path: root/epan/dissectors/packet-pw-eth.c

/* packet-pw-eth.c
 * Routines for ethernet PW dissection: it should conform to RFC 4448.
 *
 * Copyright 2008 _FF_
 *
 * Francesco Fondelli <francesco dot fondelli, gmail dot com>
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

#include "config.h"

#include <epan/packet.h>
#include <epan/addr_resolv.h>
#include <epan/etypes.h>
#include <epan/dissectors/packet-llc.h>

#include "packet-mpls.h"

void proto_register_pw_eth(void);
void proto_reg_handoff_pw_eth(void);

static int proto_pw_eth_cw;
static int proto_pw_eth_nocw;
static int proto_pw_eth_heuristic;

static int ett_pw_eth;

static int hf_pw_eth;
static int hf_pw_eth_cw;
static int hf_pw_eth_cw_sequence_number;

static dissector_handle_t eth_withoutfcs_handle;
static dissector_handle_t pw_eth_handle_cw;
static dissector_handle_t pw_eth_handle_nocw;
static dissector_handle_t pw_eth_handle_heuristic;

static int
dissect_pw_eth_cw(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
{
    tvbuff_t *next_tvb;
    uint16_t  sequence_number;

    if (tvb_reported_length_remaining(tvb, 0) < 4) {
        return 0;
    }

    if (dissect_try_cw_first_nibble(tvb, pinfo, tree))
        return tvb_captured_length(tvb);

    sequence_number = tvb_get_ntohs(tvb, 2);

    if (tree) {
        proto_tree *pw_eth_tree;
        proto_item *ti;

        ti = proto_tree_add_boolean(tree, hf_pw_eth_cw,
                                    tvb, 0, 0, true);
        proto_item_set_hidden(ti);
        ti = proto_tree_add_item(tree, proto_pw_eth_cw,
                                 tvb, 0, 4, ENC_NA);
        pw_eth_tree = proto_item_add_subtree(ti, ett_pw_eth);

        proto_tree_add_uint_format(pw_eth_tree,
                                   hf_pw_eth_cw_sequence_number,
                                   tvb, 2, 2, sequence_number,
                                   "Sequence Number: %d",
                                   sequence_number);
    }

    next_tvb = tvb_new_subset_remaining(tvb, 4);
    {
        call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, tree);
    }

    return tvb_captured_length(tvb);
}

static int
dissect_pw_eth_nocw(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
{
    tvbuff_t *next_tvb;

    if (tree) {
        proto_item *ti;
        ti = proto_tree_add_boolean(tree, hf_pw_eth, tvb, 0, 0, true);
        proto_item_set_hidden(ti);
    }

    next_tvb = tvb_new_subset_remaining(tvb, 0);
    call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, tree);

    return tvb_captured_length(tvb);
}

/*
 * FF: this function returns true if the first 12 bytes in tvb looks like
 *     two valid ethernet addresses.  false otherwise.
 */
static int
looks_like_plain_eth(tvbuff_t *tvb, int offset)
{
    const char *manuf_name_da;
    const char *manuf_name_sa;
    uint16_t etype;
    int ret = 2;

    /* Don't throw an exception. If the packet is truncated, you lose. */
    if (tvb_captured_length_remaining(tvb, offset) < 14) {
        return 0;
    }

    /* Copy the source and destination addresses, as tvb_get_manuf_name_if_known
     * only uses the first three bytes (it's for an OUI in, e.g., IEEE 802.11),
     * and returns NULL for MA-M and MA-S.
     */
    uint8_t da[6], sa[6];
    tvb_memcpy(tvb, da, offset, 6);
    /* da[0] & 0x2 is the U/L bit; if it's set, none of this helps. (#13039) */
    if (da[0] & 0x2) {
        // U/L bit; locally assigned addresses are a less solid heuristic
        ret = 1;
    } else {
        manuf_name_da = get_manuf_name_if_known(da, 6);
        if (!manuf_name_da) {
            /* Try looking for an exact match in the ethers file. */
            manuf_name_da = get_ether_name_if_known(da);
            if (!manuf_name_da) {
                return 0;
            }
        }
    }
    offset += 6;

    tvb_memcpy(tvb, sa, offset, 6);
    if (sa[0] & 0x1) {
        // Group bit should not be set on source
        return 0;
    }
    if (sa[0] & 0x2) {
        // U/L bit; locally assigned addresses are a less solid heuristic
        ret = 1;
    } else {
        manuf_name_sa = get_manuf_name_if_known(sa, 6);
        if (!manuf_name_sa) {
            manuf_name_sa = get_ether_name_if_known(sa);
            if (!manuf_name_sa) {
                return 0;
            }
        }
    }
    offset += 6;
    etype = tvb_get_ntohs(tvb, offset);

    if (etype > IEEE_802_3_MAX_LEN) {
        if (etype < ETHERNET_II_MIN_LEN) {
            return 0;
        }

        if (!try_val_to_str(etype, etype_vals)) {
            return 0;
        }
    } else {
        offset += 2;
        /* XXX - There are unusual cases like Cisco ISL, Novell raw 802.3
         * for IPX/SPX, etc. See packet-eth capture_eth()
         */
        if (tvb_reported_length_remaining(tvb, offset) < etype) {
            return 0;
        }

        if (tvb_captured_length_remaining(tvb, offset) < 3) {
            return 0;
        }
        uint8_t sap;
        sap = tvb_get_uint8(tvb, offset);
        if (!try_val_to_str(sap, sap_vals)) {
            return 0;
        }
        offset += 1;
        sap = tvb_get_uint8(tvb, offset);
        if (!try_val_to_str(sap, sap_vals)) {
            return 0;
        }
        /* We could go deeper, and see if this looks like SNAP if the dsap
         * and ssap are both 0xAA (the common case).
         */
    }

    return ret;
}

static int
dissect_pw_eth_heuristic(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
{
    /*
     * RFC 8469 states that that both ingress and egress SHOULD support the PW
     * CW, and if they do, the CW MUST be used. So it looks equally likely to
     * have the CW as not, assume CW.
     */
    uint8_t first_nibble = (tvb_get_uint8(tvb, 0) >> 4) & 0x0F;

    if (first_nibble == 0) {
        if (looks_like_plain_eth(tvb, 4) >= looks_like_plain_eth(tvb, 0)) {
            call_dissector(pw_eth_handle_cw, tvb, pinfo, tree);
        } else {
            call_dissector(pw_eth_handle_nocw, tvb, pinfo, tree);
        }
    } else {
        call_dissector(pw_eth_handle_nocw, tvb, pinfo, tree);
    }
    return tvb_captured_length(tvb);
}

static bool
dissect_pw_eth_nocw_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
    if (!looks_like_plain_eth(tvb, 0)) {
        return false;
    }
    dissect_pw_eth_nocw(tvb, pinfo, tree, data);
    return true;
}

void
proto_register_pw_eth(void)
{
    static hf_register_info hf[] = {
        {
            &hf_pw_eth,
            {
                "PW (ethernet)",
                "pweth", FT_BOOLEAN,
                BASE_NONE, NULL, 0x0, NULL, HFILL
            }
        },
        {
            &hf_pw_eth_cw,
            {
                "PW Control Word (ethernet)",
                "pweth.cw", FT_BOOLEAN,
                BASE_NONE, NULL, 0x0, NULL, HFILL
            }
        },
        {
            &hf_pw_eth_cw_sequence_number,
            {
                "PW sequence number (ethernet)",
                "pweth.cw.sequence_number", FT_UINT16,
                BASE_DEC, NULL, 0x0, NULL, HFILL
            }
        }
    };

    static int *ett[] = {
        &ett_pw_eth
    };

    proto_pw_eth_cw =
        proto_register_protocol("PW Ethernet Control Word",
                                "Ethernet PW (with CW)",
                                "pwethcw");
    proto_pw_eth_nocw =
        proto_register_protocol("Ethernet PW (no CW)", /* not displayed */
                                "Ethernet PW (no CW)",
                                "pwethnocw");
    proto_pw_eth_heuristic =
        proto_register_protocol("Ethernet PW (CW heuristic)", /* not disp. */
                                "Ethernet PW (CW heuristic)",
                                "pwethheuristic");
    proto_register_field_array(proto_pw_eth_cw, hf, array_length(hf));
    proto_register_subtree_array(ett, array_length(ett));
    pw_eth_handle_cw = register_dissector("pw_eth_cw", dissect_pw_eth_cw, proto_pw_eth_cw);
    pw_eth_handle_nocw = register_dissector("pw_eth_nocw", dissect_pw_eth_nocw, proto_pw_eth_nocw);
    pw_eth_handle_heuristic = register_dissector("pw_eth_heuristic", dissect_pw_eth_heuristic,
                       proto_pw_eth_heuristic);
}

void
proto_reg_handoff_pw_eth(void)
{
    heur_dissector_add("mpls", dissect_pw_eth_nocw_heur,
        "Ethernet PW (no CW)", "pwethnocw", proto_pw_eth_nocw,
        HEURISTIC_ENABLE);
    eth_withoutfcs_handle = find_dissector_add_dependency("eth_withoutfcs", proto_pw_eth_cw);

    dissector_add_for_decode_as("mpls.label", pw_eth_handle_cw);
    dissector_add_for_decode_as("mpls.label", pw_eth_handle_nocw);

    dissector_add_for_decode_as("mpls.label", pw_eth_handle_heuristic);

    dissector_add_for_decode_as("mpls.pfn", pw_eth_handle_cw);
    dissector_add_for_decode_as("mpls.pfn", pw_eth_handle_nocw);
}

/*
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 *
 * Local variables:
 * c-basic-offset: 4
 * tab-width: 8
 * indent-tabs-mode: nil
 * End:
 *
 * vi: set shiftwidth=4 tabstop=8 expandtab:
 * :indentSize=4:tabSize=8:noTabs=true:
 */