diff --git a/src/packet/packet.cpp b/src/packet/packet.cpp index 19c4a51..db25c9e 100644 --- a/src/packet/packet.cpp +++ b/src/packet/packet.cpp @@ -1104,13 +1104,16 @@ static inline const char *parse_udp(struct packet *pkt, const char *data, uint16 const struct udphdr *hdr = (struct udphdr *)data; SET_LAYER(pkt, layer, LAYER_TYPE_UDP, sizeof(struct udphdr), data, len, 0); - if (udp_hdr_get_dst_port(hdr) == 4789) + uint16_t src_port = udp_hdr_get_src_port(hdr); + uint16_t dst_port = udp_hdr_get_dst_port(hdr); + + if (dst_port == 4789) { // VXLAN_DPORT 4789 return parse_vxlan(pkt, layer->pld_ptr, layer->pld_len); } - if (udp_hdr_get_dst_port(hdr) == 2152 || udp_hdr_get_src_port(hdr) == 2152) + if (dst_port == 2152 || src_port == 2152) { // TODO // check V1 or V2 @@ -1119,13 +1122,13 @@ static inline const char *parse_udp(struct packet *pkt, const char *data, uint16 return parse_gtpv1_u(pkt, layer->pld_ptr, layer->pld_len); } - if (udp_hdr_get_dst_port(hdr) == 2123 || udp_hdr_get_src_port(hdr) == 2123) + if (dst_port == 2123 || src_port == 2123) { // TODO // GTP-C - GTP control 2123 } - if (udp_hdr_get_dst_port(hdr) == 1701) + if (dst_port == 1701 || src_port == 1701) { // L2TP_DPORT 1701 if (unlikely(layer->pld_len < 8)) @@ -1145,6 +1148,21 @@ static inline const char *parse_udp(struct packet *pkt, const char *data, uint16 } } + if (dst_port == 3544 || src_port == 3544) + { + // Teredo IPv6 tunneling 3544 + if (unlikely(layer->pld_len < sizeof(struct ip6_hdr))) + { + return layer->pld_ptr; + } + const struct ip6_hdr *hdr = (const struct ip6_hdr *)layer->pld_ptr; + if (ipv6_hdr_get_version(hdr) != 6) + { + return layer->pld_ptr; + } + return parse_ipv6(pkt, layer->pld_ptr, layer->pld_len); + } + return layer->pld_ptr; } diff --git a/test/packet_parser/cmp_layers.sh b/test/packet_parser/cmp_layers.sh index aa6b8f7..d61a188 100644 --- a/test/packet_parser/cmp_layers.sh +++ b/test/packet_parser/cmp_layers.sh @@ -112,6 +112,7 @@ function preprocess_tshark_ouput() { ":icmp:ip:tcp" ":icmp" ":pwethheuristic:pwethnocw" "" ":ospf" "" + ":teredo" "" ) for ((i = 0; i < ${#kv_array[@]}; i += 2)); do key=${kv_array[i]}