diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-10 20:34:10 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-10 20:34:10 +0000 |
commit | e4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc (patch) | |
tree | 68cb5ef9081156392f1dd62a00c6ccc1451b93df /epan/dissectors/file-rfc7468.c | |
parent | Initial commit. (diff) | |
download | wireshark-e4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc.tar.xz wireshark-e4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc.zip |
Adding upstream version 4.2.2.upstream/4.2.2
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'epan/dissectors/file-rfc7468.c')
-rw-r--r-- | epan/dissectors/file-rfc7468.c | 489 |
1 files changed, 489 insertions, 0 deletions
diff --git a/epan/dissectors/file-rfc7468.c b/epan/dissectors/file-rfc7468.c new file mode 100644 index 0000000..85c4397 --- /dev/null +++ b/epan/dissectors/file-rfc7468.c @@ -0,0 +1,489 @@ +/* file-rfc7468.c + * Routines for dissection of files in the format specified by RFC 7468. + * + * Wireshark - Network traffic analyzer + * By Gerald Combs <gerald@wireshark.org> + * Copyright 1998 Gerald Combs + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "config.h" + +#include <epan/packet.h> +#include <wiretap/wtap.h> + +void proto_register_rfc7468(void); +void proto_reg_handoff_rfc7468(void); + +static int proto_rfc7468 = -1; + +static gint ett_rfc7468 = -1; +static gint ett_rfc7468_preeb = -1; +static gint ett_rfc7468_data = -1; +static gint ett_rfc7468_posteb = -1; + +static int hf_rfc7468_preeb_label = -1; +static int hf_rfc7468_ber_data = -1; +static int hf_rfc7468_posteb_label = -1; + +static dissector_handle_t rfc7468_handle = NULL; +static dissector_handle_t ber_handle = NULL; + +static dissector_table_t rfc7468_label_table; + +static gboolean +line_is_eb(const guchar *line, int linelen, const char *prefix, + size_t prefixlen, const guchar **labelpp, int *labellenp) +{ + static const char suffix[] = "-----"; +#define suffixlen (sizeof suffix - 1) + const guchar *labelp; + int labellen; + + /* + * Is this line an encapulation boundary of the type specified by the + * prefix? + * + * First, it must be big enough to include the prefix at the beginning + * and the suffix at the end. + */ + if ((size_t)linelen < prefixlen + suffixlen) { + /* + * No - it's too short. + */ + return FALSE; + } + + /* + * It is, but it must begin with the prefix. + */ + if (memcmp(line, prefix, prefixlen) != 0) { + /* + * No - it doesn't begin with the prefix. + */ + return FALSE; + } + + /* + * It does, but it must also end with the suffix. + */ + if (memcmp(line + linelen - suffixlen, suffix, suffixlen) != 0) { + /* + * No - it doesn't end with the suffix. + */ + return FALSE; + } + + /* + * It begins with the prefix and ends with the suffix. Check + * the label, if there is one. + */ + labelp = line + prefixlen; + labellen = (int)(linelen - (prefixlen + suffixlen)); + *labelpp = labelp; + *labellenp = labellen; + if (labellen == 0) { + /* The label is empty. */ + return TRUE; + } + + /* + * The first character of the label must be 0x21-0x2C or 0x2E-0x7F, + * i.e., printable ASCII other than SP or '-'. + */ + if (*labelp == ' ' || *labelp == '-') + return FALSE; + labelp++; + labellen--; + + /* + * The rest of the characters must be printable ASCII. + */ + for (int i = 0; i < labellen; i++, labelp++) { + if (*labelp < 0x20 || *labelp > 0x7E) { + /* Not printable ASCII. */ + return FALSE; + } + } + return TRUE; +} + +static gboolean +line_is_blank(const guchar *line, int linelen) +{ + const guchar *p; + + p = line; + for (int i = 0; i < linelen; i++, p++) { + if (*p != ' ' && *p != '\t') { + /* Not space or tab */ + return FALSE; + } + } + return TRUE; +} + +static const char preeb_prefix[] = "-----BEGIN "; +#define preeb_prefix_len (sizeof preeb_prefix - 1) +static const char posteb_prefix[] = "-----END "; +#define posteb_prefix_len (sizeof posteb_prefix - 1) + +static gint +dissect_rfc7468(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) +{ + int offset; + int linelen; + int next_offset = 0; + const guchar *line; + const guchar *labelp = NULL; + int labellen = 0; + char *label; + proto_tree *rfc7468_tree, *preeb_tree, *posteb_tree; + proto_item *rfc7468_item, *ti; + + offset = 0; + rfc7468_item = proto_tree_add_item(tree, proto_rfc7468, tvb, offset, -1, ENC_NA); + rfc7468_tree = proto_item_add_subtree(rfc7468_item, ett_rfc7468); + + col_set_str(pinfo->cinfo, COL_PROTOCOL, "rfc7468"); + + /* + * First, process the text lines prior to the pre-encapsulation + * boundary; they're explanatory text lines. + */ + while (tvb_offset_exists(tvb, offset)) { + linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE); + if (linelen == -1) { + /* No complete line was found. Nothing more to do. */ + return tvb_captured_length(tvb); + } + + /* + * Get a buffer that refers to the line. + * + * Note that "tvb_find_line_end()" will return a value that + * is not longer than what's in the buffer, so the + * "tvb_get_ptr()" call won't throw an exception. + */ + line = tvb_get_ptr(tvb, offset, linelen); + + /* + * Is this line a pre-encapulation boundary? + */ + if (line_is_eb(line, linelen, preeb_prefix, sizeof preeb_prefix - 1, + &labelp, &labellen)) { + /* + * Yes - we're finished with the explanatory text lines. + */ + break; + } + + /* + * Add this line to the dissection. + */ + proto_tree_add_format_text(rfc7468_tree, tvb, offset, next_offset - offset); + + /* + * Step to the next line. + */ + offset = next_offset; + } + + /* + * This line is the pre-encapsulation boundary. + * Put it into the protocol tree, and create a subtree under it. + */ + ti = proto_tree_add_format_text(rfc7468_tree, tvb, offset, next_offset - offset); + preeb_tree = proto_item_add_subtree(ti, ett_rfc7468_preeb); + + /* + * Extract the label, and put it in that subtree. + */ + label = wmem_strndup(pinfo->pool, labelp, labellen); + proto_tree_add_item(preeb_tree, hf_rfc7468_preeb_label, tvb, + offset + (int)preeb_prefix_len, labellen, ENC_ASCII); + + col_add_fstr(pinfo->cinfo, COL_INFO, "Label: %s", label); + + /* + * Step to the next line. + */ + offset = next_offset; + + /* + * Skip over any blank lines before the base64 information. + */ + while (tvb_offset_exists(tvb, offset)) { + linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE); + if (linelen == -1) { + /* No complete line was found. We're done. */ + return tvb_captured_length(tvb); + } + + /* + * Get a buffer that refers to the line. + * + * Note that "tvb_find_line_end()" will return a value that + * is not longer than what's in the buffer, so the + * "tvb_get_ptr()" call won't throw an exception. + */ + line = tvb_get_ptr(tvb, offset, linelen); + + /* + * Is the line entirely blank (space or tab)? + */ + if (!line_is_blank(line, linelen)) { + /* + * No. + */ + break; + } + + /* + * Add this line to the dissection. + */ + proto_tree_add_format_text(rfc7468_tree, tvb, offset, next_offset - offset); + + /* + * Step to the next line. + */ + offset = next_offset; + } + + /* + * OK, this should be base64-encoded binary data. + */ + guint8 *databuf = NULL; + gsize databufsize = 0; + gint base64_state = 0; + guint base64_save = 0; + guint datasize = 0; + while (tvb_offset_exists(tvb, offset)) { + linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE); + if (linelen == -1) { + /* + * No complete line was found. Nothing more to do. + */ + return tvb_captured_length(tvb); + } + + /* + * Get a buffer that refers to the line. + * + * Note that "tvb_find_line_end()" will return a value that + * is not longer than what's in the buffer, so the + * "tvb_get_ptr()" call won't throw an exception. + */ + line = tvb_get_ptr(tvb, offset, linelen); + + /* + * Is this line a post-encapulation boundary? + */ + if (line_is_eb(line, linelen, posteb_prefix, sizeof posteb_prefix - 1, + &labelp, &labellen)) { + /* + * Yes - we're done with the base64 data. + */ + break; + } + + /* + * Add this line to the dissection. + */ + proto_tree_add_format_text(rfc7468_tree, tvb, offset, next_offset - offset); + + /* + * Decode it and add that to the buffer. + * First, grow the buffer as needed. + */ + databufsize += (linelen / 4) * 3 + 3; + databuf = (guint8 *)wmem_realloc(pinfo->pool, databuf, databufsize); + + /* + * Now decode into it. + */ + guint decodesize = (guint)g_base64_decode_step(line, linelen, + &databuf[datasize], + &base64_state, + &base64_save); + datasize += decodesize; + + /* + * Step to the next line. + */ + offset = next_offset; + } + + /* + * Make a tvbuff for the data, and put it into the protocol tree, + * if we have any. + */ + if (datasize != 0) { + tvbuff_t *data_tvb; + + data_tvb = tvb_new_child_real_data(tvb, databuf, datasize, datasize); + add_new_data_source(pinfo, data_tvb, "Base64-encoded data"); + + /* + * Try to decode it based on the label. + */ + if (dissector_try_string(rfc7468_label_table, label, data_tvb, pinfo, + tree, NULL) == 0) { + proto_tree *data_tree; + + /* + * No known dissector; decode it as BER. + */ + ti = proto_tree_add_item(tree, hf_rfc7468_ber_data, data_tvb, 0, -1, ENC_NA); + data_tree = proto_item_add_subtree(ti, ett_rfc7468_data); + call_dissector(ber_handle, data_tvb, pinfo, data_tree); + } + } + + /* + * This line is the post-encapsulation boundary. + * Put it into the protocol tree, and create a subtree under it. + */ + ti = proto_tree_add_format_text(rfc7468_tree, tvb, offset, next_offset - offset); + posteb_tree = proto_item_add_subtree(ti, ett_rfc7468_posteb); + + /* + * Extract the label, and put it in that subtree. + */ + proto_tree_add_item(posteb_tree, hf_rfc7468_posteb_label, tvb, + offset + (int)posteb_prefix_len, labellen, ENC_ASCII); + + return tvb_captured_length(tvb); +} + +// +// Arbitrary value - we don't want to read all of a huge non-RFC 7468 file +// only to find no pre-encapsulation boundary. +// +#define MAX_EXPLANATORY_TEXT_LINES 20 + +static gboolean +dissect_rfc7468_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) +{ + int offset; + int linelen; + int next_offset; + const guchar *line; + const guchar *labelp; + int labellen; + gboolean found = FALSE; + + /* + * Look for a pre-encapsulation boundary. + * Process up to MAX_EXPLANATORY_TEXT_LINES worth of lines that don't + * look like pre-encapsulation boundaries. + */ + offset = 0; + for (unsigned int i = 0; i < MAX_EXPLANATORY_TEXT_LINES; i++) { + linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE); + if (linelen == -1) { + /* + * No complete line was found; we ran out of file data + * and didn't find a pre-encapsulation boundary, so this + * isn't an RFC 7468 file. + */ + break; + } + + /* + * Get a buffer that refers to the line. + * + * Note that "tvb_find_line_end()" will return a value that + * is not longer than what's in the buffer, so the + * "tvb_get_ptr()" call won't throw an exception. + */ + line = tvb_get_ptr(tvb, offset, linelen); + + /* + * Is this line a pre-encapulation boundary? + */ + if (line_is_eb(line, linelen, preeb_prefix, sizeof preeb_prefix - 1, + &labelp, &labellen)) { + /* + * Yes - we're done looking. + */ + found = TRUE; + break; + } + + /* + * Step to the next line. + */ + offset = next_offset; + } + + /* + * Did we find a pre-encapsulation boundary? + */ + if (!found) + return FALSE; /* no */ + + /* + * OK, it's an RFC 7468 file. Dissect it. + */ + dissect_rfc7468(tvb, pinfo, tree, data); + return TRUE; +} + +void +proto_register_rfc7468(void) +{ + static hf_register_info hf[] = { + { &hf_rfc7468_preeb_label, + { "Pre-encapsulation boundary label", "rfc7468.preeb_label", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL } }, + { &hf_rfc7468_ber_data, + { "BER data", "rfc7468.ber_data", FT_NONE, BASE_NONE, + NULL, 0, NULL, HFILL } }, + { &hf_rfc7468_posteb_label, + { "Post-encapsulation boundary label", "rfc7468.posteb_label", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL } }, + }; + + static gint *ett[] = { + &ett_rfc7468, + &ett_rfc7468_preeb, + &ett_rfc7468_data, + &ett_rfc7468_posteb + }; + + proto_rfc7468 = proto_register_protocol("RFC 7468 file format", "rfc7468", "rfc7468"); + + proto_register_field_array(proto_rfc7468, hf, array_length(hf)); + proto_register_subtree_array(ett, array_length(ett)); + + rfc7468_label_table = register_dissector_table("rfc7468.preeb_label", "FFF", + proto_rfc7468, FT_STRING, + STRING_CASE_INSENSITIVE); + + rfc7468_handle = register_dissector("rfc7468", dissect_rfc7468, proto_rfc7468); +} + +void +proto_reg_handoff_rfc7468(void) +{ + heur_dissector_add("wtap_file", dissect_rfc7468_heur, "RFC 7468 file", "rfc7468_wtap", proto_rfc7468, HEURISTIC_ENABLE); + dissector_add_uint("wtap_encap", WTAP_ENCAP_RFC7468, rfc7468_handle); + + ber_handle = find_dissector("ber"); +} + + +/* + * Editor modelines - https://www.wireshark.org/tools/modelines.html + * + * Local variables: + * c-basic-offset: 4 + * tab-width: 8 + * indent-tabs-mode: nil + * End: + * + * vi: set shiftwidth=4 tabstop=8 expandtab: + * :indentSize=4:tabSize=8:noTabs=true: + */ |