Index: epan/dissectors/packet-mactelnet.c =================================================================== --- epan/dissectors/packet-mactelnet.c (revision 0) +++ epan/dissectors/packet-mactelnet.c (revision 0) @@ -0,0 +1,365 @@ +/* packet-mactelnet.c + * Routines for MAC-Telnet dissection + * Copyright 2010, Haakon Nessjoen + * + * $Id$ + * + * Wireshark - Network traffic analyzer + * By Gerald Combs + * Copyright 1998 Gerald Combs + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +/* + Thanks to "omniflux" for dissecting the protocol by hand before me. +*/ + +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif + +#include +#include + +#include +#include +#include + +#define PROTO_TAG_MACTELNET "MAC-Telnet" + +void proto_reg_handoff_mactelnet(void); + +/* Initialize the protocol and registered fields */ +static gint proto_mactelnet = -1; +static gint hf_mactelnet = -1; +static gint hf_mactelnet_type = -1; +static gint hf_mactelnet_protocolver = -1; +static gint hf_mactelnet_source_mac = -1; +static gint hf_mactelnet_destination_mac = -1; +static gint hf_mactelnet_session_id = -1; +static gint hf_mactelnet_client_type = -1; +static gint hf_mactelnet_databytes = -1; +static gint hf_mactelnet_datatype = -1; +static gint hf_mactelnet_control = -1; +static gint hf_mactelnet_control_length = -1; +static gint hf_mactelnet_control_encryption_key = -1; +static gint hf_mactelnet_control_password = -1; +static gint hf_mactelnet_control_username = -1; +static gint hf_mactelnet_control_terminal = -1; +static gint hf_mactelnet_control_width = -1; +static gint hf_mactelnet_control_height = -1; + +/* Global port pref */ +static int global_mactelnet_port = 20561; + +/* Initialize the subtree pointers */ +static gint ett_mactelnet = -1; +static gint ett_mactelnet_control = -1; + +/* Packet types */ +static const value_string packettypenames[] = { + { 0, "Start session" }, + { 1, "Data" }, + { 2, "Acknowledge" }, + { 255, "End session" }, + { 0, NULL } +}; + +/* Known client types */ +static const value_string clienttypenames[] = { + { 0x0015, "MAC Telnet" }, + { 0x0f90, "Winbox" }, + { 0, NULL } +}; + +/* Known control-packet types */ +static const value_string controlpackettypenames[] = { + { 0, "Begin authentication" }, + { 1, "Encryption key" }, + { 2, "Password" }, + { 3, "Username" }, + { 4, "Terminal type" }, + { 5, "Terminal width" }, + { 6, "Terminal height" }, + { 9, "End authentication" }, + { 0, NULL } +}; + + +static int +dissect_mactelnet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) +{ + proto_item *mactelnet_item = NULL; + proto_tree *mactelnet_tree = NULL; + proto_item *mactelnet_control_item = NULL; + proto_tree *mactelnet_control_tree = NULL; + guint16 type = 0; + const guint8 *source_mac; + const guint8 *destination_mac; + + + /* Check that there's enough data */ + if (tvb_length(tvb) < 22) + return 0; + + /* Make entries in Protocol column and Info column on summary display */ + col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_TAG_MACTELNET); + + /* Get the type byte */ + type = tvb_get_guint8( tvb, 1 ); + + /* Get source mac address */ + source_mac = tvb_get_ptr(tvb, 2, 6); + + /* Get destination mac address */ + destination_mac = tvb_get_ptr(tvb, 8, 6); + + col_clear(pinfo->cinfo, COL_INFO); + col_add_fstr(pinfo->cinfo, COL_INFO, "%s > %s Type: %s", + ether_to_str(source_mac), ether_to_str(destination_mac), + val_to_str(type, packettypenames, "Unknown Type:0x%02x")); + + if (tree) { + guint8 no_ip[4] = {0,0,0,0}; + guint8 offset = 0; + + /* create display subtree for the protocol */ + mactelnet_item = proto_tree_add_item(tree, proto_mactelnet, tvb, 0, -1, FALSE); + mactelnet_tree = proto_item_add_subtree(mactelnet_item, ett_mactelnet); + + /* ver(1) */ + proto_tree_add_uint(mactelnet_tree, hf_mactelnet_protocolver, tvb, offset, 1, tvb_get_guint8(tvb, offset)); + offset++; + + /* ptype(1) */ + proto_tree_add_uint(mactelnet_tree, hf_mactelnet_type, tvb, offset, 1, tvb_get_guint8(tvb, offset)); + offset++; + + /* saddr(6) */ + proto_tree_add_ether(mactelnet_tree, hf_mactelnet_source_mac, tvb, offset, 6, source_mac); + offset += 6; + + /* dstaddr(6) */ + proto_tree_add_ether(mactelnet_tree, hf_mactelnet_destination_mac, tvb, offset, 6, destination_mac); + offset += 6; + + if (memcmp(pinfo->src.data, &no_ip, 4) == 0) { + /* Server to client */ + + /* sessionid(2) */ + proto_tree_add_item(mactelnet_tree, hf_mactelnet_session_id, tvb, offset+2, 2, ENC_BIG_ENDIAN); + offset += 2; + + /* clienttype(2) */ + proto_tree_add_item(mactelnet_tree, hf_mactelnet_client_type, tvb, offset-2, 2, ENC_BIG_ENDIAN); + offset += 2; + } else { + /* Client to server */ + + /* sessionid(2) */ + proto_tree_add_item(mactelnet_tree, hf_mactelnet_session_id, tvb, offset, 2, ENC_BIG_ENDIAN); + offset += 2; + + /* clienttype(2) */ + proto_tree_add_item(mactelnet_tree, hf_mactelnet_client_type, tvb, offset, 2, ENC_BIG_ENDIAN); + offset += 2; + } + + /* counter(4) */ + proto_tree_add_item(mactelnet_tree, hf_mactelnet_databytes, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + + /* Data packets only */ + if (type == 1) { + const gchar *firstdata; + + /* Control packet deifnition */ + gchar control_packet[4] = { 0x56, 0x34, 0x12, 0xff }; + + while(tvb_length_remaining(tvb, offset) > 0) { + if (tvb_length_remaining(tvb, offset) > 4 && (firstdata = tvb_get_ptr(tvb, offset, 4)) && (memcmp(firstdata, &control_packet, 4) == 0)) { + guint8 datatype = 0; + guint32 datalength = 0; + offset += 4; + + /* Add subtree for control packet */ + mactelnet_control_item = proto_tree_add_item(mactelnet_tree, hf_mactelnet_control, tvb, offset, -1, FALSE); + mactelnet_control_tree = proto_item_add_subtree(mactelnet_control_item, ett_mactelnet); + + /* Control packet type (1) */ + datatype = tvb_get_guint8(tvb, offset); + proto_tree_add_uint(mactelnet_control_tree, hf_mactelnet_datatype, tvb, offset, 1, datatype); + offset++; + + /* Control packet length (4) */ + datalength = (guint32)((tvb_get_guint8(tvb, offset) << 24) | + (tvb_get_guint8(tvb, offset+1) << 16) | + (tvb_get_guint8(tvb, offset+2) << 8) | + tvb_get_guint8(tvb, offset+3)); + proto_tree_add_uint(mactelnet_control_tree, hf_mactelnet_control_length, tvb, offset, 4, datalength); + offset += 4; + + switch (datatype) { + case 1: /* Encryption Key */ + { + gchar *key_str; + const guint8 *key; + + key = tvb_get_ptr(tvb, offset, 16); + key_str = bytestring_to_str(key, 16, 0); + proto_tree_add_string(mactelnet_control_tree, hf_mactelnet_control_encryption_key, tvb, offset, 16, key_str); + } + break; + + case 2: /* Password */ + { + gchar *password_str; + const guint8 *password; + + password = tvb_get_ptr(tvb, offset + 1, 16); + password_str = bytestring_to_str(password, 16, 0); + proto_tree_add_string(mactelnet_control_tree, hf_mactelnet_control_password, tvb, offset, 17, password_str); + } + break; + + case 3: /* Username */ + { + const guint8 *username = tvb_get_ptr(tvb, offset, datalength); + gchar *username_str = ep_alloc(datalength + 1); + memcpy(username_str, username, datalength); + username_str[datalength] = '\0'; + proto_tree_add_string(mactelnet_control_tree, hf_mactelnet_control_username, tvb, offset, datalength, username_str); + } + break; + + case 4: /* Terminal type */ + { + const guint8 *terminal = tvb_get_ptr(tvb, offset, datalength); + gchar *terminal_str = ep_alloc(datalength + 1); + memcpy(terminal_str, terminal, datalength); + terminal_str[datalength] = '\0'; + proto_tree_add_string(mactelnet_control_tree, hf_mactelnet_control_terminal, tvb, offset, datalength, terminal_str); + } + break; + + case 5: /* Terminal width */ + proto_tree_add_uint(mactelnet_control_tree, hf_mactelnet_control_width, tvb, offset, 2, (tvb_get_guint8(tvb, offset + 1) << 8) | tvb_get_guint8(tvb, offset)); + break; + + case 6: /* Terminal height */ + proto_tree_add_uint(mactelnet_control_tree, hf_mactelnet_control_height, tvb, offset, 2, (tvb_get_guint8(tvb, offset + 1) << 8) | tvb_get_guint8(tvb, offset)); + break; + + case 9: /* End authentication (no data) */ + break; + } + offset += datalength; + + } else { + /* Data packet, let wireshark handle it */ + tvbuff_t *next_client; + next_client = tvb_new_subset(tvb, offset, -1, -1); + call_dissector(data_handle, next_client, pinfo, mactelnet_tree); + return offset; + } + } + } + + + } + return tvb_length(tvb); +} + + +void +proto_register_mactelnet(void) +{ + static hf_register_info hf[] = { + { &hf_mactelnet, + { "Data", "mactelnet.data", FT_NONE, BASE_NONE, NULL, 0x0, + "MAC-Telnet Data", HFILL }}, + { &hf_mactelnet_type, + { "Type", "mactelnet.type", FT_UINT8, BASE_DEC, VALS(packettypenames), 0x0, + "Package Type", HFILL }}, + { &hf_mactelnet_protocolver, + { "Protocol Version", "mactelnet.protocol_version", FT_UINT8, BASE_DEC, NULL, 0x0, + "Protocol Version", HFILL }}, + { &hf_mactelnet_source_mac, + { "Source MAC", "mactelnet.source_mac", FT_ETHER, BASE_NONE, NULL , 0x0, + "Source MAC", HFILL }}, + { &hf_mactelnet_destination_mac, + { "Destination MAC", "mactelnet.destination_mac", FT_ETHER, BASE_NONE, NULL , 0x0, + "Destination MAC", HFILL }}, + { &hf_mactelnet_session_id, + { "Session ID", "mactelnet.session_id", FT_UINT16, BASE_HEX, NULL , 0x0, + "Session ID for this connection", HFILL }}, + { &hf_mactelnet_client_type, + { "Client Type", "mactelnet.client_type", FT_UINT16, BASE_HEX, VALS(clienttypenames) , 0x0, + "Client type", HFILL }}, + { &hf_mactelnet_databytes, + { "Session Data Bytes", "mactelnet.session_bytes", FT_UINT32, BASE_DEC, NULL , 0x0, + "Session data bytes received", HFILL }}, + { &hf_mactelnet_datatype, + { "Data Packet Type", "mactelnet.data_type", FT_UINT8, BASE_HEX, VALS(controlpackettypenames) , 0x0, + "Data packet type", HFILL }}, + { &hf_mactelnet_control, + { "Control Packet", "mactelnet.control", FT_NONE, BASE_NONE, NULL , 0x0, + "Control Packet", HFILL }}, + { &hf_mactelnet_control_length, + { "Control Data Length", "mactelnet.control_length", FT_UINT32, BASE_DEC, NULL , 0x0, + "Control packet length", HFILL }}, + { &hf_mactelnet_control_encryption_key, + { "Encryption Key", "mactelnet.control_encryptionkey", FT_STRING, BASE_NONE, NULL , 0x0, + "Login encryption key", HFILL }}, + { &hf_mactelnet_control_password, + { "Password MD5", "mactelnet.control_password", FT_STRING, BASE_NONE, NULL , 0x0, + "Password MD5", HFILL }}, + { &hf_mactelnet_control_username, + { "Username", "mactelnet.control_username", FT_STRING, BASE_NONE, NULL , 0x0, + "Username", HFILL }}, + { &hf_mactelnet_control_terminal, + { "Terminal Type", "mactelnet.control_terminaltype", FT_STRING, BASE_NONE, NULL , 0x0, + "Terminal type", HFILL }}, + { &hf_mactelnet_control_width, + { "Terminal Width", "mactelnet.control_width", FT_UINT16, BASE_DEC, NULL , 0x0, + "Terminal width", HFILL }}, + { &hf_mactelnet_control_height, + { "Terminal Height", "mactelnet.control_height", FT_UINT16, BASE_DEC, NULL , 0x0, + "Terminal height", HFILL }} + }; + + /* Setup protocol subtree array */ + static gint *ett[] = { + &ett_mactelnet, + &ett_mactelnet_control, + }; + + /* Register the protocol name and description */ + proto_mactelnet = proto_register_protocol ("MikroTik MAC-Telnet Protocol", PROTO_TAG_MACTELNET, "mactelnet"); + + /* Required function calls to register the header fields and subtrees used */ + proto_register_field_array (proto_mactelnet, hf, array_length (hf)); + proto_register_subtree_array (ett, array_length (ett)); +} + +void +proto_reg_handoff_mactelnet(void) +{ + dissector_handle_t mactelnet_handle; + mactelnet_handle = new_create_dissector_handle(dissect_mactelnet, + proto_mactelnet); + dissector_add("udp.port", global_mactelnet_port, mactelnet_handle); +} Index: epan/dissectors/Makefile.common =================================================================== --- epan/dissectors/Makefile.common (revision 33275) +++ epan/dissectors/Makefile.common (working copy) @@ -631,6 +631,7 @@ packet-m2ua.c \ packet-m3ua.c \ packet-mac-lte.c \ + packet-mactelnet.c \ packet-maccontrol.c \ packet-manolito.c \ packet-mbtcp.c \