Wireshark · Ethereal-dev: [Ethereal-dev] Three patches for packet-pim.c

[Heikki Vatiainen <hessu@xxxxxxxxx>]

The patches are:
  o Make columns read-only for Register messages
  o Add code to dissect Null-Register dummy header
  o Fix Join/Prune decode where the number of pruned
    source addresses was used to decode the list of
    joined source addresses

There are still some mystery PIM packets that cause exceptions within
the PIM dissector. I did not find any explanation for them in the spec
and from the capture it looks like that at least cisco routers are
happy with them. One example is packet number 15 in the PIM packet
collection at http://atm.tut.fi/~hessu/ethereal/pim.cap  There are
also other examples later in the capture.


Index: packet-pim.c
===================================================================
RCS file: /cvsroot/ethereal/packet-pim.c,v
retrieving revision 1.27
diff -u -r1.27 packet-pim.c
--- packet-pim.c	2001/04/23 17:51:33	1.27
+++ packet-pim.c	2001/05/06 22:12:27
@@ -36,6 +36,7 @@
 #include <netinet/in.h>
 #endif
 
+#include <stddef.h>  /* For offsetof */
 #include <string.h>
 #include <glib.h>
 
@@ -45,6 +46,7 @@
 
 #include "packet.h"
 #include "ipproto.h"
+#include "packet-ipv6.h"
 #include "in_cksum.h"
 
 #define PIM_TYPE(x)	((x) & 0x0f)
@@ -264,13 +266,18 @@
 	if (PIM_VER(pim_typever) == 2) {
 	    /*
 	     * Well, it's PIM v2, so we can check whether this is a Register
-	     * mesage, and thus can figure out how much to checksum.
+	     * message, and thus can figure out how much to checksum and
+	     * whether to make the columns read-only.
 	     */
 	    if (PIM_TYPE(pim_typever) == 1) {
 		/*
 		 * Register message - the PIM header is 8 bytes long.
+		 * Also set the columns non-writable. Otherwise the IPv4 or
+		 * IPv6 dissector for the encapsulated packet that caused
+		 * this register will overwrite the PIM info in the columns.
 		 */
 		pim_length = 8;
+		col_set_writable(pinfo->fd, FALSE);
 	    } else {
 		/*
 		 * Other message - checksum the entire packet.
@@ -370,6 +377,40 @@
 	     */
 	    v_hl = tvb_get_guint8(tvb, offset);
 	    switch((v_hl & 0xf0) >> 4) {
+	    case 0:     /* Null-Register dummy header.
+			 * Has the same address family as the encapsulating PIM packet,
+			 * e.g. an IPv6 data packet is encapsulated in IPv6 PIM packet.
+			 */
+		    if (pinfo->src.type == AT_IPv4) {
+			    proto_tree_add_text(pimopt_tree, tvb, offset,
+						tvb_length_remaining(tvb, offset),
+						"IPv4 dummy header");
+			    proto_tree_add_text(pimopt_tree, tvb, offset + 12, 4,
+						"Source: %s",
+						ip_to_str(tvb_get_ptr(tvb, offset + 12, 4)));
+			    proto_tree_add_text(pimopt_tree, tvb, offset + 16, 4,
+						"Group: %s",
+						ip_to_str(tvb_get_ptr(tvb, offset + 16, 4)));
+		    } else if (pinfo->src.type == AT_IPv6) {
+			    struct ip6_hdr ip6_hdr;
+			    tvb_memcpy(tvb, (guint8 *)&ip6_hdr, offset,
+				       tvb_length_remaining(tvb, offset));
+			    proto_tree_add_text(pimopt_tree, tvb, offset,
+						tvb_length_remaining(tvb, offset),
+						"IPv6 dummy header");
+			    proto_tree_add_text(pimopt_tree, tvb,
+						offset + offsetof(struct ip6_hdr, ip6_src), 16,
+						"Source: %s",
+						ip6_to_str(&ip6_hdr.ip6_src));
+			    proto_tree_add_text(pimopt_tree, tvb,
+						offset + offsetof(struct ip6_hdr, ip6_dst), 16,
+						"Group: %s",
+						ip6_to_str(&ip6_hdr.ip6_dst));
+		    } else
+			    proto_tree_add_text(pimopt_tree, tvb, offset,
+						tvb_length_remaining(tvb, offset),
+						"Dummy header for an unknown protocol");
+		    break;
 	    case 4:	/* IPv4 */
 #if 0
 		    call_dissector(ip_handle, next_tvb, pinfo, tree);
@@ -466,7 +507,7 @@
 		    "Join: %d", njoin);
 		subtree = proto_item_add_subtree(tisub, ett_pim);
 		off = offset + 4;
-		for (j = 0; j < nprune; j++) {
+		for (j = 0; j < njoin; j++) {
 		    s = dissect_pim_addr(tvb, off, pimv2_source,
 			&advance);
 		    if (s == NULL)



-- 
Heikki Vatiainen                  * hessu@xxxxxxxxx
Tampere University of Technology  * Tampere, Finland