epan/dissectors/packet-pcaplog.c

   1 /* packet-pcaplog.c
   2  * Routines for pcaplog dissection
   3  * Copyright 2023, Dr. Lars Völker <lars.voelker@technica-engineering.de>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12
  13 #include "config.h"
  14
  15 #define WS_LOG_DOMAIN "pcaplog"
  16
  17 #define PEN_VCTR 46254
  18
  19 #include <wireshark.h>
  20
  21 #include <epan/packet.h>
  22 #include <epan/addr_resolv.h>
  23
  24 void proto_reg_handoff_pcaplog(void);
  25 void proto_register_pcaplog(void);
  26
  27 static int proto_pcaplog;
  28 static int hf_pcaplog_type;
  29 static int hf_pcaplog_length;
  30 static int hf_pcaplog_data;
  31
  32 static dissector_handle_t pcaplog_handle;
  33 static dissector_handle_t xml_handle;
  34
  35 static int ett_pcaplog;
  36 static int ett_pcaplog_data;
  37
  38 static int
  39 dissect_pcaplog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
  40         void *data _U_)
  41 {
  42     uint32_t data_type;
  43     uint32_t data_length;
  44     proto_item *pcaplog_item;
  45     proto_tree *pcaplog_tree;
  46     proto_item *pi_tmp;
  47     proto_tree *pt_pcaplog_data;
  48
  49     pcaplog_item = proto_tree_add_item(tree, proto_pcaplog, tvb, 0, -1, ENC_NA);
  50     pcaplog_tree = proto_item_add_subtree(pcaplog_item, ett_pcaplog);
  51
  52     proto_tree_add_item_ret_uint(pcaplog_tree, hf_pcaplog_type, tvb, 0, 4, ENC_LITTLE_ENDIAN, &data_type);
  53     proto_tree_add_item_ret_uint(pcaplog_tree, hf_pcaplog_length, tvb, 4, 4, ENC_LITTLE_ENDIAN, &data_length);
  54     pi_tmp = proto_tree_add_item(pcaplog_tree, hf_pcaplog_data, tvb, 8, data_length, ENC_NA);
  55     pt_pcaplog_data = proto_item_add_subtree(pi_tmp, ett_pcaplog_data);
  56
  57     col_set_str(pinfo->cinfo, COL_PROTOCOL, "pcaplog");
  58     col_add_fstr(pinfo->cinfo, COL_INFO, "Custom Block: PEN = %s (%d), will%s be copied",
  59                  enterprises_lookup(pinfo->rec->rec_header.custom_block_header.pen, "Unknown"),
  60                  pinfo->rec->rec_header.custom_block_header.pen,
  61                  pinfo->rec->rec_header.custom_block_header.copy_allowed ? "" : " not");
  62
  63     /* at least data_types 1-3 seem XML-based */
  64     if (data_type > 0 && data_type <= 3) {
  65         call_dissector(xml_handle, tvb_new_subset_remaining(tvb, 8), pinfo, pt_pcaplog_data);
  66     } else {
  67         call_data_dissector(tvb_new_subset_remaining(tvb, 8), pinfo, pt_pcaplog_data);
  68     }
  69     return tvb_captured_length(tvb);
  70 }
  71
  72 void
  73 proto_register_pcaplog(void)
  74 {
  75     static hf_register_info hf[] = {
  76         { &hf_pcaplog_type,
  77             { "Date Type", "pcaplog.data_type",
  78                 FT_UINT32, BASE_DEC, NULL, 0x0,
  79                 NULL, HFILL} },
  80
  81         { &hf_pcaplog_length,
  82             { "Data Length", "pcaplog.data_length",
  83                 FT_UINT32, BASE_DEC, NULL, 0x0,
  84                 NULL, HFILL} },
  85
  86         { &hf_pcaplog_data,
  87             { "Data", "pcaplog.data",
  88                 FT_BYTES, BASE_NONE, NULL, 0x0,
  89                 NULL, HFILL} },
  90     };
  91
  92     static int *ett[] = {
  93         &ett_pcaplog,
  94         &ett_pcaplog_data,
  95     };
  96
  97     proto_pcaplog = proto_register_protocol("pcaplog",
  98             "pcaplog", "pcaplog");
  99
 100     proto_register_field_array(proto_pcaplog, hf, array_length(hf));
 101     proto_register_subtree_array(ett, array_length(ett));
 102
 103     pcaplog_handle = register_dissector("pcaplog", dissect_pcaplog,
 104             proto_pcaplog);
 105
 106 }
 107
 108 void
 109 proto_reg_handoff_pcaplog(void)
 110 {
 111     xml_handle = find_dissector_add_dependency("xml", proto_pcaplog);
 112     dissector_add_uint("pcapng_custom_block", PEN_VCTR, pcaplog_handle);
 113 }