From 8a1649c5a5ff7c8bdf38cbf54ed5138c1773bfd7 Mon Sep 17 00:00:00 2001 From: David Fort Date: Sun, 29 Aug 2021 10:49:12 +0200 Subject: [PATCH] rdpudp: dissect the RDP UDP protocol This patch adds a dissector to analyze the RDP UDP protocol according to MS-RDPEUDP and MS-RDPEUDP2. --- epan/dissectors/CMakeLists.txt | 1 + epan/dissectors/packet-rdp.c | 18 +- epan/dissectors/packet-rdp.h | 1 - epan/dissectors/packet-rdp_drdynvc.c | 25 + epan/dissectors/packet-rdpudp.c | 768 +++++++++++++++++++++++++++ epan/dissectors/packet-rdpudp.h | 30 ++ 6 files changed, 825 insertions(+), 18 deletions(-) create mode 100644 epan/dissectors/packet-rdpudp.c create mode 100644 epan/dissectors/packet-rdpudp.h diff --git a/epan/dissectors/CMakeLists.txt b/epan/dissectors/CMakeLists.txt index 9f035abecb..9ce889e94f 100644 --- a/epan/dissectors/CMakeLists.txt +++ b/epan/dissectors/CMakeLists.txt @@ -1653,6 +1653,7 @@ set(DISSECTOR_SRC ${CMAKE_CURRENT_SOURCE_DIR}/packet-rdm.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-rdp.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-rdp_drdynvc.c + ${CMAKE_CURRENT_SOURCE_DIR}/packet-rdpudp.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-rdt.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-redback.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-redbackli.c diff --git a/epan/dissectors/packet-rdp.c b/epan/dissectors/packet-rdp.c index d88ee5c8b8..ac56394b81 100644 --- a/epan/dissectors/packet-rdp.c +++ b/epan/dissectors/packet-rdp.c @@ -957,22 +957,6 @@ rdp_get_conversation_data(packet_info *pinfo) return rdp_info; } -gboolean rdp_isServerAddressTarget(packet_info *pinfo) -{ - conversation_t *conv; - rdp_server_address_t *server; - rdp_conv_info_t *rdp_info; - - conv = find_conversation_pinfo(pinfo, 0); - if (!conv) - return FALSE; - - rdp_info = (rdp_conv_info_t *)conversation_get_proto_data(conv, proto_rdp); - server = &rdp_info->serverAddr; - - return addresses_equal(&server->addr, &pinfo->dst) && (pinfo->destport == server->port); -} - static int dissect_rdp_fields(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, const rdp_field_info_t *fields, int totlen) { @@ -1319,7 +1303,7 @@ dissect_rdp_channelPDU(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree switch (channelType) { case RDP_CHANNEL_DRDYNVC: subtvb = tvb_new_subset_length(tvb, offset, length); - offset = call_dissector(drdynvc_handle, subtvb, pinfo, tree); + offset += call_dissector(drdynvc_handle, subtvb, pinfo, tree); break; default: break; diff --git a/epan/dissectors/packet-rdp.h b/epan/dissectors/packet-rdp.h index 48e5f0af21..903cec768b 100644 --- a/epan/dissectors/packet-rdp.h +++ b/epan/dissectors/packet-rdp.h @@ -50,6 +50,5 @@ typedef struct _rdp_conv_info_t { rdp_channel_def_t staticChannels[RDP_MAX_CHANNELS+1]; } rdp_conv_info_t; -extern gboolean rdp_isServerAddressTarget(packet_info *infos); #endif /* __PACKET_RDP_H__ */ diff --git a/epan/dissectors/packet-rdp_drdynvc.c b/epan/dissectors/packet-rdp_drdynvc.c index fa92d2ce1e..93f86a8891 100644 --- a/epan/dissectors/packet-rdp_drdynvc.c +++ b/epan/dissectors/packet-rdp_drdynvc.c @@ -16,6 +16,7 @@ #include #include #include "packet-rdp.h" +#include "packet-rdpudp.h" void proto_register_rdp_drdynvc(void); void proto_reg_handoff_drdynvc(void); @@ -219,6 +220,30 @@ find_channel_name_by_id(packet_info *pinfo, drdynvc_conv_info_t *dyninfo, guint3 return NULL; } +static gboolean +rdp_isServerAddressTarget(packet_info *pinfo) +{ + conversation_t *conv; + rdp_conv_info_t *rdp_info; + rdpudp_conv_info_t *rdpudp_info; + + conv = find_conversation_pinfo(pinfo, 0); + if (!conv) + return FALSE; + + rdp_info = (rdp_conv_info_t *)conversation_get_proto_data(conv, proto_rdp); + if (rdp_info) { + rdp_server_address_t *server = &rdp_info->serverAddr; + return addresses_equal(&server->addr, &pinfo->dst) && (pinfo->destport == server->port); + } + + rdpudp_info = (rdpudp_conv_info_t *)conversation_get_proto_data(conv, proto_rdpudp); + if (!rdpudp_info) + return FALSE; + + return addresses_equal(&rdpudp_info->server_addr, &pinfo->dst) && (rdpudp_info->server_port == pinfo->destport); +} + static int dissect_rdp_drdynvc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void *data _U_) diff --git a/epan/dissectors/packet-rdpudp.c b/epan/dissectors/packet-rdpudp.c new file mode 100644 index 0000000000..5e0327f75e --- /dev/null +++ b/epan/dissectors/packet-rdpudp.c @@ -0,0 +1,768 @@ +/* packet-rdpudp.c + * Routines for UDP RDP packet dissection + * Copyright 2021, David Fort + * + * Wireshark - Network traffic analyzer + * By Gerald Combs + * Copyright 1998 Gerald Combs + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "config.h" + +#include +#include +#include +#include +#include + +#include "packet-rdpudp.h" + +#define PNAME "UDP Remote Desktop Protocol" +#define PSNAME "RDPUDP" +#define PFNAME "rdpudp" + +void proto_register_rdpudp(void); +void proto_reg_handoff_rdpudp(void); + +static dissector_handle_t rdpudp_handle; +int proto_rdpudp = -1; + +static int ett_rdpudp = -1; +static int ett_rdpudp_flags = -1; +static int ett_rdpudp_synex = -1; +static int ett_rdpudp_ack = -1; +static int ett_rdpudp_fec = -1; +static int ett_rdpudp_data = -1; +static int ett_rdpudp2_packetType = -1; +static int ett_rdpudp2_flags = -1; +static int ett_rdpudp2_ack = -1; +static int ett_rdpudp2_overhead = -1; +static int ett_rdpudp2_delayack = -1; +static int ett_rdpudp2_aoa = -1; +static int ett_rdpudp2_data = -1; +static int ett_rdpudp2_ackvec = -1; + + +static int pf_rdpudp_snSourceAck = -1; +static int pf_rdpudp_ReceiveWindowSize = -1; +static int pf_rdpudp_flags = -1; +static int pf_rdpudp_flag_syn = -1; +static int pf_rdpudp_flag_fin = -1; +static int pf_rdpudp_flag_ack = -1; +static int pf_rdpudp_flag_data = -1; +static int pf_rdpudp_flag_fec = -1; +static int pf_rdpudp_flag_cn = -1; +static int pf_rdpudp_flag_cwr = -1; +static int pf_rdpudp_flag_aoa = -1; +static int pf_rdpudp_flag_synlossy = -1; +static int pf_rdpudp_flag_ackdelayed = -1; +static int pf_rdpudp_flag_correlationId = -1; +static int pf_rdpudp_flag_synex = -1; +static int pf_rdpudp_snInitialSequenceNumber = -1; +static int pf_rdpudp_upstreamMtu = -1; +static int pf_rdpudp_downstreamMtu = -1; +static int pf_rdpudp_correlationId = -1; +static int pf_rdpudp_synex_flags = -1; +static int pf_rdpudp_synex_flag_version = -1; +static int pf_rdpudp_synex_version = -1; +static int pf_rdpudp_synex_cookiehash = -1; +static int pf_rdpudp_ack_vectorsize = -1; +static int pf_rdpudp_ack_item = -1; +static int pf_rdpudp_ack_item_state = -1; +static int pf_rdpudp_ack_item_rle = -1; +static int pf_rdpudp_fec_coded = -1; +static int pf_rdpudp_fec_sourcestart = -1; +static int pf_rdpudp_fec_range = -1; +static int pf_rdpudp_fec_fecindex = -1; +static int pf_rdpudp_resetseqenum = -1; +static int pf_rdpudp_source_sncoded = -1; +static int pf_rdpudp_source_snSourceStart = -1; +static int pf_rdpudp_data = -1; + +static int * const rdpudp_flags[] = { + &pf_rdpudp_flag_syn, + &pf_rdpudp_flag_fin, + &pf_rdpudp_flag_ack, + &pf_rdpudp_flag_data, + &pf_rdpudp_flag_fec, + &pf_rdpudp_flag_cn, + &pf_rdpudp_flag_cwr, + &pf_rdpudp_flag_aoa, + &pf_rdpudp_flag_synlossy, + &pf_rdpudp_flag_ackdelayed, + &pf_rdpudp_flag_correlationId, + &pf_rdpudp_flag_synex, + NULL +}; + +static int pf_rdpudp2_PacketPrefixByte = -1; +static int pf_rdpudp2_packetType = -1; +static int pf_rdpudp2_shortPacketLength = -1; +static int pf_rdpudp2_flags = -1; +static int pf_rdpudp2_flag_ack = -1; +static int pf_rdpudp2_flag_data = -1; +static int pf_rdpudp2_flag_ackvec = -1; +static int pf_rdpudp2_flag_aoa = -1; +static int pf_rdpudp2_flag_overhead = -1; +static int pf_rdpudp2_flag_delayackinfo = -1; +static int pf_rdpudp2_logWindow = -1; +static int pf_rdpudp2_AckSeq = -1; +static int pf_rdpudp2_AckTs = -1; +static int pf_rdpudp2_AckSendTimeGap = -1; +static int pf_rdpudp2_ndelayedAcks = -1; +static int pf_rdpudp2_delayedTimeScale = -1; +static int pf_rdpudp2_delayedAcks = -1; +static int pf_rdpudp2_delayedAck = -1; +static int pf_rdpudp2_OverHeadSize = -1; +static int pf_rdpudp2_DelayAckMax = -1; +static int pf_rdpudp2_DelayAckTimeout = -1; +static int pf_rdpudp2_AckOfAcksSeqNum = -1; +static int pf_rdpudp2_DataSeqNumber = -1; +static int pf_rdpudp2_DataChannelSeqNumber = -1; +static int pf_rdpudp2_Data = -1; +static int pf_rdpudp2_AckvecBaseSeq = -1; +static int pf_rdpudp2_AckvecCodecAckVecSize = -1; +static int pf_rdpudp2_AckvecHaveTs = -1; +static int pf_rdpudp2_AckvecTimeStamp = -1; +static int pf_rdpudp2_AckvecCodedAck = -1; +static int pf_rdpudp2_AckvecCodedAckMode = -1; +static int pf_rdpudp2_AckvecCodedAckRleState = -1; +static int pf_rdpudp2_AckvecCodedAckRleLen = -1; + +static int * const rdpudp2_flags[] = { + &pf_rdpudp2_flag_ack, + &pf_rdpudp2_flag_data, + &pf_rdpudp2_flag_ackvec, + &pf_rdpudp2_flag_aoa, + &pf_rdpudp2_flag_overhead, + &pf_rdpudp2_flag_delayackinfo, + &pf_rdpudp2_logWindow, + NULL +}; + +static dissector_handle_t tls_handle; +static dissector_handle_t dtls_handle; + +enum { + RDPUDP_SYN = 0x0001, + RDPUDP_FIN = 0x0002, + RDPUDP_ACK = 0x0004, + RDPUDP_DATA = 0x0008, + RDPUDP_FEC = 0x0010, + RDPUDP_CN = 0x0020, + RDPUDP_CWR = 0x0040, + RDPUDP_AOA = 0x0100, + RDPUDP_SYNLOSSY = 0x0200, + RDPUDP_ACKDELAYED = 0x0400, + RDPUDP_CORRELATIONID = 0x0800, + RDPUDP_SYNEX = 0x1000 +}; + +#define RDPUDP_VERSION_INFO_VALID 0x0001 + +enum { + RDPUDP2_ACK = 0x0001, + RDPUDP2_DATA = 0x0004, + RDPUDP2_ACKVEC = 0x0008, + RDPUDP2_AOA = 0x0010, + RDPUDP2_OVERHEAD = 0x0040, + RDPUDP2_DELAYACK = 0x00100 +}; + +static const value_string rdpudp_version_vals[] = { + { 0x0001, "UDPv1-1" }, + { 0x0002, "UDPv1-2" }, + { 0x0101, "UDPv2" }, + { 0x0, NULL} +}; + +static const value_string rdpudp_ack_states_vals[] = { + { 0, "Received" }, + { 1, "Reserved 1" }, + { 2, "Reserved 2" }, + { 3, "Pending" }, + { 0x0, NULL } +}; + +static const value_string rdpudp2_packetType_vals[] = { + { 0, "Data" }, + { 8, "Dummy"}, + { 0x0, NULL } +}; + +static const value_string rdpudp2_ackvec_mode_vals[] = { + { 0x0, "Bitmap"}, + { 0x1, "Run length"}, + { 0x0, NULL } +}; + +static const value_string rdpudp2_ackvec_rlestates_vals[] = { + { 0x0, "lost" }, + { 0x1, "received" }, + { 0x0, NULL } +}; + + +static int +dissect_rdpudp_v1(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rdpudp_conv_info_t *conv) +{ + gint offset = 0; + guint16 flags; + + col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDPUDP"); + col_clear(pinfo->cinfo, COL_INFO); + + proto_tree_add_item(tree, pf_rdpudp_snSourceAck, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + + proto_tree_add_item(tree, pf_rdpudp_ReceiveWindowSize, tvb, offset, 2, ENC_BIG_ENDIAN); + offset += 2; + + proto_tree_add_bitmask(tree, tvb, offset, pf_rdpudp_flags, ett_rdpudp_flags, rdpudp_flags, ENC_BIG_ENDIAN); + flags = tvb_get_guint16(tvb, offset, ENC_BIG_ENDIAN); + offset += 2; + + if (flags & RDPUDP_SYN) { + conv->is_lossy = (flags & RDPUDP_SYNLOSSY); + if (!(flags & RDPUDP_ACK)) { + /* set the server address only on the first SYN packet */ + copy_address(&conv->server_addr, &pinfo->dst); + conv->server_port = pinfo->destport; + } + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "SYN"); + } + + if (flags & RDPUDP_SYN) { + proto_tree_add_item(tree, pf_rdpudp_snInitialSequenceNumber, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + proto_tree_add_item(tree, pf_rdpudp_upstreamMtu, tvb, offset, 2, ENC_BIG_ENDIAN); + offset += 2; + proto_tree_add_item(tree, pf_rdpudp_downstreamMtu, tvb, offset, 2, ENC_BIG_ENDIAN); + offset += 2; + } + + if (flags & RDPUDP_CORRELATIONID) { + proto_tree_add_item(tree, pf_rdpudp_correlationId, tvb, offset, 16, ENC_NA); + offset += 32; + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "CORRELATIONID"); + } + + if (flags & RDPUDP_SYNEX) { + guint16 synex_flags; + proto_tree *synex_tree; + guint synex_sz = 2; + guint16 version_val; + + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "SYNEX"); + + synex_flags = tvb_get_guint16(tvb, offset, ENC_BIG_ENDIAN); + if (synex_flags & RDPUDP_VERSION_INFO_VALID) { + synex_sz += 2; /* version */ + + version_val = tvb_get_guint16(tvb, offset+2, ENC_BIG_ENDIAN); + + if (version_val == 0x101) + synex_sz += 32; /* cookie hash */ + } + + synex_tree = proto_tree_add_subtree(tree, tvb, offset, synex_sz, ett_rdpudp_synex, NULL, "SynEx"); + proto_tree_add_item(synex_tree, pf_rdpudp_synex_flags, tvb, offset, 2, ENC_BIG_ENDIAN); + proto_tree_add_item(synex_tree, pf_rdpudp_synex_flag_version, tvb, offset, 2, ENC_BIG_ENDIAN); + + offset += 2; + + if (synex_flags & RDPUDP_VERSION_INFO_VALID) { + proto_tree_add_item(synex_tree, pf_rdpudp_synex_version, tvb, offset, 2, ENC_BIG_ENDIAN); + + offset += 2; + if (version_val == 0x101) { + proto_tree_add_item(synex_tree, pf_rdpudp_synex_cookiehash, tvb, offset, 32, ENC_NA); + offset += 32; + + if (flags & RDPUDP_ACK) + conv->start_v2_at = pinfo->num + 1; + } + } + } + + if ((flags & RDPUDP_ACK) && !(flags & RDPUDP_SYN)) { + proto_tree *ack_tree; + guint16 uAckVectorSize = tvb_get_guint16(tvb, offset, ENC_BIG_ENDIAN); + + ack_tree = proto_tree_add_subtree(tree, tvb, offset, 2 + uAckVectorSize, ett_rdpudp_ack, NULL, "Ack"); + offset += 2; + for ( ; uAckVectorSize; uAckVectorSize--, offset++) { + proto_tree_add_item(ack_tree, pf_rdpudp_ack_item, tvb, offset, 1, ENC_BIG_ENDIAN); + proto_tree_add_item(ack_tree, pf_rdpudp_ack_item_rle, tvb, offset, 1, ENC_BIG_ENDIAN); + } + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "ACK"); + } + + if (flags & RDPUDP_FEC) { + proto_tree *fec_tree = proto_tree_add_subtree(tree, tvb, offset, 4 * 3, ett_rdpudp_fec, NULL, "FEC"); + + proto_tree_add_item(fec_tree, pf_rdpudp_fec_coded, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + proto_tree_add_item(fec_tree, pf_rdpudp_fec_sourcestart, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + proto_tree_add_item(fec_tree, pf_rdpudp_fec_range, tvb, offset, 1, ENC_BIG_ENDIAN); + offset += 1; + proto_tree_add_item(fec_tree, pf_rdpudp_fec_fecindex, tvb, offset, 1, ENC_BIG_ENDIAN); + offset += 1; + + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "FEC"); + } + + if (flags & RDPUDP_AOA) { + proto_tree_add_item(tree, pf_rdpudp_resetseqenum, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "AOA"); + } + + if (flags & RDPUDP_DATA) + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "DATA"); + + if (flags & RDPUDP_DATA) { + proto_tree *data_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_rdpudp_data, NULL, "Data"); + dissector_handle_t target_dissector; + + proto_tree_add_item(data_tree, pf_rdpudp_source_sncoded, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + + proto_tree_add_item(data_tree, pf_rdpudp_source_snSourceStart, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + + target_dissector = conv->is_lossy ? dtls_handle : tls_handle; + + call_dissector(target_dissector, tvb_new_subset_remaining(tvb, offset), pinfo, data_tree); + + offset = tvb_reported_length(tvb); + } + + return offset; +} + +static tvbuff_t * +unwrap_udp_v2(tvbuff_t *tvb, packet_info *pinfo) +{ + gint len = tvb_captured_length_remaining(tvb, 0); + guchar *buffer = (guchar*)wmem_alloc(pinfo->pool, len); + + /* copy and do the swap of byte 0 and 7*/ + tvb_memcpy(tvb, buffer, 0, len); + buffer[0] = tvb_get_guint8(tvb, 7); + buffer[7] = tvb_get_guint8(tvb, 0); + + return tvb_new_child_real_data(tvb, buffer, len, len); +} + +static int +dissect_rdpudp_v2(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) +{ + proto_item *item; + proto_tree *subtree, *data_tree = NULL; + guint16 flags; + guint8 packet_type; + tvbuff_t *subtvb; + gint offset = 0; + tvbuff_t *tvb2 = unwrap_udp_v2(tvb, pinfo); + + col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDPUDP2"); + col_clear(pinfo->cinfo, COL_INFO); + + add_new_data_source(pinfo, tvb2, "Unwrapped RDPUDP2 packet"); + + packet_type = (tvb_get_guint8(tvb2, 0) >> 1) & 0xf; + item = proto_tree_add_item(tree, pf_rdpudp2_PacketPrefixByte, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + subtree = proto_item_add_subtree(item, ett_rdpudp2_packetType); + proto_tree_add_item(subtree, pf_rdpudp2_packetType, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + proto_tree_add_item(subtree, pf_rdpudp2_shortPacketLength, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + offset++; + + proto_tree_add_bitmask(tree, tvb2, offset, pf_rdpudp2_flags, ett_rdpudp2_flags, rdpudp2_flags, ENC_LITTLE_ENDIAN); + + flags = tvb_get_guint16(tvb2, offset, ENC_LITTLE_ENDIAN); + offset += 2; + + if (flags & RDPUDP2_ACK) { + guint8 nacks = tvb_get_guint8(tvb, offset + 6) & 0xf; + subtree = proto_tree_add_subtree(tree, tvb2, offset, 7 + nacks, ett_rdpudp2_ack, NULL, "Ack"); + proto_tree_add_item(subtree, pf_rdpudp2_AckSeq, tvb2, offset, 2, ENC_LITTLE_ENDIAN); offset += 2; + proto_tree_add_item(subtree, pf_rdpudp2_AckTs, tvb2, offset, 3, ENC_LITTLE_ENDIAN); offset += 3; + proto_tree_add_item(subtree, pf_rdpudp2_AckSendTimeGap, tvb2, offset, 1, ENC_LITTLE_ENDIAN); offset++; + + proto_tree_add_item(subtree, pf_rdpudp2_ndelayedAcks, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + proto_tree_add_item(subtree, pf_rdpudp2_delayedTimeScale, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + offset++; + + offset += nacks; + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "ACK"); + } + + if (flags & RDPUDP2_OVERHEAD) { + subtree = proto_tree_add_subtree(tree, tvb2, offset, 1, ett_rdpudp2_overhead, NULL, "Overhead"); + proto_tree_add_item(subtree, pf_rdpudp2_OverHeadSize, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + offset++; + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "OVERHEAD"); + } + + + if (flags & RDPUDP2_DELAYACK) { + subtree = proto_tree_add_subtree(tree, tvb2, offset, 3, ett_rdpudp2_delayack, NULL, "DelayAck"); + proto_tree_add_item(subtree, pf_rdpudp2_DelayAckMax, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + offset++; + proto_tree_add_item(subtree, pf_rdpudp2_DelayAckTimeout, tvb2, offset, 2, ENC_LITTLE_ENDIAN); + offset += 2; + + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "DELAYACK"); + } + + if (flags & RDPUDP2_AOA) { + subtree = proto_tree_add_subtree(tree, tvb2, offset, 1, ett_rdpudp2_aoa, NULL, "Ack of Acks"); + proto_tree_add_item(subtree, pf_rdpudp2_AckOfAcksSeqNum, tvb2, offset, 2, ENC_LITTLE_ENDIAN); + offset += 2; + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "AOA"); + } + + if (flags & RDPUDP2_DATA) { + gboolean isDummy = !!(packet_type == 0x8); + data_tree = proto_tree_add_subtree(tree, tvb2, offset, 1, ett_rdpudp2_data, NULL, isDummy ? "Dummy data" : "Data"); + proto_tree_add_item(data_tree, pf_rdpudp2_DataSeqNumber, tvb2, offset, 2, ENC_LITTLE_ENDIAN); + offset += 2; + + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", isDummy ? "DUMMY" : "DATA"); + } + + if (flags & RDPUDP2_ACKVEC) { + gint ackvecSz = 3; + guint8 codedAckVecSizeA = tvb_get_guint8(tvb2, offset + 2); + guint8 codedAckVecSize = codedAckVecSizeA & 0x7f; + gboolean haveTs = !!(codedAckVecSizeA & 0x80); + + ackvecSz += codedAckVecSize; + if (haveTs) + ackvecSz += 3; + + subtree = proto_tree_add_subtree(tree, tvb2, offset, ackvecSz, ett_rdpudp2_ackvec, NULL, "AckVec"); + proto_tree_add_item(subtree, pf_rdpudp2_AckvecBaseSeq, tvb2, offset, 2, ENC_LITTLE_ENDIAN); + offset += 2; + + proto_tree_add_item(subtree, pf_rdpudp2_AckvecCodecAckVecSize, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + proto_tree_add_item(subtree, pf_rdpudp2_AckvecHaveTs, tvb2, offset, 1, ENC_LITTLE_ENDIAN); + offset++; + + if (haveTs) { + gint tsSize = 4; + proto_tree_add_item(subtree, pf_rdpudp2_AckvecTimeStamp, tvb2, offset, tsSize, ENC_LITTLE_ENDIAN); + + offset += tsSize; + } + + offset += codedAckVecSize; + col_append_sep_str(pinfo->cinfo, COL_INFO, ",", "ACKVEC"); + } + + if ((flags & RDPUDP2_DATA) && (packet_type != 0x8)) { + proto_tree_add_item(data_tree, pf_rdpudp2_DataChannelSeqNumber, tvb2, offset, 2, ENC_LITTLE_ENDIAN); + offset += 2; + + subtvb = tvb_new_subset_length(tvb2, offset, tvb_captured_length_remaining(tvb2, offset)); + add_new_data_source(pinfo, subtvb, "SSL fragment"); + call_dissector(tls_handle, subtvb, pinfo, data_tree); + + offset = tvb_captured_length(tvb2); + } + + return offset; +} + +static int +dissect_rdpudp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void *data _U_) +{ + proto_item *item; + proto_tree *tree; + conversation_t *conversation; + rdpudp_conv_info_t *rdpudp_info; + + conversation = find_or_create_conversation(pinfo); + + rdpudp_info = (rdpudp_conv_info_t *)conversation_get_proto_data(conversation, proto_rdpudp); + if (rdpudp_info == NULL) { + rdpudp_info = wmem_new0(wmem_file_scope(), rdpudp_conv_info_t); + rdpudp_info->start_v2_at = G_MAXUINT32; + rdpudp_info->is_lossy = FALSE; + + conversation_add_proto_data(conversation, proto_rdpudp, rdpudp_info); + } + + item = proto_tree_add_item(parent_tree, proto_rdpudp, tvb, 0, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_rdpudp); + + if (rdpudp_info->start_v2_at > pinfo->num) + return dissect_rdpudp_v1(tvb, pinfo, tree, rdpudp_info); + else + return dissect_rdpudp_v2(tvb, pinfo, tree); +} + +/*--- proto_register_rdpudp -------------------------------------------*/ +void +proto_register_rdpudp(void) { + /* List of fields */ + static hf_register_info hf[] = { + { &pf_rdpudp_snSourceAck, + {"snSourceAck", "rdpudp.snsourceack", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL}, + }, + { &pf_rdpudp_ReceiveWindowSize, + {"ReceiveWindowSize", "rdpudp.receivewindowsize", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_flags, + {"Flags", "rdpudp.flags", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_flag_syn, + {"Syn", "rdpudp.flags.syn", FT_BOOLEAN, 16, NULL, RDPUDP_SYN, NULL, HFILL} + }, + { &pf_rdpudp_flag_fin, + {"Fin", "rdpudp.flags.fin", FT_BOOLEAN, 16, NULL, RDPUDP_FIN, NULL, HFILL} + }, + { &pf_rdpudp_flag_ack, + {"Ack", "rdpudp.flags.ack", FT_BOOLEAN, 16, NULL, RDPUDP_ACK, NULL, HFILL} + }, + { &pf_rdpudp_flag_data, + {"Data", "rdpudp.flags.data", FT_BOOLEAN, 16, NULL, RDPUDP_DATA, NULL, HFILL} + }, + { &pf_rdpudp_flag_fec, + {"FECData", "rdpudp.flags.fec", FT_BOOLEAN, 16, NULL, RDPUDP_FEC, NULL, HFILL} + }, + { &pf_rdpudp_flag_cn, + {"CN", "rdpudp.flags.cn", FT_BOOLEAN, 16, NULL, RDPUDP_CN, NULL, HFILL} + }, + { &pf_rdpudp_flag_cwr, + {"CWR", "rdpudp.flags.cwr", FT_BOOLEAN, 16, NULL, RDPUDP_CWR, NULL, HFILL} + }, + { &pf_rdpudp_flag_aoa, + {"Ack of Acks", "rdpudp.flags.aoa", FT_BOOLEAN, 16, NULL, RDPUDP_AOA, NULL, HFILL} + }, + { &pf_rdpudp_flag_synlossy, + {"Syn lossy", "rdpudp.flags.synlossy", FT_BOOLEAN, 16, NULL, RDPUDP_SYNLOSSY, NULL, HFILL} + }, + { &pf_rdpudp_flag_ackdelayed, + {"Ack delayed", "rdpudp.flags.ackdelayed", FT_BOOLEAN, 16, NULL, RDPUDP_ACKDELAYED, NULL, HFILL} + }, + { &pf_rdpudp_flag_correlationId, + {"Correlation id", "rdpudp.flags.correlationid", FT_BOOLEAN, 16, NULL, RDPUDP_CORRELATIONID, NULL, HFILL} + }, + { &pf_rdpudp_flag_synex, + {"SynEx","rdpudp.flags.synex",FT_BOOLEAN,16,NULL,RDPUDP_SYNEX,NULL,HFILL} + }, + { &pf_rdpudp_snInitialSequenceNumber, + {"Initial SequenceNumber","rdpudp.initialsequencenumber", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_upstreamMtu, + {"Upstream MTU", "rdpudp.upstreammtu", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_downstreamMtu, + {"DownStream MTU", "rdpudp.downstreammtu", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_correlationId, + {"Correlation Id", "rdpudp.correlationid", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_synex_flags, + {"Flags", "rdpudp.synex.flags", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_synex_flag_version, + {"Version info", "rdpudp.synex.flags.versioninfo", FT_BOOLEAN, 8, NULL, 0x0001, NULL, HFILL} + }, + { &pf_rdpudp_synex_version, + {"Version", "rdpudp.synex.version", FT_UINT16, BASE_HEX, VALS(rdpudp_version_vals), 0, NULL, HFILL} + }, + {&pf_rdpudp_synex_cookiehash, + {"Cookie Hash", "rdpudp.synex.cookiehash", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_ack_vectorsize, + {"uAckVectorSize", "rdpudp.ack.vectorsize", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_ack_item, + {"Ack item", "rdpudp.ack.item", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_ack_item_state, + {"VECTOR_ELEMENT_STATE", "rdpudp.ack.item.state", FT_UINT8, BASE_HEX, VALS(rdpudp_ack_states_vals), 0xc0, NULL, HFILL} + }, + { &pf_rdpudp_ack_item_rle, + {"Run length", "rdpudp.ack.item.rle", FT_UINT8, BASE_DEC, NULL, 0x3f, NULL, HFILL} + }, + { &pf_rdpudp_fec_coded, + {"snCoded", "rdpudp.fec.coded", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_fec_sourcestart, + {"snSourceStart", "rdpudp.fec.sourcestart", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_fec_range, + {"Range", "rdpudp.fec.range", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_fec_fecindex, + {"Fec index", "rdpudp.fec.fecindex", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_resetseqenum, + {"snResetSeqNum", "rdpudp.resetSeqNum", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_source_sncoded, + {"snCoded", "rdpudp.data.sncoded", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_source_snSourceStart, + {"snSourceStart", "rdpudp.data.sourceStart", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp_data, + {"Data", "rdpudp.data", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL} + }, + + + { &pf_rdpudp2_PacketPrefixByte, + {"PacketPrefixByte", "rdpudp2.prefixbyte", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_packetType, + {"PacketType", "rdpudp2.packetType", FT_UINT8, BASE_HEX, VALS(rdpudp2_packetType_vals), 0x1e, NULL, HFILL} + }, + { &pf_rdpudp2_shortPacketLength, + {"Short packet length", "rdpudp2.shortpacketlen", FT_UINT8, BASE_DEC, NULL, 0x7, NULL, HFILL} + }, + { &pf_rdpudp2_flags, + {"Flags", "rdpudp2.flags", FT_UINT16, BASE_HEX, NULL, 0xfff, NULL, HFILL} + }, + { &pf_rdpudp2_flag_ack, + {"Ack", "rdpudp2.flags.ack", FT_UINT16, BASE_HEX, NULL, RDPUDP2_ACK, NULL, HFILL} + }, + { &pf_rdpudp2_flag_data, + {"Data", "rdpudp2.flags.data", FT_UINT16, BASE_HEX, NULL, RDPUDP2_DATA, NULL, HFILL} + }, + { &pf_rdpudp2_flag_ackvec, + {"AckVec", "rdpudp2.flags.ackvec", FT_UINT16, BASE_HEX, NULL, RDPUDP2_ACKVEC, NULL, HFILL} + }, + { &pf_rdpudp2_flag_aoa, + {"AckOfAcks", "rdpudp2.flags.ackofacks", FT_UINT16, BASE_HEX, NULL, RDPUDP2_AOA, NULL, HFILL} + }, + { &pf_rdpudp2_flag_overhead, + {"OverheadSize", "rdpudp2.flags.overheadsize", FT_UINT16, BASE_HEX, NULL, RDPUDP2_OVERHEAD, NULL, HFILL} + }, + { &pf_rdpudp2_flag_delayackinfo, + {"DelayedAckInfo", "rdpudp2.flags.delayackinfo", FT_UINT16, BASE_HEX, NULL, RDPUDP2_DELAYACK, NULL, HFILL} + }, + { &pf_rdpudp2_logWindow, + {"LogWindow", "rdpudp2.logWindow", FT_UINT16, BASE_DEC, NULL, 0xf000, NULL, HFILL} + }, + { &pf_rdpudp2_AckSeq, + {"Base Seq", "rdpudp2.ack.seqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckTs, + {"receivedTS", "rdpudp2.ack.ts", FT_UINT24, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckSendTimeGap, + {"sendTimeGap", "rdpudp2.ack.sendTimeGap", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_ndelayedAcks, + {"NumDelayedAcks", "rdpudp2.ack.numDelayedAcks", FT_UINT8, BASE_DEC, NULL, 0x0F, NULL, HFILL} + }, + { &pf_rdpudp2_delayedTimeScale, + {"delayedTimeScale", "rdpudp2.ack.delayedTimeScale", FT_UINT8, BASE_DEC, NULL, 0xF0, NULL, HFILL} + }, + { &pf_rdpudp2_delayedAcks, + {"Delayed acks", "rdpudp2.ack.delayedAcks", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_delayedAck, + {"Delayed ack", "rdpudp2.ack.delayedAck", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_OverHeadSize, + {"Overhead size", "rdpudp2.overheadsize", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_DelayAckMax, + {"MaxDelayedAcks", "rdpudp2.delayackinfo.max", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_DelayAckTimeout, + {"DelayedAckTimeoutInMs", "rdpudp2.delayackinfo.timeout", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckOfAcksSeqNum, + {"Sequence number", "rdpudp2.ackofacksseqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_DataSeqNumber, + {"Sequence number", "rdpudp2.data.seqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_DataChannelSeqNumber, + {"Channel sequence number", "rdpudp2.data.channelseqnumber", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_Data, + {"Data", "rdpudp2.data", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecBaseSeq, + {"Base sequence number", "rdpudp2.ackvec.baseseqnum", FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecCodecAckVecSize, + {"Coded ackvec size","rdpudp2.ackvec.codedackvecsize", FT_UINT16, BASE_DEC, NULL, 0x7f, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecHaveTs, + {"Have timestamp", "rdpudp2.ackvec.havets", FT_BOOLEAN, 8, NULL, 0x80, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecTimeStamp, + {"Timestamp", "rdpudp2.ackvec.timestamp", FT_UINT24, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecCodedAck, + {"Coded Ack", "rdpudp2.ackvec.codedAck", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecCodedAckMode, + {"Mode", "rdpudp2.ackvec.codecAckMode", FT_UINT8, BASE_DEC, VALS(rdpudp2_ackvec_mode_vals), 0x80, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecCodedAckRleState, + {"State", "rdpudp2.ackvec.codecAckRleState", FT_UINT8, BASE_DEC, VALS(rdpudp2_ackvec_rlestates_vals), 0x40, NULL, HFILL} + }, + { &pf_rdpudp2_AckvecCodedAckRleLen, + {"Length", "rdpudp2.ackvec.codecAckRleLen", FT_UINT8, BASE_DEC, NULL, 0x3f, NULL, HFILL} + } + }; + + /* List of subtrees */ + static gint *ett[] = { + &ett_rdpudp, + &ett_rdpudp_flags, + &ett_rdpudp_synex, + &ett_rdpudp_ack, + &ett_rdpudp_fec, + &ett_rdpudp_data, + &ett_rdpudp2_packetType, + &ett_rdpudp2_flags, + &ett_rdpudp2_ack, + &ett_rdpudp2_overhead, + &ett_rdpudp2_delayack, + &ett_rdpudp2_aoa, + &ett_rdpudp2_data, + &ett_rdpudp2_ackvec, + }; + + /* Register protocol */ + proto_rdpudp = proto_register_protocol(PNAME, PSNAME, PFNAME); + /* Register fields and subtrees */ + proto_register_field_array(proto_rdpudp, hf, array_length(hf)); + proto_register_subtree_array(ett, array_length(ett)); + + rdpudp_handle = register_dissector("rdpudp", dissect_rdpudp, proto_rdpudp); +} + +void +proto_reg_handoff_rdpudp(void) +{ + tls_handle = find_dissector("tls"); + dtls_handle = find_dissector("dtls"); + dissector_add_uint("udp.port", 3389, rdpudp_handle); +} + +/* + * Editor modelines - https://www.wireshark.org/tools/modelines.html + * + * Local Variables: + * c-basic-offset: 2 + * tab-width: 8 + * indent-tabs-mode: nil + * End: + * + * ex: set shiftwidth=2 tabstop=8 expandtab: + * :indentSize=2:tabSize=8:noTabs=true: + */ diff --git a/epan/dissectors/packet-rdpudp.h b/epan/dissectors/packet-rdpudp.h new file mode 100644 index 0000000000..fff634eece --- /dev/null +++ b/epan/dissectors/packet-rdpudp.h @@ -0,0 +1,30 @@ +/* packet-rdpudp.h + * RDP UDP dissection + * Author: David Fort + * + * Wireshark - Network traffic analyzer + * By Gerald Combs + * Copyright 1998 Gerald Combs + * + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef __PACKET_RDPUDP_H__ +#define __PACKET_RDPUDP_H__ + +#include +#include + +extern int proto_rdpudp; + +typedef struct _rdpudp_conv_info_t { + guint32 start_v2_at; + gboolean is_lossy; + + address server_addr; + guint16 server_port; +} rdpudp_conv_info_t; + + +#endif /* __PACKET_RDPUDP_H_ */