1 /* packet-reload-framing.c
2 * Routines for REsource LOcation And Discovery (RELOAD) Framing
3 * Author: Stephane Bryant <sbryant@glycon.org>
4 * Copyright 2010 Stonyfish Inc.
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 * Please refer to the following specs for protocol detail:
27 * - draft-ietf-p2psip-base-15
32 #include <epan/conversation.h>
33 #include <epan/expert.h>
35 #include <epan/exported_pdu.h>
36 #include <epan/wmem/wmem.h>
37 #include <packet-tcp.h>
39 /* Initialize the protocol and registered fields */
40 static int proto_reload_framing
= -1;
42 static int hf_reload_framing_type
= -1;
43 static int hf_reload_framing_sequence
= -1;
44 static int hf_reload_framing_ack_sequence
= -1;
45 static int hf_reload_framing_message
= -1;
46 static int hf_reload_framing_message_length
= -1;
47 static int hf_reload_framing_message_data
= -1;
48 static int hf_reload_framing_received
= -1;
49 static int hf_reload_framing_parsed_received
= -1;
50 static int hf_reload_framing_duplicate
= -1;
51 static int hf_reload_framing_response_in
= -1;
52 static int hf_reload_framing_response_to
= -1;
53 static int hf_reload_framing_time
= -1;
55 static dissector_handle_t reload_handle
;
57 static gint exported_pdu_tap
= -1;
59 /* Structure containing transaction specific information */
60 typedef struct _reload_frame_t
{
66 /* Structure containing conversation specific information */
67 typedef struct _reload_frame_conv_info_t
{
68 wmem_tree_t
*transaction_pdus
;
72 /* RELOAD Message classes = (message_code & 0x1) (response = request +1) */
77 /* Initialize the subtree pointers */
78 static gint ett_reload_framing
= -1;
79 static gint ett_reload_framing_message
= -1;
80 static gint ett_reload_framing_received
= -1;
82 static expert_field ei_reload_no_dissector
= EI_INIT
;
84 #define UDP_PORT_RELOAD 6084
85 #define TCP_PORT_RELOAD 6084
87 #define MIN_HDR_LENGTH 9
88 #define MIN_RELOADDATA_HDR_LENGTH 38
90 #define RELOAD_TOKEN 0xd2454c4f
92 static const value_string types
[] = {
99 get_reload_framing_message_length(packet_info
*pinfo _U_
, tvbuff_t
*tvb
, int offset
)
105 if (tvb_get_guint8(tvb
, offset
) == DATA
) {
106 length
= 1 + 4 + 3 + tvb_get_ntoh24(tvb
, 1 + 4);
114 dissect_reload_framing_message(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, gboolean from_dtls
)
117 proto_tree
*reload_framing_tree
;
119 guint32 message_length
= 0;
120 wmem_tree_key_t transaction_id_key
[4];
121 guint32
*key_save
, len_save
;
123 guint effective_length
;
125 conversation_t
*conversation
;
126 reload_conv_info_t
*reload_framing_info
= NULL
;
127 reload_frame_t
* reload_frame
;
131 effective_length
= tvb_length(tvb
);
133 /* First, make sure we have enough data to do the check. */
134 if (effective_length
< MIN_HDR_LENGTH
)
138 * http://tools.ietf.org/html/draft-ietf-p2psip-base-12
139 * 5.6.2. Framing Header
141 type
= tvb_get_guint8(tvb
, 0);
145 /* in the data type, check the reload token to be sure this
148 if (effective_length
< 12) /* [type + seq + length + token] */
151 relo_token
= tvb_get_ntohl(tvb
,1 + 4 + 3);
152 if (relo_token
!= RELOAD_TOKEN
) {
155 message_length
= tvb_get_ntoh24(tvb
, 1 + 4);
156 if (message_length
< MIN_RELOADDATA_HDR_LENGTH
) {
161 /* Require previous ACK (i.e., reload_framing_info attached to conversation). */
162 if (effective_length
< 9 || ! reload_framing_info
) {
170 conversation
= find_conversation(pinfo
->fd
->num
, &pinfo
->src
, &pinfo
->dst
,
171 pinfo
->ptype
, pinfo
->srcport
, pinfo
->destport
, 0);
173 reload_framing_info
= (reload_conv_info_t
*)conversation_get_proto_data(conversation
, proto_reload_framing
);
175 if (from_dtls
&& have_tap_listener(exported_pdu_tap
)) {
176 exp_pdu_data_t
*exp_pdu_data
;
178 exp_pdu_data
= load_export_pdu_tags(pinfo
, "reload-framing", -1,
179 (EXP_PDU_TAG_IP_SRC_BIT
| EXP_PDU_TAG_IP_DST_BIT
| EXP_PDU_TAG_SRC_PORT_BIT
|
180 EXP_PDU_TAG_DST_PORT_BIT
| EXP_PDU_TAG_ORIG_FNO_BIT
));
182 exp_pdu_data
->tvb_length
= effective_length
;
183 exp_pdu_data
->pdu_tvb
= tvb
;
185 tap_queue_packet(exported_pdu_tap
, pinfo
, exp_pdu_data
);
188 /* The message seems to be a valid RELOAD framing message! */
190 col_set_str(pinfo
->cinfo
, COL_PROTOCOL
, "RELOAD Frame");
191 col_clear(pinfo
->cinfo
, COL_INFO
);
193 /* Create the transaction key which may be used to track the conversation */
195 sequence
= tvb_get_ntohl(tvb
, 1);
196 transaction_id_key
[0].length
= 1;
197 transaction_id_key
[0].key
= &sequence
; /* sequence number */
199 /* When the wmem_tree_* functions iterate through the keys, they
200 * perform pointer arithmetic with guint32s, so we have to divide
201 * our length fields by that to make things work, but we still want
202 * to g_malloc and memcpy the entire amounts, since those both operate
205 transaction_id_key
[1].length
= 1;
206 transaction_id_key
[1].key
= &pinfo
->srcport
;
207 transaction_id_key
[2].length
= (pinfo
->src
.len
) / (guint
)sizeof(guint32
);
208 transaction_id_key
[2].key
= (guint32
*)g_malloc(pinfo
->src
.len
);
209 memcpy(transaction_id_key
[2].key
, pinfo
->src
.data
, pinfo
->src
.len
);
212 transaction_id_key
[1].length
= 1;
213 transaction_id_key
[1].key
= &pinfo
->destport
;
214 transaction_id_key
[2].length
= (pinfo
->dst
.len
) / (guint
)sizeof(guint32
);
215 transaction_id_key
[2].key
= (guint32
*)g_malloc(pinfo
->dst
.len
);
216 memcpy(transaction_id_key
[2].key
, pinfo
->dst
.data
, pinfo
->dst
.len
);
218 transaction_id_key
[3].length
=0;
219 transaction_id_key
[3].key
=NULL
;
220 /* The tree functions are destructive to this part of the key, so save the
221 * proper values here and restore them after each call. */
222 key_save
= transaction_id_key
[2].key
;
223 len_save
= transaction_id_key
[2].length
;
226 conversation
= conversation_new(pinfo
->fd
->num
, &pinfo
->src
, &pinfo
->dst
,
227 pinfo
->ptype
, pinfo
->srcport
, pinfo
->destport
, 0);
231 * Do we already have a state structure for this conv
233 if (!reload_framing_info
) {
234 /* No. Attach that information to the conversation, and add
235 * it to the list of information structures.
237 reload_framing_info
= wmem_new(wmem_file_scope(), reload_conv_info_t
);
238 reload_framing_info
->transaction_pdus
= wmem_tree_new(wmem_file_scope());
239 conversation_add_proto_data(conversation
, proto_reload_framing
, reload_framing_info
);
242 if (!pinfo
->fd
->flags
.visited
) {
243 if ((reload_frame
= (reload_frame_t
*)
244 wmem_tree_lookup32_array(reload_framing_info
->transaction_pdus
, transaction_id_key
)) == NULL
) {
245 transaction_id_key
[2].key
= key_save
;
246 transaction_id_key
[2].length
= len_save
;
247 reload_frame
= wmem_new(wmem_file_scope(), reload_frame_t
);
248 reload_frame
->data_frame
= 0;
249 reload_frame
->ack_frame
= 0;
250 reload_frame
->req_time
= pinfo
->fd
->abs_ts
;
251 wmem_tree_insert32_array(reload_framing_info
->transaction_pdus
, transaction_id_key
, (void *)reload_frame
);
253 transaction_id_key
[2].key
= key_save
;
254 transaction_id_key
[2].length
= len_save
;
256 /* check whether the message is a request or a response */
260 if (reload_frame
->data_frame
== 0) {
261 reload_frame
->data_frame
= pinfo
->fd
->num
;
265 /* This is a catch-all for all non-request messages */
266 if (reload_frame
->ack_frame
== 0) {
267 reload_frame
->ack_frame
= pinfo
->fd
->num
;
272 reload_frame
=(reload_frame_t
*)wmem_tree_lookup32_array(reload_framing_info
->transaction_pdus
, transaction_id_key
);
273 transaction_id_key
[2].key
= key_save
;
274 transaction_id_key
[2].length
= len_save
;
276 g_free(transaction_id_key
[2].key
);
279 /* create a "fake" pana_trans structure */
280 reload_frame
= wmem_new(wmem_packet_scope(), reload_frame_t
);
281 reload_frame
->data_frame
= (type
==DATA
) ? pinfo
->fd
->num
: 0;
282 reload_frame
->ack_frame
= (type
!=DATA
) ? pinfo
->fd
->num
: 0;
283 reload_frame
->req_time
= pinfo
->fd
->abs_ts
;
286 ti
= proto_tree_add_item(tree
, proto_reload_framing
, tvb
, 0, -1, ENC_NA
);
288 reload_framing_tree
= proto_item_add_subtree(ti
, ett_reload_framing
);
290 col_add_fstr(pinfo
->cinfo
, COL_INFO
, "%s", val_to_str_const(type
, types
, "Unknown"));
291 proto_item_append_text(ti
, ": %s", val_to_str_const(type
, types
, "Unknown"));
293 /* Retransmission control */
295 if (reload_frame
->data_frame
!= pinfo
->fd
->num
) {
297 it
= proto_tree_add_uint(reload_framing_tree
, hf_reload_framing_duplicate
, tvb
, 0, 0, reload_frame
->data_frame
);
298 PROTO_ITEM_SET_GENERATED(it
);
300 if (reload_frame
->ack_frame
) {
302 it
= proto_tree_add_uint(reload_framing_tree
, hf_reload_framing_response_in
, tvb
, 0, 0, reload_frame
->ack_frame
);
303 PROTO_ITEM_SET_GENERATED(it
);
307 /* This is a response */
308 if (reload_frame
->ack_frame
!= pinfo
->fd
->num
) {
310 it
= proto_tree_add_uint(reload_framing_tree
, hf_reload_framing_duplicate
, tvb
, 0, 0, reload_frame
->ack_frame
);
311 PROTO_ITEM_SET_GENERATED(it
);
314 if (reload_frame
->data_frame
) {
318 it
= proto_tree_add_uint(reload_framing_tree
, hf_reload_framing_response_to
, tvb
, 0, 0, reload_frame
->data_frame
);
319 PROTO_ITEM_SET_GENERATED(it
);
321 nstime_delta(&ns
, &pinfo
->fd
->abs_ts
, &reload_frame
->req_time
);
322 it
= proto_tree_add_time(reload_framing_tree
, hf_reload_framing_time
, tvb
, 0, 0, &ns
);
323 PROTO_ITEM_SET_GENERATED(it
);
330 proto_tree_add_item(reload_framing_tree
, hf_reload_framing_type
, tvb
, offset
, 1, ENC_BIG_ENDIAN
);
337 proto_item
*ti_message
;
338 proto_tree
*message_tree
;
340 proto_tree_add_item(reload_framing_tree
, hf_reload_framing_sequence
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
342 ti_message
= proto_tree_add_item(reload_framing_tree
, hf_reload_framing_message
, tvb
, offset
, 3+message_length
, ENC_NA
);
343 proto_item_append_text(ti_message
, " (opaque<%d>)", message_length
);
344 message_tree
= proto_item_add_subtree(ti_message
, ett_reload_framing_message
);
345 proto_tree_add_item(message_tree
, hf_reload_framing_message_length
, tvb
, offset
, 3, ENC_BIG_ENDIAN
);
347 proto_tree_add_item(message_tree
, hf_reload_framing_message_data
, tvb
, offset
, message_length
, ENC_NA
);
348 next_tvb
= tvb_new_subset(tvb
, offset
, effective_length
- offset
, message_length
);
349 if (reload_handle
== NULL
) {
350 expert_add_info(pinfo
, ti
, &ei_reload_no_dissector
);
351 return tvb_length(tvb
);
353 call_dissector_only(reload_handle
, next_tvb
, pinfo
, tree
, NULL
);
359 proto_item
*ti_received
;
361 proto_tree_add_uint(reload_framing_tree
, hf_reload_framing_ack_sequence
, tvb
, offset
, 4, sequence
);
364 ti_received
= proto_tree_add_item(reload_framing_tree
, hf_reload_framing_received
, tvb
, offset
, 4, ENC_BIG_ENDIAN
);
367 int last_received
= -1;
369 proto_tree
*received_tree
;
370 proto_item
*ti_parsed_received
= NULL
;
372 received
= tvb_get_ntohl(tvb
, offset
);
373 while ((received
<<indx
) != 0) {
375 if (received
&(0x1<<(31-indx
))) {
377 received_tree
= proto_item_add_subtree(ti_received
, ett_reload_framing_received
);
378 ti_parsed_received
= proto_tree_add_item(received_tree
, hf_reload_framing_parsed_received
, tvb
, offset
, 4, ENC_NA
);
379 proto_item_append_text(ti_parsed_received
, "[%u", (sequence
-32+indx
));
380 last_received
= indx
;
383 if (received
&(0x1<<(31-indx
+1))) {
389 /* 1st acked in a serie */
390 if (last_received
<0) {
392 received_tree
= proto_item_add_subtree(ti_received
, ett_reload_framing_received
);
393 ti_parsed_received
= proto_tree_add_item(received_tree
, hf_reload_framing_parsed_received
, tvb
, offset
, 4, ENC_NA
);
394 proto_item_append_text(ti_parsed_received
, "[%u",(sequence
-32+indx
));
397 proto_item_append_text(ti_parsed_received
, ",%u",(sequence
-32+indx
));
399 last_received
= indx
;
405 if ((received
&(0x1<<(31-indx
+1))) && (received
&(0x1<<(31-indx
+2)))) {
406 /* end of a series */
407 if ((received
&(0x1<<(31-indx
+3)))) {
408 proto_item_append_text(ti_parsed_received
,"-%u",(sequence
-32+indx
-1));
412 proto_item_append_text(ti_received
, ",%u", (sequence
-32+indx
-1));
422 if (last_received
>=0) {
423 if ((received
&(0x1<<(31-indx
+1))) && (received
&(0x1<<(31-indx
+2)))) {
424 /* end of a series */
425 if ((received
&(0x1<<(31-indx
+3)))) {
426 proto_item_append_text(ti_parsed_received
,"-%u",(sequence
-32+indx
-1));
430 proto_item_append_text(ti_parsed_received
, ",%u", (sequence
-32+indx
-1));
433 proto_item_append_text(ti_parsed_received
, "]");
434 PROTO_ITEM_SET_GENERATED(ti_parsed_received
);
441 DISSECTOR_ASSERT_NOT_REACHED();
444 return tvb_length(tvb
);
448 dissect_reload_framing(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void *data _U_
)
450 return dissect_reload_framing_message(tvb
, pinfo
, tree
, FALSE
);
454 dissect_reload_framing_tcp(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void* data
)
456 /* XXX: Check if we have a valid RELOAD Frame Type ? */
457 tcp_dissect_pdus(tvb
, pinfo
, tree
, TRUE
, MIN_HDR_LENGTH
,
458 get_reload_framing_message_length
, dissect_reload_framing
, data
);
459 return tvb_length(tvb
);
462 /* ToDo: If a TCP connection is identified heuristically as reload-framing, then
463 * the code should be such that reload-framing PDUs can be re-assembled (as is
464 * done for a TCP connection identified as reload-framing because of
465 * the TCP port used).
468 dissect_reload_framing_heur(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void *data _U_
)
470 if (dissect_reload_framing_message(tvb
, pinfo
, tree
, FALSE
) == 0) {
472 * It wasn't a valid RELOAD message, and wasn't
481 dissect_reload_framing_heur_dtls(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void *data _U_
)
483 if (dissect_reload_framing_message(tvb
, pinfo
, tree
, TRUE
) == 0) {
485 * It wasn't a valid RELOAD message, and wasn't
494 proto_register_reload_framing(void)
497 static hf_register_info hf
[] = {
498 { &hf_reload_framing_type
,
499 { "type (FramedMessageType)", "reload_framing.type", FT_UINT8
,
500 BASE_DEC
, VALS(types
), 0x0, NULL
, HFILL
503 { &hf_reload_framing_sequence
,
504 { "sequence (uint32)", "reload_framing.sequence", FT_UINT32
,
505 BASE_DEC
, NULL
, 0x0, NULL
, HFILL
508 { &hf_reload_framing_ack_sequence
,
509 { "ack_sequence (uint32)", "reload_framing.ack_sequence", FT_UINT32
,
510 BASE_DEC
, NULL
, 0x0, NULL
, HFILL
513 { &hf_reload_framing_message
,
514 { "message", "reload_framing.message", FT_NONE
,
515 BASE_NONE
, NULL
, 0x0, NULL
, HFILL
518 { &hf_reload_framing_message_length
,
519 { "length (uint24)", "reload_framing.message.length", FT_UINT32
,
520 BASE_DEC
, NULL
, 0x0, NULL
, HFILL
523 { &hf_reload_framing_message_data
,
524 { "data", "reload_framing.message.data", FT_BYTES
,
525 BASE_NONE
, NULL
, 0x0, NULL
, HFILL
528 { &hf_reload_framing_received
,
529 { "received (uint32)", "reload_framing.received", FT_UINT32
,
530 BASE_HEX
, NULL
, 0x0, NULL
, HFILL
533 { &hf_reload_framing_parsed_received
,
534 { "Acked Frames:", "reload_framing.parsed_received", FT_NONE
,
535 BASE_NONE
, NULL
, 0x0, NULL
, HFILL
538 { &hf_reload_framing_response_in
,
539 { "Response In", "reload_framing.response-in", FT_FRAMENUM
,
540 BASE_NONE
, NULL
, 0x0, "The response to this RELOAD Request is in this frame", HFILL
543 { &hf_reload_framing_response_to
,
544 { "Request In", "reload_framing.response-to", FT_FRAMENUM
,
545 BASE_NONE
, NULL
, 0x0, "This is a response to the RELOAD Request in this frame", HFILL
548 { &hf_reload_framing_time
,
549 { "Time", "reload_framing.time", FT_RELATIVE_TIME
,
550 BASE_NONE
, NULL
, 0x0, "The time between the Request and the Response", HFILL
553 { &hf_reload_framing_duplicate
,
554 { "Duplicated original message in", "reload_framing.duplicate", FT_FRAMENUM
,
555 BASE_NONE
, NULL
, 0x0, "This is a duplicate of RELOAD message in this frame", HFILL
560 /* Setup protocol subtree array */
561 static gint
*ett
[] = {
563 &ett_reload_framing_message
,
564 &ett_reload_framing_received
,
567 static ei_register_info ei
[] = {
568 { &ei_reload_no_dissector
, { "reload_framing.no_dissector", PI_PROTOCOL
, PI_WARN
, "Can not find reload dissector", EXPFILL
}},
571 expert_module_t
* expert_reload_framing
;
573 /* Register the protocol name and description */
574 proto_reload_framing
= proto_register_protocol("REsource LOcation And Discovery Framing", "RELOAD FRAMING", "reload-framing");
576 /* Required function calls to register the header fields and subtrees used */
577 proto_register_field_array(proto_reload_framing
, hf
, array_length(hf
));
578 proto_register_subtree_array(ett
, array_length(ett
));
579 expert_reload_framing
= expert_register_protocol(proto_reload_framing
);
580 expert_register_field_array(expert_reload_framing
, ei
, array_length(ei
));
582 new_register_dissector("reload-framing", dissect_reload_framing
, proto_reload_framing
);
587 proto_reg_handoff_reload_framing(void)
590 dissector_handle_t reload_framing_tcp_handle
;
591 dissector_handle_t reload_framing_udp_handle
;
593 reload_framing_tcp_handle
= new_create_dissector_handle(dissect_reload_framing_tcp
, proto_reload_framing
);
594 reload_framing_udp_handle
= new_create_dissector_handle(dissect_reload_framing
, proto_reload_framing
);
596 reload_handle
= find_dissector("reload");
598 dissector_add_uint("tcp.port", TCP_PORT_RELOAD
, reload_framing_tcp_handle
);
599 dissector_add_uint("udp.port", UDP_PORT_RELOAD
, reload_framing_udp_handle
);
601 heur_dissector_add("udp", dissect_reload_framing_heur
, proto_reload_framing
);
602 heur_dissector_add("tcp", dissect_reload_framing_heur
, proto_reload_framing
);
603 heur_dissector_add("dtls", dissect_reload_framing_heur_dtls
, proto_reload_framing
);
605 exported_pdu_tap
= find_tap_id(EXPORT_PDU_TAP_NAME_LAYER_7
);
609 * Editor modelines - http://www.wireshark.org/tools/modelines.html
614 * indent-tabs-mode: nil
617 * vi: set shiftwidth=2 tabstop=8 expandtab:
618 * :indentSize=2:tabSize=8:noTabs=true: