Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] How to properly handle ipv6 prefixes [Was: ... EIGRP dissector u

From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Fri, 14 Aug 2009 05:51:30 +0200
On Wed, Aug 12, 2009 at 07:14:05PM +0200, Jochen Bartl wrote:
> I have spent the last 2 days with adding IPv6, Stub Routing  and
> Authentication TLV support to the EIGRP dissector.

> A lot of the proto_tree_add_text calls were replaced by
> proto_tree_add_item, to make use of the display filter functionality.

So much for letting my half finished ipv6 and hf_ication changes lying in
my local tree. Nevertheless, I had only replaced the text stuff in half of
the functions and IPv6, so yours is more complete. The only thing my dissector
did that yours doesn't was that I added a *hack* to proto.c to allow me
to filter for the prefix' content (included for *informational purposes*
below) by adding an element of type FT_IPv6.

My usage looked like this:

  length=tvb_get_guint8(tvb, offset);
  ti = proto_tree_add_item(tree, hf_ipv6_int_prefixlen , tvb, offset, 1, FALSE);
  offset++;
  addr_len=ipv6_addr_and_mask(tvb, offset, &ipv6_addr, length);
  if (addr_len < 0) {
    proto_item_append_text(ti,"  [Invalid prefix length %u > 128]", length);
    addr_len = 1; /* assure we can exit the loop */
  } else {
    ti = proto_tree_add_item(tree, hf_ipv6_int_dest, tvb, offset, addr_len, FALSE);
...
 { &hf_ipv6_int_dest,
   { "Destination", "eigrp.ipv6int.dest", FT_IPv6, BASE_NONE, NULL, 0x0,
     NULL, HFILL }},


Which brings me to the core of my posting: What would be a good solution
to the ipv6 prefix situation, where only the masklength and the beginning bytes
of an address are put into the packet but I still want to be able to filter
on the address part and maybe even have the resolving stuff available?
Would something like my hack be OK or should we add a new type like FT_IPv6PRE
or something else?

Thanks
       Joerg

Index: proto.c
===================================================================
--- proto.c	(revision 29361)
+++ proto.c	(working copy)
@@ -181,7 +181,7 @@
 static void
 proto_tree_set_ipv6(field_info *fi, const guint8* value_ptr);
 static void
-proto_tree_set_ipv6_tvb(field_info *fi, tvbuff_t *tvb, gint start);
+proto_tree_set_ipv6_tvb(field_info *fi, tvbuff_t *tvb, gint start, gint length);
 static void
 proto_tree_set_guid(field_info *fi, const e_guid_t *value_ptr);
 static void
@@ -1030,6 +1030,7 @@
 		break;
 
 	default:
+assert(0);
 		DISSECTOR_ASSERT_NOT_REACHED();
 		value = 0;
 		break;
@@ -1202,8 +1203,8 @@
 			break;
 
 		case FT_IPv6:
-			DISSECTOR_ASSERT(length == 16);
-			proto_tree_set_ipv6_tvb(new_fi, tvb, start);
+			DISSECTOR_ASSERT(length >=0 && length <= 16);
+			proto_tree_set_ipv6_tvb(new_fi, tvb, start, length);
 			break;
 
 		case FT_ETHER:
@@ -1856,9 +1857,9 @@
 }
 
 static void
-proto_tree_set_ipv6_tvb(field_info *fi, tvbuff_t *tvb, gint start)
+proto_tree_set_ipv6_tvb(field_info *fi, tvbuff_t *tvb, gint start, gint length)
 {
-	proto_tree_set_ipv6(fi, tvb_get_ptr(tvb, start, 16));
+	proto_tree_set_ipv6(fi, tvb_get_ptr(tvb, start, length));
 }
 
 /* Add a FT_GUID to a proto_tree */