osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

ZigBee: decode ZBOSS traffic dump and Interpan frames as ZigBee. 

If decoded ZBOSS traffic dump, sure this is ZigBee, so bypass heuristic.
If decoding air sniffer dump, try to go thru heuristic by checking for ext address src mode required for interpan.

Change-Id: Iddf799400a4cf0fd73714f06b99e3d11c8cb2e60
Reviewed-on: https://code.wireshark.org/review/15921
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
dsrsupport 2016-06-15 19:45:50 +03:00 committed by Anders Broman
parent 561a063fee
commit 1b0d51ffdf
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
epan/dissectors/packet-ieee802154.c
View File

@ -88,6 +88,7 @@ void proto_reg_handoff_ieee802154(void);
/* Dissection Options for dissect_ieee802154_common */
#define DISSECT_IEEE802154_OPTION_CC24xx 0x00000001 /* FCS field contains a TI CC24xx style FCS. */
#define DISSECT_IEEE802154_OPTION_LINUX 0x00000002 /* Addressing fields are padded DLT_IEEE802_15_4_LINUX, not implemented. */
#define DISSECT_IEEE802154_OPTION_ZBOSS 0x00000003 /* ZBOSS traffic dump */
/* ethertype for 802.15.4 tag - encapsulating an Ethernet packet */
static unsigned int ieee802154_ethertype = 0x809A;
@ -368,6 +369,7 @@ static heur_dissector_list_t ieee802154_heur_subdissector_list;
static dissector_handle_t zigbee_beacon_handle;
static dissector_handle_t zigbee_ie_handle;
static dissector_handle_t zigbee_nwk_handle;
/* Versions */
static const value_string ieee802154_frame_versions[] = {
@ -721,7 +723,7 @@ dissect_ieee802154(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* da
/* Call the common dissector. */
dissect_ieee802154_common(new_tvb, pinfo, tree,
((ieee802154_cc24xx || new_tvb != tvb) ? DISSECT_IEEE802154_OPTION_CC24xx : 0));
((ieee802154_cc24xx || new_tvb != tvb) ? (DISSECT_IEEE802154_OPTION_CC24xx | DISSECT_IEEE802154_OPTION_ZBOSS) : 0));
return tvb_captured_length(tvb);
} /* dissect_ieee802154 */
@ -1509,6 +1511,10 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g
call_data_dissector(payload_tvb, pinfo, tree);
break;
}
if (options & DISSECT_IEEE802154_OPTION_ZBOSS) {
call_dissector_with_data(zigbee_nwk_handle, payload_tvb, pinfo, tree, packet);
break;
}
/* Try the PANID dissector table for stateful dissection. */
if (dissector_try_uint_new(panid_dissector_table, packet->src_pan, payload_tvb, pinfo, tree, TRUE, packet)) {
break;
@ -3638,6 +3644,7 @@ void proto_reg_handoff_ieee802154(void)
ieee802154_nofcs_handle = find_dissector("wpan_nofcs");
zigbee_beacon_handle = find_dissector_add_dependency("zbee_beacon", proto_ieee802154);
zigbee_ie_handle = find_dissector_add_dependency("zbee_ie", proto_ieee802154);
zigbee_nwk_handle = find_dissector("zbee_nwk");
dissector_add_uint("wtap_encap", WTAP_ENCAP_IEEE802_15_4, ieee802154_handle);
dissector_add_uint("wtap_encap", WTAP_ENCAP_IEEE802_15_4_NONASK_PHY, ieee802154_nonask_phy_handle);

2
epan/dissectors/packet-zbee-nwk.c
View File

@ -397,7 +397,7 @@ dissect_zbee_nwk_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void
/* All ZigBee frames must always have a 16-bit source and destination address. */
if (packet == NULL) return FALSE;
if (packet->src_addr_mode != IEEE802154_FCF_ADDR_SHORT) return FALSE;
if (packet->src_addr_mode != IEEE802154_FCF_ADDR_SHORT && packet->src_addr_mode != IEEE802154_FCF_ADDR_EXT) return FALSE;
if (packet->dst_addr_mode != IEEE802154_FCF_ADDR_SHORT) return FALSE;
/* If the frame type and version are not sane, then it's probably not ZigBee. */