH_GEX_INIT, "Diffie-Hellman GEX Init"},
|
|
|
|
{SSH2_MSG_KEX_DH_GEX_REPLY, "Diffie-Hellman GEX Reply"},
|
|
|
|
{SSH2_MSG_KEX_DH_GEX_REQUEST, "Diffie-Hellman GEX Request"},
|
2003-01-25 00:22:50 +00:00
|
|
|
{ 0, NULL }
|
|
|
|
};
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
static const value_string ssh1_msg_vals[] = {
|
|
|
|
{SSH_MSG_NONE,"No Message"},
|
|
|
|
{SSH_MSG_DISCONNECT, "Disconnect"},
|
|
|
|
{SSH_SMSG_PUBLIC_KEY,"Public Key"},
|
|
|
|
{SSH_CMSG_SESSION_KEY,"Session Key"},
|
|
|
|
{SSH_CMSG_USER,"User"},
|
|
|
|
};
|
|
|
|
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
static const value_string ssh_opcode_vals[] = {
|
|
|
|
{ 0, NULL }
|
|
|
|
};
|
|
|
|
|
|
|
|
static int ssh_dissect_key_init(tvbuff_t *tvb, int offset, proto_tree *tree);
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
static int ssh_dissect_ssh1(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response,
|
|
|
|
int number, gboolean *need_desegmentation);
|
|
|
|
static int ssh_dissect_ssh2(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response,
|
|
|
|
int number, gboolean *need_desegmentation );
|
2003-01-25 00:22:50 +00:00
|
|
|
static int ssh_dissect_key_exchange(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response,
|
|
|
|
int number, gboolean *need_desegmentation );
|
|
|
|
static int ssh_dissect_protocol(tvbuff_t *tvb, packet_info *pinfo,
|
2003-01-27 19:40:55 +00:00
|
|
|
int offset, proto_tree *tree,int is_response,int *version,
|
2003-01-25 00:22:50 +00:00
|
|
|
gboolean *need_desegmentation);
|
|
|
|
static int ssh_dissect_encrypted_packet(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response);
|
2003-01-29 07:03:39 +00:00
|
|
|
proto_item * ssh_proto_tree_add_item(proto_tree *tree, int hfindex, tvbuff_t *tvb,
|
|
|
|
gint start, gint length, gboolean little_endian);
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
static void
|
|
|
|
ssh_init_protocol(void)
|
|
|
|
{
|
|
|
|
if (ssh_global_data)
|
|
|
|
g_mem_chunk_destroy(ssh_global_data);
|
|
|
|
if (ssh_this_data)
|
|
|
|
g_mem_chunk_destroy(ssh_this_data);
|
|
|
|
|
|
|
|
ssh_global_data = g_mem_chunk_new("ssh_global_datas",
|
|
|
|
sizeof(struct ssh_flow_data),
|
|
|
|
100* sizeof(struct ssh_flow_data), G_ALLOC_AND_FREE);
|
|
|
|
ssh_this_data = g_mem_chunk_new("ssh_pku_data",
|
|
|
|
sizeof(struct ssh_pdu_data),
|
|
|
|
100* sizeof(struct ssh_pdu_data), G_ALLOC_AND_FREE);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
dissect_ssh(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
|
|
|
|
proto_tree *ssh_tree = NULL;
|
|
|
|
proto_item *ti;
|
|
|
|
conversation_t *conversation=NULL;
|
2003-04-17 07:39:18 +00:00
|
|
|
gint remain_length;
|
|
|
|
int last_offset;
|
2003-01-25 00:22:50 +00:00
|
|
|
guint this_number,number;
|
|
|
|
|
|
|
|
int offset = 0;
|
|
|
|
|
|
|
|
gboolean is_response;
|
|
|
|
gboolean is_newdata;
|
|
|
|
gboolean need_desegmentation;
|
2003-01-27 19:40:55 +00:00
|
|
|
guint version;
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
struct ssh_pdu_data *this_data=NULL;
|
|
|
|
struct ssh_flow_data *global_data=NULL;
|
|
|
|
|
|
|
|
is_newdata = FALSE;
|
|
|
|
this_data = p_get_proto_data(pinfo->fd, proto_ssh);
|
|
|
|
|
|
|
|
conversation = find_conversation(&pinfo->src, &pinfo->dst, pinfo->ptype,
|
|
|
|
pinfo->srcport, pinfo->destport, 0);
|
|
|
|
|
|
|
|
if (!conversation) {
|
|
|
|
/* create a new conversation */
|
|
|
|
conversation = conversation_new(&pinfo->src, &pinfo->dst, pinfo->ptype,
|
|
|
|
pinfo->srcport, pinfo->destport, 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
global_data = conversation_get_proto_data(conversation,proto_ssh);
|
|
|
|
if(!global_data ) {
|
|
|
|
global_data = g_mem_chunk_alloc(ssh_global_data);
|
|
|
|
global_data->req_counter=0;
|
|
|
|
global_data->rsp_counter=0;
|
2003-01-27 19:40:55 +00:00
|
|
|
global_data->version=SSH_VERSION_UNKNOWN;
|
2003-01-25 00:22:50 +00:00
|
|
|
conversation_add_proto_data(conversation,proto_ssh,global_data);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* end of attaching data
|
|
|
|
*/
|
|
|
|
if (pinfo->destport == pinfo->match_port) {
|
|
|
|
is_response=FALSE;
|
|
|
|
if(!this_data) {
|
|
|
|
this_data = g_mem_chunk_alloc(ssh_this_data);
|
|
|
|
this_data->counter = global_data->req_counter++;
|
|
|
|
p_add_proto_data(pinfo->fd, proto_ssh, this_data);
|
|
|
|
is_newdata = TRUE;
|
|
|
|
}
|
|
|
|
}else {
|
|
|
|
is_response=TRUE;
|
|
|
|
if(!this_data) {
|
|
|
|
this_data = g_mem_chunk_alloc(ssh_global_data);
|
|
|
|
this_data->counter = global_data->rsp_counter++;
|
|
|
|
p_add_proto_data(pinfo->fd, proto_ssh, this_data);
|
|
|
|
is_newdata = TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if(tree) {
|
|
|
|
ti = proto_tree_add_item(tree, proto_ssh, tvb, offset, -1, FALSE);
|
|
|
|
ssh_tree = proto_item_add_subtree(ti, ett_ssh);
|
|
|
|
}
|
|
|
|
number = 0;
|
|
|
|
|
2003-01-27 19:40:55 +00:00
|
|
|
version = global_data->version;
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
|
2003-01-27 19:40:55 +00:00
|
|
|
switch(version) {
|
|
|
|
case SSH_VERSION_UNKNOWN:
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "SSH");
|
|
|
|
break;
|
|
|
|
case SSH_VERSION_1:
|
2003-01-25 00:22:50 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "SSHv1");
|
2003-01-27 19:40:55 +00:00
|
|
|
break;
|
|
|
|
case SSH_VERSION_2:
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "SSHv2");
|
|
|
|
break;
|
|
|
|
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
if(this_data->counter != 0 && version == SSH_VERSION_UNKNOWN) {
|
2003-01-25 00:22:50 +00:00
|
|
|
offset = ssh_dissect_encrypted_packet(tvb, pinfo,
|
|
|
|
offset,ssh_tree,is_response);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
while((remain_length = tvb_reported_length_remaining(tvb,offset))> 0 ) {
|
|
|
|
need_desegmentation = FALSE;
|
|
|
|
last_offset = offset;
|
|
|
|
this_number = this_data->counter+number;
|
2003-01-28 16:21:26 +00:00
|
|
|
|
2003-01-25 00:22:50 +00:00
|
|
|
if(number > 1 && is_newdata) {
|
|
|
|
/* update the this_data and flow_data */
|
|
|
|
if(is_response) {
|
|
|
|
global_data->rsp_counter++;
|
|
|
|
} else {
|
|
|
|
global_data->req_counter++;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
number++;
|
|
|
|
if(this_number == 0) {
|
2003-01-28 16:21:26 +00:00
|
|
|
offset = ssh_dissect_protocol(tvb, pinfo,
|
|
|
|
offset,ssh_tree, is_response,
|
|
|
|
&version, &need_desegmentation);
|
2003-01-25 00:22:50 +00:00
|
|
|
if(!is_response) {
|
2003-01-27 19:40:55 +00:00
|
|
|
global_data->version= version;
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
2003-01-27 19:40:55 +00:00
|
|
|
} else {
|
2003-12-23 21:16:27 +00:00
|
|
|
switch(version) {
|
|
|
|
|
|
|
|
case SSH_VERSION_UNKNOWN:
|
|
|
|
/*
|
|
|
|
* We use "tvb_ensure_length_remaining()"
|
|
|
|
* to make sure there actually *is* data
|
|
|
|
* remaining.
|
|
|
|
*
|
|
|
|
* This means we're guaranteed that
|
|
|
|
* "remain_length" is positive.
|
|
|
|
*/
|
|
|
|
remain_length = tvb_ensure_length_remaining(tvb,
|
|
|
|
offset);
|
|
|
|
proto_tree_add_text(ssh_tree, tvb, offset,
|
|
|
|
remain_length,
|
|
|
|
"Unknown SSH version data");
|
|
|
|
offset += remain_length;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SSH_VERSION_1:
|
2003-01-28 16:21:26 +00:00
|
|
|
offset = ssh_dissect_ssh1(tvb, pinfo,
|
|
|
|
offset,ssh_tree,is_response,this_number,
|
|
|
|
&need_desegmentation);
|
2003-12-23 21:16:27 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case SSH_VERSION_2:
|
2003-01-28 16:21:26 +00:00
|
|
|
offset = ssh_dissect_ssh2(tvb, pinfo,
|
2003-01-25 00:22:50 +00:00
|
|
|
offset,ssh_tree,is_response,this_number,
|
|
|
|
&need_desegmentation);
|
2003-12-23 21:16:27 +00:00
|
|
|
break;
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
}
|
2003-01-28 16:21:26 +00:00
|
|
|
|
2003-01-25 00:22:50 +00:00
|
|
|
if(need_desegmentation) return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
static int
|
|
|
|
ssh_dissect_ssh2(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response, int this_number,
|
|
|
|
gboolean *need_desegmentation)
|
|
|
|
{
|
2003-01-29 07:03:39 +00:00
|
|
|
proto_item *ti;
|
|
|
|
proto_item *ssh2_tree=NULL;
|
|
|
|
|
|
|
|
if(tree) {
|
|
|
|
ti=proto_tree_add_text(tree,tvb,offset,-1,"SSH Version 2");
|
|
|
|
ssh2_tree = proto_item_add_subtree(ti ,ett_ssh2);
|
|
|
|
}
|
2003-01-28 16:21:26 +00:00
|
|
|
|
|
|
|
if((is_response && this_number > 3) || (!is_response && this_number>4)) {
|
|
|
|
offset = ssh_dissect_encrypted_packet(tvb, pinfo,
|
2003-01-29 07:03:39 +00:00
|
|
|
offset,ssh2_tree,is_response);
|
2003-01-28 16:21:26 +00:00
|
|
|
} else {
|
|
|
|
offset = ssh_dissect_key_exchange(tvb,pinfo,
|
2003-01-29 07:03:39 +00:00
|
|
|
offset,ssh2_tree,is_response,this_number,
|
2003-01-28 16:21:26 +00:00
|
|
|
need_desegmentation);
|
|
|
|
}
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
static int
|
|
|
|
ssh_dissect_ssh1(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response,
|
|
|
|
int number, gboolean *need_desegmentation)
|
|
|
|
{
|
|
|
|
guint plen, padding_length,len;
|
|
|
|
guint8 msg_code;
|
2003-04-17 07:39:18 +00:00
|
|
|
guint remain_length;
|
2003-01-28 16:21:26 +00:00
|
|
|
|
2003-01-29 07:03:39 +00:00
|
|
|
proto_item *ti;
|
2003-01-28 16:21:26 +00:00
|
|
|
proto_item *ssh1_tree =NULL;
|
2003-01-29 07:03:39 +00:00
|
|
|
|
|
|
|
if(tree) {
|
|
|
|
ti=proto_tree_add_text(tree,tvb,offset,-1,"SSH Version 1");
|
|
|
|
ssh1_tree = proto_item_add_subtree(ti ,ett_ssh1);
|
|
|
|
}
|
2003-01-28 16:21:26 +00:00
|
|
|
|
2003-04-17 07:39:18 +00:00
|
|
|
/*
|
|
|
|
* We use "tvb_ensure_length_remaining()" to make sure there
|
|
|
|
* actually *is* data remaining.
|
|
|
|
*
|
|
|
|
* This means we're guaranteed that "remain_length" is positive.
|
|
|
|
*/
|
|
|
|
remain_length = tvb_ensure_length_remaining(tvb,offset);
|
2003-01-28 16:21:26 +00:00
|
|
|
if (ssh_desegment && pinfo->can_desegment) {
|
|
|
|
if(remain_length < 4) {
|
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len = 4-remain_length;
|
|
|
|
*need_desegmentation = TRUE;
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
plen = tvb_get_ntohl(tvb, offset) ;
|
|
|
|
padding_length = 8 - plen%8;
|
2003-01-29 07:03:39 +00:00
|
|
|
|
|
|
|
|
2003-01-28 16:21:26 +00:00
|
|
|
if (ssh_desegment && pinfo->can_desegment) {
|
|
|
|
if(plen+4+padding_length > remain_length ) {
|
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len = plen+padding_length - remain_length;
|
|
|
|
*need_desegmentation = TRUE;
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "%s: ",
|
|
|
|
is_response?"Server":"Client");
|
|
|
|
}
|
|
|
|
|
2003-01-29 07:03:39 +00:00
|
|
|
if(plen >= 0xffff) {
|
|
|
|
if (ssh1_tree && plen > 0) {
|
|
|
|
proto_tree_add_uint_format(ssh1_tree, hf_ssh_packet_length, tvb,
|
|
|
|
offset, 4, plen,"Overly large length %x",plen);
|
|
|
|
}
|
|
|
|
plen = remain_length-4-padding_length;
|
|
|
|
} else {
|
|
|
|
if (ssh1_tree && plen > 0) {
|
|
|
|
proto_tree_add_uint(ssh1_tree, hf_ssh_packet_length, tvb,
|
|
|
|
offset, 4, plen);
|
|
|
|
}
|
2003-01-28 16:21:26 +00:00
|
|
|
}
|
|
|
|
offset+=4;
|
|
|
|
/* padding length */
|
|
|
|
|
|
|
|
if (tree) {
|
2003-01-29 07:03:39 +00:00
|
|
|
proto_tree_add_uint(ssh1_tree, hf_ssh_padding_length, tvb,
|
2003-01-28 16:21:26 +00:00
|
|
|
offset, padding_length, padding_length);
|
|
|
|
}
|
|
|
|
offset += padding_length;
|
2003-01-29 07:03:39 +00:00
|
|
|
/*
|
2003-01-28 16:21:26 +00:00
|
|
|
if(tree) {
|
|
|
|
tf=proto_tree_add_text(tree,tvb,offset,-1,"SSH Version 1");
|
|
|
|
ssh1_tree = proto_item_add_subtree(tf ,ett_ssh1);
|
|
|
|
}
|
2003-01-29 07:03:39 +00:00
|
|
|
*/
|
2003-01-28 16:21:26 +00:00
|
|
|
/* msg_code */
|
|
|
|
if(number == 1 ) {
|
|
|
|
msg_code = tvb_get_guint8(tvb, offset);
|
|
|
|
if (tree) {
|
|
|
|
proto_tree_add_uint_format(ssh1_tree, hf_ssh_msg_code, tvb,
|
|
|
|
offset, 1, msg_code,"Msg code: %s (%u)",
|
|
|
|
val_to_str(msg_code, ssh1_msg_vals, "Unknown (%u)"),
|
|
|
|
msg_code);
|
|
|
|
}
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, "%s",
|
|
|
|
val_to_str(msg_code, ssh1_msg_vals, "Unknown (%u)"));
|
|
|
|
}
|
|
|
|
offset += 1;
|
|
|
|
len = plen -1;
|
|
|
|
} else {
|
|
|
|
len = plen;
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
2003-01-29 07:03:39 +00:00
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, "Encrypted packet len=%d", len);
|
2003-01-28 16:21:26 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
/* payload */
|
2003-01-29 07:03:39 +00:00
|
|
|
if (ssh1_tree ) {
|
|
|
|
ssh_proto_tree_add_item(ssh1_tree, hf_ssh_payload,
|
2003-01-28 16:21:26 +00:00
|
|
|
tvb, offset, len, FALSE);
|
|
|
|
}
|
|
|
|
offset+=len;
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
static int
|
|
|
|
ssh_dissect_key_exchange(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response,int number,
|
|
|
|
gboolean *need_desegmentation)
|
|
|
|
{
|
|
|
|
guint plen,len;
|
|
|
|
guint8 padding_length;
|
2003-04-17 07:39:18 +00:00
|
|
|
guint remain_length;
|
|
|
|
int last_offset=offset;
|
2003-01-25 00:22:50 +00:00
|
|
|
guint msg_code;
|
|
|
|
|
|
|
|
proto_item *tf;
|
|
|
|
proto_item *key_ex_tree =NULL;
|
|
|
|
|
2003-04-17 07:39:18 +00:00
|
|
|
/*
|
|
|
|
* We use "tvb_ensure_length_remaining()" to make sure there
|
|
|
|
* actually *is* data remaining.
|
|
|
|
*
|
|
|
|
* This means we're guaranteed that "remain_length" is positive.
|
|
|
|
*/
|
|
|
|
remain_length = tvb_ensure_length_remaining(tvb,offset);
|
2003-01-25 00:22:50 +00:00
|
|
|
if (ssh_desegment && pinfo->can_desegment) {
|
|
|
|
if(remain_length < 4) {
|
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len = 4-remain_length;
|
|
|
|
*need_desegmentation = TRUE;
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
plen = tvb_get_ntohl(tvb, offset) ;
|
|
|
|
|
|
|
|
if (ssh_desegment && pinfo->can_desegment) {
|
2003-01-28 16:21:26 +00:00
|
|
|
if(plen +4 > remain_length ) {
|
2003-01-25 00:22:50 +00:00
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len = plen+4 - remain_length;
|
|
|
|
*need_desegmentation = TRUE;
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
}
|
2003-01-29 07:03:39 +00:00
|
|
|
/*
|
|
|
|
* Need to check plen > 0x80000000 here
|
|
|
|
*/
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "%s: ",
|
|
|
|
is_response?"Server":"Client");
|
|
|
|
}
|
|
|
|
|
2003-01-29 07:03:39 +00:00
|
|
|
if(plen >= 0xffff) {
|
|
|
|
if (tree) {
|
|
|
|
proto_tree_add_uint_format(tree, hf_ssh_packet_length, tvb,
|
|
|
|
offset, 4, plen,"Overly large number 0x%x",plen);
|
|
|
|
}
|
|
|
|
plen = remain_length-4;
|
|
|
|
} else {
|
|
|
|
if (tree) {
|
|
|
|
proto_tree_add_uint(tree, hf_ssh_packet_length, tvb,
|
|
|
|
offset, 4, plen);
|
|
|
|
}
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
offset+=4;
|
|
|
|
/* padding length */
|
|
|
|
padding_length = tvb_get_guint8(tvb, offset);
|
|
|
|
if (tree) {
|
|
|
|
proto_tree_add_uint(tree, hf_ssh_padding_length, tvb,
|
|
|
|
offset, 1, padding_length);
|
|
|
|
}
|
|
|
|
offset += 1;
|
|
|
|
|
|
|
|
if(tree) {
|
|
|
|
tf=proto_tree_add_text(tree,tvb,offset,-1,"Key Exchange");
|
|
|
|
key_ex_tree = proto_item_add_subtree(tf ,ett_key_exchange);
|
|
|
|
}
|
|
|
|
/* msg_code */
|
|
|
|
msg_code = tvb_get_guint8(tvb, offset);
|
|
|
|
if (tree) {
|
|
|
|
proto_tree_add_uint_format(key_ex_tree, hf_ssh_msg_code, tvb,
|
|
|
|
offset, 1, msg_code,"Msg code: %s (%u)",
|
2003-01-28 16:21:26 +00:00
|
|
|
val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"),
|
2003-01-25 00:22:50 +00:00
|
|
|
msg_code);
|
|
|
|
|
|
|
|
}
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, "%s",
|
2003-01-28 16:21:26 +00:00
|
|
|
val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
offset += 1;
|
|
|
|
|
2003-01-29 07:03:39 +00:00
|
|
|
/* 16 bytes cookie */
|
2003-01-25 00:22:50 +00:00
|
|
|
if(number == 1) {
|
|
|
|
offset = ssh_dissect_key_init(tvb, offset,key_ex_tree);
|
|
|
|
}
|
|
|
|
|
|
|
|
len = plen+4-padding_length-(offset-last_offset);
|
2003-01-29 07:03:39 +00:00
|
|
|
if (tree ) {
|
|
|
|
ssh_proto_tree_add_item(key_ex_tree, hf_ssh_payload,
|
2003-01-25 00:22:50 +00:00
|
|
|
tvb, offset, len, FALSE);
|
|
|
|
}
|
|
|
|
offset +=len;
|
|
|
|
|
|
|
|
/* padding */
|
|
|
|
if(tree) {
|
2003-01-29 07:03:39 +00:00
|
|
|
ssh_proto_tree_add_item(key_ex_tree, hf_ssh_padding_string,
|
2003-01-25 00:22:50 +00:00
|
|
|
tvb, offset, padding_length, FALSE);
|
|
|
|
}
|
|
|
|
offset+= padding_length;
|
|
|
|
|
|
|
|
/* MAC , if there is still bytes, treat it as 16bytes MAC*/
|
|
|
|
if(msg_code == SSH2_MSG_KEX_DH_GEX_REPLY) {
|
|
|
|
len = tvb_reported_length_remaining(tvb,offset);
|
|
|
|
if(len == 16) {
|
|
|
|
if(tree) {
|
|
|
|
proto_tree_add_item(key_ex_tree, hf_ssh_mac_string,
|
|
|
|
tvb, offset, len , FALSE);
|
|
|
|
}
|
|
|
|
offset+=len;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
static int
|
|
|
|
ssh_dissect_encrypted_packet(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
int offset, proto_tree *tree,int is_response)
|
|
|
|
{
|
2003-04-17 07:39:18 +00:00
|
|
|
gint len;
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
len = tvb_reported_length_remaining(tvb,offset);
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
2003-01-29 07:03:39 +00:00
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "Encrypted %s packet len=%d",
|
|
|
|
is_response?"response":"request",len);
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
if (tree ) {
|
2003-01-29 07:03:39 +00:00
|
|
|
ssh_proto_tree_add_item(tree, hf_ssh_encrypted_packet,
|
2003-01-25 00:22:50 +00:00
|
|
|
tvb, offset, len, FALSE);
|
|
|
|
}
|
|
|
|
offset+=len;
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ssh_dissect_protocol(tvbuff_t *tvb, packet_info *pinfo,
|
2003-01-27 19:40:55 +00:00
|
|
|
int offset, proto_tree *tree, int is_response, int * version,
|
2003-01-25 00:22:50 +00:00
|
|
|
gboolean *need_desegmentation)
|
|
|
|
{
|
|
|
|
guint remain_length;
|
2003-04-17 07:39:18 +00:00
|
|
|
gint linelen, protolen;
|
2003-01-25 00:22:50 +00:00
|
|
|
|
2003-01-27 19:40:55 +00:00
|
|
|
/*
|
|
|
|
* If the first packet do not contain the banner,
|
|
|
|
* it is dump in the middle of a flow or not a ssh at all
|
|
|
|
*/
|
|
|
|
if(tvb_strncaseeql(tvb,offset,"SSH-",4) != 0 ) {
|
|
|
|
offset = ssh_dissect_encrypted_packet(tvb, pinfo,
|
|
|
|
offset,tree,is_response);
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
if(!is_response) {
|
2003-01-28 16:21:26 +00:00
|
|
|
if(tvb_strncaseeql(tvb,offset,"SSH-2.",6) == 0 ) {
|
|
|
|
*(version) = SSH_VERSION_2;
|
|
|
|
}else if(tvb_strncaseeql(tvb,offset,"SSH-1.99-",9) == 0 ) {
|
2003-01-27 19:40:55 +00:00
|
|
|
*(version) = SSH_VERSION_2;
|
2003-01-28 16:21:26 +00:00
|
|
|
}else if(tvb_strncaseeql(tvb,offset,"SSH-1.",6) == 0 ) {
|
2003-01-27 19:40:55 +00:00
|
|
|
*(version) = SSH_VERSION_1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-04-17 07:39:18 +00:00
|
|
|
/*
|
|
|
|
* We use "tvb_ensure_length_remaining()" to make sure there
|
|
|
|
* actually *is* data remaining.
|
|
|
|
*
|
|
|
|
* This means we're guaranteed that "remain_length" is positive.
|
|
|
|
*/
|
|
|
|
remain_length = tvb_ensure_length_remaining(tvb,offset);
|
2003-01-29 07:03:39 +00:00
|
|
|
/*linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
|
|
|
|
*/
|
|
|
|
linelen = tvb_find_guint8(tvb, offset, -1, '\n');
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
if (ssh_desegment && pinfo->can_desegment) {
|
2003-04-17 07:39:18 +00:00
|
|
|
if(linelen == -1 || remain_length < (guint)linelen-offset ) {
|
2003-01-25 00:22:50 +00:00
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len = linelen-remain_length;
|
|
|
|
*need_desegmentation = TRUE;
|
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
}
|
2003-01-29 07:03:39 +00:00
|
|
|
if(linelen == -1 ) {
|
2003-04-17 07:39:18 +00:00
|
|
|
/* XXX - reassemble across segment boundaries? */
|
2003-01-29 07:03:39 +00:00
|
|
|
linelen = remain_length;
|
2003-04-17 07:39:18 +00:00
|
|
|
protolen = linelen;
|
2003-01-29 07:03:39 +00:00
|
|
|
} else {
|
2003-04-17 07:39:18 +00:00
|
|
|
linelen = linelen - offset + 1;
|
|
|
|
protolen = linelen - 1;
|
2003-01-29 07:03:39 +00:00
|
|
|
}
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "%s Protocol: %s",
|
|
|
|
is_response?"Server":"Client",
|
2003-04-17 07:39:18 +00:00
|
|
|
tvb_format_text(tvb,offset,protolen));
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
if (tree ) {
|
2003-01-29 07:03:39 +00:00
|
|
|
ssh_proto_tree_add_item(tree, hf_ssh_protocol,
|
2003-04-17 07:39:18 +00:00
|
|
|
tvb, offset, linelen, FALSE);
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
2003-04-17 07:39:18 +00:00
|
|
|
offset+=linelen;
|
2003-01-25 00:22:50 +00:00
|
|
|
return offset;
|
|
|
|
}
|
|
|
|
|
2003-03-08 22:15:41 +00:00
|
|
|
#define SSH_PROPOSAL(item)\
|
|
|
|
{ &hf_ssh_ ## item, &hf_ssh_ ## item ## _length }
|
|
|
|
|
|
|
|
static struct {
|
|
|
|
int *value, *length;
|
|
|
|
} ssh_proposals[] = {
|
|
|
|
SSH_PROPOSAL(kex_algorithms),
|
|
|
|
SSH_PROPOSAL(server_host_key_algorithms),
|
|
|
|
SSH_PROPOSAL(encryption_algorithms_client_to_server),
|
|
|
|
SSH_PROPOSAL(encryption_algorithms_server_to_client),
|
|
|
|
SSH_PROPOSAL(mac_algorithms_client_to_server),
|
|
|
|
SSH_PROPOSAL(mac_algorithms_server_to_client),
|
|
|
|
SSH_PROPOSAL(compression_algorithms_client_to_server),
|
|
|
|
SSH_PROPOSAL(compression_algorithms_server_to_client),
|
|
|
|
SSH_PROPOSAL(languages_client_to_server),
|
|
|
|
SSH_PROPOSAL(languages_server_to_client),
|
|
|
|
{NULL, NULL}
|
|
|
|
};
|
|
|
|
|
2003-01-25 00:22:50 +00:00
|
|
|
static int
|
|
|
|
ssh_dissect_key_init(tvbuff_t *tvb, int offset, proto_tree *tree )
|
|
|
|
{
|
|
|
|
guint len;
|
2003-03-08 22:15:41 +00:00
|
|
|
int i;
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
proto_item *tf;
|
|
|
|
proto_item *key_init_tree=NULL;
|
|
|
|
|
|
|
|
if (tree) {
|
2003-03-08 22:15:41 +00:00
|
|
|
tf=proto_tree_add_text(tree,tvb,offset,-1,"Algorithms");
|
|
|
|
key_init_tree = proto_item_add_subtree(tf, ett_key_init);
|
2003-01-25 00:22:50 +00:00
|
|
|
proto_tree_add_item(key_init_tree, hf_ssh_cookie,
|
|
|
|
tvb, offset, 16, FALSE);
|
|
|
|
}
|
|
|
|
offset += 16;
|
|
|
|
|
2003-03-08 22:15:41 +00:00
|
|
|
for (i = 0; ssh_proposals[i].value; i++) {
|
|
|
|
len = tvb_get_ntohl(tvb, offset);
|
|
|
|
if (key_init_tree) {
|
|
|
|
proto_tree_add_uint(key_init_tree,
|
|
|
|
*ssh_proposals[i].length, tvb, offset, 4, len);
|
|
|
|
}
|
|
|
|
offset+=4;
|
|
|
|
if (key_init_tree) {
|
|
|
|
ssh_proto_tree_add_item(key_init_tree,
|
|
|
|
*ssh_proposals[i].value, tvb, offset, len, FALSE);
|
|
|
|
}
|
|
|
|
offset+=len;
|
2003-01-25 00:22:50 +00:00
|
|
|
}
|
|
|
|
return offset;
|
|
|
|
}
|
2003-01-29 07:03:39 +00:00
|
|
|
proto_item *
|
|
|
|
ssh_proto_tree_add_item(proto_tree *tree, int hfindex, tvbuff_t *tvb,
|
|
|
|
gint start, gint length, gboolean little_endian)
|
|
|
|
{
|
|
|
|
if (tree && length <0xffff && length > 0) {
|
|
|
|
return proto_tree_add_item(tree, hfindex, tvb, start, length,little_endian);
|
|
|
|
}
|
|
|
|
return NULL;
|
|
|
|
}
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_register_ssh(void)
|
|
|
|
{
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_ssh_packet_length,
|
|
|
|
{ "Packet Length", "ssh.packet_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH packet length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_padding_length,
|
|
|
|
{ "Padding Length", "ssh.padding_length",
|
|
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH Packet Number", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_msg_code,
|
|
|
|
{ "Message Code", "ssh.message_code",
|
|
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH Message Code", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_cookie,
|
|
|
|
{ "Cookie", "ssh.cookie",
|
2003-03-08 22:15:41 +00:00
|
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH Cookie", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_encrypted_packet,
|
|
|
|
{ "Encrypted Packet", "ssh.encrypted_packet",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH Protocol Packet", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_protocol,
|
|
|
|
{ "Protocol", "ssh.protocol",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH Protocol", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_payload,
|
2003-01-30 08:11:20 +00:00
|
|
|
{ "Payload", "ssh.payload",
|
|
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
|
|
"SSH Payload", HFILL }},
|
2003-01-25 00:22:50 +00:00
|
|
|
|
|
|
|
{ &hf_ssh_padding_string,
|
|
|
|
{ "Padding String", "ssh.padding_string",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH Padding String", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_mac_string,
|
|
|
|
{ "MAC String", "ssh.mac_string",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH MAC String", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_kex_algorithms,
|
|
|
|
{ "kex_algorithms string", "ssh.kex_algorithms",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH kex_algorithms string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_server_host_key_algorithms,
|
|
|
|
{ "server_host_key_algorithms string", "ssh.server_host_key_algorithms",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH server_host_key_algorithms string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_encryption_algorithms_client_to_server,
|
|
|
|
{ "encryption_algorithms_client_to_server string", "ssh.encryption_algorithms_client_to_server",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH encryption_algorithms_client_to_server string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_encryption_algorithms_server_to_client,
|
|
|
|
{ "encryption_algorithms_server_to_client string", "ssh.encryption_algorithms_server_to_client",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH encryption_algorithms_server_to_client string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_mac_algorithms_client_to_server,
|
|
|
|
{ "mac_algorithms_client_to_server string", "ssh.mac_algorithms_client_to_server",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH mac_algorithms_client_to_server string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_mac_algorithms_server_to_client,
|
|
|
|
{ "mac_algorithms_server_to_client string", "ssh.mac_algorithms_server_to_client",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH mac_algorithms_server_to_client string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_compression_algorithms_client_to_server,
|
|
|
|
{ "compression_algorithms_client_to_server string", "ssh.compression_algorithms_client_to_server",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH compression_algorithms_client_to_server string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_compression_algorithms_server_to_client,
|
|
|
|
{ "compression_algorithms_server_to_client string", "ssh.compression_algorithms_server_to_client",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH compression_algorithms_server_to_client string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_languages_client_to_server,
|
|
|
|
{ "languages_client_to_server string", "ssh.languages_client_to_server",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH languages_client_to_server string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_languages_server_to_client,
|
|
|
|
{ "languages_server_to_client string", "ssh.languages_server_to_client",
|
2003-01-30 08:11:20 +00:00
|
|
|
FT_STRINGZ, BASE_NONE, NULL, 0x0,
|
2003-01-25 00:22:50 +00:00
|
|
|
"SSH languages_server_to_client string", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_kex_algorithms_length,
|
|
|
|
{ "kex_algorithms length", "ssh.kex_algorithms_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH kex_algorithms length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_server_host_key_algorithms_length,
|
|
|
|
{ "server_host_key_algorithms length", "ssh.server_host_key_algorithms_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH server_host_key_algorithms length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_encryption_algorithms_client_to_server_length,
|
|
|
|
{ "encryption_algorithms_client_to_server length", "ssh.encryption_algorithms_client_to_server_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH encryption_algorithms_client_to_server length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_encryption_algorithms_server_to_client_length,
|
|
|
|
{ "encryption_algorithms_server_to_client length", "ssh.encryption_algorithms_server_to_client_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH encryption_algorithms_server_to_client length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_mac_algorithms_client_to_server_length,
|
|
|
|
{ "mac_algorithms_client_to_server length", "ssh.mac_algorithms_client_to_server_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH mac_algorithms_client_to_server length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_mac_algorithms_server_to_client_length,
|
|
|
|
{ "mac_algorithms_server_to_client length", "ssh.mac_algorithms_server_to_client_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH mac_algorithms_server_to_client length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_compression_algorithms_client_to_server_length,
|
|
|
|
{ "compression_algorithms_client_to_server length", "ssh.compression_algorithms_client_to_server_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH compression_algorithms_client_to_server length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_compression_algorithms_server_to_client_length,
|
|
|
|
{ "compression_algorithms_server_to_client length", "ssh.compression_algorithms_server_to_client_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH compression_algorithms_server_to_client length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_languages_client_to_server_length,
|
|
|
|
{ "languages_client_to_server length", "ssh.languages_client_to_server_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH languages_client_to_server length", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_ssh_languages_server_to_client_length,
|
|
|
|
{ "languages_server_to_client length", "ssh.languages_server_to_client_length",
|
|
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
|
|
"SSH languages_server_to_client length", HFILL }},
|
|
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_ssh,
|
|
|
|
&ett_key_exchange,
|
2003-01-28 16:21:26 +00:00
|
|
|
&ett_ssh1,
|
2003-01-29 07:03:39 +00:00
|
|
|
&ett_ssh2,
|
2003-01-25 00:22:50 +00:00
|
|
|
&ett_key_init
|
|
|
|
};
|
|
|
|
module_t *ssh_module;
|
|
|
|
|
|
|
|
proto_ssh = proto_register_protocol("SSH Protocol",
|
|
|
|
"SSH", "ssh");
|
|
|
|
proto_register_field_array(proto_ssh, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
|
|
register_init_routine(&ssh_init_protocol);
|
|
|
|
|
|
|
|
ssh_module = prefs_register_protocol(proto_ssh, NULL);
|
|
|
|
prefs_register_bool_preference(ssh_module, "desegment_buffers",
|
2004-08-21 09:02:52 +00:00
|
|
|
"Reassemble SSH buffers spanning multiple TCP segments",
|
|
|
|
"Whether the SSH dissector should reassemble SSH buffers spanning multiple TCP segments. "
|
|
|
|
"To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
|
2003-01-25 00:22:50 +00:00
|
|
|
&ssh_desegment);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_ssh(void)
|
|
|
|
{
|
|
|
|
dissector_handle_t ssh_handle;
|
|
|
|
|
|
|
|
ssh_handle = create_dissector_handle(dissect_ssh, proto_ssh);
|
|
|
|
|
|
|
|
dissector_add("tcp.port", TCP_PORT_SSH, ssh_handle);
|
|
|
|
}
|