/* packet-rpcap.c

 *

 * Routines for RPCAP message formats.

 *

 * Copyright 2008, Stig Bjorlykke <stig@bjorlykke.org>, Thales Norway AS

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/aftypes.h>

#include <epan/prefs.h>

#include <epan/to_str.h>

#include <epan/expert.h>

#include <epan/exceptions.h>

#include <epan/show_exception.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wsutil/str_util.h>

#include "packet-frame.h"

#include "packet-pcap_pktdata.h"

#include "packet-tcp.h"

#define PNAME  "Remote Packet Capture"

#define PSNAME "RPCAP"

#define PFNAME "rpcap"

#define RPCAP_MSG_ERROR               0x01

#define RPCAP_MSG_FINDALLIF_REQ       0x02

#define RPCAP_MSG_OPEN_REQ            0x03

#define RPCAP_MSG_STARTCAP_REQ        0x04

#define RPCAP_MSG_UPDATEFILTER_REQ    0x05

#define RPCAP_MSG_CLOSE               0x06

#define RPCAP_MSG_PACKET              0x07

#define RPCAP_MSG_AUTH_REQ            0x08

#define RPCAP_MSG_STATS_REQ           0x09

#define RPCAP_MSG_ENDCAP_REQ          0x0A

#define RPCAP_MSG_SETSAMPLING_REQ     0x0B

#define RPCAP_MSG_FINDALLIF_REPLY     (0x80+RPCAP_MSG_FINDALLIF_REQ)

#define RPCAP_MSG_OPEN_REPLY          (0x80+RPCAP_MSG_OPEN_REQ)

#define RPCAP_MSG_STARTCAP_REPLY      (0x80+RPCAP_MSG_STARTCAP_REQ)

#define RPCAP_MSG_UPDATEFILTER_REPLY  (0x80+RPCAP_MSG_UPDATEFILTER_REQ)

#define RPCAP_MSG_AUTH_REPLY          (0x80+RPCAP_MSG_AUTH_REQ)

#define RPCAP_MSG_STATS_REPLY         (0x80+RPCAP_MSG_STATS_REQ)

#define RPCAP_MSG_ENDCAP_REPLY        (0x80+RPCAP_MSG_ENDCAP_REQ)

#define RPCAP_MSG_SETSAMPLING_REPLY   (0x80+RPCAP_MSG_SETSAMPLING_REQ)

#define RPCAP_ERR_NETW            1

#define RPCAP_ERR_INITTIMEOUT     2

#define RPCAP_ERR_AUTH            3

#define RPCAP_ERR_FINDALLIF       4

#define RPCAP_ERR_NOREMOTEIF      5

#define RPCAP_ERR_OPEN            6

#define RPCAP_ERR_UPDATEFILTER    7

#define RPCAP_ERR_GETSTATS        8

#define RPCAP_ERR_READEX          9

#define RPCAP_ERR_HOSTNOAUTH      10

#define RPCAP_ERR_REMOTEACCEPT    11

#define RPCAP_ERR_STARTCAPTURE    12

#define RPCAP_ERR_ENDCAPTURE      13

#define RPCAP_ERR_RUNTIMETIMEOUT  14

#define RPCAP_ERR_SETSAMPLING     15

#define RPCAP_ERR_WRONGMSG        16

#define RPCAP_ERR_WRONGVER        17

#define RPCAP_SAMP_NOSAMP            0

#define RPCAP_SAMP_1_EVERY_N         1

#define RPCAP_SAMP_FIRST_AFTER_N_MS  2

#define RPCAP_RMTAUTH_NULL  0

#define RPCAP_RMTAUTH_PWD   1

#define FLAG_PROMISC     0x0001

#define FLAG_DGRAM       0x0002

#define FLAG_SERVEROPEN  0x0004

#define FLAG_INBOUND     0x0008

#define FLAG_OUTBOUND    0x0010

void proto_register_rpcap (void);

void proto_reg_handoff_rpcap (void);

static int proto_rpcap;

static int hf_version;

static int hf_type;

static int hf_value;

static int hf_plen;

static int hf_error;

static int hf_error_value;

static int hf_packet;

static int hf_timestamp;

static int hf_caplen;

static int hf_len;

static int hf_npkt;

static int hf_auth_request;

static int hf_auth_type;

static int hf_auth_slen1;

static int hf_auth_slen2;

static int hf_auth_username;

static int hf_auth_password;

static int hf_auth_reply;

static int hf_auth_minvers;

static int hf_auth_maxvers;

static int hf_open_request;

static int hf_open_reply;

static int hf_linktype;

static int hf_tzoff;

static int hf_startcap_request;

static int hf_snaplen;

static int hf_read_timeout;

static int hf_flags;

static int hf_flags_promisc;

static int hf_flags_dgram;

static int hf_flags_serveropen;

static int hf_flags_inbound;

static int hf_flags_outbound;

static int hf_client_port;

static int hf_startcap_reply;

static int hf_bufsize;

static int hf_server_port;

static int hf_dummy;

static int hf_filter;

static int hf_filtertype;

static int hf_nitems;

static int hf_filterbpf_insn;

static int hf_code;

static int hf_code_class;

static int hf_code_fields;

static int hf_code_ld_size;

static int hf_code_ld_mode;

static int hf_code_alu_op;

static int hf_code_jmp_op;

static int hf_code_src;

static int hf_code_rval;

static int hf_code_misc_op;

static int hf_jt;

static int hf_jf;

static int hf_instr_value;

static int hf_stats_reply;

static int hf_ifrecv;

static int hf_ifdrop;

static int hf_krnldrop;

static int hf_srvcapt;

static int hf_findalldevs_reply;

static int hf_findalldevs_if;

static int hf_namelen;

static int hf_desclen;

static int hf_if_flags;

static int hf_naddr;

static int hf_if_name;

static int hf_if_desc;

static int hf_findalldevs_ifaddr;

static int hf_if_addr;

static int hf_if_netmask;

static int hf_if_broadaddr;

static int hf_if_dstaddr;

static int hf_if_af;

static int hf_if_port;

static int hf_if_ipv4;

static int hf_if_flowinfo;

static int hf_if_ipv6;

static int hf_if_scopeid;

static int hf_if_padding;

static int hf_if_unknown;

static int hf_sampling_request;

static int hf_sampling_method;

static int hf_sampling_dummy1;

static int hf_sampling_dummy2;

static int hf_sampling_value;

static int ett_rpcap;

static int ett_error;

static int ett_packet;

static int ett_auth_request;

static int ett_auth_reply;

static int ett_open_reply;

static int ett_startcap_request;

static int ett_startcap_reply;

static int ett_startcap_flags;

static int ett_filter;

static int ett_filterbpf_insn;

static int ett_filterbpf_insn_code;

static int ett_stats_reply;

static int ett_findalldevs_reply;

static int ett_findalldevs_if;

static int ett_findalldevs_ifaddr;

static int ett_ifaddr;

static int ett_sampling_request;

static expert_field ei_error;

static expert_field ei_if_unknown;

static expert_field ei_no_more_data;

static expert_field ei_caplen_too_big;

static dissector_handle_t pcap_pktdata_handle;

static dissector_handle_t rpcap_tcp_handle;

/* User definable values */

static bool rpcap_desegment = true;

static bool decode_content = true;

static int global_linktype = -1;

/* Global variables */

static int linktype = -1;

static bool info_added;

static const value_string message_type[] = {

  { RPCAP_MSG_ERROR,              "Error"                       },

  { RPCAP_MSG_FINDALLIF_REQ,      "Find all interfaces request" },

  { RPCAP_MSG_OPEN_REQ,           "Open request"                },

  { RPCAP_MSG_STARTCAP_REQ,       "Start capture request"       },

  { RPCAP_MSG_UPDATEFILTER_REQ,   "Update filter request"       },

  { RPCAP_MSG_CLOSE,              "Close"                       },

  { RPCAP_MSG_PACKET,             "Packet"                      },

  { RPCAP_MSG_AUTH_REQ,           "Authentication request"      },

  { RPCAP_MSG_STATS_REQ,          "Statistics request"          },

  { RPCAP_MSG_ENDCAP_REQ,         "End capture request"         },

  { RPCAP_MSG_SETSAMPLING_REQ,    "Set sampling request"        },

  { RPCAP_MSG_FINDALLIF_REPLY,    "Find all interfaces reply"   },

  { RPCAP_MSG_OPEN_REPLY,         "Open reply"                  },

  { RPCAP_MSG_STARTCAP_REPLY,     "Start capture reply"         },

  { RPCAP_MSG_UPDATEFILTER_REPLY, "Update filter reply"         },

  { RPCAP_MSG_AUTH_REPLY,         "Authentication reply"        },

  { RPCAP_MSG_STATS_REPLY,        "Statistics reply"            },

  { RPCAP_MSG_ENDCAP_REPLY,       "End capture reply"           },

  { RPCAP_MSG_SETSAMPLING_REPLY,  "Set sampling reply"          },

  { 0,   NULL }

};

static const value_string error_codes[] = {

  { RPCAP_ERR_NETW,            "Network error"                        },

  { RPCAP_ERR_INITTIMEOUT,     "Initial timeout has expired"          },

  { RPCAP_ERR_AUTH,            "Authentication error"                 },

  { RPCAP_ERR_FINDALLIF,       "Generic findalldevs error"            },

  { RPCAP_ERR_NOREMOTEIF,      "No remote interfaces"                 },

  { RPCAP_ERR_OPEN,            "Generic pcap_open error"              },

  { RPCAP_ERR_UPDATEFILTER,    "Generic updatefilter error"           },

  { RPCAP_ERR_GETSTATS,        "Generic pcap_stats error"             },

  { RPCAP_ERR_READEX,          "Generic pcap_next_ex error"           },

  { RPCAP_ERR_HOSTNOAUTH,      "The host is not authorized"           },

  { RPCAP_ERR_REMOTEACCEPT,    "Generic pcap_remoteaccept error"      },

  { RPCAP_ERR_STARTCAPTURE,    "Generic pcap_startcapture error"      },

  { RPCAP_ERR_ENDCAPTURE,      "Generic pcap_endcapture error"        },

  { RPCAP_ERR_RUNTIMETIMEOUT,  "Runtime timeout has expired"          },

  { RPCAP_ERR_SETSAMPLING,     "Error in setting sampling parameters" },

  { RPCAP_ERR_WRONGMSG,        "Unrecognized message"                 },

  { RPCAP_ERR_WRONGVER,        "Incompatible version"                 },

  { 0,   NULL }

};

static const value_string sampling_method[] = {

  { RPCAP_SAMP_NOSAMP,            "No sampling"      },

  { RPCAP_SAMP_1_EVERY_N,         "1 every N"        },

  { RPCAP_SAMP_FIRST_AFTER_N_MS,  "First after N ms" },

  { 0,   NULL }

};

static const value_string auth_type[] = {

  { RPCAP_RMTAUTH_NULL, "None"     },

  { RPCAP_RMTAUTH_PWD,  "Password" },

  { 0,   NULL }

};

static const value_string bpf_class[] = {

  { 0x00, "ld"   },

  { 0x01, "ldx"  },

  { 0x02, "st"   },

  { 0x03, "stx"  },

  { 0x04, "alu"  },

  { 0x05, "jmp"  },

  { 0x06, "ret"  },

  { 0x07, "misc" },

  { 0, NULL }

};

static const value_string bpf_size[] = {

  { 0x00, "w" },

  { 0x01, "h" },

  { 0x02, "b" },

  { 0, NULL }

};

static const value_string bpf_mode[] = {

  { 0x00, "imm" },

  { 0x01, "abs" },

  { 0x02, "ind" },

  { 0x03, "mem" },

  { 0x04, "len" },

  { 0x05, "msh" },

  { 0, NULL }

};

static const value_string bpf_alu_op[] = {

  { 0x00, "add" },

  { 0x01, "sub" },

  { 0x02, "mul" },

  { 0x03, "div" },

  { 0x04, "or"  },

  { 0x05, "and" },

  { 0x06, "lsh" },

  { 0x07, "rsh" },

  { 0x08, "neg" },

  { 0, NULL }

};

static const value_string bpf_jmp_op[] = {

  { 0x00, "ja"   },

  { 0x01, "jeq"  },

  { 0x02, "jgt"  },

  { 0x03, "jge"  },

  { 0x04, "jset" },

  { 0, NULL }

};

static const value_string bpf_src[] = {

  { 0x00, "k" },

  { 0x01, "x" },

  { 0, NULL }

};

static const value_string bpf_rval[] = {

  { 0x00, "k" },

  { 0x01, "x" },

  { 0x02, "a" },

  { 0, NULL }

};

static const value_string bpf_misc_op[] = {

  { 0x00, "tax" },

  { 0x10, "txa" },

  { 0, NULL }

};

static void rpcap_frame_end (void)

{

  info_added = false;

}

static void

dissect_rpcap_error (tvbuff_t *tvb, packet_info *pinfo,

                     proto_tree *parent_tree, int offset)

{

  proto_item *ti;

  int len;

  char *str;

  len = tvb_reported_length_remaining (tvb, offset);

  if (len <= 0)

    return;

  ti = proto_tree_add_item_ret_display_string(parent_tree, hf_error, tvb, offset, len, ENC_ASCII, pinfo->pool, &str);

  expert_add_info_format(pinfo, ti, &ei_error, "Error: %s", str);

  col_append_fstr(pinfo->cinfo, COL_INFO, ": %s", str);

}

/*

 * There's some painful history with this part of a findalldevs reply.

 *

 * Older RPCAPDs sent the addresses over the wire in the OS's native

 * structure format.  For most OSes, this looks like the over-the-wire

 * format, but might have a different value for AF_INET6 than the value

 * on the machine receiving the reply.  For OSes with the newer BSD-style

 * sockaddr structures, this has, instead of a 2-byte address family,

 * a 1-byte structure length followed by a 1-byte address family.  The

 * RPCAPD code would put the address family in network byte order before

 * sending it; that would set it to 0 on a little-endian machine, as

 * htons() of any value between 1 and 255 would result in a value > 255,

 * with its lower 8 bits zero, so putting that back into a 1-byte field

 * would set it to 0.

 *

 * Therefore, for older RPCAPDs running on an OS with newer BSD-style

 * sockaddr structures, the family field, if treated as a big-endian

 * (network byte order) 16-bit field, would be:

 *

 *  (length << 8) | family if sent by a big-endian machine

 *  (length << 8) if sent by a little-endian machine

 *

 * For current RPCAPDs, and for older RPCAPDs running on an OS with

 * older BSD-style sockaddr structures, the family field, if treated

 * as a big-endian 16-bit field, would just contain the family.

 *

 * (An additional bit of pain was that the structure was sent over the

 * wire as a network-byte-order struct sockaddr_storage, which does

 * *not* have the same size on all platforms.  On most platforms, the

 * structure is 128 bytes long; on Solaris, however, it's 256 bytes

 * long.  Neither the rpcap client code in libpcap, nor we, try to

 * detect Solaris addresses and deal with them.)

 *

 * The current rpcapd serializes the socket addresses as 128-byte

 * structures, containing:

 *

 *  a 2-octet address family value, in network byte order;

 *

 *  a 4-octet IPv4 address, if the address family value is 2

 *  (the AF_INET value on all supported platforms);

 *

 *  a 16-octet IPv6 address, if the address family value is

 *  23 (the Windows AF_INET6 value, chosen because Windows

 *  was, before rpcap was changed to standardize the format,

 *  the only platform for which precompiled binaries for

 *  rpcapd were generally available);

 *

 *  padding up to 128 bytes.

 *

 * The rpcap client code, and we, check for those address family values,

 * as well as other values that might have been produced by the old

 * code on various platforms.

 */

/*

 * Possible IPv4 family values other than the designated over-the-wire value,

 * which is 2 (because everybody uses 2 for AF_INET4).

 */

#define SOCKADDR_IN_LEN   16  /* length of struct sockaddr_in */

#define NEW_BSD_AF_INET_BE  ((SOCKADDR_IN_LEN << 8) | BSD_AF_INET)

#define NEW_BSD_AF_INET_LE  (SOCKADDR_IN_LEN << 8)

/*

 * Possible IPv6 family values other than the designated over-the-wire value,

 * which is 23 (because that's what Windows uses, and most RPCAP servers

 * out there are probably running Windows, as WinPcap includes the server

 * but few if any UN*Xes build and ship it).  Some are defined in

 * <epan/aftypes.h>.

 *

 * The new BSD sockaddr structure format was in place before 4.4-Lite, so

 * all the free-software BSDs use it.

 */

#define SOCKADDR_IN6_LEN  28  /* length of struct sockaddr_in6 */

#define NEW_BSD_AF_INET6_BSD_BE   ((SOCKADDR_IN6_LEN << 8) | BSD_AF_INET6_BSD)  /* NetBSD, OpenBSD, BSD/OS */

#define NEW_BSD_AF_INET6_FREEBSD_BE ((SOCKADDR_IN6_LEN << 8) | BSD_AF_INET6_FREEBSD)  /* FreeBSD, DragonFly BSD */

#define NEW_BSD_AF_INET6_DARWIN_BE  ((SOCKADDR_IN6_LEN << 8) | BSD_AF_INET6_DARWIN)  /* macOS, iOS, anything else Darwin-based */

#define NEW_BSD_AF_INET6_LE   (SOCKADDR_IN6_LEN << 8)

#define HPUX_AF_INET6     22

#define AIX_AF_INET6      24

static const value_string address_family[] = {

  { COMMON_AF_UNSPEC,            "AF_UNSPEC" },

  { COMMON_AF_INET,              "AF_INET"   },

  { NEW_BSD_AF_INET_BE,          "AF_INET (old server code on big-endian 4.4-Lite-based OS)" },

  { NEW_BSD_AF_INET_LE,          "AF_INET (old server code on little-endian 4.4-Lite-based OS)" },

  { WINSOCK_AF_INET6,            "AF_INET6"  },

  { NEW_BSD_AF_INET6_BSD_BE,     "AF_INET6 (old server code on big-endian NetBSD, OpenBSD, BSD/OS)"  },

  { NEW_BSD_AF_INET6_FREEBSD_BE, "AF_INET6 (old server code on big-endian FreeBSD)"  },

  { NEW_BSD_AF_INET6_DARWIN_BE,  "AF_INET6 (old server code on big-endian Mac OS X)"  },

  { NEW_BSD_AF_INET6_LE,         "AF_INET6 (old server code on little-endian 4.4-Lite-based OS)" },

  { LINUX_AF_INET6,              "AF_INET6 (old server code on Linux)"  },

  { HPUX_AF_INET6,               "AF_INET6 (old server code on HP-UX)"  },

  { AIX_AF_INET6,                "AF_INET6 (old server code on AIX)"  },

  { SOLARIS_AF_INET6,            "AF_INET6 (old server code on Solaris)"  },

  { 0,   NULL }

};

static int

dissect_rpcap_ifaddr (tvbuff_t *tvb, packet_info *pinfo,

                      proto_tree *parent_tree, int offset, int hf_id,

                      proto_item *parent_item)

{

  proto_tree *tree;

  proto_item *ti;

  uint16_t af;

  ws_in4_addr ipv4;

  ws_in6_addr ipv6;

  char ipaddr[MAX_ADDR_STR_LEN];

  ti = proto_tree_add_item (parent_tree, hf_id, tvb, offset, 128, ENC_BIG_ENDIAN);

  tree = proto_item_add_subtree (ti, ett_ifaddr);

  af = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_if_af, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  switch (af) {

  case COMMON_AF_INET:

  case NEW_BSD_AF_INET_BE:

  case NEW_BSD_AF_INET_LE:

    proto_tree_add_item (tree, hf_if_port, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    ipv4 = tvb_get_ipv4 (tvb, offset);

    ip_addr_to_str_buf(&ipv4, ipaddr, MAX_ADDR_STR_LEN);

    proto_item_append_text (ti, ": %s", ipaddr);

    if (parent_item) {

      proto_item_append_text (parent_item, ": %s", ipaddr);

    }

    proto_tree_add_item (tree, hf_if_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item (tree, hf_if_padding, tvb, offset, 120, ENC_NA);

    offset += 120;

    break;

  case WINSOCK_AF_INET6:

  case NEW_BSD_AF_INET6_BSD_BE:

  case NEW_BSD_AF_INET6_FREEBSD_BE:

  case NEW_BSD_AF_INET6_DARWIN_BE:

  case NEW_BSD_AF_INET6_LE:

  case LINUX_AF_INET6:

  case HPUX_AF_INET6:

  case AIX_AF_INET6:

  case SOLARIS_AF_INET6:

    proto_tree_add_item (tree, hf_if_port, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    proto_tree_add_item (tree, hf_if_flowinfo, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    tvb_get_ipv6 (tvb, offset, &ipv6);

    ip6_to_str_buf(&ipv6, ipaddr, MAX_ADDR_STR_LEN);

    proto_item_append_text (ti, ": %s", ipaddr);

    if (parent_item) {

      proto_item_append_text (parent_item, ": %s", ipaddr);

    }

    proto_tree_add_item (tree, hf_if_ipv6, tvb, offset, 16, ENC_NA);

    offset += 16;

    proto_tree_add_item (tree, hf_if_scopeid, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item (tree, hf_if_padding, tvb, offset, 108, ENC_NA);

    offset += 100;

    break;

  default:

    ti = proto_tree_add_item (tree, hf_if_unknown, tvb, offset, 126, ENC_NA);

    if (af != COMMON_AF_UNSPEC) {

      expert_add_info_format(pinfo, ti, &ei_if_unknown,

                             "Unknown address family: %d", af);

    }

    offset += 126;

    break;

  }

  return offset;

}

static int

dissect_rpcap_findalldevs_ifaddr (tvbuff_t *tvb, packet_info *pinfo _U_,

                                  proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  int boffset = offset;

  ti = proto_tree_add_item (parent_tree, hf_findalldevs_ifaddr, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_findalldevs_ifaddr);

  offset = dissect_rpcap_ifaddr (tvb, pinfo, tree, offset, hf_if_addr, ti);

  offset = dissect_rpcap_ifaddr (tvb, pinfo, tree, offset, hf_if_netmask, NULL);

  offset = dissect_rpcap_ifaddr (tvb, pinfo, tree, offset, hf_if_broadaddr, NULL);

  offset = dissect_rpcap_ifaddr (tvb, pinfo, tree, offset, hf_if_dstaddr, NULL);

  proto_item_set_len (ti, offset - boffset);

  return offset;

}

static int

dissect_rpcap_findalldevs_if (tvbuff_t *tvb, packet_info *pinfo _U_,

                              proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  uint16_t namelen, desclen, naddr, i;

  int boffset = offset;

  ti = proto_tree_add_item (parent_tree, hf_findalldevs_if, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_findalldevs_if);

  namelen = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_namelen, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  desclen = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_desclen, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item (tree, hf_if_flags, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  naddr = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_naddr, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item (tree, hf_dummy, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  if (namelen) {

    const uint8_t* name;

    proto_tree_add_item_ret_string(tree, hf_if_name, tvb, offset, namelen, ENC_ASCII|ENC_NA, pinfo->pool, &name);

    proto_item_append_text (ti, ": %s", name);

    offset += namelen;

  }

  if (desclen) {

    proto_tree_add_item (tree, hf_if_desc, tvb, offset, desclen, ENC_ASCII);

    offset += desclen;

  }

  for (i = 0; i < naddr; i++) {

    offset = dissect_rpcap_findalldevs_ifaddr (tvb, pinfo, tree, offset);

    if (tvb_reported_length_remaining (tvb, offset) < 0) {

      /* No more data in packet */

      expert_add_info(pinfo, ti, &ei_no_more_data);

      break;

    }

  }

  proto_item_set_len (ti, offset - boffset);

  return offset;

}

static void

dissect_rpcap_findalldevs_reply (tvbuff_t *tvb, packet_info *pinfo _U_,

                                 proto_tree *parent_tree, int offset, uint16_t no_devs)

{

  proto_tree *tree;

  proto_item *ti;

  uint16_t i;

  ti = proto_tree_add_item (parent_tree, hf_findalldevs_reply, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_findalldevs_reply);

  for (i = 0; i < no_devs; i++) {

    offset = dissect_rpcap_findalldevs_if (tvb, pinfo, tree, offset);

    if (tvb_reported_length_remaining (tvb, offset) < 0) {

      /* No more data in packet */

      expert_add_info(pinfo, ti, &ei_no_more_data);

      break;

    }

  }

  proto_item_append_text (ti, ", %d item%s", no_devs, plurality (no_devs, "", "s"));

}

static int

dissect_rpcap_filterbpf_insn (tvbuff_t *tvb, packet_info *pinfo _U_,

                              proto_tree *parent_tree, int offset)

{

  proto_tree *tree, *code_tree;

  proto_item *ti, *code_ti;

  uint8_t inst_class;

  ti = proto_tree_add_item (parent_tree, hf_filterbpf_insn, tvb, offset, 8, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_filterbpf_insn);

  code_ti = proto_tree_add_item (tree, hf_code, tvb, offset, 2, ENC_BIG_ENDIAN);

  code_tree = proto_item_add_subtree (code_ti, ett_filterbpf_insn_code);

  proto_tree_add_item (code_tree, hf_code_class, tvb, offset, 2, ENC_BIG_ENDIAN);

  inst_class = tvb_get_uint8 (tvb, offset + 1) & 0x07;

  proto_item_append_text (ti, ": %s", val_to_str_const (inst_class, bpf_class, ""));

  switch (inst_class) {

  case 0x00: /* ld */

  case 0x01: /* ldx */

    proto_tree_add_item (code_tree, hf_code_ld_size, tvb, offset, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item (code_tree, hf_code_ld_mode, tvb, offset, 2, ENC_BIG_ENDIAN);

    break;

  case 0x04: /* alu */

    proto_tree_add_item (code_tree, hf_code_src, tvb, offset, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item (code_tree, hf_code_alu_op, tvb, offset, 2, ENC_BIG_ENDIAN);

    break;

  case 0x05: /* jmp */

    proto_tree_add_item (code_tree, hf_code_src, tvb, offset, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item (code_tree, hf_code_jmp_op, tvb, offset, 2, ENC_BIG_ENDIAN);

    break;

  case 0x06: /* ret */

    proto_tree_add_item (code_tree, hf_code_rval, tvb, offset, 2, ENC_BIG_ENDIAN);

    break;

  case 0x07: /* misc */

    proto_tree_add_item (code_tree, hf_code_misc_op, tvb, offset, 2, ENC_BIG_ENDIAN);

    break;

  default:

    proto_tree_add_item (code_tree, hf_code_fields, tvb, offset, 2, ENC_BIG_ENDIAN);

    break;

  }

  offset += 2;

  proto_tree_add_item (tree, hf_jt, tvb, offset, 1, ENC_BIG_ENDIAN);

  offset += 1;

  proto_tree_add_item (tree, hf_jf, tvb, offset, 1, ENC_BIG_ENDIAN);

  offset += 1;

  proto_tree_add_item (tree, hf_instr_value, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  return offset;

}

static void

dissect_rpcap_filter (tvbuff_t *tvb, packet_info *pinfo,

                      proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  uint32_t nitems, i;

  ti = proto_tree_add_item (parent_tree, hf_filter, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_filter);

  proto_tree_add_item (tree, hf_filtertype, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item (tree, hf_dummy, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  nitems = tvb_get_ntohl (tvb, offset);

  proto_tree_add_item (tree, hf_nitems, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  for (i = 0; i < nitems; i++) {

    offset = dissect_rpcap_filterbpf_insn (tvb, pinfo, tree, offset);

    if (tvb_reported_length_remaining (tvb, offset) < 0) {

      /* No more data in packet */

      expert_add_info(pinfo, ti, &ei_no_more_data);

      break;

    }

  }

}

static int

dissect_rpcap_auth_request (tvbuff_t *tvb, packet_info *pinfo _U_,

                            proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  uint16_t type, slen1, slen2;

  ti = proto_tree_add_item (parent_tree, hf_auth_request, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_auth_request);

  type = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_auth_type, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item (tree, hf_dummy, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  slen1 = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_auth_slen1, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  slen2 = tvb_get_ntohs (tvb, offset);

  proto_tree_add_item (tree, hf_auth_slen2, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  if (type == RPCAP_RMTAUTH_NULL) {

    proto_item_append_text (ti, " (none)");

  } else if (type == RPCAP_RMTAUTH_PWD) {

    const uint8_t *username, *password;

    proto_tree_add_item_ret_string(tree, hf_auth_username, tvb, offset, slen1, ENC_ASCII|ENC_NA, pinfo->pool, &username);

    offset += slen1;

    proto_tree_add_item_ret_string(tree, hf_auth_password, tvb, offset, slen2, ENC_ASCII|ENC_NA, pinfo->pool, &password);

    offset += slen2;

    proto_item_append_text (ti, " (%s/%s)", username, password);

  }

  return offset;

}

static void

dissect_rpcap_auth_reply (tvbuff_t *tvb, packet_info *pinfo _U_,

                          proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  uint32_t minvers, maxvers;

  /*

   * Authentication replies from older servers have no payload.

   * Replies from newer servers have a payload.

   * Dissect the payload if we have any.

   */

  if (tvb_reported_length_remaining(tvb, offset) != 0) {

    ti = proto_tree_add_item (parent_tree, hf_auth_reply, tvb, offset, -1, ENC_NA);

    tree = proto_item_add_subtree (ti, ett_auth_reply);

    proto_tree_add_item_ret_uint (tree, hf_auth_minvers, tvb, offset, 1, ENC_BIG_ENDIAN, &minvers);

    offset += 1;

    proto_tree_add_item_ret_uint (tree, hf_auth_maxvers, tvb, offset, 1, ENC_BIG_ENDIAN, &maxvers);

    proto_item_append_text (ti, ", minimum version %u, maximum version %u", minvers, maxvers);

  }

}

static void

dissect_rpcap_open_request (tvbuff_t *tvb, packet_info *pinfo _U_,

                            proto_tree *parent_tree, int offset)

{

  int len;

  len = tvb_reported_length_remaining (tvb, offset);

  proto_tree_add_item (parent_tree, hf_open_request, tvb, offset, len, ENC_ASCII);

}

static void

dissect_rpcap_open_reply (tvbuff_t *tvb, packet_info *pinfo _U_,

                          proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  ti = proto_tree_add_item (parent_tree, hf_open_reply, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_open_reply);

  linktype = tvb_get_ntohl (tvb, offset);

  proto_tree_add_item (tree, hf_linktype, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item (tree, hf_tzoff, tvb, offset, 4, ENC_BIG_ENDIAN);

}

static void

dissect_rpcap_startcap_request (tvbuff_t *tvb, packet_info *pinfo,

                                proto_tree *parent_tree, int offset)

{

  proto_tree *tree, *field_tree;

  proto_item *ti, *field_ti;

  uint16_t flags;

  ti = proto_tree_add_item (parent_tree, hf_startcap_request, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_startcap_request);

  proto_tree_add_item (tree, hf_snaplen, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item (tree, hf_read_timeout, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  flags = tvb_get_ntohs (tvb, offset);

  field_ti = proto_tree_add_uint_format (tree, hf_flags, tvb, offset, 2, flags, "Flags");

  field_tree = proto_item_add_subtree (field_ti, ett_startcap_flags);

  proto_tree_add_item (field_tree, hf_flags_promisc, tvb, offset, 2, ENC_BIG_ENDIAN);

  proto_tree_add_item (field_tree, hf_flags_dgram, tvb, offset, 2, ENC_BIG_ENDIAN);

  proto_tree_add_item (field_tree, hf_flags_serveropen, tvb, offset, 2, ENC_BIG_ENDIAN);

  proto_tree_add_item (field_tree, hf_flags_inbound, tvb, offset, 2, ENC_BIG_ENDIAN);

  proto_tree_add_item (field_tree, hf_flags_outbound, tvb, offset, 2, ENC_BIG_ENDIAN);

  if (flags & 0x1F) {

    char *flagstr = wmem_strdup_printf (pinfo->pool, "%s%s%s%s%s",

          (flags & FLAG_PROMISC)    ? ", Promiscuous" : "",

          (flags & FLAG_DGRAM)      ? ", Datagram"    : "",

          (flags & FLAG_SERVEROPEN) ? ", ServerOpen"  : "",

          (flags & FLAG_INBOUND)    ? ", Inbound"     : "",

          (flags & FLAG_OUTBOUND)   ? ", Outbound"    : "");

    proto_item_append_text (field_ti, ":%s", &flagstr[1]);

  } else {

    proto_item_append_text (field_ti, " (none)");

  }

  offset += 2;

  proto_tree_add_item (tree, hf_client_port, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  dissect_rpcap_filter (tvb, pinfo, tree, offset);

}

static void

dissect_rpcap_startcap_reply (tvbuff_t *tvb, packet_info *pinfo _U_,

                              proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  ti = proto_tree_add_item (parent_tree, hf_startcap_reply, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_startcap_reply);

  proto_tree_add_item (tree, hf_bufsize, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item (tree, hf_server_port, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  proto_tree_add_item (tree, hf_dummy, tvb, offset, 2, ENC_BIG_ENDIAN);

}

static void

dissect_rpcap_stats_reply (tvbuff_t *tvb, packet_info *pinfo _U_,

                           proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  ti = proto_tree_add_item (parent_tree, hf_stats_reply, tvb, offset, 16, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_stats_reply);

  proto_tree_add_item (tree, hf_ifrecv, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item (tree, hf_ifdrop, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item (tree, hf_krnldrop, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  proto_tree_add_item (tree, hf_srvcapt, tvb, offset, 4, ENC_BIG_ENDIAN);

}

static int

dissect_rpcap_sampling_request (tvbuff_t *tvb, packet_info *pinfo _U_,

                                proto_tree *parent_tree, int offset)

{

  proto_tree *tree;

  proto_item *ti;

  uint32_t value;

  uint8_t method;

  ti = proto_tree_add_item (parent_tree, hf_sampling_request, tvb, offset, -1, ENC_NA);

  tree = proto_item_add_subtree (ti, ett_sampling_request);

  method = tvb_get_uint8 (tvb, offset);

  proto_tree_add_item (tree, hf_sampling_method, tvb, offset, 1, ENC_BIG_ENDIAN);

  offset += 1;

  proto_tree_add_item (tree, hf_sampling_dummy1, tvb, offset, 1, ENC_BIG_ENDIAN);

  offset += 1;

  proto_tree_add_item (tree, hf_sampling_dummy2, tvb, offset, 2, ENC_BIG_ENDIAN);

  offset += 2;

  value = tvb_get_ntohl (tvb, offset);

  proto_tree_add_item (tree, hf_sampling_value, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  switch (method) {

  case RPCAP_SAMP_NOSAMP:

    proto_item_append_text (ti, ": None");

    break;

  case RPCAP_SAMP_1_EVERY_N:

    proto_item_append_text (ti, ": 1 every %d", value);

    break;

  case RPCAP_SAMP_FIRST_AFTER_N_MS:

    proto_item_append_text (ti, ": First after %d ms", value);

    break;

  default:

    break;

  }

  return offset;