epan/dissectors/packet-moldudp.c

   1 /* packet-moldudp.c
   2  * Routines for MoldUDP dissection
   3  * Copyright 2012, Evan Huus <eapache@gmail.com>
   4  *
   5  * http://www.nasdaqtrader.com/content/technicalsupport/specifications/dataproducts/moldudp.pdf
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * SPDX-License-Identifier: GPL-2.0-or-later
  12  */
  13
  14 #include "config.h"
  15
  16 #include <epan/packet.h>
  17 #include <epan/expert.h>
  18 #include <epan/decode_as.h>
  19
  20 void proto_register_moldudp(void);
  21 void proto_reg_handoff_moldudp(void);
  22
  23 static dissector_handle_t moldudp_handle;
  24
  25 /* Initialize the protocol and registered fields */
  26 static int proto_moldudp;
  27 static int hf_moldudp_session;
  28 static int hf_moldudp_sequence;
  29 static int hf_moldudp_count;
  30 static int hf_moldudp_msgblk;
  31 static int hf_moldudp_msgseq;
  32 static int hf_moldudp_msglen;
  33 static int hf_moldudp_msgdata;
  34
  35 #define MOLDUDP_SESSION_LEN  10
  36 #define MOLDUDP_SEQUENCE_LEN  4
  37 #define MOLDUDP_COUNT_LEN     2
  38 #define MOLDUDP_MSGLEN_LEN    2
  39
  40 #define MOLDUDP_HEARTBEAT 0x0000
  41
  42 /* Initialize the subtree pointers */
  43 static int ett_moldudp;
  44 static int ett_moldudp_msgblk;
  45
  46 static expert_field ei_moldudp_msglen_invalid;
  47 static expert_field ei_moldudp_count_invalid;
  48
  49 static dissector_table_t moldudp_payload_table;
  50
  51 static void moldudp_prompt(packet_info *pinfo _U_, char* result)
  52 {
  53     snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Payload as");
  54 }
  55
  56 /* Code to dissect a message block */
  57 static unsigned
  58 dissect_moldudp_msgblk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
  59         unsigned offset, uint32_t sequence)
  60 {
  61     proto_item *ti;
  62     proto_tree *blk_tree;
  63     uint16_t    msglen, real_msglen, whole_len;
  64     unsigned    remaining;
  65     tvbuff_t*   next_tvb;
  66
  67     if (tvb_reported_length(tvb) - offset < MOLDUDP_MSGLEN_LEN)
  68         return 0;
  69
  70     msglen = tvb_get_letohs(tvb, offset);
  71     remaining = tvb_reported_length(tvb) - offset - MOLDUDP_MSGLEN_LEN;
  72
  73     if (msglen == 0)
  74         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP Messages (End Of Session)");
  75
  76     if (tvb_reported_length(tvb) < (offset + MOLDUDP_MSGLEN_LEN))
  77         real_msglen = 0;
  78     else if (msglen <= remaining)
  79         real_msglen = msglen;
  80     else
  81         real_msglen = remaining;
  82
  83     /* msglen and real_msglen only count the data section, and don't
  84      * include the two bytes for the length field itself. */
  85     whole_len = real_msglen + MOLDUDP_MSGLEN_LEN;
  86
  87     ti = proto_tree_add_item(tree, hf_moldudp_msgblk,
  88             tvb, offset, whole_len, ENC_NA);
  89
  90     blk_tree = proto_item_add_subtree(ti, ett_moldudp_msgblk);
  91
  92     ti = proto_tree_add_uint(blk_tree, hf_moldudp_msgseq,
  93             tvb, offset, 0, sequence);
  94
  95     proto_item_set_generated(ti);
  96
  97     ti = proto_tree_add_item(blk_tree, hf_moldudp_msglen,
  98             tvb, offset, MOLDUDP_MSGLEN_LEN, ENC_LITTLE_ENDIAN);
  99
 100     if (msglen != real_msglen)
 101         expert_add_info_format(pinfo, ti, &ei_moldudp_msglen_invalid,
 102                 "Invalid Message Length (claimed %u, found %u)",
 103                 msglen, real_msglen);
 104
 105     offset += MOLDUDP_MSGLEN_LEN;
 106
 107
 108     /* Functionality for choosing subdissector is controlled through Decode As as MoldUDP doesn't
 109        have a unique identifier to determine subdissector */
 110     next_tvb = tvb_new_subset_length(tvb, offset, real_msglen);
 111     if (!dissector_try_payload_with_data(moldudp_payload_table, next_tvb, pinfo, tree, false, NULL))
 112     {
 113         proto_tree_add_item(blk_tree, hf_moldudp_msgdata,
 114                 tvb, offset, real_msglen, ENC_NA);
 115     }
 116
 117     return whole_len;
 118 }
 119
 120 /* Code to actually dissect the packets */
 121 static int
 122 dissect_moldudp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 123 {
 124     proto_item *ti;
 125     proto_tree *moldudp_tree;
 126     unsigned    offset            = 0;
 127     uint16_t    count, real_count = 0;
 128     uint32_t    sequence;
 129
 130     /* Check that there's enough data */
 131     if (tvb_reported_length(tvb) < (MOLDUDP_SESSION_LEN  +
 132                                     MOLDUDP_SEQUENCE_LEN +
 133                                     MOLDUDP_COUNT_LEN))
 134         return 0;
 135
 136     /* Make entries in Protocol column and Info column on summary display */
 137     col_set_str(pinfo->cinfo, COL_PROTOCOL, "MoldUDP");
 138
 139     /* Clear the info column so it's sane if we crash. We fill it in later when
 140      * we've dissected more of the packet. */
 141     col_clear(pinfo->cinfo, COL_INFO);
 142
 143     count = tvb_get_letohs(tvb, MOLDUDP_SESSION_LEN + MOLDUDP_SEQUENCE_LEN);
 144
 145     if (count == MOLDUDP_HEARTBEAT)
 146         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP Heartbeat");
 147     else
 148         col_set_str(pinfo->cinfo, COL_INFO, "MoldUDP Messages");
 149
 150     /* create display subtree for the protocol */
 151     ti = proto_tree_add_item(tree, proto_moldudp,
 152                              tvb, offset, -1, ENC_NA);
 153
 154     moldudp_tree = proto_item_add_subtree(ti, ett_moldudp);
 155
 156     proto_tree_add_item(moldudp_tree, hf_moldudp_session,
 157                         tvb, offset, MOLDUDP_SESSION_LEN, ENC_ASCII);
 158     offset += MOLDUDP_SESSION_LEN;
 159
 160     sequence = tvb_get_letohl(tvb, offset);
 161     proto_tree_add_item(moldudp_tree, hf_moldudp_sequence,
 162                         tvb, offset, MOLDUDP_SEQUENCE_LEN, ENC_LITTLE_ENDIAN);
 163     offset += MOLDUDP_SEQUENCE_LEN;
 164
 165     ti = proto_tree_add_item(moldudp_tree, hf_moldudp_count,
 166                              tvb, offset, MOLDUDP_COUNT_LEN, ENC_LITTLE_ENDIAN);
 167     offset += MOLDUDP_COUNT_LEN;
 168
 169     while (tvb_reported_length(tvb) >= offset + MOLDUDP_MSGLEN_LEN)
 170     {
 171         offset += dissect_moldudp_msgblk(tvb, pinfo, moldudp_tree,
 172                                          offset, sequence++);
 173         real_count++;
 174     }
 175
 176     if (real_count != count)
 177     {
 178         expert_add_info_format(pinfo, ti, &ei_moldudp_count_invalid,
 179                                "Invalid Message Count (claimed %u, found %u)",
 180                                count, real_count);
 181     }
 182
 183     /* Return the amount of data this dissector was able to dissect */
 184     return tvb_captured_length(tvb);
 185 }
 186
 187
 188 /* Register the protocol with Wireshark */
 189 void
 190 proto_register_moldudp(void)
 191 {
 192     /* Setup list of header fields */
 193     static hf_register_info hf[] = {
 194
 195         { &hf_moldudp_session,
 196         { "Session",       "moldudp.session",  FT_STRING, BASE_NONE, NULL, 0,
 197           "The session to which this packet belongs.", HFILL }},
 198
 199         { &hf_moldudp_sequence,
 200         { "Sequence",      "moldudp.sequence", FT_UINT32, BASE_DEC,  NULL, 0,
 201           "The sequence number of the first message in this packet.", HFILL }},
 202
 203         { &hf_moldudp_count,
 204         { "Count",         "moldudp.count",    FT_UINT16, BASE_DEC,  NULL, 0,
 205           "The number of messages contained in this packet.", HFILL }},
 206
 207         { &hf_moldudp_msgblk,
 208         { "Message Block", "moldudp.msgblock", FT_NONE,   BASE_NONE, NULL, 0,
 209           "A message.", HFILL }},
 210
 211         { &hf_moldudp_msglen,
 212         { "Length",        "moldudp.msglen",   FT_UINT16, BASE_DEC,  NULL, 0,
 213           "The length of this message.", HFILL }},
 214
 215         { &hf_moldudp_msgseq,
 216         { "Sequence",      "moldudp.msgseq",   FT_UINT32, BASE_DEC,  NULL, 0,
 217           "The sequence number of this message.", HFILL }},
 218
 219         { &hf_moldudp_msgdata,
 220         { "Payload",       "moldudp.msgdata",  FT_BYTES,  BASE_NONE, NULL, 0,
 221           "The payload data of this message.", HFILL }}
 222     };
 223
 224     /* Setup protocol subtree array */
 225     static int *ett[] = {
 226         &ett_moldudp,
 227         &ett_moldudp_msgblk
 228     };
 229
 230     static ei_register_info ei[] = {
 231         { &ei_moldudp_msglen_invalid, { "moldudp.msglen.invalid", PI_MALFORMED, PI_ERROR, "Invalid Message Length", EXPFILL }},
 232         { &ei_moldudp_count_invalid, { "moldudp.count.invalid", PI_MALFORMED, PI_ERROR, "Invalid Count", EXPFILL }},
 233     };
 234
 235     expert_module_t* expert_moldudp;
 236
 237     /* Register the protocol name and description */
 238     proto_moldudp = proto_register_protocol("MoldUDP", "MoldUDP", "moldudp");
 239
 240     /* Required function calls to register the header fields and subtrees used */
 241     proto_register_field_array(proto_moldudp, hf, array_length(hf));
 242     proto_register_subtree_array(ett, array_length(ett));
 243     expert_moldudp = expert_register_protocol(proto_moldudp);
 244     expert_register_field_array(expert_moldudp, ei, array_length(ei));
 245
 246     moldudp_payload_table = register_decode_as_next_proto(proto_moldudp, "moldudp.payload", "MoldUDP Payload", moldudp_prompt);
 247
 248     /* Register the dissector */
 249     moldudp_handle = register_dissector("moldudp", dissect_moldudp, proto_moldudp);
 250 }
 251
 252
 253 void
 254 proto_reg_handoff_moldudp(void)
 255 {
 256     dissector_add_for_decode_as_with_preference("udp.port", moldudp_handle);
 257 }
 258
 259 /*
 260  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 261  *
 262  * Local variables:
 263  * c-basic-offset: 4
 264  * tab-width: 8
 265  * indent-tabs-mode: nil
 266  * End:
 267  *
 268  * vi: set shiftwidth=4 tabstop=8 expandtab:
 269  * :indentSize=4:tabSize=8:noTabs=true:
 270  */