/* packet-pcnfsd.c

 * Routines for PCNFSD dissection

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * Copied from packet-ypbind.c

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

Protocol information comes from the book

    "NFS Illustrated" by Brent Callaghan, ISBN 0-201-32570-5

*/

#include "config.h"

#include "packet-rpc.h"

#include "packet-pcnfsd.h"

void proto_register_pcnfsd(void);

void proto_reg_handoff_pcnfsd(void);

static int proto_pcnfsd;

static int hf_pcnfsd_procedure_v1;

static int hf_pcnfsd_procedure_v2;

static int hf_pcnfsd_auth_client;

static int hf_pcnfsd_auth_ident_obscure;

static int hf_pcnfsd_auth_ident_clear;

static int hf_pcnfsd_auth_password;

static int hf_pcnfsd_auth_password_obscure;

static int hf_pcnfsd_auth_password_clear;

static int hf_pcnfsd_comment;

static int hf_pcnfsd_status;

static int hf_pcnfsd_uid;

static int hf_pcnfsd_gid;

static int hf_pcnfsd_gids_count;

static int hf_pcnfsd_homedir;

static int hf_pcnfsd_def_umask;

static int hf_pcnfsd_mapreq;

static int hf_pcnfsd_mapreq_status;

static int hf_pcnfsd_username;

static int ett_pcnfsd;

static int ett_pcnfsd_auth_ident;

static int ett_pcnfsd_auth_password;

static int ett_pcnfsd_gids;

static int

dissect_pcnfsd_username(tvbuff_t *tvb, packet_info* pinfo, unsigned offset, proto_tree *tree)

{

    return dissect_rpc_string(tvb, pinfo, tree, hf_pcnfsd_username, offset, NULL);

}

#define MAP_REQ_UID     0

#define MAP_REQ_GID     1

#define MAP_REQ_UNAME   2

#define MAP_REQ_GNAME   3

static const value_string names_mapreq[] =

{

    { MAP_REQ_UID,   "MAP_REQ_UID"   },

    { MAP_REQ_GID,   "MAP_REQ_GID"   },

    { MAP_REQ_UNAME, "MAP_REQ_UNAME" },

    { MAP_REQ_GNAME, "MAP_REQ_GNAME" },

    { 0,  NULL    }

};

static int

dissect_pcnfsd2_dissect_mapreq_arg_item(tvbuff_t *tvb, unsigned offset, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

    proto_tree_add_item(tree, hf_pcnfsd_mapreq, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    offset = dissect_rpc_uint32(tvb, tree, hf_pcnfsd_uid, offset);

    offset = dissect_pcnfsd_username(tvb, pinfo, offset, tree);

    return offset;

}

static int

dissect_pcnfsd2_mapid_call(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

    unsigned offset = 0;

    offset = dissect_rpc_string(tvb, pinfo, tree, hf_pcnfsd_comment, offset, NULL);

    offset = dissect_rpc_list(tvb, pinfo, tree, offset,

          dissect_pcnfsd2_dissect_mapreq_arg_item, NULL);

    return offset;

}

#define MAP_RES_OK      0

#define MAP_RES_UNKNOWN 1

#define MAP_RES_DENIED  2

static const value_string names_maprstat[] =

{

    { MAP_RES_OK,      "MAP_RES_OK" },

    { MAP_RES_UNKNOWN, "MAP_RES_UNKNOWN"    },

    { MAP_RES_DENIED,  "MAP_RES_DENIED" },

    { 0,    NULL    }

};

static int

dissect_pcnfsd2_dissect_mapreq_res_item(tvbuff_t *tvb, unsigned offset, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

    proto_tree_add_item(tree, hf_pcnfsd_mapreq, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item(tree, hf_pcnfsd_mapreq_status, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    offset = dissect_rpc_uint32(tvb, tree, hf_pcnfsd_uid, offset);

    offset = dissect_pcnfsd_username(tvb, pinfo, offset, tree);

    return offset;

}

static int

dissect_pcnfsd2_mapid_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

    unsigned offset = 0;

    offset = dissect_rpc_string(tvb, pinfo, tree, hf_pcnfsd_comment, offset, NULL);

    offset = dissect_rpc_list(tvb, pinfo, tree, offset,

          dissect_pcnfsd2_dissect_mapreq_res_item, NULL);

    return offset;

}

/* "NFS Illustrated 14.7.13 */

static wmem_strbuf_t*

pcnfsd_decode_obscure(wmem_allocator_t *pool, const char* data, size_t len)

{

    wmem_strbuf_t *decoded_buf;

    decoded_buf = wmem_strbuf_new_sized(pool, len + 1);

    for ( ; len>0 ; len--, data++) {

        /* dissect_rpc_string/dissect_rpc_opaque_data already called

         * tvb_get_string_enc(..., ENC_ASCII), which replaced any non-ASCII

         * with UTF-8 REPLACEMENT CHARACTER, so leave unchanged any byte

         * with the high bit set.

         * XXX - It might be easier to get the raw bytes and deobfuscate

         * prior to making UTF-8.

         */

        if (*data & 0x80) {

            wmem_strbuf_append_c(decoded_buf, *data);

        } else {

            wmem_strbuf_append_c(decoded_buf, *data ^ 0x5b);

        }

    }

    /* Return the wmem_strbuf_t for clarity, since the deobfuscation can

     * place an internal '\0' byte. (We could just use the original string

     * length, but this makes it more apparent.) */

    return decoded_buf;

}

/* "NFS Illustrated" 14.7.13 */

static int

dissect_pcnfsd2_auth_call(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

    unsigned    newoffset;

    const char *ident         = NULL;

    wmem_strbuf_t *ident_decoded;

    proto_item *ident_item;

    proto_tree *ident_tree;

    const char *password      = NULL;

    wmem_strbuf_t *password_decoded;

    proto_item *password_item = NULL;

    proto_tree *password_tree = NULL;

    unsigned offset = 0;

    offset = dissect_rpc_string(tvb, pinfo, tree,

        hf_pcnfsd_auth_client, offset, NULL);

    ident_tree = proto_tree_add_subtree(tree, tvb,

                offset, -1, ett_pcnfsd_auth_ident, &ident_item, "Authentication Ident");

    /* XXX - Because this is obfuscated with a XOR pattern, it really needs

     * to retrieve the raw bytes and XOR them first; the obfuscation can place

     * a '\0' in the middle of the string if the unobfuscated identity or

     * password has a '[' (ASCII 0x5b) , so the counted string length in the

     * frame should be used, not strlen().

     */

    newoffset = dissect_rpc_string(tvb, pinfo, ident_tree,

        hf_pcnfsd_auth_ident_obscure, offset, &ident);

    proto_item_set_len(ident_item, newoffset-offset);

    if (ident && ident_tree) {

        /* Only attempt to decode the ident if it has been specified */

        if (strcmp(ident, RPC_STRING_EMPTY) != 0)

            ident_decoded = pcnfsd_decode_obscure(pinfo->pool, ident, strlen(ident));

        else

            ident_decoded = wmem_strbuf_new(pinfo->pool, ident);

        proto_tree_add_string(ident_tree,

            hf_pcnfsd_auth_ident_clear,

            tvb, offset+4,

            (int)wmem_strbuf_get_len(ident_decoded),

            wmem_strbuf_get_str(ident_decoded));

        wmem_strbuf_destroy(ident_decoded);

    }

    if (ident_item) {

        proto_item_set_text(ident_item, "Authentication Ident: %s",

            ident);

    }

    offset = newoffset;

    password_item = proto_tree_add_string_format(tree, hf_pcnfsd_auth_password,

                                          tvb, 0, 0, "", "Authentication Password");

    password_tree = proto_item_add_subtree(password_item, ett_pcnfsd_auth_password);

    newoffset = dissect_rpc_string(tvb, pinfo, password_tree,

        hf_pcnfsd_auth_password_obscure, offset, &password);

    if (password_item) {

        proto_item_set_len(password_item, newoffset-offset);

    }

    if (password && password_tree) {

        /* Only attempt to decode the password if it has been specified */

        if (strcmp(password, RPC_STRING_EMPTY))

            password_decoded = pcnfsd_decode_obscure(pinfo->pool, password, strlen(password));

        else

            password_decoded = wmem_strbuf_new(pinfo->pool, password);

        proto_tree_add_string(password_tree,

            hf_pcnfsd_auth_password_clear,

            tvb, offset+4,

            (int)wmem_strbuf_get_len(password_decoded),

            wmem_strbuf_get_str(password_decoded));

        wmem_strbuf_destroy(password_decoded);

    }

    if (password_item) {

        proto_item_set_text(password_item, "Authentication Password: %s",

            password);

    }

    offset = newoffset;

    offset = dissect_rpc_string(tvb, pinfo, tree,

        hf_pcnfsd_comment, offset, NULL);

    return offset;

}

/* "NFS Illustrated" 14.7.13 */

static int

dissect_pcnfsd2_auth_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

    int         gids_count;

    proto_tree *gtree;

    int         gids_i;

    unsigned offset = 0;

    offset = dissect_rpc_uint32(tvb, tree, hf_pcnfsd_status, offset);

    offset = dissect_rpc_uint32(tvb, tree, hf_pcnfsd_uid, offset);

    offset = dissect_rpc_uint32(tvb, tree, hf_pcnfsd_gid, offset);

    gids_count = tvb_get_ntohl(tvb,offset+0);

    gtree = proto_tree_add_subtree_format(tree, tvb,

            offset, 4+gids_count*4, ett_pcnfsd_gids, NULL, "Group IDs: %d", gids_count);

    proto_tree_add_item(gtree, hf_pcnfsd_gids_count, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    for (gids_i = 0 ; gids_i < gids_count ; gids_i++) {

        offset = dissect_rpc_uint32(tvb, gtree,

                hf_pcnfsd_gid, offset);

    }

    offset = dissect_rpc_string(tvb, pinfo, tree,

        hf_pcnfsd_homedir, offset, NULL);

    /* should be signed int32 */

    offset = dissect_rpc_uint32(tvb, tree, hf_pcnfsd_def_umask, offset);

    offset = dissect_rpc_string(tvb, pinfo, tree,

        hf_pcnfsd_comment, offset, NULL);

    return offset;

}

/* "NFS Illustrated", 14.6 */

/* proc number, "proc name", dissect_request, dissect_reply */

static const vsff pcnfsd1_proc[] = {

    { 0,    "NULL",     dissect_rpc_void,    dissect_rpc_void },

    { 1,    "AUTH",     dissect_rpc_unknown, dissect_rpc_unknown },

    { 2,    "PR_INIT",  dissect_rpc_unknown, dissect_rpc_unknown },

    { 3,    "PR_START", dissect_rpc_unknown, dissect_rpc_unknown },

    { 0,    NULL,       NULL,                NULL }

};

static const value_string pcnfsd1_proc_vals[] = {

    { 0,    "NULL" },

    { 1,    "AUTH" },

    { 2,    "PR_INIT" },

    { 3,    "PR_START" },

    { 0,    NULL }

};

/* end of PCNFS version 1 */

/* "NFS Illustrated", 14.7 */

static const vsff pcnfsd2_proc[] = {

    {  0,   "NULL",

    dissect_rpc_void, dissect_rpc_void },

    {  1,   "INFO",       dissect_rpc_unknown, dissect_rpc_unknown },

    {  2,   "PR_INIT",    dissect_rpc_unknown, dissect_rpc_unknown },

    {  3,   "PR_START",   dissect_rpc_unknown, dissect_rpc_unknown },

    {  4,   "PR_LIST",    dissect_rpc_unknown, dissect_rpc_unknown },

    {  5,   "PR_QUEUE",   dissect_rpc_unknown, dissect_rpc_unknown },

    {  6,   "PR_STATUS",  dissect_rpc_unknown, dissect_rpc_unknown },

    {  7,   "PR_CANCEL",  dissect_rpc_unknown, dissect_rpc_unknown },

    {  8,   "PR_ADMIN",   dissect_rpc_unknown, dissect_rpc_unknown },

    {  9,   "PR_REQUEUE", dissect_rpc_unknown, dissect_rpc_unknown },

    { 10,   "PR_HOLD",    dissect_rpc_unknown, dissect_rpc_unknown },

    { 11,   "PR_RELEASE", dissect_rpc_unknown, dissect_rpc_unknown },

    { 12,   "MAPID",

    dissect_pcnfsd2_mapid_call, dissect_pcnfsd2_mapid_reply },

    { 13,   "AUTH",

    dissect_pcnfsd2_auth_call,  dissect_pcnfsd2_auth_reply },

    { 14,   "ALERT",      dissect_rpc_unknown, dissect_rpc_unknown },

    { 0,    NULL,         NULL,               NULL }

};

static const value_string pcnfsd2_proc_vals[] = {

    {  0,   "NULL" },

    {  1,   "INFO" },

    {  2,   "PR_INIT" },

    {  3,   "PR_START" },

    {  4,   "PR_LIST" },

    {  5,   "PR_QUEUE" },

    {  6,   "PR_STATUS" },

    {  7,   "PR_CANCEL" },

    {  8,   "PR_ADMIN" },

    {  9,   "PR_REQUEUE" },

    { 10,   "PR_HOLD" },

    { 11,   "PR_RELEASE" },

    { 12,   "MAPID" },

    { 13,   "AUTH" },

    { 14,   "ALERT" },

    { 0,    NULL }

};

/* end of PCNFS version 2 */

static const rpc_prog_vers_info pcnfsd_vers_info[] = {

  { 1, pcnfsd1_proc, &hf_pcnfsd_procedure_v1 },

  { 2, pcnfsd2_proc, &hf_pcnfsd_procedure_v2 },

};

void

proto_register_pcnfsd(void)

{

    static hf_register_info hf[] = {

        { &hf_pcnfsd_procedure_v1, {

                "V1 Procedure", "pcnfsd.procedure_v1", FT_UINT32, BASE_DEC,

                VALS(pcnfsd1_proc_vals), 0, NULL, HFILL }},

        { &hf_pcnfsd_procedure_v2, {

                "V2 Procedure", "pcnfsd.procedure_v2", FT_UINT32, BASE_DEC,

                VALS(pcnfsd2_proc_vals), 0, NULL, HFILL }},

        { &hf_pcnfsd_auth_client, {

                "Authentication Client", "pcnfsd.auth.client", FT_STRING, BASE_NONE,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_auth_ident_obscure, {

                "Obscure Ident", "pcnfsd.auth.ident.obscure", FT_STRING, BASE_NONE,

                NULL, 0, "Authentication Obscure Ident", HFILL }},

        { &hf_pcnfsd_auth_ident_clear, {

                "Clear Ident", "pcnfsd.auth.ident.clear", FT_STRING, BASE_NONE,

                NULL, 0, "Authentication Clear Ident", HFILL }},

        { &hf_pcnfsd_auth_password, {

                "Password", "pcnfsd.auth.password", FT_STRING, BASE_NONE,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_auth_password_obscure, {

                "Obscure Password", "pcnfsd.auth.password.obscure", FT_STRING, BASE_NONE,

                NULL, 0, "Authentication Obscure Password", HFILL }},

        { &hf_pcnfsd_auth_password_clear, {

                "Clear Password", "pcnfsd.auth.password.clear", FT_STRING, BASE_NONE,

                NULL, 0, "Authentication Clear Password", HFILL }},

        { &hf_pcnfsd_comment, {

                "Comment", "pcnfsd.comment", FT_STRING, BASE_NONE,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_status, {

                "Reply Status", "pcnfsd.status", FT_UINT32, BASE_DEC,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_uid, {

                "User ID", "pcnfsd.uid", FT_UINT32, BASE_DEC,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_gid, {

                "Group ID", "pcnfsd.gid", FT_UINT32, BASE_DEC,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_gids_count, {

                "Group ID Count", "pcnfsd.gids.count", FT_UINT32, BASE_DEC,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_homedir, {

                "Home Directory", "pcnfsd.homedir", FT_STRING, BASE_NONE,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_def_umask, {

                "def_umask", "pcnfsd.def_umask", FT_UINT32, BASE_OCT,

                NULL, 0, NULL, HFILL }},

        { &hf_pcnfsd_mapreq, {

                "Request", "pcnfsd.mapreq", FT_UINT32, BASE_DEC,

                VALS(names_mapreq), 0, NULL, HFILL }},

        { &hf_pcnfsd_mapreq_status, {

                "Status", "pcnfsd.mapreq_status", FT_UINT32, BASE_DEC,

                VALS(names_maprstat), 0, NULL, HFILL }},

        { &hf_pcnfsd_username, {

                "User name", "pcnfsd.username", FT_STRING, BASE_NONE,

                NULL, 0, "pcnfsd.username", HFILL }},

    };

    static int *ett[] = {

        &ett_pcnfsd,

        &ett_pcnfsd_auth_ident,

        &ett_pcnfsd_auth_password,

        &ett_pcnfsd_gids

    };

    proto_pcnfsd = proto_register_protocol("PC NFS", "PCNFSD", "pcnfsd");

    proto_register_field_array(proto_pcnfsd, hf, array_length(hf));

    proto_register_subtree_array(ett, array_length(ett));

}

void

proto_reg_handoff_pcnfsd(void)

{

    /* Register the protocol as RPC */

    rpc_init_prog(proto_pcnfsd, PCNFSD_PROGRAM, ett_pcnfsd,

                  G_N_ELEMENTS(pcnfsd_vers_info), pcnfsd_vers_info);

}

/*

 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html

 *

 * Local variables:

 * c-basic-offset: 4

 * tab-width: 8

 * indent-tabs-mode: nil

 * End:

 *

 * vi: set shiftwidth=4 tabstop=8 expandtab:

 * :indentSize=4:tabSize=8:noTabs=true:

 */