wireshark/epan/dissectors/packet-sapigs.c

417 lines
16 KiB
C
Executable File

/* packet-sapigs.c
* Routines for SAP IGS (Internet Graphics Server) dissection
* Copyright 2022, Yvan Genuer (@iggy38), Devoteam
* Copyright 2022, Martin Gallo <martin.gallo [AT] gmail.com>
* Code contributed by SecureAuth Corp.
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
/*
* This is a simple dissector for the IGS protocol, initially added by Yvan Genuer as part of their research around the protocol:
* https://www.troopers.de/troopers18/agenda/3r38lr/. Some details and example requests can be found in pysap's documentation:
* https://pysap.readthedocs.io/en/latest/protocols/SAPIGS.html
*/
#include <config.h>
#include <inttypes.h>
#include <stdlib.h>
#include <epan/packet.h>
#include <epan/prefs.h>
#include <epan/expert.h>
#include <wsutil/strtoi.h>
#include <wsutil/wmem/wmem.h>
/*
* Define default ports. The right range should be 4NNNN, but as port numbers are proprietary and not
* IANA assigned, we leave only the ones corresponding to the instance 00.
*/
#define SAPIGS_PORT_RANGE "40000"
/* IGS Functions values */
static const value_string sapigs_function_lst[] = {
{ 1, "ADM:REGPW"}, /* Register a PortWatcher */
{ 2, "ADM:UNREGPW"}, /* Unregsiter a PortWatcher */
{ 3, "ADM:REGIP"}, /* Register an Interpreter */
{ 4, "ADM:UNREGIP"}, /* Unregsiter an Interpreter */
{ 5, "ADM:FREEIP"}, /* Inform than Interpreter is free */
{ 6, "ADM:ILLBEBACK"}, /* Call back function */
{ 7, "ADM:ABORT"}, /* Abort Interpreter work */
{ 8, "ADM:PING"}, /* Ping receive */
{ 9, "ADM:PONG"}, /* Ping send */
{ 10, "ADM:SHUTDOWNIGS"}, /* Shutdown IGS */
{ 11, "ADM:SHUTDOWNPW"}, /* Shutdown PortWatcher */
{ 12, "ADM:CHECKCONSUMER"}, /* Check Portwatcher status */
{ 13, "ADM:FREECONSUMER"}, /* Inform than portwather is free */
{ 14, "ADM:GETLOGFILE"}, /* Display log file */
{ 15, "ADM:GETCONFIGFILE"}, /* Display configfile */
{ 16, "ADM:GETDUMP"}, /* Display dump file */
{ 17, "ADM:DELETEDUMP"}, /* Delete dump file */
{ 18, "ADM:INSTALL"}, /* Upload shapefiles for GIS */
{ 19, "ADM:SWITCH"}, /* Switch trace log level */
{ 20, "ADM:GETVERSION"}, /* Get IGS Version */
{ 21, "ADM:STATUS"}, /* Display IGS Status */
{ 22, "ADM:STATISTIC"}, /* old Display IGS Statistic */
{ 23, "ADM:STATISTICNEW"}, /* Display IGS Statistic */
{ 24, "ADM:GETSTATCHART"}, /* Get IGS Statistic chart */
{ 25, "ADM:SIM"}, /* Simulation function */
{ 30, "ZIPPER"}, /* ZIP provide file(s) */
{ 31, "IMGCONV"}, /* Image converter */
{ 32, "RSPOCONNECTOR"}, /* Remote Spool Connector */
{ 33, "XMLCHART"}, /* Chart generator throught xml input */
{ 34, "CHART"}, /* Chart generator throught ABAP Table input */
{ 35, "BWGIS"}, /* BW Geographic Information System */
{ 36, "SAPGISXML"}, /* old SAP GIS throught xml input */
/* NULL */
{ 0, NULL}
};
static int proto_sapigs = -1;
/* Headers */
static int hf_sapigs_function = -1;
static int hf_sapigs_listener = -1;
static int hf_sapigs_hostname = -1;
static int hf_sapigs_id = -1;
static int hf_sapigs_padd1 = -1;
static int hf_sapigs_flag1 = -1;
static int hf_sapigs_padd2 = -1;
static int hf_sapigs_flag2 = -1;
static int hf_sapigs_padd3 = -1;
/* Data */
static int hf_sapigs_eye_catcher = -1;
static int hf_sapigs_padd4 = -1;
static int hf_sapigs_codepage = -1;
static int hf_sapigs_offset_data = -1;
static int hf_sapigs_data_size = -1;
static int hf_sapigs_data = -1;
/* Table definition */
static int hf_sapigs_tables = -1;
static int hf_sapigs_table_version = -1;
static int hf_sapigs_table_name = -1;
static int hf_sapigs_table_line_number = -1;
static int hf_sapigs_table_width = -1;
static int hf_sapigs_table_column_name = -1;
static int hf_sapigs_table_column_number = -1;
static int hf_sapigs_table_column_width = -1;
/* Others */
static int hf_sapigs_portwatcher = -1;
static int hf_sapigs_portwatcher_version = -1;
static int hf_sapigs_portwatcher_info = -1;
static int hf_sapigs_interpreter = -1;
static int hf_sapigs_chart_config = -1;
static gint ett_sapigs = -1;
/* Global port preference */
static range_t *global_sapigs_port_range;
/* Global highlight preference */
static gboolean global_sapigs_highlight_items = TRUE;
/* Protocol handle */
static dissector_handle_t sapigs_handle;
void proto_reg_handoff_sapigs(void);
void proto_register_sapigs(void);
static int
dissect_sapigs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
{
guint32 offset = 0, err_val = 0;
gint data_offset = 0, data_length = 0;
gchar *sapigs_info_function = NULL, *illbeback_type = NULL, *is_table = NULL;
proto_item *ti = NULL, *sapigs_tables = NULL;
proto_tree *sapigs_tree = NULL, *sapigs_tables_tree = NULL;
/* Add the protocol to the column */
col_add_str(pinfo->cinfo, COL_PROTOCOL, "SAPIGS");
/* Add function name in the info column */
col_add_fstr(pinfo->cinfo, COL_INFO, " function: %s", tvb_get_string_enc(pinfo->pool, tvb, 0, 32, ENC_ASCII));
/* Add the main sapigs subtree */
ti = proto_tree_add_item(tree, proto_sapigs, tvb, 0, -1, ENC_NA);
sapigs_tree = proto_item_add_subtree(ti, ett_sapigs);
/* Retrieve function name */
sapigs_info_function = (char *)tvb_get_string_enc(pinfo->pool, tvb, offset, 32, ENC_ASCII);
/* Headers */
proto_tree_add_item(sapigs_tree, hf_sapigs_function, tvb, offset, 32, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_listener, tvb, offset, 32, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_hostname, tvb, offset, 81, ENC_ASCII|ENC_NA);
offset += 81;
proto_tree_add_item(sapigs_tree, hf_sapigs_id, tvb, offset, 4, ENC_ASCII|ENC_NA);
offset += 4;
proto_tree_add_item(sapigs_tree, hf_sapigs_padd1, tvb, offset, 15, ENC_ASCII);
offset += 15;
proto_tree_add_item(sapigs_tree, hf_sapigs_flag1, tvb, offset, 1, ENC_ASCII);
offset += 1;
proto_tree_add_item(sapigs_tree, hf_sapigs_padd2, tvb, offset, 20, ENC_ASCII);
offset += 20;
proto_tree_add_item(sapigs_tree, hf_sapigs_flag2, tvb, offset, 1, ENC_ASCII);
offset += 1;
proto_tree_add_item(sapigs_tree, hf_sapigs_padd3, tvb, offset, 6, ENC_ASCII);
offset += 6;
/* switch over function name value */
switch (str_to_val(sapigs_info_function, sapigs_function_lst, err_val)){
case 8:{ /* ADM:PING */
proto_tree_add_item(sapigs_tree, hf_sapigs_portwatcher, tvb, offset, 5, ENC_ASCII|ENC_NA);
break;
}
case 9:{ /* ADM:PONG */
break;
}
case 1:{ /* ADM:REGPW */
proto_tree_add_item(sapigs_tree, hf_sapigs_portwatcher, tvb, offset, 5, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_portwatcher_version, tvb, offset, 16, ENC_ASCII|ENC_NA);
break;
}
case 3: /* ADM:REGIP */
case 5:{ /* ADM:FREEIP */
proto_tree_add_item(sapigs_tree, hf_sapigs_portwatcher, tvb, offset, 5, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_interpreter, tvb, offset, 16, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_portwatcher_version, tvb, offset, 16, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_portwatcher_info, tvb, offset, 16, ENC_ASCII|ENC_NA);
break;
}
case 6:{ /* ADM:ILLBEBACK */
illbeback_type = (gchar *)tvb_get_string_enc(pinfo->pool, tvb, offset, 10, ENC_ASCII|ENC_NA);
if (strncmp("TransMagic", illbeback_type, 10) == 0){
/* data is raw after eye_catcher */
proto_tree_add_item(sapigs_tree, hf_sapigs_eye_catcher, tvb, offset, 10, ENC_ASCII|ENC_NA);
offset += 16;
proto_tree_add_item(sapigs_tree, hf_sapigs_data, tvb, offset, -1, ENC_NA);
} else {
/* we receive sized data */
ws_strtoi((gchar *)tvb_get_string_enc(pinfo->pool, tvb, offset, 5, ENC_ASCII), NULL, &data_length);
proto_tree_add_item(sapigs_tree, hf_sapigs_data_size, tvb, offset, 5, ENC_ASCII|ENC_NA);
offset += 5;
/* Data */
if ((data_length > 0) && (tvb_reported_length_remaining(tvb, offset) >= data_length)) {
proto_tree_add_item(sapigs_tree, hf_sapigs_data, tvb, offset, data_length, ENC_NA);
}
}
break;
}
case 30: /* ZIPPER */
case 31: /* IMGCONV */
case 33: /* XMLCHART */
case 16:{ /* ADM:GETDUMP */
proto_tree_add_item(sapigs_tree, hf_sapigs_eye_catcher, tvb, offset, 10, ENC_ASCII|ENC_NA);
offset += 10;
proto_tree_add_item(sapigs_tree, hf_sapigs_padd4, tvb, offset, 2, ENC_ASCII);
offset += 2;
proto_tree_add_item(sapigs_tree, hf_sapigs_codepage, tvb, offset, 4, ENC_ASCII|ENC_NA);
offset += 4;
/* Data offset */
ws_strtoi((gchar *)tvb_get_string_enc(pinfo->pool, tvb, offset, 16, ENC_ASCII), NULL, &data_offset);
proto_tree_add_item(sapigs_tree, hf_sapigs_offset_data, tvb, offset, 16, ENC_ASCII|ENC_NA);
offset += 16;
/* Data length */
ws_strtoi((gchar *)tvb_get_string_enc(pinfo->pool, tvb, offset, 16, ENC_ASCII), NULL, &data_length);
proto_tree_add_item(sapigs_tree, hf_sapigs_data_size, tvb, offset, 16, ENC_ASCII|ENC_NA);
offset += 16;
data_offset += offset;
/* Definition tables */
is_table = (gchar *)tvb_get_string_enc(pinfo->pool, tvb, offset, 4, ENC_ASCII);
/* if the 4 next char is VERS, we are at the begining of one definition table */
while(strncmp("VERS", is_table, 4) == 0){
/* Build a tree for Tables */
sapigs_tables = proto_tree_add_item(sapigs_tree, hf_sapigs_tables, tvb, offset, 336, ENC_NA);
sapigs_tables_tree = proto_item_add_subtree(sapigs_tables, ett_sapigs);
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_version, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_name, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_line_number, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_width, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_column_name, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_column_number, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
proto_tree_add_item(sapigs_tables_tree, hf_sapigs_table_column_width, tvb, offset+8, 40, ENC_ASCII);
offset += 48;
is_table = (gchar *)tvb_get_string_enc(pinfo->pool, tvb, offset, 4, ENC_ASCII);
}
/* Data */
if ((data_length > 0) && (tvb_reported_length_remaining(tvb, offset) >= data_length)) {
proto_tree_add_item(sapigs_tree, hf_sapigs_data, tvb, data_offset, data_length, ENC_NA);
}
break;
}
case 34:{ /* CHART */
proto_tree_add_item(sapigs_tree, hf_sapigs_chart_config, tvb, offset, 32, ENC_ASCII|ENC_NA);
offset += 32;
proto_tree_add_item(sapigs_tree, hf_sapigs_data, tvb, offset, -1, ENC_NA);
break;
}
}
return tvb_reported_length(tvb);
}
void
proto_register_sapigs(void)
{
static hf_register_info hf[] = {
/* General Header fields */
{ &hf_sapigs_function,
{ "Function", "sapigs.function", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_listener,
{ "Listener", "sapigs.listener", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_hostname,
{ "Hostname", "sapigs.hostname", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_id,
{ "Id", "sapigs.id", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_padd1,
{ "Padd1", "sapigs.padd1", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_flag1,
{ "Flag1", "sapigs.flag1", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_padd2,
{ "Padd2", "sapigs.padd2", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_flag2,
{ "Flag2", "sapigs.flag2", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_padd3,
{ "Padd3", "sapigs.padd3", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
/* Data headers */
{ &hf_sapigs_eye_catcher,
{ "Eye catcher", "sapigs.eye_catcher", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_padd4,
{ "Padd4", "sapigs.padd4", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_codepage,
{ "Codepage", "sapigs.codepage", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_offset_data,
{ "Offset to data", "sapigs.offset_data", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_data_size,
{ "Data size", "sapigs.data_size", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
/* Portwatcher fields */
{ &hf_sapigs_portwatcher,
{ "Portwatcher Port", "sapigs.portwatcher", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_portwatcher_version,
{ "Portwatcher version", "sapigs.portwatcher_version", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_portwatcher_info,
{ "Portwatcher Info", "sapigs.portwatcher_info", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
/* Interpreter information */
{ &hf_sapigs_interpreter,
{ "Interpreter name", "sapigs.interpreter", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_chart_config,
{ "Chart configuration", "sapigs.chart_config", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
/* Table definition fields */
{ &hf_sapigs_tables,
{ "Table definition", "sapigs.tables", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
{ &hf_sapigs_table_version,
{ "VERS", "sapigs.table_version", FT_STRING, BASE_NONE, NULL, 0x0, "Table version", HFILL }},
{ &hf_sapigs_table_name,
{ "TBNM", "sapigs.table_name", FT_STRING, BASE_NONE, NULL, 0x0, "Table name", HFILL }},
{ &hf_sapigs_table_line_number,
{ "TBLN", "sapigs.table_line_number", FT_STRING, BASE_NONE, NULL, 0x0, "Line count", HFILL }},
{ &hf_sapigs_table_width,
{ "TBWD", "sapigs.table_width", FT_STRING, BASE_NONE, NULL, 0x0, "Table width", HFILL }},
{ &hf_sapigs_table_column_name,
{ "TBCL", "sapigs.table_column_name", FT_STRING, BASE_NONE, NULL, 0x0, "Table column name", HFILL }},
{ &hf_sapigs_table_column_number,
{ "CLNM", "sapigs.table_column_number", FT_STRING, BASE_NONE, NULL, 0x0, "Column count", HFILL }},
{ &hf_sapigs_table_column_width,
{ "CLWD", "sapigs.table_column_width", FT_STRING, BASE_NONE, NULL, 0x0, "Column width", HFILL }},
/* Data */
{ &hf_sapigs_data,
{ "Data", "sapigs.table_data", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}
};
/* Setup protocol subtre array */
static gint *ett[] = {
&ett_sapigs
};
module_t *sapigs_module;
/* Register the protocol */
proto_sapigs = proto_register_protocol("SAP Internet Graphic Server", "SAPIGS", "sapigs");
register_dissector("sapigs", dissect_sapigs, proto_sapigs);
proto_register_field_array(proto_sapigs, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
/* Register the preferences */
sapigs_module = prefs_register_protocol(proto_sapigs, proto_reg_handoff_sapigs);
range_convert_str(wmem_epan_scope(), &global_sapigs_port_range, SAPIGS_PORT_RANGE, MAX_TCP_PORT);
prefs_register_range_preference(sapigs_module, "tcp_ports", "SAP IGS Protocol TCP port numbers", "Port numbers used for SAP IGS Protocol (default "SAPIGS_PORT_RANGE ")", &global_sapigs_port_range, MAX_TCP_PORT);
prefs_register_bool_preference(sapigs_module, "highlight_unknow_items", "Highlight unknow SAP IGS messages", "Wether the SAP IGS Protocol dissector should highlight unknown IGS messages", &global_sapigs_highlight_items);
}
/**
* Helpers for dealing with the port range
*/
static void range_delete_callback (guint32 port, gpointer ptr _U_)
{
dissector_delete_uint("sapni.port", port, sapigs_handle);
}
static void range_add_callback (guint32 port, gpointer ptr _U_)
{
dissector_add_uint("sapni.port", port, sapigs_handle);
}
/**
* Register Hand off for the SAP IGS Protocol
*/
void
proto_reg_handoff_sapigs(void)
{
static range_t *sapigs_port_range;
static gboolean initialized = FALSE;
if (!initialized) {
sapigs_handle = create_dissector_handle(dissect_sapigs, proto_sapigs);
initialized = TRUE;
} else {
range_foreach(sapigs_port_range, range_delete_callback, NULL);
wmem_free(wmem_epan_scope(), sapigs_port_range);
}
sapigs_port_range = range_copy(wmem_epan_scope(), global_sapigs_port_range);
range_foreach(sapigs_port_range, range_add_callback, NULL);
}
/*
* Editor modelines - https://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/