| File: | builds/wireshark/wireshark/epan/dissectors/packet-udx.c |
| Warning: | line 1160, column 9 Value stored to 'offset' is never read |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
| 1 | /* packet-udx.c |
| 2 | * Routines for UDX dissection |
| 3 | * Copyright 2026, Frank <[email protected]> |
| 4 | * |
| 5 | * UDX is a reliable, multiplexed, UDP-based transport protocol used by the |
| 6 | * Holepunch peer-to-peer stack. Reference implementation: |
| 7 | * https://github.com/holepunchto/libudx |
| 8 | * |
| 9 | * Wireshark - Network traffic analyzer |
| 10 | * By Gerald Combs <[email protected]> |
| 11 | * Copyright 1998 Gerald Combs |
| 12 | * |
| 13 | * SPDX-License-Identifier: GPL-2.0-or-later |
| 14 | */ |
| 15 | |
| 16 | #include "config.h" |
| 17 | |
| 18 | #include <math.h> |
| 19 | |
| 20 | #include <epan/packet.h> |
| 21 | #include <epan/conversation.h> |
| 22 | #include <epan/expert.h> |
| 23 | #include <epan/prefs.h> |
| 24 | #include <epan/proto_data.h> |
| 25 | #include <epan/follow.h> |
| 26 | #include <epan/addr_resolv.h> |
| 27 | #include <epan/tap.h> |
| 28 | #include "packet-udp.h" |
| 29 | #include <wsutil/wmem/wmem_map.h> |
| 30 | #include <wsutil/wmem/wmem_tree.h> |
| 31 | |
| 32 | /* |
| 33 | * UDX wire format (all multi-byte fields little-endian): |
| 34 | * |
| 35 | * offset size field |
| 36 | * 0 1 magic (0xff) |
| 37 | * 1 1 version (1) |
| 38 | * 2 1 type flags |
| 39 | * 3 1 data offset: bytes between the fixed header and the payload, |
| 40 | * occupied by SACK blocks, or by padding on MTU probes |
| 41 | * 4 4 id - the *receiver's* stream id |
| 42 | * 8 4 window - sender's receive window in bytes |
| 43 | * 12 4 seq - per-PACKET sequence counter (not bytes) |
| 44 | * 16 4 ack - next seq expected from the peer |
| 45 | * 20 8*n SACK blocks: pairs of uint32 (start, end) seq ranges |
| 46 | * ... payload |
| 47 | */ |
| 48 | |
| 49 | #define UDX_HEADER_SIZE20 20 |
| 50 | #define UDX_MAGIC_BYTE0xff 0xff |
| 51 | #define UDX_VERSION1 1 |
| 52 | |
| 53 | #define UDX_FLAG_DATA0x01 0x01 |
| 54 | #define UDX_FLAG_END0x02 0x02 |
| 55 | #define UDX_FLAG_SACK0x04 0x04 |
| 56 | #define UDX_FLAG_MESSAGE0x08 0x08 |
| 57 | #define UDX_FLAG_DESTROY0x10 0x10 |
| 58 | #define UDX_FLAG_HEARTBEAT0x20 0x20 |
| 59 | #define UDX_FLAG_MASK0x3f 0x3f |
| 60 | |
| 61 | /* |
| 62 | * Sequence numbers count packets and wrap at 2^32, so all comparisons are |
| 63 | * made in circular arithmetic. |
| 64 | */ |
| 65 | #define UDX_SEQ_LT(a, b)((int32_t)((a) - (b)) < 0) ((int32_t)((a) - (b)) < 0) |
| 66 | #define UDX_SEQ_GT(a, b)((int32_t)((a) - (b)) > 0) ((int32_t)((a) - (b)) > 0) |
| 67 | #define UDX_SEQ_GEQ(a, b)((int32_t)((a) - (b)) >= 0) ((int32_t)((a) - (b)) >= 0) |
| 68 | |
| 69 | /* Bounds the SACK blocks examined per packet; data_offset caps the area at |
| 70 | * 255 bytes, i.e. 31 blocks. */ |
| 71 | #define UDX_MAX_SACK_BLOCKS32 32 |
| 72 | |
| 73 | /* Floor for the derived retransmission timeout, in seconds. Below this a |
| 74 | * repeat is attributed to loss recovery rather than to a timer firing. */ |
| 75 | #define UDX_MIN_RTO0.2 0.2 |
| 76 | |
| 77 | /* A repeat arriving within this window of the original is a duplicate |
| 78 | * datagram rather than anything the sender chose to send again. */ |
| 79 | #define UDX_DUP_WINDOW0.0005 0.0005 |
| 80 | |
| 81 | /* Shortest pause credited to a tail loss probe timer when no round-trip |
| 82 | * time has been measured yet. */ |
| 83 | #define UDX_MIN_PROBE_DELAY0.010 0.010 |
| 84 | |
| 85 | void proto_register_udx(void); |
| 86 | void proto_reg_handoff_udx(void); |
| 87 | |
| 88 | static dissector_handle_t udx_handle; |
| 89 | |
| 90 | static int proto_udx; |
| 91 | |
| 92 | static bool_Bool udx_analyze_sequence_numbers = true1; |
| 93 | |
| 94 | static int udx_follow_tap; |
| 95 | |
| 96 | /* Stream numbers are handed out across the whole capture so that a filter |
| 97 | * such as "udx.stream eq 3" identifies exactly one stream. */ |
| 98 | static uint32_t udx_stream_count; |
| 99 | |
| 100 | /* Queued for the follow taps: one packet's payload, where it belongs in the |
| 101 | * stream and which side sent it. */ |
| 102 | typedef struct udx_follow_tap_data { |
| 103 | tvbuff_t *tvb; |
| 104 | uint32_t stream; |
| 105 | uint32_t offset; /* position of this packet within its direction */ |
| 106 | bool_Bool from_server; |
| 107 | } udx_follow_tap_data_t; |
| 108 | |
| 109 | /* One transmitted packet, remembered so that a later acknowledgement can be |
| 110 | * linked back to it. */ |
| 111 | typedef struct udx_seg { |
| 112 | uint32_t frame; |
| 113 | nstime_t ts; |
| 114 | uint32_t len; |
| 115 | uint32_t acked_in_frame; |
| 116 | nstime_t ack_ts; |
| 117 | unsigned retrans; |
| 118 | bool_Bool sacked; |
| 119 | } udx_seg_t; |
| 120 | |
| 121 | /* One direction of one stream: the packets one endpoint sends bearing the |
| 122 | * peer's stream id. */ |
| 123 | typedef struct udx_flow { |
| 124 | uint32_t id; |
| 125 | unsigned dir; |
| 126 | unsigned order; /* creation order within this direction */ |
| 127 | nstime_t first_ts; |
| 128 | wmem_tree_t *segs; /* seq -> udx_seg_t */ |
| 129 | uint32_t base_seq; /* first sequence number seen on this flow */ |
| 130 | uint32_t low_seq; /* lowest sequence number seen on this flow */ |
| 131 | uint32_t max_seq; /* highest sequence number sent */ |
| 132 | bool_Bool have_seq; |
| 133 | uint32_t outstanding_bytes; |
| 134 | uint32_t outstanding_pkts; |
| 135 | uint32_t max_ack; /* highest acknowledgement this flow emitted */ |
| 136 | bool_Bool have_ack; |
| 137 | uint32_t max_sacked; /* highest sequence the peer selectively acked */ |
| 138 | bool_Bool have_sacked; |
| 139 | uint32_t last_rwnd; |
| 140 | bool_Bool rwnd_zero; |
| 141 | nstime_t last_tx_ts; /* when this flow last sent stream data */ |
| 142 | bool_Bool have_tx; |
| 143 | double srtt; |
| 144 | double rttvar; |
| 145 | bool_Bool have_rtt; |
| 146 | uint32_t stream_num; |
| 147 | struct udx_flow *paired; |
| 148 | struct udx_flow *cand; /* pairing candidate under consideration */ |
| 149 | unsigned cand_hits; |
| 150 | } udx_flow_t; |
| 151 | |
| 152 | typedef struct udx_conv { |
| 153 | wmem_map_t *flows; /* (dir << 32 | id) -> udx_flow_t */ |
| 154 | unsigned n_flows[2]; |
| 155 | unsigned client_dir; /* the side that sent first is the client */ |
| 156 | bool_Bool have_client_dir; |
| 157 | } udx_conv_t; |
| 158 | |
| 159 | /* Verdicts reached on the first pass and replayed on every later visit. */ |
| 160 | #define UDX_A_RETRANS0x0001 0x0001 |
| 161 | #define UDX_A_FAST_RETRANS0x0002 0x0002 |
| 162 | #define UDX_A_RTO_RETRANS0x0004 0x0004 |
| 163 | #define UDX_A_TLP0x0008 0x0008 |
| 164 | #define UDX_A_SPURIOUS0x0010 0x0010 |
| 165 | #define UDX_A_OUT_OF_ORDER0x0020 0x0020 |
| 166 | #define UDX_A_LOST_SEGMENT0x0040 0x0040 |
| 167 | #define UDX_A_KEEPALIVE0x0080 0x0080 |
| 168 | #define UDX_A_ZERO_WIN_PROBE0x0100 0x0100 |
| 169 | #define UDX_A_ZERO_WIN0x0200 0x0200 |
| 170 | #define UDX_A_WINDOW_UPDATE0x0400 0x0400 |
| 171 | #define UDX_A_MTU_PROBE0x0800 0x0800 |
| 172 | #define UDX_A_END0x1000 0x1000 |
| 173 | #define UDX_A_DESTROY0x2000 0x2000 |
| 174 | #define UDX_A_DUPLICATE0x4000 0x4000 |
| 175 | |
| 176 | typedef struct udx_ppd { |
| 177 | uint32_t flags; |
| 178 | uint32_t acks_frame; /* frame this packet acknowledges */ |
| 179 | nstime_t ack_rtt; |
| 180 | bool_Bool have_ack_rtt; |
| 181 | uint32_t bytes_in_flight; |
| 182 | uint32_t packets_in_flight; |
| 183 | uint32_t seq; /* sender sequence, to find our own segment */ |
| 184 | bool_Bool tracked; /* this packet consumed a sequence number */ |
| 185 | uint32_t stream; /* stream number at analysis time */ |
| 186 | uint32_t follow_offset; /* position within this direction */ |
| 187 | bool_Bool from_server; |
| 188 | bool_Bool follow_ok; /* payload belongs in the reassembled stream */ |
| 189 | udx_flow_t *flow; |
| 190 | } udx_ppd_t; |
| 191 | |
| 192 | static int hf_udx_magic; |
| 193 | static int hf_udx_version; |
| 194 | static int hf_udx_flags; |
| 195 | static int hf_udx_flags_data; |
| 196 | static int hf_udx_flags_end; |
| 197 | static int hf_udx_flags_sack; |
| 198 | static int hf_udx_flags_message; |
| 199 | static int hf_udx_flags_destroy; |
| 200 | static int hf_udx_flags_heartbeat; |
| 201 | static int hf_udx_data_offset; |
| 202 | static int hf_udx_id; |
| 203 | static int hf_udx_window; |
| 204 | static int hf_udx_seq; |
| 205 | static int hf_udx_ack; |
| 206 | static int hf_udx_sacks; |
| 207 | static int hf_udx_sack_block; |
| 208 | static int hf_udx_sack_start; |
| 209 | static int hf_udx_sack_end; |
| 210 | static int hf_udx_padding; |
| 211 | static int hf_udx_payload; |
| 212 | static int hf_udx_payload_len; |
| 213 | static int hf_udx_stream; |
| 214 | static int hf_udx_analysis; |
| 215 | static int hf_udx_analysis_acks_frame; |
| 216 | static int hf_udx_analysis_acked_in; |
| 217 | static int hf_udx_analysis_ack_rtt; |
| 218 | static int hf_udx_analysis_bytes_in_flight; |
| 219 | static int hf_udx_analysis_pkts_in_flight; |
| 220 | static int hf_udx_analysis_no_reverse; |
| 221 | |
| 222 | static int ett_udx; |
| 223 | static int ett_udx_flags; |
| 224 | static int ett_udx_sacks; |
| 225 | static int ett_udx_sack_block; |
| 226 | static int ett_udx_analysis; |
| 227 | |
| 228 | static expert_field ei_udx_retrans; |
| 229 | static expert_field ei_udx_fast_retrans; |
| 230 | static expert_field ei_udx_rto_retrans; |
| 231 | static expert_field ei_udx_tlp; |
| 232 | static expert_field ei_udx_spurious_retrans; |
| 233 | static expert_field ei_udx_duplicate; |
| 234 | static expert_field ei_udx_out_of_order; |
| 235 | static expert_field ei_udx_lost_segment; |
| 236 | static expert_field ei_udx_keepalive; |
| 237 | static expert_field ei_udx_zero_window_probe; |
| 238 | static expert_field ei_udx_zero_window; |
| 239 | static expert_field ei_udx_window_update; |
| 240 | static expert_field ei_udx_mtu_probe; |
| 241 | static expert_field ei_udx_end; |
| 242 | static expert_field ei_udx_destroy; |
| 243 | |
| 244 | static int * const udx_flag_fields[] = { |
| 245 | &hf_udx_flags_data, |
| 246 | &hf_udx_flags_end, |
| 247 | &hf_udx_flags_sack, |
| 248 | &hf_udx_flags_message, |
| 249 | &hf_udx_flags_destroy, |
| 250 | &hf_udx_flags_heartbeat, |
| 251 | NULL((void*)0) |
| 252 | }; |
| 253 | |
| 254 | /* Build a "DATA,SACK"-style summary of the flags byte; bare 0 is an ACK. */ |
| 255 | static void |
| 256 | udx_flags_to_str(uint8_t flags, char *buf, size_t buf_len) |
| 257 | { |
| 258 | static const struct { |
| 259 | uint8_t bit; |
| 260 | const char *name; |
| 261 | } bits[] = { |
| 262 | { UDX_FLAG_DATA0x01, "DATA" }, |
| 263 | { UDX_FLAG_END0x02, "END" }, |
| 264 | { UDX_FLAG_SACK0x04, "SACK" }, |
| 265 | { UDX_FLAG_MESSAGE0x08, "MESSAGE" }, |
| 266 | { UDX_FLAG_DESTROY0x10, "DESTROY" }, |
| 267 | { UDX_FLAG_HEARTBEAT0x20, "HEARTBEAT" }, |
| 268 | }; |
| 269 | size_t pos = 0; |
| 270 | |
| 271 | if (flags == 0) { |
| 272 | (void) g_strlcpy(buf, "ACK", buf_len); |
| 273 | return; |
| 274 | } |
| 275 | buf[0] = '\0'; |
| 276 | for (size_t i = 0; i < array_length(bits)(sizeof (bits) / sizeof (bits)[0]); i++) { |
| 277 | if (flags & bits[i].bit) { |
| 278 | if (pos > 0) |
| 279 | pos += g_strlcpy(buf + pos, ",", buf_len - pos); |
| 280 | pos += g_strlcpy(buf + pos, bits[i].name, buf_len - pos); |
| 281 | } |
| 282 | } |
| 283 | } |
| 284 | |
| 285 | /* |
| 286 | * A stable label for the two endpoints of the enclosing UDP conversation. |
| 287 | * Which endpoint gets 0 does not matter; only that a given endpoint keeps |
| 288 | * the same label for the whole capture. |
| 289 | */ |
| 290 | static unsigned |
| 291 | udx_direction(const packet_info *pinfo) |
| 292 | { |
| 293 | int c = cmp_address(&pinfo->src, &pinfo->dst); |
| 294 | |
| 295 | if (c != 0) |
| 296 | return (c < 0) ? 0 : 1; |
| 297 | return (pinfo->srcport < pinfo->destport) ? 0 : 1; |
| 298 | } |
| 299 | |
| 300 | static udx_flow_t * |
| 301 | udx_get_flow(udx_conv_t *conv, unsigned dir, uint32_t id, const nstime_t *ts) |
| 302 | { |
| 303 | uint64_t key = ((uint64_t) dir << 32) | id; |
| 304 | udx_flow_t *flow = (udx_flow_t *) wmem_map_lookup(conv->flows, &key); |
| 305 | uint64_t *key_copy; |
| 306 | |
| 307 | if (flow != NULL((void*)0)) |
| 308 | return flow; |
| 309 | |
| 310 | flow = wmem_new0(wmem_file_scope(), udx_flow_t)((udx_flow_t*)wmem_alloc0((wmem_file_scope()), sizeof(udx_flow_t ))); |
| 311 | flow->id = id; |
| 312 | flow->dir = dir; |
| 313 | flow->order = conv->n_flows[dir]++; |
| 314 | flow->first_ts = *ts; |
| 315 | flow->segs = wmem_tree_new(wmem_file_scope()); |
| 316 | flow->stream_num = udx_stream_count++; |
| 317 | |
| 318 | key_copy = wmem_new(wmem_file_scope(), uint64_t)((uint64_t*)wmem_alloc((wmem_file_scope()), sizeof(uint64_t)) ); |
| 319 | *key_copy = key; |
| 320 | wmem_map_insert(conv->flows, key_copy, flow); |
| 321 | |
| 322 | return flow; |
| 323 | } |
| 324 | |
| 325 | /* |
| 326 | * Pairing a flow with its reverse. |
| 327 | * |
| 328 | * A UDX conversation is a six tuple, but a packet carries only the receiver's |
| 329 | * stream id: the ids are exchanged in an encrypted handshake that is not |
| 330 | * visible here. The reverse flow therefore has to be inferred. |
| 331 | * |
| 332 | * Candidates are the flows travelling the other way. Each is scored on |
| 333 | * - plausibility: the acknowledgement carried by this packet must fall |
| 334 | * within the sequence numbers the candidate has actually sent; |
| 335 | * - creation order: streams are set up in pairs, so the n'th flow in one |
| 336 | * direction usually answers the n'th flow in the other; |
| 337 | * - proximity: the two flows should have appeared at about the same time. |
| 338 | * |
| 339 | * A candidate is adopted once it has been the sole best choice twice, which |
| 340 | * keeps a single ambiguous packet from binding the wrong pair. Once bound, |
| 341 | * a pairing is never revised. |
| 342 | */ |
| 343 | typedef struct udx_pair_scan { |
| 344 | udx_flow_t *self; |
| 345 | uint32_t ack; |
| 346 | udx_flow_t *best; |
| 347 | int best_score; |
| 348 | bool_Bool tie; |
| 349 | } udx_pair_scan_t; |
| 350 | |
| 351 | static void |
| 352 | udx_score_candidate(void *key _U___attribute__((unused)), void *value, void *userdata) |
| 353 | { |
| 354 | udx_flow_t *cand = (udx_flow_t *) value; |
| 355 | udx_pair_scan_t *scan = (udx_pair_scan_t *) userdata; |
| 356 | double dt; |
| 357 | int score = 0; |
| 358 | |
| 359 | if (cand->dir == scan->self->dir || cand->paired != NULL((void*)0)) |
| 360 | return; |
| 361 | |
| 362 | /* The acknowledgement must not reach past what the candidate has sent. */ |
| 363 | if (cand->have_seq) { |
| 364 | if (UDX_SEQ_GT(scan->ack, cand->max_seq + 1)((int32_t)((scan->ack) - (cand->max_seq + 1)) > 0)) |
| 365 | return; |
| 366 | score += 4; |
| 367 | } |
| 368 | |
| 369 | if (cand->order == scan->self->order) |
| 370 | score += 2; |
| 371 | |
| 372 | dt = nstime_to_sec(&cand->first_ts) - nstime_to_sec(&scan->self->first_ts); |
| 373 | if (dt < 0) |
| 374 | dt = -dt; |
| 375 | if (dt < 0.050) |
| 376 | score += 1; |
| 377 | |
| 378 | if (score > scan->best_score) { |
| 379 | scan->best_score = score; |
| 380 | scan->best = cand; |
| 381 | scan->tie = false0; |
| 382 | } else if (score == scan->best_score && scan->best != NULL((void*)0)) { |
| 383 | scan->tie = true1; |
| 384 | } |
| 385 | } |
| 386 | |
| 387 | static void |
| 388 | udx_try_pair(udx_conv_t *conv, udx_flow_t *flow, uint32_t ack) |
| 389 | { |
| 390 | udx_pair_scan_t scan; |
| 391 | |
| 392 | scan.self = flow; |
| 393 | scan.ack = ack; |
| 394 | scan.best = NULL((void*)0); |
| 395 | scan.best_score = 0; |
| 396 | scan.tie = false0; |
| 397 | |
| 398 | wmem_map_foreach(conv->flows, udx_score_candidate, &scan); |
| 399 | |
| 400 | if (scan.best == NULL((void*)0) || scan.tie) { |
| 401 | flow->cand = NULL((void*)0); |
| 402 | flow->cand_hits = 0; |
| 403 | return; |
| 404 | } |
| 405 | |
| 406 | /* |
| 407 | * One unambiguous winner is adopted at once, so that a stream is paired |
| 408 | * from its first packet on. An ambiguous scan binds nothing and is |
| 409 | * retried on the next packet, by which time the acknowledgements have |
| 410 | * usually separated the candidates. |
| 411 | */ |
| 412 | flow->cand = scan.best; |
| 413 | flow->cand_hits++; |
| 414 | |
| 415 | flow->paired = scan.best; |
| 416 | scan.best->paired = flow; |
| 417 | |
| 418 | /* Both halves report the lower of the two numbers. */ |
| 419 | if (scan.best->stream_num < flow->stream_num) |
| 420 | flow->stream_num = scan.best->stream_num; |
| 421 | else |
| 422 | scan.best->stream_num = flow->stream_num; |
| 423 | } |
| 424 | |
| 425 | /* RFC 6298 smoothing, fed only by segments that were never retransmitted. */ |
| 426 | static void |
| 427 | udx_update_rtt(udx_flow_t *flow, double sample) |
| 428 | { |
| 429 | if (!flow->have_rtt) { |
| 430 | flow->srtt = sample; |
| 431 | flow->rttvar = sample / 2; |
| 432 | flow->have_rtt = true1; |
| 433 | return; |
| 434 | } |
| 435 | flow->rttvar = 0.75 * flow->rttvar + 0.25 * fabs(flow->srtt - sample); |
| 436 | flow->srtt = 0.875 * flow->srtt + 0.125 * sample; |
| 437 | } |
| 438 | |
| 439 | static double |
| 440 | udx_rto(const udx_flow_t *flow) |
| 441 | { |
| 442 | double rto; |
| 443 | |
| 444 | if (!flow->have_rtt) |
| 445 | return UDX_MIN_RTO0.2; |
| 446 | rto = flow->srtt + 4 * flow->rttvar; |
| 447 | return (rto < UDX_MIN_RTO0.2) ? UDX_MIN_RTO0.2 : rto; |
| 448 | } |
| 449 | |
| 450 | /* |
| 451 | * Retire one segment. A packet stops being in flight the moment it is |
| 452 | * acknowledged, whether cumulatively or selectively, so both paths come |
| 453 | * through here. Returns true only for the frame that first acknowledged it, |
| 454 | * which keeps a later cumulative acknowledgement of an already selectively |
| 455 | * acknowledged packet from counting it twice. |
| 456 | */ |
| 457 | static bool_Bool |
| 458 | udx_retire_seg(packet_info *pinfo, udx_flow_t *flow, udx_seg_t *seg) |
| 459 | { |
| 460 | if (seg->acked_in_frame != 0) |
| 461 | return false0; |
| 462 | |
| 463 | seg->acked_in_frame = pinfo->num; |
| 464 | seg->ack_ts = pinfo->abs_ts; |
| 465 | |
| 466 | if (flow->outstanding_pkts > 0) { |
| 467 | flow->outstanding_pkts--; |
| 468 | flow->outstanding_bytes -= seg->len; |
| 469 | } |
| 470 | return true1; |
| 471 | } |
| 472 | |
| 473 | /* |
| 474 | * Retire every segment of the acknowledged flow below "ack", link the last |
| 475 | * of them to the acknowledging packet, and take an RTT sample from it. |
| 476 | */ |
| 477 | static void |
| 478 | udx_process_ack(packet_info *pinfo, udx_flow_t *acked_flow, |
| 479 | uint32_t ack, uint32_t prev_ack, bool_Bool have_prev, udx_ppd_t *ppd) |
| 480 | { |
| 481 | udx_seg_t *newest = NULL((void*)0); |
| 482 | uint32_t seq = ack - 1; |
| 483 | unsigned guard; |
| 484 | |
| 485 | if (!acked_flow->have_seq) |
| 486 | return; |
| 487 | |
| 488 | /* |
| 489 | * Walk back over the range this acknowledgement newly covers, which |
| 490 | * starts just above the previous cumulative acknowledgement. A segment |
| 491 | * already retired, by an earlier acknowledgement or by a selective one, |
| 492 | * is skipped rather than counted again, and the walk carries on past it |
| 493 | * so that anything older still outstanding is retired too. The counter |
| 494 | * only bounds pathological captures. |
| 495 | */ |
| 496 | for (guard = 0; guard < 4096; guard++, seq--) { |
| 497 | udx_seg_t *seg; |
| 498 | |
| 499 | if (have_prev && UDX_SEQ_LT(seq, prev_ack)((int32_t)((seq) - (prev_ack)) < 0)) |
| 500 | break; |
| 501 | if (UDX_SEQ_LT(seq, acked_flow->low_seq)((int32_t)((seq) - (acked_flow->low_seq)) < 0)) |
| 502 | break; |
| 503 | |
| 504 | seg = (udx_seg_t *) wmem_tree_lookup32(acked_flow->segs, seq); |
| 505 | if (seg == NULL((void*)0)) |
| 506 | continue; |
| 507 | |
| 508 | if (udx_retire_seg(pinfo, acked_flow, seg) && newest == NULL((void*)0)) |
| 509 | newest = seg; |
| 510 | } |
| 511 | |
| 512 | if (newest != NULL((void*)0)) { |
| 513 | nstime_t rtt; |
| 514 | |
| 515 | nstime_delta(&rtt, &pinfo->abs_ts, &newest->ts); |
| 516 | ppd->acks_frame = newest->frame; |
| 517 | ppd->ack_rtt = rtt; |
| 518 | ppd->have_ack_rtt = true1; |
| 519 | |
| 520 | /* |
| 521 | * Karn's algorithm: a retransmitted segment yields no usable sample. |
| 522 | * The sample times a packet this flow sent, so it belongs to the flow |
| 523 | * that sent it and not to the one reporting the acknowledgement. The |
| 524 | * two are only ever the same on a stream carrying data both ways; on |
| 525 | * a one-way transfer the sending flow would otherwise never obtain a |
| 526 | * round trip time at all, and every timeout test would fall back on |
| 527 | * the floor. |
| 528 | */ |
| 529 | if (newest->retrans == 0) |
| 530 | udx_update_rtt(acked_flow, nstime_to_sec(&rtt)); |
| 531 | } |
| 532 | } |
| 533 | |
| 534 | static void |
| 535 | udx_analyze(packet_info *pinfo, udx_conv_t *conv, uint8_t flags, uint8_t data_offset, |
| 536 | uint32_t id, uint32_t window, uint32_t seq, uint32_t ack, |
| 537 | uint32_t payload_len, const uint32_t *sack_start, const uint32_t *sack_end, |
| 538 | unsigned n_sacks, udx_ppd_t *ppd) |
| 539 | { |
| 540 | unsigned dir = udx_direction(pinfo); |
| 541 | udx_flow_t *flow = udx_get_flow(conv, dir, id, &pinfo->abs_ts); |
| 542 | udx_flow_t *rflow; |
| 543 | udx_seg_t *seg; |
| 544 | bool_Bool consumes_seq; |
| 545 | |
| 546 | if (!conv->have_client_dir) { |
| 547 | conv->client_dir = dir; |
| 548 | conv->have_client_dir = true1; |
| 549 | } |
| 550 | |
| 551 | ppd->flow = flow; |
| 552 | ppd->seq = seq; |
| 553 | ppd->from_server = (dir != conv->client_dir); |
| 554 | |
| 555 | if (flow->paired == NULL((void*)0)) |
| 556 | udx_try_pair(conv, flow, ack); |
| 557 | rflow = flow->paired; |
| 558 | |
| 559 | /* DATA and END occupy a sequence number; MESSAGE is an unordered |
| 560 | * datagram outside the stream and a bare ACK only reports one. */ |
| 561 | consumes_seq = (flags & (UDX_FLAG_DATA0x01 | UDX_FLAG_END0x02)) != 0; |
| 562 | |
| 563 | if (consumes_seq) { |
| 564 | seg = (udx_seg_t *) wmem_tree_lookup32(flow->segs, seq); |
| 565 | |
| 566 | if (seg == NULL((void*)0)) { |
| 567 | /* |
| 568 | * A tail loss probe does not have to repeat the tail: libudx can |
| 569 | * send the next new packet as the probe instead. Seen from here |
| 570 | * that is a fresh sequence number extending the flow after a |
| 571 | * probe-sized pause, while earlier data is still unacknowledged, |
| 572 | * which is the sender prodding for an acknowledgement rather than |
| 573 | * an application with more to say. |
| 574 | */ |
| 575 | if (payload_len > 0 && flow->have_tx && flow->have_seq && |
| 576 | flow->outstanding_pkts > 0 && seq == flow->max_seq + 1) { |
| 577 | double idle = nstime_to_sec(&pinfo->abs_ts) - |
| 578 | nstime_to_sec(&flow->last_tx_ts); |
| 579 | |
| 580 | if (idle >= (flow->have_rtt ? 2 * flow->srtt : UDX_MIN_PROBE_DELAY0.010)) |
| 581 | ppd->flags |= UDX_A_TLP0x0008; |
| 582 | } |
| 583 | |
| 584 | if (flow->have_seq && UDX_SEQ_GT(seq, flow->max_seq + 1)((int32_t)((seq) - (flow->max_seq + 1)) > 0)) |
| 585 | ppd->flags |= UDX_A_LOST_SEGMENT0x0040; |
| 586 | else if (flow->have_seq && UDX_SEQ_LT(seq, flow->max_seq)((int32_t)((seq) - (flow->max_seq)) < 0)) |
| 587 | ppd->flags |= UDX_A_OUT_OF_ORDER0x0020; |
| 588 | |
| 589 | seg = wmem_new0(wmem_file_scope(), udx_seg_t)((udx_seg_t*)wmem_alloc0((wmem_file_scope()), sizeof(udx_seg_t ))); |
| 590 | seg->frame = pinfo->num; |
| 591 | seg->ts = pinfo->abs_ts; |
| 592 | seg->len = payload_len; |
| 593 | wmem_tree_insert32(flow->segs, seq, seg); |
| 594 | |
| 595 | if (!flow->have_seq) { |
| 596 | flow->base_seq = seq; |
| 597 | flow->low_seq = seq; |
| 598 | flow->max_seq = seq; |
| 599 | flow->have_seq = true1; |
| 600 | } else { |
| 601 | if (UDX_SEQ_GT(seq, flow->max_seq)((int32_t)((seq) - (flow->max_seq)) > 0)) |
| 602 | flow->max_seq = seq; |
| 603 | /* The first packet on the wire need not be the oldest: if it |
| 604 | * was lost and resent, a lower sequence number turns up later |
| 605 | * and still has to be accounted for. */ |
| 606 | if (UDX_SEQ_LT(seq, flow->low_seq)((int32_t)((seq) - (flow->low_seq)) < 0)) |
| 607 | flow->low_seq = seq; |
| 608 | } |
| 609 | flow->outstanding_pkts++; |
| 610 | flow->outstanding_bytes += payload_len; |
| 611 | } else { |
| 612 | double dt = nstime_to_sec(&pinfo->abs_ts) - nstime_to_sec(&seg->ts); |
| 613 | |
| 614 | seg->retrans++; |
| 615 | ppd->flags |= UDX_A_RETRANS0x0001; |
| 616 | |
| 617 | if (seg->acked_in_frame != 0) { |
| 618 | ppd->flags |= UDX_A_SPURIOUS0x0010; |
| 619 | } else if (dt < UDX_DUP_WINDOW0.0005) { |
| 620 | /* Too soon to be any sender timer: the datagram was |
| 621 | * delivered, or captured, twice. */ |
| 622 | ppd->flags |= UDX_A_DUPLICATE0x4000; |
| 623 | } else if (dt >= udx_rto(flow)) { |
| 624 | /* A whole retransmission timeout has passed. That is a timer |
| 625 | * firing, whatever the peer has selectively acknowledged in |
| 626 | * the meantime, so this test comes before the SACK one. */ |
| 627 | ppd->flags |= UDX_A_RTO_RETRANS0x0004; |
| 628 | } else if (flow->have_sacked && UDX_SEQ_GT(flow->max_sacked, seq)((int32_t)((flow->max_sacked) - (seq)) > 0)) { |
| 629 | /* The peer has selectively acknowledged later packets, so |
| 630 | * this one was resent because it was reported missing rather |
| 631 | * than because a timer expired. */ |
| 632 | ppd->flags |= UDX_A_FAST_RETRANS0x0002; |
| 633 | } else if (seq == flow->max_seq && |
| 634 | dt >= (flow->have_rtt ? 2 * flow->srtt : UDX_MIN_PROBE_DELAY0.010)) { |
| 635 | /* A repeat of the tail after a probe-sized pause, with |
| 636 | * nothing newer sent, is how a tail loss probe looks here. */ |
| 637 | ppd->flags |= UDX_A_TLP0x0008; |
| 638 | } |
| 639 | } |
| 640 | |
| 641 | /* Used to spot the pause before a tail loss probe. */ |
| 642 | flow->last_tx_ts = pinfo->abs_ts; |
| 643 | flow->have_tx = true1; |
| 644 | |
| 645 | ppd->tracked = true1; |
| 646 | ppd->bytes_in_flight = flow->outstanding_bytes; |
| 647 | ppd->packets_in_flight = flow->outstanding_pkts; |
| 648 | |
| 649 | /* |
| 650 | * Position within the stream, counted from the first packet seen on |
| 651 | * this flow. Anything before that point arrived out of order at the |
| 652 | * very start of the capture and cannot be placed. |
| 653 | */ |
| 654 | if (payload_len > 0 && UDX_SEQ_GEQ(seq, flow->base_seq)((int32_t)((seq) - (flow->base_seq)) >= 0)) { |
| 655 | ppd->follow_offset = seq - flow->base_seq; |
| 656 | ppd->follow_ok = true1; |
| 657 | } |
| 658 | } |
| 659 | |
| 660 | if (flags & UDX_FLAG_END0x02) |
| 661 | ppd->flags |= UDX_A_END0x1000; |
| 662 | if (flags & UDX_FLAG_DESTROY0x10) |
| 663 | ppd->flags |= UDX_A_DESTROY0x2000; |
| 664 | |
| 665 | /* An MTU probe pads between the header and the payload; the same byte |
| 666 | * delimits SACK blocks when they are present. */ |
| 667 | if (data_offset > 0 && !(flags & UDX_FLAG_SACK0x04)) |
| 668 | ppd->flags |= UDX_A_MTU_PROBE0x0800; |
| 669 | |
| 670 | /* Acknowledgement side: retire the peer's segments, then record the |
| 671 | * selective ranges so a later repeat can be recognised as recovery. */ |
| 672 | if (rflow != NULL((void*)0)) { |
| 673 | udx_seg_t *newest_sack = NULL((void*)0); |
| 674 | uint32_t newest_sack_seq = 0; |
| 675 | |
| 676 | if (!flow->have_ack || UDX_SEQ_GT(ack, flow->max_ack)((int32_t)((ack) - (flow->max_ack)) > 0)) |
| 677 | udx_process_ack(pinfo, rflow, ack, flow->max_ack, |
| 678 | flow->have_ack, ppd); |
| 679 | |
| 680 | for (unsigned i = 0; i < n_sacks; i++) { |
| 681 | uint32_t s; |
| 682 | unsigned guard = 0; |
| 683 | |
| 684 | for (s = sack_start[i]; UDX_SEQ_LT(s, sack_end[i])((int32_t)((s) - (sack_end[i])) < 0) && guard < 1024; |
| 685 | s++, guard++) { |
| 686 | udx_seg_t *ss = (udx_seg_t *) wmem_tree_lookup32(rflow->segs, s); |
| 687 | |
| 688 | if (ss == NULL((void*)0)) |
| 689 | continue; |
| 690 | |
| 691 | ss->sacked = true1; |
| 692 | |
| 693 | /* A selective acknowledgement acknowledges the packet as |
| 694 | * surely as a cumulative one: it leaves the flight, and this |
| 695 | * is the frame that acknowledged it. */ |
| 696 | if (udx_retire_seg(pinfo, rflow, ss) && |
| 697 | (newest_sack == NULL((void*)0) || UDX_SEQ_GT(s, newest_sack_seq)((int32_t)((s) - (newest_sack_seq)) > 0))) { |
| 698 | newest_sack = ss; |
| 699 | newest_sack_seq = s; |
| 700 | } |
| 701 | } |
| 702 | |
| 703 | /* Remember how far the selective acknowledgements reach: a |
| 704 | * retransmission below this point is loss recovery. */ |
| 705 | if (!rflow->have_sacked || UDX_SEQ_GT(sack_end[i] - 1, rflow->max_sacked)((int32_t)((sack_end[i] - 1) - (rflow->max_sacked)) > 0 )) { |
| 706 | rflow->max_sacked = sack_end[i] - 1; |
| 707 | rflow->have_sacked = true1; |
| 708 | } |
| 709 | } |
| 710 | |
| 711 | /* Nothing was newly acknowledged cumulatively, but a selective range |
| 712 | * retired a packet, so report the link and the round trip from that. */ |
| 713 | if (newest_sack != NULL((void*)0) && !ppd->have_ack_rtt) { |
| 714 | nstime_t rtt; |
| 715 | |
| 716 | nstime_delta(&rtt, &pinfo->abs_ts, &newest_sack->ts); |
| 717 | ppd->acks_frame = newest_sack->frame; |
| 718 | ppd->ack_rtt = rtt; |
| 719 | ppd->have_ack_rtt = true1; |
| 720 | |
| 721 | /* Karn's algorithm again: never sample a retransmitted packet. |
| 722 | * The round trip measured belongs to the flow that sent the data, |
| 723 | * which is where the retransmission timeout is later judged. */ |
| 724 | if (newest_sack->retrans == 0) |
| 725 | udx_update_rtt(rflow, nstime_to_sec(&rtt)); |
| 726 | } |
| 727 | } |
| 728 | |
| 729 | if (!flow->have_ack || UDX_SEQ_GT(ack, flow->max_ack)((int32_t)((ack) - (flow->max_ack)) > 0)) { |
| 730 | flow->max_ack = ack; |
| 731 | flow->have_ack = true1; |
| 732 | } |
| 733 | |
| 734 | /* Receive window transitions. */ |
| 735 | if (window == 0) { |
| 736 | ppd->flags |= UDX_A_ZERO_WIN0x0200; |
| 737 | flow->rwnd_zero = true1; |
| 738 | } else if (flow->rwnd_zero) { |
| 739 | ppd->flags |= UDX_A_WINDOW_UPDATE0x0400; |
| 740 | flow->rwnd_zero = false0; |
| 741 | } |
| 742 | flow->last_rwnd = window; |
| 743 | |
| 744 | /* |
| 745 | * Keepalives and zero-window probes are the same bytes on the wire: a |
| 746 | * bare heartbeat. Only the peer's advertised window tells them apart. |
| 747 | */ |
| 748 | if ((flags & UDX_FLAG_HEARTBEAT0x20) && payload_len == 0) { |
| 749 | if (rflow != NULL((void*)0) && rflow->rwnd_zero) |
| 750 | ppd->flags |= UDX_A_ZERO_WIN_PROBE0x0100; |
| 751 | else |
| 752 | ppd->flags |= UDX_A_KEEPALIVE0x0080; |
| 753 | } |
| 754 | |
| 755 | ppd->stream = (flow->paired != NULL((void*)0) && flow->paired->stream_num < flow->stream_num) |
| 756 | ? flow->paired->stream_num |
| 757 | : flow->stream_num; |
| 758 | } |
| 759 | |
| 760 | /* |
| 761 | * Render the verdicts reached on the first pass. Nothing here computes: on a |
| 762 | * revisit the stored results are simply replayed, so what is shown never |
| 763 | * depends on how the packet was reached. |
| 764 | */ |
| 765 | static void |
| 766 | udx_show_analysis(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, udx_ppd_t *ppd) |
| 767 | { |
| 768 | proto_item *ti; |
| 769 | proto_tree *an_tree; |
| 770 | udx_seg_t *seg; |
| 771 | |
| 772 | if (ppd->flow == NULL((void*)0)) |
| 773 | return; |
| 774 | |
| 775 | ti = proto_tree_add_uint(tree, hf_udx_stream, tvb, 0, 0, |
| 776 | (ppd->flow->paired != NULL((void*)0) && |
| 777 | ppd->flow->paired->stream_num < ppd->flow->stream_num) |
| 778 | ? ppd->flow->paired->stream_num |
| 779 | : ppd->flow->stream_num); |
| 780 | proto_item_set_generated(ti); |
| 781 | |
| 782 | /* Nothing to report on a packet that neither carries data nor advances |
| 783 | * an acknowledgement, so leave the subtree out entirely rather than |
| 784 | * showing an empty one. */ |
| 785 | if (ppd->flags == 0 && ppd->acks_frame == 0 && !ppd->tracked && |
| 786 | ppd->flow->paired != NULL((void*)0)) |
| 787 | return; |
| 788 | |
| 789 | ti = proto_tree_add_item(tree, hf_udx_analysis, tvb, 0, 0, ENC_NA0x00000000); |
| 790 | proto_item_set_generated(ti); |
| 791 | an_tree = proto_item_add_subtree(ti, ett_udx_analysis); |
| 792 | |
| 793 | if (ppd->flow->paired == NULL((void*)0)) { |
| 794 | proto_item *rev_ti = proto_tree_add_item(an_tree, hf_udx_analysis_no_reverse, |
| 795 | tvb, 0, 0, ENC_NA0x00000000); |
| 796 | proto_item_set_generated(rev_ti); |
| 797 | } |
| 798 | |
| 799 | if (ppd->acks_frame != 0) { |
| 800 | ti = proto_tree_add_uint(an_tree, hf_udx_analysis_acks_frame, tvb, 0, 0, |
| 801 | ppd->acks_frame); |
| 802 | proto_item_set_generated(ti); |
| 803 | |
| 804 | if (ppd->have_ack_rtt) { |
| 805 | ti = proto_tree_add_time(an_tree, hf_udx_analysis_ack_rtt, tvb, 0, 0, |
| 806 | &ppd->ack_rtt); |
| 807 | proto_item_set_generated(ti); |
| 808 | } |
| 809 | } |
| 810 | |
| 811 | /* A packet that carried data learns only later which packet acked it. */ |
| 812 | if (ppd->tracked) { |
| 813 | seg = (udx_seg_t *) wmem_tree_lookup32(ppd->flow->segs, ppd->seq); |
| 814 | if (seg != NULL((void*)0) && seg->frame == pinfo->num && seg->acked_in_frame != 0) { |
| 815 | nstime_t rtt; |
| 816 | |
| 817 | ti = proto_tree_add_uint(an_tree, hf_udx_analysis_acked_in, tvb, 0, 0, |
| 818 | seg->acked_in_frame); |
| 819 | proto_item_set_generated(ti); |
| 820 | |
| 821 | nstime_delta(&rtt, &seg->ack_ts, &seg->ts); |
| 822 | ti = proto_tree_add_time(an_tree, hf_udx_analysis_ack_rtt, tvb, 0, 0, &rtt); |
| 823 | proto_item_set_generated(ti); |
| 824 | } |
| 825 | |
| 826 | ti = proto_tree_add_uint(an_tree, hf_udx_analysis_bytes_in_flight, tvb, 0, 0, |
| 827 | ppd->bytes_in_flight); |
| 828 | proto_item_set_generated(ti); |
| 829 | ti = proto_tree_add_uint(an_tree, hf_udx_analysis_pkts_in_flight, tvb, 0, 0, |
| 830 | ppd->packets_in_flight); |
| 831 | proto_item_set_generated(ti); |
| 832 | } |
| 833 | |
| 834 | /* Expert notes, most specific classification first. */ |
| 835 | if (ppd->flags & UDX_A_LOST_SEGMENT0x0040) |
| 836 | expert_add_info(pinfo, ti, &ei_udx_lost_segment); |
| 837 | if (ppd->flags & UDX_A_OUT_OF_ORDER0x0020) |
| 838 | expert_add_info(pinfo, ti, &ei_udx_out_of_order); |
| 839 | |
| 840 | if (ppd->flags & UDX_A_SPURIOUS0x0010) |
| 841 | expert_add_info(pinfo, ti, &ei_udx_spurious_retrans); |
| 842 | else if (ppd->flags & UDX_A_FAST_RETRANS0x0002) |
| 843 | expert_add_info(pinfo, ti, &ei_udx_fast_retrans); |
| 844 | else if (ppd->flags & UDX_A_RTO_RETRANS0x0004) |
| 845 | expert_add_info(pinfo, ti, &ei_udx_rto_retrans); |
| 846 | else if (ppd->flags & UDX_A_TLP0x0008) |
| 847 | expert_add_info(pinfo, ti, &ei_udx_tlp); |
| 848 | else if (ppd->flags & UDX_A_DUPLICATE0x4000) |
| 849 | expert_add_info(pinfo, ti, &ei_udx_duplicate); |
| 850 | else if (ppd->flags & UDX_A_RETRANS0x0001) |
| 851 | expert_add_info(pinfo, ti, &ei_udx_retrans); |
| 852 | |
| 853 | if (ppd->flags & UDX_A_ZERO_WIN_PROBE0x0100) |
| 854 | expert_add_info(pinfo, ti, &ei_udx_zero_window_probe); |
| 855 | else if (ppd->flags & UDX_A_KEEPALIVE0x0080) |
| 856 | expert_add_info(pinfo, ti, &ei_udx_keepalive); |
| 857 | |
| 858 | if (ppd->flags & UDX_A_ZERO_WIN0x0200) |
| 859 | expert_add_info(pinfo, ti, &ei_udx_zero_window); |
| 860 | if (ppd->flags & UDX_A_WINDOW_UPDATE0x0400) |
| 861 | expert_add_info(pinfo, ti, &ei_udx_window_update); |
| 862 | if (ppd->flags & UDX_A_MTU_PROBE0x0800) |
| 863 | expert_add_info(pinfo, ti, &ei_udx_mtu_probe); |
| 864 | if (ppd->flags & UDX_A_END0x1000) |
| 865 | expert_add_info(pinfo, ti, &ei_udx_end); |
| 866 | if (ppd->flags & UDX_A_DESTROY0x2000) |
| 867 | expert_add_info(pinfo, ti, &ei_udx_destroy); |
| 868 | } |
| 869 | |
| 870 | |
| 871 | /* |
| 872 | * Follow stream. |
| 873 | * |
| 874 | * Payload is delivered in sequence order per direction. A packet that |
| 875 | * arrives early is held until the gap before it is filled, and a payload |
| 876 | * already delivered - a retransmission - is dropped, so the reassembled |
| 877 | * conversation reads the way the application saw it rather than the way the |
| 878 | * network happened to deliver it. |
| 879 | */ |
| 880 | |
| 881 | /* Stream numbers restart with every capture file, as they do for TCP. */ |
| 882 | static void |
| 883 | udx_init(void) |
| 884 | { |
| 885 | udx_stream_count = 0; |
| 886 | } |
| 887 | |
| 888 | static char * |
| 889 | udx_follow_conv_filter(epan_dissect_t *edt _U___attribute__((unused)), packet_info *pinfo, |
| 890 | unsigned *stream, unsigned *sub_stream _U___attribute__((unused))) |
| 891 | { |
| 892 | udx_ppd_t *ppd = (udx_ppd_t *) p_get_proto_data(wmem_file_scope(), pinfo, proto_udx, 0); |
| 893 | |
| 894 | if (ppd == NULL((void*)0) || ppd->flow == NULL((void*)0)) |
| 895 | return NULL((void*)0); |
| 896 | |
| 897 | *stream = ppd->stream; |
| 898 | return ws_strdup_printf("udx.stream eq %u", ppd->stream)wmem_strdup_printf(((void*)0), "udx.stream eq %u", ppd->stream ); |
| 899 | } |
| 900 | |
| 901 | static char * |
| 902 | udx_follow_index_filter(unsigned stream, unsigned sub_stream _U___attribute__((unused))) |
| 903 | { |
| 904 | return ws_strdup_printf("udx.stream eq %u", stream)wmem_strdup_printf(((void*)0), "udx.stream eq %u", stream); |
| 905 | } |
| 906 | |
| 907 | static unsigned |
| 908 | udx_get_stream_count(void) |
| 909 | { |
| 910 | return udx_stream_count; |
| 911 | } |
| 912 | |
| 913 | static void |
| 914 | udx_follow_append(follow_info_t *follow_info, follow_record_t *record) |
| 915 | { |
| 916 | follow_info->payload = g_list_prepend(follow_info->payload, record); |
| 917 | follow_info->bytes_written[record->is_server ? 1 : 0] += record->data->len; |
| 918 | } |
| 919 | |
| 920 | static int |
| 921 | udx_follow_seq_cmp(const void *a, const void *b) |
| 922 | { |
| 923 | const follow_record_t *ra = (const follow_record_t *) a; |
| 924 | const follow_record_t *rb = (const follow_record_t *) b; |
| 925 | |
| 926 | if (ra->seq == rb->seq) |
| 927 | return 0; |
| 928 | return (ra->seq < rb->seq) ? -1 : 1; |
| 929 | } |
| 930 | |
| 931 | /* |
| 932 | * Release held payload that now continues the stream. The pending list is |
| 933 | * kept in sequence order, so this only ever walks its front. |
| 934 | */ |
| 935 | static void |
| 936 | udx_follow_drain(follow_info_t *follow_info, int dir) |
| 937 | { |
| 938 | while (follow_info->fragments[dir] != NULL((void*)0)) { |
| 939 | follow_record_t *held = (follow_record_t *) follow_info->fragments[dir]->data; |
| 940 | |
| 941 | /* |
| 942 | * A copy of this packet reached the delivery point ahead of the one |
| 943 | * held here, which happens whenever a retransmission arrives while an |
| 944 | * earlier gap is still open. The held copy has nothing left to give, |
| 945 | * and leaving it at the head of the list would stop every packet |
| 946 | * behind it from ever being released. |
| 947 | */ |
| 948 | if (held->seq < follow_info->seq[dir]) { |
| 949 | follow_info->fragments[dir] = |
| 950 | g_list_delete_link(follow_info->fragments[dir], |
| 951 | follow_info->fragments[dir]); |
| 952 | g_byte_array_free(held->data, true1); |
| 953 | g_free(held)(__builtin_object_size ((held), 0) != ((size_t) - 1)) ? g_free_sized (held, __builtin_object_size ((held), 0)) : (g_free) (held); |
| 954 | continue; |
| 955 | } |
| 956 | |
| 957 | if (held->seq != follow_info->seq[dir]) |
| 958 | break; |
| 959 | |
| 960 | follow_info->seq[dir]++; |
| 961 | follow_info->fragments[dir] = g_list_delete_link(follow_info->fragments[dir], |
| 962 | follow_info->fragments[dir]); |
| 963 | udx_follow_append(follow_info, held); |
| 964 | } |
| 965 | } |
| 966 | |
| 967 | static tap_packet_status |
| 968 | udx_follow_tap_listener(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U___attribute__((unused)), |
| 969 | const void *data, tap_flags_t flags _U___attribute__((unused))) |
| 970 | { |
| 971 | follow_info_t *follow_info = (follow_info_t *) tapdata; |
| 972 | const udx_follow_tap_data_t *follow_data = (const udx_follow_tap_data_t *) data; |
| 973 | follow_record_t *record; |
| 974 | unsigned length = tvb_captured_length(follow_data->tvb); |
| 975 | int dir = follow_data->from_server ? 1 : 0; |
| 976 | |
| 977 | if (follow_info->stream_id != follow_data->stream) |
| 978 | return TAP_PACKET_DONT_REDRAW; |
| 979 | |
| 980 | /* Already delivered: a retransmission or a duplicate. */ |
| 981 | if (follow_data->offset < follow_info->seq[dir]) |
| 982 | return TAP_PACKET_DONT_REDRAW; |
| 983 | |
| 984 | record = g_new0(follow_record_t, 1)((follow_record_t *) g_malloc0_n ((1), sizeof (follow_record_t ))); |
| 985 | record->is_server = follow_data->from_server; |
| 986 | record->packet_num = pinfo->fd->num; |
| 987 | record->abs_ts = pinfo->fd->abs_ts; |
| 988 | record->seq = follow_data->offset; |
| 989 | record->data = g_byte_array_sized_new(length); |
| 990 | record->data = g_byte_array_append(record->data, |
| 991 | tvb_get_ptr(follow_data->tvb, 0, length), length); |
| 992 | |
| 993 | if (follow_data->from_server) { |
| 994 | if (follow_info->server_port == 0) { |
| 995 | follow_info->server_port = pinfo->srcport; |
| 996 | copy_address(&follow_info->server_ip, &pinfo->src); |
| 997 | follow_info->client_port = pinfo->destport; |
| 998 | copy_address(&follow_info->client_ip, &pinfo->dst); |
| 999 | } |
| 1000 | } else { |
| 1001 | if (follow_info->client_port == 0) { |
| 1002 | follow_info->client_port = pinfo->srcport; |
| 1003 | copy_address(&follow_info->client_ip, &pinfo->src); |
| 1004 | follow_info->server_port = pinfo->destport; |
| 1005 | copy_address(&follow_info->server_ip, &pinfo->dst); |
| 1006 | } |
| 1007 | } |
| 1008 | |
| 1009 | if (follow_data->offset == follow_info->seq[dir]) { |
| 1010 | follow_info->seq[dir]++; |
| 1011 | udx_follow_append(follow_info, record); |
| 1012 | udx_follow_drain(follow_info, dir); |
| 1013 | } else { |
| 1014 | /* Arrived early: hold it, in order, until the gap ahead is filled. |
| 1015 | * The framework frees whatever is still pending when the stream is |
| 1016 | * reset, so an unfilled gap leaks nothing. */ |
| 1017 | follow_info->fragments[dir] = g_list_insert_sorted(follow_info->fragments[dir], |
| 1018 | record, udx_follow_seq_cmp); |
| 1019 | } |
| 1020 | |
| 1021 | return TAP_PACKET_DONT_REDRAW; |
| 1022 | } |
| 1023 | |
| 1024 | static int |
| 1025 | dissect_udx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U___attribute__((unused))) |
| 1026 | { |
| 1027 | proto_item *ti; |
| 1028 | proto_tree *udx_tree; |
| 1029 | uint8_t flags, data_offset; |
| 1030 | uint32_t id, window, seq, ack; |
| 1031 | int offset = 0; |
| 1032 | int sack_end_offset; |
| 1033 | unsigned payload_len; |
| 1034 | char flags_str[64]; |
| 1035 | uint32_t sack_start[UDX_MAX_SACK_BLOCKS32]; |
| 1036 | uint32_t sack_end[UDX_MAX_SACK_BLOCKS32]; |
| 1037 | unsigned n_sacks = 0; |
| 1038 | udx_ppd_t *ppd = NULL((void*)0); |
| 1039 | |
| 1040 | /* |
| 1041 | * Reached either from the heuristic, which has already validated the |
| 1042 | * header, or directly once a conversation has been claimed or through |
| 1043 | * "Decode As". The latter routes make this check load bearing. |
| 1044 | */ |
| 1045 | if (tvb_reported_length(tvb) < UDX_HEADER_SIZE20) |
| 1046 | return 0; |
| 1047 | |
| 1048 | col_set_str(pinfo->cinfo, COL_PROTOCOL, "UDX"); |
| 1049 | col_clear(pinfo->cinfo, COL_INFO); |
| 1050 | |
| 1051 | flags = tvb_get_uint8(tvb, 2); |
| 1052 | data_offset = tvb_get_uint8(tvb, 3); |
| 1053 | id = tvb_get_letohl(tvb, 4); |
| 1054 | window = tvb_get_letohl(tvb, 8); |
| 1055 | seq = tvb_get_letohl(tvb, 12); |
| 1056 | ack = tvb_get_letohl(tvb, 16); |
| 1057 | |
| 1058 | udx_flags_to_str(flags, flags_str, sizeof(flags_str)); |
| 1059 | |
| 1060 | /* Collect the selective acknowledgement ranges before anything is added |
| 1061 | * to the tree: the analysis below needs them, and the display needs the |
| 1062 | * analysis. */ |
| 1063 | if (flags & UDX_FLAG_SACK0x04) { |
| 1064 | /* Blocks fill the area delimited by data_offset; a packet with no |
| 1065 | * payload may leave that byte zero and run to the end instead. */ |
| 1066 | sack_end_offset = (data_offset > 0) |
| 1067 | ? UDX_HEADER_SIZE20 + data_offset |
| 1068 | : (int) tvb_reported_length(tvb); |
| 1069 | } else { |
| 1070 | /* Anything reserved without SACK blocks is MTU probe padding. */ |
| 1071 | sack_end_offset = UDX_HEADER_SIZE20 + data_offset; |
| 1072 | } |
| 1073 | |
| 1074 | /* data_offset is not trustworthy on a packet this dissector did not |
| 1075 | * validate, so never let it point past the datagram. */ |
| 1076 | sack_end_offset = MIN(sack_end_offset, (int) tvb_reported_length(tvb))(((sack_end_offset) < ((int) tvb_reported_length(tvb))) ? ( sack_end_offset) : ((int) tvb_reported_length(tvb))); |
| 1077 | |
| 1078 | if (flags & UDX_FLAG_SACK0x04) { |
| 1079 | int pos = UDX_HEADER_SIZE20; |
| 1080 | |
| 1081 | while (pos + 8 <= sack_end_offset && n_sacks < UDX_MAX_SACK_BLOCKS32) { |
| 1082 | sack_start[n_sacks] = tvb_get_letohl(tvb, pos); |
| 1083 | sack_end[n_sacks] = tvb_get_letohl(tvb, pos + 4); |
| 1084 | n_sacks++; |
| 1085 | pos += 8; |
| 1086 | } |
| 1087 | } |
| 1088 | |
| 1089 | payload_len = (unsigned) MAX(0, (int) tvb_reported_length(tvb) - sack_end_offset)(((0) > ((int) tvb_reported_length(tvb) - sack_end_offset) ) ? (0) : ((int) tvb_reported_length(tvb) - sack_end_offset)); |
| 1090 | |
| 1091 | if (udx_analyze_sequence_numbers) { |
| 1092 | if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) { |
| 1093 | conversation_t *conversation = find_or_create_conversation(pinfo); |
| 1094 | udx_conv_t *conv; |
| 1095 | |
| 1096 | conv = (udx_conv_t *) conversation_get_proto_data(conversation, proto_udx); |
| 1097 | if (conv == NULL((void*)0)) { |
| 1098 | conv = wmem_new0(wmem_file_scope(), udx_conv_t)((udx_conv_t*)wmem_alloc0((wmem_file_scope()), sizeof(udx_conv_t ))); |
| 1099 | conv->flows = wmem_map_new(wmem_file_scope(), g_int64_hash, g_int64_equal); |
| 1100 | conversation_add_proto_data(conversation, proto_udx, conv); |
| 1101 | } |
| 1102 | |
| 1103 | ppd = wmem_new0(wmem_file_scope(), udx_ppd_t)((udx_ppd_t*)wmem_alloc0((wmem_file_scope()), sizeof(udx_ppd_t ))); |
| 1104 | udx_analyze(pinfo, conv, flags, data_offset, id, window, seq, ack, |
| 1105 | payload_len, sack_start, sack_end, n_sacks, ppd); |
| 1106 | p_add_proto_data(wmem_file_scope(), pinfo, proto_udx, 0, ppd); |
| 1107 | } else { |
| 1108 | ppd = (udx_ppd_t *) p_get_proto_data(wmem_file_scope(), pinfo, proto_udx, 0); |
| 1109 | } |
| 1110 | } |
| 1111 | |
| 1112 | ti = proto_tree_add_item(tree, proto_udx, tvb, 0, -1, ENC_NA0x00000000); |
| 1113 | proto_item_append_text(ti, ", %s, Id: %u, Seq: %u, Ack: %u", flags_str, id, seq, ack); |
| 1114 | udx_tree = proto_item_add_subtree(ti, ett_udx); |
| 1115 | |
| 1116 | proto_tree_add_item(udx_tree, hf_udx_magic, tvb, offset, 1, ENC_NA0x00000000); |
| 1117 | offset += 1; |
| 1118 | proto_tree_add_item(udx_tree, hf_udx_version, tvb, offset, 1, ENC_NA0x00000000); |
| 1119 | offset += 1; |
| 1120 | proto_tree_add_bitmask(udx_tree, tvb, offset, hf_udx_flags, ett_udx_flags, |
| 1121 | udx_flag_fields, ENC_NA0x00000000); |
| 1122 | offset += 1; |
| 1123 | proto_tree_add_item(udx_tree, hf_udx_data_offset, tvb, offset, 1, ENC_NA0x00000000); |
| 1124 | offset += 1; |
| 1125 | proto_tree_add_item(udx_tree, hf_udx_id, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000); |
| 1126 | offset += 4; |
| 1127 | proto_tree_add_item(udx_tree, hf_udx_window, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000); |
| 1128 | offset += 4; |
| 1129 | proto_tree_add_item(udx_tree, hf_udx_seq, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000); |
| 1130 | offset += 4; |
| 1131 | proto_tree_add_item(udx_tree, hf_udx_ack, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000); |
| 1132 | offset += 4; |
| 1133 | |
| 1134 | if (n_sacks > 0) { |
| 1135 | proto_item *sacks_ti; |
| 1136 | proto_tree *sacks_tree, *block_tree; |
| 1137 | |
| 1138 | sacks_ti = proto_tree_add_item(udx_tree, hf_udx_sacks, tvb, offset, |
| 1139 | sack_end_offset - offset, ENC_NA0x00000000); |
| 1140 | proto_item_append_text(sacks_ti, " (%u)", n_sacks); |
| 1141 | sacks_tree = proto_item_add_subtree(sacks_ti, ett_udx_sacks); |
| 1142 | |
| 1143 | for (unsigned i = 0; i < n_sacks; i++) { |
| 1144 | block_tree = proto_tree_add_subtree_format(sacks_tree, tvb, offset, 8, |
| 1145 | ett_udx_sack_block, NULL((void*)0), |
| 1146 | "SACK: %u-%u", |
| 1147 | sack_start[i], sack_end[i]); |
| 1148 | proto_tree_add_item(block_tree, hf_udx_sack_start, tvb, offset, 4, |
| 1149 | ENC_LITTLE_ENDIAN0x80000000); |
| 1150 | proto_tree_add_item(block_tree, hf_udx_sack_end, tvb, offset + 4, 4, |
| 1151 | ENC_LITTLE_ENDIAN0x80000000); |
| 1152 | offset += 8; |
| 1153 | } |
| 1154 | } else if (!(flags & UDX_FLAG_SACK0x04) && data_offset > 0) { |
| 1155 | /* |
| 1156 | * Padding between header and payload with no SACK blocks: inserted by |
| 1157 | * mtu_probeify_packet() in libudx - this datagram is an MTU probe. |
| 1158 | */ |
| 1159 | proto_tree_add_item(udx_tree, hf_udx_padding, tvb, offset, data_offset, ENC_NA0x00000000); |
| 1160 | offset += data_offset; |
Value stored to 'offset' is never read | |
| 1161 | } |
| 1162 | |
| 1163 | if (payload_len > 0) { |
| 1164 | ti = proto_tree_add_uint(udx_tree, hf_udx_payload_len, tvb, 0, 0, payload_len); |
| 1165 | proto_item_set_generated(ti); |
| 1166 | proto_tree_add_item(udx_tree, hf_udx_payload, tvb, sack_end_offset, |
| 1167 | (int) payload_len, ENC_NA0x00000000); |
| 1168 | } |
| 1169 | |
| 1170 | if (ppd != NULL((void*)0)) { |
| 1171 | udx_show_analysis(tvb, pinfo, udx_tree, ppd); |
| 1172 | |
| 1173 | /* MESSAGE payloads travel outside the ordered stream, so they are |
| 1174 | * shown per packet but left out of the reassembled conversation. */ |
| 1175 | if (ppd->follow_ok && !(flags & UDX_FLAG_MESSAGE0x08) && |
| 1176 | have_tap_listener(udx_follow_tap)) { |
| 1177 | udx_follow_tap_data_t *follow_data = wmem_new0(pinfo->pool, udx_follow_tap_data_t)((udx_follow_tap_data_t*)wmem_alloc0((pinfo->pool), sizeof (udx_follow_tap_data_t))); |
| 1178 | |
| 1179 | follow_data->tvb = tvb_new_subset_length(tvb, sack_end_offset, (int) payload_len); |
| 1180 | follow_data->stream = ppd->stream; |
| 1181 | follow_data->offset = ppd->follow_offset; |
| 1182 | follow_data->from_server = ppd->from_server; |
| 1183 | tap_queue_packet(udx_follow_tap, pinfo, follow_data); |
| 1184 | } |
| 1185 | } |
| 1186 | |
| 1187 | col_add_fstr(pinfo->cinfo, COL_INFO, "%s Id=%u Seq=%u Ack=%u Rwnd=%u", |
| 1188 | flags_str, id, seq, ack, window); |
| 1189 | if (payload_len > 0) |
| 1190 | col_append_fstr(pinfo->cinfo, COL_INFO, " Len=%u", payload_len); |
| 1191 | if (ppd != NULL((void*)0) && (ppd->flags & UDX_A_RETRANS0x0001)) |
| 1192 | col_append_str(pinfo->cinfo, COL_INFO, " [retransmission]"); |
| 1193 | |
| 1194 | return tvb_reported_length(tvb); |
| 1195 | } |
| 1196 | |
| 1197 | static bool_Bool |
| 1198 | test_udx(tvbuff_t *tvb) |
| 1199 | { |
| 1200 | uint8_t flags, data_offset; |
| 1201 | |
| 1202 | if (tvb_captured_length(tvb) < UDX_HEADER_SIZE20) |
| 1203 | return false0; |
| 1204 | if (tvb_get_uint8(tvb, 0) != UDX_MAGIC_BYTE0xff) |
| 1205 | return false0; |
| 1206 | if (tvb_get_uint8(tvb, 1) != UDX_VERSION1) |
| 1207 | return false0; |
| 1208 | |
| 1209 | flags = tvb_get_uint8(tvb, 2); |
| 1210 | if (flags & ~UDX_FLAG_MASK0x3f) |
| 1211 | return false0; |
| 1212 | |
| 1213 | data_offset = tvb_get_uint8(tvb, 3); |
| 1214 | if (UDX_HEADER_SIZE20 + (unsigned) data_offset > tvb_reported_length(tvb)) |
| 1215 | return false0; |
| 1216 | /* The area delimited by data_offset holds SACK blocks (uint32 pairs) when |
| 1217 | * the SACK flag is set - anything not a multiple of 8 is not UDX. */ |
| 1218 | if ((flags & UDX_FLAG_SACK0x04) && data_offset > 0 && (data_offset % 8) != 0) |
| 1219 | return false0; |
| 1220 | |
| 1221 | /* |
| 1222 | * Only DATA and MESSAGE packets carry a payload. Everything else is the |
| 1223 | * fixed header followed at most by selective acknowledgement blocks, so |
| 1224 | * its length is known exactly and anything else is not UDX. |
| 1225 | */ |
| 1226 | if (!(flags & (UDX_FLAG_DATA0x01 | UDX_FLAG_MESSAGE0x08))) { |
| 1227 | unsigned trailing = tvb_reported_length(tvb) - UDX_HEADER_SIZE20; |
| 1228 | |
| 1229 | if (flags & UDX_FLAG_SACK0x04) { |
| 1230 | if ((trailing % 8) != 0) |
| 1231 | return false0; |
| 1232 | } else if (trailing != 0) { |
| 1233 | return false0; |
| 1234 | } |
| 1235 | } |
| 1236 | |
| 1237 | return true1; |
| 1238 | } |
| 1239 | |
| 1240 | static bool_Bool |
| 1241 | dissect_udx_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) |
| 1242 | { |
| 1243 | conversation_t *conversation; |
| 1244 | |
| 1245 | if (!test_udx(tvb)) |
| 1246 | return false0; |
| 1247 | |
| 1248 | /* Claim the whole UDP conversation so weaker frames (e.g. bare 20-byte |
| 1249 | * heartbeats) and future packets skip the heuristic. */ |
| 1250 | conversation = find_or_create_conversation(pinfo); |
| 1251 | conversation_set_dissector(conversation, udx_handle); |
| 1252 | |
| 1253 | dissect_udx(tvb, pinfo, tree, data); |
| 1254 | return true1; |
| 1255 | } |
| 1256 | |
| 1257 | void |
| 1258 | proto_register_udx(void) |
| 1259 | { |
| 1260 | static hf_register_info hf[] = { |
| 1261 | { &hf_udx_magic, |
| 1262 | { "Magic Byte", "udx.magic_byte", FT_UINT8, BASE_HEX, NULL((void*)0), 0x0, |
| 1263 | "Always 0xff", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1264 | }, |
| 1265 | { &hf_udx_version, |
| 1266 | { "Version", "udx.version", FT_UINT8, BASE_DEC, NULL((void*)0), 0x0, |
| 1267 | NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1268 | }, |
| 1269 | { &hf_udx_flags, |
| 1270 | { "Type", "udx.type", FT_UINT8, BASE_HEX, NULL((void*)0), 0x0, |
| 1271 | "Packet type flags", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1272 | }, |
| 1273 | { &hf_udx_flags_data, |
| 1274 | { "Data", "udx.type.data", FT_BOOLEAN, 8, NULL((void*)0), UDX_FLAG_DATA0x01, |
| 1275 | "Carries stream payload", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1276 | }, |
| 1277 | { &hf_udx_flags_end, |
| 1278 | { "End", "udx.type.end", FT_BOOLEAN, 8, NULL((void*)0), UDX_FLAG_END0x02, |
| 1279 | "Graceful end of stream (consumes a sequence number)", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1280 | }, |
| 1281 | { &hf_udx_flags_sack, |
| 1282 | { "SACK", "udx.type.sack", FT_BOOLEAN, 8, NULL((void*)0), UDX_FLAG_SACK0x04, |
| 1283 | "Carries selective acknowledgement blocks", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1284 | }, |
| 1285 | { &hf_udx_flags_message, |
| 1286 | { "Message", "udx.type.message", FT_BOOLEAN, 8, NULL((void*)0), UDX_FLAG_MESSAGE0x08, |
| 1287 | "Unordered datagram outside the byte stream", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1288 | }, |
| 1289 | { &hf_udx_flags_destroy, |
| 1290 | { "Destroy", "udx.type.destroy", FT_BOOLEAN, 8, NULL((void*)0), UDX_FLAG_DESTROY0x10, |
| 1291 | "Abrupt stream termination", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1292 | }, |
| 1293 | { &hf_udx_flags_heartbeat, |
| 1294 | { "Heartbeat", "udx.type.heartbeat", FT_BOOLEAN, 8, NULL((void*)0), UDX_FLAG_HEARTBEAT0x20, |
| 1295 | "Keepalive or zero-window probe", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1296 | }, |
| 1297 | { &hf_udx_data_offset, |
| 1298 | { "Data Offset", "udx.data_offset", FT_UINT8, BASE_DEC, NULL((void*)0), 0x0, |
| 1299 | "Bytes between the fixed header and the payload", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1300 | }, |
| 1301 | { &hf_udx_id, |
| 1302 | { "Id", "udx.id", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1303 | "Receiver's stream id", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1304 | }, |
| 1305 | { &hf_udx_window, |
| 1306 | { "Window", "udx.rwnd", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1307 | "Sender's receive window in bytes", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1308 | }, |
| 1309 | { &hf_udx_seq, |
| 1310 | { "Seq", "udx.seq", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1311 | "Packet sequence number (counts packets, not bytes)", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1312 | }, |
| 1313 | { &hf_udx_ack, |
| 1314 | { "Ack", "udx.ack", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1315 | "Next sequence number expected from the peer", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1316 | }, |
| 1317 | { &hf_udx_sacks, |
| 1318 | { "SACK Blocks", "udx.sacks", FT_NONE, BASE_NONE, NULL((void*)0), 0x0, |
| 1319 | "Selective acknowledgement ranges", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1320 | }, |
| 1321 | { &hf_udx_sack_block, |
| 1322 | { "SACK Block", "udx.sack", FT_NONE, BASE_NONE, NULL((void*)0), 0x0, |
| 1323 | NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1324 | }, |
| 1325 | { &hf_udx_sack_start, |
| 1326 | { "Start", "udx.sack.start", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1327 | "First sequence number in the acknowledged range", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1328 | }, |
| 1329 | { &hf_udx_sack_end, |
| 1330 | { "End", "udx.sack.end", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1331 | "One past the last acknowledged sequence number", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1332 | }, |
| 1333 | { &hf_udx_padding, |
| 1334 | { "Padding", "udx.padding", FT_BYTES, BASE_NONE, NULL((void*)0), 0x0, |
| 1335 | "MTU probe padding", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1336 | }, |
| 1337 | { &hf_udx_payload, |
| 1338 | { "Payload", "udx.payload", FT_BYTES, BASE_NONE, NULL((void*)0), 0x0, |
| 1339 | NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1340 | }, |
| 1341 | { &hf_udx_payload_len, |
| 1342 | { "Payload Length", "udx.length", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1343 | NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1344 | }, |
| 1345 | { &hf_udx_stream, |
| 1346 | { "Stream index", "udx.stream", FT_UINT32, BASE_DEC, NULL((void*)0), 0x0, |
| 1347 | "Index of the paired flows carrying this stream", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1348 | }, |
| 1349 | { &hf_udx_analysis, |
| 1350 | { "SEQ/ACK analysis", "udx.analysis", FT_NONE, BASE_NONE, NULL((void*)0), 0x0, |
| 1351 | "Results of the sequence number analysis", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1352 | }, |
| 1353 | { &hf_udx_analysis_acks_frame, |
| 1354 | { "This is an ACK to the packet in frame", "udx.analysis.acks_frame", |
| 1355 | FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_ACK)((gpointer) (glong) (FT_FRAMENUM_ACK)), 0x0, |
| 1356 | NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1357 | }, |
| 1358 | { &hf_udx_analysis_acked_in, |
| 1359 | { "ACKed in frame", "udx.analysis.acked_in", FT_FRAMENUM, BASE_NONE, |
| 1360 | FRAMENUM_TYPE(FT_FRAMENUM_NONE)((gpointer) (glong) (FT_FRAMENUM_NONE)), 0x0, |
| 1361 | "The frame that acknowledged this packet", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1362 | }, |
| 1363 | { &hf_udx_analysis_ack_rtt, |
| 1364 | { "Time to ACK", "udx.analysis.ack_rtt", FT_RELATIVE_TIME, BASE_NONE, NULL((void*)0), 0x0, |
| 1365 | "Time between the packet and its acknowledgement", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1366 | }, |
| 1367 | { &hf_udx_analysis_bytes_in_flight, |
| 1368 | { "Bytes in flight", "udx.analysis.bytes_in_flight", FT_UINT32, BASE_DEC, |
| 1369 | NULL((void*)0), 0x0, "Unacknowledged payload bytes on this flow", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1370 | }, |
| 1371 | { &hf_udx_analysis_pkts_in_flight, |
| 1372 | { "Packets in flight", "udx.analysis.packets_in_flight", FT_UINT32, BASE_DEC, |
| 1373 | NULL((void*)0), 0x0, "Unacknowledged packets on this flow", HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1374 | }, |
| 1375 | { &hf_udx_analysis_no_reverse, |
| 1376 | { "Reverse flow not identified", "udx.analysis.no_reverse", FT_NONE, BASE_NONE, |
| 1377 | NULL((void*)0), 0x0, "The stream carrying the other direction has not been paired", |
| 1378 | HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) } |
| 1379 | }, |
| 1380 | }; |
| 1381 | |
| 1382 | static int *ett[] = { |
| 1383 | &ett_udx, |
| 1384 | &ett_udx_flags, |
| 1385 | &ett_udx_sacks, |
| 1386 | &ett_udx_sack_block, |
| 1387 | &ett_udx_analysis, |
| 1388 | }; |
| 1389 | |
| 1390 | static ei_register_info ei[] = { |
| 1391 | { &ei_udx_retrans, |
| 1392 | { "udx.analysis.retransmission", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1393 | "This packet was retransmitted", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1394 | }, |
| 1395 | { &ei_udx_fast_retrans, |
| 1396 | { "udx.analysis.fast_retransmission", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1397 | "Fast retransmission: resent while later packets were selectively" |
| 1398 | " acknowledged", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1399 | }, |
| 1400 | { &ei_udx_rto_retrans, |
| 1401 | { "udx.analysis.rto_retransmission", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1402 | "Retransmission timeout: resent after more than the estimated RTO", |
| 1403 | EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1404 | }, |
| 1405 | { &ei_udx_tlp, |
| 1406 | { "udx.analysis.tail_loss_probe", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1407 | "Tail loss probe: sent after a pause to draw an acknowledgement" |
| 1408 | " out of the peer", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1409 | }, |
| 1410 | { &ei_udx_spurious_retrans, |
| 1411 | { "udx.analysis.spurious_retransmission", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1412 | "Spurious retransmission: this packet was already acknowledged", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1413 | }, |
| 1414 | { &ei_udx_duplicate, |
| 1415 | { "udx.analysis.duplicate", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1416 | "Duplicate packet: the same packet was seen twice in quick succession", |
| 1417 | EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1418 | }, |
| 1419 | { &ei_udx_out_of_order, |
| 1420 | { "udx.analysis.out_of_order", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1421 | "Out-of-order packet", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1422 | }, |
| 1423 | { &ei_udx_lost_segment, |
| 1424 | { "udx.analysis.lost_segment", PI_SEQUENCE0x02000000, PI_WARN0x00600000, |
| 1425 | "Previous packet not captured: a sequence number was skipped", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1426 | }, |
| 1427 | { &ei_udx_keepalive, |
| 1428 | { "udx.analysis.keepalive", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1429 | "Keepalive", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1430 | }, |
| 1431 | { &ei_udx_zero_window_probe, |
| 1432 | { "udx.analysis.zero_window_probe", PI_SEQUENCE0x02000000, PI_NOTE0x00400000, |
| 1433 | "Zero window probe: sent while the peer advertised no receive window", |
| 1434 | EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1435 | }, |
| 1436 | { &ei_udx_zero_window, |
| 1437 | { "udx.analysis.zero_window", PI_SEQUENCE0x02000000, PI_WARN0x00600000, |
| 1438 | "Zero window: the sender cannot accept more data", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1439 | }, |
| 1440 | { &ei_udx_window_update, |
| 1441 | { "udx.analysis.window_update", PI_SEQUENCE0x02000000, PI_CHAT0x00200000, |
| 1442 | "Window update: the receive window reopened", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1443 | }, |
| 1444 | { &ei_udx_mtu_probe, |
| 1445 | { "udx.analysis.mtu_probe", PI_SEQUENCE0x02000000, PI_CHAT0x00200000, |
| 1446 | "MTU probe: padded to test a larger path MTU", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1447 | }, |
| 1448 | { &ei_udx_end, |
| 1449 | { "udx.analysis.end", PI_SEQUENCE0x02000000, PI_CHAT0x00200000, |
| 1450 | "End of stream", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1451 | }, |
| 1452 | { &ei_udx_destroy, |
| 1453 | { "udx.analysis.destroy", PI_SEQUENCE0x02000000, PI_WARN0x00600000, |
| 1454 | "Stream destroyed: abrupt termination", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE , BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE , -1, ((void*)0)}} } |
| 1455 | }, |
| 1456 | }; |
| 1457 | |
| 1458 | expert_module_t *expert_udx; |
| 1459 | module_t *udx_module; |
| 1460 | |
| 1461 | proto_udx = proto_register_protocol("UDX Protocol", "UDX", "udx"); |
| 1462 | proto_register_field_array(proto_udx, hf, array_length(hf)(sizeof (hf) / sizeof (hf)[0])); |
| 1463 | proto_register_subtree_array(ett, array_length(ett)(sizeof (ett) / sizeof (ett)[0])); |
| 1464 | |
| 1465 | expert_udx = expert_register_protocol(proto_udx); |
| 1466 | expert_register_field_array(expert_udx, ei, array_length(ei)(sizeof (ei) / sizeof (ei)[0])); |
| 1467 | |
| 1468 | udx_handle = register_dissector("udx", dissect_udx, proto_udx); |
| 1469 | |
| 1470 | register_init_routine(udx_init); |
| 1471 | |
| 1472 | udx_follow_tap = register_tap("udx_follow"); |
| 1473 | register_follow_stream(proto_udx, "udx_follow", |
| 1474 | udx_follow_conv_filter, udx_follow_index_filter, |
| 1475 | udp_follow_address_filter, udp_port_to_display, |
| 1476 | udx_follow_tap_listener, udx_get_stream_count, NULL((void*)0)); |
| 1477 | |
| 1478 | udx_module = prefs_register_protocol(proto_udx, NULL((void*)0)); |
| 1479 | prefs_register_bool_preference(udx_module, "analyze_sequence_numbers", |
| 1480 | "Analyze UDX sequence numbers", |
| 1481 | "Track sequence and acknowledgement numbers to pair flows, measure " |
| 1482 | "round-trip times and flag retransmissions", |
| 1483 | &udx_analyze_sequence_numbers); |
| 1484 | } |
| 1485 | |
| 1486 | void |
| 1487 | proto_reg_handoff_udx(void) |
| 1488 | { |
| 1489 | heur_dissector_add("udp", dissect_udx_heur, "UDX over UDP", "udx_udp", |
| 1490 | proto_udx, HEURISTIC_DISABLE); |
| 1491 | dissector_add_for_decode_as_with_preference("udp.port", udx_handle); |
| 1492 | } |
| 1493 | |
| 1494 | /* |
| 1495 | * Editor modelines - https://www.wireshark.org/tools/modelines.html |
| 1496 | * |
| 1497 | * Local variables: |
| 1498 | * c-basic-offset: 4 |
| 1499 | * tab-width: 8 |
| 1500 | * indent-tabs-mode: nil |
| 1501 | * End: |
| 1502 | * |
| 1503 | * vi: set shiftwidth=4 tabstop=8 expandtab: |
| 1504 | * :indentSize=4:tabSize=8:noTabs=true: |
| 1505 | */ |