summaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-atalk.c
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-10 20:34:10 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-10 20:34:10 +0000
commite4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc (patch)
tree68cb5ef9081156392f1dd62a00c6ccc1451b93df /epan/dissectors/packet-atalk.c
parentInitial commit. (diff)
downloadwireshark-e4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc.tar.xz
wireshark-e4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc.zip
Adding upstream version 4.2.2.upstream/4.2.2
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'epan/dissectors/packet-atalk.c')
-rw-r--r--epan/dissectors/packet-atalk.c2186
1 files changed, 2186 insertions, 0 deletions
diff --git a/epan/dissectors/packet-atalk.c b/epan/dissectors/packet-atalk.c
new file mode 100644
index 00000000..396e7af5
--- /dev/null
+++ b/epan/dissectors/packet-atalk.c
@@ -0,0 +1,2186 @@
+/* packet-atalk.c
+ * Routines for AppleTalk packet disassembly: LLAP, DDP, NBP, ATP, ASP,
+ * RTMP, PAP.
+ *
+ * Simon Wilkinson <sxw@dcs.ed.ac.uk>
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "config.h"
+
+
+#include <epan/packet.h>
+#include <epan/etypes.h>
+#include <epan/ppptypes.h>
+#include <epan/aftypes.h>
+#include <epan/arcnet_pids.h>
+#include <epan/oui.h>
+#include <epan/conversation.h>
+#include <epan/prefs.h>
+#include <epan/reassemble.h>
+#include <epan/address_types.h>
+#include <epan/to_str.h>
+#include <epan/expert.h>
+#include "packet-llc.h"
+#include <epan/capture_dissectors.h>
+#include "packet-atalk.h"
+#include "packet-afp.h"
+
+void proto_register_atalk(void);
+void proto_reg_handoff_atalk(void);
+
+/* Tables for reassembly of fragments. */
+static reassembly_table atp_reassembly_table;
+
+/* desegmentation of ATP */
+static gboolean atp_defragment = TRUE;
+
+static dissector_handle_t afp_handle;
+static dissector_handle_t afp_server_status_handle;
+static dissector_handle_t nbp_handle;
+static dissector_handle_t rtmp_request_handle;
+static dissector_handle_t atp_handle;
+static dissector_handle_t zip_ddp_handle;
+static dissector_handle_t rtmp_data_handle;
+static dissector_handle_t llap_handle;
+static capture_dissector_handle_t llap_cap_handle;
+
+
+static int proto_llap = -1;
+static int hf_llap_dst = -1;
+static int hf_llap_src = -1;
+static int hf_llap_type = -1;
+
+static int hf_llc_apple_atalk_pid = -1;
+
+/*
+ * See Inside AppleTalk.
+ */
+#define APPLE_PID_ATALK 0x809B
+
+static const value_string apple_atalk_pid_vals[] = {
+ {APPLE_PID_ATALK, "AppleTalk"},
+ {0, NULL}
+};
+
+static int proto_ddp = -1;
+static int hf_ddp_hopcount = -1;
+static int hf_ddp_len = -1;
+static int hf_ddp_checksum = -1;
+static int hf_ddp_dst = -1;
+static int hf_ddp_dst_net = -1;
+static int hf_ddp_src = -1;
+static int hf_ddp_src_net = -1;
+static int hf_ddp_dst_node = -1;
+static int hf_ddp_src_node = -1;
+static int hf_ddp_dst_socket = -1;
+static int hf_ddp_src_socket = -1;
+static int hf_ddp_type = -1;
+
+static dissector_handle_t ddp_handle;
+static dissector_handle_t ddp_short_handle;
+
+/* --------------------------------------
+ * ATP protocol parameters
+ * from netatalk/include/atalk/atp.h
+ */
+#define ATP_MAXDATA (578+4) /* maximum ATP data size */
+#define ATP_BUFSIZ 587 /* maximum packet size */
+#define ATP_HDRSIZE 5 /* includes DDP type field */
+
+#define ATP_TRELMASK 0x07 /* mask all but TREL */
+#define ATP_RELTIME 30 /* base release timer (in secs) */
+
+#define ATP_TREL30 0x0 /* release time codes */
+#define ATP_TREL1M 0x1 /* these are passed in flags of */
+#define ATP_TREL2M 0x2 /* atp_sreq call, and set in the */
+#define ATP_TREL4M 0x3 /* packet control info. */
+#define ATP_TREL8M 0x4
+
+/* flags for ATP options (and control byte)
+*/
+#define ATP_XO 0x20 /* (1<<5) eXactly Once mode */
+#define ATP_EOM 0x10 /* (1<<4) End Of Message */
+#define ATP_STS 0x08 /* (1<<3) Transaction Status */
+
+/* function codes
+*/
+#define ATP_FUNCMASK (3<<6) /* mask all but function */
+
+#define ATP_TREQ 1 /* (1<<6) Trans. REQuest */
+#define ATP_TRESP 2 /* (2<<6) Trans. RESPonse */
+#define ATP_TREL 3 /* (3<<6) Trans. RELease */
+
+/* ------------------------- */
+static dissector_handle_t asp_handle;
+static dissector_handle_t pap_handle;
+
+static int proto_atp = -1;
+static int hf_atp_ctrlinfo = -1; /* guint8_t control information */
+static int hf_atp_function = -1; /* bits 7,6 function */
+static int hf_atp_xo = -1; /* bit 5 exactly-once */
+static int hf_atp_eom = -1; /* bit 4 end-of-message */
+static int hf_atp_sts = -1; /* bit 3 send transaction status */
+static int hf_atp_treltimer = -1; /* bits 2,1,0 TRel timeout indicator */
+
+static int hf_atp_bitmap = -1; /* guint8_t bitmap or sequence number */
+static int hf_atp_tid = -1; /* guint16_t transaction id. */
+static int hf_atp_user_bytes = -1;
+
+static int hf_atp_segments = -1;
+static int hf_atp_segment = -1;
+static int hf_atp_segment_overlap = -1;
+static int hf_atp_segment_overlap_conflict = -1;
+static int hf_atp_segment_multiple_tails = -1;
+static int hf_atp_segment_too_long_segment = -1;
+static int hf_atp_segment_error = -1;
+static int hf_atp_segment_count = -1;
+static int hf_atp_reassembled_in = -1;
+static int hf_atp_reassembled_length = -1;
+
+/* ------------------------- */
+static int proto_zip = -1;
+static dissector_handle_t zip_atp_handle;
+
+static int hf_zip_function = -1;
+static int hf_zip_atp_function = -1;
+static int hf_zip_start_index = -1;
+static int hf_zip_count = -1;
+static int hf_zip_zero_value = -1;
+
+static int hf_zip_network_count = -1;
+static int hf_zip_network = -1;
+static int hf_zip_network_start = -1;
+static int hf_zip_network_end = -1;
+
+static int hf_zip_flags = -1;
+static int hf_zip_flags_zone_invalid = -1;
+static int hf_zip_flags_use_broadcast = -1;
+static int hf_zip_flags_only_one_zone = -1;
+
+static int hf_zip_last_flag = -1;
+
+static int hf_zip_zone_name = -1;
+static int hf_zip_default_zone = -1;
+
+static int hf_zip_multicast_length = -1;
+static int hf_zip_multicast_address = -1;
+
+static const value_string zip_function_vals[] = {
+ {1, "Query"},
+ {2, "Reply"},
+ {5, "GetNetInfo request"},
+ {6, "GetNetInfo reply"},
+ {7, "notify"},
+ {8, "Extended reply"},
+ {0, NULL}
+};
+static value_string_ext zip_function_vals_ext = VALUE_STRING_EXT_INIT(zip_function_vals);
+
+static const value_string zip_atp_function_vals[] = {
+ {7, "GetMyZone"},
+ {8, "GetZoneList"},
+ {9, "GetLocalZones"},
+ {0, NULL}
+};
+
+static gint ett_zip = -1;
+static gint ett_zip_flags = -1;
+static gint ett_zip_zones_list = -1;
+static gint ett_zip_network_list = -1;
+
+/* --------------------------------
+ * from netatalk/include/atalk/ats.h
+ */
+
+#define ASPFUNC_CLOSE 1
+#define ASPFUNC_CMD 2
+#define ASPFUNC_STAT 3
+#define ASPFUNC_OPEN 4
+#define ASPFUNC_TICKLE 5
+#define ASPFUNC_WRITE 6
+#define ASPFUNC_WRTCONT 7
+#define ASPFUNC_ATTN 8
+
+#define ASP_HDRSIZ 4
+#define ASPERR_OK 0
+#define ASPERR_BADVERS (-1066)
+#define ASPERR_BUFSMALL (-1067)
+#define ASPERR_NOSESS (-1068)
+#define ASPERR_NOSERV (-1069)
+#define ASPERR_PARM (-1070)
+#define ASPERR_SERVBUSY (-1071)
+#define ASPERR_SESSCLOS (-1072)
+#define ASPERR_SIZERR (-1073)
+#define ASPERR_TOOMANY (-1074)
+#define ASPERR_NOACK (-1075)
+
+static int proto_asp = -1;
+static int hf_asp_func = -1;
+static int hf_asp_error = -1;
+static int hf_asp_socket = -1;
+static int hf_asp_version = -1;
+static int hf_asp_session_id = -1;
+static int hf_asp_zero_value = -1;
+static int hf_asp_init_error = -1;
+static int hf_asp_attn_code = -1;
+static int hf_asp_seq = -1;
+static int hf_asp_size = -1;
+
+typedef struct {
+ guint32 conversation;
+ guint8 src[4];
+ guint16 tid;
+} asp_request_key;
+
+typedef struct {
+ guint8 value; /* command for asp, bitmap for atp */
+} asp_request_val;
+
+static wmem_map_t *asp_request_hash = NULL;
+
+/* Hash Functions */
+static gint asp_equal (gconstpointer v, gconstpointer v2)
+{
+ const asp_request_key *val1 = (const asp_request_key*)v;
+ const asp_request_key *val2 = (const asp_request_key*)v2;
+
+ if (val1->conversation == val2->conversation &&
+ val1->tid == val2->tid &&
+ !memcmp(val1->src, val2->src, 4)) {
+ return 1;
+ }
+ return 0;
+}
+
+static guint asp_hash (gconstpointer v)
+{
+ const asp_request_key *asp_key = (const asp_request_key*)v;
+ return asp_key->tid;
+}
+
+/* ------------------------------------ */
+static wmem_map_t *atp_request_hash = NULL;
+
+
+/* ------------------------------------ */
+static int proto_nbp = -1;
+static int hf_nbp_op = -1;
+static int hf_nbp_info = -1;
+static int hf_nbp_count = -1;
+static int hf_nbp_tid = -1;
+
+static int hf_nbp_node_net = -1;
+static int hf_nbp_node_port = -1;
+static int hf_nbp_node_node = -1;
+static int hf_nbp_node_enum = -1;
+static int hf_nbp_node_object = -1;
+static int hf_nbp_node_type = -1;
+static int hf_nbp_node_zone = -1;
+
+static int proto_rtmp = -1;
+static int hf_rtmp_net = -1;
+static int hf_rtmp_node_len = -1;
+static int hf_rtmp_node = -1;
+static int hf_rtmp_tuple_net = -1;
+static int hf_rtmp_tuple_range_start = -1;
+static int hf_rtmp_tuple_range_end = -1;
+static int hf_rtmp_tuple_dist = -1;
+static int hf_rtmp_version = -1;
+static int hf_rtmp_function = -1;
+
+static gint ett_atp = -1;
+
+static gint ett_atp_segments = -1;
+static gint ett_atp_segment = -1;
+static gint ett_atp_info = -1;
+static gint ett_asp = -1;
+static gint ett_pap = -1;
+
+static gint ett_nbp = -1;
+static gint ett_nbp_info = -1;
+static gint ett_nbp_node = -1;
+static gint ett_rtmp = -1;
+static gint ett_rtmp_tuple = -1;
+static gint ett_ddp = -1;
+static gint ett_llap = -1;
+static gint ett_pstring = -1;
+
+static expert_field ei_ddp_len_invalid = EI_INIT;
+
+static const fragment_items atp_frag_items = {
+ &ett_atp_segment,
+ &ett_atp_segments,
+ &hf_atp_segments,
+ &hf_atp_segment,
+ &hf_atp_segment_overlap,
+ &hf_atp_segment_overlap_conflict,
+ &hf_atp_segment_multiple_tails,
+ &hf_atp_segment_too_long_segment,
+ &hf_atp_segment_error,
+ &hf_atp_segment_count,
+ &hf_atp_reassembled_in,
+ &hf_atp_reassembled_length,
+ /* Reassembled data field */
+ NULL,
+ "segments"
+};
+
+/* -------------------------------- */
+
+#define PAPOpenConn 1
+#define PAPOpenConnReply 2
+#define PAPSendData 3
+#define PAPData 4
+#define PAPTickle 5
+#define PAPCloseConn 6
+#define PAPCloseConnReply 7
+#define PAPSendStatus 8
+#define PAPStatus 9
+
+static int proto_pap = -1;
+
+static int hf_pap_connid = -1;
+static int hf_pap_function = -1;
+static int hf_pap_socket = -1;
+static int hf_pap_quantum = -1;
+static int hf_pap_waittime = -1;
+static int hf_pap_result = -1;
+static int hf_pap_status = -1;
+static int hf_pap_seq = -1;
+static int hf_pap_eof = -1;
+
+static int hf_pap_pad = -1;
+
+static int atalk_address_type = -1;
+
+static const value_string pap_function_vals[] = {
+ {PAPOpenConn , "Open Connection Query"},
+ {PAPOpenConnReply , "Open Connection Reply"},
+ {PAPSendData , "Send Data"},
+ {PAPData , "Data"},
+ {PAPTickle , "Tickle"},
+ {PAPCloseConn , "Close Connection Query"},
+ {PAPCloseConnReply , "Close Connection reply"},
+ {PAPSendStatus , "Send Status"},
+ {PAPStatus , "Status"},
+
+ {0, NULL}
+};
+static value_string_ext pap_function_vals_ext = VALUE_STRING_EXT_INIT(pap_function_vals);
+
+/* -------------------------------- */
+
+static dissector_table_t ddp_dissector_table;
+
+#define DDP_SHORT_HEADER_SIZE 5
+
+#define DDP_HEADER_SIZE 13
+
+
+static const value_string op_vals[] = {
+ {DDP_RTMPDATA, "AppleTalk Routing Table response or data" },
+ {DDP_NBP, "AppleTalk Name Binding Protocol packet"},
+ {DDP_ATP, "AppleTalk Transaction Protocol packet"},
+ {DDP_AEP, "AppleTalk Echo Protocol packet"},
+ {DDP_RTMPREQ, "AppleTalk Routing Table request"},
+ {DDP_ZIP, "AppleTalk Zone Information Protocol packet"},
+ {DDP_ADSP, "AppleTalk Data Stream Protocol"},
+ {DDP_EIGRP, "Cisco EIGRP for AppleTalk"},
+ {0, NULL}
+};
+static value_string_ext op_vals_ext = VALUE_STRING_EXT_INIT(op_vals);
+
+static const value_string rtmp_function_vals[] = {
+ {1, "Request"},
+ {2, "Route Data Request (split horizon processed)"},
+ {3, "Route Data Request (no split horizon processing)"},
+ {0, NULL}
+};
+
+#define NBP_BROADCAST 1
+#define NBP_LOOKUP 2
+#define NBP_FORWARD 4
+#define NBP_REPLY 3
+
+static const value_string nbp_op_vals[] = {
+ {NBP_BROADCAST, "broadcast request"},
+ {NBP_LOOKUP, "lookup"},
+ {NBP_FORWARD, "forward request"},
+ {NBP_REPLY, "reply"},
+ {0, NULL}
+};
+
+static const value_string atp_function_vals[] = {
+ {ATP_TREQ ,"REQuest"},
+ {ATP_TRESP ,"RESPonse"},
+ {ATP_TREL ,"RELease"},
+ {0, NULL}
+};
+
+static const value_string atp_trel_timer_vals[] = {
+ {0, "30 seconds"},
+ {1, "1 minute"},
+ {2, "2 minutes"},
+ {3, "4 minutes"},
+ {4, "8 minutes"},
+ {0, NULL}
+};
+
+/*
+*/
+static const value_string asp_func_vals[] = {
+ {ASPFUNC_CLOSE, "CloseSession" },
+ {ASPFUNC_CMD, "Command" },
+ {ASPFUNC_STAT, "GetStatus" },
+ {ASPFUNC_OPEN, "OpenSession" },
+ {ASPFUNC_TICKLE, "Tickle" },
+ {ASPFUNC_WRITE, "Write" },
+ {ASPFUNC_WRTCONT, "Write Cont" },
+ {ASPFUNC_ATTN, "Attention" },
+ {0, NULL } };
+static value_string_ext asp_func_vals_ext = VALUE_STRING_EXT_INIT(asp_func_vals);
+
+/* XXX: Array sorted in ascending order (unsigned) to allow value_string_ext binary search */
+static const value_string asp_error_vals[] = {
+ {AFP_OK , "success"},
+ {AFPERR_USRLOGIN , "user already logged on" },
+ {AFPERR_PWDPOLCY , "password fails policy check" },
+ {AFPERR_PWDCHNG , "password needs to be changed" },
+ {AFPERR_INTRASH , "shared folder in trash." },
+ {AFPERR_INSHRD , "folder being shared is inside a shared folder." },
+ {AFPERR_PWDEXPR , "password expired" },
+ {AFPERR_PWDSHORT , "password too short" },
+ {AFPERR_PWDSAME , "same password/can't change password" },
+ {AFPERR_BADID , "non-existent file id" },
+ {AFPERR_SAMEOBJ , "source file == destination file" },
+ {AFPERR_CATCHNG , "catalog has changed" },
+ {AFPERR_DIFFVOL , "different volume" },
+ {AFPERR_EXISTID , "file already has an id" },
+ {AFPERR_NOID , "file thread not found" },
+ {AFPERR_CTNSHRD , "share point contains a share point" },
+ {AFPERR_OLOCK , "object locked" },
+ {AFPERR_VLOCK , "volume locked" },
+ {AFPERR_ITYPE , "wrong icon type" },
+ {AFPERR_NODIR , "couldn't find directory" },
+ {AFPERR_NORENAME , "can't rename" },
+ {AFPERR_SHUTDOWN , "server is going down" },
+ {AFPERR_NFILE , "too many files open" },
+ {AFPERR_BADTYPE , "object is the wrong type" },
+ {AFPERR_NOOP , "command not supported" },
+ {AFPERR_NOTAUTH , "user not authenticated" },
+ {AFPERR_SESSCLOS , "session closed" },
+ {AFPERR_RANGEOVR , "range overlap" },
+ {AFPERR_NORANGE , "no range lock" },
+ {AFPERR_PARAM , "parameter error" },
+ {AFPERR_NOOBJ , "object not found" },
+ {AFPERR_EXIST , "object already exists" },
+ {AFPERR_NOSRVR , "no response by server at that address" },
+ {AFPERR_NLOCK , "no more locks" },
+ {AFPERR_MISC , "misc. err" },
+ {AFPERR_LOCK , "LockErr" },
+ {AFPERR_NOITEM , "ItemNotFound" },
+ {AFPERR_FLATVOL , "volume doesn't support directories" },
+ {AFPERR_BUSY , "FileBusy" },
+ {AFPERR_EOF , "end of file" },
+ {AFPERR_DFULL , "disk full" },
+ {AFPERR_DIRNEMPT , "directory not empty" },
+ {AFPERR_DENYCONF , "file synchronization locks conflict" },
+ {AFPERR_CANTMOVE , "can't move file" },
+ {AFPERR_BITMAP , "invalid bitmap" },
+ {AFPERR_BADVERS , "bad afp version number" },
+ {AFPERR_BADUAM , "uam doesn't exist" },
+ {AFPERR_AUTHCONT , "logincont" },
+ {AFPERR_ACCESS , "permission denied" },
+ {ASPERR_SESSCLOS , "session closed (ASP)" },
+ {ASPERR_NOSESS , "no more sessions available"},
+ {0, NULL } };
+value_string_ext asp_error_vals_ext = VALUE_STRING_EXT_INIT(asp_error_vals);
+
+/*
+ * hf_index must be a FT_UINT_STRING type
+ * Are these always in a Mac extended character set? Should we have a
+ * preference to allow different character sets to be selected?
+ */
+static int dissect_pascal_string(tvbuff_t *tvb, int offset, proto_tree *tree,
+ int hf_index)
+{
+ int len;
+
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(tree, hf_index, tvb, offset, 1, ENC_MAC_ROMAN|ENC_BIG_ENDIAN);
+
+ offset += (len+1);
+
+ return offset;
+}
+
+static int
+dissect_rtmp_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
+ proto_tree *rtmp_tree;
+ proto_item *ti;
+ guint8 function;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "RTMP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ function = tvb_get_guint8(tvb, 0);
+
+ col_add_str(pinfo->cinfo, COL_INFO,
+ val_to_str(function, rtmp_function_vals, "Unknown function (%02x)"));
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_rtmp, tvb, 0, 1, ENC_NA);
+ rtmp_tree = proto_item_add_subtree(ti, ett_rtmp);
+
+ proto_tree_add_uint(rtmp_tree, hf_rtmp_function, tvb, 0, 1, function);
+ }
+ return tvb_captured_length(tvb);
+}
+
+static int
+dissect_rtmp_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
+ proto_tree *rtmp_tree;
+ proto_item *ti;
+ int offset = 0;
+ guint16 net;
+ guint8 nodelen,nodelen_bits;
+ guint16 node; /* might be more than 8 bits */
+ int i;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "RTMP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ net = tvb_get_ntohs(tvb, offset);
+ nodelen_bits = tvb_get_guint8(tvb, offset+2);
+ if ( nodelen_bits <= 8 ) {
+ node = tvb_get_guint8(tvb, offset+3);
+ nodelen = 1;
+ } else {
+ node = tvb_get_ntohs(tvb, offset+3);
+ nodelen = 2;
+ }
+
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Net: %u Node Len: %u Node: %u",
+ net, nodelen_bits, node);
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_rtmp, tvb, offset, -1, ENC_NA);
+ rtmp_tree = proto_item_add_subtree(ti, ett_rtmp);
+
+ proto_tree_add_uint(rtmp_tree, hf_rtmp_net, tvb, offset, 2, net);
+ proto_tree_add_uint(rtmp_tree, hf_rtmp_node_len, tvb, offset+2, 1,
+ nodelen_bits);
+ proto_tree_add_uint(rtmp_tree, hf_rtmp_node, tvb, offset+3, nodelen,
+ node);
+ offset += 3 + nodelen;
+
+ /*
+ * Peek at what is purportedly the first tuple. If the net is 0,
+ * this is a version-number indicator for a non-extended network,
+ * not a tuple; the version number field may have the 0x80 bit set,
+ * but it's not a 6-octet tuple.
+ */
+ if (tvb_get_ntohs(tvb, offset) == 0) {
+ proto_tree_add_item(rtmp_tree, hf_rtmp_version, tvb, offset+2, 1, ENC_BIG_ENDIAN);
+ offset += 3;
+ }
+
+ i = 1;
+ while (tvb_offset_exists(tvb, offset)) {
+ proto_tree *tuple_tree;
+ guint16 tuple_net;
+ guint8 tuple_dist;
+ guint16 tuple_range_end;
+ guint8 version;
+
+ tuple_net = tvb_get_ntohs(tvb, offset);
+ tuple_dist = tvb_get_guint8(tvb, offset+2);
+
+ if (tuple_dist & 0x80) {
+ /*
+ * Extended network tuple.
+ */
+ tuple_range_end = tvb_get_ntohs(tvb, offset+3);
+ version = tvb_get_guint8(tvb, offset+5);
+ if (i == 1) {
+ /*
+ * For the first tuple, the last octet is a version number.
+ */
+ tuple_tree = proto_tree_add_subtree_format(rtmp_tree, tvb, offset, 6,
+ ett_rtmp_tuple, NULL,
+ "Tuple %d: Range Start: %u Dist: %u Range End: %u Version: 0x%02x",
+ i, tuple_net, tuple_dist&0x7F,
+ tuple_range_end, version);
+ } else {
+ tuple_tree = proto_tree_add_subtree_format(rtmp_tree, tvb, offset, 6,
+ ett_rtmp_tuple, NULL,
+ "Tuple %d: Range Start: %u Dist: %u Range End: %u",
+ i, tuple_net, tuple_dist&0x7F,
+ tuple_range_end);
+ }
+ proto_tree_add_uint(tuple_tree, hf_rtmp_tuple_range_start, tvb, offset, 2,
+ tuple_net);
+ proto_tree_add_uint(tuple_tree, hf_rtmp_tuple_dist, tvb, offset+2, 1,
+ tuple_dist & 0x7F);
+ proto_tree_add_item(tuple_tree, hf_rtmp_tuple_range_end, tvb, offset+3, 2,
+ ENC_BIG_ENDIAN);
+
+ if (i == 1)
+ proto_tree_add_uint(tuple_tree, hf_rtmp_version, tvb, offset+5, 1, version);
+ offset += 6;
+ } else {
+ /*
+ * Non-extended network tuple.
+ */
+ tuple_tree = proto_tree_add_subtree_format(rtmp_tree, tvb, offset, 3,
+ ett_rtmp_tuple, NULL,
+ "Tuple %d: Net: %u Dist: %u",
+ i, tuple_net, tuple_dist);
+ proto_tree_add_uint(tuple_tree, hf_rtmp_tuple_net, tvb, offset, 2,
+ tuple_net);
+ proto_tree_add_uint(tuple_tree, hf_rtmp_tuple_dist, tvb, offset+2, 1,
+ tuple_dist);
+ offset += 3;
+ }
+
+ i++;
+ }
+ }
+ return tvb_captured_length(tvb);
+}
+
+static int
+dissect_nbp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
+ proto_tree *nbp_tree;
+ proto_tree *nbp_info_tree;
+ proto_item *ti, *info_item;
+ int offset = 0;
+ guint8 info;
+ guint op, count;
+ guint i;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "NBP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ info = tvb_get_guint8(tvb, offset);
+ op = info >> 4;
+ count = info & 0x0F;
+
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Op: %s Count: %u",
+ val_to_str(op, nbp_op_vals, "Unknown (0x%01x)"), count);
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_nbp, tvb, offset, -1, ENC_NA);
+ nbp_tree = proto_item_add_subtree(ti, ett_nbp);
+
+ info_item = proto_tree_add_uint_format(nbp_tree, hf_nbp_info, tvb, offset, 1,
+ info,
+ "Info: 0x%01X Operation: %s Count: %u", info,
+ val_to_str(op, nbp_op_vals, "Unknown (0x%01X)"),
+ count);
+ nbp_info_tree = proto_item_add_subtree(info_item, ett_nbp_info);
+ proto_tree_add_uint(nbp_info_tree, hf_nbp_op, tvb, offset, 1, info);
+ proto_tree_add_uint(nbp_info_tree, hf_nbp_count, tvb, offset, 1, info);
+ proto_tree_add_item(nbp_tree, hf_nbp_tid, tvb, offset+1, 1, ENC_BIG_ENDIAN);
+ offset += 2;
+
+ for (i = 0; i < count; i++) {
+ proto_tree *node_item,*node_tree;
+ int soffset = offset;
+
+ node_tree = proto_tree_add_subtree_format(nbp_tree, tvb, offset, -1,
+ ett_nbp_node, &node_item, "Node %u", i+1);
+
+ proto_tree_add_item(node_tree, hf_nbp_node_net, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ proto_tree_add_item(node_tree, hf_nbp_node_node, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(node_tree, hf_nbp_node_port, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(node_tree, hf_nbp_node_enum, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+
+ offset = dissect_pascal_string(tvb, offset, node_tree, hf_nbp_node_object);
+ offset = dissect_pascal_string(tvb, offset, node_tree, hf_nbp_node_type);
+ offset = dissect_pascal_string(tvb, offset, node_tree, hf_nbp_node_zone);
+
+ proto_item_set_len(node_item, offset-soffset);
+ }
+ }
+
+ return tvb_captured_length(tvb);
+}
+
+/* -----------------------------
+ ATP protocol cf. inside appletalk chap. 9
+ desegmentation from packet-ieee80211.c
+*/
+static int
+dissect_atp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
+ proto_tree *atp_tree = NULL;
+ proto_item *ti;
+ proto_tree *atp_info_tree;
+ proto_item *info_item;
+ int offset = 0;
+ guint8 ctrlinfo;
+ guint8 frag_number = 0;
+ guint op;
+ guint16 tid;
+ guint8 query;
+ struct atp_asp_dsi_info atp_asp_dsi_info;
+ tvbuff_t *new_tvb = NULL;
+ gboolean save_fragmented;
+ gboolean more_fragment = FALSE;
+ int len;
+ guint8 bitmap;
+ guint8 nbe = 0;
+ guint8 t = 0;
+ conversation_t *conversation;
+ asp_request_val *request_val = NULL;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "ATP");
+
+ ctrlinfo = tvb_get_guint8(tvb, offset);
+ bitmap = tvb_get_guint8(tvb, offset +1);
+ tid = tvb_get_ntohs(tvb, offset +2);
+
+ t = bitmap;
+ while(t) {
+ nbe++;
+ t >>= 1;
+ }
+
+ op = ctrlinfo >> 6;
+
+ atp_asp_dsi_info.reply = (0x80 == (ctrlinfo & ATP_FUNCMASK))?1:0;
+ atp_asp_dsi_info.release = (0xC0 == (ctrlinfo & ATP_FUNCMASK))?1:0;
+ atp_asp_dsi_info.tid = tid;
+ atp_asp_dsi_info.code = 0;
+ query = (!atp_asp_dsi_info.reply && !atp_asp_dsi_info.release);
+
+ conversation = find_or_create_conversation(pinfo);
+
+ if (atp_defragment) {
+ asp_request_key request_key;
+
+ request_key.conversation = conversation->conv_index;
+ memcpy(request_key.src, (!atp_asp_dsi_info.reply)?pinfo->src.data:pinfo->dst.data, 4);
+ request_key.tid = atp_asp_dsi_info.tid;
+
+ request_val = (asp_request_val *) wmem_map_lookup(atp_request_hash, &request_key);
+
+ if (!request_val && query && nbe > 1) {
+ asp_request_key *new_request_key;
+
+ /* only save nbe packets if more than 1 requested
+ save some memory and help the defragmentation if tid wraparound, ie
+ we have both a request for 1 packet and a request for n packets,
+ hopefully most of the time ATP_EOM will be set in the last packet.
+ */
+ new_request_key = wmem_new(wmem_file_scope(), asp_request_key);
+ *new_request_key = request_key;
+
+ request_val = wmem_new(wmem_file_scope(), asp_request_val);
+ request_val->value = nbe;
+
+ wmem_map_insert(atp_request_hash, new_request_key,request_val);
+ }
+ }
+
+ /*
+ ATP_EOM is not mandatory. Some implementations don't always set it
+ if the query is only one packet.
+
+ So it needs to keep the number of packets asked in request.
+ */
+
+ if (atp_asp_dsi_info.reply) {
+ more_fragment = !(ATP_EOM & ctrlinfo) && request_val;
+ frag_number = bitmap;
+ }
+
+ col_clear(pinfo->cinfo, COL_INFO);
+ col_add_fstr(pinfo->cinfo, COL_INFO, "%s transaction %u",
+ val_to_str(op, atp_function_vals, "Unknown (0x%01x)"),tid);
+ if (more_fragment)
+ col_append_str(pinfo->cinfo, COL_INFO, " [fragment]");
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_atp, tvb, offset, -1, ENC_NA);
+ atp_tree = proto_item_add_subtree(ti, ett_atp);
+ proto_item_set_len(atp_tree, atp_asp_dsi_info.release?8:ATP_HDRSIZE -1);
+
+ info_item = proto_tree_add_item(atp_tree, hf_atp_ctrlinfo, tvb, offset, 1, ENC_BIG_ENDIAN);
+ atp_info_tree = proto_item_add_subtree(info_item, ett_atp_info);
+
+ proto_tree_add_item(atp_info_tree, hf_atp_function, tvb, offset, 1, ENC_BIG_ENDIAN);
+ proto_tree_add_item(atp_info_tree, hf_atp_xo, tvb, offset, 1, ENC_BIG_ENDIAN);
+ proto_tree_add_item(atp_info_tree, hf_atp_eom, tvb, offset, 1, ENC_BIG_ENDIAN);
+ proto_tree_add_item(atp_info_tree, hf_atp_sts, tvb, offset, 1, ENC_BIG_ENDIAN);
+ if ((ctrlinfo & (ATP_FUNCMASK|ATP_XO)) == (0x40|ATP_XO)) {
+ /* TReq with XO set */
+ proto_tree_add_item(atp_info_tree, hf_atp_treltimer, tvb, offset, 1, ENC_BIG_ENDIAN);
+ }
+ if (query) {
+ proto_tree_add_uint_format_value(atp_tree, hf_atp_bitmap, tvb, offset +1, 1,
+ bitmap, "0x%02x %u packet(s) max", bitmap, nbe);
+ }
+ else {
+ proto_tree_add_item(atp_tree, hf_atp_bitmap, tvb, offset +1, 1, ENC_BIG_ENDIAN);
+ }
+ proto_tree_add_item(atp_tree, hf_atp_tid, tvb, offset +2, 2, ENC_BIG_ENDIAN);
+
+ if (atp_asp_dsi_info.release)
+ proto_tree_add_item(atp_tree, hf_atp_user_bytes, tvb, offset +4, 4, ENC_BIG_ENDIAN);
+
+ }
+
+ if (atp_asp_dsi_info.release)
+ return tvb_captured_length(tvb);
+
+ save_fragmented = pinfo->fragmented;
+
+ /* FIXME
+ asp doesn't fit very well here
+ move asp back in atp?
+ */
+ if (atp_defragment && atp_asp_dsi_info.reply && (more_fragment || frag_number != 0)) {
+ fragment_head *fd_head;
+ int hdr;
+
+ hdr = ATP_HDRSIZE -1;
+ if (frag_number != 0)
+ hdr += 4; /* asp header */
+ len = tvb_reported_length_remaining(tvb, hdr);
+ fd_head = fragment_add_seq_check(&atp_reassembly_table,
+ tvb, hdr, pinfo, tid, NULL,
+ frag_number,
+ len,
+ more_fragment);
+ new_tvb = process_reassembled_data(tvb, ATP_HDRSIZE -1, pinfo,
+ "Reassembled ATP", fd_head, &atp_frag_items,
+ NULL, atp_tree);
+ }
+ else {
+ /* full packet */
+ new_tvb = tvb_new_subset_remaining(tvb, ATP_HDRSIZE -1 );
+ }
+
+ if (new_tvb) {
+ /* if port == 6 it's not an ASP packet but a ZIP packet */
+ if (pinfo->srcport == 6 || pinfo->destport == 6 )
+ call_dissector_with_data(zip_atp_handle, new_tvb, pinfo, tree, &atp_asp_dsi_info);
+ else {
+ /* XXX need a conversation_get_dissector function ? */
+ if (!atp_asp_dsi_info.reply && !conversation_get_dissector(conversation, pinfo->num)) {
+ dissector_handle_t sub;
+
+ /* if it's a known ASP function call ASP dissector
+ else assume it's a PAP connection ID.
+ the test is wrong because PAP conn IDs overlapped with ASP fn
+ but I don't want to keep track of NBP msgs and open connection
+ port allocation.
+ */
+ guint8 fn = tvb_get_guint8(new_tvb, 0);
+
+ if (!fn || fn > ASPFUNC_ATTN) {
+ sub = pap_handle;
+ }
+ else {
+ sub = asp_handle;
+ }
+ call_dissector_with_data(sub, new_tvb, pinfo, tree, &atp_asp_dsi_info);
+ conversation_set_dissector(conversation, sub);
+ }
+ else if (!try_conversation_dissector(&pinfo->src, &pinfo->dst, conversation_pt_to_conversation_type(pinfo->ptype),
+ pinfo->srcport, pinfo->destport, new_tvb,pinfo, tree, &atp_asp_dsi_info, 0)) {
+ call_data_dissector(new_tvb, pinfo, tree);
+
+ }
+ }
+ }
+ else {
+ /* Just show this as a fragment. */
+ new_tvb = tvb_new_subset_remaining (tvb, ATP_HDRSIZE -1);
+ call_data_dissector(new_tvb, pinfo, tree);
+ }
+ pinfo->fragmented = save_fragmented;
+ return tvb_captured_length(tvb);
+}
+
+/* -----------------------------
+ PAP protocol cf. inside appletalk chap. 10
+*/
+#define PAD(x) { proto_tree_add_item(pap_tree, hf_pap_pad, tvb, offset, x, ENC_NA); offset += x; }
+
+static int
+dissect_pap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
+{
+ int offset = 0;
+ guint8 fn;
+ guint8 connID;
+ proto_tree *pap_tree = NULL;
+ proto_item *ti;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "PAP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_pap, tvb, offset, -1, ENC_NA);
+ pap_tree = proto_item_add_subtree(ti, ett_pap);
+ }
+
+ connID = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(pap_tree, hf_pap_connid, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+
+ fn = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(pap_tree, hf_pap_function, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+
+ col_add_fstr(pinfo->cinfo, COL_INFO, "%s ID: %d",
+ val_to_str_ext(fn, &pap_function_vals_ext, "Unknown (0x%01x)"), connID);
+
+ switch(fn) {
+ case PAPOpenConn:
+ PAD(2);
+ proto_tree_add_item(pap_tree, hf_pap_socket, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(pap_tree, hf_pap_quantum, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(pap_tree, hf_pap_waittime, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ break;
+
+ case PAPOpenConnReply:
+ PAD(2);
+ proto_tree_add_item(pap_tree, hf_pap_socket, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(pap_tree, hf_pap_quantum, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(pap_tree, hf_pap_result, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ offset = dissect_pascal_string(tvb, offset, pap_tree, hf_pap_status);
+ break;
+
+ case PAPSendData:
+ proto_tree_add_item(pap_tree, hf_pap_seq, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ break;
+
+ case PAPData:
+ proto_tree_add_item(pap_tree, hf_pap_eof, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ PAD(1);
+ /* follow by data */
+ call_data_dissector(tvb_new_subset_remaining(tvb, offset), pinfo, tree);
+ break;
+
+ case PAPTickle:
+ case PAPCloseConn:
+ case PAPCloseConnReply:
+ PAD(2);
+ break;
+
+ case PAPSendStatus:
+ PAD(2);
+ break;
+
+ case PAPStatus:
+ PAD(2);
+ PAD(4);
+ offset = dissect_pascal_string(tvb, offset, pap_tree, hf_pap_status);
+ break;
+
+ default: /* unknown */
+ break;
+ }
+ return offset;
+}
+
+/* -----------------------------
+ ASP protocol cf. inside appletalk chap. 11
+*/
+static asp_request_val *
+get_transaction(tvbuff_t *tvb, packet_info *pinfo, struct atp_asp_dsi_info *atp_asp_dsi_info)
+{
+ conversation_t *conversation;
+ asp_request_key request_key, *new_request_key;
+ asp_request_val *request_val;
+ guint8 fn;
+
+ conversation = find_or_create_conversation(pinfo);
+
+ request_key.conversation = conversation->conv_index;
+ memcpy(request_key.src, (!atp_asp_dsi_info->reply)?pinfo->src.data:pinfo->dst.data, 4);
+ request_key.tid = atp_asp_dsi_info->tid;
+
+ request_val = (asp_request_val *) wmem_map_lookup(asp_request_hash, &request_key);
+ if (!request_val && !atp_asp_dsi_info->reply ) {
+ fn = tvb_get_guint8(tvb, 0);
+ new_request_key = wmem_new(wmem_file_scope(), asp_request_key);
+ *new_request_key = request_key;
+
+ request_val = wmem_new(wmem_file_scope(), asp_request_val);
+ request_val->value = fn;
+
+ wmem_map_insert(asp_request_hash, new_request_key, request_val);
+ }
+
+ return request_val;
+}
+
+
+static int
+dissect_asp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
+{
+ struct atp_asp_dsi_info *atp_asp_dsi_info;
+ asp_request_val *request_val;
+ int offset = 0;
+ proto_tree *asp_tree = NULL;
+ proto_item *ti;
+ guint8 fn;
+
+ /* Reject the packet if data is NULL */
+ if (data == NULL)
+ return 0;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "ASP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ atp_asp_dsi_info = (struct atp_asp_dsi_info *)data;
+ request_val = get_transaction(tvb, pinfo, atp_asp_dsi_info);
+ if (!request_val)
+ return 0;
+
+ fn = (guint8) request_val->value;
+
+ if (atp_asp_dsi_info->reply)
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Reply tid %u",atp_asp_dsi_info->tid);
+ else
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Function: %s tid %u",
+ val_to_str_ext(fn, &asp_func_vals_ext, "Unknown (0x%01x)"), atp_asp_dsi_info->tid);
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_asp, tvb, offset, -1, ENC_NA);
+ asp_tree = proto_item_add_subtree(ti, ett_asp);
+ }
+ if (!atp_asp_dsi_info->reply) {
+ tvbuff_t *new_tvb;
+ /* let the called deal with asp_tree == NULL */
+
+ proto_tree_add_item(asp_tree, hf_asp_func, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ switch(fn) {
+ case ASPFUNC_OPEN:
+ proto_tree_add_item(asp_tree, hf_asp_socket, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_version, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ break;
+ case ASPFUNC_TICKLE:
+ case ASPFUNC_CLOSE:
+ proto_tree_add_item(asp_tree, hf_asp_session_id, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 2, ENC_NA);
+ offset +=2;
+ break;
+ case ASPFUNC_STAT:
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 1, ENC_NA);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 2, ENC_NA);
+ offset += 2;
+ break;
+ case ASPFUNC_ATTN:
+ proto_tree_add_item(asp_tree, hf_asp_session_id, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_attn_code, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset +=2;
+ break;
+ case ASPFUNC_CMD:
+ case ASPFUNC_WRITE:
+ proto_item_set_len(asp_tree, 4);
+ proto_tree_add_item(asp_tree, hf_asp_session_id, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_seq, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ new_tvb = tvb_new_subset_remaining(tvb, offset);
+ call_dissector_with_data(afp_handle, new_tvb, pinfo, tree, atp_asp_dsi_info);
+ break;
+ case ASPFUNC_WRTCONT:
+ proto_tree_add_item(asp_tree, hf_asp_session_id, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_seq, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ proto_tree_add_item(asp_tree, hf_asp_size, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ break;
+ default:
+ proto_item_set_len(asp_tree, 4);
+ offset += 3;
+ call_data_dissector(tvb_new_subset_remaining(tvb, offset), pinfo, tree);
+ break;
+ }
+ }
+ else {
+ tvbuff_t *new_tvb;
+
+ proto_tree_add_uint(asp_tree, hf_asp_func, tvb, 0, 0, fn);
+ switch(fn) {
+ case ASPFUNC_OPEN:
+ proto_tree_add_item(asp_tree, hf_asp_socket, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_session_id, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_init_error, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ break;
+ case ASPFUNC_CLOSE:
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 1, ENC_NA);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 1, ENC_NA);
+ offset++;
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 2, ENC_NA);
+ offset += 2;
+ break;
+ case ASPFUNC_STAT:
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 4, ENC_NA);
+ offset += 4;
+ /* XXX - what if something other than AFP is running atop ASP? */
+ new_tvb = tvb_new_subset_remaining(tvb, offset);
+ call_dissector(afp_server_status_handle, new_tvb, pinfo, asp_tree);
+ break;
+ case ASPFUNC_CMD:
+ case ASPFUNC_WRITE:
+ proto_item_set_len(asp_tree, 4);
+ atp_asp_dsi_info->code = tvb_get_ntohl(tvb, offset);
+ proto_tree_add_item(asp_tree, hf_asp_error, tvb, offset, 4, ENC_BIG_ENDIAN);
+ offset += 4;
+ new_tvb = tvb_new_subset_remaining(tvb, offset);
+ call_dissector_with_data(afp_handle, new_tvb, pinfo, tree, atp_asp_dsi_info);
+ break;
+ case ASPFUNC_TICKLE:
+ case ASPFUNC_WRTCONT:
+ proto_tree_add_item(asp_tree, hf_asp_zero_value, tvb, offset, 4, ENC_NA);
+ /* FALL THROUGH */
+ case ASPFUNC_ATTN: /* FIXME capture and spec disagree */
+ default:
+ proto_item_set_len(asp_tree, 4);
+ offset += 4;
+ call_data_dissector(tvb_new_subset_remaining(tvb, offset), pinfo, tree);
+ break;
+ }
+ }
+ return offset;
+}
+
+/* -----------------------------
+ ZIP protocol cf. inside appletalk chap. 8
+*/
+/*
+ * Structure used to represent a DDP address; gives the layout of the
+ * data pointed to by an Appletalk "address" structure.
+ */
+struct atalk_ddp_addr {
+ guint16 net;
+ guint8 node;
+};
+
+
+static int atalk_str_len(const address* addr _U_)
+{
+ return 8;
+}
+
+static int atalk_to_str(const address* addr, gchar *buf, int buf_len _U_)
+{
+ struct atalk_ddp_addr atalk;
+ memcpy(&atalk, addr->data, sizeof atalk);
+
+ buf = word_to_hex(buf, atalk.net);
+ *buf++ = '.';
+ buf = bytes_to_hexstr(buf, &atalk.node, 1);
+ *buf++ = '\0'; /* NULL terminate */
+
+ return atalk_str_len(addr);
+}
+
+static const char* atalk_col_filter_str(const address* addr _U_, gboolean is_src)
+{
+ if (is_src)
+ return "ddp.src";
+
+ return "ddp.dst";
+}
+
+static int atalk_len(void)
+{
+ return 3;
+}
+
+static int
+dissect_atp_zip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
+{
+ struct atp_asp_dsi_info *atp_asp_dsi_info;
+ asp_request_val *request_val;
+ int offset = 0;
+ proto_tree *zip_tree;
+ proto_tree *sub_tree;
+ proto_item *ti;
+ guint8 fn;
+ guint16 count;
+ guint8 len;
+
+ /* Reject the packet if data is NULL */
+ if (data == NULL)
+ return 0;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "ZIP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ atp_asp_dsi_info = (struct atp_asp_dsi_info *)data;
+ request_val = get_transaction(tvb, pinfo, atp_asp_dsi_info);
+ if (!request_val)
+ return tvb_reported_length(tvb);
+
+ fn = (guint8) request_val->value;
+
+ if (atp_asp_dsi_info->reply)
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Reply tid %u",atp_asp_dsi_info->tid);
+ else
+ col_add_fstr(pinfo->cinfo, COL_INFO, "Function: %s tid %u",
+ val_to_str(fn, zip_atp_function_vals, "Unknown (0x%01x)"), atp_asp_dsi_info->tid);
+
+ if (!tree)
+ return tvb_reported_length(tvb);
+
+ ti = proto_tree_add_item(tree, proto_zip, tvb, offset, -1, ENC_NA);
+ zip_tree = proto_item_add_subtree(ti, ett_zip);
+
+ if (!atp_asp_dsi_info->reply) {
+ proto_tree_add_item(zip_tree, hf_zip_atp_function, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ switch(fn) {
+ case 7: /* start_index = 0 */
+ case 8:
+ case 9:
+ proto_tree_add_item(zip_tree, hf_zip_zero_value, tvb, offset, 1, ENC_NA);
+ offset++;
+ proto_tree_add_item(zip_tree, hf_zip_start_index, tvb, offset, 2, ENC_BIG_ENDIAN);
+ break;
+ }
+ }
+ else {
+ guint i;
+
+ proto_tree_add_uint(zip_tree, hf_zip_atp_function, tvb, 0, 0, fn);
+ switch(fn) {
+ case 7:
+ case 8:
+ case 9:
+ proto_tree_add_item(zip_tree, hf_zip_last_flag, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+
+ proto_tree_add_item(zip_tree, hf_zip_zero_value, tvb, offset, 1, ENC_NA);
+ offset++;
+ count = tvb_get_ntohs(tvb, offset);
+ ti = proto_tree_add_item(zip_tree, hf_zip_count, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ sub_tree = proto_item_add_subtree(ti, ett_zip_zones_list);
+ for (i = 0; i < count; i++) {
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(sub_tree, hf_zip_zone_name, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ offset += len +1;
+ }
+ break;
+ }
+ }
+
+ return tvb_reported_length(tvb);
+}
+
+static int
+dissect_ddp_zip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
+{
+ proto_tree *zip_tree = NULL;
+ proto_item *ti;
+ guint8 fn;
+ guint8 len;
+ gint offset = 0;
+ proto_tree *sub_tree;
+ proto_tree *net_tree;
+ guint8 flag;
+ guint16 net;
+ guint i;
+ guint count;
+
+ static int * const zip_flags[] = {
+ &hf_zip_flags_zone_invalid,
+ &hf_zip_flags_use_broadcast,
+ &hf_zip_flags_only_one_zone,
+ NULL
+ };
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "ZIP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ fn = tvb_get_guint8(tvb, 0);
+ col_add_str(pinfo->cinfo, COL_INFO,
+ val_to_str_ext(fn, &zip_function_vals_ext, "Unknown ZIP function (%02x)"));
+
+ if (!tree)
+ return tvb_captured_length(tvb);
+
+ ti = proto_tree_add_item(tree, proto_zip, tvb, 0, -1, ENC_NA);
+ zip_tree = proto_item_add_subtree(ti, ett_zip);
+
+ proto_tree_add_item(zip_tree, hf_zip_function, tvb, offset, 1,ENC_BIG_ENDIAN);
+ offset++;
+ /* fn 1,7,2,8 are not tested */
+ switch (fn) {
+ case 1: /* Query */
+ count = tvb_get_guint8(tvb, offset);
+ ti = proto_tree_add_item(zip_tree, hf_zip_network_count, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ sub_tree = proto_item_add_subtree(ti, ett_zip_network_list);
+ for (i = 0; i < count; i++) {
+ proto_tree_add_item(sub_tree, hf_zip_network, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ }
+ break;
+ case 7: /* Notify */
+ proto_tree_add_bitmask(zip_tree, tvb, offset, hf_zip_flags, ett_zip_flags, zip_flags, ENC_NA);
+ offset++;
+
+ proto_tree_add_item(zip_tree, hf_zip_zero_value, tvb, offset, 4, ENC_NA);
+ offset += 4;
+
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(zip_tree, hf_zip_zone_name, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ offset += len +1;
+
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(zip_tree, hf_zip_multicast_length,tvb, offset, 1,ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(zip_tree, hf_zip_multicast_address,tvb, offset, len,ENC_NA);
+ offset += len;
+
+ proto_tree_add_item(zip_tree, hf_zip_zone_name, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ break;
+
+ case 2: /* Reply */
+ case 8: /* Extended Reply */
+ count = tvb_get_guint8(tvb, offset);
+ ti = proto_tree_add_item(zip_tree, hf_zip_network_count, tvb, offset, 1, ENC_BIG_ENDIAN);
+ offset++;
+ sub_tree = proto_item_add_subtree(ti, ett_zip_network_list);
+ for (i = 0; i < count; i++) {
+ net = tvb_get_ntohs(tvb, offset);
+ net_tree = proto_tree_add_subtree_format(sub_tree, tvb, offset, 2, ett_zip_network_list, &ti, "Zone for network: %u", net);
+ proto_tree_add_item(net_tree, hf_zip_network, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(net_tree, hf_zip_zone_name, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ offset += len +1;
+ proto_item_set_len(ti, len+3);
+ }
+ break;
+
+ case 5 : /* GetNetInfo request */
+ proto_tree_add_item(zip_tree, hf_zip_zero_value, tvb, offset, 1, ENC_NA);
+ offset++;
+ proto_tree_add_item(zip_tree, hf_zip_zero_value, tvb, offset, 4, ENC_NA);
+ offset += 4;
+ proto_tree_add_item(zip_tree, hf_zip_zone_name, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ break;
+
+ case 6 : /* GetNetInfo reply */
+ flag = tvb_get_guint8(tvb, offset);
+ proto_tree_add_bitmask(zip_tree, tvb, offset, hf_zip_flags, ett_zip_flags, zip_flags, ENC_NA);
+ offset++;
+
+ proto_tree_add_item(zip_tree, hf_zip_network_start, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+
+ proto_tree_add_item(zip_tree, hf_zip_network_end, tvb, offset, 2, ENC_BIG_ENDIAN);
+ offset += 2;
+
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(zip_tree, hf_zip_zone_name, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ offset += len +1;
+
+ len = tvb_get_guint8(tvb, offset);
+ proto_tree_add_item(zip_tree, hf_zip_multicast_length,tvb, offset, 1,ENC_BIG_ENDIAN);
+ offset++;
+ proto_tree_add_item(zip_tree, hf_zip_multicast_address,tvb, offset, len,ENC_NA);
+ offset += len;
+ if ((flag & 0x80) != 0)
+ proto_tree_add_item(zip_tree, hf_zip_default_zone, tvb, offset, 1,ENC_ASCII|ENC_BIG_ENDIAN);
+ break;
+
+ default:
+ break;
+ }
+ return tvb_captured_length(tvb);
+}
+
+typedef struct ddp_nodes
+{
+ guint8 dnode;
+ guint8 snode;
+
+} ddp_nodes_t;
+
+static int
+dissect_ddp_short(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
+{
+ guint16 len;
+ guint8 dport;
+ guint8 sport;
+ guint8 type;
+ proto_tree *ddp_tree = NULL;
+ proto_item *ti, *hidden_item, *len_item;
+ struct atalk_ddp_addr *src = wmem_new0(pinfo->pool, struct atalk_ddp_addr),
+ *dst = wmem_new0(pinfo->pool, struct atalk_ddp_addr);
+ tvbuff_t *new_tvb;
+ ddp_nodes_t *ddp_node = (ddp_nodes_t*)data;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "DDP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ if (tree) {
+ ti = proto_tree_add_item(tree, proto_ddp, tvb, 0, DDP_SHORT_HEADER_SIZE,
+ ENC_NA);
+ ddp_tree = proto_item_add_subtree(ti, ett_ddp);
+ }
+ len = tvb_get_ntohs(tvb, 0);
+ len_item = proto_tree_add_uint(ddp_tree, hf_ddp_len, tvb, 0, 2, len);
+ if (len < DDP_SHORT_HEADER_SIZE) {
+ expert_add_info_format(pinfo, len_item, &ei_ddp_len_invalid,
+ "Length field is shorter than the DDP header size");
+ len = DDP_SHORT_HEADER_SIZE;
+ } else {
+ /* Length of the payload following the DDP header */
+ guint reported_length = tvb_reported_length(tvb);
+ if (len > reported_length) {
+ expert_add_info_format(pinfo, len_item, &ei_ddp_len_invalid,
+ "Length field is larger than the remaining packet payload");
+ len = reported_length;
+ }
+ }
+ set_actual_length(tvb, len);
+ dport = tvb_get_guint8(tvb, 2);
+ if (tree)
+ proto_tree_add_uint(ddp_tree, hf_ddp_dst_socket, tvb, 2, 1, dport);
+ sport = tvb_get_guint8(tvb, 3);
+ if (tree)
+ proto_tree_add_uint(ddp_tree, hf_ddp_src_socket, tvb, 3, 1, sport);
+ type = tvb_get_guint8(tvb, 4);
+
+ src->net = 0;
+ src->node = ddp_node->snode;
+ dst->net = 0;
+ dst->node = ddp_node->dnode;
+ set_address(&pinfo->net_src, atalk_address_type, sizeof(struct atalk_ddp_addr), src);
+ copy_address_shallow(&pinfo->src, &pinfo->net_src);
+ set_address(&pinfo->net_dst, atalk_address_type, sizeof(struct atalk_ddp_addr), dst);
+ copy_address_shallow(&pinfo->dst, &pinfo->net_dst);
+
+ pinfo->ptype = PT_DDP;
+ pinfo->destport = dport;
+ pinfo->srcport = sport;
+
+ col_add_str(pinfo->cinfo, COL_INFO,
+ val_to_str_ext(type, &op_vals_ext, "Unknown DDP protocol (%02x)"));
+
+ if (tree) {
+ hidden_item = proto_tree_add_string(ddp_tree, hf_ddp_src, tvb,
+ 4, 3, address_to_str(pinfo->pool, &pinfo->src));
+ proto_item_set_hidden(hidden_item);
+ hidden_item = proto_tree_add_string(ddp_tree, hf_ddp_dst, tvb,
+ 6, 3, address_to_str(pinfo->pool, &pinfo->dst));
+ proto_item_set_hidden(hidden_item);
+
+ proto_tree_add_uint(ddp_tree, hf_ddp_type, tvb, 4, 1, type);
+ }
+ new_tvb = tvb_new_subset_remaining(tvb, DDP_SHORT_HEADER_SIZE);
+
+ if (!dissector_try_uint(ddp_dissector_table, type, new_tvb, pinfo, tree))
+ call_data_dissector(new_tvb, pinfo, tree);
+
+ return tvb_captured_length(tvb);
+}
+
+static int
+dissect_ddp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
+{
+ proto_tree *ddp_tree;
+ proto_item *ti, *hidden_item, *len_item;
+ struct atalk_ddp_addr *src = wmem_new0(pinfo->pool, struct atalk_ddp_addr),
+ *dst = wmem_new0(pinfo->pool, struct atalk_ddp_addr);
+ tvbuff_t *new_tvb;
+ guint type;
+ guint32 len;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "DDP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ pinfo->ptype = PT_DDP;
+
+ ti = proto_tree_add_item(tree, proto_ddp, tvb, 0, DDP_HEADER_SIZE, ENC_NA);
+ ddp_tree = proto_item_add_subtree(ti, ett_ddp);
+
+ hidden_item = proto_tree_add_string(ddp_tree, hf_ddp_src, tvb,
+ 4, 3, address_to_str(pinfo->pool, &pinfo->src));
+ proto_item_set_hidden(hidden_item);
+
+ hidden_item = proto_tree_add_string(ddp_tree, hf_ddp_dst, tvb,
+ 6, 3, address_to_str(pinfo->pool, &pinfo->dst));
+ proto_item_set_hidden(hidden_item);
+
+ proto_tree_add_item(ddp_tree, hf_ddp_hopcount, tvb, 0, 2, ENC_BIG_ENDIAN);
+ len_item = proto_tree_add_item_ret_uint(ddp_tree, hf_ddp_len, tvb, 0, 2, ENC_BIG_ENDIAN, &len);
+ if (len < DDP_HEADER_SIZE) {
+ expert_add_info_format(pinfo, len_item, &ei_ddp_len_invalid,
+ "Length field is shorter than the DDP header size");
+ len = DDP_HEADER_SIZE;
+ } else {
+ /* Length of the payload following the DDP header */
+ guint reported_length = tvb_reported_length(tvb);
+ if (len > reported_length) {
+ expert_add_info_format(pinfo, len_item, &ei_ddp_len_invalid,
+ "Length field is larger than the remaining packet payload");
+ len = reported_length;
+ }
+ }
+ set_actual_length(tvb, len);
+ proto_tree_add_checksum(ddp_tree, tvb, 2, hf_ddp_checksum, -1, NULL, pinfo, 0, ENC_BIG_ENDIAN, PROTO_CHECKSUM_NO_FLAGS);
+ dst->net = tvb_get_ntohs(tvb, 4);
+ proto_tree_add_uint(ddp_tree, hf_ddp_dst_net, tvb, 4, 2, dst->net);
+ src->net = tvb_get_ntohs(tvb, 6);
+ proto_tree_add_uint(ddp_tree, hf_ddp_src_net, tvb, 6, 2, src->net);
+ dst->node = tvb_get_guint8(tvb, 8);
+ proto_tree_add_uint(ddp_tree, hf_ddp_dst_node, tvb, 8, 1, dst->node);
+ src->node = tvb_get_guint8(tvb, 9);
+ proto_tree_add_uint(ddp_tree, hf_ddp_src_node, tvb, 9, 1, src->node);
+ proto_tree_add_item_ret_uint(ddp_tree, hf_ddp_dst_socket, tvb, 10, 1, ENC_NA, &pinfo->destport);
+ proto_tree_add_item_ret_uint(ddp_tree, hf_ddp_src_socket, tvb, 11, 1, ENC_NA, &pinfo->srcport);
+ proto_tree_add_item_ret_uint(ddp_tree, hf_ddp_type, tvb, 12, 1, ENC_NA, &type);
+
+ col_add_str(pinfo->cinfo, COL_INFO,
+ val_to_str_ext(type, &op_vals_ext, "Unknown DDP protocol (%02x)"));
+
+ set_address(&pinfo->net_src, atalk_address_type, sizeof(struct atalk_ddp_addr), src);
+ copy_address_shallow(&pinfo->src, &pinfo->net_src);
+ set_address(&pinfo->net_dst, atalk_address_type, sizeof(struct atalk_ddp_addr), dst);
+ copy_address_shallow(&pinfo->dst, &pinfo->net_dst);
+
+ new_tvb = tvb_new_subset_remaining(tvb, DDP_HEADER_SIZE);
+
+ if (!dissector_try_uint(ddp_dissector_table, type, new_tvb, pinfo, tree))
+ {
+ call_data_dissector(new_tvb, pinfo, tree);
+ }
+ return tvb_captured_length(tvb);
+}
+
+static const value_string llap_type_vals[] = {
+ {0x01, "Short DDP"},
+ {0x02, "DDP" },
+ {0x81, "Enquiry"},
+ {0x82, "Acknowledgement"},
+ {0x84, "RTS"},
+ {0x85, "CTS"},
+ {0, NULL}
+};
+static value_string_ext llap_type_vals_ext = VALUE_STRING_EXT_INIT(llap_type_vals);
+
+static gboolean
+capture_llap(const guchar *pd _U_, int offset _U_, int len _U_, capture_packet_info_t *cpinfo _U_, const union wtap_pseudo_header *pseudo_header _U_)
+{
+ /* XXX - get its own counter
+ counts->other++; */
+ return FALSE;
+}
+
+static int
+dissect_llap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
+{
+ ddp_nodes_t ddp_node;
+ guint8 type;
+ proto_tree *llap_tree;
+ proto_item *ti;
+ tvbuff_t *new_tvb;
+ guint new_reported_length;
+
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "LLAP");
+ col_clear(pinfo->cinfo, COL_INFO);
+
+ ti = proto_tree_add_item(tree, proto_llap, tvb, 0, 3, ENC_NA);
+ llap_tree = proto_item_add_subtree(ti, ett_llap);
+
+ ddp_node.dnode = tvb_get_guint8(tvb, 0);
+ proto_tree_add_uint(llap_tree, hf_llap_dst, tvb, 0, 1, ddp_node.dnode);
+
+ ddp_node.snode = tvb_get_guint8(tvb, 1);
+ proto_tree_add_uint(llap_tree, hf_llap_src, tvb, 1, 1, ddp_node.snode);
+
+ type = tvb_get_guint8(tvb, 2);
+ col_add_str(pinfo->cinfo, COL_INFO,
+ val_to_str_ext(type, &llap_type_vals_ext, "Unknown LLAP type (%02x)"));
+ proto_tree_add_uint(llap_tree, hf_llap_type, tvb, 2, 1, type);
+
+ new_tvb = tvb_new_subset_remaining(tvb, 3);
+
+ switch (type) {
+ case 0x01:
+ if (call_dissector_with_data(ddp_short_handle, new_tvb, pinfo, tree, &ddp_node)) {
+ /*
+ * Set our tvbuff's length based on the new tvbuff's length, so
+ * that, if we're called from the Ethernet dissector, it can
+ * report any trailer.
+ *
+ * Add 3 to that length, for the LLAP header.
+ */
+ new_reported_length = tvb_reported_length(new_tvb) + 3;
+ set_actual_length(tvb, new_reported_length);
+ return tvb_captured_length(tvb);
+ }
+ break;
+ case 0x02:
+ if (call_dissector(ddp_handle, new_tvb, pinfo, tree)) {
+ /*
+ * As above.
+ */
+ new_reported_length = tvb_reported_length(new_tvb) + 3;
+ set_actual_length(tvb, new_reported_length);
+ return tvb_captured_length(tvb);
+ }
+ break;
+ }
+ call_data_dissector(new_tvb, pinfo, tree);
+ return tvb_captured_length(tvb);
+}
+
+void
+proto_register_atalk(void)
+{
+ static hf_register_info hf_llap[] = {
+ { &hf_llap_dst,
+ { "Destination Node", "llap.dst", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_llap_src,
+ { "Source Node", "llap.src", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_llap_type,
+ { "Type", "llap.type", FT_UINT8, BASE_HEX|BASE_EXT_STRING, &llap_type_vals_ext, 0x0,
+ NULL, HFILL }},
+ };
+
+ static hf_register_info hf_llc[] = {
+ { &hf_llc_apple_atalk_pid,
+ { "PID", "llc.apple_atalk_pid", FT_UINT16, BASE_HEX,
+ VALS(apple_atalk_pid_vals), 0x0, "Protocol ID", HFILL }
+ }
+ };
+
+ static hf_register_info hf_ddp[] = {
+ { &hf_ddp_hopcount,
+ { "Hop count", "ddp.hopcount", FT_UINT16, BASE_DEC, NULL, 0x3C00,
+ NULL, HFILL }},
+
+ { &hf_ddp_len,
+ { "Datagram length", "ddp.len", FT_UINT16, BASE_DEC, NULL, 0x03FF,
+ NULL, HFILL }},
+
+ { &hf_ddp_checksum,
+ { "Checksum", "ddp.checksum", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_dst,
+ { "Destination address", "ddp.dst", FT_STRING, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_dst_net,
+ { "Destination Net", "ddp.dst.net", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_src,
+ { "Source address", "ddp.src", FT_STRING, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_src_net,
+ { "Source Net", "ddp.src.net", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_dst_node,
+ { "Destination Node", "ddp.dst.node", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_src_node,
+ { "Source Node", "ddp.src.node", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_dst_socket,
+ { "Destination Socket", "ddp.dst_socket", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_src_socket,
+ { "Source Socket", "ddp.src_socket", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_ddp_type,
+ { "Protocol type", "ddp.type", FT_UINT8, BASE_DEC|BASE_EXT_STRING, &op_vals_ext, 0x0,
+ NULL, HFILL }},
+ };
+
+ static hf_register_info hf_nbp[] = {
+ { &hf_nbp_op,
+ { "Operation", "nbp.op", FT_UINT8, BASE_DEC,
+ VALS(nbp_op_vals), 0xF0, NULL, HFILL }},
+ { &hf_nbp_info,
+ { "Info", "nbp.info", FT_UINT8, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_count,
+ { "Count", "nbp.count", FT_UINT8, BASE_DEC,
+ NULL, 0x0F, NULL, HFILL }},
+ { &hf_nbp_node_net,
+ { "Network", "nbp.net", FT_UINT16, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_node_node,
+ { "Node", "nbp.node", FT_UINT8, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_node_port,
+ { "Port", "nbp.port", FT_UINT8, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_node_enum,
+ { "Enumerator", "nbp.enum", FT_UINT8, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_node_object,
+ { "Object", "nbp.object", FT_UINT_STRING, BASE_NONE,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_node_type,
+ { "Type", "nbp.type", FT_UINT_STRING, BASE_NONE,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_node_zone,
+ { "Zone", "nbp.zone", FT_UINT_STRING, BASE_NONE,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_nbp_tid,
+ { "Transaction ID", "nbp.tid", FT_UINT8, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }}
+ };
+
+ static hf_register_info hf_rtmp[] = {
+ { &hf_rtmp_net,
+ { "Net", "rtmp.net", FT_UINT16, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_node,
+ { "Node", "nbp.nodeid", FT_UINT8, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_node_len,
+ { "Node Length", "nbp.nodeid.length", FT_UINT8, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_tuple_net,
+ { "Net", "rtmp.tuple.net", FT_UINT16, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_tuple_range_start,
+ { "Range Start", "rtmp.tuple.range_start", FT_UINT16, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_tuple_range_end,
+ { "Range End", "rtmp.tuple.range_end", FT_UINT16, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_tuple_dist,
+ { "Distance", "rtmp.tuple.dist", FT_UINT16, BASE_DEC,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_version,
+ { "Version", "rtmp.version", FT_UINT8, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+ { &hf_rtmp_function,
+ { "Function", "rtmp.function", FT_UINT8, BASE_DEC,
+ VALS(rtmp_function_vals), 0x0, "Request Function", HFILL }}
+ };
+
+ static hf_register_info hf_atp[] = {
+ { &hf_atp_ctrlinfo,
+ { "Control info", "atp.ctrlinfo", FT_UINT8, BASE_HEX,
+ NULL, 0, NULL, HFILL }},
+
+ { &hf_atp_function,
+ { "Function", "atp.function", FT_UINT8, BASE_DEC,
+ VALS(atp_function_vals), ATP_FUNCMASK, "function code", HFILL }},
+
+
+ { &hf_atp_xo,
+ { "XO", "atp.xo", FT_BOOLEAN, 8,
+ NULL, ATP_XO, "Exactly-once flag", HFILL }},
+
+ { &hf_atp_eom,
+ { "EOM", "atp.eom", FT_BOOLEAN, 8,
+ NULL, ATP_EOM, "End-of-message", HFILL }},
+
+ { &hf_atp_sts,
+ { "STS", "atp.sts", FT_BOOLEAN, 8,
+ NULL, ATP_STS, "Send transaction status", HFILL }},
+
+ { &hf_atp_treltimer,
+ { "TRel timer", "atp.treltimer", FT_UINT8, BASE_DEC,
+ VALS(atp_trel_timer_vals), 0x07, NULL, HFILL }},
+
+ { &hf_atp_bitmap,
+ { "Bitmap", "atp.bitmap", FT_UINT8, BASE_HEX,
+ NULL, 0x0, "Bitmap or sequence number", HFILL }},
+
+ { &hf_atp_tid,
+ { "TID", "atp.tid", FT_UINT16, BASE_DEC,
+ NULL, 0x0, "Transaction id", HFILL }},
+ { &hf_atp_user_bytes,
+ { "User bytes", "atp.user_bytes", FT_UINT32, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_atp_segment_overlap,
+ { "Segment overlap", "atp.segment.overlap", FT_BOOLEAN, BASE_NONE,
+ NULL, 0x0, "Segment overlaps with other segments", HFILL }},
+
+ { &hf_atp_segment_overlap_conflict,
+ { "Conflicting data in segment overlap", "atp.segment.overlap.conflict",
+ FT_BOOLEAN, BASE_NONE,
+ NULL, 0x0, "Overlapping segments contained conflicting data", HFILL }},
+
+ { &hf_atp_segment_multiple_tails,
+ { "Multiple tail segments found", "atp.segment.multipletails",
+ FT_BOOLEAN, BASE_NONE,
+ NULL, 0x0, "Several tails were found when desegmenting the packet", HFILL }},
+
+ { &hf_atp_segment_too_long_segment,
+ { "Segment too long", "atp.segment.toolongsegment", FT_BOOLEAN, BASE_NONE,
+ NULL, 0x0, "Segment contained data past end of packet", HFILL }},
+
+ { &hf_atp_segment_error,
+ {"Desegmentation error", "atp.segment.error", FT_FRAMENUM, BASE_NONE,
+ NULL, 0x0, "Desegmentation error due to illegal segments", HFILL }},
+
+ { &hf_atp_segment_count,
+ { "Segment count", "atp.segment.count", FT_UINT32, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_atp_segment,
+ { "ATP Fragment", "atp.fragment", FT_FRAMENUM, BASE_NONE,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_atp_segments,
+ { "ATP Fragments", "atp.fragments", FT_NONE, BASE_NONE,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_atp_reassembled_in,
+ { "Reassembled ATP in frame", "atp.reassembled_in", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
+ "This ATP packet is reassembled in this frame", HFILL }},
+
+ { &hf_atp_reassembled_length,
+ { "Reassembled ATP length", "atp.reassembled.length", FT_UINT32, BASE_DEC, NULL, 0x0,
+ "The total length of the reassembled payload", HFILL }}
+ };
+
+ static hf_register_info hf_asp[] = {
+ { &hf_asp_func,
+ { "asp function", "asp.function", FT_UINT8, BASE_DEC|BASE_EXT_STRING,
+ &asp_func_vals_ext, 0, NULL, HFILL }},
+
+ { &hf_asp_error,
+ { "asp error", "asp.error", FT_INT32, BASE_DEC|BASE_EXT_STRING,
+ &asp_error_vals_ext, 0, "return error code", HFILL }},
+
+ { &hf_asp_version,
+ { "Version", "asp.version", FT_UINT16, BASE_HEX,
+ NULL, 0, "asp version", HFILL }},
+
+ { &hf_asp_attn_code,
+ { "Attn code", "asp.attn_code", FT_UINT16, BASE_HEX,
+ NULL, 0, "asp attention code", HFILL }},
+
+ { &hf_asp_init_error,
+ { "Error", "asp.init_error", FT_UINT16, BASE_DEC,
+ NULL, 0, "asp init error", HFILL }},
+
+ { &hf_asp_session_id,
+ { "Session ID", "asp.session_id", FT_UINT8, BASE_DEC,
+ NULL, 0, "asp session id", HFILL }},
+
+ { &hf_asp_socket,
+ { "Socket", "asp.socket", FT_UINT8, BASE_DEC,
+ NULL, 0, "asp socket", HFILL }},
+
+ { &hf_asp_seq,
+ { "Sequence", "asp.seq", FT_UINT16, BASE_DEC,
+ NULL, 0, "asp sequence number", HFILL }},
+
+ { &hf_asp_size,
+ { "size", "asp.size", FT_UINT16, BASE_DEC,
+ NULL, 0, "asp available size for reply", HFILL }},
+
+ { &hf_asp_zero_value,
+ { "Pad (0)", "asp.zero_value",
+ FT_BYTES, BASE_NONE, NULL, 0x0,
+ "Pad", HFILL }},
+ };
+
+ static hf_register_info hf_zip[] = {
+ { &hf_zip_function,
+ { "Function", "zip.function", FT_UINT8, BASE_DEC|BASE_EXT_STRING, &zip_function_vals_ext, 0x0,
+ "ZIP function", HFILL }},
+
+ { &hf_zip_zero_value,
+ { "Pad (0)", "zip.zero_value",FT_BYTES, BASE_NONE, NULL, 0x0,
+ "Pad", HFILL }},
+
+ { &hf_zip_atp_function,
+ { "Function", "zip.atp_function", FT_UINT8, BASE_DEC, VALS(zip_atp_function_vals), 0x0,
+ NULL, HFILL }},
+
+ { &hf_zip_start_index,
+ { "Start index", "zip.start_index", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_zip_count,
+ { "Count", "zip.count", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_zip_network_count,
+ { "Count", "zip.network_count", FT_UINT8, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+ { &hf_zip_network,
+ { "Network","zip.network", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+ { &hf_zip_network_start,
+ { "Network start","zip.network_start", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+ { &hf_zip_network_end,
+ { "Network end", "zip.network_end", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_zip_flags,
+ { "Flags", "zip.flags", FT_UINT8, BASE_HEX, NULL, 0xE0,
+ NULL, HFILL }},
+ { &hf_zip_last_flag,
+ { "Last Flag", "zip.last_flag", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
+ "Non zero if contains last zone name in the zone list", HFILL }},
+
+ { &hf_zip_flags_zone_invalid,
+ { "Zone invalid", "zip.flags.zone_invalid", FT_BOOLEAN, 8, NULL, 0x80,
+ NULL, HFILL }},
+
+ { &hf_zip_flags_use_broadcast,
+ { "Use broadcast","zip.flags.use_broadcast", FT_BOOLEAN, 8, NULL, 0x40,
+ NULL, HFILL }},
+
+ { &hf_zip_flags_only_one_zone,
+ { "Only one zone","zip.flags.only_one_zone", FT_BOOLEAN, 8, NULL, 0x20,
+ NULL, HFILL }},
+
+ { &hf_zip_zone_name,
+ { "Zone", "zip.zone_name", FT_UINT_STRING, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_zip_default_zone,
+ { "Default zone", "zip.default_zone",FT_UINT_STRING, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_zip_multicast_length,
+ { "Multicast length", "zip.multicast_length", FT_UINT8, BASE_DEC, NULL, 0x0,
+ "Multicast address length", HFILL }},
+
+ { &hf_zip_multicast_address,
+ { "Multicast address", "zip.multicast_address",FT_BYTES, BASE_NONE, NULL, 0x0,
+ NULL, HFILL }},
+
+ };
+
+ static hf_register_info hf_pap[] = {
+ { &hf_pap_connid,
+ { "ConnID", "prap.connid", FT_UINT8, BASE_DEC, NULL, 0x0,
+ "PAP connection ID", HFILL }},
+
+ { &hf_pap_function,
+ { "Function", "prap.function", FT_UINT8, BASE_DEC|BASE_EXT_STRING, &pap_function_vals_ext, 0x0,
+ "PAP function", HFILL }},
+
+ { &hf_pap_socket,
+ { "Socket", "prap.socket", FT_UINT8, BASE_DEC, NULL, 0x0,
+ "ATP responding socket number", HFILL }},
+
+ { &hf_pap_quantum,
+ { "Quantum", "prap.quantum", FT_UINT8, BASE_DEC, NULL, 0x0,
+ "Flow quantum", HFILL }},
+
+ { &hf_pap_waittime,
+ { "Wait time", "prap.waittime", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_pap_result,
+ { "Result", "prap.result", FT_UINT16, BASE_DEC, NULL, 0x0,
+ NULL, HFILL }},
+
+ { &hf_pap_seq,
+ { "Sequence", "prap.seq", FT_UINT16, BASE_DEC, NULL, 0x0,
+ "Sequence number", HFILL }},
+
+ { &hf_pap_status,
+ { "Status", "prap.status", FT_UINT_STRING, BASE_NONE, NULL, 0x0,
+ "Printer status", HFILL }},
+
+ { &hf_pap_eof,
+ { "EOF", "prap.eof", FT_BOOLEAN, BASE_NONE,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_pap_pad,
+ { "Pad", "prap.pad", FT_NONE, BASE_NONE, NULL, 0,
+ "Pad Byte", HFILL }},
+
+ };
+
+ static ei_register_info ei_ddp[] = {
+ { &ei_ddp_len_invalid, { "ddp.len_invalid", PI_PROTOCOL, PI_WARN, "Invalid length", EXPFILL }},
+ };
+
+ static gint *ett[] = {
+ &ett_llap,
+ &ett_ddp,
+ &ett_atp,
+ &ett_atp_info,
+ &ett_atp_segments,
+ &ett_atp_segment,
+ &ett_asp,
+ &ett_pap,
+
+ &ett_nbp,
+ &ett_nbp_info,
+ &ett_nbp_node,
+ &ett_pstring,
+ &ett_rtmp,
+ &ett_rtmp_tuple,
+
+ &ett_zip,
+ &ett_zip_flags,
+ &ett_zip_zones_list,
+ &ett_zip_network_list,
+ };
+ module_t *atp_module;
+ expert_module_t *expert_ddp;
+
+ /*
+ * AppleTalk over LAN (EtherTalk, TokenTalk) uses LLC/SNAP headers with
+ * an OUI of OUI_APPLE_ATALK and a PID of either ETHERTYPE_ATALK.
+ */
+ llc_add_oui(OUI_APPLE_ATALK, "llc.apple_atalk_pid", "LLC Apple AppleTalk OUI PID", hf_llc, -1);
+
+ proto_llap = proto_register_protocol("LocalTalk Link Access Protocol", "LLAP", "llap");
+ proto_register_field_array(proto_llap, hf_llap, array_length(hf_llap));
+ llap_handle = register_dissector("llap", dissect_llap, proto_llap);
+
+ llap_cap_handle = register_capture_dissector("llap", capture_llap, proto_llap);
+
+ proto_ddp = proto_register_protocol("Datagram Delivery Protocol", "DDP", "ddp");
+ proto_register_field_array(proto_ddp, hf_ddp, array_length(hf_ddp));
+ expert_ddp = expert_register_protocol(proto_ddp);
+ expert_register_field_array(expert_ddp, ei_ddp, array_length(ei_ddp));
+ ddp_handle = register_dissector("ddp", dissect_ddp, proto_ddp);
+ ddp_short_handle = register_dissector("ddp_short", dissect_ddp_short, proto_ddp);
+
+ proto_nbp = proto_register_protocol("Name Binding Protocol", "NBP", "nbp");
+ proto_register_field_array(proto_nbp, hf_nbp, array_length(hf_nbp));
+ nbp_handle = register_dissector("nbp", dissect_nbp, proto_nbp);
+
+ proto_atp = proto_register_protocol("AppleTalk Transaction Protocol packet", "ATP", "atp");
+ proto_register_field_array(proto_atp, hf_atp, array_length(hf_atp));
+ atp_handle = register_dissector("atp", dissect_atp, proto_atp);
+
+ proto_asp = proto_register_protocol("AppleTalk Session Protocol", "ASP", "asp");
+ proto_register_field_array(proto_asp, hf_asp, array_length(hf_asp));
+ asp_handle = register_dissector("asp", dissect_asp, proto_asp);
+
+ proto_pap = proto_register_protocol("Printer Access Protocol", "PrAP", "prap");
+ proto_register_field_array(proto_pap, hf_pap, array_length(hf_pap));
+ pap_handle = register_dissector("prap", dissect_pap, proto_pap);
+
+ proto_zip = proto_register_protocol("Zone Information Protocol", "ZIP", "zip");
+ proto_register_field_array(proto_zip, hf_zip, array_length(hf_zip));
+ zip_ddp_handle = register_dissector("zip.ddp", dissect_ddp_zip, proto_zip);
+ zip_atp_handle = register_dissector("zip.atp", dissect_atp_zip, proto_zip);
+
+ atp_module = prefs_register_protocol(proto_atp, NULL);
+ prefs_register_bool_preference(atp_module, "desegment",
+ "Reassemble ATP messages spanning multiple DDP packets",
+ "Whether the ATP dissector should reassemble messages spanning multiple DDP packets",
+ &atp_defragment);
+
+ proto_rtmp = proto_register_protocol("Routing Table Maintenance Protocol",
+ "RTMP", "rtmp");
+ proto_register_field_array(proto_rtmp, hf_rtmp, array_length(hf_rtmp));
+ rtmp_request_handle = register_dissector("rtmp.request", dissect_rtmp_request, proto_rtmp);
+ rtmp_data_handle = register_dissector("rtmp.data", dissect_rtmp_data, proto_rtmp);
+
+ proto_register_subtree_array(ett, array_length(ett));
+
+ /* subdissector code */
+ ddp_dissector_table = register_dissector_table("ddp.type", "DDP packet type", proto_ddp,
+ FT_UINT8, BASE_HEX);
+
+ atalk_address_type = address_type_dissector_register("AT_ATALK", "Appletalk DDP", atalk_to_str, atalk_str_len, NULL, atalk_col_filter_str, atalk_len, NULL, NULL);
+}
+
+void
+proto_reg_handoff_atalk(void)
+{
+ dissector_add_uint("llc.apple_atalk_pid", APPLE_PID_ATALK, ddp_handle);
+ dissector_add_uint("chdlc.protocol", ETHERTYPE_ATALK, ddp_handle);
+ dissector_add_uint("ppp.protocol", PPP_AT, ddp_handle);
+ dissector_add_uint("null.type", BSD_AF_APPLETALK, ddp_handle);
+ dissector_add_uint("arcnet.protocol_id", ARCNET_PROTO_APPLETALK, ddp_handle);
+
+ dissector_add_uint("ddp.type", DDP_NBP, nbp_handle);
+ dissector_add_for_decode_as_with_preference("udp.port", nbp_handle);
+
+ dissector_add_uint("ddp.type", DDP_ATP, atp_handle);
+ dissector_add_uint("ddp.type", DDP_RTMPREQ, rtmp_request_handle);
+ dissector_add_uint("ddp.type", DDP_RTMPDATA, rtmp_data_handle);
+ dissector_add_uint("ddp.type", DDP_ZIP, zip_ddp_handle);
+
+ dissector_add_uint("wtap_encap", WTAP_ENCAP_LOCALTALK, llap_handle);
+ /*
+ * This is for Ethernet packets with an Ethertype of ETHERTYPE_ATALK
+ * and LLC/SNAP packets with an OUI of 00:00:00 and a PID of
+ * ETHERTYPE_ATALK; those appear to be gatewayed LLAP packets,
+ * complete with an LLAP header.
+ */
+ dissector_add_uint("ethertype", ETHERTYPE_ATALK, llap_handle);
+ capture_dissector_add_uint("wtap_encap", WTAP_ENCAP_LOCALTALK, llap_cap_handle);
+
+ reassembly_table_register(&atp_reassembly_table,
+ &addresses_reassembly_table_functions);
+
+ atp_request_hash = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), asp_hash, asp_equal);
+ asp_request_hash = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), asp_hash, asp_equal);
+
+ afp_handle = find_dissector_add_dependency("afp", proto_asp);
+ afp_server_status_handle = find_dissector_add_dependency("afp_server_status", proto_asp);
+}
+
+/*
+ * Editor modelines - https://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 2
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=2 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */