Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8569] New: Warnings for MCC MNC fields containing non-decimal digits

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	8569
Summary	Warnings for MCC MNC fields containing non-decimal digits
Classification	Unclassified
Product	Wireshark
Version	1.9.x (Experimental)
Hardware	All
OS	All
Status	UNCONFIRMED
Severity	Enhancement
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	vineethvijaysv@gmail.com

Created attachment 10567 [details]
Test Case

Build Information:
wireshark 1.9.3 (SVN Rev 48788 from /trunk)

Copyright 1998-2013 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 2.22.0, with Cairo 1.10.0, with Pango 1.28.2, with
GLib 2.26.1, with libpcap, with libz 1.2.3.4, without POSIX capabilities,
without libnl, without SMI, without c-ares, without ADNS, without Lua, without
Python, without GnuTLS, without Gcrypt, without Kerberos, without GeoIP,
without
PortAudio, with AirPcap.

Running on Linux 2.6.35-22-generic, with locale en_IN, with libpcap version
1.1.1, with libz 1.2.3.4, without AirPcap.

Built using gcc 4.4.5.

--
Currently warnings are thrown whenever the dissection engine comes across MCC
and MNC containing non decimal digits. 
But for certain cases when MS has its deleted Location Area Information
information, these fields may have valid hexadecimal digits. As per
specifications:
"""
In abnormal cases, the MNC stored in the mobile station can have:
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ... 9, F} hex.
In such cases the mobile station shall transmit the stored values using full
hexadecimal encoding. When receiving such an MNC, the network shall treat the
LAI as deleted.
"""

Currently warnings are being triggered when MS is doing a fresh GPRS attach
towards the network. One way to remove the warnings for at least these cases
are to do following changes in packet-gsm_a_dtap.c and packet-e212.c (I am not
sure whether the warnings were purposefully implemented to notify the user
about these cases too; in which case please invalidate the bug :)):

--- packet-gsm_a_dtap.c 2013-04-08 16:13:30.932953452 +0530
+++ packet-gsm_a_dtap.c_orig    2013-04-08 15:27:16.564754235 +0530
@@ -6366,7 +6366,8 @@
        gint          ti;
        int           hf_idx;
        gboolean      nsd;
-        gboolean isGPRSAttachPacket;
+
+
        len = tvb_length(tvb);

        if (len < 2)
@@ -6458,10 +6459,6 @@

        case 8:
                get_gmm_msg_params(oct, &msg_str, &ett_tree, &hf_idx,
&dtap_msg_fcn);
-                if ( !strcmp(msg_str,"Attach Request") ||
!strcmp(msg_str,"Routing Area Update Request"))
-                      {  isGPRSAttachPacket = TRUE;
-                         pinfo->private_data = &isGPRSAttachPacket;
-                      }
                break;

        case 9:




--- packet-e212.c       2013-04-08 16:32:13.859066255 +0530
+++ packet-e212.c_orig  2013-04-08 15:27:17.288724764 +0530
@@ -2529,7 +2529,7 @@
             mnc = 100 * mnc3 + mnc;
     }
     item = proto_tree_add_uint(tree, hf_E212_mcc , tvb, start_offset, 2, mcc
);
-    if (((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) && !(pinfo->private_data) )
+    if ((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MCC
contains non-decimal digits");

     if (mnc3 != 0x0f) {
@@ -2560,7 +2560,7 @@
             val_to_str_ext_const(mcc * 1000 + mnc, &mcc_mnc_codes_ext, ""));
     }

-    if (((mnc1 > 9) || (mnc2 > 9) || ((mnc3 > 9) && (mnc3 != 0x0f))) &&
!(pinfo->private_data) )
+    if ((mnc1 > 9) || (mnc2 > 9) || ((mnc3 > 9) && (mnc3 != 0x0f)))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MNC
contains non-decimal digits");

     return mcc_mnc_str;
@@ -2649,7 +2649,7 @@
     }

     item = proto_tree_add_uint(tree, hf_E212_mcc , tvb, start_offset, 2, mcc
);
-    if (((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) && !(pinfo->private_data) )
+    if ((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MCC
contains non-decimal digits");

     if (long_mnc)
@@ -2663,7 +2663,7 @@
                    val_to_str_ext_const(mcc * 1000 + 10 * mnc,
&mcc_mnc_codes_ext, "Unknown"),
                    mnc);

-    if (((mnc1 > 9) || (mnc2 > 9) || (long_mnc && (mnc3 > 9))) &&
!(pinfo->private_data))
+    if ((mnc1 > 9) || (mnc2 > 9) || (long_mnc && (mnc3 > 9)))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MNC
contains non-decimal digits");

     if (long_mnc)

---

      You are receiving this mail because:

• You are watching all bug changes.