Add ENC_TIME_MSEC_NTP and use it in packet-gtpv2.c

While at it fix expert info a typo and an calculation.

Change-Id: I071a36edb7eed5f58708b98aebcb24bc6c34f2a8
Reviewed-on: https://code.wireshark.org/review/20766
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

doc/README.dissector

@@ -1604,7 +1604,7 @@ encodings that are currently supported are:
         timespec with a 4-byte time_t.)
 
     ENC_TIME_NTP - 8 bytes; the first 4 bytes are seconds since the NTP
-        epoch (1901-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of
+        epoch (1900-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of
         a second since that second.  (I.e., a 64-bit count of 1/2^32's of a
         second since the NTP epoch, with the upper 32 bits first and the
         lower 32 bits second, even when little-endian.)
@@ -1635,6 +1635,9 @@ encodings that are currently supported are:
         second since the UN*X epoch; see section 5.3.1 "Timestamp Option"
         in RFC 3971.
 
+    ENC_TIME_MSEC_NTP - 4-8 bytes, representing a count of milliseconds since
+        the NTP epoch.  (I.e., milliseconds since the NTP epoch.)
+
 For FT_RELATIVE_TIME fields, the encoding specifies the form in which
 the time stamp is specified, as well as its byte order.  The time stamp
 encodings that are currently supported are:

epan/dissectors/packet-gtpv2.c

@@ -6475,7 +6475,7 @@ dissect_gtpv2_ms_ts(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, pro
      * rounded value of 1000 x the value of the 64-bit timestamp (Seconds  + (Fraction / (1<<32)))
      * defined in section 6 of IETF RFC 5905
      */
-    proto_tree_add_item(tree, hf_gtpv2_ms_ts, tvb, offset, 6, ENC_BIG_ENDIAN);
+    proto_tree_add_item(tree, hf_gtpv2_ms_ts, tvb, offset, 6, ENC_TIME_MSEC_NTP | ENC_BIG_ENDIAN);
 }
 
 /*
@@ -9218,7 +9218,7 @@ void proto_register_gtpv2(void)
       },
       { &hf_gtpv2_ms_ts,
       { "Millisecond Time Stamp", "gtpv2.ms_ts",
-          FT_UINT48, BASE_DEC, NULL, 0x0,
+          FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
           NULL, HFILL }
       },
     };

epan/proto.c

@@ -1922,7 +1922,7 @@ get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start,
 
 				msecs = get_uint64_value(tree, tvb, start, length, encoding);
 				time_stamp->secs  = (time_t)(msecs / 1000);
-				time_stamp->nsecs = (int)(msecs % 1000);
+				time_stamp->nsecs = (int)(msecs % 1000)*1000000;
 			} else
 				report_type_length_mismatch(tree, "a time-in-milliseconds time stamp", length, TRUE);
 			break;
@@ -2032,7 +2032,23 @@ get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start,
 			} else
 				report_type_length_mismatch(tree, "an NTP seconds-only time stamp", length, TRUE);
 			break;
+		case ENC_TIME_MSEC_NTP | ENC_BIG_ENDIAN:
+			/*
+			* Milliseconds, 1 to 8 bytes.
+			* For absolute times, it's milliseconds since the
+			* NTP epoch.
+			*/
+			if (length >= 1 && length <= 8) {
+				guint64 msecs;
 
+				msecs = get_uint64_value(tree, tvb, start, length, encoding);
+				tmpsecs = (guint32)(msecs / 1000);
+				time_stamp->secs = (time_t)(tmpsecs - (guint32)NTP_BASETIME);
+				time_stamp->nsecs = (int)(msecs % 1000)*1000000;
+			}
+			else
+				report_type_length_mismatch(tree, "a time-in-milliseconds NTP time stamp", length, TRUE);
+			break;
 		default:
 			DISSECTOR_ASSERT_NOT_REACHED();
 			break;
@@ -2441,7 +2457,7 @@ proto_tree_new_item(field_info *new_fi, proto_tree *tree,
 			if (encoding == TRUE)
 				encoding = ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN;
 
-			if (length != 8 && length != 4) {
+			if (length > 8 || length < 4) {
 				length_error = length < 4 ? TRUE : FALSE;
 				report_type_length_mismatch(tree, "an absolute time value", length, length_error);
 			}
@@ -3004,9 +3020,9 @@ proto_tree_add_time_item(proto_tree *tree, int hfindex, tvbuff_t *tvb,
 	}
 	else {
 		const gboolean is_relative = (hfinfo->type == FT_RELATIVE_TIME) ? TRUE : FALSE;
+		const gboolean length_error = length < 4 ? TRUE : FALSE;
 
-		if (length != 8 && length != 4) {
+		if (length > 8 || length < 4) {
-			const gboolean length_error = length < 4 ? TRUE : FALSE;
 			if (is_relative)
 			    report_type_length_mismatch(tree, "a relative time value", length, length_error);
 			else

epan/proto.h

@@ -408,6 +408,9 @@ WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug(const char *message);
  *  ENC_TIME_RFC_3971 - 8 bytes, representing a count of 1/64ths of a
  *  second since the UN*X epoch; see section 5.3.1 "Timestamp Option"
  *  in RFC 3971.
+ *
+ *  ENC_TIME_MSEC_NTP - 4-8 bytes, representing a count of milliseconds since
+ *  the NTP epoch.  (I.e., milliseconds since the NTP epoch.)
  */
 #define ENC_TIME_TIMESPEC      0x00000000
 #define ENC_TIME_NTP           0x00000002
@@ -419,6 +422,7 @@ WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug(const char *message);
 #define ENC_TIME_MSECS         0x00000014
 #define ENC_TIME_SECS_NTP      0x00000018
 #define ENC_TIME_RFC_3971      0x00000020
+#define ENC_TIME_MSEC_NTP      0x00000022
 
 /*
  * Historically, the only place the representation mattered for strings