2
ettercap -- dissector portmap
4
Copyright (C) 2001 ALoR <alor@users.sourceforge.net>, NaGA <crwm@freemail.it>
6
This program is free software; you can redistribute it and/or modify
7
it under the terms of the GNU General Public License as published by
8
the Free Software Foundation; either version 2 of the License, or
9
(at your option) any later version.
11
This program is distributed in the hope that it will be useful,
12
but WITHOUT ANY WARRANTY; without even the implied warranty of
13
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14
GNU General Public License for more details.
16
You should have received a copy of the GNU General Public License
17
along with this program; if not, write to the Free Software
18
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
20
$Id: ec_dissector_portmap.c,v 1.3 2002/04/12 15:59:15 alor Exp $
24
#include "include/ec_main.h"
26
#include "include/ec_dissector.h"
27
#include "include/ec_inet_structures.h"
39
extern RPC_DISSECTOR Available_RPC_Dissectors[];
41
int Programs_tcp[XID_LEN][4];
42
int Programs_udp[XID_LEN][4];
46
FUNC_DISSECTOR(Dissector_portmapTCP);
47
FUNC_DISSECTOR(Dissector_portmapUDP);
48
void RPC_PortInsert( RPC_DISSECTOR *Entry, short port);
50
// ------------------------------------------------------------
52
void RPC_PortInsert( RPC_DISSECTOR *Entry, short port)
56
to_enter = &Entry->ports;
57
// He ya...another funny list!!!!!
58
if (Entry->ports == NULL)
59
Entry->ports = (RPC_PORTS *)malloc (sizeof(RPC_PORTS));
62
while(*to_enter != NULL)
64
if ((*to_enter)->port == port) return;
65
to_enter = (RPC_PORTS **)&((*to_enter)->next);
67
*to_enter = (RPC_PORTS *)malloc (sizeof(RPC_PORTS));
70
(*to_enter)->port = port;
71
(*to_enter)->next = NULL;
76
FUNC_DISSECTOR(Dissector_portmapTCP)
80
int type,xid,proc,proto,program,version,port,state,len,offs,i,j;
82
tcp = (TCP_header *) data;
83
buf = (char *)((int)tcp + tcp->doff * 4);
85
xid = *(int *)(buf+4);
86
proc = *(int *)(buf+24);
87
type = *(int *)(buf+8);
88
if ((len=data_to_ettercap->datalen)==0) return (0);
91
if (ntohs(tcp->dest) == SERV_PORT)
93
proto = *(int *)(buf+52);
94
program = *(int *)(buf+44);
95
version = *(int *)(buf+48);
97
if (type!=0) return (0);
99
for (i=0; i<XID_LEN; i++)
100
if (!Programs_tcp[i][XID]) break;
102
if (i==XID_LEN) return (0);
104
if (ntohl(proc)==3) // GETPORT
106
Programs_tcp[i][XID] = xid;
107
Programs_tcp[i][PROTO] = proto;
108
Programs_tcp[i][PROG] = program;
109
Programs_tcp[i][VER] = version;
112
if (ntohl(proc)==4) //DUMP
114
Programs_tcp[i][XID]=xid;
115
Programs_tcp[i][PROG]=DUMP;
122
for (j=0; j<XID_LEN; j++)
123
if (Programs_tcp[j][XID] == xid) break;
125
if (j == XID_LEN) return (0);
127
Programs_tcp[j][XID] = 0;
128
state = *(int *)(buf+12);
130
if (state != 0 || ntohl(type) != 1) // Unsuccess or not a reply :(
133
if (Programs_tcp[j][PROG]!=DUMP) // GETPORT Reply
135
port = *(int *)(buf+28);
138
while ( Available_RPC_Dissectors[i].program != 0 )
140
if ( Available_RPC_Dissectors[i].program == ntohl(Programs_tcp[j][PROG]) &&
141
Available_RPC_Dissectors[i].version == ntohl(Programs_tcp[j][VER]) &&
142
Available_RPC_Dissectors[i].proto == (short)ntohl(Programs_tcp[j][PROTO]))
144
RPC_PortInsert( &Available_RPC_Dissectors[i], (short)(ntohl(port)) );
153
while ( (len-offs)>=MAP_LEN )
155
program = *(int *)(buf+offs+4);
156
version = *(int *)(buf+offs+8);
157
proto = *(int *)(buf+offs+12);
158
port = *(int *)(buf+offs+16);
161
while ( Available_RPC_Dissectors[i].program != 0 )
163
if ( Available_RPC_Dissectors[i].program == ntohl(program) &&
164
Available_RPC_Dissectors[i].version == ntohl(version) &&
165
Available_RPC_Dissectors[i].proto == (short)ntohl(proto))
167
RPC_PortInsert( &Available_RPC_Dissectors[i], (short)(ntohl(port)) );
180
FUNC_DISSECTOR(Dissector_portmapUDP)
184
int type,xid,proc,proto,program,version,port,state,len,offs,i,j;
186
udp = (UDP_header *) data;
187
buf = data + UDP_HEADER;
190
proc = *(int *)(buf+20);
191
type = *(int *)(buf+4);
192
len = data_to_ettercap->datalen;
195
if (ntohs(udp->dest) == SERV_PORT)
197
proto = *(int *)(buf+48);
198
program = *(int *)(buf+40);
199
version = *(int *)(buf+44);
201
if (type!=0) return (0);
203
for (i=0; i<XID_LEN; i++)
204
if (!Programs_udp[i][XID]) break;
206
if (i==XID_LEN) return (0);
208
if (ntohl(proc)==3) // GETPORT
210
Programs_udp[i][XID] = xid;
211
Programs_udp[i][PROTO] = proto;
212
Programs_udp[i][PROG] = program;
213
Programs_udp[i][VER] = version;
216
if (ntohl(proc)==4) //DUMP
218
Programs_udp[i][XID]=xid;
219
Programs_udp[i][PROG]=DUMP;
225
for (j=0; j<XID_LEN; j++)
226
if (Programs_udp[j][XID]==xid) break;
228
if (j==XID_LEN) return (0);
230
Programs_udp[j][XID]=0;
231
state = *(int *)(buf+8);
233
if (state != 0 || ntohl(type) != 1) // Unsuccess or not a reply :(
236
if (Programs_udp[j][PROG]!=DUMP) // GETPORT Reply
238
port = *(int *)(buf+24);
241
while ( Available_RPC_Dissectors[i].program != 0 )
243
if ( Available_RPC_Dissectors[i].program == ntohl(Programs_udp[j][PROG]) &&
244
Available_RPC_Dissectors[i].version == ntohl(Programs_udp[j][VER]) &&
245
Available_RPC_Dissectors[i].proto == (short)ntohl(Programs_udp[j][PROTO]))
247
RPC_PortInsert( &Available_RPC_Dissectors[i], (short)(ntohl(port)) );
256
while ( (len-offs)>=MAP_LEN )
258
program = *(int *)(buf+offs+4);
259
version = *(int *)(buf+offs+8);
260
proto = *(int *)(buf+offs+12);
261
port = *(int *)(buf+offs+16);
264
while ( Available_RPC_Dissectors[i].program != 0 )
266
if ( Available_RPC_Dissectors[i].program == ntohl(program) &&
267
Available_RPC_Dissectors[i].version == ntohl(version) &&
268
Available_RPC_Dissectors[i].proto == (short)ntohl(proto))
270
RPC_PortInsert( &Available_RPC_Dissectors[i], (short)(ntohl(port)) );
283
// vim:ts=3:expandtab