1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
|
# tcap.cnf
# $Id$
# tcap conformation file
#
#.MODULE_IMPORT
#.EXPORTS
DialoguePDU
UniDialoguePDU
#.REGISTER
DialoguePDU B "0.0.17.773.1.1.1" "dialogue-as-id"
UniDialoguePDU B "0.0.17.773.1.2.1" "uniDialogue-as-id"
#.PDU
#.NO_EMIT
#.TYPE_RENAME
#.FIELD_RENAME
#----------------------------------------------------------------------------------------
#.FN_BODY DialogueOC
tvbuff_t *next_tvb;
gint8 class;
gboolean pc;
gint tag;
guint32 len;
gint ind_field;
offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
offset = dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, &ind_field);
next_tvb = tvb_new_subset(tvb, offset, len-(2*ind_field), len-(2*ind_field));
if (!next_tvb)
return offset;
dissect_tcap_ExternalPDU(TRUE, next_tvb, 0, actx, tree, -1);
return offset+len;
#----------------------------------------------------------------------------------------
#.FN_BODY ExternalPDU
gint8 class;
gboolean pc;
gint tag;
guint32 len;
gint ind_field;
/* Workaround for tagged fields */
offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
offset = dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, &ind_field);
%(DEFAULT_BODY)s
#----------------------------------------------------------------------------------------
#.FN_BODY Dialog1 VAL_PTR = ¶meter_tvb
tvbuff_t *parameter_tvb;
%(DEFAULT_BODY)s
if (!parameter_tvb)
return offset;
dissect_tcap_DialoguePDU(TRUE, tvb, 0, actx, tree, -1);
#.END
#----------------------------------------------------------------------------------------
#.FN_BODY Parameter
tvbuff_t *next_tvb;
gint8 class;
gboolean pc;
gint tag;
guint32 len;
gint ind_field;
offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
offset = dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, &ind_field);
/* need to strip the EOC off the next_tvb */
next_tvb = tvb_new_subset(tvb, offset, len-(2*ind_field), len-(2*ind_field));
if (!next_tvb)
return offset;
dissect_tcap_param(actx,tree,tvb,0);
return offset+len;
#----------------------------------------------------------------------------------------
#.FN_BODY User-information
tvbuff_t *next_tvb;
gint8 class;
gboolean pc;
gint tag;
guint32 len;
gint ind_field;
offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
offset = dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, &ind_field);
next_tvb = tvb_new_subset(tvb, offset, len-(2*ind_field), len-(2*ind_field));
if (!next_tvb)
return offset+len;
dissect_tcap_UserInformation(TRUE, next_tvb, 0, actx, tree, -1);
return offset+len;
#----------------------------------------------------------------------------------------
#.FN_BODY Component
tvbuff_t *next_tvb;
gint8 class;
gboolean pc;
gint tag;
guint32 len, comp_offset;
gint ind_field;
comp_offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
comp_offset = dissect_ber_length(actx->pinfo, tree, tvb, comp_offset, &len, &ind_field);
/* we can believe the length now */
next_tvb = tvb_new_subset(tvb, offset, len+comp_offset-offset, len+comp_offset-offset);
if (!next_tvb)
return comp_offset;
%(DEFAULT_BODY)s
dissect_tcap_ITU_ComponentPDU(implicit_tag, next_tvb, 0, actx, tcap_top_tree, hf_index);
/* return comp_offset+len; or return offset (will be automatically added */
#----------------------------------------------------------------------------------------
#.FN_BODY Applicationcontext FN_VARIANT = _str VAL_PTR = &cur_oid
%(DEFAULT_BODY)s
tcap_private.oid= (void*) cur_oid;
tcap_private.acv=TRUE;
# Do not overwrite the ApplicationContext with the UserInfoOID !
#
#----------------------------------------------------------------------------------------
#.FN_BODY UserInfoOID FN_VARIANT = _str VAL_PTR = &tcapext_oid
%(DEFAULT_BODY)s
#----------------------------------------------------------------------------------------
#.FN_BODY ExternUserInfo
tvbuff_t *next_tvb;
gint8 class;
gboolean pc;
gint tag;
guint32 len, comp_offset;
gint ind_field;
comp_offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
comp_offset = dissect_ber_length(actx->pinfo, tree, tvb, comp_offset, &len, &ind_field);
/* we can believe the length now */
next_tvb = tvb_new_subset(tvb, offset, len+comp_offset-offset, len+comp_offset-offset);
if (!next_tvb)
return comp_offset;
%(DEFAULT_BODY)s
dissect_tcap_TheExternUserInfo(implicit_tag, next_tvb, 0, actx, tcap_top_tree, hf_index);
return comp_offset+len;
#----------------------------------------------------------------------------------------
#.FN_BODY ANSIParameters
/* we are doing the ParamSet here so need to look at the tags*/
guint32 len;
len = tvb_length_remaining(tvb, offset);
if (len > 2) /* arghhh I dont know whether this is constructed or not! */
offset = dissect_tcap_param(actx,tree,tvb,offset);
else
offset = dissect_ber_octet_string(TRUE, actx, tree, tvb, 0, hf_index,
NULL);
#----------------------------------------------------------------------------------------
#.FN_BODY ComponentPDU
tvbuff_t *next_tvb;
gint8 class;
gboolean pc;
gint tag;
guint32 len, comp_offset;
gint ind_field;
comp_offset = dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag);
comp_offset = dissect_ber_length(actx->pinfo, tree, tvb, comp_offset, &len, &ind_field);
/* we can believe the length now */
next_tvb = tvb_new_subset(tvb, offset, len+comp_offset-offset, len+comp_offset-offset);
if (!next_tvb)
return offset;
%(DEFAULT_BODY)s
dissect_tcap_ANSI_ComponentPDU(implicit_tag, next_tvb, 0, actx, tcap_top_tree, hf_index);
#----------------------------------------------------------------------------------------
#.FN_BODY OrigTransactionID
tvbuff_t *parameter_tvb;
guint8 len, i;
proto_item *tid_item;
proto_tree *subtree;
tid_item = proto_tree_add_text(tree, tvb, offset, -1, "Source Transaction ID");
subtree = proto_item_add_subtree(tid_item, ett_otid);
offset = dissect_ber_octet_string(implicit_tag, actx, subtree, tvb, offset, hf_tcap_tid,
¶meter_tvb);
if (parameter_tvb){
len = tvb_length_remaining(parameter_tvb, 0);
switch(len) {
case 1:
gp_tcapsrt_info->src_tid=tvb_get_guint8(parameter_tvb, 0);
break;
case 2:
gp_tcapsrt_info->src_tid=tvb_get_ntohs(parameter_tvb, 0);
break;
case 4:
gp_tcapsrt_info->src_tid=tvb_get_ntohl(parameter_tvb, 0);
break;
default:
gp_tcapsrt_info->src_tid=0;
break;
}
if ((len)&&(check_col(actx->pinfo->cinfo, COL_INFO))){
col_append_str(actx->pinfo->cinfo, COL_INFO, "otid(");
for(i=0;i<len;i++)
col_append_fstr(actx->pinfo->cinfo, COL_INFO, "%%02x",tvb_get_guint8(parameter_tvb,i));
col_append_str(actx->pinfo->cinfo, COL_INFO, ") ");
}
}
#----------------------------------------------------------------------------------------
#.FN_BODY DestTransactionID
tvbuff_t *parameter_tvb;
guint8 len , i;
proto_item *tid_item;
proto_tree *subtree;
tid_item = proto_tree_add_text(tree, tvb, offset, -1, "Destination Transaction ID");
subtree = proto_item_add_subtree(tid_item, ett_otid);
offset = dissect_ber_octet_string(implicit_tag, actx, subtree, tvb, offset, hf_tcap_tid,
¶meter_tvb);
if (parameter_tvb){
len = tvb_length_remaining(parameter_tvb, 0);
switch(len) {
case 1:
gp_tcapsrt_info->dst_tid=tvb_get_guint8(parameter_tvb, 0);
break;
case 2:
gp_tcapsrt_info->dst_tid=tvb_get_ntohs(parameter_tvb, 0);
break;
case 4:
gp_tcapsrt_info->dst_tid=tvb_get_ntohl(parameter_tvb, 0);
break;
default:
gp_tcapsrt_info->dst_tid=0;
break;
}
if ((len)&&(check_col(actx->pinfo->cinfo, COL_INFO))){
col_append_str(actx->pinfo->cinfo, COL_INFO, "dtid(");
for(i=0;i<len;i++)
col_append_fstr(actx->pinfo->cinfo, COL_INFO, "%%02x",tvb_get_guint8(parameter_tvb,i));
col_append_str(actx->pinfo->cinfo, COL_INFO, ") ");
}
}
#.FN_HDR Begin
gp_tcapsrt_info->ope=TC_BEGIN;
/* Do not change col_add_str() to col_append_str() here: we _want_ this call
* to overwrite whatever's currently in the INFO column (e.g., "UDT" from
* the SCCP dissector).
*
* If there's something there that should not be overwritten, whoever
* put that info there should call col_set_fence() to protect it.
*/
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "Begin ");
#.END
#.FN_HDR End
gp_tcapsrt_info->ope=TC_END;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "End ");
#.END
#.FN_HDR Continue
gp_tcapsrt_info->ope=TC_CONT;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "Continue ");
#.END
#.FN_HDR Abort
gp_tcapsrt_info->ope=TC_ABORT;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "Abort ");
#.END
#.FN_HDR AbortPDU
gp_tcapsrt_info->ope=TC_ANSI_ABORT;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "Abort ");
#.END
#.FN_HDR TCMessage/ansiqueryWithPerm
gp_tcapsrt_info->ope=TC_ANSI_ALL;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "QueryWithPerm ");
#.FN_HDR TCMessage/ansiqueryWithoutPerm
gp_tcapsrt_info->ope=TC_ANSI_ALL;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "QueryWithOutPerm ");
#.FN_HDR TCMessage/ansiresponse
gp_tcapsrt_info->ope=TC_ANSI_ALL;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "Response ");
#.FN_HDR TCMessage/ansiconversationWithPerm
gp_tcapsrt_info->ope=TC_ANSI_ALL;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "ConversationWithPerm ");
#.FN_HDR TCMessage/ansiconversationWithoutPerm
gp_tcapsrt_info->ope=TC_ANSI_ALL;
if (check_col(actx->pinfo->cinfo, COL_INFO))
col_set_str(actx->pinfo->cinfo, COL_INFO, "ConversationWithoutPerm ");
#.END
#----------------------------------------------------------------------------------------
#.FN_BODY TransactionID/_untag VAL_PTR = &next_tvb
tvbuff_t *next_tvb;
guint8 len;
%(DEFAULT_BODY)s
if(next_tvb) {
tcap_private.TransactionID_str = tvb_bytes_to_str(next_tvb, 0,tvb_length(next_tvb));
len = tvb_length_remaining(next_tvb, 0);
switch(len) {
case 1:
gp_tcapsrt_info->src_tid=tvb_get_guint8(next_tvb, 0);
break;
case 2:
gp_tcapsrt_info->src_tid=tvb_get_ntohs(next_tvb, 0);
break;
case 4:
gp_tcapsrt_info->src_tid=tvb_get_ntohl(next_tvb, 0);
break;
default:
gp_tcapsrt_info->src_tid=0;
break;
}
}
#.END
|
