Wireshark · Ethereal-dev: [ethereal-dev] Patches for dissect-ftp etc

[Richard Sharpe <sharpe@xxxxxxxxxx>]

Hi,

I seem to have debugged dissect-ftp, and have added a dissect-ftpdata, and
tried to clean up pop along the way ...

Here it is ...

--- packet-ftp.c.orig	Fri Apr  2 19:25:53 1999
+++ packet-ftp.c	Sat Apr  3 05:26:10 1999
@@ -48,7 +48,7 @@
 extern packet_info pi;

 void
-dissect_ftp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
+dissect_ftp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data)
 {
         proto_tree      *ftp_tree, *ti;
 	gchar          rr[50], rd[1500];
@@ -58,9 +58,29 @@
 	bzero(rr, sizeof(rr));
 	bzero(rd, sizeof(rd));

-	strncpy(rr, pd + offset, MIN(i1, sizeof(rr) - 1));
-	i2 = (int)index(pd + offset + i1 + 1, '\r') - (int)pd - offset - i1 - 1;
-	strncpy(rd, pd + offset + i1 + 1, MIN(i2, sizeof(rd) - 1));
+	if (i1 > 0) {
+
+	  /* Hmmm, check if there was no space in there ... */
+
+	  if (i1 > max_data) {
+
+	    i1 = max_data;  /* Make things below work */
+	    strncpy(rr, pd + offset, MIN(max_data - 2, sizeof(rr) - 1));
+
+	  }
+	  else {
+
+	    strncpy(rr, pd + offset, MIN(i1, sizeof(rr) - 1));
+	    i2 = (int)index(pd + offset + i1 + 1, '\r') - (int)pd - offset - i1 - 1;
+	    strncpy(rd, pd + offset + i1 + 1, MIN(i2, sizeof(rd) - 1));
+	  }
+	}
+	else {
+
+	  i1 = max_data;
+	  strncpy(rr, pd + offset, MIN(max_data - 2, sizeof(rr) - 1));  /* Lazy, CRLF */
+
+	}

 	if (check_col(fd, COL_PROTOCOL))
 		col_add_str(fd, COL_PROTOCOL, "FTP");
@@ -76,7 +96,7 @@
 	  ti = proto_tree_add_item(tree, offset, END_OF_FRAME,
 				"File Transfer Protocol");
 	  ftp_tree = proto_tree_new();
-	  proto_item_add_subtree(ti, ftp_tree, ETT_POP);
+	  proto_item_add_subtree(ti, ftp_tree, ETT_FTP);

 	  if (pi.match_port == pi.destport) { /* Request */

@@ -91,6 +111,28 @@

 	    proto_tree_add_item(ftp_tree, offset + i1 + 1, END_OF_FRAME, "Response Arg: %s", rd);
 	  }
+
+	}
+}
+
+void
+dissect_ftpdata(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data)
+{
+        proto_tree      *ftp_tree, *ti;
+
+	if (check_col(fd, COL_PROTOCOL))
+		col_add_str(fd, COL_PROTOCOL, "FTP DATA");
+
+	if (check_col(fd, COL_INFO)) {
+
+	  col_add_fstr(fd, COL_INFO, "FTP Data ...");
+
+	}
+
+	if (tree) {
+
+	  ti = proto_tree_add_item(tree, offset, END_OF_FRAME,
+				"File Transfer Protocol Data");

 	}
 }
--- packet-ip.c.orig	Fri Apr  2 08:37:11 1999
+++ packet-ip.c	Fri Apr  2 08:00:50 1999
@@ -699,6 +699,7 @@
   pi.iplen = iph.ip_len;
   pi.iphdrlen = lo_nibble(iph.ip_v_hl);
   pi.ip_src = iph.ip_src;
+  pi.payload = pi.iplen - hlen;

   offset += hlen;
   switch (iph.ip_p) {
--- packet-pop.c.orig	Fri Apr  2 08:39:07 1999
+++ packet-pop.c	Sat Apr  3 05:11:08 1999
@@ -48,7 +48,7 @@
 extern packet_info pi;

 void
-dissect_pop(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
+dissect_pop(const u_char *pd, int offset, frame_data *fd, proto_tree *tree, int max_data)
 {
         proto_tree      *pop_tree, *ti;
 	gchar          rr[50], rd[1500];
@@ -58,9 +58,18 @@
 	bzero(rr, sizeof(rr));
 	bzero(rd, sizeof(rd));

-	strncpy(rr, pd + offset, MIN(i1, sizeof(rr) - 1));
-	i2 = (int)index(pd + offset + i1 + 1, '\r') - (int)pd - offset - i1 - 1;
-	strncpy(rd, pd + offset + i1 + 1, MIN(i2, sizeof(rd) - 1));
+	if ((i1 > max_data) || (i1 <= 0)) {
+
+	  i1 = max_data;
+	  strncpy(rr, pd + offset, MIN(max_data - 2, sizeof(rr) - 1));
+
+	}
+	else {
+
+	  strncpy(rr, pd + offset, MIN(i1, sizeof(rr) - 1));
+	  i2 = (int)index(pd + offset + i1 + 1, '\r') - (int)pd - offset - i1 - 1;
+	  strncpy(rd, pd + offset + i1 + 1, MIN(i2, sizeof(rd) - 1));
+	}

 	if (check_col(fd, COL_PROTOCOL))
 		col_add_str(fd, COL_PROTOCOL, "POP");
--- packet-tcp.c.orig	Fri Apr  2 08:36:47 1999
+++ packet-tcp.c	Sat Apr  3 05:22:08 1999
@@ -324,6 +324,8 @@
   guint      bpos;
   guint      hlen;
   guint      optlen;
+  guint      packet_max = pi.payload + offset;
+  guint      payload;

   /* To do: Check for {cap len,pkt len} < struct len */
   /* Avoids alignment problems on many architectures. */
@@ -355,6 +357,8 @@

   hlen = hi_nibble(th.th_off_x2) * 4;  /* TCP header length, in bytes */

+  payload = pi.payload - hlen;
+
   if (check_col(fd, COL_RES_SRC_PORT))
     col_add_str(fd, COL_RES_SRC_PORT, get_tcp_port(th.th_sport));
   if (check_col(fd, COL_UNRES_SRC_PORT))
@@ -448,20 +452,25 @@

   /* Check the packet length to see if there's more data
      (it could be an ACK-only packet) */
-  if (pd->cap_len > offset) {
+  if (packet_max > offset) {
     switch(MIN(th.th_sport, th.th_dport)) {
       case TCP_PORT_PRINTER:
         dissect_lpd(pd, offset, fd, tree);
         break;

+    case TCP_PORT_FTPDATA:
+      pi.match_port = TCP_PORT_FTPDATA;
+      dissect_ftpdata(pd, offset, fd, tree, payload);
+      break;
+
     case TCP_PORT_FTP:
-      pi.match_port = TCP_PORT_POP;
-      dissect_ftp(pd, offset, fd, tree);
+      pi.match_port = TCP_PORT_FTP;
+      dissect_ftp(pd, offset, fd, tree, payload);
       break;

     case TCP_PORT_POP:
       pi.match_port = TCP_PORT_POP;
-      dissect_pop(pd, offset, fd, tree);
+      dissect_pop(pd, offset, fd, tree, payload);
       break;

       case TCP_PORT_HTTP:


Regards
-------
Richard Sharpe, sharpe@xxxxxxxxxx, NIC-Handle:RJS96
NS Computer Software and Services P/L, 
Ph: +61-8-8281-0063, FAX: +61-8-8250-2080, 
Samba (Team member), Linux, Apache, Digital UNIX, AIX, C, ...