epan/dissectors/packet-wcp.c

   1 /* packet-wcp.c
   2  * Routines for Wellfleet Compression frame disassembly
   3  * Copyright 2001, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  *
  11  * ToDo:
  12  *      Add preference to allow/disallow decompression
  13  *      Calculate and verify check byte (last byte), if only we knew how!
  14  *      Handle Wellfleet compression over PPP links.
  15  *              - This will require changing the sub-dissector call
  16  *                routine to determine if layer 2 is frame relay or
  17  *                or PPP and different sub-dissector routines for each.
  18  *
  19  * Based upon information in the Nortel TCL based Pcaptap code.
  20  *http://www.mynetworkforum.com/tools/PCAPTAP/pcaptap-Win32-3.00.exe
  21  *
  22  * And lzss algorithm
  23  *http://www.rasip.fer.hr/research/compress/algorithms/fund/lz/lzss.html
  24  */
  25
  26 /*
  27  * Wellfleet compression is a variation on LZSS encoding.
  28  *
  29  * Compression is done by keeping a sliding window of previous
  30  * data transmited. The sender will use a pattern match to
  31  * encode repeated data as a data pointer field. Then a stream
  32  * of pointers and actual data bytes. The pointer values include
  33  * an offset to previous data in the stream and the length of the
  34  *  matching data.
  35  *
  36  * The data pattern matching is done on the octets.
  37  *
  38  * The data is encoded as 8 field blocks with a compression flag
  39  * byte at the beginning.  If the bit is set in the compression
  40  * flag, then that field has a compression field. If it isn't set
  41  * then the byte is raw data.
  42  *
  43  * The compression field is either 2 or 3 bytes long. The length
  44  * is determined by the length of the matching data, for short
  45  * matches the match length is encoded in the high nibble of the
  46  * first byte. Otherwise the third byte of the field contains
  47  * the match length.
  48  *
  49  * First byte -
  50  * lower 4 bits:
  51  *              High order nibble of the offset
  52  *
  53  * upper 4 bits:
  54  *              1   = length is in 3rd byte
  55  *              2-F = length of matching data - 1
  56  *
  57  * Second byte -
  58  *  Lower byte of the source offset.
  59  *
  60  * Third byte -
  61  *  Length of match - 1 if First byte upper nibble = 1, otherwise
  62  *  this byte isn't added to data stream.
  63  *
  64  * Example:
  65  *      Uncompressed data (hex):  11 22 22 22 22 33 44 55 66 77
  66  *
  67  *
  68  *      Compression data :
  69  *                      Flag bits:      0x20 (third field is compressed)
  70  *                      Data:   11 22 20 00 33 44 55
  71  *                              /  /  /  /
  72  *              raw data ------+--+  /  /
  73  *              (Comp length - 1)<<4+  /
  74  *              Data offset ----------+
  75  *
  76  *      Output data (hex):  20 11 22 20 00 33 44 55 66 77
  77  *
  78  * In this example the copy src is one byte behind the copy destination
  79  * so if appears as if output is being loaded with the source byte.
  80  *
  81  */
  82
  83
  84
  85 #include "config.h"
  86
  87
  88 #include <epan/packet.h>
  89 #include <epan/proto_data.h>
  90
  91 #include <wiretap/wtap.h>
  92 #include <wsutil/pint.h>
  93 #include <epan/conversation.h>
  94 #include <epan/etypes.h>
  95 #include <epan/nlpid.h>
  96 #include <epan/expert.h>
  97 #include <epan/exceptions.h>
  98
  99 #define MAX_WIN_BUF_LEN 0x7fff          /* storage size for decompressed data */
 100 #define MAX_WCP_BUF_LEN 2048            /* storage size for compressed data */
 101 #define FROM_DCE        0x80            /* for direction setting */
 102
 103 void proto_register_wcp(void);
 104 void proto_reg_handoff_wcp(void);
 105
 106 typedef struct {
 107         uint8_t *buf_cur;
 108         uint8_t buffer[MAX_WIN_BUF_LEN];
 109         /* initialized bytes in the buffer (since buf_cur may wrap around) */
 110         uint16_t initialized;
 111 } wcp_window_t;
 112
 113 typedef struct {
 114         wcp_window_t recv;
 115         wcp_window_t send;
 116 } wcp_circuit_data_t;
 117
 118 /* XXX do I really want the length in here */
 119 typedef struct {
 120         uint16_t len;
 121         uint8_t buffer[MAX_WCP_BUF_LEN];
 122 } wcp_pdata_t;
 123
 124
 125 static int proto_wcp;
 126 static int hf_wcp_cmd;
 127 static int hf_wcp_ext_cmd;
 128 static int hf_wcp_seq;
 129 static int hf_wcp_chksum;
 130 static int hf_wcp_tid;
 131 static int hf_wcp_rev;
 132 static int hf_wcp_init;
 133 static int hf_wcp_seq_size;
 134 static int hf_wcp_alg;
 135 static int hf_wcp_alg_cnt;
 136 static int hf_wcp_alg_a;
 137 static int hf_wcp_alg_b;
 138 static int hf_wcp_alg_c;
 139 static int hf_wcp_alg_d;
 140 /* static int hf_wcp_rexmit; */
 141
 142 static int hf_wcp_hist_size;
 143 static int hf_wcp_ppc;
 144 static int hf_wcp_pib;
 145
 146 static int hf_wcp_compressed_data;
 147 static int hf_wcp_comp_bits;
 148 /* static int hf_wcp_comp_marker; */
 149 static int hf_wcp_short_len;
 150 static int hf_wcp_long_len;
 151 static int hf_wcp_short_run;
 152 static int hf_wcp_long_run;
 153 static int hf_wcp_offset;
 154
 155 static int ett_wcp;
 156 static int ett_wcp_comp_data;
 157 static int ett_wcp_field;
 158
 159 static expert_field ei_wcp_compressed_data_exceeds;
 160 static expert_field ei_wcp_uncompressed_data_exceeds;
 161 static expert_field ei_wcp_invalid_window_offset;
 162 static expert_field ei_wcp_buffer_too_long;
 163 /* static expert_field ei_wcp_invalid_match_length; */
 164
 165 static dissector_handle_t wcp_handle;
 166 static dissector_handle_t fr_uncompressed_handle;
 167
 168 /*
 169  * Bits in the address field.
 170  */
 171 #define WCP_CMD                 0xf0    /* WCP Command */
 172 #define WCP_EXT_CMD             0x0f    /* WCP Extended Command */
 173 #define WCP_SEQ                 0x0fff  /* WCP Sequence number */
 174 #define WCP_OFFSET_MASK         0x0fff  /* WCP Pattern source offset */
 175
 176 #define PPC_COMPRESSED_IND              0x0
 177 #define PPC_UNCOMPRESSED_IND            0x1
 178 #define PPC_TPPC_COMPRESSED_IND         0x2
 179 #define PPC_TPPC_UNCOMPRESSED_IND       0x3
 180 #define CONNECT_REQ                     0x4
 181 #define CONNECT_ACK                     0x5
 182 #define CONNECT_NAK                     0x6
 183 #define DISCONNECT_REQ                  0x7
 184 #define DISCONNECT_ACK                  0x8
 185 #define INIT_REQ                        0x9
 186 #define INIT_ACK                        0xa
 187 #define RESET_REQ                       0xb
 188 #define RESET_ACK                       0xc
 189 #define REXMIT_NAK                      0xd
 190
 191
 192 static const value_string cmd_string[] = {
 193         {0, "Compressed Data"},
 194         {1, "Uncompressed Data"},
 195         {15, "Extended"},
 196         { 0,       NULL }
 197 };
 198
 199 static const value_string ext_cmd_string[] = {
 200         {0, "Per Packet Compression"},
 201         {4, "Connect Req"},
 202         {5, "Connect Ack"},
 203         {9, "Init Req"},
 204         {0x0a, "Init Ack"},
 205
 206         { 0,       NULL }
 207 };
 208
 209
 210
 211 static tvbuff_t *wcp_uncompress(tvbuff_t *src_tvb, int offset, packet_info *pinfo, proto_tree *tree);
 212 static wcp_window_t *get_wcp_window_ptr(packet_info *pinfo);
 213
 214 static void
 215 dissect_wcp_con_req(tvbuff_t *tvb, int offset, proto_tree *tree) {
 216
 217 /* WCP connector request message */
 218         uint32_t alg_cnt;
 219
 220         proto_tree_add_item(tree, hf_wcp_tid, tvb, offset, 2, ENC_BIG_ENDIAN);
 221         proto_tree_add_item(tree, hf_wcp_rev, tvb, offset + 2, 1, ENC_NA);
 222         proto_tree_add_item(tree, hf_wcp_init, tvb, offset + 3, 1, ENC_NA);
 223         proto_tree_add_item(tree, hf_wcp_seq_size, tvb, offset + 4, 1, ENC_NA);
 224         proto_tree_add_item_ret_uint(tree, hf_wcp_alg_cnt, tvb, offset + 5, 1, ENC_NA, &alg_cnt);
 225         proto_tree_add_item(tree, hf_wcp_alg_a, tvb, offset + 6, 1, ENC_NA);
 226         if (alg_cnt > 1)
 227                 proto_tree_add_item(tree, hf_wcp_alg_b, tvb, offset + 7, 1, ENC_NA);
 228         if (alg_cnt > 2)
 229                 proto_tree_add_item(tree, hf_wcp_alg_c, tvb, offset + 8, 1, ENC_NA);
 230         if (alg_cnt > 3)
 231                 proto_tree_add_item(tree, hf_wcp_alg_d, tvb, offset + 9, 1, ENC_NA);
 232 }
 233
 234 static void
 235 dissect_wcp_con_ack(tvbuff_t *tvb, int offset, proto_tree *tree) {
 236
 237         /* WCP connector ack message */
 238
 239         proto_tree_add_item(tree, hf_wcp_tid, tvb, offset, 2, ENC_BIG_ENDIAN);
 240         proto_tree_add_item(tree, hf_wcp_rev, tvb, offset + 2, 1, ENC_NA);
 241         proto_tree_add_item(tree, hf_wcp_seq_size, tvb, offset + 3, 1, ENC_NA);
 242         proto_tree_add_item(tree, hf_wcp_alg, tvb, offset + 4, 1, ENC_NA);
 243 }
 244
 245 static void
 246 dissect_wcp_init(tvbuff_t *tvb, int offset, proto_tree *tree) {
 247
 248         /* WCP Initiate Request/Ack message */
 249
 250         proto_tree_add_item(tree, hf_wcp_tid, tvb, offset, 2, ENC_BIG_ENDIAN);
 251         proto_tree_add_item(tree, hf_wcp_rev, tvb, offset + 2, 1, ENC_NA);
 252         proto_tree_add_item(tree, hf_wcp_hist_size, tvb, offset + 3, 1, ENC_NA);
 253         proto_tree_add_item(tree, hf_wcp_ppc, tvb, offset + 4, 1, ENC_NA);
 254         proto_tree_add_item(tree, hf_wcp_pib, tvb, offset + 5, 1, ENC_NA);
 255 }
 256
 257
 258 static void
 259 dissect_wcp_reset(tvbuff_t *tvb, int offset, proto_tree *tree) {
 260
 261         /* Process WCP Reset Request/Ack message */
 262
 263         proto_tree_add_item(tree, hf_wcp_tid, tvb, offset, 2, ENC_BIG_ENDIAN);
 264 }
 265
 266
 267 static void wcp_save_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree* tree) {
 268
 269         wcp_window_t *buf_ptr = 0;
 270         size_t len;
 271
 272         /* discard first 2 bytes, header and last byte (check byte) */
 273         len = tvb_reported_length(tvb) - 3;
 274         buf_ptr = get_wcp_window_ptr(pinfo);
 275
 276         if ((buf_ptr->buf_cur + len) <= (buf_ptr->buffer + MAX_WIN_BUF_LEN)) {
 277                 tvb_memcpy(tvb, buf_ptr->buf_cur, 2, len);
 278                 buf_ptr->buf_cur += len;
 279         } else {
 280                 uint8_t *buf_end = buf_ptr->buffer + MAX_WIN_BUF_LEN;
 281                 tvb_memcpy(tvb, buf_ptr->buf_cur, 2, buf_end - buf_ptr->buf_cur);
 282                 if (buf_ptr->buf_cur + len <= buf_end) {
 283                         tvb_memcpy(tvb, buf_ptr->buffer, (int) (buf_end - buf_ptr->buf_cur-2),
 284                                 len - (buf_end - buf_ptr->buf_cur));
 285                         buf_ptr->buf_cur += len - MAX_WIN_BUF_LEN;
 286                 } else {
 287                         proto_tree_add_expert(tree, pinfo, &ei_wcp_buffer_too_long, tvb, 0, -1);
 288                 }
 289         }
 290 }
 291
 292
 293 static int dissect_wcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
 294
 295         proto_tree      *wcp_tree;
 296         proto_item      *ti;
 297         int             wcp_header_len;
 298         uint16_t                temp, cmd, ext_cmd, seq;
 299         tvbuff_t        *next_tvb;
 300
 301         col_set_str(pinfo->cinfo, COL_PROTOCOL, "WCP");
 302         col_clear(pinfo->cinfo, COL_INFO);
 303
 304         temp = tvb_get_ntohs(tvb, 0);
 305
 306         cmd = (temp & 0xf000) >> 12;
 307         ext_cmd = (temp & 0x0f00) >> 8;
 308
 309         if (cmd == 0xf)
 310                 wcp_header_len = 1;
 311         else
 312                 wcp_header_len = 2;
 313
 314         seq = temp & 0x0fff;
 315
 316         /* XXX should test seq to be sure it the last + 1 !! */
 317
 318         col_set_str(pinfo->cinfo, COL_INFO, val_to_str_const(cmd, cmd_string, "Unknown"));
 319         if (cmd == 0xf)
 320                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 321                                 val_to_str_const(ext_cmd, ext_cmd_string, "Unknown"));
 322
 323         ti = proto_tree_add_item(tree, proto_wcp, tvb, 0, wcp_header_len, ENC_NA);
 324         wcp_tree = proto_item_add_subtree(ti, ett_wcp);
 325
 326         proto_tree_add_item(wcp_tree, hf_wcp_cmd, tvb, 0, 1, ENC_NA);
 327         if (cmd == 0xf) {
 328                 proto_tree_add_item(wcp_tree, hf_wcp_ext_cmd, tvb, 1, 1, ENC_NA);
 329                 switch (ext_cmd) {
 330                 case CONNECT_REQ:
 331                         dissect_wcp_con_req(tvb, 1, wcp_tree);
 332                         break;
 333
 334                 case CONNECT_ACK:
 335                         dissect_wcp_con_ack(tvb, 1, wcp_tree);
 336                         break;
 337                 case INIT_REQ:
 338                 case INIT_ACK:
 339                         dissect_wcp_init(tvb, 1, wcp_tree);
 340                         break;
 341                 case RESET_REQ:
 342                 case RESET_ACK:
 343                         dissect_wcp_reset(tvb, 1, wcp_tree);
 344                         break;
 345                 default:
 346                         break;
 347                 }
 348         } else {
 349                 proto_tree_add_uint(wcp_tree, hf_wcp_seq, tvb, 0, 2, seq);
 350         }
 351
 352
 353         /* exit if done */
 354         if (cmd != 1 && cmd != 0 && !(cmd == 0xf && ext_cmd == 0))
 355                 return 2;
 356
 357         if (cmd == 1) { /* uncompressed data */
 358                 if (!pinfo->fd->visited) {      /* if first pass */
 359                         wcp_save_data(tvb, pinfo, wcp_tree);
 360                 }
 361                 next_tvb = tvb_new_subset_remaining(tvb, wcp_header_len);
 362         } else { /* cmd == 0 || (cmd == 0xf && ext_cmd == 0) */
 363
 364                 next_tvb = wcp_uncompress(tvb, wcp_header_len, pinfo, wcp_tree);
 365
 366                 if (!next_tvb) {
 367                         return tvb_captured_length(tvb);
 368                 }
 369         }
 370
 371         /* add the check byte */
 372         proto_tree_add_checksum(wcp_tree, tvb, tvb_reported_length(tvb) - 1, hf_wcp_chksum, -1, NULL, pinfo, 0, ENC_NA, PROTO_CHECKSUM_NO_FLAGS);
 373
 374         call_dissector(fr_uncompressed_handle, next_tvb, pinfo, tree);
 375
 376         return tvb_captured_length(tvb);
 377 }
 378
 379
 380 static uint8_t *
 381 decompressed_entry(uint8_t *dst, uint16_t data_offset,
 382         uint16_t data_cnt, int *len, wcp_window_t *buf_ptr)
 383 {
 384         const uint8_t *src;
 385         uint8_t *buf_start, *buf_end;
 386
 387         buf_start = buf_ptr->buffer;
 388         buf_end = buf_ptr->buffer + MAX_WIN_BUF_LEN;
 389
 390         /* do the decompression for one field */
 391
 392         src = (dst - 1 - data_offset);
 393         if (src < buf_start)
 394                 src += MAX_WIN_BUF_LEN;
 395
 396
 397         /* XXX could do some fancy memory moves, later if speed is problem */
 398
 399         while(data_cnt--) {
 400                 *dst = *src;
 401                 if (buf_ptr->initialized < MAX_WIN_BUF_LEN)
 402                         buf_ptr->initialized++;
 403                 if ( ++(*len) >MAX_WCP_BUF_LEN) {
 404                         return NULL;    /* end of buffer error */
 405                 }
 406                 if (dst++ == buf_end)
 407                         dst = buf_start;
 408                 if (src++ == buf_end)
 409                         src = buf_start;
 410
 411         }
 412         return dst;
 413 }
 414
 415
 416 static
 417 wcp_window_t *get_wcp_window_ptr(packet_info *pinfo) {
 418
 419         /* find the circuit for this DLCI, create one if needed */
 420         /* and return the wcp_window data structure pointer */
 421         /* for the direction of this packet */
 422
 423         conversation_t *conv;
 424         wcp_circuit_data_t *wcp_circuit_data;
 425
 426         conv = find_or_create_conversation(pinfo);
 427
 428         wcp_circuit_data = (wcp_circuit_data_t *)conversation_get_proto_data(conv, proto_wcp);
 429         if (!wcp_circuit_data) {
 430                 wcp_circuit_data = wmem_new0(wmem_file_scope(), wcp_circuit_data_t);
 431                 wcp_circuit_data->recv.buf_cur = wcp_circuit_data->recv.buffer;
 432                 wcp_circuit_data->send.buf_cur = wcp_circuit_data->send.buffer;
 433                 conversation_add_proto_data(conv, proto_wcp, wcp_circuit_data);
 434         }
 435         if (pinfo->pseudo_header->dte_dce.flags & FROM_DCE)
 436                 return &wcp_circuit_data->recv;
 437         else
 438                 return &wcp_circuit_data->send;
 439 }
 440
 441
 442 static tvbuff_t *wcp_uncompress(tvbuff_t *src_tvb, int offset, packet_info *pinfo, proto_tree *tree) {
 443
 444         /* do the packet data uncompression and load it into the dst buffer */
 445
 446         proto_tree      *cd_tree, *sub_tree;
 447         proto_item      *cd_item, *ti;
 448
 449         int len, i;
 450         int cnt = tvb_reported_length(src_tvb) - 1;/* don't include check byte */
 451
 452         uint8_t *dst, *src, *buf_start, *buf_end, comp_flag_bits = 0;
 453         uint16_t data_offset, data_cnt;
 454         uint8_t src_buf[ MAX_WCP_BUF_LEN];
 455         tvbuff_t *tvb;
 456         wcp_window_t *buf_ptr = 0;
 457         wcp_pdata_t *pdata_ptr;
 458
 459         buf_ptr = get_wcp_window_ptr(pinfo);
 460
 461         buf_start = buf_ptr->buffer;
 462         buf_end = buf_start + MAX_WIN_BUF_LEN;
 463
 464         cd_item = proto_tree_add_item(tree, hf_wcp_compressed_data,
 465                 src_tvb, offset, cnt - offset, ENC_NA);
 466         cd_tree = proto_item_add_subtree(cd_item, ett_wcp_comp_data);
 467         if (cnt - offset > MAX_WCP_BUF_LEN) {
 468                 expert_add_info_format(pinfo, cd_item, &ei_wcp_compressed_data_exceeds,
 469                         "Compressed data exceeds maximum buffer length (%d > %d)",
 470                         cnt - offset, MAX_WCP_BUF_LEN);
 471                 return NULL;
 472         }
 473
 474         /*
 475          * XXX - this will throw an exception if a snapshot length cut short
 476          * the data. We may want to try to dissect the data in that case,
 477          * and we may even want to try to decompress it, *but* we will
 478          * want to mark the buffer of decompressed data as incomplete, so
 479          * that we don't try to use it for decompressing later packets.
 480          */
 481         src = (uint8_t *)tvb_memcpy(src_tvb, src_buf, offset, cnt - offset);
 482         dst = buf_ptr->buf_cur;
 483         len = 0;
 484         i = -1;
 485
 486         while(offset < cnt) {
 487                 /* There are i bytes left for this byte of flag bits */
 488                 if ( --i >= 0) {
 489                         /*
 490                          * There's still at least one more byte left for
 491                          * the current set of compression flag bits; is
 492                          * it compressed data or uncompressed data?
 493                          */
 494                         if (comp_flag_bits & 0x80) {
 495                                 /* This byte is compressed data */
 496                                 if (!(offset + 1 < cnt)) {
 497                                         /*
 498                                          * The data offset runs past the
 499                                          * end of the data.
 500                                          */
 501                                         return NULL;
 502                                 }
 503                                 data_offset = pntoh16(src) & WCP_OFFSET_MASK;
 504                                 if ((*src & 0xf0) == 0x10) {
 505                                         /*
 506                                          * The count of bytes to copy from
 507                                          * the dictionary window is in the
 508                                          * byte following the data offset.
 509                                          */
 510                                         if (!(offset + 2 < cnt)) {
 511                                                 /*
 512                                                  * The data count runs past the
 513                                                  * end of the data.
 514                                                  */
 515                                                 return NULL;
 516                                         }
 517                                         data_cnt = *(src + 2) + 1;
 518                                         if (tree) {
 519                                                 ti = proto_tree_add_item(cd_tree, hf_wcp_long_run, src_tvb,
 520                                                          offset, 3, ENC_NA);
 521                                                 sub_tree = proto_item_add_subtree(ti, ett_wcp_field);
 522                                                 proto_tree_add_uint(sub_tree, hf_wcp_offset, src_tvb,
 523                                                          offset, 2, data_offset);
 524
 525                                                 proto_tree_add_item(sub_tree, hf_wcp_long_len, src_tvb,
 526                                                          offset+2, 1, ENC_BIG_ENDIAN);
 527                                         }
 528                                         src += 3;
 529                                         offset += 3;
 530                                 } else {
 531                                         /*
 532                                          * The count of bytes to copy from
 533                                          * the dictionary window is in
 534                                          * the upper 4 bits of the next
 535                                          * byte.
 536                                          */
 537                                         data_cnt = (*src >> 4) + 1;
 538                                         if (tree) {
 539                                                 ti = proto_tree_add_item(cd_tree, hf_wcp_short_run, src_tvb,
 540                                                          offset, 2, ENC_NA);
 541                                                 sub_tree = proto_item_add_subtree(ti, ett_wcp_field);
 542                                                 proto_tree_add_uint(sub_tree, hf_wcp_short_len, src_tvb,
 543                                                          offset, 1, *src);
 544                                                 proto_tree_add_uint(sub_tree, hf_wcp_offset, src_tvb,
 545                                                          offset, 2, data_offset);
 546                                         }
 547                                         src += 2;
 548                                         offset += 2;
 549                                 }
 550                                 if (data_offset + 1 > buf_ptr->initialized) {
 551                                         expert_add_info_format(pinfo, cd_item, &ei_wcp_invalid_window_offset,
 552                                                         "Data offset exceeds valid window size (%d > %d)",
 553                                                         data_offset+1, buf_ptr->initialized);
 554                                         return NULL;
 555                                 }
 556
 557                                 if (data_offset + 1 < data_cnt) {
 558                                         expert_add_info_format(pinfo, cd_item, &ei_wcp_invalid_window_offset,
 559                                                         "Data count exceeds offset (%d > %d)",
 560                                                         data_cnt, data_offset+1);
 561                                         return NULL;
 562                                 }
 563                                 if ( !pinfo->fd->visited) {     /* if first pass */
 564                                         dst = decompressed_entry(dst,
 565                                                 data_offset, data_cnt, &len,
 566                                                 buf_ptr);
 567                                         if (dst == NULL) {
 568                                                 expert_add_info_format(pinfo, cd_item, &ei_wcp_uncompressed_data_exceeds,
 569                                                         "Uncompressed data exceeds maximum buffer length (%d > %d)",
 570                                                         len, MAX_WCP_BUF_LEN);
 571                                                 return NULL;
 572                                         }
 573                                 }
 574                         }else {
 575                                 /*
 576                                  * This byte is uncompressed data; is there
 577                                  * room for it in the buffer of uncompressed
 578                                  * data?
 579                                  */
 580                                 if ( ++len >MAX_WCP_BUF_LEN) {
 581                                         /* No - report an error. */
 582                                         expert_add_info_format(pinfo, cd_item, &ei_wcp_uncompressed_data_exceeds,
 583                                                 "Uncompressed data exceeds maximum buffer length (%d > %d)",
 584                                                 len, MAX_WCP_BUF_LEN);
 585                                         return NULL;
 586                                 }
 587
 588                                 if ( !pinfo->fd->visited) {
 589                                         /*
 590                                          * This is the first pass through
 591                                          * the packets, so copy it to the
 592                                          * buffer of uncompressed data.
 593                                          */
 594                                         *dst = *src;
 595                                         if (dst++ == buf_end)
 596                                                 dst = buf_start;
 597                                         if (buf_ptr->initialized < MAX_WIN_BUF_LEN)
 598                                                 buf_ptr->initialized++;
 599                                 }
 600                                 ++src;
 601                                 ++offset;
 602                         }
 603
 604                         /* Skip to the next compression flag bit */
 605                         comp_flag_bits <<= 1;
 606
 607                 }else {
 608                         /*
 609                          * There are no more bytes left for the current
 610                          * set of compression flag bits, so this byte
 611                          * is another byte of compression flag bits.
 612                          */
 613                         comp_flag_bits = *src++;
 614                         proto_tree_add_uint(cd_tree, hf_wcp_comp_bits, src_tvb, offset, 1,
 615                                         comp_flag_bits);
 616                         offset++;
 617
 618                         i = 8;
 619                 }
 620         }
 621
 622         if (pinfo->fd->visited) {       /* if not first pass */
 623                                         /* get uncompressed data */
 624                 pdata_ptr = (wcp_pdata_t *)p_get_proto_data(wmem_file_scope(), pinfo, proto_wcp, 0);
 625
 626                 if (!pdata_ptr) {       /* exit if no data */
 627                         REPORT_DISSECTOR_BUG("Can't find uncompressed data");
 628                         return NULL;
 629                 }
 630                 len = pdata_ptr->len;
 631         } else {
 632                 if (buf_ptr->buf_cur + len > buf_end) {
 633                         expert_add_info_format(pinfo, cd_item, &ei_wcp_invalid_window_offset,
 634                                 "Uncompressed data exceeds available buffer length (%d > %d)",
 635                                 len, (int) (buf_end - buf_ptr->buf_cur));
 636                         return NULL;
 637                 }
 638
 639                 /* save the new data as per packet data */
 640                 pdata_ptr = wmem_new0(wmem_file_scope(), wcp_pdata_t);
 641                 memcpy( &pdata_ptr->buffer, buf_ptr->buf_cur, len);
 642                 pdata_ptr->len = len;
 643
 644                 p_add_proto_data(wmem_file_scope(), pinfo, proto_wcp, 0, (void*)pdata_ptr);
 645
 646                 buf_ptr->buf_cur = dst;
 647         }
 648
 649         tvb = tvb_new_child_real_data(src_tvb, pdata_ptr->buffer, pdata_ptr->len, pdata_ptr->len);
 650
 651         /* Add new data to the data source list */
 652         add_new_data_source(pinfo, tvb, "Uncompressed WCP");
 653         return tvb;
 654
 655 }
 656
 657
 658 void
 659 proto_register_wcp(void)
 660 {
 661         static hf_register_info hf[] = {
 662                 { &hf_wcp_cmd,
 663                   { "Command", "wcp.cmd", FT_UINT8, BASE_HEX, VALS(cmd_string), WCP_CMD,
 664                     "Compression Command", HFILL }},
 665                 { &hf_wcp_ext_cmd,
 666                   { "Extended Command", "wcp.ext_cmd", FT_UINT8, BASE_HEX, VALS(ext_cmd_string), WCP_EXT_CMD,
 667                     "Extended Compression Command", HFILL }},
 668                 { &hf_wcp_seq,
 669                   { "SEQ", "wcp.seq", FT_UINT16, BASE_HEX, NULL, WCP_SEQ,
 670                     "Sequence Number", HFILL }},
 671                 { &hf_wcp_chksum,
 672                   { "Checksum", "wcp.checksum", FT_UINT8, BASE_DEC, NULL, 0,
 673                     "Packet Checksum", HFILL }},
 674                 { &hf_wcp_tid,
 675                   { "TID", "wcp.tid", FT_UINT16, BASE_DEC, NULL, 0,
 676                     NULL, HFILL }},
 677                 { &hf_wcp_rev,
 678                   { "Revision", "wcp.rev", FT_UINT8, BASE_DEC, NULL, 0,
 679                     NULL, HFILL }},
 680                 { &hf_wcp_init,
 681                   { "Initiator", "wcp.init", FT_UINT8, BASE_DEC, NULL, 0,
 682                     NULL, HFILL }},
 683                 { &hf_wcp_seq_size,
 684                   { "Seq Size", "wcp.seq_size", FT_UINT8, BASE_DEC, NULL, 0,
 685                     "Sequence Size", HFILL }},
 686                 { &hf_wcp_alg_cnt,
 687                   { "Alg Count", "wcp.alg_cnt", FT_UINT8, BASE_DEC, NULL, 0,
 688                     "Algorithm Count", HFILL }},
 689                 { &hf_wcp_alg_a,
 690                   { "Alg 1", "wcp.alg1", FT_UINT8, BASE_DEC, NULL, 0,
 691                     "Algorithm #1", HFILL }},
 692                 { &hf_wcp_alg_b,
 693                   { "Alg 2", "wcp.alg2", FT_UINT8, BASE_DEC, NULL, 0,
 694                     "Algorithm #2", HFILL }},
 695                 { &hf_wcp_alg_c,
 696                   { "Alg 3", "wcp.alg3", FT_UINT8, BASE_DEC, NULL, 0,
 697                     "Algorithm #3", HFILL }},
 698                 { &hf_wcp_alg_d,
 699                   { "Alg 4", "wcp.alg4", FT_UINT8, BASE_DEC, NULL, 0,
 700                     "Algorithm #4", HFILL }},
 701                 { &hf_wcp_alg,
 702                   { "Alg", "wcp.alg", FT_UINT8, BASE_DEC, NULL, 0,
 703                     "Algorithm", HFILL }},
 704 #if 0
 705                 { &hf_wcp_rexmit,
 706                   { "Rexmit", "wcp.rexmit", FT_UINT8, BASE_DEC, NULL, 0,
 707                     "Retransmit", HFILL }},
 708 #endif
 709                 { &hf_wcp_hist_size,
 710                   { "History", "wcp.hist", FT_UINT8, BASE_DEC, NULL, 0,
 711                     "History Size", HFILL }},
 712                 { &hf_wcp_ppc,
 713                   { "PerPackComp", "wcp.ppc", FT_UINT8, BASE_DEC, NULL, 0,
 714                     "Per Packet Compression", HFILL }},
 715                 { &hf_wcp_pib,
 716                   { "PIB", "wcp.pib", FT_UINT8, BASE_DEC, NULL, 0,
 717                     NULL, HFILL }},
 718                 { &hf_wcp_compressed_data,
 719                   { "Compressed Data", "wcp.compressed_data", FT_NONE, BASE_NONE, NULL, 0,
 720                     "Raw compressed data", HFILL }},
 721                 { &hf_wcp_comp_bits,
 722                   { "Compress Flag", "wcp.flag", FT_UINT8, BASE_HEX, NULL, 0,
 723                     "Compressed byte flag", HFILL }},
 724 #if 0
 725                 { &hf_wcp_comp_marker,
 726                   { "Compress Marker", "wcp.mark", FT_UINT8, BASE_DEC, NULL, 0,
 727                     "Compressed marker", HFILL }},
 728 #endif
 729                 { &hf_wcp_offset,
 730                   { "Source offset", "wcp.off", FT_UINT16, BASE_HEX, NULL, WCP_OFFSET_MASK,
 731                     "Data source offset", HFILL }},
 732                 { &hf_wcp_short_len,
 733                   { "Compress Length", "wcp.short_len", FT_UINT8, BASE_HEX, NULL, 0xf0,
 734                     "Compressed length", HFILL }},
 735                 { &hf_wcp_long_len,
 736                   { "Compress Length", "wcp.long_len", FT_UINT8, BASE_HEX, NULL, 0,
 737                     "Compressed length", HFILL }},
 738                 { &hf_wcp_long_run,
 739                   { "Long Compression", "wcp.long_comp", FT_BYTES, BASE_NONE, NULL, 0,
 740                     "Long Compression type", HFILL }},
 741                 { &hf_wcp_short_run,
 742                   { "Short Compression", "wcp.short_comp", FT_BYTES, BASE_NONE, NULL, 0,
 743                     "Short Compression type", HFILL }},
 744
 745         };
 746
 747
 748         static int *ett[] = {
 749                 &ett_wcp,
 750                 &ett_wcp_comp_data,
 751                 &ett_wcp_field,
 752         };
 753
 754         static ei_register_info ei[] = {
 755                 { &ei_wcp_compressed_data_exceeds, { "wcp.compressed_data.exceeds", PI_MALFORMED, PI_ERROR, "Compressed data exceeds maximum buffer length", EXPFILL }},
 756                 { &ei_wcp_uncompressed_data_exceeds, { "wcp.uncompressed_data.exceeds", PI_MALFORMED, PI_ERROR, "Uncompressed data exceeds maximum buffer length", EXPFILL }},
 757                 { &ei_wcp_invalid_window_offset, { "wcp.off.invalid", PI_MALFORMED, PI_ERROR, "Offset points outside of visible window", EXPFILL }},
 758                 { &ei_wcp_buffer_too_long, { "wcp.buffer_too_long", PI_MALFORMED, PI_ERROR, "Buffer too long", EXPFILL }},
 759 #if 0
 760                 { &ei_wcp_invalid_match_length, { "wcp.len.invalid", PI_MALFORMED, PI_ERROR, "Length greater than offset", EXPFILL }},
 761 #endif
 762         };
 763
 764         expert_module_t* expert_wcp;
 765
 766         proto_wcp = proto_register_protocol ("Wellfleet Compression", "WCP", "wcp");
 767         proto_register_field_array (proto_wcp, hf, array_length(hf));
 768         proto_register_subtree_array(ett, array_length(ett));
 769         expert_wcp = expert_register_protocol(proto_wcp);
 770         expert_register_field_array(expert_wcp, ei, array_length(ei));
 771         wcp_handle = register_dissector("wcp", dissect_wcp, proto_wcp);
 772 }
 773
 774
 775 void
 776 proto_reg_handoff_wcp(void) {
 777         /*
 778          * Get handle for the Frame Relay (uncompressed) dissector.
 779          */
 780         fr_uncompressed_handle = find_dissector_add_dependency("fr_uncompressed", proto_wcp);
 781
 782         dissector_add_uint("fr.nlpid", NLPID_COMPRESSED, wcp_handle);
 783         dissector_add_uint("ethertype",  ETHERTYPE_WCP, wcp_handle);
 784 }
 785
 786 /*
 787  * Editor modelines - https://www.wireshark.org/tools/modelines.html
 788  *
 789  * Local variables:
 790  * c-basic-offset: 8
 791  * tab-width: 8
 792  * indent-tabs-mode: t
 793  * End:
 794  *
 795  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 796  * :indentSize=8:tabSize=8:noTabs=false:
 797  */