Skip to content

Commit

Permalink
Add support for heuristic SCION traffic identification.
Browse files Browse the repository at this point in the history
Made that default, since the dispacher removal makes port-based sorting
flaky.
  • Loading branch information
jiceatscion committed Jul 18, 2024
1 parent d9c3e2d commit 6f4baf4
Showing 1 changed file with 43 additions and 19 deletions.
62 changes: 43 additions & 19 deletions tools/wireshark/scion.lua
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,23 @@ scion_proto.experts = {
e_nosup_proto,
}

-- This function heuristically identifies SCION packets. If the packet looks like it may be
-- a SCION packet, it returns true, which causes the associated scion disector to be invoked.
-- This doesn't have much data available to weed out non-SCION packets. False positives end-up being
-- described as broken SCION packets and are not passed to the vanilla UDP parser.
-- However, with the removal of the dispatcher, we have no narrow set of UDP ports to identify
-- SCION traffic from. So, there's no choice.
local function scion_proto_filter(tvbuf, pktinfo, root)
local version = bit.rshift(tvbuf(0,1):uint(), 4)
local path_type = tvbuf(8, 1):uint()
local rsv = tvbuf(10, 2):uint()
if version == 0 and path_type < 5 and rsv == 0 then
pktinfo.conversation = scion_proto
return true
end
return false
end

function scion_proto.dissector(tvbuf, pktinfo, root)
local tree = root:add(scion_proto, tvbuf())
local header_str = tree
Expand Down Expand Up @@ -280,9 +297,9 @@ end
function addr_str(buf, addrTypeLen, with_svc)
local addrType = addrTypes[addrTypeLen]
if addrType == "IPv4" then
return string.format("%s", buf:ipv4())
return string.format("%s", tostring(buf:ipv4()))
elseif addrType == "IPv6" then
return string.format("%s", buf:ipv6())
return string.format("%s", tostring(buf:ipv6()))
elseif with_svc and addrType == "SVC" then
local svcVal = buf(0, 2):uint()
local svc = svcTypes[svcVal]
Expand Down Expand Up @@ -1152,21 +1169,28 @@ function scmp_proto_dissect(tvbuf, pktinfo, root)
end


-- Below we configure Wireshark to identify SCION as the next protocol when using
-- the specified range of ports.
--
-- SCION packet on UDP/IP overlay.
table_udp = DissectorTable.get("udp.port")
-- intra-AS traffic
for i = 30000, 32000, 1 do
table_udp:add(i, scion_proto)
end
-- inter-AS BR traffic
for i = 40000, 40050, 1 do
table_udp:add(i, scion_proto)
end
-- FIXME remove once acceptance tests are updated to use ports above
-- acceptance tests
for i = 50000, 50050, 1 do
table_udp:add(i, scion_proto)
end
-- Two options are available. Identify SCION traffic by port number, or heuristically, by
-- looking for clues in the header. The heuristic is not extremely robust. It may mistake
-- non-SCION packet for scion packets. If you know precisely which ports carry SCION
-- traffic (which is made difficult by the removal of the dispatcher), you may prefer to
-- identify them by port. Keep the unwanted option commented out.

-- Heuristic selection
scion_proto:register_heuristic("udp", scion_proto_filter)

-- Port-based selection
-- table_udp = DissectorTable.get("udp.port")
-- -- intra-AS traffic
-- for i = 31000, 32767, 1 do
-- table_udp:add(i, scion_proto)
-- end
-- -- inter-AS BR traffic
-- for i = 40000, 40050, 1 do
-- table_udp:add(i, scion_proto)
-- end
-- -- FIXME remove once acceptance tests are updated to use ports above
-- -- acceptance tests
-- for i = 50000, 50050, 1 do
-- table_udp:add(i, scion_proto)
-- end

0 comments on commit 6f4baf4

Please sign in to comment.