RSL dissector bugs in presence of optional IEs

This issue was migrated from bug 15789 in our old bug tracker.

Original bug information:

Reporter: Harald Welte
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: All
Platform: All
Version: Git

Attachments:

rsl-err_ind_bug.pcap: PCAP file with RSL ERR REP without optional LINK ID

See also: Issue #15790 (closed)

Harald Welte said:

Created attachment 17129

PCAP file with RSL ERR REP without optional LINK ID

Build Information:

Paste the COMPLETE build information from "Help->About Wireshark", "wireshark -v", or "tshark -v".

The RSL dissector is implemented in a way that it doesn't actually follow the tags of the TLV structure of the RSL protocol.  Instead, it makes "blind" assumptions: If a message is longer than X, there must be another IE of type Y.

Those assumptions work suprisingly well in most situations, as a lot of IEs are mandatory, and optional IEs are mostly at the end.

However, it horribly breaks in case of a sequence of multiple optional IEs, where any one but the very last one are missing.

One good example of this is the RSL ERROR REPORT message, as described in 3GPP TS 48.058 Section 8.6.4.  It contains four optional IEs, and there is no guarantee that if the third optioanl IE (Link Identifier) is present, the previous optional IEs (Message Identifier, Channel Number) are actually present.

The dissector needs to be fixed to actually take the IEI (Tag) into account when dissecting such messages.

Other messages where I expect the same problem:
* SACCH FILLING, SACCH INFO MODIFY or BCCH INFO in case of L3 info being absent, but starting time present
* NOTIFICATION COMMAND in case group call reference being absent, but channel description or NCH DRX INFO being present
* PAGING COMMAND in case Channel NEeded is absent but eMPLL Priority or DRX Info is present
* TFO MODIFICATION REQUEST in case TFO transport container is present but supported codec type is absent
* MEASUREMENT RESULT in case MS Timing Offset being included but L3 INFO and/or L1 INFO being absent

I'm attaching an example pcap file which has an absent optional LINK ID but a present "Erroneous Message".  That Erroneous Message IE is then wrongly decoded as "Link Identifier" by the dissector.

added libwireshark versiondev labels

Gerrit Code Review said:

Change 33269 had a related patch set uploaded by Hoernchen: Fix for incorrectly decoded RSL ERR REP/BCCH INFORMATION optional IEs

https://code.wireshark.org/review/33269

Harald Welte said:

the patch by Hoernchen fixes the issue, it should be merged.

Gerrit Code Review said:

Change 33269 merged by Anders Broman: Fix for incorrectly decoded RSL ERR REP/BCCH INFORMATION optional IEs

https://code.wireshark.org/review/33269

Gerrit Code Review said:

Change 33388 had a related patch set uploaded by Jaap Keuter: Fix for incorrectly decoded RSL ERR REP/BCCH INFORMATION optional IEs

https://code.wireshark.org/review/33388

Gerrit Code Review said:

Change 33389 had a related patch set uploaded by Jaap Keuter: Fix for incorrectly decoded RSL ERR REP/BCCH INFORMATION optional IEs

https://code.wireshark.org/review/33389

Gerrit Code Review said:

Change 33388 merged by Anders Broman: Fix for incorrectly decoded RSL ERR REP/BCCH INFORMATION optional IEs

https://code.wireshark.org/review/33388

Gerrit Code Review said:

Change 33389 merged by Anders Broman: Fix for incorrectly decoded RSL ERR REP/BCCH INFORMATION optional IEs

https://code.wireshark.org/review/33389

mentioned in issue #15790 (closed)

closed