Skip to content

GSM IPA: properly handle PDUs spanning multiple TCP segments

Vadim Yanitskiy requested to merge axilirator/wireshark:fixeria/ipa into master

It may happen that a single IPA PDU gets split over two (or more) TCP packets and we need to dissect this properly. The lack of proper de-segmentation was observed while working on the osmo-epdg project (see OS#6377). A PCAP file demonstrating the problem can be found here, see frames 13 and 15. Below is how re-assembled IPA PDU looks like with the fix applied:

$ tshark -o gsm_ipa.desegment:true -r ~/Downloads/ipa_gsup_bug.pcap.gz -V | less
[2 Reassembled TCP Segments (35 bytes): #13(13), #15(22)]
    [Frame: 13, payload: 0-12 (13 bytes)]
    [Frame: 15, payload: 13-34 (22 bytes)]
    [Segment count: 2]
    [Reassembled TCP length: 35]
    [Reassembled TCP Data: 0020ee0508010862426244489257f405121001001102f121120908696e7465726e6574]
IPA protocol ip.access, type: OSMO EXT GSUP
    DataLen: 32
    Protocol: OSMO EXT (0xee)
    Osmo ext protocol: GSUP (0x05)
GSUP SendAuthInfo Request, IMSI: 262426448429754
    Message Type: SendAuthInfo Request (8)
    IE: IMSI, 262426448429754
        Information Element Identifier: IMSI (1)
        Information Element Length: 8
        IMSI: 262426448429754
        [Association IMSI: 262426448429754]
            Mobile Country Code (MCC): Germany (262)
            Mobile Network Code (MNC): Vodafone GmbH (42)
    IE: PDP Information
        Information Element Identifier: PDP Information (5)
        Information Element Length: 18
        IE: PDP Context ID
            Information Element Identifier: PDP Context ID (16)
            Information Element Length: 1
            PDP Context ID: 0
        IE: PDP Address
            Information Element Identifier: PDP Address (17)
            Information Element Length: 2
            1111 .... = Spare bit(s): 15
            .... 0001 = PDP organization: IETF (1)
            PDP type: IPv4 (33)
        IE: Access Point Name (APN), internet
            Information Element Identifier: Access Point Name (APN) (18)
            Information Element Length: 9
            APN: internet

Merge request reports