Wireshark-dev: Re: [Wireshark-dev] Decoding error SS7 SMS-MO (ok) vs SMPP Deliver SM (malformed

From: John Thacker <johnthacker@xxxxxxxxx>
Date: Fri, 10 Jun 2022 13:00:15 -0400
On Wed, Jul 7, 2021, 10:48 AM Pascal Quantin <pascal@xxxxxxxxxxxxx> wrote:
Hi Andreas,

Le mer. 7 juil. 2021 à 16:20, Andreas Fink <afink@xxxxxxxxxxxxx> a écrit :
I run into a decoding error in SMPP

...

So I presume the SMPP branch doesn't know the same User Data Headers as the SS7 branch of Wireshark.

It's even worse: your first screenshot is decoded by the gsm_sms dissector (that decodes a TPDU, including the TP-UD)), while the SMPP dissector is calling another gsm_sms_ud dissector (taht decodes the TP-UD only).
It seems like the latter is not really maintained while the former is more actively maintained and has better decoding capabilities.

I am now looking at fixing this issue along with a few other SMPP issues. There seems like three basic approaches:

1. Fix the gsm_sms_ud dissector to have the capabilities of the TP-UD (including UDH)  dissection in gsm_sms, and keep both. Cons: Duplicative code and a maintenance issue.

2. Fix the gsm_sms_ud dissector to have the capabilities of gsm_sms as above, and have gsm_sms call the gsm_sms_ud dissector instead of handling the TP-UD part of the TPDU itself. Cons: changes things for the more heavily used dissector.

3. Have SMPP call the UD decoding function from gsm_sms (after adding it to the header), remove the gsm_sms_ud dissector. Cons: some work to obsolete preferences (or alias them to new gsm_sms preferences), etc.

I lean towards doing the last. As Pascal noted, the gsm_sms_ud dissector is largely dead and less implemented code, so removing it in favor of calling the other dissector seems reasonable. If anyone has any objections I can reconsider.

John Thacker