/* packet-frame.c

 *

 * Top-most dissector. Decides dissector based on Wiretap Encapsulation Type.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 2000 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#ifdef _MSC_VER

#include <windows.h>

#endif

#include <epan/packet.h>

#include <epan/capture_dissectors.h>

#include <epan/epan.h>

#include <epan/exceptions.h>

#include <epan/show_exception.h>

#include <epan/prefs.h>

#include <epan/to_str.h>

#include <epan/sequence_analysis.h>

#include <epan/tap.h>

#include <epan/proto_data.h>

#include <epan/expert.h>

#include <epan/tfs.h>

#include <wsutil/wsgcrypt.h>

#include <wsutil/str_util.h>

#include <wsutil/wslog.h>

#include <wsutil/ws_assert.h>

#include <epan/addr_resolv.h>

#include <epan/wmem_scopes.h>

#include <epan/column-info.h>

#include "packet-frame.h"

#include <epan/color_filters.h>

void proto_register_frame(void);

void event_register_frame(void);

void proto_reg_handoff_frame(void);

void event_reg_handoff_frame(void);

static int proto_frame;

static int proto_pkt_comment;

static int proto_syscall;

static int proto_darwin;

static int hf_frame_arrival_time_local;

static int hf_frame_arrival_time_utc;

static int hf_frame_arrival_time_epoch;

static int hf_frame_shift_offset;

static int hf_frame_time_delta;

static int hf_frame_time_delta_displayed;

static int hf_frame_time_relative;

static int hf_frame_time_relative_cap;

static int hf_frame_time_reference;

static int hf_frame_number;

static int hf_frame_len;

static int hf_frame_capture_len;

static int hf_frame_p2p_dir;

static int hf_frame_file_off;

static int hf_frame_md5_hash;

static int hf_frame_marked;

static int hf_frame_ignored;

static int hf_frame_link_number;

static int hf_frame_packet_id;

static int hf_frame_hash;

static int hf_frame_hash_bytes;

static int hf_frame_verdict;

static int hf_frame_verdict_hardware;

static int hf_frame_verdict_tc;

static int hf_frame_verdict_xdp;

static int hf_frame_verdict_unknown;

static int hf_frame_drop_count;

static int hf_frame_protocols;

static int hf_frame_color_filter_name;

static int hf_frame_color_filter_text;

static int hf_frame_section_number;

static int hf_frame_interface_id;

static int hf_frame_interface_name;

static int hf_frame_interface_description;

static int hf_frame_interface_queue;

static int hf_frame_pack_flags;

static int hf_frame_pack_direction;

static int hf_frame_pack_reception_type;

static int hf_frame_pack_fcs_length;

static int hf_frame_pack_reserved;

static int hf_frame_pack_crc_error;

static int hf_frame_pack_wrong_packet_too_long_error;

static int hf_frame_pack_wrong_packet_too_short_error;

static int hf_frame_pack_wrong_inter_frame_gap_error;

static int hf_frame_pack_unaligned_frame_error;

static int hf_frame_pack_start_frame_delimiter_error;

static int hf_frame_pack_preamble_error;

static int hf_frame_pack_symbol_error;

static int hf_frame_wtap_encap;

static int hf_frame_cb_pen;

static int hf_frame_cb_copy_allowed;

static int hf_frame_comment;

static int hf_frame_encoding;

static int ett_frame;

static int ett_ifname;

static int ett_flags;

static int ett_comments;

static int ett_hash;

static int ett_verdict;

static expert_field ei_comments_text;

static expert_field ei_arrive_time_out_of_range;

static expert_field ei_incomplete;

static expert_field ei_len_lt_caplen;

static int frame_tap;

static dissector_handle_t docsis_handle;

static dissector_handle_t sysdig_handle;

static dissector_handle_t systemd_journal_handle;

static dissector_handle_t darwin_handle;

/* Preferences */

static bool show_file_off;

static bool force_docsis_encap;

static bool generate_md5_hash;

static bool generate_bits_field = true;

static bool disable_packet_size_limited_in_summary;

static unsigned max_comment_lines   = 30;

static const value_string p2p_dirs[] = {

  { P2P_DIR_UNKNOWN, "Unknown" },

  { P2P_DIR_SENT,    "Sent" },

  { P2P_DIR_RECV,    "Received" },

  { 0, NULL }

};

static const value_string packet_word_directions[] = {

  { PACK_FLAGS_DIRECTION_UNKNOWN,  "Unknown" },

  { PACK_FLAGS_DIRECTION_INBOUND,  "Inbound" },

  { PACK_FLAGS_DIRECTION_OUTBOUND, "Outbound" },

  { 0, NULL }

};

static const value_string packet_word_reception_types[] = {

  { PACK_FLAGS_RECEPTION_TYPE_UNSPECIFIED, "Not specified" },

  { PACK_FLAGS_RECEPTION_TYPE_UNICAST,     "Unicast" },

  { PACK_FLAGS_RECEPTION_TYPE_MULTICAST,   "Multicast" },

  { PACK_FLAGS_RECEPTION_TYPE_BROADCAST,   "Broadcast" },

  { PACK_FLAGS_RECEPTION_TYPE_PROMISCUOUS, "Promiscuous" },

  { 0, NULL }

};

static const value_string packet_char_enc_types[] = {

  { PACKET_CHAR_ENC_CHAR_ASCII, "ASCII" },

  { PACKET_CHAR_ENC_CHAR_EBCDIC, "EBCDIC" },

  { 0, NULL }

};

static const val64_string verdict_ebpf_tc_types[] = {

  { -1, "TC_ACT_UNSPEC"},

  { 0, "TC_ACT_OK"},

  { 1, "TC_ACT_RECLASSIFY"},

  { 2, "TC_ACT_SHOT"},

  { 3, "TC_ACT_PIPE"},

  { 4, "TC_ACT_STOLEN"},

  { 5, "TC_ACT_QUEUED"},

  { 6, "TC_ACT_REPEAT"},

  { 7, "TC_ACT_REDIRECT"},

  { 8, "TC_ACT_TRAP"},

  { 0, NULL }

};

static const val64_string verdict_ebpf_xdp_types[] = {

  { 0, "XDP_ABORTED"},

  { 1, "XDP_DROP"},

  { 2, "XDP_PASS"},

  { 3, "XDP_TX"},

  { 4, "XDP_REDIRECT"},

  { 0, NULL }

};

static dissector_table_t wtap_encap_dissector_table;

static dissector_table_t wtap_fts_rec_dissector_table;

static dissector_table_t block_pen_dissector_table;

static dissector_table_t binary_option_pen_dissector_table;

static dissector_table_t packet_block_option_dissector_table;

/* The number of tree items required to add an exception to the tree */

#define EXCEPTION_TREE_ITEMS 10

/* OPT_EPB_VERDICT sub-types */

#define OPT_VERDICT_TYPE_HW  0

#define OPT_VERDICT_TYPE_TC  1

#define OPT_VERDICT_TYPE_XDP 2

/* OPT_EPB_HASH sub-types */

#define OPT_HASH_2COMP    0

#define OPT_HASH_XOR    1

#define OPT_HASH_CRC32    2

#define OPT_HASH_MD5      3

#define OPT_HASH_SHA1     4

#define OPT_HASH_TOEPLITZ 5

/* Structure for passing as userdata to wtap_block_foreach_option */

typedef struct fr_foreach_s {

  proto_item *item;

  proto_tree *tree;

  tvbuff_t *tvb;

  packet_info *pinfo;

  unsigned n_changes;

} fr_foreach_t;

static const char *

get_verdict_type_string(uint8_t type)

{

  switch(type) {

  case OPT_VERDICT_TYPE_HW:

    return "Hardware";

  case OPT_VERDICT_TYPE_TC:

    return "eBPF_TC";

  case OPT_VERDICT_TYPE_XDP:

    return "eBPF_XDP";

  }

  return "Unknown";

}

static const char *

get_hash_type_string(uint8_t type)

{

  switch(type) {

  case OPT_HASH_2COMP:

    return "2's Complement";

  case OPT_HASH_XOR:

    return "XOR";

  case OPT_HASH_CRC32:

    return "CRC32";

  case OPT_HASH_MD5:

    return "MD5";

  case OPT_HASH_SHA1:

    return "SHA1";

  case OPT_HASH_TOEPLITZ:

    return "Toeplitz";

  default:

    return "Unknown";

  }

}

static void

ensure_tree_item(proto_tree *tree, unsigned count)

{

  /*

   * Ensure that no exception is thrown in proto.c when adding the

   * next tree item. Even if the maximum number of items is

   * reached, we know for sure that no infinite loop will occur.

   */

  if (tree && PTREE_DATA(tree)->count > count)

    PTREE_DATA(tree)->count -= count;

}

/****************************************************************************/

/* whenever a frame packet is seen by the tap listener */

/* Add a new frame into the graph */

static tap_packet_status

frame_seq_analysis_packet( void *ptr, packet_info *pinfo, epan_dissect_t *edt _U_, const void *dummy _U_, tap_flags_t flags _U_)

{

  seq_analysis_info_t *sainfo = (seq_analysis_info_t *) ptr;

  seq_analysis_item_t *sai = sequence_analysis_create_sai_with_addresses(pinfo, sainfo);

  if (!sai)

    return TAP_PACKET_DONT_REDRAW;

  sai->frame_number = pinfo->num;

  sequence_analysis_use_color_filter(pinfo, sai);

  sai->port_src=pinfo->srcport;

  sai->port_dst=pinfo->destport;

  sequence_analysis_use_col_info_as_label_comment(pinfo, sai);

  sai->line_style = 1;

  sai->conv_num = 0;

  sai->display = true;

  g_queue_push_tail(sainfo->items, sai);

  return TAP_PACKET_REDRAW;

}

/*

 * Routine used to register frame end routine.  The routine should only

 * be registered when the dissector is used in the frame, not in the

 * proto_register_XXX function.

 */

void

register_frame_end_routine(packet_info *pinfo, void (*func)(void))

{

  pinfo->frame_end_routines = g_slist_append(pinfo->frame_end_routines, (void *)func);

}

typedef void (*void_func_t)(void);

static void

call_frame_end_routine(void *routine)

{

  void_func_t func = (void_func_t)routine;

  (*func)();

}

static bool

frame_add_comment(wtap_block_t block _U_, unsigned option_id, wtap_opttype_e option_type _U_, wtap_optval_t *option, void *user_data)

{

  fr_foreach_t *fr_user_data = (fr_foreach_t *)user_data;

  proto_item *comment_item;

  proto_item *hidden_item;

  proto_tree *comments_tree;

  char *newline;             /* location of next newline in comment */

  char *ch;                  /* utility pointer */

  unsigned i;                    /* track number of lines */

  if (option_id == OPT_COMMENT) {

    ch = option->stringval;

    newline = strchr(ch, '\n');

    if (newline == NULL) {

      /* Single-line comment, no special treatment needed */

      comment_item = proto_tree_add_string_format(fr_user_data->tree,

          hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          ch,

          "%s", ch);

    }

    else {

      /* Multi-line comment. Temporarily change the first

       * newline to a null so we only show the first line

       */

      *newline = '\0';

      comment_item = proto_tree_add_string_format(fr_user_data->tree,

          hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          ch,

          "%s [...]", ch);

      comments_tree = proto_item_add_subtree(comment_item, ett_comments);

      for (i = 0; i < max_comment_lines; i++) {

        /* Add each line as a separate item under

         * the comment tree

         */

        proto_tree_add_string_format(comments_tree, hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          ch,

          "%s", ch);

        if (newline == NULL) {

          /* This was set in the previous loop

           * iteration; it means we've added the

           * final line

           */

          break;

        }

        else {

          /* Put back the newline we removed */

          *newline = '\n';

          ch = newline + 1;

          if (*ch == '\0') {

            break;

          }

          /* Find next newline to repeat the process

           * in the next iteration

           */

          newline = strchr(ch, '\n');

          if (newline != NULL) {

            *newline = '\0';

          }

        }

      }

      if (i == max_comment_lines) {

        /* Put back a newline if we still have one dangling */

        if (newline != NULL) {

          *newline = '\n';

        }

        /* Add truncation notice */

        proto_tree_add_string_format(comments_tree, hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          "",

          "[comment truncated at %d line%s]",

          max_comment_lines,

          plurality(max_comment_lines, "", "s"));

      }

      /* Add the original comment unchanged as a hidden

       * item, so searches still work like before

       */

      hidden_item = proto_tree_add_string(comments_tree,

          hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          option->stringval);

      proto_item_set_hidden(hidden_item);

      comment_item = comments_tree;

    }

    hidden_item = expert_add_info_format(fr_user_data->pinfo, comment_item, &ei_comments_text,

        "%s",  option->stringval);

    proto_item_set_hidden(hidden_item);

  }

  fr_user_data->n_changes++;

  return true;

}

static bool

frame_add_hash(wtap_block_t block _U_, unsigned option_id, wtap_opttype_e option_type _U_, wtap_optval_t *option, void *user_data)

{

  fr_foreach_t *fr_user_data = (fr_foreach_t *)user_data;

  if (option_id == OPT_PKT_HASH) {

    packet_hash_opt_t *hash = &option->packet_hash;

    const char *format

      = fr_user_data->n_changes ? ", %s (%u)" : "%s (%u)";

    proto_item_append_text(fr_user_data->item, format,

               get_hash_type_string(hash->type),

               hash->type);

    proto_tree_add_bytes_with_length(fr_user_data->tree,

             hf_frame_hash_bytes,

             fr_user_data->tvb, 0, 0,

             hash->hash_bytes->data,

             hash->hash_bytes->len);

  }

  fr_user_data->n_changes++;

  return true;

}

static bool

frame_add_verdict(wtap_block_t block _U_, unsigned option_id, wtap_opttype_e option_type _U_, wtap_optval_t *option, void *user_data)

{

  fr_foreach_t *fr_user_data = (fr_foreach_t *)user_data;

  if (option_id == OPT_PKT_VERDICT) {

    packet_verdict_opt_t *verdict = &option->packet_verdictval;

    char *format = fr_user_data->n_changes ? ", %s (%u)" : "%s (%u)";

    proto_item_append_text(fr_user_data->item, format,

               get_verdict_type_string(verdict->type),

               verdict->type);

    switch(verdict->type) {

      case OPT_VERDICT_TYPE_TC:

        proto_tree_add_int64(fr_user_data->tree,

                 hf_frame_verdict_tc,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_linux_ebpf_tc);

        break;

      case OPT_VERDICT_TYPE_XDP:

        proto_tree_add_int64(fr_user_data->tree,

                 hf_frame_verdict_xdp,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_linux_ebpf_xdp);

        break;

      case OPT_VERDICT_TYPE_HW:

        proto_tree_add_bytes_with_length(fr_user_data->tree,

                 hf_frame_verdict_hardware,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_bytes->data,

                 verdict->data.verdict_bytes->len);

        break;

      default:

        proto_tree_add_bytes_with_length(fr_user_data->tree,

                 hf_frame_verdict_unknown,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_bytes->data,

                 verdict->data.verdict_bytes->len);

        break;

    }

  }

  fr_user_data->n_changes++;

  return true;

}

struct custom_binary_opt_cb_data {

  tvbuff_t *tvb;

  packet_info *pinfo;

  proto_tree *tree;

  struct custom_binary_opt_data data;

};

static bool

handle_packet_option(wtap_block_t block _U_, unsigned option_id,

    wtap_opttype_e option_type _U_, wtap_optval_t *optval, void *user_data)

{

  struct custom_binary_opt_cb_data *cb_data = (struct custom_binary_opt_cb_data *)user_data;

  switch (option_id) {

  case OPT_CUSTOM_STR_COPY:

  case OPT_CUSTOM_STR_NO_COPY:

    /* Display it */

    break;

  case OPT_CUSTOM_BIN_COPY:

  case OPT_CUSTOM_BIN_NO_COPY:

    /* Process it */

    cb_data->data.optval = optval;

    dissector_try_uint_with_data(binary_option_pen_dissector_table,

        optval->custom_binaryval.pen, cb_data->tvb,

        cb_data->pinfo, cb_data->tree, false, &cb_data->data);

    break;

  default:

    dissector_try_uint_with_data(packet_block_option_dissector_table,

      option_id, cb_data->tvb,

      cb_data->pinfo, cb_data->tree, false, optval);

    break;

  }

  return true;

}

static int

dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data)

{

  proto_item  *volatile ti = NULL;

  unsigned     cap_len = 0, frame_len = 0;

  nstime_t     rel_ts;

  uint32_t     pack_flags;

  uint32_t     interface_queue;

  uint64_t     drop_count;

  uint64_t     packetid;

  proto_tree  *volatile tree;

  proto_tree  *comments_tree;

  proto_tree  *volatile fh_tree = NULL;

  proto_item  *item;

  const char *cap_plurality, *frame_plurality;

  frame_data_t *fr_data = (frame_data_t*)data;

  const color_filter_t *color_filter;

  dissector_handle_t dissector_handle;

  fr_foreach_t fr_user_data;

  tree=parent_tree;

  DISSECTOR_ASSERT(fr_data);

  /*

   * Set the protocol to the record type name.

   */

  pinfo->current_proto = pinfo->rec->rec_type_name;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, pinfo->rec->rec_type_name);

  if (wtap_block_count_option(fr_data->pkt_block, OPT_COMMENT) > 0) {

    item = proto_tree_add_item(tree, proto_pkt_comment, tvb, 0, 0, ENC_NA);

    comments_tree = proto_item_add_subtree(item, ett_comments);

    fr_user_data.item = item;

    fr_user_data.tree = comments_tree;

    fr_user_data.pinfo = pinfo;

    fr_user_data.tvb = tvb;

    fr_user_data.n_changes = 0;

    wtap_block_foreach_option(fr_data->pkt_block, frame_add_comment, (void *)&fr_user_data);

  }

  cap_len = tvb_captured_length(tvb);

  frame_len = tvb_reported_length(tvb);

  /* If FRAME is not referenced from any filters we don't need to

     worry about generating any tree items.

     We do, however, have to worry about generating expert infos,

     as those have to show up if, for example, the user requests

     the expert info dialog.

     Therefore, the dissection code has to be careful about

     what stuff it does only if do_frame_dissection is true.

     XXX - all these tricks to optimize dissection if only some

     information is required are fragile.  Something better that

     handles this automatically would be useful. */

  bool do_frame_dissection = proto_field_is_referenced(tree, proto_frame);

  cap_plurality = plurality(cap_len, "", "s");

  frame_plurality = plurality(frame_len, "", "s");

  /* Put in frame header information. */

  if (do_frame_dissection) {

    ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, tvb_captured_length(tvb),

        "Frame %u: %s", pinfo->num, pinfo->rec->rec_type_name);

  } else {

    ti = NULL;

  }

  switch (pinfo->rec->rec_type) {

  case REC_TYPE_PACKET:

    if (do_frame_dissection) {

      proto_item_append_text(ti, ", %u byte%s on wire",

          frame_len, frame_plurality);

      if (generate_bits_field)

        proto_item_append_text(ti, " (%u bits)", frame_len * 8);

      proto_item_append_text(ti, ", %u byte%s captured",

          cap_len, cap_plurality);

      if (generate_bits_field) {

        proto_item_append_text(ti, " (%u bits)",

            cap_len * 8);

      }

      if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID) {

        const char *interface_name = epan_get_interface_name(pinfo->epan,

            pinfo->rec->rec_header.packet_header.interface_id,

            pinfo->rec->presence_flags & WTAP_HAS_SECTION_NUMBER ? pinfo->rec->section_number : 0);

        if (interface_name != NULL) {

          proto_item_append_text(ti, " on interface %s, id %u",

              interface_name, pinfo->rec->rec_header.packet_header.interface_id);

        } else {

          proto_item_append_text(ti, " on unnamed interface, id %u",

              pinfo->rec->rec_header.packet_header.interface_id);

        }

      }

    }

    if (WTAP_OPTTYPE_SUCCESS == wtap_block_get_uint32_option_value(fr_data->pkt_block, OPT_PKT_FLAGS, &pack_flags)) {

      switch (PACK_FLAGS_DIRECTION(pack_flags)) {

      case PACK_FLAGS_DIRECTION_UNKNOWN:

      default:

        pinfo->p2p_dir = P2P_DIR_UNKNOWN;

        break;

      case PACK_FLAGS_DIRECTION_INBOUND:

        pinfo->p2p_dir = P2P_DIR_RECV;

        if (do_frame_dissection)

          proto_item_append_text(ti, " (inbound)");

        break;

      case PACK_FLAGS_DIRECTION_OUTBOUND:

        pinfo->p2p_dir = P2P_DIR_SENT;

        if (do_frame_dissection)

          proto_item_append_text(ti, " (outbound)");

        break;

      }

    }

    /*

     * If the pseudo-header *and* the packet record both

     * have direction information, the pseudo-header

     * overrides the packet record.

     */

    if (pinfo->pseudo_header != NULL) {

      switch (pinfo->rec->rec_header.packet_header.pkt_encap) {

      case WTAP_ENCAP_WFLEET_HDLC:

      case WTAP_ENCAP_CHDLC_WITH_PHDR:

      case WTAP_ENCAP_PPP_WITH_PHDR:

      case WTAP_ENCAP_SDLC:

      case WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR:

        pinfo->p2p_dir = pinfo->pseudo_header->p2p.sent ?

            P2P_DIR_SENT : P2P_DIR_RECV;

        break;

      case WTAP_ENCAP_BLUETOOTH_HCI:

        pinfo->p2p_dir = pinfo->pseudo_header->bthci.sent ?

          P2P_DIR_SENT : P2P_DIR_RECV;

        break;

      case WTAP_ENCAP_LAPB:

      case WTAP_ENCAP_FRELAY_WITH_PHDR:

        pinfo->p2p_dir =

            (pinfo->pseudo_header->dte_dce.flags & FROM_DCE) ?

            P2P_DIR_RECV : P2P_DIR_SENT;

        break;

      case WTAP_ENCAP_ISDN:

      case WTAP_ENCAP_V5_EF:

      case WTAP_ENCAP_DPNSS:

      case WTAP_ENCAP_BACNET_MS_TP_WITH_PHDR:

        pinfo->p2p_dir = pinfo->pseudo_header->isdn.uton ?

            P2P_DIR_SENT : P2P_DIR_RECV;

        break;

      case WTAP_ENCAP_LINUX_LAPD:

        pinfo->p2p_dir = (pinfo->pseudo_header->lapd.pkttype == 3 ||

          pinfo->pseudo_header->lapd.pkttype == 4) ?

          P2P_DIR_SENT : P2P_DIR_RECV;

        break;

      case WTAP_ENCAP_MTP2_WITH_PHDR:

        pinfo->p2p_dir = pinfo->pseudo_header->mtp2.sent ?

            P2P_DIR_SENT : P2P_DIR_RECV;

        pinfo->link_number  = pinfo->pseudo_header->mtp2.link_number;

        break;

      case WTAP_ENCAP_GSM_UM:

        pinfo->p2p_dir = pinfo->pseudo_header->gsm_um.uplink ?

            P2P_DIR_SENT : P2P_DIR_RECV;

        break;

      }

    }

    break;

  case REC_TYPE_FT_SPECIFIC_EVENT:

    break;

  case REC_TYPE_FT_SPECIFIC_REPORT:

    break;

  case REC_TYPE_SYSCALL:

    if (do_frame_dissection) {

      /*

       * This gives us a top-of-tree "syscall" protocol

       * with "frame" fields underneath. Should we create

       * corresponding syscall.time, .time_epoch, etc

       * fields and use them instead or would frame.*

       * be preferred?

       *

       * XXX - is this length value relevant?

       */

      proto_item_append_text(ti, ", %u byte%s",

          frame_len, frame_plurality);

    }

    break;

  case REC_TYPE_SYSTEMD_JOURNAL_EXPORT:

    if (do_frame_dissection) {

      /*

       * XXX - we need to rethink what's handled by

       * packet-record.c, what's handled by packet-frame.c.

       * and what's handled by the syscall and systemd

       * journal dissectors (and maybe even the packet

       * dissector).

       *

       * XXX - is this length value relevant?

       */

      proto_item_append_text(ti, ", %u byte%s",

          frame_len, frame_plurality);

    }

    break;

  case REC_TYPE_CUSTOM_BLOCK:

    if (do_frame_dissection) {

      proto_item_append_text(ti, ", %u byte%s",

          frame_len, frame_plurality);

      proto_item_append_text(ti, ", copying%s allowed",

                             pinfo->rec->rec_header.custom_block_header.copy_allowed ? "" : " not");

    }

    break;

  default:

    col_set_str(pinfo->cinfo, COL_PROTOCOL, "UNKNOWN");

    col_add_fstr(pinfo->cinfo, COL_INFO, "Record type %u",

        pinfo->rec->rec_type);

    call_data_dissector(tvb, pinfo, parent_tree);

    return tvb_captured_length(tvb);

  }

  if (do_frame_dissection) {

    fh_tree = proto_item_add_subtree(ti, ett_frame);

  } else {

    fh_tree = NULL;

  }

  if (pinfo->rec->presence_flags & WTAP_HAS_SECTION_NUMBER &&

      do_frame_dissection &&

      (proto_field_is_referenced(tree, hf_frame_section_number))) {

    /* Show it as 1-origin */

    proto_tree_add_uint(fh_tree, hf_frame_section_number, tvb,

            0, 0, pinfo->rec->section_number + 1);

  }

  if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID &&

      do_frame_dissection &&

      ((proto_field_is_referenced(tree, hf_frame_interface_id) || proto_field_is_referenced(tree, hf_frame_interface_name) || proto_field_is_referenced(tree, hf_frame_interface_description)))) {

    unsigned section_number = pinfo->rec->presence_flags & WTAP_HAS_SECTION_NUMBER ? pinfo->rec->section_number : 0;

    const char *interface_name = epan_get_interface_name(pinfo->epan, pinfo->rec->rec_header.packet_header.interface_id, section_number);

    const char *interface_description = epan_get_interface_description(pinfo->epan, pinfo->rec->rec_header.packet_header.interface_id, section_number);

    proto_tree *if_tree;

    proto_item *if_item;

    if (interface_name) {

      if_item = proto_tree_add_uint_format_value(fh_tree, hf_frame_interface_id, tvb, 0, 0,

                   pinfo->rec->rec_header.packet_header.interface_id, "%u (%s)",

                   pinfo->rec->rec_header.packet_header.interface_id, interface_name);

      if_tree = proto_item_add_subtree(if_item, ett_ifname);

      proto_tree_add_string(if_tree, hf_frame_interface_name, tvb, 0, 0, interface_name);

    } else {

      if_item = proto_tree_add_uint(fh_tree, hf_frame_interface_id, tvb, 0, 0, pinfo->rec->rec_header.packet_header.interface_id);

    }

    if (interface_description) {

      if_tree = proto_item_add_subtree(if_item, ett_ifname);

      proto_tree_add_string(if_tree, hf_frame_interface_description, tvb, 0, 0, interface_description);

    }

  }

  if (pinfo->rec->rec_type == REC_TYPE_PACKET) {

    if (do_frame_dissection) {

      if (WTAP_OPTTYPE_SUCCESS == wtap_block_get_uint32_option_value(fr_data->pkt_block, OPT_PKT_QUEUE, &interface_queue)) {

        proto_tree_add_uint(fh_tree, hf_frame_interface_queue, tvb, 0, 0, interface_queue);

      }

      if (wtap_block_count_option(fr_data->pkt_block, OPT_PKT_HASH) > 0) {

        proto_tree *hash_tree;

        proto_item *hash_item;

        hash_item = proto_tree_add_string(fh_tree, hf_frame_hash, tvb, 0, 0, "");

        hash_tree = proto_item_add_subtree(hash_item, ett_hash);

        fr_user_data.item = hash_item;

        fr_user_data.tree = hash_tree;

        fr_user_data.pinfo = pinfo;

        fr_user_data.tvb = tvb;

        fr_user_data.n_changes = 0;

        wtap_block_foreach_option(fr_data->pkt_block, frame_add_hash, (void *)&fr_user_data);

      }

      if (WTAP_OPTTYPE_SUCCESS == wtap_block_get_uint32_option_value(fr_data->pkt_block, OPT_PKT_FLAGS, &pack_flags)) {

        proto_tree *flags_tree;

        proto_item *flags_item;

        static int * const flags[] = {

          &hf_frame_pack_direction,

          &hf_frame_pack_reception_type,

          &hf_frame_pack_fcs_length,

          &hf_frame_pack_reserved,

          &hf_frame_pack_crc_error,

          &hf_frame_pack_wrong_packet_too_long_error,

          &hf_frame_pack_wrong_packet_too_short_error,

          &hf_frame_pack_wrong_inter_frame_gap_error,

          &hf_frame_pack_unaligned_frame_error,

          &hf_frame_pack_start_frame_delimiter_error,

          &hf_frame_pack_preamble_error,

          &hf_frame_pack_symbol_error,

          NULL

        };

        flags_item = proto_tree_add_uint(fh_tree, hf_frame_pack_flags, tvb, 0, 0, pack_flags);

        flags_tree = proto_item_add_subtree(flags_item, ett_flags);

        proto_tree_add_bitmask_list_value(flags_tree, tvb, 0, 0, flags, pack_flags);

      }

      if (WTAP_OPTTYPE_SUCCESS == wtap_block_get_uint64_option_value(fr_data->pkt_block, OPT_PKT_PACKETID, &packetid)) {

        proto_tree_add_uint64(fh_tree, hf_frame_packet_id, tvb, 0, 0, packetid);

      }

      if (wtap_block_count_option(fr_data->pkt_block, OPT_PKT_VERDICT) > 0) {

        proto_tree *verdict_tree;

        proto_item *verdict_item;

        verdict_item = proto_tree_add_string(fh_tree, hf_frame_verdict, tvb, 0, 0, "");

        verdict_tree = proto_item_add_subtree(verdict_item, ett_verdict);

        fr_user_data.item = verdict_item;

        fr_user_data.tree = verdict_tree;

        fr_user_data.pinfo = pinfo;

        fr_user_data.tvb = tvb;

        fr_user_data.n_changes = 0;

        wtap_block_foreach_option(pinfo->rec->block, frame_add_verdict, (void *)&fr_user_data);

      }

      proto_tree_add_int(fh_tree, hf_frame_wtap_encap, tvb, 0, 0, pinfo->rec->rec_header.packet_header.pkt_encap);

    }

  }

  if (pinfo->presence_flags & PINFO_HAS_TS) {

    if (do_frame_dissection) {

      proto_tree_add_time(fh_tree, hf_frame_arrival_time_local, tvb, 0, 0, &pinfo->abs_ts);

      proto_tree_add_time(fh_tree, hf_frame_arrival_time_utc, tvb, 0, 0, &pinfo->abs_ts);

      proto_tree_add_time(fh_tree, hf_frame_arrival_time_epoch, tvb, 0, 0, &pinfo->abs_ts);

    }

    if (pinfo->abs_ts.nsecs < 0 || pinfo->abs_ts.nsecs >= 1000000000) {

      expert_add_info_format(pinfo, ti, &ei_arrive_time_out_of_range,

                "Arrival Time: Fractional second %09ld is invalid,"

                " the valid range is 0-999999999",

                (long) pinfo->abs_ts.nsecs);

    }

    if (do_frame_dissection) {

      item = proto_tree_add_time(fh_tree, hf_frame_shift_offset, tvb,

              0, 0, &(pinfo->fd->shift_offset));

      proto_item_set_generated(item);

      if (proto_field_is_referenced(tree, hf_frame_time_delta)) {

        nstime_t     del_cap_ts;

        if (frame_delta_time_prev_captured(pinfo->epan, pinfo->fd, &del_cap_ts)) {

          item = proto_tree_add_time(fh_tree, hf_frame_time_delta, tvb,

                   0, 0, &(del_cap_ts));

          proto_item_set_generated(item);

        }

      }

      if (proto_field_is_referenced(tree, hf_frame_time_delta_displayed)) {

        nstime_t del_dis_ts;

        if (frame_delta_time_prev_displayed(pinfo->epan, pinfo->fd, &del_dis_ts)) {

          item = proto_tree_add_time(fh_tree, hf_frame_time_delta_displayed, tvb,

                   0, 0, &(del_dis_ts));

          proto_item_set_generated(item);

        }

      }

      if (frame_rel_time(pinfo->epan, pinfo->fd, &rel_ts)) {

        item = proto_tree_add_time(fh_tree, hf_frame_time_relative, tvb,

                 0, 0, &(rel_ts));

        proto_item_set_generated(item);

      }

      if (frame_rel_start_time(pinfo->epan, pinfo->fd, &rel_ts)) {

        item = proto_tree_add_time(fh_tree, hf_frame_time_relative_cap, tvb,

                 0, 0, &(rel_ts));

        proto_item_set_generated(item);

      }

      if (pinfo->fd->ref_time) {

        ti = proto_tree_add_item(fh_tree, hf_frame_time_reference, tvb, 0, 0, ENC_NA);

        proto_item_set_generated(ti);

      }

    }

  }

  if (do_frame_dissection) {

    proto_tree_add_uint(fh_tree, hf_frame_number, tvb,

            0, 0, pinfo->num);

    item = proto_tree_add_uint_format_value(fh_tree, hf_frame_len, tvb,

              0, 0, frame_len, "%u byte%s (%u bits)",

              frame_len, frame_plurality, frame_len * 8);

  } else {

    item = NULL;

  }

  if (frame_len < cap_len) {

    /*

     * A reported length less than a captured length

     * is bogus, as you cannot capture more data

     * than there is in a packet.

     */

    expert_add_info(pinfo, item, &ei_len_lt_caplen);

  }

  if (do_frame_dissection) {

    proto_tree_add_uint_format_value(fh_tree, hf_frame_capture_len, tvb,

             0, 0, cap_len, "%u byte%s (%u bits)",

             cap_len, cap_plurality, cap_len * 8);

    if (pinfo->rec->rec_type == REC_TYPE_PACKET) {

      if (WTAP_OPTTYPE_SUCCESS == wtap_block_get_uint64_option_value(fr_data->pkt_block, OPT_PKT_DROPCOUNT, &drop_count)) {

        proto_tree_add_uint64(fh_tree, hf_frame_drop_count, tvb, 0, 0, drop_count);

      }

    }

    if (generate_md5_hash) {

      const uint8_t *cp;

      uint8_t       digest[HASH_MD5_LENGTH];

      const char   *digest_string;

      cp = tvb_get_ptr(tvb, 0, cap_len);

      gcry_md_hash_buffer(GCRY_MD_MD5, digest, cp, cap_len);

      digest_string = bytes_to_str_punct(pinfo->pool, digest, HASH_MD5_LENGTH, '\0');

      ti = proto_tree_add_string(fh_tree, hf_frame_md5_hash, tvb, 0, 0, digest_string);

      proto_item_set_generated(ti);

    }

    ti = proto_tree_add_boolean(fh_tree, hf_frame_marked, tvb, 0, 0, pinfo->fd->marked);

    proto_item_set_generated(ti);