Wireshark · Wireshark-dev: Re: [Wireshark-dev] frame relay bugfix

[Rene Pilz <pilz@xxxxxx>]

Hi

This patch consists also the last issues. Additionally it solves:
- For the SSCOP frames the AAL5 decoding was not performed due to an
earlier patch. This caused that no SSCOP message was properly decoded.
- As the detection between a LANE frame and a SSCOP frame is rather hard
a switch within the atm dissector is included which enforce SSCOP
dissecting over a LANE frame. At the moment I do not see a better
solution for that.

Rene Pilz

On Fri, 2006-11-24 at 15:53 +0100, Rene Pilz wrote:
> Hi
> 
> Attached is a patch for following items:
> - Frame Relay: Calculate the size of the frame relay header larger than
> 2 bytes correctly
> - ERF File: In approx 10% of the cases ethereal is not able to recognize
> the ERF file correctly. So the file format check of erf is moved more to
> the beginning of the function. This is not real a solution, but as erf
> files are not that seldom this might be acceptable.
> - Added Columns: Add columns for DLCI (Frame Relay) and TLLI (GSM
> BSSGP). As these are crucial Identifiers within this protocol this is
> rather useful. At least they asked me several times.
> 
> So please take a look at it. Thanks.
> 
> Best Regards
> Rene
> 
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
-- 
Dipl-Ing (FH) MSc. C.E René Pilz
ftw. Telekommunications Research Center Vienna http://www.ftw.at
Tech Gate Vienna, Donaucitystraße 1, A-1220 Wien
Mobile: +43 664 8269871 Office: +43 1 5052830-13  Fax: +43 1 5052830-99

Index: epan/column.c
===================================================================
--- epan/column.c	(revision 20002)
+++ epan/column.c	(working copy)
@@ -93,7 +93,9 @@
     "%y", 
     "%z", 
     "%v", 
-    "%E"
+    "%E",
+	"%C",
+	"%l"
 };
                      
   if (fmt < 0 || fmt >= NUM_COL_FMTS)
@@ -154,6 +156,8 @@
 	"DCE/RPC context ID (cn_ctx_id)",           /* COL_DCE_CTX */
 	"802.1Q VLAN id",                           /* COL_8021Q_VLAN_ID */
 	"TEI",                                      /* XXX - why is it missing in column_utils.c and elsewhere? */
+	"Frame Relay DLCI",							/* COL_FR_DLCI */
+	"GPRS BSSGP TLLI",							/* COL_BSSGP_TLLI */
 };
 
 const gchar *
@@ -260,6 +264,12 @@
     case COL_TEI:
       fmt_list[COL_TEI] = TRUE;
       break;
+    case COL_FR_DLCI:
+      fmt_list[COL_FR_DLCI] = TRUE;
+      break;
+    case COL_BSSGP_TLLI:
+      fmt_list[COL_BSSGP_TLLI] = TRUE;
+      break;
     default:
       break;
   }
@@ -460,7 +470,7 @@
       return "0000000";
       break;
     case COL_VSAN:
-      return "000000";
+     return "000000";
       break;
     case COL_TX_RATE:
       return "108.0";
@@ -486,6 +496,12 @@
     case COL_TEI:
       return "127";
       break;
+    case COL_FR_DLCI:
+      return "8388608";
+      break;
+    case COL_BSSGP_TLLI:
+      return "0xffffffff";
+      break;
     default: /* COL_INFO */
       return "Source port: kerberos-master  Destination port: kerberos-master";
       break;
@@ -640,6 +656,10 @@
 	break;
       case 'E':
 	return COL_TEI;
+      case 'C':
+	return COL_FR_DLCI;
+      case 'l':
+	return COL_BSSGP_TLLI;
 	break;
     }
     cptr++;
Index: epan/column-utils.c
===================================================================
--- epan/column-utils.c	(revision 20002)
+++ epan/column-utils.c	(working copy)
@@ -1242,6 +1242,10 @@
     case COL_8021Q_VLAN_ID:
         break;
 
+    case COL_FR_DLCI:	/* done by packet-fr.c */
+    case COL_BSSGP_TLLI: /* done by packet-bssgp.c */
+        break;
+
     case NUM_COL_FMTS:	/* keep compiler happy - shouldn't get here */
       g_assert_not_reached();
       break;
Index: epan/dissectors/packet-fr.c
===================================================================
--- epan/dissectors/packet-fr.c	(revision 20002)
+++ epan/dissectors/packet-fr.c	(working copy)
@@ -551,6 +551,8 @@
       }
       proto_tree_add_boolean(octet_tree, hf_fr_dc, tvb, offset, 1, fr_octet);
       proto_tree_add_boolean(octet_tree, hf_fr_ea, tvb, offset, 1, fr_octet);
+      
+      offset++;
     }
   }
   if (tree) {
@@ -561,6 +563,11 @@
   pinfo->ctype = CT_DLCI;
   pinfo->circuit_id = address;
 
+  /* Add DLCI to a collumn */
+  if ( check_col(pinfo->cinfo, COL_FR_DLCI)) {
+      col_add_fstr(pinfo->cinfo, COL_FR_DLCI, "%u", address);
+  }
+  
   if (check_col(pinfo->cinfo, COL_INFO))
       col_add_fstr(pinfo->cinfo, COL_INFO, "DLCI %u", address);
 
Index: epan/dissectors/packet-atm.c
===================================================================
--- epan/dissectors/packet-atm.c	(revision 20002)
+++ epan/dissectors/packet-atm.c	(working copy)
@@ -37,6 +37,7 @@
 #include "packet-eth.h"
 #include "packet-tr.h"
 #include "packet-llc.h"
+#include "prefs.h"
 
 static int proto_atm = -1;
 static int hf_atm_aal = -1;
@@ -70,6 +71,8 @@
 static dissector_handle_t fp_handle;
 static dissector_handle_t data_handle;
 
+static gboolean dissect_lanesscop = FALSE;
+
 /*
  * See
  *
@@ -1017,7 +1020,8 @@
       proto_tree_add_text(atm_tree, tvb, 0, 0, "Cells: %u",
 		reported_length/48);
     }
-    if (pinfo->pseudo_header->atm.aal == AAL_5 &&
+    if ((pinfo->pseudo_header->atm.aal == AAL_5 ||
+    	pinfo->pseudo_header->atm.aal == AAL_SIGNALLING) &&
         length >= reported_length) {
       /*
        * XXX - what if the packet is truncated?  Can that happen?
@@ -1558,6 +1562,12 @@
 {
   proto_tree   *atm_tree = NULL;
   proto_item   *atm_ti = NULL;
+  
+  if ( pinfo->pseudo_header->atm.aal == AAL_5 &&
+  	pinfo->pseudo_header->atm.type == TRAF_LANE &&
+  	dissect_lanesscop ) {
+  	pinfo->pseudo_header->atm.aal = AAL_SIGNALLING;
+  }
 
   if (check_col(pinfo->cinfo, COL_PROTOCOL))
     col_set_str(pinfo->cinfo, COL_PROTOCOL, "ATM");
@@ -1677,6 +1687,9 @@
 		&ett_atm_lane_lc_flags,
 		&ett_atm_lane_lc_tlv,
 	};
+	
+	module_t *atm_module;
+	
 	proto_atm = proto_register_protocol("ATM", "ATM", "atm");
 	proto_aal1 = proto_register_protocol("ATM AAL1", "AAL1", "aal1");
 	proto_aal3_4 = proto_register_protocol("ATM AAL3/4", "AAL3/4", "aal3_4");
@@ -1693,6 +1706,11 @@
 
 	register_dissector("lane", dissect_lane, proto_atm_lane);
 	register_dissector("atm_untruncated", dissect_atm_untruncated, proto_atm);
+	
+	atm_module = prefs_register_protocol ( proto_atm, NULL );
+	prefs_register_bool_preference ( atm_module, "dissect_lane_as_sscop", "Dissect LANE as SSCOP",
+		"Autodection between LANE and SSCOP is hard. As default LANE is preferred",
+		&dissect_lanesscop);
 }
 
 void
Index: epan/dissectors/packet-bssgp.c
===================================================================
--- epan/dissectors/packet-bssgp.c	(revision 20002)
+++ epan/dissectors/packet-bssgp.c	(working copy)
@@ -2892,6 +2892,11 @@
     col_append_sep_fstr(bi->pinfo->cinfo, COL_INFO, BSSGP_SEP, 
 			"TLLI %#4x", tlli);
   }
+  
+  if (check_col(bi->pinfo->cinfo, COL_BSSGP_TLLI)) {
+    col_add_fstr(bi->pinfo->cinfo, COL_BSSGP_TLLI, "%#04x", tlli);
+  }
+  
   decode_nri(bi->bssgp_tree, bi, tlli);
 }
 
Index: epan/column_info.h
===================================================================
--- epan/column_info.h	(revision 20002)
+++ epan/column_info.h	(working copy)
@@ -101,6 +101,8 @@
   COL_DCE_CTX,        /* DCE/RPC connection oriented context id */
   COL_8021Q_VLAN_ID,  /* 802.1Q vlan ID */
   COL_TEI,            /* q.921 TEI */
+  COL_FR_DLCI,		  /* Frame Relay DLCI */
+  COL_BSSGP_TLLI,	  /* GPRS BSSGP IE TLLI */
   NUM_COL_FMTS        /* Should always be last */
 };
 
Index: wiretap/file_access.c
===================================================================
--- wiretap/file_access.c	(revision 20002)
+++ wiretap/file_access.c	(working copy)
@@ -117,6 +117,7 @@
 	 * would be, for example, saved copies of a Telnet session
 	 * to some box.
 	 */
+	erf_open,
 	etherpeek_open,
 	pppdump_open,
 	iseries_open,
@@ -127,7 +128,6 @@
 	csids_open,
 	vms_open,
 	cosine_open,
-	erf_open,
 	hcidump_open,
 };
 
Index: wiretap/erf.c
===================================================================
--- wiretap/erf.c	(revision 20002)
+++ wiretap/erf.c	(working copy)
@@ -123,7 +123,10 @@
 		guint32 packet_size;
 		erf_timestamp_t ts;
 
-		if (file_read(&header,1,sizeof(header),wth->fh) != sizeof(header)) {
+		int r = file_read(&header,1,sizeof(header),wth->fh);
+
+		if (r == 0 ) break;
+		if (r != sizeof(header)) {
 			if ((*err = file_error(wth->fh)) != 0)
 				return -1;
 			else
Index: wiretap/atm.c
===================================================================
--- wiretap/atm.c	(revision 20002)
+++ wiretap/atm.c	(working copy)
@@ -74,6 +74,7 @@
 	 * guessing based on the contents, if we have enough data
 	 * to guess.
 	 */
+	 
 	if (len >= 3) {
 		if (pd[0] == 0xaa && pd[1] == 0xaa && pd[2] == 0x03) {
 			/*
@@ -81,7 +82,8 @@
 			 * multiplexed RFC 1483 traffic.
 			 */
 			pseudo_header->atm.type = TRAF_LLCMX;
-		} else if (len < 16) {
+		} else if ((pseudo_header->atm.aal5t_len &&
+			pseudo_header->atm.aal5t_len < 16) || len<16) {
 			/*
 			 * As this cannot be a LANE Ethernet frame (less
 			 * than 2 bytes of LANE header + 14 bytes of