3 * Routines to dissect WTP component of WAP traffic.
7 * Wireshark - Network traffic analyzer
8 * By Gerald Combs <gerald@wireshark.org>
9 * Copyright 1998 Gerald Combs
11 * WAP dissector based on original work by Ben Fowler
12 * Updated by Neil Hunter <neil.hunter@energis-squared.com>
13 * WTLS support by Alexandre P. Ferreira (Splice IP)
15 * This program is free software; you can redistribute it and/or
16 * modify it under the terms of the GNU General Public License
17 * as published by the Free Software Foundation; either version 2
18 * of the License, or (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
38 #include <epan/packet.h>
39 #include <epan/reassemble.h>
40 #include <epan/emem.h>
41 #include "packet-wap.h"
42 #include "packet-wtp.h"
43 #include "packet-wsp.h"
45 static const true_false_string continue_truth = {
50 static const true_false_string RID_truth = {
55 static const true_false_string TIDNew_truth = {
60 static const true_false_string tid_response_truth = {
65 static const true_false_string UP_truth = {
66 "User Acknowledgement required" ,
67 "User Acknowledgement optional"
70 static const true_false_string TVETOK_truth = {
75 static const value_string vals_wtp_pdu_type[] = {
81 { 5, "Segmented Invoke" },
82 { 6, "Segmented Result" },
83 { 7, "Negative Ack" },
87 static const value_string vals_transaction_trailer[] = {
88 { 0, "Not last packet" },
89 { 1, "Last packet of message" },
90 { 2, "Last packet of group" },
91 { 3, "Re-assembly not supported" },
95 static const value_string vals_version[] = {
103 static const value_string vals_abort_type[] = {
109 static const value_string vals_abort_reason_provider[] = {
111 { 0x01, "Protocol Error" },
112 { 0x02, "Invalid TID" },
113 { 0x03, "Not Implemented Class 2" },
114 { 0x04, "Not Implemented SAR" },
115 { 0x05, "Not Implemented User Acknowledgement" },
116 { 0x06, "WTP Version Zero" },
117 { 0x07, "Capacity Temporarily Exceeded" },
118 { 0x08, "No Response" },
119 { 0x09, "Message Too Large" },
123 static const value_string vals_transaction_classes[] = {
124 { 0x00, "Unreliable Invoke without Result" },
125 { 0x01, "Reliable Invoke without Result" },
126 { 0x02, "Reliable Invoke with Reliable Result" },
130 static const value_string vals_tpi_type[] = {
134 { 0x03, "Packet sequence number" },
135 { 0x04, "SDU boundary" },
136 { 0x05, "Frame boundary" },
140 static const value_string vals_tpi_opt[] = {
141 { 0x01, "Maximum receive unit" },
142 { 0x02, "Total message size" },
143 { 0x03, "Delay transmission timer" },
144 { 0x04, "Maximum group" },
145 { 0x05, "Current TID" },
146 { 0x06, "No cached TID" },
150 /* File scoped variables for the protocol and registered fields */
151 static int proto_wtp = HF_EMPTY;
153 /* These fields used by fixed part of header */
154 static int hf_wtp_header_sub_pdu_size = HF_EMPTY;
155 static int hf_wtp_header_flag_continue = HF_EMPTY;
156 static int hf_wtp_header_pdu_type = HF_EMPTY;
157 static int hf_wtp_header_flag_Trailer = HF_EMPTY;
158 static int hf_wtp_header_flag_RID = HF_EMPTY;
159 static int hf_wtp_header_flag_TID = HF_EMPTY;
160 static int hf_wtp_header_flag_TID_response = HF_EMPTY;
162 /* These fields used by Invoke packets */
163 static int hf_wtp_header_Inv_version = HF_EMPTY;
164 static int hf_wtp_header_Inv_flag_TIDNew = HF_EMPTY;
165 static int hf_wtp_header_Inv_flag_UP = HF_EMPTY;
166 static int hf_wtp_header_Inv_Reserved = HF_EMPTY;
167 static int hf_wtp_header_Inv_TransactionClass = HF_EMPTY;
170 static int hf_wtp_header_variable_part = HF_EMPTY;
171 static int hf_wtp_data = HF_EMPTY;
173 static int hf_wtp_tpi_type = HF_EMPTY;
174 static int hf_wtp_tpi_psn = HF_EMPTY;
175 static int hf_wtp_tpi_opt = HF_EMPTY;
176 static int hf_wtp_tpi_optval = HF_EMPTY;
177 static int hf_wtp_tpi_info = HF_EMPTY;
179 static int hf_wtp_header_Ack_flag_TVETOK = HF_EMPTY;
180 static int hf_wtp_header_Abort_type = HF_EMPTY;
181 static int hf_wtp_header_Abort_reason_provider = HF_EMPTY;
182 static int hf_wtp_header_Abort_reason_user = HF_EMPTY;
183 static int hf_wtp_header_sequence_number = HF_EMPTY;
184 static int hf_wtp_header_missing_packets = HF_EMPTY;
186 /* These fields used when reassembling WTP fragments */
187 static int hf_wtp_fragments = HF_EMPTY;
188 static int hf_wtp_fragment = HF_EMPTY;
189 static int hf_wtp_fragment_overlap = HF_EMPTY;
190 static int hf_wtp_fragment_overlap_conflict = HF_EMPTY;
191 static int hf_wtp_fragment_multiple_tails = HF_EMPTY;
192 static int hf_wtp_fragment_too_long_fragment = HF_EMPTY;
193 static int hf_wtp_fragment_error = HF_EMPTY;
194 static int hf_wtp_reassembled_in = HF_EMPTY;
195 static int hf_wtp_reassembled_length = HF_EMPTY;
197 /* Initialize the subtree pointers */
198 static gint ett_wtp = ETT_EMPTY;
199 static gint ett_wtp_sub_pdu_tree = ETT_EMPTY;
200 static gint ett_header = ETT_EMPTY;
201 static gint ett_tpilist = ETT_EMPTY;
202 static gint ett_wsp_fragments = ETT_EMPTY;
203 static gint ett_wtp_fragment = ETT_EMPTY;
205 static const fragment_items wtp_frag_items = {
210 &hf_wtp_fragment_overlap,
211 &hf_wtp_fragment_overlap_conflict,
212 &hf_wtp_fragment_multiple_tails,
213 &hf_wtp_fragment_too_long_fragment,
214 &hf_wtp_fragment_error,
215 &hf_wtp_reassembled_in,
216 &hf_wtp_reassembled_length,
220 /* Handle for WSP dissector */
221 static dissector_handle_t wsp_handle;
226 static GHashTable *wtp_fragment_table = NULL;
229 wtp_defragment_init(void)
231 fragment_table_init(&wtp_fragment_table);
235 * Extract some bitfields
237 #define pdu_type(octet) (((octet) >> 3) & 0x0F) /* Note pdu type must not be 0x00 */
238 #define transaction_class(octet) ((octet) & 0x03) /* ......XX */
239 #define transmission_trailer(octet) (((octet) >> 1) & 0x01) /* ......X. */
241 static char retransmission_indicator(unsigned char octet)
243 switch (pdu_type(octet)) {
247 case SEGMENTED_INVOKE:
248 case SEGMENTED_RESULT:
250 return octet & 0x01; /* .......X */
260 wtp_handle_tpi(proto_tree *tree, tvbuff_t *tvb)
266 proto_item *subTree = NULL;
268 tByte = tvb_get_guint8(tvb, offset++);
269 tType = (tByte & 0x78) >> 3;
270 if (tByte & 0x04) /* Long TPI */
271 tLen = tvb_get_guint8(tvb, offset++);
274 subTree = proto_tree_add_uint(tree, hf_wtp_tpi_type,
275 tvb, 0, tvb_length(tvb), tType);
276 proto_item_add_subtree(subTree, ett_tpilist);
278 case 0x00: /* Error*/
281 case 0x01: /* Info */
282 /* Beware, untested case here */
283 proto_tree_add_item(subTree, hf_wtp_tpi_info,
284 tvb, offset, tLen, bo_little_endian);
286 case 0x02: /* Option */
287 proto_tree_add_item(subTree, hf_wtp_tpi_opt,
288 tvb, offset++, 1, bo_little_endian);
289 proto_tree_add_item(subTree, hf_wtp_tpi_optval,
290 tvb, offset, tLen - 1, bo_little_endian);
293 proto_tree_add_item(subTree, hf_wtp_tpi_psn,
294 tvb, offset, 1, bo_little_endian);
296 case 0x04: /* SDU boundary */
299 case 0x05: /* Frame boundary */
307 /* Code to actually dissect the packets */
309 dissect_wtp_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
312 int offCur = 0; /* current offset from start of WTP data */
313 gint returned_length, str_index = 0;
317 /* continuation flag */
318 unsigned char fCon; /* Continue flag */
319 unsigned char fRID; /* Re-transmission indicator*/
320 unsigned char fTTR = '\0'; /* Transmission trailer */
321 guint cbHeader = 0; /* Fixed header length */
322 guint vHeader = 0; /* Variable header length*/
325 /* Set up structures we'll need to add the protocol subtree and manage it */
326 proto_item *ti = NULL;
327 proto_tree *wtp_tree = NULL;
330 char clsTransaction = 3;
331 int numMissing = 0; /* Number of missing packets in a negative ack */
333 tvbuff_t *wsp_tvb = NULL;
334 guint8 psn = 0; /* Packet sequence number*/
335 guint16 TID = 0; /* Transaction-Id */
339 #define SZINFO_SIZE 256
340 szInfo=ep_alloc(SZINFO_SIZE);
342 b0 = tvb_get_guint8 (tvb, offCur + 0);
343 /* Discover Concatenated PDUs */
345 guint c_fieldlen = 0; /* Length of length-field */
346 guint c_pdulen = 0; /* Length of conc. PDU */
349 ti = proto_tree_add_item(tree, proto_wtp,
350 tvb, offCur, 1, bo_little_endian);
351 wtp_tree = proto_item_add_subtree(ti, ett_wtp_sub_pdu_tree);
352 proto_item_append_text(ti, ", PDU concatenation");
356 while (offCur < (int) tvb_reported_length(tvb)) {
358 /* The length of an embedded WTP PDU is coded as either:
359 * - a 7-bit value contained in one octet with highest bit == 0.
360 * - a 15-bit value contained in two octets (little endian)
361 * if the 1st octet has its highest bit == 1.
362 * This means that this is NOT encoded as an uintvar-integer!!!
364 b0 = tvb_get_guint8(tvb, offCur + 0);
367 c_pdulen = ((b0 & 0x7f) << 8) | tvb_get_guint8(tvb, offCur + 1);
373 proto_tree_add_uint(wtp_tree, hf_wtp_header_sub_pdu_size,
374 tvb, offCur, c_fieldlen, c_pdulen);
377 col_append_str(pinfo->cinfo, COL_INFO, ", ");
379 /* Skip the length field for the WTP sub-tvb */
380 wtp_tvb = tvb_new_subset(tvb, offCur + c_fieldlen, c_pdulen, c_pdulen);
381 dissect_wtp_common(wtp_tvb, pinfo, wtp_tree);
382 offCur += c_fieldlen + c_pdulen;
386 proto_item_append_text(ti, ", PDU count: %u", i);
390 /* No concatenation */
392 fRID = retransmission_indicator(b0);
396 printf("WTP packet %u: tree = %p, pdu = %s (%u) length: %u\n",
397 pinfo->fd->num, tree,
398 val_to_str(pdut, vals_wtp_pdu_type, "Unknown PDU type 0x%x"),
399 pdut, tvb_length(tvb));
402 /* Develop the string to put in the Info column */
403 returned_length = g_snprintf(szInfo, SZINFO_SIZE, "WTP %s",
404 val_to_str(pdut, vals_wtp_pdu_type, "Unknown PDU type 0x%x"));
405 str_index += MIN(returned_length, SZINFO_SIZE-str_index);
409 fTTR = transmission_trailer(b0);
410 TID = tvb_get_ntohs(tvb, offCur + 1);
412 clsTransaction = transaction_class(tvb_get_guint8(tvb, offCur + 3));
413 returned_length = g_snprintf(&szInfo[str_index], SZINFO_SIZE-str_index,
414 " Class %d", clsTransaction);
415 str_index += MIN(returned_length, SZINFO_SIZE-str_index);
419 case SEGMENTED_INVOKE:
420 case SEGMENTED_RESULT:
421 fTTR = transmission_trailer(b0);
422 TID = tvb_get_ntohs(tvb, offCur + 1);
423 psn = tvb_get_guint8(tvb, offCur + 3);
425 returned_length = g_snprintf(&szInfo[str_index], SZINFO_SIZE-str_index,
427 str_index += MIN(returned_length, SZINFO_SIZE-str_index);
437 fTTR = transmission_trailer(b0);
438 TID = tvb_get_ntohs(tvb, offCur + 1);
448 /* Variable number of missing packets */
449 numMissing = tvb_get_guint8(tvb, offCur + 3);
450 cbHeader = numMissing + 4;
457 returned_length = g_snprintf(&szInfo[str_index], SZINFO_SIZE-str_index, " R" );
458 str_index += MIN(returned_length, SZINFO_SIZE-str_index);
460 /* In the interest of speed, if "tree" is NULL, don't do any work not
461 necessary to generate protocol tree items. */
464 fprintf(stderr, "dissect_wtp: cbHeader = %d\n", cbHeader);
466 /* NOTE - Length will be set when we process the TPI */
467 ti = proto_tree_add_item(tree, proto_wtp, tvb, offCur, 0, bo_little_endian);
469 fprintf(stderr, "dissect_wtp: (7) Returned from proto_tree_add_item\n");
471 wtp_tree = proto_item_add_subtree(ti, ett_wtp);
473 /* Code to process the packet goes here */
475 fprintf(stderr, "dissect_wtp: cbHeader = %d\n", cbHeader);
476 fprintf(stderr, "dissect_wtp: offCur = %d\n", offCur);
478 /* Add common items: only CON and PDU Type */
481 hf_wtp_header_flag_continue, /* id */
483 offCur, /* start of highlight */
484 1, /* length of highlight*/
487 proto_tree_add_item(wtp_tree, hf_wtp_header_pdu_type, tvb, offCur, 1, bo_little_endian);
491 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_Trailer, tvb, offCur, 1, bo_little_endian);
492 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_RID, tvb, offCur, 1, bo_little_endian);
493 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
494 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
496 proto_tree_add_item(wtp_tree, hf_wtp_header_Inv_version , tvb, offCur + 3, 1, bo_little_endian);
497 proto_tree_add_item(wtp_tree, hf_wtp_header_Inv_flag_TIDNew, tvb, offCur + 3, 1, bo_little_endian);
498 proto_tree_add_item(wtp_tree, hf_wtp_header_Inv_flag_UP, tvb, offCur + 3, 1, bo_little_endian);
499 proto_tree_add_item(wtp_tree, hf_wtp_header_Inv_Reserved, tvb, offCur + 3, 1, bo_little_endian);
500 proto_tree_add_item(wtp_tree, hf_wtp_header_Inv_TransactionClass, tvb, offCur + 3, 1, bo_little_endian);
501 proto_item_append_text(ti,
503 ", Transaction Class: %s (%u)",
505 val_to_str(clsTransaction, vals_transaction_classes, "Undefined"),
510 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_Trailer, tvb, offCur, 1, bo_little_endian);
511 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_RID, tvb, offCur, 1, bo_little_endian);
512 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
513 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
514 proto_item_append_text(ti, ", PDU: Result (%u)", RESULT);
518 proto_tree_add_item(wtp_tree, hf_wtp_header_Ack_flag_TVETOK, tvb, offCur, 1, bo_big_endian);
520 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_RID, tvb, offCur, 1, bo_little_endian);
521 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
522 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
523 proto_item_append_text(ti, ", PDU: ACK (%u)", ACK);
527 abortType = tvb_get_guint8 (tvb, offCur) & 0x07;
528 proto_tree_add_item(wtp_tree, hf_wtp_header_Abort_type , tvb, offCur , 1, bo_little_endian);
529 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
530 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
532 if (abortType == PROVIDER)
534 guint8 reason = tvb_get_guint8(tvb, offCur + 3);
535 proto_tree_add_item( wtp_tree, hf_wtp_header_Abort_reason_provider , tvb, offCur + 3 , 1, bo_little_endian);
536 proto_item_append_text(ti,
538 ", Type: Provider (%u)"
542 val_to_str(reason, vals_abort_reason_provider, "Undefined"),
545 else if (abortType == USER)
547 guint8 reason = tvb_get_guint8(tvb, offCur + 3);
548 proto_tree_add_item(wtp_tree, hf_wtp_header_Abort_reason_user , tvb, offCur + 3 , 1, bo_little_endian);
549 proto_item_append_text(ti,
555 val_to_str_ext_const(reason, &vals_wsp_reason_codes_ext, "Undefined"),
560 case SEGMENTED_INVOKE:
561 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_Trailer, tvb, offCur, 1, bo_little_endian);
562 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_RID, tvb, offCur, 1, bo_little_endian);
563 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
564 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
566 proto_tree_add_item(wtp_tree, hf_wtp_header_sequence_number , tvb, offCur + 3, 1, bo_little_endian);
567 proto_item_append_text(ti,
568 ", PDU: Segmented Invoke (%u)"
569 ", Packet Sequence Number: %u",
570 SEGMENTED_INVOKE, psn);
573 case SEGMENTED_RESULT:
574 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_Trailer, tvb, offCur, 1, bo_little_endian);
575 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_RID, tvb, offCur, 1, bo_little_endian);
576 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
577 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
579 proto_tree_add_item(wtp_tree, hf_wtp_header_sequence_number , tvb, offCur + 3, 1, bo_little_endian);
580 proto_item_append_text(ti,
581 ", PDU: Segmented Result (%u)"
582 ", Packet Sequence Number: %u",
583 SEGMENTED_RESULT, psn);
587 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_RID, tvb, offCur, 1, bo_little_endian);
588 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID_response, tvb, offCur + 1, 2, bo_big_endian);
589 proto_tree_add_item(wtp_tree, hf_wtp_header_flag_TID, tvb, offCur + 1, 2, bo_big_endian);
591 proto_tree_add_item(wtp_tree, hf_wtp_header_missing_packets , tvb, offCur + 3, 1, bo_little_endian);
592 /* Iterate through missing packets */
593 for (i = 0; i < numMissing; i++)
595 proto_tree_add_item(wtp_tree, hf_wtp_header_sequence_number, tvb, offCur + 4 + i, 1, bo_little_endian);
597 proto_item_append_text(ti,
598 ", PDU: Negative Ack (%u)"
599 ", Missing Packets: %u",
600 NEGATIVE_ACK, numMissing);
607 proto_item_append_text(ti, ", Retransmission");
609 } else { /* tree is NULL */
611 fprintf(stderr, "dissect_wtp: (4) tree was %p\n", tree);
614 /* Process the variable part */
615 if (fCon) { /* Now, analyze variable part */
618 unsigned char tpiLen;
621 vHeader = 0; /* Start scan all over */
624 tByte = tvb_get_guint8(tvb, offCur + cbHeader + vHeader);
626 if (tByte & 0x04) /* Long TPI */
627 tpiLen = 2 + tvb_get_guint8(tvb,
628 offCur + cbHeader + vHeader + 1);
630 tpiLen = 1 + (tByte & 0x03);
633 tmp_tvb = tvb_new_subset(tvb, offCur + cbHeader + vHeader,
635 wtp_handle_tpi(wtp_tree, tmp_tvb);
640 /* There is no variable part */
641 } /* End of variable part of header */
643 /* Set the length of the WTP protocol part now we know the length of the
644 * fixed and variable WTP headers */
646 proto_item_set_len(ti, cbHeader + vHeader);
649 fprintf( stderr, "dissect_wtp: cbHeader = %d\n", cbHeader );
653 * Any remaining data ought to be WSP data (if not WTP ACK, NACK
654 * or ABORT pdu), so, if we have any remaining data, and it's
655 * not an ACK, NACK, or ABORT PDU, hand it off (defragmented) to the
657 * Note that the last packet of a fragmented WTP message needn't
658 * contain any data, so we allow payloadless packets to be
659 * reassembled. (XXX - does the reassembly code handle this
660 * for packets other than the last packet?)
662 * Try calling a subdissector only if:
663 * - The WTP payload is ressembled in this very packet,
664 * - The WTP payload is not fragmented across packets.
666 dataOffset = offCur + cbHeader + vHeader;
667 dataLen = tvb_reported_length_remaining(tvb, dataOffset);
668 if ((dataLen >= 0) &&
669 ! ((pdut==ACK) || (pdut==NEGATIVE_ACK) || (pdut==ABORT)))
671 /* Try to reassemble if needed, and hand over to WSP
672 * A fragmented WTP packet is either:
673 * - An INVOKE with fTTR (transmission trailer) not set,
674 * - a SEGMENTED_INVOKE,
675 * - A RESULT with fTTR (transmission trailer) not set,
676 * - a SEGMENTED_RESULT.
678 if ( ( (pdut == SEGMENTED_INVOKE) || (pdut == SEGMENTED_RESULT)
679 || ( ((pdut == INVOKE) || (pdut == RESULT)) && (!fTTR) )
680 ) && tvb_bytes_exist(tvb, dataOffset, dataLen) )
682 /* Try reassembling fragments */
683 fragment_data *fd_wtp = NULL;
684 guint32 reassembled_in = 0;
685 gboolean save_fragmented = pinfo->fragmented;
687 pinfo->fragmented = TRUE;
688 fd_wtp = fragment_add_seq(tvb, dataOffset, pinfo, TID,
689 wtp_fragment_table, psn, dataLen, !fTTR);
690 /* XXX - fragment_add_seq() yields NULL unless Wireshark knows
691 * that the packet is part of a reassembled whole. This means
692 * that fd_wtp will be NULL as long as Wireshark did not encounter
693 * (and process) the packet containing the last fragment.
694 * This implies that Wireshark needs two passes over the data for
695 * correct reassembly. At the first pass, a capture containing
696 * three fragments plus a retransmssion of the last fragment
697 * will progressively show:
699 * Packet 1: (Unreassembled fragment 1)
700 * Packet 2: (Unreassembled fragment 2)
701 * Packet 3: (Reassembled WTP)
702 * Packet 4: (WTP payload reassembled in packet 3)
704 * However at subsequent evaluation (e.g., by applying a display
705 * filter) the packet summary will show:
707 * Packet 1: (WTP payload reassembled in packet 3)
708 * Packet 2: (WTP payload reassembled in packet 3)
709 * Packet 3: (Reassembled WTP)
710 * Packet 4: (WTP payload reassembled in packet 3)
712 * This is important to know, and also affects read filters!
714 wsp_tvb = process_reassembled_data(tvb, dataOffset, pinfo,
715 "Reassembled WTP", fd_wtp, &wtp_frag_items,
718 printf("WTP: Packet %u %s -> %d: wsp_tvb = %p, fd_wtp = %p, frame = %u\n",
720 fd_wtp ? "Reassembled" : "Not reassembled",
721 fd_wtp ? fd_wtp->reassembled_in : -1,
728 reassembled_in = fd_wtp->reassembled_in;
729 if (pinfo->fd->num == reassembled_in) {
730 /* Reassembled in this very packet:
731 * We can safely hand the tvb to the WSP dissector */
732 call_dissector(wsp_handle, wsp_tvb, pinfo, tree);
734 /* Not reassembled in this packet */
735 if (check_col(pinfo->cinfo, COL_INFO)) {
736 col_append_fstr(pinfo->cinfo, COL_INFO,
737 "%s (WTP payload reassembled in packet %u)",
738 szInfo, fd_wtp->reassembled_in);
741 proto_tree_add_text(wtp_tree, tvb, dataOffset, -1,
746 /* Not reassembled yet, or not reassembled at all */
747 if (check_col(pinfo->cinfo, COL_INFO)) {
748 col_append_fstr(pinfo->cinfo, COL_INFO,
749 "%s (Unreassembled fragment %u)",
753 proto_tree_add_text(wtp_tree, tvb, dataOffset, -1,
757 /* Now reset fragmentation information in pinfo */
758 pinfo->fragmented = save_fragmented;
760 else if ( ((pdut == INVOKE) || (pdut == RESULT)) && (fTTR) )
762 /* Non-fragmented payload */
763 wsp_tvb = tvb_new_subset_remaining(tvb, dataOffset);
764 /* We can safely hand the tvb to the WSP dissector */
765 call_dissector(wsp_handle, wsp_tvb, pinfo, tree);
769 /* Nothing to hand to subdissector */
770 if (check_col(pinfo->cinfo, COL_INFO))
771 col_append_str(pinfo->cinfo, COL_INFO, szInfo);
776 /* Nothing to hand to subdissector */
777 if (check_col(pinfo->cinfo, COL_INFO))
778 col_append_str(pinfo->cinfo, COL_INFO, szInfo);
783 * Called directly from UDP.
784 * Put "WTP+WSP" into the "Protocol" column.
787 dissect_wtp_fromudp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
789 col_set_str(pinfo->cinfo, COL_PROTOCOL, "WTP+WSP");
790 col_clear(pinfo->cinfo, COL_INFO);
792 dissect_wtp_common(tvb, pinfo, tree);
796 * Called from a higher-level WAP dissector, presumably WTLS.
797 * Put "WTLS+WSP+WTP" to the "Protocol" column.
799 * XXX - is this supposed to be called from WTLS? If so, we're not
802 * XXX - can this be called from any other dissector?
805 dissect_wtp_fromwtls(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
807 col_set_str(pinfo->cinfo, COL_PROTOCOL, "WTLS+WTP+WSP");
808 col_clear(pinfo->cinfo, COL_INFO);
810 dissect_wtp_common(tvb, pinfo, tree);
813 /* Register the protocol with Wireshark */
815 proto_register_wtp(void)
818 /* Setup list of header fields */
819 static hf_register_info hf[] = {
820 { &hf_wtp_header_sub_pdu_size,
823 FT_UINT16, BASE_DEC, NULL, 0x0,
824 "Size of Sub-PDU (bytes)", HFILL
827 { &hf_wtp_header_flag_continue,
830 FT_BOOLEAN, 8, TFS( &continue_truth ), 0x80,
834 { &hf_wtp_header_pdu_type,
837 FT_UINT8, BASE_HEX, VALS( vals_wtp_pdu_type ), 0x78,
841 { &hf_wtp_header_flag_Trailer,
844 FT_UINT8, BASE_HEX, VALS( vals_transaction_trailer ), 0x06,
848 { &hf_wtp_header_flag_RID,
849 { "Re-transmission Indicator",
851 FT_BOOLEAN, 8, TFS( &RID_truth ), 0x01,
855 { &hf_wtp_header_flag_TID_response,
858 FT_BOOLEAN, 16, TFS( &tid_response_truth ), 0x8000,
862 { &hf_wtp_header_flag_TID,
865 FT_UINT16, BASE_HEX, NULL, 0x7FFF,
869 { &hf_wtp_header_Inv_version,
871 "wtp.header.version",
872 FT_UINT8, BASE_HEX, VALS( vals_version ), 0xC0,
876 { &hf_wtp_header_Inv_flag_TIDNew,
879 FT_BOOLEAN, 8, TFS( &TIDNew_truth ), 0x20,
883 { &hf_wtp_header_Inv_flag_UP,
886 FT_BOOLEAN, 8, TFS( &UP_truth ), 0x10,
890 { &hf_wtp_header_Inv_Reserved,
893 FT_UINT8, BASE_HEX, NULL, 0x0C,
897 { &hf_wtp_header_Inv_TransactionClass,
898 { "Transaction Class",
899 "wtp.inv.transaction_class",
900 FT_UINT8, BASE_HEX, VALS( vals_transaction_classes ), 0x03,
904 { &hf_wtp_header_Ack_flag_TVETOK,
907 FT_BOOLEAN, 8, TFS( &TVETOK_truth ), 0x04,
911 { &hf_wtp_header_Abort_type,
914 FT_UINT8, BASE_HEX, VALS ( vals_abort_type ), 0x07,
918 { &hf_wtp_header_Abort_reason_provider,
920 "wtp.abort.reason.provider",
921 FT_UINT8, BASE_HEX, VALS ( vals_abort_reason_provider ), 0x00,
925 /* Assume WSP is the user and use its reason codes */
926 { &hf_wtp_header_Abort_reason_user,
928 "wtp.abort.reason.user",
929 FT_UINT8, BASE_HEX|BASE_EXT_STRING, &vals_wsp_reason_codes_ext, 0x00,
933 { &hf_wtp_header_sequence_number,
934 { "Packet Sequence Number",
935 "wtp.header.sequence",
936 FT_UINT8, BASE_DEC, NULL, 0x00,
940 { &hf_wtp_header_missing_packets,
942 "wtp.header.missing_packets",
943 FT_UINT8, BASE_DEC, NULL, 0x00,
947 { &hf_wtp_header_variable_part,
948 { "Header: Variable part",
949 "wtp.header_variable_part",
950 FT_BYTES, BASE_NONE, NULL, 0x0,
951 "Variable part of the header", HFILL
957 FT_BYTES, BASE_NONE, NULL, 0x0,
964 FT_UINT8, BASE_HEX, VALS(vals_tpi_type), 0x00,
965 "Identification of the Transport Information Item", HFILL
969 { "Packet sequence number",
971 FT_UINT8, BASE_DEC, NULL, 0x00,
972 "Sequence number of this packet", HFILL
978 FT_UINT8, BASE_HEX, VALS(vals_tpi_opt), 0x00,
979 "The given option for this TPI", HFILL
982 { &hf_wtp_tpi_optval,
985 FT_NONE, BASE_NONE, NULL, 0x00,
986 "The value that is supplied with this option", HFILL
992 FT_NONE, BASE_NONE, NULL, 0x00,
993 "The information being send by this TPI", HFILL
997 /* Fragment fields */
998 { &hf_wtp_fragment_overlap,
999 { "Fragment overlap",
1000 "wtp.fragment.overlap",
1001 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1002 "Fragment overlaps with other fragments", HFILL
1005 { &hf_wtp_fragment_overlap_conflict,
1006 { "Conflicting data in fragment overlap",
1007 "wtp.fragment.overlap.conflict",
1008 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1009 "Overlapping fragments contained conflicting data", HFILL
1012 { &hf_wtp_fragment_multiple_tails,
1013 { "Multiple tail fragments found",
1014 "wtp.fragment.multipletails",
1015 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1016 "Several tails were found when defragmenting the packet", HFILL
1019 { &hf_wtp_fragment_too_long_fragment,
1020 { "Fragment too long",
1021 "wtp.fragment.toolongfragment",
1022 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1023 "Fragment contained data past end of packet", HFILL
1026 { &hf_wtp_fragment_error,
1027 { "Defragmentation error",
1028 "wtp.fragment.error",
1029 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1030 "Defragmentation error due to illegal fragments", HFILL
1033 { &hf_wtp_reassembled_in,
1035 "wtp.reassembled.in",
1036 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1037 "WTP fragments are reassembled in the given packet", HFILL
1040 { &hf_wtp_reassembled_length,
1041 { "Reassembled WTP length",
1042 "wtp.reassembled.length",
1043 FT_UINT32, BASE_DEC, NULL, 0x0,
1044 "The total length of the reassembled payload", HFILL
1050 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1054 { &hf_wtp_fragments,
1057 FT_NONE, BASE_NONE, NULL, 0x0,
1063 /* Setup protocol subtree array */
1064 static gint *ett[] = {
1066 &ett_wtp_sub_pdu_tree,
1073 /* Register the protocol name and description */
1074 proto_wtp = proto_register_protocol(
1075 "Wireless Transaction Protocol", /* protocol name for use by wireshark */
1076 "WTP", /* short version of name */
1077 "wtp" /* Abbreviated protocol name, should Match IANA
1078 < URL:http://www.iana.org/assignments/port-numbers/ >
1082 /* Required calls to register the header fields and subtrees used */
1083 proto_register_field_array(proto_wtp, hf, array_length(hf));
1084 proto_register_subtree_array(ett, array_length(ett));
1086 register_dissector("wtp-wtls", dissect_wtp_fromwtls, proto_wtp);
1087 register_dissector("wtp-udp", dissect_wtp_fromudp, proto_wtp);
1088 register_init_routine(wtp_defragment_init);
1092 proto_reg_handoff_wtp(void)
1094 dissector_handle_t wtp_fromudp_handle;
1097 * Get a handle for the connection-oriented WSP dissector - if WTP
1098 * PDUs have data, it is WSP.
1100 wsp_handle = find_dissector("wsp-co");
1102 wtp_fromudp_handle = find_dissector("wtp-udp");
1103 dissector_add_uint("udp.port", UDP_PORT_WTP_WSP, wtp_fromudp_handle);
1104 dissector_add_uint("gsm-sms-ud.udh.port", UDP_PORT_WTP_WSP, wtp_fromudp_handle);
1105 dissector_add_uint("gsm-sms.udh.port", UDP_PORT_WTP_WSP, wtp_fromudp_handle);