From ddffa62468cbf6a326cd9d77e035d2c83b0a8e63 Mon Sep 17 00:00:00 2001 From: Simon Walton Date: Wed, 29 May 2019 18:10:48 -0700 Subject: [PATCH 1/3] Use STUN RFC magic number to filter for such packets --- tools/dissectors/1-hfudt.lua | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/dissectors/1-hfudt.lua b/tools/dissectors/1-hfudt.lua index 8179276dbb..1a2e8beab6 100644 --- a/tools/dissectors/1-hfudt.lua +++ b/tools/dissectors/1-hfudt.lua @@ -163,10 +163,13 @@ local unsourced_packet_types = { local fragments = {} +local RFC_5389_MAGIC_COOKIE = 0x2112A442 + function p_hfudt.dissector(buf, pinfo, tree) -- make sure this isn't a STUN packet - those don't follow HFUDT format - if pinfo.dst == Address.ip("stun.highfidelity.io") then return end + -- if pinfo.dst == Address.ip("stun.highfidelity.io") then return end + if buf(4, 4):uint() == RFC_5389_MAGIC_COOKIE then return end -- validate that the packet length is at least the minimum control packet size if buf:len() < 4 then return end From d620d3511f60b6470dda7bdfa3467b028177a3ef Mon Sep 17 00:00:00 2001 From: Simon Walton Date: Wed, 29 May 2019 18:21:37 -0700 Subject: [PATCH 2/3] Add packet-len check --- tools/dissectors/1-hfudt.lua | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/dissectors/1-hfudt.lua b/tools/dissectors/1-hfudt.lua index 1a2e8beab6..2e6990d6ff 100644 --- a/tools/dissectors/1-hfudt.lua +++ b/tools/dissectors/1-hfudt.lua @@ -169,7 +169,7 @@ function p_hfudt.dissector(buf, pinfo, tree) -- make sure this isn't a STUN packet - those don't follow HFUDT format -- if pinfo.dst == Address.ip("stun.highfidelity.io") then return end - if buf(4, 4):uint() == RFC_5389_MAGIC_COOKIE then return end + if buf:len() >= 8 and buf(4, 4):uint() == RFC_5389_MAGIC_COOKIE then return end -- validate that the packet length is at least the minimum control packet size if buf:len() < 4 then return end From bffd87b331f82fe7ea3a24fb4918255088c6659b Mon Sep 17 00:00:00 2001 From: Simon Walton Date: Thu, 30 May 2019 11:41:12 -0700 Subject: [PATCH 3/3] Fallback for STUN packets --- tools/dissectors/1-hfudt.lua | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tools/dissectors/1-hfudt.lua b/tools/dissectors/1-hfudt.lua index 2e6990d6ff..70831416b9 100644 --- a/tools/dissectors/1-hfudt.lua +++ b/tools/dissectors/1-hfudt.lua @@ -167,9 +167,10 @@ local RFC_5389_MAGIC_COOKIE = 0x2112A442 function p_hfudt.dissector(buf, pinfo, tree) - -- make sure this isn't a STUN packet - those don't follow HFUDT format - -- if pinfo.dst == Address.ip("stun.highfidelity.io") then return end - if buf:len() >= 8 and buf(4, 4):uint() == RFC_5389_MAGIC_COOKIE then return end + -- make sure this isn't a STUN packet - those don't follow HFUDT format + if buf:len() >= 8 and buf(4, 4):uint() == RFC_5389_MAGIC_COOKIE then + return 0 + end -- validate that the packet length is at least the minimum control packet size if buf:len() < 4 then return end