MPLS: relax pw_eth_heuristic and improve 1st nibble logic

relax pw_eth_heuristic and, at the same time, improve
the 1st nibble logic in dissect_mpls in order to disambiguate
between Ethernet pseudo-wire without a control word, with the MAC
address's first nibble being 4/6 and IPv4/6 packet.

Bug: 13301
Change-Id: If4697c2e40271d84e2db11a9f64ee60a8657e164
Signed-off-by: Francesco Fondelli <francesco.fondelli@gmail.com>
Reviewed-on: https://code.wireshark.org/review/19599
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

2 files changed, 51 insertions, 24 deletions

diff --git a/epan/dissectors/packet-mpls.c b/epan/dissectors/packet-mpls.c
index 4ea63e589e..03f8ea3b01 100644
--- a/epan/dissectors/packet-mpls.c
+++ b/epan/dissectors/packet-mpls.c
@@ -479,29 +479,51 @@ dissect_mpls(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_
     }
 
     /*
-     * No, there isn't, so use the 1st nibble logic (see BCP 4928,
-     * RFC 4385 and 5586).
+     * No, there isn't, so use a mix of the 1st nibble logic (see BCP 4928,
+     * RFC 4385 and 5586) + heuristic.
      */
     switch(first_nibble) {
     case 4:
-        /*
-         * XXX - this could be from an Ethernet pseudo-wire without a
-         * control word, with the MAC address's first nibble being 4.
-         */
-        call_dissector(dissector_ip, next_tvb, pinfo, tree);
-        /* IP dissector may reduce the length of the tvb.
-           We need to do the same, so that ethernet trailer is detected. */
-        set_actual_length(tvb, offset+tvb_reported_length(next_tvb));
+        {
+            /*
+             * This could be from an Ethernet pseudo-wire without a
+             * control word, with the MAC address's first nibble being 4
+             * or an IPv4 packet (or something else).
+             */
+            guint iplen = tvb_get_ntohs(next_tvb, 2);
+            guint reported_len = tvb_reported_length(next_tvb);
+            if (iplen >= (reported_len - 4) && iplen <= reported_len) {
+                /* the supposed IP total len is equal to the reported len plus
+                   the possible padding, we have a good indication this is IP */
+                call_dissector(dissector_ip, next_tvb, pinfo, tree);
+                /* IP dissector may reduce the length of the tvb.
+                   We need to do the same, so that ethernet trailer is detected. */
+                set_actual_length(tvb, offset + tvb_reported_length(next_tvb));
+                break;
+            }
+            /* last resort */
+            call_dissector(dissector_pw_eth_heuristic, next_tvb, pinfo, tree);
+        }
         break;
     case 6:
-        /*
-         * XXX - this could be from an Ethernet pseudo-wire without a
-         * control word, with the MAC address's first nibble being 6.
-         */
-        call_dissector(dissector_ipv6, next_tvb, pinfo, tree);
-        /* IPv6 dissector may reduce the length of the tvb.
-           We need to do the same, so that ethernet trailer is detected. */
-        set_actual_length(tvb, offset+tvb_reported_length(next_tvb));
+        {
+            /*
+             * This could be from an Ethernet pseudo-wire without a
+             * control word, with the MAC address's first nibble being 6
+             * or an IPv6 packet (or something else).
+             */
+            guint ip6len = tvb_get_guint16(next_tvb, offset + 4, ENC_BIG_ENDIAN);
+            guint reported_len = tvb_reported_length(next_tvb);
+            if (ip6len >= (reported_len - 4) && ip6len <= reported_len) {
+                call_dissector(dissector_ipv6, next_tvb, pinfo, tree);
+                /* IPv6 dissector may reduce the length of the tvb.
+                   We need to do the same, so that ethernet trailer is detected. */
+                set_actual_length(tvb, offset + tvb_reported_length(next_tvb));
+                break;
+            }
+            /* last resort */
+            call_dissector(dissector_pw_eth_heuristic, next_tvb, pinfo, tree);
+        }
         break;
     case 1:
         /*
diff --git a/epan/dissectors/packet-pw-eth.c b/epan/dissectors/packet-pw-eth.c
index 2c245331f7..58f8f3cb65 100644
--- a/epan/dissectors/packet-pw-eth.c
+++ b/epan/dissectors/packet-pw-eth.c
@@ -108,27 +108,32 @@ dissect_pw_eth_nocw(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* d
 }
 
 /*
- * FF: this function returns TRUE if the first 12 bytes in tvb looks like
- *     two valid ethernet addresses.  FALSE otherwise.
+ * FF: this function returns 2 if the first 12 bytes in tvb looks like
+ *     two valid ethernet addresses, 1 if either one of them contains a
+ *     registered OUI and 0 otherwise.
  */
-static gboolean
+static int
 looks_like_plain_eth(tvbuff_t *tvb _U_)
 {
     const gchar *manuf_name_da;
     const gchar *manuf_name_sa;
 
     if (tvb_reported_length_remaining(tvb, 0) < 14) {
-        return FALSE;
+        return 0;
     }
 
     manuf_name_da = tvb_get_manuf_name_if_known(tvb, 0);
     manuf_name_sa = tvb_get_manuf_name_if_known(tvb, 6);
 
     if (manuf_name_da && manuf_name_sa) {
-        return TRUE;
+        return 2;
+    }
+
+    if (manuf_name_da || manuf_name_sa) {
+        return 1;
     }
 
-    return FALSE;
+    return 0;
 }
 
 static int