diff options
| -rw-r--r-- | doc/README.dissector | 5 | ||||
| -rw-r--r-- | epan/dissectors/packet-gtpv2.c | 4 | ||||
| -rw-r--r-- | epan/proto.c | 24 | ||||
| -rw-r--r-- | epan/proto.h | 4 |
4 files changed, 30 insertions, 7 deletions
diff --git a/doc/README.dissector b/doc/README.dissector index 41297df7ae..ac57159991 100644 --- a/doc/README.dissector +++ b/doc/README.dissector @@ -1604,7 +1604,7 @@ encodings that are currently supported are: timespec with a 4-byte time_t.) ENC_TIME_NTP - 8 bytes; the first 4 bytes are seconds since the NTP - epoch (1901-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of + epoch (1900-01-01 00:00:00 GMT) and the next 4 bytes are 1/2^32's of a second since that second. (I.e., a 64-bit count of 1/2^32's of a second since the NTP epoch, with the upper 32 bits first and the lower 32 bits second, even when little-endian.) @@ -1635,6 +1635,9 @@ encodings that are currently supported are: second since the UN*X epoch; see section 5.3.1 "Timestamp Option" in RFC 3971. + ENC_TIME_MSEC_NTP - 4-8 bytes, representing a count of milliseconds since + the NTP epoch. (I.e., milliseconds since the NTP epoch.) + For FT_RELATIVE_TIME fields, the encoding specifies the form in which the time stamp is specified, as well as its byte order. The time stamp encodings that are currently supported are: diff --git a/epan/dissectors/packet-gtpv2.c b/epan/dissectors/packet-gtpv2.c index d728e3ddb4..e4a88cb2d4 100644 --- a/epan/dissectors/packet-gtpv2.c +++ b/epan/dissectors/packet-gtpv2.c @@ -6475,7 +6475,7 @@ dissect_gtpv2_ms_ts(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, pro * rounded value of 1000 x the value of the 64-bit timestamp (Seconds + (Fraction / (1<<32))) * defined in section 6 of IETF RFC 5905 */ - proto_tree_add_item(tree, hf_gtpv2_ms_ts, tvb, offset, 6, ENC_BIG_ENDIAN); + proto_tree_add_item(tree, hf_gtpv2_ms_ts, tvb, offset, 6, ENC_TIME_MSEC_NTP | ENC_BIG_ENDIAN); } /* @@ -9218,7 +9218,7 @@ void proto_register_gtpv2(void) }, { &hf_gtpv2_ms_ts, { "Millisecond Time Stamp", "gtpv2.ms_ts", - FT_UINT48, BASE_DEC, NULL, 0x0, + FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, NULL, HFILL } }, }; diff --git a/epan/proto.c b/epan/proto.c index fcc4ab0bd8..89fc19cacc 100644 --- a/epan/proto.c +++ b/epan/proto.c @@ -1922,7 +1922,7 @@ get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start, msecs = get_uint64_value(tree, tvb, start, length, encoding); time_stamp->secs = (time_t)(msecs / 1000); - time_stamp->nsecs = (int)(msecs % 1000); + time_stamp->nsecs = (int)(msecs % 1000)*1000000; } else report_type_length_mismatch(tree, "a time-in-milliseconds time stamp", length, TRUE); break; @@ -2032,7 +2032,23 @@ get_time_value(proto_tree *tree, tvbuff_t *tvb, const gint start, } else report_type_length_mismatch(tree, "an NTP seconds-only time stamp", length, TRUE); break; + case ENC_TIME_MSEC_NTP | ENC_BIG_ENDIAN: + /* + * Milliseconds, 1 to 8 bytes. + * For absolute times, it's milliseconds since the + * NTP epoch. + */ + if (length >= 1 && length <= 8) { + guint64 msecs; + msecs = get_uint64_value(tree, tvb, start, length, encoding); + tmpsecs = (guint32)(msecs / 1000); + time_stamp->secs = (time_t)(tmpsecs - (guint32)NTP_BASETIME); + time_stamp->nsecs = (int)(msecs % 1000)*1000000; + } + else + report_type_length_mismatch(tree, "a time-in-milliseconds NTP time stamp", length, TRUE); + break; default: DISSECTOR_ASSERT_NOT_REACHED(); break; @@ -2441,7 +2457,7 @@ proto_tree_new_item(field_info *new_fi, proto_tree *tree, if (encoding == TRUE) encoding = ENC_TIME_TIMESPEC|ENC_LITTLE_ENDIAN; - if (length != 8 && length != 4) { + if (length > 8 || length < 4) { length_error = length < 4 ? TRUE : FALSE; report_type_length_mismatch(tree, "an absolute time value", length, length_error); } @@ -3004,9 +3020,9 @@ proto_tree_add_time_item(proto_tree *tree, int hfindex, tvbuff_t *tvb, } else { const gboolean is_relative = (hfinfo->type == FT_RELATIVE_TIME) ? TRUE : FALSE; + const gboolean length_error = length < 4 ? TRUE : FALSE; - if (length != 8 && length != 4) { - const gboolean length_error = length < 4 ? TRUE : FALSE; + if (length > 8 || length < 4) { if (is_relative) report_type_length_mismatch(tree, "a relative time value", length, length_error); else diff --git a/epan/proto.h b/epan/proto.h index 1ddf718bec..1d937c6443 100644 --- a/epan/proto.h +++ b/epan/proto.h @@ -408,6 +408,9 @@ WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug(const char *message); * ENC_TIME_RFC_3971 - 8 bytes, representing a count of 1/64ths of a * second since the UN*X epoch; see section 5.3.1 "Timestamp Option" * in RFC 3971. + * + * ENC_TIME_MSEC_NTP - 4-8 bytes, representing a count of milliseconds since + * the NTP epoch. (I.e., milliseconds since the NTP epoch.) */ #define ENC_TIME_TIMESPEC 0x00000000 #define ENC_TIME_NTP 0x00000002 @@ -419,6 +422,7 @@ WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug(const char *message); #define ENC_TIME_MSECS 0x00000014 #define ENC_TIME_SECS_NTP 0x00000018 #define ENC_TIME_RFC_3971 0x00000020 +#define ENC_TIME_MSEC_NTP 0x00000022 /* * Historically, the only place the representation mattered for strings |