/* packet-netlink-psample.c * Routines for netlink-psample dissection * Based on netlink-net_dm and netlink-generic dissectors * Copyright 2021, Mellanox Technologies Ltd. * Code by Amit Cohen * * Wireshark - Network traffic analyzer * By Gerald Combs * Copyright 1998 Gerald Combs * * SPDX-License-Identifier: GPL-2.0-or-later */ /* psample is a netlink-based protocol via which alerts * about sampled packets are sent to user space * * Relevant Linux kernel header file: * include/uapi/linux/psample.h */ #include "config.h" #include #include "packet-netlink.h" #include "packet-sll.h" void proto_register_netlink_psample(void); void proto_reg_handoff_netlink_psample(void); enum ws_psample_commands { WS_PSAMPLE_CMD_SAMPLE, WS_PSAMPLE_CMD_GET_GROUP, WS_PSAMPLE_CMD_NEW_GROUP, WS_PSAMPLE_CMD_DEL_GROUP, }; enum ws_psample_attrs { WS_PSAMPLE_ATTR_IIFINDEX, WS_PSAMPLE_ATTR_OIFINDEX, WS_PSAMPLE_ATTR_ORIGSIZE, WS_PSAMPLE_ATTR_SAMPLE_GROUP, WS_PSAMPLE_ATTR_GROUP_SEQ, WS_PSAMPLE_ATTR_SAMPLE_RATE, WS_PSAMPLE_ATTR_DATA, WS_PSAMPLE_ATTR_GROUP_REFCOUNT, WS_PSAMPLE_ATTR_TUNNEL, WS_PSAMPLE_ATTR_PAD, WS_PSAMPLE_ATTR_OUT_TC, WS_PSAMPLE_ATTR_OUT_TC_OCC, WS_PSAMPLE_ATTR_LATENCY, WS_PSAMPLE_ATTR_TIMESTAMP, WS_PSAMPLE_ATTR_PROTO, }; struct netlink_psample_info { packet_info *pinfo; uint16_t protocol; /* protocol for packet payload */ }; static int proto_netlink_psample; static dissector_handle_t netlink_psample_handle; static dissector_table_t sll_ltype_table; static int hf_psample_attrs; static int hf_psample_commands; static int hf_psample_group_refcount; static int hf_psample_group_seq; static int hf_psample_iifindex; static int hf_psample_latency; static int hf_psample_oifindex; static int hf_psample_origsize; static int hf_psample_out_tc; static int hf_psample_out_tc_occ; static int hf_psample_proto; static int hf_psample_sample_group; static int hf_psample_sample_rate; static int hf_psample_timestamp; static int hf_psample_tunnel; static int ett_psample; static int ett_psample_attrs; static const value_string ws_psample_commands_vals[] = { { WS_PSAMPLE_CMD_SAMPLE, "Sample" }, { WS_PSAMPLE_CMD_GET_GROUP, "Get group" }, { WS_PSAMPLE_CMD_NEW_GROUP, "New group" }, { WS_PSAMPLE_CMD_DEL_GROUP, "Delete group" }, { 0, NULL }, }; static value_string_ext ws_psample_commands_vals_ext = VALUE_STRING_EXT_INIT(ws_psample_commands_vals); static const value_string ws_psample_attrs_vals[] = { { WS_PSAMPLE_ATTR_IIFINDEX, "Input interface index" }, { WS_PSAMPLE_ATTR_OIFINDEX, "Output interface index" }, { WS_PSAMPLE_ATTR_ORIGSIZE, "Original size" }, { WS_PSAMPLE_ATTR_SAMPLE_GROUP, "Sample group" }, { WS_PSAMPLE_ATTR_GROUP_SEQ, "Group sequence number" }, { WS_PSAMPLE_ATTR_SAMPLE_RATE, "Sample rate" }, { WS_PSAMPLE_ATTR_DATA, "Data" }, { WS_PSAMPLE_ATTR_GROUP_REFCOUNT, "Group reference count" }, { WS_PSAMPLE_ATTR_TUNNEL, "Tunnel" }, { WS_PSAMPLE_ATTR_PAD, "Pad" }, { WS_PSAMPLE_ATTR_OUT_TC, "Output traffic class" }, { WS_PSAMPLE_ATTR_OUT_TC_OCC, "Output traffic class occupancy" }, { WS_PSAMPLE_ATTR_LATENCY, "Latency" }, { WS_PSAMPLE_ATTR_TIMESTAMP, "Timestamp" }, { WS_PSAMPLE_ATTR_PROTO, "Protocol" }, { 0, NULL }, }; static value_string_ext ws_psample_attrs_vals_ext = VALUE_STRING_EXT_INIT(ws_psample_attrs_vals); static int dissect_psample_attrs(tvbuff_t *tvb, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int nla_type, int offset, int len) { enum ws_psample_attrs type = (enum ws_psample_attrs) nla_type & NLA_TYPE_MASK; struct netlink_psample_info *info = (struct netlink_psample_info *) data; uint64_t value64, timestamp; nstime_t ts_nstime; tvbuff_t *next_tvb; uint32_t value; switch (type) { case WS_PSAMPLE_ATTR_IIFINDEX: proto_tree_add_item_ret_uint(tree, hf_psample_iifindex, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_OIFINDEX: proto_tree_add_item_ret_uint(tree, hf_psample_oifindex, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_ORIGSIZE: proto_tree_add_item_ret_uint(tree, hf_psample_origsize, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_SAMPLE_GROUP: proto_tree_add_item_ret_uint(tree, hf_psample_sample_group, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_GROUP_SEQ: proto_tree_add_item_ret_uint(tree, hf_psample_group_seq, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_SAMPLE_RATE: proto_tree_add_item_ret_uint(tree, hf_psample_sample_rate, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_DATA: next_tvb = tvb_new_subset_length(tvb, offset, len); if (!dissector_try_uint(sll_ltype_table, info->protocol, next_tvb, info->pinfo, tree)) call_data_dissector(next_tvb, info->pinfo, tree); return 1; case WS_PSAMPLE_ATTR_GROUP_REFCOUNT: proto_tree_add_item_ret_uint(tree, hf_psample_group_refcount, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_TUNNEL: /* Currently there is no support for tunnel dissection. */ return 0; case WS_PSAMPLE_ATTR_OUT_TC: proto_tree_add_item_ret_uint(tree, hf_psample_out_tc, tvb, offset, len, nl_data->encoding, &value); proto_item_append_text(tree, ": %u", value); return 1; case WS_PSAMPLE_ATTR_OUT_TC_OCC: proto_tree_add_item_ret_uint64(tree, hf_psample_out_tc_occ, tvb, offset, len, nl_data->encoding, &value64); proto_item_append_text(tree, ": %"PRIu64, value64); return 1; case WS_PSAMPLE_ATTR_LATENCY: proto_tree_add_item_ret_uint64(tree, hf_psample_latency, tvb, offset, len, nl_data->encoding, &value64); proto_item_append_text(tree, ": %"PRIu64, value64); return 1; case WS_PSAMPLE_ATTR_TIMESTAMP: timestamp = tvb_get_uint64(tvb, offset, nl_data->encoding); ts_nstime.secs = timestamp / 1000000000; ts_nstime.nsecs = timestamp % 1000000000; proto_tree_add_time(tree, hf_psample_timestamp, tvb, offset, 8, &ts_nstime); return 1; case WS_PSAMPLE_ATTR_PROTO: info->protocol = tvb_get_uint16(tvb, offset, nl_data->encoding); /* This attribute encodes 'skb->protocol' and if it is greater * than or equal to 1536 (0x0600), then it is an Ethertype and * we need to treat the packet as Ethernet. */ if (info->protocol >= 1536 || info->protocol == LINUX_SLL_P_802_2) info->protocol = LINUX_SLL_P_ETHERNET; proto_tree_add_item(tree, hf_psample_proto, tvb, offset, len, nl_data->encoding); return 1; default: return 0; } } static int dissect_netlink_psample(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) { genl_info_t *genl_info = (genl_info_t *)data; struct netlink_psample_info info; proto_tree *nlmsg_tree; proto_item *pi; int offset; DISSECTOR_ASSERT(genl_info); col_set_str(pinfo->cinfo, COL_PROTOCOL, "psample"); col_clear(pinfo->cinfo, COL_INFO); /* Generic netlink header */ offset = dissect_genl_header(tvb, genl_info, genl_info->nl_data, hf_psample_commands); /* Not all commands have a payload */ if (!tvb_reported_length_remaining(tvb, offset)) /* XXX If you do not set the protocol item, you cannot filter on these messages */ return offset; pi = proto_tree_add_item(tree, proto_netlink_psample, tvb, offset, -1, ENC_NA); nlmsg_tree = proto_item_add_subtree(pi, ett_psample); info.pinfo = pinfo; info.protocol = 0; offset = dissect_netlink_attributes_to_end(tvb, hf_psample_attrs, ett_psample_attrs, &info, genl_info->nl_data, nlmsg_tree, offset, dissect_psample_attrs); return offset; } void proto_register_netlink_psample(void) { static hf_register_info hf[] = { { &hf_psample_commands, { "Command", "psample.cmd", FT_UINT8, BASE_DEC | BASE_EXT_STRING, &ws_psample_commands_vals_ext, 0x00, NULL, HFILL } }, { &hf_psample_attrs, { "Attribute type", "psample.attr_type", FT_UINT16, BASE_DEC | BASE_EXT_STRING, &ws_psample_attrs_vals_ext, NLA_TYPE_MASK, NULL, HFILL } }, { &hf_psample_iifindex, { "Input interface index", "psample.iifindex", FT_UINT16, BASE_HEX, NULL, 0x00, NULL, HFILL } }, { &hf_psample_oifindex, { "Output interface index", "psample.oifindex", FT_UINT16, BASE_HEX, NULL, 0x00, NULL, HFILL } }, { &hf_psample_origsize, { "Original size", "psample.origsize", FT_UINT32, BASE_HEX, NULL, 0x00, NULL, HFILL } }, { &hf_psample_sample_group, { "Sample group", "psample.sample_group", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } }, { &hf_psample_group_seq, { "Group sequence number", "psample.group_seq_num", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } }, { &hf_psample_sample_rate, { "Sample rate", "psample.sample_rate", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } }, { &hf_psample_tunnel, { "Tunnel", "psample.tunnel", FT_UINT32, BASE_HEX, NULL, 0x00, NULL, HFILL } }, { &hf_psample_group_refcount, { "Group reference count", "psample.group_refcount", FT_UINT32, BASE_HEX, NULL, 0x00, NULL, HFILL } }, { &hf_psample_out_tc, { "Output traffic class", "psample.out_tc", FT_UINT16, BASE_DEC, NULL, 0x00, NULL, HFILL } }, { &hf_psample_out_tc_occ, { "Output traffic class occupancy", "psample.out_tc_occ", FT_UINT64, BASE_DEC, NULL, 0x00, NULL, HFILL } }, { &hf_psample_latency, { "Latency", "psample.latency", FT_UINT64, BASE_DEC, NULL, 0x00, NULL, HFILL } }, { &hf_psample_timestamp, { "Timestamp", "psample.timestamp", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x00, NULL, HFILL } }, { &hf_psample_proto, { "Protocol", "psample.proto", FT_UINT16, BASE_HEX, NULL, 0x00, NULL, HFILL } }, }; static int *ett[] = { &ett_psample, &ett_psample_attrs, }; proto_netlink_psample = proto_register_protocol("Linux psample protocol", "psample", "psample"); proto_register_field_array(proto_netlink_psample, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); netlink_psample_handle = register_dissector("psample", dissect_netlink_psample, proto_netlink_psample); } void proto_reg_handoff_netlink_psample(void) { dissector_add_string("genl.family", "psample", netlink_psample_handle); sll_ltype_table = find_dissector_table("sll.ltype"); } /* * Editor modelines - https://www.wireshark.org/tools/modelines.html * * Local variables: * c-basic-offset: 8 * tab-width: 8 * indent-tabs-mode: t * End: * * vi: set shiftwidth=8 tabstop=8 noexpandtab: * :indentSize=8:tabSize=8:noTabs=false: */