/* packet-frame.c

 *

 * Top-most dissector. Decides dissector based on Wiretap Encapsulation Type.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 2000 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <string.h>

#ifdef _MSC_VER

#include <windows.h>

#endif

#include <epan/packet.h>

#include <epan/capture_dissectors.h>

#include <epan/epan.h>

#include <epan/exceptions.h>

#include <epan/show_exception.h>

#include <epan/prefs.h>

#include <epan/to_str.h>

#include <epan/sequence_analysis.h>

#include <epan/tap.h>

#include <epan/proto_data.h>

#include <epan/expert.h>

#include <epan/tfs.h>

#include <wsutil/wsgcrypt.h>

#include <wsutil/str_util.h>

#include <wsutil/wslog.h>

#include <wsutil/ws_assert.h>

#include <epan/addr_resolv.h>

#include <epan/wmem_scopes.h>

#include <epan/column-info.h>

#include <epan/conversation_filter.h>

#include <wsutil/pint.h>

#include "packet-frame.h"

#include <epan/color_filters.h>

#include <epan/tag_rules.h>

void proto_register_frame(void);

void event_register_frame(void);

void proto_reg_handoff_frame(void);

void event_reg_handoff_frame(void);

static int proto_frame;

static int proto_pkt_comment;

static int proto_syscall;

static int proto_darwin;

static int hf_frame_arrival_time_local;

static int hf_frame_arrival_time_utc;

static int hf_frame_arrival_time_epoch;

static int hf_frame_shift_offset;

static int hf_frame_time_delta;

static int hf_frame_time_delta_displayed;

static int hf_frame_time_relative;

static int hf_frame_time_relative_cap;

static int hf_frame_time_reference;

static int hf_frame_number;

static int hf_frame_len;

static int hf_frame_capture_len;

static int hf_frame_p2p_dir;

static int hf_frame_file_off;

static int hf_frame_md5_hash;

static int hf_frame_marked;

static int hf_frame_ignored;

static int hf_frame_link_number;

static int hf_frame_packet_id;

static int hf_frame_process;

static int hf_frame_process_pid;

static int hf_frame_process_tid;

static int hf_frame_process_name;

static int hf_frame_process_path;

static int hf_frame_process_cmdline;

static int hf_frame_process_ppid;

static int hf_frame_process_uid;

static int hf_frame_process_user;

static int hf_frame_process_uuid;

static int hf_frame_process_start_time;

static int hf_frame_hash;

static int hf_frame_hash_bytes;

static int hf_frame_verdict;

static int hf_frame_verdict_hardware;

static int hf_frame_verdict_tc;

static int hf_frame_verdict_xdp;

static int hf_frame_verdict_unknown;

static int hf_frame_drop_count;

static int hf_frame_protocols;

static int hf_frame_color_filter_count;

static int hf_frame_color_filter_name;

static int hf_frame_color_filter_text;

static int hf_frame_color_filter_disabled;

static int hf_frame_section_number;

static int hf_frame_interface_id;

static int hf_frame_interface_name;

static int hf_frame_interface_description;

static int hf_frame_interface_queue;

static int hf_frame_pack_flags;

static int hf_frame_pack_direction;

static int hf_frame_pack_reception_type;

static int hf_frame_pack_fcs_length;

static int hf_frame_pack_reserved;

static int hf_frame_pack_crc_error;

static int hf_frame_pack_wrong_packet_too_long_error;

static int hf_frame_pack_wrong_packet_too_short_error;

static int hf_frame_pack_wrong_inter_frame_gap_error;

static int hf_frame_pack_unaligned_frame_error;

static int hf_frame_pack_start_frame_delimiter_error;

static int hf_frame_pack_preamble_error;

static int hf_frame_pack_symbol_error;

static int hf_frame_wtap_encap;

static int hf_frame_cb_pen;

static int hf_frame_cb_copy_allowed;

static int hf_frame_comment;

static int hf_frame_tags;

static int hf_frame_tag;

static int hf_frame_encoding;

static int hf_frame_cust_opt;

static int hf_frame_cust_opt_pen;

static int hf_frame_cust_opt_copy_allowed;

static int hf_frame_cust_opt_string;

static int hf_frame_cust_opt_data;

static int ett_frame;

static int ett_ifname;

static int ett_flags;

static int ett_comments;

static int ett_hash;

static int ett_verdict;

static int ett_process;

static int ett_frame_tags;

static int ett_frame_color_filters;

static int ett_frame_color_filter;

static expert_field ei_comments_text;

static expert_field ei_arrive_time_out_of_range;

static expert_field ei_incomplete;

static expert_field ei_len_lt_caplen;

static int frame_tap;

static dissector_handle_t docsis_handle;

static dissector_handle_t sysdig_handle;

static dissector_handle_t systemd_journal_handle;

static dissector_handle_t darwin_handle;

/* Preferences */

static bool show_file_off;

static bool force_docsis_encap;

static bool generate_md5_hash;

static bool generate_bits_field = true;

static bool disable_packet_size_limited_in_summary;

static unsigned max_comment_lines   = 30;

static const value_string p2p_dirs[] = {

  { P2P_DIR_UNKNOWN, "Unknown" },

  { P2P_DIR_SENT,    "Sent" },

  { P2P_DIR_RECV,    "Received" },

  { 0, NULL }

};

static const value_string packet_word_directions[] = {

  { PACK_FLAGS_DIRECTION_UNKNOWN,  "Unknown" },

  { PACK_FLAGS_DIRECTION_INBOUND,  "Inbound" },

  { PACK_FLAGS_DIRECTION_OUTBOUND, "Outbound" },

  { 0, NULL }

};

static const value_string packet_word_reception_types[] = {

  { PACK_FLAGS_RECEPTION_TYPE_UNSPECIFIED, "Not specified" },

  { PACK_FLAGS_RECEPTION_TYPE_UNICAST,     "Unicast" },

  { PACK_FLAGS_RECEPTION_TYPE_MULTICAST,   "Multicast" },

  { PACK_FLAGS_RECEPTION_TYPE_BROADCAST,   "Broadcast" },

  { PACK_FLAGS_RECEPTION_TYPE_PROMISCUOUS, "Promiscuous" },

  { 0, NULL }

};

static const value_string packet_char_enc_types[] = {

  { PACKET_CHAR_ENC_CHAR_ASCII, "ASCII" },

  { PACKET_CHAR_ENC_CHAR_EBCDIC, "EBCDIC" },

  { 0, NULL }

};

static const val64_string verdict_ebpf_tc_types[] = {

  { -1, "TC_ACT_UNSPEC"},

  { 0, "TC_ACT_OK"},

  { 1, "TC_ACT_RECLASSIFY"},

  { 2, "TC_ACT_SHOT"},

  { 3, "TC_ACT_PIPE"},

  { 4, "TC_ACT_STOLEN"},

  { 5, "TC_ACT_QUEUED"},

  { 6, "TC_ACT_REPEAT"},

  { 7, "TC_ACT_REDIRECT"},

  { 8, "TC_ACT_TRAP"},

  { 0, NULL }

};

static const val64_string verdict_ebpf_xdp_types[] = {

  { 0, "XDP_ABORTED"},

  { 1, "XDP_DROP"},

  { 2, "XDP_PASS"},

  { 3, "XDP_TX"},

  { 4, "XDP_REDIRECT"},

  { 0, NULL }

};

static dissector_table_t wtap_encap_dissector_table;

static dissector_table_t wtap_fts_rec_dissector_table;

static dissector_table_t block_pen_dissector_table;

static dissector_table_t binary_option_pen_dissector_table;

static dissector_table_t string_option_pen_dissector_table;

static dissector_table_t packet_block_option_dissector_table;

/* The number of tree items required to add an exception to the tree */

#define EXCEPTION_TREE_ITEMS 10

/* OPT_EPB_VERDICT sub-types */

#define OPT_VERDICT_TYPE_HW  0

#define OPT_VERDICT_TYPE_TC  1

#define OPT_VERDICT_TYPE_XDP 2

/* OPT_EPB_HASH sub-types */

#define OPT_HASH_2COMP    0

#define OPT_HASH_XOR    1

#define OPT_HASH_CRC32    2

#define OPT_HASH_MD5      3

#define OPT_HASH_SHA1     4

#define OPT_HASH_TOEPLITZ 5

/* Structure for passing as userdata to wtap_block_foreach_option */

typedef struct fr_foreach_s {

  proto_item *item;

  proto_tree *tree;

  tvbuff_t *tvb;

  packet_info *pinfo;

  unsigned n_changes;

} fr_foreach_t;

static const char *

get_verdict_type_string(uint8_t type)

{

  switch(type) {

  case OPT_VERDICT_TYPE_HW:

    return "Hardware";

  case OPT_VERDICT_TYPE_TC:

    return "eBPF_TC";

  case OPT_VERDICT_TYPE_XDP:

    return "eBPF_XDP";

  }

  return "Unknown";

}

static const char *

get_hash_type_string(uint8_t type)

{

  switch(type) {

  case OPT_HASH_2COMP:

    return "2's Complement";

  case OPT_HASH_XOR:

    return "XOR";

  case OPT_HASH_CRC32:

    return "CRC32";

  case OPT_HASH_MD5:

    return "MD5";

  case OPT_HASH_SHA1:

    return "SHA1";

  case OPT_HASH_TOEPLITZ:

    return "Toeplitz";

  default:

    return "Unknown";

  }

}

static void

ensure_tree_item(proto_tree *tree, unsigned count)

{

  /*

   * Ensure that no exception is thrown in proto.c when adding the

   * next tree item. Even if the maximum number of items is

   * reached, we know for sure that no infinite loop will occur.

   */

  if (tree && PTREE_DATA(tree)->count > count)

    PTREE_DATA(tree)->count -= count;

}

/****************************************************************************/

/* whenever a frame packet is seen by the tap listener */

/* Add a new frame into the graph */

static tap_packet_status

frame_seq_analysis_packet( void *ptr, packet_info *pinfo, epan_dissect_t *edt _U_, const void *dummy _U_, tap_flags_t flags _U_)

{

  seq_analysis_info_t *sainfo = (seq_analysis_info_t *) ptr;

  seq_analysis_item_t *sai = sequence_analysis_create_sai_with_addresses(pinfo, sainfo);

  if (!sai)

    return TAP_PACKET_DONT_REDRAW;

  sai->frame_number = pinfo->num;

  sequence_analysis_use_color_filter(pinfo, sai);

  sai->port_src=pinfo->srcport;

  sai->port_dst=pinfo->destport;

  sequence_analysis_use_col_info_as_label_comment(pinfo, sai);

  sai->line_style = 1;

  sai->conv_num = 0;

  sai->display = true;

  g_queue_push_tail(sainfo->items, sai);

  return TAP_PACKET_REDRAW;

}

/*

 * Routine used to register frame end routine.  The routine should only

 * be registered when the dissector is used in the frame, not in the

 * proto_register_XXX function.

 */

void

register_frame_end_routine(packet_info *pinfo, void (*func)(void))

{

  pinfo->frame_end_routines = g_slist_append(pinfo->frame_end_routines, (void *)func);

}

typedef void (*void_func_t)(void);

static void

call_frame_end_routine(void *routine)

{

  void_func_t func = (void_func_t)routine;

  (*func)();

}

static bool

frame_add_comment(wtap_block_t block _U_, unsigned option_id, wtap_opttype_e option_type _U_, wtap_optval_t *option, void *user_data)

{

  fr_foreach_t *fr_user_data = (fr_foreach_t *)user_data;

  proto_item *comment_item;

  proto_item *hidden_item;

  proto_tree *comments_tree;

  char *newline;             /* location of next newline in comment */

  char *ch;                  /* utility pointer */

  unsigned i;                    /* track number of lines */

  if (option_id == OPT_COMMENT) {

    ch = option->stringval;

    newline = strchr(ch, '\n');

    if (newline == NULL) {

      /* Single-line comment, no special treatment needed */

      comment_item = proto_tree_add_string_format(fr_user_data->tree,

          hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          ch,

          "%s", ch);

    }

    else {

      /* Multi-line comment. Temporarily change the first

       * newline to a null so we only show the first line

       */

      *newline = '\0';

      comment_item = proto_tree_add_string_format(fr_user_data->tree,

          hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          ch,

          "%s [...]", ch);

      comments_tree = proto_item_add_subtree(comment_item, ett_comments);

      for (i = 0; i < max_comment_lines; i++) {

        /* Add each line as a separate item under

         * the comment tree

         */

        proto_tree_add_string_format(comments_tree, hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          ch,

          "%s", ch);

        if (newline == NULL) {

          /* This was set in the previous loop

           * iteration; it means we've added the

           * final line

           */

          break;

        }

        else {

          /* Put back the newline we removed */

          *newline = '\n';

          ch = newline + 1;

          if (*ch == '\0') {

            break;

          }

          /* Find next newline to repeat the process

           * in the next iteration

           */

          newline = strchr(ch, '\n');

          if (newline != NULL) {

            *newline = '\0';

          }

        }

      }

      if (i == max_comment_lines) {

        /* Put back a newline if we still have one dangling */

        if (newline != NULL) {

          *newline = '\n';

        }

        /* Add truncation notice */

        proto_tree_add_string_format(comments_tree, hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          "",

          "[comment truncated at %d line%s]",

          max_comment_lines,

          plurality(max_comment_lines, "", "s"));

      }

      /* Add the original comment unchanged as a hidden

       * item, so searches still work like before

       */

      hidden_item = proto_tree_add_string(comments_tree,

          hf_frame_comment,

          fr_user_data->tvb, 0, 0,

          option->stringval);

      proto_item_set_hidden(hidden_item);

      comment_item = comments_tree;

    }

    hidden_item = expert_add_info_format(fr_user_data->pinfo, comment_item, &ei_comments_text,

        "%s",  option->stringval);

    proto_item_set_hidden(hidden_item);

  }

  fr_user_data->n_changes++;

  return true;

}

static bool

frame_add_hash(wtap_block_t block _U_, unsigned option_id, wtap_opttype_e option_type _U_, wtap_optval_t *option, void *user_data)

{

  fr_foreach_t *fr_user_data = (fr_foreach_t *)user_data;

  if (option_id == OPT_PKT_HASH) {

    packet_hash_opt_t *hash = &option->packet_hash;

    const char *format

      = fr_user_data->n_changes ? ", %s (%u)" : "%s (%u)";

    proto_item_append_text(fr_user_data->item, format,

               get_hash_type_string(hash->type),

               hash->type);

    proto_tree_add_bytes_with_length(fr_user_data->tree,

             hf_frame_hash_bytes,

             fr_user_data->tvb, 0, 0,

             hash->hash_bytes->data,

             hash->hash_bytes->len);

  }

  fr_user_data->n_changes++;

  return true;

}

static bool

frame_add_verdict(wtap_block_t block _U_, unsigned option_id, wtap_opttype_e option_type _U_, wtap_optval_t *option, void *user_data)

{

  fr_foreach_t *fr_user_data = (fr_foreach_t *)user_data;

  if (option_id == OPT_PKT_VERDICT) {

    packet_verdict_opt_t *verdict = &option->packet_verdictval;

    char *format = fr_user_data->n_changes ? ", %s (%u)" : "%s (%u)";

    proto_item_append_text(fr_user_data->item, format,

               get_verdict_type_string(verdict->type),

               verdict->type);

    switch(verdict->type) {

      case OPT_VERDICT_TYPE_TC:

        proto_tree_add_int64(fr_user_data->tree,

                 hf_frame_verdict_tc,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_linux_ebpf_tc);

        break;

      case OPT_VERDICT_TYPE_XDP:

        proto_tree_add_int64(fr_user_data->tree,

                 hf_frame_verdict_xdp,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_linux_ebpf_xdp);

        break;

      case OPT_VERDICT_TYPE_HW:

        proto_tree_add_bytes_with_length(fr_user_data->tree,

                 hf_frame_verdict_hardware,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_bytes->data,

                 verdict->data.verdict_bytes->len);

        break;

      default:

        proto_tree_add_bytes_with_length(fr_user_data->tree,

                 hf_frame_verdict_unknown,

                 fr_user_data->tvb, 0, 0,

                 verdict->data.verdict_bytes->data,

                 verdict->data.verdict_bytes->len);

        break;

    }

  }

  fr_user_data->n_changes++;

  return true;

}

struct custom_binary_opt_cb_data {

  tvbuff_t *tvb;

  packet_info *pinfo;

  proto_tree *tree;

  struct custom_binary_opt_data data;

};

static bool

handle_packet_option(wtap_block_t block _U_, unsigned option_id,

    wtap_opttype_e option_type _U_, wtap_optval_t *optval, void *user_data)

{

  struct custom_binary_opt_cb_data *cb_data = (struct custom_binary_opt_cb_data *)user_data;

  proto_item *ti;

  proto_tree *opt_tree;

  switch (option_id) {

  case OPT_CUSTOM_STR_COPY:

  case OPT_CUSTOM_STR_NO_COPY:

    /* Display it */

    cb_data->data.optval = optval;

    if (!dissector_try_uint_with_data(string_option_pen_dissector_table,

        optval->custom_stringval.pen, cb_data->tvb,

        cb_data->pinfo, cb_data->tree, false, &cb_data->data)) {

      ti = proto_tree_add_item(cb_data->tree, hf_frame_cust_opt, cb_data->tvb, 0, tvb_reported_length(cb_data->tvb), ENC_NA);

      opt_tree = proto_item_add_subtree(ti, ett_verdict);

      proto_tree_add_uint(opt_tree, hf_frame_cust_opt_pen, cb_data->tvb, 0, 0,

               optval->custom_stringval.pen);

      proto_tree_add_boolean(opt_tree, hf_frame_cust_opt_copy_allowed, cb_data->tvb, 0, 0, option_id == OPT_CUSTOM_STR_COPY);

      proto_tree_add_string(opt_tree, hf_frame_cust_opt_string, cb_data->tvb, 0, 0, optval->custom_stringval.string);

    }

    break;

  case OPT_CUSTOM_BIN_COPY:

  case OPT_CUSTOM_BIN_NO_COPY:

    /* Process it */

    cb_data->data.optval = optval;

    if (!dissector_try_uint_with_data(binary_option_pen_dissector_table,

        optval->custom_binaryval.pen, cb_data->tvb,

        cb_data->pinfo, cb_data->tree, false, &cb_data->data)) {

      ti = proto_tree_add_item(cb_data->tree, hf_frame_cust_opt, cb_data->tvb, 0, tvb_reported_length(cb_data->tvb), ENC_NA);

      opt_tree = proto_item_add_subtree(ti, ett_verdict);

      proto_tree_add_uint(opt_tree, hf_frame_cust_opt_pen, cb_data->tvb, 0, 0,

               optval->custom_binaryval.pen);

      proto_tree_add_boolean(opt_tree, hf_frame_cust_opt_copy_allowed, cb_data->tvb, 0, 0, option_id == OPT_CUSTOM_BIN_COPY);

      proto_tree_add_bytes_with_length(opt_tree, hf_frame_cust_opt_data, cb_data->tvb, 0, 0, optval->custom_binaryval.data.custom_data, (unsigned)optval->custom_binaryval.data.custom_data_len);

    }

    break;

  default:

    dissector_try_uint_with_data(packet_block_option_dissector_table,

      option_id, cb_data->tvb,

      cb_data->pinfo, cb_data->tree, false, optval);

    break;

  }

  return true;

}

/* Conversation (temporary) coloring rules are never listed. With "details"

 * every other matching rule is listed; otherwise the rule that colors the

 * frame and the disabled matches, which exist only while

 * gui.coloring_rules_include_disabled is set. */

static bool

color_filter_entry_shown(const color_filter_t *colorf,

                         const color_filter_t *primary, bool details)

{

  if (color_filter_is_tmp(colorf))

    return false;

  return details || colorf == primary || !colorf->enabled;

}

/* A single listed rule keeps the flat items directly under the Frame item. */

static void

add_color_filter_flat(proto_tree *tree, tvbuff_t *tvb, const color_filter_t *colorf)

{

  proto_item *item;

  ensure_tree_item(tree, 1);

  item = proto_tree_add_string(tree, hf_frame_color_filter_name, tvb,

                               0, 0, colorf->filter_name);

  proto_item_set_generated(item);

  ensure_tree_item(tree, 1);

  item = proto_tree_add_string(tree, hf_frame_color_filter_text, tvb,

                               0, 0, colorf->filter_text);

  proto_item_set_generated(item);

  if (!colorf->enabled) {

    ensure_tree_item(tree, 1);

    item = proto_tree_add_boolean(tree, hf_frame_color_filter_disabled, tvb,

                                  0, 0, true);

    proto_item_set_generated(item);

  }

}

/* One of several listed rules: the name item shows only the rule name and

 * holds the filter string and, for a disabled rule, the disabled flag. */

static void

add_color_filter_nested(proto_tree *tree, tvbuff_t *tvb, const color_filter_t *colorf)

{

  proto_item *item;

  proto_tree *rule_tree;

  ensure_tree_item(tree, 1);

  item = proto_tree_add_string_format(tree, hf_frame_color_filter_name, tvb,

                                      0, 0, colorf->filter_name, "%s",

                                      colorf->filter_name);

  proto_item_set_generated(item);

  rule_tree = proto_item_add_subtree(item, ett_frame_color_filter);

  ensure_tree_item(rule_tree, 1);

  item = proto_tree_add_string_format(rule_tree, hf_frame_color_filter_text, tvb,

                                      0, 0, colorf->filter_text,

                                      "Filter String: %s", colorf->filter_text);

  proto_item_set_generated(item);

  if (!colorf->enabled) {

    ensure_tree_item(rule_tree, 1);

    item = proto_tree_add_boolean_format(rule_tree, hf_frame_color_filter_disabled,

                                         tvb, 0, 0, true, "Disabled: %s",

                                         tfs_get_true_false(true));

    proto_item_set_generated(item);

  }

}

/* Key of the per-packet data holding the process ID, for the conversation filter. */

#define FRAME_PROCESS_ID_KEY 1

/*

 * Add the process and thread IDs from one pcapng epb_processid_threadid

 * option, and what the file's process information says about the

 * process.  wiretap stores the option as a 64-bit value with the process

 * ID in the upper 32 bits and the thread ID in the lower 32 bits; an ID

 * of 0 means that it is not available.

 *

 * The tree may be NULL; if this is the packet's first process, its ID is

 * remembered for the conversation filter, and its user name is set for

 * the user name column, regardless.

 */

static void

frame_add_process(proto_tree *fh_tree, tvbuff_t *tvb, packet_info *pinfo, uint64_t procid_threadid, bool first)

{

  uint32_t pid, tid, process_info_id, ppid, uid;

  unsigned section_number;

  bool have_info = false;

  const char *name = NULL, *path, *user;

  const uint8_t *cmdline, *uuid;

  size_t cmdline_size, uuid_size;

  nstime_t start_time;

  proto_item *process_item, *item;

  proto_tree *process_tree;

  pid = (uint32_t)(procid_threadid >> 32);

  tid = (uint32_t)procid_threadid;

  section_number = pinfo->rec->presence_flags & WTAP_HAS_SECTION_NUMBER ? pinfo->rec->section_number : 0;

  if (pid != 0) {

    if (first)

      p_add_proto_data(pinfo->pool, pinfo, proto_frame, FRAME_PROCESS_ID_KEY, GUINT_TO_POINTER(pid));

    /*

     * Look the process up, using the time stamp of the packet

     * to tell apart processes that reused the ID.

     */

    have_info = epan_find_process_info(pinfo->epan, pid, section_number,

        (pinfo->presence_flags & PINFO_HAS_TS) ? &pinfo->abs_ts : NULL,

        pinfo->fd->file_off, &process_info_id);

    if (have_info) {

      name = epan_get_process_name(pinfo->epan, process_info_id, section_number);

      if (first)

        pinfo->user_name = epan_get_process_user_name(pinfo->epan, process_info_id, section_number);

    }

    col_append_sep_fstr(pinfo->cinfo, COL_PROCESS_ID, ",", "%u", pid);

    if (name != NULL)

      col_append_sep_str(pinfo->cinfo, COL_PROCESS_NAME, ",", name);

  }

  if (fh_tree == NULL)

    return;

  if (name != NULL) {

    process_item = proto_tree_add_none_format(fh_tree, hf_frame_process, tvb, 0, 0,

        "Process information: PID %u (%s), TID %u", pid, name, tid);

  } else {

    process_item = proto_tree_add_none_format(fh_tree, hf_frame_process, tvb, 0, 0,

        "Process information: PID %u, TID %u", pid, tid);

  }

  process_tree = proto_item_add_subtree(process_item, ett_process);

  item = proto_tree_add_uint(process_tree, hf_frame_process_pid, tvb, 0, 0, pid);

  if (pid == 0)

    proto_item_append_text(item, " (not available)");

  item = proto_tree_add_uint(process_tree, hf_frame_process_tid, tvb, 0, 0, tid);

  if (tid == 0)

    proto_item_append_text(item, " (not available)");

  if (!have_info)

    return;

  if (name != NULL) {

    item = proto_tree_add_string(process_tree, hf_frame_process_name, tvb, 0, 0, name);

    proto_item_set_generated(item);

  }

  path = epan_get_process_path(pinfo->epan, process_info_id, section_number);

  if (path != NULL) {

    item = proto_tree_add_string(process_tree, hf_frame_process_path, tvb, 0, 0, path);

    proto_item_set_generated(item);

  }

  cmdline = epan_get_process_cmdline(pinfo->epan, process_info_id, section_number, &cmdline_size);

  if (cmdline != NULL) {

    /* The arguments are separated by NULs; show them separated by spaces. */

    char *cmdline_str = (char *)wmem_alloc(pinfo->pool, cmdline_size + 1);

    size_t i;

    for (i = 0; i < cmdline_size; i++)

      cmdline_str[i] = cmdline[i] == '\0' ? ' ' : cmdline[i];

    cmdline_str[cmdline_size] = '\0';

    item = proto_tree_add_string(process_tree, hf_frame_process_cmdline, tvb, 0, 0, cmdline_str);

    proto_item_set_generated(item);

  }

  if (epan_get_process_parent_id(pinfo->epan, process_info_id, section_number, &ppid)) {

    item = proto_tree_add_uint(process_tree, hf_frame_process_ppid, tvb, 0, 0, ppid);

    proto_item_set_generated(item);

  }

  if (epan_get_process_user_id(pinfo->epan, process_info_id, section_number, &uid)) {

    item = proto_tree_add_uint(process_tree, hf_frame_process_uid, tvb, 0, 0, uid);

    proto_item_set_generated(item);

  }

  user = epan_get_process_user_name(pinfo->epan, process_info_id, section_number);

  if (user != NULL) {

    item = proto_tree_add_string(process_tree, hf_frame_process_user, tvb, 0, 0, user);

    proto_item_set_generated(item);

  }

  uuid = epan_get_process_uuid(pinfo->epan, process_info_id, section_number, &uuid_size);

  if (uuid != NULL && uuid_size == 16) {

    e_guid_t guid;

    guid.data1 = pntohu32(uuid);

    guid.data2 = pntohu16(uuid + 4);

    guid.data3 = pntohu16(uuid + 6);

    memcpy(guid.data4, uuid + 8, sizeof guid.data4);

    item = proto_tree_add_guid(process_tree, hf_frame_process_uuid, tvb, 0, 0, &guid);

    proto_item_set_generated(item);

  }

  if (epan_get_process_start_time(pinfo->epan, process_info_id, section_number, &start_time)) {

    item = proto_tree_add_time(process_tree, hf_frame_process_start_time, tvb, 0, 0, &start_time);

    proto_item_set_generated(item);

  }

}

/*

 * Add the processes the packet belongs to.  A packet can have several

 * epb_processid_threadid options, one for each process that could have

 * sent or received it, e.g. every process that has the socket open, or

 * the sender and the receivers of a multicast datagram on the capturing

 * host.

 */

static void

frame_add_process_info(proto_tree *fh_tree, tvbuff_t *tvb, packet_info *pinfo, wtap_block_t pkt_block)

{

  unsigned count = wtap_block_count_option(pkt_block, OPT_PKT_PROCIDTHRDID);

  for (unsigned n = 0; n < count; n++) {

    uint64_t procid_threadid;

    if (wtap_block_get_nth_uint64_option_value(pkt_block, OPT_PKT_PROCIDTHRDID, n, &procid_threadid) != WTAP_OPTTYPE_SUCCESS)

      break;

    frame_add_process(fh_tree, tvb, pinfo, procid_threadid, n == 0);

  }

}

static bool

frame_process_filter_valid(packet_info *pinfo, void *user_data _U_)

{

  return p_get_proto_data(pinfo->pool, pinfo, proto_frame, FRAME_PROCESS_ID_KEY) != NULL;

}

static char *

frame_process_build_filter(packet_info *pinfo, void *user_data _U_)

{

  return ws_strdup_printf("frame.process.pid == %u",

      GPOINTER_TO_UINT(p_get_proto_data(pinfo->pool, pinfo, proto_frame, FRAME_PROCESS_ID_KEY)));

}

static int

dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data)

{

  proto_item  *volatile ti = NULL;

  unsigned     cap_len = 0, frame_len = 0;

  nstime_t     rel_ts;

  uint32_t     pack_flags;

  uint32_t     interface_queue;

  uint64_t     drop_count;

  uint64_t     packetid;

  proto_tree  *volatile tree;

  proto_tree  *comments_tree;

  proto_tree  *volatile fh_tree = NULL;

  proto_item  *item;

  const char *cap_plurality, *frame_plurality;

  frame_data_t *fr_data = (frame_data_t*)data;

  const color_filter_t *color_filter;

  dissector_handle_t dissector_handle;

  fr_foreach_t fr_user_data;

  tree=parent_tree;

  if (!fr_data) {

    return 0;

  }

  /*

   * Set the protocol to the record type name.

   */

  pinfo->current_proto = pinfo->rec->rec_type_name;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, pinfo->rec->rec_type_name);

  if (wtap_block_count_option(fr_data->pkt_block, OPT_COMMENT) > 0) {

    TRY {

#ifdef _MSC_VER

      /* Win32: Visual-C Structured Exception Handling (SEH)

         to trap hardware exceptions like memory access violations */

      /* (a running debugger will be called before the except part below) */

      /* Note: A Windows "exceptional exception" may leave the kazlib's (Portable Exception Handling)

         stack in an inconsistent state thus causing a crash at some point in the

         handling of the exception.

         See: https://lists.wireshark.org/archives/wireshark-dev/200704/msg00243.html

      */

      __try {

#endif

        item = proto_tree_add_item(tree, proto_pkt_comment, tvb, 0, 0, ENC_NA);

        comments_tree = proto_item_add_subtree(item, ett_comments);

        fr_user_data.item = item;

        fr_user_data.tree = comments_tree;

        fr_user_data.pinfo = pinfo;

        fr_user_data.tvb = tvb;

        fr_user_data.n_changes = 0;

        wtap_block_foreach_option(fr_data->pkt_block, frame_add_comment, (void *)&fr_user_data);

#ifdef _MSC_VER

      } __except(EXCEPTION_EXECUTE_HANDLER /* handle all exceptions */) {

        ensure_tree_item(parent_tree, EXCEPTION_TREE_ITEMS);

        switch (GetExceptionCode()) {

        case(STATUS_ACCESS_VIOLATION):

          show_exception(tvb, pinfo, parent_tree, DissectorError,

                   "STATUS_ACCESS_VIOLATION: dissector accessed an invalid memory address");

          break;

        case(STATUS_INTEGER_DIVIDE_BY_ZERO):

          show_exception(tvb, pinfo, parent_tree, DissectorError,

                   "STATUS_INTEGER_DIVIDE_BY_ZERO: dissector tried an integer division by zero");

          break;

        case(STATUS_STACK_OVERFLOW):

          show_exception(tvb, pinfo, parent_tree, DissectorError,

                   "STATUS_STACK_OVERFLOW: dissector overflowed the stack (e.g. endless loop)");

          /* XXX - this will have probably corrupted the stack,

             which makes problems later in the exception code */

          break;

          /* XXX - add other hardware exception codes as required */

        default:

          show_exception(tvb, pinfo, parent_tree, DissectorError,

                   ws_strdup_printf("dissector caused an unknown exception: 0x%x", GetExceptionCode()));

        }

      }

#endif

    }

    CATCH_BOUNDS_AND_DISSECTOR_ERRORS {

      ensure_tree_item(parent_tree, EXCEPTION_TREE_ITEMS);

      show_exception(tvb, pinfo, parent_tree, EXCEPT_CODE, GET_MESSAGE);

    }

    ENDTRY;

  }

  cap_len = tvb_captured_length(tvb);

  frame_len = tvb_reported_length(tvb);

  /* If FRAME is not referenced from any filters we don't need to

     worry about generating any tree items.

     We do, however, have to worry about generating expert infos,

     as those have to show up if, for example, the user requests

     the expert info dialog.

     Therefore, the dissection code has to be careful about

     what stuff it does only if do_frame_dissection is true.

     XXX - all these tricks to optimize dissection if only some

     information is required are fragile.  Something better that

     handles this automatically would be useful. */

  bool do_frame_dissection = proto_field_is_referenced(tree, proto_frame);

  cap_plurality = plurality(cap_len, "", "s");

  frame_plurality = plurality(frame_len, "", "s");

  /* Put in frame header information. */

  if (do_frame_dissection) {

    ti = proto_tree_add_protocol_format(tree, proto_frame, tvb, 0, tvb_captured_length(tvb),

        "Frame %u: %s", pinfo->num, pinfo->rec->rec_type_name);

  } else {

    ti = NULL;

  }

  switch (pinfo->rec->rec_type) {

  case REC_TYPE_PACKET:

    if (do_frame_dissection) {

      proto_item_append_text(ti, ", %u byte%s on wire",

          frame_len, frame_plurality);

      if (generate_bits_field)

        proto_item_append_text(ti, " (%u bits)", frame_len * 8);

      proto_item_append_text(ti, ", %u byte%s captured",

          cap_len, cap_plurality);

      if (generate_bits_field) {

        proto_item_append_text(ti, " (%u bits)",

            cap_len * 8);

      }

      if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID) {

        const char *interface_name = epan_get_interface_name(pinfo->epan,

            pinfo->rec->rec_header.packet_header.interface_id,

            pinfo->rec->presence_flags & WTAP_HAS_SECTION_NUMBER ? pinfo->rec->section_number : 0);

        if (interface_name != NULL) {

          proto_item_append_text(ti, " on interface %s, id %u",

              interface_name, pinfo->rec->rec_header.packet_header.interface_id);

        } else {

          proto_item_append_text(ti, " on unnamed interface, id %u",

              pinfo->rec->rec_header.packet_header.interface_id);

        }

      }

    }

    if (WTAP_OPTTYPE_SUCCESS == wtap_block_get_uint32_option_value(fr_data->pkt_block, OPT_PKT_FLAGS, &pack_flags)) {

      switch (PACK_FLAGS_DIRECTION(pack_flags)) {

      case PACK_FLAGS_DIRECTION_UNKNOWN:

      default:

        pinfo->p2p_dir = P2P_DIR_UNKNOWN;

        break;

      case PACK_FLAGS_DIRECTION_INBOUND:

        pinfo->p2p_dir = P2P_DIR_RECV;

        if (do_frame_dissection)

          proto_item_append_text(ti, " (inbound)");

        break;

      case PACK_FLAGS_DIRECTION_OUTBOUND:

        pinfo->p2p_dir = P2P_DIR_SENT;

        if (do_frame_dissection)

          proto_item_append_text(ti, " (outbound)");

        break;

      }

    }