324 lines
9.8 KiB
C
324 lines
9.8 KiB
C
/* packet-miop.c
|
|
* Routines for CORBA MIOP packet disassembly
|
|
* Significantly based on packet-giop.c
|
|
* Copyright 2009 Alvaro Vega Garcia <avega at tid dot es>
|
|
*
|
|
* According with Unreliable Multicast Draft Adopted Specification
|
|
* 2001 October (OMG)
|
|
* Chapter 29: Unreliable Multicast Inter-ORB Protocol (MIOP)
|
|
* http://www.omg.org/technology/documents/specialized_corba.htm
|
|
*
|
|
* Wireshark - Network traffic analyzer
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
* Copyright 1998 Gerald Combs
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
|
|
|
|
#include "config.h"
|
|
|
|
#include <epan/packet.h>
|
|
|
|
#include <epan/expert.h>
|
|
|
|
#include "packet-giop.h"
|
|
|
|
void proto_register_miop(void);
|
|
void proto_reg_handoff_miop(void);
|
|
|
|
/*
|
|
* Useful visible data/structs
|
|
*/
|
|
|
|
#define MIOP_MAX_UNIQUE_ID_LENGTH 252
|
|
|
|
#define MIOP_HEADER_SIZE 16
|
|
|
|
/*
|
|
* Set to 1 for DEBUG output - TODO make this a runtime option
|
|
*/
|
|
|
|
#define DEBUG 0
|
|
|
|
/*
|
|
* ------------------------------------------------------------------------------------------+
|
|
* Data/Variables/Structs
|
|
* ------------------------------------------------------------------------------------------+
|
|
*/
|
|
|
|
|
|
static int proto_miop = -1;
|
|
|
|
/*
|
|
* (sub)Tree declares
|
|
*/
|
|
|
|
|
|
static gint hf_miop_magic = -1;
|
|
static gint hf_miop_hdr_version = -1;
|
|
static gint hf_miop_flags = -1;
|
|
static gint hf_miop_packet_length = -1;
|
|
static gint hf_miop_packet_number = -1;
|
|
static gint hf_miop_number_of_packets = -1;
|
|
static gint hf_miop_unique_id_len = -1;
|
|
static gint hf_miop_unique_id = -1;
|
|
|
|
static gint ett_miop = -1;
|
|
|
|
static expert_field ei_miop_version_not_supported = EI_INIT;
|
|
static expert_field ei_miop_unique_id_len_exceed_max_value = EI_INIT;
|
|
|
|
static dissector_handle_t miop_handle;
|
|
|
|
#define MIOP_MAGIC 0x4d494f50 /* "MIOP" */
|
|
|
|
static gboolean
|
|
dissect_miop_heur_check (tvbuff_t * tvb, packet_info * pinfo _U_, proto_tree * tree _U_, void * data _U_) {
|
|
|
|
guint tot_len;
|
|
guint32 magic;
|
|
|
|
/* check magic number and version */
|
|
|
|
|
|
tot_len = tvb_captured_length(tvb);
|
|
|
|
if (tot_len < MIOP_HEADER_SIZE) /* tot_len < 16 */
|
|
{
|
|
/* Not enough data captured to hold the GIOP header; don't try
|
|
to interpret it as GIOP. */
|
|
return FALSE;
|
|
}
|
|
|
|
magic = tvb_get_ntohl(tvb,0);
|
|
if(magic != MIOP_MAGIC){
|
|
/* Not a MIOP packet. */
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/* Main entry point */
|
|
static int dissect_miop (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void* data _U_) {
|
|
guint offset = 0;
|
|
|
|
proto_tree *miop_tree = NULL;
|
|
proto_item *ti;
|
|
|
|
guint8 hdr_version;
|
|
guint version_major;
|
|
guint version_minor;
|
|
|
|
guint8 flags;
|
|
|
|
guint16 packet_length;
|
|
guint packet_number;
|
|
guint number_of_packets;
|
|
guint byte_order;
|
|
|
|
guint32 unique_id_len;
|
|
|
|
wmem_strbuf_t *flags_strbuf = wmem_strbuf_create(pinfo->pool);
|
|
wmem_strbuf_append(flags_strbuf, "none");
|
|
|
|
if (!dissect_miop_heur_check(tvb, pinfo, tree, data))
|
|
return 0;
|
|
|
|
col_set_str (pinfo->cinfo, COL_PROTOCOL, "MIOP");
|
|
/* Clear out stuff in the info column */
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
|
|
|
/* Extract major and minor version numbers */
|
|
hdr_version = tvb_get_guint8(tvb, 4);
|
|
version_major = ((hdr_version & 0xf0) >> 4);
|
|
version_minor = (hdr_version & 0x0f);
|
|
|
|
if (hdr_version != 16)
|
|
{
|
|
col_add_fstr (pinfo->cinfo, COL_INFO, "Version %u.%u",
|
|
version_major, version_minor);
|
|
|
|
ti = proto_tree_add_item (tree, proto_miop, tvb, 0, -1, ENC_NA);
|
|
miop_tree = proto_item_add_subtree (ti, ett_miop);
|
|
proto_tree_add_expert_format(miop_tree, pinfo, &ei_miop_version_not_supported,
|
|
tvb, 0, -1,
|
|
"MIOP version %u.%u not supported",
|
|
version_major, version_minor);
|
|
return 5;
|
|
}
|
|
|
|
flags = tvb_get_guint8(tvb, 5);
|
|
byte_order = (flags & 0x01) ? ENC_LITTLE_ENDIAN : ENC_BIG_ENDIAN;
|
|
|
|
if (byte_order == ENC_BIG_ENDIAN) {
|
|
packet_length = tvb_get_ntohs(tvb, 6);
|
|
packet_number = tvb_get_ntohl(tvb, 8);
|
|
number_of_packets = tvb_get_ntohl(tvb, 12);
|
|
unique_id_len = tvb_get_ntohl(tvb, 16);
|
|
}
|
|
else {
|
|
packet_length = tvb_get_letohs(tvb, 6);
|
|
packet_number = tvb_get_letohl(tvb, 8);
|
|
number_of_packets = tvb_get_letohl(tvb, 12);
|
|
unique_id_len = tvb_get_letohl(tvb, 16);
|
|
}
|
|
|
|
col_add_fstr (pinfo->cinfo, COL_INFO, "MIOP %u.%u Packet s=%d (%u of %u)",
|
|
version_major, version_minor, packet_length,
|
|
packet_number + 1,
|
|
number_of_packets);
|
|
|
|
if (tree)
|
|
{
|
|
|
|
ti = proto_tree_add_item (tree, proto_miop, tvb, 0, -1, ENC_NA);
|
|
miop_tree = proto_item_add_subtree (ti, ett_miop);
|
|
|
|
/* XXX - Should we bail out if we don't have the right magic number? */
|
|
proto_tree_add_item(miop_tree, hf_miop_magic, tvb, offset, 4, ENC_ASCII);
|
|
offset += 4;
|
|
proto_tree_add_uint_format_value(miop_tree, hf_miop_hdr_version, tvb, offset, 1, hdr_version,
|
|
"%u.%u", version_major, version_minor);
|
|
offset++;
|
|
if (flags & 0x01) {
|
|
wmem_strbuf_truncate(flags_strbuf, 0);
|
|
wmem_strbuf_append(flags_strbuf, "little-endian");
|
|
}
|
|
if (flags & 0x02) {
|
|
wmem_strbuf_append_printf(flags_strbuf, "%s%s",
|
|
wmem_strbuf_get_len(flags_strbuf) ? ", " : "", "last message");
|
|
}
|
|
proto_tree_add_uint_format_value(miop_tree, hf_miop_flags, tvb, offset, 1,
|
|
flags, "0x%02x (%s)", flags, wmem_strbuf_get_str(flags_strbuf));
|
|
offset++;
|
|
proto_tree_add_item(miop_tree, hf_miop_packet_length, tvb, offset, 2, byte_order);
|
|
offset += 2;
|
|
proto_tree_add_item(miop_tree, hf_miop_packet_number, tvb, offset, 4, byte_order);
|
|
offset += 4;
|
|
proto_tree_add_item(miop_tree, hf_miop_number_of_packets, tvb, offset, 4, byte_order);
|
|
|
|
offset += 4;
|
|
ti = proto_tree_add_item(miop_tree, hf_miop_unique_id_len, tvb, offset, 4, byte_order);
|
|
|
|
if (unique_id_len >= MIOP_MAX_UNIQUE_ID_LENGTH) {
|
|
expert_add_info_format(pinfo, ti, &ei_miop_unique_id_len_exceed_max_value,
|
|
"Unique Id length (%u) exceeds max value (%u)",
|
|
unique_id_len, MIOP_MAX_UNIQUE_ID_LENGTH);
|
|
return offset;
|
|
}
|
|
|
|
offset += 4;
|
|
proto_tree_add_item(miop_tree, hf_miop_unique_id, tvb, offset, unique_id_len,
|
|
byte_order);
|
|
|
|
if (packet_number == 0) {
|
|
/* It is the first packet of the collection
|
|
We can call to GIOP dissector to show more about this first
|
|
uncompleted GIOP message
|
|
*/
|
|
tvbuff_t *payload_tvb;
|
|
|
|
offset += unique_id_len;
|
|
payload_tvb = tvb_new_subset_remaining (tvb, offset);
|
|
dissect_giop(payload_tvb, pinfo, tree);
|
|
}
|
|
}
|
|
|
|
return tvb_captured_length(tvb);
|
|
}
|
|
|
|
static gboolean
|
|
dissect_miop_heur (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void * data _U_) {
|
|
|
|
if (!dissect_miop_heur_check(tvb, pinfo, tree, data))
|
|
return FALSE;
|
|
|
|
dissect_miop (tvb, pinfo, tree, data);
|
|
|
|
/* TODO: make reasembly */
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
void proto_register_miop (void) {
|
|
|
|
|
|
/* A header field is something you can search/filter on.
|
|
*
|
|
* We create a structure to register our fields. It consists of an
|
|
* array of hf_register_info structures, each of which are of the format
|
|
* {&(field id), {name, abbrev, type, display, strings, bitmask, blurb, HFILL}}.
|
|
*/
|
|
static hf_register_info hf[] = {
|
|
{ &hf_miop_magic,
|
|
{ "Magic", "miop.magic", FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"PacketHeader magic", HFILL }},
|
|
{ &hf_miop_hdr_version,
|
|
{ "Version", "miop.hdr_version", FT_UINT8, BASE_HEX, NULL, 0x0,
|
|
"PacketHeader hdr_version", HFILL }},
|
|
{ &hf_miop_flags,
|
|
{ "Flags", "miop.flags", FT_UINT8, BASE_OCT, NULL, 0x0,
|
|
"PacketHeader flags", HFILL }},
|
|
{ &hf_miop_packet_length,
|
|
{ "Length", "miop.packet_length", FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"PacketHeader packet_length", HFILL }},
|
|
{ &hf_miop_packet_number,
|
|
{ "PacketNumber", "miop.packet_number", FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
"PacketHeader packet_number", HFILL }},
|
|
{ &hf_miop_number_of_packets,
|
|
{ "NumberOfPackets", "miop.number_of_packets", FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
"PacketHeader number_of_packets", HFILL }},
|
|
{ &hf_miop_unique_id_len,
|
|
{ "UniqueIdLength", "miop.unique_id_len", FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
"UniqueId length", HFILL }},
|
|
{ &hf_miop_unique_id,
|
|
{ "UniqueId", "miop.unique_id", FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
"UniqueId id", HFILL }},
|
|
};
|
|
|
|
|
|
static gint *ett[] = {
|
|
&ett_miop
|
|
};
|
|
|
|
static ei_register_info ei[] = {
|
|
{ &ei_miop_version_not_supported, { "miop.version.not_supported", PI_UNDECODED, PI_WARN, "MIOP version not supported", EXPFILL }},
|
|
{ &ei_miop_unique_id_len_exceed_max_value, { "miop.unique_id_len.exceed_max_value", PI_MALFORMED, PI_WARN, "Unique Id length exceeds max value", EXPFILL }},
|
|
};
|
|
|
|
expert_module_t* expert_miop;
|
|
|
|
proto_miop = proto_register_protocol("Unreliable Multicast Inter-ORB Protocol", "MIOP", "miop");
|
|
proto_register_field_array (proto_miop, hf, array_length (hf));
|
|
proto_register_subtree_array (ett, array_length (ett));
|
|
expert_miop = expert_register_protocol(proto_miop);
|
|
expert_register_field_array(expert_miop, ei, array_length(ei));
|
|
|
|
miop_handle = register_dissector("miop", dissect_miop, proto_miop);
|
|
|
|
}
|
|
|
|
|
|
void proto_reg_handoff_miop (void) {
|
|
|
|
dissector_add_for_decode_as_with_preference("udp.port", miop_handle);
|
|
|
|
heur_dissector_add("udp", dissect_miop_heur, "MIOP over UDP", "miop_udp", proto_miop, HEURISTIC_ENABLE);
|
|
|
|
}
|
|
|
|
/*
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
|
*
|
|
* Local variables:
|
|
* c-basic-offset: 2
|
|
* tab-width: 8
|
|
* indent-tabs-mode: nil
|
|
* End:
|
|
*
|
|
* vi: set shiftwidth=2 tabstop=8 expandtab:
|
|
* :indentSize=2:tabSize=8:noTabs=true:
|
|
*/
|