Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tools: add support for heuristic SCION traffic identification by wireshark #4582

Merged
merged 7 commits into from
Jul 24, 2024
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Add support for heuristic SCION traffic identification.
Made that default, since the dispacher removal makes port-based sorting
flaky.
  • Loading branch information
jiceatscion committed Jul 18, 2024
commit 6f4baf4c807abf6ff809c935448476e75585c2c1
62 changes: 43 additions & 19 deletions tools/wireshark/scion.lua
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,23 @@ scion_proto.experts = {
e_nosup_proto,
}

-- This function heuristically identifies SCION packets. If the packet looks like it may be
-- a SCION packet, it returns true, which causes the associated scion disector to be invoked.
-- This doesn't have much data available to weed out non-SCION packets. False positives end-up being
-- described as broken SCION packets and are not passed to the vanilla UDP parser.
-- However, with the removal of the dispatcher, we have no narrow set of UDP ports to identify
-- SCION traffic from. So, there's no choice.
local function scion_proto_filter(tvbuf, pktinfo, root)
local version = bit.rshift(tvbuf(0,1):uint(), 4)
local path_type = tvbuf(8, 1):uint()
local rsv = tvbuf(10, 2):uint()
if version == 0 and path_type < 5 and rsv == 0 then
pktinfo.conversation = scion_proto
return true
end
return false
end

function scion_proto.dissector(tvbuf, pktinfo, root)
local tree = root:add(scion_proto, tvbuf())
local header_str = tree
Expand Down Expand Up @@ -280,9 +297,9 @@ end
function addr_str(buf, addrTypeLen, with_svc)
local addrType = addrTypes[addrTypeLen]
if addrType == "IPv4" then
return string.format("%s", buf:ipv4())
return string.format("%s", tostring(buf:ipv4()))
elseif addrType == "IPv6" then
return string.format("%s", buf:ipv6())
return string.format("%s", tostring(buf:ipv6()))
elseif with_svc and addrType == "SVC" then
local svcVal = buf(0, 2):uint()
local svc = svcTypes[svcVal]
Expand Down Expand Up @@ -1152,21 +1169,28 @@ function scmp_proto_dissect(tvbuf, pktinfo, root)
end


-- Below we configure Wireshark to identify SCION as the next protocol when using
-- the specified range of ports.
--
-- SCION packet on UDP/IP overlay.
table_udp = DissectorTable.get("udp.port")
-- intra-AS traffic
for i = 30000, 32000, 1 do
table_udp:add(i, scion_proto)
end
-- inter-AS BR traffic
for i = 40000, 40050, 1 do
table_udp:add(i, scion_proto)
end
-- FIXME remove once acceptance tests are updated to use ports above
-- acceptance tests
for i = 50000, 50050, 1 do
table_udp:add(i, scion_proto)
end
-- Two options are available. Identify SCION traffic by port number, or heuristically, by
-- looking for clues in the header. The heuristic is not extremely robust. It may mistake
-- non-SCION packet for scion packets. If you know precisely which ports carry SCION
-- traffic (which is made difficult by the removal of the dispatcher), you may prefer to
-- identify them by port. Keep the unwanted option commented out.

-- Heuristic selection
scion_proto:register_heuristic("udp", scion_proto_filter)

-- Port-based selection
-- table_udp = DissectorTable.get("udp.port")
-- -- intra-AS traffic
-- for i = 31000, 32767, 1 do
-- table_udp:add(i, scion_proto)
-- end
-- -- inter-AS BR traffic
-- for i = 40000, 40050, 1 do
-- table_udp:add(i, scion_proto)
-- end
-- -- FIXME remove once acceptance tests are updated to use ports above
-- -- acceptance tests
-- for i = 50000, 50050, 1 do
-- table_udp:add(i, scion_proto)
-- end
Loading