/* packet-saprouter.c

 * Routines for SAP Router dissection

 * Copyright 2022, Martin Gallo <martin.gallo [AT] gmail.com>

 * Code contributed by SecureAuth Corp.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

 * This is a dissector for the SAP Router protocol.

 *

 * Some details and example requests can be found in pysap's documentation: https://pysap.readthedocs.io/en/latest/protocols/SAPRouter.html.

 */

#include <config.h>

#include <stdlib.h>

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/expert.h>

#include <wsutil/wmem/wmem.h>

#include <epan/conversation.h>

#include <epan/credentials.h>

#include <epan/tap.h>

#include "packet-sapni.h"

#include "packet-sapsnc.h"

/* Define default ports */

#define SAPROUTER_PORT_RANGE "3298-3299"

/*

 * Length of the frame header

 */

#define SAPROUTER_HEADER_LEN  8

/*

 * Offsets of header fields

 */

#define SAPROUTER_ROUTE_LENGTH_OFFSET 16

#define SAPROUTER_ROUTE_OFFSET_OFFSET 20

/* SAP Router Eye Catcher strings */

#define SAPROUTER_TYPE_NIPING_STRING "EYECATCHER"

#define SAPROUTER_TYPE_ROUTE_STRING "NI_ROUTE"

#define SAPROUTER_TYPE_ROUTE_ACCEPT "NI_PONG"

#define SAPROUTER_TYPE_ERR_STRING "NI_RTERR"

#define SAPROUTER_TYPE_ADMIN_STRING "ROUTER_ADM"

#define SAPROUTER_ERR_FIXED_LEN   12U

/* SAP Router Talk Modes */

static const value_string saprouter_talk_mode_vals[] = {

  { 0, "NI_MSG_IO" },

  { 1, "NI_RAW_IO" },

  { 2, "NI_ROUT_IO" },

  /* NULL */

  { 0, NULL},

};

/* SAP Router Operation values */

static const value_string saprouter_opcode_vals[] = {

  { 0, "Error information" },

  { 1, "Version Request" },

  { 2, "Version Response" },

  { 5, "Send Handle (5)" },   /* TODO: Check this opcodes */

  { 6, "Send Handle (6)" },   /* TODO: Check this opcodes */

  { 8, "Send Handle (8)" },   /* TODO: Check this opcodes */

  { 70, "SNC request" },      /* TODO: Check this opcodes NiSncOpcode: NISNC_REQ */

  { 71, "SNC handshake complete" }, /* TODO: Check this opcodes NiSncOpcode: NISNC_ACK */

  /* NULL */

  { 0, NULL}

};

/* SAP Router Return Code values (as per SAP Note 63342 https://launchpad.support.sap.com/#/notes/63342) */

static const value_string saprouter_return_code_vals[] = {

  { -1, "NI-internal error (NIEINTERN)" },

  { -2, "Host name unknown (NIEHOST_UNKNOWN)" },

  { -3, "Service unknown (NIESERV_UNKNOWN)" },

  { -4, "Service already used (NIESERV_USED)" },

  { -5, "Time limit reached (NIETIMEOUT)" },

  { -6, "Connection to partner broken (NIECONN_BROKEN)" },

  { -7, "Data range too small (NIETOO_SMALL)" },

  { -8, "Invalid parameters (NIEINVAL)" },

  { -9, "Wake-Up (without data) (NIEWAKEUP)" },

  {-10, "Connection setup failed (NIECONN_REFUSED)" },

  {-11, "PING/PONG signal received (NIEPING)" },

  {-12, "Connection to partner via NiRouter not yet set up (NIECONN_PENDING)" },

  {-13, "Invalid version (NIEVERSION)" },

  {-14, "Local hostname cannot be found (NIEMYHOSTNAME)" },

  {-15, "No free port in range (NIENOFREEPORT)" },

  {-16, "Local hostname invalid (NIEMYHOST_VERIFY)" },

  {-17, "Error in the SNC shift in the saprouter ==> (NIESNC_FAILURE)" },

  {-18, "Opcode received (NIEOPCODE)" },

  {-19, "queue limit reached, next package not accepted (NIEQUE_FULL)" },

  {-20, "Requested package too large (NIETOO_BIG)" },

  {-90, "Host name unknown (NIEROUT_HOST_UNKNOWN)" },

  {-91, "Service unknown (NIEROUT_SERV_UNKNOWN)" },

  {-92, "Connection setup failed (NIEROUT_CONN_REFUSED)" },

  {-93, "NI-internal errors (NIEROUT_INTERN)" },

  {-94, "Connect from source to destination not allowed (NIEROUT_PERM_DENIED)" },

  {-95, "Connection terminated (NIEROUT_CONN_BROKEN)" },

  {-96, "Invalid client version (NIEROUT_VERSION)" },

  {-97, "Connection cancelled by administrator (NIEROUT_CANCELED)" },

  {-98, "saprouter shutdown (NIEROUT_SHUTDOWN)" },

  {-99, "Information request refused (NIEROUT_INFO_DENIED)" },

  {-100, "Max. number of clients reached (NIEROUT_OVERFLOW)" },

  {-101, "Talkmode not allowed (NIEROUT_MODE_DENIED)" },

  {-102, "Client not available (NIEROUT_NOCLIENT)" },

  {-103, "Error in external library (NIEROUT_EXTERN)" },

  {-104, "Error in the SNC shift (NIEROUT_SNC_FAILURE)" },

  /* NULL */

  { 0, NULL}

};

/* SAP Router Admin Command values */

static const value_string saprouter_admin_command_vals[] = {

  { 2, "Information Request" },

  { 3, "New Route Table Request" },

  { 4, "Toggle Trace Request" },

  { 5, "Stop Request" },

  { 6, "Cancel Route Request" },

  { 7, "Dump Buffers Request" },

  { 8, "Flush Buffers Request" },

  { 9, "Soft Shutdown Request" },

  { 10, "Set Trace Peer" },

  { 11, "Clear Trace Peer" },

  { 12, "Trace Connection" },

  { 13, "Trace Connection" },

  { 14, "Hide Error Information Request" },

  /* NULL */

  { 0, NULL}

};

static int credentials_tap;

static int proto_saprouter;

/* General fields */

static int hf_saprouter_type;

static int hf_saprouter_ni_version;

/* Niping messages */

static int hf_saprouter_niping_message;

/* Route information */

static int hf_saprouter_route_version;

static int hf_saprouter_entries;

static int hf_saprouter_talk_mode;

static int hf_saprouter_rest_nodes;

static int hf_saprouter_route_length;

static int hf_saprouter_route_offset;

static int hf_saprouter_route;

static int hf_saprouter_route_string;

static int hf_saprouter_route_requested_in;

static int hf_saprouter_route_accepted_in;

/* Route strings */

static int hf_saprouter_route_string_hostname;

static int hf_saprouter_route_string_service;

static int hf_saprouter_route_string_password;

/* Error Information/Control Messages */

static int hf_saprouter_opcode;

static int hf_saprouter_return_code;

static int hf_saprouter_unknown;

/* Error Information Messages */

static int hf_saprouter_error_length;

static int hf_saprouter_error_string;

static int hf_saprouter_error_eyecatcher;

static int hf_saprouter_error_counter;

static int hf_saprouter_error_error;

static int hf_saprouter_error_return_code;

static int hf_saprouter_error_component;

static int hf_saprouter_error_release;

static int hf_saprouter_error_version;

static int hf_saprouter_error_module;

static int hf_saprouter_error_line;

static int hf_saprouter_error_detail;

static int hf_saprouter_error_time;

static int hf_saprouter_error_system_call;

static int hf_saprouter_error_errorno;

static int hf_saprouter_error_errorno_text;

static int hf_saprouter_error_error_count;

static int hf_saprouter_error_location;

static int hf_saprouter_error_unknown;  /* TODO: Unknown fields */

/* Control Messages */

static int hf_saprouter_control_length;

static int hf_saprouter_control_string;

static int hf_saprouter_control_unknown;

/* Admin Messages */

static int hf_saprouter_admin_command;

static int hf_saprouter_admin_password;

static int hf_saprouter_admin_client_count_short;

static int hf_saprouter_admin_client_count_int;

static int hf_saprouter_admin_client_ids;

static int hf_saprouter_admin_client_id;

static int hf_saprouter_admin_address_mask;

static int ett_saprouter;

/* Expert info */

static expert_field ei_saprouter_route_password_found;

static expert_field ei_saprouter_route_invalid_length;

static expert_field ei_saprouter_info_password_found;

static expert_field ei_saprouter_invalid_client_ids;

static expert_field ei_saprouter_control_invalid_length;

/* Global port preference */

static range_t *global_saprouter_port_range;

/* Global SNC dissection preference */

static bool global_saprouter_snc_dissection = true;

/* Protocol handle */

static dissector_handle_t saprouter_handle;

/* Session state information being tracked in a SAP Router conversation */

typedef struct saprouter_session_state {

  bool route_information;

  unsigned   route_requested_in;

  bool route_accepted;

  unsigned   route_accepted_in;

  bool route_snc_protected;

  char  *src_hostname;      /* Source hostname (first entry in the route string) */

  uint32_t src_port;        /* Source port number */

  char  *src_password;      /* Source password XXX: Check if possible */

  char  *dest_hostname;     /* Destination hostname (last entry in the route string) */

  uint32_t dest_port;       /* Destination port number */

  char  *dest_password;     /* Destination password */

} saprouter_session_state;

/*

 *

 */

void proto_reg_handoff_saprouter(void);

void proto_register_saprouter(void);

static uint32_t

dissect_serviceport(char *port){

  uint32_t portnumber = 0;

  if (g_ascii_isdigit(port[0])){

    portnumber = (uint32_t)strtoul(port, NULL, 10);

  } else if ((strlen(port)>5) && g_str_has_prefix(port, "sapdp")){

    portnumber = 3200 + (uint32_t)strtoul(port+5, NULL, 10);

  } else if ((strlen(port)>5) && g_str_has_prefix(port, "sapgw")){

    portnumber = 3300 + (uint32_t)strtoul(port+5, NULL, 10);

  } else if ((strlen(port)>5) && g_str_has_prefix(port, "sapms")){

    portnumber = 3600 + (uint32_t)strtoul(port+5, NULL, 10);

  }

  return (portnumber);

}

static bool

saprouter_tvb_strsize_bounded(tvbuff_t *tvb, uint32_t offset, uint32_t *len)

{

  unsigned nul_offset;

  int remaining;

  remaining = tvb_captured_length_remaining(tvb, offset);

  if (remaining <= 0) {

    return false;

  }

  if (!tvb_find_uint8_length(tvb, offset, (unsigned)remaining, '\0', &nul_offset)) {

    return false;

  }

  *len = nul_offset - offset + 1;

  return true;

}

static bool

saprouter_type_matches(tvbuff_t *tvb, uint32_t offset, uint32_t eyecatcher_length, const char *type)

{

  uint32_t type_length = (uint32_t)strlen(type);

  if (eyecatcher_length != type_length + 1) {

    return false;

  }

  return tvb_strneql(tvb, offset, type, type_length) == 0 &&

      tvb_get_uint8(tvb, offset + type_length) == '\0';

}

static void

dissect_routestring(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset, saprouter_session_state *session_state){

  int hop = 1;

  uint32_t len, route_offset, int_port = 0;

  char *hostname = NULL, *port = NULL, *password = NULL;

  proto_item *route_hop = NULL, *route_password = NULL;

  proto_tree *route_hop_tree = NULL;

  while (tvb_offset_exists(tvb, offset)){

    route_offset = offset; hostname = port = password = NULL;

    /* Create the subtree for this route hop */

    route_hop = proto_tree_add_item(tree, hf_saprouter_route_string, tvb, offset, 0, ENC_NA);

    route_hop_tree = proto_item_add_subtree(route_hop, ett_saprouter);

    proto_item_append_text(route_hop, ", nro %d", hop);

    /* Dissect the hostname string */

    if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) {

      break;

    }

    hostname = (char *)tvb_get_string_enc(wmem_file_scope(), tvb, offset, len - 1, ENC_ASCII);

    proto_tree_add_item(route_hop_tree, hf_saprouter_route_string_hostname, tvb, offset, len, ENC_ASCII);

    offset += len;

    /* Dissect the port string */

    if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) {

      break;

    }

    port = (char *)tvb_get_string_enc(pinfo->pool, tvb, offset, len - 1, ENC_ASCII);

    proto_tree_add_item(route_hop_tree, hf_saprouter_route_string_service, tvb, offset, len, ENC_ASCII);

    offset += len;

    /* Dissect the password string */

    if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) {

      break;

    }

    password = (char *)tvb_get_string_enc(wmem_file_scope(), tvb, offset, len - 1, ENC_ASCII);

    route_password = proto_tree_add_item(route_hop_tree, hf_saprouter_route_string_password, tvb, offset, len, ENC_ASCII);

    /* If a password was found, add a expert warning in the security category */

    if (len > 1){

      expert_add_info(pinfo, route_password, &ei_saprouter_route_password_found);

      /* Add the password to the credential tap */

      tap_credential_t *auth =  wmem_new0(pinfo->pool, tap_credential_t);

      auth->num = pinfo->num;

      auth->password_hf_id = hf_saprouter_route_string_password;

      auth->proto = "SAP Router Route String password";

      auth->username = wmem_strdup(pinfo->pool, CREDENTIALS_PLACEHOLDER);

      tap_queue_packet(credentials_tap, pinfo, auth);

    }

    offset += len;

    /* Adjust the size of the route hop item now that we know the size */

    proto_item_set_len(route_hop, offset - route_offset);

    /* Get the service port in numeric format */

    int_port = dissect_serviceport(port);

    /* Add the first hostname/port as source in the conversation state*/

    if ((hop==1) && !(pinfo->fd->visited)){

      session_state->src_hostname = hostname;

      session_state->src_port = int_port;

      session_state->src_password = password;

    }

    hop++;

  }

  if (!(pinfo->fd->visited)) {

    /* Add the last hostname/port as destination */

    if (hop!=1){

      session_state->dest_hostname = hostname;

      session_state->dest_port = int_port;

      session_state->dest_password = password;

    }

    /* Save the status of the conversation state */

    session_state->route_information = true;

    session_state->route_accepted = false;

  }

}

static void

dissect_errorstring(tvbuff_t *tvb, proto_tree *tree, uint32_t offset)

{

  uint32_t len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_eyecatcher, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_counter, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_error, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_return_code, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_component, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_release, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_version, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_module, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_line, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_detail, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_time, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_system_call, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_errorno, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_errorno_text, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_error_count, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_location, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_unknown, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_unknown, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_unknown, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_unknown, tvb, offset, len, ENC_ASCII);

  offset += len;

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &len)) return;

  proto_tree_add_item(tree, hf_saprouter_error_eyecatcher, tvb, offset, len, ENC_ASCII);

}

static tvbuff_t*

dissect_saprouter_snc_frame(tvbuff_t *tvb _U_, packet_info *pinfo _U_, proto_tree *tree _U_, uint32_t offset _U_){

  /* Call the SNC dissector */

  if (global_saprouter_snc_dissection == true){

    return dissect_sapsnc_frame(tvb, pinfo, tree, offset);

  }

  return NULL;

}

static int

dissect_saprouter(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

  tvbuff_t *next_tvb = NULL;

  uint8_t opcode;

  uint32_t offset = 0, eyecatcher_length = 0;

  int remaining;

  conversation_t *conversation = NULL;

  saprouter_session_state *session_state = NULL;

  proto_item *ti = NULL, *ri = NULL, *ei = NULL, *ci = NULL, *gi = NULL, *admin_password = NULL;

  proto_tree *saprouter_tree = NULL, *route_tree = NULL, *text_tree = NULL, *clients_tree = NULL;

  /* Search for a conversation */

  conversation = find_or_create_conversation(pinfo);

  session_state = (saprouter_session_state *)conversation_get_proto_data(conversation, proto_saprouter);

  if (!session_state){

    session_state = wmem_new(wmem_file_scope(), saprouter_session_state);

    if (session_state){

      session_state->route_information = false;

      session_state->route_requested_in = 0;

      session_state->route_accepted = false;

      session_state->route_accepted_in = 0;

      session_state->route_snc_protected = false;

      session_state->src_hostname = NULL;

      session_state->src_port = 0;

      session_state->src_password = NULL;

      session_state->dest_hostname = NULL;

      session_state->dest_port = 0;

      session_state->dest_password = NULL;

      conversation_add_proto_data(conversation, proto_saprouter, session_state);

    } else {

      /* Unable to establish a conversation, break dissection of the packet */

      return 0;

    }

  }

  /* Add the protocol to the column */

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "SAPROUTER");

  /* Add the main SAP Router subtree */

  ti = proto_tree_add_item(tree, proto_saprouter, tvb, offset, -1, ENC_NA);

  saprouter_tree = proto_item_add_subtree(ti, ett_saprouter);

  /* Get the 'eye catcher' length */

  if (!saprouter_tvb_strsize_bounded(tvb, offset, &eyecatcher_length)) {

    remaining = tvb_reported_length_remaining(tvb, offset);

    eyecatcher_length = remaining > 0 ? (uint32_t)remaining : 0;

  }

  /* Niping message */

  if (tvb_reported_length_remaining(tvb, offset) >= 10 && tvb_strneql(tvb, offset, SAPROUTER_TYPE_NIPING_STRING, 10) == 0) {

    col_set_str(pinfo->cinfo, COL_INFO, "Niping message");

    proto_tree_add_item(saprouter_tree, hf_saprouter_type, tvb, offset, 10, ENC_ASCII);

    offset += 10;

    proto_item_append_text(ti, ", Niping message");

    if (tvb_reported_length_remaining(tvb, offset)) {

      proto_tree_add_item(saprouter_tree, hf_saprouter_niping_message, tvb, offset, -1, ENC_NA);

    }

  }

  /* Admin Message Type */

  else if (saprouter_type_matches(tvb, offset, eyecatcher_length, SAPROUTER_TYPE_ADMIN_STRING)) {

    col_set_str(pinfo->cinfo, COL_INFO, "Admin message");

    proto_tree_add_item(saprouter_tree, hf_saprouter_type, tvb, offset, eyecatcher_length, ENC_ASCII);

    offset += eyecatcher_length;

    proto_item_append_text(ti, ", Admin message");

    if (tvb_reported_length_remaining(tvb, offset) < 2) {

      expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router admin message is shorter than 2 fixed bytes");

      return tvb_reported_length(tvb);

    }

    proto_tree_add_item(saprouter_tree, hf_saprouter_ni_version, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    opcode = tvb_get_uint8(tvb, offset);

    proto_tree_add_item(saprouter_tree, hf_saprouter_admin_command, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    switch (opcode){

      case 2:{  /* Info request */

        uint32_t password_len;

        if (tvb_reported_length_remaining(tvb, offset) < 2) {

          expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router admin info request is shorter than 2 fixed bytes");

          return tvb_reported_length(tvb);

        }

        offset+=2; /* Skip 2 bytes */

        /* Check if a password was supplied */

        if (saprouter_tvb_strsize_bounded(tvb, offset, &password_len) && password_len > 1){

          admin_password = proto_tree_add_item(saprouter_tree, hf_saprouter_admin_password, tvb, offset, password_len, ENC_ASCII);

          expert_add_info(pinfo, admin_password, &ei_saprouter_info_password_found);

          /* Add the password to the credential tap */

          tap_credential_t *auth =  wmem_new0(pinfo->pool, tap_credential_t);

          auth->num = pinfo->num;

          auth->password_hf_id = hf_saprouter_admin_password;

          auth->proto = "SAP Router Info Request password";

          auth->username = wmem_strdup(pinfo->pool, CREDENTIALS_PLACEHOLDER);

          tap_queue_packet(credentials_tap, pinfo, auth);

        }

        break;

      }

      case 10:  /* Set Peer Trace */

      case 11:{ /* Clear Peer Trace */

        proto_tree_add_item(saprouter_tree, hf_saprouter_admin_address_mask, tvb, offset, 32, ENC_ASCII);

        break;

      }

      case 6:  /* Cancel Route request */

      case 12: /* Trace Connection */

      case 13: /* Trace Connection */

      {

        uint32_t client_count = 0, client_count_actual = 0;

        /* Retrieve the client count first */

        if (opcode == 6){

          if (tvb_reported_length_remaining(tvb, offset) < 4) {

            expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router cancel route request is shorter than 4 fixed bytes");

            return tvb_reported_length(tvb);

          }

          offset+=2; /* Skip 2 bytes for Cancel Route request*/

          client_count = tvb_get_ntohs(tvb, offset);

          proto_tree_add_item(saprouter_tree, hf_saprouter_admin_client_count_short, tvb, offset, 2, ENC_BIG_ENDIAN);

          offset+=2;

        } else {

          if (tvb_reported_length_remaining(tvb, offset) < 4) {

            expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router trace connection request is shorter than 4 fixed bytes");

            return tvb_reported_length(tvb);

          }

          client_count = tvb_get_ntohl(tvb, offset);

          proto_tree_add_item(saprouter_tree, hf_saprouter_admin_client_count_int, tvb, offset, 4, ENC_BIG_ENDIAN);

          offset+=4;

        }

        /* Parse the list of client IDs */

        remaining = tvb_reported_length_remaining(tvb, offset);

        ci = proto_tree_add_item(saprouter_tree, hf_saprouter_admin_client_ids, tvb, offset, remaining > 0 ? remaining : 0, ENC_NA);

        clients_tree = proto_item_add_subtree(ci, ett_saprouter);

        while (tvb_offset_exists(tvb, offset) && tvb_reported_length_remaining(tvb, offset)>=4){

          proto_tree_add_item(clients_tree, hf_saprouter_admin_client_id, tvb, offset, 4, ENC_BIG_ENDIAN);

          offset+=4;

          client_count_actual+=1;

        }

        /* Check if the actual count of IDs differes from the reported number */

        if ((client_count_actual != client_count) || tvb_reported_length_remaining(tvb, offset)>0){

          expert_add_info(pinfo, clients_tree, &ei_saprouter_invalid_client_ids);

        }

        break;

      }

      default: {

        /* Skip 2 bytes */

        break;

      }

    }

  /* Route Message Type */

  } else if (saprouter_type_matches(tvb, offset, eyecatcher_length, SAPROUTER_TYPE_ROUTE_STRING)){

    uint32_t route_length = 0, route_offset = 0;

    tvbuff_t *route_tvb = NULL;

    col_set_str(pinfo->cinfo, COL_INFO, "Route message");

    if (tvb_reported_length_remaining(tvb, offset) < SAPROUTER_ROUTE_OFFSET_OFFSET + 4) {

      expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_route_invalid_length, "Route message is shorter than %u bytes", SAPROUTER_ROUTE_OFFSET_OFFSET + 4);

      return tvb_reported_length(tvb);

    }

    /* Get the route length/offset */

    route_length = tvb_get_ntohl(tvb, offset + SAPROUTER_ROUTE_LENGTH_OFFSET);

    route_offset = offset + SAPROUTER_ROUTE_OFFSET_OFFSET + 4;

    proto_tree_add_item(saprouter_tree, hf_saprouter_type, tvb, 0, eyecatcher_length, ENC_ASCII);

    offset += eyecatcher_length;

    proto_item_append_text(ti, ", Route message");

    /* Add the fields */

    proto_tree_add_item(saprouter_tree, hf_saprouter_route_version, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    proto_tree_add_item(saprouter_tree, hf_saprouter_ni_version, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    proto_tree_add_item(saprouter_tree, hf_saprouter_entries, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    proto_tree_add_item(saprouter_tree, hf_saprouter_talk_mode, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset+=3; /* There're two unused bytes there */

    proto_tree_add_item(saprouter_tree, hf_saprouter_rest_nodes, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    proto_tree_add_item(saprouter_tree, hf_saprouter_route_length, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset+=4;

    proto_tree_add_item(saprouter_tree, hf_saprouter_route_offset, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset+=4;

    /* Add the route tree */

    remaining = tvb_reported_length_remaining(tvb, route_offset);

    if (route_offset < offset || remaining < 0) {

      expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_route_invalid_length, "Route string offset is invalid (route_offset=%u)", route_offset);

      route_length = 0;

    } else if ((uint32_t)remaining != route_length){

      expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_route_invalid_length, "Route string length is invalid (remaining=%d, route_length=%d)", remaining, route_length);

      route_length = (uint32_t)remaining;

    }

    ri = proto_tree_add_item(saprouter_tree, hf_saprouter_route, tvb, route_offset, route_length, ENC_NA);

    route_tree = proto_item_add_subtree(ri, ett_saprouter);

    /* Dissect the route string */

    if (route_length > 0) {

      route_tvb = tvb_new_subset_length(tvb, route_offset, route_length);

      dissect_routestring(route_tvb, pinfo, route_tree, 0, session_state);

    }

    /* If this is the first time we're seeing this packet, mark it as the one where the route was requested */

    if (!pinfo->fd->visited) {

      session_state->route_requested_in = pinfo->num;

    }

    /* Add the route to the colinfo*/

    if (session_state->src_hostname){

      col_append_fstr(pinfo->cinfo, COL_INFO, ", Source: Hostname=%s Service Port=%d", session_state->src_hostname, session_state->src_port);

      if (session_state->src_password && strlen(session_state->src_password)>0)

        col_append_fstr(pinfo->cinfo, COL_INFO, " Password=%s", session_state->src_password);

    }

    if (session_state->dest_hostname){

      col_append_fstr(pinfo->cinfo, COL_INFO, ", Destination: Hostname=%s Service Port=%d", session_state->dest_hostname, session_state->dest_port);

      if (session_state->dest_password && strlen(session_state->dest_password)>0)

        col_append_fstr(pinfo->cinfo, COL_INFO, " Password=%s", session_state->dest_password);

    }

    if (session_state->route_accepted && session_state->route_accepted_in) {

      gi = proto_tree_add_uint(saprouter_tree, hf_saprouter_route_accepted_in, tvb, 0, 0, session_state->route_accepted_in);

      proto_item_set_generated(gi);

    }

  /* Error Information/Control Message Type */

  } else if (saprouter_type_matches(tvb, offset, eyecatcher_length, SAPROUTER_TYPE_ERR_STRING)){

    /* Extract the opcode if possible to determine the type of message */

    if (tvb_offset_exists(tvb, offset + 10)) {

      opcode = tvb_get_uint8(tvb, offset + 10);

    } else {

      opcode = 0;

    }

    col_set_str(pinfo->cinfo, COL_INFO, (opcode==0)? "Error information" : "Control message");

    uint32_t text_length = 0;

    proto_item_append_text(ti, (opcode==0)? ", Error information" : ", Control message");

    remaining = tvb_reported_length_remaining(tvb, offset);

    if (remaining < (int)(eyecatcher_length + SAPROUTER_ERR_FIXED_LEN)) {

      expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router error/control message is shorter than %u fixed bytes", eyecatcher_length + SAPROUTER_ERR_FIXED_LEN);

      proto_tree_add_item(saprouter_tree, hf_saprouter_type, tvb, offset, eyecatcher_length, ENC_ASCII);

      return tvb_reported_length(tvb);

    }

    /* Add the fields */

    proto_tree_add_item(saprouter_tree, hf_saprouter_type, tvb, offset, eyecatcher_length, ENC_ASCII);

    offset += eyecatcher_length;

    proto_tree_add_item(saprouter_tree, hf_saprouter_ni_version, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset++;

    proto_tree_add_item(saprouter_tree, hf_saprouter_opcode, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset+=2; /* There's a unused byte there */

    proto_tree_add_item(saprouter_tree, hf_saprouter_return_code, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset+=4;

    text_length = tvb_get_ntohl(tvb, offset);

    /* Error Information Message */

    if (opcode == 0){

      proto_tree_add_item(saprouter_tree, hf_saprouter_error_length, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset+=4;

      remaining = tvb_reported_length_remaining(tvb, offset);

      if ((text_length > 0) && remaining > 0){

        if ((uint32_t)remaining < text_length) {

          expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router error text is shorter than its reported length (remaining=%d, text_length=%u)", remaining, text_length);

          text_length = (uint32_t)remaining;

        }

        /* Add the error string tree */

        ei = proto_tree_add_item(saprouter_tree, hf_saprouter_error_string, tvb, offset, text_length, ENC_NA);

        text_tree = proto_item_add_subtree(ei, ett_saprouter);

        dissect_errorstring(tvb_new_subset_length(tvb, offset, text_length), text_tree, 0);

        offset += text_length;

      }

      /* Add an unknown int field */

      if (tvb_reported_length_remaining(tvb, offset) >= 4) {

        proto_tree_add_item(saprouter_tree, hf_saprouter_unknown, tvb, offset, 4, ENC_BIG_ENDIAN);

      }

      /* Control Message */

    } else {

      /* Add the opcode name */

      proto_item_append_text(ti, ", opcode=%s", val_to_str_const(opcode, saprouter_opcode_vals, "Unknown"));

      col_append_fstr(pinfo->cinfo, COL_INFO, ", opcode=%s", val_to_str_const(opcode, saprouter_opcode_vals, "Unknown"));

      proto_tree_add_item(saprouter_tree, hf_saprouter_control_length, tvb, offset, 4, ENC_BIG_ENDIAN);

      offset+=4;

      remaining = tvb_reported_length_remaining(tvb, offset);

      if ((text_length > 0) && remaining > 0){

        if ((uint32_t)remaining < text_length) {

          expert_add_info_format(pinfo, saprouter_tree, &ei_saprouter_control_invalid_length, "SAP Router control text is shorter than its reported length (remaining=%d, text_length=%u)", remaining, text_length);

          text_length = (uint32_t)remaining;

        }

        /* Add the control string tree */

        proto_tree_add_item(saprouter_tree, hf_saprouter_control_string, tvb, offset, text_length, ENC_ASCII);

        offset += text_length;

      }

      /* SNC request, mark the conversation as SNC protected and dissect the SNC frame */

      if (opcode == 70 || opcode == 71){

        session_state->route_snc_protected = true;

        if (tvb_reported_length_remaining(tvb, offset) > 0) {

          dissect_saprouter_snc_frame(tvb, pinfo, tree, offset);

        }

      /* Other opcodes */

      } else {

        if (tvb_reported_length_remaining(tvb, offset) >= 4) {

          proto_tree_add_item(saprouter_tree, hf_saprouter_control_unknown, tvb, offset, 4, ENC_ASCII);

        }

      }

    }

  /* Route Acceptance (NI_PONG) Message Type */

  } else if (tvb_strneql(tvb, offset, SAPROUTER_TYPE_ROUTE_ACCEPT, eyecatcher_length) == 0){

    /* Route information available */

    if (session_state->route_information){

      /* If this is the first time we're seen the packet, mark is as the one where the route was accepted */

      if (!pinfo->fd->visited) {

        session_state->route_accepted = true;

        session_state->route_accepted_in = pinfo->num;

      }

      col_append_fstr(pinfo->cinfo, COL_INFO, ", from %s:%d to %s:%d", session_state->src_hostname, session_state->src_port, session_state->dest_hostname, session_state->dest_port);

      proto_item_append_text(ti, ", from %s:%d to %s:%d", session_state->src_hostname, session_state->src_port, session_state->dest_hostname, session_state->dest_port);

      if (session_state->route_requested_in) {

        gi = proto_tree_add_uint(saprouter_tree, hf_saprouter_route_requested_in, tvb, 0, 0, session_state->route_requested_in);

        proto_item_set_generated(gi);

      }

    }

  /* Unknown Message Type */

  } else {

    col_set_str(pinfo->cinfo, COL_INFO, "Routed message");

    proto_item_append_text(ti, ", Routed message");

    /* If the session is protected with SNC, first dissect the SNC frame

     * and save the content for further dissection.

     */

    if (session_state->route_snc_protected) {

      col_append_str(pinfo->cinfo, COL_INFO, ", SNC protected");

      proto_item_append_text(ti, ", SNC protected");

      next_tvb = dissect_saprouter_snc_frame(tvb, pinfo, tree, offset);

    /* If the session is not protected dissect the entire payload */

    } else {

      next_tvb = tvb;

    }

    /* If the session has information about the route requested */

    if (session_state->route_information){

      /* Route accepted */

      if (session_state->route_accepted){

        col_append_fstr(pinfo->cinfo, COL_INFO, ", from %s:%d to %s:%d ", session_state->src_hostname, session_state->src_port, session_state->dest_hostname, session_state->dest_port);

        proto_item_append_text(ti, ", from %s:%d to %s:%d ", session_state->src_hostname, session_state->src_port, session_state->dest_hostname, session_state->dest_port);

        if (session_state->route_requested_in) {

          gi = proto_tree_add_uint(saprouter_tree, hf_saprouter_route_requested_in, tvb, 0, 0, session_state->route_requested_in);

          proto_item_set_generated(gi);

        }

        if (session_state->route_accepted_in) {

          gi = proto_tree_add_uint(saprouter_tree, hf_saprouter_route_accepted_in, tvb, 0, 0, session_state->route_accepted_in);

          proto_item_set_generated(gi);

        }

      /* Route not accepted but some information available */

      } else {

        col_append_str(pinfo->cinfo, COL_INFO, ", to unknown destination");

        proto_item_append_text(ti, ", to unknown destination");

      }

      /* Call the dissector in the NI protocol sub-dissectors table

       * according to the route destination port number. */

      if (next_tvb) {

        dissect_sap_protocol_payload(next_tvb, offset, pinfo, tree, 0, session_state->dest_port);

      }

    } else {

      /* No route information available */

      col_append_str(pinfo->cinfo, COL_INFO, ", to unknown destination");

      proto_item_append_text(ti, ", to unknown destination");

    }

  }

  return tvb_reported_length(tvb);

}

void

proto_register_saprouter(void)

{

  static hf_register_info hf[] = {

    { &hf_saprouter_type,

      { "Type", "saprouter.type", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    /* Niping message */

    { &hf_saprouter_niping_message,

      { "Niping message", "saprouter.message", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    /* NI Route messages */

    { &hf_saprouter_route_version,

      { "Route version", "saprouter.version", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_ni_version,

      { "NI version", "saprouter.niversion", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_entries,

      { "Entries", "saprouter.entries", FT_UINT8, BASE_DEC, NULL, 0x0, "Total number of entries", HFILL }},

    { &hf_saprouter_talk_mode,

      { "Talk Mode", "saprouter.talkmode", FT_UINT8, BASE_DEC, VALS(saprouter_talk_mode_vals), 0x0, NULL, HFILL }},

    { &hf_saprouter_rest_nodes,

      { "Remaining Hops", "saprouter.restnodes", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_length,

      { "Route String Length", "saprouter.routelength", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_offset,

      { "Route String Offset", "saprouter.routeoffset", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route,

      { "Route String", "saprouter.routestring", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_string,

      { "Route Hop", "saprouter.routestring", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_string_hostname,

      { "Hostname", "saprouter.routestring.hostname", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_string_service,

      { "Service", "saprouter.routestring.service", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_string_password,

      { "Password", "saprouter.routestring.password", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},

    { &hf_saprouter_route_requested_in,

      { "Route Requested in", "saprouter.requested_in", FT_FRAMENUM, BASE_NONE, NULL, 0x0, "The route request for this packet is in this packet", HFILL }},