| blob | b34ef8480fd74cf021f08a0ae89a598879a658f3 |
1 /* packet-f5ethtrailer.c
2 *
3 * F5 Ethernet Trailer Copyright 2008-2018 F5 Networks
4 *
5 * SPDX-License-Identifier: GPL-2.0-or-later
6 */
8 /*
9 Supported Platforms:
10 BIG-IP 9.4.2 - 13.x for the old format trailers
11 BIG-IP 11.2.0 and later for fileinfo
12 BIG-IP 14.0 began using the new format trailers
14 Usage:
16 * Acquire capture files using the following command line:
17 * tcpdump -w capture.pcap -s0 -i internal:nnn
18 * Load the capture file into wireshark.
20 * Observe the grammar added to the beginning of each packet in the "Info"
21 column of the packet list pane.
22 * Observe the added "F5 Ethernet trailer" section in the packet detail
23 pane.
24 * These fields are filterable like any other field.
25 * Review the preferences for the dissector.
27 * If you are missing the Low details of the trailer for some packets, try
28 modifying the settings for the Ethernet dissector. Go to "Edit/Preferences...",
29 expand "Protocols" on the left and select "Ethernet". Disable "Assume
30 short frames which include a trailer contain padding".
32 Notes:
34 Follow F5 Conversation:
36 As an alternative to the Populate Fields for Other Dissectors below, you
37 can now follow a connection through the BIG-IP using the main menu
38 Analyze/Conversation Filter menu. There are three options: follow "F5 IP",
39 "F5 TCP" or "F5 UDP". Select a frame and choose the appropriate menu item.
40 For best results, disable Populate Fields for Other Dissectors. This
41 method of following a conversation should avoid the stray packets problem
42 mentioned below.
44 These menu selections will populate an appropriate filter expression with
45 ip.addr, tcp.port or udp.port, f5ethtrailer.peeraddr, f5ethtrailer.peerport
46 and f5ethtrailer.peeripproto.
48 You will need to have gathered the capture with high noise (":nnn") to
49 contain the peer flow information in order for this to work.
51 Populate Fields for Other Dissectors:
53 The populate fields for other dissectors will add hidden fields to the
54 f5ethtrailer for "ip.addr", "ipv6.addr", "tcp.port" and "udp.port" based on
55 information in high noise of a packet. This will allow the "Conversation
56 Filter" option in Wireshark to find both the client-side and server-side
57 flows for a connection.
59 In order to use this, you will need to enable the "Populate fields for
60 other dissectors" preference. Note that the fields are registered when the
61 preference is enabled. After changing the preference, you may need to
62 restart Wireshark for proper handling.
64 Please note that this may cause some stray packets to show up in filter
65 results since, for example, "tcp.port eq A and tcp.port eq B" can now be
66 matching on at least four fields (tcp.port from the TCP dissector and
67 tcp.port from the f5ethtrailer dissector) and a filter can match on an
68 address/port from the IP/TCP/UDP dissector or an address/port from the
69 f5ethtrailer dissector.
71 For example, given two connections:
72 client:12345 <-> VIP:443 {BIGIP} clientS:12346 <-> poolmember:80
73 client:12346 <-> VIP:443 {BIGIP} clientS:12347 <-> poolmember:80
74 Selecting "Conversation Filter->TCP" on the client side of the second
75 connection will result in a filter of:
76 ip.addr eq client and ip.addr eq VIP and
77 tcp.port eq 12346 and tcp.port eq 443
78 All four flows would be displayed by the filter:
79 * From client:12345 <-> VIP:443 (unexpected)
80 - ip.addr from ip.src matches.
81 - ip.addr from ip.dst matches.
82 - tcp.port from f5ethtrailer.peerlocalport matches.
83 - tcp.port from tcp.dstport matches.
84 * From clientS:12346 <-> poolmember:80 (unexpected)
85 - ip.addr from f5ethtrailer.peerremoteaddr matches.
86 - ip.addr from f5ethtrailer.peerlocaladdr matches.
87 - tcp.port from tcp.srcport matches.
88 - tcp.port from f5ethtrailer.peerlocalport matches.
89 * From client:12346 <-> VIP:443 (expected)
90 - ip.addr from ip.src matches.
91 - ip.addr from ip.dst matches.
92 - tcp.port from tcp.srcport matches.
93 - tcp.port from tcp.dstport matches.
94 * From clientS:12347 <-> poolmember:80 (desired)
95 - ip.addr from f5ethtrailer.peerremoteaddr matches.
96 - ip.addr from f5ethtrailer.peerlocaladdr matches.
97 - tcp.port from f5ethtrailer.peerremoteport matches.
98 - tcp.port from f5ethtrailer.peerlocalport matches.
100 You can filter based on IP/port information by disabling the "Populate
101 fields for other dissectors" and creating your own filter like:
102 ( ip.addr eq client and ip.addr eq VIP and
103 tcp.port eq 12346 and tcp.port eq 443 ) or
104 ( f5ethtrailer.peeraddr eq client and f5ethtrailer.peeraddr eq VIP and
105 f5ethtrailer.peerport eq 12346 and f5ethtrailer.peerport eq 443 )
107 Since the preference is disabled by default, it should not cause any
108 interference unless the user actively enables the preference.
110 Analysis:
112 The f5ethtrailer dissector can add an "F5 Analysis" subtree to the "F5
113 Ethernet trailer" protocol tree. The items added here are also added to
114 Wireshark expert info. The analysis done is intended to help spot traffic
115 anomalies.
117 Possible Analysis:
118 * Flow reuse or SYN retransmit
119 Filter field name: f5ethtrailer.analysis.flowreuse
120 This is intended to highlight initial packets that arrive that match
121 a pre-existing flow. In other words, a TCP SYN packet that arrives
122 and matches an existing flow. This can indicate:
123 - A prior flow was not properly terminated and a new flow is starting.
124 - A stray SYN has arrived for an existing connection.
125 - A SYN has been retransmitted (the first SYN would have created the
126 flow that subsequent SYNs would match).
128 * Flow lost, incorrect VLAN, loose initiation, tunnel or SYN cookie use
129 Filter field name: f5ethtrailer.analysis.flowlost
130 This is intended to highlight non-initial packets that arrive that
131 do not match an existing flow. In other words, a TCP non-SYN packet
132 arriving that does not match an existing flow. This can indicate:
133 - The flow is no longer in the BIGIP's connection table.
134 - VLAN keyed connections is in use (the default) and a packet arrived
135 on an incorrect VLAN.
136 - A stray packet has arrived.
137 - The packet may be handled by a virtual server with loose initiation.
138 In this case, a packet in the middle of a TCP conversation could
139 arrive and then be handled by a virtual server that has loose
140 initiation enabled to create a flow.
141 - The packet may be the inner payload of a tunnel. For inbound tunnel
142 traffic, the encapsulating packet is shown as well as the
143 encapsulated packet (and the encapsulated packet may not have flow
144 information).
145 - SYN cookies are being used (the initial SYN would not have created
146 a flow).
148 A few notes. The analysis is implemented by using Wireshark taps and
149 tapping the IP/IPv6/TCP dissectors. The taps are not called until after
150 packet dissection is completely finished. So, the f5ethtrailer dissector
151 may not have the necessary data to draw conclusions. The traffic light
152 in the lower left corner of the Wireshark GUI might not properly reflect
153 the existence of these analysis fields.
155 Hiding Slot Information in Info Column:
157 You can now specify which platforms will display slot information in the
158 summary in the info columns. In the preferences for the F5 Ethernet
159 trailer dissector, you can provide a regular expression to match the
160 platform in F5 tcpdump header packet. If there is no platform information
161 in the header (or there is no header at all), slot information will always
162 be displayed. A reasonable regular expression would be "^(A.*|Z101)$" to
163 match chassis and vCMP platforms (there is no distinction for vCMP on a
164 chassis versus an appliance). The default is to always display slot
165 information (no regular expression is provided by default).
167 Statistics reports:
169 All statistics are reported as packet counts and byte counts. Byte count
170 statistics do not include the bytes of the trailer.
172 Statistics menu now has:
173 F5/Virtual Server Distribution
174 A line for each named virtual server name
175 A line for traffic with a flow ID and no virtual server name
176 A line for traffic without a flow ID.
178 F5/tmm Distribution
179 A line for each tmm.
180 A line each for ingress and egress (should add to tmm total)
181 A line each for (should add to tmm total)
182 Traffic with a virtual server name
183 Traffic with a flow ID and no virtual server name
184 Traffic without a flow ID.
185 */
189 #include <string.h>
190 #include <epan/packet.h>
191 #include <epan/prefs.h>
192 #include <epan/epan_dissect.h>
193 #include <epan/ipproto.h>
194 #include <epan/tap.h>
195 #include <epan/expert.h>
196 #include <epan/proto.h>
197 #include <epan/proto_data.h>
198 #include <epan/conversation_filter.h>
199 #include <epan/tfs.h>
203 #include <epan/to_str.h>
204 #include <epan/stats_tree.h>
205 #define F5FILEINFOTAP_SRC
207 #undef F5FILEINFOTAP_SRC
208 #include <wsutil/wslog.h>
210 /* Wireshark ID of the F5ETHTRAILER protocol */
215 /** Helper dissector for DPT format noise */
228 /* Common Fields */
238 /* Low */
255 /* Med */
273 /* High */
290 /* Analysis */
293 /* These fields will be used if pref_pop_other_fields is enabled.
294 They will be populated with data from the "high" trailer so that filtering on ip.addr, tcp.port, etc...
295 can find peer side flows of the specific flow you're searching for. */
310 /* These are the ids of the subtrees that we may be creating */
321 /* For fileinformation */
330 /* Wireshark preference to show RST cause in info column */
332 /** Wireshark preference to look at all trailer bytes for f5ethtrailer */
334 /* Wireshark preference to enable/disable the population of other dissectors'
335 * fields.*/
337 /** Wireshark preference to perform analysis */
339 /** Wireshark preference to generate keylog entries from f5ethtrailer TLS data */
341 /** Identifiers for taps (when enabled), only the address is important, the
342 * values are unused. */
347 /** Used "in" and "out" map for the true and false for ingress. (Not actually
348 * used in field definition, but rather used to display via a format call
349 * and in the info column information.) */
356 };
358 /** Strings for decoding the hardware action */
365 };
370 NULL,
371 };
374 NONE,
375 NEW_FORMAT,
376 OLD_FORMAT,
379 /** Table containing subdissectors for different providers
380 * These are used with new format trailers */
384 /*-----------------------------------------------------------------------------------------------*/
385 /**
386 * @brief Convert a Wireshark port type to a IP protocol number.
387 *
388 * @attention Not all port types are supported, only the ones that this dissector actively uses.
389 *
390 * @param ptype The Wireshark port_type
391 * @return The IP protocol number corresponding to the port type.
392 */
395 {
407 }
411 /*===============================================================================================*/
412 /* Analyze menu functions */
414 /*-----------------------------------------------------------------------------------------------*/
415 /**
416 * @brief Determines if we can apply an IP Conversation filter.
417 *
418 * @attention This is an interface function to be called from the rest of wireshark.
419 *
420 * @param pinfo A pointer to the packet info to look at for the L3 data.
421 * @return True if it is valid IP/IPv6, false otherwise
422 */
423 static bool
425 {
435 /*-----------------------------------------------------------------------------------------------*/
436 /**
437 * @brief Determines if we can apply a TCP Conversation filter.
438 *
439 * @attention This is an interface function to be called from the rest of wireshark.
440 *
441 * @param pinfo A pointer to the packet info to look at for the L3/L4 data.
442 * @return True if it is valid IP/IPv6 + TCP, false otherwise
443 */
444 static bool
446 {
457 /*-----------------------------------------------------------------------------------------------*/
458 /**
459 * @brief Determines if we can apply a UDP Conversation filter.
460 *
461 * @attention This is an interface function to be called from the rest of wireshark.
462 *
463 * @param pinfo A pointer to the packet info to look at for the L3/L4 data.
464 * @return True if it is valid IP/IPv6 + UDP, false otherwise
465 */
466 static bool
468 {
479 /*-----------------------------------------------------------------------------------------------*/
480 /**
481 * @brief Calculates the F5 IP conversation filter based on the current packet.
482 *
483 * @attention This is an interface function to be called from the rest of wireshark.
484 *
485 * @param pinfo A pointer to the packet info to look at for the L3/L4 data.
486 * @return A filter string for the F5 IP conversation or NULL if no filter can be
487 * computed. The caller should free this string with g_free().
488 *
489 * @attention This function uses ws_strdup_printf() rather than the wmem equivalent because the
490 * caller (menu_dissector_filter_cb()) uses g_free to free the filter string.
491 * (as of WS 1.12).
492 */
495 {
506 "(ip.addr eq %s and ip.addr eq %s) or"
509 }
515 "(ipv6.addr eq %s and ipv6.addr eq %s) or"
518 }
519 }
523 /*-----------------------------------------------------------------------------------------------*/
524 /**
525 * @brief Calculates the F5 TCP conversation filter based on the current packet.
526 *
527 * @attention This is an interface function to be called from the rest of wireshark.
528 *
529 * @param pinfo A pointer to the packet info to look at for the L3/L4 data.
530 *
531 * @return A filter string for the F5 TCP conversation or NULL if no filter can be
532 * computed. The caller should free this string with g_free().
533 *
534 * Prior to version 11.0.0, the f5ethtrailer.peeripproto field was not populated properly. In
535 * an effort to accurately match the appropriate protocol, the filter adds:
536 * f5ethtrailer.ipproto eq 6 (for the >=11.0.0 case)
537 * or f5ethtrailer.ipproto eq 0 and tcp (for the <11.0.0 case)
538 * This is in an attempt to try to not pick up UDP packets that happen to have the same ports when
539 * you are filtering on a TCP conversation. Note that in the <11.0.0 case, an IP protocol change
540 * across the peer flows (I don't know that I've seen that happen, so it's at least rare) will not
541 * be filtered properly. In the >=11.0.0 case, if you have TCP on one side and UDP on the other
542 * and it should "do the right thing".
543 *
544 * @attention This function uses ws_strdup_printf() rather than the wmem equivalent because the
545 * caller (menu_dissector_filter_cb()) uses g_free to free the filter string.
546 * (as of WS 1.12).
547 */
550 {
561 "(ip.addr eq %s and ip.addr eq %s and tcp.port eq %d and tcp.port eq %d) or"
562 " (f5ethtrailer.peeraddr eq %s and f5ethtrailer.peeraddr eq %s and"
563 " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"
567 }
573 "(ipv6.addr eq %s and ipv6.addr eq %s and tcp.port eq %d and tcp.port eq %d) or"
574 " (f5ethtrailer.peeraddr6 eq %s and f5ethtrailer.peeraddr6 eq %s and"
575 " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"
579 }
580 }
584 /*-----------------------------------------------------------------------------------------------*/
585 /**
586 * @brief Calculates the F5 UDP conversation filter based on the current packet.
587 *
588 * @attention This is an interface function to be called from the rest of wireshark.
589 *
590 * @param pinfo A pointer to the packet info to look at for the L3/L4 data.
591 * @return A filter string for the F5 UDP conversation or NULL if no filter can be
592 * computed. The caller should free this string with g_free().
593 *
594 * Prior to version 11.0.0, the f5ethtrailer.peeripproto field was not populated properly. In
595 * an effort to accurately match the appropriate protocol, the filter adds:
596 * f5ethtrailer.ipproto eq 17 (for the >=11.0.0 case)
597 * or f5ethtrailer.ipproto eq 0 and udp (for the <11.0.0 case)
598 * This is in an attempt to try to not pick up TCP packets that happen to have the same ports when
599 * you are filtering on a UDP conversation. Note that in the <11.0.0 case, an IP protocol change
600 * across the peer flows (I don't know that I've seen that happen, so it's at least rare) will not
601 * be filtered properly. In the >=11.0.0 case, if you have TCP on one side and UDP on the other
602 * and it should "do the right thing".
603 *
604 * @attention This function uses ws_strdup_printf() rather than the wmem equivalent because the
605 * caller (menu_dissector_filter_cb()) uses g_free to free the filter string.
606 * (as of WS 1.12).
607 */
610 {
621 "(ip.addr eq %s and ip.addr eq %s and udp.port eq %d and udp.port eq %d) or"
622 " (f5ethtrailer.peeraddr eq %s and f5ethtrailer.peeraddr eq %s and"
623 " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"
627 }
633 "(ipv6.addr eq %s and ipv6.addr eq %s and udp.port eq %d and udp.port eq %d) or"
634 " (f5ethtrailer.peeraddr6 eq %s and f5ethtrailer.peeraddr6 eq %s and"
635 " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"
639 }
640 }
644 /* End of Analyze menu functions */
645 /*===============================================================================================*/
647 /*===============================================================================================*/
648 /* Stats tree functions */
663 static const char *st_str_virtdist = "F5" STATS_TREE_MENU_SEPARATOR "Virtual Server Distribution";
665 static const char *st_str_virtdist_bytes = "Virtual Server Byte Distribution (excludes trailer)";
669 /*-----------------------------------------------------------------------------------------------*/
670 /**
671 * @brief Initializer for tmm distribution statistics
672 *
673 * @attention This is an interface function to be called from the rest of wireshark.
674 *
675 * @param st A pointer to the stats tree to use
676 *
677 */
678 static void
680 {
688 /*-----------------------------------------------------------------------------------------------*/
689 /**
690 * @brief Per-packet tmm distribution statistics
691 *
692 * @attention This is an interface function to be called from the rest of wireshark.
693 *
694 * @param st A pointer to the stats tree to use
695 * @param pinfo A pointer to the packet info.
696 * @param edt Unused
697 * @param data A pointer to the data provided by the tap
698 * @return TAP_PACKET_REDRAW if the data was actually used to alter
699 * the statistics, TAP_PACKET_DONT_REDRAW otherwise.
700 *
701 */
702 static tap_packet_status
704 stats_tree *st, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)
705 {
717 /* Unnecessary since this tap packet function and the F5 Ethernet trailer dissector are both in
718 * the same source file. If you are using this function as an example in a separate tap source
719 * file, you should uncomment this.
720 if(check_f5eth_tap_magic(tdata) == 0) return TAP_PACKET_DONT_REDRAW;
721 */
732 st_node_tmm_bytes =
737 /* Create nodes in case we see no egress packets */
743 /* Create nodes in case we see no ingress packets */
746 }
750 /* No flow ID and no virtual name */
754 /* Create nodes in case we see no packets without a virtual */
758 /* Flow ID and no virtual name */
762 /* Create nodes in case we see no packets with a virtual */
765 }
766 /* Create nodes in case we see no packets with a virtual */
770 /* Has a virtual name */
774 /* Create nodes in case we see no packets without a virtual */
777 /* Create nodes in case we see no packets without a flow */
780 }
785 /*-----------------------------------------------------------------------------------------------*/
786 /**
787 * @brief Initialize Virtual Server stats tree
788 *
789 * @param st A pointer to the stats tree to use
790 */
791 static void
793 {
809 /*-----------------------------------------------------------------------------------------------*/
810 /**
811 * @brief Per-packet Virtual Server distribution statistics
812 *
813 * @param st A pointer to the stats tree to use
814 * @param pinfo A pointer to the packet info.
815 * @param edt Unused
816 * @param data A pointer to the data provided by the tap
817 * @return TAP_PACKET_REDRAW if the data was actually used to alter
818 * the statistics, TAP_PACKET_DONT_REDRAW otherwise.
819 */
820 static tap_packet_status
822 stats_tree *st, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)
823 {
829 /* Unnecessary since this tap packet function and the F5 Ethernet trailer dissector are both in
830 * the same source file. If you are using this function as an example in a separate tap source
831 * file, you should uncomment this.
832 if(check_f5eth_tap_magic(tdata) == 0) return TAP_PACKET_DONT_REDRAW;
833 */
840 /* We could have low noise (with a virtual name) without medium noise (with the flow ID).
841 * That will get treated as a no flow case. */
844 /* No flow ID */
848 /* Flow ID without virtual name */
851 }
853 /* Has virtual name */
856 }
861 /* End of statistics gathering */
862 /*===============================================================================================*/
864 /*===============================================================================================*/
865 /* Info column display handling.
866 *
867 * Format Specifiers:
868 * in/out are separate formats so that no printf formatting is required for these two common
869 * alternatives.
870 * There are two sets of six format strings. One set corresponding to "full" or long output
871 * ("long" is not used due to conflict with C keyword) and the other set corresponding to
872 * "brief" output.
873 * Full:
874 * in/out only; one for in, one for out:
875 * info_format_full_in_only, info_format_full_out_only
876 * in/out, slot and tmm; one for in and one for out:
877 * info_format_full_in_slot, info_format_full_out_slot
878 * in/out and tmm (no slot information); one for in and one for out:
879 * info_format_full_in_noslot, info_format_full_out_noslot
880 * Brief:
881 * in/out only; one for in, one for out:
882 * info_format_brief_in_only, info_format_brief_out_only
883 * in/out, slot and tmm; one for in and one for out:
884 * info_format_brief_in_slot, info_format_brief_out_slot
885 * in/out and tmm (no slot information); one for in and one for out:
886 * info_format_brief_in_noslot, info_format_brief_out_noslot
887 * The set of format specifiers in use are chosen based on whether brief is chosen and the
888 * following variables are set accordingly:
889 * info_format_in_only, info_format_out_only (should have no format specifiers)
890 * info_format_in_slot, info_format_out_slot (should have two format specifiers)
891 * info_format_in_noslot, info_format_out_noslot (should have one format specifier)
892 *
893 * Functions:
894 * Separate functions depending on the amount of information desired. The decision is made once
895 * when the preference is set and a function pointer is used to call the appropriate one:
896 * f5eth_set_info_col_inout(): In/out only.
897 * f5eth_set_info_col_slot(): in/out, slot and tmm.
898 * f5eth_set_info_col_noslot(): in/out and tmm (no slot information).
899 * f5eth_set_info_col is the function pointer to the function currently in use.
900 */
902 /** Info column display format formats */
910 /* Variables used in f5eth_set_info_col functions initialized to defaults */
918 /** Info column display format preference types:
919 * These correspond to bit flags
920 * Display on = 0x0001
921 * In out only = 0x0002
922 * Brief = 0x0004
923 */
932 /** Info column display format type strings */
940 };
941 /** Info column display preference (default to full) */
944 /** Preference for the brief in/out characters */
947 /** Function pointer prototype for info column set functions */
950 /** Preference for setting platform regex for which platforms to display slot information for. */
952 /** Whether or not to display slot information, set based on platform and regex preference. */
955 /*-----------------------------------------------------------------------------------------------*/
956 /**
957 * @brief Adds full format (in/out, slot, tmm) to info column
958 *
959 * @param pinfo A pointer to the packet info structure.
960 * @param ingress zero for egress, non-zero for ingress.
961 * @param slot The slot number handling the packet
962 * @param tmm The tmm handling the packet
963 */
964 static void
966 {
968 /*
969 * HTTP and other protocols set writable to false to protect
970 * their data. We don't care.
971 */
981 }
983 /* Reset writable to whatever it was before we got here. */
987 /*-----------------------------------------------------------------------------------------------*/
988 /**
989 * @brief Adds format without slot (in/out, tmm) to info column
990 *
991 * @param pinfo A pointer to the packet info structure.
992 * @param ingress zero for egress, non-zero for ingress.
993 * @param slot The slot number handling the packet (unused)
994 * @param tmm The tmm handling the packet
995 */
996 static void
997 f5eth_set_info_col_noslot(packet_info *pinfo, unsigned ingress, unsigned slot _U_, unsigned tmm)
998 {
1000 /*
1001 * HTTP and other protocols set writable to false to protect
1002 * their data. We don't care.
1003 */
1011 }
1013 /* Reset writable to whatever it was before we got here. */
1017 /*-----------------------------------------------------------------------------------------------*/
1018 /**
1019 * @brief Adds format with only direction (in/out) to info column
1020 *
1021 * @param pinfo A pointer to the packet info structure.
1022 * @param ingress zero for egress, non-zero for ingress.
1023 * @param slot The slot number handling the packet (unused)
1024 * @param tmm The tmm handling the packet (unused)
1025 */
1026 static void
1027 f5eth_set_info_col_inout(packet_info *pinfo, unsigned ingress, unsigned slot _U_, unsigned tmm _U_)
1028 {
1030 /*
1031 * HTTP and other protocols set writable to false to protect
1032 * their data. We don't care.
1033 */
1041 }
1043 /* Reset writable to whatever it was before we got here. */
1047 /** The column display function. Will really be set in proto_reg_handoff_f5fileinfo() */
1050 /*-----------------------------------------------------------------------------------------------*/
1051 /**
1052 * @brief Called out of f5info processing to determine platform display information
1053 *
1054 * @param platform String representing the platform name (can be NULL, will not be referenced
1055 * after the function returns.)
1056 */
1057 static void
1059 {
1060 /** Always display slot information when there is no platform information in the header or
1061 * if there was no regex specified in the preference. But use the in/out only
1062 * function if that is specified in the preference.*/
1070 }
1072 }
1074 /** If the string matches the regex */
1077 /** Then display the slot information (only if in/out only is not selected). */
1083 }
1085 /** Else do not display the slot information (only if in/out only is not selected). */
1091 }
1092 }
1095 /* End of info column display handling. */
1096 /*===============================================================================================*/
1098 /** Magic information for the fileinfo packet that might appear at the beginning of a capture. */
1102 };
1104 #define F5_OFF_TYPE 0
1105 #define F5_OFF_LENGTH 1
1106 #define F5_OFF_VERSION 2
1107 #define F5_OFF_VALUE 3
1109 /** This is used only for old format trailers. The highest version number is 3 for medium trailers. */
1110 #define F5TRAILER_VER_MAX 3
1112 #define F5TYPE_LOW 1
1113 #define F5TYPE_MED 2
1114 #define F5TYPE_HIGH 3
1116 /* These are to perform a sanity check to try to avoid rendering true garbage
1117 * in packets. So, in addition to matching one of the types, the len of the
1118 * suspected trailer needs to fall into this range.
1119 *
1120 * Max length seems to be 42 on high detail.
1121 * Max length with RST cause in medium(v1) is 30 + 8 + 1 + 96 (might be 30+96)?
1122 * Max length with RST cause in medium(v2) is 31 + 8 + 1 + 96 (might be 31+96)?
1123 * Max length with RST cause in medium(v3) is 35 + 8 + 1 + 96 (might be 35+96)?
1124 * Min length is 8 on v9.4 medium detail.
1125 * Min length is 7 on v11.2 low trailer with no VIP name.
1126 *
1127 * These are only used for old format trailers.
1128 */
1129 #define F5_MIN_SANE 7
1130 #define F5_MAX_SANE 140
1132 #define F5_LOW_FLAGS_INGRESS_MASK 0x01
1133 #define F5_LOW_FLAGS_HWACTION_MASK 0x06
1135 #define F5_HIV0_LEN 42
1137 /* Old format trailers */
1138 #define F5_MEDV94_LEN 8
1139 #define F5_MEDV10_LEN 21
1140 #define F5_MEDV11_LEN 29
1141 #define F5_MEDV1_LENMIN 30
1142 #define F5_MEDV2_LENMIN 31
1143 #define F5_MEDV3_LENMIN 35
1144 #define F5_LOWV94_LEN 35
1145 #define F5_LOWV10_LEN 22
1146 #define F5_OFF_LOW_ING 3
1147 #define F5_OFF_LOW_SLOT 4
1148 #define F5_OFF_LOW_TMM 5
1149 #define VIP_NAME_LEN 16
1150 #define F5_LOWV1_LENMIN 7
1152 /* New format (DPT) trailers */
1155 #define F5_DPT_V1_HDR_MAGIC_OFF 0
1156 #define F5_DPT_V1_HDR_MAGIC_LEN 4
1157 #define F5_DPT_V1_HDR_MAGIC 0xf5deb0f5
1158 #define F5_DPT_V1_HDR_LENGTH_OFF (F5_DPT_V1_HDR_MAGIC_OFF + F5_DPT_V1_HDR_MAGIC_LEN)
1159 #define F5_DPT_V1_HDR_LENGTH_LEN 2
1160 #define F5_DPT_V1_HDR_VERSION_OFF (F5_DPT_V1_HDR_LENGTH_OFF + F5_DPT_V1_HDR_LENGTH_LEN)
1161 #define F5_DPT_V1_HDR_VERSION_LEN 2
1164 #define F5_DPT_V1_HDR_LEN (F5_DPT_V1_HDR_VERSION_OFF + F5_DPT_V1_HDR_VERSION_LEN)
1166 #define F5_DPT_PROVIDER_NOISE 1
1168 #define F5_DPT_V1_TLV_PROVIDER_OFF 0
1169 #define F5_DPT_V1_TLV_PROVIDER_LEN 2
1170 #define F5_DPT_V1_TLV_TYPE_OFF (F5_DPT_V1_TLV_PROVIDER_OFF + F5_DPT_V1_TLV_PROVIDER_LEN)
1171 #define F5_DPT_V1_TLV_TYPE_LEN 2
1172 #define F5_DPT_V1_TLV_LENGTH_OFF (F5_DPT_V1_TLV_TYPE_OFF + F5_DPT_V1_TLV_TYPE_LEN)
1173 #define F5_DPT_V1_TLV_LENGTH_LEN 2
1174 #define F5_DPT_V1_TLV_VERSION_OFF (F5_DPT_V1_TLV_LENGTH_OFF + F5_DPT_V1_TLV_LENGTH_LEN)
1175 #define F5_DPT_V1_TLV_VERSION_LEN 2
1176 #define F5_DPT_V1_TLV_HDR_LEN (F5_DPT_V1_TLV_VERSION_OFF+F5_DPT_V1_TLV_VERSION_LEN)
1178 /*===============================================================================================*/
1179 /* This section is for performing analysis of the trailer information. */
1181 /** Analysis Overview:
1182 *
1183 * The analysis in this dissector is meant to correlate data in the F5 Ethernet trailer with other
1184 * data in the frame (e.g. IP, TCP) and highlight things that don't look right. They might be
1185 * perfectly valid, but in most cases, they are not.
1186 *
1187 * How it works:
1188 *
1189 * When analysis is enabled, the dissector ties protocol data to each packet. The dissector
1190 * populates some useful data it needs to perform analysis into the protocol data. It also
1191 * registers taps on IP, IPv6 and TCP to populate data from those headers into the stored protocol
1192 * data.
1193 *
1194 * All of that information is then used to look for certain, common anomalies.
1195 *
1196 * It uses taps rather than surfing the WS protocol tree because:
1197 * 1. I suspect that surfing the protocol tree is rather expensive.
1198 * 2. We need to try to find the outer-most headers and use those. The taps should fire in
1199 * order so that should get what is needed. When searching the tree, it's difficult to
1200 * know if, for example, the TCP header we are on is tied to the outer IP header or to
1201 * the IP header that's inside and ICMP inside an IP.
1202 *
1203 * Challenges:
1204 *
1205 * 1. Taps run after all dissectors run on a packet. As a result, when the trailer dissector is
1206 * running, it does not have the data from the other protocols to perform the analysis.
1207 * 2. The Ethernet dissector does not call trailer dissectors if it is not building a tree.
1208 *
1209 * Flow:
1210 *
1211 * In the trailer dissector, if ip_visited is set and analysis done is not set, then analysis
1212 * is performed.
1213 *
1214 * In the tcp tap, if analysis_done is not set and pkt_ingress is not unknown (meaning that the
1215 * trailer dissector had an opportunity to run on this packet), then analysis is performed. Also
1216 * in this case, we attempt to attach the expert info to a top-level tree element for the
1217 * F5 Ethernet trailer.
1218 *
1219 * The purpose of the analysis in the dissector is for first-pass misses of the dissector. For
1220 * example, on initial file load, if the Ethernet dissector does not call the trailer dissector
1221 * then analysis cannot be performed by the tcp tap because the data from the trailer is not
1222 * available. In order to get the analysis on the second pass, we run here.
1223 *
1224 * The purpose of the analysis and rendering in the tcp tap is to handle one-pass situations
1225 * (e.g. tshark). In one-pass situations, after the tcp tap is called, the trailer dissector
1226 * will not run again to have an opportunity to perform and render analysis.
1227 */
1231 #define IP_OFFSET_MASK ((1 << IP_OFFSET_WIDTH) - 1)
1233 /** Structure used to store data gathered by the taps and dissector that is attached to the pinfo
1234 * structure for the packet. This structure ends up getting allocated for every packet. So, we
1235 * want to keep it small.
1236 *
1237 * For fields that are 1 bit wide, they have 0 == false and 1 == true.
1238 * For fields that are 2 bits wide, they have 0 == false, 1 == true and 3 == unknown.
1239 */
1256 };
1258 /*-----------------------------------------------------------------------------------------------*/
1259 /**
1260 * @brief Allocates a new analysis data structure and initializes the values.
1261 *
1262 * @return wmem allocated analysis structure
1263 */
1266 {
1269 /* r->ip_visited = 0; */
1270 /* r->tcp_visited = 0; */
1280 /* r->analysis_done = 0; */
1281 /* r->analysis_flowreuse = 0; */
1282 /* r->analysis_flowlost = 0; */
1283 /* r->analysis_hasresults = 0; */
1288 /* Functions for find a subtree of a particular type of the current tree. */
1290 /** Structure used as the anonymous data in the proto_tree_children_foreach() function */
1294 };
1296 /*-----------------------------------------------------------------------------------------------*/
1297 /**
1298 * @brief Function to see if a node is of a particular type and return it if it is a tree.
1299 *
1300 * @param pn A pointer to the proto_node being looked at.
1301 * @param data A pointer to the subtree_search structure with search criteria and results.
1302 */
1303 static void
1305 {
1311 }
1314 /*-----------------------------------------------------------------------------------------------*/
1315 /**
1316 * @brief Function to search child trees (one level) for a tree of a specific type.
1317 *
1318 * @param tree A pointer to the proto_tree being looked at.
1319 * @param hf The register hfinfo id that we are looking for.
1320 * @return The tree that was found or NULL if it was not found.
1321 */
1324 {
1335 /*-----------------------------------------------------------------------------------------------*/
1336 /**
1337 * @brief Computes the analysis results based on the data in the analysis data struct.
1338 *
1339 * @param ad A pointer to the f5eth_analysis_data_t struct
1340 */
1341 static void
1343 {
1344 /** Tests that apply to ingress TCP non-frags */
1346 /** If this is an inbound SYN and there is a flow ID, we might have a problem. */
1350 }
1352 /** If this is an inbound packet with the ACK flag set and there is no flow, we might have
1353 * a problem. */
1357 }
1358 }
1363 /*-----------------------------------------------------------------------------------------------*/
1364 /**
1365 * @brief Puts the results of the F5 Ethernet trailer analysis into the protocol tree.
1366 *
1367 * @param tvb A pointer to a TV buffer for the packet.
1368 * @param pinfo A pointer to the packet info struction for the packet
1369 * @param tree A pointer to the protocol tree structure
1370 * @param ad A pointer to the intra-noise information data
1371 */
1372 static void
1375 {
1384 }
1387 }
1390 /*-----------------------------------------------------------------------------------------------*/
1391 /**
1392 * @brief Tap call back to retrieve information about the IP headers.
1393 *
1394 * @param tapdata UNUSED
1395 * @param pinfo Pointer to acket Info data structure
1396 * @param edt UNUSED
1397 * @param data Pointer to ws_ip4 structure
1398 * @return tap_packet_status
1399 */
1400 static tap_packet_status
1401 ip_tap_pkt(void *tapdata _U_, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)
1402 {
1418 /* Only care about TCP at this time */
1419 /* We wait until here to make this check so that if TCP in encapsulated in something else, we
1420 * don't work on the encapsulated header. So, we only want to work on TCP if it associated
1421 * with the first IP header (not if it's embedded in an ICMP datagram or some sort of tunnel).
1422 */
1426 }
1434 /*-----------------------------------------------------------------------------------------------*/
1435 /**
1436 * @brief Tap call back to retrieve information about the IPv6 headers.
1437 *
1438 * @param tapdata UNUSED
1439 * @param pinfo Pointer to acket Info data structure
1440 * @param edt UNUSED
1441 * @param data Pointer to ws_ip6_hdr structure
1442 * @return tap_packet_status
1443 */
1444 static tap_packet_status
1445 ipv6_tap_pkt(void *tapdata _U_, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)
1446 {
1462 /* Only care about TCP at this time */
1463 /* We wait until here to make this check so that if TCP in encapsulated in something else, we
1464 * don't work on the encapsulated header. So, we only want to work on TCP if it associated
1465 * with the first IP header (not if it's embedded in an ICMP datagram or some sort of tunnel.
1466 */
1467 /* Note that this only works if TCP is the first next header. If there are other IPv6 headers,
1468 * we will not see the fact that it is TCP (limitation of IPv6 tap). This becomes a problem if
1469 * there are hop_by_hop or routing headers or other (non-fragment) IPv6 headers. If it's a
1470 * fragment, we don't care anyways (too much effort). */
1474 }
1481 /*-----------------------------------------------------------------------------------------------*/
1482 /**
1483 * @brief Tap call back to retrieve information about the TCP headers.
1484 *
1485 * @param tapdata UNUSED
1486 * @param pinfo Pointer to acket Info data structure
1487 * @param edt UNUSED
1488 * @param data Pointer to tcp_info_t structure
1489 * @return tap_packet_status
1490 */
1491 static tap_packet_status
1492 tcp_tap_pkt(void *tapdata _U_, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)
1493 {
1512 /** Only do this if the trailer dissector ran. */
1515 /** If there were results from the analysis, go find the tree and try to insert them. */
1519 /** This was the first opportunity to run, so add anything necessary to the tree. */
1520 /* If we don't find a tree, we could theoretically anchor it to the top-tree. However,
1521 * this situation should not happen since, if we know the ingress property, then the
1522 * trailer dissector ran and probably created a subtree, so it should most always be
1523 * there. If it is not there, it could be because there is nothing of interest to a
1524 * filter in the f5ethtrailer protocol, so it didn't create a tree (so probably don't
1525 * want to blindly tie this to the top-tree). Other causes would warrant further
1526 * investigation as to why it couldn't be found. */
1529 }
1530 }
1535 /* End of analysis functions */
1536 /*===============================================================================================*/
1538 /* Used to determine if an address is an IPv4 address represented as an IPv6
1539 * address. */
1543 #define F5_IPV6ADDR_LEN 16
1545 /*---------------------------------------------------------------------------*/
1546 /**
1547 * @brief Display an IPv6 encoded IPv4 addr in an IPv4 field if appropriate.
1548 *
1549 * @param tree Pointer to tree struct
1550 * @param addrfield hf_index address will be placed in
1551 * @param rtdomfield hf_index route doamin will be placed in
1552 * @param tvb Pointer to tvb
1553 * @param offset Offset into the tvb containg the IPv6 address
1554 * @param hidden Should the protocol item be hidden
1555 * @return Pointer to proto_item created
1556 */
1560 {
1569 }
1571 /* Route domain information may show up here if the traffic is between tmm and the BIG-IP
1572 * host (e.g. monitor traffic). If so, break it up and render it for ease of viewing (and
1573 * searching). Ignore the incorrect addresses used by 10.0.x (solution 10511) as these
1574 * will hopefully not be common. */
1575 /* TODO: review - These are technically backwards as we are probably returning the wrong pi. However,
1576 * when configuring, people usually see route domain after the address, so that is why this
1577 * particular ordering is used (and none of the callers currently use the return value). */
1583 }
1589 }
1590 }
1595 /**
1596 * @brief Render a tree item to dispalay header info for old format trailer blocks
1597 *
1598 * @attention The old format trailers used a fair amount of magic numbers. Continuing that
1599 use for now with the same magic numbers in this function
1600 *
1601 * @param tvb Pointer to the tvb
1602 * @param tree Pointer to tree struct
1603 * @param offset Offset into the tvb
1604 * @return Number of bytes consumed
1605 */
1606 static int
1608 {
1621 /* offset += 1; */
1626 /*---------------------------------------------------------------------------*/
1627 /**
1628 * @brief Dissect old format "high" trailer TLV
1629 *
1630 * @param tvb Pointer to the tvb to be processed
1631 * @param pinfo Pointer to packet_info struct
1632 * @param tree Pointer to protocol tree
1633 * @param offset Offset into the tvb where trailer begins
1634 * @param trailer_length Length of the trailer data to process
1635 * @param trailer_ver Version of the trailer detected
1636 * @param tdata Pointer to tap data structure
1637 * @return Number of btyes consumed
1638 */
1639 static unsigned
1642 {
1650 /* We do not need to do anything if we don't have a tree */
1660 }
1662 /* Add in the high order structures. */
1669 /* peer remote address */
1674 }
1682 /* peer local address */
1687 }
1696 /* If there is no proto in the trailer, go get it from the actual packet
1697 * information. */
1700 }
1702 /* peer remote port */
1712 }
1713 }
1719 /* peer remote port */
1730 }
1731 }
1739 /*---------------------------------------------------------------------------*/
1740 /**
1741 * @brief Dissect old format "medium" trailer TLV
1742 *
1743 * @param tvb Pointer to the tvb to be processed
1744 * @param pinfo Pointer to packet_info struct
1745 * @param tree Pointer to protocol tree
1746 * @param offset Offset into the tvb where trailer begins
1747 * @param trailer_length Length of the trailer data to process
1748 * @param trailer_ver Version of the trailer detected
1749 * @param tdata Pointer to tap data structure
1750 * @return Number of btyes consumed
1751 */
1752 static unsigned
1755 {
1766 }
1771 }
1773 /* check size is valid */
1776 }
1779 /* If we want the RST cause in the summary, we need to do it here,
1780 * before the tree check below */
1787 }
1788 }
1793 }
1795 /* check size is valid */
1798 }
1801 /* If we want the RST cause in the summary, we need to do it here,
1802 * before the tree check below */
1809 }
1810 }
1815 }
1817 /* check size is valid */
1820 }
1823 /* If we want the RST cause in the summary, we need to do it here,
1824 * before the tree check below */
1831 }
1832 }
1836 }
1838 /* We do not need to do anything more if we don't have a tree and we are not performing
1839 * analysis */
1846 /* After 9.4, flow IDs and flags and type are here in medium */
1849 /* In v10, flowIDs are 32bit */
1861 /* After v10, flowIDs are 64bit */
1872 }
1877 }
1882 }
1884 /* We do not need to do anything if we don't have a tree */
1885 /* Needed to get here so that analysis and tap will work. */
1896 }
1938 }
1939 }
1940 }
1945 /*---------------------------------------------------------------------------*/
1946 /* Low level trailers */
1947 /**
1948 * @brief Dissect old format "low" trailer TLV
1949 *
1950 * @param tvb Pointer to the tvb to be processed
1951 * @param pinfo Pointer to packet_info struct
1952 * @param tree Pointer to protocol tree
1953 * @param offset Offset into the tvb where trailer begins
1954 * @param trailer_length Length of the trailer data to process
1955 * @param trailer_ver Version of the trailer detected
1956 * @param tdata Pointer to tap data structure
1957 * @return Number of btyes consumed
1958 */
1959 static unsigned
1962 {
1975 }
1979 /* Analysis doesn't care about the virtual name, only populate if there is a tap
1980 * active */
1985 }
1989 /* Analysis doesn't care about the virtual name, only populate if there is a tap
1990 * active */
1995 }
1996 }
2001 }
2003 /* check size is valid */
2006 }
2009 /* Analysis doesn't care about the virtual name, only populate if there is a tap active
2010 */
2014 }
2018 }
2026 }
2027 /* Is the column visible? */
2030 }
2032 /* We do not need to do anything more if we don't have a tree and we are not performing
2033 * analysis and this is not v9.4. If v9.4, need to continue to get flow
2034 * information.*/
2039 }
2044 /* Use special formatting here so that users do not have to filter on "IN"
2045 * and "OUT", but rather can continue to use typical boolean values. "IN"
2046 * and "OUT" are provided as convenience. */
2050 o++;
2058 /* In v9.4, flowIDs, flags and type are here in low */
2074 }
2076 /* We do not need to do anything more if we don't have a tree */
2077 /* Needed to get here so that analysis will work. */
2085 }
2092 /**
2093 * @brief Render a header tree for new format tlvs
2094 *
2095 * @param tvb Pointer to tvb
2096 * @param tree Pointer to protocol tree
2097 * @param offset Offset into the tvb
2098 */
2099 static void
2101 {
2121 /*---------------------------------------------------------------------------*/
2122 /**
2123 * @brief Render the data for DPT high noise trailer TLV
2124 *
2125 * @param tvb The tvbuff containing the TLV block (header and data)
2126 * @param pinfo The pinfo structure for the frame
2127 * @param tree The tree to render the TVB under
2128 * @param data Pointer to tdata for the trailer
2129 * @return The size of the TVB
2130 */
2131 static int
2132 dissect_dpt_trailer_noise_high(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data)
2133 {
2145 /* Unknown version, cannot do anything */
2148 }
2151 /* We do not need to do anything if we do not have a tree */
2153 }
2163 /* If there was no peer id in the medium trailer, then there is no peer flow information to
2164 * render; skip it all.
2165 */
2169 }
2171 /* Add in the high order structures. */
2178 /* peer remote address */
2183 }
2191 /* peer local address */
2196 }
2204 /* peer remote port */
2215 }
2216 }
2222 /* peer remote port */
2233 }
2234 }
2242 /*---------------------------------------------------------------------------*/
2243 /**
2244 * @brief Render the data for DPT medium noise trailer TVB
2245 *
2246 * @param tvb The tvbuff containing the TLV block (header and data)
2247 * @param pinfo The pinfo structure for the frame
2248 * @param tree The tree to render the TVB under
2249 * @param data Pointer to tdata for the trailer
2250 * @return The size of the TVB
2251 */
2252 static int
2254 {
2268 /* Unknown version, cannot do anything */
2271 }
2281 /* Check for an invalid reset cause length and do not try to reference any of the data if it is
2282 * bad
2283 */
2286 /* Set this to zero to prevent processing of things that utilze it */
2288 }
2291 /* If we want the RST cause in the summary, we need to do it here,
2292 * before the tree check below */
2299 }
2300 }
2302 /* We do not need to do anything more if we don't have a tree and we are not performing
2303 * analysis */
2325 /* We do not need to do anything if we don't have a tree */
2326 /* Needed to get here so that analysis and tap will work. */
2329 }
2381 /*o = startcause + rstcauselen;*/
2385 }
2386 }
2396 };
2398 /*---------------------------------------------------------------------------*/
2399 /**
2400 * @brief Render the data for DPT low noise trailer TVB
2401 *
2402 * @param tvb The tvbuff containing the TLV block (header and data)
2403 * @param pinfo The pinfo structure for the frame
2404 * @param tree The tree to render the TVB under
2405 * @param data Pointer to tdata for the trailer
2406 * @return The size of the TVB
2407 */
2408 static int
2410 {
2426 /* Unknown version, cannot do anything */
2429 }
2431 /* Add the Low Noise trailer and attach a subtree */
2440 /* Direction */
2446 }
2447 /* Use special formatting here so that users do not have to filter on "IN"
2448 * and "OUT", but rather can continue to use typical boolean values. "IN"
2449 * and "OUT" are provided as convenience. */
2454 /* The old ingress field is now a flag field. Leave the old ingress field
2455 * for backward compatibility for users that are accustomed to using
2456 * "f5ethtrailer.ingress" but mark it as generated to indicate that that
2457 * field no longer really exists. */
2461 ENC_BIG_ENDIAN);
2462 }
2466 /* Slot */
2471 /* TMM */
2476 }
2480 /* Is the column visible? */
2483 }
2486 /* VIP Name */
2488 /* Make sure VIP Name Length does not extend past the TVB */
2492 /* Cannot go any further */
2494 }
2504 }
2507 /* This area now is a data block containing a number of BIG-IP config object names
2508 * i.e. Virtual server that handled the packt
2509 * Port that handled the packet
2510 * Trunk that handled the packet
2511 *
2512 * 1-Byte Length of block (excluding this byte)
2513 * len-Bytes data block
2514 * <len><data block...>
2515 *
2516 * Then the "data block" is a variable number of object names
2517 * Each name value is:
2518 * 1-Byte Type
2519 * 1-Byte Length (excluding type and length bytes)
2520 * len-Bytes String
2521 * <type><len><string><type><len><string>
2522 */
2532 /* Cannot go any further */
2534 }
2537 /* Begin parsing the data field and adding items for the strings contained */
2565 /* unknown type */
2571 }
2581 /* Cannot go any further */
2583 }
2591 }
2596 }
2598 }
2600 }
2604 /*---------------------------------------------------------------------------*/
2605 /**
2606 * @brief Render the data for DPT noise provider TVB
2607 *
2608 * @param tvb The tvbuff containing the packet data for this TLV
2609 * @param pinfo The pinfo structure for the frame
2610 * @param tree The tree to render the TVB under
2611 * @param data Pointer to tdata for the trailer
2612 * @return The size of the TVB
2613 */
2614 static int
2616 {
2621 dissector_try_uint_with_data(noise_subdissector_table, pattern, tvb, pinfo, tree, false, data));
2624 /*---------------------------------------------------------------------------*/
2625 /**
2626 * @brief Render the data for DPT TVB for an unknown provider
2627 *
2628 * @param tvb The tvbuff containing the packet data for this DPT
2629 * @param pinfo The pinfo structure for the frame
2630 * @param tree The tree to render the TVB under
2631 * @param data Pointer to tdata for the trailer
2632 * @return The size of the TVB
2633 */
2634 static int
2635 dissect_dpt_trailer_unknown(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
2636 {
2650 }
2655 /*---------------------------------------------------------------------------*/
2656 /**
2657 * @brief Render the data for DPT block
2658 *
2659 * There is no predetermined or guaranteed order the DPT TLVs will be
2660 * attached to the frame. Use conversation data to coalesce information
2661 * across TLVs and frames.
2662 *
2663 * @param tvb The tvbuff containing the packet data for this DPT block
2664 * @param pinfo The pinfo structure for the frame
2665 * @param tree The tree to render the DPT block in
2666 * @param data Pointer to tdata for the trailer
2667 * @return The size of the DPT block
2668 */
2669 static int
2671 {
2681 /* Render the DPT header */
2693 /* If this is an unknown version, return after rendering header and data */
2698 }
2708 /* Report an error if the length specified in the header is either
2709 * Not long enough to contain the header
2710 * Indicates that the TLV is longer than the data that would have been captured.
2711 */
2727 }
2728 /* If the length here is bad, then we probably will not index to the next TLV, so
2729 * abort and do not try to render anymore TLVs.
2730 */
2732 }
2738 /* Render the TLV header as unknown */
2740 }
2742 }
2747 /*---------------------------------------------------------------------------*/
2748 /**
2749 * @brief Dissect the old format trailers (9.4.2 - 13.x)
2750 *
2751 * @param tvb The tvbuff containing the packet data for this trailer
2752 * @param pinfo The pinfo structure for the frame
2753 * @param tree The tree to render the thrailer under
2754 * @param data Pointer to tdata for the trailer
2755 * @return int Number of bytes cosumed by the dissector
2756 */
2757 static int
2759 {
2762 /* While we still have data in the trailer. For old format trailers, this needs
2763 * type, length, version (3 bytes) and for new format trailers, the magic header (4 bytes).
2764 * All old format trailers are at least 4 bytes long, so just check for length of magic.
2765 */
2767 /* length field does not include the type and length bytes. Add them back in */
2771 /* Invalid length - either a malformed trailer, corrupt packet, or not f5ethtrailer */
2773 }
2777 /* Parse out the specified trailer. */
2792 }
2802 }
2808 processed =
2813 }
2816 /* Unknown type - malformed trailer, corrupt packet, or not f5ethtrailer - bali out*/
2818 }
2820 /* couldn't process trailer - bali out */
2823 }
2825 }
2829 /*---------------------------------------------------------------------------*/
2830 /**
2831 * @brief Dissector entry point
2832 *
2833 * @param tvb The tvbuff containing the packet data for this trailer
2834 * @param pinfo The pinfo structure for the frame
2835 * @param tree The tree to render the thrailer under
2836 * @param data Pointer to tdata for the trailer
2837 * @return int Number of bytes cosumed by the dissector
2838 *
2839 * New format trailers (BIG-IP 14.0 and later) begin with
2840 * 4-byte magic number (0xf5deb0f5)
2841 * 2-byte trailer length (Length includes header)
2842 * 2-byte version
2843 * 1 or more variable length TLVs
2844 *
2845 * Each New format TLV starts with
2846 * 2-byte Provider ID
2847 * 2-byte Type ID
2848 * 2-byte TLV Length (Length includes header)
2849 * 2-byte Version
2850 * (TLVlen - 8) bytes of data
2851 *
2852 * Old format trailers (BIG-IP 9.4.2 - 13.x) were a list of variable length
2853 * TLVs.
2854 * 1-byte Type
2855 * 1-byte TLV Length (TLVlen does not include the type and length fields)
2856 * TLVlen bytes of data
2857 */
2858 static int
2860 {
2867 /* The trailers are really only helpful if we have the entire trailer. If we
2868 don't, don't try to dissect it. */
2870 }
2872 /* In some circumstances it is possible that a short ethernet frame was padded before tmm
2873 was able to append f5ethtrailer. In many cases (and should be) this padding is zeros.
2874 The f5ethtrailer does not start with a zero, so trim off any leading zeros before
2875 looking for an f5ethtrailer. */
2877 offset++;
2878 }
2882 /* There must be at least enough bytes for a legacy low ver1 trailer. New format
2883 trailers will be longer */
2885 }
2888 /* Check if this is a new format trailer. */
2892 /* we have the right magic, but the length doesn't match up.
2893 assume we're not an f5ethtrailer, or it is corrupt.
2894 Either way, don't try and dissect. */
2896 }
2897 /* Looks like a new format trailer */
2900 }
2901 /* It's possible to have the trailer added after the FCS has already been added.
2902 Let's move in 4 bytes and check there. However, it is also possible for the FCS
2903 to start with a sequence of zeros that would have been already been skipped. If so,
2904 we need to back up. If there is an FCS display the Original.
2906 Only add this check for new format trailers. Old format trailers are becoming less
2907 common and likely wouldn't have been added after FCS anyway.
2908 If needed, the walk trailer prefernce would find the old format trailer after an FCS.
2909 This seems reasonable enough for old format trailers. */
2914 }
2919 }
2920 }
2921 }
2923 /* Not new format? Are we old format? */
2926 /* Check for old format trailers */
2934 /* Found at least one old format TLV */
2937 }
2939 /* Didn't find an f5ethtrailer, and we're not going to keep looking. */
2942 offset++;
2943 }
2945 found_trailer:
2946 ;
2947 /* Good to go, start dissection */
2951 /* Initialize data structure for taps and analysis */
2963 }
2964 }
2967 /* dissect new format trailer */
2971 /* dissect old format trailer */
2974 }
2978 /* If the analyis preference is enabled, process it */
2982 /* Get the analysis data information for this packet */
2988 }
2994 }
2995 /* Only perform the analysis if we had an opportunity to get the TCP information. In
2996 * this case, if the ip tap ran then they all should have run. We use IP so we don't
2997 * perform analysis every time we visit a UDP/ICMP, etc. packet. */
3000 }
3002 }
3004 /* Call tap handlers if it appears that we got enough data
3005 * (should have low noise if there is anything) */
3008 }
3012 static bool
3014 {
3016 }
3018 /*-----------------------------------------------------------------------------------------------*/
3019 /* Begin DPT TLS provider */
3020 /*-----------------------------------------------------------------------------------------------*/
3021 /* We want to be able to render TLS diagnostic data that is available and
3022 * generate keylog entries for later decryption use. We are not making
3023 * decisions about RFC compliance or functional correctness of the TLS
3024 * data here. If data is there, we will render it. If a keylog entry
3025 * can be generated we will generate it even if it is wrong.
3026 *
3027 * The diagnostic information provided in F5 Ethernet trailers is state information
3028 * inteded for troubleshooting and diagnostics. This data is not sent on the wire.
3029 * It is only appended to frames captured on the BIG-IP, if explicitly requested. As
3030 * such if the data exists in the context, it will be appended to each packet with a
3031 * TLS layer. Filtering of duplicate / appropriate data and interpretation is left
3032 * to the dissector.
3033 *
3034 * This will result in things like the TLS dissector displaying the client random
3035 * in the CLIENT HELLO packet, while the F5 Ethtrailer TLS shows all zeros for the
3036 * client random. Then the F5 Ethtrailer will provide the client random in the
3037 * ACK to the CLIENT HELLO. It will also result in the same information being
3038 * provided on multiple packets.
3039 *
3040 * All the necessary parts to create a valid keylog record needed for decryption
3041 * may not be available in the same frame.
3042 */
3044 #define F5_DPT_PROVIDER_TLS 4
3046 /* PRE13 in this context indicates pre TLS-v1.3, not pre-standard (draft) TLS-v1.3. i.e. TLS-v1.2 and earlier */
3047 #define F5_DPT_TLS_PRE13_STD 0
3048 #define F5_DPT_TLS_PRE13_EXT 1
3049 #define F5_DPT_TLS_13_STD 2
3050 #define F5_DPT_TLS_13_EXT 3
3052 #define F5TLS_SECRET_LEN 48
3053 #define F5TLS_SESS_ID_LEN 32
3054 #define F5TLS_RANDOM_LEN 32
3055 #define F5TLS_HASH_LEN 64
3056 #define F5TLS_ZEROS_LEN 256
3057 #define F5TLS_T2V1_LEN 393
3064 /*
3065 * As we come across the initial crypto data, store it in a struct on the conversation.
3066 */
3068 f5tls_element_t master_secret;
3069 f5tls_element_t client_random;
3070 /* added by TLS 1.3 */
3071 f5tls_element_t erly_traf_sec;
3072 f5tls_element_t clnt_hs_sec;
3073 f5tls_element_t srvr_hs_sec;
3074 f5tls_element_t clnt_ap_sec;
3075 f5tls_element_t srvr_ap_sec;
3078 /*
3079 * As we collect enough information to create a keylog entry in the conversation data create
3080 * a field with the keylog entry on the first frame and store on the frame. This should limit
3081 * keylog entries to a unique list.
3082 */
3085 /* TLS 1.3 keylogs */
3102 /* TLS 1.x fields */
3108 /* TLS 1.3 fields */
3122 /* The types of keylog entries that could be created */
3124 CLIENT_RANDOM,
3125 CLIENT_TRAFFIC_SECRET_0,
3126 SERVER_TRAFFIC_SECRET_0,
3127 CLIENT_HANDSHAKE_TRAFFIC_SECRET,
3128 SERVER_HANDSHAKE_TRAFFIC_SECRET,
3129 EARLY_TRAFFIC_SECRET,
3132 /* Create a field of zeros. We need to check if the secrets, randoms, etc are all zeros and memcmp
3133 * looks like the best way to do it. So, create a single, global field of zeros at file scope.
3134 * That should cut down on some overhead...
3135 */
3138 /*-----------------------------------------------------------------------*/
3139 /** Get a null terminated hexstring of a byte array
3140 *
3141 * @param scope scope of the wmem allocate buffer
3142 * @param ba The byte aray to convert to a hexstring
3143 * @param ba_len Number of bytes to convert
3144 * @return Null terminated char* wmem allocated - no need to free
3145 */
3148 {
3158 /*-----------------------------------------------------------------------------------------------*/
3159 /**
3160 * @brief Create a keylog entry and add it to the packet info
3161 *
3162 * Keylog entries will be created as described in the tls dissector.
3163 * packet-tls-utils.c: tls_keylog_process_lines()
3164 *
3165 * @param keylog_type Type of keylog record to generate
3166 * @param xxxx First crypto element in for keylog record (see above)
3167 * @param yyyy Second crypto element in the keylog record (see above)
3168 * @return Null terminated keylog record wmem allocated with file scope
3169 */
3171 f5eth_add_tls_keylog(packet_info *pinfo, keylog_t keylog_type, f5tls_element_t *xxxx, f5tls_element_t *yyyy)
3172 {
3199 }
3202 /*-----------------------------------------------------------------------------------------------*/
3203 /**
3204 * @brief Process the data entries
3205 *
3206 * @param element Pointer to crypto element
3207 * @param pinfo Packet info pointer (unused)
3208 * @param tvb tvb
3209 * @param offset Offset into the tvb to pull the entry
3210 * @param len Length of byte string to convert from the tvb
3211 * @return Is the entry different than previously seen
3212 */
3213 static bool
3216 {
3218 /* Nothing to do */
3220 }
3223 /* unchanged */
3225 }
3227 /* Populate the element structure */
3235 /*----------------------------------------------------------------------*/
3236 /** TLS <= 1.2 trailer - Type 0
3237 *
3238 * @param tvb The tvbuff containing the DPT TLV block (header and data).
3239 * @param pinfo The pinfo structure for the frame.
3240 * @param tree The tree to render the DPT TLV under.
3241 * @param data Structure pointing to conversation and packet proto data.
3242 * @return Number of bytes decoded.
3243 */
3244 static int
3246 {
3259 /* Create a subtree and render a header */
3267 /* Add our fields */
3273 /* o += F5TLS_RANDOM_LEN; */
3277 }
3282 /* If this is our first pass through, add protocol data and build keylog entries.
3283 Assume that by the time the master secret is processed, the client random is
3284 available on the conversation data. */
3296 }
3297 }
3299 /* Display any keylog entries we have in our packet data */
3303 }
3306 /* Unknown version */
3309 }
3313 /*----------------------------------------------------------------------*/
3314 /** TLS 1.3 trailer - Type 2
3315 *
3316 * @param tvb The tvbuff containing the DPT TLV block (header and data).
3317 * @param pinfo The pinfo structure for the frame.
3318 * @param tree The tree to render the DPT TLV under.
3319 * @param data Structure pointing to conversation and packet proto data.
3320 * @return Number of bytes decoded.
3321 */
3322 static int
3324 {
3339 /* Create a subtree and render a header */
3348 /* Add our fields */
3352 /* nothing to render */
3363 }
3375 /* o += F5TLS_RANDOM_LEN; */
3376 }
3380 }
3385 /* If this is our first pass through, add protocol data and build keylog entries.
3386 Assume that if a CRand exists on the conversation that it is the one that matches
3387 up with the newly set / changed secret. */
3398 ets_changed =
3403 }
3404 chs_changed =
3407 shs_changed =
3410 cap_changed =
3413 sap_changed =
3422 }
3426 }
3430 }
3434 }
3438 }
3439 }
3440 }
3442 /* Display any keylog entries we have in our packet data */
3446 }
3450 }
3454 }
3458 }
3462 }
3465 /* Unknown version */
3468 }
3472 /*----------------------------------------------------------------------*/
3473 /** TLS extended trailer - Types 1 and 3
3474 *
3475 * Render as <DATA> - No dissection
3476 *
3477 * @param tvb The tvbuff containing the DPT TLV block (header and data).
3478 * @param pinfo The pinfo structure for the frame (unused).
3479 * @param tree The tree to render the DPT TLV under.
3480 * @param data Data passed (unused).
3481 * @return Number of bytes decoded.
3482 */
3483 static int
3486 {
3492 /* Create a subtree and render a header */
3504 /*-----------------------------------------------------------------------------------------------*/
3505 /**
3506 * @brief Dissector for the TLS DPT provider
3507 *
3508 * @param tvb The tvbuff containing the DPT TLV block (header and data).
3509 * @param pinfo The pinfo structure for the frame.
3510 * @param tree The tree to render the DPT TLV under.
3511 * @param data Data passed (tap data) (unused).
3512 * @return The length as read from the TLV header.
3513 *
3514 */
3515 static int
3517 {
3522 /* We only need the conversation to bring data parts together that arrive on
3523 different frames. After the first pass, the keylog entries are stored
3524 on the individual packet's data */
3534 }
3535 }
3542 }
3543 }
3545 /* Combine 2 byte TYPE with 2 byte VERSION into uint32_t for the subdissector table lookup */
3549 dissector_try_uint_with_data(tls_subdissector_table, pattern, tvb, pinfo, tree, false, tls_data));
3552 /*-----------------------------------------------------------------------------------------------*/
3553 /* End DPT TLS Provider */
3554 /*-----------------------------------------------------------------------------------------------*/
3556 /**
3557 * @brief Initialization routine called before first pass through a capture.
3558 *
3559 */
3560 static void
3562 {
3563 /** Need to set display_slot to true when initially reading a capture. This covers the
3564 * situation when a user loads a capture that turns off slot display and then loads a
3565 * different capture that contains trailers, but does not have the F5INFO frame. In this
3566 * case, we need to turn the slot display back on. */
3568 /* Set the info column function to use based on whether or not an in/out only
3569 * preference is chosen. */
3578 }
3580 /* If we are doing analysis, enable the tap listeners */
3591 }
3599 }
3607 }
3608 }
3609 }
3611 /**
3612 * @brief Cleanup after closing a capture file.
3613 *
3614 */
3615 static void
3617 {
3621 }
3625 }
3629 }
3630 }
3632 /**
3633 * @brief Sets up the format strings to use for the Info column
3634 *
3635 */
3636 static void
3638 {
3646 /* Set the set of format specifier strings to use based on whether or not one of the
3647 * brief preferences is chosen */
3654 info_format_in_slot =
3656 info_format_out_slot =
3658 info_format_in_noslot =
3660 info_format_out_noslot =
3669 }
3679 }
3680 }
3682 /**
3683 * @brief f5ethtrailer Dissector registration
3684 *
3685 */
3686 void
3688 {
3691 /* A header field is something you can search/filter on.
3692 *
3693 * We create a structure to register our fields. It consists of an
3694 * array of hf_register_info structures, each of which are of the format
3695 * {&(field id), {name, abrv, type, display, strs, bitmask, blurb, HFILL}}.
3696 */
3701 },
3705 },
3709 },
3713 },
3717 },
3721 },
3725 },
3729 },
3733 },
3735 /* Low parameters */
3739 },
3742 },
3746 },
3750 },
3754 },
3758 },
3762 },
3766 },
3770 },
3774 },
3778 },
3782 },
3786 },
3790 },
3794 },
3798 },
3800 /* Medium parameters */
3804 },
3808 },
3812 },
3816 },
3820 },
3824 },
3828 },
3832 },
3836 },
3840 },
3844 },
3848 },
3852 },
3856 },
3860 },
3864 },
3868 },
3870 /* High parameters */
3874 },
3878 },
3882 },
3886 },
3890 },
3894 },
3898 },
3902 },
3906 },
3910 },
3914 },
3918 },
3922 },
3926 },
3930 },
3934 },
3936 /* Analysis parameters */
3940 },
3945 },
3949 },
3953 },
3955 /* TLS provider parameters */
3959 },
3963 },
3967 },
3971 },
3975 },
3979 },
3981 { "Client Handshake Traffic Secret", "f5ethtrailer.tls.client_hs_secret", FT_BYTES, BASE_NONE, NULL,
3983 },
3985 { "Server Handshake Traffic Secret", "f5ethtrailer.tls.server_hs_secret", FT_BYTES, BASE_NONE, NULL,
3987 },
3989 { "Client Application Traffic Secret", "f5ethtrailer.tls.client_app_secret", FT_BYTES, BASE_NONE, NULL,
3991 },
3993 { "Server Application Traffic Secret", "f5ethtrailer.tls.server_app_secret", FT_BYTES, BASE_NONE, NULL,
3995 },
3999 },
4000 };
4015 };
4021 EXPFILL } },
4028 };
4030 proto_f5ethtrailer = proto_register_protocol("F5 Ethernet Trailer Protocol", "F5 Ethernet trailer", "f5ethtrailer");
4038 /* Register the dissector preferences */
4043 "In a few cases a short ethernet frame will be padded with non-zero"
4044 "bytes. If this happens, an f5ethtrailer will not be found."
4045 "Enabling this will step through each byte of the ethernet trailer"
4051 "Disable this if you do not want this dissector to populate"
4052 " well-known fields in other dissectors (i.e. ip.addr, ipv6.addr,"
4053 " tcp.port and udp.port). Enabling this will allow filters that"
4054 " reference those fields to also find data in the trailers but"
4055 " will reduce performance. After disabling, you should restart"
4061 "Enabling this will perform analysis of the trailer data. It will"
4067 "The settings below affect how information from this dissector is"
4074 "In/out only removes slot/tmm information. Brief shortens the string"
4083 " and '<' for out). If this is not set or is less than two"
4084 " characters, the default is used. If it is longer than two"
4090 "If the platform in the F5 FILEINFO packet matches the provided regex,"
4091 " slot information will be displayed in the info column; otherwise, it"
4093 " empty or there is no platform information in the capture, slot"
4099 "If present, include the RST cause text from the trailer in the "
4105 "If enabled, KEYLOG entries will be added to the TLS decode"
4106 " in the f5ethtrailer protocol tree. It will populate the"
4113 /* Register dissector table for additional providers */
4116 proto_f5ethtrailer_dpt_noise =
4121 proto_f5ethtrailer_dpt_tls =
4127 f5dpt_noise_handle =
4128 register_dissector("f5ethtrailer.noise", dissect_dpt_trailer_noise, proto_f5ethtrailer_dpt_noise);
4129 f5dpt_tls_handle = register_dissector("f5ethtrailer.tls", dissect_dpt_trailer_tls, proto_f5ethtrailer_dpt_tls);
4131 /* Analyze Menu Items */
4132 register_conversation_filter("f5ethtrailer", "F5 TCP", f5_tcp_conv_valid, f5_tcp_conv_filter, NULL);
4133 register_conversation_filter("f5ethtrailer", "F5 UDP", f5_udp_conv_valid, f5_udp_conv_filter, NULL);
4134 register_conversation_filter("f5ethtrailer", "F5 IP", f5_ip_conv_valid, f5_ip_conv_filter, NULL);
4136 /* Register the f5ethtrailer tap for statistics */
4146 /* Setup col info strings */
4150 /**
4151 * @brief f5ethtrailer Dissector handoff function
4152 *
4153 */
4154 void
4156 {
4160 /* Register helper dissectors */
4161 /* Noise Provider */
4173 /* TLS provider */
4186 /* These fields are duplicates of other, well-known fields so that
4187 * filtering on these fields will also pick up data out of the
4188 * trailers.
4189 */
4195 }
4197 /*===============================================================================================*/
4198 /* This section is rendering the F5 tcpdump file properties packet.
4199 *
4200 * Note that this should technically have a protocol tree item, but it does not. The data
4201 * rendered by this dissector should be the only data in the packet. So, rather than requiring
4202 * the user to select the packet and expand the tree to view it, putting the items into the top
4203 * tree essentially renders them expanded. There is no proto_tree_expand_item() sort of call that
4204 * can be used to do this in a data-encapsulated manner (it can be hacked, but I opted for this
4205 * method instead).
4206 */
4208 /* Platform ID to platform name mapping
4209 *
4210 * https://my.f5.com/manage/s/article/K9476
4211 * https://my.f5.com/manage/s/article/K86001294
4212 * https://my.f5.com/manage/s/article/K4309
4213 */
4216 /* rSeries */
4225 /* VELOS */
4229 /* iSeries */
4242 /* Standard series */
4261 /* VIPRION */
4273 /* Herculon */
4278 /* Virtualized platforms*/
4282 };
4283 /* It currently looks like these do not apply. Kept for completeness only */
4284 #if 0
4299 #endif
4301 /**
4302 * @brief Dissector for rendering the F5 tcpdump file properties packet.
4303 *
4304 * This is a heuristic dissector because the Ethernet dissector has a hook
4305 * to pass packets to a dissector before it gets rendered as Ethernet and
4306 * that seems to make sense here. This could be a registered dissector on
4307 * the Ethertype 0x5ff, but this way it can skip a packet and let other
4308 * dissectors have a chance to dissect (and the Ethernet dissector does not
4309 * waste its time rendering Ethernet information for no reason).
4310 *
4311 * TODO: This should return int with how many bytes were consumed.
4312 *
4313 * @param tvb Pointer to tvb
4314 * @param pinfo Pointer to packet info
4315 * @param tree Pointer to protocol tree
4316 * @param data Pointer to data structure (unused)
4317 * @return bool
4318 */
4319 static bool
4321 {
4329 /* Must be the first packet */
4336 }
4338 /* Didn't find the magic at the start of the packet. */
4364 i++;
4366 }
4368 }
4375 proto_tree_add_string_format(tree, hf_fi_platformname, tvb, offset + 6, objlen - 6, platform_name,
4383 }
4390 /**
4391 * @brief F5FILEINFO protocol dissector registration
4392 *
4393 */
4394 void
4396 {
4401 },
4405 },
4409 },
4413 },
4417 },
4421 },
4425 },
4426 };
4428 proto_f5fileinfo = proto_register_protocol("F5 Capture Information", "FILEINFO", "f5fileinfo");
4432 }
4434 /**
4435 * @brief F5FILEINFO dissector handoff
4436 *
4437 */
4438 void
4440 {
4443 }
4445 /*
4446 * Editor modelines - https://www.wireshark.org/tools/modelines.html
4447 *
4448 * Local variables:
4449 * c-basic-offset: 4
4450 * tab-width: 8
4451 * indent-tabs-mode: nil
4452 * End:
4453 *
4454 * vi: set shiftwidth=4 tabstop=8 expandtab:
4455 * :indentSize=4:tabSize=8:noTabs=true:
4456 */