Cisco ACI specific protocol enhancements

Add Ethertype for Cisco ACI ARP gleaning and dissect its payload
Improve some Cisco ACI vendor specific DHCP options
Update mcp after looking at knet_parser.py
Update lldp after looking at knet_parser.py

Also reorder some ETHERTYPEs by value

1 files changed, 74 insertions, 59 deletions

diff --git a/epan/dissectors/packet-cisco-mcp.c b/epan/dissectors/packet-cisco-mcp.c
index 7082479bc8..00e27dc434 100644
--- a/epan/dissectors/packet-cisco-mcp.c
+++ b/epan/dissectors/packet-cisco-mcp.c
@@ -1,5 +1,5 @@
 /* packet-cisco-mcp.c
- * Routines for the disassembly of Cisco's MCP (Miscabling Protocol)
+ * Routines for the disassembly of Cisco's MCP (MisCabling Protocol)
  *
  * Copyright 2019 Joerg Mayer (see AUTHORS file)
  *
@@ -12,9 +12,7 @@
 
 /*
   TODO:
-  - Figure out the meaning of more types
   - Figure out the hash calculation
-  - Display Value in TLV toplevel item where appropriate
 
 Specs: No specs available
   No header
@@ -28,6 +26,7 @@ Patent:
 Documentation:
   https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737909.pdf
   https://unofficialaciguide.com/2018/03/27/using-mcp-miscabling-protocol-for-aci/
+  knet_parser.py from Cisco
  */
 
 #include "config.h"
@@ -45,13 +44,14 @@ static int proto_mcp = -1;
 static int hf_mcp_tlv_type = -1;
 static int hf_mcp_tlv_length = -1;
 /* Values */
-static int hf_mcp_1 = -1;
-static int hf_mcp_switchid = -1;
-static int hf_mcp_3 = -1;
-static int hf_mcp_ifindex = -1;
-static int hf_mcp_timestamp = -1;
-static int hf_mcp_hmac = -1;
-// static int hf_mcp_end = -1;
+static int hf_mcp_fabric_id = -1;
+static int hf_mcp_node_id = -1;
+static int hf_mcp_vpc_domain = -1;
+static int hf_mcp_vpc_id = -1;
+static int hf_mcp_vpc_vtep = -1;
+static int hf_mcp_port_id = -1;
+static int hf_mcp_send_time = -1;
+static int hf_mcp_digest = -1;
 static int hf_mcp_unknown = -1;
 
 static expert_field ei_mcp_short_tlv = EI_INIT;
@@ -65,22 +65,22 @@ static gint ett_mcp_tlv_header = -1;
 #define PROTO_LONG_NAME "Miscabling Protocol"
 
 typedef enum {
-	MCP_TYPE_1 = 1,		// Len=4, perhaps version or fabric-id
-	MCP_TYPE_SWITCHID = 2,	// Len=4,
-	MCP_TYPE_3 = 3,		// Len=12,
-	MCP_TYPE_IFINDEX = 4,	// Len=4,
-	MCP_TYPE_TIMESTAMP = 5,	// Len=4,
-	MCP_TYPE_HMAC = 6,	// Len=20, Guessing, possibly SHA1
+	MCP_TYPE_FABRIC_ID = 1,	// Len=4,
+	MCP_TYPE_NODE_ID = 2,	// Len=4,
+	MCP_TYPE_VPC_INFO = 3,	// Len=12,
+	MCP_TYPE_PORT_ID = 4,	// Len=4,
+	MCP_TYPE_SEND_TIME = 5,	// Len=4,
+	MCP_TYPE_DIGEST = 6,	// Len=20,
 	MCP_TYPE_END = 7	// Len=0
 } mcp_type_t;
 
 static const value_string mcp_type_vals[] = {
-	{ MCP_TYPE_1,		"Unknown1"},
-	{ MCP_TYPE_SWITCHID,	"SwitchID"},
-	{ MCP_TYPE_3,		"Unknown3"},
-	{ MCP_TYPE_IFINDEX,	"IfIndex"},
-	{ MCP_TYPE_TIMESTAMP,	"Timestamp"},
-	{ MCP_TYPE_HMAC,	"HMAC?"},
+	{ MCP_TYPE_FABRIC_ID,	"Fabric ID"},
+	{ MCP_TYPE_NODE_ID,	"Node ID"},
+	{ MCP_TYPE_VPC_INFO,	"VPC Info"},
+	{ MCP_TYPE_PORT_ID,	"Port ID"},
+	{ MCP_TYPE_SEND_TIME,	"Send Time"},
+	{ MCP_TYPE_DIGEST,	"Digest"},
 	{ MCP_TYPE_END,		"End"},
 
 	{ 0,	NULL }
@@ -89,7 +89,7 @@ static const value_string mcp_type_vals[] = {
 static int
 dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 {
-	proto_item *ti;
+	proto_item *ti, *pi;
 	proto_tree *mcp_tree;
 	proto_tree *tlv_tree;
 	guint32 offset = 0;
@@ -97,8 +97,8 @@ dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 	guint8 tlv_type;
 	guint16 tlv_length;
 	guint16 data_length = tvb_reported_length_remaining(tvb, offset);;
-	guint32 switchid, ifindex, timestamp;
-	gchar* timestamp_str;
+	guint32 fabricid, nodeid, vpcdomain, vpcid, portid, sendtime;
+	gchar *sendtime_str, *vpcvtep_str;
 
 	col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_SHORT_NAME);
 	col_set_str(pinfo->cinfo, COL_INFO, "");
@@ -118,8 +118,7 @@ dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 		tlv_length = tvb_get_guint8(tvb, offset + 1);
 
 		tlv_tree = proto_tree_add_subtree_format(mcp_tree, tvb, offset, tlv_length + 2,
-			ett_mcp_tlv_header, NULL, "TLV length %d, type %d = %s",
-			tlv_length, tlv_type, val_to_str(tlv_type, mcp_type_vals, "Unknown (0x%02x)"));
+			ett_mcp_tlv_header, NULL, "%s", val_to_str(tlv_type, mcp_type_vals, "Unknown (0x%02x)"));
 
 		proto_tree_add_uint(tlv_tree, hf_mcp_tlv_type, tvb, offset, 1, tlv_type);
 		offset += 1;
@@ -133,56 +132,64 @@ dissect_mcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 		offset += 1;
 
 		switch (tlv_type) {
-		case MCP_TYPE_1:
+		case MCP_TYPE_FABRIC_ID:
 			if (tlv_length == 4) {
-				proto_tree_add_item(tlv_tree, hf_mcp_1, tvb, offset, tlv_length, ENC_BIG_ENDIAN);
+				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_fabric_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &fabricid);
+				proto_item_append_text(tlv_tree, ": %u", fabricid);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "FabricID/%u ", fabricid);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_SWITCHID:
+		case MCP_TYPE_NODE_ID:
 			if (tlv_length == 4) {
-				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_switchid, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &switchid);
-				proto_item_append_text(tlv_tree, ": %u", switchid);
-				col_append_fstr(pinfo->cinfo, COL_INFO, "SwID/%u ", switchid);
+				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_node_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &nodeid);
+				proto_item_append_text(tlv_tree, ": %u", nodeid);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "NodeID/%u ", nodeid);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_3:
-			proto_tree_add_item(tlv_tree, hf_mcp_3, tvb, offset, tlv_length, ENC_NA);
+		case MCP_TYPE_VPC_INFO:
+			proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_vpc_domain, tvb, offset, 4, ENC_NA, &vpcdomain);
+			proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_vpc_id, tvb, offset + 4, 4, ENC_NA, &vpcid);
+			pi = proto_tree_add_item(tlv_tree, hf_mcp_vpc_vtep, tvb, offset + 8, 4, ENC_NA);
+			vpcvtep_str = proto_item_get_display_repr(wmem_packet_scope(), pi);
+			proto_item_append_text(tlv_tree, ": %u/%u/%s", vpcdomain, vpcid, vpcvtep_str);
+// FIXME: Why is vpcvtep_str displayed as "(null)" in COL_INFO but not above??? scope???
+			col_append_fstr(pinfo->cinfo, COL_INFO, "VpcInfo/%u,%u,%s ", vpcdomain, vpcid, vpcvtep_str);
 			break;
-		case MCP_TYPE_IFINDEX:
+		case MCP_TYPE_PORT_ID:
 			if (tlv_length == 4) {
-				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_ifindex, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &ifindex);
-				proto_item_append_text(tlv_tree, ": 0x%08x", ifindex);
-				col_append_fstr(pinfo->cinfo, COL_INFO, "ifIdx/0x%08x ", ifindex);
+				proto_tree_add_item_ret_uint(tlv_tree, hf_mcp_port_id, tvb, offset, tlv_length, ENC_BIG_ENDIAN, &portid);
+				proto_item_append_text(tlv_tree, ": 0x%08x", portid);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "PortID/0x%08x ", portid);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_TIMESTAMP:
+		case MCP_TYPE_SEND_TIME:
 			if (tlv_length == 4) {
-				proto_tree_add_item(tlv_tree, hf_mcp_timestamp, tvb, offset, tlv_length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
-				timestamp = tvb_get_ntohl(tvb, offset);
-				timestamp_str = abs_time_secs_to_str(wmem_packet_scope(), timestamp, ABSOLUTE_TIME_LOCAL, TRUE);
-				proto_item_append_text(tlv_tree, ": %s", timestamp_str);
-				col_append_fstr(pinfo->cinfo, COL_INFO, "time/%s ", timestamp_str);
+				proto_tree_add_item(tlv_tree, hf_mcp_send_time, tvb, offset, tlv_length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
+				sendtime = tvb_get_ntohl(tvb, offset);
+				sendtime_str = abs_time_secs_to_str(wmem_packet_scope(), sendtime, ABSOLUTE_TIME_LOCAL, TRUE);
+				proto_item_append_text(tlv_tree, ": %s", sendtime_str);
+				col_append_fstr(pinfo->cinfo, COL_INFO, "SendTime/%s ", sendtime_str);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
 					4, tlv_length);
 			}
 			break;
-		case MCP_TYPE_HMAC:
+		case MCP_TYPE_DIGEST:
 			if (tlv_length == 20) {
-				proto_tree_add_item(tlv_tree, hf_mcp_hmac, tvb, offset, tlv_length, ENC_NA);
+				proto_tree_add_item(tlv_tree, hf_mcp_digest, tvb, offset, tlv_length, ENC_NA);
 			} else {
 				proto_tree_add_expert_format(mcp_tree, pinfo, &ei_mcp_unexpected_tlv_length, tvb,
 					offset, tlv_length, "Expected value length differs from seen length (%u != %u)",
@@ -226,28 +233,36 @@ proto_register_mcp(void)
 			0x0, NULL, HFILL }},
 
 	/* TLV data (aka V) */
-		{ &hf_mcp_1,
-		{ "Type1",	"mcp.type1", FT_UINT32, BASE_DEC, NULL,
+		{ &hf_mcp_fabric_id,
+		{ "Fabric ID",	"mcp.fabric_id", FT_UINT32, BASE_DEC, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_switchid,
-		{ "Switch ID",	"mcp.switchid", FT_UINT32, BASE_DEC, NULL,
+		{ &hf_mcp_node_id,
+		{ "Node ID",	"mcp.node_id", FT_UINT32, BASE_DEC, NULL,
 			0x0, "Originating Switch", HFILL }},
 
-		{ &hf_mcp_3,
-		{ "Type3",	"mcp.type3", FT_BYTES, BASE_NONE, NULL,
+		{ &hf_mcp_vpc_domain,
+		{ "VPC Domain",	"mcp.vpc.domain", FT_UINT32, BASE_DEC, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_ifindex,
-		{ "IfIndex",	"mcp.ifindex", FT_UINT32, BASE_HEX, NULL,
+		{ &hf_mcp_vpc_id,
+		{ "VPC ID",	"mcp.vpc.id", FT_UINT32, BASE_DEC, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_timestamp,
-		{ "Timestamp",	"mcp.timestamp", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL,
+		{ &hf_mcp_vpc_vtep,
+		{ "VPC VTEP",	"mcp.vpc.vtep", FT_IPv4, BASE_NONE, NULL,
 			0x0, NULL, HFILL }},
 
-		{ &hf_mcp_hmac,
-		{ "HMAC(?)",	"mcp.hmac", FT_BYTES, BASE_NONE, NULL,
+		{ &hf_mcp_port_id,
+		{ "Port ID",	"mcp.port_id", FT_UINT32, BASE_HEX, NULL,
+			0x0, NULL, HFILL }},
+
+		{ &hf_mcp_send_time,
+		{ "Send Time",	"mcp.send_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL,
+			0x0, NULL, HFILL }},
+
+		{ &hf_mcp_digest,
+		{ "Digest",	"mcp.digest", FT_BYTES, BASE_NONE, NULL,
 			0x0, NULL, HFILL }},
 
 		{ &hf_mcp_unknown,