| blob | ffbf5cce8b5777f9eb232bbf01e02225c64779d9 |
1 /* packet-catapult-dct2000.c
2 * Routines for Catapult DCT2000 packet stub header disassembly
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
15 #include <epan/packet.h>
16 #include <epan/expert.h>
17 #include <epan/prefs.h>
18 #include <epan/addr_resolv.h>
19 #include <epan/proto_data.h>
20 #include <epan/tfs.h>
22 #include <wsutil/strtoi.h>
24 #include <wiretap/catapult_dct2000.h>
38 /* Protocol and registered fields. */
112 /* UMTS RLC fields */
132 /* Variables used for preferences */
140 /* Protocol subtree. */
155 };
169 };
175 };
178 #define RLC_MGMT_ASSIGN 0x41
179 #define RLC_AM_DATA_REQ 0x60
180 #define RLC_AM_DATA_IND 0x61
181 #define RLC_AM_DATA_CONF 0x62
182 #define RLC_UM_DATA_REQ 0x70
183 #define RLC_UM_DATA_IND 0x71
184 #define RLC_UM_DATA_CONF 0x74
185 #define RLC_TR_DATA_REQ 0x80
186 #define RLC_TR_DATA_IND 0x81
187 #define RLC_TR_DATA_CONF 0x83
197 };
206 };
209 #define CCPRI_REQ 1
210 #define CCPRI_IND 2
216 };
243 };
250 };
263 };
265 #define LTE_NAS_RRC_DATA_IND 0x02
266 #define LTE_NAS_RRC_DATA_REQ 0x03
267 #define LTE_NAS_RRC_ESTABLISH_REQ 0x06
268 #define LTE_NAS_RRC_RELEASE_IND 0x08
276 };
279 #define NAS_S1AP_DATA_REQ 0x00
280 #define NAS_S1AP_DATA_IND 0x01
286 };
289 /* Distinguish between similar 4G or 5G protocols */
291 LTE,
292 NR
293 };
301 };
309 };
317 };
325 };
328 #define MAX_OUTHDR_VALUES 32
348 static unsigned parse_outhdr_string(const unsigned char *outhdr_string, int outhdr_length, unsigned *outhdr_values);
365 /* Return the number of bytes used to encode the length field
366 (we're not interested in the length value itself) */
368 {
370 {
372 }
373 else
374 {
376 }
377 }
380 /* Look for the protocol data within an ipprim packet.
381 Only set *data_offset if data field found. */
388 {
392 /* Get the ipprim command code. */
395 /* Only accept UDP or TCP data request or indication */
407 }
409 /* Skip any other TLC fields before reach payload */
411 /* Look at next tag */
414 /* Is this the data payload we're expecting? */
420 }
422 /* Read length in next byte */
426 /* Remote IP address */
428 /* Sent *to* remote, so dest */
431 }
435 }
437 /* Remote port follows (if present) */
441 }
444 }
445 }
446 }
447 else
450 /* Local IP address */
452 /* Sent *from* local, so source */
455 }
459 }
460 }
461 }
462 else
464 /* Get local port */
466 /* Sent from local, so source */
468 }
471 }
472 }
473 else
475 /* Get conn_id */
477 }
479 /* Skip the length of the indicated value */
481 }
482 }
484 /* No data found... */
486 }
490 /* Look for the protocol data within an sctpprim (variant 1 or 2...) packet.
491 Only set *data_offset if data field found. */
496 {
499 /* Get the sctpprim command code. */
504 /* Only accept interested in data requests or indications */
511 }
516 /* Skip any other fields before reach payload */
518 /* Look at next tag */
521 /* Is this the data payload we're expecting? */
525 }
527 /* Skip length field */
528 offset++;
553 /* Fail if not a known header field */
555 }
556 }
557 }
559 /* No data found... */
561 }
563 /* Look for the protocol data within an sctpprim (variant 3) packet.
564 Return value indicates whether this header found.
565 Only set *data_offset if data field found. */
570 {
575 /* Get the sctpprim (2 byte) command code. */
579 /* Only interested in data requests or indications */
583 }
585 /* Overall length field is next 2 bytes */
588 /* Rx/Tx ops have different formats */
590 /*****************/
591 /* DataInd */
593 /* Next 2 bytes are associate ID */
596 /* Next 2 bytes are destination port */
600 /* Destination address should follow - check tag */
604 }
606 /* Skip tag */
609 /* Length field */
612 {
614 }
617 /* Address data is here */
622 }
624 /* Not interested in remaining (fixed) fields */
627 }
630 }
632 /* Data should now be here */
636 /* 2-byte length field */
639 /* Data is here!!! */
642 }
645 }
646 }
648 /***********************************/
649 /* SendDataReq (top_tag == 0x0400) */
651 /* AssociateId should follow - check tag */
655 }
657 /* Skip tag */
660 /* Skip 2-byte value */
662 }
664 /* Get tag */
668 /* Some optional params */
672 /* Length field */
676 }
679 /* Address data is here */
698 }
700 /* Get the next tag */
703 }
706 /* Mandatory payload type */
709 }
715 /* Optional options */
724 /* Get next tag */
727 }
730 /* Data should now be here!! */
732 /* 2-byte length field */
735 /* Data is here!!! */
738 }
741 }
742 }
743 }
746 /* Dissect a UMTS RLC frame by:
747 - parsing the primitive header
748 - passing those values + outhdeader to dissector
749 - calling the UMTS RLC dissector */
754 {
763 /* Top-level opcode */
771 /* No data to dissect */
773 }
775 /* Keep going until reach data tag or end of frame */
790 offset++;
796 offset++;
814 /* For other fields, just skip length and following data */
818 proto_tree_add_item(tree, hf_catapult_dct2000_buffer_occupancy, tvb, offset, length, ENC_BIG_ENDIAN);
833 proto_tree_add_item(tree, hf_catapult_dct2000_rx_timing_deviation, tvb, offset, 1, ENC_BIG_ENDIAN);
836 proto_tree_add_item(tree, hf_catapult_dct2000_transport_channel_type, tvb, offset, 1, ENC_BIG_ENDIAN);
846 }
848 }
849 }
851 /* Have we got enough info to call dissector */
854 outhdr_values_found);
856 /* Set appropriate RLC dissector handle */
861 /* DCH channels. */
862 /* TODO: can't really tell if these are control or transport...
863 maybe control with preferences (UAT?) between "rlc.ps_dtch" and "rlc.dcch" ? */
874 /* Give up here */
876 }
878 /* Call UMTS RLC dissector */
882 }
883 }
884 }
887 {
891 }
893 }
896 /* Dissect an RRC LTE or NR frame by first parsing the header entries then passing
897 the data to the RRC dissector, according to direction and channel type. */
901 {
905 LogicalChannelType logicalChannelType;
911 /* Top-level opcode */
927 /* Unexpected opcode tag! */
929 }
931 /* Skip length */
934 /* Get next tag */
938 {
939 /* Dedicated channel info */
941 /* Skip length */
942 offset++;
946 /* UEId */
947 proto_tree_add_item_ret_uint(tree, hf_catapult_dct2000_ueid, tvb, offset, 2, ENC_BIG_ENDIAN, &ueid);
950 /* Get tag of channel type */
955 offset++;
960 offset++;
963 offset++;
968 offset++;
972 /* Unexpected channel type */
974 }
977 }
981 /* Common channel info */
983 /* Skip length */
984 offset++;
986 /* Cell-id */
992 /* Logical channel type */
996 offset++;
998 /* Won't be seen if RRC decoder is called... */
1000 cell_id,
1007 /* Skip length */
1008 offset++;
1010 /* Transport channel type */
1014 offset++;
1018 /* Skip length */
1019 offset++;
1021 /* UEId */
1029 }
1033 /* Unexpected tag */
1035 }
1037 /* Optional Carrier Id */
1042 offset++;
1043 }
1045 /* Optional Carrier Type */
1050 offset++;
1051 }
1053 /* Optional Cell Group */
1058 offset++;
1059 }
1062 /* Data_Ind_UE_SM - 1 byte MAC */
1063 offset++;
1064 }
1066 /* Data_Req_UE_SM - SecurityMode Params */
1067 /* N.B. DRB keys do not get configured here.. */
1071 /* Uplink Sec Mode */
1074 sc_ti = proto_tree_add_item(tree, hf_catapult_dct2000_security_mode_params, tvb, offset, len, ENC_NA);
1081 /* Downlink Sec Mode */
1092 /* Cell Group Id */
1093 offset++;
1096 }
1098 /* Optional cryptParams */
1104 /* Cipher algorithm (required) */
1109 /* Ciphering key (optional) */
1111 /* Skip tag and length */
1120 }
1123 }
1124 }
1126 }
1127 }
1129 offset--;
1130 }
1132 /* Now should be Auth params (required) */
1134 /* Skip tag */
1135 offset++;
1139 /* Integrity algorithm (required) */
1144 /* Integrity key (optional */
1146 /* Skip tag and length */
1155 }
1158 }
1159 }
1161 }
1162 }
1163 }
1165 /* Optional data tag may follow */
1168 }
1172 }
1174 /* Skip length */
1177 /* Look up dissector handle corresponding to direction and channel type */
1180 /* Uplink channel types */
1185 }
1188 }
1193 }
1197 }
1199 /* Should be 8 bytes.. */
1201 }
1202 }
1206 /* Unknown Uplink channel type */
1208 }
1211 /* Downlink channel types */
1216 }
1219 }
1224 }
1227 }
1232 }
1235 }
1241 }
1244 }
1245 }
1249 }
1252 }
1253 }
1257 /* Unknown Downlink channel type */
1259 }
1260 }
1262 /* Send to RRC dissector, if got here, have sub-dissector and some data left */
1265 /* Set MAC-NR info for this PDU. Needed so that UEId can be found for this frame,
1266 * as used by MAC/RLC/PDCP configuration from RRC dissector */
1272 /* Store info in packet */
1274 }
1278 }
1279 }
1282 /* Dissect an CCPRI LTE frame by first parsing the header entries then passing
1283 the data to the CPRI C&M dissector
1285 XXX - is this the Common Public Radio Interface? If so, what's the extra
1286 "C" in "CCPRI"? And why is the LAPB dissector involved here? The CPRI
1287 spec just speaks of HDLC; LAPB is certainly a HDLC-based protocol, but
1288 that doesn't mean every HDLC-based protocol is LAPB. */
1291 {
1298 /* Top-level opcode */
1299 proto_tree_add_item(tree, hf_catapult_dct2000_lte_ccpri_opcode, tvb, offset, 1, ENC_BIG_ENDIAN);
1302 /* Skip 2-byte length field */
1305 /* Cell-id */
1310 /* Status (ind only) */
1316 offset++;
1321 }
1322 }
1324 /* Channel ID */
1327 offset++;
1329 /* Data tag must follow */
1333 }
1335 /* Skip length */
1339 /* Send remainder to lapb dissector; I assume "CPRI" is the Common
1340 Public Radio Interface, in which case the "lapb" dissector is
1341 being used to dissect the HDLC used by CPRI, and in which case
1342 we should really have a CPRI dissector that dissects its HDLC
1343 and then hands off to a CPRI C&M dissector. */
1348 }
1349 }
1354 /* Dissect a PDCP LTE frame by first parsing the RLCPrim header then passing
1355 the data to the PDCP LTE dissector */
1358 {
1366 /* Look this up so can update channel info */
1367 p_pdcp_lte_info = (struct pdcp_lte_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_pdcp_lte, 0);
1369 /* This really should be set...can't dissect anything without it */
1371 }
1373 /* Top-level opcode */
1377 }
1378 offset++;
1382 /* Assume UE side, so REQ is UL, IND is DL */
1392 }
1394 /* Parse header */
1403 /* Get next tag */
1408 /* Dedicated channel info */
1410 /* Length will fit in one byte here */
1411 offset++;
1415 /* UEId */
1423 /* Get tag of channel type */
1428 offset++;
1431 channelId);
1437 offset++;
1440 channelId);
1447 /* Unexpected channel type */
1449 }
1454 /* Common channel info */
1456 /* Skip length */
1457 offset++;
1459 /* Cell-id */
1464 /* Logical channel type */
1474 /* Skip length */
1475 offset++;
1477 /* Transport channel type */
1481 offset++;
1485 /* Skip length */
1486 offset++;
1488 /* UEId */
1499 }
1503 /* Unexpected tag */
1505 }
1507 /* Other optional fields may follow */
1512 /* This is MUI */
1513 offset++;
1518 /* CNF follows MUI in AM */
1522 offset++;
1523 }
1524 }
1526 /* Discard Req */
1527 offset++;
1530 offset++;
1531 }
1534 }
1537 /********************************/
1538 /* Should be at data tag now */
1540 /* Call PDCP LTE dissector */
1548 }
1549 }
1555 /* Look up dissector by protocol name. Fix up known name mis-matches.
1556 This includes exact matches and prefixes (e.g. "diameter_rx" -> "diameter") */
1558 {
1561 }
1562 else
1565 }
1566 else
1569 }
1570 else
1573 }
1574 else
1577 }
1578 else
1581 }
1583 /* Only check really old names to convert if preference is checked */
1585 /* Use known aliases and protocol name prefixes */
1588 }
1589 else
1597 }
1598 else
1603 }
1604 else
1607 }
1608 else
1611 }
1612 else
1615 }
1616 else
1619 }
1620 else
1623 }
1624 else
1627 }
1628 else
1631 }
1632 else
1635 }
1636 }
1638 /* Try for an exact match */
1640 }
1643 /* Populate outhdr_values array with numbers found in outhdr_string */
1644 static unsigned parse_outhdr_string(const unsigned char *outhdr_string, int outhdr_string_len, unsigned *outhdr_values)
1645 {
1649 /* Populate values array */
1659 /* Find digits */
1663 }
1666 }
1667 }
1670 /* No more numbers left */
1672 }
1674 /* Convert digits into value (much faster than format_text() + atoi()) */
1678 }
1681 /* Skip comma */
1682 n++;
1683 }
1685 }
1689 /* Fill in an FP packet info struct and attach it to the packet for the FP
1690 dissector to use */
1694 {
1701 /* Only need to set info once per session. */
1702 struct fp_info *p_fp_info = (struct fp_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_fp, 0);
1705 }
1707 /* Allocate struct */
1710 /* Check that the number of outhdr values looks sensible */
1715 }
1717 /* 3gpp release (99, 4, 5, 6, 7) */
1720 }
1723 }
1726 }
1729 }
1732 }
1735 }
1738 }
1740 /* Really shouldn't get here */
1743 }
1745 /* Release date is derived from variant number */
1746 /* Only R6 sub-versions currently influence format within a release */
1751 }
1754 }
1770 }
1786 }
1789 /* Channel type */
1791 /* Sad hack until this value is filled in properly */
1794 }
1796 /* Derive direction from node type/side */
1801 /* Division type introduced for R7 */
1805 }
1807 /* HS-DSCH config */
1811 /* Entity (MAC-hs or MAC-ehs) used */
1814 }
1815 }
1817 /* This is the pre-R7 default */
1819 }
1820 }
1823 /* IUR only uses the above... */
1825 /* Store info in packet */
1829 }
1831 /* DCH CRC present... */
1834 /* ... but don't trust for edch */
1837 }
1839 /* How many paging indications (if PCH data) */
1842 /* Number of channels (for coordinated channels) */
1846 }
1848 /* EDCH-Common is always T2 */
1851 }
1854 /* TF size for each channel */
1861 }
1862 }
1864 /* Number of TBs for each channel */
1871 }
1872 }
1873 }
1874 /* EDCH info */
1880 /* DDI values */
1886 }
1887 }
1889 /* Corresponding MAC-d sizes */
1895 }
1896 }
1903 }
1904 }
1907 }
1908 }
1910 /* Interface must be IuB */
1913 /* Store info in packet */
1915 }
1918 /* Fill in an RLC packet info struct and attach it to the packet for the RLC
1919 dissector to use */
1923 {
1924 /* Only need to set info once per session. */
1926 struct rlc_info *p_rlc_info = (struct rlc_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_umts_rlc, 0);
1930 }
1932 /* Check that the number of outhdr values looks correct */
1935 }
1937 /* Allocate structs */
1941 /* Fill in struct fields for first (only) PDU in this frame */
1943 /* Urnti. Just use UEId */
1946 /* ciphered (off by default) */
1949 /* deciphered (off by default) */
1952 /* Mode. */
1973 }
1975 /* rbid. TODO: does this need conversion? */
1978 /* li_size */
1981 /* Store info in packet */
1984 /* Also store minimal FP info consulted by RLC dissector
1985 TODO: Don't really know direction, but use S/R flag to make
1986 logs in same context consistent. Will be correct for NodeB logs,
1987 but RLC dissector seems to not use anyway... */
1991 }
1994 /* Fill in a MAC LTE packet info struct and attach it to the packet for that
1995 dissector to use */
1996 static void attach_mac_lte_info(packet_info *pinfo, unsigned *outhdr_values, unsigned outhdr_values_found)
1997 {
2001 /* Only need to set info once per session. */
2005 }
2007 /* Allocate & zero struct */
2010 /* Populate the struct from outhdr values */
2016 /* Set these extra PHY present flags to false by default */
2019 }
2022 }
2032 }
2033 /* TODO: delete if won't see this special case anymore? */
2035 /* CRC only valid for Downlink */
2039 }
2042 }
2043 }
2048 /* Extra PHY parameters */
2064 }
2067 }
2068 }
2070 /* Uplink */
2076 /* Skip retx flag */
2079 /* TODO: delete if won't see this special case anymore? */
2083 }
2090 }
2091 }
2092 }
2094 /* System frame number */
2097 }
2103 }
2106 /* R10 parameter not set yet */
2108 }
2111 /* Carrier ID */
2113 }
2115 /* Remaining fields not (yet?) supported in
2116 the mac-lte dissector. */
2118 /* Serving cell index */
2119 }
2121 /* UE Type */
2122 }
2124 /* Store info in packet */
2126 }
2129 /* Fill in a RLC LTE packet info struct and attach it to the packet for that
2130 dissector to use */
2133 {
2137 /* Only need to set info once per session. */
2141 }
2143 /* Allocate & zero struct */
2155 /* Store info in packet */
2157 }
2159 /* Fill in a PDCP LTE packet info struct and attach it to the packet for the PDCP LTE
2160 dissector to use */
2163 {
2167 /* Only need to set info once per session. */
2168 p_pdcp_lte_info = (pdcp_lte_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_pdcp_lte, 0);
2171 }
2173 /* Allocate & zero struct */
2180 }
2192 /* Remaining 2 (fixed) fields are ah_length and gre_checksum */
2194 /* Store info in packet */
2196 }
2199 /* Attempt to show tty (raw character messages) as text lines. */
2201 {
2207 /* Create tty tree. */
2211 /* Show the tty lines one at a time. */
2213 /* Find the end of the line. */
2216 /* Extract & add the string. */
2219 /* If the first byte of the string is printable ASCII treat as string... */
2224 }
2226 /* Otherwise show as $hex */
2235 /* Write hex out to new string */
2239 }
2241 }
2242 lines++;
2244 /* Show first line in info column */
2248 }
2250 /* Move onto next line. */
2252 }
2254 /* Close off summary of tty message in info column */
2257 }
2258 }
2261 /* Scan the log comment looking for notable out-of-band MAC events that should
2262 be sent to the MAC dissector */
2265 {
2272 mac_lte_oob_event oob_event;
2276 /* Current strings of interest begin with ">> ", so if don't see, avoid sscanf() calls. */
2279 }
2281 /*********************************************/
2282 /* Look for strings matching formats */
2284 /* RACH Preamble request */
2285 if (sscanf(string, ">> RACH Preamble Request [CarrierId=%u] [LTE UE = %u] [RAPID = %u] [Attempt = %u",
2288 }
2290 /* Scheduling Requests */
2295 /* Newer, multi-UE format */
2298 /* Parse other ueid/rnti pairs */
2305 /* Find the start of the next entry */
2309 }
2311 /* This is an error - shouldn't happen */
2313 }
2315 /* Read this entry */
2317 /* Assuming that if we can't read this one there is no point trying others */
2320 }
2321 }
2322 }
2323 }
2325 /* SR failures */
2329 }
2331 /* No events found */
2335 /********************************************/
2336 /* We have an event. Allocate & zero struct */
2339 /* This indicates to MAC dissector that it has an oob event */
2353 }
2362 }
2368 /* Store info in packet */
2371 /* Call MAC dissector */
2373 }
2375 static uint8_t
2377 {
2380 }
2384 }
2386 /* Not a valid hex string character */
2388 }
2391 /*****************************************/
2392 /* Main dissection function. */
2393 /*****************************************/
2394 static int
2396 {
2423 /* Set Protocol */
2426 /* Clear Info */
2429 /* Create root (protocol) tree. */
2433 }
2435 /*********************************************************************/
2436 /* Note that these are the fields of the stub header as written out */
2437 /* by the wiretap module */
2439 /* Context Name */
2444 }
2447 /* Context port number */
2452 }
2453 offset++;
2455 /* Timestamp in file */
2456 timestamp_string = tvb_get_stringz_enc(pinfo->pool, tvb, offset, ×tamp_length, ENC_ASCII);
2458 /* g_ascii_strtod(timestamp_string, NULL)) is much simpler, but *very* slow..
2459 There will be seconds, a dot, and 4 decimal places.
2460 N.B. timestamp_length also includes following NULL character */
2462 /* Can't properly parse, but leave showing how far we got */
2464 }
2466 /* Seconds. */
2472 }
2474 /* Subseconds (4 digits). N.B. trailing zeros are written out by wiretap module. */
2484 }
2488 /* DCT2000 protocol name */
2493 }
2497 }
2501 /* Protocol Variant */
2506 }
2509 /* Outhdr (shown as string) */
2514 }
2518 /* Direction */
2523 }
2524 offset++;
2526 /* Read frame encapsulation set by wiretap */
2529 }
2531 offset++;
2533 /* Add useful details to protocol tree label */
2535 context_name,
2536 port_number,
2537 timestamp_string,
2539 protocol_name,
2540 variant_string);
2546 /* FP protocols need info from outhdr attached */
2552 outhdr_values);
2556 else
2558 }
2560 /* RLC protocols need info from outhdr attached */
2570 outhdr_values);
2571 /* Can't attach info yet. Need combination of outheader values
2572 and fields parsed from primitive header... */
2573 }
2575 /* LTE MAC needs info attached */
2580 outhdr_values);
2582 }
2584 /* LTE RLC needs info attached */
2589 outhdr_values);
2591 }
2593 /* LTE PDCP needs info attached */
2598 outhdr_values);
2600 }
2617 /* UEId */
2625 /* UEId */
2632 /* Establish cause. TODO: value_string */
2637 /* Priority. TODO: Vals are low | high */
2643 /* UEId */
2650 /* Release cause. TODO: value_string */
2659 }
2661 /* Look up dissector if it looks right */
2666 }
2669 }
2670 }
2671 }
2673 /* NR NAS for S1AP */
2677 /* Opcode tag (only interested in ones that carry NAS PDU) */
2681 /* Skip overall length */
2684 /* UE Id. Skip tag and fixed length */
2690 /* NAS PDU tag is 2 bytes */
2694 /* Also skip length */
2698 /* N.B. Ignoring some optional fields after the NAS PDU */
2699 }
2700 }
2701 }
2704 /* Note that the first item of pinfo->pseudo_header->dct2000 will contain
2705 the pseudo-header needed (in some cases) by the Wireshark dissector that
2706 this packet data will be handed off to. */
2709 /***********************************************************************/
2710 /* Now hand off to the dissector of intended packet encapsulation type */
2712 /* Get protocol handle, and set p2p_dir where necessary.
2713 (packet-frame.c won't copy it from pseudo-header because it doesn't
2714 know about Catapult DCT2000 encap type...)
2715 */
2719 #if 0
2720 /* TODO: this doesn't work yet.
2721 pseudo_header isn't copied from wtap to pinfo... */
2727 /* Add PDCP thread info as generated fields */
2734 }
2735 #endif
2741 /*
2742 * XXX - if the file can handle B-channel traffic as well
2743 * as D-channel traffic, have the libwiretap code fill
2744 * in the channel, and call the ISDN dissector rather
2745 * than the LAPD-with-pseudoheader dissector.
2746 */
2772 /**********************************************************/
2773 /* The wiretap module wasn't able to set an encapsulation */
2774 /* type, but it may still be possible to dissect the data */
2775 /* if we know about the protocol or if we can recognise */
2776 /* and parse or skip a primitive header */
2777 /**********************************************************/
2779 /* Show context.port in src or dest column as appropriate */
2783 context_name,
2784 port_number);
2785 }
2786 else
2790 context_name,
2791 port_number);
2792 }
2795 /**************************************************************************/
2796 /* These protocols have no encapsulation type, just look them up directly */
2809 }
2811 else
2816 }
2818 else
2823 }
2825 else
2829 /* Dissect proprietary header, then pass remainder to PDCP */
2832 }
2835 /* Work with generic XML protocol. */
2836 else
2839 }
2842 /* Attempt to show tty messages as raw text */
2843 else
2847 }
2849 else
2852 }
2854 else
2856 /* Extract & add the string. */
2860 /* Show comment string */
2866 /* Look into string for out-of-band MAC events, such as SRReq, SRInd */
2868 }
2870 /* Look for and flag generic error messages */
2872 proto_item *error_ti = proto_tree_add_item(dct2000_tree, hf_catapult_dct2000_error_comment, tvb,
2877 }
2880 /* Look for logged MAC-NR PDU */
2881 /* Example contents would be:
2882 $Debug - NRMAC PDU: direction=0 rntiType=3 rnti=8495 ueid=1 SN=0 SFN=0 length=22 $40111212121212121212121212121212121212121212
2883 */
2886 if ((sscanf(string, "L1_App: NRMAC PDU: direction=%d rntiType=%d rnti=%d ueid=%d SN=%d SFN=%d length=%d $",
2888 (sscanf(string, "NRMAC PDU: direction=%d rntiType=%d rnti=%d ueid=%d SN=%d SFN=%d length=%d $",
2890 {
2893 /* Only need to set info once per session? */
2894 /* p_mac_nr_info = get_mac_nr_proto_data(pinfo); */
2896 /* Allocate & zero struct */
2899 /* Populate the struct from outhdr values */
2902 /* Map internal RNTI type -> Wireshark #defines from packet-mac-nr.h */
2922 }
2926 // 0xFFFF trumps logged rntiType...
2929 }
2936 /* Always present. TODO: miss out if both zero? */
2941 /* Store info in packet */
2944 /* Payload is from $ to end of string */
2950 }
2951 }
2953 /* Convert data to hex. */
2958 }
2960 /* Create tvb */
2963 /* Call the dissector! */
2965 }
2967 /* Look for logged NRUP PDU */
2974 off++;
2975 }
2979 /* Pad out to nearest 4 bytes if necessary. */
2980 /* Convert data to hex. */
2981 #define MAX_NRUP_DATA_LENGTH 200
2985 /* The rest (or all) is data! */
2989 }
2990 /* Pad out to nearest 4 bytes if necessary. */
2994 }
2995 }
2997 /* Create separate NRUP tvb */
3001 /* Call the dissector! */
3003 }
3005 /* Read key info from formatted lines */
3006 /* e.g. NRPDCP: RRCPRIM:ueId= 1;setThreadAuthKey: RRC id=1 alg 2 key: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 */
3009 if (!PINFO_FD_VISITED(pinfo) && sscanf(string, "NRPDCP: RRCPRIM:ueId= %u;setThreadAuthKey: RRC id=%u alg %u key: ", &ue_id, &id, &alg) == 3) {
3013 }
3014 else if (!PINFO_FD_VISITED(pinfo) && sscanf(string, "NRPDCP: RRCPRIM:ueId= %u;setThreadAuthKey: UP id=%u alg %u key: ", &ue_id, &id, &alg) == 3) {
3018 }
3019 }
3022 if (!PINFO_FD_VISITED(pinfo) && sscanf(string, "NRPDCP: RRCPRIM:ueId= %u;setThreadCryptKey: RRC id=%u alg %u key: ", &ue_id, &id, &alg) == 3) {
3026 }
3027 else if (!PINFO_FD_VISITED(pinfo) && sscanf(string, "NRPDCP: RRCPRIM:ueId= %u;setThreadCryptKey: UP id=%u alg %u key: ", &ue_id, &id, &alg) == 3) {
3031 }
3032 }
3034 /* 'raw' (ethernet) frames logged as text comments */
3039 {
3040 /* Interface */
3044 /* Direction */
3048 /* Payload is from $ to end of string */
3054 }
3055 }
3057 /* Convert data to hex. */
3062 }
3064 /* Create tvb */
3068 /* PDU */
3072 /* Call the dissector! */
3074 }
3077 }
3079 else
3081 /* Extract & add the string. */
3084 /* Show sprint string */
3090 }
3092 /* RRC (LTE or NR).
3093 Dissect proprietary header, then pass remainder
3094 to RRC dissector (depending upon direction and channel type) */
3095 else
3111 }
3116 }
3118 else
3122 /* Dissect proprietary header, then pass remainder to lapb */
3125 }
3127 /* Many DCT2000 protocols have at least one IPPrim variant. If the
3128 protocol name can be matched to a dissector, try to find the
3129 UDP/TCP data inside and dissect it.
3130 */
3140 /* For ipprim, want to show ipprim header even if can't find dissector to call for payload.. */
3152 /* Fetch IPv6 addresses */
3155 }
3158 }
3161 /* Will use this dissector then. */
3165 /* Add address parameters to tree */
3166 /* Unfortunately can't automatically create a conversation filter for this...
3167 I *could* create a fake IP header from these details, but then it would be tricky
3168 to get the FP dissector called as it has no well-known ports or heuristics... */
3177 ) :
3186 ) :
3193 }
3195 /* Add these IPPRIM fields inside an IPPRIM subtree */
3198 /* Try to add right stuff to pinfo so conversation stuff works... */
3201 /* Add addresses & ports into ipprim tree.
3202 Also set address info in pinfo for conversations... */
3213 hf_catapult_dct2000_ipprim_src_addr_v4 :
3214 hf_catapult_dct2000_ipprim_src_addr_v6,
3216 ENC_NA);
3218 /* Add hidden item for "side-less" addr */
3221 hf_catapult_dct2000_ipprim_addr_v4 :
3222 hf_catapult_dct2000_ipprim_addr_v6,
3224 ENC_NA);
3226 }
3234 hf_catapult_dct2000_ipprim_udp_src_port :
3235 hf_catapult_dct2000_ipprim_tcp_src_port,
3239 hf_catapult_dct2000_ipprim_udp_port :
3240 hf_catapult_dct2000_ipprim_tcp_port,
3243 }
3253 hf_catapult_dct2000_ipprim_dst_addr_v4 :
3254 hf_catapult_dct2000_ipprim_dst_addr_v6,
3256 ENC_NA);
3258 /* Add hidden item for "side-less" addr */
3261 hf_catapult_dct2000_ipprim_addr_v4 :
3262 hf_catapult_dct2000_ipprim_addr_v6,
3264 ENC_NA);
3266 }
3274 hf_catapult_dct2000_ipprim_udp_dst_port :
3275 hf_catapult_dct2000_ipprim_tcp_dst_port,
3279 hf_catapult_dct2000_ipprim_udp_port :
3280 hf_catapult_dct2000_ipprim_tcp_port,
3283 }
3286 hf_catapult_dct2000_ipprim_conn_id,
3288 }
3291 /* Set source and dest columns now (will be overwriiten if
3292 src and dst IP addresses set) */
3298 }
3304 }
3306 /* Set length for IPPrim tree */
3308 }
3309 }
3312 /* Try SCTP Prim heuristic if configured to */
3333 /* Will use this dissector then. */
3342 "<ipv6-address>"
3343 ) :
3349 /* Add these SCTPPRIM fields inside an SCTPPRIM subtree */
3352 /* Destination address */
3362 hf_catapult_dct2000_sctpprim_dst_addr_v4 :
3363 hf_catapult_dct2000_sctpprim_dst_addr_v6,
3365 ENC_NA);
3367 /* Add hidden item for "side-less" addr */
3370 hf_catapult_dct2000_sctpprim_addr_v4 :
3371 hf_catapult_dct2000_sctpprim_addr_v6,
3373 ENC_NA);
3375 }
3381 hf_catapult_dct2000_sctpprim_dst_port,
3383 }
3385 /* Set length for SCTPPrim tree */
3387 }
3388 }
3390 /* Next chance: is there a (private) registered protocol of the form
3391 "dct2000.protocol" ? */
3393 /* TODO: only look inside if a preference enabled? */
3395 /* N.B. avoiding snprintf(), which was slow */
3399 }
3401 /* Last resort: Allow any PDU to be dissected if the protocol matches with
3402 a dissector name */
3405 }
3411 /* !! If get here, there is a mismatch between
3412 this dissector and the wiretap module catapult_dct2000.c !!
3413 */
3416 }
3418 /* Set selection length of dct2000 tree */
3421 /* Try appropriate dissector, if one has been selected */
3423 /* Dissect the remainder of the frame using chosen protocol handle */
3425 sub_dissector_result = call_dissector_only(protocol_handle, next_tvb, pinfo, tree, protocol_data);
3426 }
3430 /* Could get here because:
3431 - encap is DCT2000_ENCAP_UNHANDLED and we still didn't handle it, OR
3432 - desired protocol is unavailable (probably disabled), OR
3433 - protocol rejected our data
3434 Show remaining bytes as unparsed data */
3440 context_name,
3441 port_number,
3442 timestamp_string,
3444 protocol_name,
3445 variant_string);
3446 }
3448 /* Show number of dissected bytes */
3451 hf_catapult_dct2000_dissected_length,
3454 }
3455 }
3458 }
3462 /******************************************************************************/
3463 /* Associate this protocol with the Catapult DCT2000 file encapsulation type. */
3464 /******************************************************************************/
3466 {
3477 }
3479 /****************************************/
3480 /* Register the protocol */
3481 /****************************************/
3483 {
3485 {
3490 }
3491 },
3495 NULL, HFILL
3496 }
3497 },
3502 }
3503 },
3508 }
3509 },
3514 }
3515 },
3520 }
3521 },
3526 }
3527 },
3532 }
3533 },
3538 }
3539 },
3543 NULL, HFILL
3544 }
3545 },
3549 NULL, HFILL
3550 }
3551 },
3555 NULL, HFILL
3556 }
3557 },
3562 }
3563 },
3568 NULL, HFILL
3569 }
3570 },
3575 }
3576 },
3581 }
3582 },
3587 }
3588 },
3593 }
3594 },
3599 }
3600 },
3605 }
3606 },
3611 }
3612 },
3617 }
3618 },
3623 }
3624 },
3629 }
3630 },
3635 }
3636 },
3641 }
3642 },
3647 }
3648 },
3653 NULL, HFILL
3654 }
3655 },
3660 }
3661 },
3666 }
3667 },
3672 }
3673 },
3678 }
3679 },
3684 }
3685 },
3690 NULL, HFILL
3691 }
3692 },
3696 NULL, HFILL
3697 }
3698 },
3704 }
3705 },
3710 }
3711 },
3716 }
3717 },
3722 }
3723 },
3728 }
3729 },
3734 }
3735 },
3739 NULL, HFILL
3740 }
3741 },
3746 }
3747 },
3752 }
3753 },
3758 }
3759 },
3763 NULL, HFILL
3764 }
3765 },
3769 NULL, HFILL
3770 }
3771 },
3775 NULL, HFILL
3776 }
3777 },
3782 NULL, HFILL
3783 }
3784 },
3788 NULL, HFILL
3789 }
3790 },
3794 NULL, HFILL
3795 }
3796 },
3800 NULL, HFILL
3801 }
3802 },
3806 NULL, HFILL
3807 }
3808 },
3812 NULL, HFILL
3813 }
3814 },
3818 NULL, HFILL
3819 }
3820 },
3825 NULL, HFILL
3826 }
3827 },
3831 NULL, HFILL
3832 }
3833 },
3837 NULL, HFILL
3838 }
3839 },
3844 NULL, HFILL
3845 }
3846 },
3850 NULL, HFILL
3851 }
3852 },
3856 NULL, HFILL
3857 }
3858 },
3862 NULL, HFILL
3863 }
3864 },
3868 NULL, HFILL
3869 }
3870 },
3876 }
3877 },
3882 }
3883 },
3887 NULL, HFILL
3888 }
3889 },
3893 NULL, HFILL
3894 }
3895 },
3899 NULL, HFILL
3900 }
3901 },
3905 NULL, HFILL
3906 }
3907 },
3911 NULL, HFILL
3912 }
3913 },
3917 NULL, HFILL
3918 }
3919 },
3923 NULL, HFILL
3924 }
3925 },
3929 NULL, HFILL
3930 }
3931 },
3935 NULL, HFILL
3936 }
3937 },
3941 NULL, HFILL
3942 }
3943 },
3947 NULL, HFILL
3948 }
3949 },
3954 NULL, HFILL
3955 }
3956 },
3960 NULL, HFILL
3961 }
3962 },
3966 NULL, HFILL
3967 }
3968 }
3969 };
3972 {
3977 &ett_catapult_dct2000_security_mode_params
3978 };
3981 { &ei_catapult_dct2000_lte_ccpri_status_error, { "dct2000.lte.ccpri.status.error", PI_SEQUENCE, PI_ERROR, "CCPRI Indication has error status", EXPFILL }},
3982 { &ei_catapult_dct2000_error_comment_expert, { "dct2000.error-comment.expert", PI_SEQUENCE, PI_ERROR, "Formatted expert comment", EXPFILL }},
3983 { &ei_catapult_dct2000_string_invalid, { "dct2000.string.invalid", PI_MALFORMED, PI_ERROR, "String must contain an integer", EXPFILL }}
3984 };
3989 /* Register protocol. */
3998 /* Allow dissector to find be found by name. */
3999 catapult_dct2000_handle = register_dissector("dct2000", dissect_catapult_dct2000, proto_catapult_dct2000);
4001 /* Preferences */
4004 /* This preference no longer supported (introduces linkage dependency between
4005 dissectors and wiretap) */
4009 /* Determines whether for not-handled protocols we should try to parse it if:
4010 - it looks like it's embedded in an ipprim message, AND
4011 - the DCT2000 protocol name can be matched to a Wireshark dissector name */
4014 "If a payload looks like it's embedded in an "
4015 "IP primitive message, and there is a Wireshark "
4016 "dissector matching the DCT2000 protocol name, "
4020 /* Determines whether for not-handled protocols we should try to parse it if:
4021 - it looks like it's embedded in an sctpprim message, AND
4022 - the DCT2000 protocol name can be matched to a Wireshark dissector name */
4025 "If a payload looks like it's embedded in an "
4026 "SCTP primitive message, and there is a Wireshark "
4027 "dissector matching the DCT2000 protocol name, "
4031 /* Determines whether LTE RRC messages should be dissected */
4034 "When set, attempt to decode LTE RRC frames. "
4035 "Note that this won't affect other protocols "
4039 /* Determines whether out-of-band messages should dissected */
4042 "When set, look for formatted messages indicating "
4043 "specific events. This may be quite slow, so should "
4047 /* Whether old protocol names conversions should be checked */
4050 "When set, look for some older protocol names so that"
4054 /* Determines if the protocol field in the DCT2000 shall be used to lookup for dissector */
4056 "Look for a dissector using the protocol name in the "
4058 "When set, if there is a Wireshark dissector matching "
4059 "the protocol name, it will parse the PDU using "
4060 "that dissector. This may be slow, so should be "
4063 }
4065 /*
4066 * Editor modelines - https://www.wireshark.org/tools/modelines.html
4067 *
4068 * Local variables:
4069 * c-basic-offset: 4
4070 * tab-width: 8
4071 * indent-tabs-mode: nil
4072 * End:
4073 *
4074 * vi: set shiftwidth=4 tabstop=8 expandtab:
4075 * :indentSize=4:tabSize=8:noTabs=true:
4076 */