Wireshark · Ethereal-dev: [Ethereal-dev] Please review: Evaluating FCS bit in radiotap header

[Joerg Mayer <jmayer@xxxxxxxxx>]

The attached patch should properly indicate whether a packet in radiotap
format has an fcs or not. As I a) don't have a sample capture and b) am
not sure I've uderstood the evalutation process during packet reading
correctly I'd be happy if someone could have a look at the patch before
it is committed.

Thanks
       Joerg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.

Index: epan/dissectors/packet-radiotap.c
===================================================================
--- epan/dissectors/packet-radiotap.c	(revision 14641)
+++ epan/dissectors/packet-radiotap.c	(working copy)
@@ -72,6 +72,7 @@
     IEEE80211_RADIOTAP_ANTENNA = 11,
     IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
     IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
+    IEEE80211_RADIOTAP_FCS = 14,
     IEEE80211_RADIOTAP_EXT = 31
 };
 
@@ -287,7 +288,7 @@
     offset+=sizeof(struct ieee80211_radiotap_header);
 
     if(check_col(pinfo->cinfo, COL_INFO))
-	col_add_fstr(pinfo->cinfo, COL_INFO, "Radiotap Capture v%x, Length %d",
+	col_add_fstr(pinfo->cinfo, COL_INFO, "Radiotap Capture v%x, Length %u",
 		version, length);
 
     /* Dissect the packet */
Index: wiretap/libpcap.c
===================================================================
--- wiretap/libpcap.c	(revision 14641)
+++ wiretap/libpcap.c	(working copy)
@@ -1204,7 +1204,6 @@
 
 	case WTAP_ENCAP_IEEE_802_11:
 	case WTAP_ENCAP_PRISM_HEADER:
-	case WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP:
 	case WTAP_ENCAP_IEEE_802_11_WLAN_AVS:
 		/*
 		 * We don't know whether there's an FCS in this frame or not.
@@ -1271,7 +1270,30 @@
 	wth->phdr.caplen = packet_size;
 	wth->phdr.len = orig_size;
 
-	if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+	switch (wth->file_encap) {
+
+	case WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP:
+		/*
+		 * Bit 14 definitely decides whether the frame is
+		 * followed by an FCS or not.
+		 */
+		if (packet_size < 8) {
+			/*
+			 * Too short to parse the minimum size radiotap header.
+			 */
+			*err = WTAP_ERR_BAD_RECORD;
+			*err_info = g_strdup_printf("libpcap: file has a %u-byte packet, too small to have a radiotap header\n",
+				    packet_size);
+				return FALSE;
+		}
+		wth->pseudo_header.ieee_802_11.fcs_len = 0;
+		/* IEEE80211_RADIOTAP_FCS = Bit 14, little endian */
+		if (*(buffer_start_ptr(wth->frame_buffer) + 5) & 64) {
+	                wth->pseudo_header.ieee_802_11.fcs_len = 4;
+		}
+		break;
+
+	case WTAP_ENCAP_ATM_PDUS:
 		if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
 			/*
 			 * Nokia IPSO ATM.
@@ -1294,6 +1316,7 @@
 				    wth->phdr.caplen, &wth->pseudo_header);
 			}
 		}
+		break;
 	}
 
 	return TRUE;