/* packet-ns-mep.c

 * Routines for netscaler GSLB metric exchange protocol dissection

 * Copyright 2006, Ravi Kondamuru <Ravi.Kondamuru@citrix.com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/to_str.h>

#include <epan/unit_strings.h>

#include <wsutil/array.h>

#include "packet-tcp.h"

void proto_register_ns_mep(void);

void proto_reg_handoff_ns_mep(void);

static dissector_handle_t nsmep_handle;

static int proto_ns_mep;

static int ett_nsmep;

static int ett_nsmep_mfu;

static int ett_nsmep_nwu;

static int hf_nsmep_majver;

static int hf_nsmep_minver;

static int hf_nsmep_msgtype;

static int hf_nsmep_msglen;

static int hf_nsmep_errcode;

static int hf_nsmep_mfu_state;

static int hf_ns_metricUpdate;

static int hf_ns_forceUpdateRequest;

static int hf_ns_forceUpdateResp;

static int hf_ns_currentOpenConn;

static int hf_ns_currentSurgeCount;

static int hf_ns_currentIOHCount;

static int hf_ns_currentReusePool;

static int hf_ns_currentServerConn;

static int hf_ns_currentClientConn;

static int hf_ns_TotalReq;

static int hf_ns_TotalReqBytes;

static int hf_ns_TotalResp;

static int hf_ns_TotalRespBytes;

static int hf_ns_networkMetrics;

static int hf_ns_roundTripTime;

static int hf_ns_hops;

static int hf_ns_persistenceInfo;

static int hf_ns_persistenceGslbServIp;

static int hf_ns_persistenceGslbServPort;

static int hf_ns_persistenceId;

static int hf_ns_sitePersistenceDom;

static int hf_ns_gslbDomNamelen;

static int hf_ns_gslbServPreflen;

static int hf_ns_gslbCookieDomNamelen;

static int hf_ns_gslbCookieTimeout;

static int hf_ns_gslbVidlen;

static int hf_ns_gslbFlags;

static int hf_ns_gslbCookieDomName;

static int hf_ns_gslbVs;

static int hf_ns_gslbPrefix;

static int hf_ns_sitePersistenceFlushDom;

static int hf_ns_gslbDomName;

static int hf_ns_sitePersistenceFlushServ;

static int hf_ns_sitePersisGetServReq;

static int hf_ns_siteDomTTL;

static int hf_ns_sitePersistenceGetServResp;

static int hf_nsmep_mfu_ip;

static int hf_nsmep_mfu_port;

static int hf_nsmep_mfu_svctype;

static int hf_nsmep_mfu_eff_state;

static int hf_nsmep_mfu_mepflag;

static int hf_nsmep_mfu_reqflag;

static int hf_nsmep_adv_ip;

static int hf_nsmep_ldns_ip;

static int hf_nsmep_site_persistence;

static dissector_handle_t nsrpc_handle;

/*GSLB MEP message types */

#define nslist_gslbmessage_VALUE_STRING_LIST(V) \

  V(GSLB_MSG_NONE, 0, "NONE")\

  V(GSLB_MSG_SITE_METRIC_UPDATE, 1, "SITE METRIC UPDATE") \

  V(GSLB_MSG_SITE_METRIC_FORCE_REQ, 2, "SITE METRIC FORCE REQ")\

  V(GSLB_MSG_SITE_ADV_IP_ADDR, 3, "SITE ADV IP ADDR")\

  V(GSLB_MSG_SITE_ADV_IP_ACK, 4, "SITE ADV IP ACK")\

  V(GSLB_MSG_SITE_ADV_IP_NACK, 5, "SITE ADV IP NACK")\

  V(GSLB_MSG_SITE_METRIC_FORCE_UPDATE, 6, "SITE METRIC FORCE UPDATE")\

  V(GSLB_MSG_NETW_METRIC_UPDATE, 7, "NETWORK METRIC UPDATE")\

  V(GSLB_MSG_PERSIST_RECORD, 8, "PERSIST RECORD")\

  V(GSLB_MSG_KEEP_ALIVE, 9, "KEEP ALIVE")\

  V(GSLB_MSG_CNAME_PERSIST_RECORD, 10, "CNAME PERSIST RECORD")\

  V(GSLB_MSG_LBNODE_DOM_INFO, 11, "DOMAIN INFO")\

  V(GSLB_MSG_LBNODE_SITE_INFO, 12, "SITE INFO")\

  V(GSLB_MSG_LBNODE_FLUSH_SVC_INFO, 13, "FLUSH SVC")\

  V(GSLB_MSG_LBNODE_FLUSH_DOM_INFO, 14, "FLUSH DOMAIN")\

  V(GSLB_MSG_LBNODE_GETSVC, 15, "GET SVC")\

  V(GSLB_MSG_LBNODE_GETSVC_RESP, 16, "GET SVC RESP")\

VALUE_STRING_ENUM(nslist_gslbmessage);

VALUE_STRING_ARRAY(nslist_gslbmessage);

static const value_string ns_entity_state_vals[] = {

  { 0x01, "SERVER_STATE_DOWN" },

  { 0x02, "SERVER_STATE_UNKNOWN" },

  { 0x03, "SERVER_STATE_BUSY" },

  { 0x04, "SERVER_STATE_OFS" },

  { 0x05, "SERVER_STATE_TROFS" },

  { 0x07, "SERVER_STATE_UP" },

  { 0x08, "SERVER_STATE_TROFS_DOWN" },

  { 0,        NULL }

};

static const value_string ns_svc_type_vals[] = {

  { 0x00, "NSSVC_HTTP"},

  { 0x01, "NSSVC_FTP"},

  { 0x02, "NSSVC_TCP"},

  { 0x03, "NSSVC_UDP"},

  { 0x04, "NSSVC_SSL_BRIDGE"},

  { 0x05, "NSSVC_MONITOR"},

  { 0x06, "NSSVC_MONITOR_UDP"},

  { 0x07, "NSSVC_NNTP"},

  { 0x08, "NSSVC_HTTPSVR"},

  { 0x09, "NSSVC_HTTPCLNT"},

  { 0x0a, "NSSVC_RPCSVR"},

  { 0x0b, "NSSVC_RPCCLNT"},

  { 0x0c, "NSSVC_NAT"},

  { 0x0d, "NSSVC_ANY"},

  { 0x0e, "NSSVC_SSL"},

  { 0x0f, "NSSVC_DNS"},

  { 0x10, "NSSVC_ADNS"},

  { 0x11, "NSSVC_SNMP"},

  { 0x12, "NSSVC_HA"},

  { 0x13, "NSSVC_MONITOR_PING"},

  { 0x14, "NSSVC_SSL_TCP"},

  { 0x15, "NSSVC_AAA"},

  { 0x16, "NSSVC_SINCTCP"},

  { 0x17, "NSSVC_VPN_AFTP"},

  { 0x18, "NSSVC_MONITORS"},

  { 0x19, "NSSVC_SSLVPNUDP"},

  { 0x1a, "NSSVC_SINCUDP"},

  { 0x1b, "NSSVC_RIP"},

  { 0x1c, "NSSVC_DNSCLT"},

  { 0x1d, "NSSVC_SASP"},

  { 0x1e, "NSSVC_RPCSVRS"},

  { 0x1f, "NSSVC_RPCCLNTS"},

  { 0x20, "NSSVC_WINS_RESOLVER"},

  { 0x21, "NSSVC_DHCPRA"},

  { 0x22, "NSSVC_ROUTE"},

  { 0x23, "NSSVC_AUDIT"},

  { 0x24, "NSSVC_SIP_UDP"},

  { 0x25, "NSSVC_STA_HTTP"},

  { 0x26, "NSSVC_STA_SSL"},

  { 0x27, "NSSVC_DNS_RESOLV"},

  { 0x28, "NSSVC_RTSP"},

  { 0, NULL }

};

static const value_string ns_rpc_errcode_vals[] = {

  { 0x000, "SUCCESS" },

  { 0x101, "PERM ERR" },

  { 0x10C, "NO MEM" },

  { 0x135, "CONN ABORTED" },

  { 0x150, "AUTH ERR" },

  { 0x153, "NOCODE" },

  { 0x154, "NOT SUPERUSER" },

  { 0x155, "LARGE DATA"},

  { 0x156, "SMALL DATA" },

  { 0x160, "LOGIN REQD" },

  { 0x161, "INVALID ARG" },

  { 0x162, "INVALID USER/ PASSWD" },

  { 0x163, "INVALID USER/ PASSWD" },

  { 0x413, "INTERNAL ERR" },

  { 0x6FF, "DH REQ" },

  { 0, NULL }

};

static const value_string value_site_persistence[] = {

  { 0x00, "NONE"},

  { 0x01, "CONN-PROXY"},

  { 0x02, "HTTP-REDIRECT"},

  { 0, NULL}

};

#define GSLIB_EXCHANGE_DATA_SIZE    72

#define GSLB_FORCE_VIP_SIZE         12

#define GSLIB_NET_MET_TABLE_SIZE    8

#define NS_PERSIST_INFO_SIZE            12

#define NS_GSLB_DOM_INFO_MIN_SIZE       23

#define NS_GSLB_FLUSH_DOM_INFO_MIN_SIZE 9

#define Ns_GSLB_MSG_SITE_METRIC_UPDATE_SIZE 16

/* XXX - for informational purposes only */

typedef struct nsgslb_dom_info {

  uint32_t public_ip;

  uint16_t  public_port;

  uint16_t protocol;

  uint8_t domainlen;

  uint8_t prefixlen;

  uint8_t cookiedomlen;

  uint8_t site_persistence;

  uint8_t cookietimeout;

  uint8_t vidlen;

  uint8_t flags;

  uint16_t reserved;

}nsgslb_dom_info_t;

/*gslb domain info flag values */

#define NSGSLB_DOMINFO_DOGSLB 0x01

#define NSGSLB_DOMINFO_REDIRECT 0x02

#define NSGSLB_DOMINFO_FLUSH_ALL_GSLBINFO 0x4

static void

dissect_ns_mep_v02xx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)

{

  uint32_t maj_ver, min_ver, mesgtype, mesglen, errcode;

  uint32_t public_port, svctype, domainlen;

  proto_item *ti;

  proto_tree *ns_mep_tree;

  int offset = 0, start_offset;

  char* version_str;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NS-MEP");

  col_clear(pinfo->cinfo, COL_INFO);

  ti = proto_tree_add_item(tree, proto_ns_mep, tvb, 0, -1, ENC_NA);

  ns_mep_tree = proto_item_add_subtree(ti, ett_nsmep);

  proto_tree_add_item_ret_uint(ns_mep_tree, hf_nsmep_majver, tvb, offset, 1, ENC_LITTLE_ENDIAN, &maj_ver);

  offset +=1;

  proto_tree_add_item_ret_uint(ns_mep_tree, hf_nsmep_minver, tvb, offset, 1, ENC_LITTLE_ENDIAN, &min_ver);

  offset +=1;

  proto_tree_add_item_ret_uint(ns_mep_tree, hf_nsmep_msgtype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &mesgtype);

  offset +=2;

  version_str = wmem_strdup_printf(pinfo->pool, "v%d.%d %s", maj_ver, min_ver, val_to_str(pinfo->pool, mesgtype, nslist_gslbmessage, "Unknown Mesg Type:  0x%02X"));

  proto_item_append_text(ti, ", %s", version_str);

  proto_tree_add_item_ret_uint(ns_mep_tree, hf_nsmep_msglen, tvb, offset, 2, ENC_LITTLE_ENDIAN, &mesglen);

  offset +=2;

  proto_tree_add_item_ret_uint(ns_mep_tree, hf_nsmep_errcode, tvb, offset, 2, ENC_LITTLE_ENDIAN, &errcode);

  offset +=2;

  col_add_fstr(pinfo->cinfo, COL_INFO, "Mesg: %s; Len: %d", version_str, mesglen);

  switch (mesgtype)

  {

  case GSLB_MSG_SITE_METRIC_UPDATE:

  {

    proto_item *tf;

    proto_tree *ns_mep_mfu_tree;

    while (tvb_reported_length_remaining(tvb, offset) >= Ns_GSLB_MSG_SITE_METRIC_UPDATE_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_metricUpdate, tvb, offset, Ns_GSLB_MSG_SITE_METRIC_UPDATE_SIZE, ENC_NA);

      ns_mep_mfu_tree = proto_item_add_subtree(tf, ett_nsmep_mfu);

      /* proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_cmd, tvb, offset, 2, ENC_LITTLE_ENDIAN); */

      offset +=2;

      proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_state, tvb, offset, 2, ENC_LITTLE_ENDIAN);

      offset +=2;

      proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset +=4;

      proto_tree_add_item_ret_uint(ns_mep_mfu_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

      offset +=2;

      proto_tree_add_item_ret_uint(ns_mep_mfu_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

      offset +=2;

      proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

      if ((maj_ver > 2) || ((maj_ver==2) && (min_ver > 2)))

      {

        proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_eff_state, tvb, offset, 1, ENC_LITTLE_ENDIAN);

        offset +=1;

        proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_mepflag, tvb, offset, 1, ENC_LITTLE_ENDIAN);

        offset +=1;

        offset +=2;

      } else

      {

        offset +=4;

      }

    }

  }

  break;

  case GSLB_MSG_SITE_METRIC_FORCE_REQ:

  {

    proto_item *tf;

    proto_tree *ns_mep_mfr_tree;

    while (tvb_reported_length_remaining(tvb, offset) >= GSLB_FORCE_VIP_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_forceUpdateRequest, tvb, offset, GSLB_FORCE_VIP_SIZE, ENC_NA);

      ns_mep_mfr_tree = proto_item_add_subtree(tf, ett_nsmep_mfu);

      proto_tree_add_item(ns_mep_mfr_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset +=4;

      proto_tree_add_item_ret_uint(ns_mep_mfr_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

      offset +=2;

      proto_tree_add_item_ret_uint(ns_mep_mfr_tree, hf_nsmep_mfu_svctype, tvb, offset, 4, ENC_LITTLE_ENDIAN, &svctype);

      offset +=4;

      proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

      if ((maj_ver > 2) || ((maj_ver==2) && (min_ver > 2)))

      {

        proto_tree_add_item(ns_mep_mfr_tree, hf_nsmep_mfu_reqflag, tvb, offset, 1, ENC_LITTLE_ENDIAN);

        offset +=1;

        offset +=1;

      } else

      {

        offset +=2;

      }

    }

  }

  break;

  case GSLB_MSG_SITE_ADV_IP_ADDR:

    proto_tree_add_item(ns_mep_tree, hf_nsmep_adv_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

    break;

  case GSLB_MSG_SITE_ADV_IP_ACK:

    break;

  case GSLB_MSG_SITE_ADV_IP_NACK:

    break;

  case GSLB_MSG_SITE_METRIC_FORCE_UPDATE:

  {

    proto_item *tf;

    proto_tree *ns_mep_mfu_tree;

    while (tvb_reported_length_remaining(tvb, offset) >= GSLIB_EXCHANGE_DATA_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_forceUpdateResp, tvb, offset, GSLIB_EXCHANGE_DATA_SIZE, ENC_NA);

      ns_mep_mfu_tree = proto_item_add_subtree(tf, ett_nsmep_mfu);

      /* proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_cmd, tvb, offset, 2, ENC_LITTLE_ENDIAN); */

      offset +=2;

      proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_state, tvb, offset, 2, ENC_LITTLE_ENDIAN);

      offset +=2;

      proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset +=4;

      proto_tree_add_item_ret_uint(ns_mep_mfu_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

      offset +=2;

      proto_tree_add_item_ret_uint(ns_mep_mfu_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

      offset +=2;

      proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

      if ((maj_ver > 2) || ((maj_ver==2) && (min_ver > 2)))

      {

        proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_eff_state, tvb, offset, 1, ENC_LITTLE_ENDIAN);

        offset +=1;

        proto_tree_add_item(ns_mep_mfu_tree, hf_nsmep_mfu_mepflag, tvb, offset, 1, ENC_LITTLE_ENDIAN);

        offset +=1;

        offset +=2;

      } else

      {

        offset +=4;

      }

      /* All the counters */

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_currentOpenConn, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_currentSurgeCount, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_currentIOHCount, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_currentReusePool, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_currentServerConn, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_currentClientConn, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_TotalReq, tvb, offset, 8, ENC_LITTLE_ENDIAN);

      offset += 8;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_TotalReqBytes, tvb, offset, 8, ENC_LITTLE_ENDIAN);

      offset += 8;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_TotalResp, tvb, offset, 8, ENC_LITTLE_ENDIAN);

      offset += 8;

      proto_tree_add_item(ns_mep_mfu_tree, hf_ns_TotalRespBytes, tvb, offset, 8, ENC_LITTLE_ENDIAN);

      offset += 8;

    }

  }

  break;

  case GSLB_MSG_NETW_METRIC_UPDATE:

  {

    proto_item *tf;

    proto_tree *ns_mep_nwu_tree;

    while (tvb_reported_length_remaining(tvb, offset) >= GSLIB_NET_MET_TABLE_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_networkMetrics, tvb, offset, GSLIB_NET_MET_TABLE_SIZE, ENC_NA);

      proto_item_append_text(tf, " of %s", tvb_address_to_str(pinfo->pool, tvb, AT_IPv4, offset));

      ns_mep_nwu_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

      proto_tree_add_item(ns_mep_nwu_tree, hf_nsmep_ldns_ip, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_tree, hf_ns_roundTripTime, tvb, offset, 2, ENC_LITTLE_ENDIAN);

      offset += 2;

      proto_tree_add_item(ns_mep_tree, hf_ns_hops, tvb, offset, 1, ENC_LITTLE_ENDIAN);

      offset += 1;

      offset += 1;

    }

  }

  break;

  case GSLB_MSG_PERSIST_RECORD:

  {

    proto_item *tf;

    proto_tree *ns_mep_pr_tree;

    while (tvb_reported_length_remaining(tvb, offset) >= NS_PERSIST_INFO_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_persistenceInfo, tvb, offset, NS_PERSIST_INFO_SIZE, ENC_NA);

      proto_item_append_text(tf, " %s", tvb_address_to_str(pinfo->pool, tvb, AT_IPv4, offset));

      ns_mep_pr_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

      proto_tree_add_item(ns_mep_pr_tree, hf_nsmep_ldns_ip, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset +=4;

      proto_tree_add_item(ns_mep_tree, hf_ns_persistenceGslbServIp, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset += 4;

      proto_tree_add_item(ns_mep_tree, hf_ns_persistenceGslbServPort, tvb, offset, 2, ENC_LITTLE_ENDIAN);

      offset += 2;

      proto_tree_add_item(ns_mep_tree, hf_ns_persistenceId, tvb, offset, 2, ENC_LITTLE_ENDIAN);

      offset += 2;

    }

  }

  break;

  case GSLB_MSG_LBNODE_DOM_INFO:

  {

    proto_item *tf;

    proto_tree *ns_mep_di_tree;

    uint32_t prefixlen, cookiedomlen, flags, vidlen;

    while (tvb_reported_length_remaining(tvb, offset) >= NS_GSLB_DOM_INFO_MIN_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_sitePersistenceDom, tvb, offset, NS_GSLB_DOM_INFO_MIN_SIZE, ENC_NA);

      ns_mep_di_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

      start_offset = offset;

      proto_tree_add_item(ns_mep_di_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset += 4;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

      offset += 2;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

      offset += 2;

      proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbDomNamelen, tvb, offset, 1, ENC_LITTLE_ENDIAN, &domainlen);

      offset += 1;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbServPreflen, tvb, offset, 1, ENC_LITTLE_ENDIAN, &prefixlen);

      offset += 1;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbCookieDomNamelen, tvb, offset, 1, ENC_LITTLE_ENDIAN, &cookiedomlen);

      offset += 1;

      proto_tree_add_item(ns_mep_di_tree, hf_nsmep_site_persistence, tvb, offset, 1, ENC_LITTLE_ENDIAN);

      offset += 1;

      proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbCookieTimeout, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      offset += 4;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbVidlen, tvb, offset, 4, ENC_LITTLE_ENDIAN, &vidlen);

      offset += 4;

      tf = proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbFlags, tvb, offset, 1, ENC_LITTLE_ENDIAN, &flags);

      if (flags == NSGSLB_DOMINFO_FLUSH_ALL_GSLBINFO)

      {

        proto_item_append_text(tf, "Flush all gslb information");

      }

      else if (flags)

      {

        proto_item_append_text(tf, "Undefined");

      }

      offset += 1;

      offset += 2; /* Skip reserved */

      proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbDomName, tvb, offset, domainlen, ENC_ASCII);

      offset += domainlen;

      if (cookiedomlen)

      {

        proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbCookieDomName, tvb, offset, cookiedomlen, ENC_ASCII);

        offset += cookiedomlen;

      }

      proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbVs, tvb, offset, vidlen, ENC_ASCII);

      offset += vidlen;

      if (prefixlen)

      {

        proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbPrefix, tvb, offset, prefixlen, ENC_ASCII);

        offset += prefixlen;

      }

      proto_item_set_len(tf, offset-start_offset);

    }

    break;

  }

  case GSLB_MSG_LBNODE_FLUSH_DOM_INFO:

  {

    proto_item *tf;

    proto_tree *ns_mep_di_tree;

    while (tvb_reported_length_remaining(tvb, offset) >= NS_GSLB_FLUSH_DOM_INFO_MIN_SIZE)

    {

      tf = proto_tree_add_item(ns_mep_tree, hf_ns_sitePersistenceFlushDom, tvb, offset, 9, ENC_NA);

      ns_mep_di_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

      start_offset = offset;

      proto_tree_add_item(ns_mep_di_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset += 4;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

      offset += 2;

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

      offset += 2;

      proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

      proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbDomNamelen, tvb, offset, 1, ENC_LITTLE_ENDIAN, &domainlen);

      offset += 1;

      proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbDomName, tvb, offset, domainlen, ENC_ASCII);

      offset += domainlen;

      proto_item_set_len(tf, offset-start_offset);

      /* XXX - Do we really have a full domain info message here? */

    }

    break;

  }

  case GSLB_MSG_LBNODE_FLUSH_SVC_INFO:

  {

    proto_item *tf;

    proto_tree *ns_mep_di_tree;

    tf = proto_tree_add_item(ns_mep_tree, hf_ns_sitePersistenceFlushServ, tvb, offset, 8, ENC_NA);

    ns_mep_di_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

    proto_tree_add_item(ns_mep_di_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

    offset += 2;

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

    offset += 2;

    proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

    break;

  }

  case GSLB_MSG_LBNODE_GETSVC:

  {

    proto_item *tf;

    proto_tree *ns_mep_di_tree;

    tf = proto_tree_add_item(ns_mep_tree, hf_ns_sitePersisGetServReq, tvb, offset, 9, ENC_NA);

    ns_mep_di_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

    start_offset = offset;

    proto_tree_add_item(ns_mep_di_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

    offset += 2;

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

    offset += 2;

    proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbDomNamelen, tvb, offset, 1, ENC_LITTLE_ENDIAN, &domainlen);

    offset += 1;

    proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbDomName, tvb, offset, domainlen, ENC_ASCII);

    offset += domainlen;

    proto_item_set_len(tf, start_offset - offset);

    /* XXX - Do we really have a full domain info message here? */

    break;

  }

  case GSLB_MSG_LBNODE_GETSVC_RESP:

  {

    proto_item *tf;

    proto_tree *ns_mep_di_tree;

    tf = proto_tree_add_item(ns_mep_tree, hf_ns_sitePersistenceGetServResp, tvb, offset, 9, ENC_NA);

    ns_mep_di_tree = proto_item_add_subtree(tf, ett_nsmep_nwu);

    start_offset = offset;

    proto_tree_add_item(ns_mep_di_tree, hf_nsmep_mfu_ip, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_port, tvb, offset, 2, ENC_BIG_ENDIAN, &public_port);

    offset += 2;

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_nsmep_mfu_svctype, tvb, offset, 2, ENC_LITTLE_ENDIAN, &svctype);

    offset += 2;

    proto_item_append_text(tf, " for %s:%d:%s", tvb_address_to_str(pinfo->pool, tvb, FT_IPv4, offset-8), public_port, val_to_str(pinfo->pool, svctype, ns_svc_type_vals, "0x%02X"));

    proto_tree_add_item_ret_uint(ns_mep_di_tree, hf_ns_gslbDomNamelen, tvb, offset, 1, ENC_LITTLE_ENDIAN, &domainlen);

    offset += 1;

    proto_tree_add_item(ns_mep_di_tree, hf_ns_siteDomTTL, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    offset += 4;

    proto_tree_add_item(ns_mep_di_tree, hf_ns_gslbDomName, tvb, offset, domainlen, ENC_ASCII);

    offset += domainlen;

    proto_item_set_len(tf, start_offset - offset);

    break;

  }

  case GSLB_MSG_KEEP_ALIVE:

  default:

    break;

  }

}

static int

dissect_ns_mep_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  uint16_t ver;

  uint8_t maj_ver, min_ver;

  ver = tvb_get_letohs(tvb, 0);

  maj_ver = tvb_get_uint8(tvb, 0);

  min_ver = tvb_get_uint8(tvb, 1);

  switch(ver)

  {

  case 0x0001:

  case 0x0102:

  case 0x0202:

  case 0x0302:

  case 0x0402:

  case 0x0502:

  case 0x0602:

    dissect_ns_mep_v02xx(tvb, pinfo, tree);

    return tvb_captured_length(tvb);

  default:

    /* It is netscaler mep packet of unknown mep version. */

    col_set_str(pinfo->cinfo, COL_PROTOCOL, "NS-MEP");

    col_clear(pinfo->cinfo, COL_INFO);

    col_add_fstr(pinfo->cinfo, COL_INFO, "The v%d.%d MEP Dissector unavailable", maj_ver, min_ver);

    break;

  }

  return tvb_captured_length(tvb);

}

static unsigned

get_ns_mep_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)

{

  /* Get the length of the data from the header. */

  return tvb_get_letohs(tvb, offset + 4);

}

static int

dissect_ns_mep(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  uint16_t ns_rpc_sig;

  if (tvb_reported_length(tvb) >= 6)

  {

    /* Get the signature */

    ns_rpc_sig = tvb_get_letohs(tvb, 4);

    if (ns_rpc_sig == 0xA5A5)

    {

      /* If the signature is present, it is a netscaler-rpc connection. call

      the nsrpc dissector.  */

      call_dissector(nsrpc_handle, tvb, pinfo, tree);

      return tvb_captured_length(tvb);

    }

  }

  tcp_dissect_pdus(tvb, pinfo, tree, true, 6, get_ns_mep_pdu_len, dissect_ns_mep_pdu, data);

  return tvb_captured_length(tvb);

}

void

proto_register_ns_mep(void)

{

  static hf_register_info hf_nsmep[] = {

    { &hf_nsmep_majver,

      { "Major Version", "nstrace.mep.maj", FT_UINT8, BASE_DEC, NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_minver,

      { "Minor Version", "nstrace.mep.min", FT_UINT8, BASE_DEC, NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_msgtype,

      { "Message Type", "nstrace.mep.type", FT_UINT16, BASE_HEX,  VALS(nslist_gslbmessage), 0x0,

      NULL, HFILL }},

    { &hf_nsmep_msglen,

      { "Message Length", "nstrace.mep.len", FT_UINT16, BASE_DEC,  NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_errcode,

      { "Status Code", "nstrace.mep.errcode", FT_UINT16, BASE_HEX, VALS(ns_rpc_errcode_vals), 0x0,

      NULL, HFILL }},

    //added newly

    { &hf_ns_metricUpdate,

      { "Metric Update", "nstrace.mep.mfu.metricUpdate", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_forceUpdateRequest,

      { "Force Update Request", "nstrace.mep.mfu.forceUpdateRequest", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_forceUpdateResp,

      { "Force Update Response", "nstrace.mep.mfu.mep_mfu_force_update", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_currentOpenConn,

      { "Current Open Estd Conn", "nstrace.mep.mfu.currentOpenConn", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_currentSurgeCount,

      { "Current Surge Count", "nstrace.mep.mfu.currentSurgeCount", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_currentIOHCount,

      { "Current IOH Count", "nstrace.mep.mfu.currentIOHCount", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_currentReusePool,

      { "Current Reuse pool", "nstrace.mep.mfu.currentReusePool", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_currentServerConn,

      { "Current Server Conn", "nstrace.mep.mfu.currentServerConn", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_currentClientConn,

      { "Current Client Conn", "nstrace.mep.mfu.currentClientConn", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_TotalReq,

      { "Total Requests", "nstrace.mep.mfu.TotalReq", FT_UINT64, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_TotalReqBytes,

      { "Total Requests Bytes", "nstrace.mep.mfu.TotalReqBytes", FT_UINT64, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_TotalResp,

      { "Total Responses", "nstrace.mep.mfu.TotalResp", FT_UINT64, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_TotalRespBytes,

      { "Total Responses Bytes", "nstrace.mep.mfu.TotalRespBytes", FT_UINT64, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_networkMetrics,

      { "Network Metrics", "nstrace.mep.mfu.networkMetrics", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_roundTripTime,

      { "Round Trip Time", "nstrace.mep.mfu.roundTripTime", FT_UINT16, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,

      NULL, HFILL } },

    { &hf_ns_hops,

      { "Hops", "nstrace.mep.mfu.hops", FT_UINT8, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_persistenceInfo,

      { "Persistence Info for LDNS IP", "nstrace.mep.mfu.persistenceInfo", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_persistenceGslbServIp,

      { "Persistence GSLB Service IP", "nstrace.mep.mfu.persistenceGslbServIp", FT_IPv4, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_persistenceGslbServPort,

      { "Persistence GSLB Service Port", "nstrace.mep.mfu.persistenceGslbServPort", FT_UINT16, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_persistenceId,

      { "Persistence Id", "nstrace.mep.mfu.persistenceId", FT_UINT16, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_sitePersistenceDom,

      { "Site persistence Domain Info", "nstrace.mep.mfu.sitePersistenceDom", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbDomNamelen,

      { "GSLB Domain Name length", "nstrace.mep.mfu.gslbDomNamelen", FT_UINT8, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbServPreflen,

      { "GSLB Service Prefix length", "nstrace.mep.mfu.gslbServPreflen", FT_UINT8, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbCookieDomNamelen,

      { "GSLB Cookie domain name length", "nstrace.mep.mfu.gslbCookieDomNamelen", FT_UINT8, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbCookieTimeout,

      { "GSLB cookie timeout", "nstrace.mep.mfu.gslbCookieTimeout", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbVidlen,

      { "GSLB vserver ID length", "nstrace.mep.mfu.gslbVidlen", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbFlags,

      { "Flags", "nstrace.mep.mfu.flags", FT_UINT8, BASE_HEX, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbCookieDomName,

      { "GSLB Cookie Domain Name", "nstrace.mep.mfu.gslbCookieDomName", FT_STRING, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbVs,

      { "GSLB Vserver ID", "nstrace.mep.mfu.gslbVs", FT_STRING, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbPrefix,

      { "GSLB service prefix", "nstrace.mep.mfu.gslbPrefix", FT_STRING, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_sitePersistenceFlushDom,

      { "Site persistence Flush Domain Info", "nstrace.mep.mfu.sitePersistenceFlushDom", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_gslbDomName,

      { "GSLB Domain Name", "nstrace.mep.mfu.gslbDomName", FT_STRING, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_sitePersistenceFlushServ,

      { "Site persistence Flush Service", "nstrace.mep.mfu.sitePersistenceFlushServ", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_sitePersisGetServReq,

      { "Site persistence Get Service request", "nstrace.mep.mfu.sitePersisGetServReq", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_sitePersistenceGetServResp,

      { "Site persistence Get Service response", "nstrace.mep.mfu.sitePersistenceGetServResp", FT_NONE, BASE_NONE, NULL, 0x0,

      NULL, HFILL } },

    { &hf_ns_siteDomTTL,

      { "Site Domain TTL", "nstrace.mep.mfu.siteDomTTL", FT_UINT32, BASE_DEC, NULL, 0x0,

      NULL, HFILL } },

    { &hf_nsmep_mfu_state,

      { "Service State", "nstrace.mep.mfu.state", FT_UINT16, BASE_HEX, VALS(ns_entity_state_vals), 0x0,

      NULL, HFILL }},

    { &hf_nsmep_mfu_eff_state,

      { "Service Effective State", "nstrace.mep.mfu.effstate", FT_UINT8, BASE_HEX, VALS(ns_entity_state_vals), 0x0,

      NULL, HFILL }},

    { &hf_nsmep_mfu_mepflag,

      { "MEP Flags", "nstrace.mep.mfu.mepflag", FT_UINT8, BASE_HEX, NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_mfu_ip,

      { "Service IP Address", "nstrace.mep.mfu.ip", FT_IPv4, BASE_NONE,  NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_mfu_port,

      { "Service Port", "nstrace.mep.mfu.port", FT_UINT16, BASE_DEC_HEX,  NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_mfu_svctype,

      { "Service Type", "nstrace.mep.mfu.svctype", FT_UINT32, BASE_HEX, VALS(ns_svc_type_vals), 0x0,

      NULL, HFILL }},

    { &hf_nsmep_mfu_reqflag,

      { "Request Flags", "nstrace.mep.mfu.reqflag", FT_UINT8, BASE_HEX, NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_adv_ip,

      { "Advertise Local IP Address", "nstrace.mep.adv.ip", FT_IPv4, BASE_NONE,  NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_ldns_ip,

      { "LDNS IP Address", "nstrace.mep.ldns.ip", FT_IPv4, BASE_NONE,  NULL, 0x0,

      NULL, HFILL }},

    { &hf_nsmep_site_persistence,

      { "Site Persistence", "nstrace.mep.mfu.sitepers", FT_UINT16, BASE_HEX, VALS(value_site_persistence), 0x0,

      NULL, HFILL }},

  };

  static int *ett[] = {

    &ett_nsmep,

    &ett_nsmep_mfu,

    &ett_nsmep_nwu,

  };

  proto_ns_mep = proto_register_protocol("NetScaler Metric Exchange Protocol", "NetScaler MEP", "nstrace.mep");

  proto_register_field_array(proto_ns_mep, hf_nsmep, array_length(hf_nsmep));

  proto_register_subtree_array(ett, array_length(ett));

  nsmep_handle = register_dissector("nstrace.mep", dissect_ns_mep, proto_ns_mep);

}

void proto_reg_handoff_ns_mep(void)

{

  nsrpc_handle = find_dissector_add_dependency("nsrpc", proto_ns_mep);

  dissector_add_for_decode_as("tcp.port", nsmep_handle);

}

/*

 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html

 *

 * Local variables:

 * c-basic-offset: 8

 * tab-width: 8

 * indent-tabs-mode: t

 * End:

 *

 * vi: set shiftwidth=8 tabstop=8 noexpandtab:

 * :indentSize=8:tabSize=8:noTabs=false:

 */