Add support for parsing Teredo IPv6 tunneling

This commit is contained in:
luwenpeng
2024-06-04 18:08:45 +08:00
parent bd69493991
commit ade7b4c8ab
2 changed files with 23 additions and 4 deletions

View File

@@ -1104,13 +1104,16 @@ static inline const char *parse_udp(struct packet *pkt, const char *data, uint16
const struct udphdr *hdr = (struct udphdr *)data; const struct udphdr *hdr = (struct udphdr *)data;
SET_LAYER(pkt, layer, LAYER_TYPE_UDP, sizeof(struct udphdr), data, len, 0); SET_LAYER(pkt, layer, LAYER_TYPE_UDP, sizeof(struct udphdr), data, len, 0);
if (udp_hdr_get_dst_port(hdr) == 4789) uint16_t src_port = udp_hdr_get_src_port(hdr);
uint16_t dst_port = udp_hdr_get_dst_port(hdr);
if (dst_port == 4789)
{ {
// VXLAN_DPORT 4789 // VXLAN_DPORT 4789
return parse_vxlan(pkt, layer->pld_ptr, layer->pld_len); return parse_vxlan(pkt, layer->pld_ptr, layer->pld_len);
} }
if (udp_hdr_get_dst_port(hdr) == 2152 || udp_hdr_get_src_port(hdr) == 2152) if (dst_port == 2152 || src_port == 2152)
{ {
// TODO // TODO
// check V1 or V2 // check V1 or V2
@@ -1119,13 +1122,13 @@ static inline const char *parse_udp(struct packet *pkt, const char *data, uint16
return parse_gtpv1_u(pkt, layer->pld_ptr, layer->pld_len); return parse_gtpv1_u(pkt, layer->pld_ptr, layer->pld_len);
} }
if (udp_hdr_get_dst_port(hdr) == 2123 || udp_hdr_get_src_port(hdr) == 2123) if (dst_port == 2123 || src_port == 2123)
{ {
// TODO // TODO
// GTP-C - GTP control 2123 // GTP-C - GTP control 2123
} }
if (udp_hdr_get_dst_port(hdr) == 1701) if (dst_port == 1701 || src_port == 1701)
{ {
// L2TP_DPORT 1701 // L2TP_DPORT 1701
if (unlikely(layer->pld_len < 8)) if (unlikely(layer->pld_len < 8))
@@ -1145,6 +1148,21 @@ static inline const char *parse_udp(struct packet *pkt, const char *data, uint16
} }
} }
if (dst_port == 3544 || src_port == 3544)
{
// Teredo IPv6 tunneling 3544
if (unlikely(layer->pld_len < sizeof(struct ip6_hdr)))
{
return layer->pld_ptr;
}
const struct ip6_hdr *hdr = (const struct ip6_hdr *)layer->pld_ptr;
if (ipv6_hdr_get_version(hdr) != 6)
{
return layer->pld_ptr;
}
return parse_ipv6(pkt, layer->pld_ptr, layer->pld_len);
}
return layer->pld_ptr; return layer->pld_ptr;
} }

View File

@@ -112,6 +112,7 @@ function preprocess_tshark_ouput() {
":icmp:ip:tcp" ":icmp" ":icmp:ip:tcp" ":icmp"
":pwethheuristic:pwethnocw" "" ":pwethheuristic:pwethnocw" ""
":ospf" "" ":ospf" ""
":teredo" ""
) )
for ((i = 0; i < ${#kv_array[@]}; i += 2)); do for ((i = 0; i < ${#kv_array[@]}; i += 2)); do
key=${kv_array[i]} key=${kv_array[i]}