epan/dissectors/packet-udt.c

   1 /* packet-udt.c
   2  *
   3  * Routines for UDT packet dissection
   4  *
   5  * Copyright 2013 (c) chas williams <chas@cmf.nrl.navy.mil>
   6  *
   7  * $Id$
   8  *
   9  * Wireshark - Network traffic analyzer
  10  * By Gerald Combs <gerald@wireshark.org>
  11  * Copyright 1998 Gerald Combs
  12  *
  13  * Copied from packet-tftp.c
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  28  */
  29
  30 #include "config.h"
  31
  32 #include <glib.h>
  33 #include <epan/packet.h>
  34 #include <epan/conversation.h>
  35 #include <epan/expert.h>
  36
  37 /*
  38  * based on http://tools.ietf.org/html/draft-gg-udt-03
  39  */
  40
  41 #define UDT_TYPE_DATA                   0
  42 #define UDT_TYPE_CONTROL                1
  43
  44 #define UDT_PACKET_TYPE_HANDSHAKE       0x0000
  45 #define UDT_PACKET_TYPE_KEEPALIVE       0x0001
  46 #define UDT_PACKET_TYPE_ACK             0x0002
  47 #define UDT_PACKET_TYPE_NAK             0x0003
  48 #define UDT_PACKET_TYPE_SHUTDOWN        0x0005
  49 #define UDT_PACKET_TYPE_ACK2            0x0006
  50
  51 #define UDT_HANDSHAKE_TYPE_STREAM       0
  52 #define UDT_HANDSHAKE_TYPE_DGRAM        1
  53
  54 static const value_string udt_packet_types[] = {
  55         {UDT_PACKET_TYPE_HANDSHAKE, "handshake"},
  56         {UDT_PACKET_TYPE_KEEPALIVE, "keepalive"},
  57         {UDT_PACKET_TYPE_ACK, "ack"},
  58         {UDT_PACKET_TYPE_NAK, "nak"},
  59         {UDT_PACKET_TYPE_SHUTDOWN, "shutdown"},
  60         {UDT_PACKET_TYPE_ACK2, "ack2"},
  61         {0, NULL},
  62 };
  63
  64 static const value_string udt_handshake_types[] = {
  65         {UDT_HANDSHAKE_TYPE_STREAM, "STREAM"},
  66         {UDT_HANDSHAKE_TYPE_DGRAM, "DGRAM"},
  67         {0, NULL},
  68 };
  69
  70 static const value_string udt_types[] = {
  71         {UDT_TYPE_DATA, "DATA"},
  72         {UDT_TYPE_CONTROL, "CONTROL"},
  73         {0, NULL},
  74 };
  75
  76 static int proto_udt = -1;
  77 static int hf_udt_iscontrol = -1;
  78 static int hf_udt_type = -1;
  79 static int hf_udt_seqno = -1;
  80 static int hf_udt_ack_seqno = -1;
  81 static int hf_udt_ackno = -1;
  82 static int hf_udt_msgno = -1;
  83 static int hf_udt_msgno_first = -1;
  84 static int hf_udt_msgno_last = -1;
  85 static int hf_udt_msgno_inorder = -1;
  86 static int hf_udt_timestamp = -1;
  87 static int hf_udt_id = -1;
  88 static int hf_udt_addinfo = -1;
  89 static int hf_udt_rtt = -1;
  90 static int hf_udt_rttvar = -1;
  91 static int hf_udt_bufavail = -1;
  92 static int hf_udt_rate = -1;
  93 static int hf_udt_linkcap = -1;
  94 static int hf_udt_handshake_version = -1;
  95 static int hf_udt_handshake_type = -1;
  96 static int hf_udt_handshake_isn = -1;
  97 static int hf_udt_handshake_mtu = -1;
  98 static int hf_udt_handshake_flow_window = -1;
  99 static int hf_udt_handshake_reqtype = -1;
 100 static int hf_udt_handshake_id = -1;
 101 static int hf_udt_handshake_cookie = -1;
 102 static int hf_udt_handshake_peerip = -1;
 103
 104 static gint ett_udt = -1;
 105
 106 static expert_field ei_udt_nak_seqno = EI_INIT;
 107
 108 static dissector_handle_t udt_handle;
 109 static dissector_handle_t data_handle;
 110
 111 static int
 112 dissect_udt(tvbuff_t * tvb, packet_info * pinfo, proto_tree * parent_tree,
 113             void *data _U_)
 114 {
 115         proto_tree *tree;
 116         proto_item *udt_item;
 117         int is_control, type;
 118         guint i;
 119
 120         /* Ensure we have enough data */
 121         if (tvb_length(tvb) < 16)
 122                 return 0;
 123
 124         col_set_str(pinfo->cinfo, COL_PROTOCOL, "UDT");
 125         col_clear(pinfo->cinfo, COL_INFO);
 126
 127         is_control = tvb_get_ntohl(tvb, 0) & 0x80000000;
 128         type = (tvb_get_ntohl(tvb, 0) >> 16) & 0x7fff;
 129
 130         if (is_control)
 131                 col_add_fstr(pinfo->cinfo, COL_INFO, "UDT type: %s  id: %x",
 132                              val_to_str(type, udt_packet_types,
 133                                         "Unknown Control Type (%x)"),
 134                              tvb_get_ntohl(tvb, 12));
 135         else
 136                 col_add_fstr(pinfo->cinfo, COL_INFO,
 137                              "UDT type: data  seqno: %u  msgno: %u  id: %x",
 138                              tvb_get_ntohl(tvb, 0) & 0x7fffffff,
 139                              tvb_get_ntohl(tvb, 4) & 0x1fffffff,
 140                              tvb_get_ntohl(tvb, 12));
 141
 142         udt_item = proto_tree_add_item(parent_tree, proto_udt, tvb,
 143                                               0, -1, ENC_NA);
 144         tree = proto_item_add_subtree(udt_item, ett_udt);
 145
 146         proto_tree_add_item(tree, hf_udt_iscontrol, tvb, 0, 4, ENC_BIG_ENDIAN);
 147         if (is_control) {
 148                 proto_tree_add_item(tree, hf_udt_type, tvb, 0, 2,
 149                                     ENC_BIG_ENDIAN);
 150                 switch (type) {
 151                 case UDT_PACKET_TYPE_ACK:
 152                         proto_tree_add_item(tree, hf_udt_ackno, tvb, 4, 4,
 153                                             ENC_BIG_ENDIAN);
 154                         break;
 155                 case UDT_PACKET_TYPE_ACK2:
 156                         proto_tree_add_item(tree, hf_udt_ackno, tvb, 4, 4,
 157                                             ENC_BIG_ENDIAN);
 158                         break;
 159                 default:
 160                         proto_tree_add_item(tree, hf_udt_addinfo, tvb, 4, 4,
 161                                             ENC_BIG_ENDIAN);
 162                 }
 163                 proto_tree_add_item(tree, hf_udt_timestamp, tvb, 8, 4,
 164                                     ENC_BIG_ENDIAN);
 165                 proto_tree_add_item(tree, hf_udt_id, tvb, 12, 4,
 166                                     ENC_BIG_ENDIAN);
 167
 168                 switch (type) {
 169                 case UDT_PACKET_TYPE_HANDSHAKE:
 170                         proto_tree_add_item(tree, hf_udt_handshake_version, tvb,
 171                                             16, 4, ENC_BIG_ENDIAN);
 172                         proto_tree_add_item(tree, hf_udt_handshake_type, tvb,
 173                                             20, 4, ENC_BIG_ENDIAN);
 174                         proto_tree_add_item(tree, hf_udt_handshake_isn, tvb, 24,
 175                                             4, ENC_BIG_ENDIAN);
 176                         proto_tree_add_item(tree, hf_udt_handshake_mtu, tvb, 28,
 177                                             4, ENC_BIG_ENDIAN);
 178                         proto_tree_add_item(tree, hf_udt_handshake_flow_window,
 179                                             tvb, 32, 4, ENC_BIG_ENDIAN);
 180                         proto_tree_add_item(tree, hf_udt_handshake_reqtype, tvb,
 181                                             36, 4, ENC_BIG_ENDIAN);
 182                         proto_tree_add_item(tree, hf_udt_handshake_id, tvb, 40,
 183                                             4, ENC_BIG_ENDIAN);
 184                         proto_tree_add_item(tree, hf_udt_handshake_cookie, tvb,
 185                                             44, 4, ENC_BIG_ENDIAN);
 186                         proto_tree_add_item(tree, hf_udt_handshake_peerip, tvb,
 187                                             48, 16, ENC_NA);
 188                         proto_item_set_len(udt_item, 64);
 189                         break;
 190                 case UDT_PACKET_TYPE_ACK:
 191                         proto_tree_add_item(tree, hf_udt_ack_seqno, tvb, 16, 4,
 192                                             ENC_BIG_ENDIAN);
 193                         proto_tree_add_item(tree, hf_udt_rtt, tvb, 20, 4,
 194                                             ENC_BIG_ENDIAN);
 195                         proto_tree_add_item(tree, hf_udt_rttvar, tvb, 24, 4,
 196                                             ENC_BIG_ENDIAN);
 197                         proto_tree_add_item(tree, hf_udt_bufavail, tvb, 28, 4,
 198                                             ENC_BIG_ENDIAN);
 199                         /* if not a light ack, decode the rate and link capacity */
 200                         if (tvb_length(tvb) == 40) {
 201                                 proto_tree_add_item(tree, hf_udt_rate, tvb, 32,
 202                                                     4, ENC_BIG_ENDIAN);
 203                                 proto_tree_add_item(tree, hf_udt_linkcap, tvb,
 204                                                     36, 4, ENC_BIG_ENDIAN);
 205                                 proto_item_set_len(udt_item, 40);
 206                         }
 207                         else
 208                         {
 209                                 proto_item_set_len(udt_item, 32);
 210                         }
 211                         break;
 212                 case UDT_PACKET_TYPE_NAK:
 213                         for (i = 16; i < tvb_length(tvb); i = i + 4) {
 214                                 guint32 start, finish;
 215                                 int is_range;
 216
 217                                 is_range = tvb_get_ntohl(tvb, i) & 0x80000000;
 218                                 start = tvb_get_ntohl(tvb, i) & 0x7fffffff;
 219
 220                                 if (is_range) {
 221                                         finish = tvb_get_ntohl(tvb, i + 4) & 0x7fffffff;
 222
 223                                         proto_tree_add_expert_format(tree, pinfo, &ei_udt_nak_seqno,
 224                                                                         tvb, i, 8, "Missing Sequence Number(s): %u-%u",
 225                                                                     start, finish);
 226                                         i = i + 4;
 227                                 } else {
 228                                         proto_tree_add_expert_format(tree, pinfo, &ei_udt_nak_seqno,
 229                                                                     tvb, i, 4, "Missing Sequence Number: %u",
 230                                                                     start);
 231                                 }
 232                         }
 233
 234                         proto_item_set_len(udt_item, tvb_length(tvb));
 235                         break;
 236                 }
 237         } else {
 238                 /* otherwise, a data packet */
 239                 tvbuff_t *next_tvb;
 240
 241                 proto_tree_add_item(tree, hf_udt_seqno, tvb, 0, 4,
 242                                     ENC_BIG_ENDIAN);
 243                 proto_tree_add_item(tree, hf_udt_msgno_first, tvb, 4, 4,
 244                                     ENC_BIG_ENDIAN);
 245                 proto_tree_add_item(tree, hf_udt_msgno_last, tvb, 4, 4,
 246                                     ENC_BIG_ENDIAN);
 247                 proto_tree_add_item(tree, hf_udt_msgno_inorder, tvb, 4, 4,
 248                                     ENC_BIG_ENDIAN);
 249                 proto_tree_add_item(tree, hf_udt_msgno, tvb, 4, 4,
 250                                     ENC_BIG_ENDIAN);
 251                 proto_tree_add_item(tree, hf_udt_timestamp, tvb, 8, 4,
 252                                     ENC_BIG_ENDIAN);
 253                 proto_tree_add_item(tree, hf_udt_id, tvb, 12, 4,
 254                                     ENC_BIG_ENDIAN);
 255
 256                 next_tvb = tvb_new_subset_remaining(tvb, 16);
 257                 call_dissector(data_handle, next_tvb, pinfo, parent_tree);
 258         }
 259
 260         return tvb_length(tvb);
 261 }
 262
 263 static gboolean
 264 dissect_udt_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
 265 {
 266         conversation_t *conv;
 267
 268         /* Must have at least 20 bytes */
 269         if (tvb_reported_length(tvb) < 20)
 270                 return 0;
 271
 272         /* detect handshake control packet */
 273         if (tvb_get_ntohl(tvb, 0) != (0x80000000 | UDT_PACKET_TYPE_HANDSHAKE))
 274                 return FALSE;
 275
 276         /* must be version 4 */
 277         if ((tvb_get_ntohl(tvb, 16) != 4))
 278                 return FALSE;
 279
 280         /* must be datagram or stream */
 281         if ((tvb_get_ntohl(tvb, 20) != UDT_HANDSHAKE_TYPE_DGRAM)
 282             && (tvb_get_ntohl(tvb, 20) != UDT_HANDSHAKE_TYPE_STREAM))
 283                 return FALSE;
 284
 285         conv = find_or_create_conversation(pinfo);
 286         conversation_set_dissector(conv, udt_handle);
 287         dissect_udt(tvb, pinfo, tree, data);
 288
 289         return TRUE;
 290 }
 291
 292 void proto_register_udt(void)
 293 {
 294         expert_module_t *expert_udt;
 295
 296         static hf_register_info hf[] = {
 297                 {&hf_udt_iscontrol, {
 298                                      "Type", "udt.iscontrol", FT_UINT32,
 299                                      BASE_DEC,
 300                                      VALS(udt_types), 0x80000000, NULL, HFILL}},
 301
 302                 {&hf_udt_type, {
 303                                 "Type", "udt.type", FT_UINT16, BASE_HEX,
 304                                 VALS(udt_packet_types), 0x7fff, NULL, HFILL}},
 305
 306                 {&hf_udt_seqno, {
 307                                  "Sequence Number", "udt.seqno", FT_UINT32,
 308                                  BASE_DEC,
 309                                  NULL, 0x7fffffff, NULL, HFILL}},
 310
 311                 {&hf_udt_addinfo, {
 312                                    "Additional Info", "udt.addinfo", FT_UINT32,
 313                                    BASE_DEC,
 314                                    NULL, 0, NULL, HFILL}},
 315
 316                 {&hf_udt_msgno, {
 317                                  "Message Number", "udt.msgno", FT_UINT32,
 318                                  BASE_DEC,
 319                                  NULL, 0x1fffffff, NULL, HFILL}},
 320
 321                 {&hf_udt_msgno_first, {
 322                                        "First Indicator", "udt.msg.first",
 323                                        FT_UINT32, BASE_DEC,
 324                                        NULL, 0x80000000, NULL, HFILL}},
 325
 326                 {&hf_udt_msgno_last, {
 327                                       "Last Indicator", "udt.msg.last",
 328                                       FT_UINT32, BASE_DEC,
 329                                       NULL, 0x40000000, NULL, HFILL}},
 330
 331                 {&hf_udt_msgno_inorder, {
 332                                          "In-Order Indicator", "udt.msg.order",
 333                                          FT_UINT32, BASE_DEC,
 334                                          NULL, 0x20000000, NULL, HFILL}},
 335
 336                 {&hf_udt_timestamp, {
 337                                      "Timestamp", "udt.timestamp", FT_UINT32,
 338                                      BASE_DEC,
 339                                      NULL, 0, NULL, HFILL}},
 340
 341                 {&hf_udt_id, {
 342                               "ID", "udt.id", FT_UINT32, BASE_HEX,
 343                               NULL, 0, NULL, HFILL}},
 344
 345                 {&hf_udt_ack_seqno, {
 346                                      "Ack Sequence Number", "udt.ack_seqno",
 347                                      FT_UINT32, BASE_DEC,
 348                                      NULL, 0, NULL, HFILL}},
 349
 350                 {&hf_udt_ackno, {
 351                                  "Ack Number", "udt.ackno", FT_UINT32, BASE_DEC,
 352                                  NULL, 0, NULL, HFILL}},
 353
 354                 {&hf_udt_rtt, {
 355                                "RTT (microseconds)", "udt.rtt", FT_UINT32,
 356                                BASE_DEC,
 357                                NULL, 0, NULL, HFILL}},
 358
 359                 {&hf_udt_rttvar, {
 360                                   "RTT Variance (microseconds)", "udt.rttvar",
 361                                   FT_UINT32, BASE_DEC,
 362                                   NULL, 0, NULL, HFILL}},
 363
 364                 {&hf_udt_bufavail, {
 365                                     "Buffer Available (packets)", "udt.rttvar",
 366                                     FT_UINT32, BASE_DEC,
 367                                     NULL, 0, NULL, HFILL}},
 368
 369                 {&hf_udt_rate, {
 370                                 "Rate (packets/second)", "udt.rate", FT_UINT32,
 371                                 BASE_DEC,
 372                                 NULL, 0, NULL, HFILL}},
 373
 374                 {&hf_udt_linkcap, {
 375                                    "Link Capacity (packets/second)",
 376                                    "udt.linkcap", FT_UINT32, BASE_DEC,
 377                                    NULL, 0, NULL, HFILL}},
 378
 379                 {&hf_udt_handshake_version, {
 380                                              "Version", "udt.hs.version",
 381                                              FT_UINT32, BASE_DEC,
 382                                              NULL, 0, NULL, HFILL}},
 383
 384                 {&hf_udt_handshake_type, {
 385                                           "Type", "udt.hs.type", FT_UINT32,
 386                                           BASE_DEC,
 387                                           VALS(udt_handshake_types), 0, NULL,
 388                                           HFILL}},
 389
 390                 {&hf_udt_handshake_isn, {
 391                                          "Initial Sequence Number",
 392                                          "udt.hs.isn", FT_UINT32, BASE_DEC,
 393                                          NULL, 0, NULL, HFILL}},
 394
 395                 {&hf_udt_handshake_mtu, {
 396                                          "MTU", "udt.hs.mtu", FT_UINT32,
 397                                          BASE_DEC,
 398                                          NULL, 0, NULL, HFILL}},
 399
 400                 {&hf_udt_handshake_flow_window, {
 401                                                  "Flow Window",
 402                                                  "udt.hs.flow_window",
 403                                                  FT_UINT32, BASE_DEC,
 404                                                  NULL, 0, NULL, HFILL}},
 405
 406                 {&hf_udt_handshake_reqtype, {
 407                                              "Requested Type", "udt.hs.reqtype",
 408                                              FT_INT32, BASE_DEC,
 409                                              NULL, 0, NULL, HFILL}},
 410
 411                 {&hf_udt_handshake_id, {
 412                                         "ID", "udt.hs.id", FT_UINT32, BASE_DEC,
 413                                         NULL, 0, NULL, HFILL}},
 414
 415                 {&hf_udt_handshake_cookie, {
 416                                             "SYN Cookie", "udt.hs.cookie",
 417                                             FT_UINT32, BASE_HEX,
 418                                             NULL, 0, NULL, HFILL}},
 419
 420                 {&hf_udt_handshake_peerip, {
 421                                             "Peer IP Address", "udt.hs.peerip",
 422                                             FT_BYTES, BASE_NONE,
 423                                             NULL, 0, NULL, HFILL}},
 424         };
 425
 426         static gint *ett[] = {
 427                 &ett_udt,
 428         };
 429
 430         static ei_register_info ei[] = {
 431                 { &ei_udt_nak_seqno,
 432                   { "udt.nak_seqno", PI_SEQUENCE, PI_NOTE,
 433                     "Missing Sequence Number(s)", EXPFILL }},
 434         };
 435
 436         proto_udt = proto_register_protocol("UDT Protocol", "UDT", "udt");
 437         proto_register_field_array(proto_udt, hf, array_length(hf));
 438         proto_register_subtree_array(ett, array_length(ett));
 439
 440         expert_udt = expert_register_protocol(proto_udt);
 441         expert_register_field_array(expert_udt, ei, array_length(ei));
 442 }
 443
 444 void proto_reg_handoff_udt(void)
 445 {
 446         data_handle = find_dissector("data");
 447         udt_handle = new_create_dissector_handle(dissect_udt, proto_udt);
 448
 449         heur_dissector_add("udp", dissect_udt_heur, proto_udt);
 450         dissector_add_handle("udp.port", udt_handle);
 451 }