forked from osmocom/wireshark
ZigBee: decode ZBOSS traffic dump and Interpan frames as ZigBee.
If decoded ZBOSS traffic dump, sure this is ZigBee, so bypass heuristic. If decoding air sniffer dump, try to go thru heuristic by checking for ext address src mode required for interpan. Change-Id: Iddf799400a4cf0fd73714f06b99e3d11c8cb2e60 Reviewed-on: https://code.wireshark.org/review/15921 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
parent
561a063fee
commit
1b0d51ffdf
|
@ -88,6 +88,7 @@ void proto_reg_handoff_ieee802154(void);
|
|||
/* Dissection Options for dissect_ieee802154_common */
|
||||
#define DISSECT_IEEE802154_OPTION_CC24xx 0x00000001 /* FCS field contains a TI CC24xx style FCS. */
|
||||
#define DISSECT_IEEE802154_OPTION_LINUX 0x00000002 /* Addressing fields are padded DLT_IEEE802_15_4_LINUX, not implemented. */
|
||||
#define DISSECT_IEEE802154_OPTION_ZBOSS 0x00000003 /* ZBOSS traffic dump */
|
||||
|
||||
/* ethertype for 802.15.4 tag - encapsulating an Ethernet packet */
|
||||
static unsigned int ieee802154_ethertype = 0x809A;
|
||||
|
@ -368,6 +369,7 @@ static heur_dissector_list_t ieee802154_heur_subdissector_list;
|
|||
|
||||
static dissector_handle_t zigbee_beacon_handle;
|
||||
static dissector_handle_t zigbee_ie_handle;
|
||||
static dissector_handle_t zigbee_nwk_handle;
|
||||
|
||||
/* Versions */
|
||||
static const value_string ieee802154_frame_versions[] = {
|
||||
|
@ -721,7 +723,7 @@ dissect_ieee802154(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* da
|
|||
|
||||
/* Call the common dissector. */
|
||||
dissect_ieee802154_common(new_tvb, pinfo, tree,
|
||||
((ieee802154_cc24xx || new_tvb != tvb) ? DISSECT_IEEE802154_OPTION_CC24xx : 0));
|
||||
((ieee802154_cc24xx || new_tvb != tvb) ? (DISSECT_IEEE802154_OPTION_CC24xx | DISSECT_IEEE802154_OPTION_ZBOSS) : 0));
|
||||
return tvb_captured_length(tvb);
|
||||
} /* dissect_ieee802154 */
|
||||
|
||||
|
@ -1509,6 +1511,10 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g
|
|||
call_data_dissector(payload_tvb, pinfo, tree);
|
||||
break;
|
||||
}
|
||||
if (options & DISSECT_IEEE802154_OPTION_ZBOSS) {
|
||||
call_dissector_with_data(zigbee_nwk_handle, payload_tvb, pinfo, tree, packet);
|
||||
break;
|
||||
}
|
||||
/* Try the PANID dissector table for stateful dissection. */
|
||||
if (dissector_try_uint_new(panid_dissector_table, packet->src_pan, payload_tvb, pinfo, tree, TRUE, packet)) {
|
||||
break;
|
||||
|
@ -3638,6 +3644,7 @@ void proto_reg_handoff_ieee802154(void)
|
|||
ieee802154_nofcs_handle = find_dissector("wpan_nofcs");
|
||||
zigbee_beacon_handle = find_dissector_add_dependency("zbee_beacon", proto_ieee802154);
|
||||
zigbee_ie_handle = find_dissector_add_dependency("zbee_ie", proto_ieee802154);
|
||||
zigbee_nwk_handle = find_dissector("zbee_nwk");
|
||||
|
||||
dissector_add_uint("wtap_encap", WTAP_ENCAP_IEEE802_15_4, ieee802154_handle);
|
||||
dissector_add_uint("wtap_encap", WTAP_ENCAP_IEEE802_15_4_NONASK_PHY, ieee802154_nonask_phy_handle);
|
||||
|
|
|
@ -397,7 +397,7 @@ dissect_zbee_nwk_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void
|
|||
|
||||
/* All ZigBee frames must always have a 16-bit source and destination address. */
|
||||
if (packet == NULL) return FALSE;
|
||||
if (packet->src_addr_mode != IEEE802154_FCF_ADDR_SHORT) return FALSE;
|
||||
if (packet->src_addr_mode != IEEE802154_FCF_ADDR_SHORT && packet->src_addr_mode != IEEE802154_FCF_ADDR_EXT) return FALSE;
|
||||
if (packet->dst_addr_mode != IEEE802154_FCF_ADDR_SHORT) return FALSE;
|
||||
|
||||
/* If the frame type and version are not sane, then it's probably not ZigBee. */
|
||||
|
|
Loading…
Reference in New Issue