diff options
author | Peter Wu <peter@lekensteyn.nl> | 2016-08-20 15:10:21 +0200 |
---|---|---|
committer | Michael Mann <mmann78@netscape.net> | 2016-08-21 21:28:19 +0000 |
commit | 565dbf44ff21b90de29f4c829f517b429b931220 (patch) | |
tree | 0ba4d1215e667e72f2f390980562cab8cee75f35 /epan/dissectors/packet-nflog.c | |
parent | dc42aadcac2636df4c15f8650b668503911e3017 (diff) |
nflog: support NFLOG bridge (ebtables) dissection
See net/netfilter/nfnetlink_log.c, that is the only place that sets
NFULA_PACKET_HDR to struct nfulnl_msg_packet_hdr.
Tested with nflog-ebtables.pcapng from SampleCaptures wiki.
Change-Id: I7e21f8f584f3911b3aa7d0d027ff9624886bef73
Reviewed-on: https://code.wireshark.org/review/17191
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan/dissectors/packet-nflog.c')
-rw-r--r-- | epan/dissectors/packet-nflog.c | 29 |
1 files changed, 28 insertions, 1 deletions
diff --git a/epan/dissectors/packet-nflog.c b/epan/dissectors/packet-nflog.c index 381ddada16..82df074dcc 100644 --- a/epan/dissectors/packet-nflog.c +++ b/epan/dissectors/packet-nflog.c @@ -24,6 +24,7 @@ #include "config.h" +#include <epan/etypes.h> #include <epan/packet.h> #include <wiretap/wtap.h> @@ -104,6 +105,12 @@ static header_field_info hfi_nflog_tlv_type NFLOG_HFI_INIT = { "Type", "nflog.tlv_type", FT_UINT16, BASE_DEC, VALS(nflog_tlv_vals), 0x7fff, "TLV Type", HFILL }; /* TLV values */ +static header_field_info hfi_nflog_tlv_hwprotocol NFLOG_HFI_INIT = + { "HW protocol", "nflog.protocol", FT_UINT16, BASE_HEX, VALS(etype_vals), 0x00, NULL, HFILL }; + +static header_field_info hfi_nflog_tlv_hook NFLOG_HFI_INIT = + { "Netfilter hook", "nflog.hook", FT_UINT8, BASE_DEC, VALS(netfilter_hooks_vals), 0x00, NULL, HFILL }; + static header_field_info hfi_nflog_tlv_prefix NFLOG_HFI_INIT = { "Prefix", "nflog.prefix", FT_STRINGZ, BASE_NONE, NULL, 0x00, "TLV Prefix Value", HFILL }; @@ -121,6 +128,7 @@ static header_field_info hfi_nflog_tlv_unknown NFLOG_HFI_INIT = static dissector_handle_t ip_handle; static dissector_handle_t ip6_handle; +static dissector_table_t ethertype_table; static int dissect_nflog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) @@ -134,6 +142,7 @@ dissect_nflog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U tvbuff_t *next_tvb = NULL; int pf; + guint16 hw_protocol = 0; col_set_str(pinfo->cinfo, COL_PROTOCOL, "NFLOG"); col_clear(pinfo->cinfo, COL_INFO); @@ -184,6 +193,16 @@ dissect_nflog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U proto_tree_add_item(tlv_tree, &hfi_nflog_tlv_length, tvb, offset + 0, 2, ENC_HOST_ENDIAN); proto_tree_add_item(tlv_tree, &hfi_nflog_tlv_type, tvb, offset + 2, 2, ENC_HOST_ENDIAN); switch (tlv_type) { + case WS_NFULA_PACKET_HDR: + if (value_len == 4) { + proto_tree_add_item(tlv_tree, &hfi_nflog_tlv_hwprotocol, + tvb, offset + 4, 2, ENC_BIG_ENDIAN); + proto_tree_add_item(tlv_tree, &hfi_nflog_tlv_hook, + tvb, offset + 6, 1, ENC_NA); + handled = TRUE; + } + break; + case WS_NFULA_PAYLOAD: handled = TRUE; break; @@ -231,13 +250,18 @@ dissect_nflog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U tvb, offset + 4, value_len, ENC_NA); } + if (tlv_type == WS_NFULA_PACKET_HDR && value_len == 4) + hw_protocol = tvb_get_ntohs(tvb, offset + 4); if (tlv_type == WS_NFULA_PAYLOAD) next_tvb = tvb_new_subset_length(tvb, offset + 4, value_len); offset += ((tlv_len + 3) & ~3); /* next TLV aligned to 4B */ } - if (next_tvb) { + if (next_tvb && hw_protocol) { + if (!dissector_try_uint(ethertype_table, hw_protocol, next_tvb, pinfo, tree)) + call_data_dissector(next_tvb, pinfo, tree); + } else if (next_tvb) { switch (pf) { /* Note: NFPROTO_INET is not supposed to appear here, it is mapped * to NFPROTO_IPV4 or NFPROTO_IPV6 */ @@ -269,6 +293,8 @@ proto_register_nflog(void) &hfi_nflog_tlv_length, &hfi_nflog_tlv_type, /* TLV values */ + &hfi_nflog_tlv_hwprotocol, + &hfi_nflog_tlv_hook, &hfi_nflog_tlv_prefix, &hfi_nflog_tlv_uid, &hfi_nflog_tlv_gid, @@ -304,6 +330,7 @@ proto_reg_handoff_nflog(void) nflog_handle = find_dissector("nflog"); dissector_add_uint("wtap_encap", WTAP_ENCAP_NFLOG, nflog_handle); + ethertype_table = find_dissector_table("ethertype"); } /* |