/src/wireshark/epan/dissectors/packet-tpkt.c

Source
/* packet-tpkt.c
 *
 * Routine to check for RFC 1006 TPKT header and to dissect TPKT header
 * Copyright 2000, Philips Electronics N.V.
 * Andreas Sikkema <h323@ramdyne.nl>
 *
 * Routine to dissect RFC 1006 TPKT packet containing OSI TP PDU
 * Copyright 2001, Martin Thomas <Martin_A_Thomas@yahoo.com>
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

#include "config.h"

#include <epan/packet.h>
#include <epan/exceptions.h>
#include <epan/prefs.h>
#include <epan/show_exception.h>
#include <epan/conversation.h>

#include "packet-tpkt.h"

void proto_register_tpkt(void);
void proto_reg_handoff_tpkt(void);

static heur_dissector_list_t tpkt_heur_subdissector_list;

/* TPKT header fields             */
static int proto_tpkt;
static int proto_tpkt_heur;
static protocol_t *proto_tpkt_ptr;
static int hf_tpkt_version;
static int hf_tpkt_reserved;
static int hf_tpkt_length;
static int hf_tpkt_continuation_data;


/* TPKT fields defining a sub tree */
static int ett_tpkt;

/* desegmentation of OSI over TPKT over TCP */
static bool tpkt_desegment = true;

#define TCP_PORT_TPKT_RANGE       "102"

/* IANA registered port for RDP (as ms-wbt-server) */
#define TCP_PORT_RDP 3389

/* find the dissector for OSI TP (aka COTP) */
static dissector_handle_t osi_tp_handle;
static dissector_handle_t tpkt_handle;

#define DEFAULT_TPKT_PORT_RANGE "102"

/*
 * Check whether this could be a TPKT-encapsulated PDU.
 * Returns -1 if it's not, and the PDU length from the TPKT header
 * if it is.
 *
 * "min_len" is the minimum length of the PDU; the length field in the
 * TPKT header must be at least "4+min_len" in order for this to be a
 * valid TPKT PDU for the protocol in question.
 */
bool
is_tpkt(tvbuff_t *tvb, unsigned min_len, unsigned *pkt_len)
{
    unsigned t_pkt_len;

    /*
     * If TPKT is disabled, don't dissect it, just return -1, meaning
     * "this isn't TPKT".
     */
    if (!proto_is_protocol_enabled(proto_tpkt_ptr))
        return false;

    /* There should at least be 4 bytes left in the frame */
    if (tvb_captured_length(tvb) < 4)
        return false;  /* there aren't */

    /*
     * The first octet should be 3 and the second one should be 0
     * The H.323 implementers guide suggests that this might not
     * always be the case....
     */
    if (!(tvb_get_uint8(tvb, 0) == 3 && tvb_get_uint8(tvb, 1) == 0))
        return false;  /* they're not */

    /*
     * Get the length from the TPKT header.  Make sure it's large
     * enough.
     */
    t_pkt_len = tvb_get_ntohs(tvb, 2);
    if (t_pkt_len < 4 + min_len)
        return false;  /* it's not */

    /*
     * Return the length from the header.
     */
    if (pkt_len) {
        *pkt_len = t_pkt_len;
    }
    return true;
}
uint16_t
is_asciitpkt(tvbuff_t *tvb)
{
    uint16_t count;
        /*
         * If TPKT is disabled, don't dissect it, just return -1, meaning
         * "this isn't TPKT".
         */
    if (!proto_is_protocol_enabled(proto_tpkt_ptr))
       return -1;

          /* There should at least be 8 bytes left in the frame */
    if (!tvb_bytes_exist(tvb, 0, 8))
        return -1;      /* there aren't */

        /*
         * The first four  octets should be alphanumeric ASCII
         */
    for (count = 0; count <=7 ; count ++)
        {
        if(!g_ascii_isalnum(tvb_get_uint8(tvb,count)))
          {
          return 0;
          }
        }
     return 1;


}
static int
parseLengthText ( uint8_t* pTpktData )
{
    int value = 0;
    const uint8_t * pData = pTpktData;
    int bitvalue = 0, count1 = 3;
    int count;
    for (count = 0; count <= 3; count++)
        {
        if (('0' <= *(pData + count)) && (*(pData + count) <= '9'))
            bitvalue = *(pData + count) - 48;
        else if (('a' <= *(pData + count)) && (*(pData + count) <= 'f' ))
            bitvalue = *(pData + count) - 87;
        else if (('A' <= *(pData + count)) && (*(pData + count) <= 'F' ))
            bitvalue = *(pData + count) - 55;

        value += bitvalue << (4*count1);
        count1--;
        }
    return value;
}
static int
parseVersionText ( uint8_t* pTpktData )
{
    int value = 0;
    uint8_t * pData = pTpktData;
    int bitvalue = 0, count1 = 1;
    int count;
    for (count = 0; count <= 1; count++)
        {
        if (('0' <= *(pData + count)) && (*(pData + count) <= '9'))
            bitvalue = *(pData + count) - 48;
        else if (('a' <= *(pData + count)) && (*(pData + count) <= 'f' ))
            bitvalue = *(pData + count) - 87;
        else if (('A' <= *(pData + count)) && (*(pData + count) <= 'F' ))
            bitvalue = *(pData + count) - 55;

        value += bitvalue << (4*count1);
        count1--;
        }

    return value;
}
static int
parseReservedText ( uint8_t* pTpktData )
{
    int value = 0;
    uint8_t * pData = pTpktData;
    int bitvalue = 0, count1 = 1;
    int count;
    for (count = 0; count <= 1; count++)
        {
        if (('0' <= *(pData + count)) && (*(pData + count) <= '9'))
            bitvalue = *(pData + count) - 48;
        else if (('a' <= *(pData + count)) && (*(pData + count) <= 'f' ))
            bitvalue = *(pData + count) - 87;
        else if (('A' <= *(pData + count)) && (*(pData + count) <= 'F' ))
            bitvalue = *(pData + count) - 55;

        value += bitvalue << (4*count1);
        count1--;
        }

    return value;
}

/*
 * Length of the TPKT text-layer header.
 */
static const int TEXT_LAYER_LENGTH   = 9;

/*
 * Dissect ASCII TPKT-encapsulated data in a TCP stream.
 */
void
dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
          dissector_handle_t subdissector_handle)
{
    proto_item *ti = NULL;
    proto_tree *tpkt_tree = NULL;
    volatile unsigned offset = 0;
    int data_len;
    volatile int mgcp_packet_len = 0;
    int mgcp_version, mgcp_reserved;
    tvbuff_t *volatile next_tvb;
    const char *saved_proto;
    uint8_t string[4];

    /*
     * If we're reassembling segmented TPKT PDUs, empty the COL_INFO
     * column, so subdissectors can append information
     * without having to worry about emptying the column.
     *
     * We use "col_add_str()" because the subdissector
     * might be appending information to the column, in
     * which case we'd have to zero the buffer out explicitly
     * anyway.
     */
    if (tpkt_desegment)
        col_clear(pinfo->cinfo, COL_INFO);

    while (tvb_reported_length_remaining(tvb, offset) != 0) {
        /*
         * Is the first byte of this putative TPKT header
         * a valid TPKT version number, i.e. 3?
         */
        if (tvb_get_uint8(tvb, offset) != 48) {
            /*
             * No, so don't assume this is a TPKT header;
             * we might be in the middle of TPKT data,
             * so don't get the length and don't try to
             * do reassembly.
             */
            col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
            col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
            if (tree) {
                ti = proto_tree_add_item(tree, proto_tpkt, tvb,
                             offset, -1, ENC_NA);
                tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);

                proto_tree_add_item(tpkt_tree, hf_tpkt_continuation_data, tvb, offset, -1, ENC_NA);
            }
            return;
        }

        /*
         * Get the length from the TPKT header.
         */

        tvb_memcpy(tvb, (uint8_t *)string, offset, 2);
        mgcp_version = parseVersionText(string);
        tvb_memcpy(tvb, (uint8_t *)string, offset +2, 2);
        mgcp_reserved = parseReservedText(string);
        tvb_memcpy(tvb, (uint8_t *)string, offset + 4, 4);
        mgcp_packet_len = parseLengthText(string);
        data_len = mgcp_packet_len;

        /*
         * Dissect the TPKT header.
         * Save and restore "pinfo->current_proto".
         */
        saved_proto = pinfo->current_proto;
        pinfo->current_proto = "TPKT";

        col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
        /*
         * Don't add the TPKT header information if we're
         * reassembling segmented TPKT PDUs or if this
         * PDU isn't reassembled.
         *
         * XXX - the first is so that subdissectors can append
         * information without getting TPKT stuff in the middle;
         * why the second?
         */
        if (!tpkt_desegment && !pinfo->fragmented) {
            col_add_fstr(pinfo->cinfo, COL_INFO,
                     "TPKT Data length = %u", data_len);
        }

        if (tree) {
            ti = proto_tree_add_item(tree, proto_tpkt, tvb,
                         offset, 8, ENC_NA);
            tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);
            proto_item_set_text(ti, "TPKT");

            /* Version */
            proto_tree_add_uint(tpkt_tree, hf_tpkt_version, tvb,
                        offset, 2, mgcp_version);

            /* Reserved octet*/
            proto_tree_add_uint(tpkt_tree, hf_tpkt_reserved, tvb,
                        offset + 2, 2, mgcp_reserved);

            /* Length */
            proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb,
                        offset + 4, 4, mgcp_packet_len);
        }
        pinfo->current_proto = saved_proto;

        /* Skip the TPKT header. */
        offset += TEXT_LAYER_LENGTH;

        next_tvb = tvb_new_subset_length(tvb, offset, data_len);

        /*
         * Call the subdissector.
         *
         * If it gets an error that means there's no point in
         * dissecting any more TPKT messages, rethrow the
         * exception in question.
         *
         * If it gets any other error, report it and continue, as that
         * means that TPKT message got an error, but that doesn't mean
         * we should stop dissecting TPKT messages within this frame
         * or chunk of reassembled data.
         */
        TRY {
            call_dissector(subdissector_handle, next_tvb, pinfo,
                       tree);
        }
        CATCH_NONFATAL_ERRORS {

            show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
        }
        ENDTRY;

        /*
         * Skip the payload.
         */
        offset += data_len;
    }
}

/*
 * Dissect TPKT-encapsulated data in a TCP stream.
 */
void
dissect_tpkt_encap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
           bool desegment, dissector_handle_t subdissector_handle)
{
    proto_item *ti = NULL;
    proto_tree *tpkt_tree = NULL;
    volatile unsigned offset = 0;
    unsigned length_remaining;
    volatile unsigned data_len;
    volatile unsigned length;
    tvbuff_t *volatile next_tvb;
    const char *saved_proto;
    bool save_fragmented;
    heur_dtbl_entry_t *hdtbl_entry;

    /*
     * If we're reassembling segmented TPKT PDUs, empty the COL_INFO
     * column, so subdissectors can append information
     * without having to worry about emptying the column.
     *
     * We use "col_add_str()" because the subdissector
     * might be appending information to the column, in
     * which case we'd have to zero the buffer out explicitly
     * anyway.
     */
    if (desegment)
        col_clear(pinfo->cinfo, COL_INFO);

    while (tvb_reported_length_remaining(tvb, offset) != 0) {
        /*
         * Is the first byte of this putative TPKT header
         * a valid TPKT version number, i.e. 3?
         */
        if (tvb_get_uint8(tvb, offset) != 3) {
            /*
             * No, so don't assume this is a TPKT header;
             * we might be in the middle of TPKT data,
             * so don't get the length and don't try to
             * do reassembly.
             */

            if (dissector_try_heuristic(tpkt_heur_subdissector_list, tvb,
                                        pinfo, proto_tree_get_root(tree),
                                        &hdtbl_entry, NULL)) {
                return;
            }

            col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
            col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
            if (tree) {
                ti = proto_tree_add_item(tree, proto_tpkt, tvb,
                    offset, -1, ENC_NA);
                tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);

                proto_tree_add_item(tpkt_tree, hf_tpkt_continuation_data, tvb, offset, -1, ENC_NA);
            }
            return;
        }

        length_remaining = tvb_captured_length_remaining(tvb, offset);

        /*
         * Can we do reassembly?
         */
        if (desegment && pinfo->can_desegment) {
            /*
             * Yes - is the TPKT header split across segment
             * boundaries?
             */
            if (length_remaining < 4) {
                /*
                 * Yes.  Tell the TCP dissector where the data
                 * for this message starts in the data it
                 * handed us and that we need "some more data."
                 * Don't tell it exactly how many bytes we need
                 * because if/when we ask for even more (after
                 * the header) that will break reassembly.
                 */
                pinfo->desegment_offset = offset;
                pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
                return;
            }
        }

        /*
         * Get the length from the TPKT header.
         */
        data_len = tvb_get_ntohs(tvb, offset + 2);

        if (data_len < 4) {
            /*
             * The length includes the TPKT header, so this can't be a valid
             * TPKT header. We only checked one byte above, so we might be in
             * the middle of TPKT data. Call it continuation as above.
             */
            if (dissector_try_heuristic(tpkt_heur_subdissector_list, tvb,
                                        pinfo, proto_tree_get_root(tree),
                                        &hdtbl_entry, NULL)) {
                return;
            }

            col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
            col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
            if (tree) {
                ti = proto_tree_add_item(tree, proto_tpkt, tvb,
                    offset, -1, ENC_NA);
                tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);

                proto_tree_add_item(tpkt_tree, hf_tpkt_continuation_data, tvb, offset, -1, ENC_NA);
            }
            return;
        }

        /*
         * Can we do reassembly?
         */
        if (desegment && pinfo->can_desegment) {
            /*
             * Yes - is the payload split across segment
             * boundaries?
             */
            if (length_remaining < data_len) {
                /*
                 * Yes.  Tell the TCP dissector where
                 * the data for this message starts in
                 * the data it handed us, and how many
                 * more bytes we need, and return.
                 */
                pinfo->desegment_offset = offset;
                pinfo->desegment_len =
                    data_len - length_remaining;
                return;
            }
        }

        /*
         * Dissect the TPKT header.
         * Save and restore "pinfo->current_proto".
         */
        saved_proto = pinfo->current_proto;
        pinfo->current_proto = "TPKT";

        col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
        /*
         * Don't add the TPKT header information if we're
         * reassembling segmented TPKT PDUs or if this
         * PDU isn't reassembled.
         *
         * XXX - the first is so that subdissectors can append
         * information without getting TPKT stuff in the middle;
         * why the second?
         */
        if (!desegment && !pinfo->fragmented) {
            col_add_fstr(pinfo->cinfo, COL_INFO,
                "TPKT Data length = %u", data_len);
        }

        if (tree) {
            ti = proto_tree_add_item(tree, proto_tpkt, tvb,
                offset, 4, ENC_NA);
            tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);
            proto_item_set_text(ti, "TPKT");

            /* Version */
            proto_tree_add_item(tpkt_tree, hf_tpkt_version, tvb,
                offset, 1, ENC_BIG_ENDIAN);
            proto_item_append_text(ti, ", Version: 3");

            /* Reserved octet*/
            proto_tree_add_item(tpkt_tree, hf_tpkt_reserved, tvb,
                offset + 1, 1, ENC_BIG_ENDIAN);

            /* Length */
            proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb,
                offset + 2, 2, data_len);
            proto_item_append_text(ti, ", Length: %u", data_len);
        }
        pinfo->current_proto = saved_proto;

        /* Skip the TPKT header. */
        offset += 4;
        data_len -= 4;

        /*
         * Construct a tvbuff with reported length the amount
         * amount of data in this TPKT packet.
         *
         * If reassembly isn't enabled, and we don't have all the
         * payload, mark the packet as fragmented, so that
         * FragmentBoundsError is thrown instead of ReportedBoundsError.
         */
        save_fragmented = pinfo->fragmented;
        length = length_remaining - 4;
        if (length < data_len) {
            pinfo->fragmented = true;
        }
        next_tvb = tvb_new_subset_length(tvb, offset, data_len);

        /*
         * Call the subdissector.
         *
         * If it gets an error that means there's no point in
         * dissecting any more TPKT messages, rethrow the
         * exception in question.
         *
         * If it gets any other error, report it and continue,
         * as that means that TPKT message got an error, but
         * that doesn't mean we should stop dissecting TPKT
         * messages within this frame or chunk of reassembled
         * data.
         */
        TRY {
            call_dissector(subdissector_handle, next_tvb, pinfo,
                tree);
        }
        CATCH_NONFATAL_ERRORS {
            show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
        }
        ENDTRY;

        pinfo->fragmented = save_fragmented;

        /*
         * Skip the payload.
         */
        offset += data_len;
    }
}

/*
 * Dissect RFC 1006 TPKT, which wraps a TPKT header around an OSI TP
 * PDU.
 */
static int
dissect_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
{
    dissect_tpkt_encap(tvb, pinfo, tree, tpkt_desegment, osi_tp_handle);
    return tvb_captured_length(tvb);
}

/*
 * Dissect ASCII TPKT, which wraps a ASCII TPKT header around an OSI TP
 * PDU.
 */
#if 0
static int
dissect_ascii_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
{
    dissect_asciitpkt(tvb, pinfo, tree, osi_tp_handle);
    return tvb_captured_length(tvb);
}
#endif

/* A heuristic dissector for TPKT. This is useful for RDP, where TLS may
 * or may not be present depending on the RDP security settings.
 */
static int
dissect_tpkt_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
    unsigned pkt_len;
    if (!is_tpkt(tvb, 0, &pkt_len)) {
        /* Doesn't look like TPKT directly. Might be over TLS, so reject
         * and let the TLS heuristic dissector take a look
         */
        return 0;
    }

    return dissect_tpkt(tvb, pinfo, tree, data);
}

static bool
dissect_tpkt_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
    return dissect_tpkt_tcp(tvb, pinfo, tree, data) > 0;
}

void
proto_register_tpkt(void)
{
    static hf_register_info hf[] = {
        {
            &hf_tpkt_version,
            {
                "Version",
                "tpkt.version",
                FT_UINT16,
                BASE_DEC,
                NULL,
                0x0,
                "Version, only version 3 is defined", HFILL
            }
        },
        {
            &hf_tpkt_reserved,
            {
                "Reserved",
                "tpkt.reserved",
                FT_UINT8,
                BASE_DEC,
                NULL,
                0x0,
                "Reserved, should be 0", HFILL
            }
        },
        {
            &hf_tpkt_length,
            {
                "Length",
                "tpkt.length",
                FT_UINT16,
                BASE_DEC,
                NULL,
                0x0,
                "Length of data unit, including this header", HFILL
            }
        },
        {
            &hf_tpkt_continuation_data,
            {
                "Continuation data",
                "tpkt.continuation_data",
                FT_BYTES,
                BASE_NONE,
                NULL,
                0x0,
                NULL, HFILL
            }
        },
    };

    static int *ett[] =
    {
        &ett_tpkt,
    };
    module_t *tpkt_module;

    proto_tpkt = proto_register_protocol("TPKT - ISO on TCP - RFC1006", "TPKT", "tpkt");
    proto_tpkt_ptr = find_protocol_by_id(proto_tpkt);
    proto_register_field_array(proto_tpkt, hf, array_length(hf));
    proto_register_subtree_array(ett, array_length(ett));
    tpkt_handle = register_dissector("tpkt", dissect_tpkt, proto_tpkt);

    tpkt_module = prefs_register_protocol(proto_tpkt, NULL);
    prefs_register_bool_preference(tpkt_module, "desegment",
        "Reassemble TPKT messages spanning multiple TCP segments",
        "Whether the TPKT dissector should reassemble messages spanning multiple TCP segments. "
        "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
        &tpkt_desegment);

    /* heuristic dissectors for preamble CredSSP before RDP and Fast-Path RDP packets */
    tpkt_heur_subdissector_list = register_heur_dissector_list_with_description("tpkt", "TPKT fragment", proto_tpkt);

    proto_tpkt_heur = proto_register_protocol_in_name_only("TPKT Heuristic (for RDP)", "TPKT Heuristic (for RDP)", "tpkt", proto_tpkt, FT_PROTOCOL);
}

void
proto_reg_handoff_tpkt(void)
{
    osi_tp_handle = find_dissector("ositp");
    dissector_add_uint_range_with_preference("tcp.port", TCP_PORT_TPKT_RANGE, tpkt_handle);

    /* ssl_dissector_add registers TLS as the dissector for TCP for the
     * given port. We can't use it, since on port 3389 TPKT (for RDP) can be
     * over TLS or directly over TCP, depending on the RDP security settings.
     * TPKT heuristics are also too weak to enable in general. Instead,
     * use the heuristic dissector by default just on the RDP port, and
     * if rejected the TLS heuristic dissector will be tried.
     */
    dissector_add_uint("tcp.port", TCP_PORT_RDP, create_dissector_handle(dissect_tpkt_tcp, proto_tpkt_heur));
    heur_dissector_add("tcp", dissect_tpkt_heur, "TPKT over TCP", "tpkt_tcp", proto_tpkt, HEURISTIC_DISABLE);
    heur_dissector_add("tls", dissect_tpkt_heur, "TPKT over TLS", "tpkt_tls", proto_tpkt, HEURISTIC_ENABLE);

    /*
    tpkt_ascii_handle = create_dissector_handle(dissect_ascii_tpkt, proto_tpkt);
    dissector_add_uint("tcp.port", TCP_PORT_TPKT, tpkt_ascii_handle);
    */

}

/*
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 *
 * Local variables:
 * c-basic-offset: 4
 * tab-width: 8
 * indent-tabs-mode: nil
 * End:
 *
 * vi: set shiftwidth=4 tabstop=8 expandtab:
 * :indentSize=4:tabSize=8:noTabs=true:
 */

Coverage Report

Created: 2026-07-12 07:10