epan/dissectors/packet-ipvs-syncd.c

   1 /* packet-ipvs-syncd.c   2001 Ronnie Sahlberg <See AUTHORS for email>
   2  * Routines for IGMP packet disassembly
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #include "config.h"
  12
  13 #include <epan/packet.h>
  14
  15 void proto_register_ipvs_syncd(void);
  16 void proto_reg_handoff_ipvs_syncd(void);
  17
  18 static dissector_handle_t ipvs_syncd_handle;
  19
  20 static int proto_ipvs_syncd;
  21 static int hf_conn_count;
  22 static int hf_syncid;
  23 static int hf_size;
  24 static int hf_resv;
  25 static int hf_version;
  26 static int hf_proto;
  27 static int hf_cport;
  28 static int hf_vport;
  29 static int hf_dport;
  30 static int hf_caddr;
  31 static int hf_vaddr;
  32 static int hf_daddr;
  33 static int hf_flags;
  34 static int hf_flags_conn_type;
  35 static int hf_flags_hashed_entry;
  36 static int hf_flags_no_output_packets;
  37 static int hf_flags_conn_not_established;
  38 static int hf_flags_adjust_output_seq;
  39 static int hf_flags_adjust_input_seq;
  40 static int hf_flags_no_client_port_set;
  41 static int hf_state;
  42 static int hf_in_seq_init;
  43 static int hf_in_seq_delta;
  44 static int hf_in_seq_pdelta;
  45 static int hf_out_seq_init;
  46 static int hf_out_seq_delta;
  47 static int hf_out_seq_pdelta;
  48
  49 /* Payload v1 */
  50 static int hf_type;
  51 static int hf_ver;
  52 static int hf_size_v1;
  53 static int hf_flags_v1;
  54 static int hf_fwmark;
  55 static int hf_timeout;
  56 static int hf_caddr6;
  57 static int hf_vaddr6;
  58 static int hf_daddr6;
  59
  60 static int ett_ipvs_syncd;
  61 static int ett_conn;
  62 static int ett_flags;
  63
  64 #define IPVS_SYNCD_MC_GROUP "224.0.0.18"
  65 #define IPVS_SYNCD_PORT 8848 /* Not IANA registered */
  66
  67 static const value_string proto_strings[] = {
  68         {0x06, "TCP"},
  69         {0x11, "UDP"},
  70         {0x00, NULL},
  71 };
  72
  73 static const value_string state_strings[] = {
  74         {0x00, "Input"},
  75         {0x04, "Output"},
  76         {0x08, "Input Only"},
  77         {0x00, NULL},
  78 };
  79
  80 static const value_string type_strings[] = {
  81         {0x0, "IPv4"},
  82         {0x2, "IPv6"},
  83         {0x00, NULL},
  84 };
  85
  86 /*
  87  *  IPVS Connection Flags
  88  *  Pulled from include/net/ip_vs.h in linux kernel source
  89  */
  90 #define IP_VS_CONN_F_FWD_MASK         0x0007    /* mask for the fwd methods */
  91 #define IP_VS_CONN_F_MASQ             0x0000    /* masquerading */
  92 #define IP_VS_CONN_F_LOCALNODE        0x0001    /* local node */
  93 #define IP_VS_CONN_F_TUNNEL           0x0002    /* tunneling */
  94 #define IP_VS_CONN_F_DROUTE           0x0003    /* direct routing */
  95 #define IP_VS_CONN_F_BYPASS           0x0004    /* cache bypass */
  96 #define IP_VS_CONN_F_HASHED           0x0040    /* hashed entry */
  97 #define IP_VS_CONN_F_NOOUTPUT         0x0080    /* no output packets */
  98 #define IP_VS_CONN_F_INACTIVE         0x0100    /* not established */
  99 #define IP_VS_CONN_F_OUT_SEQ          0x0200    /* must do output seq adjust */
 100 #define IP_VS_CONN_F_IN_SEQ           0x0400    /* must do input seq adjust */
 101 #define IP_VS_CONN_F_SEQ_MASK         0x0600    /* in/out sequence mask */
 102 #define IP_VS_CONN_F_NO_CPORT         0x0800    /* no client port set yet */
 103
 104 static const value_string connection_type_strings[] = {
 105         {IP_VS_CONN_F_MASQ,      "Masquerade"},
 106         {IP_VS_CONN_F_LOCALNODE, "Local Node"},
 107         {IP_VS_CONN_F_TUNNEL,    "Tunnel"},
 108         {IP_VS_CONN_F_DROUTE,    "Direct Routing"},
 109         {0x00, NULL},
 110 };
 111
 112
 113 static int
 114 dissect_ipvs_syncd(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
 115 {
 116         proto_tree *tree;
 117         proto_item *item;
 118         int         offset = 0;
 119         uint8_t     cnt    = 0;
 120         uint8_t     version = 0;
 121         int         conn   = 0;
 122
 123         item = proto_tree_add_item(parent_tree, proto_ipvs_syncd, tvb, offset, -1, ENC_NA);
 124         tree = proto_item_add_subtree(item, ett_ipvs_syncd);
 125
 126
 127         col_set_str(pinfo->cinfo, COL_PROTOCOL, "IPVS");
 128         col_clear(pinfo->cinfo, COL_INFO);
 129
 130         cnt = tvb_get_uint8(tvb, offset);
 131         if(cnt == 0) { //Version 1 (or after...) first byte is reserved
 132                 proto_tree_add_item(tree, hf_resv, tvb, offset, 1, ENC_NA);
 133                 col_set_str(pinfo->cinfo, COL_INFO, "v1");
 134         } else {
 135                 proto_tree_add_item(tree, hf_conn_count, tvb, offset, 1, ENC_BIG_ENDIAN);
 136                 col_set_str(pinfo->cinfo, COL_INFO, "v0");
 137         }
 138         offset += 1;
 139
 140         proto_tree_add_item(tree, hf_syncid, tvb, offset, 1, ENC_BIG_ENDIAN);
 141         offset += 1;
 142
 143         proto_tree_add_item(tree, hf_size, tvb, offset, 2, ENC_BIG_ENDIAN);
 144         offset += 2;
 145
 146         if(cnt == 0) { //Version 1 (or after...)
 147                 cnt = tvb_get_uint8(tvb, offset);
 148                 proto_tree_add_item(tree, hf_conn_count, tvb, offset, 1, ENC_BIG_ENDIAN);
 149                 offset += 1;
 150
 151                 version = tvb_get_uint8(tvb, offset);
 152                 proto_tree_add_item(tree, hf_version, tvb, offset, 1, ENC_BIG_ENDIAN);
 153                 offset += 1;
 154
 155                 proto_tree_add_item(tree, hf_resv, tvb, offset, 2, ENC_NA);
 156                 offset += 2;
 157         }
 158         col_append_fstr(pinfo->cinfo, COL_INFO, " %u Connection(s)", cnt);
 159
 160         for (conn = 0; conn < cnt; conn++)
 161         {
 162                 if(version) {
 163
 164                         proto_tree *ctree;
 165                         uint8_t type;
 166                         uint16_t size;
 167
 168                         ctree = proto_tree_add_subtree_format(tree, tvb, offset, 36, ett_conn, NULL,
 169                                                               "Connection #%d", conn+1);
 170
 171                         type = tvb_get_uint8(tvb, offset);
 172                         proto_tree_add_item(ctree, hf_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 173                         offset += 1;
 174
 175                         proto_tree_add_item(ctree, hf_proto, tvb, offset, 1, ENC_BIG_ENDIAN);
 176                         offset += 1;
 177
 178                         size = (tvb_get_ntohs(tvb, offset) & 0x1FFF);
 179                         proto_item_set_len(ctree, size);
 180                         proto_tree_add_item(ctree, hf_ver, tvb, offset, 2, ENC_BIG_ENDIAN);
 181                         proto_tree_add_item(ctree, hf_size_v1, tvb, offset, 2, ENC_BIG_ENDIAN);
 182                         offset += 2;
 183
 184                         proto_tree_add_item(ctree, hf_flags_v1, tvb, offset, 4, ENC_BIG_ENDIAN);
 185                         offset += 4;
 186
 187                         proto_tree_add_item(ctree, hf_state, tvb, offset, 2, ENC_BIG_ENDIAN);
 188                         offset += 2;
 189
 190                         proto_tree_add_item(ctree, hf_cport, tvb, offset, 2, ENC_BIG_ENDIAN);
 191                         offset += 2;
 192
 193                         proto_tree_add_item(ctree, hf_vport, tvb, offset, 2, ENC_BIG_ENDIAN);
 194                         offset += 2;
 195
 196                         proto_tree_add_item(ctree, hf_dport, tvb, offset, 2, ENC_BIG_ENDIAN);
 197                         offset += 2;
 198
 199                         proto_tree_add_item(ctree, hf_fwmark, tvb, offset, 4, ENC_BIG_ENDIAN);
 200                         offset += 4;
 201
 202                         proto_tree_add_item(ctree, hf_timeout, tvb, offset, 4, ENC_BIG_ENDIAN);
 203                         offset += 4;
 204
 205                         if(type == 0){ /* IPv4 */
 206
 207                                 proto_tree_add_item(ctree, hf_caddr, tvb, offset, 4, ENC_BIG_ENDIAN);
 208                                 offset += 4;
 209
 210                                 proto_tree_add_item(ctree, hf_vaddr, tvb, offset, 4, ENC_BIG_ENDIAN);
 211                                 offset += 4;
 212
 213                                 proto_tree_add_item(ctree, hf_daddr, tvb, offset, 4, ENC_BIG_ENDIAN);
 214                                 offset += 4;
 215                         } else { /* IPv6 */
 216
 217                                 proto_tree_add_item(ctree, hf_caddr6, tvb, offset, 16, ENC_NA);
 218                                 offset += 16;
 219
 220                                 proto_tree_add_item(ctree, hf_vaddr6, tvb, offset, 16, ENC_NA);
 221                                 offset += 16;
 222
 223                                 proto_tree_add_item(ctree, hf_daddr6, tvb, offset, 16, ENC_NA);
 224                                 offset += 16;
 225                         }
 226
 227                 } else {
 228
 229                         proto_tree *ctree;
 230                         proto_tree *ftree, *fi;
 231                         uint16_t flags;
 232
 233                         ctree = proto_tree_add_subtree_format(tree, tvb, offset, 24, ett_conn, NULL,
 234                                                               "Connection #%d", conn+1);
 235
 236                         proto_tree_add_item(ctree, hf_resv, tvb, offset, 1, ENC_NA);
 237                         offset += 1;
 238
 239                         proto_tree_add_item(ctree, hf_proto, tvb, offset, 1, ENC_BIG_ENDIAN);
 240                         offset += 1;
 241
 242                         proto_tree_add_item(ctree, hf_cport, tvb, offset, 2, ENC_BIG_ENDIAN);
 243                         offset += 2;
 244
 245                         proto_tree_add_item(ctree, hf_vport, tvb, offset, 2, ENC_BIG_ENDIAN);
 246                         offset += 2;
 247
 248                         proto_tree_add_item(ctree, hf_dport, tvb, offset, 2, ENC_BIG_ENDIAN);
 249                         offset += 2;
 250
 251                         proto_tree_add_item(ctree, hf_caddr, tvb, offset, 4, ENC_BIG_ENDIAN);
 252                         offset += 4;
 253
 254                         proto_tree_add_item(ctree, hf_vaddr, tvb, offset, 4, ENC_BIG_ENDIAN);
 255                         offset += 4;
 256
 257                         proto_tree_add_item(ctree, hf_daddr, tvb, offset, 4, ENC_BIG_ENDIAN);
 258                         offset += 4;
 259
 260                         flags = tvb_get_ntohs(tvb, offset);
 261                         fi = proto_tree_add_item(ctree, hf_flags, tvb, offset, 2, ENC_BIG_ENDIAN);
 262                         ftree = proto_item_add_subtree(fi, ett_flags);
 263                         proto_tree_add_item(ftree, hf_flags_conn_type, tvb, offset, 2, ENC_BIG_ENDIAN);
 264                         proto_tree_add_item(ftree, hf_flags_hashed_entry, tvb, offset, 2, ENC_BIG_ENDIAN);
 265                         proto_tree_add_item(ftree, hf_flags_no_output_packets, tvb, offset, 2, ENC_BIG_ENDIAN);
 266                         proto_tree_add_item(ftree, hf_flags_conn_not_established, tvb, offset, 2, ENC_BIG_ENDIAN);
 267                         proto_tree_add_item(ftree, hf_flags_adjust_output_seq, tvb, offset, 2, ENC_BIG_ENDIAN);
 268                         proto_tree_add_item(ftree, hf_flags_adjust_input_seq, tvb, offset, 2, ENC_BIG_ENDIAN);
 269                         proto_tree_add_item(ftree, hf_flags_no_client_port_set, tvb, offset, 2, ENC_BIG_ENDIAN);
 270
 271                         offset += 2;
 272
 273                         proto_tree_add_item(ctree, hf_state, tvb, offset, 2, ENC_BIG_ENDIAN);
 274                         offset += 2;
 275
 276                         /* we have full connection info */
 277                         if ( flags & IP_VS_CONN_F_SEQ_MASK )
 278                         {
 279                                 proto_tree_add_item(ctree, hf_in_seq_init, tvb, offset, 4, ENC_BIG_ENDIAN);
 280                                 offset += 4;
 281
 282                                 proto_tree_add_item(ctree, hf_in_seq_delta, tvb, offset, 4, ENC_BIG_ENDIAN);
 283                                 offset += 4;
 284
 285                                 proto_tree_add_item(ctree, hf_in_seq_pdelta, tvb, offset, 4, ENC_BIG_ENDIAN);
 286                                 offset += 4;
 287
 288                                 proto_tree_add_item(ctree, hf_out_seq_init, tvb, offset, 4, ENC_BIG_ENDIAN);
 289                                 offset += 4;
 290
 291                                 proto_tree_add_item(ctree, hf_out_seq_delta, tvb, offset, 4, ENC_BIG_ENDIAN);
 292                                 offset += 4;
 293
 294                                 proto_tree_add_item(ctree, hf_out_seq_pdelta, tvb, offset, 4, ENC_BIG_ENDIAN);
 295                                 offset += 4;
 296
 297                         }
 298                 }
 299
 300         }
 301
 302         return tvb_captured_length(tvb);
 303 }
 304
 305 void
 306 proto_register_ipvs_syncd(void)
 307 {
 308         static hf_register_info hf[] = {
 309                 { &hf_conn_count,
 310                         { "Connection Count", "ipvs.conncount", FT_UINT8, BASE_DEC,
 311                           NULL, 0, NULL, HFILL }},
 312
 313                 { &hf_syncid,
 314                         { "Synchronization ID", "ipvs.syncid", FT_UINT8, BASE_DEC,
 315                           NULL, 0, NULL, HFILL }},
 316
 317                 { &hf_size,
 318                         { "Size", "ipvs.size", FT_UINT16, BASE_DEC,
 319                           NULL, 0, NULL, HFILL }},
 320
 321                 { &hf_resv,
 322                         { "Reserved", "ipvs.resv", FT_BYTES, BASE_NONE,
 323                           NULL, 0, NULL, HFILL }},
 324
 325                 { &hf_version,
 326                         { "Version", "ipvs.version", FT_UINT8, BASE_DEC,
 327                           NULL, 0, NULL, HFILL }},
 328
 329                 { &hf_proto,
 330                         { "Protocol", "ipvs.proto", FT_UINT8, BASE_HEX,
 331                           VALS(proto_strings), 0, NULL, HFILL }},
 332
 333                 { &hf_cport,
 334                         { "Client Port", "ipvs.cport", FT_UINT16, BASE_DEC,
 335                           NULL, 0, NULL, HFILL }},
 336
 337                 { &hf_vport,
 338                         { "Virtual Port", "ipvs.vport", FT_UINT16, BASE_DEC,
 339                           NULL, 0, NULL, HFILL }},
 340
 341                 { &hf_dport,
 342                         { "Destination Port", "ipvs.dport", FT_UINT16, BASE_DEC,
 343                           NULL, 0, NULL, HFILL }},
 344
 345                 { &hf_caddr,
 346                         { "Client Address", "ipvs.caddr", FT_IPv4, BASE_NONE,
 347                           NULL, 0, NULL, HFILL }},
 348
 349                 { &hf_vaddr,
 350                         { "Virtual Address", "ipvs.vaddr", FT_IPv4, BASE_NONE,
 351                           NULL, 0, NULL, HFILL }},
 352
 353                 { &hf_daddr,
 354                         { "Destination Address", "ipvs.daddr", FT_IPv4, BASE_NONE,
 355                           NULL, 0, NULL, HFILL }},
 356
 357                 { &hf_flags,
 358                         { "Flags", "ipvs.flags", FT_UINT16, BASE_HEX,
 359                           NULL, 0, NULL, HFILL }},
 360
 361                 { &hf_flags_conn_type,
 362                         { "Connection Type", "ipvs.flags.conn_type", FT_UINT16, BASE_HEX,
 363                           VALS(connection_type_strings), 0x0F, NULL, HFILL }},
 364
 365                 { &hf_flags_hashed_entry,
 366                         { "Hashed Entry", "ipvs.flags.hashed_entry", FT_BOOLEAN, 16,
 367                           NULL, IP_VS_CONN_F_HASHED, NULL, HFILL }},
 368
 369                 { &hf_flags_no_output_packets,
 370                         { "No Output Packets", "ipvs.flags.no_output_packets", FT_BOOLEAN, 16,
 371                           NULL, IP_VS_CONN_F_NOOUTPUT, NULL, HFILL }},
 372
 373                 { &hf_flags_conn_not_established,
 374                         { "Connection Not Established", "ipvs.flags.conn_not_established", FT_BOOLEAN, 16,
 375                           NULL, IP_VS_CONN_F_INACTIVE, NULL, HFILL }},
 376
 377                 { &hf_flags_adjust_output_seq,
 378                         { "Adjust Output Sequence", "ipvs.flags.adjust_output_seq", FT_BOOLEAN, 16,
 379                           NULL, IP_VS_CONN_F_OUT_SEQ, NULL, HFILL }},
 380
 381                 { &hf_flags_adjust_input_seq,
 382                         { "Adjust Input Sequence", "ipvs.flags.adjust_input_seq", FT_BOOLEAN, 16,
 383                           NULL, IP_VS_CONN_F_IN_SEQ, NULL, HFILL }},
 384
 385                 { &hf_flags_no_client_port_set,
 386                         { "No Client Port Set", "ipvs.flags.no_client_port_set", FT_BOOLEAN, 16,
 387                           NULL, IP_VS_CONN_F_NO_CPORT, NULL, HFILL }},
 388
 389                 { &hf_state,
 390                         { "State", "ipvs.state", FT_UINT16, BASE_HEX,
 391                           VALS(state_strings), 0, NULL, HFILL }},
 392
 393                 { &hf_in_seq_init,
 394                         { "Input Sequence (Initial)", "ipvs.in_seq.initial", FT_UINT32,
 395                                 BASE_HEX, NULL, 0, NULL, HFILL }},
 396
 397                 { &hf_in_seq_delta,
 398                         { "Input Sequence (Delta)", "ipvs.in_seq.delta", FT_UINT32,
 399                                 BASE_HEX, NULL, 0, NULL, HFILL }},
 400
 401                 { &hf_in_seq_pdelta,
 402                         { "Input Sequence (Previous Delta)", "ipvs.in_seq.pdelta", FT_UINT32,
 403                                 BASE_HEX, NULL, 0, NULL, HFILL }},
 404
 405                 { &hf_out_seq_init,
 406                         { "Output Sequence (Initial)", "ipvs.out_seq.initial", FT_UINT32,
 407                                 BASE_HEX, NULL, 0, NULL, HFILL }},
 408
 409                 { &hf_out_seq_delta,
 410                         { "Output Sequence (Delta)", "ipvs.out_seq.delta", FT_UINT32,
 411                                 BASE_HEX, NULL, 0, NULL, HFILL }},
 412
 413                 { &hf_out_seq_pdelta,
 414                         { "Output Sequence (Previous Delta)", "ipvs.out_seq.pdelta", FT_UINT32,
 415                                 BASE_HEX, NULL, 0, NULL, HFILL }},
 416
 417                 /* v1 payload */
 418
 419                 { &hf_type,
 420                         { "Type", "ipvs.type", FT_UINT8, BASE_DEC,
 421                           VALS(type_strings), 0, NULL, HFILL }},
 422
 423                 { &hf_ver,
 424                         { "Version", "ipvs.ver", FT_UINT16, BASE_DEC,
 425                           NULL, 0xE000, NULL, HFILL }},
 426
 427                 { &hf_size_v1,
 428                         { "Size", "ipvs.size.v1", FT_UINT16, BASE_DEC,
 429                           NULL, 0x1FFF, NULL, HFILL }},
 430
 431                 { &hf_flags_v1,
 432                         { "Flags", "ipvs.flags.v1", FT_UINT32, BASE_HEX,
 433                           NULL, 0, NULL, HFILL }},
 434
 435                 { &hf_fwmark,
 436                         { "FWmark", "ipvs.fwmark", FT_UINT32, BASE_HEX,
 437                           NULL, 0, NULL, HFILL }},
 438
 439                 { &hf_timeout,
 440                         { "Timeout", "ipvs.timeout", FT_UINT32, BASE_DEC,
 441                           NULL, 0, NULL, HFILL }},
 442
 443                 { &hf_caddr6,
 444                         { "Client Address", "ipvs.caddr6", FT_IPv6, BASE_NONE,
 445                           NULL, 0, NULL, HFILL }},
 446
 447                 { &hf_vaddr6,
 448                         { "Virtual Address", "ipvs.vaddr6", FT_IPv6, BASE_NONE,
 449                           NULL, 0, NULL, HFILL }},
 450
 451                 { &hf_daddr6,
 452                         { "Destination Address", "ipvs.daddr6", FT_IPv6, BASE_NONE,
 453                           NULL, 0, NULL, HFILL }},
 454
 455         };
 456         static int *ett[] = {
 457                 &ett_ipvs_syncd,
 458                 &ett_conn,
 459                 &ett_flags,
 460         };
 461
 462         proto_ipvs_syncd = proto_register_protocol("IP Virtual Services Sync Daemon", "IPVS", "ipvs");
 463         proto_register_field_array(proto_ipvs_syncd, hf, array_length(hf));
 464         proto_register_subtree_array(ett, array_length(ett));
 465
 466         ipvs_syncd_handle = register_dissector("ipvs", dissect_ipvs_syncd, proto_ipvs_syncd);
 467 }
 468
 469 void
 470 proto_reg_handoff_ipvs_syncd(void)
 471 {
 472         dissector_add_uint_with_preference("udp.port", IPVS_SYNCD_PORT, ipvs_syncd_handle);
 473 }
 474
 475 /*
 476  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 477  *
 478  * Local variables:
 479  * c-basic-offset: 8
 480  * tab-width: 8
 481  * indent-tabs-mode: t
 482  * End:
 483  *
 484  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 485  * :indentSize=8:tabSize=8:noTabs=false:
 486  */