Add conversation/endpoint statistics for Linux SLL

Bug: 14048
Change-Id: I320380c492b83f0e45bfbf20505deb3c5f11ae67
Reviewed-on: https://code.wireshark.org/review/24243
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

1 files changed, 80 insertions, 0 deletions

diff --git a/epan/dissectors/packet-sll.c b/epan/dissectors/packet-sll.c
index b678b56091..8f07a2022f 100644
--- a/epan/dissectors/packet-sll.c
+++ b/epan/dissectors/packet-sll.c
@@ -26,6 +26,7 @@
 
 #include <epan/packet.h>
 #include <epan/capture_dissectors.h>
+#include <epan/conversation_table.h>
 #include <epan/arptypes.h>
 #include <wsutil/pint.h>
 #include "packet-sll.h"
@@ -41,6 +42,11 @@
 
 void proto_register_sll(void);
 void proto_reg_handoff_sll(void);
+
+typedef struct sll_tap_data {
+	address src_address;
+} sll_tap_data;
+
 /*
  * A DLT_LINUX_SLL fake link-layer header.
  */
@@ -87,6 +93,7 @@ static dissector_handle_t netlink_handle;
 static header_field_info *hfi_sll = NULL;
 
 static int proto_sll;
+static int sll_tap = -1;
 
 #define SLL_HFI_INIT HFI_INIT(proto_sll)
 
@@ -159,6 +166,67 @@ static gpointer sll_value(packet_info *pinfo)
 	return p_get_proto_data(pinfo->pool, pinfo, proto_sll, 0);
 }
 
+static const char* sll_conv_get_filter_type(conv_item_t* conv, conv_filter_type_e filter)
+{
+	if ((filter == CONV_FT_SRC_ADDRESS) && (conv->src_address.type == AT_ETHER))
+		return "sll.src.eth";
+
+	if ((filter == CONV_FT_ANY_ADDRESS) && (conv->src_address.type == AT_ETHER))
+		return "sll.src.eth";
+
+	if ((filter == CONV_FT_SRC_ADDRESS) && (conv->src_address.type == AT_IPv4))
+		return "sll.src.ipv4";
+
+	if ((filter == CONV_FT_ANY_ADDRESS) && (conv->src_address.type == AT_IPv4))
+		return "sll.src.ipv4";
+
+	return CONV_FILTER_INVALID;
+}
+
+static ct_dissector_info_t sll_ct_dissector_info = {&sll_conv_get_filter_type};
+static address no_dst = {AT_NONE, 0, NULL, NULL};
+
+static int
+sll_conversation_packet(void *pct, packet_info *pinfo, epan_dissect_t *edt _U_, const void *vip)
+{
+	conv_hash_t *hash = (conv_hash_t*) pct;
+	const sll_tap_data *tap_data = (const sll_tap_data*)vip;
+
+	add_conversation_table_data(hash, &tap_data->src_address, &no_dst, 0, 0, 1, pinfo->fd->pkt_len, &pinfo->rel_ts, &pinfo->abs_ts, &sll_ct_dissector_info, ENDPOINT_NONE);
+
+	return 1;
+}
+
+static const char* sll_host_get_filter_type(hostlist_talker_t* host, conv_filter_type_e filter)
+{
+	if ((filter == CONV_FT_SRC_ADDRESS) && (host->myaddress.type == AT_ETHER))
+		return "sll.src.eth";
+
+	if ((filter == CONV_FT_ANY_ADDRESS) && (host->myaddress.type == AT_ETHER))
+		return "sll.src.eth";
+
+	if ((filter == CONV_FT_SRC_ADDRESS) && (host->myaddress.type == AT_IPv4))
+		return "sll.src.ipv4";
+
+	if ((filter == CONV_FT_ANY_ADDRESS) && (host->myaddress.type == AT_IPv4))
+		return "sll.src.ipv4";
+
+	return CONV_FILTER_INVALID;
+}
+
+static hostlist_dissector_info_t sll_host_dissector_info = {&sll_host_get_filter_type};
+
+static int
+sll_hostlist_packet(void *pit, packet_info *pinfo, epan_dissect_t *edt _U_, const void *vip)
+{
+	conv_hash_t *hash = (conv_hash_t*) pit;
+	const sll_tap_data *tap_data = (const sll_tap_data*)vip;
+
+	add_hostlist_table_data(hash, &tap_data->src_address, 0, TRUE, 1, pinfo->fd->pkt_len, &sll_host_dissector_info, ENDPOINT_NONE);
+
+	return 1;
+}
+
 static gboolean
 capture_sll(const guchar *pd, int offset _U_, int len, capture_packet_info_t *cpinfo, const union wtap_pseudo_header *pseudo_header _U_)
 {
@@ -190,6 +258,7 @@ dissect_sll(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 	tvbuff_t *next_tvb;
 	proto_tree *fh_tree;
 	ethertype_data_t ethertype_data;
+	sll_tap_data* tap_data;
 
 	pkttype = tvb_get_ntohs(tvb, 0);
 
@@ -233,6 +302,8 @@ dissect_sll(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 	fh_tree = proto_item_add_subtree(ti, ett_sll);
 	proto_tree_add_item(fh_tree, &hfi_sll_pkttype, tvb, 0, 2, ENC_BIG_ENDIAN);
 
+	tap_data = wmem_new0(wmem_file_scope(), sll_tap_data);
+
 	/*
 	 * XXX - check the link-layer address type value?
 	 * For now, we just assume halen 4 is IPv4 and halen 6 is Ethernet.
@@ -244,11 +315,13 @@ dissect_sll(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 	case 4:
 		set_address_tvb(&pinfo->dl_src, AT_IPv4, 4, tvb, 6);
 		copy_address_shallow(&pinfo->src, &pinfo->dl_src);
+		copy_address_wmem(wmem_file_scope(), &tap_data->src_address, &pinfo->src);
 		proto_tree_add_item(fh_tree, &hfi_sll_src_ipv4, tvb, 6, 4, ENC_BIG_ENDIAN);
 		break;
 	case 6:
 		set_address_tvb(&pinfo->dl_src, AT_ETHER, 6, tvb, 6);
 		copy_address_shallow(&pinfo->src, &pinfo->dl_src);
+		copy_address_wmem(wmem_file_scope(), &tap_data->src_address, &pinfo->src);
 		proto_tree_add_item(fh_tree, &hfi_sll_src_eth, tvb, 6, 6, ENC_NA);
 		break;
 	case 0:
@@ -303,6 +376,9 @@ dissect_sll(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 			break;
 		}
 	}
+
+	tap_queue_packet(sll_tap, pinfo, tap_data);
+
 	return tvb_captured_length(tvb);
 }
 
@@ -345,6 +421,7 @@ proto_register_sll(void)
 	proto_register_subtree_array(ett, array_length(ett));
 
 	sll_handle = create_dissector_handle(dissect_sll, proto_sll);
+	sll_tap = register_tap("sll");
 
 	sll_linux_dissector_table = register_dissector_table (
 		"sll.ltype",
@@ -353,6 +430,9 @@ proto_register_sll(void)
 		BASE_HEX
 	);
 	register_capture_dissector_table("sll.ltype", "Linux SLL protocol");
+
+	register_conversation_table(proto_sll, TRUE, sll_conversation_packet, sll_hostlist_packet);
+
 	register_decode_as(&sll_da);
 }