epan/dissectors/packet-pcli.c

   1 /* packet-pcli.c
   2  * Routines for Packet Cable Lawful Intercept packet disassembly
   3  *
   4  * Packet Cable Lawful Intercept is described by various PacketCable/CableLabs
   5  * specs.
   6  *
   7  * One spec is PacketCable(TM) Electronic Surveillance Specification
   8  * PKT-SP-ESP-I01-991229, the front page of which speaks of it as
   9  * being "Interim".  It does not appear to be available from the
  10  * CableLabs Web site, but is available through the Wayback Machine
  11  * at
  12  *
  13  *     http://web.archive.org/web/20030428211154/http://www.packetcable.com/downloads/specs/pkt-sp-esp-I01-991229.pdf
  14  *
  15  * See Section 4 "Call Content Connection Interface".  In that spec, the
  16  * packets have a 4-octet Call Content Connection (CCC) Identifier, followed
  17  * by the Intercepted Information.  The Intercepted Information is an IP
  18  * datagram, starting with an IP header.
  19  *
  20  * However, later specifications, such as PacketCable(TM) 1.5 Specifications,
  21  * Electronic Surveillance, PKT-SP-ESP1.5-I02-070412, at
  22  *
  23  *    http://www.cablelabs.com/wp-content/uploads/specdocs/PKT-SP-ESP1.5-I02-070412.pdf
  24  *
  25  * the front page of which speaks of it as being "ISSUED", in Section 5 "Call
  26  * Content Connection Interface", gives a header with a 4-octet CCC
  27  * Identifier followed by an 8-byte NTP-format timestamp.
  28  *
  29  * The PacketCable(TM) 2.0, PacketCable Electronic Surveillance Delivery
  30  * Function to Collection Function Interface Specification,
  31  * PKT-SP-ES-DCI-C01-140314, at
  32  *
  33  *     http://www.cablelabs.com/wp-content/uploads/specdocs/PKT-SP-ES-DCI-C01-140314.pdf
  34  *
  35  * which speaks of it as being "CLOSED" ("A static document, reviewed,
  36  * tested, validated, and closed to further engineering change requests to
  37  * the specification through CableLabs."), shows in section 7 "CALL CONTENT
  38  * CONNECTION (CCC) INTERFACE", a header with the 4-octet CCC Identifier,
  39  * the 8-byte NTP-format timestamp, and an 8-octet Case ID.
  40  *
  41  * So we may need a preference for the version.
  42  *
  43  * Copyright (c) 2000 by Ed Warnicke <hagbard@physics.rutgers.edu>
  44  *
  45  * Wireshark - Network traffic analyzer
  46  * By Gerald Combs <gerald@wireshark.org>
  47  * Copyright 1999 Gerald Combs
  48  *
  49  * SPDX-License-Identifier: GPL-2.0-or-later
  50  */
  51
  52 /* Include files */
  53
  54 #include "config.h"
  55
  56 #include <epan/decode_as.h>
  57 #include <epan/packet.h>
  58 #include <epan/prefs.h>
  59
  60 void proto_register_pcli(void);
  61 void proto_reg_handoff_pcli(void);
  62
  63 static dissector_handle_t pcli_handle, pcli_handle8, pcli_handle12, pcli_handle20;
  64
  65 /* Define the pcli proto */
  66
  67 static int proto_pcli;
  68 static int proto_pcli8;
  69 static int proto_pcli12;
  70 static int proto_pcli20;
  71
  72 /* Define headers for pcli */
  73
  74 static int hf_pcli_cccid;
  75 static int hf_pcli_header;
  76 static int hf_pcli_timestamp;
  77 static int hf_pcli_case_id;
  78
  79 /* Define the tree for pcli */
  80
  81 static int ett_pcli;
  82
  83 /*
  84  * Here are the global variables associated with the preferences
  85  * for pcli
  86  */
  87
  88 static bool pcli_summary_in_tree = true;
  89
  90 static dissector_table_t    pcli_subdissector_table;
  91
  92 static proto_tree *
  93 dissect_pcli_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int* offset)
  94 {
  95     uint32_t cccid;
  96     proto_tree *pcli_tree;
  97     proto_item *pcli_item;
  98
  99     /* Set the protocol column */
 100     col_set_str(pinfo->cinfo, COL_PROTOCOL, "PCLI");
 101
 102     /*
 103      *If we have a non-null tree (ie we are building the proto_tree
 104      * instead of just filling out the columns ), then add a PLCI
 105      * tree node and put a CCCID header element under it.
 106      */
 107     pcli_item = proto_tree_add_item(tree, proto_pcli, tvb, *offset, 4, ENC_NA);
 108     pcli_tree = proto_item_add_subtree(pcli_item, ett_pcli);
 109     proto_tree_add_item_ret_uint(pcli_tree, hf_pcli_cccid, tvb, *offset, 4, ENC_BIG_ENDIAN, &cccid);
 110     (*offset) += 4;
 111     if (pcli_summary_in_tree) {
 112         proto_item_append_text(pcli_item, ", CCCID: %u", cccid);
 113     }
 114
 115     /* Set the info column */
 116     col_add_fstr(pinfo->cinfo, COL_INFO, "CCCID: %u", cccid);
 117
 118     return pcli_tree;
 119 }
 120
 121 static void
 122 dissect_pcli_payload(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
 123 {
 124     tvbuff_t * next_tvb;
 125
 126     next_tvb = tvb_new_subset_remaining(tvb, offset);
 127
 128     if (!dissector_try_payload_with_data(pcli_subdissector_table, next_tvb, pinfo, tree, true, NULL)) {
 129         call_data_dissector(next_tvb, pinfo, tree);
 130     }
 131 }
 132
 133 static int
 134 dissect_pcli(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 135 {
 136     int offset = 0;
 137
 138     dissect_pcli_common(tvb, pinfo, tree, &offset);
 139
 140     dissect_pcli_payload(tvb, pinfo, tree, offset);
 141     return tvb_captured_length(tvb);
 142 }
 143
 144 static int
 145 dissect_pcli8(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 146 {
 147     proto_tree *pcli_tree;
 148     int offset = 0;
 149
 150     pcli_tree = dissect_pcli_common(tvb, pinfo, tree, &offset);
 151
 152     proto_tree_add_item(pcli_tree, hf_pcli_header, tvb, offset, 4, ENC_BIG_ENDIAN);
 153     offset += 4;
 154
 155     dissect_pcli_payload(tvb, pinfo, tree, offset);
 156     return tvb_captured_length(tvb);
 157 }
 158
 159 static int
 160 dissect_pcli12(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 161 {
 162     proto_tree *pcli_tree;
 163     int offset = 0;
 164
 165     pcli_tree = dissect_pcli_common(tvb, pinfo, tree, &offset);
 166
 167     proto_tree_add_item(pcli_tree, hf_pcli_timestamp, tvb, offset, 8, ENC_TIME_NTP|ENC_BIG_ENDIAN);
 168     offset += 8;
 169
 170     dissect_pcli_payload(tvb, pinfo, tree, offset);
 171     return tvb_captured_length(tvb);
 172 }
 173
 174 static int
 175 dissect_pcli20(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 176 {
 177     proto_tree *pcli_tree;
 178     int offset = 0;
 179
 180     pcli_tree = dissect_pcli_common(tvb, pinfo, tree, &offset);
 181
 182     proto_tree_add_item(pcli_tree, hf_pcli_timestamp, tvb, offset, 8, ENC_TIME_NTP|ENC_BIG_ENDIAN);
 183     offset += 8;
 184     proto_tree_add_item(pcli_tree, hf_pcli_case_id, tvb, offset, 8, ENC_BIG_ENDIAN);
 185     offset += 8;
 186
 187     dissect_pcli_payload(tvb, pinfo, tree, offset);
 188     return tvb_captured_length(tvb);
 189 }
 190
 191 static void
 192 pcli_prompt(packet_info *pinfo _U_, char* result)
 193 {
 194     snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "PCLI payload as");
 195 }
 196
 197 void
 198 proto_register_pcli(void)
 199 {
 200     static hf_register_info hf[] = {
 201         { &hf_pcli_cccid,
 202             { "CCCID", "pcli.cccid", FT_UINT32, BASE_DEC, NULL, 0x0,
 203               "Call Content Connection Identifier", HFILL }},
 204         { &hf_pcli_header,
 205             { "CCCID", "pcli.header", FT_UINT32, BASE_HEX, NULL, 0x0,
 206               "Part of 8 byte header (including CCCID?)", HFILL }},
 207         { &hf_pcli_timestamp,
 208             { "Timestamp", "pcli.timestamp", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
 209               NULL, HFILL }},
 210         { &hf_pcli_case_id,
 211             { "Case ID", "pcli.case_id", FT_UINT64, BASE_HEX, NULL, 0x0,
 212               NULL, HFILL }},
 213     };
 214
 215     static int *ett[] = {
 216         &ett_pcli,
 217     };
 218
 219     module_t *pcli_module;
 220
 221     proto_pcli = proto_register_protocol("Packet Cable Lawful Intercept", "PCLI", "pcli");
 222     /* Create "placeholders" to remove confusion with Decode As" */
 223     proto_pcli8 = proto_register_protocol_in_name_only("Packet Cable Lawful Intercept (8 byte CCCID)", "PCLI8 (8 byte CCCID)", "pcli8", proto_pcli, FT_PROTOCOL);
 224     proto_pcli12 = proto_register_protocol_in_name_only("Packet Cable Lawful Intercept (timestamp)", "PCLI12 (timestamp)", "pcli12", proto_pcli, FT_PROTOCOL);
 225     proto_pcli20 = proto_register_protocol_in_name_only("Packet Cable Lawful Intercept (timestamp, case ID)", "PCLI20 (timestamp, case ID)", "pcli20", proto_pcli, FT_PROTOCOL);
 226
 227     proto_register_field_array(proto_pcli,hf,array_length(hf));
 228     proto_register_subtree_array(ett,array_length(ett));
 229
 230     pcli_module = prefs_register_protocol(proto_pcli, NULL);
 231     prefs_register_obsolete_preference(pcli_module, "udp_port");
 232
 233     prefs_register_bool_preference(pcli_module, "summary_in_tree",
 234         "Show PCLI summary in protocol tree",
 235         "Whether the PCLI summary line should be shown in the protocol tree",
 236         &pcli_summary_in_tree);
 237
 238     pcli_subdissector_table = register_decode_as_next_proto(proto_pcli, "pcli.payload",
 239                                                              "PCLI payload dissector", pcli_prompt);
 240
 241     /* Register the dissector handles */
 242     pcli_handle = register_dissector("pcli", dissect_pcli, proto_pcli);
 243     pcli_handle8 = register_dissector("pcli8", dissect_pcli8, proto_pcli8);
 244     pcli_handle12 = register_dissector("pcli12", dissect_pcli12, proto_pcli12);
 245     pcli_handle20 = register_dissector("pcli20", dissect_pcli20, proto_pcli20);
 246 }
 247
 248 /* The registration hand-off routing */
 249
 250 void
 251 proto_reg_handoff_pcli(void)
 252 {
 253     dissector_add_for_decode_as_with_preference("udp.port", pcli_handle);
 254     dissector_add_for_decode_as_with_preference("udp.port", pcli_handle8);
 255     dissector_add_for_decode_as_with_preference("udp.port", pcli_handle12);
 256     dissector_add_for_decode_as_with_preference("udp.port", pcli_handle20);
 257 }
 258
 259 /*
 260  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 261  *
 262  * Local variables:
 263  * c-basic-offset: 4
 264  * tab-width: 8
 265  * indent-tabs-mode: nil
 266  * End:
 267  *
 268  * vi: set shiftwidth=4 tabstop=8 expandtab:
 269  * :indentSize=4:tabSize=8:noTabs=true:
 270  */