rsl: Fix treatment of SACCH FILL / SACCH INFO MODIFY

The RSL SACCH INFO MODIFY / RSL SACCH FILL messages contain a
SI5 / SI6 / SI5bis / SI5ter message.  Those SI are (like the SI on CCCH)
sent as UI frame in downlink direction.  Since Phase 2, the "L2
pseudo-length field is part of the L3 message, and not stripped /
interpreted at L2.

3GPP TS 44.006 states that a special B4 frame format is used on the
SACCH downlink for UI frames, which is basically a normal B frame, but
with no length field at L2, shifting the length field into L3 where it
becomes the L2 pseudo-length.

From RSL, we need to call a variant of the RR dissector that is able to
decode a L3 message that includes a L2 pseudo-length.  This is,
paradoxically, not the "gsm_a_sacch" dissector, as that one is only used
for B-frames, i.e. actual LAPDm ABM frames.  We must use the "gsm_a_ccch"
dissector.

See also the discussion in
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14105
as well as https://lists.osmocom.org/pipermail/openbsc/2017-December/011545.html
and https://osmocom.org/issues/3059 for further background information.

Ping-Bug: 14105
Change-Id: Icdad2b7698d5d7d613cacceec6a3d848b946306c
Reviewed-on: https://code.wireshark.org/review/26797
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/epan/dissectors/packet-rsl.c b/epan/dissectors/packet-rsl.c
index a98438157a..4785a77e7b 100644
--- a/epan/dissectors/packet-rsl.c
+++ b/epan/dissectors/packet-rsl.c
@@ -1355,6 +1355,8 @@ dissect_rsl_ie_L3_inf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int o
        /* L3 PDUs carried on CCCH have L2 PSEUDO LENGTH octet or are RR Short PD format */
        proto_tree_add_item(ie_tree, hf_rsl_llsdu_ccch, tvb, offset, length, ENC_NA);
        next_tvb = tvb_new_subset_length(tvb, offset, length);
+       /* The gsm_a_ccch dissector is the only one handling messages with L2 pseudo-length,
+        * so we pass it also downlink SACCH (SI5/SI6 and related) */
        call_dissector(gsm_a_ccch_handle, next_tvb, pinfo, top_tree);
     }
     else if (type == L3_INF_SACCH)
@@ -3729,7 +3731,7 @@ dissct_rsl_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
         /* L3 Info (SYS INFO)       9.3.11 O 1) TLV 22 */
         if (tvb_reported_length_remaining(tvb, offset) > 0)
            offset = dissect_rsl_ie_L3_inf(tvb, pinfo, tree, offset, FALSE,
-                                          (sys_info_type == 0x48) ? L3_INF_SACCH : L3_INF_OTHER);
+                                          (sys_info_type == 0x48) ? L3_INF_SACCH : L3_INF_CCCH);
         /* Starting Time            9.3.23 O 2) TV 3 */
         if (tvb_reported_length_remaining(tvb, offset) > 0)
             offset = dissect_rsl_ie_starting_time(tvb, pinfo, tree, offset, FALSE);
@@ -4022,7 +4024,7 @@ dissct_rsl_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
         /* L3 Info                  9.3.11  O 1) TLV 22 */
         if (tvb_reported_length_remaining(tvb, offset) > 0)
             offset = dissect_rsl_ie_L3_inf(tvb, pinfo, tree, offset, FALSE,
-                                           (sys_info_type == 0x48) ? L3_INF_SACCH : L3_INF_OTHER);
+                                           (sys_info_type == 0x48) ? L3_INF_SACCH : L3_INF_CCCH);
         /* Starting Time            9.3.23  O 2) TV 3 */
         if (tvb_reported_length_remaining(tvb, offset) > 0)
             offset = dissect_rsl_ie_starting_time(tvb, pinfo, tree, offset, FALSE);