From e4ba6dbc3f1e76890b22773807ea37fe8fa2b1bc Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 10 Apr 2024 22:34:10 +0200 Subject: Adding upstream version 4.2.2. Signed-off-by: Daniel Baumann --- epan/dissectors/packet-redbackli.c | 293 +++++++++++++++++++++++++++++++++++++ 1 file changed, 293 insertions(+) create mode 100644 epan/dissectors/packet-redbackli.c (limited to 'epan/dissectors/packet-redbackli.c') diff --git a/epan/dissectors/packet-redbackli.c b/epan/dissectors/packet-redbackli.c new file mode 100644 index 00000000..372a178a --- /dev/null +++ b/epan/dissectors/packet-redbackli.c @@ -0,0 +1,293 @@ +/* packet-redbackli.c + * + * Redback Lawful Intercept Packet dissector + * + * Copyright 2008 Florian Lohoff + * + * Wireshark - Network traffic analyzer + * By Gerald Combs + * Copyright 1998 Gerald Combs + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "config.h" + +#include + +void proto_register_redbackli(void); +void proto_reg_handoff_redbackli(void); + +static int proto_redbackli = -1; + +static int hf_redbackli_avptype = -1; +static int hf_redbackli_avplen = -1; +static int hf_redbackli_seqno = -1; /* Sequence No */ +static int hf_redbackli_liid = -1; /* LI Id */ +static int hf_redbackli_sessid = -1; /* Session Id */ +static int hf_redbackli_label = -1; /* Label */ +static int hf_redbackli_acctid = -1; /* Accounting Session Id */ +static int hf_redbackli_dir = -1; /* Direction */ +static int hf_redbackli_eohpad = -1; /* End Of Header Padding */ +static int hf_redbackli_unknownavp = -1; /* Unknown AVP */ + +static int ett_redbackli = -1; + +static dissector_handle_t ip_handle; +static dissector_handle_t redbackli_handle; + + +#define RB_AVP_SEQNO 1 +#define RB_AVP_LIID 2 +#define RB_AVP_SESSID 3 +#define RB_AVP_DIR 4 +#define RB_AVP_LABEL 20 +#define RB_AVP_ACCTID 40 +#define RB_AVP_EOH 0 + +static const value_string avp_names[] = { + {RB_AVP_SEQNO, "Sequence No"}, + {RB_AVP_LIID, "Lawful Intercept Id"}, + {RB_AVP_SESSID, "Session Id"}, + {RB_AVP_LABEL, "Label"}, + {RB_AVP_ACCTID, "Accounting Session Id"}, + {RB_AVP_DIR, "Direction"}, + {RB_AVP_EOH, "End Of Header"}, + {0, NULL} +}; + +static void +redbackli_dissect_avp(guint8 avptype, guint8 avplen, tvbuff_t *tvb, gint offset, proto_tree *tree) +{ + const char *avpname; + proto_tree *st = NULL; + + avpname = val_to_str_const(avptype, avp_names, "Unknown"); + + st = proto_tree_add_subtree_format(tree, tvb, offset, avplen+2, ett_redbackli, NULL, "%s AVP", avpname); + + proto_tree_add_uint(st, hf_redbackli_avptype, tvb, offset, 1, avptype); + proto_tree_add_uint(st, hf_redbackli_avplen, tvb, offset+1, 1, avplen); + + if (!avplen) + return; + + /* XXX: ToDo: Validate the length (avplen) of the fixed length fields + before calling proto_tree_add_item(). + Note that the field lengths have been validated when + dissect_avp() is called from redbackli_dissect_heur(). + */ + + switch (avptype) { + case(RB_AVP_SEQNO): + proto_tree_add_item(st, hf_redbackli_seqno, tvb, + offset+2, avplen, ENC_BIG_ENDIAN); + break; + case(RB_AVP_LIID): + proto_tree_add_item(st, hf_redbackli_liid, tvb, + offset+2, avplen, ENC_BIG_ENDIAN); + break; + case(RB_AVP_SESSID): + proto_tree_add_item(st, hf_redbackli_sessid, tvb, + offset+2, avplen, ENC_BIG_ENDIAN); + break; + case(RB_AVP_LABEL): + proto_tree_add_item(st, hf_redbackli_label, tvb, + offset+2, avplen, ENC_ASCII); + break; + case(RB_AVP_EOH): + proto_tree_add_item(st, hf_redbackli_eohpad, tvb, + offset+2, avplen, ENC_NA); + break; + case(RB_AVP_DIR): + proto_tree_add_item(st, hf_redbackli_dir, tvb, + offset+2, avplen, ENC_NA); + break; + case(RB_AVP_ACCTID): + proto_tree_add_item(st, hf_redbackli_acctid, tvb, + offset+2, avplen, ENC_NA); + break; + default: + proto_tree_add_item(st, hf_redbackli_unknownavp, tvb, + offset+2, avplen, ENC_NA); + break; + } + + return; +} + +static int +redbackli_dissect(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) +{ + guint8 avptype, avplen; + gint len, offset = 0; + gboolean eoh; + proto_item *ti; + proto_tree *redbackli_tree = NULL; + tvbuff_t *next_tvb; + + col_set_str(pinfo->cinfo, COL_PROTOCOL, "RBLI"); + + ti = proto_tree_add_item(tree, proto_redbackli, + tvb, 0, -1, ENC_NA); + redbackli_tree = proto_item_add_subtree(ti, ett_redbackli); + + len = tvb_reported_length(tvb); + offset = 0; + eoh = FALSE; + while (!eoh && (len > 2)) { + avptype = tvb_get_guint8(tvb, offset+0); + avplen = tvb_get_guint8(tvb, offset+1); + + if ((len-2) < avplen) /* AVP Complete ? */ + break; + + if (tree) + redbackli_dissect_avp(avptype, avplen, tvb, offset, redbackli_tree); + + if (avptype == RB_AVP_EOH) + eoh = TRUE; + + offset += 2 + avplen; + len -= 2 + avplen; + } + + next_tvb = tvb_new_subset_remaining(tvb, offset); + call_dissector(ip_handle, next_tvb, pinfo, tree); + + return tvb_captured_length(tvb); +} + + +#define REDBACKLI_INTSIZE 6 +#define REDBACKLI_EOHSIZE 2 +#define MIN_REDBACKLI_SIZE (3*REDBACKLI_INTSIZE+REDBACKLI_EOHSIZE) + +static gboolean +redbackli_dissect_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) +{ + gint len, offset = 0; + gboolean eoh = FALSE; + guint8 avptype, avplen; + guint32 avpfound = 0; + + len = tvb_captured_length(tvb); + if (len < MIN_REDBACKLI_SIZE) + return FALSE; + + /* + * We scan the possible AVPs and look out for mismatches. + * An int AVP needs to be 4 byte long, and the eoh must be 0 or 1 + * long .. Unknown AVPs also mean not for us ... + * + */ + while ((len > 2) && !eoh) { + avptype = tvb_get_guint8(tvb, offset+0); + avplen = tvb_get_guint8(tvb, offset+1); + + switch (avptype) { + case(RB_AVP_SEQNO): + case(RB_AVP_LIID): + case(RB_AVP_SESSID): + if (avplen != 4) + return FALSE; + avpfound |= 1< 1 || offset == 0) + return FALSE; + eoh = TRUE; + break; + case(RB_AVP_LABEL): + case(RB_AVP_DIR): /* Is this correct? the hf_ originally had FT_UINT8 for DIR */ + case(RB_AVP_ACCTID): + break; + default: + return FALSE; + } + offset += 2 + avplen; + len -= 2 + avplen; + } + + if (!(avpfound & (1<