| blob | a6048f45eb744496acebf4284a5f3fb98ddcac19 |
1 /* packet-dcm.c
2 * Routines for DICOM dissection
3 * Copyright 2003, Rich Coe <richcoe2@gmail.com>
4 * Copyright 2008-2019, David Aggeler <david_aggeler@hispeed.ch>
5 *
6 * DICOM communication protocol: https://www.dicomstandard.org/current/
7 *
8 * Part 5: Data Structures and Encoding
9 * Part 6: Data Dictionary
10 * Part 7: Message Exchange
11 * Part 8: Network Communication Support for Message Exchange
12 * Part 10: Media Storage and File Format
13 *
14 * Wireshark - Network traffic analyzer
15 * By Gerald Combs <gerald@wireshark.org>
16 * Copyright 1998 Gerald Combs
17 *
18 * SPDX-License-Identifier: GPL-2.0-or-later
19 */
22 /*
23 *
24 * ToDo
25 *
26 * - Implement value multiplicity (VM) consistently in dissect_dcm_tag_value()
27 * - Syntax detection, in case an association request is missing in capture
28 * - Read private tags from configuration and parse in capture
29 *
30 * History
31 *
32 * Feb 2019 - David Aggeler
33 *
34 * - Fixed re-assembly and export (consolidated duplicate code)
35 * - Fixed random COL_INFO issues
36 * - Improved COL_INFO for C-FIND
37 * - Improved COL_INFO for multiple PDUs in one frame
38 *
39 * Feb 2019 - Rickard Holmberg
40 *
41 * - Updated DICOM definitions to 2019a
42 *
43 * Oct 2018 - Rickard Holmberg
44 *
45 * - Moved DICOM definitions to packet-dcm.h
46 * - Generate definitions from docbook with Phyton script
47 * - Updated DICOM definitions to 2018e
48 *
49 * June 2018 - David Aggeler
50 *
51 * - Fixed initial COL_INFO for associations. It used to 'append' instead of 'set'.
52 * - Changed initial length check from tvb_reported_length() to tvb_captured_length()
53 * - Heuristic Dissection:
54 * o Modified registration, so it can be clearly identified in the Enable/Disable Protocols dialog
55 * o Enabled by default
56 * o Return proper data type
57 *
58 * February 2018 - David Aggeler
59 *
60 * - Fixed Bug 14415. Some tag descriptions which are added to the parent item (32 tags).
61 * If one of those was empty a crash occurred. Mainly the RTPlan modality was affected.
62 * - Fixed length decoding for OD, OL, UC, UR
63 * - Fixed hf_dcm_assoc_item_type to be interpreted as 1 byte
64 * - Fixed pdu_type to be interpreted as 1 byte
65 * - Fixed decoding of AT type, where value length was wrongly reported in capture as 2 (instead of n*4)
66 *
67 * Misc. authors & dates
68 *
69 * - Fixed 'AT' value representation. The 'element' was equal to the 'group'.
70 * - Changed 'FL' value representations
71 *
72 * September 2013 - Pascal Quantin
73 *
74 * - Replace all ep_ and se_ allocation with wmem_ allocations
75 *
76 * February 2013 - Stefan Allers
77 *
78 * - Support for dissection of Extended Negotiation (Query/Retrieve)
79 * - Support for dissection of SCP/SCU Role Selection
80 * - Support for dissection of Async Operations Window Negotiation
81 * - Fixed: Improper calculation of length for Association Header
82 * - Missing UIDs (Transfer Syntax, SOP Class...) added acc. PS 3.x-2011
83 *
84 * Jul 11, 2010 - David Aggeler
85 *
86 * - Finally, better reassembly using fragment_add_seq_next().
87 * The previous mode is still supported.
88 * - Fixed sporadic decoding and export issues. Always decode
89 * association negotiation, since performance check (tree==NULL)
90 * is now only in dissect_dcm_pdv_fragmented().
91 * - Added one more PDV length check
92 * - Show Association Headers as individual items
93 * - Code cleanup. i.e. moved a few lookup functions to be closer to the dissection
94 *
95 * May 13, 2010 - David Aggeler (SVN 32815)
96 *
97 * - Fixed HF to separate signed & unsigned values and to have BASE_DEC all signed ones
98 * - Fixed private sequences with undefined length in ILE
99 * - Fixed some spellings in comments
100 *
101 * May 27, 2009 - David Aggeler (SVN 29060)
102 *
103 * - Fixed corrupt files on DICOM Export
104 * - Fixed memory limitation on DICOM Export
105 * - Removed minimum packet length for static port mode
106 * - Simplified checks for heuristic mode
107 * - Removed unused functions
108 *
109 * May 17, 2009 - David Aggeler (SVN 28392)
110 *
111 * - Spelling
112 * - Added expert_add_info() for status responses with warning & error level
113 * - Added command details in info column (optionally)
114 *
115 * Dec 19, 2008 to Mar 29, 2009 - Misc (SVN 27880)
116 *
117 * - Spellings, see SVN
118 *
119 * Oct 26, 2008 - David Aggeler (SVN 26662)
120 *
121 * - Support remaining DICOM/ARCNEMA tags
122 *
123 * Oct 3, 2008 - David Aggeler (SVN 26417)
124 *
125 * - DICOM Tags: Support all tags, except for group 1000, 7Fxx
126 * and tags (0020,3100 to 0020, 31FF).
127 * Luckily these ones are retired anyhow
128 * - DICOM Tags: Optionally show sequences, items and tags as subtree
129 * - DICOM Tags: Certain items do have a summary of a few contained tags
130 * - DICOM Tags: Support all defined VR representations
131 * - DICOM Tags: For Explicit Syntax, use VR in the capture
132 * - DICOM Tags: Lookup UIDs
133 * - DICOM Tags: Handle split at PDV start and end. RT Structures were affected by this.
134 * - DICOM Tags: Handle split in tag header
135 *
136 * - Added all status messages from PS 3.4 & PS 3.7
137 * - Fixed two more type warnings on solaris, i.e. (char *)tvb_get_ephemeral_string
138 * - Replaced all ep_alloc() with ep_alloc0() and se_alloc() with se_alloc0()
139 * - Replaced g_strdup with ep_strdup() or se_strdup()
140 * - Show multiple PDU description in COL_INFO, not just last one. Still not all, but more
141 * sophisticated logic for this column is probably overkill
142 * - Since DICOM is a 32 bit protocol with all length items specified unsigned
143 * all offset & position variables are now declared as uint32_t for dissect_dcm_pdu and
144 * its nested functions. dissect_dcm_main() remained by purpose on int,
145 * since we request data consolidation, requiring a true as return value
146 * - Decode DVTk streams when using defined ports (not in heuristic mode)
147 * - Changed to warning level 4 (for MSVC) and fixed the warnings
148 * - Code cleanup & removed last DISSECTOR_ASSERT()
149 *
150 * Jul 25, 2008 - David Aggeler (SVN 25834)
151 *
152 * - Replaced unsigned char with char, since it caused a lot of warnings on solaris.
153 * - Moved a little more form the include to this one to be consistent
154 *
155 * Jul 17, 2008 - David Aggeler
156 *
157 * - Export objects as part 10 compliant DICOM file. Finally, this major milestone has been reached.
158 * - PDVs are now a child of the PCTX rather than the ASSOC object.
159 * - Fixed PDV continuation for unknown tags (e.g. RT Structure Set)
160 * - Replaced proprietary trim() with g_strstrip()
161 * - Fixed strings that are displayed with /000 (padding of odd length)
162 * - Added expert_add_info() for invalid flags and presentation context IDs
163 *
164 * Jun 17, 2008 - David Aggeler
165 *
166 * - Support multiple PDVs per PDU
167 * - Better summary, in PDV, PDU header and in INFO Column, e.g. show commands like C-STORE
168 * - Fixed Association Reject (was working before my changes)
169 * - Fixed PDV Continuation with very small packets. Reduced minimum packet length
170 * from 10 to 2 Bytes for PDU Type 4
171 * - Fixed PDV Continuation. Last packet was not found correctly.
172 * - Fixed compilation warning (build 56 on solaris)
173 * - Fixed tree expansion (hf_dcm_xxx)
174 * - Added expert_add_info() for Association Reject
175 * - Added expert_add_info() for Association Abort
176 * - Added expert_add_info() for short PDVs (i.e. last fragment, but PDV is not completed yet)
177 * - Clarified and grouped data structures and its related code (dcmItem, dcmState) to have
178 * consistent _new() & _get() functions and to be according to coding conventions
179 * - Added more function declaration to be more consistent
180 * - All dissect_dcm_xx now have (almost) the same parameter order
181 * - Removed DISSECTOR_ASSERT() for packet data errors. Not designed to handle this.
182 * - Handle multiple DICOM Associations in a capture correctly, i.e. if presentation contexts are different.
183 *
184 * May 23, 2008 - David Aggeler
185 *
186 * - Added Class UID lookup, both in the association and in the transfer
187 * - Better hierarchy for items in Association request/response and therefore better overview
188 * This was a major rework. Abstract Syntax & Transfer Syntax are now children
189 * of a presentation context and therefore grouped. User Info is now grouped.
190 * - Re-assemble PDVs that span multiple PDUs, i.e fix continuation packets
191 * This caused significant changes to the data structures
192 * - Added preference with DICOM TCP ports, to prevent 'stealing' the conversation
193 * i.e. don't just rely on heuristic
194 * - Use pinfo->desegment_len instead of tcp_dissect_pdus()
195 * - Returns number of bytes parsed
196 * - For non DICOM packets, do not allocate any memory anymore,
197 * - Added one DISSECTOR_ASSERT() to prevent loop with len==0. More to come
198 * - Heuristic search is optional to save resources for non DICOM users
199 *
200 * - Output naming closer to DICOM Standard
201 * - Variable names closer to Standard
202 * - Protocol in now called DICOM not dcm anymore.
203 * - Fixed type of a few variables to unsigned char instead of uint8_t
204 * - Changed some of the length displays to decimal, because the hex value can
205 * already be seen in the packet and decimal is easier for length calculation
206 * in respect to TCP
207 *
208 * Apr 28, 2005 - Rich Coe
209 *
210 * - fix memory leak when Assoc packet is processed repeatedly in wireshark
211 * - removed unused partial packet flag
212 * - added better support for DICOM VR
213 * - sequences
214 * - report actual VR in packet display, if supplied by xfer syntax
215 * - show that we are not displaying entire tag string with '[...]',
216 * some tags can hold up to 2^32-1 chars
217 *
218 * - remove my goofy attempt at trying to get access to the fragmented packets
219 * - process all the data in the Assoc packet even if display is off
220 * - limit display of data in Assoc packet to defined size of the data even
221 * if reported size is larger
222 * - show the last tag in a packet as [incomplete] if we don't have all the data
223 * - added framework for reporting DICOM async negotiation (not finished)
224 * (I'm not aware of an implementation which currently supports this)
225 *
226 * Nov 9, 2004 - Rich Coe
227 *
228 * - Fixed the heuristic code -- sometimes a conversation already exists
229 * - Fixed the dissect code to display all the tags in the PDU
230 *
231 * Initial - Rich Coe
232 *
233 * - It currently displays most of the DICOM packets.
234 * - I've used it to debug Query/Retrieve, Storage, and Echo protocols.
235 * - Not all DICOM tags are currently displayed symbolically.
236 * Unknown tags are displayed as '(unknown)'
237 * More known tags might be added in the future.
238 * If the tag data contains a string, it will be displayed.
239 * Even if the tag contains Explicit VR, it is not currently used to
240 * symbolically display the data.
241 *
242 */
246 #include <epan/packet.h>
247 #include <epan/exceptions.h>
248 #include <epan/prefs.h>
249 #include <epan/expert.h>
250 #include <epan/tap.h>
251 #include <epan/reassemble.h>
252 #include <epan/export_object.h>
254 #include <wsutil/str_util.h>
255 #include <wsutil/utf8_entities.h>
266 /* Many thanks to http://medicalconnections.co.uk/ for the GUID */
284 /* Initialize the protocol and registered fields */
348 /* Initialize the subtree pointers */
396 };
413 };
421 };
423 /* Used for DICOM Export Object feature */
433 static tap_packet_status
436 {
442 /*
443 The values will be freed when the export Object window is closed.
444 Therefore, strings and buffers must be copied.
445 */
451 /* g_path_get_basename() allocates a new string */
461 }
462 }
465 /* ************************************************************************* */
466 /* Fragment items */
467 /* ************************************************************************* */
469 /* Initialize the subtree pointers */
487 /* Fragment subtrees */
490 /* Fragment fields */
501 /* Reassembled data field */
502 NULL,
503 /* Tag */
504 "Message fragments"
505 };
507 /* Structure to handle fragmented DICOM PDU packets */
512 /* Contains information about an open tag in a PDV, in case it was not complete.
514 This implementation differentiates between open headers (grm, elm, vr, vl) and
515 open values. This data structure will handle both cases.
517 Open headers are not shown in the packet where the tag starts, but only in the next PDV.
518 Open values are shown in the packet where the tag starts, with <Byte 1-n> as the value
520 The same PDV can close an open tag from a previous PDV at the beginning
521 and at the same have time open a new tag at the end. The closing part at the beginning
522 does not have its own persistent data.
524 Do not overwrite the values, once defined, to save some memory.
526 Since PDVs are always n*2 bytes, store each of the 2 Bytes in a variable.
527 This way, we don't need to call tvb_get_xxx on a self created buffer
529 */
544 /* These ones are, where the value was truncated */
552 /*
553 Per Data PDV store data needed, to allow decoding of tags longer than a PDV
554 */
566 /* Following is derived from the transfer syntax in the parent PCTX, except for Command PDVs */
569 /* Used and filled for Export Object only */
574 char *sop_instance_uid; /* SOP Instance UID. Set in 1st PDV of a DICOM object. wmem_file_scope() */
575 /* End Export use */
581 This flag delimits different DICOM object in the same association */
584 /* The following five attributes are only used for command PDVs */
591 bool is_pending; /* Command response is 'Current Match is supplied. Sub-operations are continuing' */
607 /*
608 Per Presentation Context in an association store data needed, for subsequent decoding
609 */
623 #define DCM_UNK 0xf0
655 /* ---------------------------------------------------------------------
656 * DICOM Status Value Definitions
657 *
658 * Collected from PS 3.7 & 3.4
659 *
660 */
669 /* From PS 3.7 */
695 /* from PS 3.4 */
698 { 0xA501, "Refused because General Purpose Scheduled Procedure Step Object may no longer be updated"},
700 { 0xA503, "Refused because the General Purpose Scheduled Procedure Step SOP Instance is already in the 'IN PROGRESS' state"},
701 { 0xA504, "Refused because the related General Purpose Scheduled Procedure Step SOP Instance is not in the 'IN PROGRESS' state"},
702 { 0xA505, "Refused because Referenced General Purpose Scheduled Procedure Step Transaction UID does not match the Transaction UID of the N-ACTION request"},
703 { 0xA510, "Refused because an Initiate Media Creation action has already been received for this SOP Instance"},
707 /*
708 { 0xA7xx, "Refused: Out of Resources"},
709 */
711 /*
712 { 0xA9xx, "Error: Data Set does not match SOP Class"},
713 */
717 { 0xB101, "Specified Synchronization Frame of Reference UID does not match SCP Synchronization Frame of Reference"},
720 { 0xB605, "Requested Min Density or Max Density outside of printer's operating range. The printer will use its respective minimum or maximum density value instead"},
731 /*
732 { 0xCxxx, "Error: Cannot understand/Unable to Process"},
733 { 0xFE00, "Matching/Sub-operations terminated due to Cancel request"},
734 */
736 { 0xFF01, "Matches are continuing - Warning that one or more Optional Keys were not supported for existence for this Identifier"}
738 };
741 /* following definitions are used to call dissect_dcm_assoc_item() */
742 #define DCM_ITEM_VALUE_TYPE_UID 1
743 #define DCM_ITEM_VALUE_TYPE_STRING 2
744 #define DCM_ITEM_VALUE_TYPE_UINT32 3
746 /* And from here on, only use unsigned 32 bit values. Offset is always positive number in respect to the tvb buffer start */
747 static uint32_t dissect_dcm_pdu (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset);
749 static uint32_t dissect_dcm_assoc_detail(tvbuff_t *tvb, packet_info *pinfo, proto_item *ti, dcm_state_assoc_t *assoc, uint32_t offset, uint32_t len);
751 static uint32_t dissect_dcm_tag_value(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, dcm_state_pdv_t * pdv, uint32_t offset, uint16_t grp, uint16_t elm, uint32_t vl, uint32_t vl_max, const char * vr, char ** tag_value);
753 static void
755 {
758 /* Create three hash tables for quick lookups */
759 /* Add UID objects to hash table */
764 }
766 /* Add Tag objects to hash table */
771 }
773 /* Add Status Values to hash table */
778 }
779 }
781 /*
782 Get or create conversation and DICOM data structure if desired.
783 Return new or existing DICOM structure, which is used to store context IDs and transfer syntax.
784 Return NULL in case of the structure couldn't be created.
785 */
788 {
801 /* Mark it as DICOM conversation. Needed for the heuristic mode,
802 to prevent stealing subsequent packets by other dissectors
803 */
805 }
808 }
813 {
814 /* Create new association object and initialize the members */
821 /* add to the end of the list */
825 }
828 }
831 }
833 /*
834 Find or create association object based on packet number. Return NULL, if association was not found.
835 */
838 {
845 /* we have more associations in the same stream */
848 }
850 /* last or only associations in the same stream */
853 }
855 }
859 }
861 }
865 {
866 /* Create new presentation context object and initialize the members */
874 /* add to the end of the list list */
878 }
881 }
885 }
889 {
890 /* Find or create presentation context object. Return NULL, if Context ID was not found */
893 /*
894 static char notfound[] = "not found - click on ASSOC Request";
895 static dcm_state_pctx_t dunk = { NULL, NULL, false, 0, notfound, notfound, notfound, notfound, DCM_UNK };
896 */
901 }
905 }
908 }
911 /*
912 Create new PDV object and initialize all members
913 */
916 {
925 /* add to the end of the list */
929 }
932 }
935 }
940 {
941 /* Find or create PDV object. Return NULL, if PDV was not found, based on packet number and offset */
949 }
953 }
955 }
959 {
963 /* Get First PDV of the DICOM Object */
966 }
969 }
996 };
999 /*
1000 Convert the two status bytes into a text based on lookup.
1002 Classification
1003 0x0000 : SUCCESS
1004 0x0001 & Bxxx : WARNING
1005 0xFE00 : CANCEL
1006 0XFFxx : PENDING
1007 All other : FAILURE
1008 */
1011 {
1016 /* Use specific text first */
1017 status = (dcm_status_t const *)wmem_map_lookup(dcm_status_table, GUINT_TO_POINTER((uint32_t)status_value));
1021 }
1025 /* 0xA7xx */
1027 }
1029 /* 0xA9xx */
1031 }
1033 /* 0xCxxx */
1035 }
1037 /* Encountered at least one case, with status_value == 0xD001 */
1039 }
1040 }
1043 }
1047 {
1048 /* Return Description, UID or error */
1051 }
1053 static void
1055 {
1066 /* this would be faster to skip the common parts, and have a FSA to
1067 * find the syntax.
1068 * Absent of coding that, this is in descending order of probability */
1083 }
1085 static void
1087 {
1091 }
1093 static void
1095 {
1102 }
1104 static uint32_t
1108 {
1109 /* Only Explicit Little Endian is needed to create Metafile Header
1110 Generic function to write a TAG, VR, LEN & VALUE to a combined buffer
1111 The value (buffer, len) must be preprocessed by a VR specific function
1112 */
1134 /* DICOM likes it complicated. Special handling for these types */
1138 /* Add two reserved 0x00 bytes */
1142 /* Length is a 4 byte field */
1149 /* Length is a 2 byte field */
1154 }
1162 }
1164 static uint32_t
1167 {
1170 }
1172 static uint32_t
1175 {
1178 }
1180 static uint32_t
1184 {
1188 /* NULL object. E.g. happens if UID was not found/set. Don't create element*/
1190 }
1195 /* Odd length: since buffer is 0 initialized, pad with a 0x00 */
1197 }
1199 return dcm_export_create_tag_base(buffer, bufflen, offset, grp, elm, vr, (const uint8_t *)value, len);
1200 }
1204 dcm_export_create_header(packet_info *pinfo, uint32_t *dcm_header_len, const char *sop_class_uid, char *sop_instance_uid, char *xfer_uid)
1205 {
1210 #define DCM_HEADER_MAX 512
1212 dcm_header=(uint8_t *)wmem_alloc0(pinfo->pool, DCM_HEADER_MAX); /* Slightly longer than needed */
1213 /* The subsequent functions rely on a 0 initialized buffer */
1223 /*
1224 (0002,0000) File Meta Information Group Length UL
1225 (0002,0001) File Meta Information Version OB
1226 (0002,0002) Media Storage SOP Class UID UI
1227 (0002,0003) Media Storage SOP Instance UID UI
1228 (0002,0010) Transfer Syntax UID UI
1229 (0002,0012) Implementation Class UID UI
1230 (0002,0013) Implementation Version Name SH
1231 */
1251 /* Finally write the meta header length */
1259 }
1262 /*
1263 Concatenate related PDVs into one buffer and add it to the export object list.
1265 Supports both modes:
1267 - Multiple DICOM PDVs are reassembled with fragment_add_seq_next()
1268 and process_reassembled_data(). In this case all data will be in the last
1269 PDV, and all its predecessors will have zero data.
1271 - DICOM PDVs are keep separate. Every PDV contains data.
1272 */
1273 static void
1275 {
1295 /* Calculate total PDV length, i.e. all packets until last PDV without continuation */
1303 }
1305 /* Count number of PDVs with the same Packet Number */
1309 }
1316 }
1319 }
1328 /* Make sure filename does not contain invalid character. Rather conservative.
1329 Even though this should be a valid DICOM UID, apply the same filter rules
1330 in case of bogus data.
1331 */
1334 }
1336 /* No SOP Instance or SOP Class UID found in PDV. Use wireshark ones */
1342 /* Make sure filename does not contain invalid character. Rather conservative.*/
1346 }
1350 dcm_header=dcm_export_create_header(pinfo, &dcm_header_len, sop_class_uid, sop_instance_uid, pctx->xfer_uid);
1351 }
1353 /* We are running blind, i.e. no presentation context/syntax found.
1354 Don't invent one, so the meta header will miss
1355 the transfer syntax UID tag (even though it is mandatory)
1356 */
1357 dcm_header=dcm_export_create_header(pinfo, &dcm_header_len, sop_class_uid, sop_instance_uid, NULL);
1358 }
1359 }
1363 /* Allocate the final size */
1372 }
1374 /* Copy PDV per PDV to target buffer */
1379 }
1381 /* Last packet */
1384 /* Add to list */
1385 /* The tap will copy the values and free the copies; this only
1386 * needs packet lifetime. */
1396 }
1397 }
1399 /*
1400 For tags with fixed length items, calculate the value multiplicity (VM). String tags use a separator, which is not supported by this function.
1401 Support item count from 0 to n. and handles bad encoding (e.g. an 'AT' tag was reported to be 2 bytes instead of 4 bytes)
1402 */
1403 static uint32_t
1405 {
1407 /* This could all be formulated in a single line but it does not make it easier to read */
1411 }
1414 }
1417 }
1419 }
1421 /*
1422 Decode the association header
1423 */
1424 static uint32_t
1425 dissect_dcm_assoc_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset, dcm_state_assoc_t *assoc,
1427 {
1450 assoc_header_ptree = proto_tree_add_subtree(tree, tvb, offset, pdu_len, ett_assoc_header, &assoc_header_pitem, "Association Header");
1460 /*
1461 * XXX - this is in "the ISO 646:1990-Basic G0 Set"; ISO/IEC 646:1991
1462 * claims to be the third edition of the standard, with the second
1463 * version being ISO 646:1983, so I'm not sure what happened to
1464 * ISO 646:1990. ISO/IEC 646:1991 speaks of "the basic 7-bit code
1465 * table", which leaves positions 2/3 (0x23) and 2/4 (0x24) as
1466 * being either NUMBER SIGN or POUND SIGN and either DOLLAR SIGN or
1467 * CURRENCY SIGN, respectively, and positions 4/0 (0x40), 5/11 (0x5b),
1468 * 5/12 (0x5c), 5/13 (0x5d), 5/14 (0x5e), 6/0 (0x60), 7/11 (0x7b),
1469 * 7/12 (0x7c), 7/13 (0x7d), and 7/14 (0x7e) as being "available for
1470 * national or application-oriented use", so I'm *guessing* that
1471 * "the ISO 646:1990-Basic G0 Set" means "those positions aren't
1472 * specified" and thus should probably be treated as not valid
1473 * in that "Basic" set.
1474 */
1475 proto_tree_add_item_ret_display_string(assoc_header_ptree, hf_dcm_assoc_called, tvb, offset, 16, ENC_ISO_646_BASIC|ENC_NA, pinfo->pool, &ae_called);
1479 proto_tree_add_item_ret_display_string(assoc_header_ptree, hf_dcm_assoc_calling, tvb, offset, 16, ENC_ISO_646_BASIC|ENC_NA, pinfo->pool, &ae_calling);
1488 offset = dissect_dcm_assoc_detail(tvb, pinfo, assoc_header_ptree, assoc, offset, pdu_len-offset);
1498 proto_tree_add_item_ret_display_string(assoc_header_ptree, hf_dcm_assoc_called, tvb, offset, 16, ENC_ISO_646_BASIC|ENC_NA, pinfo->pool, &ae_called_resp);
1502 proto_tree_add_item_ret_display_string(assoc_header_ptree, hf_dcm_assoc_calling, tvb, offset, 16, ENC_ISO_646_BASIC|ENC_NA, pinfo->pool, &ae_calling_resp);
1511 offset = dissect_dcm_assoc_detail(tvb, pinfo, assoc_header_ptree, assoc, offset, pdu_len-offset);
1526 }
1536 }
1543 }
1550 }
1552 }
1565 /* Provider aborted */
1597 /* reserved */
1609 }
1612 }
1622 /* User aborted */
1625 }
1627 /* Provider aborted, slightly more information */
1630 }
1635 }
1641 /* proto_item and proto_tree are one and the same */
1643 }
1645 }
1647 /*
1648 Decode one item in a association request or response. Lookup UIDs if requested.
1649 Create a subtree node with summary and three elements (item_type, item_len, value)
1650 */
1651 static void
1656 {
1675 assoc_item_ptree = proto_tree_add_subtree(tree, tvb, offset, item_len+4, ett_subtree, &assoc_item_pitem, pitem_prefix);
1688 }
1690 /* Unknown UID, or no UID at all */
1692 }
1717 }
1718 }
1720 /*
1721 Decode the SOP Class Extended Negotiation Sub-Item Fields in a association request or response.
1722 Lookup UIDs if requested
1723 */
1724 static void
1725 dissect_dcm_assoc_sopclass_extneg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset)
1726 {
1742 assoc_item_extneg_item = proto_tree_add_item(tree, hf_dcm_info_extneg, tvb, offset, item_len+4, ENC_NA);
1744 assoc_item_extneg_tree = proto_item_add_subtree(assoc_item_extneg_item, ett_assoc_info_extneg);
1746 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_assoc_item_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1747 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_assoc_item_len, tvb, offset+2, 2, ENC_BIG_ENDIAN);
1748 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_info_extneg_sopclassuid_len, tvb, offset+4, 2, ENC_BIG_ENDIAN);
1750 sopclassuid_str = (char *)tvb_get_string_enc(pinfo->pool, tvb, offset+6, sop_class_uid_len, ENC_ASCII);
1755 }
1758 }
1761 proto_tree_add_string(assoc_item_extneg_tree, hf_dcm_info_extneg_sopclassuid, tvb, offset+6, sop_class_uid_len, buf_desc);
1763 /* Count how many fields are following. */
1766 /*
1767 * The next field contains Service Class specific information identified by the SOP Class UID.
1768 */
1769 if (0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENT_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_FIND) ||
1770 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_STUDY_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_FIND) ||
1771 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENTSTUDY_ONLY_QUERYRETRIEVE_INFORMATION_MODEL_FIND_RETIRED) ||
1772 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENT_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_MOVE) ||
1773 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_STUDY_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_MOVE) ||
1774 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENTSTUDY_ONLY_QUERYRETRIEVE_INFORMATION_MODEL_MOVE_RETIRED) ||
1775 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENT_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_GET) ||
1776 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_STUDY_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_GET) ||
1777 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENTSTUDY_ONLY_QUERYRETRIEVE_INFORMATION_MODEL_GET_RETIRED))
1778 {
1780 {
1782 }
1784 /* Support for Relational queries. */
1785 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_info_extneg_relational_query, tvb, offset+6+sop_class_uid_len, 1, ENC_BIG_ENDIAN);
1787 }
1789 /* More sub-items are only allowed for the C-FIND SOP Classes. */
1790 if (0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENT_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_FIND) ||
1791 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_STUDY_ROOT_QUERYRETRIEVE_INFORMATION_MODEL_FIND) ||
1792 0 == strcmp(sopclassuid_str, DCM_UID_SOP_CLASS_PATIENTSTUDY_ONLY_QUERYRETRIEVE_INFORMATION_MODEL_FIND_RETIRED))
1793 {
1795 {
1797 }
1799 /* Combined Date-Time matching. */
1800 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_info_extneg_date_time_matching, tvb, offset+7+sop_class_uid_len, 1, ENC_BIG_ENDIAN);
1804 {
1806 }
1808 /* Fuzzy semantic matching of person names. */
1809 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_info_extneg_fuzzy_semantic_matching, tvb, offset+8+sop_class_uid_len, 1, ENC_BIG_ENDIAN);
1813 {
1815 }
1817 /* Timezone query adjustment. */
1818 proto_tree_add_item(assoc_item_extneg_tree, hf_dcm_info_extneg_timezone_query_adjustment, tvb, offset+9+sop_class_uid_len, 1, ENC_BIG_ENDIAN);
1820 }
1821 }
1823 /*
1824 Decode user identities in the association
1825 */
1826 static void
1827 dissect_dcm_assoc_user_identify(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset)
1828 {
1838 assoc_item_user_identify_item = proto_tree_add_item(tree, hf_dcm_info_user_identify, tvb, offset, item_len+4, ENC_NA);
1839 assoc_item_user_identify_tree = proto_item_add_subtree(assoc_item_user_identify_item, ett_assoc_info_user_identify);
1841 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_assoc_item_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1843 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_assoc_item_len, tvb, offset, 2, ENC_BIG_ENDIAN);
1847 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_info_user_identify_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1850 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_info_user_identify_response_requested, tvb, offset, 1, ENC_BIG_ENDIAN);
1854 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_info_user_identify_primary_field_length, tvb, offset, 2, ENC_BIG_ENDIAN);
1857 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_info_user_identify_primary_field, tvb, offset, primary_field_length, ENC_UTF_8);
1858 proto_item_append_text(assoc_item_user_identify_item, ": %s", tvb_get_string_enc(pinfo->pool, tvb, offset, primary_field_length, ENC_UTF_8|ENC_NA));
1863 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_info_user_identify_secondary_field_length, tvb, offset, 2, ENC_BIG_ENDIAN);
1866 proto_tree_add_item(assoc_item_user_identify_tree, hf_dcm_info_user_identify_secondary_field, tvb, offset, secondary_field_length, ENC_UTF_8);
1867 proto_item_append_text(assoc_item_user_identify_item, ", %s", tvb_get_string_enc(pinfo->pool, tvb, offset, secondary_field_length, ENC_UTF_8|ENC_NA));
1868 }
1869 }
1871 /*
1872 Decode unknown item types in the association
1873 */
1874 static void
1876 {
1885 assoc_item_unknown_item = proto_tree_add_item(tree, hf_dcm_info_unknown, tvb, offset, item_len+4, ENC_NA);
1886 assoc_item_unknown_tree = proto_item_add_subtree(assoc_item_unknown_item, ett_assoc_info_unknown);
1888 proto_tree_add_item(assoc_item_unknown_tree, hf_dcm_assoc_item_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1889 proto_tree_add_item(assoc_item_unknown_tree, hf_dcm_assoc_item_len, tvb, offset+2, 2, ENC_BIG_ENDIAN);
1892 proto_tree_add_item(assoc_item_unknown_tree, hf_dcm_assoc_item_data, tvb, offset, item_len, ENC_NA);
1893 }
1895 /*
1896 Decode the SCP/SCU Role Selection Sub-Item Fields in a association request or response.
1897 Lookup UIDs if requested
1898 */
1899 static void
1900 dissect_dcm_assoc_role_selection(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset)
1901 {
1916 assoc_item_rolesel_item = proto_tree_add_item(tree, hf_dcm_info_rolesel, tvb, offset, item_len+4, ENC_NA);
1918 assoc_item_rolesel_tree = proto_item_add_subtree(assoc_item_rolesel_item, ett_assoc_info_rolesel);
1920 proto_tree_add_item(assoc_item_rolesel_tree, hf_dcm_assoc_item_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1921 proto_tree_add_item(assoc_item_rolesel_tree, hf_dcm_assoc_item_len, tvb, offset+2, 2, ENC_BIG_ENDIAN);
1922 proto_tree_add_item(assoc_item_rolesel_tree, hf_dcm_info_rolesel_sopclassuid_len, tvb, offset+4, 2, ENC_BIG_ENDIAN);
1924 sopclassuid_str = (char *)tvb_get_string_enc(pinfo->pool, tvb, offset+6, sop_class_uid_len, ENC_ASCII);
1932 }
1935 }
1939 }
1942 }
1946 }
1949 }
1951 proto_tree_add_string(assoc_item_rolesel_tree, hf_dcm_info_rolesel_sopclassuid, tvb, offset+6, sop_class_uid_len, buf_desc);
1953 proto_tree_add_item(assoc_item_rolesel_tree, hf_dcm_info_rolesel_scurole, tvb, offset+6+sop_class_uid_len, 1, ENC_BIG_ENDIAN);
1954 proto_tree_add_item(assoc_item_rolesel_tree, hf_dcm_info_rolesel_scprole, tvb, offset+7+sop_class_uid_len, 1, ENC_BIG_ENDIAN);
1955 }
1957 /*
1958 Decode the Asynchronous operations (and sub-operations) Window Negotiation Sub-Item Fields in a association request or response.
1959 */
1960 static void
1962 {
1971 assoc_item_asyncneg_item = proto_tree_add_item(tree, hf_dcm_info_async_neg, tvb, offset, item_len+4, ENC_NA);
1973 assoc_item_asyncneg_tree = proto_item_add_subtree(assoc_item_asyncneg_item, ett_assoc_info_async_neg);
1975 proto_tree_add_item(assoc_item_asyncneg_tree, hf_dcm_assoc_item_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1976 proto_tree_add_item(assoc_item_asyncneg_tree, hf_dcm_assoc_item_len, tvb, offset+2, 2, ENC_BIG_ENDIAN);
1977 proto_tree_add_item(assoc_item_asyncneg_tree, hf_dcm_info_async_neg_max_num_ops_inv, tvb, offset+4, 2, ENC_BIG_ENDIAN);
1978 proto_tree_add_item(assoc_item_asyncneg_tree, hf_dcm_info_async_neg_max_num_ops_per, tvb, offset+6, 2, ENC_BIG_ENDIAN);
1983 proto_item_append_text(assoc_item_asyncneg_item, "%s%d", "Maximum Number Operations Invoked: ", max_num_ops_inv);
1984 if (max_num_ops_inv==0) proto_item_append_text(assoc_item_asyncneg_item, "%s", " (unlimited)");
1985 proto_item_append_text(assoc_item_asyncneg_item, ", %s%d", "Maximum Number Operations Performed: ", max_num_ops_per);
1986 if (max_num_ops_per==0) proto_item_append_text(assoc_item_asyncneg_item, "%s", " (unlimited)");
1987 }
1989 /*
1990 Decode a presentation context item in a Association Request or Response. In the response, set the accepted transfer syntax, if any.
1991 */
1992 static void
1996 {
2028 pctx_ptree = proto_tree_add_subtree(tree, tvb, offset-4, item_len+4, ett_assoc_pctx, &pctx_pitem, pitem_prefix);
2031 pctx_result = tvb_get_uint8(tvb, 2 + offset); /* only set in responses, otherwise reserved and 0x00 */
2033 /* Find or create DICOM context object */
2037 }
2039 proto_tree_add_uint(pctx_ptree, hf_dcm_assoc_item_type, tvb, offset-4, 1, item_type); /* The type is only one byte long */
2042 proto_tree_add_uint_format(pctx_ptree, hf_dcm_pctx_id, tvb, offset, 1, pctx_id, "Context ID: 0x%02x", pctx_id);
2045 /* Association response. */
2053 }
2057 }
2069 /* Parse Item. Works also in info mode where dcm_pctx_tree is NULL */
2072 &hf_dcm_assoc_item_type, &hf_dcm_assoc_item_len, &hf_dcm_pctx_abss_syntax, ett_assoc_pctx_abss);
2082 &hf_dcm_assoc_item_type, &hf_dcm_assoc_item_len, &hf_dcm_pctx_xfer_syntax, ett_assoc_pctx_xfer);
2084 /*
2085 In a correct Association Response, only one Transfer syntax shall be present.
2086 Therefore, pctx_xfer_uid, pctx_xfer_desc are used for the accept scenario in the info mode
2087 */
2090 /* Association Response, Context Accepted */
2092 }
2100 }
2101 }
2108 }
2112 }
2117 }
2122 }
2124 }
2130 }
2131 }
2134 /* Permanent copy information into structure */
2137 }
2139 /*
2140 Copy to buffer first, because proto_item_append_text()
2141 crashed for an unknown reason using 'ID 0x%02x, %s, %s'
2142 and in my opinion correctly set parameters.
2143 */
2148 }
2151 }
2152 }
2153 else
2154 {
2156 /* Accepted */
2161 }
2163 /* Rejected */
2167 }
2168 }
2171 }
2173 /*
2174 Decode the user info item in a Association Request or Response
2175 */
2176 static void
2177 dissect_dcm_userinfo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint32_t offset, uint32_t len, const char *pitem_prefix)
2178 {
2204 proto_tree_add_uint(userinfo_ptree, hf_dcm_assoc_item_type, tvb, offset-4, 1, item_type); /* The type is only one byte long */
2222 }
2231 /* Parse Item. Works also in info mode where dcm_pctx_tree is NULL */
2238 }
2249 &hf_dcm_assoc_item_type, &hf_dcm_assoc_item_len, &hf_dcm_info_version, ett_assoc_info_version);
2253 }
2294 }
2295 }
2296 }
2299 /*
2300 Create a subtree for association requests or responses
2301 */
2302 static uint32_t
2305 {
2327 }
2341 dissect_dcm_pctx(tvb, pinfo, assoc_tree, assoc, offset, item_len, "Presentation Context: ", true);
2346 dissect_dcm_pctx(tvb, pinfo, assoc_tree, assoc, offset, item_len, "Presentation Context: ", false);
2358 }
2359 }
2363 }
2365 static uint32_t
2368 {
2369 /* Dissect Context and Flags of a PDV and create new PDV structure */
2383 /* 1 Byte Context */
2392 }
2400 /* only create presentation context, if it does not yet exist */
2402 /* Create fake PCTX and guess Syntax ILE, ELE, EBE */
2405 /* To be done: Guess Syntax */
2407 }
2408 }
2411 /* Create PDV structure:
2413 Since we can have multiple PDV per packet (offset) and
2414 multiple merged packets per PDV (the tvb raw_offset)
2415 we need both values to uniquely identify a PDV
2416 */
2421 }
2423 /* 1 Byte Flag */
2424 /* PS3.8 E.2 Bits 2 through 7 are always set to 0 by the sender and never checked by the receiver. */
2434 else
2446 else
2458 else
2460 desc_header = wmem_strdup(wmem_file_scope(), "Command"); /* Will be overwritten with real command tag */
2471 else
2489 }
2495 }
2496 }
2499 /* Data PDV */
2503 /* Every Data PDV sequence should be preceded by a Command PDV,
2504 so we should always hit this for a correct capture
2505 */
2508 /* Should be done far more intelligent, e.g. does not catch the (Retired) ones */
2511 }
2514 }
2516 }
2518 /* Use previous command and append DATA*/
2520 }
2521 }
2524 }
2525 }
2534 }
2538 }
2540 /*
2541 Based on the value representation, decode the value of one tag.
2542 Support VM>1 for most types, but not all. Returns new offset
2543 */
2544 static uint32_t
2545 dissect_dcm_tag_value(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, dcm_state_pdv_t *pdv,
2548 {
2554 /* Make sure we have all the bytes of the item; this should throw
2555 and exception if vl_max is so large that it causes the offset
2556 to overflow. */
2559 /* ---------------------------------------------------------------------------
2560 Potentially long types. Obey vl_max
2561 ---------------------------------------------------------------------------
2562 */
2564 if ((strncmp(vr, "AE", 2) == 0) || (strncmp(vr, "AS", 2) == 0) || (strncmp(vr, "CS", 2) == 0) ||
2569 /*
2570 15 ways to represent a string.
2572 For LT, ST, UT the DICOM standard does not allow multi-value
2573 For the others, VM is built into 'automatically, because it uses '\' as separator
2574 */
2582 /* Last byte of string is 0x00, i.e. padded */
2584 }
2587 }
2590 /* The error comment */
2592 }
2595 /* This is a UID. Attempt a lookup. Will only return something for classes of course */
2600 }
2603 }
2604 }
2607 *tag_value = wmem_strdup_printf(pinfo->pool, "%s%s", ws_utf8_truncate(vals, 50), UTF8_HORIZONTAL_ELLIPSIS);
2608 }
2611 }
2612 }
2615 }
2619 /* Array of Bytes, Words, Float, or Doubles. Don't perform any decoding. VM=1. Multiple arrays are not possible */
2621 proto_tree_add_bytes_format_value(tree, hf_dcm_tag_value_byte, tvb, offset, vl_max, NULL, "%s", "(binary)");
2624 }
2627 /* Usually the case for private tags in implicit syntax, since tag was not found and VR not specified.
2628 Not been able to create UN yet. No need to support VM > 1.
2629 */
2635 /* String detector, i.e. check if we only have alpha-numeric character */
2643 /* TAB, LF, CR */
2644 }
2646 /* No extended ASCII, 0-9, A-Z, a-z */
2647 }
2649 /* Last Byte can be null*/
2651 }
2653 /* Here's the code */
2655 }
2656 }
2663 }
2665 proto_tree_add_bytes_format_value(tree, hf_dcm_tag_value_byte, tvb, offset, vl_max, NULL, "%s", "(binary)");
2668 }
2669 }
2670 /* ---------------------------------------------------------------------------
2671 Smaller types. vl/vl_max are not used. Fixed item length from 2 to 8 bytes
2672 ---------------------------------------------------------------------------
2673 */
2676 /* Attribute Tag e.g. (0022,8866). 2*2 Bytes, Can have VM > 1 */
2682 /* In on capture the reported length for this tag was 2 bytes. And since vl_max is unsigned long, -3 caused it to be 2^32-1
2683 So make it at least one loop so set it to at least 4.
2684 */
2694 proto_tree_add_uint_format_value(tree, hf_dcm_tag_value_32u, tvb, offset + i*vm_item_len, vm_item_len,
2699 i++;
2700 }
2702 }
2707 proto_tree_add_bytes_format_value(tree, hf_dcm_tag_value_byte, tvb, offset, 4, NULL, "%f", valf);
2710 }
2715 proto_tree_add_bytes_format_value(tree, hf_dcm_tag_value_byte, tvb, offset, 8, NULL, "%f", vald);
2718 }
2725 }
2732 }
2733 else if (strncmp(vr, "UL", 2) == 0) { /* Unsigned Long. Can be VM > 1, but not yet supported */
2739 }
2740 else if (strncmp(vr, "US", 2) == 0) { /* Unsigned Short. Can be VM > 1, but not yet supported */
2745 /* This is a command */
2748 }
2750 /* This is a status message. If value is not 0x0000, add an expert info */
2756 /* C-FIND also has a 0xFF01 as a valid response */
2758 }
2760 /* Neither success nor pending */
2762 }
2766 }
2769 }
2774 }
2777 }
2780 }
2783 }
2786 }
2789 }
2790 }
2797 }
2798 }
2799 /* Invalid VR, can only occur with Explicit syntax */
2805 }
2810 }
2812 /*
2813 Return true, if the required size does not fit at position 'offset'.
2814 */
2815 static bool
2816 dcm_tag_is_open(dcm_state_pdv_t *pdv, uint32_t startpos, uint32_t offset, uint32_t endpos, uint32_t size_required)
2817 {
2825 }
2828 }
2829 }
2833 {
2839 static dcm_tag_t const tag_private_grp_len = { 0x00000000, "Private Tag Group Length", "UL", "1", 0, 0 };
2842 /* Try a direct hit first before doing a masked search */
2843 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER(((uint32_t)grp << 16) | elm));
2847 /* No match found */
2850 }
2853 }
2856 }
2858 /* There are a few tags that require a mask to be found */
2859 else if (((grp & 0xFF00) == 0x5000) || ((grp & 0xFF00) == 0x6000) || ((grp & 0xFF00) == 0x7F00)) {
2860 /* Do a special for groups 0x50xx, 0x60xx and 0x7Fxx */
2861 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER((((uint32_t)grp & 0xFF00) << 16) | elm));
2862 }
2864 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER(((uint32_t)grp << 16) | (elm & 0xFF00)));
2865 }
2867 /* This map was done to 0x041x */
2868 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER(((uint32_t)grp << 16) | (elm & 0xFF0F) | 0x0010));
2869 }
2871 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER(((uint32_t)grp << 16) | (elm & 0xFF0F)));
2872 }
2874 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER(((uint32_t)grp << 16) | (elm & 0x000F)));
2875 }
2877 tag_def = (dcm_tag_t const *)wmem_map_lookup(dcm_tag_table, GUINT_TO_POINTER(((uint32_t)grp << 16) | (elm & 0x0000)));
2878 }
2881 /* Still no match found */
2883 }
2884 }
2887 }
2890 dcm_tag_summary(packet_info *pinfo, uint16_t grp, uint16_t elm, uint32_t vl, const char *tag_desc, const char *vr,
2892 {
2900 }
2903 }
2907 }
2910 }
2912 if (is_implicit) tag_sum = wmem_strdup_printf(pinfo->pool, "(%04x,%04x) %s %s", grp, elm, tag_vl, desc_mod);
2913 else tag_sum = wmem_strdup_printf(pinfo->pool, "(%04x,%04x) %s %s [%s]", grp, elm, tag_vl, desc_mod, vr);
2916 }
2918 /*
2919 Decode one tag. If it is a sequence or item start create a subtree. Returns new offset.
2920 http://dicom.nema.org/medical/dicom/current/output/chtml/part05/chapter_7.html
2921 */
2922 static uint32_t
2923 // NOLINTNEXTLINE(misc-no-recursion)
2928 {
2958 /* Decode the syntax a little more */
2966 *tag_description = NULL; /* Reset description. It's wmem packet scope memory, so not really bad*/
2973 }
2976 /* Since we may have a fragmented header, check for every attribute,
2977 whether we have already decoded left-overs from the previous PDV.
2978 Since we have implicit & explicit syntax, copying the open tag to
2979 a buffer without decoding, would have caused tvb_get_xxtohs()
2980 implementations on the copy.
2982 An alternative approach would have been to resemble the PDVs first.
2984 The attempts to reassemble without named sources (to be implemented)
2985 were very sensitive to missing packets. In such a case, no packet
2986 of a PDV chain was decoded, not even the start.
2988 So for the time being, use this rather cumbersome approach.
2990 For every two bytes (PDV length are always a factor of 2)
2991 check whether we have enough data in the buffer and store the value
2992 accordingly. In the next frame check, whether we have decoded this yet.
2993 */
2995 /* Group */
2999 }
3008 }
3010 /* Element */
3014 }
3023 }
3025 /* Find the best matching tag */
3028 /* Value Representation */
3031 /* Item start, Item Delimitation or Sequence Delimitation */
3034 }
3036 /* Get VR from tag definition */
3039 }
3045 }
3048 /* Controlled exit, if VR does not fit. */
3057 }
3059 if ((strcmp(vr, "OB") == 0) || (strcmp(vr, "OW") == 0) || (strcmp(vr, "OF") == 0) || (strcmp(vr, "OD") == 0) || (strcmp(vr, "OL") == 0) ||
3060 (strcmp(vr, "SQ") == 0) || (strcmp(vr, "UC") == 0) || (strcmp(vr, "UR") == 0) || (strcmp(vr, "UT") == 0) || (strcmp(vr, "UN") == 0)) {
3061 /* Part 5, Table 7.1-1 in the standard */
3062 /* Length is always 4 bytes: OB, OD, OF, OL, OW, SQ, UC, UR, UT or UN */
3066 /* Skip 2 Bytes */
3069 }
3074 }
3075 }
3078 }
3079 }
3082 /* Value Length. This is rather cumbersome code to get a 4 byte length, but in the
3083 fragmented case, we have 2*2 bytes. So always use that pattern
3084 */
3090 }
3098 }
3104 }
3112 }
3116 }
3119 }
3121 /* Now we have most of the information, except for sequences and items with undefined
3122 length :-/. But, whether we know the length or not, we now need to create the tree
3123 item and subtree, before we can loop into sequences and items
3125 Display the information we collected so far. Don't wait until the value is parsed,
3126 because that parsing might cause an exception. If that happens within a sequence,
3127 the sequence tag would not show up with the value
3129 Use different ett_ for Sequences & Items, so that fold/unfold state makes sense
3130 */
3132 tag_summary = dcm_tag_summary(pinfo, grp, elm, vl, tag_def->description, vr, tag_def->is_retired, is_implicit);
3138 }
3141 }
3144 /* 'Just' mark header as the length of the item */
3145 tag_ptree = proto_tree_add_subtree(tree, tvb, offset_tag, offset - offset_tag, ett, &tag_pitem, tag_summary);
3147 }
3149 /* Show real length of item */
3150 tag_ptree = proto_tree_add_subtree(tree, tvb, offset_tag, offset + vl - offset_tag, ett, &tag_pitem, tag_summary);
3152 }
3154 /* Value is longer than what we have in the PDV, -> we do have a OPEN tag */
3155 tag_ptree = proto_tree_add_subtree(tree, tvb, offset_tag, endpos - offset_tag, ett, &tag_pitem, tag_summary);
3157 }
3159 /* If you are going to touch the following 25 lines, make sure you reserve a few hours to go
3160 through both display options and check for proper tree display :-)
3161 */
3165 /* Use different ett_ for Sequences & Items, so that fold/unfold state makes sense */
3169 }
3170 }
3175 }
3176 }
3177 }
3179 /* For tags */
3182 }
3183 }
3185 /* ---------------------------------------------------------------
3186 Tag details as separate items
3187 ---------------------------------------------------------------
3188 */
3193 /* Add VR to tag detail, except for sequence items */
3196 /* Select header, since no VR is present in implicit syntax */
3198 }
3201 }
3202 }
3204 /* Add length to tag detail */
3208 /* ---------------------------------------------------------------
3209 Finally the Tag Value
3210 ---------------------------------------------------------------
3211 */
3213 /* Sequence or Item Start */
3219 const char *item_description = NULL; /* Will be allocated as wmem packet scope memory in dissect_dcm_tag() */
3222 /* Undefined length */
3225 while ((!local_end_of_seq_or_item) && (!pdv->open_tag.is_header_fragmented) && (offset < endpos)) {
3227 offset = dissect_dcm_tag(tvb, pinfo, seq_ptree, pdv, offset, endpos, false, &item_description, &local_end_of_seq_or_item);
3232 }
3233 }
3235 }
3237 /* Defined length */
3243 offset = dissect_dcm_tag(tvb, pinfo, seq_ptree, pdv, offset, endpos_item, false, &item_description, &local_end_of_seq_or_item);
3248 }
3249 }
3251 }
3254 /* Item delimitation for items with undefined length */
3256 }
3258 /* Sequence delimitation for sequences with undefined length */
3260 }
3262 /* No value for this tag */
3264 /* The following copy is needed. tag_value is post processed with g_strstrip()
3265 and that one will crash the whole application, when a constant is used.
3266 */
3269 }
3271 /* Tag is longer than the PDV/PDU. Don't perform any decoding */
3281 /* Save the needed data for reuse, and subsequent packets
3282 This will leak a little within the session.
3284 But since we may have tags being closed and reopen in the same PDV
3285 we will always need to store this
3286 */
3288 tag_desc = dcm_tag_summary(pinfo, grp, elm, vl, tag_def->description, vr, tag_def->is_retired, is_implicit);
3295 }
3296 }
3298 /* Regular value. Identify the type, decode and display */
3301 offset = dissect_dcm_tag_value(tvb, pinfo, tag_ptree, pdv, offset, grp, elm, vl, vl_max, vr, &tag_value);
3304 /* -------------------------------------------------------------
3305 We have decoded the value. Now store those tags of interest
3306 -------------------------------------------------------------
3307 */
3309 /* Store SOP Class and Instance UID in first PDV of this object */
3312 }
3314 dcm_state_pdv_get_obj_start(pdv)->sop_instance_uid = wmem_strdup(wmem_file_scope(), tag_value);
3315 }
3317 /* This is the command tag -> overwrite existing PDV description */
3319 }
3320 }
3323 /* -------------------------------------------------------------------
3324 Add the value to the already constructed item
3325 -------------------------------------------------------------------
3326 */
3332 }
3335 }
3337 /*
3338 'Decode' open tags from previous PDV. It mostly ends in 'continuation' or 'end' in the description.
3339 */
3340 static uint32_t
3343 {
3350 /* Not first PDV in the given presentation context (Those don't have remaining data to parse :-) */
3351 /* And previous PDV has left overs, i.e. this is a continuation PDV */
3354 /*
3355 Remaining bytes are equal or more than we expect for the open tag
3356 Finally reach the end of this tag. Don't touch the open_tag structure
3357 of this PDV, as we may see a new open tag at the end
3358 */
3361 }
3363 /*
3364 The tag is not yet complete, however, the flag indicates that it should be
3365 Therefore end this tag and issue an expert_add_info. Don't touch the
3366 open_tag structure of this PDV, as we may see a new open tag at the end
3367 */
3370 }
3372 /*
3373 * More to do for this tag
3374 */
3377 /* Set data in current PDV structure */
3379 /* No need to do it twice or more */
3386 }
3388 }
3397 }
3405 }
3409 }
3412 }
3414 /*
3415 Decode the tag section inside a PDV. This can be a single combined dataset
3416 or DICOM natively split PDVs. Therefore it needs to resume previously opened tags.
3417 For data PDVs, only process tags when tree is set or listening to export objects tap.
3418 For command PDVs, process all tags.
3419 On export copy the content to the export buffer.
3420 */
3421 static uint32_t
3431 {
3440 /* Performance optimization starts here. Don't put any COL_INFO related stuff in here */
3443 /* Eventually, we will have a syntax detector. Until then, don't decode */
3448 }
3453 /* Treat the left overs */
3456 /* Decode all tags, sequences and items in this PDV recursively */
3458 offset = dissect_dcm_tag(tvb, pinfo, tree, pdv, offset, endpos, is_first_tag, &tag_value, &dummy);
3460 }
3461 }
3462 }
3470 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s (%s, %s)", pdv->desc, pdv->status, pdv->comment);
3471 }
3474 }
3476 }
3478 /* Show command details in header */
3482 }
3485 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s ID=%d", pdv->desc, pdv->message_id_resp);
3488 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s C=%d", *pdv_description, pdv->no_completed);
3489 }
3491 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s R=%d", *pdv_description, pdv->no_remaining);
3492 }
3494 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s W=%d", *pdv_description, pdv->no_warning);
3495 }
3497 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s F=%d", *pdv_description, pdv->no_failed);
3498 }
3500 {
3502 }
3503 }
3504 }
3505 }
3510 /* Copy pure DICOM data to buffer, without PDV flags
3511 Packet scope for the memory allocation is too small, since we may have PDV in different tvb.
3512 Therefore check if this was already done.
3513 */
3517 }
3519 /* At the last segment, merge all related previous PDVs and copy to export buffer */
3521 }
3522 }
3525 }
3527 /*
3528 Handle one PDV inside a data PDU. When needed, perform the reassembly of PDV fragments.
3529 PDV fragments are different from TCP fragmentation.
3530 Create PDV object when needed.
3531 Return pdv_description to be used e.g. in COL_INFO.
3532 */
3533 static uint32_t
3536 {
3550 /* Dissect Context ID, Find PDV object, Decode Command/Data flag and More Fragments flag */
3554 {
3555 /* Combine the different PDVs. This is the default preference and useful in most scenarios.
3556 This will create one 'huge' PDV. E.g. a CT image will fits in one buffer.
3557 */
3560 /* Try to create somewhat unique ID.
3561 Include the conversation index, to separate TCP session
3562 Include bits from the reassembly number in the current Presentation
3563 Context (that we track ourselves) in order to distinguish between
3564 PDV fragments from the same frame but different reassemblies.
3565 */
3568 /* The following expression seems to executed late in VS2017 in 'RelWithDebInf'.
3569 Therefore it may appear as 0 at first
3570 */
3574 /* This one will chain the packets until 'is_last_fragment' */
3577 tvb,
3578 offset,
3579 pinfo,
3580 reassembly_id,
3581 NULL,
3582 pdv_body_len,
3586 /* Was not really fragmented, therefore use 'conventional' decoding.
3587 process_reassembled_data() does not cope with two PDVs in the same frame, therefore catch it here
3588 */
3590 offset = dissect_dcm_pdv_body(tvb, pinfo, tree, assoc, pdv, offset, pdv_body_len, pdv_description);
3591 }
3592 else
3593 {
3594 /* Will return a complete buffer, once last fragment is hit.
3595 The description is not used in packet-dcm. COL_INFO is set specifically in dissect_dcm_pdu()
3596 */
3598 tvb,
3599 offset,
3600 pinfo,
3602 head,
3604 NULL,
3605 tree);
3608 /* Just show this as a fragment */
3613 /* We know the presentation context already */
3614 *pdv_description = wmem_strdup_printf(pinfo->pool, "%s (reassembled in #%u)", pdv->desc, head->reassembled_in);
3615 }
3617 /* Decoding of the presentation context did not occur yet or did not succeed */
3618 *pdv_description = wmem_strdup_printf(pinfo->pool, "PDV Fragment (reassembled in #%u)", head->reassembled_in);
3619 }
3620 }
3622 /* We don't know the last fragment yet (and/or we'll never see it).
3623 This can happen, e.g. when TCP packet arrive our of order.
3624 */
3626 }
3629 }
3631 /* Decode reassembled data. This needs to be += */
3632 offset += dissect_dcm_pdv_body(combined_tvb, pinfo, tree, assoc, pdv, 0, tvb_captured_length(combined_tvb), pdv_description);
3633 }
3634 }
3635 }
3637 /* Do not reassemble DICOM PDVs, i.e. decode PDVs one by one.
3638 This may be useful when troubleshooting PDU length issues,
3639 or to better understand the PDV split.
3640 The tag level decoding is more challenging, as leftovers need
3641 to be displayed adequately. Not a big deal for binary values.
3642 */
3643 offset = dissect_dcm_pdv_body(tvb, pinfo, tree, assoc, pdv, offset, pdv_body_len, pdv_description);
3644 }
3647 }
3649 static uint32_t
3652 {
3654 /* 04 P-DATA-TF
3655 1 1 reserved
3656 2 4 length
3657 - (1+) presentation data value (PDV) items
3658 6 4 length
3659 10 1 Presentation Context ID (odd ints 1 - 255)
3660 - PDV
3661 11 1 header
3662 0x01 if set, contains Message Command info, else Message Data
3663 0x02 if set, contains last fragment
3664 */
3679 /* Loop through multiple PDVs */
3684 pdv_ptree = proto_tree_add_subtree(tree, tvb, offset, pdv_len+4, ett_dcm_data_pdv, &pdv_pitem, "PDV");
3692 }
3696 }
3700 }
3702 offset = dissect_dcm_pdv_fragmented(tvb, pinfo, pdv_ptree, assoc, offset, pdv_len, &pdv_description);
3704 /* The following doesn't seem to work anymore */
3708 }
3711 }
3712 }
3717 }
3722 }
3725 /*
3726 Test for DICOM traffic.
3728 - Minimum 10 Bytes
3729 - Look for the association request
3730 - Check PDU size vs TCP payload size
3732 Since used in heuristic mode, be picky for performance reasons.
3733 We are called in static mode, once we decoded the association request and called conversation_set_dissector()
3734 They we can be more liberal on the packet selection
3735 */
3736 static bool
3738 {
3744 /*
3745 Ensure that the tvb_captured_length is big enough before fetching the values.
3746 Otherwise it can trigger an exception during the heuristic check,
3747 preventing next heuristic dissectors from being called
3749 tvb_reported_length() is the real size of the packet as transmitted on the wire
3750 tvb_captured_length() is the number of bytes captured (so you always have captured <= reported).
3752 The 10 bytes represent an association request header including the 2 reserved bytes not used below
3753 In the captures at hand, the parsing result was equal.
3754 */
3758 }
3761 }
3767 /* Exit, if not an association request at version 1 */
3770 }
3772 /* Exit if TCP payload is bigger than PDU length (plus header)
3773 OK for PRESENTATION_DATA, questionable for ASSOCIATION requests
3774 */
3777 }
3780 }
3782 /*
3783 Main function to decode DICOM traffic. Supports reassembly of TCP packets.
3784 */
3785 static int
3787 {
3796 /*
3797 TCP packets are assembled well by wireshark in conjunction with the dissectors.
3799 Therefore, we will only see properly aligned PDUs, at the beginning of the buffer.
3800 So if the buffer does not start with the PDU header, it's not DICOM traffic.
3802 Do the byte checking as early as possible.
3803 The heuristic hook requires an association request
3805 DICOM PDU are nice, but need to be managed
3807 We can have any combination:
3808 - One or more DICOM PDU per TCP packet
3809 - PDU split over different TCP packets
3810 - And both together, i.e. some complete PDUs and then a fraction of a new PDU in a TCP packet
3812 This function will handle multiple PDUs per TCP packet and will ask for more data,
3813 if the last PDU does not fit
3815 It does not reassemble fragmented PDVs by purpose, since the Tag Value parsing needs to be done
3816 per Tag, and PDU recombination here would
3817 a) need to eliminate PDU/PDV/Ctx header (12 bytes)
3818 b) not show the true DICOM logic in transfer
3820 The length check is tricky. If not a PDV continuation, 10 Bytes are required. For PDV continuation
3821 anything seems to be possible, depending on the buffer alignment of the sending process.
3823 */
3828 if (pdu_type == 0 || pdu_type > 7) /* Wrong PDU type. 'Or' is slightly more efficient than 'and' */
3832 /* Port is defined explicitly, or association request was previously found successfully.
3833 Be more tolerant on minimum packet size. Also accept < 6
3834 */
3837 /* we need 6 bytes at least to get PDU length */
3841 }
3842 }
3845 /* Passing this point, we should always have tlen >= 6 */
3851 /* Mark it. This is a DICOM packet */
3855 /* Process all PDUs in the buffer */
3861 /* PDU is larger than the remaining packet (buffer), therefore request whole PDU
3862 The next time this function is called, tlen will be equal to pdu_len
3863 */
3868 }
3870 /* Process a whole PDU */
3873 /* Next PDU */
3877 expert_add_info_format(pinfo, NULL, &ei_dcm_invalid_pdu_length, "Invalid PDU length (%u)", pdu_len);
3879 }
3882 /* we got at least 6 bytes of the next PDU still in the buffer */
3884 }
3887 }
3888 }
3890 }
3892 /*
3893 Callback function used to register
3894 */
3895 static int
3897 {
3898 /* Less checking on ports that match */
3900 }
3902 /*
3903 Test for an Association Request. Decode, when successful.
3904 */
3905 static bool
3907 {
3909 /* This will be potentially called for every packet */
3914 /*
3915 Conversation_set_dissector() is called inside dcm_state_get() once
3916 we have enough details. From there on, we will be 'static'
3917 */
3920 /* there may have been another reason why it is not DICOM */
3922 }
3926 }
3928 /*
3929 Only set a valued with col_set_str() if it does not yet exist.
3930 (In a multiple PDV scenario, col_set_str() actually appends for the subsequent calls)
3931 */
3933 {
3937 {
3939 }
3940 }
3942 /*
3943 CSV add a value to a column, if it does not exist yet
3944 */
3946 {
3950 {
3952 }
3953 }
3955 /*
3956 Dissect a single DICOM PDU. Can be an association or a data package. Creates a tree item.
3957 */
3958 static uint32_t
3960 {
3972 /* Get or create conversation. Used to store context IDs and xfer Syntax */
3977 }
3982 /* PDU type is only one byte, then one byte reserved */
3991 /* Find previously detected association, else create a new one object*/
3996 }
4002 /* Everything that needs to be shown in any UI column (like COL_INFO)
4003 needs to be calculated also with tree == null
4004 */
4005 offset = dissect_dcm_pdu_data(tvb, pinfo, dcm_ptree, assoc, offset, pdu_len, &pdu_data_description);
4010 }
4011 }
4014 /* Decode Association request, response, reject, abort details */
4016 }
4019 }
4022 /*
4023 Register the protocol with Wireshark
4024 */
4025 void
4027 {
4066 FT_NONE, BASE_NONE, NULL, 0, "This field contains the ACSE User Information Item of the A-ASSOCIATErequest.", HFILL } },
4072 FT_NONE, BASE_NONE, NULL, 0, "This field contains the optional SOP Class Extended Negotiation Sub-Item of the ACSE User Information Item of the A-ASSOCIATE-RQ/RSP.", HFILL } },
4073 { &hf_dcm_info_extneg_sopclassuid_len, { "SOP Class UID Length", "dicom.userinfo.extneg.sopclassuid.len",
4074 FT_UINT16, BASE_DEC, NULL, 0, "This field contains the length of the SOP Class UID in the Extended Negotiation Sub-Item.", HFILL } },
4076 FT_STRING, BASE_NONE, NULL, 0, "This field contains the SOP Class UID in the Extended Negotiation Sub-Item.", HFILL } },
4077 { &hf_dcm_info_extneg_relational_query, { "Relational-queries", "dicom.userinfo.extneg.relational",
4078 FT_UINT8, BASE_HEX, NULL, 0, "This field indicates, if relational queries are supported.", HFILL } },
4079 { &hf_dcm_info_extneg_date_time_matching, { "Combined Date-Time matching", "dicom.userinfo.extneg.datetimematching",
4080 FT_UINT8, BASE_HEX, NULL, 0, "This field indicates, if combined date-time matching is supported.", HFILL } },
4081 { &hf_dcm_info_extneg_fuzzy_semantic_matching, { "Fuzzy semantic matching", "dicom.userinfo.extneg.fuzzymatching",
4082 FT_UINT8, BASE_HEX, NULL, 0, "This field indicates, if fuzzy semantic matching of person names is supported.", HFILL } },
4083 { &hf_dcm_info_extneg_timezone_query_adjustment, { "Timezone query adjustment", "dicom.userinfo.extneg.timezone",
4084 FT_UINT8, BASE_HEX, NULL, 0, "This field indicates, if timezone query adjustment is supported.", HFILL } },
4086 FT_NONE, BASE_NONE, NULL, 0, "This field contains the optional SCP/SCU Role Selection Sub-Item of the ACSE User Information Item of the A-ASSOCIATE-RQ/RSP.", HFILL } },
4087 { &hf_dcm_info_rolesel_sopclassuid_len, { "SOP Class UID Length", "dicom.userinfo.rolesel.sopclassuid.len",
4088 FT_UINT16, BASE_DEC, NULL, 0, "This field contains the length of the SOP Class UID in the SCP/SCU Role Selection Sub-Item.", HFILL } },
4090 FT_STRING, BASE_NONE, NULL, 0, "This field contains the SOP Class UID in the SCP/SCU Role Selection Sub-Item.", HFILL } },
4092 FT_UINT8, BASE_HEX, NULL, 0, "This field contains the SCU-role as defined for the Association-requester.", HFILL } },
4094 FT_UINT8, BASE_HEX, NULL, 0, "This field contains the SCP-role as defined for the Association-requester.", HFILL } },
4095 { &hf_dcm_info_async_neg, { "Asynchronous Operations (and sub-operations) Window Negotiation", "dicom.userinfo.asyncneg",
4096 FT_NONE, BASE_NONE, NULL, 0, "This field contains the optional Asynchronous Operations (and sub-operations) Window Negotiation Sub-Item of the ACSE User Information Item of the A-ASSOCIATE-RQ/RSP.", HFILL } },
4097 { &hf_dcm_info_async_neg_max_num_ops_inv, { "Maximum-number-operations-invoked", "dicom.userinfo.asyncneg.maxnumopsinv",
4098 FT_UINT16, BASE_DEC, NULL, 0, "This field contains the maximum-number-operations-invoked in the Asynchronous Operations (and sub-operations) Window Negotiation Sub-Item.", HFILL } },
4099 { &hf_dcm_info_async_neg_max_num_ops_per, { "Maximum-number-operations-performed", "dicom.userinfo.asyncneg.maxnumopsper",
4100 FT_UINT16, BASE_DEC, NULL, 0, "This field contains the maximum-number-operations-performed in the Asynchronous Operations (and sub-operations) Window Negotiation Sub-Item.", HFILL } },
4109 { &hf_dcm_info_user_identify_response_requested, { "Response Requested", "dicom.userinfo.user_identify.response_requested",
4111 { &hf_dcm_info_user_identify_primary_field_length, { "Primary Field Length", "dicom.userinfo.user_identify.primary_field_length",
4113 { &hf_dcm_info_user_identify_primary_field, { "Primary Field", "dicom.userinfo.user_identify.primary_field",
4115 { &hf_dcm_info_user_identify_secondary_field_length, { "Secondary Field Length", "dicom.userinfo.user_identify.secondary_field_length",
4117 { &hf_dcm_info_user_identify_secondary_field, { "Secondary Field", "dicom.userinfo.user_identify.secondary_field",
4150 /* Fragment entries */
4183 };
4185 /* Setup protocol subtree array */
4209 &ett_dcm_pdv_fragments
4210 };
4213 { &ei_dcm_assoc_rejected, { "dicom.assoc.reject", PI_RESPONSE_CODE, PI_WARN, "Association rejected", EXPFILL }},
4214 { &ei_dcm_assoc_aborted, { "dicom.assoc.abort", PI_RESPONSE_CODE, PI_WARN, "Association aborted", EXPFILL }},
4215 { &ei_dcm_no_abstract_syntax, { "dicom.no_abstract_syntax", PI_MALFORMED, PI_ERROR, "No Abstract Syntax provided for this Presentation Context", EXPFILL }},
4216 { &ei_dcm_multiple_abstract_syntax, { "dicom.multiple_abstract_syntax", PI_MALFORMED, PI_ERROR, "More than one Abstract Syntax provided for this Presentation Context", EXPFILL }},
4217 { &ei_dcm_no_transfer_syntax, { "dicom.no_transfer_syntax", PI_MALFORMED, PI_ERROR, "No Transfer Syntax provided for this Presentation Context", EXPFILL }},
4218 { &ei_dcm_no_abstract_syntax_uid, { "dicom.no_abstract_syntax_uid", PI_MALFORMED, PI_ERROR, "No Abstract Syntax UID found for this Presentation Context", EXPFILL }},
4219 { &ei_dcm_multiple_transfer_syntax, { "dicom.multiple_transfer_syntax", PI_MALFORMED, PI_ERROR, "Only one Transfer Syntax allowed in a Association Response", EXPFILL }},
4220 { &ei_dcm_assoc_item_len, { "dicom.assoc.item.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid Association Item Length", EXPFILL }},
4221 { &ei_dcm_pdv_ctx, { "dicom.pdv.ctx.invalid", PI_MALFORMED, PI_ERROR, "Invalid Presentation Context ID", EXPFILL }},
4222 { &ei_dcm_pdv_flags, { "dicom.pdv.flags.invalid", PI_MALFORMED, PI_ERROR, "Invalid Flags", EXPFILL }},
4223 { &ei_dcm_status_msg, { "dicom.status_msg", PI_RESPONSE_CODE, PI_WARN, "Status Message", EXPFILL }},
4224 { &ei_dcm_data_tag, { "dicom.data.tag.missing", PI_MALFORMED, PI_ERROR, "Early termination of tag. Data is missing", EXPFILL }},
4225 { &ei_dcm_pdv_len, { "dicom.pdv.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid PDV length", EXPFILL }},
4226 { &ei_dcm_invalid_pdu_length, { "dicom.pdu_length.invalid", PI_MALFORMED, PI_ERROR, "Invalid PDU length", EXPFILL }},
4227 };
4232 /* Register the protocol name and description */
4235 /* Required function calls to register the header fields and subtrees used */
4241 /* Allow other dissectors to find this one by name. */
4246 /* Used to migrate an older configuration file to a newer one */
4251 "Create DICOM File Meta Header according to PS 3.10 on export for PDUs. "
4252 "If the captured PDV does not contain a SOP Class UID and SOP Instance UID "
4258 "Do not show items below this size in the export list. "
4259 "Set it to 0, to see DICOM commands and responses in the list. "
4265 "Create a node for sequences and items, and show children in a hierarchy. "
4266 "De-select this option, if you prefer a flat display or e.g. "
4272 "Create a node for a tag and show tag details as single elements. "
4273 "This can be useful to debug a tag and to allow display filters on these attributes. "
4279 "Show message ID and number of completed, remaining, warned or failed operations in header and info column.",
4284 "Decode all DICOM tags in the last PDV. This will ensure the proper reassembly. "
4285 "De-select, to troubleshoot PDU length issues, or to understand PDV fragmentation. "
4293 /* Register processing of fragmented DICOM PDVs */
4296 }
4298 /*
4299 Register static TCP port range specified in preferences.
4300 Register heuristic search as well.
4302 Statically defined ports take precedence over a heuristic one. I.e., if a foreign protocol claims a port,
4303 where DICOM is running on, we would never be called, by just having the heuristic registration.
4305 This function is also called, when preferences change.
4306 */
4307 void
4309 {
4310 /* Adds a UI element to the preferences dialog. This is the static part. */
4313 /*
4314 The following shows up as child protocol of 'DICOM' in 'Enable/Disable Protocols ...'
4316 The registration procedure for dissectors is a two-stage procedure.
4318 In stage 1, dissectors create tables in which other dissectors can register them. That's the stage in which proto_register_ routines are called.
4319 In stage 2, dissectors register themselves in tables created in stage 1. That's the stage in which proto_reg_handoff_ routines are called.
4321 heur_dissector_add() needs to be called in proto_reg_handoff_dcm() function.
4322 */
4324 heur_dissector_add("tcp", dissect_dcm_heuristic, "DICOM on any TCP port (heuristic)", "dicom_tcp", proto_dcm, HEURISTIC_ENABLE);
4325 }
4328 /*
4330 PDU's
4331 01 ASSOC-RQ
4332 1 1 reserved
4333 2 4 length
4334 6 2 protocol version (0x0 0x1)
4335 8 2 reserved
4336 10 16 dest aetitle
4337 26 16 src aetitle
4338 42 32 reserved
4339 74 - presentation data value items
4341 02 A-ASSOC-AC
4342 1 reserved
4343 4 length
4344 2 protocol version (0x0 0x1)
4345 2 reserved
4346 16 dest aetitle (not checked)
4347 16 src aetitle (not checked)
4348 32 reserved
4349 - presentation data value items
4351 03 ASSOC-RJ
4352 1 reserved
4353 4 length (4)
4354 1 reserved
4355 1 result (1 reject perm, 2 reject transient)
4356 1 source (1 service user, 2 service provider, 3 service provider)
4357 1 reason
4358 1 == source
4359 1 no reason given
4360 2 application context name not supported
4361 3 calling aetitle not recognized
4362 7 called aetitle not recognized
4363 2 == source
4364 1 no reason given
4365 2 protocol version not supported
4366 3 == source
4367 1 temporary congestion
4368 2 local limit exceeded
4370 04 P-DATA
4371 1 1 reserved
4372 2 4 length
4373 - (1+) presentation data value (PDV) items
4374 6 4 length
4375 10 1 Presentation Context ID (odd ints 1 - 255)
4376 - PDV
4377 11 1 header
4378 0x01 if set, contains Message Command info, else Message Data
4379 0x02 if set, contains last fragment
4381 05 A-RELEASE-RQ
4382 1 reserved
4383 4 length (4)
4384 4 reserved
4386 06 A-RELEASE-RP
4387 1 reserved
4388 4 length (4)
4389 4 reserved
4391 07 A-ABORT
4392 1 reserved
4393 4 length (4)
4394 2 reserved
4395 1 source (0 = user, 1 = provider)
4396 1 reason if 1 == source (0 not spec, 1 unrecognized, 2 unexpected 4 unrecognized param, 5 unexpected param, 6 invalid param)
4400 ITEM's
4401 10 Application Context
4402 1 reserved
4403 2 length
4404 - name
4406 20 Presentation Context
4407 1 reserved
4408 2 length
4409 1 Presentation context id
4410 3 reserved
4411 - (1) abstract and (1+) transfer syntax sub-items
4413 21 Presentation Context (Reply)
4414 1 reserved
4415 2 length
4416 1 ID (odd int's 1-255)
4417 1 reserved
4418 1 result (0 accept, 1 user-reject, 2 no-reason, 3 abstract not supported, 4- transfer syntax not supported)
4419 1 reserved
4420 - (1) type 40
4422 30 Abstract syntax
4423 1 reserved
4424 2 length
4425 - name (<= 64)
4427 40 Transfer syntax
4428 1 reserved
4429 2 length
4430 - name (<= 64)
4432 50 user information
4433 1 reserved
4434 2 length
4435 - user data
4437 51 max length
4438 1 reserved
4439 2 length (4)
4440 4 max PDU lengths
4442 From 3.7 Annex D Association Negotiation
4443 ========================================
4445 52 IMPLEMENTATION CLASS UID
4446 1 Item-type 52H
4447 1 Reserved
4448 2 Item-length
4449 n Implementation-class-uid
4451 55 IMPLEMENTATION VERSION NAME
4452 1 Item-type 55H
4453 1 Reserved
4454 2 Item-length
4455 n Implementation-version-name
4457 53 ASYNCHRONOUS OPERATIONS WINDOW
4458 1 Item-type 53H
4459 1 Reserved
4460 2 Item-length
4461 2 Maximum-number-operations-invoked
4462 2 Maximum-number-operations-performed
4464 54 SCP/SCU ROLE SELECTION
4465 1 Item-type 54H
4466 1 Reserved
4467 2 Item-length (n)
4468 2 UID-length (m)
4469 m SOP-class-uid
4470 1 SCU-role
4471 0 - non support of the SCU role
4472 1 - support of the SCU role
4473 1 SCP-role
4474 0 - non support of the SCP role
4475 1 - support of the SCP role.
4477 56 SOP CLASS EXTENDED NEGOTIATION
4478 1 Item-type 56H
4479 1 Reserved
4480 2 Item-Length (n)
4481 2 SOP-class-uid-length (m)
4482 m SOP-class-uid
4483 n-m Service-class-application-information
4485 57 SOP CLASS COMMON EXTENDED NEGOTIATION
4486 1 Item-type 57H
4487 1 Sub-item-version
4488 2 Item-Length
4489 2 SOP-class-uid-length (m)
4490 7-x SOP-class-uid The SOP Class identifier encoded as a UID as defined in PS 3.5.
4491 (x+1)-(x+2) Service-class-uid-length The Service-class-uid-length shall be the number of bytes in the Service-class-uid field. It shall be encoded as an unsigned binary number.
4492 (x+3)-y Service-class-uid The Service Class identifier encoded as a UID as defined in PS 3.5.
4493 (y+1)-(y+2) Related-general-sop-class-identification-length The Related-general-sop-class-identification-length shall be the number of bytes in the Related-general-sop-class-identification field. Shall be zero if no Related General SOP Classes are identified.
4494 (y+3)-z Related-general-sop-class-identification The Related-general-sop-class-identification is a sequence of pairs of length and UID sub-fields. Each pair of sub-fields shall be formatted in accordance with Table D.3-13.
4495 (z+1)-k Reserved Reserved for additional fields of the sub-item. Shall be zero-length for Version 0 of Sub-item definition.
4497 Table D.3-13
4498 RELATED-GENERAL-SOP-CLASS-IDENTIFICATION SUB-FIELDS
4499 Bytes Sub-Field Name Description of Sub-Field
4500 1-2 Related-general-sop-class-uid-length The Related-general-sop-class-uid-length shall be the number of bytes in the Related-general-sop-class-uid sub-field. It shall be encoded as an unsigned binary number.
4501 3-n Related-general-sop-class-uid The Related General SOP Class identifier encoded as a UID as defined in PS 3.5.
4503 58 User Identity Negotiation
4504 1 Item-type 58H
4505 1 Reserved
4506 2 Item-length
4507 1 User-Identity-Type Field value shall be in the range 1 to 4 with the following meanings:
4508 1 - Username as a string in UTF-8
4509 2 - Username as a string in UTF-8 and passcode
4510 3 - Kerberos Service ticket
4511 4 - SAML Assertion
4512 Other values are reserved for future standardization.
4513 1 Positive-response-requested Field value:
4514 0 - no response requested
4515 1 - positive response requested
4516 2 Primary-field-length The User-Identity-Length shall contain the length of the User-Identity value.
4517 9-n Primary-field This field shall convey the user identity, either the username as a series of characters, or the Kerberos Service ticket encoded in accordance with RFC-1510.
4518 n+1-n+2 Secondary-field-length This field shall be non-zero only if User-Identity-Type has the value 2. It shall contain the length of the secondary-field.
4519 n+3-m Secondary-field This field shall be present only if User-Identity-Type has the value 2. It shall contain the Passcode value.
4521 59 User Identity Negotiation Reply
4522 1 Item-type 59H
4523 1 Reserved
4524 2 Item-length
4525 5-6 Server-response-length This field shall contain the number of bytes in the Server-response. May be zero.
4526 7-n Server-response This field shall contain the Kerberos Server ticket, encoded in accordance with RFC-1510, if the User-Identity-Type value in the A-ASSOCIATE-RQ was 3. This field shall contain the SAML response if the User-Identity-Type value in the A-ASSOCIATE-RQ was 4. This field shall be zero length if the value of the User-Identity-Type in the A-ASSOCIATE-RQ was 1 or 2.
4528 */
4530 /*
4531 * Editor modelines - https://www.wireshark.org/tools/modelines.html
4532 *
4533 * Local variables:
4534 * c-basic-offset: 4
4535 * tab-width: 8
4536 * indent-tabs-mode: nil
4537 * End:
4538 *
4539 * vi: set shiftwidth=4 tabstop=8 expandtab:
4540 * :indentSize=4:tabSize=8:noTabs=true:
4541 */