Wireshark-bugs: [Wireshark-bugs] [Bug 8569] New: Warnings for MCC MNC fields containing non-deci

Date: Mon, 08 Apr 2013 11:25:34 +0000
Bug ID 8569
Summary Warnings for MCC MNC fields containing non-decimal digits
Classification Unclassified
Product Wireshark
Version 1.9.x (Experimental)
Hardware All
OS All
Status UNCONFIRMED
Severity Enhancement
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Created attachment 10567 [details]
Test Case

Build Information:
wireshark 1.9.3 (SVN Rev 48788 from /trunk)

Copyright 1998-2013 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 2.22.0, with Cairo 1.10.0, with Pango 1.28.2, with
GLib 2.26.1, with libpcap, with libz 1.2.3.4, without POSIX capabilities,
without libnl, without SMI, without c-ares, without ADNS, without Lua, without
Python, without GnuTLS, without Gcrypt, without Kerberos, without GeoIP,
without
PortAudio, with AirPcap.

Running on Linux 2.6.35-22-generic, with locale en_IN, with libpcap version
1.1.1, with libz 1.2.3.4, without AirPcap.

Built using gcc 4.4.5.

--
Currently warnings are thrown whenever the dissection engine comes across MCC
and MNC containing non decimal digits. 
But for certain cases when MS has its deleted Location Area Information
information, these fields may have valid hexadecimal digits. As per
specifications:
"""
In abnormal cases, the MNC stored in the mobile station can have:
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ... 9, F} hex.
In such cases the mobile station shall transmit the stored values using full
hexadecimal encoding. When receiving such an MNC, the network shall treat the
LAI as deleted.
"""

Currently warnings are being triggered when MS is doing a fresh GPRS attach
towards the network. One way to remove the warnings for at least these cases
are to do following changes in packet-gsm_a_dtap.c and packet-e212.c (I am not
sure whether the warnings were purposefully implemented to notify the user
about these cases too; in which case please invalidate the bug :)):

--- packet-gsm_a_dtap.c 2013-04-08 16:13:30.932953452 +0530
+++ packet-gsm_a_dtap.c_orig    2013-04-08 15:27:16.564754235 +0530
@@ -6366,7 +6366,8 @@
        gint          ti;
        int           hf_idx;
        gboolean      nsd;
-        gboolean isGPRSAttachPacket;
+
+
        len = tvb_length(tvb);

        if (len < 2)
@@ -6458,10 +6459,6 @@

        case 8:
                get_gmm_msg_params(oct, &msg_str, &ett_tree, &hf_idx,
&dtap_msg_fcn);
-                if ( !strcmp(msg_str,"Attach Request") ||
!strcmp(msg_str,"Routing Area Update Request"))
-                      {  isGPRSAttachPacket = TRUE;
-                         pinfo->private_data = &isGPRSAttachPacket;
-                      }
                break;

        case 9:




--- packet-e212.c       2013-04-08 16:32:13.859066255 +0530
+++ packet-e212.c_orig  2013-04-08 15:27:17.288724764 +0530
@@ -2529,7 +2529,7 @@
             mnc = 100 * mnc3 + mnc;
     }
     item = proto_tree_add_uint(tree, hf_E212_mcc , tvb, start_offset, 2, mcc
);
-    if (((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) && !(pinfo->private_data) )
+    if ((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MCC
contains non-decimal digits");

     if (mnc3 != 0x0f) {
@@ -2560,7 +2560,7 @@
             val_to_str_ext_const(mcc * 1000 + mnc, &mcc_mnc_codes_ext, ""));
     }

-    if (((mnc1 > 9) || (mnc2 > 9) || ((mnc3 > 9) && (mnc3 != 0x0f))) &&
!(pinfo->private_data) )
+    if ((mnc1 > 9) || (mnc2 > 9) || ((mnc3 > 9) && (mnc3 != 0x0f)))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MNC
contains non-decimal digits");

     return mcc_mnc_str;
@@ -2649,7 +2649,7 @@
     }

     item = proto_tree_add_uint(tree, hf_E212_mcc , tvb, start_offset, 2, mcc
);
-    if (((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) && !(pinfo->private_data) )
+    if ((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MCC
contains non-decimal digits");

     if (long_mnc)
@@ -2663,7 +2663,7 @@
                    val_to_str_ext_const(mcc * 1000 + 10 * mnc,
&mcc_mnc_codes_ext, "Unknown"),
                    mnc);

-    if (((mnc1 > 9) || (mnc2 > 9) || (long_mnc && (mnc3 > 9))) &&
!(pinfo->private_data))
+    if ((mnc1 > 9) || (mnc2 > 9) || (long_mnc && (mnc3 > 9)))
         expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MNC
contains non-decimal digits");

     if (long_mnc)


You are receiving this mail because:
  • You are watching all bug changes.