epan/dissectors/packet-hdfs.c

   1 /* packet-hdfs.c
   2  * HDFS Protocol and dissectors
   3  *
   4  * Copyright (c) 2011 by Isilon Systems.
   5  *
   6  * Author: Allison Obourn <aobourn@isilon.com>
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1999 Gerald Combs
  11  *
  12  * SPDX-License-Identifier: GPL-2.0-or-later
  13  */
  14
  15
  16 #include "config.h"
  17
  18 #include <epan/packet.h>
  19 #include <epan/prefs.h>
  20 #include "packet-tcp.h"
  21
  22 void proto_register_hdfs(void);
  23 void proto_reg_handoff_hdfs(void);
  24
  25 #if 0
  26 #define NAMENODE_PORT 8020
  27 #endif
  28
  29 #define REQUEST_STR "hrpc"
  30
  31 #define SEND_DEC 1936027236
  32 #define SEND_OFFSET 13
  33 #define HEAR_DEC 1214603634
  34 #define HEAR_OFFSET 9
  35 #define TBEA_DEC 1952605537
  36 #define TBEA_OFFSET 5
  37 #define T_DEC 116
  38 #define T_OFFSET 1
  39
  40 #define FIRST_READ_FRAGMENT_LEN 15
  41 #define SECOND_READ_FRAGMENT_LEN 29
  42
  43
  44 #if 0
  45 static const int START;
  46 static const int AUTHENTICATION = 1;
  47 static const int DATA = 2;
  48 #endif
  49
  50 static range_t *tcp_ports;
  51
  52 static int proto_hdfs;
  53 static int hf_hdfs_pdu_type;
  54 static int hf_hdfs_flags;
  55 static int hf_hdfs_sequenceno;
  56 static int hf_hdfs_packetno;
  57 static int hf_hdfs_authlen;
  58 static int hf_hdfs_success;
  59 static int hf_hdfs_auth;
  60 static int hf_hdfs_len;
  61 static int hf_hdfs_strcall;
  62 static int hf_hdfs_params;
  63 static int hf_hdfs_paramtype;
  64 static int hf_hdfs_paramval;
  65 static int hf_hdfs_paramvalnum;
  66 /* static int hf_hdfs_rest; */
  67 static int hf_hdfs_fileperm;
  68 static int hf_hdfs_blockloc;
  69 static int hf_hdfs_endblockloc;
  70 static int hf_hdfs_blockgen;
  71 static int hf_hdfs_prover;
  72 static int hf_hdfs_objname;
  73 static int hf_hdfs_filename;
  74 static int hf_hdfs_blockcount;
  75 static int hf_hdfs_ownername;
  76 static int hf_hdfs_groupname;
  77 static int hf_hdfs_namelenone;
  78 static int hf_hdfs_namelentwo;
  79 static int hf_hdfs_accesstime;
  80 static int hf_hdfs_modtime;
  81 static int hf_hdfs_blockrep;
  82 static int hf_hdfs_isdir;
  83 static int hf_hdfs_blocksize;
  84 static int hf_hdfs_filelen;
  85 static int hf_hdfs_construct;
  86 static int hf_hdfs_hostname;
  87 static int hf_hdfs_rackloc;
  88 static int hf_hdfs_adminstate;
  89 static int hf_hdfs_activecon;
  90 static int hf_hdfs_lastupdate;
  91 static int hf_hdfs_remaining;
  92 static int hf_hdfs_dfsused;
  93 static int hf_hdfs_capacity;
  94 static int hf_hdfs_ipcport;
  95 static int hf_hdfs_infoport;
  96 static int hf_hdfs_storageid;
  97 static int hf_hdfs_datanodeid;
  98 static int hf_hdfs_locations;
  99 static int hf_hdfs_offset;
 100 static int hf_hdfs_corrupt;
 101 static int hf_hdfs_identifier;
 102 static int hf_hdfs_password;
 103 static int hf_hdfs_kind;
 104 static int hf_hdfs_service;
 105
 106 static int ett_hdfs;
 107
 108 static dissector_handle_t hdfs_handle;
 109
 110 /* Parses the parameters of a function.
 111    Parses the type length which is always in 2 bytes.
 112    Next the type which is the previously found length.
 113    If this type is variable length it then reads the length of the data
 114    from 2 bytes and then the data.
 115    Otherwise reads just the data. */
 116 static void
 117 dissect_params (tvbuff_t *tvb, proto_tree *hdfs_tree, unsigned offset, int params) {
 118
 119     unsigned length;
 120     int i =  0;
 121     const uint8_t* type_name;
 122     for (i = 0; i < params; i++) {
 123
 124         /* get length that we just dissected */
 125         length = tvb_get_ntohs(tvb, offset);
 126
 127         /* 2 bytes = parameter type length */
 128         proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 129         offset += 2;
 130
 131         /* length bytes = parameter type */
 132         proto_tree_add_item(hdfs_tree, hf_hdfs_paramtype, tvb, offset, length, ENC_ASCII);
 133         offset += length;
 134
 135         if (offset >= length && (!tvb_memeql(tvb, offset - length, (const uint8_t*)"long", length) || !tvb_memeql(tvb, offset - length, (const uint8_t*)"int", length) ||
 136                                  !tvb_memeql(tvb, offset - length, (const uint8_t*)"short", length) || !tvb_memeql(tvb, offset - length, (const uint8_t*)"char", length) ||
 137                                  !tvb_memeql(tvb, offset - length, (const uint8_t*)"byte", length) || !tvb_memeql(tvb, offset - length, (const uint8_t*)"float", length)
 138                                  || !tvb_memeql(tvb, offset - length, (const uint8_t*)"double", length) || !tvb_memeql(tvb, offset - length, (const uint8_t*)"boolean", length))) {
 139
 140             if (!tvb_memeql(tvb, offset - length, (const uint8_t*)"boolean", length)) {
 141                 length = 1;
 142             } else if (!tvb_memeql(tvb, offset - length, (const uint8_t*)"short", length)) {
 143                 length = 2;
 144             } else {
 145                 length = sizeof(type_name);
 146             }
 147
 148             proto_tree_add_item(hdfs_tree, hf_hdfs_paramvalnum, tvb, offset, length, ENC_BIG_ENDIAN);
 149             offset += length;
 150
 151         } else {
 152             /* get length */
 153             length = tvb_get_ntohs(tvb, offset);
 154
 155             /* 2 bytes = parameter value length */
 156             proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 157             offset += 2;
 158
 159             proto_tree_add_item(hdfs_tree, hf_hdfs_paramval, tvb, offset, length, ENC_ASCII);
 160             offset += length;
 161
 162             if (!tvb_memeql(tvb, offset - length, (const uint8_t*)"org.apache.hadoop.fs.permission.FsPermission", length)) {
 163                 proto_tree_add_item(hdfs_tree, hf_hdfs_fileperm, tvb, offset, 2, ENC_BIG_ENDIAN);
 164                 offset += 2;
 165             }
 166         }
 167     }
 168 }
 169
 170
 171 /* Dissects a data packet of the form:
 172    method name length   : 2B
 173    method name          : above value
 174    number of parameters         : 4B
 175     -- list of parameters the length of above --
 176    parameter type length        : 2B
 177    parameter type               : above value
 178    -- if the type is variable size --
 179    parameter value length       : 2B
 180    parameter value              : above value
 181    -- otherwise --
 182    parameter value      : length of the type  */
 183 static void
 184 dissect_data (tvbuff_t *tvb, proto_tree *hdfs_tree, unsigned offset) {
 185     int params = 0;
 186     unsigned length = 0;
 187
 188     /* get length */
 189     length = tvb_get_ntohs(tvb, offset);
 190
 191     /* method name length = 2 B */
 192     proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 193     offset += 2;
 194
 195     /* length bytes = method name */
 196     proto_tree_add_item(hdfs_tree, hf_hdfs_strcall, tvb, offset, length, ENC_ASCII);
 197     offset += length;
 198
 199     /* we only want to parse the packet if it is not a heartbeat (random looking numbers are the decimal
 200        representation of sendHeartbeat */
 201     if (!(tvb_get_ntohl(tvb, offset - SEND_OFFSET) == SEND_DEC && tvb_get_ntohl(tvb, offset - HEAR_OFFSET) == HEAR_DEC &&
 202           tvb_get_ntohl(tvb, offset - TBEA_OFFSET) == TBEA_DEC && tvb_get_uint8(tvb, offset - T_OFFSET) == T_DEC)) {
 203
 204         /* get number of params */
 205         params = tvb_get_ntohl(tvb, offset);
 206
 207         /* 4 bytes = # of parameters */
 208         proto_tree_add_item(hdfs_tree, hf_hdfs_params, tvb, offset, 4, ENC_BIG_ENDIAN);
 209         offset += 4;
 210
 211         /* go through all params and dissect their type length, type, value length and value */
 212         dissect_params (tvb, hdfs_tree, offset, params);
 213     }
 214 }
 215
 216 /*
 217 response to a get protocol version message
 218 contains a type length, type name and the value
 219 */
 220 static int
 221 dissect_resp_long (tvbuff_t *tvb, proto_tree *hdfs_tree, int offset) {
 222     /* get length that we just dissected */
 223     int length = tvb_get_ntohs(tvb, offset);
 224
 225     /* 2 bytes = parameter type length */
 226     proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 227     offset += 2;
 228
 229     /* length bytes = parameter type */
 230     proto_tree_add_item(hdfs_tree, hf_hdfs_paramtype, tvb, offset, length, ENC_ASCII);
 231     offset += length;
 232
 233     /* the value */
 234     proto_tree_add_item(hdfs_tree, hf_hdfs_prover, tvb, offset, 8, ENC_BIG_ENDIAN);
 235     offset += 8;
 236
 237     return offset;
 238 }
 239
 240 /*
 241 Response to a file status message
 242 */
 243 static int
 244 dissect_resp_filestatus (tvbuff_t *tvb, proto_tree *hdfs_tree, int offset) {
 245
 246     int length;
 247
 248     /* file status */
 249     proto_tree_add_item(hdfs_tree, hf_hdfs_fileperm, tvb, offset, 2, ENC_BIG_ENDIAN);
 250     offset += 2;
 251
 252     /* get length */
 253     length = tvb_get_ntohs(tvb, offset);
 254
 255     /* 2 bytes = file name length */
 256     proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 257     offset += 2;
 258
 259     /* file name */
 260     proto_tree_add_item(hdfs_tree, hf_hdfs_filename, tvb, offset, length, ENC_ASCII);
 261     offset += length;
 262
 263
 264     /* 8 file size / end location  */
 265     proto_tree_add_item(hdfs_tree, hf_hdfs_endblockloc, tvb, offset, 8, ENC_BIG_ENDIAN);
 266     offset += 8;
 267
 268     /* is directory */
 269     proto_tree_add_item(hdfs_tree, hf_hdfs_isdir, tvb, offset, 1, ENC_BIG_ENDIAN);
 270     offset += 1;
 271
 272     /* block replication factor */
 273     proto_tree_add_item(hdfs_tree, hf_hdfs_blockrep, tvb, offset, 2, ENC_BIG_ENDIAN);
 274     offset += 2;
 275
 276     /* block size */
 277     proto_tree_add_item(hdfs_tree, hf_hdfs_blocksize, tvb, offset, 8, ENC_BIG_ENDIAN);
 278     offset += 8;
 279
 280     /* modified time */
 281     proto_tree_add_item(hdfs_tree, hf_hdfs_modtime, tvb, offset, 8, ENC_BIG_ENDIAN);
 282     offset += 8;
 283
 284     /* access time */
 285     proto_tree_add_item(hdfs_tree, hf_hdfs_accesstime, tvb, offset, 8, ENC_BIG_ENDIAN);
 286     offset += 8;
 287
 288     /* 2 of file permissions */
 289     proto_tree_add_item(hdfs_tree, hf_hdfs_fileperm, tvb, offset, 2, ENC_BIG_ENDIAN);
 290     offset += 2;
 291
 292
 293     /* get length */
 294     length = tvb_get_uint8 (tvb, offset);
 295
 296     /* owner name length */
 297     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 298     offset += 1;
 299
 300     /* owner name */
 301     proto_tree_add_item(hdfs_tree, hf_hdfs_ownername, tvb, offset, length, ENC_ASCII);
 302     offset += length;
 303
 304     /* get length */
 305     length = tvb_get_uint8 (tvb, offset);
 306
 307     /* group name length */
 308     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 309     offset += 1;
 310
 311     /* group name */
 312     proto_tree_add_item(hdfs_tree, hf_hdfs_groupname, tvb, offset, length, ENC_ASCII);
 313     offset += length;
 314
 315     return offset;
 316 }
 317
 318
 319 /*
 320 Response to the get block info message
 321 parses the sent back information about each blcok
 322 */
 323 static int
 324 dissect_block_info (tvbuff_t *tvb, proto_tree *hdfs_tree, int offset) {
 325
 326     int length;
 327
 328     length = tvb_get_uint8(tvb, offset);
 329
 330     /* identifier length */
 331     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 332     offset += 1;
 333
 334     /* identifier */
 335     proto_tree_add_item(hdfs_tree, hf_hdfs_identifier, tvb, offset, length, ENC_ASCII);
 336     offset += length;
 337
 338     length = tvb_get_uint8(tvb, offset);
 339
 340     /* password length */
 341     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 342     offset += 1;
 343
 344     /* password */
 345     proto_tree_add_item(hdfs_tree, hf_hdfs_password, tvb, offset, length, ENC_ASCII);
 346     offset += length;
 347
 348     length = tvb_get_uint8(tvb, offset);
 349
 350     /* kind length */
 351     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 352     offset += 1;
 353
 354     /* kind */
 355     proto_tree_add_item(hdfs_tree, hf_hdfs_kind, tvb, offset, length, ENC_ASCII);
 356     offset += length;
 357
 358     length = tvb_get_uint8(tvb, offset);
 359
 360     /* service length */
 361     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 362     offset += 1;
 363
 364     /* service */
 365     proto_tree_add_item(hdfs_tree, hf_hdfs_service, tvb, offset, length, ENC_ASCII);
 366     offset += length;
 367
 368     /* corrupt */
 369     proto_tree_add_item(hdfs_tree, hf_hdfs_corrupt, tvb, offset, 1, ENC_BIG_ENDIAN);
 370     offset += 1;
 371
 372     /* offset */
 373     proto_tree_add_item(hdfs_tree, hf_hdfs_offset, tvb, offset, 8, ENC_BIG_ENDIAN);
 374     offset += 8;
 375
 376
 377     /* block info section */
 378
 379     /* block location */
 380     proto_tree_add_item(hdfs_tree, hf_hdfs_blockloc, tvb, offset, 8, ENC_BIG_ENDIAN);
 381     offset += 8;
 382
 383     /* block size */
 384     proto_tree_add_item(hdfs_tree, hf_hdfs_blocksize, tvb, offset, 8, ENC_BIG_ENDIAN);
 385     offset += 8;
 386
 387     /* gen id 8 */
 388     proto_tree_add_item(hdfs_tree, hf_hdfs_blockgen, tvb, offset, 8, ENC_BIG_ENDIAN);
 389     offset += 8;
 390
 391     /* locations */
 392     proto_tree_add_item(hdfs_tree, hf_hdfs_locations, tvb, offset, 4, ENC_BIG_ENDIAN);
 393     offset += 4;
 394
 395
 396     /* address section */
 397
 398     /* get length */
 399     length = tvb_get_ntohs(tvb, offset);
 400
 401     /* length of addr */
 402     proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 403     offset += 2;
 404
 405     /* datanode id */
 406     proto_tree_add_item(hdfs_tree, hf_hdfs_datanodeid, tvb, offset, length, ENC_ASCII);
 407     offset += length;
 408
 409     length = tvb_get_ntohs(tvb, offset);
 410
 411     /* length of addr */
 412     proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 413     offset += 2;
 414
 415     /* storageid */
 416     proto_tree_add_item(hdfs_tree, hf_hdfs_storageid, tvb, offset, length, ENC_ASCII);
 417     offset += length;
 418
 419     /* info port */
 420     proto_tree_add_item(hdfs_tree, hf_hdfs_infoport, tvb, offset, 2, ENC_BIG_ENDIAN);
 421     offset += 2;
 422
 423
 424     /* default name node port */
 425     proto_tree_add_item(hdfs_tree, hf_hdfs_ipcport, tvb, offset, 2, ENC_BIG_ENDIAN);
 426     offset += 2;
 427
 428     /* capacity */
 429     proto_tree_add_item(hdfs_tree, hf_hdfs_capacity, tvb, offset, 8, ENC_BIG_ENDIAN);
 430     offset += 8;
 431
 432     /* dfs used */
 433     proto_tree_add_item(hdfs_tree, hf_hdfs_dfsused, tvb, offset, 8, ENC_BIG_ENDIAN);
 434     offset += 8;
 435
 436     /* remaining */
 437     proto_tree_add_item(hdfs_tree, hf_hdfs_remaining, tvb, offset, 8, ENC_BIG_ENDIAN);
 438     offset += 8;
 439
 440     /* last update */
 441     proto_tree_add_item(hdfs_tree, hf_hdfs_lastupdate, tvb, offset, 8, ENC_BIG_ENDIAN);
 442     offset += 8;
 443
 444     /* num active connections */
 445     proto_tree_add_item(hdfs_tree, hf_hdfs_activecon, tvb, offset, 4, ENC_BIG_ENDIAN);
 446     offset += 4;
 447
 448
 449     length = tvb_get_uint8(tvb, offset);
 450
 451     /* location rack length */
 452     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 453     offset += 1;
 454
 455     /* location rack */
 456     proto_tree_add_item(hdfs_tree, hf_hdfs_rackloc, tvb, offset, length, ENC_ASCII);
 457     offset += length;
 458
 459     length = tvb_get_uint8(tvb, offset);
 460
 461     /* hostname length */
 462     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 463     offset += 1;
 464
 465     /* hostname */
 466     proto_tree_add_item(hdfs_tree, hf_hdfs_hostname, tvb, offset, length, ENC_ASCII);
 467     offset += length;
 468
 469     length = tvb_get_uint8(tvb, offset);
 470
 471     /* admin state length */
 472     proto_tree_add_item(hdfs_tree, hf_hdfs_namelenone, tvb, offset, 1, ENC_BIG_ENDIAN);
 473     offset += 1;
 474
 475     /* admin state */
 476     proto_tree_add_item(hdfs_tree, hf_hdfs_adminstate, tvb, offset, length, ENC_ASCII);
 477     offset += length;
 478
 479     return offset;
 480
 481 }
 482
 483
 484
 485 /*
 486 dissects the response from get block info.
 487 */
 488 static void
 489 dissect_resp_locatedblocks (tvbuff_t *tvb, proto_tree *hdfs_tree, int offset) {
 490
 491
 492     /* file length = 8  */
 493     proto_tree_add_item(hdfs_tree, hf_hdfs_filelen, tvb, offset, 8, ENC_BIG_ENDIAN);
 494     offset += 8;
 495
 496     /* under construction = 1  */
 497     proto_tree_add_item(hdfs_tree, hf_hdfs_construct, tvb, offset, 1, ENC_BIG_ENDIAN);
 498     offset += 1;
 499
 500     /* number of blocks */
 501     proto_tree_add_item(hdfs_tree, hf_hdfs_blockcount, tvb, offset, 4, ENC_BIG_ENDIAN);
 502     offset += 4;
 503
 504     /* dissect info for each block */
 505     while (tvb_reported_length(tvb) - offset > 0) {
 506         offset = dissect_block_info (tvb, hdfs_tree, offset);
 507     }
 508
 509 }
 510
 511
 512 static int
 513 dissect_hdfs_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 514 {
 515     unsigned offset = 0;
 516     int success = 0;
 517     unsigned length = 0;
 518
 519
 520     col_set_str(pinfo->cinfo, COL_PROTOCOL, "HDFS");
 521     /* Clear out stuff in the info column */
 522     col_clear(pinfo->cinfo,COL_INFO);
 523
 524     if (tree) {
 525
 526         proto_item *ti;
 527         proto_tree *hdfs_tree;
 528
 529         ti = proto_tree_add_item(tree, proto_hdfs, tvb, 0, -1, ENC_NA);
 530         hdfs_tree = proto_item_add_subtree(ti, ett_hdfs);
 531
 532         /* Response */
 533         if (value_is_in_range(tcp_ports, pinfo->srcport)) {
 534             /* 4 bytes = sequence number */
 535             proto_tree_add_item(hdfs_tree, hf_hdfs_packetno, tvb, offset, 4, ENC_BIG_ENDIAN);
 536             offset += 4;
 537
 538             /* 4 bytes = status -> 0000 = success, 0001 = error, ffff = fatal */
 539             success = tvb_get_ntohl(tvb, offset);
 540             proto_tree_add_item(hdfs_tree, hf_hdfs_success, tvb, offset, 4, ENC_BIG_ENDIAN);
 541             offset += 4;
 542
 543             if (success != 0) {
 544                 return offset;
 545             }
 546
 547             if (!tvb_memeql(tvb, offset + 2, (const uint8_t*)"long", 4)) {
 548                 dissect_resp_long (tvb, hdfs_tree,  offset);
 549
 550             } else {
 551
 552                 /* name length = 2 B */
 553                 length = tvb_get_ntohs(tvb, offset);
 554                 proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 555                 offset += 2;
 556
 557                 /* length bytes = method name */
 558                 proto_tree_add_item(hdfs_tree, hf_hdfs_objname, tvb, offset, length, ENC_ASCII);
 559                 offset += length;
 560
 561                 /* get length that we just dissected */
 562                 length = tvb_get_ntohs(tvb, offset);
 563
 564                 /* 2 bytes = objects length */
 565                 proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 566                 offset += 2;
 567
 568                 /* length bytes = object name */
 569                 proto_tree_add_item(hdfs_tree, hf_hdfs_objname, tvb, offset, length, ENC_ASCII);
 570                 offset += length;
 571
 572                 /* responses about block location info */
 573                 if (!tvb_memeql(tvb, offset - length, (const uint8_t*)"org.apache.hadoop.hdfs.protocol.LocatedBlocks", length)) {
 574                     dissect_resp_locatedblocks (tvb, hdfs_tree, offset);
 575
 576                     /* responses about file statuses */
 577                 } else if (!tvb_memeql(tvb, offset - length, (const uint8_t*)"org.apache.hadoop.hdfs.protocol.HdfsFileStatus", length)) {
 578                     dissect_resp_filestatus (tvb, hdfs_tree, offset);
 579
 580                 } else {
 581                     /* get length */
 582                     length = tvb_get_ntohs(tvb, offset);
 583
 584                     /* 2 bytes = parameter value length */
 585                     proto_tree_add_item(hdfs_tree, hf_hdfs_namelentwo, tvb, offset, 2, ENC_BIG_ENDIAN);
 586                     offset += 2;
 587
 588                     /* the value of the parameter */
 589                     proto_tree_add_item(hdfs_tree, hf_hdfs_paramval, tvb, offset, length, ENC_ASCII);
 590                     /*offset += length;*/
 591                 }
 592             }
 593
 594             /* Request to namenode */
 595         } else {
 596
 597             /* check the packet length */
 598             unsigned auth = tvb_get_ntohl(tvb, offset);
 599
 600             /* first setup packet starts with "hrpc" */
 601             if (!tvb_memeql(tvb, offset, (const uint8_t*)REQUEST_STR, sizeof(REQUEST_STR) - 1)) {
 602
 603                 proto_tree_add_item(hdfs_tree, hf_hdfs_sequenceno, tvb, offset, sizeof(REQUEST_STR) - 1, ENC_ASCII);
 604                 offset += (int)sizeof(REQUEST_STR) - 1;
 605
 606                 proto_tree_add_item(hdfs_tree, hf_hdfs_pdu_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 607                 offset += 1;
 608
 609                 proto_tree_add_item(hdfs_tree, hf_hdfs_flags, tvb, offset, 1, ENC_BIG_ENDIAN);
 610                 /*offset += 1;*/
 611
 612             } else {
 613                 /* second authentication packet */
 614                 if (auth + 4 != tvb_reported_length(tvb)) {
 615
 616                     /* authentication length (read out of first 4 bytes) */
 617                     length = tvb_get_ntohl(tvb, offset);
 618                     proto_tree_add_item(hdfs_tree, hf_hdfs_authlen, tvb, offset, 4, ENC_ASCII);
 619                     offset += 4;
 620
 621                     /* authentication (length the number we just got) */
 622                     proto_tree_add_item(hdfs_tree, hf_hdfs_auth, tvb, offset, length, ENC_ASCII);
 623                     offset += length;
 624                 }
 625
 626                 /* data packets */
 627
 628                 /* 4 bytes = length */
 629                 proto_tree_add_item(hdfs_tree, hf_hdfs_len, tvb, offset, 4, ENC_BIG_ENDIAN);
 630                 offset += 4;
 631
 632                 /* 4 bytes = sequence number */
 633                 proto_tree_add_item(hdfs_tree, hf_hdfs_packetno, tvb, offset, 4, ENC_BIG_ENDIAN);
 634                 offset += 4;
 635
 636                 /* dissect packet data */
 637                 dissect_data (tvb, hdfs_tree, offset);
 638             }
 639         }
 640     }
 641     return tvb_captured_length(tvb);
 642 }
 643
 644 /* determine PDU length of protocol  */
 645 static unsigned get_hdfs_message_len(packet_info *pinfo _U_, tvbuff_t *tvb,
 646                                   int offset _U_, void *data _U_)
 647 {
 648     int len = tvb_reported_length(tvb);
 649
 650     if (tvb_reported_length(tvb) == 1448 || tvb_reported_length(tvb) == 1321) {
 651         len = 150 * tvb_get_ntohs(tvb, 113) + 115 ;
 652     }
 653
 654     return len;
 655
 656 }
 657
 658 static int
 659 dissect_hdfs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 660 {
 661     int frame_header_len = 0;
 662     bool need_reassemble = false;
 663
 664     frame_header_len = tvb_reported_length(tvb);
 665
 666     if (frame_header_len == 1448 || frame_header_len ==  1321) {
 667         need_reassemble = true;
 668     }
 669
 670     tcp_dissect_pdus(tvb, pinfo, tree, need_reassemble, frame_header_len, get_hdfs_message_len, dissect_hdfs_message, data);
 671     return tvb_captured_length(tvb);
 672 }
 673
 674 static void
 675 apply_hdfs_prefs(void)
 676 {
 677   /* HDFS uses the port preference to determine request/response */
 678   tcp_ports = prefs_get_range_value("hdfs", "tcp.port");
 679 }
 680
 681 /* registers the protcol with the given names */
 682 void
 683 proto_register_hdfs(void)
 684 {
 685
 686     static hf_register_info hf[] = {
 687
 688         /* list of all options for dissecting the protocol */
 689
 690         /*************************************************
 691         First packet
 692         **************************************************/
 693         { &hf_hdfs_sequenceno,
 694           { "HDFS protocol type", "hdfs.type",
 695             FT_STRING, BASE_NONE,
 696             NULL, 0x0,
 697             NULL, HFILL }
 698         },
 699         { &hf_hdfs_pdu_type,
 700           { "HDFS protocol version", "hdfs.version",
 701             FT_UINT8, BASE_DEC,
 702             NULL, 0x0,
 703             NULL, HFILL }
 704         },
 705         { &hf_hdfs_flags,
 706           { "HDFS authentication type", "hdfs.auth_type",
 707             FT_UINT8, BASE_DEC,
 708             NULL, 0x0,
 709             NULL, HFILL }
 710         },
 711         /***********************************************
 712         Authentication packet
 713         ***********************************************/
 714         { &hf_hdfs_authlen,
 715           { "HDFS authentication length", "hdfs.authlen",
 716             FT_STRING, BASE_NONE,
 717             NULL, 0x0,
 718             NULL, HFILL }
 719         },
 720         { &hf_hdfs_auth,
 721           { "HDFS authorization bits", "hdfs.auth",
 722             FT_STRING, BASE_NONE,
 723             NULL, 0x0,
 724             NULL, HFILL }
 725         },
 726         /**********************************************
 727         Response
 728         **********************************************/
 729         { &hf_hdfs_packetno,
 730           { "HDFS packet number", "hdfs.seqno",
 731             FT_UINT32, BASE_DEC,
 732             NULL, 0x0,
 733             NULL, HFILL }
 734         },
 735         { &hf_hdfs_success,
 736           { "HDFS success", "hdfs.success",
 737             FT_UINT32, BASE_DEC,
 738             NULL, 0x0,
 739             NULL, HFILL }
 740         },
 741         { &hf_hdfs_strcall,
 742           { "HDFS method name", "hdfs.strcall",
 743             FT_STRING, BASE_NONE,
 744             NULL, 0x0,
 745             NULL, HFILL }
 746         },
 747 #if 0
 748         { &hf_hdfs_rest,
 749           { "HDFS value", "hdfs.rest",
 750             FT_STRING, BASE_NONE,
 751             NULL, 0x0,
 752             NULL, HFILL }
 753         },
 754 #endif
 755         { &hf_hdfs_blockloc,
 756           { "HDFS block location", "hdfs.blockloc",
 757             FT_UINT64, BASE_DEC,
 758             NULL, 0x0,
 759             NULL, HFILL }
 760         },
 761         { &hf_hdfs_blocksize,
 762           { "HDFS block size", "hdfs.blocksize",
 763             FT_UINT64, BASE_DEC,
 764             NULL, 0x0,
 765             NULL, HFILL }
 766         },
 767         { &hf_hdfs_endblockloc,
 768           { "HDFS file size", "hdfs.endblockloc",
 769             FT_UINT64, BASE_DEC,
 770             NULL, 0x0,
 771             NULL, HFILL }
 772         },
 773         { &hf_hdfs_blockgen,
 774           { "HDFS block gen", "hdfs.blockgen",
 775             FT_UINT64, BASE_DEC,
 776             NULL, 0x0,
 777             NULL, HFILL }
 778         },
 779         { &hf_hdfs_prover,
 780           { "HDFS protocol version", "hdfs.prover",
 781             FT_UINT64, BASE_DEC,
 782             NULL, 0x0,
 783             NULL, HFILL }
 784         },
 785         { &hf_hdfs_objname,
 786           { "HDFS object name", "hdfs.objname",
 787             FT_STRING, BASE_NONE,
 788             NULL, 0x0,
 789             NULL, HFILL }
 790         },
 791         { &hf_hdfs_filename,
 792           { "HDFS file name", "hdfs.filename",
 793             FT_STRING, BASE_NONE,
 794             NULL, 0x0,
 795             NULL, HFILL }
 796         },
 797         { &hf_hdfs_blockcount,
 798           { "HDFS block count", "hdfs.blockcount",
 799             FT_UINT32, BASE_DEC,
 800             NULL, 0x0,
 801             NULL, HFILL }
 802         },
 803         { &hf_hdfs_ownername,
 804           { "HDFS owner name", "hdfs.ownername",
 805             FT_STRING, BASE_NONE,
 806             NULL, 0x0,
 807             NULL, HFILL }
 808         },
 809         { &hf_hdfs_groupname,
 810           { "HDFS group name", "hdfs.groupname",
 811             FT_STRING, BASE_NONE,
 812             NULL, 0x0,
 813             NULL, HFILL }
 814         },
 815         { &hf_hdfs_accesstime,
 816           { "HDFS access time", "hdfs.accesstime",
 817             FT_UINT64, BASE_DEC,
 818             NULL, 0x0,
 819             NULL, HFILL }
 820         },
 821         { &hf_hdfs_modtime,
 822           { "HDFS modified time", "hdfs.modtime",
 823             FT_UINT64, BASE_DEC,
 824             NULL, 0x0,
 825             NULL, HFILL }
 826         },
 827         { &hf_hdfs_blockrep,
 828           { "HDFS block replication factor", "hdfs.blockrep",
 829             FT_UINT16, BASE_DEC,
 830             NULL, 0x0,
 831             NULL, HFILL }
 832         },
 833         { &hf_hdfs_isdir,
 834           { "HDFS is directory", "hdfs.isdir",
 835             FT_UINT8, BASE_DEC,
 836             NULL, 0x0,
 837             NULL, HFILL }
 838         },
 839         { &hf_hdfs_filelen,
 840           { "HDFS file length", "hdfs.filelen",
 841             FT_UINT64, BASE_DEC,
 842             NULL, 0x0,
 843             NULL, HFILL }
 844         },
 845         { &hf_hdfs_construct,
 846           { "HDFS under construction", "hdfs.construct",
 847             FT_UINT8, BASE_DEC,
 848             NULL, 0x0,
 849             NULL, HFILL }
 850         },
 851         { &hf_hdfs_rackloc,
 852           { "HDFS rack location", "hdfs.rackloc",
 853             FT_STRING, BASE_NONE,
 854             NULL, 0x0,
 855             NULL, HFILL }
 856         },
 857         { &hf_hdfs_adminstate,
 858           { "HDFS admin state", "hdfs.adminstate",
 859             FT_STRING, BASE_NONE,
 860             NULL, 0x0,
 861             NULL, HFILL }
 862         },
 863         { &hf_hdfs_hostname,
 864           { "HDFS hostname", "hdfs.hostname",
 865             FT_STRING, BASE_NONE,
 866             NULL, 0x0,
 867             NULL, HFILL }
 868         },
 869
 870
 871         { &hf_hdfs_namelenone,
 872           { "HDFS name length", "hdfs.namelenone",
 873             FT_UINT8, BASE_DEC,
 874             NULL, 0x0,
 875             NULL, HFILL }
 876         },
 877         { &hf_hdfs_namelentwo,
 878           { "HDFS name length", "hdfs.namelentwo",
 879             FT_UINT16, BASE_DEC,
 880             NULL, 0x0,
 881             NULL, HFILL }
 882         },
 883
 884
 885         /***************************************
 886         file info response
 887         ***************************************/
 888         { &hf_hdfs_activecon,
 889           { "HDFS active connections", "hdfs.activecon",
 890             FT_UINT32, BASE_DEC,
 891             NULL, 0x0,
 892             NULL, HFILL }
 893         },
 894         { &hf_hdfs_lastupdate,
 895           { "HDFS lastupdate", "hdfs.lastupdate",
 896             FT_UINT64, BASE_DEC,
 897             NULL, 0x0,
 898             NULL, HFILL }
 899         },
 900         { &hf_hdfs_remaining,
 901           { "HDFS remaining", "hdfs.remaining",
 902             FT_UINT64, BASE_DEC,
 903             NULL, 0x0,
 904             NULL, HFILL }
 905         },
 906         { &hf_hdfs_dfsused,
 907           { "HDFS dfs used", "hdfs.dfsused",
 908             FT_UINT64, BASE_DEC,
 909             NULL, 0x0,
 910             NULL, HFILL }
 911         },
 912         { &hf_hdfs_capacity,
 913           { "HDFS capacity", "hdfs.capacity",
 914             FT_UINT64, BASE_DEC,
 915             NULL, 0x0,
 916             NULL, HFILL }
 917         },
 918         { &hf_hdfs_ipcport,
 919           { "HDFS ipcport", "hdfs.ipcport",
 920             FT_UINT16, BASE_DEC,
 921             NULL, 0x0,
 922             NULL, HFILL }
 923         },
 924         { &hf_hdfs_infoport,
 925           { "HDFS info port", "hdfs.infoport",
 926             FT_UINT16, BASE_DEC,
 927             NULL, 0x0,
 928             NULL, HFILL }
 929         },
 930         { &hf_hdfs_storageid,
 931           { "HDFS storage id", "hdfs.storageid",
 932             FT_STRING, BASE_NONE,
 933             NULL, 0x0,
 934             NULL, HFILL }
 935         },
 936         { &hf_hdfs_datanodeid,
 937           { "HDFS datanodeid", "hdfs.datanodeid",
 938             FT_STRING, BASE_NONE,
 939             NULL, 0x0,
 940             NULL, HFILL }
 941         },
 942         { &hf_hdfs_locations,
 943           { "HDFS locations", "hdfs.locations",
 944             FT_UINT32, BASE_DEC,
 945             NULL, 0x0,
 946             NULL, HFILL }
 947         },
 948
 949         { &hf_hdfs_identifier,
 950           { "HDFS locations", "hdfs.identifier",
 951             FT_STRING, BASE_NONE,
 952             NULL, 0x0,
 953             NULL, HFILL }
 954         },
 955         { &hf_hdfs_password,
 956           { "HDFS password", "hdfs.password",
 957             FT_STRING, BASE_NONE,
 958             NULL, 0x0,
 959             NULL, HFILL }
 960         },
 961         { &hf_hdfs_kind,
 962           { "HDFS kind", "hdfs.kind",
 963             FT_STRING, BASE_NONE,
 964             NULL, 0x0,
 965             NULL, HFILL }
 966         },
 967         { &hf_hdfs_service,
 968           { "HDFS locations", "hdfs.service",
 969             FT_STRING, BASE_NONE,
 970             NULL, 0x0,
 971             NULL, HFILL }
 972         },
 973         { &hf_hdfs_corrupt,
 974           { "HDFS corrupt", "hdfs.corrupt",
 975             FT_UINT8, BASE_DEC,
 976             NULL, 0x0,
 977             NULL, HFILL }
 978         },
 979         { &hf_hdfs_offset,
 980           { "HDFS offset", "hdfs.offset",
 981             FT_UINT64, BASE_DEC,
 982             NULL, 0x0,
 983             NULL, HFILL }
 984         },
 985
 986
 987         /***********************************************
 988         Data request
 989         ***********************************************/
 990         { &hf_hdfs_len,
 991           { "HDFS length", "hdfs.len",
 992             FT_UINT32, BASE_DEC,
 993             NULL, 0x0,
 994             NULL, HFILL }
 995         },
 996         /* packet number, same as in response
 997            method name length, same as in response
 998            string call, same as in response */
 999         { &hf_hdfs_params,
1000           { "HDFS number of parameters", "hdfs.params",
1001             FT_UINT32, BASE_DEC,
1002             NULL, 0x0,
1003             NULL, HFILL }
1004         },
1005         { &hf_hdfs_paramtype,
1006           { "HDFS parameter type", "hdfs.paramtype",
1007             FT_STRING, BASE_NONE,
1008             NULL, 0x0,
1009             NULL, HFILL }
1010         },
1011         { &hf_hdfs_paramval,
1012           { "HDFS parameter value", "hdfs.paramval",
1013             FT_STRING, BASE_NONE,
1014             NULL, 0x0,
1015             NULL, HFILL }
1016         },
1017         /* param value that is displayed as a number not a string */
1018         { &hf_hdfs_paramvalnum,
1019           { "HDFS parameter value", "hdfs.paramvalnum",
1020             FT_INT64, BASE_DEC,
1021             NULL, 0x0,
1022             NULL, HFILL }
1023         },
1024         { &hf_hdfs_fileperm,
1025           { "HDFS File permission", "hdfs.fileperm",
1026             FT_INT16, BASE_DEC,
1027             NULL, 0x0,
1028             NULL, HFILL }
1029         },
1030
1031     };
1032
1033     /* Setup protocol subtree array */
1034     static int *ett[] = {
1035         &ett_hdfs
1036     };
1037
1038     proto_hdfs = proto_register_protocol ("HDFS Protocol", "HDFS", "hdfs");
1039
1040     proto_register_field_array(proto_hdfs, hf, array_length(hf));
1041     proto_register_subtree_array(ett, array_length(ett));
1042
1043     prefs_register_protocol(proto_hdfs, apply_hdfs_prefs);
1044     hdfs_handle = register_dissector("hdfs", dissect_hdfs, proto_hdfs);
1045 }
1046
1047 /* registers handoff */
1048 void
1049 proto_reg_handoff_hdfs(void)
1050 {
1051     dissector_add_for_decode_as_with_preference("tcp.port", hdfs_handle);
1052     apply_hdfs_prefs();
1053 }
1054 /*
1055  * Editor modelines
1056  *
1057  * Local Variables:
1058  * c-basic-offset: 4
1059  * tab-width: 8
1060  * indent-tabs-mode: nil
1061  * End:
1062  *
1063  * ex: set shiftwidth=4 tabstop=8 expandtab:
1064  * :indentSize=4:tabSize=8:noTabs=true:
1065  */