2000-12-17 07:38:14 +00:00
|
|
|
/* packet-xot.c
|
2002-04-09 08:15:04 +00:00
|
|
|
* Routines for X.25 over TCP dissection (RFC 1613)
|
2000-12-17 07:38:14 +00:00
|
|
|
*
|
|
|
|
* Copyright 2000, Paul Ionescu <paul@acorp.ro>
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
2000-12-17 07:38:14 +00:00
|
|
|
*
|
2006-05-21 04:49:01 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2000-12-17 07:38:14 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
2000-12-17 07:38:14 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
2000-12-17 07:38:14 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
2000-12-17 07:38:14 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <ctype.h>
|
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
#include <glib.h>
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2006-03-20 10:52:53 +00:00
|
|
|
#include <epan/emem.h>
|
2003-01-21 01:45:17 +00:00
|
|
|
#include "packet-tcp.h"
|
2004-09-27 22:55:15 +00:00
|
|
|
#include <epan/prefs.h>
|
2000-12-17 07:38:14 +00:00
|
|
|
|
|
|
|
#define TCP_PORT_XOT 1998
|
|
|
|
|
|
|
|
static gint proto_xot = -1;
|
2001-09-13 08:05:26 +00:00
|
|
|
static gint hf_xot_version = -1;
|
|
|
|
static gint hf_xot_length = -1;
|
|
|
|
|
2000-12-17 07:38:14 +00:00
|
|
|
static gint ett_xot = -1;
|
|
|
|
|
2002-04-09 08:15:04 +00:00
|
|
|
/* desegmentation of X.25 over TCP */
|
|
|
|
static gboolean xot_desegment = TRUE;
|
|
|
|
|
If you register more than one field with the same name, the dfilter code
can now handle that; this allows us to register both the modulo-8 and
the modulo-128 versions of various X.25 bitfields with "x.25.XXX" names,
which lets us get rid of the "ex.25" protocol stuff completely and use
"x.25" for both modulo-8 and modulo-128 X.25. Do so. (Also, fix up
some cases where we appeared to be using the modulo-8 fields when
dissecting modulo-128 X.25.)
This, in turn, allows us to register the X.25 dissector, as there's now
only one protocol with which it's associated, and make it static and
have it called only through a handle, and to, when registering it with
the "llc.dsap" dissector table, associate it with "proto_x25".
That, in turn, allows us to get rid of the "CHECK_DISPLAY_AS_DATA()"
calls, and the code to set "pinfo->current_proto", in the X.25
dissector.
The code for the display filter expression dialog would, if there are
two fields with the same name registered under a protocol, list both of
them; have it list only one of them - the fields should have the same
type, the same radix, and the same value_string/true_false_string table
if any (if they don't, they're really not the same field...).
svn path=/trunk/; revision=3023
2001-02-12 09:06:19 +00:00
|
|
|
static dissector_handle_t x25_handle;
|
|
|
|
|
2006-10-31 09:29:07 +00:00
|
|
|
static guint get_xot_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
|
2000-12-17 07:38:14 +00:00
|
|
|
{
|
2003-01-21 01:45:17 +00:00
|
|
|
guint16 plen;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Get the length of the X.25-over-TCP packet.
|
|
|
|
*/
|
|
|
|
plen = tvb_get_ntohs(tvb, offset + 2);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* That length doesn't include the header; add that in.
|
|
|
|
*/
|
|
|
|
return plen + 4;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void dissect_xot_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
int offset = 0;
|
2002-04-09 08:15:04 +00:00
|
|
|
guint16 version;
|
|
|
|
guint16 plen;
|
|
|
|
int length;
|
2000-12-17 07:38:14 +00:00
|
|
|
proto_item *ti;
|
|
|
|
proto_tree *xot_tree;
|
2002-08-28 21:04:11 +00:00
|
|
|
tvbuff_t *next_tvb;
|
2001-09-13 08:05:26 +00:00
|
|
|
|
2003-01-21 01:45:17 +00:00
|
|
|
/*
|
|
|
|
* Dissect the X.25-over-TCP packet.
|
|
|
|
*/
|
|
|
|
version = tvb_get_ntohs(tvb, offset + 0);
|
|
|
|
plen = tvb_get_ntohs(tvb, offset + 2);
|
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL))
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "XOT");
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO))
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "XOT Version = %u, size = %u",
|
|
|
|
version, plen);
|
|
|
|
|
|
|
|
if (tree) {
|
|
|
|
ti = proto_tree_add_protocol_format(tree, proto_xot, tvb, offset, 4,
|
2002-04-09 08:15:04 +00:00
|
|
|
"X.25 over TCP");
|
2003-01-21 01:45:17 +00:00
|
|
|
xot_tree = proto_item_add_subtree(ti, ett_xot);
|
|
|
|
|
|
|
|
proto_tree_add_uint(xot_tree, hf_xot_version, tvb, offset, 2, version);
|
|
|
|
proto_tree_add_uint(xot_tree, hf_xot_length, tvb, offset + 2, 2, plen);
|
2000-12-17 07:38:14 +00:00
|
|
|
}
|
2003-01-21 01:45:17 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Construct a tvbuff containing the amount of the payload we have
|
|
|
|
* available. Make its reported length the amount of data in the
|
|
|
|
* X.25-over-TCP packet.
|
|
|
|
*/
|
|
|
|
length = tvb_length_remaining(tvb, offset + 4);
|
|
|
|
if (length > plen)
|
|
|
|
length = plen;
|
2006-09-29 19:39:40 +00:00
|
|
|
if (plen > 0)
|
|
|
|
{
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset + 4, length, plen);
|
|
|
|
call_dissector(x25_handle, next_tvb, pinfo, tree);
|
|
|
|
}
|
2003-01-21 01:45:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int dissect_xot(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Do we have the full version number and, if so, is it zero?
|
|
|
|
* If we have it but it's not zero, reject this segment.
|
|
|
|
*/
|
|
|
|
if (tvb_bytes_exist(tvb, 0, 2)) {
|
|
|
|
if (tvb_get_ntohs(tvb, 0) != 0)
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The version number's OK, so dissect this segment.
|
|
|
|
*/
|
|
|
|
tcp_dissect_pdus(tvb, pinfo, tree, xot_desegment, 4, get_xot_pdu_len,
|
|
|
|
dissect_xot_pdu);
|
|
|
|
|
|
|
|
return tvb_length(tvb);
|
2000-12-17 07:38:14 +00:00
|
|
|
}
|
2002-04-09 08:15:04 +00:00
|
|
|
|
2006-05-21 04:49:01 +00:00
|
|
|
/* Register the protocol with Wireshark */
|
2002-08-28 21:04:11 +00:00
|
|
|
void
|
2001-09-13 08:05:26 +00:00
|
|
|
proto_register_xot(void)
|
|
|
|
{
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_xot_version,
|
|
|
|
{ "Version", "xot.version", FT_UINT16, BASE_DEC,
|
|
|
|
NULL, 0, "Version of X.25 over TCP protocol", HFILL }},
|
2000-12-17 07:38:14 +00:00
|
|
|
|
2001-09-13 08:05:26 +00:00
|
|
|
{ &hf_xot_length,
|
|
|
|
{ "Length", "xot.length", FT_UINT16, BASE_DEC,
|
|
|
|
NULL, 0, "Length of X.25 over TCP packet", HFILL }}
|
2000-12-17 07:38:14 +00:00
|
|
|
|
2001-09-13 08:05:26 +00:00
|
|
|
};
|
2000-12-17 07:38:14 +00:00
|
|
|
|
2001-09-13 08:05:26 +00:00
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_xot,
|
|
|
|
};
|
2002-04-09 08:15:04 +00:00
|
|
|
module_t *xot_module;
|
2000-12-17 07:38:14 +00:00
|
|
|
|
2001-09-13 08:05:26 +00:00
|
|
|
proto_xot = proto_register_protocol("X.25 over TCP", "XOT", "xot");
|
|
|
|
proto_register_field_array(proto_xot, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2006-11-30 18:29:45 +00:00
|
|
|
register_dissector("xot", dissect_xot, proto_xot);
|
2002-04-09 08:15:04 +00:00
|
|
|
|
|
|
|
xot_module = prefs_register_protocol(proto_xot, NULL);
|
|
|
|
prefs_register_bool_preference(xot_module, "desegment",
|
2004-08-21 09:02:52 +00:00
|
|
|
"Reassemble X.25-over-TCP messages spanning multiple TCP segments",
|
|
|
|
"Whether the X.25-over-TCP dissector should reassemble messages spanning multiple TCP segments. "
|
|
|
|
"To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
|
2002-04-09 08:15:04 +00:00
|
|
|
&xot_desegment);
|
|
|
|
}
|
2000-12-17 07:38:14 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_xot(void)
|
|
|
|
{
|
2001-12-03 04:00:26 +00:00
|
|
|
dissector_handle_t xot_handle;
|
|
|
|
|
2001-09-13 08:05:26 +00:00
|
|
|
/*
|
|
|
|
* Get a handle for the X.25 dissector.
|
|
|
|
*/
|
|
|
|
x25_handle = find_dissector("x.25");
|
If you register more than one field with the same name, the dfilter code
can now handle that; this allows us to register both the modulo-8 and
the modulo-128 versions of various X.25 bitfields with "x.25.XXX" names,
which lets us get rid of the "ex.25" protocol stuff completely and use
"x.25" for both modulo-8 and modulo-128 X.25. Do so. (Also, fix up
some cases where we appeared to be using the modulo-8 fields when
dissecting modulo-128 X.25.)
This, in turn, allows us to register the X.25 dissector, as there's now
only one protocol with which it's associated, and make it static and
have it called only through a handle, and to, when registering it with
the "llc.dsap" dissector table, associate it with "proto_x25".
That, in turn, allows us to get rid of the "CHECK_DISPLAY_AS_DATA()"
calls, and the code to set "pinfo->current_proto", in the X.25
dissector.
The code for the display filter expression dialog would, if there are
two fields with the same name registered under a protocol, list both of
them; have it list only one of them - the fields should have the same
type, the same radix, and the same value_string/true_false_string table
if any (if they don't, they're really not the same field...).
svn path=/trunk/; revision=3023
2001-02-12 09:06:19 +00:00
|
|
|
|
2003-01-21 01:45:17 +00:00
|
|
|
xot_handle = new_create_dissector_handle(dissect_xot, proto_xot);
|
2001-12-03 04:00:26 +00:00
|
|
|
dissector_add("tcp.port", TCP_PORT_XOT, xot_handle);
|
2000-12-17 07:38:14 +00:00
|
|
|
}
|