?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / epan / dissectors / packet-erf.c
blobe3e834be2dedaf02993b3287c6c0c410da75676f
1 /* packet-erf.c
2 * Routines for ERF encapsulation dissection
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
10
11 #include "config.h"
12
13 #include <epan/packet.h>
14 #include <epan/expert.h>
15 #include <epan/prefs.h>
16 #include <epan/ipproto.h>
17 #include <epan/tfs.h>
18 #include <epan/unit_strings.h>
19 #include <wsutil/str_util.h>
20 #include <wiretap/wtap.h>
21 #include <wiretap/erf_record.h>
22
23 #include "packet-erf.h"
24 #include "packet-ptp.h"
25
26 /*
27 */
28
29 void proto_register_erf(void);
30 void proto_reg_handoff_erf(void);
31
32 #define DECHAN_MAX_LINE_RATE 5
33 #define DECHAN_MAX_VC_SIZE 5
34 #define DECHAN_MAX_AUG_INDEX 4
35
36 typedef struct sdh_g707_format_s
37 {
38 uint8_t m_sdh_line_rate;
39 uint8_t m_vc_size ;
40 int8_t m_vc_index_array[DECHAN_MAX_AUG_INDEX];
41 /* i = 3 --> ITU-T letter #D - index of AUG-16
42 * i = 2 --> ITU-T letter #C - index of AUG-4,
43 * i = 1 --> ITU-T letter #B - index of AUG-1
44 * i = 0 --> ITU-T letter #A - index of AU3*/
45 } sdh_g707_format_t;
46
47 static dissector_handle_t erf_handle;
48 static dissector_table_t erf_dissector_table;
49
50 /* Initialize the protocol and registered fields */
51 static int proto_erf;
52
53 static int hf_erf_ts;
54 static int hf_erf_rectype;
55 static int hf_erf_type;
56 static int hf_erf_ehdr;
57 static int hf_erf_ehdr_t;
58 static int hf_erf_flags;
59 static int hf_erf_flags_cap;
60 static int hf_erf_flags_if_raw;
61 static int hf_erf_flags_vlen;
62 static int hf_erf_flags_trunc;
63 static int hf_erf_flags_rxe;
64 static int hf_erf_flags_dse;
65 static int hf_erf_flags_res;
66
67 static int hf_erf_rlen;
68 static int hf_erf_lctr;
69 static int hf_erf_color;
70 static int hf_erf_wlen;
71
72 /* Classification extension header */
73
74 /* InterceptID extension header */
75 static int hf_erf_ehdr_int_res1;
76 static int hf_erf_ehdr_int_id;
77 static int hf_erf_ehdr_int_res2;
78
79 /* Raw Link extension header */
80 static int hf_erf_ehdr_raw_link_res;
81 static int hf_erf_ehdr_raw_link_seqnum;
82 static int hf_erf_ehdr_raw_link_rate;
83 static int hf_erf_ehdr_raw_link_type;
84
85 /* Classification extension header */
86 static int hf_erf_ehdr_class_flags;
87 static int hf_erf_ehdr_class_flags_sh;
88 static int hf_erf_ehdr_class_flags_shm;
89 static int hf_erf_ehdr_class_flags_res1;
90 static int hf_erf_ehdr_class_flags_user;
91 static int hf_erf_ehdr_class_flags_res2;
92 static int hf_erf_ehdr_class_flags_drop;
93 static int hf_erf_ehdr_class_flags_str;
94 static int hf_erf_ehdr_class_seqnum;
95
96 /* BFS extension header */
97 static int hf_erf_ehdr_bfs_hash;
98 static int hf_erf_ehdr_bfs_color;
99 static int hf_erf_ehdr_bfs_raw_hash;
100
101 /* Channelised extension header */
102 static int hf_erf_ehdr_chan_morebits;
103 static int hf_erf_ehdr_chan_morefrag;
104 static int hf_erf_ehdr_chan_seqnum;
105 static int hf_erf_ehdr_chan_res;
106 static int hf_erf_ehdr_chan_virt_container_id;
107 static int hf_erf_ehdr_chan_assoc_virt_container_size;
108 static int hf_erf_ehdr_chan_rate;
109 static int hf_erf_ehdr_chan_type;
110
111 /* Filter Hash extension header */
112 static int hf_erf_ehdr_signature_payload_hash;
113 static int hf_erf_ehdr_signature_color;
114 static int hf_erf_ehdr_signature_flow_hash;
115
116 /* Flow ID extension header */
117 static int hf_erf_ehdr_flow_id_source_id;
118 static int hf_erf_ehdr_flow_id_hash_type;
119 static int hf_erf_ehdr_flow_id_hash_type_type;
120 static int hf_erf_ehdr_flow_id_hash_type_inner;
121 static int hf_erf_ehdr_flow_id_stack_type;
122 static int hf_erf_ehdr_flow_id_flow_hash;
123
124 /* Host ID extension header */
125 static int hf_erf_ehdr_host_id_sourceid;
126 static int hf_erf_ehdr_host_id_hostid;
127
128 /* Anchor ID extension header */
129 static int hf_erf_ehdr_anchor_id_definition;
130 static int hf_erf_ehdr_anchor_id_reserved;
131 static int hf_erf_ehdr_anchor_id_anchorid;
132 static int hf_erf_ehdr_anchor_id_flags;
133
134 static int hf_erf_anchor_linked;
135 static int hf_erf_anchor_anchorid;
136 static int hf_erf_anchor_hostid;
137
138 /* Generated Host ID/Source ID */
139 static int hf_erf_sourceid;
140 static int hf_erf_hostid;
141 static int hf_erf_source_current;
142 static int hf_erf_source_next;
143 static int hf_erf_source_prev;
144
145 /* Entropy extension header */
146 static int hf_erf_ehdr_entropy_entropy;
147 static int hf_erf_ehdr_entropy_entropy_raw;
148 static int hf_erf_ehdr_entropy_reserved;
149
150 /* Unknown extension header */
151 static int hf_erf_ehdr_unk;
152
153 /* MC HDLC Header */
154 static int hf_erf_mc_hdlc;
155 static int hf_erf_mc_hdlc_cn;
156 static int hf_erf_mc_hdlc_res1;
157 static int hf_erf_mc_hdlc_res2;
158 static int hf_erf_mc_hdlc_fcse;
159 static int hf_erf_mc_hdlc_sre;
160 static int hf_erf_mc_hdlc_lre;
161 static int hf_erf_mc_hdlc_afe;
162 static int hf_erf_mc_hdlc_oe;
163 static int hf_erf_mc_hdlc_lbe;
164 static int hf_erf_mc_hdlc_first;
165 static int hf_erf_mc_hdlc_res3;
166
167 /* MC RAW Header */
168 static int hf_erf_mc_raw;
169 static int hf_erf_mc_raw_int;
170 static int hf_erf_mc_raw_res1;
171 static int hf_erf_mc_raw_sre;
172 static int hf_erf_mc_raw_lre;
173 static int hf_erf_mc_raw_res2;
174 static int hf_erf_mc_raw_lbe;
175 static int hf_erf_mc_raw_first;
176 static int hf_erf_mc_raw_res3;
177
178 /* MC ATM Header */
179 static int hf_erf_mc_atm;
180 static int hf_erf_mc_atm_cn;
181 static int hf_erf_mc_atm_res1;
182 static int hf_erf_mc_atm_mul;
183 static int hf_erf_mc_atm_port;
184 static int hf_erf_mc_atm_res2;
185 static int hf_erf_mc_atm_lbe;
186 static int hf_erf_mc_atm_hec;
187 static int hf_erf_mc_atm_crc10;
188 static int hf_erf_mc_atm_oamcell;
189 static int hf_erf_mc_atm_first;
190 static int hf_erf_mc_atm_res3;
191
192 /* MC Raw link Header */
193 static int hf_erf_mc_rawl;
194 static int hf_erf_mc_rawl_cn;
195 static int hf_erf_mc_rawl_res1;
196 static int hf_erf_mc_rawl_lbe;
197 static int hf_erf_mc_rawl_first;
198 static int hf_erf_mc_rawl_res2;
199
200 /* MC AAL5 Header */
201 static int hf_erf_mc_aal5;
202 static int hf_erf_mc_aal5_cn;
203 static int hf_erf_mc_aal5_res1;
204 static int hf_erf_mc_aal5_port;
205 static int hf_erf_mc_aal5_crcck;
206 static int hf_erf_mc_aal5_crce;
207 static int hf_erf_mc_aal5_lenck;
208 static int hf_erf_mc_aal5_lene;
209 static int hf_erf_mc_aal5_res2;
210 static int hf_erf_mc_aal5_first;
211 static int hf_erf_mc_aal5_res3;
212
213 /* MC AAL2 Header */
214 static int hf_erf_mc_aal2;
215 static int hf_erf_mc_aal2_cn;
216 static int hf_erf_mc_aal2_res1;
217 static int hf_erf_mc_aal2_res2;
218 static int hf_erf_mc_aal2_port;
219 static int hf_erf_mc_aal2_res3;
220 static int hf_erf_mc_aal2_first;
221 static int hf_erf_mc_aal2_maale;
222 static int hf_erf_mc_aal2_lene;
223 static int hf_erf_mc_aal2_cid;
224
225 /* AAL2 Header */
226 static int hf_erf_aal2;
227 static int hf_erf_aal2_cid;
228 static int hf_erf_aal2_maale;
229 static int hf_erf_aal2_maalei;
230 static int hf_erf_aal2_first;
231 static int hf_erf_aal2_res1;
232
233 /* ERF Ethernet header/pad */
234 static int hf_erf_eth;
235 static int hf_erf_eth_off;
236 static int hf_erf_eth_pad;
237
238 /* ERF Meta record tag */
239 static int hf_erf_meta_tag_type;
240 static int hf_erf_meta_tag_len;
241 static int hf_erf_meta_tag_unknown;
242
243 /* Initialize the subtree pointers */
244 static int ett_erf;
245 static int ett_erf_pseudo_hdr;
246 static int ett_erf_rectype;
247 static int ett_erf_hash_type;
248 static int ett_erf_flags;
249 static int ett_erf_mc_hdlc;
250 static int ett_erf_mc_raw;
251 static int ett_erf_mc_atm;
252 static int ett_erf_mc_rawlink;
253 static int ett_erf_mc_aal5;
254 static int ett_erf_mc_aal2;
255 static int ett_erf_aal2;
256 static int ett_erf_eth;
257 static int ett_erf_meta;
258 static int ett_erf_meta_tag;
259 static int ett_erf_source;
260 static int ett_erf_anchor;
261 static int ett_erf_anchor_flags;
262 static int ett_erf_entropy_value;
263
264 static expert_field ei_erf_extension_headers_not_shown;
265 static expert_field ei_erf_packet_loss;
266 static expert_field ei_erf_mc_hdlc_checksum_error;
267 static expert_field ei_erf_mc_hdlc_short_error;
268 static expert_field ei_erf_mc_hdlc_long_error;
269 static expert_field ei_erf_mc_hdlc_abort_error;
270 static expert_field ei_erf_mc_hdlc_octet_error;
271 static expert_field ei_erf_mc_hdlc_lost_byte_error;
272 static expert_field ei_erf_rx_error;
273 static expert_field ei_erf_ds_error;
274 static expert_field ei_erf_truncation_error;
275 static expert_field ei_erf_meta_section_len_error;
276 static expert_field ei_erf_meta_truncated_record;
277 static expert_field ei_erf_meta_truncated_tag;
278 static expert_field ei_erf_meta_zero_len_tag;
279 static expert_field ei_erf_meta_reset;
280
281 typedef enum {
282 ERF_HDLC_CHDLC = 0,
283 ERF_HDLC_PPP = 1,
284 ERF_HDLC_FRELAY = 2,
285 ERF_HDLC_MTP2 = 3,
286 ERF_HDLC_GUESS = 4,
287 ERF_HDLC_MAX = 5
288 } erf_hdlc_type_vals;
289
290 static int erf_hdlc_type = ERF_HDLC_GUESS;
291 static dissector_handle_t chdlc_handle, ppp_handle, frelay_handle, mtp2_handle;
292
293 static bool erf_rawcell_first;
294
295 typedef enum {
296 ERF_AAL5_GUESS = 0,
297 ERF_AAL5_LLC = 1,
298 ERF_AAL5_UNSPEC = 2
299 } erf_aal5_type_val;
300
301 static int erf_aal5_type = ERF_AAL5_GUESS;
302 static dissector_handle_t atm_untruncated_handle;
303
304 static dissector_handle_t sdh_handle;
305
306 /* ERF Extension Header */
307 #define ERF_EHDR_FLOW_ID_HASH_TYPE_TYPE_MASK 0x7f
308 #define ERF_EHDR_FLOW_ID_HASH_TYPE_INNER_MASK 0x80
309
310 /* Classification */
311 #define EHDR_CLASS_FLAGS_MASK 0x00ffffff
312 #define EHDR_CLASS_SH_MASK 0x00800000
313 #define EHDR_CLASS_SHM_MASK 0x00400000
314 #define EHDR_CLASS_RES1_MASK 0x00300000
315 #define EHDR_CLASS_USER_MASK 0x000FFFF0
316 #define EHDR_CLASS_RES2_MASK 0x00000008
317 #define EHDR_CLASS_DROP_MASK 0x00000004
318 #define EHDR_CLASS_STER_MASK 0x00000003
319
320 /* Header for ATM traffic identification */
321 #define ATM_HDR_LENGTH 4
322
323 /* Multi Channel HDLC */
324 #define MC_HDLC_CN_MASK 0x000003ff
325 #define MC_HDLC_RES1_MASK 0x0000fc00
326 #define MC_HDLC_RES2_MASK 0x00ff0000
327 #define MC_HDLC_FCSE_MASK 0x01000000
328 #define MC_HDLC_SRE_MASK 0x02000000
329 #define MC_HDLC_LRE_MASK 0x04000000
330 #define MC_HDLC_AFE_MASK 0x08000000
331 #define MC_HDLC_OE_MASK 0x10000000
332 #define MC_HDLC_LBE_MASK 0x20000000
333 #define MC_HDLC_FIRST_MASK 0x40000000
334 #define MC_HDLC_RES3_MASK 0x80000000
335
336 /* Multi Channel RAW */
337 #define MC_RAW_INT_MASK 0x0000000f
338 #define MC_RAW_RES1_MASK 0x01fffff0
339 #define MC_RAW_SRE_MASK 0x02000000
340 #define MC_RAW_LRE_MASK 0x04000000
341 #define MC_RAW_RES2_MASK 0x18000000
342 #define MC_RAW_LBE_MASK 0x20000000
343 #define MC_RAW_FIRST_MASK 0x40000000
344 #define MC_RAW_RES3_MASK 0x80000000
345
346 /* Multi Channel ATM */
347 #define MC_ATM_CN_MASK 0x000003ff
348 #define MC_ATM_RES1_MASK 0x00007c00
349 #define MC_ATM_MUL_MASK 0x00008000
350 #define MC_ATM_PORT_MASK 0x000f0000
351 #define MC_ATM_RES2_MASK 0x00f00000
352 #define MC_ATM_LBE_MASK 0x01000000
353 #define MC_ATM_HEC_MASK 0x02000000
354 #define MC_ATM_CRC10_MASK 0x04000000
355 #define MC_ATM_OAMCELL_MASK 0x08000000
356 #define MC_ATM_FIRST_MASK 0x10000000
357 #define MC_ATM_RES3_MASK 0xe0000000
358
359 /* Multi Channel RAW Link */
360 #define MC_RAWL_CN_MASK 0x000003ff
361 #define MC_RAWL_RES1_MASK 0x1ffffc00
362 #define MC_RAWL_LBE_MASK 0x20000000
363 #define MC_RAWL_FIRST_MASK 0x40000000
364 #define MC_RAWL_RES2_MASK 0x80000000
365
366 /* Multi Channel AAL5 */
367 #define MC_AAL5_CN_MASK 0x000003ff
368 #define MC_AAL5_RES1_MASK 0x0000fc00
369 #define MC_AAL5_PORT_MASK 0x000f0000
370 #define MC_AAL5_CRCCK_MASK 0x00100000
371 #define MC_AAL5_CRCE_MASK 0x00200000
372 #define MC_AAL5_LENCK_MASK 0x00400000
373 #define MC_AAL5_LENE_MASK 0x00800000
374 #define MC_AAL5_RES2_MASK 0x0f000000
375 #define MC_AAL5_FIRST_MASK 0x10000000
376 #define MC_AAL5_RES3_MASK 0xe0000000
377
378 /* Multi Channel AAL2 */
379 #define MC_AAL2_CN_MASK 0x000003ff
380 #define MC_AAL2_RES1_MASK 0x00001c00
381 #define MC_AAL2_RES2_MASK 0x0000e000
382 #define MC_AAL2_PORT_MASK 0x000f0000
383 #define MC_AAL2_RES3_MASK 0x00100000
384 #define MC_AAL2_FIRST_MASK 0x00200000
385 #define MC_AAL2_MAALE_MASK 0x00400000
386 #define MC_AAL2_LENE_MASK 0x00800000
387 #define MC_AAL2_CID_MASK 0xff000000
388 #define MC_AAL2_CID_SHIFT 24
389
390 /* AAL2 */
391 #define AAL2_CID_MASK 0x000000ff
392 #define AAL2_CID_SHIFT 0
393 #define AAL2_MAALE_MASK 0x0000ff00
394 #define AAL2_MAALEI_MASK 0x00010000
395 #define AAL2_FIRST_MASK 0x00020000
396 #define AAL2_RES1_MASK 0xfffc0000
397
398 /* ETH */
399 #define ETH_OFF_MASK 0x00
400 #define ETH_RES1_MASK 0x00
401
402 /* Invalid Provenance sections used for special lookup */
403 #define ERF_META_SECTION_NONE 0
404 #define ERF_META_SECTION_UNKNOWN 1
405
406 #define NS_PER_S 1000000000
407
408 /* Record type defines */
409 static const value_string erf_type_vals[] = {
410 { ERF_TYPE_LEGACY ,"LEGACY"},
411 { ERF_TYPE_HDLC_POS ,"HDLC_POS"},
412 { ERF_TYPE_ETH ,"ETH"},
413 { ERF_TYPE_ATM ,"ATM"},
414 { ERF_TYPE_AAL5 ,"AAL5"},
415 { ERF_TYPE_MC_HDLC ,"MC_HDLC"},
416 { ERF_TYPE_MC_RAW ,"MC_RAW"},
417 { ERF_TYPE_MC_ATM ,"MC_ATM"},
418 { ERF_TYPE_MC_RAW_CHANNEL ,"MC_RAW_CHANNEL"},
419 { ERF_TYPE_MC_AAL5 ,"MC_AAL5"},
420 { ERF_TYPE_COLOR_HDLC_POS ,"COLOR_HDLC_POS"},
421 { ERF_TYPE_COLOR_ETH ,"COLOR_ETH"},
422 { ERF_TYPE_COLOR_HASH_POS ,"COLOR_HASH_POS"},
423 { ERF_TYPE_COLOR_HASH_ETH ,"COLOR_HASH_ETH"},
424 { ERF_TYPE_MC_AAL2 ,"MC_AAL2 "},
425 { ERF_TYPE_IP_COUNTER ,"IP_COUNTER"},
426 { ERF_TYPE_TCP_FLOW_COUNTER ,"TCP_FLOW_COUNTER"},
427 { ERF_TYPE_DSM_COLOR_HDLC_POS ,"DSM_COLOR_HDLC_POS"},
428 { ERF_TYPE_DSM_COLOR_ETH ,"DSM_COLOR_ETH "},
429 { ERF_TYPE_COLOR_MC_HDLC_POS ,"COLOR_MC_HDLC_POS"},
430 { ERF_TYPE_AAL2 ,"AAL2"},
431 { ERF_TYPE_PAD ,"PAD"},
432 { ERF_TYPE_INFINIBAND , "INFINIBAND"},
433 { ERF_TYPE_IPV4 , "IPV4"},
434 { ERF_TYPE_IPV6 , "IPV6"},
435 { ERF_TYPE_RAW_LINK , "RAW_LINK"},
436 { ERF_TYPE_INFINIBAND_LINK , "INFINIBAND_LINK"},
437 { ERF_TYPE_META , "META"},
438 { ERF_TYPE_OPA_SNC , "OMNI-PATH_SNC"},
439 { ERF_TYPE_OPA_9B , "OMNI-PATH"},
440 {0, NULL}
441 };
442
443 /* Extended headers type defines */
444 static const value_string ehdr_type_vals[] = {
445 { ERF_EXT_HDR_TYPE_CLASSIFICATION , "Classification"},
446 { ERF_EXT_HDR_TYPE_INTERCEPTID , "InterceptID"},
447 { ERF_EXT_HDR_TYPE_RAW_LINK , "Raw Link"},
448 { ERF_EXT_HDR_TYPE_BFS , "BFS Filter/Hash"},
449 { ERF_EXT_HDR_TYPE_CHANNELISED , "Channelised"},
450 { ERF_EXT_HDR_TYPE_SIGNATURE , "Signature"},
451 { ERF_EXT_HDR_TYPE_PKT_ID , "Packet ID"},
452 { ERF_EXT_HDR_TYPE_FLOW_ID , "Flow ID"},
453 { ERF_EXT_HDR_TYPE_HOST_ID , "Host ID"},
454 { ERF_EXT_HDR_TYPE_ANCHOR_ID , "Anchor ID"},
455 { ERF_EXT_HDR_TYPE_ENTROPY , "Entropy"},
456 { 0, NULL }
457 };
458
459 /* Used for Provenance ext_hdrs_added/removed, should match the field abbreviation */
460 static const value_string ehdr_type_vals_short[] = {
461 { ERF_EXT_HDR_TYPE_CLASSIFICATION , "class"},
462 { ERF_EXT_HDR_TYPE_INTERCEPTID , "int"},
463 { ERF_EXT_HDR_TYPE_RAW_LINK , "raw"},
464 { ERF_EXT_HDR_TYPE_BFS , "bfs"},
465 { ERF_EXT_HDR_TYPE_CHANNELISED , "chan"},
466 { ERF_EXT_HDR_TYPE_SIGNATURE , "signature"},
467 { ERF_EXT_HDR_TYPE_PKT_ID , "packetid"},
468 { ERF_EXT_HDR_TYPE_FLOW_ID , "flowid"},
469 { ERF_EXT_HDR_TYPE_HOST_ID , "hostid"},
470 { ERF_EXT_HDR_TYPE_ANCHOR_ID , "anchorid"},
471 { ERF_EXT_HDR_TYPE_ENTROPY , "entropy"},
472 { 0, NULL }
473 };
474
475 /* XXX: Must be at least array_length(ehdr_type_vals). */
476 #define ERF_HF_VALUES_PER_TAG 32
477
478 static const value_string raw_link_types[] = {
479 { 0x00, "raw SONET"},
480 { 0x01, "raw SDH"},
481 { 0x02, "SONET spe"},
482 { 0x03, "SDH spe"},
483 { 0x04, "ds3"},
484 { 0x05, "SONET spe w/o POH"},
485 { 0x06, "SDH spe w/o POH"},
486 { 0x07, "SONET line mode 2"},
487 { 0x08, "SHD line mode 2"},
488 { 0x09, "raw bit-level"},
489 { 0x0A, "raw 10Gbe 66b"},
490 { 0, NULL },
491 };
492
493 static const value_string raw_link_rates[] = {
494 { 0x00, "reserved"},
495 { 0x01, "oc3/stm1"},
496 { 0x02, "oc12/stm4"},
497 { 0x03, "oc48/stm16"},
498 { 0x04, "oc192/stm64"},
499 { 0, NULL },
500 };
501
502 static const value_string channelised_assoc_virt_container_size[] = {
503 { 0x00, "unused field"},
504 { 0x01, "VC-3 / STS-1"},
505 { 0x02, "VC-4 / STS-3"},
506 { 0x03, "VC-4-4c / STS-12"},
507 { 0x04, "VC-4-16c / STS-48"},
508 { 0x05, "VC-4-64c / STS-192"},
509 { 0, NULL }
510 };
511
512 static const value_string channelised_rate[] = {
513 { 0x00, "Reserved"},
514 { 0x01, "STM-0 / STS-1"},
515 { 0x02, "STM-1 / STS-3"},
516 { 0x03, "STM-4 / STS-12"},
517 { 0x04, "STM-16 / STS-48"},
518 { 0x05, "STM-64 / STS-192"},
519 { 0, NULL}
520 };
521
522 static const value_string channelised_type[] = {
523 { 0x00, "SOH / TOH"},
524 { 0x01, "POH"},
525 { 0x02, "Container"},
526 { 0x03, "POS Packet"},
527 { 0x04, "ATM Cell"},
528 { 0x05, "Positive justification bytes"},
529 { 0x06, "Raw demultiplexed channel"},
530 { 0, NULL}
531 };
532
533 static const value_string erf_hash_type[] = {
534 { 0x00, "Not set"},
535 { 0x01, "Non-IP (Src/Dst MACs, EtherType)"},
536 { 0x02, "2-tuple (Src/Dst IPs)"},
537 { 0x03, "3-tuple (Src/Dst IPs, IP Protocol)"},
538 { 0x04, "4-tuple (Src/Dst IPs, IP Protocol, Interface ID)"},
539 { 0x05, "5-tuple (Src/Dst IPs, IP Protocol, Src/Dst L4 Ports)"},
540 { 0x06, "6-tuple (Src/Dst IPs, IP Protocol, Src/Dst L4 Ports, Interface ID)"},
541 { 0, NULL}
542 };
543
544 static const value_string erf_hash_mode[] = {
545 { 0x00, "Reserved"},
546 { 0x01, "Reserved"},
547 { 0x02, "2-tuple (Src/Dst IPs)"},
548 { 0x03, "3-tuple (Src/Dst IPs, IP Protocol)"},
549 { 0x04, "4-tuple (Src/Dst IPs, IP Protocol, Interface ID)"},
550 { 0x05, "5-tuple (Src/Dst IPs, IP Protocol, Src/Dst L4 Ports)"},
551 { 0x06, "6-tuple (Src/Dst IPs, IP Protocol, Src/Dst L4 Ports, Interface ID)"},
552 { 0x07, "2-tuple (Inner Src/Dst IPs)"},
553 { 0x08, "4-tuple (Inner Src/Dst IPs, Outer Src/Dst IPs)"},
554 { 0x09, "4-tuple (Inner Src/Dst IPs, Inner Src/Dst L4 Ports)"},
555 { 0x0A, "6-tuple (Inner Src/Dst IPs, Outer Src/Dst IPs, Inner Src/Dst L4 Ports)"},
556 { 0, NULL}
557 };
558
559 static const value_string erf_stack_type[] = {
560 { 0x00, "Not set"},
561 { 0x01, "Non-IP"},
562 { 0x02, "No VLAN, IPv4"},
563 { 0x03, "No VLAN, IPv6"},
564 { 0x04, "One VLAN, IPv4"},
565 { 0x05, "One VLAN, IPv6"},
566 { 0x06, "Two VLANs, IPv4"},
567 { 0x07, "Two VLANs, IPv6"},
568 { 0, NULL}
569 };
570 static const value_string erf_port_type[] = {
571 { 0x00, "Reserved"},
572 { 0x01, "Capture Port"},
573 { 0x02, "Timing Port"},
574 { 0, NULL}
575 };
576
577 static const value_string erf_clk_source[] = {
578 { 0x00, "Invalid"},
579 { 0x01, "None" },
580 { 0x02, "External"},
581 { 0x03, "Host"},
582 { 0x04, "Link Cable"},
583 { 0x05, "PTP"},
584 { 0x06, "Internal"},
585 { 0, NULL}
586 };
587
588 static const value_string erf_clk_state[] = {
589 { 0x00, "Invalid" },
590 { 0x01, "Unsynchronized"},
591 { 0x02, "Synchronized"},
592 { 0, NULL}
593 };
594
595 static const value_string erf_clk_link_mode[] = {
596 { 0x00, "Invalid"},
597 { 0x01, "Not Connected"},
598 { 0x02, "Master"},
599 { 0x03, "Disabled Master"},
600 { 0x04, "Slave"},
601 { 0, NULL}
602 };
603
604 static const value_string erf_clk_port_proto[] = {
605 { 0x00, "Invalid" },
606 { 0x01, "None" },
607 { 0x02, "1PPS" },
608 { 0x03, "IRIG-B" },
609 { 0x04, "Ethernet" },
610 { 0, NULL }
611 };
612
613 static const value_string erf_tap_mode[] = {
614 { 0x00, "Invalid" },
615 { 0x01, "Off" },
616 { 0x02, "Active" },
617 { 0x03, "Monitor" },
618 { 0x04, "Bypass" },
619 { 0x05, "Blocking" },
620 { 0, NULL }
621 };
622
623 static const value_string erf_tap_fail_mode[] = {
624 { 0x00, "Invalid" },
625 { 0x01, "Off" },
626 { 0x02, "Open" },
627 { 0x03, "Closed" },
628 { 0, NULL }
629 };
630
631 static const value_string erf_dpi_state[] = {
632 { 0x00, "Terminated"},
633 { 0x01, "Inspecting"},
634 { 0x02, "Monitoring"},
635 { 0x03, "Classified"},
636 { 0, NULL}
637 };
638
639 static const value_string erf_flow_state[] = {
640 { 0x00, "Active"},
641 { 0x01, "Terminated"},
642 { 0x02, "Expired"},
643 { 0, NULL}
644 };
645
646 /* Used as templates for ERF_META_TAG_tunneling_mode */
647 static const header_field_info erf_tunneling_modes[] = {
648 { "IP-in-IP", "ip_in_ip", FT_BOOLEAN, 32, NULL, 0x1, NULL, HFILL },
649 /* 0x02 is currently unused and reserved */
650 { "VXLAN", "vxlan", FT_BOOLEAN, 32, NULL, 0x4, NULL, HFILL },
651 { "GRE", "gre", FT_BOOLEAN, 32, NULL, 0x8, NULL, HFILL },
652 { "GTP", "gtp", FT_BOOLEAN, 32, NULL, 0x10, NULL, HFILL },
653 { "MPLS over VLAN", "mpls_vlan", FT_BOOLEAN, 32, NULL, 0x20, NULL, HFILL }
654 };
655
656
657 /* Used as templates for ERF_META_TAG_if_link_status */
658 static const header_field_info erf_link_status[] = {
659 { "Link", "link", FT_BOOLEAN, 32, TFS(&tfs_up_down), 0x1, NULL, HFILL }
660 };
661
662 /* Used as templates for ERF_META_TAG_ptp_time_properties */
663 static const header_field_info erf_ptp_time_properties_flags[] = {
664 { "Leap61", "leap61", FT_BOOLEAN, 32, NULL, 0x1, NULL, HFILL },
665 { "Leap59", "leap59", FT_BOOLEAN, 32, NULL, 0x2, NULL, HFILL },
666 { "Current UTC Offset Valid", "currentUtcOffsetValid", FT_BOOLEAN, 32, NULL, 0x4, NULL, HFILL },
667 { "PTP Timescale", "ptpTimescale", FT_BOOLEAN, 32, NULL, 0x8, NULL, HFILL },
668 { "Time Traceable", "timeTraceable", FT_BOOLEAN, 32, NULL, 0x10, NULL, HFILL },
669 { "Frequency Traceable", "frequencyTraceable", FT_BOOLEAN, 32, NULL, 0x20, NULL, HFILL }
670 };
671
672 /* Used as templates for ERF_META_TAG_ptp_gm_clock_quality */
673 static const header_field_info erf_ptp_clock_quality[] = {
674 { "Clock Class", "clockClass", FT_UINT32, BASE_DEC, NULL, 0xFF000000, NULL, HFILL },
675 { "Clock Accuracy", "clockAccuracy", FT_UINT32, BASE_DEC | BASE_EXT_STRING, &ptp_v2_clockAccuracy_vals_ext, 0x00FF0000, NULL, HFILL },
676 { "Offset Scaled Log Variance","offsetScaledLogVariance", FT_UINT32, BASE_DEC, NULL, 0x0000FFFF, NULL, HFILL },
677 };
678
679 /* Used as templates for ERF_META_TAG_parent_section */
680 static const header_field_info erf_parent_section[] = {
681 { "Section Type", "section_type", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL },
682 { "Section ID", "section_id", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }
683 };
684
685 /* Used as templates for ERF_META_TAG_stream_flags */
686 static const header_field_info erf_stream_flags[] = {
687 { "Relative Snapping", "relative_snap", FT_BOOLEAN, 32, NULL, 0x1, NULL, HFILL },
688 { "Entropy Snapping", "entropy_snap", FT_BOOLEAN, 32, NULL, 0x2, NULL, HFILL }
689 };
690
691 /* Used as templates for ERF_META_TAG_ext_hdrs_added/removed subtrees */
692 static const header_field_info erf_ext_hdr_items[] = {
693 { "Extension Headers 0 to 31", "0_31", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL },
694 { "Extension Headers 32 to 63", "32_63", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL },
695 { "Extension Headers 64 to 95", "64_95", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL },
696 { "Extension Headers 96 to 127", "96_127", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }
697 };
698
699 /* Used as templates for ERF_META_TAG_smart_trunc_default */
700 static const header_field_info erf_smart_trunc_default_flags[] = {
701 { "Truncation Candidate", "trunc_candidate", FT_BOOLEAN, 32, &tfs_yes_no, 0x1, NULL, HFILL }
702 };
703
704 typedef struct {
705 uint16_t code;
706 header_field_info hfinfo;
707 } erf_meta_hf_template_t;
708
709 typedef struct {
710 int ett_value;
711 /*
712 * XXX: Must be at least array_length(ehdr_type_vals). Should change to
713 * dynamic (possibly using new proto tree API) if many more fields defined.
714 * Non-trivial as bitmask functions take an array of pointers not values.
715 * Either that or add a value-string-like automatic bitmask flags proto_item.
716 *
717 * Note that this struct is only added for tags that need it.
718 */
719 int hf_values[ERF_HF_VALUES_PER_TAG];
720 } erf_meta_tag_info_ex_t;
721
722 typedef struct {
723 uint16_t code;
724 uint16_t section;
725 const erf_meta_hf_template_t* tag_template;
726 const erf_meta_hf_template_t* section_template;
727
728 int ett;
729 int hf_value;
730 erf_meta_tag_info_ex_t *extra;
731 /* TODO: could add a type_value and callback here for greater flexibility */
732 } erf_meta_tag_info_t;
733
734 typedef struct {
735 wmem_map_t* tag_table;
736 wmem_array_t* hfri;
737 wmem_array_t* ett;
738 wmem_array_t* vs_list;
739 wmem_array_t* vs_abbrev_list;
740 erf_meta_tag_info_t* unknown_section_info;
741 } erf_meta_index_t;
742
743 typedef struct {
744 wmem_map_t* source_map;
745 wmem_map_t* host_anchor_map;
746 uint64_t implicit_host_id;
747 } erf_state_t;
748
749 typedef struct {
750 wmem_tree_t* meta_tree;
751 wmem_list_t* meta_list;
752 } erf_source_info_t;
753
754 typedef struct {
755 unsigned frame_num;
756 } erf_anchored_info_t;
757
758 typedef struct {
759 wmem_tree_t* anchored_tree;
760 wmem_list_t* anchored_list;
761 } erf_host_anchor_info_t;
762
763 typedef struct {
764 uint64_t host_id;
765 uint64_t anchor_id;
766 } erf_anchor_key_t;
767
768 #define ERF_SOURCE_KEY(host_id, source_id) (((uint64_t) host_id << 16) | source_id)
769 #define ERF_TAG_INFO_KEY(tag_info) (((uint32_t) (tag_info)->section << 16) | (tag_info)->code)
770
771 static erf_meta_index_t erf_meta_index;
772 static erf_state_t erf_state;
773
774 /*
775 * XXX: These header_field_info are used as templates for dynamically building
776 * per-section fields for each tag, as well as appropriate value_string arrays.
777 * We abuse the abbrev field to store the short name of the tags.
778 */
779 static const erf_meta_hf_template_t erf_meta_tags[] = {
780 { ERF_META_TAG_padding, { "Padding", "padding", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
781 { ERF_META_TAG_comment, { "Comment", "comment", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
782 { ERF_META_TAG_gen_time, { "Metadata Generation Time", "gen_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, NULL, HFILL } },
783 { ERF_META_TAG_parent_section, { "Parent Section", "parent_section", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
784 { ERF_META_TAG_reset, { "Metadata Reset", "reset", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
785 { ERF_META_TAG_event_time, { "Event Time", "event_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, NULL, HFILL } },
786 { ERF_META_TAG_host_id, { "Host ID", "host_id", FT_UINT64, BASE_HEX, NULL, 0x0, NULL, HFILL } },
787 { ERF_META_TAG_attribute, { "Attribute", "attribute", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
788 { ERF_META_TAG_fcs_len, { "FCS Length (bits)", "fcs_len", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
789 { ERF_META_TAG_mask_ipv4, { "Subnet Mask (IPv4)", "mask_ipv4", FT_IPv4, BASE_NETMASK, NULL, 0x0, NULL, HFILL } },
790 { ERF_META_TAG_mask_cidr, { "Subnet Mask (CIDR)", "mask_cidr", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
791
792 { ERF_META_TAG_org_name, { "Organisation", "org_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
793 { ERF_META_TAG_name, { "Name", "name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
794 { ERF_META_TAG_descr, { "Description", "descr", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
795 { ERF_META_TAG_config, { "Configuration", "config", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
796 { ERF_META_TAG_datapipe, { "Datapipe Name", "datapipe", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
797 { ERF_META_TAG_app_name, { "Application Name", "app_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
798 { ERF_META_TAG_os, { "Operating System", "os", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
799 { ERF_META_TAG_hostname, { "Hostname", "hostname", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
800 { ERF_META_TAG_user, { "User", "user", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
801 { ERF_META_TAG_model, { "Model", "model", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
802 { ERF_META_TAG_fw_version, { "Firmware Version", "fw_version", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
803 { ERF_META_TAG_serial_no, { "Serial Number", "serial_no", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
804 { ERF_META_TAG_ts_offset, { "Timestamp Offset", "ts_offset", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
805 { ERF_META_TAG_ts_clock_freq, { "Timestamp Clock Frequency (Hz)", "ts_clock_freq", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
806 { ERF_META_TAG_tzone, { "Timezone Offset", "tzone", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
807 { ERF_META_TAG_tzone_name, { "Timezone Name", "tzone_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
808 { ERF_META_TAG_loc_lat, { "Location Latitude", "loc_lat", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
809 { ERF_META_TAG_loc_long, { "Location Longitude", "loc_long", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
810 { ERF_META_TAG_snaplen, { "Snap Length", "snaplen", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
811 { ERF_META_TAG_card_num, { "Card Number", "card_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
812 { ERF_META_TAG_module_num, { "Module Number", "module_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
813 { ERF_META_TAG_access_num, { "Access Number", "access_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
814 { ERF_META_TAG_stream_num, { "Stream Number", "stream_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
815 { ERF_META_TAG_loc_name, { "Location Name", "loc_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
816 { ERF_META_TAG_parent_file, { "Parent Filename", "parent_file", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
817 { ERF_META_TAG_filter, { "Filter", "filter", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
818 { ERF_META_TAG_flow_hash_mode, { "Flow Hash Mode", "flow_hash_mode", FT_UINT32, BASE_DEC, VALS(erf_hash_mode), 0x0, NULL, HFILL } },
819 { ERF_META_TAG_tunneling_mode, { "Tunneling Mode", "tunneling_mode", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
820 { ERF_META_TAG_npb_format, { "NPB Format", "npb_format", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
821 { ERF_META_TAG_mem, { "Memory", "mem", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
822 { ERF_META_TAG_datamine_id, { "Datamine ID", "datamine_id", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
823 { ERF_META_TAG_rotfile_id, { "Rotfile ID", "rotfile_id", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
824 { ERF_META_TAG_rotfile_name, { "Rotfile Name", "rotfile_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
825 { ERF_META_TAG_dev_name, { "Device Name", "dev_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
826 { ERF_META_TAG_dev_path, { "Device Canonical Path", "dev_path", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
827 { ERF_META_TAG_loc_descr, { "Location Description", "loc_descr", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
828 { ERF_META_TAG_app_version, { "Application Version", "app_version", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
829 { ERF_META_TAG_cpu_affinity, { "CPU Affinity Mask", "cpu_affinity", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
830 { ERF_META_TAG_cpu, { "CPU Model", "cpu", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
831 { ERF_META_TAG_cpu_phys_cores, { "CPU Physical Cores", "cpu_phys_cores", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
832 { ERF_META_TAG_cpu_numa_nodes, { "CPU NUMA Nodes", "cpu_numa_nodes", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
833 { ERF_META_TAG_dag_attribute, { "DAG Attribute", "dag_attribute", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
834 { ERF_META_TAG_dag_version, { "DAG Software Version", "dag_version", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
835 { ERF_META_TAG_stream_flags, { "Stream Flags", "stream_flags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
836 { ERF_META_TAG_entropy_threshold, { "Entropy Threshold", "entropy_threshold", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
837 { ERF_META_TAG_smart_trunc_default, { "Smart Truncation Default", "smart_trunc_default",FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
838 { ERF_META_TAG_ext_hdrs_added, { "Extension Headers Added", "ext_hdrs_added", FT_BYTES, BASE_NO_DISPLAY_VALUE, NULL, 0x0, NULL, HFILL } },
839 { ERF_META_TAG_ext_hdrs_removed, { "Extension Headers Removed", "ext_hdrs_removed", FT_BYTES, BASE_NO_DISPLAY_VALUE, NULL, 0x0, NULL, HFILL } },
840 { ERF_META_TAG_relative_snaplen, { "Relative Snap Length", "relative_snaplen", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
841 { ERF_META_TAG_temperature, { "Temperature", "temperature", FT_FLOAT, BASE_NONE|BASE_UNIT_STRING, UNS(&units_degree_celsius), 0x0, NULL, HFILL } },
842 { ERF_META_TAG_power, { "Power Consumption", "power", FT_FLOAT, BASE_NONE|BASE_UNIT_STRING, UNS(&units_watt), 0x0, NULL, HFILL } },
843 { ERF_META_TAG_vendor, { "Vendor", "vendor", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
844 { ERF_META_TAG_cpu_threads, { "CPU Threads", "cpu_threads", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
845
846 { ERF_META_TAG_if_num, { "Interface Number", "if_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
847 { ERF_META_TAG_if_vc, { "Interface Virtual Circuit", "if_vc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
848 { ERF_META_TAG_if_speed, { "Interface Line Rate", "if_speed", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
849 { ERF_META_TAG_if_ipv4, { "Interface IPv4 address", "if_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
850 { ERF_META_TAG_if_ipv6, { "Interface IPv6 address", "if_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
851 { ERF_META_TAG_if_mac, { "Interface MAC address", "if_mac", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL } },
852 { ERF_META_TAG_if_eui, { "Interface EUI-64 address", "if_eui", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
853 { ERF_META_TAG_if_ib_gid, { "Interface InfiniBand GID", "if_ib_gid", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
854 { ERF_META_TAG_if_ib_lid, { "Interface InfiniBand LID", "if_ib_lid", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
855 { ERF_META_TAG_if_wwn, { "Interface WWN", "if_wwn", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
856 { ERF_META_TAG_if_fc_id, { "Interface FCID address", "if_fc_id", FT_BYTES, SEP_DOT, NULL, 0x0, NULL, HFILL } },
857 { ERF_META_TAG_if_tx_speed, { "Interface TX Line Rate", "if_tx_speed", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
858 { ERF_META_TAG_if_erf_type, { "Interface ERF type", "if_erf_type", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
859 { ERF_META_TAG_if_link_type, { "Interface link type", "if_link_type", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
860 { ERF_META_TAG_if_sfp_type, { "Interface Transceiver type", "if_sfp_type", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
861 { ERF_META_TAG_if_rx_power, { "Interface RX Optical Power", "if_rx_power", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
862 { ERF_META_TAG_if_tx_power, { "Interface TX Optical Power", "if_tx_power", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
863 { ERF_META_TAG_if_link_status, { "Interface Link Status", "if_link_status", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
864 { ERF_META_TAG_if_phy_mode, { "Interface Endace PHY Mode", "if_phy_mode", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
865 { ERF_META_TAG_if_port_type, { "Interface Port Type", "if_port_type", FT_UINT32, BASE_DEC, VALS(erf_port_type), 0x0, NULL, HFILL } },
866 { ERF_META_TAG_if_rx_latency, { "Interface Uncorrected RX Latency", "if_rx_latency", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
867 { ERF_META_TAG_tap_mode, { "Tap Mode", "tap_mode", FT_UINT32, BASE_DEC, VALS(erf_tap_mode), 0x0, NULL, HFILL } },
868 { ERF_META_TAG_tap_fail_mode, { "Tap Failover Mode", "tap_fail_mode", FT_UINT32, BASE_DEC, VALS(erf_tap_fail_mode), 0x0, NULL, HFILL } },
869 { ERF_META_TAG_watchdog_expired, { "Watchdog Expired", "watchdog_expired", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
870 { ERF_META_TAG_watchdog_interval, { "Watchdog Interval (ms)", "watchdog_interval", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
871
872 { ERF_META_TAG_src_ipv4, { "Source IPv4 address", "src_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
873 { ERF_META_TAG_dest_ipv4, { "Destination IPv4 address", "dest_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
874 { ERF_META_TAG_src_ipv6, { "Source IPv6 address", "src_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
875 { ERF_META_TAG_dest_ipv6, { "Destination IPv6 address", "dest_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
876 { ERF_META_TAG_src_mac, { "Source MAC address", "src_mac", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL } },
877 { ERF_META_TAG_dest_mac, { "Destination MAC address", "dest_mac", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL } },
878 { ERF_META_TAG_src_eui, { "Source EUI-64 address", "src_eui", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
879 { ERF_META_TAG_dest_eui, { "Destination EUI-64 address", "dest_eui", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
880 { ERF_META_TAG_src_ib_gid, { "Source InfiniBand GID address", "src_ib_gid", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
881 { ERF_META_TAG_dest_ib_gid, { "Destination InfiniBand GID address", "dest_ib_gid", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
882 { ERF_META_TAG_src_ib_lid, { "Source InfiniBand LID address", "src_ib_lid", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
883 { ERF_META_TAG_dest_ib_lid, { "Destination InfiniBand LID address", "dest_ib_lid", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
884 { ERF_META_TAG_src_wwn, { "Source WWN address", "src_wwn", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
885 { ERF_META_TAG_dest_wwn, { "Destination WWN address", "dest_wwn", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
886 { ERF_META_TAG_src_fc_id, { "Source FCID address", "src_fc_id", FT_BYTES, SEP_DOT, NULL, 0x0, NULL, HFILL } },
887 { ERF_META_TAG_dest_fc_id, { "Destination FCID address", "dest_fc_id", FT_BYTES, SEP_DOT, NULL, 0x0, NULL, HFILL } },
888 { ERF_META_TAG_src_port, { "Source Port", "src_port", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
889 { ERF_META_TAG_dest_port, { "Destination Port", "dest_port", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
890 { ERF_META_TAG_ip_proto, { "IP Protocol", "ip_proto", FT_UINT32, BASE_DEC|BASE_EXT_STRING, &ipproto_val_ext, 0x0, NULL, HFILL } },
891 { ERF_META_TAG_flow_hash, { "Flow Hash", "flow_hash", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
892 { ERF_META_TAG_filter_match, { "Filter Match", "filter_match", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
893 { ERF_META_TAG_filter_match_name, { "Filter Match Name", "filter_match_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
894 { ERF_META_TAG_error_flags, { "Error Flags", "error_flags", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
895 { ERF_META_TAG_initiator_pkts, { "Initiator Packets", "initiator_pkts", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
896 { ERF_META_TAG_responder_pkts, { "Responder Packets", "responder_pkts", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
897 { ERF_META_TAG_initiator_bytes, { "Initiator Bytes", "initiator_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
898 { ERF_META_TAG_responder_bytes, { "Responder Bytes", "responder_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
899 { ERF_META_TAG_initiator_min_entropy, { "Initiator Minimum Entropy", "initiator_min_entropy", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
900 { ERF_META_TAG_responder_min_entropy, { "Responder Minimum Entropy", "responder_min_entropy", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
901 { ERF_META_TAG_initiator_avg_entropy, { "Initiator Average Entropy", "initiator_avg_entropy", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
902 { ERF_META_TAG_responder_avg_entropy, { "Responder Average Entropy", "responder_avg_entropy", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
903 { ERF_META_TAG_initiator_max_entropy, { "Initiator Maximum Entropy", "initiator_max_entropy", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
904 { ERF_META_TAG_responder_max_entropy, { "Responder Maximum Entropy", "responder_max_entropy", FT_FLOAT, BASE_NONE, NULL, 0x0, NULL, HFILL } },
905 { ERF_META_TAG_dpi_application, { "DPI Application", "dpi_application", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
906 { ERF_META_TAG_dpi_confidence, { "DPI Confidence", "dpi_confidence", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
907 { ERF_META_TAG_dpi_state, { "DPI State", "dpi_state", FT_UINT32, BASE_NONE, VALS(erf_dpi_state), 0x0, NULL, HFILL } },
908 { ERF_META_TAG_dpi_protocol_stack, { "DPI Protocol Stack", "dpi_protocol_stack", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
909 { ERF_META_TAG_flow_state, { "Flow State", "flow_state", FT_UINT32, BASE_NONE, VALS(erf_flow_state), 0x0, NULL, HFILL } },
910 { ERF_META_TAG_vlan_id, { "VLAN ID", "vlan_id", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
911 { ERF_META_TAG_mpls_label, { "MPLS Label", "mpls_label", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
912 { ERF_META_TAG_vlan_pcp, { "VLAN PCP", "vlan_pcp", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
913 { ERF_META_TAG_mpls_tc, { "MPLS_TC", "mpls_tc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
914 { ERF_META_TAG_dscp, { "DSCP", "dscp", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
915 { ERF_META_TAG_initiator_mpls_label, { "Initiator MPLS Label", "initiator_mpls_label", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
916 { ERF_META_TAG_responder_mpls_label, { "Responder MPLS Label", "responder_mpls_label", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
917 { ERF_META_TAG_initiator_mpls_tc, { "Initiator MPLS TC", "initiator_mpls_tc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
918 { ERF_META_TAG_responder_mpls_tc, { "Responder MPLS TC", "responder_mpls_tc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
919 { ERF_META_TAG_initiator_ipv4, { "Initiator IPv4", "initiator_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
920 { ERF_META_TAG_responder_ipv4, { "Responder IPv4", "responder_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
921 { ERF_META_TAG_initiator_ipv6, { "Initiator IPv6", "initiator_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
922 { ERF_META_TAG_responder_ipv6, { "Responder IPv6", "responder_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
923 { ERF_META_TAG_initiator_mac, { "Initiator MAC Address", "initiator_mac", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL } },
924 { ERF_META_TAG_responder_mac, { "Responder MAC Address", "responder_mac", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL } },
925 { ERF_META_TAG_initiator_port, { "Initiator Port", "initiator_port", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
926 { ERF_META_TAG_responder_port, { "Responder Port", "responder_port", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
927 { ERF_META_TAG_initiator_retx, { "Initiator Retransmissions", "initiator_retx", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
928 { ERF_META_TAG_responder_retx, { "Responder Retransmissions", "responder_retx", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
929 { ERF_META_TAG_initiator_zwin, { "Initiator Zero Window Count", "initiator_zwin", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
930 { ERF_META_TAG_responder_zwin, { "Responder Zero Window Count", "responder_zwin", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
931 { ERF_META_TAG_initiator_tcp_flags, { "Initiator TCP Flags", "initiator_flags", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
932 { ERF_META_TAG_responder_tcp_flags, { "Responder TCP Flags", "responder_flags", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
933 { ERF_META_TAG_tcp_irtt, { "TCP Initial Round Trip Time", "tcp_irtt", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
934
935 { ERF_META_TAG_start_time, { "Start Time", "start_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, NULL, HFILL } },
936 { ERF_META_TAG_end_time, { "End Time", "end_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, NULL, HFILL } },
937 { ERF_META_TAG_stat_if_drop, { "Interface Drop", "stat_if_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
938 { ERF_META_TAG_stat_frames, { "Packets Received", "stat_frames", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
939 { ERF_META_TAG_stat_bytes, { "Bytes Received", "stat_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
940 { ERF_META_TAG_stat_cap, { "Packets Captured", "stat_cap", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
941 { ERF_META_TAG_stat_cap_bytes, { "Bytes Captured", "stat_cap_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
942 { ERF_META_TAG_stat_os_drop, { "OS Drop", "stat_os_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
943 { ERF_META_TAG_stat_ds_lctr, { "Internal Error Drop", "stat_ds_lctr", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
944 { ERF_META_TAG_stat_filter_match, { "Filter Match", "stat_filter_match", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
945 { ERF_META_TAG_stat_filter_drop, { "Filter Drop", "stat_filter_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
946 { ERF_META_TAG_stat_too_short, { "Packets Too Short", "stat_too_short", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
947 { ERF_META_TAG_stat_too_long, { "Packets Too Long", "stat_too_long", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
948 { ERF_META_TAG_stat_rx_error, { "Packets RX Error", "stat_rx_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
949 { ERF_META_TAG_stat_fcs_error, { "Packets FCS Error", "stat_fcs_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
950 { ERF_META_TAG_stat_aborted, { "Packets Aborted", "stat_aborted", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
951 { ERF_META_TAG_stat_proto_error, { "Packets Protocol Error", "stat_proto_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
952 { ERF_META_TAG_stat_b1_error, { "SDH B1 Errors", "stat_b1_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
953 { ERF_META_TAG_stat_b2_error, { "SDH B2 Errors", "stat_b2_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
954 { ERF_META_TAG_stat_b3_error, { "SDH B3 Errors", "stat_b3_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
955 { ERF_META_TAG_stat_rei_error, { "SDH REI Errors", "stat_rei_error", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
956 { ERF_META_TAG_stat_drop, { "Packets Dropped", "stat_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
957 { ERF_META_TAG_stat_buf_drop, { "Buffer Drop", "stat_buf_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
958 { ERF_META_TAG_stream_drop, { "Stream Drop", "stream_drop", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
959 { ERF_META_TAG_stream_buf_drop, { "Stream Buffer Drop", "stream_buf_drop", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
960 { ERF_META_TAG_pkt_drop, { "Packet Drop", "packet_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
961 { ERF_META_TAG_record_drop, { "Record Drop", "record_drop", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
962 { ERF_META_TAG_bandwidth, { "Bandwidth", "bandwidth", FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0, NULL, HFILL } },
963 { ERF_META_TAG_duration, { "Duration", "duration", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
964 { ERF_META_TAG_top_index, { "Top N Index", "top_index", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
965 { ERF_META_TAG_concurrent_flows, { "Concurrent Flows", "concurrent_flows", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
966 { ERF_META_TAG_active_flows, { "Active Flows", "active_flows", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
967 { ERF_META_TAG_created_flows, { "Created Flows", "created_flows", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
968 { ERF_META_TAG_deleted_flows, { "Deleted Flows", "deleted_flows", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
969 { ERF_META_TAG_active_endpoints, { "Active Endpoints", "active_endpoints", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
970 { ERF_META_TAG_tx_pkts, { "Transmitted Packets", "tx_packets", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
971 { ERF_META_TAG_tx_bytes, { "Transmitted Bytes", "tx_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
972 { ERF_META_TAG_rx_bandwidth, { "Receive Bandwidth", "rx_bandwidth", FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0, NULL, HFILL } },
973 { ERF_META_TAG_tx_bandwidth, { "Transmit Bandwidth", "tx_bandwidth", FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0, NULL, HFILL } },
974 { ERF_META_TAG_records, { "Records", "records", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
975 { ERF_META_TAG_record_bytes, { "Record Bytes", "record_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
976 { ERF_META_TAG_pkt_drop_bytes, { "Packet Drop Bytes", "packet_drop_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
977 { ERF_META_TAG_record_drop_bytes, { "Record Drop Bytes", "record_drop_bytes", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
978 { ERF_META_TAG_drop_bandwidth, { "Drop Bandwidth", "drop_bandwidth", FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0, NULL, HFILL } },
979 { ERF_META_TAG_retx_pkts, { "Retransmitted Packets", "retx_packets", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
980 { ERF_META_TAG_zwin_pkts, { "Zero-Window Packets", "zwin_packets", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL } },
981
982 { ERF_META_TAG_ns_host_ipv4, { "IPv4 Name", "ns_host_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
983 { ERF_META_TAG_ns_host_ipv6, { "IPv6 Name", "ns_host_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
984 { ERF_META_TAG_ns_host_mac, { "MAC Name", "ns_host_mac", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL } },
985 { ERF_META_TAG_ns_host_eui, { "EUI Name", "ns_host_eui", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
986 { ERF_META_TAG_ns_host_ib_gid, { "InfiniBand GID Name", "ns_host_ib_gid", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
987 { ERF_META_TAG_ns_host_ib_lid, { "InfiniBand LID Name", "ns_host_ib_lid", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
988 { ERF_META_TAG_ns_host_wwn, { "WWN Name", "ns_host_wwn", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
989 { ERF_META_TAG_ns_host_fc_id, { "FCID Name", "ns_host_fc_id", FT_BYTES, SEP_DOT, NULL, 0x0, NULL, HFILL } },
990 { ERF_META_TAG_ns_dns_ipv4, { "Nameserver IPv4 address", "ns_dns_ipv4", FT_IPv4, BASE_NONE, NULL, 0x0, NULL, HFILL } },
991 { ERF_META_TAG_ns_dns_ipv6, { "Nameserver IPv6 address", "ns_dns_ipv6", FT_IPv6, BASE_NONE, NULL, 0x0, NULL, HFILL } },
992
993 { ERF_META_TAG_exthdr, { "ERF Extension Header", "exthdr", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
994 { ERF_META_TAG_pcap_ng_block, { "Pcapng Block", "pcap_ng_block", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
995 { ERF_META_TAG_asn1, { "ASN.1", "asn1", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
996 { ERF_META_TAG_section_ref, { "Section Reference", "section_ref", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
997
998 { ERF_META_TAG_clk_source, { "Clock Source", "clk_source", FT_UINT32, BASE_DEC, VALS(erf_clk_source), 0x0, NULL, HFILL } },
999 { ERF_META_TAG_clk_state, { "Clock State", "clk_state", FT_UINT32, BASE_DEC, VALS(erf_clk_state), 0x0, NULL, HFILL } },
1000 { ERF_META_TAG_clk_threshold, { "Clock Threshold", "clk_threshold", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1001 { ERF_META_TAG_clk_correction, { "Clock Correction", "clk_correction", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1002 { ERF_META_TAG_clk_failures, { "Clock Failures", "clk_failures", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1003 { ERF_META_TAG_clk_resyncs, { "Clock Resyncs", "clk_resyncs", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1004 { ERF_META_TAG_clk_phase_error, { "Clock Phase Error", "clk_phase_error", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1005 { ERF_META_TAG_clk_input_pulses, { "Clock Input Pulses", "clk_input_pulses", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1006 { ERF_META_TAG_clk_rejected_pulses, { "Clock Rejected Pulses", "clk_rejected_pulses", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1007 { ERF_META_TAG_clk_phc_index, { "Clock PHC Index", "clk_phc_index", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1008 { ERF_META_TAG_clk_phc_offset, { "Clock PHC Offset", "clk_phc_offset", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1009 { ERF_META_TAG_clk_timebase, { "Clock Timebase", "clk_timebase", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1010 { ERF_META_TAG_clk_descr, { "Clock Description", "clk_descr", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1011 { ERF_META_TAG_clk_out_source, { "Clock Output Source", "clk_out_source", FT_UINT32, BASE_DEC, VALS(erf_clk_source), 0x0, NULL, HFILL } },
1012 { ERF_META_TAG_clk_link_mode, { "Clock Link Cable Mode", "clk_link_mode", FT_UINT32, BASE_DEC, VALS(erf_clk_link_mode), 0x0, NULL, HFILL } },
1013
1014 /*
1015 * PTP tags use the native PTPv2 format to preserve precision
1016 * (except expanding integers to 32-bit).
1017 */
1018 { ERF_META_TAG_ptp_domain_num, { "PTP Domain Number", "ptp_domain_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1019 { ERF_META_TAG_ptp_steps_removed, { "PTP Steps Removed", "ptp_steps_removed", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1020 /* PTP TimeInterval scaled nanoseconds, using FT_RELATIVE_TIME so can compare with clk_threshold */
1021 { ERF_META_TAG_ptp_offset_from_master, { "PTP Offset From Master", "ptp_offset_from_master", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1022 { ERF_META_TAG_ptp_mean_path_delay, { "PTP Mean Path Delay", "ptp_mean_path_delay", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1023 { ERF_META_TAG_ptp_parent_identity, { "PTP Parent Clock Identity", "ptp_parent_identity", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1024 { ERF_META_TAG_ptp_parent_port_num, { "PTP Parent Port Number", "ptp_parent_port_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1025 { ERF_META_TAG_ptp_gm_identity, { "PTP Grandmaster Identity", "ptp_gm_identity", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1026 /* PTP ClockQuality combined field, see erf_ptp_clock_quality */
1027 { ERF_META_TAG_ptp_gm_clock_quality, { "PTP Grandmaster Clock Quality", "ptp_gm_clock_quality", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
1028 /* Integer seconds, using FT_RELATIVE_TIME so can compare with clk_phc_offset */
1029 { ERF_META_TAG_ptp_current_utc_offset, { "PTP Current UTC Offset", "ptp_current_utc_offset", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1030 /* PTP TIME_PROPERTIES_DATA_SET flags, see erf_ptp_time_properties_flags */
1031 { ERF_META_TAG_ptp_time_properties, { "PTP Time Properties", "ptp_time_properties", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
1032 { ERF_META_TAG_ptp_time_source, { "PTP Time Source", "ptp_time_source", FT_UINT32, BASE_DEC | BASE_EXT_STRING, &ptp_v2_timeSource_vals_ext, 0x0, NULL, HFILL } },
1033 { ERF_META_TAG_ptp_clock_identity, { "PTP Clock Identity", "ptp_clock_identity", FT_EUI64, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1034 { ERF_META_TAG_ptp_port_num, { "PTP Port Number", "ptp_port_num", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1035 { ERF_META_TAG_ptp_port_state, { "PTP Port State", "ptp_port_state", FT_UINT32, BASE_DEC | BASE_EXT_STRING, &ptp_v2_portState_vals_ext, 0x0, NULL, HFILL } },
1036 { ERF_META_TAG_ptp_delay_mechanism, { "PTP Delay Mechanism", "ptp_delay_mechanism", FT_UINT32, BASE_DEC, VALS(ptp_v2_delayMechanism_vals), 0x0, NULL, HFILL } },
1037
1038 { ERF_META_TAG_clk_port_proto, { "Clock Input Port Protocol", "clk_port_proto", FT_UINT32, BASE_DEC, VALS(erf_clk_port_proto), 0x0, NULL, HFILL } },
1039
1040 { ERF_META_TAG_ntp_status, { "NTP Status", "ntp_status", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1041 { ERF_META_TAG_ntp_stratum, { "NTP Stratum", "ntp_stratum", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1042 { ERF_META_TAG_ntp_rootdelay, { "NTP Root Delay", "ntp_root_delay", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1043 { ERF_META_TAG_ntp_rootdisp, { "NTP Root Dispersion", "ntp_root_dispersion", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1044 { ERF_META_TAG_ntp_offset, { "NTP Offset", "ntp_offset", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1045 { ERF_META_TAG_ntp_frequency, { "NTP Frequency", "ntp_frequency", FT_INT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_hz), 0x0, NULL, HFILL } },
1046 { ERF_META_TAG_ntp_sys_jitter, { "NTP System Jitter", "ntp_sys_jitter", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
1047 { ERF_META_TAG_ntp_peer_remote, { "NTP Peer Remote", "ntp_peer_remote", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1048 { ERF_META_TAG_ntp_peer_refid, { "NTP Peer Refid", "ntp_peer_refid", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }
1049 };
1050
1051 /* Sections are also tags, but enumerate them separately to make logic simpler */
1052 static const erf_meta_hf_template_t erf_meta_sections[] = {
1053 /*
1054 * Some tags (such as generation time) can appear before the first section,
1055 * we group these together into a fake section for consistency.
1056 */
1057 { ERF_META_SECTION_NONE, { "No Section", "section_none", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1058 { ERF_META_SECTION_UNKNOWN, { "Unknown Section", "section_unknown", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1059
1060 { ERF_META_SECTION_CAPTURE, { "Capture Section", "section_capture", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1061 { ERF_META_SECTION_HOST, { "Host Section", "section_host", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1062 { ERF_META_SECTION_MODULE, { "Module Section", "section_module", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1063 { ERF_META_SECTION_INTERFACE, { "Interface Section", "section_interface", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1064 { ERF_META_SECTION_FLOW, { "Flow Section", "section_flow", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1065 { ERF_META_SECTION_STATS, { "Statistics Section", "section_stats", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1066 { ERF_META_SECTION_INFO, { "Information Section", "section_info", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1067 { ERF_META_SECTION_CONTEXT, { "Context Section", "section_context", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1068 { ERF_META_SECTION_STREAM, { "Stream Section", "section_stream", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1069 { ERF_META_SECTION_TRANSFORM, { "Transform Section", "section_transform", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1070 { ERF_META_SECTION_DNS, { "DNS Section", "section_dns", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1071 { ERF_META_SECTION_SOURCE, { "Source Section", "section_source", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1072 { ERF_META_SECTION_NETWORK, { "Network Section", "section_network", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1073 { ERF_META_SECTION_ENDPOINT, { "Endpoint Section", "section_endpoint", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1074 { ERF_META_SECTION_INPUT, { "Input Section", "section_input", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
1075 { ERF_META_SECTION_OUTPUT, { "Output Section", "section_output", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } }
1076 };
1077
1078 static int erf_type_has_color(unsigned int type) {
1079 switch (type & ERF_HDR_TYPE_MASK) {
1080 case ERF_TYPE_COLOR_HDLC_POS:
1081 case ERF_TYPE_COLOR_ETH:
1082 case ERF_TYPE_COLOR_HASH_POS:
1083 case ERF_TYPE_COLOR_HASH_ETH:
1084 case ERF_TYPE_DSM_COLOR_HDLC_POS:
1085 case ERF_TYPE_DSM_COLOR_ETH:
1086 case ERF_TYPE_COLOR_MC_HDLC_POS:
1087 return 1;
1088 }
1089 return 0;
1090 }
1091
1092 static erf_meta_tag_info_ex_t* erf_meta_tag_info_ex_new(wmem_allocator_t *allocator) {
1093 size_t i = 0;
1094 erf_meta_tag_info_ex_t *extra = wmem_new0(allocator, erf_meta_tag_info_ex_t);
1095
1096 extra->ett_value = -1;
1097 for (i = 0; i < array_length(extra->hf_values); i++) {
1098 extra->hf_values[i] = -1;
1099 }
1100
1101 return extra;
1102 }
1103
1104 static erf_meta_tag_info_t* erf_meta_tag_info_new(wmem_allocator_t *allocator, const erf_meta_hf_template_t *section, const erf_meta_hf_template_t *tag) {
1105 erf_meta_tag_info_t *tag_info = wmem_new0(allocator, erf_meta_tag_info_t);
1106
1107 tag_info->code = tag->code;
1108 tag_info->section = section->code;
1109 tag_info->ett = -1;
1110 tag_info->hf_value = -1;
1111 tag_info->tag_template = tag;
1112 tag_info->section_template = section;
1113 tag_info->extra = NULL;
1114
1115 return tag_info;
1116 }
1117
1118 static erf_meta_tag_info_t*
1119 init_section_fields(wmem_array_t *hfri_table, wmem_array_t *ett_table, const erf_meta_hf_template_t *section)
1120 {
1121 erf_meta_tag_info_t *section_info;
1122 int *ett_tmp; /* wmem_array_append needs actual memory to copy from */
1123 hf_register_info hfri_tmp[] = {
1124 { NULL, { "Section ID", NULL, FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }}, /* Section ID */
1125 { NULL, { "Section Length", NULL, FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }}, /* Section Length */
1126 { NULL, { "Reserved", NULL, FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }} /* Reserved extra bytes */
1127 };
1128
1129 section_info = erf_meta_tag_info_new(wmem_epan_scope(), section, section /*Needed for lookup commonality*/);
1130 section_info->extra = erf_meta_tag_info_ex_new(wmem_epan_scope());
1131
1132 /*Can't use the generic functions here because directly at section level*/
1133 hfri_tmp[0].hfinfo.abbrev = wmem_strconcat(wmem_epan_scope(), "erf.meta.", section->hfinfo.abbrev, ".section_id", NULL);
1134 hfri_tmp[0].p_id = &section_info->hf_value;
1135 hfri_tmp[1].hfinfo.abbrev = wmem_strconcat(wmem_epan_scope(), "erf.meta.", section->hfinfo.abbrev, ".section_len", NULL);
1136 hfri_tmp[1].p_id = &section_info->extra->hf_values[0];
1137 hfri_tmp[2].hfinfo.abbrev = wmem_strconcat(wmem_epan_scope(), "erf.meta.", section->hfinfo.abbrev, ".section_hdr_rsvd", NULL);
1138 hfri_tmp[2].p_id = &section_info->extra->hf_values[1];
1139
1140 /* Add hf_register_info, ett entries */
1141 wmem_array_append(hfri_table, hfri_tmp, array_length(hfri_tmp));
1142 ett_tmp = &section_info->ett;
1143 wmem_array_append(ett_table, &ett_tmp, 1);
1144 ett_tmp = &section_info->extra->ett_value;
1145 wmem_array_append(ett_table, &ett_tmp, 1);
1146
1147 return section_info;
1148 }
1149
1150 static erf_meta_tag_info_t*
1151 init_tag_value_field(wmem_array_t *hfri_table, erf_meta_tag_info_t *tag_info)
1152 {
1153 hf_register_info hfri_tmp = { NULL, { NULL, NULL, FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}; /* Value, will be filled from template */
1154
1155 /* Add value field */
1156 hfri_tmp.p_id = &tag_info->hf_value;
1157 hfri_tmp.hfinfo = tag_info->tag_template->hfinfo;
1158 hfri_tmp.hfinfo.abbrev = wmem_strconcat(wmem_epan_scope(), "erf.meta.", tag_info->section_template->hfinfo.abbrev, ".", tag_info->tag_template->hfinfo.abbrev, NULL);
1159 wmem_array_append_one(hfri_table, hfri_tmp);
1160
1161 return tag_info;
1162 }
1163
1164 static erf_meta_tag_info_t*
1165 init_tag_value_subfields(wmem_array_t *hfri_table, erf_meta_tag_info_t *tag_info, const header_field_info *extra_fields, int extra_fields_len)
1166 {
1167 int i = 0;
1168 hf_register_info hfri_tmp = { NULL, { NULL, NULL, FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}; /* Value, will be filled from template */
1169
1170 if (extra_fields) {
1171 tag_info->extra = erf_meta_tag_info_ex_new(wmem_epan_scope());
1172 for (i = 0; i < extra_fields_len; i++) {
1173 /* Add value subfield */
1174 hfri_tmp.p_id = &tag_info->extra->hf_values[i];
1175 hfri_tmp.hfinfo = extra_fields[i];
1176 hfri_tmp.hfinfo.abbrev = wmem_strconcat(wmem_epan_scope(), "erf.meta.", tag_info->section_template->hfinfo.abbrev, ".", tag_info->tag_template->hfinfo.abbrev, ".", extra_fields[i].abbrev, NULL);
1177 wmem_array_append_one(hfri_table, hfri_tmp);
1178 }
1179 }
1180
1181 return tag_info;
1182 }
1183
1184 static erf_meta_tag_info_t*
1185 init_ext_hdrs_tag_value_subfields(wmem_array_t *hfri_table, erf_meta_tag_info_t *tag_info)
1186 {
1187 size_t i = 0;
1188 size_t num_known_ext_hdrs = array_length(ehdr_type_vals) -1 /*null terminated*/;
1189 hf_register_info hfri_tmp = { NULL, { NULL, NULL, FT_BOOLEAN, 32, NULL, 0x1, NULL, HFILL } }; /* Value, will be filled from template */
1190
1191 DISSECTOR_ASSERT(array_length(ehdr_type_vals_short) > num_known_ext_hdrs);
1192 /* XXX: this currently supports only up to 27 known extension headers */
1193 DISSECTOR_ASSERT(ERF_HF_VALUES_PER_TAG > num_known_ext_hdrs - 4); /* -1 sentinel terminated */
1194 /* Use the first 4 hf_values for 32-bit subtree */
1195 init_tag_value_subfields(hfri_table, tag_info, erf_ext_hdr_items, array_length(erf_ext_hdr_items));
1196 DISSECTOR_ASSERT(tag_info->extra);
1197
1198 /*Fill in the rest of the remaining 27 entries with any known tag entries values */
1199 for (i = 0; i < num_known_ext_hdrs; i++) {
1200 /* Add value subfield */
1201 hfri_tmp.p_id = &tag_info->extra->hf_values[4+i];
1202 hfri_tmp.hfinfo.bitmask = (uint64_t)1 << ehdr_type_vals[i].value;
1203 hfri_tmp.hfinfo.name = ehdr_type_vals[i].strptr;
1204 hfri_tmp.hfinfo.abbrev = wmem_strconcat(wmem_epan_scope(),
1205 "erf.meta.", tag_info->section_template->hfinfo.abbrev, ".", tag_info->tag_template->hfinfo.abbrev, ".", ehdr_type_vals_short[i].strptr, NULL);
1206 wmem_array_append_one(hfri_table, hfri_tmp);
1207 }
1208
1209 return tag_info;
1210 }
1211
1212 static erf_meta_tag_info_t*
1213 init_ns_addr_tag_value_fields(wmem_array_t *hfri_table, erf_meta_tag_info_t *tag_info)
1214 {
1215 header_field_info ns_addr_extra_fields[] = {
1216 { NULL, NULL, FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }, /* Address value, will be filled from template */
1217 { "Name", "name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } /* Name value */
1218 };
1219
1220 tag_info->extra = erf_meta_tag_info_ex_new(wmem_epan_scope());
1221
1222 /* Set address subfield type, etc. from template based on address type */
1223 ns_addr_extra_fields[0] = tag_info->tag_template->hfinfo;
1224 ns_addr_extra_fields[0].name = "Address";
1225 ns_addr_extra_fields[0].abbrev = "addr";
1226 /* Don't need a main value as we just use a text subtree */
1227 /* Init subfields */
1228 init_tag_value_subfields(hfri_table, tag_info, ns_addr_extra_fields, array_length(ns_addr_extra_fields));
1229
1230 return tag_info;
1231 }
1232
1233 static erf_meta_tag_info_t*
1234 init_tag_fields(wmem_array_t *hfri_table, wmem_array_t *ett_table, const erf_meta_hf_template_t *section, const erf_meta_hf_template_t *tag)
1235 {
1236 erf_meta_tag_info_t *tag_info;
1237 int *ett_tmp; /* wmem_array_append needs actual memory to copy from */
1238
1239 tag_info = erf_meta_tag_info_new(wmem_epan_scope(), section, tag);
1240
1241 /*Tags with subfields (only)*/
1242 /*XXX: Can't currently easily be described in the template because
1243 * there is curently no dissect bitfield equivalent that supports arbitrary
1244 * types/offsets*/
1245 switch (tag->code) {
1246 /*Special case: parent_section*/
1247 case ERF_META_TAG_parent_section:
1248 /*Don't need a main value*/
1249 /*Init subfields*/
1250 init_tag_value_subfields(hfri_table, tag_info, erf_parent_section, array_length(erf_parent_section));
1251 break;
1252
1253 /* Special case: name entry */
1254 case ERF_META_TAG_ns_dns_ipv4:
1255 case ERF_META_TAG_ns_dns_ipv6:
1256 case ERF_META_TAG_ns_host_ipv4:
1257 case ERF_META_TAG_ns_host_ipv6:
1258 case ERF_META_TAG_ns_host_mac:
1259 case ERF_META_TAG_ns_host_eui:
1260 case ERF_META_TAG_ns_host_wwn:
1261 case ERF_META_TAG_ns_host_ib_gid:
1262 case ERF_META_TAG_ns_host_ib_lid:
1263 case ERF_META_TAG_ns_host_fc_id:
1264 init_ns_addr_tag_value_fields(hfri_table, tag_info);
1265 break;
1266
1267 /* Usual case: init single field template */
1268 default:
1269 init_tag_value_field(hfri_table, tag_info);
1270 break;
1271 }
1272
1273 /*Tags that need additional subfields*/
1274 switch (tag->code) {
1275 /*Special case: bitfields*/
1276 /*TODO: Maybe put extra_fields in template with dissect callback?*/
1277 case ERF_META_TAG_tunneling_mode:
1278 init_tag_value_subfields(hfri_table, tag_info, erf_tunneling_modes, array_length(erf_tunneling_modes));
1279 break;
1280 case ERF_META_TAG_if_link_status:
1281 init_tag_value_subfields(hfri_table, tag_info, erf_link_status, array_length(erf_link_status));
1282 break;
1283 case ERF_META_TAG_ptp_time_properties:
1284 init_tag_value_subfields(hfri_table, tag_info, erf_ptp_time_properties_flags, array_length(erf_ptp_time_properties_flags));
1285 break;
1286 case ERF_META_TAG_ptp_gm_clock_quality:
1287 init_tag_value_subfields(hfri_table, tag_info, erf_ptp_clock_quality, array_length(erf_ptp_clock_quality));
1288 break;
1289 case ERF_META_TAG_stream_flags:
1290 init_tag_value_subfields(hfri_table, tag_info, erf_stream_flags, array_length(erf_stream_flags));
1291 break;
1292 case ERF_META_TAG_smart_trunc_default:
1293 init_tag_value_subfields(hfri_table, tag_info, erf_smart_trunc_default_flags, array_length(erf_smart_trunc_default_flags));
1294 break;
1295 case ERF_META_TAG_ext_hdrs_added:
1296 case ERF_META_TAG_ext_hdrs_removed:
1297 init_ext_hdrs_tag_value_subfields(hfri_table, tag_info);
1298 break;
1299 }
1300
1301 /* Add ett entries */
1302 ett_tmp = &tag_info->ett;
1303 wmem_array_append_one(ett_table, ett_tmp);
1304
1305 return tag_info;
1306 }
1307
1308 static void
1309 init_meta_tags(void)
1310 {
1311 unsigned int i, j = 0;
1312 const erf_meta_hf_template_t *section = NULL;
1313 const erf_meta_hf_template_t *tag = NULL;
1314 erf_meta_tag_info_t *tag_info;
1315 value_string vs_tmp = {0, NULL};
1316
1317 erf_meta_index.tag_table = wmem_map_new(wmem_epan_scope(), g_direct_hash, g_direct_equal);
1318 erf_meta_index.vs_list = wmem_array_new(wmem_epan_scope(), sizeof(value_string));
1319 erf_meta_index.vs_abbrev_list = wmem_array_new(wmem_epan_scope(), sizeof(value_string));
1320 erf_meta_index.hfri = wmem_array_new(wmem_epan_scope(), sizeof(hf_register_info));
1321 erf_meta_index.ett = wmem_array_new(wmem_epan_scope(), sizeof(int*));
1322
1323 /* Generate tag fields */
1324 for (j = 0; j < array_length(erf_meta_tags); j++) {
1325 tag = &erf_meta_tags[j];
1326
1327 /* Generate copy of the tag for each section */
1328 for (i = 0; i < array_length(erf_meta_sections); i++) {
1329 section = &erf_meta_sections[i];
1330 tag_info = init_tag_fields(erf_meta_index.hfri, erf_meta_index.ett, section, tag);
1331 /* Add to hash table */
1332 wmem_map_insert(erf_meta_index.tag_table, GUINT_TO_POINTER(ERF_TAG_INFO_KEY(tag_info)), tag_info);
1333 }
1334
1335 /* Add value string entries */
1336 vs_tmp.value = tag->code;
1337 vs_tmp.strptr = tag->hfinfo.name;
1338 wmem_array_append_one(erf_meta_index.vs_list, vs_tmp);
1339 vs_tmp.value = tag->code;
1340 vs_tmp.strptr = tag->hfinfo.abbrev;
1341 wmem_array_append_one(erf_meta_index.vs_abbrev_list, vs_tmp);
1342 }
1343
1344 /* Generate section fields (skipping section_none and parts of section_unknown) */
1345 for (i = 1; i < array_length(erf_meta_sections); i++) {
1346 section = &erf_meta_sections[i];
1347 tag_info = init_section_fields(erf_meta_index.hfri, erf_meta_index.ett, section);
1348
1349 if (i != 1) { /* don't add value string for unknown section as it doesn't correspond to one section type code */
1350 /* Add to hash table */
1351 wmem_map_insert(erf_meta_index.tag_table, GUINT_TO_POINTER(ERF_TAG_INFO_KEY(tag_info)), tag_info);
1352 /* Add value string entries */
1353 vs_tmp.value = section->code;
1354 vs_tmp.strptr = section->hfinfo.name;
1355 wmem_array_append_one(erf_meta_index.vs_list, vs_tmp);
1356 vs_tmp.value = section->code;
1357 vs_tmp.strptr = section->hfinfo.abbrev;
1358 wmem_array_append_one(erf_meta_index.vs_abbrev_list, vs_tmp);
1359 } else {
1360 /* Store section_unknown separately to simplify logic later */
1361 erf_meta_index.unknown_section_info = tag_info;
1362 }
1363 }
1364
1365 /* Terminate value string lists with {0, NULL} */
1366 vs_tmp.value = 0;
1367 vs_tmp.strptr = NULL;
1368 wmem_array_append_one(erf_meta_index.vs_list, vs_tmp);
1369 wmem_array_append_one(erf_meta_index.vs_abbrev_list, vs_tmp);
1370 /* TODO: try value_string_ext, requires sorting first */
1371 }
1372
1373 static inline value_string *erf_to_value_string(wmem_array_t *array) {
1374 return (value_string *)wmem_array_get_raw(array);
1375 }
1376
1377 static unsigned erf_anchor_key_hash(const void *key) {
1378 const erf_anchor_key_t *anchor_key = (const erf_anchor_key_t*) key;
1379
1380 return ((uint32_t)anchor_key->host_id ^ (uint32_t)anchor_key->anchor_id);
1381
1382 }
1383
1384 static gboolean erf_anchor_key_equal(const void *a, const void *b) {
1385 const erf_anchor_key_t *anchor_key_a = (const erf_anchor_key_t*) a ;
1386 const erf_anchor_key_t *anchor_key_b = (const erf_anchor_key_t*) b ;
1387
1388 return (anchor_key_a->host_id) == (anchor_key_b->host_id) &&
1389 (anchor_key_a->anchor_id & ERF_EXT_HDR_TYPE_ANCHOR_ID) == (anchor_key_b->anchor_id & ERF_EXT_HDR_TYPE_ANCHOR_ID);
1390 }
1391
1392 static void erf_host_anchor_info_insert(packet_info *pinfo, uint64_t host_id, uint64_t anchor_id, uint8_t flags _U_) {
1393 erf_host_anchor_info_t *anchor_info;
1394 erf_anchor_key_t key = {host_id, anchor_id};
1395 erf_anchored_info_t *anchored_info;
1396
1397 anchor_info = (erf_host_anchor_info_t*)wmem_map_lookup(erf_state.host_anchor_map, &key);
1398
1399 if(!anchor_info) {
1400 erf_anchor_key_t *key_ptr = wmem_new(wmem_file_scope(), erf_anchor_key_t);
1401 *key_ptr = key;
1402
1403 anchor_info = (erf_host_anchor_info_t*) wmem_new(wmem_file_scope(), erf_host_anchor_info_t);
1404 anchor_info->anchored_tree = wmem_tree_new(wmem_file_scope());
1405 anchor_info->anchored_list = wmem_list_new(wmem_file_scope());
1406
1407 wmem_map_insert(erf_state.host_anchor_map, key_ptr, anchor_info);
1408 }
1409
1410 /* Information about this frame associated with the Anchor ID */
1411 anchored_info = (erf_anchored_info_t*)wmem_tree_lookup32(anchor_info->anchored_tree, pinfo->num);
1412 if(!anchored_info) {
1413 /* anchored_info not found */
1414 anchored_info = (erf_anchored_info_t*)wmem_new(wmem_file_scope(), erf_anchored_info_t);
1415 anchored_info->frame_num = pinfo->num;
1416
1417 wmem_list_append(anchor_info->anchored_list, anchored_info);
1418 wmem_tree_insert32(anchor_info->anchored_tree, pinfo->num, anchored_info);
1419 }
1420 else {
1421 return;
1422 }
1423 }
1424
1425
1426 static int
1427 erf_source_append(uint64_t host_id, uint8_t source_id, uint32_t num)
1428 {
1429 erf_source_info_t *source_info;
1430 uint64_t source_key = ERF_SOURCE_KEY(host_id, source_id);
1431
1432 source_info = (erf_source_info_t*) wmem_map_lookup(erf_state.source_map, &source_key);
1433
1434 if (!source_info) {
1435 uint64_t *source_key_ptr = wmem_new(wmem_file_scope(), uint64_t);
1436 *source_key_ptr = source_key;
1437
1438 source_info = (erf_source_info_t*) wmem_new(wmem_file_scope(), erf_source_info_t);
1439 source_info->meta_tree = wmem_tree_new(wmem_file_scope());
1440 source_info->meta_list = wmem_list_new(wmem_file_scope());
1441
1442 wmem_map_insert(erf_state.source_map, source_key_ptr, source_info);
1443 }
1444
1445 /* Add the frame to the list for that source */
1446 wmem_list_append(source_info->meta_list, GUINT_TO_POINTER(num));
1447 /*
1448 * XXX: This assumes we are inserting fd_num in order, which we are as we use
1449 * PINFO_FD_VISITED in caller.
1450 */
1451 wmem_tree_insert32(source_info->meta_tree, num, wmem_list_tail(source_info->meta_list));
1452
1453 return 0;
1454 }
1455
1456 static uint32_t
1457 erf_source_find_closest(uint64_t host_id, uint8_t source_id, uint32_t fnum, uint32_t *fnum_next_ptr) {
1458 wmem_list_frame_t *list_frame = NULL;
1459 wmem_list_frame_t *list_frame_prev = NULL;
1460 erf_source_info_t *source_info = NULL;
1461 uint64_t source_key = ERF_SOURCE_KEY(host_id, source_id);
1462 uint32_t fnum_prev = UINT32_MAX;
1463 uint32_t fnum_next = UINT32_MAX;
1464
1465 source_info = (erf_source_info_t*) wmem_map_lookup(erf_state.source_map, &source_key);
1466
1467 if (source_info) {
1468 list_frame = (wmem_list_frame_t*) wmem_tree_lookup32_le(source_info->meta_tree, fnum);
1469
1470 if (list_frame) {
1471 fnum_prev = GPOINTER_TO_UINT(wmem_list_frame_data(list_frame));
1472 /* If looking at a metadata record, get the real previous meta frame */
1473 if (fnum_prev == fnum) {
1474 list_frame_prev = wmem_list_frame_prev(list_frame);
1475 fnum_prev = list_frame_prev ? GPOINTER_TO_UINT(wmem_list_frame_data(list_frame_prev)) : UINT32_MAX;
1476 }
1477
1478 list_frame = wmem_list_frame_next(list_frame);
1479 fnum_next = list_frame ? GPOINTER_TO_UINT(wmem_list_frame_data(list_frame)) : UINT32_MAX;
1480 } else {
1481 /*
1482 * XXX: Edge case: still need the first meta record to find the next one at the
1483 * beginning of the file.
1484 */
1485 list_frame = wmem_list_head(source_info->meta_list);
1486 fnum_next = list_frame ? GPOINTER_TO_UINT(wmem_list_frame_data(list_frame)) : UINT32_MAX;
1487 fnum_prev = UINT32_MAX;
1488 }
1489 }
1490
1491 if (fnum_next_ptr)
1492 *fnum_next_ptr = fnum_next;
1493
1494 return fnum_prev;
1495 }
1496
1497 /* Copy of atm_guess_traffic_type from atm.c in /wiretap */
1498 static void
1499 erf_atm_guess_lane_type(tvbuff_t *tvb, int offset, unsigned len,
1500 struct atm_phdr *atm_info)
1501 {
1502 if (len >= 2) {
1503 if (tvb_get_ntohs(tvb, offset) == 0xFF00) {
1504 /*
1505 * Looks like LE Control traffic.
1506 */
1507 atm_info->subtype = TRAF_ST_LANE_LE_CTRL;
1508 } else {
1509 /*
1510 * XXX - Ethernet, or Token Ring?
1511 * Assume Ethernet for now; if we see earlier
1512 * LANE traffic, we may be able to figure out
1513 * the traffic type from that, but there may
1514 * still be situations where the user has to
1515 * tell us.
1516 */
1517 atm_info->subtype = TRAF_ST_LANE_802_3;
1518 }
1519 }
1520 }
1521
1522 static void
1523 erf_atm_guess_traffic_type(tvbuff_t *tvb, int offset, unsigned len,
1524 struct atm_phdr *atm_info)
1525 {
1526 /*
1527 * Start out assuming nothing other than that it's AAL5.
1528 */
1529 atm_info->aal = AAL_5;
1530 atm_info->type = TRAF_UNKNOWN;
1531 atm_info->subtype = TRAF_ST_UNKNOWN;
1532
1533 if (atm_info->vpi == 0) {
1534 /*
1535 * Traffic on some PVCs with a VPI of 0 and certain
1536 * VCIs is of particular types.
1537 */
1538 switch (atm_info->vci) {
1539
1540 case 5:
1541 /*
1542 * Signalling AAL.
1543 */
1544 atm_info->aal = AAL_SIGNALLING;
1545 return;
1546
1547 case 16:
1548 /*
1549 * ILMI.
1550 */
1551 atm_info->type = TRAF_ILMI;
1552 return;
1553 }
1554 }
1555
1556 /*
1557 * OK, we can't tell what it is based on the VPI/VCI; try
1558 * guessing based on the contents, if we have enough data
1559 * to guess.
1560 */
1561
1562 if (len >= 3) {
1563 uint8_t mtp3b;
1564 if (tvb_get_ntoh24(tvb, offset) == 0xAAAA03) {
1565 /*
1566 * Looks like a SNAP header; assume it's LLC
1567 * multiplexed RFC 1483 traffic.
1568 */
1569 atm_info->type = TRAF_LLCMX;
1570 } else if ((atm_info->aal5t_len &&
1571 atm_info->aal5t_len < 16) || len<16) {
1572 /*
1573 * As this cannot be a LANE Ethernet frame (less
1574 * than 2 bytes of LANE header + 14 bytes of
1575 * Ethernet header) we can try it as a SSCOP frame.
1576 */
1577 atm_info->aal = AAL_SIGNALLING;
1578 } else if (((mtp3b = tvb_get_uint8(tvb, offset)) == 0x83) || (mtp3b == 0x81)) {
1579 /*
1580 * MTP3b headers often encapsulate
1581 * a SCCP or MTN in the 3G network.
1582 * This should cause 0x83 or 0x81
1583 * in the first byte.
1584 */
1585 atm_info->aal = AAL_SIGNALLING;
1586 } else {
1587 /*
1588 * Assume it's LANE.
1589 */
1590 atm_info->type = TRAF_LANE;
1591 erf_atm_guess_lane_type(tvb, offset, len, atm_info);
1592 }
1593 } else {
1594 /*
1595 * Not only VCI 5 is used for signaling. It might be
1596 * one of these VCIs.
1597 */
1598 atm_info->aal = AAL_SIGNALLING;
1599 }
1600 }
1601
1602 static void
1603 dissect_classification_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1604 {
1605 proto_item *flags_item;
1606 proto_tree *flags_tree;
1607 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1608 uint32_t value = ((uint32_t)(hdr >> 32)) & EHDR_CLASS_FLAGS_MASK;
1609
1610 flags_item = proto_tree_add_uint(tree, hf_erf_ehdr_class_flags, tvb, 0, 0, value);
1611 flags_tree = proto_item_add_subtree(flags_item, ett_erf_flags);
1612
1613 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_sh, tvb, 0, 0, value);
1614 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_shm, tvb, 0, 0, value);
1615 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_res1, tvb, 0, 0, value);
1616 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_user, tvb, 0, 0, value);
1617 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_res2, tvb, 0, 0, value);
1618 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_drop, tvb, 0, 0, value);
1619 proto_tree_add_uint(flags_tree, hf_erf_ehdr_class_flags_str, tvb, 0, 0, value);
1620
1621 proto_tree_add_uint(tree, hf_erf_ehdr_class_seqnum, tvb, 0, 0, (uint32_t)hdr);
1622 }
1623
1624 static void
1625 dissect_intercept_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1626 {
1627 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1628
1629 proto_tree_add_uint(tree, hf_erf_ehdr_int_res1, tvb, 0, 0, (uint8_t)((hdr >> 48) & 0xFF));
1630 proto_tree_add_uint(tree, hf_erf_ehdr_int_id, tvb, 0, 0, (uint16_t)((hdr >> 32 ) & 0xFFFF));
1631 proto_tree_add_uint(tree, hf_erf_ehdr_int_res2, tvb, 0, 0, (uint32_t)hdr);
1632 }
1633
1634 static void
1635 dissect_raw_link_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1636 {
1637 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1638
1639 proto_tree_add_uint(tree, hf_erf_ehdr_raw_link_res , tvb, 0, 0, (uint32_t)((hdr >> 32) & 0xFFFFFF));
1640 proto_tree_add_uint(tree, hf_erf_ehdr_raw_link_seqnum , tvb, 0, 0, (uint32_t)((hdr >> 16) & 0xffff));
1641 proto_tree_add_uint(tree, hf_erf_ehdr_raw_link_rate, tvb, 0, 0, (uint32_t)((hdr >> 8) & 0x00ff));
1642 proto_tree_add_uint(tree, hf_erf_ehdr_raw_link_type, tvb, 0, 0, (uint32_t)(hdr & 0x00ff));
1643 }
1644
1645 static void
1646 dissect_bfs_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1647 {
1648 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1649
1650 proto_tree_add_uint(tree, hf_erf_ehdr_bfs_hash, tvb, 0, 0, (uint32_t)((hdr >> 48) & 0xFF));
1651 proto_tree_add_uint(tree, hf_erf_ehdr_bfs_color, tvb, 0, 0, (uint32_t)((hdr >> 32) & 0xFFFF));
1652 proto_tree_add_uint(tree, hf_erf_ehdr_bfs_raw_hash, tvb, 0, 0, (uint32_t)(hdr & 0xFFFFFFFF));
1653 }
1654
1655 static int
1656 channelised_fill_sdh_g707_format(sdh_g707_format_t* in_fmt, uint16_t bit_flds, uint8_t vc_size, uint8_t rate)
1657 {
1658 int i = 0; /* i = 3 --> ITU-T letter #D - index of AUG-16
1659 * i = 2 --> ITU-T letter #C - index of AUG-4,
1660 * i = 1 --> ITU-T letter #B - index of AUG-1
1661 * i = 0 --> ITU-T letter #A - index of AU3*/
1662
1663 if ( (0 == vc_size) || (vc_size > DECHAN_MAX_VC_SIZE) || (rate > DECHAN_MAX_LINE_RATE) )
1664 {
1665 /* unknown / unused / invalid container size or invalid line rate */
1666 in_fmt->m_vc_size = 0;
1667 in_fmt->m_sdh_line_rate = 0;
1668 memset(&(in_fmt->m_vc_index_array[0]), 0x00, DECHAN_MAX_AUG_INDEX);
1669 return -1;
1670 }
1671
1672 in_fmt->m_vc_size = vc_size;
1673 in_fmt->m_sdh_line_rate = rate;
1674 memset(&(in_fmt->m_vc_index_array[0]), 0xff, DECHAN_MAX_AUG_INDEX);
1675
1676 /* for STM64 traffic,from #D and so on .. */
1677 for (i = (rate - 2); i >= 0; i--)
1678 {
1679 uint8_t aug_n_index = 0;
1680
1681 /*if AUG-n is bigger than vc-size*/
1682 if ( i >= (vc_size - 1))
1683 {
1684 /* check the value in bit flds */
1685 aug_n_index = ((bit_flds >> (2 *i))& 0x3) +1;
1686 }
1687 else
1688 {
1689 aug_n_index = 0;
1690 }
1691 in_fmt->m_vc_index_array[i] = aug_n_index;
1692 }
1693 return 0;
1694 }
1695
1696 static void
1697 channelised_fill_vc_id_string(wmem_strbuf_t* out_string, sdh_g707_format_t* in_fmt)
1698 {
1699 int i;
1700 bool is_printed = false;
1701
1702 static const char* g_vc_size_strings[] = {
1703 "unknown", /*0x0*/
1704 "VC3", /*0x1*/
1705 "VC4", /*0x2*/
1706 "VC4-4c", /*0x3*/
1707 "VC4-16c", /*0x4*/
1708 "VC4-64c", /*0x5*/};
1709
1710 wmem_strbuf_truncate(out_string, 0);
1711
1712 if ( (in_fmt->m_vc_size > DECHAN_MAX_VC_SIZE) || (in_fmt->m_sdh_line_rate > DECHAN_MAX_LINE_RATE) )
1713 {
1714 wmem_strbuf_append_printf(out_string, "Malformed");
1715 return;
1716 }
1717
1718 wmem_strbuf_append_printf(out_string, "%s(",
1719 (in_fmt->m_vc_size < array_length(g_vc_size_strings)) ?
1720 g_vc_size_strings[in_fmt->m_vc_size] : g_vc_size_strings[0] );
1721
1722 if (in_fmt->m_sdh_line_rate <= 0 )
1723 {
1724 /* line rate is not given */
1725 for (i = (DECHAN_MAX_AUG_INDEX -1); i >= 0; i--)
1726 {
1727 if ((in_fmt->m_vc_index_array[i] > 0) || (is_printed) )
1728 {
1729 wmem_strbuf_append_printf(out_string, "%s%d",
1730 ((is_printed)?", ":""),
1731 in_fmt->m_vc_index_array[i]);
1732 is_printed = true;
1733 }
1734 }
1735
1736 }
1737 else
1738 {
1739 for (i = in_fmt->m_sdh_line_rate - 2; i >= 0; i--)
1740 {
1741 wmem_strbuf_append_printf(out_string, "%s%d",
1742 ((is_printed)?", ":""),
1743 in_fmt->m_vc_index_array[i]);
1744 is_printed = true;
1745 }
1746 }
1747 if ( ! is_printed )
1748 {
1749 /* Not printed . possibly it's a ocXc packet with (0,0,0...) */
1750 for ( i =0; i < in_fmt->m_vc_size - 2; i++)
1751 {
1752 wmem_strbuf_append_printf(out_string, "%s0",
1753 ((is_printed)?", ":""));
1754 is_printed = true;
1755 }
1756 }
1757 wmem_strbuf_append_c(out_string, ')');
1758 return;
1759 }
1760
1761 static void
1762 dissect_channelised_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1763 {
1764 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1765 uint8_t vc_id = (uint8_t)((hdr >> 24) & 0xFF);
1766 uint8_t vc_size = (uint8_t)((hdr >> 16) & 0xFF);
1767 uint8_t line_rate = (uint8_t)((hdr >> 8) & 0xFF);
1768 sdh_g707_format_t g707_format;
1769 wmem_strbuf_t *vc_id_string = wmem_strbuf_create(pinfo->pool);
1770
1771 channelised_fill_sdh_g707_format(&g707_format, vc_id, vc_size, line_rate);
1772 channelised_fill_vc_id_string(vc_id_string, &g707_format);
1773
1774 proto_tree_add_boolean(tree, hf_erf_ehdr_chan_morebits, tvb, 0, 0, (uint8_t)((hdr >> 63) & 0x1));
1775 proto_tree_add_boolean(tree, hf_erf_ehdr_chan_morefrag, tvb, 0, 0, (uint8_t)((hdr >> 55) & 0x1));
1776 proto_tree_add_uint(tree, hf_erf_ehdr_chan_seqnum, tvb, 0, 0, (uint16_t)((hdr >> 40) & 0x7FFF));
1777 proto_tree_add_uint(tree, hf_erf_ehdr_chan_res, tvb, 0, 0, (uint8_t)((hdr >> 32) & 0xFF));
1778 proto_tree_add_uint_format_value(tree, hf_erf_ehdr_chan_virt_container_id, tvb, 0, 0, vc_id,
1779 "0x%.2x (g.707: %s)", vc_id, wmem_strbuf_get_str(vc_id_string));
1780 proto_tree_add_uint(tree, hf_erf_ehdr_chan_assoc_virt_container_size, tvb, 0, 0, vc_size);
1781 proto_tree_add_uint(tree, hf_erf_ehdr_chan_rate, tvb, 0, 0, line_rate);
1782 proto_tree_add_uint(tree, hf_erf_ehdr_chan_type, tvb, 0, 0, (uint8_t)((hdr >> 0) & 0xFF));
1783 }
1784
1785 static void
1786 dissect_signature_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1787 {
1788 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1789
1790 proto_tree_add_uint(tree, hf_erf_ehdr_signature_payload_hash, tvb, 0, 0, (uint32_t)((hdr >> 32) & 0xFFFFFF));
1791 proto_tree_add_uint(tree, hf_erf_ehdr_signature_color, tvb, 0, 0, (uint8_t)((hdr >> 24) & 0xFF));
1792 proto_tree_add_uint(tree, hf_erf_ehdr_signature_flow_hash, tvb, 0, 0, (uint32_t)(hdr & 0xFFFFFF));
1793 }
1794
1795 static void
1796 dissect_host_id_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1797 {
1798 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1799
1800 proto_tree_add_uint(tree, hf_erf_ehdr_host_id_sourceid, tvb, 0, 0, (uint8_t)((hdr >> 48) & 0xFF));
1801 proto_tree_add_uint64(tree, hf_erf_ehdr_host_id_hostid, tvb, 0, 0, (hdr & ERF_EHDR_HOST_ID_MASK));
1802 }
1803
1804 static void
1805 dissect_anchor_id_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1806 {
1807 static int * const anchor_flags[] =
1808 {
1809 &hf_erf_ehdr_anchor_id_definition,
1810 &hf_erf_ehdr_anchor_id_reserved,
1811 NULL
1812 };
1813
1814 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1815
1816 proto_tree_add_bitmask_value(tree, tvb, 0, hf_erf_ehdr_anchor_id_flags, ett_erf_anchor_flags, anchor_flags, (uint8_t)(hdr >> 48) & 0xff);
1817 proto_tree_add_uint64(tree, hf_erf_ehdr_anchor_id_anchorid, tvb, 0, 0, (hdr & ERF_EHDR_ANCHOR_ID_MASK));
1818 }
1819
1820
1821 static void
1822 dissect_flow_id_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1823 {
1824 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1825 uint8_t hash_type = (uint8_t)((hdr >> 40) & 0xFF);
1826 proto_item *hash_type_item;
1827 proto_tree *hash_type_tree;
1828
1829 proto_tree_add_uint(tree, hf_erf_ehdr_flow_id_source_id, tvb, 0, 0, (uint8_t)((hdr >> 48) & 0xFF));
1830
1831 hash_type_item = proto_tree_add_uint_format_value(tree, hf_erf_ehdr_flow_id_hash_type, tvb, 0, 0, hash_type,
1832 "0x%02x (%s%s)",
1833 hash_type,
1834 (hash_type & ERF_EHDR_FLOW_ID_HASH_TYPE_INNER_MASK) ? "Inner " : "",
1835 val_to_str_const(
1836 (hash_type & ERF_EHDR_FLOW_ID_HASH_TYPE_TYPE_MASK),
1837 erf_hash_type,
1838 "Unknown Type"));
1839
1840 hash_type_tree = proto_item_add_subtree(hash_type_item, ett_erf_hash_type);
1841 proto_tree_add_uint(hash_type_tree, hf_erf_ehdr_flow_id_hash_type_type, tvb, 0, 0, hash_type);
1842 proto_tree_add_uint(hash_type_tree, hf_erf_ehdr_flow_id_hash_type_inner, tvb, 0, 0, hash_type);
1843
1844 proto_tree_add_uint(tree, hf_erf_ehdr_flow_id_stack_type, tvb, 0, 0, (uint8_t)((hdr >> 32) & 0xFF));
1845 proto_tree_add_uint(tree, hf_erf_ehdr_flow_id_flow_hash, tvb, 0, 0, (uint32_t)(hdr & 0xFFFFFFFF));
1846 }
1847
1848 static float
1849 entropy_from_entropy_header_value(uint8_t entropy_hdr_value)
1850 {
1851 /* mapping 1-255 to 0.0-8.0 */
1852 /* 255 is 8.0 */
1853 /* 1 represent any value less than 2/32 */
1854 /* 0 represents not calculated */
1855 return (float)((entropy_hdr_value == 0)?0.0f: (((float)entropy_hdr_value+1) / 32.0f));
1856 }
1857
1858 static void
1859 dissect_entropy_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
1860 {
1861 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
1862 uint8_t entropy_hdr_value = (uint8_t)((hdr >> 48) & 0xFF);
1863 float entropy;
1864 proto_item *pi;
1865 proto_tree *entropy_value_tree;
1866
1867 entropy = entropy_from_entropy_header_value(entropy_hdr_value);
1868
1869 pi = proto_tree_add_float_format_value(tree, hf_erf_ehdr_entropy_entropy, tvb, 0, 0, entropy,
1870 "%.2f %s", (double) entropy, entropy == 0.0f ? "(not calculated)":"bits");
1871 entropy_value_tree = proto_item_add_subtree(pi, ett_erf_entropy_value);
1872 proto_tree_add_uint(entropy_value_tree, hf_erf_ehdr_entropy_entropy_raw, tvb, 0, 0, entropy_hdr_value);
1873
1874 proto_tree_add_uint64(tree, hf_erf_ehdr_entropy_reserved, tvb, 0, 0, (hdr & 0xFFFFFFFFFFFF));
1875 }
1876
1877 static uint64_t
1878 find_host_id(packet_info *pinfo, bool *has_anchor_definition) {
1879 uint64_t hdr;
1880 uint8_t type;
1881 uint8_t has_more = pinfo->pseudo_header->erf.phdr.type & 0x80;
1882 int i = 0;
1883 uint64_t host_id = ERF_META_HOST_ID_IMPLICIT;
1884 bool anchor_definition = false;
1885
1886 while(has_more && (i < MAX_ERF_EHDR)) {
1887 hdr = pinfo->pseudo_header->erf.ehdr_list[i].ehdr;
1888 type = (uint8_t) (hdr >> 56);
1889
1890 switch (type & 0x7f) {
1891 case ERF_EXT_HDR_TYPE_HOST_ID:
1892 if (host_id == ERF_META_HOST_ID_IMPLICIT)
1893 host_id = hdr & ERF_EHDR_HOST_ID_MASK;
1894 break;
1895 case ERF_EXT_HDR_TYPE_ANCHOR_ID:
1896 if ((hdr & ERF_EHDR_ANCHOR_ID_DEFINITION_MASK))
1897 anchor_definition = true;
1898 break;
1899 }
1900 has_more = type & 0x80;
1901 i += 1;
1902 }
1903
1904 if (has_anchor_definition)
1905 *has_anchor_definition = anchor_definition;
1906
1907 return host_id;
1908 }
1909
1910 static void dissect_host_anchor_id(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint64_t host_id, uint64_t anchor_id, uint8_t anchor _U_) {
1911
1912 erf_anchor_key_t key = {host_id, anchor_id};
1913 erf_host_anchor_info_t *anchor_info;
1914 erf_anchored_info_t *anchored_info;
1915 wmem_list_frame_t *frame;
1916 wmem_list_t *frame_list;
1917 proto_item *pi = NULL;
1918 proto_tree *subtree;
1919
1920 /* TODO: top level linking to most recent frame like we have for Host ID? */
1921 subtree = proto_tree_add_subtree_format(tree, tvb, 0, 0, ett_erf_anchor, &pi, "Host ID: 0x%012" PRIx64 ", Anchor ID: 0x%012" PRIx64, host_id & ERF_EHDR_HOST_ID_MASK, anchor_id & ERF_EHDR_ANCHOR_ID_MASK);
1922 proto_item_set_generated(pi);
1923
1924 pi = proto_tree_add_uint64(subtree, hf_erf_anchor_hostid, tvb, 0, 0, host_id & ERF_EHDR_HOST_ID_MASK);
1925 proto_item_set_generated(pi);
1926 pi = proto_tree_add_uint64(subtree, hf_erf_anchor_anchorid, tvb, 0, 0, anchor_id & ERF_EHDR_ANCHOR_ID_MASK);
1927 proto_item_set_generated(pi);
1928
1929 anchor_info = (erf_host_anchor_info_t*)wmem_map_lookup(erf_state.host_anchor_map, &key);
1930
1931 if(!anchor_info) {
1932 return;
1933 }
1934
1935 frame_list = anchor_info->anchored_list;
1936
1937 /* Try to link frames */
1938 frame = wmem_list_head(frame_list);
1939 while(frame != NULL) {
1940 anchored_info = (erf_anchored_info_t*)wmem_list_frame_data(frame);
1941 if(pinfo->num != anchored_info->frame_num) {
1942 /* Don't list the frame itself */
1943 pi = proto_tree_add_uint(subtree, hf_erf_anchor_linked, tvb, 0, 0, anchored_info->frame_num);
1944 proto_item_set_generated(pi);
1945 /* XXX: Need to do this each time because pinfo is discarded. Filtering does not reset visited as it does not do a full redissect.
1946 We also might not catch all frames in the first pass (e.g. comment after record). */
1947 mark_frame_as_depended_upon(pinfo->fd, anchored_info->frame_num);
1948 }
1949 frame = wmem_list_frame_next(frame);
1950 }
1951 }
1952
1953 static void
1954 dissect_host_id_source_id(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint64_t host_id, uint8_t source_id)
1955 {
1956 proto_tree *hostid_tree;
1957 proto_item *pi = NULL;
1958 uint32_t fnum_current = UINT32_MAX;
1959 uint32_t fnum = UINT32_MAX;
1960 uint32_t fnum_next = UINT32_MAX;
1961
1962 fnum = erf_source_find_closest(host_id, source_id, pinfo->num, &fnum_next);
1963
1964 if (fnum != UINT32_MAX) {
1965 fnum_current = fnum;
1966 } else {
1967 /* XXX: Possibly undesirable side effect: first metadata record links to next */
1968 fnum_current = fnum_next;
1969 }
1970
1971 if (fnum_current != UINT32_MAX) {
1972 pi = proto_tree_add_uint_format(tree, hf_erf_source_current, tvb, 0, 0, fnum_current,
1973 "Host ID: 0x%012" PRIx64 ", Source ID: %u", host_id, source_id&0xFF);
1974 hostid_tree = proto_item_add_subtree(pi, ett_erf_source);
1975 } else {
1976 /* If we have no frame number to link against, just add a static subtree */
1977 hostid_tree = proto_tree_add_subtree_format(tree, tvb, 0, 0, ett_erf_source, &pi,
1978 "Host ID: 0x%012" PRIx64 ", Source ID: %u", host_id, source_id&0xFF);
1979 }
1980 proto_item_set_generated(pi);
1981
1982 pi = proto_tree_add_uint64(hostid_tree, hf_erf_hostid, tvb, 0, 0, host_id);
1983 proto_item_set_generated(pi);
1984 pi = proto_tree_add_uint(hostid_tree, hf_erf_sourceid, tvb, 0, 0, source_id);
1985 proto_item_set_generated(pi);
1986
1987 if (fnum_next != UINT32_MAX) {
1988 pi = proto_tree_add_uint(hostid_tree, hf_erf_source_next, tvb, 0, 0, fnum_next);
1989 proto_item_set_generated(pi);
1990 /* XXX: Save the surrounding nearest periodic records when we do a filtered save so we keep native ERF metadata */
1991 mark_frame_as_depended_upon(pinfo->fd, fnum_next);
1992 }
1993 if (fnum != UINT32_MAX) {
1994 pi = proto_tree_add_uint(hostid_tree, hf_erf_source_prev, tvb, 0, 0, fnum);
1995 proto_item_set_generated(pi);
1996 mark_frame_as_depended_upon(pinfo->fd, fnum);
1997 }
1998 }
1999
2000 static void
2001 dissect_unknown_ex_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int idx)
2002 {
2003 uint64_t hdr = pinfo->pseudo_header->erf.ehdr_list[idx].ehdr;
2004
2005 proto_tree_add_uint64(tree, hf_erf_ehdr_unk, tvb, 0, 0, hdr);
2006 }
2007
2008 static void
2009 dissect_mc_hdlc_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2010 {
2011 proto_item *mc_hdlc_item;
2012 proto_tree *mc_hdlc_tree;
2013 uint32_t mc_hdlc;
2014 proto_item *pi;
2015
2016 /* Multi Channel HDLC Header */
2017 mc_hdlc_item = proto_tree_add_uint(tree, hf_erf_mc_hdlc, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2018 mc_hdlc_tree = proto_item_add_subtree(mc_hdlc_item, ett_erf_mc_hdlc);
2019 mc_hdlc = pinfo->pseudo_header->erf.subhdr.mc_hdr;
2020
2021 proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_cn, tvb, 0, 0, mc_hdlc);
2022 proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_res1, tvb, 0, 0, mc_hdlc);
2023 proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_res2, tvb, 0, 0, mc_hdlc);
2024 pi=proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_fcse, tvb, 0, 0, mc_hdlc);
2025 if (mc_hdlc & MC_HDLC_FCSE_MASK)
2026 expert_add_info(pinfo, pi, &ei_erf_mc_hdlc_checksum_error);
2027
2028 pi=proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_sre, tvb, 0, 0, mc_hdlc);
2029 if (mc_hdlc & MC_HDLC_SRE_MASK)
2030 expert_add_info(pinfo, pi, &ei_erf_mc_hdlc_short_error);
2031
2032 pi=proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_lre, tvb, 0, 0, mc_hdlc);
2033 if (mc_hdlc & MC_HDLC_LRE_MASK)
2034 expert_add_info(pinfo, pi, &ei_erf_mc_hdlc_long_error);
2035
2036 pi=proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_afe, tvb, 0, 0, mc_hdlc);
2037 if (mc_hdlc & MC_HDLC_AFE_MASK)
2038 expert_add_info(pinfo, pi, &ei_erf_mc_hdlc_abort_error);
2039
2040 pi=proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_oe, tvb, 0, 0, mc_hdlc);
2041 if (mc_hdlc & MC_HDLC_OE_MASK)
2042 expert_add_info(pinfo, pi, &ei_erf_mc_hdlc_octet_error);
2043
2044 pi=proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_lbe, tvb, 0, 0, mc_hdlc);
2045 if (mc_hdlc & MC_HDLC_LBE_MASK)
2046 expert_add_info(pinfo, pi, &ei_erf_mc_hdlc_lost_byte_error);
2047
2048 proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_first, tvb, 0, 0, mc_hdlc);
2049 proto_tree_add_uint(mc_hdlc_tree, hf_erf_mc_hdlc_res3, tvb, 0, 0, mc_hdlc);
2050 }
2051
2052 static void
2053 dissect_mc_raw_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2054 {
2055 proto_item *mc_raw_item;
2056 proto_tree *mc_raw_tree;
2057 uint32_t mc_raw;
2058
2059 /* Multi Channel RAW Header */
2060 mc_raw_item = proto_tree_add_uint(tree, hf_erf_mc_raw, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2061 mc_raw_tree = proto_item_add_subtree(mc_raw_item, ett_erf_mc_raw);
2062 mc_raw = pinfo->pseudo_header->erf.subhdr.mc_hdr;
2063
2064 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_int, tvb, 0, 0, mc_raw);
2065 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_res1, tvb, 0, 0, mc_raw);
2066 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_sre, tvb, 0, 0, mc_raw);
2067 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_lre, tvb, 0, 0, mc_raw);
2068 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_res2, tvb, 0, 0, mc_raw);
2069 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_lbe, tvb, 0, 0, mc_raw);
2070 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_first, tvb, 0, 0, mc_raw);
2071 proto_tree_add_uint(mc_raw_tree, hf_erf_mc_raw_res3, tvb, 0, 0, mc_raw);
2072 }
2073
2074 static void
2075 dissect_mc_atm_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2076 {
2077 proto_item *mc_atm_item;
2078 proto_tree *mc_atm_tree;
2079 uint32_t mc_atm;
2080
2081 /*"Multi Channel ATM Header"*/
2082 mc_atm_item = proto_tree_add_uint(tree, hf_erf_mc_atm, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2083 mc_atm_tree = proto_item_add_subtree(mc_atm_item, ett_erf_mc_atm);
2084 mc_atm = pinfo->pseudo_header->erf.subhdr.mc_hdr;
2085
2086 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_cn, tvb, 0, 0, mc_atm);
2087 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_res1, tvb, 0, 0, mc_atm);
2088 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_mul, tvb, 0, 0, mc_atm);
2089
2090 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_port, tvb, 0, 0, mc_atm);
2091 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_res2, tvb, 0, 0, mc_atm);
2092
2093 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_lbe, tvb, 0, 0, mc_atm);
2094 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_hec, tvb, 0, 0, mc_atm);
2095 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_crc10, tvb, 0, 0, mc_atm);
2096 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_oamcell, tvb, 0, 0, mc_atm);
2097 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_first, tvb, 0, 0, mc_atm);
2098 proto_tree_add_uint(mc_atm_tree, hf_erf_mc_atm_res3, tvb, 0, 0, mc_atm);
2099 }
2100
2101 static void
2102 dissect_mc_rawlink_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2103 {
2104 proto_item *mc_rawl_item;
2105 proto_tree *mc_rawl_tree;
2106 uint32_t mc_rawl;
2107
2108 /* Multi Channel RAW Link Header */
2109 mc_rawl_item = proto_tree_add_uint(tree, hf_erf_mc_rawl, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2110 mc_rawl_tree = proto_item_add_subtree(mc_rawl_item, ett_erf_mc_rawlink);
2111 mc_rawl = pinfo->pseudo_header->erf.subhdr.mc_hdr;
2112
2113 proto_tree_add_uint(mc_rawl_tree, hf_erf_mc_rawl_cn, tvb, 0, 0, mc_rawl);
2114 proto_tree_add_uint(mc_rawl_tree, hf_erf_mc_rawl_res1, tvb, 0, 0, mc_rawl);
2115 proto_tree_add_uint(mc_rawl_tree, hf_erf_mc_rawl_lbe, tvb, 0, 0, mc_rawl);
2116 proto_tree_add_uint(mc_rawl_tree, hf_erf_mc_rawl_first, tvb, 0, 0, mc_rawl);
2117 proto_tree_add_uint(mc_rawl_tree, hf_erf_mc_rawl_res2, tvb, 0, 0, mc_rawl);
2118 }
2119
2120 static void
2121 dissect_mc_aal5_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2122 {
2123 proto_item *mc_aal5_item;
2124 proto_tree *mc_aal5_tree;
2125 uint32_t mc_aal5;
2126
2127 /* Multi Channel AAL5 Header */
2128 mc_aal5_item = proto_tree_add_uint(tree, hf_erf_mc_aal5, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2129 mc_aal5_tree = proto_item_add_subtree(mc_aal5_item, ett_erf_mc_aal5);
2130 mc_aal5 = pinfo->pseudo_header->erf.subhdr.mc_hdr;
2131
2132 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_cn, tvb, 0, 0, mc_aal5);
2133 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_res1, tvb, 0, 0, mc_aal5);
2134
2135 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_port, tvb, 0, 0, mc_aal5);
2136 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_crcck, tvb, 0, 0, mc_aal5);
2137 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_crce, tvb, 0, 0, mc_aal5);
2138 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_lenck, tvb, 0, 0, mc_aal5);
2139 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_lene, tvb, 0, 0, mc_aal5);
2140
2141 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_res2, tvb, 0, 0, mc_aal5);
2142 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_first, tvb, 0, 0, mc_aal5);
2143 proto_tree_add_uint(mc_aal5_tree, hf_erf_mc_aal5_res3, tvb, 0, 0, mc_aal5);
2144 }
2145
2146 static void
2147 dissect_mc_aal2_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2148 {
2149 proto_item *mc_aal2_item;
2150 proto_tree *mc_aal2_tree;
2151 uint32_t mc_aal2;
2152
2153 /* Multi Channel AAL2 Header */
2154 mc_aal2_item = proto_tree_add_uint(tree, hf_erf_mc_aal2, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2155 mc_aal2_tree = proto_item_add_subtree(mc_aal2_item, ett_erf_mc_aal2);
2156 mc_aal2 = pinfo->pseudo_header->erf.subhdr.mc_hdr;
2157
2158 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_cn, tvb, 0, 0, mc_aal2);
2159 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_res1, tvb, 0, 0, mc_aal2);
2160 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_res2, tvb, 0, 0, mc_aal2);
2161
2162 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_port, tvb, 0, 0, mc_aal2);
2163 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_res3, tvb, 0, 0, mc_aal2);
2164 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_first, tvb, 0, 0, mc_aal2);
2165 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_maale, tvb, 0, 0, mc_aal2);
2166 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_lene, tvb, 0, 0, mc_aal2);
2167
2168 proto_tree_add_uint(mc_aal2_tree, hf_erf_mc_aal2_cid, tvb, 0, 0, mc_aal2);
2169 }
2170
2171 static void
2172 dissect_aal2_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2173 {
2174 proto_item *aal2_item;
2175 proto_tree *aal2_tree;
2176 uint32_t aal2;
2177
2178 /* AAL2 Header */
2179 aal2_item = proto_tree_add_uint(tree, hf_erf_aal2, tvb, 0, 0, pinfo->pseudo_header->erf.subhdr.mc_hdr);
2180 aal2_tree = proto_item_add_subtree(aal2_item, ett_erf_aal2);
2181 aal2 = pinfo->pseudo_header->erf.subhdr.aal2_hdr;
2182
2183 proto_tree_add_uint(aal2_tree, hf_erf_aal2_cid, tvb, 0, 0, aal2);
2184
2185 proto_tree_add_uint(aal2_tree, hf_erf_aal2_maale, tvb, 0, 0, aal2);
2186
2187 proto_tree_add_uint(aal2_tree, hf_erf_aal2_maalei, tvb, 0, 0, aal2);
2188 proto_tree_add_uint(aal2_tree, hf_erf_aal2_first, tvb, 0, 0, aal2);
2189 proto_tree_add_uint(aal2_tree, hf_erf_aal2_res1, tvb, 0, 0, aal2);
2190 }
2191
2192 static void
2193 dissect_eth_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2194 {
2195 proto_item *eth_item;
2196 proto_tree *eth_tree;
2197 uint8_t eth_offset, eth_pad;
2198
2199 eth_item = proto_tree_add_item(tree, hf_erf_eth, tvb, 0, 0, ENC_NA);
2200
2201 eth_tree = proto_item_add_subtree(eth_item, ett_erf_eth);
2202 eth_offset = pinfo->pseudo_header->erf.subhdr.eth_hdr.offset;
2203 eth_pad = pinfo->pseudo_header->erf.subhdr.eth_hdr.pad;
2204
2205 proto_tree_add_uint(eth_tree, hf_erf_eth_off, tvb, 0, 0, eth_offset);
2206 proto_tree_add_uint(eth_tree, hf_erf_eth_pad, tvb, 0, 0, eth_pad);
2207 }
2208
2209 static void
2210 dissect_erf_pseudo_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2211 {
2212 proto_item *pi;
2213 proto_item *flags_item, *rectype_item;
2214 proto_tree *flags_tree, *rectype_tree;
2215 bool has_flags = false;
2216
2217 proto_tree_add_uint64(tree, hf_erf_ts, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.ts);
2218
2219 rectype_item = proto_tree_add_uint_format_value(tree, hf_erf_rectype, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.type,
2220 "0x%02x (Type %d: %s)",
2221 pinfo->pseudo_header->erf.phdr.type,
2222 pinfo->pseudo_header->erf.phdr.type & ERF_HDR_TYPE_MASK,
2223 val_to_str_const(
2224 pinfo->pseudo_header->erf.phdr.type & ERF_HDR_TYPE_MASK,
2225 erf_type_vals,
2226 "Unknown Type"));
2227
2228 rectype_tree = proto_item_add_subtree(rectype_item, ett_erf_rectype);
2229 proto_tree_add_uint(rectype_tree, hf_erf_type, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.type);
2230 proto_tree_add_uint(rectype_tree, hf_erf_ehdr, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.type);
2231
2232 flags_item=proto_tree_add_uint(tree, hf_erf_flags, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2233 flags_tree = proto_item_add_subtree(flags_item, ett_erf_flags);
2234
2235 proto_tree_add_uint(flags_tree, hf_erf_flags_if_raw, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2236
2237 proto_tree_add_uint(flags_tree, hf_erf_flags_vlen, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2238 pi=proto_tree_add_uint(flags_tree, hf_erf_flags_trunc, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2239 if (pinfo->pseudo_header->erf.phdr.flags & ERF_HDR_TRUNC_MASK) {
2240 proto_item_append_text(flags_item, "(ERF Truncation Error");
2241 expert_add_info(pinfo, pi, &ei_erf_truncation_error);
2242 has_flags = true;
2243 }
2244
2245 pi=proto_tree_add_uint(flags_tree, hf_erf_flags_rxe, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2246 if (pinfo->pseudo_header->erf.phdr.flags & ERF_HDR_RXE_MASK) {
2247 proto_item_append_text(flags_item, "%sERF Rx Error", has_flags ? "; " : "(");
2248 expert_add_info(pinfo, pi, &ei_erf_rx_error);
2249 has_flags = true;
2250 }
2251
2252 pi=proto_tree_add_uint(flags_tree, hf_erf_flags_dse, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2253 if (pinfo->pseudo_header->erf.phdr.flags & ERF_HDR_DSE_MASK) {
2254 proto_item_append_text(flags_item, "%sERF DS Error", has_flags ? "; " : "(");
2255 expert_add_info(pinfo, pi, &ei_erf_ds_error);
2256 has_flags = true;
2257 }
2258 if (has_flags) {
2259 proto_item_append_text(flags_item, ")");
2260 }
2261
2262 proto_tree_add_uint(flags_tree, hf_erf_flags_res, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.flags);
2263
2264 proto_tree_add_uint(tree, hf_erf_flags_cap, tvb, 0, 0, erf_interface_id_from_flags(pinfo->pseudo_header->erf.phdr.flags));
2265
2266 proto_tree_add_uint(tree, hf_erf_rlen, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.rlen);
2267
2268 if (erf_type_has_color(pinfo->pseudo_header->erf.phdr.type)) {
2269 proto_tree_add_uint(tree, hf_erf_color, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.lctr);
2270 } else {
2271 pi=proto_tree_add_uint(tree, hf_erf_lctr, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.lctr);
2272 if (pinfo->pseudo_header->erf.phdr.lctr > 0)
2273 expert_add_info(pinfo, pi, &ei_erf_packet_loss);
2274 }
2275
2276 proto_tree_add_uint(tree, hf_erf_wlen, tvb, 0, 0, pinfo->pseudo_header->erf.phdr.wlen);
2277 }
2278
2279 static void
2280 dissect_erf_pseudo_extension_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2281 {
2282 proto_item *pi;
2283 proto_item *ehdr_tree;
2284 uint64_t hdr;
2285 uint8_t type;
2286 uint8_t has_more = pinfo->pseudo_header->erf.phdr.type & 0x80;
2287 int i = 0;
2288 int max = array_length(pinfo->pseudo_header->erf.ehdr_list);
2289
2290 uint64_t host_id = ERF_META_HOST_ID_IMPLICIT;
2291 uint8_t source_id = 0;
2292 bool found_host_id = false;
2293 bool has_anchor_definition = false;
2294
2295 /*
2296 * Get the first Host ID of the record (which may not be the first extension
2297 * header).
2298 */
2299 host_id = find_host_id(pinfo, &has_anchor_definition);
2300 if (host_id == ERF_META_HOST_ID_IMPLICIT) {
2301 /*
2302 * XXX: We are relying here on the Wireshark doing a second parse any
2303 * time it does anything with tree items (including filtering) to associate
2304 * the records before the first ERF_TYPE_META record. This does not work
2305 * with TShark in one-pass mode, in which case the first few records get
2306 * Host ID 0 (unset).
2307 */
2308 host_id = erf_state.implicit_host_id;
2309 found_host_id = false;
2310 } else {
2311 found_host_id = true;
2312 }
2313
2314 while(has_more && (i < max)) {
2315 hdr = pinfo->pseudo_header->erf.ehdr_list[i].ehdr;
2316 type = (uint8_t) (hdr >> 56);
2317
2318 pi = proto_tree_add_uint(tree, hf_erf_ehdr_t, tvb, 0, 0, (type & 0x7f));
2319 ehdr_tree = proto_item_add_subtree(pi, ett_erf_pseudo_hdr);
2320
2321 switch (type & 0x7f) {
2322 case ERF_EXT_HDR_TYPE_CLASSIFICATION:
2323 dissect_classification_ex_header(tvb, pinfo, ehdr_tree, i);
2324 break;
2325 case ERF_EXT_HDR_TYPE_INTERCEPTID:
2326 dissect_intercept_ex_header(tvb, pinfo, ehdr_tree, i);
2327 break;
2328 case ERF_EXT_HDR_TYPE_RAW_LINK:
2329 dissect_raw_link_ex_header(tvb, pinfo, ehdr_tree, i);
2330 break;
2331 case ERF_EXT_HDR_TYPE_BFS:
2332 dissect_bfs_ex_header(tvb, pinfo, ehdr_tree, i);
2333 break;
2334 case ERF_EXT_HDR_TYPE_CHANNELISED:
2335 dissect_channelised_ex_header(tvb, pinfo, ehdr_tree, i);
2336 break;
2337 case ERF_EXT_HDR_TYPE_SIGNATURE:
2338 dissect_signature_ex_header(tvb, pinfo, ehdr_tree, i);
2339 break;
2340 case ERF_EXT_HDR_TYPE_FLOW_ID:
2341 if (source_id == 0) {
2342 source_id = (uint8_t)((hdr >> 48) & 0xFF);
2343 }
2344 dissect_flow_id_ex_header(tvb, pinfo, ehdr_tree, i);
2345 break;
2346 case ERF_EXT_HDR_TYPE_HOST_ID:
2347 host_id = hdr & ERF_EHDR_HOST_ID_MASK;
2348 source_id = (uint8_t)((hdr >> 48) & 0xFF);
2349 dissect_host_id_ex_header(tvb, pinfo, ehdr_tree, i);
2350
2351 /* Track and dissect combined Host ID and Source ID(s) */
2352 if (!PINFO_FD_VISITED(pinfo)) {
2353 if ((pinfo->pseudo_header->erf.phdr.type & 0x7f) == ERF_TYPE_META) {
2354 /* Update the implicit Host ID when ERF_TYPE_META */
2355 /* XXX: We currently assume there is only one in the whole file */
2356 if (erf_state.implicit_host_id == 0 && source_id > 0) {
2357 erf_state.implicit_host_id = host_id;
2358 }
2359
2360 /* Add to the sequence of ERF_TYPE_META records if periodic record */
2361 /*
2362 * Adding metadata from comment records makes for unhelpful linking
2363 * and means we miss out on the correct frame when marking surrounding
2364 * metadata as depended upon (e.g. could end up with a comment from
2365 * another frame). We mark the anchor linked records separately.
2366 */
2367 if (!has_anchor_definition) {
2368 /* XXX: this is a heuristic, technically we could have non-local sections
2369 in the metadata even as an anchor definition record. */
2370 erf_source_append(host_id, source_id, pinfo->num);
2371 }
2372 }
2373 }
2374 dissect_host_id_source_id(tvb, pinfo, tree, host_id, source_id);
2375 break;
2376 case ERF_EXT_HDR_TYPE_ANCHOR_ID:
2377 dissect_anchor_id_ex_header(tvb, pinfo, ehdr_tree, i);
2378 if (!PINFO_FD_VISITED(pinfo)) {
2379 erf_host_anchor_info_insert(pinfo, host_id, hdr & ERF_EHDR_ANCHOR_ID_MASK, (uint8_t)(hdr >> 48));
2380 }
2381 dissect_host_anchor_id(tvb, pinfo, tree, host_id, hdr & ERF_EHDR_ANCHOR_ID_MASK, (uint8_t)(hdr >> 48));
2382 break;
2383 case ERF_EXT_HDR_TYPE_ENTROPY:
2384 dissect_entropy_ex_header(tvb, pinfo, ehdr_tree, i);
2385 break;
2386 default:
2387 dissect_unknown_ex_header(tvb, pinfo, ehdr_tree, i);
2388 break;
2389 }
2390
2391 has_more = type & 0x80;
2392 i += 1;
2393 }
2394 if (has_more) {
2395 proto_tree_add_expert(tree, pinfo, &ei_erf_extension_headers_not_shown, tvb, 0, 0);
2396 }
2397
2398 /* If we have no explicit Host ID association, associate with the first Source ID (or 0) and implicit Host ID */
2399 /* XXX: We are allowed to assume there is only one Source ID unless we have
2400 * a Host ID extension header */
2401 if (!found_host_id) {
2402 /*
2403 * TODO: Do we also want to track Host ID 0 Source ID 0 records?
2404 * Don't for now to preserve feel of legacy files.
2405 */
2406 if (host_id != 0 || source_id != 0) {
2407 if (!PINFO_FD_VISITED(pinfo)) {
2408 if ((pinfo->pseudo_header->erf.phdr.type & 0x7f) == ERF_TYPE_META) {
2409 /* Add to the sequence of ERF_TYPE_META records */
2410 erf_source_append(host_id, source_id, pinfo->num);
2411 }
2412 }
2413 dissect_host_id_source_id(tvb, pinfo, tree, host_id, source_id);
2414 }
2415 }
2416 }
2417
2418 uint64_t* erf_get_ehdr(packet_info *pinfo, uint8_t hdrtype, int* afterindex) {
2419 uint8_t type;
2420 uint8_t has_more;
2421 int max;
2422 int i = afterindex ? *afterindex + 1 : 0; /*allow specifying instance to start after for use in loop*/
2423
2424 if (!pinfo) /*XXX: how to determine if erf pseudo_header is valid?*/
2425 return NULL;
2426
2427 has_more = pinfo->pseudo_header->erf.phdr.type & 0x80;
2428 max = array_length(pinfo->pseudo_header->erf.ehdr_list);
2429
2430
2431 while(has_more && (i < max)) {
2432 type = (uint8_t) (pinfo->pseudo_header->erf.ehdr_list[i].ehdr >> 56);
2433
2434 if ((type & 0x7f) == (hdrtype & 0x7f)) {
2435 if (afterindex)
2436 *afterindex = i;
2437 return &pinfo->pseudo_header->erf.ehdr_list[i].ehdr;
2438 }
2439
2440 has_more = type & 0x80;
2441 i += 1;
2442 }
2443
2444 return NULL;
2445 }
2446
2447 static void
2448 check_section_length(packet_info *pinfo, proto_item *sectionlen_pi, int offset, int sectionoffset, int sectionlen) {
2449 if (sectionlen_pi) {
2450 if (offset - sectionoffset == sectionlen) {
2451 proto_item_append_text(sectionlen_pi, " [correct]");
2452 } else if (sectionlen != 0) {
2453 proto_item_append_text(sectionlen_pi, " [incorrect, should be %u]", offset - sectionoffset);
2454 expert_add_info(pinfo, sectionlen_pi, &ei_erf_meta_section_len_error);
2455 }
2456 }
2457 }
2458
2459 static proto_item*
2460 dissect_meta_tag_bitfield(proto_item *section_tree, tvbuff_t *tvb, int offset, erf_meta_tag_info_t *tag_info, proto_item **out_tag_tree)
2461 {
2462 proto_item *tag_pi = NULL;
2463 int* hf_flags[ERF_HF_VALUES_PER_TAG];
2464 int i;
2465
2466 DISSECTOR_ASSERT(tag_info->extra);
2467
2468 for (i = 0; tag_info->extra->hf_values[i] != -1; i++) {
2469 hf_flags[i] = &tag_info->extra->hf_values[i];
2470 }
2471 hf_flags[i] = NULL;
2472
2473 /* use flags variant so we print integers without value_strings */
2474 tag_pi = proto_tree_add_bitmask_with_flags(section_tree, tvb, offset + 4, tag_info->hf_value, tag_info->ett, hf_flags, ENC_BIG_ENDIAN, BMT_NO_FLAGS);
2475 if (out_tag_tree) {
2476 *out_tag_tree = proto_item_get_subtree(tag_pi);
2477 }
2478
2479 return tag_pi;
2480 }
2481
2482 static proto_item*
2483 dissect_meta_tag_ext_hdrs(proto_item *section_tree, tvbuff_t *tvb, int offset, int taglength, erf_meta_tag_info_t *tag_info, proto_item **out_tag_tree, expert_field **out_truncated_expert)
2484 {
2485 proto_item *tag_pi = NULL;
2486 proto_tree *subtree = NULL;
2487 proto_item *subtree_pi = NULL;
2488 int i;
2489 uint32_t ext_hdrs[4] = {0, 0, 0, 0};
2490 int int_offset = 0;
2491 int int_avail = MIN(taglength / 4, 4);
2492 int bit_offset = 0;
2493 int ext_hdr_num = 0;
2494 bool first = true;
2495 bool all_set = true;
2496
2497 DISSECTOR_ASSERT(tag_info->extra);
2498
2499 tag_pi = proto_tree_add_item(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, ENC_BIG_ENDIAN);
2500 *out_tag_tree = proto_item_add_subtree(tag_pi, tag_info->ett);
2501
2502 for (int_offset = 0; int_offset < int_avail; int_offset++) {
2503 ext_hdrs[int_offset] = tvb_get_uint32(tvb, offset + 4 + int_offset*4, ENC_BIG_ENDIAN);
2504 if (ext_hdrs[int_offset] != UINT32_MAX)
2505 all_set = false;
2506 }
2507
2508 /* Special case: all specified bits are 1 means all extension headers */
2509 if (all_set)
2510 proto_item_append_text(tag_pi, ": <All>");
2511
2512 /* Add 4 subtrees, one for each uint32 representing 32 extension header numbers */
2513 for (int_offset = 0; int_offset < int_avail; int_offset++) {
2514 /* TODO: Put subtree hf values somewhere better than first 4 hf_values */
2515 subtree_pi = proto_tree_add_item(*out_tag_tree, tag_info->extra->hf_values[int_offset], tvb, offset + 4 + int_offset*4, 4, ENC_BIG_ENDIAN);
2516
2517 /* Add the individual bit dissections */
2518 /* XXX: This currently assumes we only know up to the first 32 */
2519 if (int_offset == 0) {
2520 subtree = proto_item_add_subtree(subtree_pi, tag_info->ett);
2521 for (i = 4; tag_info->extra->hf_values[i] != -1; i++) {
2522 proto_tree_add_boolean(subtree, tag_info->extra->hf_values[i], tvb, offset + 4 + int_offset*4, 4, ext_hdrs[int_offset]);
2523 }
2524 }
2525
2526 /* Add all set bits to the header, including the ones we don't understand */
2527 for (bit_offset = 0; bit_offset < 32; bit_offset++) {
2528 if (ext_hdrs[int_offset] & (1U << bit_offset)) {
2529 proto_item_append_text(subtree_pi, ", %s", val_to_str(ext_hdr_num, ehdr_type_vals, "%d"));
2530
2531 /* Also add to the top level */
2532 if (!all_set)
2533 proto_item_append_text(tag_pi, "%s %s", first ? ":" : ",", val_to_str(ext_hdr_num, ehdr_type_vals, "%d"));
2534
2535 first = false;
2536 }
2537
2538 ext_hdr_num++;
2539 }
2540 }
2541
2542 if (first)
2543 proto_item_append_text(tag_pi, ": <None>");
2544
2545 /* Check for truncated tag (i.e. last uint32 is partial) */
2546 if (int_avail < 4 && taglength % 4 != 0) {
2547 *out_truncated_expert = &ei_erf_meta_truncated_tag;
2548 }
2549
2550 return tag_pi;
2551 }
2552
2553 static void erf_ts_to_nstime(uint64_t timestamp, nstime_t* t, bool is_relative) {
2554 uint64_t ts = timestamp;
2555
2556 /* relative ERF timestamps are signed, convert as if unsigned then flip back */
2557 if (is_relative) {
2558 ts = (uint64_t) ABS((int64_t)timestamp);
2559 }
2560
2561
2562 t->secs = (long) (ts >> 32);
2563 ts = ((ts & 0xffffffff) * 1000 * 1000 * 1000);
2564 ts += (ts & 0x80000000) << 1; /* rounding */
2565 t->nsecs = ((int) (ts >> 32));
2566 if (t->nsecs >= NS_PER_S) {
2567 t->nsecs -= NS_PER_S;
2568 t->secs += 1;
2569 }
2570
2571 if (is_relative && (int64_t)timestamp < 0) {
2572 /*
2573 * Set both signs to negative for consistency with other nstime code
2574 * and so -0.123 works.
2575 */
2576 t->secs = -(t->secs);
2577 t->nsecs = -(t->nsecs);
2578 }
2579 }
2580
2581 /* TODO: Would be nice if default FT_RELATIVE_TIME formatter was prettier */
2582 static proto_item *dissect_relative_time(proto_tree *tree, const int hfindex, tvbuff_t *tvb, int offset, int length, nstime_t* t) {
2583 proto_item *pi = NULL;
2584
2585 DISSECTOR_ASSERT(t);
2586
2587 /*Print in nanoseconds if <1ms for small values*/
2588 if (t->secs == 0 && t->nsecs < 1000000 && t->nsecs > -1000000) {
2589 pi = proto_tree_add_time_format_value(tree, hfindex, tvb, offset, length, t, "%d nanoseconds", t->nsecs);
2590 } else {
2591 pi = proto_tree_add_time(tree, hfindex, tvb, offset, length, t);
2592 }
2593
2594 return pi;
2595 }
2596
2597 static proto_item *dissect_ptp_timeinterval(proto_tree *tree, const int hfindex, tvbuff_t *tvb, int offset, int length, int64_t timeinterval) {
2598 nstime_t t;
2599 uint64_t ti, ti_ns;
2600
2601 ti = (uint64_t) ABS(timeinterval);
2602
2603 ti += (ti & 0x8000) << 1; /* rounding */
2604 ti_ns = ti >> 16;
2605 t.secs = (time_t) (ti_ns / NS_PER_S);
2606 t.nsecs = (uint32_t)(ti_ns % NS_PER_S);
2607 if (t.nsecs >= NS_PER_S) {
2608 t.nsecs -= NS_PER_S;
2609 t.secs += 1;
2610 }
2611
2612 if (timeinterval < 0) {
2613 /*
2614 * Set both signs to negative for consistency with other nstime code
2615 * and so -0.123 works.
2616 */
2617 t.secs = -(t.secs);
2618 t.nsecs = -(t.nsecs);
2619 }
2620
2621 return dissect_relative_time(tree, hfindex, tvb, offset, length, &t);
2622 }
2623
2624 static int
2625 meta_tag_expected_length(erf_meta_tag_info_t *tag_info) {
2626 ftenum_t ftype = tag_info->tag_template->hfinfo.type;
2627 int expected_length = 0;
2628
2629 switch (ftype) {
2630 case FT_ABSOLUTE_TIME:
2631 case FT_RELATIVE_TIME:
2632 /* Timestamps are in ERF timestamp except as below */
2633 expected_length = 8;
2634 break;
2635
2636 default:
2637 expected_length = ftype_wire_size(ftype); /* Returns 0 if unknown */
2638 break;
2639 }
2640
2641 /* Special case overrides */
2642 switch (tag_info->code) {
2643 case ERF_META_TAG_ptp_current_utc_offset:
2644 /*
2645 * PTP tags are in native PTP format, but only current_utc_offset is
2646 * a different length to the ERF timestamp.
2647 */
2648 expected_length = 4;
2649 break;
2650
2651 case ERF_META_TAG_if_wwn:
2652 case ERF_META_TAG_src_wwn:
2653 case ERF_META_TAG_dest_wwn:
2654 case ERF_META_TAG_ns_host_wwn:
2655 /* 16-byte WWNs */
2656 expected_length = 16;
2657 break;
2658
2659 case ERF_META_TAG_ext_hdrs_added:
2660 case ERF_META_TAG_ext_hdrs_removed:
2661 /* 1 to 4 uint32 fields */
2662 expected_length = 4;
2663 break;
2664 }
2665
2666 return expected_length;
2667 }
2668
2669 static void
2670 dissect_meta_record_tags(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
2671 proto_item *pi = NULL;
2672 proto_item *tag_pi = NULL;
2673 proto_item *tag_tree;
2674 proto_item *section_pi = NULL;
2675 proto_item *section_tree = tree;
2676 proto_item *sectionlen_pi = NULL;
2677
2678 uint16_t sectiontype = ERF_META_SECTION_NONE;
2679 uint16_t tagtype = 0;
2680 uint16_t taglength = 0;
2681 const char *tagvalstring = NULL;
2682 erf_meta_tag_info_t *tag_info;
2683 int expected_length = 0;
2684 expert_field *truncated_expert = NULL;
2685 bool skip_truncated = false;
2686
2687 /* Used for search entry and unknown tags */
2688 erf_meta_hf_template_t tag_template_unknown = { 0, { "Unknown", "unknown",
2689 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } };
2690 erf_meta_tag_info_t tag_info_local = { 0, 0, &tag_template_unknown, &tag_template_unknown,
2691 ett_erf_meta_tag, hf_erf_meta_tag_unknown, NULL };
2692
2693 int offset = 0;
2694 int sectionoffset = 0;
2695 uint16_t sectionid = 0;
2696 uint16_t sectionlen = 0;
2697 int remaining_len = 0;
2698
2699 int captured_length = (int) tvb_captured_length(tvb);
2700
2701 /* Set column heading title*/
2702 col_set_str(pinfo->cinfo, COL_INFO, "Provenance Metadata");
2703
2704 /* Go through the sections and their tags */
2705 /* Not using tvb_captured_length because want to check for overrun */
2706 while ((remaining_len = captured_length - offset) >= 4) {
2707 tagtype = tvb_get_ntohs(tvb, offset);
2708 taglength = tvb_get_ntohs(tvb, offset + 2);
2709 tag_tree = NULL;
2710 tag_pi = NULL;
2711 truncated_expert = NULL;
2712 skip_truncated = false;
2713
2714 if (ERF_META_IS_SECTION(tagtype))
2715 sectiontype = tagtype;
2716
2717 /* Look up per-section tag hf */
2718 tag_info_local.code = tagtype;
2719 tag_info_local.section = sectiontype;
2720 tag_info = (erf_meta_tag_info_t*) wmem_map_lookup(erf_meta_index.tag_table, GUINT_TO_POINTER(ERF_TAG_INFO_KEY(&tag_info_local)));
2721
2722 /* Fall back to unknown tag */
2723 if (tag_info == NULL)
2724 tag_info = &tag_info_local;
2725
2726 /* Get expected length (minimum length in the case of ns_host_*) */
2727 expected_length = meta_tag_expected_length(tag_info);
2728
2729 if (remaining_len < (int32_t)taglength + 4 || taglength < expected_length) {
2730 /*
2731 * Malformed tag, just dissect type and length. Top level tag
2732 * dissection means can't add the subtree and type/length first.
2733 *
2734 * Allow too-long tags for now (and proto_tree generally generates
2735 * a warning for these anyway).
2736 */
2737 skip_truncated = true;
2738 truncated_expert = &ei_erf_meta_truncated_tag;
2739 }
2740
2741 if (taglength == 0) {
2742 /*
2743 * We highlight zero length differently as a special case to indicate
2744 * a deliberately invalid tag.
2745 */
2746 if (!ERF_META_IS_SECTION(tagtype) && tagtype != ERF_META_TAG_padding) {
2747 truncated_expert = &ei_erf_meta_zero_len_tag;
2748 /* XXX: Still dissect normally too if string/unknown or section header */
2749 if (expected_length != 0) {
2750 skip_truncated = true;
2751 }
2752 }
2753 }
2754
2755 /* Dissect value, length and type */
2756 if (ERF_META_IS_SECTION(tagtype)) { /* Section header tag */
2757 if (section_pi) {
2758 /* Update section item length of last section */
2759 proto_item_set_len(section_pi, offset - sectionoffset);
2760 if (sectionlen_pi) {
2761 check_section_length(pinfo, sectionlen_pi, offset, sectionoffset, sectionlen);
2762 }
2763 }
2764
2765 sectionoffset = offset;
2766 if (tag_info->tag_template == &tag_template_unknown) {
2767 /* Unknown section */
2768 sectiontype = ERF_META_SECTION_UNKNOWN;
2769 tag_info = erf_meta_index.unknown_section_info;
2770 }
2771 DISSECTOR_ASSERT(tag_info->extra);
2772
2773 tagvalstring = val_to_str(tagtype, erf_to_value_string(erf_meta_index.vs_list), "Unknown Section (0x%x)");
2774 col_append_sep_fstr(pinfo->cinfo, COL_INFO, NULL, "%s", tagvalstring);
2775 section_tree = proto_tree_add_subtree(tree, tvb, offset, 0, tag_info->extra->ett_value, &section_pi, tagvalstring);
2776 tag_tree = proto_tree_add_subtree_format(section_tree, tvb, offset, MIN(taglength + 4, remaining_len), tag_info->ett, &tag_pi, "Provenance %s Header", tagvalstring);
2777
2778 /* XXX: Value may have been truncated (avoiding exception so get custom expertinfos) */
2779 if (taglength >= 4 && !skip_truncated) {
2780 sectionid = tvb_get_ntohs(tvb, offset + 4);
2781 sectionlen = tvb_get_ntohs(tvb, offset + 6);
2782
2783 /* Add section_id */
2784 proto_tree_add_uint(tag_tree, tag_info->hf_value, tvb, offset + 4, 2, sectionid);
2785 if (sectionid != 0) {
2786 if(sectionid & 0x8000U) {
2787 /* Local section */
2788 proto_item_append_text(section_pi, " (Local) %u", sectionid & 0x7FFFU);
2789 }
2790 else {
2791 proto_item_append_text(section_pi, " %u", sectionid);
2792 }
2793 }
2794
2795 /* Add section_len */
2796 sectionlen_pi = proto_tree_add_uint(tag_tree, tag_info->extra->hf_values[0], tvb, offset + 6, 2, sectionlen);
2797
2798 /* Reserved extra section header information */
2799 if (taglength > 4) {
2800 proto_tree_add_item(tag_tree, tag_info->extra->hf_values[1], tvb, offset + 8, taglength - 4, ENC_NA);
2801 }
2802 } else if (taglength != 0) {
2803 /* Section Header value is too short */
2804 truncated_expert = &ei_erf_meta_truncated_tag;
2805 }
2806 } else if (!skip_truncated) { /* Not section header tag (and not truncated) */
2807 enum ftenum tag_ft;
2808 char pi_label[ITEM_LABEL_LENGTH+1];
2809 bool dissected = true;
2810 uint32_t value32;
2811 uint64_t value64;
2812 float float_value;
2813 char *tmp = NULL;
2814
2815 tag_ft = tag_info->tag_template->hfinfo.type;
2816 pi_label[0] = '\0';
2817
2818 /* Group tags before first section header into a fake section */
2819 if (offset == 0) {
2820 section_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_erf_meta, &section_pi, "No Section");
2821 }
2822
2823 /* Handle special cases */
2824 /* TODO: might want to do this dynamically via tag_info callback */
2825 switch (tagtype) {
2826 /* TODO: use get_tcp_port in epan/addr_resolv.h etc */
2827 case ERF_META_TAG_if_speed:
2828 case ERF_META_TAG_if_tx_speed:
2829 value64 = tvb_get_ntoh64(tvb, offset + 4);
2830 tmp = format_size((int64_t)value64, FORMAT_SIZE_UNIT_BITS_S, FORMAT_SIZE_PREFIX_SI);
2831 tag_pi = proto_tree_add_uint64_format_value(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, value64, "%s (%" PRIu64 " bps)", tmp, value64);
2832 g_free(tmp);
2833 break;
2834
2835 case ERF_META_TAG_if_rx_power:
2836 case ERF_META_TAG_if_tx_power:
2837 value32 = tvb_get_ntohl(tvb, offset + 4);
2838 tag_pi = proto_tree_add_int_format_value(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, (int32_t) value32, "%.2fdBm", (double)((int32_t) value32)/100.0);
2839 break;
2840
2841 case ERF_META_TAG_temperature:
2842 case ERF_META_TAG_power:
2843 value32 = tvb_get_ntohl(tvb, offset + 4);
2844 float_value = (float)((int32_t) value32)/1000.0f;
2845 tag_pi = proto_tree_add_float(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, float_value);
2846 break;
2847
2848 case ERF_META_TAG_loc_lat:
2849 case ERF_META_TAG_loc_long:
2850 value32 = tvb_get_ntohl(tvb, offset + 4);
2851 tag_pi = proto_tree_add_int_format_value(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, (int32_t) value32, "%.2f", (double)((int32_t) value32)*1000000.0);
2852 break;
2853
2854 case ERF_META_TAG_mask_cidr:
2855 value32 = tvb_get_ntohl(tvb, offset + 4);
2856 tag_pi = proto_tree_add_uint_format_value(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, value32, "/%u", value32);
2857 break;
2858
2859 case ERF_META_TAG_mem:
2860 value64 = tvb_get_ntoh64(tvb, offset + 4);
2861 tmp = format_size((int64_t)value64, FORMAT_SIZE_UNIT_BYTES, FORMAT_SIZE_PREFIX_IEC);
2862 tag_pi = proto_tree_add_uint64_format_value(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, value64, "%s (%" PRIu64" bytes)", tmp, value64);
2863 g_free(tmp);
2864 break;
2865
2866 case ERF_META_TAG_parent_section:
2867 DISSECTOR_ASSERT(tag_info->extra);
2868 value32 = tvb_get_ntohs(tvb, offset + 4);
2869 /*
2870 * XXX: Formatting value manually because don't have erf_meta_vs_list
2871 * populated at registration time.
2872 */
2873 tag_tree = proto_tree_add_subtree_format(section_tree, tvb, offset + 4, taglength, tag_info->ett, &tag_pi, "%s: %s %u", tag_info->tag_template->hfinfo.name,
2874 val_to_str(value32, erf_to_value_string(erf_meta_index.vs_list), "Unknown Section (%u)"), tvb_get_ntohs(tvb, offset + 4 + 2));
2875
2876 proto_tree_add_uint_format_value(tag_tree, tag_info->extra->hf_values[0], tvb, offset + 4, MIN(2, taglength), value32, "%s (%u)",
2877 val_to_str_const(value32, erf_to_value_string(erf_meta_index.vs_abbrev_list), "Unknown"), value32);
2878 proto_tree_add_item(tag_tree, tag_info->extra->hf_values[1], tvb, offset + 6, MIN(2, taglength - 2), ENC_BIG_ENDIAN);
2879 break;
2880
2881 case ERF_META_TAG_reset:
2882 tag_pi = proto_tree_add_item(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, ENC_NA);
2883 expert_add_info(pinfo, tag_pi, &ei_erf_meta_reset);
2884 break;
2885
2886 case ERF_META_TAG_if_link_status:
2887 case ERF_META_TAG_tunneling_mode:
2888 case ERF_META_TAG_ptp_time_properties:
2889 case ERF_META_TAG_ptp_gm_clock_quality:
2890 case ERF_META_TAG_stream_flags:
2891 case ERF_META_TAG_smart_trunc_default:
2892 tag_pi = dissect_meta_tag_bitfield(section_tree, tvb, offset, tag_info, &tag_tree);
2893 break;
2894
2895
2896 case ERF_META_TAG_ns_dns_ipv4:
2897 case ERF_META_TAG_ns_dns_ipv6:
2898 case ERF_META_TAG_ns_host_ipv4:
2899 case ERF_META_TAG_ns_host_ipv6:
2900 case ERF_META_TAG_ns_host_mac:
2901 case ERF_META_TAG_ns_host_eui:
2902 case ERF_META_TAG_ns_host_wwn:
2903 case ERF_META_TAG_ns_host_ib_gid:
2904 case ERF_META_TAG_ns_host_ib_lid:
2905 case ERF_META_TAG_ns_host_fc_id:
2906 {
2907 int addr_len = ftype_wire_size(tag_ft);
2908
2909 DISSECTOR_ASSERT(tag_info->extra);
2910
2911 tag_tree = proto_tree_add_subtree(section_tree, tvb, offset + 4, taglength, tag_info->ett, &tag_pi, tag_info->tag_template->hfinfo.name);
2912 /* Address */
2913 pi = proto_tree_add_item(tag_tree, tag_info->extra->hf_values[0], tvb, offset + 4, MIN(addr_len, taglength), ENC_BIG_ENDIAN);
2914 /* Name */
2915 proto_tree_add_item(tag_tree, tag_info->extra->hf_values[1], tvb, offset + 4 + addr_len, taglength - addr_len, ENC_UTF_8);
2916 if (pi) {
2917 proto_item_fill_label(PITEM_FINFO(pi), pi_label, NULL);
2918 /* Set top level label e.g IPv4 Name: hostname Address: 1.2.3.4 */
2919 /* TODO: Name is unescaped here but escaped in actual field */
2920 proto_item_append_text(tag_pi, ": %s, %s",
2921 tvb_get_stringzpad(pinfo->pool, tvb, offset + 4 + addr_len, taglength - addr_len, ENC_UTF_8), pi_label /* Includes ": " */);
2922 }
2923
2924 break;
2925 }
2926
2927 case ERF_META_TAG_ptp_offset_from_master:
2928 case ERF_META_TAG_ptp_mean_path_delay:
2929 value64 = tvb_get_ntoh64(tvb, offset + 4);
2930 tag_pi = dissect_ptp_timeinterval(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, (int64_t) value64);
2931 break;
2932
2933 case ERF_META_TAG_ptp_current_utc_offset:
2934 {
2935 nstime_t t;
2936
2937 value32 = tvb_get_ntohl(tvb, offset + 4);
2938 /* PTP value is signed */
2939 t.secs = (int32_t) value32;
2940 t.nsecs = 0;
2941
2942 tag_pi = dissect_relative_time(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, &t);
2943 break;
2944 }
2945
2946 case ERF_META_TAG_entropy_threshold:
2947 case ERF_META_TAG_initiator_min_entropy:
2948 case ERF_META_TAG_responder_min_entropy:
2949 case ERF_META_TAG_initiator_avg_entropy:
2950 case ERF_META_TAG_responder_avg_entropy:
2951 case ERF_META_TAG_initiator_max_entropy:
2952 case ERF_META_TAG_responder_max_entropy:
2953 {
2954 float entropy;
2955 value32 = tvb_get_ntohl(tvb, offset + 4);
2956 entropy = entropy_from_entropy_header_value((uint8_t) value32);
2957
2958 tag_pi = proto_tree_add_float_format_value(section_tree, tag_info->hf_value, tvb, 0, 0, entropy,
2959 "%.2f %s", (double) entropy, entropy == 0.0f ? "(not calculated)":"bits");
2960 break;
2961 }
2962
2963 case ERF_META_TAG_ext_hdrs_added:
2964 case ERF_META_TAG_ext_hdrs_removed:
2965 tag_pi = dissect_meta_tag_ext_hdrs(section_tree, tvb, offset, taglength, tag_info, &tag_tree, &truncated_expert);
2966 break;
2967
2968 default:
2969 dissected = false;
2970 break;
2971 }
2972
2973 /* If not special case, dissect generically from template */
2974 if (!dissected) {
2975 if (FT_IS_INT(tag_ft) || FT_IS_UINT(tag_ft)) {
2976 tag_pi = proto_tree_add_item(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, ENC_BIG_ENDIAN);
2977 } else if (FT_IS_STRING(tag_ft)) {
2978 tag_pi = proto_tree_add_item(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, ENC_UTF_8);
2979 } else if (FT_IS_TIME(tag_ft)) {
2980 /*
2981 * ERF timestamps are conveniently the same as NTP/PTP timestamps but
2982 * little endian.
2983 */
2984 /*
2985 * FIXME: ENC_TIME_NTP | ENC_LITTLE_ENDIAN only swaps the
2986 * upper and lower 32 bits. Is that a bug or by design? Should add
2987 * a 'PTP" variant that doesn't round to microseconds and use that
2988 * here. For now do by hand.
2989 */
2990 nstime_t t;
2991 uint64_t ts;
2992
2993 ts = tvb_get_letoh64(tvb, offset + 4);
2994 erf_ts_to_nstime(ts, &t, tag_ft == FT_RELATIVE_TIME);
2995
2996 tag_pi = dissect_relative_time(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, &t);
2997 } else {
2998 tag_pi = proto_tree_add_item(section_tree, tag_info->hf_value, tvb, offset + 4, taglength, ENC_NA);
2999 }
3000 }
3001 }
3002
3003 /* Create subtree for tag if we haven't already */
3004 if (!tag_tree) {
3005 /* Make sure we actually put the subtree in the right place */
3006 if (tag_pi || !tree) {
3007 tag_tree = proto_item_add_subtree(tag_pi, tag_info->ett);
3008 } else {
3009 /* Truncated or error (avoiding exception so get custom expertinfos) */
3010 tag_tree = proto_tree_add_subtree_format(section_tree, tvb, offset, MIN(taglength + 4, remaining_len), tag_info->ett, &tag_pi, "%s: [Invalid]", tag_info->tag_template->hfinfo.name);
3011 }
3012 }
3013
3014 /* Add tag type field to subtree */
3015 /*
3016 * XXX: Formatting value manually because don't have erf_meta_vs_list
3017 * populated at registration time.
3018 */
3019 proto_tree_add_uint_format_value(tag_tree, hf_erf_meta_tag_type, tvb, offset, 2, tagtype, "%s (%u)", val_to_str_const(tagtype, erf_to_value_string(erf_meta_index.vs_abbrev_list), "Unknown"), tagtype);
3020 proto_tree_add_uint(tag_tree, hf_erf_meta_tag_len, tvb, offset + 2, 2, taglength);
3021
3022 /* Add truncated expertinfo if needed */
3023 if (truncated_expert) {
3024 expert_add_info(pinfo, tag_pi, truncated_expert);
3025 }
3026
3027 offset += (((uint32_t)taglength + 4) + 0x3U) & ~0x3U;
3028 }
3029
3030 if (remaining_len != 0) {
3031 /* Record itself is truncated */
3032 expert_add_info(pinfo, proto_tree_get_parent(tree), &ei_erf_meta_truncated_record);
3033 /* Continue to setting sectionlen error */
3034 }
3035
3036 /* Check final section length */
3037 proto_item_set_len(section_pi, offset - sectionoffset);
3038 check_section_length(pinfo, sectionlen_pi, offset, sectionoffset, sectionlen);
3039 }
3040
3041 static int
3042 dissect_erf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
3043 {
3044 uint8_t flags;
3045 uint8_t erf_type;
3046 uint32_t atm_hdr = 0;
3047 proto_tree *erf_tree;
3048 proto_item *erf_item;
3049 erf_hdlc_type_vals hdlc_type;
3050 uint8_t first_byte;
3051 tvbuff_t *new_tvb;
3052 uint8_t aal2_cid;
3053 struct atm_phdr atm_info;
3054
3055 erf_type=pinfo->pseudo_header->erf.phdr.type & 0x7F;
3056
3057 col_set_str(pinfo->cinfo, COL_PROTOCOL, "ERF");
3058
3059 col_add_str(pinfo->cinfo, COL_INFO,
3060 val_to_str(erf_type, erf_type_vals, "Unknown type %u"));
3061
3062 erf_item = proto_tree_add_item(tree, proto_erf, tvb, 0, -1, ENC_NA);
3063 erf_tree = proto_item_add_subtree(erf_item, ett_erf);
3064
3065 dissect_erf_pseudo_header(tvb, pinfo, erf_tree);
3066 if (pinfo->pseudo_header->erf.phdr.type & 0x80) {
3067 dissect_erf_pseudo_extension_header(tvb, pinfo, erf_tree);
3068 }
3069
3070 flags = pinfo->pseudo_header->erf.phdr.flags;
3071 /*
3072 * Set if frame is Received or Sent.
3073 * XXX - this is really testing the low-order bit of the capture
3074 * interface number, so interface 0 is assumed to be capturing
3075 * in one direction on a bi-directional link, interface 1 is
3076 * assumed to be capturing in the other direction on that link,
3077 * and interfaces 2 and 3 are assumed to be capturing in two
3078 * different directions on another link. We don't distinguish
3079 * between the two links.
3080 */
3081 pinfo->p2p_dir = ( (flags & 0x01) ? P2P_DIR_RECV : P2P_DIR_SENT);
3082
3083 switch (erf_type) {
3084
3085 case ERF_TYPE_RAW_LINK:
3086 if(sdh_handle) {
3087 call_dissector(sdh_handle, tvb, pinfo, tree);
3088 }
3089 else{
3090 call_data_dissector(tvb, pinfo, tree);
3091 }
3092 break;
3093
3094 case ERF_TYPE_ETH:
3095 case ERF_TYPE_COLOR_ETH:
3096 case ERF_TYPE_DSM_COLOR_ETH:
3097 case ERF_TYPE_COLOR_HASH_ETH:
3098 dissect_eth_header(tvb, pinfo, erf_tree);
3099 /* fall through */
3100 case ERF_TYPE_IPV4:
3101 case ERF_TYPE_IPV6:
3102 case ERF_TYPE_INFINIBAND:
3103 case ERF_TYPE_INFINIBAND_LINK:
3104 case ERF_TYPE_OPA_SNC:
3105 case ERF_TYPE_OPA_9B:
3106 if (!dissector_try_uint(erf_dissector_table, erf_type, tvb, pinfo, tree)) {
3107 call_data_dissector(tvb, pinfo, tree);
3108 }
3109 break;
3110
3111 case ERF_TYPE_LEGACY:
3112 case ERF_TYPE_IP_COUNTER:
3113 case ERF_TYPE_TCP_FLOW_COUNTER:
3114 /* undefined */
3115 break;
3116
3117 case ERF_TYPE_PAD:
3118 /* Nothing to do */
3119 break;
3120
3121 case ERF_TYPE_MC_RAW:
3122 dissect_mc_raw_header(tvb, pinfo, erf_tree);
3123 call_data_dissector(tvb, pinfo, tree);
3124 break;
3125
3126 case ERF_TYPE_MC_RAW_CHANNEL:
3127 dissect_mc_rawlink_header(tvb, pinfo, erf_tree);
3128 call_data_dissector(tvb, pinfo, tree);
3129 break;
3130
3131 case ERF_TYPE_MC_ATM:
3132 dissect_mc_atm_header(tvb, pinfo, erf_tree);
3133 /* continue with type ATM */
3134 /* FALL THROUGH */
3135
3136 case ERF_TYPE_ATM:
3137 memset(&atm_info, 0, sizeof(atm_info));
3138 atm_hdr = tvb_get_ntohl(tvb, 0);
3139 atm_info.vpi = ((atm_hdr & 0x0ff00000) >> 20);
3140 atm_info.vci = ((atm_hdr & 0x000ffff0) >> 4);
3141 atm_info.channel = (flags & 0x03);
3142
3143 /* Work around to have decoding working */
3144 if (erf_rawcell_first) {
3145 new_tvb = tvb_new_subset_remaining(tvb, ATM_HDR_LENGTH);
3146 /* Treat this as a (short) ATM AAL5 PDU */
3147 atm_info.aal = AAL_5;
3148 switch (erf_aal5_type) {
3149
3150 case ERF_AAL5_GUESS:
3151 atm_info.type = TRAF_UNKNOWN;
3152 atm_info.subtype = TRAF_ST_UNKNOWN;
3153 /* Try to guess the type according to the first bytes */
3154 erf_atm_guess_traffic_type(new_tvb, 0, tvb_captured_length(new_tvb), &atm_info);
3155 break;
3156
3157 case ERF_AAL5_LLC:
3158 atm_info.type = TRAF_LLCMX;
3159 atm_info.subtype = TRAF_ST_UNKNOWN;
3160 break;
3161
3162 case ERF_AAL5_UNSPEC:
3163 atm_info.aal = AAL_5;
3164 atm_info.type = TRAF_UNKNOWN;
3165 atm_info.subtype = TRAF_ST_UNKNOWN;
3166 break;
3167 }
3168
3169 call_dissector_with_data(atm_untruncated_handle, new_tvb, pinfo, tree,
3170 &atm_info);
3171 } else {
3172 /* Treat this as a raw cell */
3173 atm_info.flags |= ATM_RAW_CELL;
3174 atm_info.flags |= ATM_NO_HEC;
3175 atm_info.aal = AAL_UNKNOWN;
3176 /* can call atm_untruncated because we set ATM_RAW_CELL flag */
3177 call_dissector_with_data(atm_untruncated_handle, tvb, pinfo, tree,
3178 &atm_info);
3179 }
3180 break;
3181
3182 case ERF_TYPE_MC_AAL5:
3183 dissect_mc_aal5_header(tvb, pinfo, erf_tree);
3184 /* continue with type AAL5 */
3185 /* FALL THROUGH */
3186
3187 case ERF_TYPE_AAL5:
3188 atm_hdr = tvb_get_ntohl(tvb, 0);
3189 memset(&atm_info, 0, sizeof(atm_info));
3190 atm_info.vpi = ((atm_hdr & 0x0ff00000) >> 20);
3191 atm_info.vci = ((atm_hdr & 0x000ffff0) >> 4);
3192 atm_info.channel = (flags & 0x03);
3193
3194 new_tvb = tvb_new_subset_remaining(tvb, ATM_HDR_LENGTH);
3195 /* Work around to have decoding working */
3196 atm_info.aal = AAL_5;
3197 switch (erf_aal5_type) {
3198
3199 case ERF_AAL5_GUESS:
3200 atm_info.type = TRAF_UNKNOWN;
3201 atm_info.subtype = TRAF_ST_UNKNOWN;
3202 /* Try to guess the type according to the first bytes */
3203 erf_atm_guess_traffic_type(new_tvb, 0, tvb_captured_length(new_tvb), &atm_info);
3204 break;
3205
3206 case ERF_AAL5_LLC:
3207 atm_info.type = TRAF_LLCMX;
3208 atm_info.subtype = TRAF_ST_UNKNOWN;
3209 break;
3210
3211 case ERF_AAL5_UNSPEC:
3212 atm_info.aal = AAL_5;
3213 atm_info.type = TRAF_UNKNOWN;
3214 atm_info.subtype = TRAF_ST_UNKNOWN;
3215 break;
3216 }
3217
3218 call_dissector_with_data(atm_untruncated_handle, new_tvb, pinfo, tree,
3219 &atm_info);
3220 break;
3221
3222 case ERF_TYPE_MC_AAL2:
3223 dissect_mc_aal2_header(tvb, pinfo, erf_tree);
3224
3225 /*
3226 * Most of the information is in the ATM header; fetch it.
3227 */
3228 atm_hdr = tvb_get_ntohl(tvb, 0);
3229
3230 /*
3231 * The channel identification number is in the MC header, so it's
3232 * in the pseudo-header, not in the packet data.
3233 */
3234 aal2_cid = (pinfo->pseudo_header->erf.subhdr.mc_hdr & MC_AAL2_CID_MASK) >> MC_AAL2_CID_SHIFT;
3235
3236 /* Zero out and fill in the ATM pseudo-header. */
3237 memset(&atm_info, 0, sizeof(atm_info));
3238 atm_info.aal = AAL_2;
3239 atm_info.flags |= ATM_AAL2_NOPHDR;
3240 atm_info.vpi = ((atm_hdr & 0x0ff00000) >> 20);
3241 atm_info.vci = ((atm_hdr & 0x000ffff0) >> 4);
3242 atm_info.channel = (flags & 0x03);
3243 atm_info.aal2_cid = aal2_cid;
3244 atm_info.type = TRAF_UNKNOWN;
3245 atm_info.subtype = TRAF_ST_UNKNOWN;
3246
3247 /* remove ATM cell header from tvb */
3248 new_tvb = tvb_new_subset_remaining(tvb, ATM_HDR_LENGTH);
3249 call_dissector_with_data(atm_untruncated_handle, new_tvb, pinfo, tree,
3250 &atm_info);
3251 break;
3252
3253 case ERF_TYPE_AAL2:
3254 dissect_aal2_header(tvb, pinfo, erf_tree);
3255
3256 /*
3257 * Most of the information is in the ATM header; fetch it.
3258 */
3259 atm_hdr = tvb_get_ntohl(tvb, 0);
3260
3261 /*
3262 * The channel identification number is in the AAL2 header, so it's
3263 * in the pseudo-header, not in the packet data.
3264 */
3265 aal2_cid = (pinfo->pseudo_header->erf.subhdr.aal2_hdr & AAL2_CID_MASK) >> AAL2_CID_SHIFT;
3266
3267 /* Zero out and fill in the ATM pseudo-header. */
3268 memset(&atm_info, 0, sizeof(atm_info));
3269 atm_info.aal = AAL_2;
3270 atm_info.flags |= ATM_AAL2_NOPHDR;
3271 atm_info.vpi = ((atm_hdr & 0x0ff00000) >> 20);
3272 atm_info.vci = ((atm_hdr & 0x000ffff0) >> 4);
3273 atm_info.channel = (flags & 0x03);
3274 atm_info.aal2_cid = aal2_cid;
3275 atm_info.type = TRAF_UNKNOWN;
3276 atm_info.subtype = TRAF_ST_UNKNOWN;
3277
3278 /* remove ATM cell header from tvb */
3279 new_tvb = tvb_new_subset_remaining(tvb, ATM_HDR_LENGTH);
3280 call_dissector_with_data(atm_untruncated_handle, new_tvb, pinfo, tree,
3281 &atm_info);
3282 break;
3283
3284 case ERF_TYPE_MC_HDLC:
3285 dissect_mc_hdlc_header(tvb, pinfo, erf_tree);
3286 /* continue with type HDLC */
3287 /* FALL THROUGH */
3288
3289 case ERF_TYPE_HDLC_POS:
3290 case ERF_TYPE_COLOR_HDLC_POS:
3291 case ERF_TYPE_DSM_COLOR_HDLC_POS:
3292 case ERF_TYPE_COLOR_MC_HDLC_POS:
3293 case ERF_TYPE_COLOR_HASH_POS:
3294 hdlc_type = (erf_hdlc_type_vals)erf_hdlc_type;
3295
3296 if (hdlc_type == ERF_HDLC_GUESS) {
3297 /* Try to guess the type. */
3298 first_byte = tvb_get_uint8(tvb, 0);
3299 if (first_byte == 0x0f || first_byte == 0x8f)
3300 hdlc_type = ERF_HDLC_CHDLC;
3301 else {
3302 /* Anything to check for to recognize Frame Relay or MTP2?
3303 Should we require PPP packets to begin with FF 03? */
3304 hdlc_type = ERF_HDLC_PPP;
3305 }
3306 }
3307 /* Clean the pseudo header (if used in subdissector) and call the
3308 appropriate subdissector. */
3309 switch (hdlc_type) {
3310 case ERF_HDLC_CHDLC:
3311 call_dissector(chdlc_handle, tvb, pinfo, tree);
3312 break;
3313 case ERF_HDLC_PPP:
3314 call_dissector(ppp_handle, tvb, pinfo, tree);
3315 break;
3316 case ERF_HDLC_FRELAY:
3317 memset(&pinfo->pseudo_header->dte_dce, 0, sizeof(pinfo->pseudo_header->dte_dce));
3318 call_dissector(frelay_handle, tvb, pinfo, tree);
3319 break;
3320 case ERF_HDLC_MTP2:
3321 /* not used, but .. */
3322 memset(&pinfo->pseudo_header->mtp2, 0, sizeof(pinfo->pseudo_header->mtp2));
3323 call_dissector(mtp2_handle, tvb, pinfo, tree);
3324 break;
3325 default:
3326 break;
3327 }
3328 break;
3329
3330 case ERF_TYPE_META:
3331 dissect_meta_record_tags(tvb, pinfo, erf_tree);
3332 break;
3333
3334 default:
3335 call_data_dissector(tvb, pinfo, tree);
3336 break;
3337 } /* erf type */
3338 return tvb_captured_length(tvb);
3339 }
3340
3341 static void erf_init_dissection(void)
3342 {
3343 erf_state.implicit_host_id = 0;
3344 erf_state.source_map = wmem_map_new(wmem_file_scope(), wmem_int64_hash, g_int64_equal);
3345 erf_state.host_anchor_map = wmem_map_new(wmem_file_scope(), erf_anchor_key_hash, erf_anchor_key_equal);
3346 /* Old map is freed automatically */
3347 }
3348
3349 void
3350 proto_register_erf(void)
3351 {
3352
3353 static hf_register_info hf[] = {
3354 /* ERF Header */
3355 { &hf_erf_ts,
3356 { "Timestamp", "erf.ts",
3357 FT_UINT64, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3358 { &hf_erf_rectype,
3359 { "Record type", "erf.types",
3360 FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3361 { &hf_erf_type,
3362 { "Type", "erf.types.type",
3363 FT_UINT8, BASE_DEC, VALS(erf_type_vals), ERF_HDR_TYPE_MASK, NULL, HFILL } },
3364 { &hf_erf_ehdr,
3365 { "Extension header present", "erf.types.ext_header",
3366 FT_UINT8, BASE_DEC, NULL, ERF_HDR_EHDR_MASK, NULL, HFILL } },
3367 { &hf_erf_flags,
3368 { "Flags", "erf.flags",
3369 FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3370 { &hf_erf_flags_cap,
3371 { "Capture interface", "erf.flags.cap",
3372 FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3373 { &hf_erf_flags_if_raw,
3374 { "Raw interface", "erf.flags.if_raw",
3375 FT_UINT8, BASE_HEX, NULL, ERF_HDR_CAP_MASK, NULL, HFILL } },
3376 { &hf_erf_flags_vlen,
3377 { "Varying record length", "erf.flags.vlen",
3378 FT_UINT8, BASE_DEC, NULL, ERF_HDR_VLEN_MASK, NULL, HFILL } },
3379 { &hf_erf_flags_trunc,
3380 { "Truncated", "erf.flags.trunc",
3381 FT_UINT8, BASE_DEC, NULL, ERF_HDR_TRUNC_MASK, NULL, HFILL } },
3382 { &hf_erf_flags_rxe,
3383 { "RX error", "erf.flags.rxe",
3384 FT_UINT8, BASE_DEC, NULL, ERF_HDR_RXE_MASK, NULL, HFILL } },
3385 { &hf_erf_flags_dse,
3386 { "DS error", "erf.flags.dse",
3387 FT_UINT8, BASE_DEC, NULL, ERF_HDR_DSE_MASK, NULL, HFILL } },
3388 { &hf_erf_flags_res,
3389 { "Reserved", "erf.flags.res",
3390 FT_UINT8, BASE_DEC, NULL, ERF_HDR_RES_MASK, NULL, HFILL } },
3391 { &hf_erf_rlen,
3392 { "Record length", "erf.rlen",
3393 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3394 { &hf_erf_lctr,
3395 { "Loss counter", "erf.lctr",
3396 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3397 { &hf_erf_color,
3398 { "Color", "erf.color",
3399 FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3400 { &hf_erf_wlen,
3401 { "Wire length", "erf.wlen",
3402 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3403 { &hf_erf_ehdr_t,
3404 { "Extension Header", "erf.ehdr.types",
3405 FT_UINT8, BASE_DEC, VALS(ehdr_type_vals), 0x0, NULL, HFILL } },
3406
3407 /* Intercept ID Extension Header */
3408 { &hf_erf_ehdr_int_res1,
3409 { "Reserved", "erf.ehdr.int.res1",
3410 FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3411 { &hf_erf_ehdr_int_id,
3412 { "Intercept ID", "erf.ehdr.int.intid",
3413 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3414 { &hf_erf_ehdr_int_res2,
3415 { "Reserved", "erf.ehdr.int.res2",
3416 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3417
3418 /* Raw Link Extension Header */
3419 { &hf_erf_ehdr_raw_link_res,
3420 { "Reserved", "erf.ehdr.raw.res",
3421 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3422 { &hf_erf_ehdr_raw_link_seqnum,
3423 { "Sequence number", "erf.ehdr.raw.seqnum",
3424 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3425 { &hf_erf_ehdr_raw_link_rate,
3426 { "Rate", "erf.ehdr.raw.rate",
3427 FT_UINT8, BASE_DEC, VALS(raw_link_rates), 0x0, NULL, HFILL } },
3428 { &hf_erf_ehdr_raw_link_type,
3429 { "Link Type", "erf.ehdr.raw.link_type",
3430 FT_UINT8, BASE_DEC, VALS(raw_link_types), 0x0, NULL, HFILL } },
3431
3432 /* Classification Extension Header */
3433 { &hf_erf_ehdr_class_flags,
3434 { "Flags", "erf.ehdr.class.flags",
3435 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3436 { &hf_erf_ehdr_class_flags_sh,
3437 { "Search hit", "erf.ehdr.class.flags.sh",
3438 FT_UINT32, BASE_DEC, NULL, EHDR_CLASS_SH_MASK, NULL, HFILL } },
3439 { &hf_erf_ehdr_class_flags_shm,
3440 { "Multiple search hits", "erf.ehdr.class.flags.shm",
3441 FT_UINT32, BASE_DEC, NULL, EHDR_CLASS_SHM_MASK, NULL, HFILL } },
3442 { &hf_erf_ehdr_class_flags_res1,
3443 { "Reserved", "erf.ehdr.class.flags.res1",
3444 FT_UINT32, BASE_HEX, NULL, EHDR_CLASS_RES1_MASK, NULL, HFILL } },
3445 { &hf_erf_ehdr_class_flags_user,
3446 { "User classification", "erf.ehdr.class.flags.user",
3447 FT_UINT32, BASE_DEC, NULL, EHDR_CLASS_USER_MASK, NULL, HFILL } },
3448 { &hf_erf_ehdr_class_flags_res2,
3449 { "Reserved", "erf.ehdr.class.flags.res2",
3450 FT_UINT32, BASE_HEX, NULL, EHDR_CLASS_RES2_MASK, NULL, HFILL } },
3451 { &hf_erf_ehdr_class_flags_drop,
3452 { "Drop Steering Bit", "erf.ehdr.class.flags.drop",
3453 FT_UINT32, BASE_DEC, NULL, EHDR_CLASS_DROP_MASK, NULL, HFILL } },
3454 { &hf_erf_ehdr_class_flags_str,
3455 { "Stream Steering Bits", "erf.ehdr.class.flags.str",
3456 FT_UINT32, BASE_DEC, NULL, EHDR_CLASS_STER_MASK, NULL, HFILL } },
3457 { &hf_erf_ehdr_class_seqnum,
3458 { "Sequence number", "erf.ehdr.class.seqnum",
3459 FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3460
3461 /* BFS Extension Header */
3462 { &hf_erf_ehdr_bfs_hash,
3463 { "Hash", "erf.ehdr.bfs.hash",
3464 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL } },
3465 { &hf_erf_ehdr_bfs_color,
3466 { "Filter Color", "erf.ehdr.bfs.color",
3467 FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL } },
3468 { &hf_erf_ehdr_bfs_raw_hash,
3469 { "Raw Hash", "erf.ehdr.bfs.rawhash",
3470 FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } },
3471
3472 /* Channelised Extension Header */
3473 { &hf_erf_ehdr_chan_morebits,
3474 { "More Bits", "erf.ehdr.chan.morebits",
3475 FT_BOOLEAN, BASE_NONE, NULL, 0, NULL, HFILL } },
3476 { &hf_erf_ehdr_chan_morefrag,
3477 { "More Fragments", "erf.ehdr.chan.morefrag",
3478 FT_BOOLEAN, BASE_NONE, NULL, 0, NULL, HFILL } },
3479 { &hf_erf_ehdr_chan_seqnum,
3480 { "Sequence Number", "erf.ehdr.chan.seqnum",
3481 FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } },
3482 { &hf_erf_ehdr_chan_res,
3483 { "Reserved", "erf.ehdr.chan.res",
3484 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL } },
3485 { &hf_erf_ehdr_chan_virt_container_id,
3486 { "Virtual Container ID", "erf.ehdr.chan.vcid",
3487 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL } },
3488 { &hf_erf_ehdr_chan_assoc_virt_container_size,
3489 { "Associated Virtual Container Size", "erf.ehdr.chan.vcsize",
3490 FT_UINT8, BASE_HEX, VALS(channelised_assoc_virt_container_size), 0, NULL, HFILL } },
3491 { &hf_erf_ehdr_chan_rate,
3492 { "Origin Line Type/Rate", "erf.ehdr.chan.rate",
3493 FT_UINT8, BASE_HEX, VALS(channelised_rate), 0, NULL, HFILL } },
3494 { &hf_erf_ehdr_chan_type,
3495 { "Frame Part Type", "erf.ehdr.chan.type",
3496 FT_UINT8, BASE_HEX, VALS(channelised_type), 0, NULL, HFILL } },
3497
3498 /* Signature Extension Header */
3499 { &hf_erf_ehdr_signature_payload_hash,
3500 { "Payload Hash", "erf.ehdr.signature.payloadhash",
3501 FT_UINT24, BASE_HEX, NULL, 0, NULL, HFILL } },
3502 { &hf_erf_ehdr_signature_color,
3503 { "Filter Color", "erf.ehdr.signature.color",
3504 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL } },
3505 { &hf_erf_ehdr_signature_flow_hash,
3506 { "Flow Hash", "erf.ehdr.signature.flowhash",
3507 FT_UINT24, BASE_HEX, NULL, 0, NULL, HFILL } },
3508
3509 /* Flow ID Extension Header */
3510 { &hf_erf_ehdr_flow_id_source_id,
3511 { "Source ID", "erf.ehdr.flowid.sourceid",
3512 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } },
3513 { &hf_erf_ehdr_flow_id_hash_type,
3514 { "Hash Type", "erf.ehdr.flowid.hashtype",
3515 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL } },
3516 { &hf_erf_ehdr_flow_id_hash_type_type,
3517 { "Type", "erf.ehdr.flowid.hashtype.type",
3518 FT_UINT8, BASE_DEC, VALS(erf_hash_type), ERF_EHDR_FLOW_ID_HASH_TYPE_TYPE_MASK, NULL, HFILL } },
3519 { &hf_erf_ehdr_flow_id_hash_type_inner,
3520 { "Hash is for Tunnel Inner", "erf.ehdr.flowid.hashtype.inner",
3521 FT_UINT8, BASE_DEC, NULL, ERF_EHDR_FLOW_ID_HASH_TYPE_INNER_MASK, NULL, HFILL } },
3522 { &hf_erf_ehdr_flow_id_stack_type,
3523 { "Stack Type", "erf.ehdr.flowid.stacktype",
3524 FT_UINT8, BASE_HEX, VALS(erf_stack_type), 0, NULL, HFILL } },
3525 { &hf_erf_ehdr_flow_id_flow_hash,
3526 { "Flow Hash", "erf.ehdr.flowid.flowhash",
3527 FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } },
3528
3529 /* Host ID Extension Header */
3530 { &hf_erf_ehdr_host_id_sourceid,
3531 { "Source ID", "erf.ehdr.hostid.sourceid",
3532 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } },
3533 { &hf_erf_ehdr_host_id_hostid,
3534 { "Host ID", "erf.ehdr.hostid.hostid",
3535 FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL } },
3536
3537 /* Anchor ID Extension Header */
3538 { &hf_erf_ehdr_anchor_id_flags,
3539 { "Flags", "erf.ehdr.anchorid.flags",
3540 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL} },
3541 { &hf_erf_ehdr_anchor_id_definition,
3542 { "Anchor Definition", "erf.ehdr.anchorid.flags.definition",
3543 FT_BOOLEAN, 8 /*bits in bitfield*/, NULL, 0x80, NULL, HFILL} },
3544 { &hf_erf_ehdr_anchor_id_reserved,
3545 { "Reserved", "erf.ehdr.anchorid.flags.rsvd",
3546 FT_UINT8, BASE_HEX, NULL, 0x7f, NULL, HFILL} },
3547 { &hf_erf_ehdr_anchor_id_anchorid,
3548 { "Anchor ID", "erf.ehdr.anchorid.anchorid",
3549 FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL} },
3550
3551 /* Generated fields for navigating Host ID/Anchor ID */
3552 { &hf_erf_anchor_linked,
3553 {"Linked Frame", "erf.anchor.frame",
3554 FT_FRAMENUM, BASE_NONE, NULL, 0, NULL, HFILL} },
3555 { &hf_erf_anchor_anchorid,
3556 { "Anchor ID", "erf.anchor.anchorid",
3557 FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL } },
3558 { &hf_erf_anchor_hostid,
3559 { "Host ID", "erf.anchor.hostid",
3560 FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL } },
3561
3562 /* Generated fields for navigating Host ID/Source ID */
3563 { &hf_erf_sourceid,
3564 { "Source ID", "erf.sourceid",
3565 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } },
3566 { &hf_erf_hostid,
3567 { "Host ID", "erf.hostid",
3568 FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL } },
3569 { &hf_erf_source_current,
3570 { "Next Metadata in Source", "erf.source_meta_frame_current",
3571 FT_FRAMENUM, BASE_NONE, NULL, 0, NULL, HFILL } },
3572 { &hf_erf_source_next,
3573 { "Next Metadata in Source", "erf.source_meta_frame_next",
3574 FT_FRAMENUM, BASE_NONE, NULL, 0, NULL, HFILL } },
3575 { &hf_erf_source_prev,
3576 { "Previous Metadata in Source", "erf.source_meta_frame_prev",
3577 FT_FRAMENUM, BASE_NONE, NULL, 0, NULL, HFILL } },
3578
3579 /* Entropy Extension Header */
3580 { &hf_erf_ehdr_entropy_entropy,
3581 { "Entropy", "erf.ehdr.entropy.entropy",
3582 FT_FLOAT, BASE_NONE, NULL, 0, NULL, HFILL} },
3583 { &hf_erf_ehdr_entropy_entropy_raw,
3584 { "Raw Entropy", "erf.ehdr.entropy.entropy.raw",
3585 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL} },
3586 { &hf_erf_ehdr_entropy_reserved,
3587 { "Reserved", "erf.ehdr.entropy.rsvd",
3588 FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL} },
3589
3590 /* Unknown Extension Header */
3591 { &hf_erf_ehdr_unk,
3592 { "Data", "erf.ehdr.unknown.data",
3593 FT_UINT64, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3594
3595 /* MC HDLC Header */
3596 { &hf_erf_mc_hdlc,
3597 { "Multi Channel HDLC Header", "erf.mchdlc",
3598 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3599 { &hf_erf_mc_hdlc_cn,
3600 { "Connection number", "erf.mchdlc.cn",
3601 FT_UINT32, BASE_DEC, NULL, MC_HDLC_CN_MASK, NULL, HFILL } },
3602 { &hf_erf_mc_hdlc_res1,
3603 { "Reserved", "erf.mchdlc.res1",
3604 FT_UINT32, BASE_HEX, NULL, MC_HDLC_RES1_MASK, NULL, HFILL } },
3605 { &hf_erf_mc_hdlc_res2,
3606 { "Reserved", "erf.mchdlc.res2",
3607 FT_UINT32, BASE_HEX, NULL, MC_HDLC_RES2_MASK, NULL, HFILL } },
3608 { &hf_erf_mc_hdlc_fcse,
3609 { "FCS error", "erf.mchdlc.fcse",
3610 FT_UINT32, BASE_DEC, NULL, MC_HDLC_FCSE_MASK, NULL, HFILL } },
3611 { &hf_erf_mc_hdlc_sre,
3612 { "Short record error", "erf.mchdlc.sre",
3613 FT_UINT32, BASE_DEC, NULL, MC_HDLC_SRE_MASK, NULL, HFILL } },
3614 { &hf_erf_mc_hdlc_lre,
3615 { "Long record error", "erf.mchdlc.lre",
3616 FT_UINT32, BASE_DEC, NULL, MC_HDLC_LRE_MASK, NULL, HFILL } },
3617 { &hf_erf_mc_hdlc_afe,
3618 { "Aborted frame error", "erf.mchdlc.afe",
3619 FT_UINT32, BASE_DEC, NULL, MC_HDLC_AFE_MASK, NULL, HFILL } },
3620 { &hf_erf_mc_hdlc_oe,
3621 { "Octet error", "erf.mchdlc.oe",
3622 FT_UINT32, BASE_DEC, NULL, MC_HDLC_OE_MASK, NULL, HFILL } },
3623 { &hf_erf_mc_hdlc_lbe,
3624 { "Lost byte error", "erf.mchdlc.lbe",
3625 FT_UINT32, BASE_DEC, NULL, MC_HDLC_LBE_MASK, NULL, HFILL } },
3626 { &hf_erf_mc_hdlc_first,
3627 { "First record", "erf.mchdlc.first",
3628 FT_UINT32, BASE_DEC, NULL, MC_HDLC_FIRST_MASK, NULL, HFILL } },
3629 { &hf_erf_mc_hdlc_res3,
3630 { "Reserved", "erf.mchdlc.res3",
3631 FT_UINT32, BASE_HEX, NULL, MC_HDLC_RES3_MASK, NULL, HFILL } },
3632
3633 /* MC RAW Header */
3634 { &hf_erf_mc_raw,
3635 { "Multi Channel RAW Header", "erf.mcraw",
3636 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3637 { &hf_erf_mc_raw_int,
3638 { "Physical interface", "erf.mcraw.int",
3639 FT_UINT32, BASE_DEC, NULL, MC_RAW_INT_MASK, NULL, HFILL } },
3640 { &hf_erf_mc_raw_res1,
3641 { "Reserved", "erf.mcraw.res1",
3642 FT_UINT32, BASE_HEX, NULL, MC_RAW_RES1_MASK, NULL, HFILL } },
3643 { &hf_erf_mc_raw_sre,
3644 { "Short record error", "erf.mcraw.sre",
3645 FT_UINT32, BASE_DEC, NULL, MC_RAW_SRE_MASK, NULL, HFILL } },
3646 { &hf_erf_mc_raw_lre,
3647 { "Long record error", "erf.mcraw.lre",
3648 FT_UINT32, BASE_DEC, NULL, MC_RAW_LRE_MASK, NULL, HFILL } },
3649 { &hf_erf_mc_raw_res2,
3650 { "Reserved", "erf.mcraw.res2",
3651 FT_UINT32, BASE_HEX, NULL, MC_RAW_RES2_MASK, NULL, HFILL } },
3652 { &hf_erf_mc_raw_lbe,
3653 { "Lost byte error", "erf.mcraw.lbe",
3654 FT_UINT32, BASE_DEC, NULL, MC_RAW_LBE_MASK, NULL, HFILL } },
3655 { &hf_erf_mc_raw_first,
3656 { "First record", "erf.mcraw.first",
3657 FT_UINT32, BASE_DEC, NULL, MC_RAW_FIRST_MASK, NULL, HFILL } },
3658 { &hf_erf_mc_raw_res3,
3659 { "Reserved", "erf.mcraw.res3",
3660 FT_UINT32, BASE_HEX, NULL, MC_RAW_RES3_MASK, NULL, HFILL } },
3661
3662 /* MC ATM Header */
3663 { &hf_erf_mc_atm,
3664 { "Multi Channel ATM Header", "erf.mcatm",
3665 FT_UINT32, BASE_HEX, NULL, 0x00, NULL, HFILL } },
3666 { &hf_erf_mc_atm_cn,
3667 { "Connection number", "erf.mcatm.cn",
3668 FT_UINT32, BASE_DEC, NULL, MC_ATM_CN_MASK, NULL, HFILL } },
3669 { &hf_erf_mc_atm_res1,
3670 { "Reserved", "erf.mcatm.res1",
3671 FT_UINT32, BASE_HEX, NULL, MC_ATM_RES1_MASK, NULL, HFILL } },
3672 { &hf_erf_mc_atm_mul,
3673 { "Multiplexed", "erf.mcatm.mul",
3674 FT_UINT32, BASE_DEC, NULL, MC_ATM_MUL_MASK, NULL, HFILL } },
3675 { &hf_erf_mc_atm_port,
3676 { "Physical port", "erf.mcatm.port",
3677 FT_UINT32, BASE_DEC, NULL, MC_ATM_PORT_MASK, NULL, HFILL } },
3678 { &hf_erf_mc_atm_res2,
3679 { "Reserved", "erf.mcatm.res2",
3680 FT_UINT32, BASE_HEX, NULL, MC_ATM_RES2_MASK, NULL, HFILL } },
3681 { &hf_erf_mc_atm_lbe,
3682 { "Lost Byte Error", "erf.mcatm.lbe",
3683 FT_UINT32, BASE_DEC, NULL, MC_ATM_LBE_MASK, NULL, HFILL } },
3684 { &hf_erf_mc_atm_hec,
3685 { "HEC corrected", "erf.mcatm.hec",
3686 FT_UINT32, BASE_DEC, NULL, MC_ATM_HEC_MASK, NULL, HFILL } },
3687 { &hf_erf_mc_atm_crc10,
3688 { "OAM Cell CRC10 Error (not implemented)", "erf.mcatm.crc10",
3689 FT_UINT32, BASE_DEC, NULL, MC_ATM_CRC10_MASK, NULL, HFILL } },
3690 { &hf_erf_mc_atm_oamcell,
3691 { "OAM Cell", "erf.mcatm.oamcell",
3692 FT_UINT32, BASE_DEC, NULL, MC_ATM_OAMCELL_MASK, NULL, HFILL } },
3693 { &hf_erf_mc_atm_first,
3694 { "First record", "erf.mcatm.first",
3695 FT_UINT32, BASE_DEC, NULL, MC_ATM_FIRST_MASK, NULL, HFILL } },
3696 { &hf_erf_mc_atm_res3,
3697 { "Reserved", "erf.mcatm.res3",
3698 FT_UINT32, BASE_HEX, NULL, MC_ATM_RES3_MASK, NULL, HFILL } },
3699
3700 /* MC RAW Link Header */
3701 { &hf_erf_mc_rawl,
3702 { "Multi Channel RAW Link Header", "erf.mcrawl",
3703 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3704 { &hf_erf_mc_rawl_cn,
3705 { "Connection number", "erf.mcrawl.cn",
3706 FT_UINT32, BASE_DEC, NULL, MC_RAWL_CN_MASK, NULL, HFILL } },
3707 { &hf_erf_mc_rawl_res1,
3708 { "Reserved", "erf.mcrawl.res1",
3709 FT_UINT32, BASE_HEX, NULL, MC_RAWL_RES2_MASK, NULL, HFILL } },
3710 { &hf_erf_mc_rawl_lbe,
3711 { "Lost byte error", "erf.mcrawl.lbe",
3712 FT_UINT32, BASE_DEC, NULL, MC_RAWL_LBE_MASK, NULL, HFILL } },
3713 { &hf_erf_mc_rawl_first,
3714 { "First record", "erf.mcrawl.first",
3715 FT_UINT32, BASE_DEC, NULL, MC_RAWL_FIRST_MASK, NULL, HFILL } },
3716 { &hf_erf_mc_rawl_res2,
3717 { "Reserved", "erf.mcrawl.res2",
3718 FT_UINT32, BASE_HEX, NULL, MC_RAWL_RES2_MASK, NULL, HFILL } },
3719
3720 /* MC AAL5 Header */
3721 { &hf_erf_mc_aal5,
3722 { "Multi Channel AAL5 Header", "erf.mcaal5",
3723 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3724 { &hf_erf_mc_aal5_cn,
3725 { "Connection number", "erf.mcaal5.cn",
3726 FT_UINT32, BASE_DEC, NULL, MC_AAL5_CN_MASK, NULL, HFILL } },
3727 { &hf_erf_mc_aal5_res1,
3728 { "Reserved", "erf.mcaal5.res1",
3729 FT_UINT32, BASE_HEX, NULL, MC_AAL5_RES1_MASK, NULL, HFILL } },
3730 { &hf_erf_mc_aal5_port,
3731 { "Physical port", "erf.mcaal5.port",
3732 FT_UINT32, BASE_DEC, NULL, MC_AAL5_PORT_MASK, NULL, HFILL } },
3733 { &hf_erf_mc_aal5_crcck,
3734 { "CRC checked", "erf.mcaal5.crcck",
3735 FT_UINT32, BASE_DEC, NULL, MC_AAL5_CRCCK_MASK, NULL, HFILL } },
3736 { &hf_erf_mc_aal5_crce,
3737 { "CRC error", "erf.mcaal5.crce",
3738 FT_UINT32, BASE_DEC, NULL, MC_AAL5_CRCE_MASK, NULL, HFILL } },
3739 { &hf_erf_mc_aal5_lenck,
3740 { "Length checked", "erf.mcaal5.lenck",
3741 FT_UINT32, BASE_DEC, NULL, MC_AAL5_LENCK_MASK, NULL, HFILL } },
3742 { &hf_erf_mc_aal5_lene,
3743 { "Length error", "erf.mcaal5.lene",
3744 FT_UINT32, BASE_DEC, NULL, MC_AAL5_LENE_MASK, NULL, HFILL } },
3745 { &hf_erf_mc_aal5_res2,
3746 { "Reserved", "erf.mcaal5.res2",
3747 FT_UINT32, BASE_HEX, NULL, MC_AAL5_RES2_MASK, NULL, HFILL } },
3748 { &hf_erf_mc_aal5_first,
3749 { "First record", "erf.mcaal5.first",
3750 FT_UINT32, BASE_DEC, NULL, MC_AAL5_FIRST_MASK, NULL, HFILL } },
3751 { &hf_erf_mc_aal5_res3,
3752 { "Reserved", "erf.mcaal5.res3",
3753 FT_UINT32, BASE_HEX, NULL, MC_AAL5_RES3_MASK, NULL, HFILL } },
3754
3755 /* MC AAL2 Header */
3756 { &hf_erf_mc_aal2,
3757 { "Multi Channel AAL2 Header", "erf.mcaal2",
3758 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3759 { &hf_erf_mc_aal2_cn,
3760 { "Connection number", "erf.mcaal2.cn",
3761 FT_UINT32, BASE_DEC, NULL, MC_AAL2_CN_MASK, NULL, HFILL } },
3762 { &hf_erf_mc_aal2_res1,
3763 { "Reserved for extra connection", "erf.mcaal2.res1",
3764 FT_UINT32, BASE_HEX, NULL, MC_AAL2_RES1_MASK, NULL, HFILL } },
3765 { &hf_erf_mc_aal2_res2,
3766 { "Reserved for type", "erf.mcaal2.mul",
3767 FT_UINT32, BASE_HEX, NULL, MC_AAL2_RES2_MASK, NULL, HFILL } },
3768 { &hf_erf_mc_aal2_port,
3769 { "Physical port", "erf.mcaal2.port",
3770 FT_UINT32, BASE_DEC, NULL, MC_AAL2_PORT_MASK, NULL, HFILL } },
3771 { &hf_erf_mc_aal2_res3,
3772 { "Reserved", "erf.mcaal2.res2",
3773 FT_UINT32, BASE_HEX, NULL, MC_AAL2_RES3_MASK, NULL, HFILL } },
3774 { &hf_erf_mc_aal2_first,
3775 { "First cell received", "erf.mcaal2.lbe",
3776 FT_UINT32, BASE_DEC, NULL, MC_AAL2_FIRST_MASK, NULL, HFILL } },
3777 { &hf_erf_mc_aal2_maale,
3778 { "MAAL error", "erf.mcaal2.hec",
3779 FT_UINT32, BASE_DEC, NULL, MC_AAL2_MAALE_MASK, NULL, HFILL } },
3780 { &hf_erf_mc_aal2_lene,
3781 { "Length error", "erf.mcaal2.crc10",
3782 FT_UINT32, BASE_DEC, NULL, MC_AAL2_LENE_MASK, NULL, HFILL } },
3783 { &hf_erf_mc_aal2_cid,
3784 { "Channel Identification Number", "erf.mcaal2.cid",
3785 FT_UINT32, BASE_DEC, NULL, MC_AAL2_CID_MASK, NULL, HFILL } },
3786
3787 /* AAL2 Header */
3788 { &hf_erf_aal2,
3789 { "AAL2 Header", "erf.aal2",
3790 FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3791 { &hf_erf_aal2_cid,
3792 { "Channel Identification Number", "erf.aal2.cid",
3793 FT_UINT32, BASE_DEC, NULL, AAL2_CID_MASK, NULL, HFILL } },
3794 { &hf_erf_aal2_maale,
3795 { "MAAL error number", "erf.aal2.maale",
3796 FT_UINT32, BASE_DEC, NULL, AAL2_MAALE_MASK, NULL, HFILL } },
3797 { &hf_erf_aal2_maalei,
3798 { "MAAL error", "erf.aal2.hec",
3799 FT_UINT32, BASE_DEC, NULL, AAL2_MAALEI_MASK, NULL, HFILL } },
3800 { &hf_erf_aal2_first,
3801 { "First cell received", "erf.aal2.lbe",
3802 FT_UINT32, BASE_DEC, NULL, AAL2_FIRST_MASK, NULL, HFILL } },
3803 { &hf_erf_aal2_res1,
3804 { "Reserved", "erf.aal2.res1",
3805 FT_UINT32, BASE_HEX, NULL, AAL2_RES1_MASK, NULL, HFILL } },
3806
3807 /* ETH Header */
3808 { &hf_erf_eth,
3809 { "Ethernet pad", "erf.eth",
3810 FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } },
3811 { &hf_erf_eth_off,
3812 { "Offset", "erf.eth.off",
3813 FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3814 { &hf_erf_eth_pad,
3815 { "Padding", "erf.eth.pad",
3816 FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } },
3817
3818 /* Provenance record unknown tags */
3819 { &hf_erf_meta_tag_type,
3820 { "Tag Type", "erf.meta.tag.type",
3821 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3822 { &hf_erf_meta_tag_len,
3823 { "Tag Length", "erf.meta.tag.len",
3824 FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
3825 { &hf_erf_meta_tag_unknown,
3826 { "Unknown Tag", "erf.meta.unknown",
3827 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } }
3828 };
3829
3830 static int *ett[] = {
3831 &ett_erf,
3832 &ett_erf_pseudo_hdr,
3833 &ett_erf_rectype,
3834 &ett_erf_hash_type,
3835 &ett_erf_flags,
3836 &ett_erf_mc_hdlc,
3837 &ett_erf_mc_raw,
3838 &ett_erf_mc_atm,
3839 &ett_erf_mc_rawlink,
3840 &ett_erf_mc_aal5,
3841 &ett_erf_mc_aal2,
3842 &ett_erf_aal2,
3843 &ett_erf_eth,
3844 &ett_erf_meta,
3845 &ett_erf_meta_tag,
3846 &ett_erf_source,
3847 &ett_erf_anchor,
3848 &ett_erf_anchor_flags,
3849 &ett_erf_entropy_value
3850 };
3851
3852 static const enum_val_t erf_hdlc_options[] = {
3853 { "chdlc", "Cisco HDLC", ERF_HDLC_CHDLC },
3854 { "ppp", "PPP serial", ERF_HDLC_PPP },
3855 { "frelay", "Frame Relay", ERF_HDLC_FRELAY },
3856 { "mtp2", "SS7 MTP2", ERF_HDLC_MTP2 },
3857 { "guess", "Attempt to guess", ERF_HDLC_GUESS },
3858 { NULL, NULL, 0 }
3859 };
3860
3861 static const enum_val_t erf_aal5_options[] = {
3862 { "guess", "Attempt to guess", ERF_AAL5_GUESS },
3863 { "llc", "LLC multiplexed", ERF_AAL5_LLC },
3864 { "unspec", "Unspecified", ERF_AAL5_UNSPEC },
3865 { NULL, NULL, 0 }
3866 };
3867
3868 static ei_register_info ei[] = {
3869 { &ei_erf_mc_hdlc_checksum_error, { "erf.mchdlc.checksum.error", PI_CHECKSUM, PI_ERROR, "ERF MC HDLC FCS Error", EXPFILL }},
3870 { &ei_erf_mc_hdlc_short_error, { "erf.mchdlc.short.error", PI_RECEIVE, PI_ERROR, "ERF MC HDLC Short Record Error, <5 bytes", EXPFILL }},
3871 { &ei_erf_mc_hdlc_long_error, { "erf.mchdlc.long.error", PI_RECEIVE, PI_ERROR, "ERF MC HDLC Long Record Error, >2047 bytes", EXPFILL }},
3872 { &ei_erf_mc_hdlc_abort_error, { "erf.mchdlc.abort.error", PI_RECEIVE, PI_ERROR, "ERF MC HDLC Aborted Frame Error", EXPFILL }},
3873 { &ei_erf_mc_hdlc_octet_error, { "erf.mchdlc.octet.error", PI_RECEIVE, PI_ERROR, "ERF MC HDLC Octet Error, the closing flag was not octet aligned after bit unstuffing", EXPFILL }},
3874 { &ei_erf_mc_hdlc_lost_byte_error, { "erf.mchdlc.lost_byte.error", PI_RECEIVE, PI_ERROR, "ERF MC HDLC Lost Byte Error", EXPFILL }},
3875 { &ei_erf_rx_error, { "erf.rx.error", PI_INTERFACE, PI_ERROR, "ERF RX Error", EXPFILL }},
3876 { &ei_erf_ds_error, { "erf.ds.error", PI_INTERFACE, PI_ERROR, "ERF DS Error", EXPFILL }},
3877 { &ei_erf_truncation_error, { "erf.truncation.error", PI_INTERFACE, PI_ERROR, "ERF Truncation Error", EXPFILL }},
3878 { &ei_erf_packet_loss, { "erf.packet_loss", PI_INTERFACE, PI_WARN, "Packet loss occurred between previous and current packet", EXPFILL }},
3879 { &ei_erf_extension_headers_not_shown, { "erf.ehdr.more_not_shown", PI_INTERFACE, PI_WARN, "More extension headers were present, not shown", EXPFILL }},
3880 { &ei_erf_meta_section_len_error, { "erf.meta.section_len.error", PI_PROTOCOL, PI_ERROR, "Provenance Section Length incorrect", EXPFILL }},
3881 { &ei_erf_meta_truncated_record, { "erf.meta.truncated_record", PI_MALFORMED, PI_ERROR, "Provenance truncated record", EXPFILL }},
3882 { &ei_erf_meta_truncated_tag, { "erf.meta.truncated_tag", PI_PROTOCOL, PI_ERROR, "Provenance truncated tag", EXPFILL }},
3883 { &ei_erf_meta_zero_len_tag, { "erf.meta.zero_len_tag", PI_PROTOCOL, PI_NOTE, "Provenance zero length tag", EXPFILL }},
3884 { &ei_erf_meta_reset, { "erf.meta.metadata_reset", PI_PROTOCOL, PI_WARN, "Provenance metadata reset", EXPFILL }}
3885 };
3886
3887 module_t *erf_module;
3888 expert_module_t* expert_erf;
3889
3890 proto_erf = proto_register_protocol("Extensible Record Format", "ERF", "erf");
3891 erf_handle = register_dissector("erf", dissect_erf, proto_erf);
3892
3893 init_meta_tags();
3894
3895 proto_register_field_array(proto_erf, hf, array_length(hf));
3896 proto_register_subtree_array(ett, array_length(ett));
3897 expert_erf = expert_register_protocol(proto_erf);
3898 expert_register_field_array(expert_erf, ei, array_length(ei));
3899
3900 /* Register per-section Provenance fields */
3901 proto_register_field_array(proto_erf, (hf_register_info*) wmem_array_get_raw(erf_meta_index.hfri), (int) wmem_array_get_count(erf_meta_index.hfri));
3902 proto_register_subtree_array((int**) wmem_array_get_raw(erf_meta_index.ett), (int) wmem_array_get_count(erf_meta_index.ett));
3903
3904 erf_module = prefs_register_protocol(proto_erf, NULL);
3905
3906 prefs_register_enum_preference(erf_module, "hdlc_type", "ERF_HDLC Layer 2",
3907 "Protocol encapsulated in HDLC records",
3908 &erf_hdlc_type, erf_hdlc_options, false);
3909
3910 prefs_register_bool_preference(erf_module, "rawcell_first",
3911 "Raw ATM cells are first cell of AAL5 PDU",
3912 "Whether raw ATM cells should be treated as "
3913 "the first cell of an AAL5 PDU",
3914 &erf_rawcell_first);
3915
3916 prefs_register_enum_preference(erf_module, "aal5_type",
3917 "ATM AAL5 packet type",
3918 "Protocol encapsulated in ATM AAL5 packets",
3919 &erf_aal5_type, erf_aal5_options, false);
3920
3921 /*
3922 * We just use eth_maybefcs now and respect the Ethernet preference.
3923 * ERF records usually have FCS.
3924 */
3925 prefs_register_obsolete_preference(erf_module, "ethfcs");
3926
3927 erf_dissector_table = register_dissector_table("erf.types.type", "ERF Type", proto_erf, FT_UINT8, BASE_DEC);
3928
3929 register_init_routine(erf_init_dissection);
3930 /* No extra cleanup needed */
3931 }
3932
3933 void
3934 proto_reg_handoff_erf(void)
3935 {
3936 int file_type_subtype_erf;
3937
3938 dissector_add_uint("wtap_encap", WTAP_ENCAP_ERF, erf_handle);
3939 /* Also register dissector for Provenance non-packet records */
3940 file_type_subtype_erf = wtap_name_to_file_type_subtype("erf");
3941 if (file_type_subtype_erf != -1)
3942 dissector_add_uint("wtap_fts_rec", file_type_subtype_erf, erf_handle);
3943
3944 /* Get handles for serial line protocols */
3945 chdlc_handle = find_dissector_add_dependency("chdlc", proto_erf);
3946 ppp_handle = find_dissector_add_dependency("ppp_hdlc", proto_erf);
3947 frelay_handle = find_dissector_add_dependency("fr", proto_erf);
3948 mtp2_handle = find_dissector_add_dependency("mtp2_with_crc", proto_erf);
3949
3950 /* Get handle for ATM dissector */
3951 atm_untruncated_handle = find_dissector_add_dependency("atm_untruncated", proto_erf);
3952
3953 sdh_handle = find_dissector_add_dependency("sdh", proto_erf);
3954 }
3955
3956 /*
3957 * Editor modelines - https://www.wireshark.org/tools/modelines.html
3958 *
3959 * Local Variables:
3960 * c-basic-offset: 2
3961 * tab-width: 8
3962 * indent-tabs-mode: nil
3963 * End:
3964 *
3965 * ex: set shiftwidth=2 tabstop=8 expandtab:
3966 * :indentSize=2:tabSize=8:noTabs=true:
3967 */
Metzes wireshark repo