2 * Routines for LAPDm frame disassembly
3 * Duncan Salerno <duncan.salerno@googlemail.com>
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
9 * SPDX-License-Identifier: GPL-2.0-or-later
14 * Mobile Station - Base Stations System (MS - BSS) Interface Data Link (DL) Layer Specification
15 * Base Station Controller - Base Transceiver Station (BSC - BTS) interface; Layer 2 specification
16 * http://www.3gpp.org/ftp/Specs/html-info/44006.htm
18 * From 3GPP TS 44.006:
20 * LAPDm is used for information sent on the control channels BCCH, AGCH, NCH,
21 * PCH, FACCH, SACCH and SDCCH as defined in 3GPP TS 44.003.
23 * AGCH, NCH and PCH are sometimes referred to by the collective name CCCH.
24 * FACCH, SACCH and SDCCH are, similarly, referred to by the collective name DCCH.
26 * Format A is used on DCCHs for frames where there is no information field.
27 * Formats B, Bter and B4 are used on DCCHs for frames containing an information field:
28 * Format Bter is used on request of higher layers if and only if short L2 header type 1 is
29 * supported and a UI command is to be transmitted on SAPI 0;
30 * Format B4 is used for UI frames transmitted by the network on SACCH;
31 * Format B is applied in all other cases.
32 * Format Bbis is used only on BCCH, PCH, NCH, and AGCH.
33 * In addition there is a Format C for transmission of random access signals.
35 * This module currently supports A, B, B4
36 * In the future will support Bter
37 * Bbis and C should be supported elsewhere
41 #include "packet-lapdm.h"
43 #include <epan/packet.h>
44 #include <epan/prefs.h>
45 #include <epan/xdlc.h>
46 #include <epan/reassemble.h>
47 #include <epan/conversation.h>
49 void proto_register_lapdm(void);
51 static dissector_handle_t b4_info_handle
;
53 static int proto_lapdm
;
54 static int hf_lapdm_address
;
55 static int hf_lapdm_ea
;
56 static int hf_lapdm_cr
;
57 static int hf_lapdm_sapi
;
58 static int hf_lapdm_lpd
;
60 static int hf_lapdm_control
;
61 static int hf_lapdm_n_r
;
62 static int hf_lapdm_n_s
;
63 static int hf_lapdm_p
;
64 static int hf_lapdm_f
;
65 static int hf_lapdm_s_ftype
;
66 static int hf_lapdm_u_modifier_cmd
;
67 static int hf_lapdm_u_modifier_resp
;
68 static int hf_lapdm_ftype_i
;
69 static int hf_lapdm_ftype_s_u
;
71 static int hf_lapdm_length
;
72 static int hf_lapdm_el
;
73 static int hf_lapdm_m
;
74 static int hf_lapdm_len
;
77 * LAPDm fragment handling
79 static int hf_lapdm_fragment_data
;
80 static int hf_lapdm_fragments
;
81 static int hf_lapdm_fragment
;
82 static int hf_lapdm_fragment_overlap
;
83 static int hf_lapdm_fragment_overlap_conflicts
;
84 static int hf_lapdm_fragment_multiple_tails
;
85 static int hf_lapdm_fragment_too_long_fragment
;
86 static int hf_lapdm_fragment_error
;
87 static int hf_lapdm_fragment_count
;
88 static int hf_lapdm_reassembled_in
;
89 static int hf_lapdm_reassembled_length
;
92 static int ett_lapdm_address
;
93 static int ett_lapdm_control
;
94 static int ett_lapdm_length
;
95 static int ett_lapdm_fragment
;
96 static int ett_lapdm_fragments
;
98 static reassembly_table lapdm_reassembly_table
;
100 static wmem_map_t
*lapdm_last_n_s_map
;
102 static dissector_table_t lapdm_sapi_dissector_table
;
104 static bool reassemble_lapdm
= true;
107 * Bits in the address field.
109 #define LAPDM_SAPI 0x1c /* Service Access Point Identifier */
110 #define LAPDM_SAPI_SHIFT 2
111 #define LAPDM_CR 0x02 /* Command/Response bit */
112 #define LAPDM_EA 0x01 /* First Address Extension bit */
113 #define LAPDM_LPD 0x60 /* Link Protocol Discriminator */
116 * Bits in the length field.
118 #define LAPDM_EL 0x01 /* Extended Length = 1 */
119 #define LAPDM_M 0x02 /* More fragments */
120 #define LAPDM_M_SHIFT 1
121 #define LAPDM_LEN 0xfc /* Length */
122 #define LAPDM_LEN_SHIFT 2
124 #define LAPDM_HEADER_LEN 3
125 #define LAPDM_HEADER_LEN_B4 2
127 #define LAPDM_SAPI_RR_CC_MM 0
128 #define LAPDM_SAPI_SMS 3
130 /* Used only for U frames */
131 static const xdlc_cf_items lapdm_cf_items
= {
137 &hf_lapdm_u_modifier_cmd
,
138 &hf_lapdm_u_modifier_resp
,
143 static const value_string lapdm_ea_vals
[] = {
144 { 0, "More octets" },
145 { 1, "Final octet" },
149 static const value_string lapdm_sapi_vals
[] = {
150 { LAPDM_SAPI_RR_CC_MM
, "RR/MM/CC" },
151 { LAPDM_SAPI_SMS
, "SMS/SS" },
155 static const value_string lapdm_lpd_vals
[] = {
157 { 1, "Cell broadcast service" },
161 static const value_string lapdm_m_vals
[] = {
162 { 0, "Last segment" },
163 { 1, "More segments" },
167 static const value_string lapdm_el_vals
[] = {
168 { 0, "More octets" },
169 { 1, "Final octet" },
174 static const fragment_items lapdm_frag_items
= {
175 /* Fragment subtrees */
177 &ett_lapdm_fragments
,
178 /* Fragment fields */
181 &hf_lapdm_fragment_overlap
,
182 &hf_lapdm_fragment_overlap_conflicts
,
183 &hf_lapdm_fragment_multiple_tails
,
184 &hf_lapdm_fragment_too_long_fragment
,
185 &hf_lapdm_fragment_error
,
186 &hf_lapdm_fragment_count
,
187 /* Reassembled in field */
188 &hf_lapdm_reassembled_in
,
189 /* Reassembled length field */
190 &hf_lapdm_reassembled_length
,
191 /* Reassembled data field */
197 static bool hdr_has_length(enum lapdm_hdr_type hdr_type
)
200 case LAPDM_HDR_FMT_A
:
201 case LAPDM_HDR_FMT_B
:
210 dissect_lapdm(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void* data
)
212 proto_tree
*lapdm_tree
, *addr_tree
, *length_tree
;
213 proto_item
*lapdm_ti
, *addr_ti
, *length_ti
;
214 uint8_t addr
, length
, header_len
, cr
, sapi
, len
, n_s
;
218 int available_length
;
219 bool is_response
= false;
220 enum lapdm_hdr_type hdr_type
= LAPDM_HDR_FMT_B
;
221 bool is_acch
= false, is_ui_frame
= false;
224 lapdm_data_t
*ld
= (lapdm_data_t
*) data
;
225 is_acch
= ld
->is_acch
;
228 /* Check that there's enough data */
229 if (tvb_captured_length(tvb
) < LAPDM_HEADER_LEN_B4
)
232 control
= tvb_get_uint8(tvb
, 1);
233 is_ui_frame
= (control
& XDLC_S_U_MASK
) == XDLC_U
&& (control
& XDLC_U_MODIFIER_MASK
) == XDLC_UI
;
235 /* only downlink UI SACCH frames use B4 header format */
236 if (is_acch
&& is_ui_frame
&& pinfo
->p2p_dir
== P2P_DIR_RECV
) {
237 hdr_type
= LAPDM_HDR_FMT_B4
;
238 header_len
= LAPDM_HEADER_LEN_B4
;
241 header_len
= LAPDM_HEADER_LEN
;
243 /* Check that there's enough data */
244 if (tvb_captured_length(tvb
) < header_len
)
247 length
= tvb_get_uint8(tvb
, 2);
250 col_set_str(pinfo
->cinfo
, COL_PROTOCOL
, "LAPDm");
252 addr
= tvb_get_uint8(tvb
, 0);
254 cr
= addr
& LAPDM_CR
;
255 if (pinfo
->p2p_dir
== P2P_DIR_RECV
) {
256 is_response
= cr
? false : true;
258 else if (pinfo
->p2p_dir
== P2P_DIR_SENT
) {
259 is_response
= cr
? true : false;
263 lapdm_ti
= proto_tree_add_item(tree
, proto_lapdm
, tvb
, 0, header_len
, ENC_NA
);
264 lapdm_tree
= proto_item_add_subtree(lapdm_ti
, ett_lapdm
);
266 addr_ti
= proto_tree_add_uint(lapdm_tree
, hf_lapdm_address
, tvb
, 0, 1, addr
);
267 addr_tree
= proto_item_add_subtree(addr_ti
, ett_lapdm_address
);
269 proto_tree_add_uint(addr_tree
, hf_lapdm_lpd
, tvb
, 0, 1, addr
);
270 proto_tree_add_uint(addr_tree
, hf_lapdm_sapi
, tvb
, 0, 1, addr
);
271 proto_tree_add_uint(addr_tree
, hf_lapdm_cr
, tvb
, 0, 1, addr
);
272 proto_tree_add_uint(addr_tree
, hf_lapdm_ea
, tvb
, 0, 1, addr
);
279 control
= dissect_xdlc_control(tvb
, 1, pinfo
, lapdm_tree
, hf_lapdm_control
,
280 ett_lapdm_control
, &lapdm_cf_items
, NULL
/* LAPDm doesn't support extended */, NULL
, NULL
,
281 is_response
, false, false);
283 /* dissect length field (if present) */
284 if (tree
&& hdr_has_length(hdr_type
)) {
285 length_ti
= proto_tree_add_uint(lapdm_tree
, hf_lapdm_length
, tvb
,
287 length_tree
= proto_item_add_subtree(length_ti
, ett_lapdm_length
);
289 proto_tree_add_uint(length_tree
, hf_lapdm_len
, tvb
, 2, 1, length
);
290 proto_tree_add_uint(length_tree
, hf_lapdm_m
, tvb
, 2, 1, length
);
291 proto_tree_add_uint(length_tree
, hf_lapdm_el
, tvb
, 2, 1, length
);
294 if (hdr_has_length(hdr_type
)) {
295 len
= (length
& LAPDM_LEN
) >> LAPDM_LEN_SHIFT
;
296 m
= (length
& LAPDM_M
) >> LAPDM_M_SHIFT
;
298 len
= tvb_captured_length(tvb
) - header_len
;
302 sapi
= (addr
& LAPDM_SAPI
) >> LAPDM_SAPI_SHIFT
;
303 n_s
= (control
& XDLC_N_S_MASK
) >> XDLC_N_S_SHIFT
;
304 available_length
= tvb_captured_length(tvb
) - header_len
;
306 /* No point in doing anything if no payload
308 if( !MIN(len
, available_length
) )
311 payload
= tvb_new_subset_length_caplen(tvb
, header_len
, MIN(len
,available_length
), len
);
313 /* Potentially segmented I frame
315 if( (control
& XDLC_I_MASK
) == XDLC_I
&& reassemble_lapdm
&& !pinfo
->flags
.in_error_pkt
)
317 fragment_head
*fd_m
= NULL
;
318 tvbuff_t
*reassembled
= NULL
;
319 uint32_t fragment_id
;
320 bool save_fragmented
= pinfo
->fragmented
, add_frag
;
322 pinfo
->fragmented
= m
;
324 /* Rely on caller to provide a way to group fragments */
325 fragment_id
= (conversation_get_id_from_elements(pinfo
, CONVERSATION_GSMTAP
, USE_LAST_ENDPOINT
) << 4) | (sapi
<< 1) | pinfo
->p2p_dir
;
327 if (!PINFO_FD_VISITED(pinfo
)) {
328 /* Check if new N(S) is equal to previous N(S) (to avoid adding retransmissions in reassembly table)
329 As GUINT_TO_POINTER macro does not allow to differentiate NULL from 0, use 1-8 range instead of 0-7 */
330 unsigned *p_last_n_s
= (unsigned*)wmem_map_lookup(lapdm_last_n_s_map
, GUINT_TO_POINTER(fragment_id
));
331 if (GPOINTER_TO_UINT(p_last_n_s
) == (unsigned)(n_s
+1)) {
335 wmem_map_insert(lapdm_last_n_s_map
, GUINT_TO_POINTER(fragment_id
), GUINT_TO_POINTER(n_s
+1));
342 /* This doesn't seem the best way of doing it as doesn't
343 take N(S) into account, but N(S) isn't always 0 for
346 fd_m
= fragment_add_seq_next (&lapdm_reassembly_table
, payload
, 0,
348 fragment_id
, /* uint32_t ID for fragments belonging together */
350 /*n_s uint32_t fragment sequence number */
351 len
, /* uint32_t fragment length */
352 m
); /* More fragments? */
354 reassembled
= process_reassembled_data(payload
, 0, pinfo
,
355 "Reassembled LAPDm", fd_m
, &lapdm_frag_items
,
358 /* Reassembled into this packet
360 if (fd_m
&& pinfo
->num
== fd_m
->reassembled_in
) {
361 if (!dissector_try_uint(lapdm_sapi_dissector_table
, sapi
,
362 reassembled
, pinfo
, tree
))
363 call_data_dissector(reassembled
, pinfo
, tree
);
365 if (!PINFO_FD_VISITED(pinfo
)) {
366 /* If reassembling is done, allow fragment_id reuse */
367 wmem_map_remove(lapdm_last_n_s_map
, GUINT_TO_POINTER(fragment_id
));
371 col_append_str(pinfo
->cinfo
, COL_INFO
, " (Fragment)");
372 proto_tree_add_item(lapdm_tree
, hf_lapdm_fragment_data
, payload
, 0, -1, ENC_NA
);
376 /* Now reset fragmentation information in pinfo
378 pinfo
->fragmented
= save_fragmented
;
380 else if (hdr_type
== LAPDM_HDR_FMT_B4
)
382 /* B4 frames have no length octet at L2 level, but instead a L2 pseudo length octet
383 * at L3. We must call the proper dissector for decoding them */
384 call_dissector(b4_info_handle
, payload
, pinfo
, tree
);
388 if (!PINFO_FD_VISITED(pinfo
) && ((control
& XDLC_S_U_MASK
) == XDLC_U
) && ((control
& XDLC_U_MODIFIER_MASK
) == XDLC_SABM
)) {
389 /* SABM frame; reset the last N(S) to an invalid value */
390 uint32_t fragment_id
= (conversation_get_id_from_elements(pinfo
, CONVERSATION_GSMTAP
, USE_LAST_ENDPOINT
) << 4) | (sapi
<< 1) | pinfo
->p2p_dir
;
391 wmem_map_insert(lapdm_last_n_s_map
, GUINT_TO_POINTER(fragment_id
), GUINT_TO_POINTER(0));
395 If we have some data, try and dissect it (only happens for UI, SABM, UA or I frames)
397 if (!dissector_try_uint(lapdm_sapi_dissector_table
, sapi
,
398 payload
, pinfo
, tree
))
399 call_data_dissector(payload
, pinfo
, tree
);
401 return tvb_captured_length(tvb
);
405 proto_register_lapdm(void)
407 static hf_register_info hf
[] = {
410 { "Address Field", "lapdm.address_field", FT_UINT8
, BASE_HEX
, NULL
, 0x0,
414 { "EA", "lapdm.ea", FT_UINT8
, BASE_DEC
, VALS(lapdm_ea_vals
), LAPDM_EA
,
415 "Address field extension bit", HFILL
}},
418 { "C/R", "lapdm.cr", FT_UINT8
, BASE_DEC
, NULL
, LAPDM_CR
,
419 "Command/response field bit", HFILL
}},
422 { "LPD", "lapdm.lpd", FT_UINT8
, BASE_DEC
, VALS(lapdm_lpd_vals
), LAPDM_LPD
,
423 "Link Protocol Discriminator", HFILL
}},
426 { "SAPI", "lapdm.sapi", FT_UINT8
, BASE_DEC
, VALS(lapdm_sapi_vals
), LAPDM_SAPI
,
427 "Service access point identifier", HFILL
}},
430 { "Control Field", "lapdm.control_field", FT_UINT8
, BASE_HEX
, NULL
, 0x0,
434 { "N(R)", "lapdm.control.n_r", FT_UINT8
, BASE_DEC
,
435 NULL
, XDLC_N_R_MASK
, NULL
, HFILL
}},
438 { "N(S)", "lapdm.control.n_s", FT_UINT8
, BASE_DEC
,
439 NULL
, XDLC_N_S_MASK
, NULL
, HFILL
}},
442 { "Poll", "lapdm.control.p", FT_BOOLEAN
, 8,
443 NULL
, XDLC_P_F
, NULL
, HFILL
}},
446 { "Final", "lapdm.control.f", FT_BOOLEAN
, 8,
447 NULL
, XDLC_P_F
, NULL
, HFILL
}},
450 { "Supervisory frame type", "lapdm.control.s_ftype", FT_UINT8
, BASE_HEX
,
451 VALS(stype_vals
), XDLC_S_FTYPE_MASK
, NULL
, HFILL
}},
453 { &hf_lapdm_u_modifier_cmd
,
454 { "Command", "lapdm.control.u_modifier_cmd", FT_UINT8
, BASE_HEX
,
455 VALS(modifier_vals_cmd
), XDLC_U_MODIFIER_MASK
, NULL
, HFILL
}},
457 { &hf_lapdm_u_modifier_resp
,
458 { "Response", "lapdm.control.u_modifier_resp", FT_UINT8
, BASE_HEX
,
459 VALS(modifier_vals_resp
), XDLC_U_MODIFIER_MASK
, NULL
, HFILL
}},
462 { "Frame type", "lapdm.control.ftype", FT_UINT8
, BASE_HEX
,
463 VALS(ftype_vals
), XDLC_I_MASK
, NULL
, HFILL
}},
465 { &hf_lapdm_ftype_s_u
,
466 { "Frame type", "lapdm.control.ftype", FT_UINT8
, BASE_HEX
,
467 VALS(ftype_vals
), XDLC_S_U_MASK
, NULL
, HFILL
}},
470 { "Length Field", "lapdm.length_field", FT_UINT8
, BASE_HEX
,
471 NULL
, 0x0, NULL
, HFILL
}},
474 { "EL", "lapdm.el", FT_UINT8
, BASE_DEC
,
475 VALS(lapdm_el_vals
), LAPDM_EL
, "Length indicator field extension bit", HFILL
}},
478 { "M", "lapdm.m", FT_UINT8
, BASE_DEC
,
479 VALS(lapdm_m_vals
), LAPDM_M
, "More data bit", HFILL
}},
482 { "Length", "lapdm.length", FT_UINT8
, BASE_DEC
,
483 NULL
, LAPDM_LEN
, "Length indicator", HFILL
}},
485 /* Fragment reassembly
487 { &hf_lapdm_fragment_data
,
488 { "Fragment Data", "lapdm.fragment_data", FT_NONE
, BASE_NONE
,
489 NULL
, 0x00, NULL
, HFILL
}},
491 { &hf_lapdm_fragments
,
492 { "Message fragments", "lapdm.fragments", FT_NONE
, BASE_NONE
,
493 NULL
, 0x00, "LAPDm Message fragments", HFILL
}},
495 { &hf_lapdm_fragment
,
496 { "Message fragment", "lapdm.fragment", FT_FRAMENUM
, BASE_NONE
,
497 NULL
, 0x00, "LAPDm Message fragment", HFILL
}},
499 { &hf_lapdm_fragment_overlap
,
500 { "Message fragment overlap", "lapdm.fragment.overlap", FT_BOOLEAN
, BASE_NONE
,
501 NULL
, 0x0, "LAPDm Message fragment overlaps with other fragment(s)", HFILL
}},
503 { &hf_lapdm_fragment_overlap_conflicts
,
504 { "Message fragment overlapping with conflicting data", "lapdm.fragment.overlap.conflicts", FT_BOOLEAN
, BASE_NONE
,
505 NULL
, 0x0, "LAPDm Message fragment overlaps with conflicting data", HFILL
}},
507 { &hf_lapdm_fragment_multiple_tails
,
508 { "Message has multiple tail fragments", "lapdm.fragment.multiple_tails", FT_BOOLEAN
, BASE_NONE
,
509 NULL
, 0x0, "LAPDm Message fragment has multiple tail fragments", HFILL
}},
511 { &hf_lapdm_fragment_too_long_fragment
,
512 { "Message fragment too long", "lapdm.fragment.too_long_fragment", FT_BOOLEAN
, BASE_NONE
,
513 NULL
, 0x0, "LAPDm Message fragment data goes beyond the packet end", HFILL
}},
515 { &hf_lapdm_fragment_error
,
516 { "Message defragmentation error", "lapdm.fragment.error", FT_FRAMENUM
, BASE_NONE
,
517 NULL
, 0x00, "LAPDm Message defragmentation error due to illegal fragments", HFILL
}},
519 { &hf_lapdm_fragment_count
,
520 { "Message fragment count", "lapdm.fragment.count", FT_UINT32
, BASE_DEC
,
521 NULL
, 0x00, NULL
, HFILL
}},
523 { &hf_lapdm_reassembled_in
,
524 { "Reassembled in", "lapdm.reassembled.in", FT_FRAMENUM
, BASE_NONE
,
525 NULL
, 0x00, "LAPDm Message has been reassembled in this packet.", HFILL
}},
527 { &hf_lapdm_reassembled_length
,
528 { "Reassembled LAPDm length", "lapdm.reassembled.length", FT_UINT32
, BASE_DEC
,
529 NULL
, 0x00, "The total length of the reassembled payload", HFILL
}}
532 static int *ett
[] = {
541 module_t
*lapdm_module
;
543 proto_lapdm
= proto_register_protocol("Link Access Procedure, Channel Dm (LAPDm)", "LAPDm", "lapdm");
544 proto_register_field_array (proto_lapdm
, hf
, array_length(hf
));
545 proto_register_subtree_array(ett
, array_length(ett
));
547 register_dissector("lapdm", dissect_lapdm
, proto_lapdm
);
549 lapdm_sapi_dissector_table
= register_dissector_table("lapdm.sapi", "LAPDm SAPI", proto_lapdm
, FT_UINT8
, BASE_DEC
);
551 lapdm_module
= prefs_register_protocol(proto_lapdm
, NULL
);
552 prefs_register_bool_preference(lapdm_module
, "reassemble",
553 "Reassemble fragmented LAPDm packets",
554 "Whether the dissector should defragment LAPDm messages spanning multiple packets.",
557 lapdm_last_n_s_map
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), g_direct_hash
, g_direct_equal
);
559 reassembly_table_register(&lapdm_reassembly_table
,
560 &addresses_reassembly_table_functions
);
562 /* B4 frames have no length octet at L2 level, but instead a L2 pseudo length octet
563 * at L3. We must call the proper dissector for decoding them, and gsm_a_ccch supports
564 * L2 pseudo length */
565 b4_info_handle
= find_dissector_add_dependency("gsm_a_ccch", proto_lapdm
);
569 * Editor modelines - https://www.wireshark.org/tools/modelines.html
574 * indent-tabs-mode: nil
577 * vi: set shiftwidth=4 tabstop=8 expandtab:
578 * :indentSize=4:tabSize=8:noTabs=true: