1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
/* packet-pcaplog.c
* Routines for pcaplog dissection
* Copyright 2023, Dr. Lars Völker <lars.voelker@technica-engineering.de>
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "config.h"
#define WS_LOG_DOMAIN "pcaplog"
#define PEN_VCTR 46254
#include <wireshark.h>
#include <epan/packet.h>
#include <epan/addr_resolv.h>
void proto_reg_handoff_pcaplog(void);
void proto_register_pcaplog(void);
static int proto_pcaplog;
static int hf_pcaplog_type;
static int hf_pcaplog_length;
static int hf_pcaplog_data;
static dissector_handle_t pcaplog_handle;
static dissector_handle_t xml_handle;
static int ett_pcaplog;
static int ett_pcaplog_data;
static int
dissect_pcaplog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
void *data _U_)
{
uint32_t data_type;
uint32_t data_length;
proto_item *pcaplog_item;
proto_tree *pcaplog_tree;
proto_item *pi_tmp;
proto_tree *pt_pcaplog_data;
pcaplog_item = proto_tree_add_item(tree, proto_pcaplog, tvb, 0, -1, ENC_NA);
pcaplog_tree = proto_item_add_subtree(pcaplog_item, ett_pcaplog);
proto_tree_add_item_ret_uint(pcaplog_tree, hf_pcaplog_type, tvb, 0, 4, ENC_LITTLE_ENDIAN, &data_type);
proto_tree_add_item_ret_uint(pcaplog_tree, hf_pcaplog_length, tvb, 4, 4, ENC_LITTLE_ENDIAN, &data_length);
pi_tmp = proto_tree_add_item(pcaplog_tree, hf_pcaplog_data, tvb, 8, data_length, ENC_NA);
pt_pcaplog_data = proto_item_add_subtree(pi_tmp, ett_pcaplog_data);
col_set_str(pinfo->cinfo, COL_PROTOCOL, "pcaplog");
col_add_fstr(pinfo->cinfo, COL_INFO, "Custom Block: PEN = %s (%d), will%s be copied",
enterprises_lookup(pinfo->rec->rec_header.custom_block_header.pen, "Unknown"),
pinfo->rec->rec_header.custom_block_header.pen,
pinfo->rec->rec_header.custom_block_header.copy_allowed ? "" : " not");
/* at least data_types 1-3 seem XML-based */
if (data_type > 0 && data_type <= 3) {
call_dissector(xml_handle, tvb_new_subset_remaining(tvb, 8), pinfo, pt_pcaplog_data);
} else {
call_data_dissector(tvb_new_subset_remaining(tvb, 8), pinfo, pt_pcaplog_data);
}
return tvb_captured_length(tvb);
}
void
proto_register_pcaplog(void)
{
static hf_register_info hf[] = {
{ &hf_pcaplog_type,
{ "Date Type", "pcaplog.data_type",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL} },
{ &hf_pcaplog_length,
{ "Data Length", "pcaplog.data_length",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL} },
{ &hf_pcaplog_data,
{ "Data", "pcaplog.data",
FT_BYTES, BASE_NONE, NULL, 0x0,
NULL, HFILL} },
};
static int *ett[] = {
&ett_pcaplog,
&ett_pcaplog_data,
};
proto_pcaplog = proto_register_protocol("pcaplog",
"pcaplog", "pcaplog");
proto_register_field_array(proto_pcaplog, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
pcaplog_handle = register_dissector("pcaplog", dissect_pcaplog,
proto_pcaplog);
}
void
proto_reg_handoff_pcaplog(void)
{
xml_handle = find_dissector_add_dependency("xml", proto_pcaplog);
dissector_add_uint("pcapng_custom_block", PEN_VCTR, pcaplog_handle);
}
|
