Wireshark · Ethereal-dev: [Ethereal-dev] IEEE 802.11 dissection: auth challenge bug / fragments

[Jouni Malinen <jkmaline@xxxxxxxxx>]

Ethereal uses wrong offset when adding challenge element (patch below).

In addition, current IEEE 802.11 dissection does not seem to support
802.11 fragments. When 802.11 frames are fragmented, Ethereal tries to
dissect fragmented payload and this will produce bogus data for other
but the first fragment.

I do not know Ethereal code enough to easily add support for this, but the
frames could be assembled before dissecting them (is this needed for
something like follow TCP stream, etc. ?) or at least marked as fragments
so that the fragments would not be parsed (the latter part of the patch).


Index: packet-ieee80211.c
===================================================================
RCS file: /cvsroot/ethereal/packet-ieee80211.c,v
retrieving revision 1.53
diff -u -r1.53 packet-ieee80211.c
--- packet-ieee80211.c	2002/04/08 09:09:47	1.53
+++ packet-ieee80211.c	2002/04/13 11:32:42
@@ -815,8 +815,8 @@
       proto_tree_add_uint (tree, tag_length, tvb, offset + 1, 1, tag_len);
       memset (out_buff, 0, SHORT_STR);
       snprintf (out_buff, SHORT_STR, "Challenge text: %.47s", tag_data_ptr);
-      proto_tree_add_string (tree, tag_interpretation, tvb, offset, tag_len,
-			     out_buff);
+      proto_tree_add_string (tree, tag_interpretation, tvb, offset + 2,
+			     tag_len, out_buff);
 
       break;
 
@@ -1558,6 +1558,14 @@
 
       }
       ENDTRY;
+
+      if (COOK_FRAGMENT_NUMBER(tvb_get_letohs(tvb, 22)) > 0) {
+	/* Just show this as a fragment. */
+	if (check_col(pinfo->cinfo, COL_INFO))
+	  col_add_fstr(pinfo->cinfo, COL_INFO, "Fragmented IEEE 802.11 frame");
+	call_dissector(data_handle, next_tvb, pinfo, tree);
+	break;
+      }
 
       if (is_802_2)
         call_dissector(llc_handle, next_tvb, pinfo, tree);


-- 
Jouni Malinen                                            PGP id EFC895FA