kbandla / dpkt

fast, simple packet creation / parsing, with definitions for the basic TCP/IP protocols
Other
1.09k stars 271 forks source link

MPLS decoding to support PW ECW #425

Closed obormot closed 5 years ago

obormot commented 5 years ago

The following input is Eth - MPLS - MPLS - ECW - Eth - ARP

buf = (
    b'\xcc\x00\x0d\x5c\x00\x10\xcc\x01\x0d\x5c\x00\x10\x88\x47\x00\x01\x30\xfe\x00\x01\x01\xff'
    b'\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x50\x79\x66\x68\x00\x08\x06\x00\x01\x08\x00'
    b'\x06\x04\x00\x01\x00\x50\x79\x66\x68\x00\xc0\xa8\x00\x0a\xff\xff\xff\xff\xff\xff\xc0\xa8'
    b'\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
    b'\x00\x00'
)

Currently decodes to:

Ethernet(
    dst='\xcc\x00\r\\\x00\x10', 
    src='\xcc\x01\r\\\x00\x10', 
    labels=[(19, 0, 254), (16, 0, 255)], 
    mpls_labels=[
        MPLSlabel(s=0, exp=0, val=19, ttl=254), 
        MPLSlabel(s=1, exp=0, val=16, ttl=255)
    ], 
    data='\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00Pyfh....

We need to support Pseudo-wire Ethernet Control Word (ECW) to decode to smth like this instead:

Ethernet(
    dst='\xcc\x00\r\\\x00\x10', 
    src='\xcc\x01\r\\\x00\x10', 
    labels=[(19, 0, 254), (16, 0, 255)], 
    mpls_labels=[
        MPLSlabel(s=0, exp=0, val=19, ttl=254), 
        MPLSlabel(s=1, exp=0, val=16, ttl=255)
    ], 
    data=ECW(
        seq=0,
        data=Ethernet(
            dst='\xff\xff\xff\xff\xff\xff', 
            src='\x00Pyfh\x00', type=2054, 
            data=ARP(sha='\x00Pyfh\x00', ...

For reference this is how Wireshark does it https://www.wireshark.org/lists/wireshark-bugs/201406/msg00823.html