ui/cli/tap-diameter-avp.c

   1 /* tap-diameter-avp.c
   2  * Copyright 2010 Andrej Kuehnal <andrejk@freenet.de>
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23  */
  24
  25 /*
  26  * This TAP enables extraction of most important diameter fields in text format.
  27  * - much more performance than -T text and -T pdml
  28  * - more powerfull than -T field and -z proto,colinfo
  29  * - exacltly one text line per diameter message
  30  * - multiple diameter messages in one frame supported
  31  *   E.g. one device watchdog answer and two credit control answers
  32  *        in one TCP packet produces 3 text lines.
  33  * - several fields with same name within one diameter message supported
  34  *   E.g. Multiple AVP(444) Subscription-Id-Data once with IMSI once with MSISDN
  35  * - several grouped AVPs supported
  36  *   E.g. Zero or more Multiple-Services-Credit-Control AVPs(456)
  37  */
  38
  39 #include "config.h"
  40
  41 #include <stdio.h>
  42
  43 #include <string.h>
  44 #include "epan/packet_info.h"
  45 #include <epan/tap.h>
  46 #include <epan/epan_dissect.h>
  47 #include <epan/stat_cmd_args.h>
  48 #include "epan/value_string.h"
  49 #include "epan/ftypes/ftypes.h"
  50 #include "epan/to_str.h"
  51 #include "epan/dissectors/packet-diameter.h"
  52
  53
  54 /* used to keep track of the statistics for an entire program interface */
  55 typedef struct _diameteravp_t {
  56         guint32 frame;
  57         guint32 diammsg_toprocess;
  58         guint32 cmd_code;
  59         guint32 req_count;
  60         guint32 ans_count;
  61         guint32 paired_ans_count;
  62         gchar* filter;
  63 } diameteravp_t;
  64
  65 /* Copied from proto.c */
  66 static gboolean
  67 tree_traverse_pre_order(proto_tree *tree, proto_tree_traverse_func func, gpointer data)
  68 {
  69         proto_node *pnode = tree;
  70         proto_node *child;
  71         proto_node *current;
  72
  73         if (func(pnode, data))
  74                 return TRUE;
  75
  76         child = pnode->first_child;
  77         while (child != NULL) {
  78                 current = child;
  79                 child = current->next;
  80                 if (tree_traverse_pre_order((proto_tree *)current, func, data))
  81                         return TRUE;
  82         }
  83         return FALSE;
  84 }
  85
  86 static gboolean
  87 diam_tree_to_csv(proto_node* node, gpointer data)
  88 {
  89         char* val_str=NULL;
  90         char* val_tmp=NULL;
  91         ftenum_t ftype;
  92         field_info* fi;
  93         header_field_info       *hfi;
  94         if(!node) {
  95                 fprintf(stderr,"traverse end: empty node. node='%p' data='%p'\n",(void *)node,(void *)data);
  96                 return FALSE;
  97         }
  98         fi=node->finfo;
  99         hfi=fi ? fi->hfinfo : NULL;
 100         if(!hfi) {
 101                 fprintf(stderr,"traverse end: hfi not found. node='%p'\n",(void *)node);
 102                 return FALSE;
 103         }
 104         ftype=fi->value.ftype->ftype;
 105         if (ftype!=FT_NONE&&ftype!=FT_PROTOCOL) {
 106                 /* convert value to string */
 107                 if(fi->value.ftype->val_to_string_repr)
 108                 {
 109                         val_tmp=fvalue_to_string_repr(&fi->value,FTREPR_DISPLAY,NULL);
 110                         if(val_tmp)
 111                         {
 112                                 val_str=ep_strdup(val_tmp);
 113                                 g_free(val_tmp);
 114                         }
 115                 }
 116                 if(!val_str)
 117                         val_str=ep_strdup_printf("unsupported type: %s",ftype_name(ftype));
 118
 119                 /*printf("traverse: name='%s', abbrev='%s',desc='%s', val='%s'\n",hfi->name,hfi->abbrev,ftype_name(hfi->type),val_str);*/
 120                 printf("%s='%s' ",hfi->name,val_str);
 121         }
 122         return FALSE;
 123 }
 124
 125 static int
 126 diameteravp_packet(void *pds, packet_info *pinfo, epan_dissect_t *edt _U_, const void *pdi)
 127 {
 128         int ret = 0;
 129         double resp_time=0.;
 130         gboolean is_request=TRUE;
 131         guint32 cmd_code=0;
 132         guint32 req_frame=0;
 133         guint32 ans_frame=0;
 134         guint32 diam_child_node=0;
 135         proto_node* current=NULL;
 136         proto_node* node = NULL;
 137         header_field_info* hfi=NULL;
 138         field_info* finfo=NULL;
 139         const diameter_req_ans_pair_t* dp=(const diameter_req_ans_pair_t*)pdi;
 140         diameteravp_t *ds=NULL;
 141
 142         /* Validate paramerers. */
 143         if(!dp || !edt || !edt->tree)
 144                 return ret;
 145
 146         /* Several diameter messages within one frame are possible.                    *
 147          * Check if we processing the message in same frame like befor or in new frame.*/
 148         ds=(diameteravp_t *)pds;
 149         if(pinfo->fd->num > ds->frame) {
 150                 ds->frame=pinfo->fd->num;
 151                 ds->diammsg_toprocess=0;
 152         } else {
 153                         ds->diammsg_toprocess+=1;
 154         }
 155
 156         /* Extract data from request/answer pair provided by diameter dissector.*/
 157         is_request=dp->processing_request;
 158         cmd_code=dp->cmd_code;
 159         req_frame=dp->req_frame;
 160         ans_frame=dp->ans_frame;
 161         if(!is_request) {
 162                 nstime_t ns;
 163                 nstime_delta(&ns, &pinfo->fd->abs_ts, &dp->req_time);
 164                 resp_time=nstime_to_sec(&ns);
 165                 resp_time=resp_time<0?0.:resp_time;
 166         }
 167
 168         /* Check command code provided by command line option.*/
 169         if (ds->cmd_code && ds->cmd_code!=cmd_code)
 170                 return ret;
 171
 172         /* Loop over top level nodes */
 173         node = edt->tree->first_child;
 174         while (node != NULL) {
 175                 current = node;
 176                 node = current->next;
 177                 finfo=current->finfo;
 178                 hfi=finfo ? finfo->hfinfo : NULL;
 179                 /*fprintf(stderr,"DEBUG: diameteravp_packet %d %p %p node=%p abbrev=%s\n",cmd_code,edt,edt->tree,current,hfi->abbrev);*/
 180                 /* process current diameter subtree in the current frame. */
 181                 if(hfi && hfi->abbrev && strcmp(hfi->abbrev,"diameter")==0) {
 182                         /* Process current diameter message in the frame */
 183                         if (ds->diammsg_toprocess==diam_child_node) {
 184                                 if(is_request) {
 185                                         ds->req_count++;
 186                                 } else {
 187                                         ds->ans_count++;
 188                                         if (req_frame>0)
 189                                                 ds->paired_ans_count++;
 190                                 }
 191                                 /* Output frame data.*/
 192                                 printf("frame='%d' time='%f' src='%s' srcport='%d' dst='%s' dstport='%d' proto='diameter' msgnr='%d' is_request='%d' cmd='%d' req_frame='%d' ans_frame='%d' resp_time='%f' ",
 193                                                                 pinfo->fd->num,nstime_to_sec(&pinfo->fd->abs_ts),ep_address_to_str(&pinfo->src),pinfo->srcport,ep_address_to_str(&pinfo->dst), pinfo->destport,ds->diammsg_toprocess,is_request,cmd_code,req_frame,ans_frame,resp_time);
 194                                 /* Visit selected nodes of one diameter message.*/
 195                                 tree_traverse_pre_order(current, diam_tree_to_csv, &ds);
 196                                 /* End of message.*/
 197                                 printf("\n");
 198                                 /*printf("hfi: name='%s', msg_curr='%d' abbrev='%s',type='%s'\n",hfi->name,diam_child_node,hfi->abbrev,ftype_name(hfi->type));*/
 199                         }
 200                         diam_child_node++;
 201                 }
 202         }
 203         return ret;
 204 }
 205
 206 static void
 207 diameteravp_draw(void* pds)
 208 {
 209         diameteravp_t *ds=(diameteravp_t *)pds;
 210         /* printing results */
 211         printf("=== Diameter Summary ===\nrequset count:\t%d\nanswer count:\t%d\nreq/ans pairs:\t%d\n",ds->req_count,ds->ans_count,ds->paired_ans_count);
 212 }
 213
 214
 215 static void
 216 diameteravp_init(const char *opt_arg, void* userdata _U_)
 217 {
 218         diameteravp_t *ds;
 219         gchar* field=NULL;
 220         gchar** tokens;
 221         guint opt_count=0;
 222         guint opt_idx=0;
 223         GString* filter=NULL;
 224         GString* error_string=NULL;
 225
 226         ds=g_new(diameteravp_t,1);
 227         ds->frame=0;
 228         ds->diammsg_toprocess=0;
 229         ds->cmd_code=0;
 230         ds->req_count=0;
 231         ds->ans_count=0;
 232         ds->paired_ans_count=0;
 233         ds->filter=NULL;
 234
 235         filter=g_string_new("diameter");
 236
 237         /* Split command line options. */
 238         tokens = g_strsplit(opt_arg,",", 1024);
 239         opt_count=0;
 240         while (tokens[opt_count])
 241                 opt_count++;
 242         if (opt_count>2)
 243                 ds->cmd_code=(guint32)atoi(tokens[2]);
 244
 245         /* Loop over diameter field names. */
 246         for(opt_idx=3;opt_idx<opt_count;opt_idx++)
 247         {
 248                 /* Current field from command line arguments. */
 249                 field=tokens[opt_idx];
 250                 /* Connect all requested fields with logical OR. */
 251                 g_string_append(filter,"||");
 252                 /* Prefix field name with "diameter." by default. */
 253                 if(!strchr(field,'.'))
 254                         g_string_append(filter, "diameter.");
 255                 /* Append field name to the filter. */
 256                 g_string_append(filter, field);
 257         }
 258         g_strfreev(tokens);
 259         ds->filter=g_string_free(filter,FALSE);
 260
 261         error_string=register_tap_listener("diameter", ds, ds->filter, 0, NULL, diameteravp_packet, diameteravp_draw);
 262         if(error_string){
 263                 /* error, we failed to attach to the tap. clean up */
 264                 g_free(ds);
 265
 266                 fprintf(stderr, "tshark: Couldn't register diam,csv tap: %s\n",
 267                                 error_string->str);
 268                 g_string_free(error_string, TRUE);
 269                 exit(1);
 270         }
 271 }
 272
 273
 274 void
 275 register_tap_listener_diameteravp(void)
 276 {
 277         register_stat_cmd_arg("diameter,avp", diameteravp_init, NULL);
 278 }
 279