* Routines for Q.931 frame disassembly
* Guy Harris <guy@alum.mit.edu>
*
- * $Id: packet-q931.c,v 1.23 2001/02/11 23:19:00 guy Exp $
+ * $Id: packet-q931.c,v 1.42 2002/03/25 20:23:17 guy Exp $
*
* Modified by Andreas Sikkema for possible use with H.323
*
* Ethereal - Network traffic analyzer
- * By Gerald Combs <gerald@zing.org>
+ * By Gerald Combs <gerald@ethereal.com>
* Copyright 1998
- *
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
#include <stdio.h>
#include <glib.h>
#include <string.h>
-#include "packet.h"
-#include "strutil.h"
+#include <epan/packet.h>
+#include <epan/strutil.h>
#include "nlpid.h"
#include "packet-q931.h"
+#include "prefs.h"
-#ifdef H323
#include "packet-tpkt.h"
-#include "packet-h225.h"
-#endif
/* Q.931 references:
*
static gint ett_q931 = -1;
static gint ett_q931_ie = -1;
+/* desegmentation of Q.931 over TPKT over TCP */
+static gboolean q931_desegment = TRUE;
+
+static dissector_handle_t h225_handle;
+static dissector_handle_t q931_tpkt_pdu_handle;
+
/*
* Q.931 message types.
*/
#define Q931_CONNECT_ACK 0x0F
#define Q931_PROGRESS 0x03
#define Q931_SETUP 0x05
-#define Q931_SETUP_ACK 0x0B
+#define Q931_SETUP_ACK 0x0D
#define Q931_HOLD 0x24
#define Q931_HOLD_ACK 0x28
#define Q931_HOLD_REJECT 0x30
#define Q931_STATUS_ENQUIRY 0x75
static const value_string q931_message_type_vals[] = {
- { Q931_ESCAPE, "ESCAPE" },
+ { Q931_ESCAPE, "ESCAPE" },
{ Q931_ALERTING, "ALERTING" },
{ Q931_CALL_PROCEEDING, "CALL PROCEEDING" },
{ Q931_CONNECT, "CONNECT" },
{ 0, NULL }
};
-/*
- * XXX - should this (or, rather, a routine to return a string containing
- * the stuff we put after "Protocol discriminator:") be in "packet-osi.c"?
- *
- * I.e., is the convention that 16-63 and 80-254 are for network-layer
- * or layer-3 protocols, and 64-79 are for national use, specific to
- * Q.931 (and maybe Q.2931), or is it a more general ISO standard?
- */
static void
dissect_q931_protocol_discriminator(tvbuff_t *tvb, int offset, proto_tree *tree)
{
unsigned int discriminator = tvb_get_guint8(tvb, offset);
- char *nlpid_string;
- nlpid_string = match_strval(discriminator, nlpid_vals);
- if (nlpid_string != NULL) {
+ if (discriminator == NLPID_Q_931) {
proto_tree_add_uint_format(tree, hf_q931_discriminator,
tvb, offset, 1, discriminator,
- "Protocol discriminator: %s", nlpid_string);
+ "Protocol discriminator: Q.931");
+ } else if (discriminator == NLPID_Q_2931) {
+ proto_tree_add_uint_format(tree, hf_q931_discriminator,
+ tvb, offset, 1, discriminator,
+ "Protocol discriminator: Q.2931");
+ } else if ((discriminator >= 16 && discriminator < 63)
+ || ((discriminator >= 80) && (discriminator < 254))) {
+ proto_tree_add_uint_format(tree, hf_q931_discriminator,
+ tvb, offset, 1, discriminator,
+ "Protocol discriminator: Network layer or layer 3 protocol (0x%02X)",
+ discriminator);
+ } else if (discriminator >= 64 && discriminator <= 79) {
+ proto_tree_add_uint_format(tree, hf_q931_discriminator,
+ tvb, offset, 1, discriminator,
+ "Protocol discriminator: National use (0x%02X)",
+ discriminator);
} else {
- if ((discriminator >= 16 && discriminator < 63)
- || ((discriminator >= 80) && (discriminator < 254))) {
- proto_tree_add_uint_format(tree, hf_q931_discriminator,
- tvb, offset, 1, discriminator,
- "Protocol discriminator: Network layer or layer 3 protocol (0x%02X)",
- discriminator);
- } else if (discriminator >= 64 && discriminator <= 79) {
- proto_tree_add_uint_format(tree, hf_q931_discriminator,
- tvb, offset, 1, discriminator,
- "Protocol discriminator: National use (0x%02X)",
- discriminator);
- } else {
- proto_tree_add_uint_format(tree, hf_q931_discriminator,
- tvb, offset, 1, discriminator,
- "Protocol discriminator: Reserved (0x%02X)",
- discriminator);
- }
+ proto_tree_add_uint_format(tree, hf_q931_discriminator,
+ tvb, offset, 1, discriminator,
+ "Protocol discriminator: Reserved (0x%02X)",
+ discriminator);
}
}
{ 0x04, "Call delivered" },
{ 0x06, "Call present" },
{ 0x07, "Call received" },
- { 0x09, "Connect request" },
- { 0x0A, "Incoming call proceeding" },
- { 0x0B, "Active" },
- { 0x0C, "Disconnect request" },
- { 0x0F, "Disconnect indication" },
- { 0x11, "Suspend request" },
- { 0x13, "Resume request" },
- { 0x16, "Release request" },
+ { 0x08, "Connect request" },
+ { 0x09, "Incoming call proceeding" },
+ { 0x0A, "Active" },
+ { 0x0B, "Disconnect request" },
+ { 0x0C, "Disconnect indication" },
+ { 0x0F, "Suspend request" },
+ { 0x12, "Resume request" },
+ { 0x13, "Release request" },
+ { 0x16, "Call abort"},
{ 0x19, "Overlap receiving" },
{ 0x3D, "Restart request" },
{ 0x3E, "Restart" },
/*
* Dissect a User-user information element.
*/
-#define Q931_PROTOCOL_DISCRIMINATOR_IA5 0x04
+#define Q931_PROTOCOL_DISCRIMINATOR_IA5 0x04
+#define Q931_PROTOCOL_DISCRIMINATOR_ASN1 0x05
static const value_string q931_protocol_discriminator_vals[] = {
{ 0x00, "User-specific protocol" },
{ 0x01, "OSI high layer protocols" },
{ 0x02, "X.244" },
{ Q931_PROTOCOL_DISCRIMINATOR_IA5, "IA5 characters" },
- { 0x05, "X.208 and X.209 coded user information" },
+ { Q931_PROTOCOL_DISCRIMINATOR_ASN1, "X.208 and X.209 coded user information" },
{ 0x07, "V.120 rate adaption" },
{ 0x08, "Q.931/I.451 user-network call control messages" },
{ 0, NULL }
{ 0x00, NULL },
};
-static gboolean
-q931_dissector(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
- gboolean started_heuristic)
+static void
+dissect_q931_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
+ gboolean is_tpkt)
{
int offset = 0;
- guint reported_length;
proto_tree *q931_tree = NULL;
proto_item *ti;
- proto_tree *ie_tree;
+ proto_tree *ie_tree = NULL;
guint8 call_ref_len;
guint8 call_ref[15];
guint8 message_type;
guint16 info_element_len;
int codeset;
gboolean non_locking_shift;
- guint8 protocol_discriminator;
-
-#ifdef H323
tvbuff_t *h225_tvb;
- gboolean is_h323_h225 = FALSE;
- /*
- * It is very much possible to find a TPKT header here
- * TPKT is defined in RFC 1009 as a wrapper around ISO
- * defined protocols. There could even be several TPKT
- * wrapped messages in one TCP data field...
- * XXXXXXXX THIS IS NOT IMPLEMENTED YET!!! XXXXXXXXXXX
- *
- * For Q.931 related messages this is easy. If a
- * protocol discriminator is found with a value of 3
- * and it's the first discriminator in the Q.931
- * message one can safely assume it to be a TPKT
- * header. See also Q.931 Table 4-1/Q.931
- */
-#endif
- protocol_discriminator = tvb_get_guint8( tvb, offset );
- /* Keep the protocol discriminator for later use */
-
-#ifdef H323
- if ( started_heuristic ) {
- /*
- * The heuristic Q.931 message should conform to this
- */
- if ( protocol_discriminator != NLPID_Q_931 )
- return FALSE;
-
- if ( ! is_tpkt( tvb, &offset ) )
- return FALSE;
-
- if ( tvb_length_remaining( tvb, offset ) <= 3 )
- return FALSE;
- }
-
- /*
- * The first byte should be < 8 (3 is TPKT, rest is Q.931)
- */
- if ( protocol_discriminator < 8 ) {
- /*
- * The minimum length of a Q.931 message is 3:
- * 1 byte for the protocol discriminator,
- * 1 for the call_reference length,
- * and one for the message type.
- */
- if ( tvb_length_remaining( tvb, offset ) <= 3 )
- return FALSE;
-
- /*
- * OK, there are a couple of bytes available, but is there
- * also a protocol discriminator?
- */
- if ( tvb_length_remaining( tvb, offset ) > 3 ) {
- /* Reread the protocol discriminator */
- protocol_discriminator =
- tvb_get_guint8( tvb, offset + 4);
- } else {
- /* No discriminator available */
- protocol_discriminator = 0;
- }
-
- /*
- * If it's not H.323 related Q.931 no heuristic action needed
- * Dangerous, there might be other uses for this code.....
- */
- if ( ( started_heuristic ) && (protocol_discriminator != 8 ) )
- return FALSE;
-
- /*
- * Always check if it's a real TPKT message
- */
- if ( ! is_tpkt( tvb, &offset ) )
- return FALSE;
-
- dissect_tpkt( tvb, &offset, pinfo, tree );
-
- /*
- * Reset the current_proto variable because dissect_tpkt
- * messed with it
- */
- if ( started_heuristic )
- pinfo->current_proto = "Q.931 HEUR";
- else
- pinfo->current_proto = "Q.931";
- }
-#endif
-
- /*
- * The minimum length of a Q.931 message is
- * 3, 1 byte for the protocol discr. 1 for the call_reference length,
- * and one for the message type.
- */
- if ( tvb_length_remaining( tvb, offset ) <= 3 ) {
- return FALSE;
- }
-
- if (check_col(pinfo->fd, COL_PROTOCOL))
- col_set_str(pinfo->fd, COL_PROTOCOL, "Q.931");
+ if (check_col(pinfo->cinfo, COL_PROTOCOL))
+ col_set_str(pinfo->cinfo, COL_PROTOCOL, "Q.931");
if (tree) {
- ti = proto_tree_add_item(tree, proto_q931, tvb, offset,
- tvb_length(tvb), FALSE);
+ ti = proto_tree_add_item(tree, proto_q931, tvb, offset, -1,
+ FALSE);
q931_tree = proto_item_add_subtree(ti, ett_q931);
- dissect_q931_protocol_discriminator( tvb, offset, q931_tree );
+ dissect_q931_protocol_discriminator(tvb, offset, q931_tree);
}
offset += 1;
call_ref_len = tvb_get_guint8(tvb, offset) & 0xF; /* XXX - do as a bit field? */
offset += call_ref_len;
}
message_type = tvb_get_guint8(tvb, offset);
- if (check_col(pinfo->fd, COL_INFO)) {
- col_add_str(pinfo->fd, COL_INFO,
+ if (check_col(pinfo->cinfo, COL_INFO)) {
+ col_add_str(pinfo->cinfo, COL_INFO,
val_to_str(message_type, q931_message_type_vals,
"Unknown message type (0x%02X)"));
}
*/
codeset = 0; /* start out in codeset 0 */
non_locking_shift = TRUE;
- reported_length = tvb_reported_length(tvb);
- while (offset < reported_length) {
+ while (tvb_reported_length_remaining(tvb, offset) > 0) {
info_element = tvb_get_guint8(tvb, offset);
/*
/*
* Variable-length IE.
- */
-#ifndef H323
- info_element_len = tvb_get_guint8(tvb, offset + 1);
-#else
- /*
+ *
* According to page 18 from Recommendation H.225.0 :
* " Length of user-user contents contents
* - Shall be 2 octets instead of 1 (as in Figure 4-36/Q.931)"
- *
- * This will be true for all messages going to / from TCP port
- * 1720 and with the first and fourth octet of the user-user
- * IE having the values 0x7E and 0x05 resp.
- * See http://www.mbuf.org/~moto/h323/h323decoder.html
*
+ * We assume that if this is Q.931-over-TPKT, it might
+ * be H.225 traffic, and check for the IE being a user-user
+ * IE with ASN.1 encoding of the user information.
*/
-
- if ( ( tvb_get_guint8( tvb, offset ) == 0x7E ) &&
- ( tvb_get_guint8( tvb, offset + 3 ) == 0x05 ) &&
- /* ( ( pi.srcport == 1720 ) || ( pi.destport == 1720 ) ) && */
- ( protocol_discriminator == NLPID_Q_931 ) ) {
- info_element_len = tvb_get_ntohs( tvb, offset + 1 );
- is_h323_h225 = TRUE;
- if ( tree == NULL ) {
- h225_tvb = tvb_new_subset( tvb, offset + 4, info_element_len - 1, info_element_len - 1 );
- dissect_h225_cs( h225_tvb, pinfo, tree );
- /*
- * Skip the 4 bytes of the element header and then the element itself
- */
- offset += 4;
- offset += info_element_len - 1;
- }
- } else {
- info_element_len = tvb_get_guint8( tvb, offset + 1 );
- }
-#endif
- if (q931_tree != NULL) {
-#ifdef H323
- if (is_h323_h225) {
+ if (is_tpkt && tvb_bytes_exist(tvb, offset, 4) &&
+ tvb_get_guint8(tvb, offset) == Q931_IE_USER_USER &&
+ tvb_get_guint8(tvb, offset + 3) == Q931_PROTOCOL_DISCRIMINATOR_ASN1) {
+ info_element_len = tvb_get_ntohs(tvb, offset + 1);
+ if (q931_tree != NULL) {
ti = proto_tree_add_text(q931_tree, tvb, offset,
- 1+1+1, "%s",
+ 1+2+info_element_len, "%s",
val_to_str(info_element,
q931_info_element_vals,
"Unknown information element (0x%02X)"));
q931_info_element_vals, "Unknown (0x%02X)"));
proto_tree_add_text(ie_tree, tvb, offset + 1,
2, "Length: %u", info_element_len);
- } else {
-#endif
+ proto_tree_add_text(ie_tree, tvb, offset + 3,
+ 1, "Protocol discriminator: %s",
+ val_to_str(tvb_get_guint8(tvb, offset + 3),
+ q931_protocol_discriminator_vals,
+ "Unknown (0x%02x)"));
+ }
+
+ if (info_element_len > 1) {
+ /*
+ * Do we have a handle for the H.225
+ * dissector?
+ */
+ if (h225_handle != NULL) {
+ /*
+ * Yes - call it, regardless of
+ * whether we're building a
+ * protocol tree or not.
+ */
+ h225_tvb = tvb_new_subset(tvb,
+ offset + 4, info_element_len - 1,
+ info_element_len - 1);
+ call_dissector(h225_handle, h225_tvb,
+ pinfo, tree);
+ } else {
+ /*
+ * No - just show it as "User
+ * information" (if "ie_tree" is
+ * null, this won't add anything).
+ */
+ proto_tree_add_text(ie_tree, tvb,
+ offset + 4, info_element_len - 1,
+ "User information: %s",
+ tvb_bytes_to_str(tvb, offset + 4,
+ info_element_len - 1));
+ }
+ }
+ offset += 1 + 2 + info_element_len;
+ } else {
+ info_element_len = tvb_get_guint8(tvb, offset + 1);
+ if (q931_tree != NULL) {
ti = proto_tree_add_text(q931_tree, tvb, offset,
1+1+info_element_len, "%s",
val_to_str(info_element, q931_info_element_vals,
"Unknown (0x%02X)"));
proto_tree_add_text(ie_tree, tvb, offset + 1, 1,
"Length: %u", info_element_len);
-#ifdef H323
- }
-#endif
- switch (info_element) {
- case Q931_IE_SEGMENTED_MESSAGE:
- dissect_q931_segmented_message_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ switch (info_element) {
- case Q931_IE_BEARER_CAPABILITY:
- case Q931_IE_LOW_LAYER_COMPAT:
- dissect_q931_bearer_capability_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_SEGMENTED_MESSAGE:
+ dissect_q931_segmented_message_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_CAUSE:
- dissect_q931_cause_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_BEARER_CAPABILITY:
+ case Q931_IE_LOW_LAYER_COMPAT:
+ dissect_q931_bearer_capability_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_CALL_STATE:
- dissect_q931_call_state_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_CAUSE:
+ dissect_q931_cause_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_CHANNEL_IDENTIFICATION:
- dissect_q931_channel_identification_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_CALL_STATE:
+ dissect_q931_call_state_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_PROGRESS_INDICATOR:
- dissect_q931_progress_indicator_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_CHANNEL_IDENTIFICATION:
+ dissect_q931_channel_identification_ie(
+ tvb, offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_NETWORK_SPECIFIC_FACIL:
- case Q931_IE_TRANSIT_NETWORK_SEL:
- dissect_q931_ns_facilities_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_PROGRESS_INDICATOR:
+ dissect_q931_progress_indicator_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_NOTIFICATION_INDICATOR:
- dissect_q931_notification_indicator_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_NETWORK_SPECIFIC_FACIL:
+ case Q931_IE_TRANSIT_NETWORK_SEL:
+ dissect_q931_ns_facilities_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_DISPLAY:
- dissect_q931_ia5_ie(tvb, offset + 2,
- info_element_len, ie_tree,
- "Display information");
- break;
+ case Q931_IE_NOTIFICATION_INDICATOR:
+ dissect_q931_notification_indicator_ie(
+ tvb, offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_DATE_TIME:
- dissect_q931_date_time_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_DISPLAY:
+ dissect_q931_ia5_ie(tvb, offset + 2,
+ info_element_len, ie_tree,
+ "Display information");
+ break;
- case Q931_IE_KEYPAD_FACILITY:
- dissect_q931_ia5_ie(tvb, offset + 2,
- info_element_len, ie_tree,
- "Keypad facility");
- break;
+ case Q931_IE_DATE_TIME:
+ dissect_q931_date_time_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_SIGNAL:
- dissect_q931_signal_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_KEYPAD_FACILITY:
+ dissect_q931_ia5_ie(tvb, offset + 2,
+ info_element_len, ie_tree,
+ "Keypad facility");
+ break;
- case Q931_IE_INFORMATION_RATE:
- dissect_q931_information_rate_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_SIGNAL:
+ dissect_q931_signal_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_E2E_TRANSIT_DELAY:
- dissect_q931_e2e_transit_delay_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_INFORMATION_RATE:
+ dissect_q931_information_rate_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_TD_SELECTION_AND_INT:
- dissect_q931_td_selection_and_int_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_E2E_TRANSIT_DELAY:
+ dissect_q931_e2e_transit_delay_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_PL_BINARY_PARAMETERS:
- dissect_q931_pl_binary_parameters_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_TD_SELECTION_AND_INT:
+ dissect_q931_td_selection_and_int_ie(
+ tvb, offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_PL_WINDOW_SIZE:
- dissect_q931_pl_window_size_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_PL_BINARY_PARAMETERS:
+ dissect_q931_pl_binary_parameters_ie(
+ tvb, offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_PACKET_SIZE:
- dissect_q931_packet_size_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_PL_WINDOW_SIZE:
+ dissect_q931_pl_window_size_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_CUG:
- dissect_q931_cug_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_PACKET_SIZE:
+ dissect_q931_packet_size_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_REVERSE_CHARGE_IND:
- dissect_q931_reverse_charge_ind_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_CUG:
+ dissect_q931_cug_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_CALLING_PARTY_NUMBER:
- case Q931_IE_CALLED_PARTY_NUMBER:
- case Q931_IE_REDIRECTING_NUMBER:
- dissect_q931_number_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_REVERSE_CHARGE_IND:
+ dissect_q931_reverse_charge_ind_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_CALLING_PARTY_SUBADDR:
- case Q931_IE_CALLED_PARTY_SUBADDR:
- dissect_q931_party_subaddr_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_CALLING_PARTY_NUMBER:
+ case Q931_IE_CALLED_PARTY_NUMBER:
+ case Q931_IE_REDIRECTING_NUMBER:
+ dissect_q931_number_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_RESTART_INDICATOR:
- dissect_q931_restart_indicator_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_CALLING_PARTY_SUBADDR:
+ case Q931_IE_CALLED_PARTY_SUBADDR:
+ dissect_q931_party_subaddr_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_HIGH_LAYER_COMPAT:
- dissect_q931_high_layer_compat_ie(tvb,
- offset + 2, info_element_len, ie_tree);
- break;
+ case Q931_IE_RESTART_INDICATOR:
+ dissect_q931_restart_indicator_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
- case Q931_IE_USER_USER:
-#ifdef H323
- if (is_h323_h225) {
- h225_tvb = tvb_new_subset(tvb,
- offset + 4, info_element_len - 1,
- info_element_len - 1);
- dissect_h225_cs(h225_tvb, pinfo, tree);
- offset += 3;
- proto_tree_add_text(ie_tree, tvb,
- offset, 1,
- "Protocol discriminator: %s",
- val_to_str(tvb_get_guint8(tvb, offset),
- q931_protocol_discriminator_vals,
- "Unknown (0x%02x)"));
- offset += info_element_len;
- } else {
-#endif
+ case Q931_IE_HIGH_LAYER_COMPAT:
+ dissect_q931_high_layer_compat_ie(tvb,
+ offset + 2, info_element_len,
+ ie_tree);
+ break;
+
+ case Q931_IE_USER_USER:
dissect_q931_user_user_ie(tvb,
offset + 2, info_element_len,
ie_tree);
-#ifdef H323
- }
-#endif
- break;
+ break;
- default:
- proto_tree_add_text(ie_tree, tvb, offset + 2,
- info_element_len, "Data: %s",
- bytes_to_str(
- tvb_get_ptr(tvb, offset + 2, info_element_len),
- info_element_len));
- break;
+ default:
+ proto_tree_add_text(ie_tree, tvb,
+ offset + 2, info_element_len,
+ "Data: %s",
+ bytes_to_str(
+ tvb_get_ptr(tvb, offset + 2,
+ info_element_len),
+ info_element_len));
+ break;
+ }
}
+ offset += 1 + 1 + info_element_len;
}
- offset += 1 + 1 + info_element_len;
if (non_locking_shift)
codeset = 0;
}
+}
+
+/*
+ * Q.931-over-TPKT-over-TCP.
+ */
+static gboolean
+dissect_q931_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+ int lv_tpkt_len;
/*
- * Heuristic should return TRUE if it get's here.
+ * Check whether this looks like a TPKT-encapsulated
+ * Q.931 packet.
*/
+ lv_tpkt_len = is_tpkt(tvb);
+ if (lv_tpkt_len == -1) {
+ /*
+ * It's not a TPKT packet; reject it.
+ */
+ return FALSE;
+ }
- return TRUE;
-
-}
+ /*
+ * If this segment is *exactly* the length of a TPKT header,
+ * we assume that, as it looks like a TPKT header, it
+ * is one, and that the code put a TPKT header in one
+ * segment and the rest of the PDU in another.
+ */
+ if (tvb_length(tvb) == 4) {
+ /*
+ * It is - call the "dissect TPKT over a TCP stream"
+ * routine.
+ */
+ dissect_tpkt_encap(tvb, pinfo, tree, q931_desegment,
+ q931_tpkt_pdu_handle);
+ return TRUE;
+ }
-#ifdef H323
-gboolean
-dissect_q931_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
-{
/*
- * XXX - should this be heuristic, or should we just make
- * port 1720 do Q.931-inside-TPKT; that port appears to be
- * intended for H.323 calls, according to
+ * Well, we have more data than just the TPKT header;
+ * check whether it looks like the beginning of a
+ * Q.931 message.
*
- * http://www.isi.edu/in-notes/iana/assignments/port-numbers
+ * The minimum length of a Q.931 message is 3:
+ * 1 byte for the protocol discriminator,
+ * 1 for the call_reference length,
+ * and one for the message type.
*
- * which says it's for "h323hostcall"?
+ * Check that we have that many bytes past the
+ * TPKT header.
+ */
+ if (!tvb_bytes_exist(tvb, 4, 3))
+ return FALSE;
+
+ /*
+ * And check that we have that many bytes in the TPKT
+ * packet.
*/
- pinfo->current_proto = "Q.931 HEUR";
- return q931_dissector(tvb, pinfo, tree, TRUE);
+ if (lv_tpkt_len < 3)
+ return FALSE;
+
+ /* Check the protocol discriminator */
+ if (tvb_get_guint8(tvb, 4) != NLPID_Q_931) {
+ /* Doesn't look like Q.931 inside TPKT */
+ return FALSE;
+ }
+
+ /*
+ * OK, it looks like Q.931-over-TPKT.
+ * Call the "dissect TPKT over a TCP stream" routine.
+ */
+ dissect_tpkt_encap(tvb, pinfo, tree, q931_desegment,
+ q931_tpkt_pdu_handle);
+
+ return TRUE;
}
-#endif
-void
+static void
+dissect_q931_tpkt_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+ dissect_q931_pdu(tvb, pinfo, tree, TRUE);
+}
+
+static void
dissect_q931(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
- pinfo->current_proto = "Q.931";
- q931_dissector(tvb, pinfo, tree, FALSE);
+ dissect_q931_pdu(tvb, pinfo, tree, FALSE);
}
void
static hf_register_info hf[] = {
{ &hf_q931_discriminator,
{ "Protocol discriminator", "q931.disc", FT_UINT8, BASE_HEX, NULL, 0x0,
- "" }},
+ "", HFILL }},
{ &hf_q931_call_ref_len,
{ "Call reference value length", "q931.call_ref_len", FT_UINT8, BASE_DEC, NULL, 0x0,
- "" }},
+ "", HFILL }},
{ &hf_q931_call_ref,
{ "Call reference value", "q931.call_ref", FT_BYTES, BASE_HEX, NULL, 0x0,
- "" }},
+ "", HFILL }},
{ &hf_q931_message_type,
{ "Message type", "q931.message_type", FT_UINT8, BASE_HEX, VALS(q931_message_type_vals), 0x0,
- "" }},
-
- };
+ "", HFILL }},
+ };
static gint *ett[] = {
&ett_q931,
&ett_q931_ie,
};
+ module_t *q931_module;
proto_q931 = proto_register_protocol("Q.931", "Q.931", "q931");
proto_register_field_array (proto_q931, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
+ register_dissector("q931", dissect_q931, proto_q931);
+ q931_tpkt_pdu_handle = create_dissector_handle(dissect_q931_tpkt_pdu,
+ proto_q931);
+
+ q931_module = prefs_register_protocol(proto_q931, NULL);
+ prefs_register_bool_preference(q931_module, "desegment_h323_messages",
+ "Desegment all Q.931 messages spanning multiple TCP segments",
+ "Whether the Q.931 dissector should desegment all messages spanning multiple TCP segments",
+ &q931_desegment);
}
void
proto_reg_handoff_q931(void)
{
-#ifdef H323
- heur_dissector_add("tcp", dissect_q931_heur);
-#endif
+ /*
+ * Attempt to get a handle for the H.225 dissector.
+ * If we can't, the handle we get is null, and we'll just
+ * dissect putatively-H.255 Call Signaling stuff as User
+ * Information.
+ */
+ h225_handle = find_dissector("h225");
+
+ /*
+ * For H.323.
+ */
+ heur_dissector_add("tcp", dissect_q931_tpkt, proto_q931);
}
git.samba.org / obnox / wireshark / wip.git / blobdiff