epan/dissectors/packet-netanalyzer.c

   1 /* packet-netanalyzer.c
   2  * Dissector for Hilscher netANALYZER frames.
   3  * Copyright 2008-2011, Hilscher GmbH, Holger Pfrommer hpfrommer[AT]hilscher.com
   4  *
   5  * $Id$
   6  *
   7  * Packet structure:
   8  * +---------------------------+
   9  * |           Header          |
  10  * |         (4 Octets)        |
  11  * +---------------------------+
  12  * |           Payload         |
  13  * .                           .
  14  * .                           .
  15  * .                           .
  16  *
  17  * Description:
  18  * The header field contains a 32-bit value in little-endian byte order.
  19  * The low-order 8 bits are a set of error flags for the packet:
  20  *     0x00000001 - MII RX_ER
  21  *     0x00000002 - alignment error
  22  *     0x00000004 - FCS error
  23  *     0x00000008 - frame too long
  24  *     0x00000010 - SFD error
  25  *     0x00000020 - frame shorter than 64 bytes
  26  *     0x00000040 - preamble shorter than 7 bytes
  27  *     0x00000080 - preamble longer than 7 bytes/li>
  28  * The next bit, 0x00000100, is set if the packet arrived on the GPIO port rather tha the Ethernet port.
  29  * The next bit, 0x00000200, is set if the packet was received in transparent capture mode.
  30  *   That should never be set for LINKTYPE_NETANALYZER and should always be set for LINKTYPE_NETANALYZER_TRANSPARENT.
  31  * The next 4 bits, 0x00003C00, are a bitfield giving the version of the header field; the current version is 1.
  32  * The next 2 bits, 0x0000C000, are the capture port/GPIO number, from 0 to 3.
  33  * The next 12 bits, 0x0FFF0000, are the frame length, in bytes.
  34  * The topmost 4 bits, 0xF0000000, are reserved.
  35  * The payload is an Ethernet frame, beginning with the MAC header and ending with the FCS, for LINKTYPE_NETANALYZER,
  36  *   and an Ethernet frame, beginning with the preamble and ending with the FCS, for LINKTYPE_NETANALYZER_TRANSPARENT.
  37  *
  38  *
  39  * Wireshark - Network traffic analyzer
  40  * By Gerald Combs <gerald[AT]wireshark.org>
  41  * Copyright 1999 Gerald Combs
  42  *
  43  * This program is free software; you can redistribute it and/or
  44  * modify it under the terms of the GNU General Public License
  45  * as published by the Free Software Foundation; either version 2
  46  * of the License, or (at your option) any later version.
  47  *
  48  * This program is distributed in the hope that it will be useful,
  49  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  50  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  51  * GNU General Public License for more details.
  52  *
  53  * You should have received a copy of the GNU General Public License
  54  * along with this program; if not, write to the Free Software
  55  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  56  */
  57
  58
  59 #include "config.h"
  60
  61 #include <glib.h>
  62 #include <epan/packet.h>
  63 #include <epan/wmem/wmem.h>
  64 #include <expert.h>
  65
  66
  67 void proto_reg_handoff_netanalyzer(void);
  68
  69
  70 #define HEADER_SIZE  4
  71 #define INFO_TYPE_OFFSET    18
  72
  73 #define MSK_RX_ERR             0x01
  74 #define TXT_RX_ERR             "MII RX_ER error"
  75 #define MSK_ALIGN_ERR          0x02
  76 #define TXT_ALIGN_ERR          "Alignment error"
  77 #define MSK_FCS_ERROR          0x04
  78 #define TXT_FCS_ERROR          "FCS error"
  79 #define MSK_TOO_LONG           0x08
  80 #define TXT_TOO_LONG           "Frame too long"
  81 #define MSK_SFD_ERROR          0x10
  82 #define TXT_SFD_ERROR          "No valid SFD found"
  83 #define MSK_SHORT_FRAME        0x20
  84 #define TXT_SHORT_FRAME        "Frame smaller 64 bytes"
  85 #define MSK_SHORT_PREAMBLE     0x40
  86 #define TXT_SHORT_PREAMBLE     "Preamble shorter than 7 bytes"
  87 #define MSK_LONG_PREAMBLE      0x80
  88 #define TXT_LONG_PREAMBLE      "Preamble longer than 7 bytes"
  89
  90 static const char *msk_strings[] = {
  91   "MII RX_ER error",                /* 0x01 */
  92   "Alignment error",                /* 0x02 */
  93   "FCS error",                      /* 0x04 */
  94   "Frame too long",                 /* 0x08 */
  95   "No valid SFD found",             /* 0x10 */
  96   "Frame smaller 64 bytes",         /* 0x20 */
  97   "Preamble shorter than 7 bytes",  /* 0x40 */
  98   "Preamble longer than 7 bytes"    /* 0x80 */
  99 };
 100
 101 #define SRT_PORT_NUM           6
 102 #define SRT_VERSION            2
 103 #define SRT_GPIO_FLAG          0
 104 #define MSK_PACKET_STATUS      0xff
 105 #define MSK_LENGTH             0x0fff
 106 #define MSK_TRANSPARENT_MODE   0x02
 107
 108
 109 static const value_string gpio_number[] = {
 110   { 0x0, "GPIO 0" },
 111   { 0x1, "GPIO 1" },
 112   { 0x2, "GPIO 2" },
 113   { 0x3, "GPIO 3" },
 114   { 0,   NULL }
 115 };
 116
 117 static const value_string gpio_edge_vals[] = {
 118   { 0x0, "rising edge" },
 119   { 0x1, "falling edge" },
 120   { 0,   NULL }
 121 };
 122
 123
 124 static dissector_handle_t  eth_dissector_handle;
 125 static dissector_handle_t  data_dissector_handle;
 126
 127 static gint  proto_netanalyzer           = -1;
 128
 129 static gint  hf_netanalyzer_gpio_number              = -1;
 130 static gint  hf_netanalyzer_gpio_edge                = -1;
 131 static gint  hf_netanalyzer_port                     = -1;
 132 static gint  hf_netanalyzer_length                   = -1;
 133 static gint  hf_netanalyzer_status                   = -1;
 134 static gint  hf_netanalyzer_status_rx_err            = -1;
 135 static gint  hf_netanalyzer_status_align_err         = -1;
 136 static gint  hf_netanalyzer_status_fcs               = -1;
 137 static gint  hf_netanalyzer_status_too_long          = -1;
 138 static gint  hf_netanalyzer_status_sfd_error         = -1;
 139 static gint  hf_netanalyzer_status_short_frame       = -1;
 140 static gint  hf_netanalyzer_status_short_preamble    = -1;
 141 static gint  hf_netanalyzer_status_long_preamble     = -1;
 142
 143 static gint  ett_netanalyzer                         = -1;
 144 static gint  ett_netanalyzer_status                  = -1;
 145 static gint  ett_netanalyzer_transparent             = -1;
 146
 147 static expert_field ei_netanalyzer_header_version_wrong = EI_INIT;
 148 static expert_field ei_netanalyzer_gpio_def_none = EI_INIT;
 149 static expert_field ei_netanalyzer_header_version_none = EI_INIT;
 150
 151 /* common routine for Ethernet and transparent mode */
 152 static int
 153 dissect_netanalyzer_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 154 {
 155   proto_item              *ti = NULL;
 156   proto_tree              *netanalyzer_header_tree = NULL;
 157   proto_item              *ti_status = NULL;
 158   proto_tree              *netanalyzer_status_tree = NULL;
 159   guint32                 packet_status;
 160   guint32                 port_num;
 161   guint32                 frame_length;
 162   guint                   is_gpio;
 163   guint32                 offset;
 164   guint                   gpio_num;
 165   guint                   gpio_edge;
 166   guint                   version;
 167   guint                   idx;
 168
 169   if (tree)
 170   {
 171     /* generate netANALYZER tree */
 172     ti = proto_tree_add_item(tree, proto_netanalyzer, tvb, 0, HEADER_SIZE, ENC_NA);
 173     netanalyzer_header_tree = proto_item_add_subtree(ti, ett_netanalyzer);
 174
 175     is_gpio = (tvb_get_guint8(tvb, 1) >> SRT_GPIO_FLAG) & 0x1;
 176
 177     if (!is_gpio)
 178     {
 179       /* normal packet, no GPIO */
 180
 181       /* decode version */
 182       version = (tvb_get_guint8(tvb, 1) >> SRT_VERSION) & 0xf;
 183       if (version != 1)
 184       {
 185         /* something is wrong */
 186         expert_add_info(pinfo, ti, &ei_netanalyzer_header_version_wrong);
 187         return FALSE;
 188       }
 189
 190       /* decode port */
 191       port_num = (tvb_get_guint8(tvb, 1) >> SRT_PORT_NUM) & 0x3;
 192       proto_tree_add_uint(netanalyzer_header_tree, hf_netanalyzer_port, tvb, 0, 4, port_num);
 193       proto_item_append_text(ti, " (Port: %u, ", port_num);
 194
 195       /* decode length */
 196       frame_length = tvb_get_letohs(tvb, 2) & MSK_LENGTH;
 197       proto_tree_add_uint(netanalyzer_header_tree, hf_netanalyzer_length, tvb, 0, 4, frame_length);
 198       proto_item_append_text(ti, "Length: %u byte%s, ", frame_length, (frame_length == 1) ? "" : "s");
 199
 200       /* decode status */
 201       proto_item_append_text(ti, "Status: ");
 202       packet_status = tvb_get_guint8(tvb, 0);
 203       if (packet_status == 0)
 204       {
 205         ti_status = proto_tree_add_uint_format(netanalyzer_header_tree, hf_netanalyzer_status, tvb, 0, 1,
 206                                                packet_status, "Status: No Error");
 207         proto_item_append_text(ti, "No Error)");
 208       }
 209       else
 210       {
 211         wmem_strbuf_t      *strbuf;
 212         gboolean            first = TRUE;
 213
 214         ti_status = proto_tree_add_uint_format(netanalyzer_header_tree, hf_netanalyzer_status, tvb, 0, 1,
 215                                                packet_status, "Status: Error present (expand tree for details)");
 216         strbuf = wmem_strbuf_new_label(wmem_epan_scope());
 217         for (idx = 0; idx < 8; idx++)
 218         {
 219           if (packet_status & (1 << idx))
 220           {
 221             if (first)
 222             {
 223               first = FALSE;
 224             }
 225             else
 226             {
 227               wmem_strbuf_append(strbuf, ", ");
 228             }
 229             wmem_strbuf_append(strbuf, msk_strings[idx]);
 230           }
 231         }
 232         proto_item_append_text(ti, "%s)", wmem_strbuf_get_str(strbuf));
 233       }
 234
 235       netanalyzer_status_tree = proto_item_add_subtree(ti_status, ett_netanalyzer_status);
 236       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_rx_err, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 237       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_align_err, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 238       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_fcs, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 239       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_too_long, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 240       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_sfd_error, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 241       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_short_frame, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 242       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_short_preamble, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 243       proto_tree_add_item(netanalyzer_status_tree, hf_netanalyzer_status_long_preamble, tvb, 0, 1, ENC_LITTLE_ENDIAN);
 244
 245       /* decode transparent mode */
 246       if (tvb_get_guint8(tvb, 1) & MSK_TRANSPARENT_MODE)
 247       {
 248         proto_tree_add_text(netanalyzer_header_tree, tvb, 0, 4, "This frame was captured in transparent mode");
 249         proto_item_append_text(ti, ", Transparent Mode");
 250
 251         if (packet_status & MSK_ALIGN_ERR)
 252         {
 253           proto_tree_add_text(netanalyzer_header_tree, tvb, tvb_length(tvb)-1, 1, "Displayed frame data contains additional nibble due to alignment error (upper nibble is not valid)");
 254         }
 255       }
 256     }
 257     else
 258     {
 259       guchar *szTemp;
 260
 261       /* GPIO pseudo packet */
 262       /* check consistency */
 263       if ( (tvb_get_guint8(tvb, 10) == 0x00) &&
 264            (tvb_get_guint8(tvb, 11) == 0x02) &&
 265            (tvb_get_guint8(tvb, 12) == 0xa2) &&
 266            (tvb_get_guint8(tvb, 13) == 0xff) &&
 267            (tvb_get_guint8(tvb, 14) == 0xff) &&
 268            (tvb_get_guint8(tvb, 15) == 0xff) &&
 269            (tvb_get_guint8(tvb, 16) == 0x88) &&
 270            (tvb_get_guint8(tvb, 17) == 0xff) &&
 271            (tvb_get_guint8(tvb, INFO_TYPE_OFFSET) == 0x00) )
 272       {
 273 #define MAX_BUFFER 255
 274         szTemp=(guchar *)wmem_alloc(wmem_epan_scope(), MAX_BUFFER);
 275
 276         /* everything ok */
 277         col_set_str(pinfo->cinfo, COL_PROTOCOL, "netANALYZER");
 278
 279         offset = INFO_TYPE_OFFSET;
 280
 281         /* GPIO number */
 282         offset++;
 283         proto_tree_add_item (netanalyzer_header_tree, hf_netanalyzer_gpio_number, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 284         gpio_num = (tvb_get_guint8(tvb, offset) & 0x03);
 285
 286         /* GPIO edge */
 287         offset++;
 288         ti = proto_tree_add_item (netanalyzer_header_tree, hf_netanalyzer_gpio_edge, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 289         gpio_edge = (tvb_get_guint8(tvb, offset) & 0x01);
 290
 291         g_snprintf(szTemp, MAX_BUFFER,
 292                    "GPIO event on GPIO %d (%sing edge)", gpio_num, (gpio_edge == 0x00) ? "ris" : "fall");
 293
 294         col_add_fstr(pinfo->cinfo, COL_INFO, "%s", szTemp);
 295         proto_item_append_text(ti, " %s", szTemp);
 296       }
 297       else
 298       {
 299         /* something is wrong */
 300         expert_add_info(pinfo, ti, &ei_netanalyzer_gpio_def_none);
 301       }
 302       return FALSE;
 303     }
 304   }
 305   return TRUE;
 306 }
 307
 308
 309 /* Ethernet capture mode */
 310 static void
 311 dissect_netanalyzer(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 312 {
 313   tvbuff_t                *next_tvb;
 314   proto_item              *ti = NULL;
 315
 316   if (tvb_length(tvb) >= 4)
 317   {
 318     /* generate tvb subset for Ethernet frame */
 319     if (dissect_netanalyzer_common(tvb, pinfo, tree))
 320     {
 321       /* hand off to eth dissector with the new tvb subset */
 322       next_tvb = tvb_new_subset_remaining(tvb, 4);
 323       call_dissector(eth_dissector_handle, next_tvb, pinfo, tree);
 324     }
 325   }
 326   else
 327   {
 328     /* something is wrong */
 329     ti = proto_tree_add_text(tree, tvb, 4, tvb_length(tvb)-4, "netANALYZER");
 330     expert_add_info(pinfo, ti, &ei_netanalyzer_header_version_none);
 331   }
 332 }
 333
 334
 335 /* Transparent capture mode */
 336 static void
 337 dissect_netanalyzer_transparent(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 338 {
 339   proto_item              *ti = NULL;
 340   proto_tree              *transparent_payload_tree = NULL;
 341   tvbuff_t                *next_tvb;
 342
 343   if (tvb_length(tvb) >= 4)
 344   {
 345     /* generate tvb subset for Ethernet frame */
 346     if (dissect_netanalyzer_common(tvb, pinfo, tree))
 347     {
 348       /* do not hand off transparent packet for further Ethernet dissectors
 349        * as normally the transparent mode is used for low level analysis
 350        * where dissecting the frame's content wouldn't make much sense
 351        * use data dissector instead */
 352       ti = proto_tree_add_text(tree, tvb, 4, tvb_length(tvb)-4, "Raw packet data");
 353       transparent_payload_tree = proto_item_add_subtree(ti, ett_netanalyzer_transparent);
 354       next_tvb = tvb_new_subset_remaining(tvb, 4);
 355       call_dissector(data_dissector_handle, next_tvb, pinfo, transparent_payload_tree);
 356
 357       col_set_str(pinfo->cinfo, COL_PROTOCOL, "netANALYZER");
 358       col_set_str(pinfo->cinfo, COL_INFO, "Frame captured in transparent mode");
 359     }
 360   }
 361   else
 362   {
 363     /* something is wrong */
 364     ti = proto_tree_add_text(tree, tvb, 4, tvb_length(tvb)-4, "netANALYZER transparent mode");
 365     expert_add_info(pinfo, ti, &ei_netanalyzer_header_version_none);
 366   }
 367 }
 368
 369
 370 void proto_register_netanalyzer(void)
 371 {
 372     static hf_register_info hf[] = {
 373         { &hf_netanalyzer_gpio_number,
 374           { "Event on", "netanalyzer.gpio_event.gpio_number",
 375             FT_UINT8, BASE_HEX, VALS(gpio_number), 0x0,
 376             "Event on GPIO number", HFILL }
 377         },
 378         { &hf_netanalyzer_gpio_edge,
 379           { "Event type", "netanalyzer.gpio_event.gpio_edge",
 380             FT_UINT8, BASE_HEX, VALS(gpio_edge_vals), 0x0,
 381             "Edge of GPIO event", HFILL }
 382         },
 383         { &hf_netanalyzer_port,
 384           { "Reception Port", "netanalyzer.port",
 385             FT_UINT8, BASE_DEC, NULL, 0x0,
 386             "netANALYZER reception port", HFILL }
 387         },
 388         { &hf_netanalyzer_length,
 389           { "Ethernet frame length", "netanalyzer.framelen",
 390             FT_UINT16, BASE_DEC, NULL, 0x0,
 391             "Actual Ethernet frame length", HFILL }
 392         },
 393         { &hf_netanalyzer_status,
 394           { "Frame Status", "netanalyzer.packetstatus",
 395             FT_UINT8, BASE_HEX, NULL, MSK_PACKET_STATUS,
 396             "Status of Ethernet frame", HFILL }
 397         },
 398         { &hf_netanalyzer_status_rx_err,
 399           { TXT_RX_ERR, "netanalyzer.packetstatus.rx_er",
 400             FT_BOOLEAN, 8, NULL, MSK_RX_ERR,
 401             "RX_ER detected in frame", HFILL }
 402         },
 403         { &hf_netanalyzer_status_align_err,
 404           { TXT_ALIGN_ERR, "netanalyzer.packetstatus.alignment_error",
 405             FT_BOOLEAN, 8, NULL, MSK_ALIGN_ERR,
 406             "Alignment error detected in frame", HFILL }
 407         },
 408         { &hf_netanalyzer_status_fcs,
 409           { TXT_FCS_ERROR, "netanalyzer.packetstatus.fcs_error",
 410             FT_BOOLEAN, 8, NULL, MSK_FCS_ERROR,
 411             "FCS error detected in frame", HFILL }
 412         },
 413         { &hf_netanalyzer_status_too_long,
 414           { TXT_TOO_LONG, "netanalyzer.packetstatus.too_long",
 415             FT_BOOLEAN, 8, NULL, MSK_TOO_LONG,
 416             "Frame too long (capture truncated)", HFILL }
 417         },
 418         { &hf_netanalyzer_status_sfd_error,
 419           { TXT_SFD_ERROR, "netanalyzer.packetstatus.sfd_error",
 420             FT_BOOLEAN, 8, NULL, MSK_SFD_ERROR,
 421             "SDF error detected in frame", HFILL }
 422         },
 423         { &hf_netanalyzer_status_short_frame,
 424           { TXT_SHORT_FRAME, "netanalyzer.packetstatus.short_frame",
 425             FT_BOOLEAN, 8, NULL, MSK_SHORT_FRAME,
 426             "Frame too short", HFILL }
 427         },
 428         { &hf_netanalyzer_status_short_preamble,
 429           { TXT_SHORT_PREAMBLE, "netanalyzer.packetstatus.short_preamble",
 430             FT_BOOLEAN, 8, NULL, MSK_SHORT_PREAMBLE,
 431             "Preamble shorter than 7 bytes", HFILL }
 432         },
 433         { &hf_netanalyzer_status_long_preamble,
 434           { TXT_LONG_PREAMBLE, "netanalyzer.packetstatus.long_preamble",
 435             FT_BOOLEAN, 8, NULL, MSK_LONG_PREAMBLE,
 436             "Preamble longer than 7 bytes", HFILL }
 437         },
 438     };
 439
 440     static gint *ett[] = {
 441         &ett_netanalyzer,
 442         &ett_netanalyzer_status,
 443         &ett_netanalyzer_transparent,
 444     };
 445
 446     static ei_register_info ei[] = {
 447         { &ei_netanalyzer_header_version_wrong, { "netanalyzer.header_version.wrong", PI_PROTOCOL, PI_ERROR, "Wrong netANALYZER header version", EXPFILL }},
 448         { &ei_netanalyzer_gpio_def_none, { "netanalyzer.gpio_def_none", PI_MALFORMED, PI_ERROR, "No valid netANALYZER GPIO definition found", EXPFILL }},
 449         { &ei_netanalyzer_header_version_none, { "netanalyzer.header_version.none", PI_MALFORMED, PI_ERROR, "No netANALYZER header found", EXPFILL }},
 450     };
 451
 452     expert_module_t* expert_netanalyzer;
 453
 454     proto_netanalyzer = proto_register_protocol (
 455                           "netANALYZER",            /* name */
 456                           "netANALYZER",            /* short name */
 457                           "netanalyzer" );          /* abbrev */
 458
 459     proto_register_field_array(proto_netanalyzer, hf, array_length(hf));
 460     proto_register_subtree_array(ett, array_length(ett));
 461     expert_netanalyzer = expert_register_protocol(proto_netanalyzer);
 462     expert_register_field_array(expert_netanalyzer, ei, array_length(ei));
 463
 464 }
 465
 466
 467 void proto_reg_handoff_netanalyzer(void)
 468 {
 469   dissector_handle_t netana_handle;
 470   dissector_handle_t netana_handle_transparent;
 471
 472   eth_dissector_handle  = find_dissector("eth_withfcs");
 473   data_dissector_handle = find_dissector("data");
 474
 475   netana_handle             = create_dissector_handle(dissect_netanalyzer,             proto_netanalyzer);
 476   netana_handle_transparent = create_dissector_handle(dissect_netanalyzer_transparent, proto_netanalyzer);
 477   dissector_add_uint("wtap_encap", WTAP_ENCAP_NETANALYZER,             netana_handle);
 478   dissector_add_uint("wtap_encap", WTAP_ENCAP_NETANALYZER_TRANSPARENT, netana_handle_transparent);
 479 }