From 01ddd93a7296b54a2048de74691984a7e78e4cb9 Mon Sep 17 00:00:00 2001 From: Francesco Fondelli Date: Tue, 10 Jan 2017 08:54:52 +0000 Subject: MPLS: relax pw_eth_heuristic and improve 1st nibble logic relax pw_eth_heuristic and, at the same time, improve the 1st nibble logic in dissect_mpls in order to disambiguate between Ethernet pseudo-wire without a control word, with the MAC address's first nibble being 4/6 and IPv4/6 packet. Bug: 13301 Change-Id: If4697c2e40271d84e2db11a9f64ee60a8657e164 Signed-off-by: Francesco Fondelli Reviewed-on: https://code.wireshark.org/review/19599 Reviewed-by: Alexis La Goutte Petri-Dish: Alexis La Goutte Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman --- epan/dissectors/packet-mpls.c | 58 ++++++++++++++++++++++++++++------------- epan/dissectors/packet-pw-eth.c | 17 +++++++----- 2 files changed, 51 insertions(+), 24 deletions(-) diff --git a/epan/dissectors/packet-mpls.c b/epan/dissectors/packet-mpls.c index 4ea63e589e..03f8ea3b01 100644 --- a/epan/dissectors/packet-mpls.c +++ b/epan/dissectors/packet-mpls.c @@ -479,29 +479,51 @@ dissect_mpls(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ } /* - * No, there isn't, so use the 1st nibble logic (see BCP 4928, - * RFC 4385 and 5586). + * No, there isn't, so use a mix of the 1st nibble logic (see BCP 4928, + * RFC 4385 and 5586) + heuristic. */ switch(first_nibble) { case 4: - /* - * XXX - this could be from an Ethernet pseudo-wire without a - * control word, with the MAC address's first nibble being 4. - */ - call_dissector(dissector_ip, next_tvb, pinfo, tree); - /* IP dissector may reduce the length of the tvb. - We need to do the same, so that ethernet trailer is detected. */ - set_actual_length(tvb, offset+tvb_reported_length(next_tvb)); + { + /* + * This could be from an Ethernet pseudo-wire without a + * control word, with the MAC address's first nibble being 4 + * or an IPv4 packet (or something else). + */ + guint iplen = tvb_get_ntohs(next_tvb, 2); + guint reported_len = tvb_reported_length(next_tvb); + if (iplen >= (reported_len - 4) && iplen <= reported_len) { + /* the supposed IP total len is equal to the reported len plus + the possible padding, we have a good indication this is IP */ + call_dissector(dissector_ip, next_tvb, pinfo, tree); + /* IP dissector may reduce the length of the tvb. + We need to do the same, so that ethernet trailer is detected. */ + set_actual_length(tvb, offset + tvb_reported_length(next_tvb)); + break; + } + /* last resort */ + call_dissector(dissector_pw_eth_heuristic, next_tvb, pinfo, tree); + } break; case 6: - /* - * XXX - this could be from an Ethernet pseudo-wire without a - * control word, with the MAC address's first nibble being 6. - */ - call_dissector(dissector_ipv6, next_tvb, pinfo, tree); - /* IPv6 dissector may reduce the length of the tvb. - We need to do the same, so that ethernet trailer is detected. */ - set_actual_length(tvb, offset+tvb_reported_length(next_tvb)); + { + /* + * This could be from an Ethernet pseudo-wire without a + * control word, with the MAC address's first nibble being 6 + * or an IPv6 packet (or something else). + */ + guint ip6len = tvb_get_guint16(next_tvb, offset + 4, ENC_BIG_ENDIAN); + guint reported_len = tvb_reported_length(next_tvb); + if (ip6len >= (reported_len - 4) && ip6len <= reported_len) { + call_dissector(dissector_ipv6, next_tvb, pinfo, tree); + /* IPv6 dissector may reduce the length of the tvb. + We need to do the same, so that ethernet trailer is detected. */ + set_actual_length(tvb, offset + tvb_reported_length(next_tvb)); + break; + } + /* last resort */ + call_dissector(dissector_pw_eth_heuristic, next_tvb, pinfo, tree); + } break; case 1: /* diff --git a/epan/dissectors/packet-pw-eth.c b/epan/dissectors/packet-pw-eth.c index 2c245331f7..58f8f3cb65 100644 --- a/epan/dissectors/packet-pw-eth.c +++ b/epan/dissectors/packet-pw-eth.c @@ -108,27 +108,32 @@ dissect_pw_eth_nocw(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* d } /* - * FF: this function returns TRUE if the first 12 bytes in tvb looks like - * two valid ethernet addresses. FALSE otherwise. + * FF: this function returns 2 if the first 12 bytes in tvb looks like + * two valid ethernet addresses, 1 if either one of them contains a + * registered OUI and 0 otherwise. */ -static gboolean +static int looks_like_plain_eth(tvbuff_t *tvb _U_) { const gchar *manuf_name_da; const gchar *manuf_name_sa; if (tvb_reported_length_remaining(tvb, 0) < 14) { - return FALSE; + return 0; } manuf_name_da = tvb_get_manuf_name_if_known(tvb, 0); manuf_name_sa = tvb_get_manuf_name_if_known(tvb, 6); if (manuf_name_da && manuf_name_sa) { - return TRUE; + return 2; + } + + if (manuf_name_da || manuf_name_sa) { + return 1; } - return FALSE; + return 0; } static int -- cgit v1.2.1