epan/dissectors/packet-netlink.c

   1 /* packet-netlink.c
   2  *
   3  * Wireshark - Network traffic analyzer
   4  * By Gerald Combs <gerald@wireshark.org>
   5  * Copyright 1998 Gerald Combs
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 /* http://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html */
  23
  24 #define NEW_PROTO_TREE_API
  25
  26 #include "config.h"
  27
  28 #include <epan/packet.h>
  29 #include <epan/arptypes.h>
  30 #include <wiretap/wtap.h>
  31
  32 #include "packet-netlink.h"
  33
  34 void proto_register_netlink(void);
  35 void proto_reg_handoff_netlink(void);
  36
  37 /*
  38  * A DLT_LINUX_SLL fake link-layer header.
  39  */
  40 #define SLL_HEADER_SIZE 16              /* total header length */
  41
  42 static const value_string netlink_family_vals[] = {
  43         { WS_NETLINK_ROUTE,          "Route" },
  44         { WS_NETLINK_UNUSED,         "Unused" },
  45         { WS_NETLINK_USERSOCK,       "User-mode socket protocols" },
  46         { WS_NETLINK_FIREWALL,       "Unused (formerly: ip_queue)" },
  47         { WS_NETLINK_SOCK_DIAG,      "Socket monitoring" },
  48         { WS_NETLINK_NFLOG,          "Netfilter ULOG" },
  49         { WS_NETLINK_XFRM,           "IPsec" },
  50         { WS_NETLINK_SELINUX,        "SELinux events" },
  51         { WS_NETLINK_ISCSI,          "Open-iSCSI" },
  52         { WS_NETLINK_AUDIT,          "Auditing" },
  53         { WS_NETLINK_FIB_LOOKUP,     "FIB lookup" },
  54         { WS_NETLINK_CONNECTOR,      "Kernel connector" },
  55         { WS_NETLINK_NETFILTER,      "Netfilter" },
  56         { WS_NETLINK_IP6_FW,         "Unused (formerly: ip6_queue)" },
  57         { WS_NETLINK_DNRTMSG,        "DECnet routing messages" },
  58         { WS_NETLINK_KOBJECT_UEVENT, "Kernel messages to userspace" },
  59         { WS_NETLINK_GENERIC,        "Generic" },
  60         { WS_NETLINK_SCSITRANSPORT,  "SCSI Transports" },
  61         { WS_NETLINK_ECRYPTFS,       "ecryptfs" },
  62         { WS_NETLINK_RDMA,           "RDMA" },
  63         { WS_NETLINK_CRYPTO,         "Crypto layer" },
  64         { 0, NULL }
  65 };
  66
  67 value_string_ext netlink_family_vals_ext = VALUE_STRING_EXT_INIT(netlink_family_vals);
  68
  69 static const value_string type_vals[] = {
  70         { WS_NLMSG_NOOP,    "Nothing" },
  71         { WS_NLMSG_ERROR,   "Error" },
  72         { WS_NLMSG_DONE,    "End of a dump" },
  73         { WS_NLMSG_OVERRUN, "Data lost" },
  74         { 0, NULL }
  75 };
  76
  77 static const value_string ha_types[] = {
  78         { ARPHRD_NETLINK,    "Netlink" },
  79         { 0, NULL }
  80 };
  81
  82 static dissector_handle_t netlink_handle;
  83
  84 static header_field_info *hfi_netlink = NULL;
  85
  86 #define NETLINK_HFI_INIT HFI_INIT(proto_netlink)
  87
  88 static header_field_info hfi_netlink_hatype NETLINK_HFI_INIT =
  89         { "Link-layer address type", "netlink.hatype", FT_UINT16, BASE_DEC,
  90                 VALS(ha_types), 0x0, NULL, HFILL };
  91
  92 /* Linux netlink protocol type */
  93 static header_field_info hfi_netlink_family NETLINK_HFI_INIT =
  94         { "Family", "netlink.family", FT_UINT16, BASE_HEX | BASE_EXT_STRING,
  95                 &netlink_family_vals_ext, 0x00, NULL, HFILL };
  96
  97 static header_field_info hfi_netlink_hdr_len NETLINK_HFI_INIT =
  98         { "Length", "netlink.hdr_len", FT_UINT32, BASE_DEC,
  99                 NULL, 0x00, "Length of message including header", HFILL };
 100
 101 static header_field_info hfi_netlink_hdr_type NETLINK_HFI_INIT =
 102         { "Message type", "netlink.hdr_type", FT_UINT16, BASE_HEX,
 103                 VALS(type_vals), 0x00, "Type of message content", HFILL };
 104
 105 static header_field_info hfi_netlink_hdr_flags NETLINK_HFI_INIT =
 106         { "Flags", "netlink.hdr_flags", FT_UINT16, BASE_HEX,
 107                 NULL, 0x00, "Additional flags", HFILL };
 108
 109 static header_field_info hfi_netlink_hdr_flag_dumpfiltered NETLINK_HFI_INIT =
 110         { "Dump filtered", "netlink.hdr_flags.dump_filtered", FT_UINT16, BASE_DEC,
 111                 NULL, WS_NLM_F_DUMP_FILTERED, "Dump was filtered as requested", HFILL };
 112
 113 static header_field_info hfi_netlink_hdr_flag_dumpintr NETLINK_HFI_INIT =
 114         { "Dump inconsistent", "netlink.hdr_flags.dump_intr", FT_UINT16, BASE_DEC,
 115                 NULL, WS_NLM_F_DUMP_INTR, "Dump was inconsistent due to sequence change", HFILL };
 116
 117 static header_field_info hfi_netlink_hdr_flag_echo NETLINK_HFI_INIT =
 118         { "Echo", "netlink.hdr_flags.echo", FT_UINT16, BASE_DEC,
 119                 NULL, WS_NLM_F_ECHO, "Echo this request", HFILL };
 120
 121 static header_field_info hfi_netlink_hdr_flag_ack NETLINK_HFI_INIT =
 122         { "Ack", "netlink.hdr_flags.ack", FT_UINT16, BASE_DEC,
 123                 NULL, WS_NLM_F_ACK, "Asking for an ack", HFILL };
 124
 125 static header_field_info hfi_netlink_hdr_flag_multi NETLINK_HFI_INIT =
 126         { "Multipart message", "netlink.hdr_flags.multi", FT_UINT16, BASE_DEC,
 127                 NULL, WS_NLM_F_MULTI, "Part of multi-part message terminated by NLMSG_DONE", HFILL };
 128
 129 static header_field_info hfi_netlink_hdr_flag_request NETLINK_HFI_INIT =
 130         { "Request", "netlink.hdr_flags.request", FT_UINT16, BASE_DEC,
 131                 NULL, WS_NLM_F_REQUEST, "It is a request message", HFILL };
 132
 133 static header_field_info hfi_netlink_hdr_flag_root NETLINK_HFI_INIT =
 134         { "Specify tree root", "netlink.hdr_flags.root", FT_UINT16, BASE_DEC,
 135                 NULL, WS_NLM_F_ROOT, "Return the complete table instead of a single entry", HFILL };
 136
 137 static header_field_info hfi_netlink_hdr_flag_match NETLINK_HFI_INIT =
 138         { "Return all matching", "netlink.hdr_flags.match", FT_UINT16, BASE_DEC,
 139                 NULL, WS_NLM_F_MATCH, "Return all entries matching criteria in request", HFILL };
 140
 141 static header_field_info hfi_netlink_hdr_flag_atomic NETLINK_HFI_INIT =
 142         { "Atomic", "netlink.hdr_flags.atomic", FT_UINT16, BASE_DEC,
 143                 NULL, WS_NLM_F_ATOMIC, "Return an atomic snapshot of the table", HFILL };
 144
 145 static header_field_info hfi_netlink_hdr_flag_replace NETLINK_HFI_INIT =
 146         { "Replace", "netlink.hdr_flags.replace", FT_UINT16, BASE_DEC,
 147                 NULL, WS_NLM_F_REPLACE, "Replace existing objects", HFILL };
 148
 149 static header_field_info hfi_netlink_hdr_flag_excl NETLINK_HFI_INIT =
 150         { "Excl", "netlink.hdr_flags.excl", FT_UINT16, BASE_DEC,
 151                 NULL, WS_NLM_F_EXCL, "Do not replace existing objects", HFILL };
 152
 153 static header_field_info hfi_netlink_hdr_flag_create NETLINK_HFI_INIT =
 154         { "Create", "netlink.hdr_flags.create", FT_UINT16, BASE_DEC,
 155                 NULL, WS_NLM_F_CREATE, "Create objects if it does not already exist", HFILL };
 156
 157 static header_field_info hfi_netlink_hdr_flag_append NETLINK_HFI_INIT =
 158         { "Append", "netlink.hdr_flags.append", FT_UINT16, BASE_DEC,
 159                 NULL, WS_NLM_F_APPEND, "Add to end of object list", HFILL };
 160
 161 static header_field_info hfi_netlink_hdr_seq NETLINK_HFI_INIT =
 162         { "Sequence", "netlink.hdr_seq", FT_UINT32, BASE_DEC,
 163                 NULL, 0x00, "Sequence number", HFILL };
 164
 165 static header_field_info hfi_netlink_hdr_pid NETLINK_HFI_INIT =
 166         { "Port ID", "netlink.hdr_pid", FT_UINT32, BASE_DEC,
 167                 NULL, 0x00, "Sender port ID", HFILL };
 168
 169 static header_field_info hfi_netlink_attr_type NETLINK_HFI_INIT =
 170         { "Type", "netlink.attr_type", FT_UINT16, BASE_HEX,
 171                 NULL, 0x0000, "Netlink Attribute type", HFILL };
 172
 173 static header_field_info hfi_netlink_attr_type_nested NETLINK_HFI_INIT =
 174         { "Nested", "netlink.attr_type.nested", FT_UINT16, BASE_DEC,
 175                 NULL, NLA_F_NESTED, "Carries nested attributes", HFILL };
 176
 177 static header_field_info hfi_netlink_attr_type_net_byteorder NETLINK_HFI_INIT =
 178         { "Network byte order", "netlink.attr_type.net_byteorder", FT_UINT16, BASE_DEC,
 179                 NULL, NLA_F_NET_BYTEORDER, "Payload stored in network byte order", HFILL };
 180
 181 static header_field_info hfi_netlink_attr_len NETLINK_HFI_INIT =
 182         { "Len", "netlink.attr_len", FT_UINT16, BASE_DEC,
 183                 NULL, 0x00, NULL, HFILL };
 184
 185 /* TODO add a value_string for errno. */
 186 static header_field_info hfi_netlink_error NETLINK_HFI_INIT =
 187         { "Error code", "netlink.error", FT_INT32, BASE_DEC,
 188                 NULL, 0x00, "Negative errno or 0 for acknowledgements", HFILL };
 189
 190 static gint ett_netlink_cooked = -1;
 191 static gint ett_netlink_msghdr = -1;
 192 static gint ett_netlink_msg = -1;
 193 static gint ett_netlink_hdr_flags = -1;
 194 static gint ett_netlink_attr_type = -1;
 195
 196 static dissector_table_t netlink_dissector_table;
 197
 198
 199 static const int *netlink_header_get_flags[] = {
 200         &hfi_netlink_hdr_flag_request.id,
 201         &hfi_netlink_hdr_flag_multi.id,
 202         &hfi_netlink_hdr_flag_ack.id,
 203         &hfi_netlink_hdr_flag_echo.id,
 204         &hfi_netlink_hdr_flag_dumpintr.id,
 205         &hfi_netlink_hdr_flag_dumpfiltered.id,
 206
 207         &hfi_netlink_hdr_flag_root.id,
 208         &hfi_netlink_hdr_flag_match.id,
 209         &hfi_netlink_hdr_flag_atomic.id,
 210         NULL
 211 };
 212
 213 static const int *netlink_header_new_flags[] = {
 214         &hfi_netlink_hdr_flag_request.id,
 215         &hfi_netlink_hdr_flag_multi.id,
 216         &hfi_netlink_hdr_flag_ack.id,
 217         &hfi_netlink_hdr_flag_echo.id,
 218         &hfi_netlink_hdr_flag_dumpintr.id,
 219         &hfi_netlink_hdr_flag_dumpfiltered.id,
 220
 221         &hfi_netlink_hdr_flag_replace.id,
 222         &hfi_netlink_hdr_flag_excl.id,
 223         &hfi_netlink_hdr_flag_create.id,
 224         &hfi_netlink_hdr_flag_append.id,
 225         NULL
 226 };
 227
 228 static const int *netlink_header_standard_flags[] = {
 229         &hfi_netlink_hdr_flag_request.id,
 230         &hfi_netlink_hdr_flag_multi.id,
 231         &hfi_netlink_hdr_flag_ack.id,
 232         &hfi_netlink_hdr_flag_echo.id,
 233         &hfi_netlink_hdr_flag_dumpintr.id,
 234         &hfi_netlink_hdr_flag_dumpfiltered.id,
 235         NULL
 236 };
 237
 238
 239 int
 240 dissect_netlink_attributes(tvbuff_t *tvb, header_field_info *hfi_type, int ett, void *data, proto_tree *tree, int offset, int length, netlink_attributes_cb_t cb)
 241 {
 242         int padding = (4 - offset) & 3;
 243
 244         /* align to 4 */
 245         offset += padding;
 246         if (length == -1) {
 247                 length = tvb_captured_length_remaining(tvb, offset);
 248         } else {
 249                 length -= padding;
 250         }
 251
 252         while (length >= 4) {
 253                 guint16 rta_len, rta_type, type;
 254
 255                 proto_item *ti, *type_item;
 256                 proto_tree *attr_tree, *type_tree;
 257
 258                 rta_len = tvb_get_letohs(tvb, offset);
 259                 if (rta_len < 4) {
 260                         /* XXX invalid expert */
 261                         break;
 262                 }
 263
 264                 /* XXX expert info when rta_len < length? */
 265                 rta_len = MIN(rta_len, length);
 266
 267                 attr_tree = proto_tree_add_subtree(tree, tvb, offset, rta_len, ett, &ti, "Attribute");
 268
 269                 proto_tree_add_item(attr_tree, &hfi_netlink_attr_len, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 270                 offset += 2;
 271
 272                 rta_type = tvb_get_letohs(tvb, offset);
 273                 type = rta_type & NLA_TYPE_MASK;
 274                 type_item = proto_tree_add_item(attr_tree, &hfi_netlink_attr_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 275                 type_tree = proto_item_add_subtree(type_item, ett_netlink_attr_type);
 276                 proto_tree_add_item(type_tree, &hfi_netlink_attr_type_nested, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 277                 proto_tree_add_item(type_tree, &hfi_netlink_attr_type_net_byteorder, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 278                 proto_tree_add_item(type_tree, hfi_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 279                 offset += 2;
 280
 281                 if (rta_type & NLA_F_NESTED)
 282                         proto_item_append_text(type_item, ", Nested");
 283
 284                 if (hfi_type->strings) {
 285                         /* XXX, export hf_try_val_to_str */
 286                         const char *rta_str = try_val_to_str(type, (const value_string *) hfi_type->strings);
 287
 288                         if (rta_str) {
 289                                 proto_item_append_text(type_item, ", %s (%d)", rta_str, type);
 290                                 proto_item_append_text(ti, ": %s", rta_str);
 291                         }
 292                 }
 293
 294                 if (!cb(tvb, data, attr_tree, rta_type, offset, rta_len - 4)) {
 295                         /* not handled */
 296                 }
 297
 298                 /* Assume offset already aligned, next offset is rta_len plus alignment. */
 299                 rta_len = MIN((rta_len + 3) & ~3, length);
 300                 offset += rta_len - 4;  /* Header was already skipped */
 301                 length -= rta_len;
 302         }
 303
 304         return offset;
 305 }
 306
 307 static int
 308 dissect_netlink_hdr(tvbuff_t *tvb, proto_tree *tree, int offset, int encoding, guint16 *type, guint32 *port_id)
 309 {
 310         guint16 hdr_flags;
 311         guint16 hdr_type;
 312
 313         proto_tree *fh_hdr;
 314         proto_item *pi_type;
 315
 316         fh_hdr = proto_tree_add_subtree(tree, tvb, offset, 16, ett_netlink_msghdr, NULL, "Header");
 317
 318         proto_tree_add_item(fh_hdr, &hfi_netlink_hdr_len, tvb, offset, 4, encoding);
 319         offset += 4;
 320
 321         pi_type = proto_tree_add_item(fh_hdr, &hfi_netlink_hdr_type, tvb, offset, 2, encoding);
 322         hdr_type = tvb_get_letohs(tvb, offset);
 323         if (hdr_type >= WS_NLMSG_MIN_TYPE) {
 324                 proto_item_set_text(pi_type, "Message type: Protocol-specific (0x%04x)", hdr_type);
 325         }
 326         if (type) {
 327                 *type = hdr_type;
 328         }
 329         offset += 2;
 330
 331         hdr_flags = tvb_get_guint16(tvb, offset, encoding);
 332         if ((hdr_flags & WS_NLM_F_REQUEST) && (hdr_flags & 0x0f00)) {
 333                 /* XXX detect based on the protocol family and message type
 334                  * whether this is a GET, NEW or regular request. */
 335                 proto_tree_add_bitmask(fh_hdr, tvb, offset, hfi_netlink_hdr_flags.id,
 336                         ett_netlink_hdr_flags, netlink_header_get_flags, encoding);
 337                 proto_tree_add_bitmask(fh_hdr, tvb, offset, hfi_netlink_hdr_flags.id,
 338                         ett_netlink_hdr_flags, netlink_header_new_flags, encoding);
 339         } else {
 340                 proto_tree_add_bitmask(fh_hdr, tvb, offset, hfi_netlink_hdr_flags.id,
 341                         ett_netlink_hdr_flags, netlink_header_standard_flags, encoding);
 342         }
 343
 344         offset += 2;
 345
 346         proto_tree_add_item(fh_hdr, &hfi_netlink_hdr_seq, tvb, offset, 4, encoding);
 347         offset += 4;
 348
 349         proto_tree_add_item_ret_uint(fh_hdr, hfi_netlink_hdr_pid.id, tvb, offset, 4, encoding, port_id);
 350         offset += 4;
 351
 352         return offset;
 353 }
 354
 355 static void
 356 dissect_netlink_error(tvbuff_t *tvb, proto_tree *tree, int offset, int encoding)
 357 {
 358         /*
 359          * XXX - this should make sure we don't run past the end of the
 360          * message.
 361          */
 362
 363         /*
 364          * Assume sizeof(int) == 4; RFC 3549 doesn't say "32 bits", it
 365          * says "integer (typically 32 bits)".
 366          */
 367         proto_tree_add_item(tree, &hfi_netlink_error, tvb, offset, 4, encoding);
 368         offset += 4;
 369
 370         dissect_netlink_hdr(tvb, tree, offset, encoding, NULL, NULL);
 371 }
 372
 373 static int
 374 dissect_netlink(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *_data _U_)
 375 {
 376         guint16     protocol, hatype;
 377         proto_item *ti;
 378         tvbuff_t   *next_tvb;
 379         proto_tree *fh_tree;
 380
 381         int offset;
 382
 383         hatype = tvb_get_ntohs(tvb, 2);
 384         if (hatype != ARPHRD_NETLINK)
 385                 return 0;
 386
 387         col_set_str(pinfo->cinfo, COL_PROTOCOL, "Netlink");
 388         col_clear(pinfo->cinfo, COL_INFO);
 389
 390         ti = proto_tree_add_protocol_format(tree, hfi_netlink->id, tvb, 0,
 391                         SLL_HEADER_SIZE, "Linux netlink (cooked header)");
 392         fh_tree = proto_item_add_subtree(ti, ett_netlink_cooked);
 393
 394         /* Unused 2B */
 395         offset = 2;
 396
 397         proto_tree_add_item(fh_tree, &hfi_netlink_hatype, tvb, offset, 2, ENC_BIG_ENDIAN);
 398         offset += 2;
 399
 400         /* Unused 10B */
 401         offset += 10;
 402
 403         protocol = tvb_get_ntohs(tvb, offset);
 404         proto_tree_add_item(fh_tree, &hfi_netlink_family, tvb, offset, 2, ENC_BIG_ENDIAN);
 405         offset += 2;
 406
 407         /* DISSECTOR_ASSERT(offset == 16); */
 408
 409         while (tvb_reported_length_remaining(tvb, offset) >= 16) {
 410                 struct packet_netlink_data data;
 411
 412                 int pkt_end_offset;
 413                 guint32 pkt_len;
 414                 guint32 port_id;
 415
 416                 proto_tree *fh_msg;
 417
 418
 419                 int encoding = ENC_LITTLE_ENDIAN; /* XXX */
 420
 421                 pkt_len = tvb_get_letohl(tvb, offset);
 422
 423                 pkt_end_offset = offset + pkt_len;
 424
 425                 fh_msg = proto_tree_add_subtree(tree, tvb, offset, pkt_len, ett_netlink_msg, NULL, "Netlink message");
 426
 427                 if (pkt_len < 16) {
 428                         /*
 429                          * This field includes the length of the 16-byte header,
 430                          * so its value is invalid.  Add it, report an error,
 431                          * and stop trying to dissect.
 432                          */
 433                         proto_tree *fh_hdr;
 434
 435                         fh_hdr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_netlink_msghdr, NULL, "Header");
 436
 437                         proto_tree_add_item(fh_hdr, &hfi_netlink_hdr_len, tvb, offset, 4, encoding);
 438                         /* XXX invalid expert */
 439                         break;
 440                 }
 441
 442                 offset = dissect_netlink_hdr(tvb, fh_msg, offset, encoding, &data.type, &port_id);
 443
 444                 /* XXX */
 445                 if (port_id == 0x00)
 446                         pinfo->p2p_dir = P2P_DIR_SENT; /* userspace -> kernel */
 447                 else
 448                         pinfo->p2p_dir = P2P_DIR_RECV; /* userspace or kernel -> userspace */
 449
 450                 if (data.type == WS_NLMSG_ERROR) {
 451                         dissect_netlink_error(tvb, fh_msg, offset, encoding);
 452                 } else if (pkt_len > 16) {
 453                         data.magic = PACKET_NETLINK_MAGIC;
 454                         data.encoding = encoding;
 455
 456                         next_tvb = tvb_new_subset_length(tvb, offset, pkt_len-16);
 457
 458                         if (!dissector_try_uint_new(netlink_dissector_table, protocol, next_tvb, pinfo, fh_msg, TRUE, &data))
 459                                 call_data_dissector(next_tvb, pinfo, fh_msg);
 460
 461                 }
 462
 463                 offset = pkt_end_offset;
 464         }
 465
 466         return offset;
 467 }
 468
 469 void
 470 proto_register_netlink(void)
 471 {
 472 #ifndef HAVE_HFI_SECTION_INIT
 473         static header_field_info *hfi[] = {
 474         /* Cooked header */
 475                 &hfi_netlink_hatype,
 476                 &hfi_netlink_family,
 477
 478         /* Netlink message header */
 479                 &hfi_netlink_hdr_len,
 480                 &hfi_netlink_hdr_type,
 481                 &hfi_netlink_hdr_flags,
 482                 &hfi_netlink_hdr_flag_request,
 483                 &hfi_netlink_hdr_flag_multi,
 484                 &hfi_netlink_hdr_flag_ack,
 485                 &hfi_netlink_hdr_flag_echo,
 486                 &hfi_netlink_hdr_flag_dumpintr,
 487                 &hfi_netlink_hdr_flag_dumpfiltered,
 488
 489                 &hfi_netlink_hdr_flag_root,
 490                 &hfi_netlink_hdr_flag_match,
 491                 &hfi_netlink_hdr_flag_atomic,
 492
 493                 &hfi_netlink_hdr_flag_replace,
 494                 &hfi_netlink_hdr_flag_excl,
 495                 &hfi_netlink_hdr_flag_create,
 496                 &hfi_netlink_hdr_flag_append,
 497
 498                 &hfi_netlink_hdr_seq,
 499                 &hfi_netlink_hdr_pid,
 500
 501         /* Netlink message attribute */
 502                 &hfi_netlink_attr_len,
 503                 &hfi_netlink_attr_type,
 504                 &hfi_netlink_attr_type_nested,
 505                 &hfi_netlink_attr_type_net_byteorder,
 506
 507         /* Netlink message payloads */
 508                 &hfi_netlink_error,
 509         };
 510 #endif
 511
 512         static gint *ett[] = {
 513                 &ett_netlink_cooked,
 514                 &ett_netlink_msghdr,
 515                 &ett_netlink_msg,
 516                 &ett_netlink_hdr_flags,
 517                 &ett_netlink_attr_type,
 518         };
 519
 520         int proto_netlink;
 521
 522         proto_netlink = proto_register_protocol("Linux netlink protocol",  "NETLINK", "netlink" );
 523         hfi_netlink = proto_registrar_get_nth(proto_netlink);
 524
 525         proto_register_fields(proto_netlink, hfi, array_length(hfi));
 526         proto_register_subtree_array(ett, array_length(ett));
 527
 528         netlink_handle = create_dissector_handle(dissect_netlink, proto_netlink);
 529
 530         netlink_dissector_table = register_dissector_table(
 531                 "netlink.protocol",
 532                 "Linux netlink protocol type",
 533                 proto_netlink, FT_UINT16,
 534                 BASE_HEX
 535         );
 536         register_dissector("netlink", dissect_netlink, proto_netlink);
 537 }
 538
 539 void
 540 proto_reg_handoff_netlink(void)
 541 {
 542         dissector_add_uint("wtap_encap", WTAP_ENCAP_NETLINK, netlink_handle);
 543 }
 544
 545 /*
 546  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 547  *
 548  * Local variables:
 549  * c-basic-offset: 8
 550  * tab-width: 8
 551  * indent-tabs-mode: t
 552  * End:
 553  *
 554  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 555  * :indentSize=8:tabSize=8:noTabs=false:
 556  */