wsutil/exported_pdu_tlvs.h

   1 /** @file
   2  *
   3  * Definitions for exported_pdu TLVs
   4  * Copyright 2013, Anders Broman <anders-broman@ericsson.com>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #ifndef EXPORTED_PDU_TLVS_H
  14 #define EXPORTED_PDU_TLVS_H
  15
  16 /**
  17  * This is the format of the link-layer header of packets of type
  18  * LINKTYPE_WIRESHARK_UPPER_PDU in pcap and pcapng files.
  19  *
  20  * It is a sequence of TLVs; at least one TLV MUST indicate what protocol is
  21  * in the PDU following the TLVs.
  22  *
  23  * Each TLV contains, in order:
  24  *
  25  *    a 2-byte big-endian type field;
  26  *    a 2-byte big-endian length field;
  27  *    a value, the length of which is indicated by the value of
  28  *      the length field (that value does not include the length
  29  *      of the type or length fields themselves).
  30  *
  31  * Buffer layout:
  32  *  0                   1                   2                   3
  33  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  34  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  35  * |      Option Code              |         Option Length         |
  36  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  37  * /                       Option Value                            /
  38  * /             variable length, aligned to 32 bits               /
  39  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  40  * /                                                               /
  41  * /                 . . . other options . . .                     /
  42  * /                                                               /
  43  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  44  * |   Option Code == opt_endofopt  |  Option Length == 0          |
  45  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  46  *
  47  * The list of TLVs may begin with a TLV of type EXP_PDU_TAG_OPTIONS_LENGTH;
  48  * its value is a 4-byte integer value, giving the length of all TLVs
  49  * following that TLV (i.e., the length does not include the length of
  50  * the EXP_PDU_TAG_OPTIONS_LENGTH TLV). This tag is deprecated; it is
  51  * not guaranteed to be present, and code reading packets should not
  52  * require it to be present.
  53  *
  54  * The last TLV is of type EXP_PDU_TAG_END_OF_OPT; it has a length
  55  * of 0, and the value is zero-length.
  56  *
  57  * For string values, a string may have zero, one, or more null bytes
  58  * at the end; code that reads the string value must not assume that
  59  * there are, or are not, null bytes at the end.  Null bytes are included
  60  * in the length field, but are not part of the string value.
  61  *
  62  * For integral values, the values are in big-endian format.
  63  */
  64
  65 /*  Tag values
  66  *
  67  *  Do NOT add new values to this list without asking
  68  *  wireshark-dev[AT]wireshark.org for a value. Otherwise, you run the risk of
  69  *  using a value that's already being used for some other purpose, and of
  70  *  having tools that read exported_pdu captures not being able to handle
  71  *  captures with your new tag value, with no hope that they will ever be
  72  *  changed to do so (as that would destroy their ability to read captures
  73  *  using that value for that other purpose).
  74  */
  75 #define EXP_PDU_TAG_END_OF_OPT            0 /**< End-of-options Tag. */
  76 /* 1 - 9 reserved */
  77 #define EXP_PDU_TAG_OPTIONS_LENGTH       10 /**< Total length of the options excluding this TLV
  78                                              * Deprecated - do not use
  79                                              */
  80 #define EXP_PDU_TAG_LINKTYPE             11 /**< Deprecated - do not use */
  81 #define EXP_PDU_TAG_DISSECTOR_NAME       12 /**< The value part should be an ASCII non NULL terminated string
  82                                              * of the registered dissector used by Wireshark e.g "sip"
  83                                              * Will be used to call the next dissector.
  84                                              * NOTE: this is NOT a protocol name;
  85                                              * a given protocol may have multiple
  86                                              * dissectors, if, for example, the
  87                                              * protocol headers depend on the
  88                                              * protocol being used to transport
  89                                              * the protocol in question.
  90                                              */
  91 #define EXP_PDU_TAG_HEUR_DISSECTOR_NAME  13 /**< The value part should be an ASCII non NULL terminated string
  92                                           * containing the heuristic dissector unique short name given
  93                                           * during registration, e.g "sip_udp"
  94                                           * Will be used to call the next dissector.
  95                                           */
  96 #define EXP_PDU_TAG_DISSECTOR_TABLE_NAME 14 /**< The value part should be an ASCII non NULL terminated string
  97                                           * containing the dissector table name given
  98                                           * during registration, e.g "gsm_map.v3.arg.opcode"
  99                                           * Will be used to call the next dissector.
 100                                           */
 101
 102 /* For backwards source compatibility */
 103 #define EXP_PDU_TAG_PROTO_NAME           EXP_PDU_TAG_DISSECTOR_NAME
 104 #define EXP_PDU_TAG_HEUR_PROTO_NAME      EXP_PDU_TAG_HEUR_DISSECTOR_NAME
 105
 106 /* Add protocol type related tags here.
 107  * NOTE Only one protocol type tag may be present in a packet, the first one
 108  * found will be used*/
 109 /* 13 - 19 reserved */
 110 #define EXP_PDU_TAG_IPV4_SRC        20  /**< IPv4 source address - 4 bytes */
 111 #define EXP_PDU_TAG_IPV4_DST        21  /**< IPv4 destination address - 4 bytes */
 112 #define EXP_PDU_TAG_IPV6_SRC        22  /**< IPv6 source address - 16 bytes */
 113 #define EXP_PDU_TAG_IPV6_DST        23  /**< IPv6 destination address - 16 bytes */
 114
 115 /* Port type values for EXP_PDU_TAG_PORT_TYPE; these do not necessarily
 116  * correspond to port type values inside libwireshark. */
 117 #define EXP_PDU_PT_NONE         0
 118 #define EXP_PDU_PT_SCTP         1
 119 #define EXP_PDU_PT_TCP          2
 120 #define EXP_PDU_PT_UDP          3
 121 #define EXP_PDU_PT_DCCP         4
 122 #define EXP_PDU_PT_IPX          5
 123 #define EXP_PDU_PT_NCP          6
 124 #define EXP_PDU_PT_EXCHG        7
 125 #define EXP_PDU_PT_DDP          8
 126 #define EXP_PDU_PT_SBCCS        9
 127 #define EXP_PDU_PT_IDP          10
 128 #define EXP_PDU_PT_TIPC         11
 129 #define EXP_PDU_PT_USB          12
 130 #define EXP_PDU_PT_I2C          13
 131 #define EXP_PDU_PT_IBQP         14
 132 #define EXP_PDU_PT_BLUETOOTH    15
 133 #define EXP_PDU_PT_TDMOP        16
 134 #define EXP_PDU_PT_IWARP_MPA    17
 135 #define EXP_PDU_PT_MCTP         18
 136
 137 #define EXP_PDU_TAG_PORT_TYPE       24  /**< part type - 4 bytes, EXP_PDU_PT value */
 138 #define EXP_PDU_TAG_SRC_PORT        25  /**< source port - 4 bytes (even for protocols with 2-byte ports) */
 139 #define EXP_PDU_TAG_DST_PORT        26  /**< destination port - 4 bytes (even for protocols with 2-byte ports) */
 140
 141 #define EXP_PDU_TAG_SS7_OPC         28
 142 #define EXP_PDU_TAG_SS7_DPC         29
 143
 144 #define EXP_PDU_TAG_ORIG_FNO        30
 145
 146 #define EXP_PDU_TAG_DVBCI_EVT       31
 147
 148 #define EXP_PDU_TAG_DISSECTOR_TABLE_NAME_NUM_VAL 32 /**< value part is the numeric value to be used calling the dissector table
 149                                                       *  given with tag EXP_PDU_TAG_DISSECTOR_TABLE_NAME, must follow immediately after the table tag.
 150                                                       */
 151
 152 #define EXP_PDU_TAG_COL_PROT_TEXT   33 /**< UTF-8 text string to put in COL_PROTOCOL, one use case is in conjunction with dissector tables where
 153                                         *   COL_PROTOCOL might not be filled in.
 154                                         */
 155
 156
 157 /**< value part is structure passed into TCP subdissectors.  The field
 158     begins with a 2-byte version number; if the version number value is
 159     1, the value part is in the form:
 160
 161     version          2 bytes - xport PDU version of structure (for backwards/forwards compatibility)
 162     seq              4 bytes - Sequence number of first byte in the data
 163     nxtseq           4 bytes - Sequence number of first byte after data
 164     lastackseq       4 bytes - Sequence number of last ack
 165     is_reassembled   1 byte - Non-zero if this is reassembled data
 166     flags            2 bytes - TCP flags
 167     urgent_pointer   2 bytes - Urgent pointer value for the current packet
 168
 169   All multi-byte values are in big-endian format.  There is no alignment
 170   padding between values, so seq. nxtseq, and lastackseq are not aligned
 171   on 4-byte boundaries, andflags and urgent_pointer are not aligned on
 172   2-byte boundaries.
 173 */
 174 #define EXP_PDU_TAG_TCP_INFO_DATA  34
 175
 176 #define EXP_PDU_TAG_P2P_DIRECTION  35  /**< The packet direction (P2P_DIR_SENT, P2P_DIR_RECV). */
 177
 178 #define EXP_PDU_TAG_COL_INFO_TEXT  36 /**< UTF-8 text string to put in COL_INFO, useful when putting meta data into the packet list.
 179                                         */
 180
 181 #define EXP_PDU_TAG_USER_DATA_PDU  37 /**< Raw user data PDU which can be dissected as any protocol. */
 182
 183 /* 3GPP identity types for EXP_PDU_TAG_3GPP_ID */
 184 #define EXP_PDU_3GPP_ID_CGI     0 /**< 56-bit 2G/3G Cell Global Identifier (MNC big-endian encoding) */
 185 #define EXP_PDU_3GPP_ID_ECGI    1 /**< 52-bit 4G E-UTRAN Cell Global Identifier (MNC big-endian encoding) */
 186 #define EXP_PDU_3GPP_ID_NCGI    2 /**< 60-bit NR Cell Global Identifier (MNC big-endian encoding) */
 187
 188 /**< Stores a 3GPP identifier.
 189     The value begins with a 1-byte identity type (EXP_PDU_3GPP_ID_*),
 190     followed by the identity itself.
 191 */
 192 #define EXP_PDU_TAG_3GPP_ID   38
 193
 194 #define EXP_PDU_TAG_IPV4_LEN            4
 195 #define EXP_PDU_TAG_IPV6_LEN            16
 196
 197 #define EXP_PDU_TAG_PORT_TYPE_LEN       4
 198 #define EXP_PDU_TAG_PORT_LEN            4
 199
 200 #define EXP_PDU_TAG_SS7_OPC_LEN         8 /* 4 bytes PC, 2 bytes standard type, 1 byte NI, 1 byte padding */
 201 #define EXP_PDU_TAG_SS7_DPC_LEN         8 /* 4 bytes PC, 2 bytes standard type, 1 byte NI, 1 byte padding */
 202
 203 #define EXP_PDU_TAG_ORIG_FNO_LEN        4
 204
 205 #define EXP_PDU_TAG_DVBCI_EVT_LEN       1
 206
 207 #define EXP_PDU_TAG_DISSECTOR_TABLE_NUM_VAL_LEN     4
 208
 209 #endif /* EXPORTED_PDU_TLVS_H */