epan/dissectors/packet-roofnet.c

   1 /* packet-roofnet.c
   2  * Routines for roofnet dissection
   3  * Copyright 2006, Sebastien Tandel (sebastien@tandel.be)
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  24  */
  25
  26 #include "config.h"
  27
  28 #include <glib.h>
  29
  30 #include <epan/packet.h>
  31 #include <epan/addr_resolv.h>
  32 #include <epan/expert.h>
  33 #include <epan/ptvcursor.h>
  34
  35
  36 /* roofnet packet type constants */
  37 #define ROOFNET_PT_QUERY 0x01
  38 #define ROOFNET_PT_REPLY 0x02
  39 #define ROOFNET_PT_DATA 0x04
  40 #define ROOFNET_PT_GATEWAY 0x08
  41 static const value_string roofnet_pt_vals[] = {
  42   { ROOFNET_PT_QUERY, "Query" },
  43   { ROOFNET_PT_REPLY, "Reply" },
  44   { ROOFNET_PT_DATA, "Data" },
  45   { ROOFNET_PT_GATEWAY, "Gateway" },
  46   { 0, NULL }
  47 };
  48
  49 /* roofnet flag bit masks */
  50 #define ROOFNET_FLAG_ERROR 0x01
  51 #define ROOFNET_FLAG_UPDATE 0x02
  52 static const value_string roofnet_flags_vals[] = {
  53   { ROOFNET_FLAG_ERROR, "Error" },
  54   { ROOFNET_FLAG_UPDATE, "Update" },
  55   { 0, NULL }
  56 };
  57
  58 /* header length */
  59 #define ROOFNET_HEADER_LENGTH 160
  60 /* roofnet max length */
  61 /* may change with time */
  62 #define ROOFNET_MAX_LENGTH 400
  63 /* Roofnet Link Description Length
  64  * which is 6 fields of 4 bytes */
  65 #define ROOFNET_LINK_DESCRIPTION_LENGTH 6*4
  66
  67 /* offset constants */
  68 #define ROOFNET_OFFSET_TYPE 1
  69 #define ROOFNET_OFFSET_NLINKS 2
  70 #define ROOFNET_OFFSET_DATA_LENGTH 10
  71
  72 /* offset relative to a link section of roofnet */
  73 #define ROOFNET_LINK_OFFSET_SRC 0
  74 #define ROOFNET_LINK_OFFSET_DST 20
  75 /* roofnet link fields length */
  76 #define ROOFNET_LINK_LEN 24
  77
  78 /* forward reference */
  79 void proto_reg_handoff_roofnet(void);
  80
  81 static dissector_handle_t ip_handle;
  82 static int proto_roofnet = -1;
  83
  84 /* hf fields for the header of roofnet */
  85 static int hf_roofnet_version = -1;
  86 static int hf_roofnet_type = -1;
  87 static int hf_roofnet_nlinks = -1;
  88 static int hf_roofnet_next = -1;
  89 static int hf_roofnet_ttl = -1;
  90 static int hf_roofnet_cksum = -1;
  91 static int hf_roofnet_flags = -1;
  92 static int hf_roofnet_data_length = -1;
  93 static int hf_roofnet_query_dst = -1;
  94 static int hf_roofnet_seq = -1;
  95 /* static int hf_roofnet_links = -1; */
  96 static int hf_roofnet_link_src = -1;
  97 static int hf_roofnet_link_forward = -1;
  98 static int hf_roofnet_link_rev = -1;
  99 static int hf_roofnet_link_seq = -1;
 100 static int hf_roofnet_link_age = -1;
 101 static int hf_roofnet_link_dst = -1;
 102
 103
 104 static gint ett_roofnet = -1;
 105 static gint ett_roofnet_link = -1;
 106
 107 static expert_field ei_roofnet_too_many_links = EI_INIT;
 108
 109 /*
 110  * dissect the header of roofnet
 111  */
 112 static void dissect_roofnet_header(proto_tree *tree, tvbuff_t *tvb, guint *offset)
 113 {
 114   ptvcursor_t *cursor = ptvcursor_new(tree, tvb, *offset);
 115
 116   ptvcursor_add(cursor, hf_roofnet_version, 1, ENC_BIG_ENDIAN);
 117   ptvcursor_add(cursor, hf_roofnet_type, 1, ENC_BIG_ENDIAN);
 118   ptvcursor_add(cursor, hf_roofnet_nlinks, 1, ENC_BIG_ENDIAN);
 119   ptvcursor_add(cursor, hf_roofnet_next, 1, ENC_BIG_ENDIAN);
 120   ptvcursor_add(cursor, hf_roofnet_ttl, 2, ENC_BIG_ENDIAN);
 121   ptvcursor_add(cursor, hf_roofnet_cksum, 2, ENC_BIG_ENDIAN);
 122   ptvcursor_add(cursor, hf_roofnet_flags, 2, ENC_BIG_ENDIAN);
 123   ptvcursor_add(cursor, hf_roofnet_data_length, 2, ENC_BIG_ENDIAN);
 124   ptvcursor_add(cursor, hf_roofnet_query_dst, 4, ENC_BIG_ENDIAN);
 125   ptvcursor_add(cursor, hf_roofnet_seq, 4, ENC_BIG_ENDIAN);
 126
 127   *offset = ptvcursor_current_offset(cursor);
 128   ptvcursor_free(cursor);
 129 }
 130
 131 /*
 132  * dissect the description of link in roofnet
 133  */
 134 static void dissect_roofnet_link(proto_tree *tree, tvbuff_t *tvb, guint *offset, guint link)
 135 {
 136   proto_item *it= NULL;
 137   proto_tree *subtree= NULL;
 138
 139   ptvcursor_t *cursor= NULL;
 140
 141   guint32 addr_src= 0;
 142   guint32 addr_dst= 0;
 143
 144   addr_src= tvb_get_ipv4(tvb, *offset + ROOFNET_LINK_OFFSET_SRC);
 145   addr_dst= tvb_get_ipv4(tvb, *offset + ROOFNET_LINK_OFFSET_DST);
 146
 147   it = proto_tree_add_text(tree, tvb, *offset, ROOFNET_LINK_LEN,
 148                             "link: %u, src: %s, dst: %s",
 149                             link,
 150                             get_hostname(addr_src),
 151                             get_hostname(addr_dst));
 152   subtree= proto_item_add_subtree(it, ett_roofnet_link);
 153
 154   proto_tree_add_ipv4(subtree, hf_roofnet_link_src, tvb, *offset, 4, addr_src);
 155   *offset += 4;
 156
 157   cursor = ptvcursor_new(subtree, tvb, *offset);
 158
 159   ptvcursor_add(cursor, hf_roofnet_link_forward, 4, ENC_BIG_ENDIAN);
 160   ptvcursor_add(cursor, hf_roofnet_link_rev, 4, ENC_BIG_ENDIAN);
 161   ptvcursor_add(cursor, hf_roofnet_link_seq, 4, ENC_BIG_ENDIAN);
 162   ptvcursor_add(cursor, hf_roofnet_link_age, 4, ENC_BIG_ENDIAN);
 163
 164   ptvcursor_free(cursor);
 165
 166   *offset = ptvcursor_current_offset(cursor);
 167   proto_tree_add_ipv4(subtree, hf_roofnet_link_dst, tvb, *offset, 4, addr_dst);
 168   /* don't increment offset here because the dst of this link is the src of the next one */
 169 }
 170
 171 /*
 172  * dissect the data in roofnet
 173  */
 174 static void dissect_roofnet_data(proto_tree *tree, tvbuff_t *tvb, packet_info * pinfo, gint offset)
 175 {
 176   guint16 roofnet_datalen= 0;
 177   guint16 remaining_datalen= 0;
 178
 179   roofnet_datalen = tvb_get_ntohs(tvb, ROOFNET_OFFSET_DATA_LENGTH);
 180   remaining_datalen= tvb_reported_length_remaining(tvb, offset);
 181
 182
 183   /* dissect on remaining_datalen */
 184    if (roofnet_datalen < remaining_datalen)
 185      proto_tree_add_text(tree, tvb, offset, roofnet_datalen,
 186          "[More payload data (%u) than told by Roofnet (%u)]",
 187          remaining_datalen, roofnet_datalen);
 188
 189   if (roofnet_datalen == 0)
 190     return;
 191
 192   /* dissect ip payload */
 193   call_dissector(ip_handle, tvb_new_subset_remaining(tvb, offset), pinfo, tree);
 194
 195 }
 196
 197 /*
 198  * entry point of the roofnet dissector
 199  */
 200 static void dissect_roofnet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 201 {
 202   proto_item * it;
 203   proto_tree * roofnet_tree;
 204   guint offset= 0;
 205
 206   guint8 roofnet_msg_type= 0;
 207   guint8 roofnet_nlinks= 0;
 208   guint8 nlink= 1;
 209
 210   col_set_str(pinfo->cinfo, COL_PROTOCOL, "Roofnet");
 211
 212   roofnet_msg_type = tvb_get_guint8(tvb, ROOFNET_OFFSET_TYPE);
 213   /* Clear out stuff in the info column */
 214   col_add_fstr(pinfo->cinfo, COL_INFO, "Message Type: %s",
 215         val_to_str(roofnet_msg_type, roofnet_pt_vals, "Unknown (%d)"));
 216
 217   it = proto_tree_add_item(tree, proto_roofnet, tvb, offset, -1, ENC_NA);
 218   roofnet_tree = proto_item_add_subtree(it, ett_roofnet);
 219
 220   dissect_roofnet_header(roofnet_tree, tvb, &offset);
 221
 222   roofnet_nlinks= tvb_get_guint8(tvb, ROOFNET_OFFSET_NLINKS);
 223   /* Check that we do not have a malformed roofnet packet */
 224   if ((roofnet_nlinks*6*4)+ROOFNET_HEADER_LENGTH > ROOFNET_MAX_LENGTH) {
 225     expert_add_info_format(pinfo, it, &ei_roofnet_too_many_links, "Too many links (%u)\n", roofnet_nlinks);
 226     return;
 227   }
 228
 229   for (; roofnet_nlinks > 0; roofnet_nlinks--) {
 230     /* Do we have enough buffer to decode the next link ? */
 231     if (tvb_reported_length_remaining(tvb, offset) < ROOFNET_LINK_DESCRIPTION_LENGTH)
 232       return;
 233     dissect_roofnet_link(roofnet_tree, tvb, &offset, nlink++);
 234   }
 235
 236   dissect_roofnet_data(tree, tvb, pinfo, offset+4);
 237 }
 238
 239 void proto_register_roofnet(void)
 240 {
 241   static hf_register_info hf[] = {
 242     /* Roofnet Header */
 243     { &hf_roofnet_version,
 244       { "Version", "roofnet.version",
 245       FT_UINT8, BASE_DEC, NULL, 0x0, "Roofnet Version", HFILL }
 246     },
 247
 248     { &hf_roofnet_type,
 249       { "Type", "roofnet.type",
 250         FT_UINT8, BASE_DEC, VALS(roofnet_pt_vals), 0x0, "Roofnet Message Type", HFILL }
 251     },
 252
 253     { &hf_roofnet_nlinks,
 254       { "Number of Links", "roofnet.nlinks",
 255         FT_UINT8, BASE_DEC, NULL, 0x0, "Roofnet Number of Links", HFILL }
 256     },
 257
 258     { &hf_roofnet_next,
 259       { "Next Link", "roofnet.next",
 260         FT_UINT8, BASE_DEC, NULL, 0x0, "Roofnet Next Link to Use", HFILL }
 261     },
 262
 263     { &hf_roofnet_ttl,
 264       { "Time To Live", "roofnet.ttl",
 265         FT_UINT16, BASE_DEC, NULL, 0x0, "Roofnet Time to Live", HFILL }
 266     },
 267
 268     { &hf_roofnet_cksum,
 269       { "Checksum", "roofnet.cksum",
 270         FT_UINT16, BASE_DEC, NULL, 0x0, "Roofnet Header Checksum", HFILL }
 271     },
 272
 273     { &hf_roofnet_flags,
 274       { "Flags", "roofnet.flags",
 275         FT_UINT16, BASE_DEC, VALS(roofnet_flags_vals), 0x0, "Roofnet Flags", HFILL }
 276     },
 277
 278     { &hf_roofnet_data_length,
 279       { "Data Length", "roofnet.datalength",
 280         FT_UINT16, BASE_DEC, NULL, 0x0, "Data Payload Length", HFILL }
 281     },
 282
 283     { &hf_roofnet_query_dst,
 284       { "Query Dst", "roofnet.querydst",
 285         FT_IPv4, BASE_NONE, NULL, 0x0, "Roofnet Query Destination", HFILL }
 286     },
 287
 288     { &hf_roofnet_seq,
 289       { "Seq", "roofnet.seq",
 290         FT_UINT32, BASE_DEC, NULL, 0x0, "Roofnet Sequential Number", HFILL }
 291     },
 292
 293 #if 0
 294     { &hf_roofnet_links,
 295       { "Links", "roofnet.links",
 296       FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }
 297     },
 298 #endif
 299
 300     { &hf_roofnet_link_src,
 301       { "Source IP", "roofnet.link.src",
 302       FT_IPv4, BASE_NONE, NULL, 0x0, "Roofnet Message Source", HFILL }
 303     },
 304
 305     { &hf_roofnet_link_forward,
 306       { "Forward", "roofnet.link.forward",
 307         FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }
 308     },
 309
 310     { &hf_roofnet_link_rev,
 311       { "Rev", "roofnet.link.rev",
 312         FT_UINT32, BASE_DEC, NULL, 0x0, "Revision Number", HFILL }
 313     },
 314
 315     { &hf_roofnet_link_seq,
 316       { "Seq", "roofnet.link.seq",
 317         FT_UINT32, BASE_DEC, NULL, 0x0, "Link Sequential Number", HFILL }
 318     },
 319
 320     { &hf_roofnet_link_age,
 321       { "Age", "roofnet.link.age",
 322         FT_UINT32, BASE_DEC, NULL, 0x0, "Information Age", HFILL }
 323     },
 324
 325     { &hf_roofnet_link_dst,
 326       { "Dst IP", "roofnet.link.dst",
 327         FT_IPv4, BASE_NONE, NULL, 0x0, "Roofnet Message Destination", HFILL }
 328     }
 329   };
 330
 331   /* setup protocol subtree array */
 332   static gint *ett[] = {
 333     &ett_roofnet,
 334     &ett_roofnet_link
 335   };
 336
 337   static ei_register_info ei[] = {
 338      { &ei_roofnet_too_many_links, { "roofnet.too_many_links", PI_MALFORMED, PI_ERROR, "Too many links", EXPFILL }},
 339   };
 340
 341   expert_module_t* expert_roofnet;
 342
 343   proto_roofnet = proto_register_protocol(
 344                                 "Roofnet Protocol", /* Name */
 345                                 "Roofnet",          /* Short Name */
 346                                 "roofnet"           /* Abbrev */
 347                                 );
 348
 349   proto_register_field_array(proto_roofnet, hf, array_length(hf));
 350   proto_register_subtree_array(ett, array_length(ett));
 351   expert_roofnet = expert_register_protocol(proto_roofnet);
 352   expert_register_field_array(expert_roofnet, ei, array_length(ei));
 353 }
 354
 355
 356 void proto_reg_handoff_roofnet(void)
 357 {
 358   dissector_handle_t roofnet_handle;
 359
 360   /* Until now there is no other option than having an IPv4 payload (maybe
 361    * extended one day to IPv6 or other?) */
 362   ip_handle = find_dissector("ip");
 363   roofnet_handle = create_dissector_handle(dissect_roofnet, proto_roofnet);
 364   /* I did not put the type numbers in the ethertypes.h as they only are
 365    * experimental and not official */
 366   dissector_add_uint("ethertype", 0x0641, roofnet_handle);
 367   dissector_add_uint("ethertype", 0x0643, roofnet_handle);
 368   dissector_add_uint("ethertype", 0x0644, roofnet_handle);
 369   dissector_add_uint("ethertype", 0x0645, roofnet_handle);
 370 }