forked from osmocom/wireshark
Have "is_tpkt()" take a minimum-payload-length argument and check
whether the length value in the TPKT header is large enough to include that much payload - if not, report the packet as not being a TPKT packet. Have the heuristic Q.931 dissector supply the appropriate value. svn path=/trunk/; revision=5457
This commit is contained in:
Guy Harris
parent
a92af3868d
commit
c845015f06
|
|
@ -2,7 +2,7 @@
|
|||
* Routines for Q.931 frame disassembly
|
||||
* Guy Harris <guy@alum.mit.edu>
|
||||
*
|
||||
* $Id: packet-q931.c,v 1.42 2002/03/25 20:23:17 guy Exp $
|
||||
* $Id: packet-q931.c,v 1.43 2002/05/13 21:18:25 guy Exp $
|
||||
*
|
||||
* Modified by Andreas Sikkema for possible use with H.323
|
||||
*
|
||||
|
|
@ -2503,8 +2503,13 @@ dissect_q931_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|||
/*
|
||||
* Check whether this looks like a TPKT-encapsulated
|
||||
* Q.931 packet.
|
||||
*
|
||||
* The minimum length of a Q.931 message is 3:
|
||||
* 1 byte for the protocol discriminator,
|
||||
* 1 for the call_reference length,
|
||||
* and one for the message type.
|
||||
*/
|
||||
lv_tpkt_len = is_tpkt(tvb);
|
||||
lv_tpkt_len = is_tpkt(tvb, 3);
|
||||
if (lv_tpkt_len == -1) {
|
||||
/*
|
||||
* It's not a TPKT packet; reject it.
|
||||
|
|
@ -2533,24 +2538,17 @@ dissect_q931_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|||
* check whether it looks like the beginning of a
|
||||
* Q.931 message.
|
||||
*
|
||||
* The minimum length of a Q.931 message is 3:
|
||||
* 1 byte for the protocol discriminator,
|
||||
* 1 for the call_reference length,
|
||||
* and one for the message type.
|
||||
* The minimum length of a Q.931 message is 3, as per the
|
||||
* above.
|
||||
*
|
||||
* Check that we have that many bytes past the
|
||||
* TPKT header.
|
||||
* Check that we have that many bytes past the TPKT header in
|
||||
* the tvbuff; we already know that the TPKT header says we
|
||||
* have that many bytes (as we passed 3 as the "min_len" argument
|
||||
* to "is_tpkt()").
|
||||
*/
|
||||
if (!tvb_bytes_exist(tvb, 4, 3))
|
||||
return FALSE;
|
||||
|
||||
/*
|
||||
* And check that we have that many bytes in the TPKT
|
||||
* packet.
|
||||
*/
|
||||
if (lv_tpkt_len < 3)
|
||||
return FALSE;
|
||||
|
||||
/* Check the protocol discriminator */
|
||||
if (tvb_get_guint8(tvb, 4) != NLPID_Q_931) {
|
||||
/* Doesn't look like Q.931 inside TPKT */
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* Routine to dissect RFC 1006 TPKT packet containing OSI TP PDU
|
||||
* Copyright 2001, Martin Thomas <Martin_A_Thomas@yahoo.com>
|
||||
*
|
||||
* $Id: packet-tpkt.c,v 1.18 2002/03/25 20:17:09 guy Exp $
|
||||
* $Id: packet-tpkt.c,v 1.19 2002/05/13 21:18:25 guy Exp $
|
||||
*
|
||||
* Ethereal - Network traffic analyzer
|
||||
* By Gerald Combs <gerald@ethereal.com>
|
||||
|
|
@ -71,10 +71,16 @@ static dissector_handle_t osi_tp_handle;
|
|||
* Check whether this could be a TPKT-encapsulated PDU.
|
||||
* Returns -1 if it's not, and the PDU length from the TPKT header
|
||||
* if it is.
|
||||
*
|
||||
* "min_len" is the minimum length of the PDU; the length field in the
|
||||
* TPKT header must be at least "4+min_len" in order for this to be a
|
||||
* valid TPKT PDU for the protocol in question.
|
||||
*/
|
||||
int
|
||||
is_tpkt(tvbuff_t *tvb)
|
||||
is_tpkt(tvbuff_t *tvb, int min_len)
|
||||
{
|
||||
guint16 pkt_len;
|
||||
|
||||
/*
|
||||
* If TPKT is disabled, don't dissect it, just return -1, meaning
|
||||
* "this isn't TPKT".
|
||||
|
|
@ -92,12 +98,20 @@ is_tpkt(tvbuff_t *tvb)
|
|||
* always be the case....
|
||||
*/
|
||||
if (!(tvb_get_guint8(tvb, 0) == 3 && tvb_get_guint8(tvb, 1) == 0))
|
||||
return -1; /* They're not */
|
||||
return -1; /* they're not */
|
||||
|
||||
/*
|
||||
* Return the length from the TPKT header.
|
||||
* Get the length from the TPKT header. Make sure it's large
|
||||
* enough.
|
||||
*/
|
||||
return tvb_get_ntohs(tvb, 2);
|
||||
pkt_len = tvb_get_ntohs(tvb, 2);
|
||||
if (pkt_len < 4 + min_len)
|
||||
return -1; /* it's not */
|
||||
|
||||
/*
|
||||
* Return the length from the header.
|
||||
*/
|
||||
return pkt_len;
|
||||
}
|
||||
|
||||
/*
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
* Copyright 2000, Philips Electronics N.V.
|
||||
* Andreas Sikkema <andreas.sikkema@philips.com>
|
||||
*
|
||||
* $Id: packet-tpkt.h,v 1.7 2002/02/23 02:30:15 guy Exp $
|
||||
* $Id: packet-tpkt.h,v 1.8 2002/05/13 21:18:25 guy Exp $
|
||||
*
|
||||
* Ethereal - Network traffic analyzer
|
||||
* By Gerald Combs <gerald@ethereal.com>
|
||||
|
|
@ -30,8 +30,12 @@
|
|||
* Check whether this could be a TPKT-encapsulated PDU.
|
||||
* Returns -1 if it's not, and the PDU length from the TPKT header
|
||||
* if it is.
|
||||
*
|
||||
* "min_len" is the minimum length of the PDU; the length field in the
|
||||
* TPKT header must be at least "4+min_len" in order for this to be a
|
||||
* valid TPKT PDU for the protocol in question.
|
||||
*/
|
||||
extern int is_tpkt(tvbuff_t *tvb);
|
||||
extern int is_tpkt(tvbuff_t *tvb, int min_len);
|
||||
|
||||
/*
|
||||
* Dissect TPKT-encapsulated data in a TCP stream.
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
/* plugin_table.h
|
||||
* Table of exported addresses for Ethereal plugins.
|
||||
*
|
||||
* $Id: plugin_table.h,v 1.47 2002/05/05 22:30:39 guy Exp $
|
||||
* $Id: plugin_table.h,v 1.48 2002/05/13 21:18:26 guy Exp $
|
||||
*
|
||||
* Ethereal - Network traffic analyzer
|
||||
* Copyright 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
|
||||
|
|
@ -223,7 +223,7 @@ typedef gint8 (*addr_get_CDR_wchar)(tvbuff_t *, gchar **, int *,
|
|||
typedef guint32 (*addr_get_CDR_wstring)(tvbuff_t *, gchar **, int *, gboolean,
|
||||
int, MessageHeader *);
|
||||
|
||||
typedef int (*addr_is_tpkt)(tvbuff_t *);
|
||||
typedef int (*addr_is_tpkt)(tvbuff_t *, int);
|
||||
typedef void (*addr_dissect_tpkt_encap)(tvbuff_t *, packet_info *,
|
||||
proto_tree *, gboolean, dissector_handle_t);
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue