ERF: Add dissection and wiretap support for ERF_TYPE_META.

ERF Dissector:
Add dissection for ERF_TYPE_META, Host ID and Flow ID extension headers.
Rename ERF extension header defines to ERF_EXT_HDR* and put in erf.h.

The Flow ID extension header has an improved 32-bit Flow Hash with a Hash Type
field describing what the hash was computed over. The Host ID extension header
contains a 48-bit organizationally unique Host Identifier. Both extension
headers contain the same 8-bit Source ID used for distinguishing records from
multiple sources in the same file and for metadata linking to ERF_TYPE_META
records. Host ID is used to identify the capturing host and can also be used to
distinguish records from multiple hosts in the same file.

ERF_TYPE_META records have a payload consisting of TLV metadata, divided into
sections which define the context of the TLV tag. The dissector registers
a field for each tag for each section type based on a template.
ERF_TYPE_META records generally have a Host ID extension header used to link
metadata to packet records with the same Host ID and Source ID. The associated
Host ID can either be explicit on all records, or implicit where the Host ID
extension header is only present on MetaERF records and other records are
associated using only the Source ID in the Flow ID extension header.

Includes per-record generated Source summary and frame linking. These have the
'correct' Host ID and Source IDs from either extension header, including
applying the Implicit Host ID, and links to the most recent ERF_TYPE_META
record. Relies on Wireshark doing more than one pass to associate the correct
implicit Host ID tree items for records before the first ERF_TYPE_META record.
The metadata is technically not associated at that point anyway.

ERF Wiretap:
Add per-HostID/per-SourceID wtap interfaces and basic ERF_TYPE_META support.

Adds read support for displaying some fields of the 'first'
ERF_TYPE_META record in the Capture File Properties screen. Concatenates
and merges some summary fields to provide more useful information and
attempt to combine ERF sources, streams and interfaces into wtap interfaces.

Interface naming gracefully degrades when Host ID and Source ID are not present
and is intended to be parseable for use by DAG software.
Supports Implicit Host ID, but assumes it does not change.
NOTE: Now only ERF interfaces that are present in the file are added.
Only works with native ERF files for now. Written such that it is easily
adapted for use by pcap dissector.

Some support for setting REC_TYPE_FT_SPECIFIC_REPORT on MetaERF records.
Disabled for now as this breaks pcapng_dump saving of ERF_TYPE_META
and ft_specific_record_phdr clashes with erf_mc_phdr.
Only when native ERF file (as uses wth->file_type_subtype).
Register packet-erf as a dissector of WTAP_FILE_TYPE_SUBTYPE_ERF.

Bug: 12303
Change-Id: I6a697cdc851319595da2852f3a977cef8a42431d
Reviewed-on: https://code.wireshark.org/review/14510
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>

1 files changed, 184 insertions, 0 deletions

diff --git a/wiretap/erf.h b/wiretap/erf.h
index 870db96140..bc22a5b660 100644
--- a/wiretap/erf.h
+++ b/wiretap/erf.h
@@ -96,6 +96,177 @@
 #define ERF_TYPE_MIN  1   /* sanity checking */
 #define ERF_TYPE_MAX  48  /* sanity checking */
 
+#define ERF_EXT_HDR_TYPE_CLASSIFICATION  3
+#define ERF_EXT_HDR_TYPE_INTERCEPTID     4
+#define ERF_EXT_HDR_TYPE_RAW_LINK        5
+#define ERF_EXT_HDR_TYPE_BFS             6
+#define ERF_EXT_HDR_TYPE_CHANNELISED    12
+#define ERF_EXT_HDR_TYPE_SIGNATURE      14
+#define ERF_EXT_HDR_TYPE_FLOW_ID        16
+#define ERF_EXT_HDR_TYPE_HOST_ID        17
+
+/* Host ID */
+#define ERF_EHDR_HOST_ID_MASK G_GUINT64_CONSTANT(0xffffffffffff)
+
+/* ERF Meta */
+#define ERF_META_SECTION_MASK 0xFF00
+#define ERF_META_IS_SECTION(type) (type > 0 && (type & ERF_META_SECTION_MASK) == ERF_META_SECTION_MASK)
+
+#define ERF_META_SECTION_CAPTURE     0xFF00
+#define ERF_META_SECTION_HOST        0xFF01
+#define ERF_META_SECTION_MODULE      0xFF02
+#define ERF_META_SECTION_INTERFACE   0xFF03
+#define ERF_META_SECTION_FLOW        0xFF04
+#define ERF_META_SECTION_STATS       0xFF05
+#define ERF_META_SECTION_INFO        0xFF06
+#define ERF_META_SECTION_CONTEXT     0xFF07
+#define ERF_META_SECTION_STREAM      0xFF08
+#define ERF_META_SECTION_TRANSFORM   0xFF09
+#define ERF_META_SECTION_DNS         0xFF0A
+#define ERF_META_SECTION_SOURCE      0xFF0B
+
+#define ERF_META_TAG_padding           0
+#define ERF_META_TAG_comment           1
+#define ERF_META_TAG_gen_time          2
+#define ERF_META_TAG_parent_section    3
+#define ERF_META_TAG_reset             4
+#define ERF_META_TAG_event_time        5
+#define ERF_META_TAG_host_id           6
+#define ERF_META_TAG_fcs_len           8
+#define ERF_META_TAG_mask_ipv4         9
+#define ERF_META_TAG_mask_cidr         10
+
+#define ERF_META_TAG_org_name          11
+#define ERF_META_TAG_name              12
+#define ERF_META_TAG_descr             13
+#define ERF_META_TAG_config            14
+#define ERF_META_TAG_datapipe          15
+#define ERF_META_TAG_app_name          16
+#define ERF_META_TAG_os                17
+#define ERF_META_TAG_hostname          18
+#define ERF_META_TAG_user              19
+#define ERF_META_TAG_model             20
+#define ERF_META_TAG_fw_version        21
+#define ERF_META_TAG_serial_no         22
+#define ERF_META_TAG_ts_offset         23
+#define ERF_META_TAG_ts_clock_freq     24
+#define ERF_META_TAG_tzone             25
+#define ERF_META_TAG_tzone_name        26
+#define ERF_META_TAG_loc_lat           27
+#define ERF_META_TAG_loc_long          28
+#define ERF_META_TAG_snaplen           29
+#define ERF_META_TAG_card_num          30
+#define ERF_META_TAG_module_num        31
+#define ERF_META_TAG_access_num        32
+#define ERF_META_TAG_stream_num        33
+#define ERF_META_TAG_loc_name          34
+#define ERF_META_TAG_parent_file       35
+#define ERF_META_TAG_filter            36
+#define ERF_META_TAG_flow_hash_mode    37
+#define ERF_META_TAG_tunneling_mode    38
+#define ERF_META_TAG_npb_format        39
+#define ERF_META_TAG_mem               40
+#define ERF_META_TAG_datamine_id       41
+#define ERF_META_TAG_rotfile_id        42
+#define ERF_META_TAG_rotfile_name      43
+#define ERF_META_TAG_dev_name          44
+#define ERF_META_TAG_dev_path          45
+#define ERF_META_TAG_loc_descr         46
+#define ERF_META_TAG_app_version       47
+#define ERF_META_TAG_cpu_affinity      48
+#define ERF_META_TAG_cpu               49
+#define ERF_META_TAG_cpu_phys_cores    50
+#define ERF_META_TAG_cpu_numa_nodes    51
+#define ERF_META_TAG_dag_attribute     52
+#define ERF_META_TAG_dag_version       53
+
+#define ERF_META_TAG_if_num            64
+#define ERF_META_TAG_if_vc             65
+#define ERF_META_TAG_if_speed          66
+#define ERF_META_TAG_if_ipv4           67
+#define ERF_META_TAG_if_ipv6           68
+#define ERF_META_TAG_if_mac            69
+#define ERF_META_TAG_if_eui            70
+#define ERF_META_TAG_if_ib_gid         71
+#define ERF_META_TAG_if_ib_lid         72
+#define ERF_META_TAG_if_wwn            73
+#define ERF_META_TAG_if_fc_id          74
+#define ERF_META_TAG_if_tx_speed       75
+#define ERF_META_TAG_if_erf_type       76
+#define ERF_META_TAG_if_link_type      77
+#define ERF_META_TAG_if_sfp_type       78
+#define ERF_META_TAG_if_rx_power       79
+#define ERF_META_TAG_if_tx_power       80
+#define ERF_META_TAG_if_link_status    81
+#define ERF_META_TAG_if_phy_mode       82
+#define ERF_META_TAG_if_port_type      83
+
+#define ERF_META_TAG_src_ipv4          128
+#define ERF_META_TAG_dest_ipv4         129
+#define ERF_META_TAG_src_ipv6          130
+#define ERF_META_TAG_dest_ipv6         131
+#define ERF_META_TAG_src_mac           132
+#define ERF_META_TAG_dest_mac          133
+#define ERF_META_TAG_src_eui           134
+#define ERF_META_TAG_dest_eui          135
+#define ERF_META_TAG_src_ib_gid        136
+#define ERF_META_TAG_dest_ib_gid       137
+#define ERF_META_TAG_src_ib_lid        138
+#define ERF_META_TAG_dest_ib_lid       139
+#define ERF_META_TAG_src_wwn           140
+#define ERF_META_TAG_dest_wwn          141
+#define ERF_META_TAG_src_fc_id         142
+#define ERF_META_TAG_dest_fc_id        143
+#define ERF_META_TAG_src_port          144
+#define ERF_META_TAG_dest_port         145
+#define ERF_META_TAG_ip_proto          146
+#define ERF_META_TAG_flow_hash         147
+#define ERF_META_TAG_filter_match      148
+#define ERF_META_TAG_filter_match_name 149
+#define ERF_META_TAG_error_flags       150
+
+#define ERF_META_TAG_start_time        193
+#define ERF_META_TAG_end_time          194
+#define ERF_META_TAG_stat_if_drop      195
+#define ERF_META_TAG_stat_frames       196
+#define ERF_META_TAG_stat_bytes        197
+#define ERF_META_TAG_stat_cap          198
+#define ERF_META_TAG_stat_cap_bytes    199
+#define ERF_META_TAG_stat_os_drop      200
+#define ERF_META_TAG_stat_ds_lctr      201
+#define ERF_META_TAG_stat_filter_match 202
+#define ERF_META_TAG_stat_filter_drop  203
+#define ERF_META_TAG_stat_too_short    204
+#define ERF_META_TAG_stat_too_long     205
+#define ERF_META_TAG_stat_rx_error     206
+#define ERF_META_TAG_stat_fcs_error    207
+#define ERF_META_TAG_stat_aborted      208
+#define ERF_META_TAG_stat_proto_error  209
+#define ERF_META_TAG_stat_b1_error     210
+#define ERF_META_TAG_stat_b2_error     211
+#define ERF_META_TAG_stat_b3_error     212
+#define ERF_META_TAG_stat_rei_error    213
+#define ERF_META_TAG_stat_drop         214
+#define ERF_META_TAG_stat_buf_drop     215
+#define ERF_META_TAG_stream_drop       216
+#define ERF_META_TAG_stream_buf_drop   217
+
+#define ERF_META_TAG_ns_host_ipv4      256
+#define ERF_META_TAG_ns_host_ipv6      257
+#define ERF_META_TAG_ns_host_mac       258
+#define ERF_META_TAG_ns_host_eui       259
+#define ERF_META_TAG_ns_host_ib_gid    260
+#define ERF_META_TAG_ns_host_ib_lid    261
+#define ERF_META_TAG_ns_host_wwn       262
+#define ERF_META_TAG_ns_host_fc_id     263
+#define ERF_META_TAG_ns_dns_ipv4       264
+#define ERF_META_TAG_ns_dns_ipv6       265
+
+#define ERF_META_TAG_exthdr            321
+#define ERF_META_TAG_pcap_ng_block     322
+#define ERF_META_TAG_asn1              323
+
+
  /*
   * The timestamp is 64bit unsigned fixed point little-endian value with
   * 32 bits for second and 32 bits for fraction.
@@ -130,6 +301,13 @@ union erf_subhdr {
   struct erf_eth_hdr eth_hdr;
 };
 
+typedef struct {
+  GHashTable* if_map;
+  guint64 implicit_host_id;
+  gboolean capture_metadata;
+  gboolean host_metadata;
+} erf_t;
+
 #define MIN_RECORDS_FOR_ERF_CHECK 3
 #define RECORDS_FOR_ERF_CHECK 20
 #define FCS_BITS	32
@@ -138,7 +316,13 @@ wtap_open_return_val erf_open(wtap *wth, int *err, gchar **err_info);
 int erf_dump_can_write_encap(int encap);
 int erf_dump_open(wtap_dumper *wdh, int *err);
 
+erf_t* erf_priv_create(void);
+erf_t* erf_priv_free(erf_t* erf_priv);
+
 int erf_populate_interfaces(wtap *wth);
+int erf_populate_interface(erf_t* erf_priv, wtap *wth, union wtap_pseudo_header *pseudo_header, guint64 host_id, guint8 source_id, guint8 if_num);
+int erf_populate_interface_from_header(erf_t* erf_priv, wtap *wth, union wtap_pseudo_header *pseudo_header);
+int erf_get_source_from_header(union wtap_pseudo_header *pseudo_header, guint64 *host_id, guint8 *source_id);
 
 #endif /* __W_ERF_H__ */