I'm not ASN.1 expert either, but it appears that the existing "asn1_tag_decode()" only works for the "high tag number" format (multi-octet) tag IDs. In particular, it assumes that bit 8 will be set on low-tag-number identifiers (but this isn't necessarily the case).
Oops, no, that's not the problem...
The problem is that the TCAP dissector is using 'asn1_tag_decode()' instead of 'asn1_id_decode()' (which does the work for dealing with low and high tag number formats).
However, the TCAP dissector wants the tag to include the Class, Constructor, and Tag bits all combined together...
So there are 3 options:
1) Rewrite a bunch of the TCAP dissector to look at tag IDs as a triplet (class, constructor, tag number)
- this probably has negative filtering consequences: users will probably want to filter on "tcap.msgtype == 0x62" instead of just the tag number
2) Make 'asn1_tag_decode_m()' a wrapper around 'asn1_id_decode()' that then squishes the class, constructor, and tag number back together
3) Change the comment for (and maybe the name of) 'asn1_tag_decode_m()' to indicate why that function is used instead of 'asn1_id_decode()'
The attached patch does #3.
Michael Lum wrote:
That was in the original file from Samuel Qu so I don't know why he thought it was necessary to override it.
I believe the difference is this part:
ret = asn1_octet_decode (asn1, &ch); if (ret != ASN1_ERR_NOERROR) return ret; if ((ch & 0x1f) != 0x1f) { *tag = ch; return ASN1_ERR_NOERROR; } else { *tag = ch >> 5; }
I don't know enough about ASN1 to recognize the significance of 0x1f.
-----Original Message----- From: Guy Harris [mailto:[EMAIL PROTECTED] Sent: Thursday, September 11, 2003 1:16 AM To: Michael Lum Cc: Jeff Morriss; Ethereal Development List Subject: Re: [Ethereal-dev] ITU/ANSI TCAP dissector
On Wed, Sep 10, 2003 at 09:32:40AM -0700, Michael Lum wrote:
Here's mine as well.
The file compiled perfectly clean on SPARC with gcc.
It still got some warnings - Jeff Morris' patches fixed them; the functions
dissect_ansi_tcap_reject dissect_ansi_tcap_re dissect_ansi_tcap_rr dissect_ansi_tcap_invoke dissect_tcap_invoke dissect_tcap_rr dissect_tcap_reject
need to return "void", not "int".
Also, what is the significance of "asn1_tag_decode_m()"? The comment says
/* to make the source file easy to be contributed , override this function */ /* so there is no need to modify asn1.c(with a bug) any more */
Does that mean that "asn1_tag_decode()" in asn1.c is buggy? If so, then it should be fixed, not overridden.
_______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
tcap-asn1.patch.gz
Description: GNU Zip compressed data
