Wireshark · Ethereal-dev: [ethereal-dev] WCCP 1.0 Decoder

[Jerry Talkington <jerryt@xxxxxxxxxx>]

I put together a WCCPv1 dissector.  I can't do the WCCP version 2 dissector
(well, I plan on doing one, but I can't release it), since the company I
work for had to license it from Cisco.

This also modifies the GRE dissector, to get to the payload of the packets,
and to add search fields for the protocols it knows about.

For some reason the cvs diff I'm using doesn't pick up new files (even with the
-N flag), so I'll attach packet-wccp.c as a seperate file.

-- 
Jerry Talkington
NetCache Escalation Engineer
Network Appliance, Inc.

"I believe the children are our future: nasty, brutish and short."

Index: Makefile.am
===================================================================
RCS file: /cvsroot/ethereal/Makefile.am,v
retrieving revision 1.131
diff -u -r1.131 Makefile.am
--- Makefile.am	1999/12/09 20:41:23	1.131
+++ Makefile.am	1999/12/11 21:20:12
@@ -146,6 +146,7 @@
 	packet-vines.h \
 	packet-vlan.c \
 	packet-vrrp.c \
+	packet-wccp.c\
 	packet-x25.c   \
 	packet-yhoo.c  \
 	packet-yhoo.h  \
Index: packet-gre.c
===================================================================
RCS file: /cvsroot/ethereal/packet-gre.c,v
retrieving revision 1.11
diff -u -r1.11 packet-gre.c
--- packet-gre.c	1999/12/10 21:27:13	1.11
+++ packet-gre.c	1999/12/11 21:20:13
@@ -42,6 +42,9 @@
 
 static gint ett_gre = -1;
 static gint ett_gre_flags = -1;
+static guint32 hf_gre_ppp = -1;
+static guint32 hf_gre_ip  = -1;
+static guint32 hf_gre_wccp = -1;
 
 /* bit positions for flags in header */
 #define GH_B_C		0x8000
@@ -57,10 +60,12 @@
 
 #define GRE_PPP		0x880B
 #define	GRE_IP		0x0800
+#define GRE_WCCP	0x883e
 
 static int calc_len(guint16, int);
 static void add_flags_and_ver(proto_tree *, guint16, int, int);
 
+
 void
 dissect_gre(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
   
@@ -69,6 +74,7 @@
   static const value_string typevals[] = {
     { GRE_PPP, "PPP" },
     { GRE_IP,  "IP" },
+    { GRE_WCCP, "WCCP"},
     { 0,       NULL  }
   };
   guint16	sre_af;
@@ -101,8 +107,29 @@
     proto_tree_add_text(gre_tree, offset, sizeof(type),
 			"Protocol Type: %s (%#04x)",
 			val_to_str(type, typevals, "Unknown"), type);
-    offset += sizeof(type);    
+    if(type == GRE_PPP) {
+    	proto_tree_add_item_hidden(gre_tree, hf_gre_ppp, offset, sizeof(type), TRUE);
+    	offset += sizeof(type);    
+    } else if(type == GRE_IP) {
+    	proto_tree_add_item_hidden(gre_tree, hf_gre_ip, offset, sizeof(type), TRUE);
+    	offset += sizeof(type);    
+    } else if(type == GRE_WCCP) {
+    	guint8 ip_offset;
+	
+	proto_tree_add_item_hidden(gre_tree, hf_gre_wccp, offset, sizeof(type), TRUE);
+    	offset += sizeof(type);    
+	
+	ip_offset = pd[offset]; 
+	if ((ip_offset & 0x45)) {
+		/* we can assume that all wccp packets are streaming ip */
+	} else {
+		/* WCCP 1 and 2 both use the same type, but v2 has an extra 4 octet header */
+		offset += sizeof(guint32);
+	}
 
+    }
+    	
+
     if (flags_and_ver & GH_B_C || flags_and_ver & GH_B_R) {
       guint16 checksum = pntohs(pd + offset);
       proto_tree_add_text(gre_tree, offset, sizeof(checksum),
@@ -174,13 +201,15 @@
 
     switch (type) {
       case GRE_PPP:
- 	dissect_payload_ppp(pd, offset, fd, tree);
+	dissect_payload_ppp(pd, offset, fd, tree);
  	break;
       case GRE_IP:
+      case GRE_WCCP:
         dissect_ip(pd, offset, fd, tree);
         break;
       default:
 	dissect_data(pd, offset, fd, gre_tree);
+	break;
     }
   }
 }
@@ -258,16 +287,26 @@
 void
 proto_register_gre(void)
 {
-/*        static hf_register_info hf[] = {
-                { &variable,
-                { "Name",           "gre.abbreviation", TYPE, VALS_POINTER }},
-        };*/
+	static hf_register_info hf[] = {
+		{ &hf_gre_ppp,
+			{ "GRE Encapsulated PPP", "gre.ppp", FT_BOOLEAN, BASE_NONE, 0x0, 0x0,
+				"GRE Encapsulated PPP"}
+		},
+		{ &hf_gre_ppp,
+			{ "GRE Encapsulated IP", "gre.ip", FT_BOOLEAN, BASE_NONE, 0x0, 0x0,
+				"GRE Encapsulated IP"}
+		},
+		{ &hf_gre_wccp,
+			{ "GRE Encapsulated WCCP", "gre.wccp", FT_BOOLEAN, BASE_NONE, 0x0, 0x0,
+				"GRE Encapsulated WCCP"}
+		},
+	};
 	static gint *ett[] = {
 		&ett_gre,
 		&ett_gre_flags,
 	};
 
         proto_gre = proto_register_protocol("Generic Routing Encapsulation", "gre");
- /*       proto_register_field_array(proto_gre, hf, array_length(hf));*/
+        proto_register_field_array(proto_gre, hf, array_length(hf));
 	proto_register_subtree_array(ett, array_length(ett));
 }
Index: packet-udp.c
===================================================================
RCS file: /cvsroot/ethereal/packet-udp.c,v
retrieving revision 1.42
diff -u -r1.42 packet-udp.c
--- packet-udp.c	1999/12/09 20:41:26	1.42
+++ packet-udp.c	1999/12/11 21:20:13
@@ -95,6 +95,7 @@
 #define UDP_PORT_RX_LOW 7000
 #define UDP_PORT_RX_HIGH 7009
 #define UDP_PORT_RX_AFS_BACKUPS 7021
+#define UDP_PORT_WCCP	2048
 
 struct hash_struct {
   guint16 proto;
@@ -308,6 +309,8 @@
 	dissect_icp(pd,offset,fd,tree);
  } else if ( PORT_IS(UDP_PORT_ICQ)) {
         dissect_icq(pd,offset,fd,tree);
+ } else if (PORT_IS(UDP_PORT_WCCP) ) {
+ 	dissect_wccp(pd, offset, fd, tree);
  } else {
       /* OK, find a routine in the table, else use the default */
 
Index: packet.h
===================================================================
RCS file: /cvsroot/ethereal/packet.h,v
retrieving revision 1.159
diff -u -r1.159 packet.h
--- packet.h	1999/12/09 04:06:54	1.159
+++ packet.h	1999/12/11 21:20:13
@@ -406,6 +406,7 @@
 void dissect_vines_spp(const u_char *, int, frame_data *, proto_tree *);
 void dissect_vlan(const u_char *, int, frame_data *, proto_tree *);
 void dissect_vrrp(const u_char *, int, frame_data *, proto_tree *);
+void dissect_wccp(const u_char *, int, frame_data *, proto_tree *);
 void dissect_payload_ppp(const u_char *, int, frame_data *, proto_tree *);
 void dissect_x25(const u_char *, int, frame_data *, proto_tree *);
 void dissect_yhoo(const u_char *, int, frame_data *, proto_tree *);

/* packet-wccp.c
 * Routines for Web Cache Coordination Protocol dissection
 * Jerry Talkington <jerryt@xxxxxxxxxx>
 *
 * $Id: $
 *
 * Ethereal - Network traffic analyzer
 * By Gerald Combs <gerald@xxxxxxxxxx>
 * Copyright 1998 Gerald Combs
 *
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#ifdef HAVE_SYS_TYPES_H
# include <sys/types.h>
#endif

#ifdef HAVE_NETINET_IN_H
#include <netinet/in.h>
#endif
#include <glib.h>
#include "packet.h"

#define WCCPv1			0x0004
#define WCCP_HERE_I_AM		0x0007
#define WCCP_I_SEE_YOU		0x0008
#define WCCP_ASSIGN_BUCKET	0x0009

static const value_string wccp_types[] = {
	{ WCCP_HERE_I_AM, "WCCP_HERE_I_AM" }, 
	{ WCCP_I_SEE_YOU, "WCCP_I_SEE_YOU" },
	{ WCCP_ASSIGN_BUCKET, "WCCP_ASSIGN_BUCKET" },
	{ 0, NULL}
};

static const value_string wccp_version_val[] = {
	{ WCCPv1, "1"},
	{ 0, NULL}
};

typedef struct _wccp_cache_info {
	guint32 ip_addr;
	guint32 hash_rev;
	guint32 hash_info[8];
	guint32 reserved;
} wccp_cache_info;

static guint32 proto_wccp = -1;
static guint32 ett_wccp = -1;
static guint32 ett_cache_count = -1;
static guint32 ett_cache_info = -1;
static guint32 ett_buckets = -1;
static guint32 hf_wccp_message_type = -1;	/* the message type */
static guint32 hf_wccp_version = -1;		/* protocol version */
static guint32 hf_hash_version = -1;		/* the version of the hash */
static guint32 hf_change_num = -1;		/* change number */
static guint32 hf_recvd_id = -1;			
static guint32 hf_cache_ip = -1;

int wccp_bucket_info(guint8 bucket_info, proto_tree *bucket_tree, guint32 start, int offset);

void
dissect_wccp(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
{
	const u_char *data, *data_end;
	proto_tree *wccp_tree = NULL;
	proto_item *wccp_tree_item = NULL;
	guint32 wccp_message_type = 0;
	
	data = &pd[offset];
	data_end = data + END_OF_FRAME;

	if(check_col(fd, COL_PROTOCOL)) {
		col_add_str(fd, COL_PROTOCOL, "WCCP");
	}
	
	wccp_message_type = pntohl(&pd[offset]);

	if(check_col(fd, COL_INFO)) {
		col_add_str(fd, COL_INFO, val_to_str(wccp_message_type, wccp_types, "Unknown WCCP message"));
	}

	if(tree != NULL) {
		guint32 wccp_version = 0;

		wccp_tree_item = proto_tree_add_item_format(tree, proto_wccp, offset, (data_end - data),
			NULL, "Web Cache Coordination Protocol");

		wccp_tree = proto_item_add_subtree(wccp_tree_item, ett_wccp);
		proto_tree_add_item(wccp_tree, hf_wccp_message_type , offset, sizeof(wccp_message_type), wccp_message_type);
		offset += sizeof(wccp_message_type);

		wccp_version = pntohl(&pd[offset]);
		proto_tree_add_item(wccp_tree, hf_wccp_version, offset, sizeof(wccp_version), wccp_version);
		offset += sizeof(wccp_version);

		if(wccp_message_type == WCCP_HERE_I_AM) {
			guint32 *rsvd;
			guint32 hash_version;
			guint32 recvd_id;
			guint32 i = 0;
			guint32 n = 0;
			guint8  bucket_info;
			proto_tree *bucket_tree = NULL;
			proto_item *bucket_item = NULL;
			
			hash_version = pntohl(&pd[offset]);
			proto_tree_add_item(wccp_tree, hf_hash_version, offset, sizeof(hash_version), hash_version);
			offset += sizeof(hash_version);

			bucket_item = proto_tree_add_text(wccp_tree, offset, 32, "Hash Information");
			bucket_tree = proto_item_add_subtree(bucket_item, ett_buckets);
			for(i = 0, n = 0; i < 32; i++) {
				bucket_info = (guint32)pd[offset];
				n = wccp_bucket_info(bucket_info, bucket_tree, n, offset);
				offset += sizeof(bucket_info);
			}

			/* we only care about the first bit, the rest is just pad */
			rsvd = (guint32 *)&pd[offset];
			proto_tree_add_text(wccp_tree, offset, sizeof(rsvd), ( (*rsvd & (1<<31) ) ? "U: Historical" : "U: Current" ) );
			offset += sizeof(rsvd);

			recvd_id = pntohl(&pd[offset]);
			proto_tree_add_item(wccp_tree, hf_recvd_id, offset, sizeof(recvd_id), recvd_id);
			offset += sizeof(recvd_id); /* copy and paste is fun */

		} else if (wccp_message_type == WCCP_I_SEE_YOU) {
			guint32 change_num = 0;
			guint32 recvd_id = 0;
			guint32 cache_count = 0;
			guint32 i = 0;
			guint32 n = 0;
			guint32 ccount = 0;
			guint8  bucket_info;
			wccp_cache_info *cache_info;
			proto_item *cache_count_item = NULL;
			proto_item *cache_info_item = NULL;
			proto_item *bucket_item = NULL;
			proto_tree *cache_count_tree = NULL;
			proto_tree *cache_info_tree = NULL;
			proto_tree *bucket_tree = NULL;
			
			
			change_num = pntohl(&pd[offset]);
			proto_tree_add_item(wccp_tree, hf_change_num, offset, sizeof(change_num), change_num);
			offset += sizeof(change_num);

			recvd_id = pntohl(&pd[offset]);
			proto_tree_add_item(wccp_tree, hf_recvd_id, offset, sizeof(recvd_id), recvd_id);
			offset += sizeof(recvd_id);

			cache_count = pntohl(&pd[offset]);
			cache_count_item = proto_tree_add_text(wccp_tree, offset, sizeof(cache_count), "Number of caches: %i", cache_count); 
			offset += sizeof(cache_count);
			
			cache_count_tree = proto_item_add_subtree(cache_count_item, ett_cache_count);
			for(ccount = 0; ccount < cache_count; ccount++) { 
				cache_info = (wccp_cache_info *)&pd[offset];
				cache_info_item = proto_tree_add_item(cache_count_tree, hf_cache_ip, offset, sizeof(cache_info->ip_addr), cache_info->ip_addr);
				offset += sizeof(cache_info->ip_addr);
				
				cache_info_tree = proto_item_add_subtree(cache_info_item, ett_cache_info);
				
				proto_tree_add_text(cache_info_tree, offset, sizeof(cache_info->hash_rev), "Hash Revision: %i", cache_info->hash_rev);
				offset += sizeof(cache_info->hash_rev);
				bucket_item = proto_tree_add_text(cache_info_tree, offset, 32, "Hash Information");
				bucket_tree = proto_item_add_subtree(bucket_item, ett_buckets);


				for(i = 0, n = 0; i < 32; i++) {
					bucket_info = (guint32)pd[offset];
					n = wccp_bucket_info(bucket_info, bucket_tree, n, offset);
					offset += sizeof(bucket_info);
				}
				proto_tree_add_text(cache_info_tree, offset, sizeof(cache_info->reserved), ( (cache_info->reserved & (1<<31) ) ? "U: Historical" : "U: Current" ) );
				offset += sizeof(cache_info->reserved);
			}
			

		} else if (wccp_message_type == WCCP_ASSIGN_BUCKET) {
		/* this hasn't been tested, since I don't have any traces with this in it. */
			guint32 recvd_id = 0;
			guint32 wc_count = 0;
			guint32 ip_addr = 0;
			guint16 cache_index;
			guint8  i = 0;
			guint8  bucket_info;
			proto_item *ip_item;
			proto_item *bucket_item;
			proto_tree *ip_tree;
			proto_tree *bucket_tree;

			recvd_id = pd[offset];
			proto_tree_add_item(wccp_tree, hf_recvd_id, offset, sizeof(recvd_id), recvd_id);
			offset += sizeof(recvd_id);

			wc_count = pntohl(&pd[offset]);
			ip_item = proto_tree_add_text(wccp_tree, offset, sizeof(wc_count), "Number of caches: %i", wc_count); 
			offset += sizeof(wc_count);

			ip_tree = proto_item_add_subtree(ip_item, ett_cache_count);
			for(i = 0; i < wc_count; i++) {
				ip_addr = pd[offset];
				proto_tree_add_item(ip_tree, hf_cache_ip, offset, sizeof(ip_addr), ip_addr);
				offset += sizeof(ip_addr);
			}

			bucket_item = proto_tree_add_text(wccp_tree, offset, 32, "Bucket Assignments");
			bucket_tree = proto_item_add_subtree(bucket_item, ett_buckets);
			
			for(i = 0; i < 256; i++) {
				bucket_info = pd[offset];
				if(bucket_info != 0xff) {
					cache_index = g_ntohs((guint16)bucket_info);
					proto_tree_add_text(bucket_tree, offset, sizeof(bucket_info), "Bucket %i: Cache %i", i, bucket_info);
				} else {
					proto_tree_add_text(bucket_tree, offset, sizeof(bucket_info), "Bucket %i: Unassigned", i);
				}
				offset += sizeof(bucket_info);
			}
		}
		
		
	}
}
/*
 * wccp_bucket_info()
 * takes an integer representing a "Hash Information" bitmap, and spits out
 * the corresponding proto_tree entries, returning the next bucket number.
 */

int
wccp_bucket_info(guint8 bucket_info, proto_tree *bucket_tree, guint32 start, int offset)
{
	guint32 i;

	for(i = 0; i < 8; i++) {
		proto_tree_add_text(bucket_tree, offset, sizeof(bucket_info), "Bucket %3d: %s", start, (bucket_info & 1<<i ? "Assigned" : "Not Assigned") );
		start++;
	}
	return(start);
}

/* register */
void
proto_register_wccp(void)
{
	static gint *ett[] = {
		&ett_wccp,
		&ett_cache_count,
		&ett_cache_info,
		&ett_buckets,
	};
	static hf_register_info hf[] = {
		{ &hf_wccp_message_type,
			{ "WCCP Message Type", "wccp.message", FT_UINT32, BASE_DEC, VALS(wccp_types), 0x0,
				"The WCCP message that was sent"}
		},
		{ &hf_wccp_version, 
			{ "WCCP Version", "wccp.version", FT_UINT32, BASE_DEC, VALS(wccp_version_val), 0x0,
				"The WCCP version"}
		},
		{ &hf_hash_version,
			{ "Hash Revision", "wccp.hash_revision", FT_UINT32, BASE_DEC, 0x0, 0x0,
				"The cache hash revision"}
		},
		{ &hf_change_num,
			{ "Change Number", "wccp.change_num", FT_UINT32, BASE_DEC, 0x0, 0x0,
				"The the Web-Cache list entry change number"}
		},
		{ &hf_recvd_id,
			{ "Received ID", "wccp.recvd_id", FT_UINT32, BASE_DEC, 0x0, 0x0,
				"The number of I_SEE_YOU's that have been sent"}
		},
		{ &hf_cache_ip,
			{ "Cache IP address", "wccp.cache.ip", FT_IPv4, BASE_NONE, NULL, 0x0,
				"The IP address of a cache"}
		},
		
	};

	
	proto_wccp = proto_register_protocol("Web Cache Coordination Protocol", "wccp");
	proto_register_field_array(proto_wccp, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett)); 
}