osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

GTP: extend TPDU Heuristic for ethernet frames 

When set to TPDU Heuristic the eth.type of the payload is compared
against IPv6, IP and ARP Ether type values and if found the frame
is handed of to the Ethernet dissector.

Change-Id: I909713062c535112bc77a71ee107822e4544772e
Reviewed-on: https://code.wireshark.org/review/37934
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
Bjoern Riemer 2020-07-23 11:39:14 +02:00 committed by Anders Broman
parent 8cf0cd1bb1
commit 26c4120204
1 changed files with 24 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
epan/dissectors/packet-gtp.c
View File

@ -54,6 +54,7 @@
#include <epan/to_str.h>
#include <epan/uat.h>
#include <epan/proto_data.h>
#include <epan/etypes.h>
#include "packet-ppp.h"
#include "packet-radius.h"
@ -9741,23 +9742,33 @@ dissect_gtp_common(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree)
next_tvb = tvb_new_subset_remaining(tvb, offset);
call_dissector(ipv6_handle, next_tvb, pinfo, tree);
} else {
if (tvb_reported_length_remaining(tvb, offset)>14) {
guint16 eth_type;
eth_type = tvb_get_ntohs(tvb, offset+12);
if (eth_type == ETHERTYPE_ARP || eth_type == ETHERTYPE_IPv6 || eth_type == ETHERTYPE_IP) {
/* guess this is an ethernet PDU based on the eth type field */
next_tvb = tvb_new_subset_remaining(tvb, offset);
call_dissector(eth_handle, next_tvb, pinfo, tree);
}
} else {
#if 0
/* This turns out not to be true, remove the code and try to improve it if we get bug reports */
/* this seems to be a PPP packet */
/* This turns out not to be true, remove the code and try to improve it if we get bug reports */
/* this seems to be a PPP packet */
if (sub_proto == 0xff) {
guint8 control_field;
/* this might be an address field, even it shouldn't be here */
control_field = tvb_get_guint8(tvb, offset + 1);
if (control_field == 0x03)
/* now we are pretty sure that address and control field are mistakenly inserted -> ignore it for PPP dissection */
acfield_len = 2;
}
if (sub_proto == 0xff) {
guint8 control_field;
/* this might be an address field, even it shouldn't be here */
control_field = tvb_get_guint8(tvb, offset + 1);
if (control_field == 0x03)
/* now we are pretty sure that address and control field are mistakenly inserted -> ignore it for PPP dissection */
acfield_len = 2;
}
next_tvb = tvb_new_subset_remaining(tvb, offset + acfield_len);
call_dissector(ppp_handle, next_tvb, pinfo, tree);
next_tvb = tvb_new_subset_remaining(tvb, offset + acfield_len);
call_dissector(ppp_handle, next_tvb, pinfo, tree);
#endif
proto_tree_add_item(tree, hf_gtp_tpdu_data, tvb, offset, -1, ENC_NA);
proto_tree_add_item(tree, hf_gtp_tpdu_data, tvb, offset, -1, ENC_NA);
}
}
col_prepend_fstr(pinfo->cinfo, COL_PROTOCOL, "GTP <");
col_append_str(pinfo->cinfo, COL_PROTOCOL, ">");