Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 33048: /trunk/ /trunk/epan/dissectors/: packet-ber.c pac

[Graeme Lunt <graeme@xxxxxxxxxxx>]

Jeff,.

Like the issue that the patch highlighted with Stig's presentation example, an IMPLICITly OCTET STRING looks similar to a EXPLICITly tagged ANY - until you start looking at the constructed bit.

The ansi_tcap dissector is decoding an OCTET STRING - when I don't think it needs to.

Attached is the fix I think you require to ansi_tcap - but it might break other things - I don't know much about the protocol. Certainly it makes your example capture file work and simplifies the conformance file. If it breaks other things, let me know and I'll go back to the drawing board.

Graeme

On 8 June 2010 15:20, Jeff Morriss <jeff.morriss.ws@gmail.com> wrote:

gal@xxxxxxxxxxxxx wrote:
> http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=33048
>
> User: gal
> Date: 2010/06/02 07:43 AM
>
> Log:
>  Bug 3597 - implicit octet string that is constructed causes PRES/FTAM dissect failure
>
>  Introduced some state to remember last dissected Tag/Length so that they can be recalled if an IMPLICIT tag is encountered and stripped. This allows its to be determined if the value has a constructed value - and so can be reassembled.
>
>  In this case, it is a IMPLICIT constructed OCTET STRING at the presentation layer.
>
>  Many thanks to Fred Gruman for identifying - and apologies for the delay in commiting.

This breaks the ANSI TCAP dissector.  It now complains "BER Error:
OctetString expected but class:CONTEXT(2) primitive tag:21 was
unexpected" and then the packet is marked as unreassembled.

I'm afraid I don't understand this stuff well enough to attempt a fix.
Can someone take a look?  A sample capture that shows the problem can be
found on the SampleCaptures page:

http://wiki.wireshark.org/SampleCaptures?action="">
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

Index: asn1/ansi_tcap/ansi_tcap.cnf
===================================================================
--- asn1/ansi_tcap/ansi_tcap.cnf	(revision 33367)
+++ asn1/ansi_tcap/ansi_tcap.cnf	(working copy)
@@ -18,18 +18,12 @@
 #.END
 
 #--- INVOKE ---
-#.FIELD_ATTR
-Invoke/parameter  TYPE = FT_BYTES  DISPLAY = BASE_NONE
 
 #.FN_BODY Invoke/parameter
-tvbuff_t	*parameter_tvb;
 
-  offset = dissect_ber_octet_string(TRUE, actx, tree, tvb, offset, hf_index,
-                                       &parameter_tvb);
-  if(!parameter_tvb)
-    return offset;
+  if(find_tcap_subdissector(tvb, actx, tree))
+    offset = tvb_length(tvb);
   
-  find_tcap_subdissector(parameter_tvb, actx, tree);
 
 #.FN_HDR Invoke
   ansi_tcap_private.d.pdu = 1;
@@ -37,38 +31,21 @@
 #--- RETURN RESULT ---
 
 #.FIELD_ATTR
-ReturnResult/parameter  TYPE = FT_BYTES  DISPLAY = BASE_NONE
 
 #.FN_BODY ReturnResult/parameter
-tvbuff_t	*parameter_tvb;
+  if(find_tcap_subdissector(tvb, actx, tree))
+    offset = tvb_length(tvb);
 
-
-  offset = dissect_ber_octet_string(TRUE, actx, tree, tvb, offset, hf_index,
-                                       &parameter_tvb);
-  if(!parameter_tvb)
-    return offset;
-  
-  find_tcap_subdissector(parameter_tvb, actx, tree);
-
 #.FN_HDR ReturnResult
   ansi_tcap_private.d.pdu = 2;
 
 
 #--- RETURN ERROR ---
 
-#.FIELD_ATTR
-ReturnError/parameter  TYPE = FT_BYTES  DISPLAY = BASE_NONE
-
 #.FN_BODY ReturnError/parameter
-tvbuff_t	*parameter_tvb;
+  if(find_tcap_subdissector(tvb, actx, tree))
+    offset = tvb_length(tvb);
 
-  offset = dissect_ber_octet_string(TRUE, actx, tree, tvb, offset, hf_index,
-                                       &parameter_tvb);
-  if(!parameter_tvb)
-    return offset;
-  
-  find_tcap_subdissector(parameter_tvb, actx, tree);
-
 #.FN_HDR ReturnError
   ansi_tcap_private.d.pdu = 3;