epan/dissectors/packet-moldudp64.c

   1 /* packet-moldudp64.c
   2  * Routines for MoldUDP64 dissection
   3  * Copyright 2012, Evan Huus <eapache@gmail.com>
   4  *
   5  * http://www.nasdaqtrader.com/content/technicalsupport/specifications/dataproducts/moldudp64.pdf
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * SPDX-License-Identifier: GPL-2.0-or-later
  12  */
  13
  14 #include "config.h"
  15
  16 #include <epan/packet.h>
  17 #include <epan/expert.h>
  18 #include <epan/decode_as.h>
  19
  20 void proto_register_moldudp64(void);
  21 void proto_reg_handoff_moldudp64(void);
  22
  23 static dissector_handle_t moldudp64_handle;
  24
  25 /* Initialize the protocol and registered fields */
  26 static int proto_moldudp64;
  27 static int hf_moldudp64_session;
  28 static int hf_moldudp64_sequence;
  29 static int hf_moldudp64_count;
  30 static int hf_moldudp64_msgblk;
  31 static int hf_moldudp64_msglen;
  32 static int hf_moldudp64_msgseq;
  33 static int hf_moldudp64_msgdata;
  34
  35 #define MOLDUDP64_SESSION_LEN  10
  36 #define MOLDUDP64_SEQUENCE_LEN  8
  37 #define MOLDUDP64_COUNT_LEN     2
  38 #define MOLDUDP64_MSGLEN_LEN    2
  39
  40 #define MOLDUDP64_HEARTBEAT 0x0000
  41 #define MOLDUDP64_ENDOFSESS 0xFFFF
  42
  43 /* Initialize the subtree pointers */
  44 static int ett_moldudp64;
  45 static int ett_moldudp64_msgblk;
  46
  47 static expert_field ei_moldudp64_msglen_invalid;
  48 static expert_field ei_moldudp64_end_of_session_extra;
  49 static expert_field ei_moldudp64_count_invalid;
  50 static expert_field ei_moldudp64_request;
  51
  52 static dissector_table_t moldudp64_payload_table;
  53
  54 static void moldudp64_prompt(packet_info *pinfo _U_, char* result)
  55 {
  56     snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Payload as");
  57 }
  58
  59 /* Code to dissect a message block */
  60 static unsigned
  61 dissect_moldudp64_msgblk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
  62         unsigned offset, uint64_t sequence)
  63 {
  64     proto_item *ti;
  65     proto_tree *blk_tree;
  66     uint16_t    msglen, real_msglen, whole_len;
  67     int         remaining;
  68     tvbuff_t*   next_tvb;
  69
  70     if (tvb_captured_length_remaining(tvb, offset) < MOLDUDP64_MSGLEN_LEN)
  71         return 0;
  72
  73     msglen = tvb_get_ntohs(tvb, offset);
  74     remaining = tvb_reported_length(tvb) - offset - MOLDUDP64_MSGLEN_LEN;
  75
  76     if (remaining < 0)
  77         real_msglen = 0;
  78     else if (msglen <= remaining)
  79         real_msglen = msglen;
  80     else
  81         real_msglen = remaining;
  82
  83     /* msglen and real_msglen only count the data section, and don't
  84      * include the two bytes for the length field itself. */
  85     whole_len = real_msglen + MOLDUDP64_MSGLEN_LEN;
  86
  87     ti = proto_tree_add_item(tree, hf_moldudp64_msgblk,
  88             tvb, offset, whole_len, ENC_NA);
  89
  90     blk_tree = proto_item_add_subtree(ti, ett_moldudp64_msgblk);
  91
  92     ti = proto_tree_add_uint64(blk_tree, hf_moldudp64_msgseq,
  93             tvb, offset, 0, sequence);
  94
  95     proto_item_set_generated(ti);
  96
  97     ti = proto_tree_add_item(blk_tree, hf_moldudp64_msglen,
  98             tvb, offset, MOLDUDP64_MSGLEN_LEN, ENC_BIG_ENDIAN);
  99
 100     if (msglen != real_msglen)
 101         expert_add_info_format(pinfo, ti, &ei_moldudp64_msglen_invalid,
 102                 "Invalid Message Length (claimed %u, found %u)",
 103                 msglen, real_msglen);
 104
 105     offset += MOLDUDP64_MSGLEN_LEN;
 106
 107     next_tvb = tvb_new_subset_length(tvb, offset, real_msglen);
 108     if (!dissector_try_payload_new(moldudp64_payload_table, next_tvb, pinfo, tree, false, NULL))
 109     {
 110         proto_tree_add_item(blk_tree, hf_moldudp64_msgdata, tvb, offset, real_msglen, ENC_NA);
 111     }
 112
 113     return whole_len;
 114 }
 115
 116 /* Code to actually dissect the packets */
 117 static int
 118 dissect_moldudp64(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 119 {
 120     proto_item *ti;
 121     proto_tree *moldudp64_tree;
 122     unsigned    offset            = 0;
 123     uint16_t    count, real_count = 0;
 124     uint64_t    sequence;
 125
 126     /* Check that there's enough data */
 127     if (tvb_reported_length(tvb) < (MOLDUDP64_SESSION_LEN  +
 128                                     MOLDUDP64_SEQUENCE_LEN +
 129                                     MOLDUDP64_COUNT_LEN))
 130         return 0;
 131
 132     /* Make entries in Protocol column and Info column on summary display */
 133     col_set_str(pinfo->cinfo, COL_PROTOCOL, "MoldUDP64");
 134
 135     /* Clear the info column so it's sane if we crash. We fill it in later when
 136      * we've dissected more of the packet. */
 137     col_clear(pinfo->cinfo, COL_INFO);
 138
 139     sequence = tvb_get_ntoh64(tvb, MOLDUDP64_SESSION_LEN);
 140     count = tvb_get_ntohs(tvb, MOLDUDP64_SESSION_LEN + MOLDUDP64_SEQUENCE_LEN);
 141
 142     if (count == MOLDUDP64_HEARTBEAT)
 143         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP64 Heartbeat");
 144     else if (count == MOLDUDP64_ENDOFSESS)
 145         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP64 End Of Session");
 146     else if (count > 0 && tvb_reported_length(tvb) == (MOLDUDP64_SESSION_LEN  +
 147                                                        MOLDUDP64_SEQUENCE_LEN +
 148                                                        MOLDUDP64_COUNT_LEN))
 149         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP64 Request");
 150     else
 151         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP64 Messages");
 152
 153     /* create display subtree for the protocol */
 154     ti = proto_tree_add_item(tree, proto_moldudp64,
 155                              tvb, offset, -1, ENC_NA);
 156
 157     moldudp64_tree = proto_item_add_subtree(ti, ett_moldudp64);
 158
 159     proto_tree_add_item(moldudp64_tree, hf_moldudp64_session,
 160                         tvb, offset, MOLDUDP64_SESSION_LEN, ENC_ASCII);
 161     offset += MOLDUDP64_SESSION_LEN;
 162
 163     proto_tree_add_item(moldudp64_tree, hf_moldudp64_sequence,
 164                         tvb, offset, MOLDUDP64_SEQUENCE_LEN, ENC_BIG_ENDIAN);
 165     offset += MOLDUDP64_SEQUENCE_LEN;
 166
 167     ti = proto_tree_add_item(moldudp64_tree, hf_moldudp64_count,
 168                              tvb, offset, MOLDUDP64_COUNT_LEN, ENC_BIG_ENDIAN);
 169     offset += MOLDUDP64_COUNT_LEN;
 170
 171     while (tvb_reported_length(tvb) >= offset + MOLDUDP64_MSGLEN_LEN)
 172     {
 173         offset += dissect_moldudp64_msgblk(tvb, pinfo, moldudp64_tree,
 174                                            offset, sequence++);
 175         real_count++;
 176     }
 177
 178     if (count == MOLDUDP64_ENDOFSESS && real_count != 0)
 179     {
 180         expert_add_info(pinfo, ti, &ei_moldudp64_end_of_session_extra);
 181     }
 182     else if (count > 0 && real_count == 0)
 183     {
 184         expert_add_info(pinfo, ti, &ei_moldudp64_request);
 185     }
 186     else if (real_count != count)
 187     {
 188         expert_add_info_format(pinfo, ti, &ei_moldudp64_count_invalid,
 189                                "Invalid Message Count (claimed %u, found %u)",
 190                                count, real_count);
 191     }
 192
 193     /* Return the amount of data this dissector was able to dissect */
 194     return tvb_captured_length(tvb);
 195 }
 196
 197
 198 /* Register the protocol with Wireshark */
 199 void
 200 proto_register_moldudp64(void)
 201 {
 202     /* Setup list of header fields */
 203     static hf_register_info hf[] = {
 204
 205         { &hf_moldudp64_session,
 206         { "Session",       "moldudp64.session",  FT_STRING, BASE_NONE, NULL, 0,
 207           "The session to which this packet belongs.", HFILL }},
 208
 209         { &hf_moldudp64_sequence,
 210         { "Sequence",      "moldudp64.sequence", FT_UINT64, BASE_DEC,  NULL, 0,
 211           "The sequence number of the first message in this packet.", HFILL }},
 212
 213         { &hf_moldudp64_count,
 214         { "Count",         "moldudp64.count",    FT_UINT16, BASE_DEC,  NULL, 0,
 215           "The number of messages contained in this packet.", HFILL }},
 216
 217         { &hf_moldudp64_msgblk,
 218         { "Message Block", "moldudp64.msgblock", FT_NONE,   BASE_NONE, NULL, 0,
 219           "A message.", HFILL }},
 220
 221         { &hf_moldudp64_msglen,
 222         { "Length",        "moldudp64.msglen",   FT_UINT16, BASE_DEC,  NULL, 0,
 223           "The length of this message.", HFILL }},
 224
 225         { &hf_moldudp64_msgseq,
 226         { "Sequence",      "moldudp64.msgseq",   FT_UINT64, BASE_DEC,  NULL, 0,
 227           "The sequence number of this message.", HFILL }},
 228
 229         { &hf_moldudp64_msgdata,
 230         { "Payload",       "moldudp64.msgdata",  FT_BYTES,  BASE_NONE, NULL, 0,
 231           "The payload data of this message.", HFILL }}
 232     };
 233
 234     /* Setup protocol subtree array */
 235     static int *ett[] = {
 236         &ett_moldudp64,
 237         &ett_moldudp64_msgblk
 238     };
 239
 240     static ei_register_info ei[] = {
 241         { &ei_moldudp64_msglen_invalid, { "moldudp64.msglen.invalid", PI_MALFORMED, PI_ERROR, "Invalid Message Length", EXPFILL }},
 242         { &ei_moldudp64_end_of_session_extra, { "moldudp64.end_of_session_extra", PI_MALFORMED, PI_ERROR, "End Of Session packet with extra data.", EXPFILL }},
 243         { &ei_moldudp64_count_invalid, { "moldudp64.count.invalid", PI_MALFORMED, PI_ERROR, "Invalid Message Count", EXPFILL }},
 244         { &ei_moldudp64_request, { "moldudp64.request", PI_COMMENTS_GROUP, PI_COMMENT, "Number of Requested Messages", EXPFILL }},
 245     };
 246
 247     expert_module_t* expert_moldudp64;
 248
 249     /* Register the protocol name and description */
 250     proto_moldudp64 = proto_register_protocol("MoldUDP64", "MoldUDP64", "moldudp64");
 251
 252     /* Required function calls to register the header fields and subtrees used */
 253     proto_register_field_array(proto_moldudp64, hf, array_length(hf));
 254     proto_register_subtree_array(ett, array_length(ett));
 255     expert_moldudp64 = expert_register_protocol(proto_moldudp64);
 256     expert_register_field_array(expert_moldudp64, ei, array_length(ei));
 257
 258     moldudp64_payload_table = register_decode_as_next_proto(proto_moldudp64, "moldudp64.payload",
 259                                                             "MoldUDP64 Payload", moldudp64_prompt);
 260
 261     /* Register the dissector */
 262     moldudp64_handle = register_dissector("moldudp64", dissect_moldudp64, proto_moldudp64);
 263 }
 264
 265
 266 void
 267 proto_reg_handoff_moldudp64(void)
 268 {
 269     dissector_add_for_decode_as_with_preference("udp.port", moldudp64_handle);
 270 }
 271
 272 /*
 273  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 274  *
 275  * Local variables:
 276  * c-basic-offset: 4
 277  * tab-width: 8
 278  * indent-tabs-mode: nil
 279  * End:
 280  *
 281  * vi: set shiftwidth=4 tabstop=8 expandtab:
 282  * :indentSize=4:tabSize=8:noTabs=true:
 283  */