2006-07-06 10:58:48 +00:00
|
|
|
/* packet-cwids.c
|
2010-10-08 17:48:22 +00:00
|
|
|
* Routines for dissecting wireless ids packets sent from a Cisco
|
2006-07-06 10:58:48 +00:00
|
|
|
* access point to the WLSE (or whatever)
|
|
|
|
*
|
|
|
|
* Copyright 2006 Joerg Mayer (see AUTHORS file)
|
|
|
|
*
|
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 22:56:06 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
2006-07-06 10:58:48 +00:00
|
|
|
*/
|
|
|
|
|
2006-07-09 12:11:30 +00:00
|
|
|
/* With current IOS, you can use Cisco wireless Bridges/APs as
|
2006-07-25 05:17:17 +00:00
|
|
|
* wireless sniffers and configure them to send the data to some
|
|
|
|
* central IDS:
|
|
|
|
* interface dot11Radio 0
|
|
|
|
* station-role scanner
|
|
|
|
* monitor frames endpoint ip address 172.22.1.1 port 8999 truncate 2312
|
|
|
|
* These frames are raw, i.e. they don't have a pcap header.
|
|
|
|
* Running wireshark at the receiving end will provide those.
|
2006-07-06 10:58:48 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
/* 2do:
|
|
|
|
* - Find out more about the contents of the capture header
|
|
|
|
* - Protect the address fields etc (all columns?)
|
|
|
|
* - Create subelements and put each header and packet into it
|
|
|
|
* - fuzz-test the dissector
|
2006-07-25 05:17:17 +00:00
|
|
|
* - Find some heuristic to detect the packet automagically and
|
2006-07-06 10:58:48 +00:00
|
|
|
* convert dissector into a heuristic dissector
|
|
|
|
* - Is the TRY/CATCH stuff OK?
|
|
|
|
*/
|
|
|
|
|
2012-09-20 02:03:38 +00:00
|
|
|
#include "config.h"
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
#include <glib.h>
|
|
|
|
#include <epan/packet.h>
|
2013-11-10 15:59:37 +00:00
|
|
|
#include <epan/exceptions.h>
|
2006-07-06 10:58:48 +00:00
|
|
|
#include <epan/etypes.h>
|
|
|
|
#include <epan/expert.h>
|
|
|
|
#include <epan/prefs.h>
|
Move show_exception() and show_reported_bounds_error() to
epan/show_exception.c, as it's used outside
epan/dissectors/packet-frame.c. Update their callers to include
<epan/show_exception.h> to get their declaration.
Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if
there's more stuff in the packet to dissect after the dissector call
that threw the exception, doesn't mean you shouldn't go ahead and
dissect that stuff. Use it in all those cases, including ones where
BoundsError was inappropriately being caught (you want those passed up
to the top level, so that the packet is reported as having been cut
short in the capture process).
Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that
correspond to running past the end of the data for a tvbuff; use it
rather than explicitly catching those exceptions individually, and
rather than just catching all exceptions (the only place that
DissectorError should be caught, for example, is at the top level, so
dissector bugs show up in the protocol tree).
Don't catch and then immediately rethrow exceptions without doing
anything else; just let the exceptions go up to the final catcher.
Use show_exception() to report non-fatal errors, rather than doing it
yourself.
If a dissector is called from Lua, catch all non-fatal errors and use
show_exception() to report them rather than catching only
ReportedBoundsError and adding a proto_malformed item.
Don't catch exceptions when constructing a trailer tvbuff in
packet-ieee8023.c - just construct it after the payload has been
dissected, and let whatever exceptions that throws be handled at the top
level.
Avoid some TRY/CATCH/ENDTRY cases by using checks such as
tvb_bytes_exist() before even looking in the tvbuff.
svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
|
|
|
#include <epan/show_exception.h>
|
2006-07-06 10:58:48 +00:00
|
|
|
|
2008-09-12 16:52:01 +00:00
|
|
|
static guint global_udp_port = 0;
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
static int proto_cwids = -1;
|
|
|
|
static int hf_cwids_version = -1;
|
|
|
|
static int hf_cwids_unknown1 = -1;
|
2006-07-25 05:17:17 +00:00
|
|
|
static int hf_cwids_channel = -1;
|
|
|
|
static int hf_cwids_unknown2 = -1;
|
2006-07-06 10:58:48 +00:00
|
|
|
static int hf_cwids_reallength = -1;
|
|
|
|
static int hf_cwids_capturelen = -1;
|
2006-07-25 05:17:17 +00:00
|
|
|
static int hf_cwids_unknown3 = -1;
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
static gint ett_cwids = -1;
|
|
|
|
|
2014-08-01 14:08:57 +00:00
|
|
|
static expert_field ie_ieee80211_subpacket = EI_INIT;
|
|
|
|
|
2006-07-06 10:58:48 +00:00
|
|
|
static dissector_handle_t ieee80211_handle;
|
|
|
|
|
|
|
|
static void
|
|
|
|
dissect_cwids(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
tvbuff_t *wlan_tvb;
|
|
|
|
proto_tree *ti, *cwids_tree;
|
2007-04-13 00:50:23 +00:00
|
|
|
volatile int offset = 0;
|
2006-07-06 10:58:48 +00:00
|
|
|
guint16 capturelen;
|
2010-10-08 17:48:22 +00:00
|
|
|
void *pd_save;
|
2006-07-06 10:58:48 +00:00
|
|
|
|
2009-08-09 06:26:46 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "CWIDS");
|
2009-08-09 07:59:51 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_INFO, "Cwids: ");
|
2006-07-06 10:58:48 +00:00
|
|
|
/* FIXME: col_set_fence(pinfo->cinfo, all-cols, only addr-cols?); */
|
|
|
|
|
|
|
|
cwids_tree = NULL;
|
|
|
|
|
2014-06-19 17:18:16 +00:00
|
|
|
while(tvb_length_remaining(tvb, offset) > 0) {
|
2011-10-21 02:10:19 +00:00
|
|
|
ti = proto_tree_add_item(tree, proto_cwids, tvb, offset, 28, ENC_NA);
|
2006-07-06 10:58:48 +00:00
|
|
|
cwids_tree = proto_item_add_subtree(ti, ett_cwids);
|
2010-10-08 17:48:22 +00:00
|
|
|
|
2011-08-26 17:02:33 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_version, tvb, offset, 2, ENC_BIG_ENDIAN);
|
2006-07-06 10:58:48 +00:00
|
|
|
offset += 2;
|
2011-10-04 22:44:31 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_unknown1, tvb, offset, 7, ENC_NA);
|
2006-07-25 05:17:17 +00:00
|
|
|
offset += 7;
|
2011-08-26 17:02:33 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_channel, tvb, offset, 1, ENC_BIG_ENDIAN);
|
2006-07-25 05:17:17 +00:00
|
|
|
offset += 1;
|
2011-10-04 22:44:31 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_unknown2, tvb, offset, 6, ENC_NA);
|
2006-07-25 05:17:17 +00:00
|
|
|
offset += 6;
|
2011-08-26 17:02:33 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_reallength, tvb, offset, 2, ENC_BIG_ENDIAN);
|
2006-07-06 10:58:48 +00:00
|
|
|
offset += 2;
|
|
|
|
capturelen = tvb_get_ntohs(tvb, offset);
|
2011-08-26 17:02:33 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_capturelen, tvb, offset, 2, ENC_BIG_ENDIAN);
|
2006-07-06 10:58:48 +00:00
|
|
|
offset += 2;
|
2011-10-04 22:44:31 +00:00
|
|
|
proto_tree_add_item(cwids_tree, hf_cwids_unknown3, tvb, offset, 8, ENC_NA);
|
2006-07-06 10:58:48 +00:00
|
|
|
offset += 8;
|
2010-10-08 17:48:22 +00:00
|
|
|
|
2014-06-06 14:35:50 +00:00
|
|
|
wlan_tvb = tvb_new_subset_length(tvb, offset, capturelen);
|
2006-07-06 10:58:48 +00:00
|
|
|
/* Continue after ieee80211 dissection errors */
|
2010-10-08 17:48:22 +00:00
|
|
|
pd_save = pinfo->private_data;
|
2006-07-06 10:58:48 +00:00
|
|
|
TRY {
|
|
|
|
call_dissector(ieee80211_handle, wlan_tvb, pinfo, tree);
|
Move show_exception() and show_reported_bounds_error() to
epan/show_exception.c, as it's used outside
epan/dissectors/packet-frame.c. Update their callers to include
<epan/show_exception.h> to get their declaration.
Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if
there's more stuff in the packet to dissect after the dissector call
that threw the exception, doesn't mean you shouldn't go ahead and
dissect that stuff. Use it in all those cases, including ones where
BoundsError was inappropriately being caught (you want those passed up
to the top level, so that the packet is reported as having been cut
short in the capture process).
Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that
correspond to running past the end of the data for a tvbuff; use it
rather than explicitly catching those exceptions individually, and
rather than just catching all exceptions (the only place that
DissectorError should be caught, for example, is at the top level, so
dissector bugs show up in the protocol tree).
Don't catch and then immediately rethrow exceptions without doing
anything else; just let the exceptions go up to the final catcher.
Use show_exception() to report non-fatal errors, rather than doing it
yourself.
If a dissector is called from Lua, catch all non-fatal errors and use
show_exception() to report them rather than catching only
ReportedBoundsError and adding a proto_malformed item.
Don't catch exceptions when constructing a trailer tvbuff in
packet-ieee8023.c - just construct it after the payload has been
dissected, and let whatever exceptions that throws be handled at the top
level.
Avoid some TRY/CATCH/ENDTRY cases by using checks such as
tvb_bytes_exist() before even looking in the tvbuff.
svn path=/trunk/; revision=47924
2013-02-27 22:43:54 +00:00
|
|
|
} CATCH_BOUNDS_ERRORS {
|
|
|
|
show_exception(wlan_tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
|
2006-07-06 10:58:48 +00:00
|
|
|
|
2010-10-08 17:48:22 +00:00
|
|
|
/* Restore the private_data structure in case one of the
|
|
|
|
* called dissectors modified it (and, due to the exception,
|
|
|
|
* was unable to restore it).
|
|
|
|
*/
|
|
|
|
pinfo->private_data = pd_save;
|
2014-08-01 14:08:57 +00:00
|
|
|
expert_add_info(pinfo, ti, &ie_ieee80211_subpacket);
|
2006-07-06 10:58:48 +00:00
|
|
|
} ENDTRY;
|
|
|
|
|
|
|
|
offset += capturelen;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2006-07-09 12:11:30 +00:00
|
|
|
void proto_register_cwids(void);
|
|
|
|
void proto_reg_handoff_cwids(void);
|
|
|
|
|
2006-07-06 10:58:48 +00:00
|
|
|
void
|
|
|
|
proto_register_cwids(void)
|
|
|
|
{
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_cwids_version,
|
|
|
|
{ "Capture Version", "cwids.version", FT_UINT16, BASE_DEC, NULL,
|
|
|
|
0x0, "Version or format of record", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_cwids_unknown1,
|
|
|
|
{ "Unknown1", "cwids.unknown1", FT_BYTES, BASE_NONE, NULL,
|
2006-07-25 05:17:17 +00:00
|
|
|
0x0, "1st Unknown block - timestamp?", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_cwids_channel,
|
|
|
|
{ "Channel", "cwids.channel", FT_UINT8, BASE_DEC, NULL,
|
|
|
|
0x0, "Channel for this capture", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_cwids_unknown2,
|
|
|
|
{ "Unknown2", "cwids.unknown2", FT_BYTES, BASE_NONE, NULL,
|
|
|
|
0x0, "2nd Unknown block", HFILL }},
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
{ &hf_cwids_reallength,
|
|
|
|
{ "Original length", "cwids.reallen", FT_UINT16, BASE_DEC, NULL,
|
|
|
|
0x0, "Original num bytes in frame", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_cwids_capturelen,
|
|
|
|
{ "Capture length", "cwids.caplen", FT_UINT16, BASE_DEC, NULL,
|
|
|
|
0x0, "Captured bytes in record", HFILL }},
|
|
|
|
|
2006-07-25 05:17:17 +00:00
|
|
|
{ &hf_cwids_unknown3,
|
|
|
|
{ "Unknown3", "cwids.unknown3", FT_BYTES, BASE_NONE, NULL,
|
|
|
|
0x0, "3rd Unknown block", HFILL }},
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
};
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_cwids,
|
|
|
|
};
|
|
|
|
|
2014-08-01 14:08:57 +00:00
|
|
|
static ei_register_info ei[] = {
|
|
|
|
{ &ie_ieee80211_subpacket, { "cwids.ieee80211_malformed", PI_MALFORMED, PI_ERROR, "Malformed or short IEEE80211 subpacket", EXPFILL }},
|
|
|
|
};
|
|
|
|
|
2006-07-06 10:58:48 +00:00
|
|
|
module_t *cwids_module;
|
2014-08-01 14:08:57 +00:00
|
|
|
expert_module_t* expert_cwids;
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
proto_cwids = proto_register_protocol("Cisco Wireless IDS Captures", "CWIDS", "cwids");
|
|
|
|
proto_register_field_array(proto_cwids, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2014-08-01 14:08:57 +00:00
|
|
|
expert_cwids = expert_register_protocol(proto_cwids);
|
|
|
|
expert_register_field_array(expert_cwids, ei, array_length(ei));
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
cwids_module = prefs_register_protocol(proto_cwids, proto_reg_handoff_cwids);
|
|
|
|
prefs_register_uint_preference(cwids_module, "udp.port",
|
|
|
|
"CWIDS port",
|
|
|
|
"Set the destination UDP port Cisco wireless IDS messages",
|
2008-09-12 16:52:01 +00:00
|
|
|
10, &global_udp_port);
|
2006-07-06 10:58:48 +00:00
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_cwids(void)
|
|
|
|
{
|
2008-09-12 16:52:01 +00:00
|
|
|
static dissector_handle_t cwids_handle;
|
|
|
|
static guint saved_udp_port;
|
|
|
|
static gboolean initialized = FALSE;
|
|
|
|
|
|
|
|
if (!initialized) {
|
|
|
|
cwids_handle = create_dissector_handle(dissect_cwids, proto_cwids);
|
2014-06-20 16:43:28 +00:00
|
|
|
dissector_add_for_decode_as("udp.port", cwids_handle);
|
2014-05-29 17:56:46 +00:00
|
|
|
ieee80211_handle = find_dissector("wlan_withoutfcs");
|
2008-09-12 16:52:01 +00:00
|
|
|
initialized = TRUE;
|
|
|
|
} else {
|
|
|
|
if (saved_udp_port != 0) {
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_delete_uint("udp.port", saved_udp_port, cwids_handle);
|
2008-09-12 16:52:01 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if (global_udp_port != 0) {
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("udp.port", global_udp_port, cwids_handle);
|
2008-09-12 16:52:01 +00:00
|
|
|
}
|
|
|
|
saved_udp_port = global_udp_port;
|
2006-07-06 10:58:48 +00:00
|
|
|
}
|
|
|
|
|
2014-09-30 20:59:17 +00:00
|
|
|
/*
|
|
|
|
* Editor modelines - http://www.wireshark.org/tools/modelines.html
|
|
|
|
*
|
|
|
|
* Local variables:
|
|
|
|
* c-basic-offset: 8
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: t
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
|
|
|
|
* :indentSize=8:tabSize=8:noTabs=false:
|
|
|
|
*/
|