ProtocolProfilerDecoders.tcl

#####
# ProtocolProfileDecoders.tcl
# Author: Thomas Schockaert
# Last Changed: 20141104
# Contents: The procedures that turn a piece of hex string into something more meaningful to the user.
# Howto:
# - Procedure names follow a specific naming-scheme:
#   1) the word 'decode'
#   2) an underscore
#   3) whatever you put in the protocol map as the third field of the field definitions
#   Example: pmap(0) {"testfield" 10 "mytext"}
#   -> This field will be decoded by the procedure named 'decode_mytext'
# - Each procedure takes a fielddefinition and the rawvalue as arguments.
#   1) 'fielddefinition' is whatever you put in the protocol map for a certain index
#   2) 'rawvalue' is the protocol data on from the wire
# - You return a readable value
#   1) you can use this to map an entire protocol level
#   2) you can use this to translate protocol-specific encodings (example: dns encodes hostnames in a 'special' way)
#####

proc decode_dnssoa { fielddefinition rawvalue } {

}

### decode_ipv4 { fielddefinition rawvalue }
# Description:
# - Reads every the rawvalue in blocks of 2 characters, which yields a 2-character hex string that can be translated to its decimal counterpart.
# - The decimal counterparts are concatenated with a dot to create an IP address
# Returns:
# - an IP address
proc decode_ip { fielddefinition rawvalue } {
    set readablevalue ""
    set y 0
    while { $y < [string length $rawvalue] } {
        # decimal representation of the size of the label
        set octet [substr $rawvalue $y 2]
        lappend readablevalue "[expr 0x$octet]"
        set y [expr $y+2]
    }
    set readablevalue [join $readablevalue "."]
    return $readablevalue
}

### decode_dnstext { fielddefinition rawvalue }
# Description:
# - The translation that happens is described here: http://www.tcpipguide.com/free/t_DNSNameNotationandMessageCompressionTechnique.htm
# Returns:
# - a hostname (FQDN)
proc decode_dnstext { fielddefinition rawvalue } {
    set readablevalue ""
    set y 0
    while { $y < [string length $rawvalue] } {
        # decimal representation of the size of the label
        set label_size [expr [expr 0x[substr $rawvalue $y 2]]*2]
        set label [substr $rawvalue [expr $y+2] $label_size]
        lappend readablevalue "[binary format H* $label]"
        set y [expr $y+2+$label_size]
    }
    set readablevalue [join $readablevalue "."]
    return $readablevalue
}

### decode_tmap { fielddefinition rawvalue }
# Description:
# - Finds the rawvalue in a statically defined tmap (= textmap) array. If found, returns that value, if not found, uses the element with index '-1' from the array.
# Returns:
# - the textual, human-readable equivalent of a hex string
proc decode_tmap { fielddefinition rawvalue } {
    set fieldname [lindex $fielddefinition 0]
    #upvar $stop_here stop_here_local
    set stop_here_local 0
    eval "if \{ \[catch \{ set readablevalue \$static::tmap_$fieldname\(0x$rawvalue\) \} errmsg\] \} \{ set stop_here_local 1 \}"
    eval "if \{ \$stop_here_local == 1 \} \{ set readablevalue \$static::tmap_$fieldname\(-1\) \}"
    return $readablevalue
}

### decode_lmap { fielddefinition rawvalue }
# Description:
# - The rawvalue consists of multipe entries of the same size.
# - This iterates those entries and finds the corresponding value in a statically defined tmap (= textmap) array. If found, returns that value, if not found, uses the element with index '-1' from the array.
# Returns:
# - the textual, human-readable equivalent of all entries in the rawvalue hex string, concatenated with a comma (,)
proc decode_lmap { fielddefinition rawvalue } {
    set fieldname [lindex $fielddefinition 0]
    set listmap_fieldsize [lindex $fielddefinition 3]
    set readablevalue ""
    set listmapvalue_notfound 0
    for { set z 0 } { $z < [string length $rawvalue] } { set z [expr $z+4] } {
        set listmap_currentvalue [substr $rawvalue $z 4]
        eval "if \{ \[catch \{ set tmp_readablevalue \$static::tmap_$fieldname\(0x$listmap_currentvalue\) \} errmsg\] \} \{ set listmapvalue_notfound 1 \}"
        eval "if \{ \$listmapvalue_notfound == 1 \} \{ set tmp_readablevalue \$static::tmap_$fieldname\(-1\) \}"
        lappend readablevalue "$tmp_readablevalue"
    }
    set readablevalue [join $readablevalue ","]
    return $readablevalue
}

### decode_dec { fielddefinition rawvalue }
# Description:
# - Converts the rawvalue to decimal
# Returns:
# - the decimal equivalent of the rawvalue hex string
proc decode_dec { fielddefinition rawvalue } {
    if { $rawvalue == "" } {
        return 0
    }
    return [expr 0x$rawvalue]
}

### decode_dec { fielddefinition rawvalue }
# Description:
# - Prefixes the hex string with '0x'
# Returns:
# - the hexadecimal notation of the rawvalue hex string
proc decode_hex { fielddefinition rawvalue } {
    return 0x$rawvalue
}

### decode_time { fielddefinition rawvalue }
# Description:
# - Decodes the hex string as a unix epoch time string
# Returns:
# - the date and time in the default format of the clock format command
proc decode_time { fielddefinition rawvalue } {
    return [clock format [expr 0x$rawvalue]]
}