/* packet-f5ethtrailer.c

 *

 * F5 Ethernet Trailer Copyright 2008-2018 F5 Networks

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

Supported Platforms:

    BIG-IP 9.4.2 - 13.x for the old format trailers

    BIG-IP 11.2.0 and later for fileinfo

    BIG-IP 14.0 began using the new format trailers

Usage:

  * Acquire capture files using the following command line:

    * tcpdump -w capture.pcap -s0 -i internal:nnn

  * Load the capture file into wireshark.

  * Observe the grammar added to the beginning of each packet in the "Info"

    column of the packet list pane.

  * Observe the added "F5 Ethernet trailer" section in the packet detail

    pane.

  * These fields are filterable like any other field.

  * Review the preferences for the dissector.

  * If you are missing the Low details of the trailer for some packets, try

    modifying the settings for the Ethernet dissector.  Go to "Edit/Preferences...",

    expand "Protocols" on the left and select "Ethernet".  Disable "Assume

    short frames which include a trailer contain padding".

Notes:

  Follow F5 Conversation:

    As an alternative to the Populate Fields for Other Dissectors below, you

    can now follow a connection through the BIG-IP using the main menu

    Analyze/Conversation Filter menu.  There are three options: follow "F5 IP",

    "F5 TCP" or "F5 UDP".  Select a frame and choose the appropriate menu item.

    For best results, disable Populate Fields for Other Dissectors.  This

    method of following a conversation should avoid the stray packets problem

    mentioned below.

    These menu selections will populate an appropriate filter expression with

    ip.addr, tcp.port or udp.port, f5ethtrailer.peeraddr, f5ethtrailer.peerport

    and f5ethtrailer.peeripproto.

    You will need to have gathered the capture with high noise (":nnn") to

    contain the peer flow information in order for this to work.

  Populate Fields for Other Dissectors:

    The populate fields for other dissectors will add hidden fields to the

    f5ethtrailer for "ip.addr", "ipv6.addr", "tcp.port" and "udp.port" based on

    information in high noise of a packet.  This will allow the "Conversation

    Filter" option in Wireshark to find both the client-side and server-side

    flows for a connection.

    In order to use this, you will need to enable the "Populate fields for

    other dissectors" preference.  Note that the fields are registered when the

    preference is enabled.  After changing the preference, you may need to

    restart Wireshark for proper handling.

    Please note that this may cause some stray packets to show up in filter

    results since, for example, "tcp.port eq A and tcp.port eq B" can now be

    matching on at least four fields (tcp.port from the TCP dissector and

    tcp.port from the f5ethtrailer dissector) and a filter can match on an

    address/port from the IP/TCP/UDP dissector or an address/port from the

    f5ethtrailer dissector.

    For example, given two connections:

      client:12345 <-> VIP:443 {BIGIP} clientS:12346 <-> poolmember:80

      client:12346 <-> VIP:443 {BIGIP} clientS:12347 <-> poolmember:80

    Selecting "Conversation Filter->TCP" on the client side of the second

    connection will result in a filter of:

      ip.addr eq client and ip.addr eq VIP and

      tcp.port eq 12346 and tcp.port eq 443

    All four flows would be displayed by the filter:

      * From client:12345 <-> VIP:443 (unexpected)

        - ip.addr from ip.src matches.

        - ip.addr from ip.dst matches.

        - tcp.port from f5ethtrailer.peerlocalport matches.

        - tcp.port from tcp.dstport matches.

      * From clientS:12346 <-> poolmember:80 (unexpected)

        - ip.addr from f5ethtrailer.peerremoteaddr matches.

        - ip.addr from f5ethtrailer.peerlocaladdr matches.

        - tcp.port from tcp.srcport matches.

        - tcp.port from f5ethtrailer.peerlocalport matches.

      * From client:12346 <-> VIP:443 (expected)

        - ip.addr from ip.src matches.

        - ip.addr from ip.dst matches.

        - tcp.port from tcp.srcport matches.

        - tcp.port from tcp.dstport matches.

      * From clientS:12347 <-> poolmember:80 (desired)

        - ip.addr from f5ethtrailer.peerremoteaddr matches.

        - ip.addr from f5ethtrailer.peerlocaladdr matches.

        - tcp.port from f5ethtrailer.peerremoteport matches.

        - tcp.port from f5ethtrailer.peerlocalport matches.

    You can filter based on IP/port information by disabling the "Populate

    fields for other dissectors" and creating your own filter like:

      ( ip.addr eq client and ip.addr eq VIP and

        tcp.port eq 12346 and tcp.port eq 443 ) or

      ( f5ethtrailer.peeraddr eq client and f5ethtrailer.peeraddr eq VIP and

        f5ethtrailer.peerport eq 12346 and f5ethtrailer.peerport eq 443 )

    Since the preference is disabled by default, it should not cause any

    interference unless the user actively enables the preference.

  Analysis:

    The f5ethtrailer dissector can add an "F5 Analysis" subtree to the "F5

    Ethernet trailer" protocol tree.  The items added here are also added to

    Wireshark expert info.  The analysis done is intended to help spot traffic

    anomalies.

    Possible Analysis:

      * Flow reuse or SYN retransmit

        Filter field name: f5ethtrailer.analysis.flowreuse

        This is intended to highlight initial packets that arrive that match

        a pre-existing flow.  In other words, a TCP SYN packet that arrives

        and matches an existing flow.  This can indicate:

        - A prior flow was not properly terminated and a new flow is starting.

        - A stray SYN has arrived for an existing connection.

        - A SYN has been retransmitted (the first SYN would have created the

          flow that subsequent SYNs would match).

      * Flow lost, incorrect VLAN, loose initiation, tunnel or SYN cookie use

        Filter field name: f5ethtrailer.analysis.flowlost

        This is intended to highlight non-initial packets that arrive that

        do not match an existing flow.  In other words, a TCP non-SYN packet

        arriving that does not match an existing flow.  This can indicate:

        - The flow is no longer in the BIGIP's connection table.

        - VLAN keyed connections is in use (the default) and a packet arrived

          on an incorrect VLAN.

        - A stray packet has arrived.

        - The packet may be handled by a virtual server with loose initiation.

          In this case, a packet in the middle of a TCP conversation could

          arrive and then be handled by a virtual server that has loose

          initiation enabled to create a flow.

        - The packet may be the inner payload of a tunnel.  For inbound tunnel

          traffic, the encapsulating packet is shown as well as the

          encapsulated packet (and the encapsulated packet may not have flow

          information).

        - SYN cookies are being used (the initial SYN would not have created

          a flow).

    A few notes.  The analysis is implemented by using Wireshark taps and

    tapping the IP/IPv6/TCP dissectors.  The taps are not called until after

    packet dissection is completely finished.  So, the f5ethtrailer dissector

    may not have the necessary data to draw conclusions.  The traffic light

    in the lower left corner of the Wireshark GUI might not properly reflect

    the existence of these analysis fields.

  Hiding Slot Information in Info Column:

    You can now specify which platforms will display slot information in the

    summary in the info columns.  In the preferences for the F5 Ethernet

    trailer dissector, you can provide a regular expression to match the

    platform in F5 tcpdump header packet.  If there is no platform information

    in the header (or there is no header at all), slot information will always

    be displayed.  A reasonable regular expression would be "^(A.*|Z101)$" to

    match chassis and vCMP platforms (there is no distinction for vCMP on a

    chassis versus an appliance).  The default is to always display slot

    information (no regular expression is provided by default).

  Statistics reports:

    All statistics are reported as packet counts and byte counts.  Byte count

    statistics do not include the bytes of the trailer.

    Statistics menu now has:

      F5/Virtual Server Distribution

        A line for each named virtual server name

        A line for traffic with a flow ID and no virtual server name

        A line for traffic without a flow ID.

      F5/tmm Distribution

        A line for each tmm.

          A line each for ingress and egress (should add to tmm total)

          A line each for (should add to tmm total)

            Traffic with a virtual server name

            Traffic with a flow ID and no virtual server name

            Traffic without a flow ID.

 */

#include "config.h"

#include <string.h>

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/epan_dissect.h>

#include <epan/ipproto.h>

#include <epan/tap.h>

#include <epan/expert.h>

#include <epan/proto.h>

#include <epan/proto_data.h>

#include <epan/conversation_filter.h>

#include <epan/tfs.h>

#include "packet-ip.h"

#include "packet-tcp.h"

#include <epan/to_str.h>

#include <epan/stats_tree.h>

#define F5FILEINFOTAP_SRC

#include "packet-f5ethtrailer.h"

#undef F5FILEINFOTAP_SRC

#include <wsutil/wslog.h>

/* Wireshark ID of the F5ETHTRAILER protocol */

static int proto_f5ethtrailer;

static int tap_f5ethtrailer   = -1;

static int proto_f5fileinfo;

static int tap_f5fileinfo     = -1;

/** Helper dissector for DPT format noise */

static int proto_f5ethtrailer_dpt_noise;

void proto_reg_handoff_f5ethtrailer(void);

void proto_register_f5ethtrailer(void);

void proto_reg_handoff_f5fileinfo(void);

void proto_register_f5fileinfo(void);

static dissector_handle_t f5dpt_noise_handle;

static dissector_handle_t f5dpt_tls_handle;

/* Common Fields */

static int hf_provider;

static int hf_type;

static int hf_length;

static int hf_version;

static int hf_data;

static int hf_data_str;

static int hf_dpt_unknown;

static int hf_trailer_hdr;

static int hf_orig_fcs;

/* Low */

static int hf_low_id;

static int hf_flags;

static int hf_flags_ingress;

static int hf_flags_hwaction;

static int hf_ingress;

static int hf_slot0;

static int hf_slot1;

static int hf_tmm;

static int hf_obj_name_type;

static int hf_obj_data_len;

static int hf_vipnamelen;

static int hf_vip;

static int hf_portnamelen;

static int hf_phys_port;

static int hf_trunknamelen;

static int hf_trunk;

/* Med */

static int hf_med_id;

static int hf_flow_id;

static int hf_peer_id;

static int hf_any_flow;

static int hf_cf_flags;

static int hf_cf_flags2;

static int hf_flow_type;

static int hf_ha_unit;

static int hf_reserved;

static int hf_priority;

static int hf_rstcause;

static int hf_rstcause_len;

static int hf_rstcause_ver;

static int hf_rstcause_peer;

static int hf_rstcause_val;

static int hf_rstcause_line;

static int hf_rstcause_txt;

/* High */

static int hf_high_id;

static int hf_peer_ipproto;

static int hf_peer_vlan;

static int hf_peer_remote_addr;

static int hf_peer_remote_ip6addr;

static int hf_peer_remote_rtdom;

static int hf_peer_local_addr;

static int hf_peer_local_ip6addr;

static int hf_peer_local_rtdom;

static int hf_peer_ipaddr;

static int hf_peer_ip6addr;

static int hf_peer_rtdom;

static int hf_peer_remote_port;

static int hf_peer_local_port;

static int hf_peer_port;

static int hf_peer_nopeer;

/* Analysis */

static int hf_analysis;

/* These fields will be used if pref_pop_other_fields is enabled.

   They will be populated with data from the "high" trailer so that filtering on ip.addr, tcp.port, etc...

   can find peer side flows of the specific flow you're searching for. */

static int hf_ip_ipaddr;

static int hf_ip6_ip6addr;

static int hf_tcp_tcpport;

static int hf_udp_udpport;

static int hf_dpt_magic;

static int hf_dpt_ver;

static int hf_dpt_len;

static expert_field ei_f5eth_flowlost;

static expert_field ei_f5eth_flowreuse;

static expert_field ei_f5eth_badlen;

static expert_field ei_f5eth_undecoded;

/* These are the ids of the subtrees that we may be creating */

static int ett_f5ethtrailer;

static int ett_f5ethtrailer_unknown;

static int ett_f5ethtrailer_low;

static int ett_f5ethtrailer_low_flags;

static int ett_f5ethtrailer_med;

static int ett_f5ethtrailer_high;

static int ett_f5ethtrailer_rstcause;

static int ett_f5ethtrailer_trailer_hdr;

static int ett_f5ethtrailer_obj_names;

/* For fileinformation */

static int hf_fi_command;

static int hf_fi_version;

static int hf_fi_hostname;

static int hf_fi_platform;

static int hf_fi_platformname;

static int hf_fi_product;

static int hf_fi_session;

/* Wireshark preference to show RST cause in info column */

static bool rstcause_in_info = true;

/** Wireshark preference to look at all trailer bytes for f5ethtrailer */

static bool pref_walk_trailer;

/* Wireshark preference to enable/disable the population of other dissectors'

 * fields.*/

static bool pref_pop_other_fields;

/** Wireshark preference to perform analysis */

static bool pref_perform_analysis;

/** Wireshark preference to generate keylog entries from f5ethtrailer TLS data */

static bool pref_generate_keylog = true;

/** Identifiers for taps (when enabled), only the address is important, the

 * values are unused. */

static bool tap_ip_enabled;

static bool tap_ipv6_enabled;

static bool tap_tcp_enabled;

/** Used "in" and "out" map for the true and false for ingress. (Not actually

 * used in field definition, but rather used to display via a format call

 * and in the info column information.) */

static const true_false_string f5tfs_ing = {"IN", "OUT"};

static const value_string f5_flags_ingress_vs[] = {

    {0, "Out"},

    {1, "In"},

    {0, NULL}

};

/** Strings for decoding the hardware action */

static const value_string f5_flags_hwaction_vs[] = {

    {0, "Not set"},

    {1, "Challenge"},

    {2, "Drop"},

    {3, "Forward"},

    {0, NULL}

};

static int * const hf_flags__fields[] = {

    &hf_flags_ingress,

    &hf_flags_hwaction,

    NULL,

};

typedef enum {

    NONE,

    NEW_FORMAT,

    OLD_FORMAT,

} found_t;

/** Table containing subdissectors for different providers

 *  These are used with new format trailers */

static dissector_table_t provider_subdissector_table;

static dissector_table_t noise_subdissector_table;

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Convert a Wireshark port type to a IP protocol number.

 *

 * @attention Not all port types are supported, only the ones that this dissector actively uses.

 *

 * @param ptype The Wireshark port_type

 * @return      The IP protocol number corresponding to the port type.

 */

inline static uint8_t

ptype_to_ipproto(const port_type ptype)

{

    uint8_t ipproto = 0;

    switch (ptype) {

    case PT_TCP:

        ipproto = IP_PROTO_TCP;

        break;

    case PT_UDP:

        ipproto = IP_PROTO_UDP;

        break;

    default:

        ipproto = 0;

        break;

    }

    return ipproto;

} /* ptype_to_ipproto() */

/*===============================================================================================*/

/* Analyze menu functions */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Determines if we can apply an IP Conversation filter.

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param pinfo   A pointer to the packet info to look at for the L3 data.

 * @return        True if it is valid IP/IPv6, false otherwise

 */

static bool

f5_ip_conv_valid(packet_info *pinfo, void *user_data _U_)

{

    bool is_ip = false;

    bool is_f5ethtrailer = false;

    proto_get_frame_protocols(pinfo->layers, &is_ip, NULL, NULL, NULL, NULL, NULL, NULL);

    is_f5ethtrailer = proto_is_frame_protocol(pinfo->layers, "f5ethtrailer");

    return is_ip && is_f5ethtrailer;

} /* f5_ip_conv_valid() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Determines if we can apply a TCP Conversation filter.

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param pinfo   A pointer to the packet info to look at for the L3/L4 data.

 * @return        True if it is valid IP/IPv6 + TCP, false otherwise

 */

static bool

f5_tcp_conv_valid(packet_info *pinfo, void *user_data _U_)

{

    bool is_ip  = false;

    bool is_tcp = false;

    bool is_f5ethtrailer = false;

    proto_get_frame_protocols(pinfo->layers, &is_ip, &is_tcp, NULL, NULL, NULL, NULL, NULL);

    is_f5ethtrailer = proto_is_frame_protocol(pinfo->layers, "f5ethtrailer");

    return is_ip && is_tcp && is_f5ethtrailer;

} /* f5_tcp_conv_valid() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Determines if we can apply a UDP Conversation filter.

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param pinfo   A pointer to the packet info to look at for the L3/L4 data.

 * @return        True if it is valid IP/IPv6 + UDP, false otherwise

 */

static bool

f5_udp_conv_valid(packet_info *pinfo, void *user_data _U_)

{

    bool is_ip  = false;

    bool is_udp = false;

    bool is_f5ethtrailer = false;

    proto_get_frame_protocols(pinfo->layers, &is_ip, NULL, &is_udp, NULL, NULL, NULL, NULL);

    is_f5ethtrailer = proto_is_frame_protocol(pinfo->layers, "f5ethtrailer");

    return is_ip && is_udp && is_f5ethtrailer;

} /* f5_tcp_conv_valid() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Calculates the F5 IP conversation filter based on the current packet.

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param pinfo   A pointer to the packet info to look at for the L3/L4 data.

 * @return        A filter string for the F5 IP conversation or NULL if no filter can be

 *                  computed.  The caller should free this string with g_free().

 *

 * @attention This function uses ws_strdup_printf() rather than the wmem equivalent because the

 *             caller (menu_dissector_filter_cb()) uses g_free to free the filter string.

 *             (as of WS 1.12).

 */

static char *

f5_ip_conv_filter(packet_info *pinfo, void *user_data _U_)

{

    char *buf = NULL;

    char src_addr[WS_INET6_ADDRSTRLEN];

    char dst_addr[WS_INET6_ADDRSTRLEN];

    *dst_addr = *src_addr = '\0';

    if (pinfo->net_src.type == AT_IPv4 && pinfo->net_dst.type == AT_IPv4) {

        address_to_str_buf(&pinfo->src, src_addr, WS_INET6_ADDRSTRLEN);

        address_to_str_buf(&pinfo->dst, dst_addr, WS_INET6_ADDRSTRLEN);

        if (*src_addr != '\0' && *dst_addr != '\0') {

            buf = ws_strdup_printf(

                "(ip.addr eq %s and ip.addr eq %s) or"

                " (f5ethtrailer.peeraddr eq %s and f5ethtrailer.peeraddr eq %s)",

                src_addr, dst_addr, src_addr, dst_addr);

        }

    } else if (pinfo->net_src.type == AT_IPv6 && pinfo->net_dst.type == AT_IPv6) {

        address_to_str_buf(&pinfo->src, src_addr, WS_INET6_ADDRSTRLEN);

        address_to_str_buf(&pinfo->dst, dst_addr, WS_INET6_ADDRSTRLEN);

        if (*src_addr != '\0' && *dst_addr != '\0') {

            buf = ws_strdup_printf(

                "(ipv6.addr eq %s and ipv6.addr eq %s) or"

                " (f5ethtrailer.peeraddr6 eq %s and f5ethtrailer.peeraddr6 eq %s)",

                src_addr, dst_addr, src_addr, dst_addr);

        }

    }

    return buf;

} /* f5_ip_conv_filter() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Calculates the F5 TCP conversation filter based on the current packet.

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param pinfo   A pointer to the packet info to look at for the L3/L4 data.

 *

 * @return        A filter string for the F5 TCP conversation or NULL if no filter can be

 *                  computed.  The caller should free this string with g_free().

 *

 *  Prior to version 11.0.0, the f5ethtrailer.peeripproto field was not populated properly.  In

 *  an effort to accurately match the appropriate protocol, the filter adds:

 *       f5ethtrailer.ipproto eq 6 (for the >=11.0.0 case)

 *    or f5ethtrailer.ipproto eq 0 and tcp (for the <11.0.0 case)

 *  This is in an attempt to try to not pick up UDP packets that happen to have the same ports when

 *  you are filtering on a TCP conversation.  Note that in the <11.0.0 case, an IP protocol change

 *  across the peer flows (I don't know that I've seen that happen, so it's at least rare) will not

 *  be filtered properly.  In the >=11.0.0 case, if you have TCP on one side and UDP on the other

 *  and it should "do the right thing".

 *

 * @attention This function uses ws_strdup_printf() rather than the wmem equivalent because the

 *             caller (menu_dissector_filter_cb()) uses g_free to free the filter string.

 *             (as of WS 1.12).

 */

static char *

f5_tcp_conv_filter(packet_info *pinfo, void *user_data _U_)

{

    char *buf = NULL;

    char src_addr[WS_INET6_ADDRSTRLEN];

    char dst_addr[WS_INET6_ADDRSTRLEN];

    *dst_addr = *src_addr = '\0';

    if (pinfo->net_src.type == AT_IPv4 && pinfo->net_dst.type == AT_IPv4) {

        address_to_str_buf(&pinfo->src, src_addr, WS_INET6_ADDRSTRLEN);

        address_to_str_buf(&pinfo->dst, dst_addr, WS_INET6_ADDRSTRLEN);

        if (*src_addr != '\0' && *dst_addr != '\0') {

            buf = ws_strdup_printf(

                "(ip.addr eq %s and ip.addr eq %s and tcp.port eq %d and tcp.port eq %d) or"

                " (f5ethtrailer.peeraddr eq %s and f5ethtrailer.peeraddr eq %s and"

                " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"

                " (f5ethtrailer.peeripproto eq 6 or (f5ethtrailer.peeripproto eq 0 and tcp)))",

                src_addr, dst_addr, pinfo->srcport, pinfo->destport,

                src_addr, dst_addr, pinfo->srcport, pinfo->destport);

        }

    } else if (pinfo->net_src.type == AT_IPv6 && pinfo->net_dst.type == AT_IPv6) {

        address_to_str_buf(&pinfo->src, src_addr, WS_INET6_ADDRSTRLEN);

        address_to_str_buf(&pinfo->dst, dst_addr, WS_INET6_ADDRSTRLEN);

        if (*src_addr != '\0' && *dst_addr != '\0') {

            buf = ws_strdup_printf(

                "(ipv6.addr eq %s and ipv6.addr eq %s and tcp.port eq %d and tcp.port eq %d) or"

                " (f5ethtrailer.peeraddr6 eq %s and f5ethtrailer.peeraddr6 eq %s and"

                " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"

                " (f5ethtrailer.peeripproto eq 6 or (f5ethtrailer.peeripproto eq 0 and tcp)))",

                src_addr, dst_addr, pinfo->srcport, pinfo->destport,

                src_addr, dst_addr, pinfo->srcport, pinfo->destport);

        }

    }

    return buf;

} /* f5_tcp_conv_filter() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Calculates the F5 UDP conversation filter based on the current packet.

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param pinfo   A pointer to the packet info to look at for the L3/L4 data.

 * @return        A filter string for the F5 UDP conversation or NULL if no filter can be

 *                  computed.  The caller should free this string with g_free().

 *

 *  Prior to version 11.0.0, the f5ethtrailer.peeripproto field was not populated properly.  In

 *  an effort to accurately match the appropriate protocol, the filter adds:

 *       f5ethtrailer.ipproto eq 17 (for the >=11.0.0 case)

 *    or f5ethtrailer.ipproto eq 0 and udp (for the <11.0.0 case)

 *  This is in an attempt to try to not pick up TCP packets that happen to have the same ports when

 *  you are filtering on a UDP conversation.  Note that in the <11.0.0 case, an IP protocol change

 *  across the peer flows (I don't know that I've seen that happen, so it's at least rare) will not

 *  be filtered properly.  In the >=11.0.0 case, if you have TCP on one side and UDP on the other

 *  and it should "do the right thing".

 *

 * @attention This function uses ws_strdup_printf() rather than the wmem equivalent because the

 *             caller (menu_dissector_filter_cb()) uses g_free to free the filter string.

 *             (as of WS 1.12).

 */

static char *

f5_udp_conv_filter(packet_info *pinfo, void *user_data _U_)

{

    char *buf = NULL;

    char src_addr[WS_INET6_ADDRSTRLEN];

    char dst_addr[WS_INET6_ADDRSTRLEN];

    *dst_addr = *src_addr = '\0';

    if (pinfo->net_src.type == AT_IPv4 && pinfo->net_dst.type == AT_IPv4) {

        address_to_str_buf(&pinfo->src, src_addr, WS_INET6_ADDRSTRLEN);

        address_to_str_buf(&pinfo->dst, dst_addr, WS_INET6_ADDRSTRLEN);

        if (*src_addr != '\0' && *dst_addr != '\0') {

            buf = ws_strdup_printf(

                "(ip.addr eq %s and ip.addr eq %s and udp.port eq %d and udp.port eq %d) or"

                " (f5ethtrailer.peeraddr eq %s and f5ethtrailer.peeraddr eq %s and"

                " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"

                " (f5ethtrailer.peeripproto eq 17 or (f5ethtrailer.peeripproto eq 0 and udp)))",

                src_addr, dst_addr, pinfo->srcport, pinfo->destport,

                src_addr, dst_addr, pinfo->srcport, pinfo->destport);

        }

    } else if (pinfo->net_src.type == AT_IPv6 && pinfo->net_dst.type == AT_IPv6) {

        address_to_str_buf(&pinfo->src, src_addr, WS_INET6_ADDRSTRLEN);

        address_to_str_buf(&pinfo->dst, dst_addr, WS_INET6_ADDRSTRLEN);

        if (*src_addr != '\0' && *dst_addr != '\0') {

            buf = ws_strdup_printf(

                "(ipv6.addr eq %s and ipv6.addr eq %s and udp.port eq %d and udp.port eq %d) or"

                " (f5ethtrailer.peeraddr6 eq %s and f5ethtrailer.peeraddr6 eq %s and"

                " f5ethtrailer.peerport eq %d and f5ethtrailer.peerport eq %d and"

                " (f5ethtrailer.peeripproto eq 17 or (f5ethtrailer.peeripproto eq 0 and udp)))",

                src_addr, dst_addr, pinfo->srcport, pinfo->destport,

                src_addr, dst_addr, pinfo->srcport, pinfo->destport);

        }

    }

    return buf;

} /* f5_udp_conv_filter() */

/* End of Analyze menu functions */

/*===============================================================================================*/

/*===============================================================================================*/

/* Stats tree functions */

static int st_node_tmmpktdist              = -1; /**< Tree for packet counts */

static int st_node_tmmbytedist             = -1; /**< Tree for byte counts (excludes trailer) */

static const char *st_str_tmmdist         = "F5" STATS_TREE_MENU_SEPARATOR "tmm Distribution";

static const char *st_str_tmmdist_pkts    = "tmm Packet Distribution";

static const char *st_str_tmmdist_bytes   = "tmm Byte Distribution (excludes trailer)";

static const char *st_str_tmm_dir_in      = "direction in";

static const char *st_str_tmm_dir_out     = "direction out";

static const char *st_str_tmm_flow_virt   = "flow with virtual";

static const char *st_str_tmm_flow_novirt = "flow without virtual";

static const char *st_str_tmm_flow_none   = "flow none";

static int st_node_virtpktdist             = -1; /**< Tree for packet counts */

static int st_node_virtbytedist            = -1; /**< Tree for packet counts (excludes trailer) */

static const char *st_str_virtdist        = "F5" STATS_TREE_MENU_SEPARATOR "Virtual Server Distribution";

static const char *st_str_virtdist_pkts   = "Virtual Server Packet Distribution";

static const char *st_str_virtdist_bytes  = "Virtual Server Byte Distribution (excludes trailer)";

static const char *st_str_virtdist_noflow = "No flow";

static const char *st_str_virtdist_novirt = "Flow without virtual server name";

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Initializer for tmm distribution statistics

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param st      A pointer to the stats tree to use

 *

 */

static void

f5eth_tmmdist_stats_tree_init(stats_tree *st)

{

    st_node_tmmpktdist = stats_tree_create_node(st, st_str_tmmdist_pkts, 0, STAT_DT_INT, true);

    stat_node_set_flags(st, st_str_tmmdist_pkts, 0, true, ST_FLG_SORT_TOP);

    st_node_tmmbytedist = stats_tree_create_node(st, st_str_tmmdist_bytes, 0, STAT_DT_INT, true);

} /* f5eth_tmmdist_stats_tree_init() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Per-packet tmm distribution statistics

 *

 * @attention This is an interface function to be called from the rest of wireshark.

 *

 * @param st      A pointer to the stats tree to use

 * @param pinfo   A pointer to the packet info.

 * @param edt     Unused

 * @param data    A pointer to the data provided by the tap

 * @return        TAP_PACKET_REDRAW if the data was actually used to alter

 *                  the statistics, TAP_PACKET_DONT_REDRAW otherwise.

 *

 */

static tap_packet_status

f5eth_tmmdist_stats_tree_packet(

    stats_tree *st, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)

{

    const f5eth_tap_data_t *tdata = (const f5eth_tap_data_t *)data;

    uint32_t pkt_len;

    int st_node_tot_pkts;

    int st_node_tot_bytes;

    int st_node_tmm_pkts;

    int st_node_tmm_bytes;

    char *tmm_stat_name;

    if (tdata == NULL)

        return TAP_PACKET_DONT_REDRAW;

    /* Unnecessary since this tap packet function and the F5 Ethernet trailer dissector are both in

     * the same source file.  If you are using this function as an example in a separate tap source

     * file, you should uncomment this.

    if(check_f5eth_tap_magic(tdata) == 0) return TAP_PACKET_DONT_REDRAW;

     */

    tmm_stat_name = wmem_strdup_printf(NULL, "slot %3d,tmm %3d", tdata->slot, tdata->tmm);

    pkt_len = pinfo->fd->pkt_len - tdata->trailer_len;

    st_node_tot_pkts  = tick_stat_node(st, st_str_tmmdist_pkts, 0, true);

    st_node_tot_bytes = increase_stat_node(st, st_str_tmmdist_bytes, 0, true, pkt_len);

    st_node_tmm_pkts = tick_stat_node(st, tmm_stat_name, st_node_tot_pkts, true);

    st_node_tmm_bytes =

        increase_stat_node(st, tmm_stat_name, st_node_tot_bytes, true, pkt_len);

    if (tdata->ingress == 1) {

        tick_stat_node(st, st_str_tmm_dir_in, st_node_tmm_pkts, false);

        increase_stat_node(st, st_str_tmm_dir_in, st_node_tmm_bytes, false, pkt_len);

        /* Create nodes in case we see no egress packets */

        increase_stat_node(st, st_str_tmm_dir_out, st_node_tmm_pkts, false, 0);

        increase_stat_node(st, st_str_tmm_dir_out, st_node_tmm_bytes, false, 0);

    } else {

        tick_stat_node(st, st_str_tmm_dir_out, st_node_tmm_pkts, false);

        increase_stat_node(st, st_str_tmm_dir_out, st_node_tmm_bytes, false, pkt_len);

        /* Create nodes in case we see no ingress packets */

        increase_stat_node(st, st_str_tmm_dir_in, st_node_tmm_pkts, false, 0);

        increase_stat_node(st, st_str_tmm_dir_in, st_node_tmm_bytes, false, 0);

    }

    if (tdata->virtual_name == NULL) {

        if (tdata->flow == 0) {

            /* No flow ID and no virtual name */

            tick_stat_node(st, st_str_tmm_flow_none, st_node_tmm_pkts, false);

            increase_stat_node(st, st_str_tmm_flow_none, st_node_tmm_bytes, false, pkt_len);

            /* Create nodes in case we see no packets without a virtual */

            increase_stat_node(st, st_str_tmm_flow_novirt, st_node_tmm_pkts, false, 0);

            increase_stat_node(st, st_str_tmm_flow_novirt, st_node_tmm_bytes, false, 0);

        } else {

            /* Flow ID and no virtual name */

            tick_stat_node(st, st_str_tmm_flow_novirt, st_node_tmm_pkts, false);

            increase_stat_node(st, st_str_tmm_flow_novirt, st_node_tmm_bytes, false, pkt_len);

            /* Create nodes in case we see no packets with a virtual */

            increase_stat_node(st, st_str_tmm_flow_none, st_node_tmm_pkts, false, 0);

            increase_stat_node(st, st_str_tmm_flow_none, st_node_tmm_bytes, false, 0);

        }

        /* Create nodes in case we see no packets with a virtual */

        increase_stat_node(st, st_str_tmm_flow_virt, st_node_tmm_pkts, false, 0);

        increase_stat_node(st, st_str_tmm_flow_virt, st_node_tmm_bytes, false, 0);

    } else {

        /* Has a virtual name */

        tick_stat_node(st, st_str_tmm_flow_virt, st_node_tmm_pkts, false);

        increase_stat_node(st, st_str_tmm_flow_virt, st_node_tmm_bytes, false, pkt_len);

        /* Create nodes in case we see no packets without a virtual */

        increase_stat_node(st, st_str_tmm_flow_novirt, st_node_tmm_pkts, false, 0);

        increase_stat_node(st, st_str_tmm_flow_novirt, st_node_tmm_bytes, false, 0);

        /* Create nodes in case we see no packets without a flow */

        increase_stat_node(st, st_str_tmm_flow_none, st_node_tmm_pkts, false, 0);

        increase_stat_node(st, st_str_tmm_flow_none, st_node_tmm_bytes, false, 0);

    }

    wmem_free(NULL, tmm_stat_name);

    return TAP_PACKET_REDRAW;

} /* f5eth_tmmdist_stats_tree_packet() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Initialize Virtual Server stats tree

 *

 * @param st A pointer to the stats tree to use

 */

static void

f5eth_virtdist_stats_tree_init(stats_tree *st)

{

    st_node_virtpktdist = stats_tree_create_node(st, st_str_virtdist_pkts, 0, STAT_DT_INT, true);

    stat_node_set_flags(st, st_str_virtdist_pkts, 0, true, ST_FLG_SORT_TOP);

    st_node_virtbytedist = stats_tree_create_node(st, st_str_virtdist_bytes, 0, STAT_DT_INT, true);

    stats_tree_create_node(st, st_str_virtdist_noflow, st_node_virtpktdist, STAT_DT_INT, true);

    stat_node_set_flags(st, st_str_virtdist_noflow, st_node_virtpktdist, true, ST_FLG_SORT_TOP);

    stats_tree_create_node(st, st_str_virtdist_novirt, st_node_virtpktdist, STAT_DT_INT, true);

    stat_node_set_flags(st, st_str_virtdist_novirt, st_node_virtpktdist, true, ST_FLG_SORT_TOP);

    stats_tree_create_node(st, st_str_virtdist_noflow, st_node_virtbytedist, STAT_DT_INT, true);

    stat_node_set_flags(st, st_str_virtdist_noflow, st_node_virtbytedist, true, ST_FLG_SORT_TOP);

    stats_tree_create_node(st, st_str_virtdist_novirt, st_node_virtbytedist, STAT_DT_INT, true);

    stat_node_set_flags(st, st_str_virtdist_novirt, st_node_virtbytedist, true, ST_FLG_SORT_TOP);

} /* f5eth_virtdist_stats_tree_init() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Per-packet Virtual Server distribution statistics

 *

 * @param st      A pointer to the stats tree to use

 * @param pinfo   A pointer to the packet info.

 * @param edt     Unused

 * @param data    A pointer to the data provided by the tap

 * @return        TAP_PACKET_REDRAW if the data was actually used to alter

 *                  the statistics, TAP_PACKET_DONT_REDRAW otherwise.

 */

static tap_packet_status

f5eth_virtdist_stats_tree_packet(

    stats_tree *st, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)

{

    const f5eth_tap_data_t *tdata = (const f5eth_tap_data_t *)data;

    uint32_t pkt_len;

    if (tdata == NULL)

        return TAP_PACKET_DONT_REDRAW;

    /* Unnecessary since this tap packet function and the F5 Ethernet trailer dissector are both in

     * the same source file.  If you are using this function as an example in a separate tap source

     * file, you should uncomment this.

    if(check_f5eth_tap_magic(tdata) == 0) return TAP_PACKET_DONT_REDRAW;

     */

    pkt_len = pinfo->fd->pkt_len - tdata->trailer_len;

    tick_stat_node(st, st_str_virtdist_pkts, 0, true);

    increase_stat_node(st, st_str_virtdist_bytes, 0, true, pkt_len);

    /* We could have low noise (with a virtual name) without medium noise (with the flow ID).

     * That will get treated as a no flow case. */

    if (tdata->virtual_name == NULL) {

        if (tdata->flow == 0) {

            /* No flow ID */

            tick_stat_node(st, st_str_virtdist_noflow, st_node_virtpktdist, true);

            increase_stat_node(st, st_str_virtdist_noflow, st_node_virtbytedist, true, pkt_len);

        } else {

            /* Flow ID without virtual name */

            tick_stat_node(st, st_str_virtdist_novirt, st_node_virtpktdist, true);

            increase_stat_node(st, st_str_virtdist_novirt, st_node_virtbytedist, true, pkt_len);

        }

    } else {

        /* Has virtual name */

        tick_stat_node(st, tdata->virtual_name, st_node_virtpktdist, true);

        increase_stat_node(st, tdata->virtual_name, st_node_virtbytedist, true, pkt_len);

    }

    return TAP_PACKET_REDRAW;

} /* f5eth_virtdist_stats_tree_packet() */

/* End of statistics gathering */

/*===============================================================================================*/

/*===============================================================================================*/

/* Info column display handling.

 *

 * Format Specifiers:

 *   in/out are separate formats so that no printf formatting is required for these two common

 *     alternatives.

 *   There are two sets of six format strings.  One set corresponding to "full" or long output

 *     ("long" is not used due to conflict with C keyword) and the other set corresponding to

 *     "brief" output.

 *     Full:

 *       in/out only; one for in, one for out:

 *         info_format_full_in_only,    info_format_full_out_only

 *       in/out, slot and tmm; one for in and one for out:

 *         info_format_full_in_slot,    info_format_full_out_slot

 *       in/out and tmm (no slot information); one for in and one for out:

 *         info_format_full_in_noslot,  info_format_full_out_noslot

 *     Brief:

 *       in/out only; one for in, one for out:

 *         info_format_brief_in_only,   info_format_brief_out_only

 *       in/out, slot and tmm; one for in and one for out:

 *         info_format_brief_in_slot,   info_format_brief_out_slot

 *       in/out and tmm (no slot information); one for in and one for out:

 *         info_format_brief_in_noslot, info_format_brief_out_noslot

 *   The set of format specifiers in use are chosen based on whether brief is chosen and the

 *     following variables are set accordingly:

 *        info_format_in_only,          info_format_out_only   (should have no format specifiers)

 *        info_format_in_slot,          info_format_out_slot   (should have two format specifiers)

 *        info_format_in_noslot,        info_format_out_noslot (should have one format specifier)

 *

 * Functions:

 *   Separate functions depending on the amount of information desired.  The decision is made once

 *     when the preference is set and a function pointer is used to call the appropriate one:

 *       f5eth_set_info_col_inout():   In/out only.

 *       f5eth_set_info_col_slot():    in/out, slot and tmm.

 *       f5eth_set_info_col_noslot():  in/out and tmm (no slot information).

 *   f5eth_set_info_col is the function pointer to the function currently in use.

 */

/** Info column display format formats */

static const char info_format_full_in_only[]    = "IN : ";

static const char info_format_full_out_only[]   = "OUT: ";

static const char info_format_full_in_slot[]    = "IN  s%u/tmm%-2u: ";

static const char info_format_full_out_slot[]   = "OUT s%u/tmm%-2u: ";

static const char info_format_full_in_noslot[]  = "IN  tmm%-2u: ";

static const char info_format_full_out_noslot[] = "OUT tmm%-2u: ";

/* Variables used in f5eth_set_info_col functions initialized to defaults */

static char *info_format_in_only; /**< In format in use with in/out only */

static char *info_format_out_only; /**< Out format in use with in/out only */

static char *info_format_in_noslot; /**< In format in use without slot */

static char *info_format_out_noslot; /**< Out format in use without slot */

static char *info_format_in_slot; /**< In format in use with slot */

static char *info_format_out_slot; /**< Out format in use with slot */

/** Info column display format preference types:

  * These correspond to bit flags

  *   Display on  = 0x0001

  *   In out only = 0x0002

  *   Brief       = 0x0004

  */

typedef enum {

    none              = 0,

    full              = 1,

    in_out_only       = 3,

    brief             = 5,

    brief_in_out_only = 7

} f5eth_info_type_t;

/** Info column display format type strings */

static const enum_val_t f5eth_display_strings[] = {

    {"None",           "None",               0},

    {"Full",           "Full",               1},

    {"InOutOnly",      "In/out only",        3},

    {"Brief",          "Brief",              5},

    {"BriefInOutOnly", "Brief in/out only",  7},

    {NULL,             NULL,                 0}

};

/** Info column display preference (default to full) */

static f5eth_info_type_t pref_info_type = full;

/** Preference for the brief in/out characters */

static const char *pref_brief_inout_chars;

/** Function pointer prototype for info column set functions */

typedef void (*f5eth_set_col_info_func)(packet_info *, unsigned, unsigned, unsigned);

/** Preference for setting platform regex for which platforms to display slot information for. */

static const char *pref_slots_regex;

/** Whether or not to display slot information, set based on platform and regex preference. */

static bool display_slot = true;

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Adds full format (in/out, slot, tmm) to info column

 *

 * @param pinfo   A pointer to the packet info structure.

 * @param ingress zero for egress, non-zero for ingress.

 * @param slot    The slot number handling the packet

 * @param tmm     The tmm handling the packet

 */

static void

f5eth_set_info_col_slot(packet_info *pinfo, unsigned ingress, unsigned slot, unsigned tmm)

{

    bool col_writable;

    /*

     * HTTP and other protocols set writable to false to protect

     * their data.  We don't care.

     */

    col_writable = col_get_writable(pinfo->cinfo, COL_INFO);

    col_set_writable(pinfo->cinfo, COL_INFO, true);

    if (ingress != 0) {

        DISSECTOR_ASSERT(info_format_in_slot);

        col_prepend_fence_fstr(pinfo->cinfo, COL_INFO, info_format_in_slot, slot, tmm);

    } else {

        DISSECTOR_ASSERT(info_format_out_slot);

        col_prepend_fence_fstr(pinfo->cinfo, COL_INFO, info_format_out_slot, slot, tmm);

    }

    /* Reset writable to whatever it was before we got here. */

    col_set_writable(pinfo->cinfo, COL_INFO, col_writable);

} /* f5eth_set_info_col_slot() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Adds format without slot (in/out, tmm) to info column

 *

 * @param pinfo   A pointer to the packet info structure.

 * @param ingress zero for egress, non-zero for ingress.

 * @param slot    The slot number handling the packet (unused)

 * @param tmm     The tmm handling the packet

 */

static void

f5eth_set_info_col_noslot(packet_info *pinfo, unsigned ingress, unsigned slot _U_, unsigned tmm)

{

    bool col_writable;

    /*

     * HTTP and other protocols set writable to false to protect

     * their data.  We don't care.

     */

    col_writable = col_get_writable(pinfo->cinfo, COL_INFO);

    col_set_writable(pinfo->cinfo, COL_INFO, true);

    if (ingress != 0) {

        col_prepend_fence_fstr(pinfo->cinfo, COL_INFO, info_format_in_noslot, tmm);

    } else {

        col_prepend_fence_fstr(pinfo->cinfo, COL_INFO, info_format_out_noslot, tmm);

    }

    /* Reset writable to whatever it was before we got here. */

    col_set_writable(pinfo->cinfo, COL_INFO, col_writable);

} /* f5eth_set_info_col_noslot() */

/*-----------------------------------------------------------------------------------------------*/

/**

 * @brief Adds format with only direction (in/out) to info column

 *

 * @param pinfo   A pointer to the packet info structure.

 * @param ingress zero for egress, non-zero for ingress.

 * @param slot    The slot number handling the packet (unused)

 * @param tmm     The tmm handling the packet (unused)

 */

static void

f5eth_set_info_col_inout(packet_info *pinfo, unsigned ingress, unsigned slot _U_, unsigned tmm _U_)

{

    bool col_writable;

    /*

     * HTTP and other protocols set writable to false to protect

     * their data.  We don't care.

     */