/* Code to actually dissect the packets */ static void dissect_msnlb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_item *ti; proto_tree *msnlb_tree; guint16 offset = 0; guint8 type = 0; /* Blatent assumption of name and size */ col_set_str(pinfo->cinfo, COL_PROTOCOL, "MS NLB"); if (check_col(pinfo->cinfo, COL_INFO)) { col_clear(pinfo->cinfo, COL_INFO); col_append_str(pinfo->cinfo, COL_INFO, "MS NLB heartbeat"); } if (tree) { ti = proto_tree_add_item(tree, proto_msnlb, tvb, 0, -1, FALSE); msnlb_tree = proto_item_add_subtree(ti, ett_msnlb); type = tvb_get_guint8(tvb, offset); proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_hpn, tvb, offset, 4, TRUE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_cls_virt_ip, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_host_ip, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; switch (type) { case 0xc0: offset = display_unicode_string(tvb, msnlb_tree, offset, hf_msnlb_host_name, NULL); break; case 0xbf: proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_count, tvb, offset, 4, TRUE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, 4, FALSE); offset += 4; default: proto_tree_add_item(msnlb_tree, hf_msnlb_unknown, tvb, offset, tvb_length_remaining(tvb, offset), FALSE); offset += 4; } } }
static int dissect_headers(proto_tree *tree, tvbuff_t *tvb, int offset, packet_info *pinfo) { proto_tree *hdrs_tree = NULL; proto_tree *hdr_tree = NULL; proto_item *hdr = NULL; proto_item *handle_item; gint item_length = -1; guint8 hdr_id, i; if (tvb_length_remaining(tvb, offset) > 0) { proto_item *hdrs; hdrs = proto_tree_add_text(tree, tvb, offset, item_length, "Headers"); hdrs_tree = proto_item_add_subtree(hdrs, ett_btobex_hdrs); } else { return offset; } while (tvb_length_remaining(tvb, offset) > 0) { hdr_id = tvb_get_guint8(tvb, offset); switch(0xC0 & hdr_id) { case 0x00: /* null terminated unicode */ item_length = tvb_get_ntohs(tvb, offset+1); break; case 0x40: /* byte sequence */ item_length = tvb_get_ntohs(tvb, offset+1); break; case 0x80: /* 1 byte */ item_length = 2; break; case 0xc0: /* 4 bytes */ item_length = 5; break; } hdr = proto_tree_add_text(hdrs_tree, tvb, offset, item_length, "%s", val_to_str_ext_const(hdr_id, &header_id_vals_ext, "Unknown")); hdr_tree = proto_item_add_subtree(hdr, ett_btobex_hdr); proto_tree_add_item(hdr_tree, hf_hdr_id, tvb, offset, 1, ENC_BIG_ENDIAN); offset++; switch(0xC0 & hdr_id) { case 0x00: /* null terminated unicode */ { proto_tree_add_item(hdr_tree, hf_hdr_length, tvb, offset, 2, ENC_BIG_ENDIAN); offset += 2; if ((item_length - 3) > 0) { char *str; display_unicode_string(tvb, hdr_tree, offset, &str); proto_item_append_text(hdr_tree, " (\"%s\")", str); col_append_fstr(pinfo->cinfo, COL_INFO, " \"%s\"", str); } else { col_append_str(pinfo->cinfo, COL_INFO, " \"\""); } offset += item_length - 3; } break; case 0x40: /* byte sequence */ proto_tree_add_item(hdr_tree, hf_hdr_length, tvb, offset, 2, ENC_BIG_ENDIAN); offset += 2; handle_item = proto_tree_add_item(hdr_tree, hf_hdr_val_byte_seq, tvb, offset, item_length - 3, ENC_NA); if (((hdr_id == 0x46) || (hdr_id == 0x4a)) && (item_length == 19)) { /* target or who */ for(i=0; target_vals[i].strptr != NULL; i++) { if (tvb_memeql(tvb, offset, target_vals[i].value, 16) == 0) { proto_item_append_text(handle_item, ": %s", target_vals[i].strptr); proto_item_append_text(hdr_tree, " (%s)", target_vals[i].strptr); col_append_fstr(pinfo->cinfo, COL_INFO, " - %s", target_vals[i].strptr); } } } if (!tvb_strneql(tvb, offset, "<?xml", 5)) { tvbuff_t* next_tvb = tvb_new_subset_remaining(tvb, offset); call_dissector(xml_handle, next_tvb, pinfo, tree); } else if (is_ascii_str(tvb_get_ptr(tvb, offset,item_length - 3), item_length - 3)) { proto_item_append_text(hdr_tree, " (\"%s\")", tvb_get_ephemeral_string(tvb, offset,item_length - 3)); col_append_fstr(pinfo->cinfo, COL_INFO, " \"%s\"", tvb_get_ephemeral_string(tvb, offset,item_length - 3)); } offset += item_length - 3; break; case 0x80: /* 1 byte */ proto_item_append_text(hdr_tree, " (%i)", tvb_get_ntohl(tvb, offset)); proto_tree_add_item(hdr_tree, hf_hdr_val_byte, tvb, offset, 1, ENC_BIG_ENDIAN); offset++; break; case 0xc0: /* 4 bytes */ proto_item_append_text(hdr_tree, " (%i)", tvb_get_ntohl(tvb, offset)); proto_tree_add_item(hdr_tree, hf_hdr_val_long, tvb, offset, 4, ENC_BIG_ENDIAN); offset += 4; break; default: break; } } return offset; }