osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Added decoding of RAN/NAS cause IE/AVP 

Change-Id: I889820405528be5e17edf85e52291d642a98cce6
Reviewed-on: https://code.wireshark.org/review/19216
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
Jan Spevak 2016-12-12 10:48:37 +01:00 committed by Anders Broman
parent 047023d443
commit 36ec6240a8
9 changed files with 468 additions and 159 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
epan/dissectors/Makefile.am
View File

@ -1528,6 +1528,7 @@ DISSECTOR_INCLUDES = \
packet-dcom-dispatch.h \
packet-dcm.h \
packet-diameter.h \
packet-diameter_3gpp.h \
packet-diffserv-mpls-common.h \
packet-disp.h \
packet-dns.h \

1
epan/dissectors/asn1/s1ap/s1ap.cnf
View File

@ -17,6 +17,7 @@ CauseTransport
CauseNas
CauseProtocol
CauseMisc
Cause
#.EXPORTS
ENB-StatusTransfer-TransparentContainer_PDU

156
epan/dissectors/packet-diameter_3gpp.c
View File

@ -30,12 +30,15 @@
#include <epan/packet.h>
#include <epan/expert.h>
#include <epan/asn1.h>
#include "packet-diameter.h"
#include "packet-diameter_3gpp.h"
#include "packet-gsm_a_common.h"
#include "packet-e164.h"
#include "packet-e212.h"
#include "packet-ntp.h"
#include "packet-s1ap.h"
#include "packet-sip.h"
#include "packet-lcsap.h"
@ -399,6 +402,19 @@ static int hf_diameter_3gpp_feature_list1_rx_flags_spare_bits = -1;
static int hf_diameter_3gpp_feature_list2_rx_flags_bit0 = -1;
static int hf_diameter_3gpp_feature_list2_rx_flags_spare_bits = -1;
static int hf_diameter_3gpp_ran_nas_protocol_type = -1;
static int hf_diameter_3gpp_ran_nas_cause_type = -1;
static int hf_diameter_3gpp_ran_nas_cause_value = -1;
static int hf_diameter_3gpp_s1ap_radio_network = -1;
static int hf_diameter_3gpp_s1ap_transport = -1;
static int hf_diameter_3gpp_s1ap_nas = -1;
static int hf_diameter_3gpp_s1ap_protocol = -1;
static int hf_diameter_3gpp_s1ap_misc = -1;
static int hf_diameter_3gpp_emm_cause = -1;
static int hf_diameter_3gpp_esm_cause = -1;
static int hf_diameter_3gpp_diameter_cause = -1;
static int hf_diameter_3gpp_ikev2_cause = -1;
/* Dissector handles */
static dissector_handle_t xml_handle;
@ -1855,6 +1871,82 @@ dissect_diameter_3gpp_eutran_positioning_data(tvbuff_t *tvb, packet_info *pinfo
return dissect_lcsap_Positioning_Data_PDU(tvb, pinfo, tree, NULL);
}
/* AVP Code: 2819 RAN-NAS-Release-Cause*/
static const value_string ran_nas_prot_type_vals[] = {
{ 1, "S1AP Cause" },
{ 2, "EMM Cause" },
{ 3, "ESM Cause" },
{ 4, "Diameter Cause" },
{ 5, "IKEv2 Cause" },
{ 0, NULL}
};
static int
dissect_diameter_3gpp_ran_nas_release_cause(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
{
int offset = 0;
int length = tvb_reported_length(tvb);
guint8 octet = tvb_get_guint8(tvb, offset);
guint8 proto_type = (octet >> 4);
int cause_type = 0;
proto_tree_add_item(tree, hf_diameter_3gpp_ran_nas_protocol_type, tvb, offset, 1, ENC_BIG_ENDIAN);
if (proto_type == 1) {
proto_tree_add_item(tree, hf_diameter_3gpp_ran_nas_cause_type, tvb, offset, 1, ENC_BIG_ENDIAN);
cause_type = octet & 0x0F;
}
offset += 1;
switch (proto_type) {
case 1:
switch (cause_type) {
case 0:
proto_tree_add_item(tree, hf_diameter_3gpp_s1ap_radio_network, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
case 1:
proto_tree_add_item(tree, hf_diameter_3gpp_s1ap_transport, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
case 2:
proto_tree_add_item(tree, hf_diameter_3gpp_s1ap_nas, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
case 3:
proto_tree_add_item(tree, hf_diameter_3gpp_s1ap_protocol, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
case 4:
proto_tree_add_item(tree, hf_diameter_3gpp_s1ap_misc, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
default:
proto_tree_add_item(tree, hf_diameter_3gpp_ran_nas_cause_value, tvb, offset, 1, ENC_BIG_ENDIAN);
}
offset += 1;
break;
case 2:
proto_tree_add_item(tree, hf_diameter_3gpp_emm_cause, tvb, offset, 1, ENC_BIG_ENDIAN);
offset += 1;
break;
case 3:
proto_tree_add_item(tree, hf_diameter_3gpp_esm_cause, tvb, offset, 1, ENC_BIG_ENDIAN);
offset += 1;
break;
case 4:
proto_tree_add_item(tree, hf_diameter_3gpp_diameter_cause, tvb, offset, 2, ENC_BIG_ENDIAN);
offset += 2;
break;
case 5:
proto_tree_add_item(tree, hf_diameter_3gpp_ikev2_cause, tvb, offset, 2, ENC_BIG_ENDIAN);
offset += 2;
break;
default:
proto_tree_add_item(tree, hf_diameter_3gpp_ran_nas_cause_value, tvb, offset, length - offset, ENC_BIG_ENDIAN);
offset += (length - offset);
break;
}
return offset;
}
/* AVP Code: 3502 MBMS-Bearer-Event */
static int
dissect_diameter_3gpp_mbms_bearer_event(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
@ -2096,6 +2188,9 @@ proto_reg_handoff_diameter_3gpp(void)
/* AVP Code: 2516 EUTRAN-Positioning-Data */
dissector_add_uint("diameter.3gpp", 2516, create_dissector_handle(dissect_diameter_3gpp_eutran_positioning_data, proto_diameter_3gpp));
/* AVP Code: 2819 RAN-NAS-Release-Cause */
dissector_add_uint("diameter.3gpp", 2819, create_dissector_handle(dissect_diameter_3gpp_ran_nas_release_cause, proto_diameter_3gpp));
/* AVP Code: 3502 MBMS-Bearer-Event */
dissector_add_uint("diameter.3gpp", 3502, create_dissector_handle(dissect_diameter_3gpp_mbms_bearer_event, proto_diameter_3gpp));
@ -2111,7 +2206,6 @@ proto_reg_handoff_diameter_3gpp(void)
xml_handle = find_dissector_add_dependency("xml", proto_diameter_3gpp);
}
/*
* 3GPP TS 24.008 Quality of service
*/
@ -3884,6 +3978,66 @@ proto_register_diameter_3gpp(void)
FT_UINT32, BASE_HEX, NULL, 0xFFFFF800,
NULL, HFILL}
},
{ &hf_diameter_3gpp_ran_nas_protocol_type,
{ "Protocol Type", "diameter.3gpp.ran_nas.protocol_type",
FT_UINT8, BASE_DEC, VALS(ran_nas_prot_type_vals), 0xF0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_ran_nas_cause_type,
{ "S1AP Cause Type", "diameter.3gpp.ran_nas.s1ap_type",
FT_UINT8, BASE_DEC, VALS(s1ap_Cause_vals), 0x0F,
NULL, HFILL}
},
{ &hf_diameter_3gpp_ran_nas_cause_value,
{ "Cause Value", "diameter.3gpp.ran_nas.cause_value",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_s1ap_radio_network,
{ "S1AP Radio Network Cause Value", "diameter.3gpp.ran_nas.radio_cause",
FT_UINT8, BASE_DEC, VALS(s1ap_CauseRadioNetwork_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_s1ap_transport,
{ "S1AP Transport Cause Value", "diameter.3gpp.ran_nas.transport_cause",
FT_UINT8, BASE_DEC, VALS(s1ap_CauseTransport_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_s1ap_nas,
{ "S1AP NAS Cause Value", "diameter.3gpp.ran_nas.nas_cause",
FT_UINT8, BASE_DEC, VALS(s1ap_CauseNas_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_s1ap_protocol,
{ "S1AP Protocol Cause Value", "diameter.3gpp.ran_nas.protocol_cause",
FT_UINT8, BASE_DEC, VALS(s1ap_CauseProtocol_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_s1ap_misc,
{ "S1AP Misc. Cause Value", "diameter.3gpp.ran_nas.misc_cause",
FT_UINT8, BASE_DEC, VALS(s1ap_CauseMisc_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_emm_cause,
{ "EMM Cause Value", "diameter.3gpp.ran_nas.emm_cause",
FT_UINT8, BASE_DEC, VALS(nas_eps_emm_cause_values), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_esm_cause,
{ "ESM Cause Value", "diameter.3gpp.ran_nas.esm_cause",
FT_UINT8, BASE_DEC, VALS(nas_eps_esm_cause_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_diameter_cause,
{ "Diameter Cause Value", "diameter.3gpp.ran_nas.diameter_cause",
FT_UINT16, BASE_DEC, VALS(diameter_3gpp_termination_cause_vals), 0x0,
NULL, HFILL}
},
{ &hf_diameter_3gpp_ikev2_cause,
{ "IKEv2 Cause Value", "diameter.3gpp.ran_nas.ikev2_cause",
FT_UINT16, BASE_DEC, VALS(diameter_3gpp_IKEv2_error_type_vals), 0x0,
NULL, HFILL}
},
};

95
epan/dissectors/packet-diameter_3gpp.h Normal file
View File

@ -0,0 +1,95 @@
/* packet-diameter_3gpp.h
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
static const value_string diameter_3gpp_IKEv2_error_type_vals[] = {
{ 1, "UNSUPPORTED_CRITICAL_PAYLOAD" },
{ 4, "INVALID_IKE_SPI" },
{ 5, "INVALID_MAJOR_VERSION" },
{ 7, "INVALID_SYNTAX" },
{ 9, "INVALID_MESSAGE_ID" },
{ 11, "INVALID_SPI" },
{ 14, "NO_PROPOSAL_CHOSEN" },
{ 17, "INVALID_IKE_PAYLOAD" },
{ 24, "AUTHENTICATION_FAILED" },
{ 34, "SINGLE_PAIR_REQUIRED" },
{ 35, "NO_ADDITIONAL_SAS" },
{ 36, "INTERNAL_ADDRESS_FAILURE" },
{ 37, "FAILED_CP_REQUIRED" },
{ 38, "TS_UNACCEPTABLE" },
{ 39, "INVALID_SELECTORS" },
{ 40, "UNACCEPTABLE_ADDRESSES" },
{ 41, "UNEXPECTED_NAT_DETECTED" },
{ 42, "USE_ASSIGNED_HoA" },
{ 43, "TEMPORARY_FAILURE" },
{ 44, "CHILD_SA_NOT_FOUND" },
{ 45, "INVALID_GROUP_ID" },
{ 46, "AUTHORIZATION_FAILED" },
{ 0, NULL }
};
static const value_string diameter_3gpp_termination_cause_vals[] = {
{ 1, "DIAMETER_LOGOUT" },
{ 2, "DIAMETER_SERVICE_NOT_PROVIDED" },
{ 3, "DIAMETER_BAD_ANSWER" },
{ 4, "DIAMETER_ADMINISTRATIVE" },
{ 5, "DIAMETER_LINK_BROKEN" },
{ 6, "DIAMETER_AUTH_EXPIRED" },
{ 7, "DIAMETER_USER_MOVED" },
{ 8, "DIAMETER_SESSION_TIMEOUT" },
{ 9, "Unassigned" },
{ 10, "Unassigned" },
{ 11, "User Request" },
{ 12, "Lost Carrier" },
{ 13, "Lost Service" },
{ 14, "Idle Timeout" },
{ 15, "Session Timeout" },
{ 16, "Admin Reset" },
{ 17, "Admin Reboot" },
{ 18, "Port Error" },
{ 19, "NAS Error" },
{ 20, "NAS Request" },
{ 21, "NAS Reboot" },
{ 22, "Port Unneeded" },
{ 23, "Port Preempted" },
{ 24, "Port Suspended" },
{ 25, "Service Unavailable" },
{ 26, "Callback" },
{ 27, "User Error" },
{ 28, "Host Request" },
{ 29, "Supplicant Restart" },
{ 30, "Reauthentication Failure" },
{ 31, "Port Reinitialized" },
{ 32, "Port Administratively Disabled" },
{ 0, NULL }
};
/*
* Editor modelines
*
* Local Variables:
* c-basic-offset: 4
* tab-width: 8
* indent-tabs-mode: nil
* End:
*
* ex: set shiftwidt=4 tabstop=8 expandtab:
* :indentSize=4:tabSize=8:noTabs=true:
*/

2
epan/dissectors/packet-gsm_a_common.h
View File

@ -757,6 +757,8 @@ extern value_string_ext gsm_a_rr_rxlev_vals_ext;
extern const value_string gsm_a_gm_type_of_ciph_alg_vals[];
extern value_string_ext nas_eps_emm_cause_values_ext;
extern const value_string nas_eps_emm_cause_values[];
extern const value_string nas_eps_esm_cause_vals[];
typedef enum
{

59
epan/dissectors/packet-gtpv2.c
View File

@ -42,6 +42,7 @@
#include "packet-ntp.h"
#include "packet-gtpv2.h"
#include "packet-diameter.h"
#include "packet-diameter_3gpp.h"
#include "packet-ip.h"
void proto_register_gtpv2(void);
@ -560,6 +561,13 @@ static int hf_gtpv2_twan_relay_id_ipv6 = -1;
static int hf_gtpv2_twan_circuit_id_len = -1;
static int hf_gtpv2_twan_circuit_id = -1;
static int hf_gtpv2_integer_number_val = -1;
static int hf_gtpv2_ran_nas_protocol_type = -1;
static int hf_gtpv2_ran_nas_cause_type = -1;
static int hf_gtpv2_ran_nas_cause_value = -1;
static int hf_gtpv2_emm_cause = -1;
static int hf_gtpv2_esm_cause = -1;
static int hf_gtpv2_diameter_cause = -1;
static int hf_gtpv2_ikev2_cause = -1;
static gint ett_gtpv2 = -1;
static gint ett_gtpv2_flags = -1;
@ -628,7 +636,6 @@ static expert_field ei_gtpv2_mbms_session_duration_secs = EI_INIT;
static expert_field ei_gtpv2_ie = EI_INIT;
static expert_field ei_gtpv2_int_size_not_handled = EI_INIT;
/* Definition of User Location Info (AVP 22) masks */
#define GTPv2_ULI_CGI_MASK 0x01
#define GTPv2_ULI_SAI_MASK 0x02
@ -5949,10 +5956,51 @@ dissect_gtpv2_mbms_flags(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree
/*
* 8.103 RAN/NAS Cause
*/
static const value_string ran_nas_prot_type_vals[] = {
{ 1, "S1AP Cause" },
{ 2, "EMM Cause" },
{ 3, "ESM Cause" },
{ 4, "Diameter Cause" },
{ 5, "IKEv2 Cause" },
{ 0, NULL },
};
static void
dissect_gtpv2_ran_nas_cause(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, proto_item *item _U_, guint16 length _U_, guint8 message_type _U_, guint8 instance _U_, session_args_t * args _U_)
{
proto_tree_add_expert(tree, pinfo, &ei_gtpv2_ie_data_not_dissected, tvb, 0, length);
int offset = 0;
guint8 octet = tvb_get_guint8(tvb, offset);
guint8 proto_type = (octet >> 4);
int cause_type = 0;
proto_tree_add_item(tree, hf_gtpv2_ran_nas_protocol_type, tvb, offset, 1, ENC_BIG_ENDIAN);
if (proto_type == 1) {
proto_tree_add_item(tree, hf_gtpv2_ran_nas_cause_type, tvb, offset, 1, ENC_BIG_ENDIAN);
cause_type = octet & 0x0F;
}
offset += 1;
switch (proto_type) {
case 1:
dissect_gtpv2_s1ap_cause(tvb, pinfo, tree, offset, cause_type);
break;
case 2:
proto_tree_add_item(tree, hf_gtpv2_emm_cause, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
case 3:
proto_tree_add_item(tree, hf_gtpv2_esm_cause, tvb, offset, 1, ENC_BIG_ENDIAN);
break;
case 4:
proto_tree_add_item(tree, hf_gtpv2_diameter_cause, tvb, offset, 2, ENC_BIG_ENDIAN);
break;
case 5:
proto_tree_add_item(tree, hf_gtpv2_ikev2_cause, tvb, offset, 2, ENC_BIG_ENDIAN);
break;
default:
proto_tree_add_item(tree, hf_gtpv2_ran_nas_cause_value, tvb, offset, length - offset, ENC_BIG_ENDIAN);
break;
}
}
/*
* 8.104 CN Operator Selection Entity
@ -9013,6 +9061,13 @@ void proto_register_gtpv2(void)
{ &hf_gtpv2_twan_circuit_id_len,{ "Relay Identity Type Length", "gtpv2.twan_id.relay_id_type_len", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
{ &hf_gtpv2_twan_circuit_id,{ "Circuit-ID", "gtpv2.twan_id.circuit_id", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
{ &hf_gtpv2_integer_number_val,{ "Value", "gtpv2.integer_number_val", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
{ &hf_gtpv2_ran_nas_protocol_type, {"RAN/NAS Protocol Type", "gtpv2.ran_nas.protocol_type", FT_UINT8, BASE_DEC, VALS(ran_nas_prot_type_vals), 0xF0, NULL, HFILL} },
{ &hf_gtpv2_ran_nas_cause_type, {"RAN/NAS S1AP Cause Type", "gtpv2.ran_nas.s1ap_type", FT_UINT8, BASE_DEC, VALS(s1ap_Cause_vals), 0x0F, NULL, HFILL} },
{ &hf_gtpv2_ran_nas_cause_value, {"RAN/NAS Cause Value", "gtpv2.ran_nas.cause_value", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL} },
{ &hf_gtpv2_emm_cause, {"EMM Cause Value", "gtpv2.ran_nas.emm_cause", FT_UINT8, BASE_DEC, VALS(nas_eps_emm_cause_values), 0x0, NULL, HFILL} },
{ &hf_gtpv2_esm_cause, {"ESM Cause Value", "gtpv2.ran_nas.esm_cause", FT_UINT8, BASE_DEC, VALS(nas_eps_esm_cause_vals), 0x0, NULL, HFILL} },
{ &hf_gtpv2_diameter_cause, {"Diameter Cause Value", "gtpv2.ran_nas.diameter_cause", FT_UINT16, BASE_DEC, VALS(diameter_3gpp_termination_cause_vals), 0x0, NULL, HFILL} },
{ &hf_gtpv2_ikev2_cause, {"IKEv2 Cause Value", "gtpv2.ran_nas.ikev2_cause", FT_UINT16, BASE_DEC, VALS(diameter_3gpp_IKEv2_error_type_vals), 0x0, NULL, HFILL} },
};
static gint *ett_gtpv2_array[] = {

2
epan/dissectors/packet-nas_eps.c
View File

@ -2637,7 +2637,7 @@ de_esm_qos(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo _U_,
* 9.9.4.4 ESM cause
*/
static const value_string nas_eps_esm_cause_vals[] = {
const value_string nas_eps_esm_cause_vals[] = {
{ 0x08, "Operator Determined Barring"},
{ 0x1a, "Insufficient resources"},
{ 0x1b, "Missing or unknown APN"},

310
epan/dissectors/packet-s1ap.c
View File

File diff suppressed because it is too large Load Diff

1
epan/dissectors/packet-s1ap.h
View File

@ -42,6 +42,7 @@ typedef struct _s1ap_ctx_t {
/*--- Included file: packet-s1ap-exp.h ---*/
#line 1 "./asn1/s1ap/packet-s1ap-exp.h"
WS_DLL_PUBLIC const value_string s1ap_Cause_vals[];
WS_DLL_PUBLIC const value_string s1ap_CauseMisc_vals[];
WS_DLL_PUBLIC const value_string s1ap_CauseProtocol_vals[];
WS_DLL_PUBLIC const value_string s1ap_CauseRadioNetwork_vals[];