diff options
| author | Anders Broman <anders.broman@ericsson.com> | 2012-09-14 14:14:46 +0000 |
|---|---|---|
| committer | Anders Broman <anders.broman@ericsson.com> | 2012-09-14 14:14:46 +0000 |
| commit | ffbacb51d25ea2eb33441121d19d7292936ec01d (patch) | |
| tree | 44e74b707e2956865d2297a35ec2b2fd133321bb | |
| parent | 6aca10831f86c562970b13efa811f46e25ee3091 (diff) | |
| download | wireshark-ffbacb51d25ea2eb33441121d19d7292936ec01d.tar.gz wireshark-ffbacb51d25ea2eb33441121d19d7292936ec01d.tar.bz2 wireshark-ffbacb51d25ea2eb33441121d19d7292936ec01d.zip | |
Heuristically dissect TIPC IP payloads.
svn path=/trunk/; revision=44900
| -rw-r--r-- | epan/dissectors/packet-ip.c | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/epan/dissectors/packet-ip.c b/epan/dissectors/packet-ip.c index bba473929a..42f93be2ba 100644 --- a/epan/dissectors/packet-ip.c +++ b/epan/dissectors/packet-ip.c @@ -2408,6 +2408,46 @@ dissect_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree) pinfo->fragmented = save_fragmented; } +static gboolean +dissect_ip_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) +{ + int length, tot_length; + guint8 oct, version, ihl; + +/* + 0 1 2 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + |Version| IHL |Type of Service| Total Length | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + +*/ + length = tvb_length(tvb); + if(length<4){ + /* Need at least 4 bytes to make some sort of decision */ + return FALSE; + } + oct = tvb_get_guint8(tvb,0); + ihl = oct & 0x0f; + version = oct >> 4; + if(version == 6){ + /* TODO: Add IPv6 checks here */ + return FALSE; + } + /* version == IPv4 , the minimum value for a correct header is 5 */ + if((version != 4)|| (ihl < 5)){ + return FALSE; + } + tot_length = tvb_get_ntohs(tvb,2); + + if(tot_length != tvb_reported_length(tvb)){ + return FALSE; + } + + dissect_ip(tvb, pinfo, tree); + return TRUE; +} + void proto_register_ip(void) { @@ -2938,6 +2978,8 @@ proto_reg_handoff_ip(void) dissector_add_uint("arcnet.protocol_id", ARCNET_PROTO_IP_1201, ip_handle); dissector_add_uint("ax25.pid", AX25_P_IP, ip_handle); dissector_add_handle("udp.port", ip_handle); + + heur_dissector_add("tipc", dissect_ip_heur, proto_ip); } /* |