?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / epan / dissectors / packet-cisco-mcp.c
blob92c76315ae65b83dfe49a340289c8570c49798d3
1 /* packet-cisco-mcp.c
2 * Routines for the disassembly of Cisco's MCP (MisCabling Protocol)
3 *
4 * Copyright 2019 Joerg Mayer (see AUTHORS file)
5 *
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
9 *
10 * SPDX-License-Identifier: GPL-2.0-or-later
11 */
12
13 /*
14 TODO:
15 - Figure out the hash calculation
16 - Figure out strict mode tlv
17
18 Specs: No specs available
19 No header
20 Sequence of TLVs of format
21 Type (1 byte)
22 Length (1 byte)
23 Value (Length bytes of Data)
24
25 Patent:
26 http://www.freepatentsonline.com/20150124643.pdf
27 Documentation:
28 https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737909.pdf
29 https://unofficialaciguide.com/2018/03/27/using-mcp-miscabling-protocol-for-aci/
30 knet_parser.py from Cisco
31 Strict mode:
32 https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/5x/aci-fundamentals/cisco-aci-fundamentals-52x/fundamentals-52x.html#Cisco_Concept.dita_637b67a2-6826-4cc4-8fbf-6998dc791d8b
33 */
34
35 #include "config.h"
36
37 #include <epan/packet.h>
38 #include <epan/expert.h>
39 #include <epan/to_str.h>
40 #include <epan/cisco_pid.h>
41
42 void proto_register_mcp(void);
43 void proto_reg_handoff_mcp(void);
44
45 static dissector_handle_t mcp_handle;
46
47 static int proto_mcp;
48 /* TLV header */
49 static int hf_mcp_tlv_type;
50 static int hf_mcp_strict_tlv_type;
51 static int hf_mcp_tlv_length;
52 /* Values */
53 static int hf_mcp_fabric_id;
54 static int hf_mcp_node_id;
55 static int hf_mcp_vpc_domain;
56 static int hf_mcp_vpc_id;
57 static int hf_mcp_vpc_vtep;
58 static int hf_mcp_port_id;
59 static int hf_mcp_send_time;
60 static int hf_mcp_strictmode;
61 static int hf_mcp_digest;
62 static int hf_mcp_unknown;
63
64 static expert_field ei_mcp_short_tlv;
65 static expert_field ei_mcp_trailing_bytes;
66 static expert_field ei_mcp_unexpected_tlv_length;
67
68 static int ett_mcp;
69 static int ett_mcp_tlv_header;
70
71 #define PROTO_SHORT_NAME "MCP"
72 #define PROTO_LONG_NAME "Miscabling Protocol"
73
74 // non-strict mode
75 typedef enum { // Total length of MCPDU = 62
76 MCP_TYPE_FABRIC_ID = 1, // Len=4,
77 MCP_TYPE_NODE_ID = 2, // Len=4,
78 MCP_TYPE_VPC_INFO = 3, // Len=12,
79 MCP_TYPE_PORT_ID = 4, // Len=4,
80 MCP_TYPE_SEND_TIME = 5, // Len=4,
81 MCP_TYPE_DIGEST = 6, // Len=20,
82 MCP_TYPE_END = 7 // Len=0
83 } mcp_type_t;
84
85 // strict mode - minimum ACI software: 5.2(4)
86 typedef enum { // Total length of MCPDU = 68
87 MCPS_TYPE_FABRIC_ID = 1, // Len=4,
88 MCPS_TYPE_NODE_ID = 2, // Len=4,
89 MCPS_TYPE_VPC_INFO = 3, // Len=12,
90 MCPS_TYPE_PORT_ID = 4, // Len=4,
91 MCPS_TYPE_SEND_TIME = 5, // Len=4,
92 MCPS_TYPE_STRICTMODE = 6, // Len=4
93 MCPS_TYPE_DIGEST = 7, // Len=20,
94 MCPS_TYPE_END = 8 // Len=0
95 } mcp_strict_type_t;
96
97 static const value_string mcp_type_vals[] = {
98 { MCP_TYPE_FABRIC_ID, "Fabric ID"},
99 { MCP_TYPE_NODE_ID, "Node ID"},
100 { MCP_TYPE_VPC_INFO, "VPC Info"},
101 { MCP_TYPE_PORT_ID, "Port ID"},
102 { MCP_TYPE_SEND_TIME, "Send Time"},
103 { MCP_TYPE_DIGEST, "Digest"},
104 { MCP_TYPE_END, "End"},
105
106 { 0, NULL }
107 };
108
109 static const value_string mcp_strict_type_vals[] = {
110 { MCPS_TYPE_FABRIC_ID, "Fabric ID"},
111 { MCPS_TYPE_NODE_ID, "Node ID"},
112 { MCPS_TYPE_VPC_INFO, "VPC Info"},
113 { MCPS_TYPE_PORT_ID, "Port ID"},
114 { MCPS_TYPE_SEND_TIME, "Send Time"},
115 { MCPS_TYPE_STRICTMODE, "Strictmode?"},
116 { MCPS_TYPE_DIGEST, "Digest"},
117 { MCPS_TYPE_END, "End"},
118
119 { 0, NULL }
120 };
121
122 static int
123 dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
124 {
125 proto_item *ti;
126 proto_tree *mcp_tree;
127 proto_tree *tlv_tree;
128 uint32_t offset = 0;
129 bool last = false;
130 bool strict_mode = true;
131 uint8_t tlv_type, use_tlv;
132 uint16_t tlv_length;
133 uint16_t data_length = tvb_reported_length_remaining(tvb, offset);
134 uint32_t fabricid, nodeid, vpcdomain, vpcid, portid, sendtime, strictmode;
135 char *sendtime_str, *vpcvtep_str;
136
137 col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_SHORT_NAME);
138 col_clear(pinfo->cinfo, COL_INFO);
139
140 ti = proto_tree_add_item(tree, proto_mcp, tvb, offset, -1,
141 ENC_NA);
142 mcp_tree = proto_item_add_subtree(ti, ett_mcp);
143
144 /* No header whatsoever, just a plain sequence of TLVs */
145 while (offset < data_length && !last) {
146 if (data_length - offset < 2) {
147 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_short_tlv, tvb,
148 offset, data_length, "Too few bytes left for TLV (%u < 2)", data_length - offset);
149 break;
150 }
151 tlv_type = tvb_get_uint8(tvb, offset);
152 // HACK: Interestring version handling
153 use_tlv = tlv_type;
154 if (data_length == 62) {
155 strict_mode = false;
156 if (tlv_type >= MCPS_TYPE_STRICTMODE) {
157 use_tlv = tlv_type + 1;
158 }
159 }
160
161 tlv_length = tvb_get_uint8(tvb, offset + 1);
162
163 if (strict_mode) {
164 tlv_tree = proto_tree_add_subtree_format(mcp_tree, tvb, offset, tlv_length + 2,
165 ett_mcp_tlv_header, NULL, "%s", val_to_str(tlv_type, mcp_strict_type_vals, "Unknown (0x%02x)"));
166 proto_tree_add_uint(tlv_tree, hf_mcp_strict_tlv_type, tvb, offset, 1, tlv_type);
167 } else {
168 tlv_tree = proto_tree_add_subtree_format(mcp_tree, tvb, offset, tlv_length + 2,
169 ett_mcp_tlv_header, NULL, "%s", val_to_str(tlv_type, mcp_type_vals, "Unknown (0x%02x)"));
170 proto_tree_add_uint(tlv_tree, hf_mcp_tlv_type, tvb, offset, 1, tlv_type);
171 }
172 offset += 1;
173
174 proto_tree_add_uint(tlv_tree, hf_mcp_tlv_length, tvb, offset, 1, tlv_length);
175 if (tlv_length > (data_length - (offset + 1))) {
176 proto_tree_add_expert_format(tlv_tree, pinfo, &ei_mcp_short_tlv, tvb,
177 offset, 1, "TLV length (%u) passes end of packet", tlv_length);
178 break;
179 }
180 offset += 1;
181
182 switch (use_tlv) {
183 case MCPS_TYPE_FABRIC_ID:
184 if (tlv_length == 4) {
185 proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_fabric_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &fabricid);
186 proto_item_append_text(tlv_tree, ": %u", fabricid);
187 col_append_fstr(pinfo->cinfo, COL_INFO, "FabricID/%u ", fabricid);
188 } else {
189 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
190 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
191 4, tlv_length);
192 }
193 break;
194 case MCPS_TYPE_NODE_ID:
195 if (tlv_length == 4) {
196 proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_node_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &nodeid);
197 proto_item_append_text(tlv_tree, ": %u", nodeid);
198 col_append_fstr(pinfo->cinfo, COL_INFO, "NodeID/%u ", nodeid);
199 } else {
200 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
201 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
202 4, tlv_length);
203 }
204 break;
205 case MCPS_TYPE_VPC_INFO:
206 proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_vpc_domain, tvb, offset, 4, ENC_NA, &vpcdomain);
207 proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_vpc_id, tvb, offset + 4, 4, ENC_NA, &vpcid);
208 proto_tree_add_item(tlv_tree, hf_mcp_vpc_vtep, tvb, offset + 8, 4, ENC_NA);
209 vpcvtep_str = tvb_address_to_str(pinfo->pool, tvb, AT_IPv4, offset + 8);
210 proto_item_append_text(tlv_tree, ": %u/%u/%s", vpcdomain, vpcid, vpcvtep_str);
211 col_append_fstr(pinfo->cinfo, COL_INFO, "VpcInfo/%u,%u,%s ", vpcdomain, vpcid, vpcvtep_str);
212 break;
213 case MCPS_TYPE_PORT_ID:
214 if (tlv_length == 4) {
215 proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_port_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &portid);
216 proto_item_append_text(tlv_tree, ": 0x%08x", portid);
217 col_append_fstr(pinfo->cinfo, COL_INFO, "PortID/0x%08x ", portid);
218 } else {
219 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
220 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
221 4, tlv_length);
222 }
223 break;
224 case MCPS_TYPE_SEND_TIME:
225 if (tlv_length == 4) {
226 proto_tree_add_item(tlv_tree, hf_mcp_send_time, tvb, offset, tlv_length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
227 sendtime = tvb_get_ntohl(tvb, offset);
228 sendtime_str = abs_time_secs_to_str(pinfo->pool, sendtime, ABSOLUTE_TIME_LOCAL, true);
229 proto_item_append_text(tlv_tree, ": %s", sendtime_str);
230 col_append_fstr(pinfo->cinfo, COL_INFO, "SendTime/%s ", sendtime_str);
231 } else {
232 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
233 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
234 4, tlv_length);
235 }
236 break;
237 case MCPS_TYPE_STRICTMODE:
238 if (tlv_length == 4) {
239 proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_strictmode, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &strictmode);
240 proto_item_append_text(tlv_tree, ": %d", strictmode);
241 col_append_fstr(pinfo->cinfo, COL_INFO, "Unk1/%d ", strictmode);
242 } else {
243 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
244 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
245 4, tlv_length);
246 }
247 break;
248 case MCPS_TYPE_DIGEST:
249 if (tlv_length == 20) {
250 proto_tree_add_item(tlv_tree, hf_mcp_digest, tvb, offset, tlv_length, ENC_NA);
251 } else {
252 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
253 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
254 20, tlv_length);
255 }
256 break;
257 case MCPS_TYPE_END:
258 last = true;
259 if (tlv_length != 0) {
260 proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
261 offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
262 0, tlv_length);
263 }
264 break;
265 default:
266 proto_tree_add_item(tlv_tree, hf_mcp_unknown, tvb, offset, tlv_length, ENC_NA);
267 break;
268 }
269 offset += tlv_length;
270 }
271 if (offset < data_length) {
272 proto_tree_add_expert(mcp_tree, pinfo, &ei_mcp_trailing_bytes, tvb, offset,
273 data_length - offset);
274 }
275
276 return tvb_captured_length(tvb);
277 }
278
279 void
280 proto_register_mcp(void)
281 {
282 static hf_register_info hf[] = {
283
284 /* TLV header (aka TL) */
285 { &hf_mcp_tlv_type,
286 { "TLV type", "mcp.tlv.type", FT_UINT8, BASE_DEC, VALS(mcp_type_vals),
287 0x0, NULL, HFILL }},
288
289 { &hf_mcp_strict_tlv_type,
290 { "TLV type", "mcp.tlv.type", FT_UINT8, BASE_DEC, VALS(mcp_strict_type_vals),
291 0x0, NULL, HFILL }},
292
293 { &hf_mcp_tlv_length,
294 { "TLV length", "mcp.tlv.length", FT_UINT16, BASE_DEC, NULL,
295 0x0, NULL, HFILL }},
296
297 /* TLV data (aka V) */
298 { &hf_mcp_fabric_id,
299 { "Fabric ID", "mcp.fabric_id", FT_UINT32, BASE_DEC, NULL,
300 0x0, NULL, HFILL }},
301
302 { &hf_mcp_node_id,
303 { "Node ID", "mcp.node_id", FT_UINT32, BASE_DEC, NULL,
304 0x0, "Originating Switch", HFILL }},
305
306 { &hf_mcp_vpc_domain,
307 { "VPC Domain", "mcp.vpc.domain", FT_UINT32, BASE_DEC, NULL,
308 0x0, NULL, HFILL }},
309
310 { &hf_mcp_vpc_id,
311 { "VPC ID", "mcp.vpc.id", FT_UINT32, BASE_DEC, NULL,
312 0x0, NULL, HFILL }},
313
314 { &hf_mcp_vpc_vtep,
315 { "VPC VTEP", "mcp.vpc.vtep", FT_IPv4, BASE_NONE, NULL,
316 0x0, NULL, HFILL }},
317
318 { &hf_mcp_port_id,
319 { "Port ID", "mcp.port_id", FT_UINT32, BASE_HEX, NULL,
320 0x0, NULL, HFILL }},
321
322 { &hf_mcp_send_time,
323 { "Send Time", "mcp.send_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL,
324 0x0, NULL, HFILL }},
325
326 { &hf_mcp_strictmode,
327 { "Strict Mode?", "mcp.strictmode", FT_UINT32, BASE_DEC, NULL,
328 0x0, NULL, HFILL }},
329
330 { &hf_mcp_digest,
331 { "Digest", "mcp.digest", FT_BYTES, BASE_NONE, NULL,
332 0x0, NULL, HFILL }},
333
334 { &hf_mcp_unknown,
335 { "Unknown", "mcp.unknown", FT_BYTES, BASE_NONE, NULL,
336 0x0, NULL, HFILL }},
337
338 };
339
340 static int *ett[] = {
341 &ett_mcp,
342 &ett_mcp_tlv_header,
343 };
344
345 static ei_register_info ei[] = {
346 { &ei_mcp_short_tlv,
347 { "mcp.short_tlv", PI_MALFORMED, PI_ERROR,
348 "TLV is too short", EXPFILL }},
349
350 { &ei_mcp_trailing_bytes,
351 { "mcp.trailing_bytes", PI_PROTOCOL, PI_WARN,
352 "Trailing bytes after last TLV", EXPFILL }},
353
354 { &ei_mcp_unexpected_tlv_length,
355 { "mcp.unexpected_tlv_length", PI_PROTOCOL, PI_WARN,
356 "Expected Value length differs from seen length", EXPFILL }},
357 };
358
359 expert_module_t* expert_mcp;
360
361 proto_mcp = proto_register_protocol(PROTO_LONG_NAME, PROTO_SHORT_NAME, "mcp");
362 proto_register_field_array(proto_mcp, hf, array_length(hf));
363 proto_register_subtree_array(ett, array_length(ett));
364 expert_mcp = expert_register_protocol(proto_mcp);
365 expert_register_field_array(expert_mcp, ei, array_length(ei));
366
367 mcp_handle = register_dissector("mcp", dissect_mcp, proto_mcp);
368 }
369
370 void
371 proto_reg_handoff_mcp(void)
372 {
373 dissector_add_uint("llc.cisco_pid", CISCO_PID_MCP, mcp_handle);
374 }
375
376 /*
377 * Editor modelines - https://www.wireshark.org/tools/modelines.html
378 *
379 * Local variables:
380 * c-basic-offset: 8
381 * tab-width: 8
382 * indent-tabs-mode: t
383 * End:
384 *
385 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
386 * :indentSize=8:tabSize=8:noTabs=false:
387 */
Metzes wireshark repo