epan/dissectors/packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) packet disassembly
   3  * John Thomes <john@ensemblecom.com>
   4  *
   5  * Minor changes by: (2000-01-10)
   6  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   7  * Thomas Parvais <thomas.parvais@advalvas.be>
   8  *
   9  * Added RFC 5515 by Uli Heilmeier <uh@heilmeier.eu>, 2016-02-29
  10  *
  11  * Ericsson L2TP by Harald Welte <laforge@gnumonks.org>, 2016-07-16
  12  *
  13  * Wireshark - Network traffic analyzer
  14  * By Gerald Combs <gerald@wireshark.org>
  15  * Copyright 1998 Gerald Combs
  16  *
  17  * This program is free software; you can redistribute it and/or
  18  * modify it under the terms of the GNU General Public License
  19  * as published by the Free Software Foundation; either version 2
  20  * of the License, or (at your option) any later version.
  21  *
  22  * This program is distributed in the hope that it will be useful,
  23  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  * GNU General Public License for more details.
  26  *
  27  * You should have received a copy of the GNU General Public License
  28  * along with this program; if not, write to the Free Software
  29  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  30  */
  31
  32 /*
  33  * RFC 2661 for L2TPv2
  34  * http://tools.ietf.org/html/rfc2661
  35  *
  36  * RFC 3931 for L2TPv3
  37  * http://tools.ietf.org/html/rfc3931
  38  *
  39  * Layer Two Tunneling Protocol "L2TP" number assignments:
  40  *     http://www.iana.org/assignments/l2tp-parameters
  41  *
  42  * Pseudowire types:
  43  *
  44  * RFC 4591 for Frame Relay
  45  * http://tools.ietf.org/html/rfc4591
  46  *
  47  * RFC 4454 for ATM
  48  * http://tools.ietf.org/html/rfc4454
  49  *
  50  * RFC 4719 for Ethernet
  51  * http://tools.ietf.org/html/rfc4719
  52  *
  53  * RFC 4349 for HDLC
  54  * http://tools.ietf.org/html/rfc4349
  55  *
  56  * XXX - what about LAPD?
  57  */
  58
  59 #include "config.h"
  60
  61 #include <epan/packet.h>
  62 #include <epan/ipproto.h>
  63 #include <epan/sminmpec.h>
  64 #include <epan/addr_resolv.h>
  65 #include <epan/prefs.h>
  66 #include <epan/conversation.h>
  67 #include <epan/expert.h>
  68 #include <epan/decode_as.h>
  69 #include <epan/proto_data.h>
  70
  71 #include <wsutil/wsgcrypt.h>
  72
  73 #include "packet-l2tp.h"
  74
  75 void proto_register_l2tp(void);
  76 void proto_reg_handoff_l2tp(void);
  77
  78 static int proto_l2tp = -1;
  79 static int hf_l2tp_type = -1;
  80 static int hf_l2tp_length_bit = -1;
  81 static int hf_l2tp_seq_bit = -1;
  82 static int hf_l2tp_offset_bit = -1;
  83 static int hf_l2tp_priority = -1;
  84 static int hf_l2tp_version = -1;
  85 static int hf_l2tp_length = -1;
  86 static int hf_l2tp_tunnel = -1;
  87 static int hf_l2tp_session = -1;
  88 static int hf_l2tp_Ns = -1;
  89 static int hf_l2tp_Nr = -1;
  90 static int hf_l2tp_offset = -1;
  91 static int hf_l2tp_avp_mandatory = -1;
  92 static int hf_l2tp_avp_hidden = -1;
  93 static int hf_l2tp_avp_length = -1;
  94 static int hf_l2tp_avp_vendor_id = -1;
  95 static int hf_l2tp_avp_type = -1;
  96 static int hf_l2tp_tie_breaker = -1;
  97 static int hf_l2tp_sid = -1;
  98 static int hf_l2tp_res = -1;
  99 static int hf_l2tp_ccid = -1;
 100 static int hf_l2tp_cookie = -1;
 101 static int hf_l2tp_l2_spec_def = -1;
 102 static int hf_l2tp_l2_spec_atm = -1;
 103 static int hf_l2tp_l2_spec_docsis_dmpt = -1;
 104 static int hf_l2tp_l2_spec_v = -1;
 105 static int hf_l2tp_l2_spec_s = -1;
 106 static int hf_l2tp_l2_spec_h = -1;
 107 static int hf_l2tp_l2_spec_flow_id = -1;
 108 static int hf_l2tp_l2_spec_sequence = -1;
 109 static int hf_l2tp_l2_spec_t = -1;
 110 static int hf_l2tp_l2_spec_g = -1;
 111 static int hf_l2tp_l2_spec_c = -1;
 112 static int hf_l2tp_l2_spec_u = -1;
 113 static int hf_l2tp_cisco_avp_type = -1;
 114 static int hf_l2tp_ericsson_avp_type = -1;
 115 static int hf_l2tp_broadband_avp_type = -1;
 116 static int hf_l2tp_cablelabs_avp_type = -1;
 117 static int hf_l2tp_avp_message_type = -1;
 118 static int hf_l2tp_avp_assigned_tunnel_id = -1;
 119 static int hf_l2tp_avp_assigned_control_conn_id = -1;
 120 static int hf_l2tp_avp_assigned_session_id = -1;
 121 static int hf_l2tp_avp_remote_session_id = -1;
 122 static int hf_l2tp_avp_local_session_id = -1;
 123 static int hf_l2tp_avp_called_number = -1;
 124 static int hf_l2tp_avp_calling_number = -1;
 125 static int hf_l2tp_cisco_tie_breaker = -1;
 126 static int hf_l2tp_cablel_avp_l_bit = -1;
 127 static int hf_l2tp_cablel_avp_tsid_group_id = -1;
 128 static int hf_l2tp_cablel_avp_frequency = -1;
 129 static int hf_l2tp_cablel_avp_modulation = -1;
 130 static int hf_l2tp_cablel_avp_m = -1;
 131 static int hf_l2tp_cablel_avp_n = -1;
 132 static int hf_l2tp_broadband_agent_circuit_id = -1;
 133 static int hf_l2tp_broadband_agent_remote_id = -1;
 134 static int hf_l2tp_broadband_actual_dr_up = -1;
 135 static int hf_l2tp_broadband_actual_dr_down = -1;
 136 static int hf_l2tp_broadband_minimum_dr_up = -1;
 137 static int hf_l2tp_broadband_minimum_dr_down = -1;
 138 static int hf_l2tp_broadband_attainable_dr_up = -1;
 139 static int hf_l2tp_broadband_attainable_dr_down = -1;
 140 static int hf_l2tp_broadband_maximum_dr_up = -1;
 141 static int hf_l2tp_broadband_maximum_dr_down = -1;
 142 static int hf_l2tp_broadband_minimum_dr_up_low_power = -1;
 143 static int hf_l2tp_broadband_minimum_dr_down_low_power = -1;
 144 static int hf_l2tp_broadband_maximum_interleaving_delay_up = -1;
 145 static int hf_l2tp_broadband_actual_interleaving_delay_up = -1;
 146 static int hf_l2tp_broadband_maximum_interleaving_delay_down = -1;
 147 static int hf_l2tp_broadband_actual_interleaving_delay_down = -1;
 148 static int hf_l2tp_broadband_access_loop_encapsulation = -1;
 149 static int hf_l2tp_broadband_access_loop_encapsulation_data_link = -1;
 150 static int hf_l2tp_broadband_access_loop_encapsulation_enc1 = -1;
 151 static int hf_l2tp_broadband_access_loop_encapsulation_enc2 = -1;
 152 static int hf_l2tp_broadband_ancp_access_line_type = -1;
 153 static int hf_l2tp_broadband_iwf_session = -1;
 154 static int hf_l2tp_avp_csu = -1;
 155 static int hf_l2tp_avp_csu_res = -1;
 156 static int hf_l2tp_avp_csu_remote_session_id_v2 = -1;
 157 static int hf_l2tp_avp_csu_current_tx_speed_v2 = -1;
 158 static int hf_l2tp_avp_csu_current_rx_speed_v2 = -1;
 159 static int hf_l2tp_avp_csu_remote_session_id_v3 = -1;
 160 static int hf_l2tp_avp_csu_current_tx_speed_v3 = -1;
 161 static int hf_l2tp_avp_csu_current_rx_speed_v3 = -1;
 162
 163 static int hf_l2tp_ericsson_msg_type = -1;
 164 static int hf_l2tp_ericsson_conn_type = -1;
 165 static int hf_l2tp_ericsson_stn_name = -1;
 166 static int hf_l2tp_ericsson_crc32_enable = -1;
 167 static int hf_l2tp_ericsson_abis_lower_mode = -1;
 168 static int hf_l2tp_ericsson_tc_overl_thresh = -1;
 169 static int hf_l2tp_ericsson_tc_num_groups = -1;
 170 static int hf_l2tp_ericsson_tcg_group_id = -1;
 171 static int hf_l2tp_ericsson_tcg_num_sapis = -1;
 172 static int hf_l2tp_ericsson_tcg_sapi = -1;
 173 static int hf_l2tp_ericsson_tcg_ip = -1;
 174 static int hf_l2tp_ericsson_tcg_dscp = -1;
 175 static int hf_l2tp_ericsson_tcg_crc32_enable = -1;
 176 static int hf_l2tp_ericsson_tcg_bundling_tout = -1;
 177 static int hf_l2tp_ericsson_tcg_bundling_max_pkt = -1;
 178 static int hf_l2tp_ericsson_tc_num_maps = -1;
 179 static int hf_l2tp_ericsson_map_tei_low = -1;
 180 static int hf_l2tp_ericsson_map_tei_high = -1;
 181 static int hf_l2tp_ericsson_map_sc = -1;
 182 static int hf_l2tp_ericsson_ver_pref = -1;
 183 static int hf_l2tp_ericsson_ver_2 = -1;
 184 static int hf_l2tp_ericsson_ver_3 = -1;
 185
 186 /* Generated from convert_proto_tree_add_text.pl */
 187 static int hf_l2tp_cisco_pw_type = -1;
 188 static int hf_l2tp_avp_error_code = -1;
 189 static int hf_l2tp_avp_cause_msg = -1;
 190 static int hf_l2tp_avp_host_name = -1;
 191 static int hf_l2tp_avp_maximum_bps = -1;
 192 static int hf_l2tp_avp_pseudowire_type = -1;
 193 static int hf_l2tp_avp_minimum_bps = -1;
 194 static int hf_l2tp_avp_nonce = -1;
 195 static int hf_l2tp_avp_circuit_status = -1;
 196 static int hf_l2tp_avp_receive_window_size = -1;
 197 static int hf_l2tp_avp_vendor_name = -1;
 198 static int hf_l2tp_avp_layer2_specific_sublayer = -1;
 199 static int hf_l2tp_avp_disconnect_code = -1;
 200 static int hf_l2tp_cisco_circuit_status = -1;
 201 static int hf_l2tp_cisco_remote_session_id = -1;
 202 static int hf_l2tp_avp_router_id = -1;
 203 static int hf_l2tp_avp_send_accm = -1;
 204 static int hf_l2tp_avp_last_sent_lcp_confreq = -1;
 205 static int hf_l2tp_avp_sync_framing_supported = -1;
 206 static int hf_l2tp_cisco_assigned_control_connection_id = -1;
 207 static int hf_l2tp_avp_sync_framing_type = -1;
 208 static int hf_l2tp_avp_assigned_cookie = -1;
 209 static int hf_l2tp_avp_time_out_errors = -1;
 210 static int hf_l2tp_avp_sub_address = -1;
 211 static int hf_l2tp_avp_connect_speed = -1;
 212 static int hf_l2tp_avp_analog_access_supported = -1;
 213 static int hf_l2tp_avp_private_group_id = -1;
 214 static int hf_l2tp_avp_proxy_authen_response = -1;
 215 static int hf_l2tp_avp_chap_challenge = -1;
 216 static int hf_l2tp_avp_call_serial_number = -1;
 217 static int hf_l2tp_avp_digital_access_supported = -1;
 218 static int hf_l2tp_avp_physical_channel = -1;
 219 static int hf_l2tp_avp_advisory_msg = -1;
 220 static int hf_l2tp_avp_data_sequencing = -1;
 221 static int hf_l2tp_avp_control_protocol_number = -1;
 222 static int hf_l2tp_avp_error_message = -1;
 223 static int hf_l2tp_avp_initial_received_lcp_confreq = -1;
 224 static int hf_l2tp_avp_async_framing_supported = -1;
 225 static int hf_l2tp_cisco_message_digest = -1;
 226 static int hf_l2tp_avp_circuit_type = -1;
 227 static int hf_l2tp_cisco_circuit_type = -1;
 228 static int hf_l2tp_avp_proxy_authen_challenge = -1;
 229 static int hf_l2tp_cisco_assigned_cookie = -1;
 230 static int hf_l2tp_avp_receive_accm = -1;
 231 static int hf_l2tp_stop_ccn_result_code = -1;
 232 static int hf_l2tp_avp_proxy_authen_id = -1;
 233 static int hf_l2tp_avp_digital_bearer_type = -1;
 234 static int hf_l2tp_avp_rx_connect_speed = -1;
 235 static int hf_l2tp_cisco_nonce = -1;
 236 static int hf_l2tp_avp_chap_challenge_response = -1;
 237 static int hf_l2tp_avp_cause_code = -1;
 238 static int hf_l2tp_avp_protocol_revision = -1;
 239 static int hf_l2tp_avp_alignment_errors = -1;
 240 static int hf_l2tp_avp_last_received_lcp_confreq = -1;
 241 static int hf_l2tp_avp_crc_errors = -1;
 242 static int hf_l2tp_avp_random_vector = -1;
 243 static int hf_l2tp_avp_preferred_language = -1;
 244 static int hf_l2tp_cisco_interface_mtu = -1;
 245 static int hf_l2tp_avp_async_framing_type = -1;
 246 static int hf_l2tp_avp_pw_type = -1;
 247 static int hf_l2tp_cisco_local_session_id = -1;
 248 static int hf_l2tp_avp_hardware_overruns = -1;
 249 static int hf_l2tp_avp_proxy_authen_type = -1;
 250 static int hf_l2tp_cisco_draft_avp_version = -1;
 251 static int hf_l2tp_avp_protocol_version = -1;
 252 static int hf_l2tp_result_code = -1;
 253 static int hf_l2tp_avp_buffer_overruns = -1;
 254 static int hf_l2tp_avp_remote_end_id = -1;
 255 static int hf_l2tp_cisco_pseudowire_type = -1;
 256 static int hf_l2tp_avp_message_digest = -1;
 257 static int hf_l2tp_avp_proxy_authen_name = -1;
 258 static int hf_l2tp_avp_analog_bearer_type = -1;
 259 static int hf_l2tp_avp_cause_code_direction = -1;
 260 static int hf_l2tp_avp_firmware_revision = -1;
 261 static int hf_l2tp_avp_cause_code_message = -1;
 262 static int hf_l2tp_avp_framing_errors = -1;
 263 static int hf_l2tp_cisco_remote_end_id = -1;
 264 static int hf_l2tp_avp_tx_connect_speed_v3 = -1;
 265 static int hf_l2tp_avp_rx_connect_speed_v3 = -1;
 266 static int hf_l2tp_lapd_info = -1;
 267 static int hf_l2tp_session_id = -1;
 268 static int hf_l2tp_zero_length_body_message = -1;
 269 static int hf_l2tp_offset_padding = -1;
 270
 271 static dissector_table_t l2tp_vendor_avp_dissector_table;
 272 static dissector_table_t pw_type_table;
 273
 274 #define UDP_PORT_L2TP   1701
 275
 276 #define CONTROL_BIT(msg_info)        (msg_info & 0x8000) /* Type bit control = 1 data = 0 */
 277 #define LENGTH_BIT(msg_info)         (msg_info & 0x4000) /* Length bit = 1  */
 278 #define RESERVE_BITS(msg_info)       (msg_info &0x37F8)  /* Reserved bit - unused */
 279 #define SEQUENCE_BIT(msg_info)       (msg_info & 0x0800) /* SEQUENCE bit = 1 Ns and Nr fields */
 280 #define OFFSET_BIT(msg_info)         (msg_info & 0x0200) /* Offset */
 281 #define PRIORITY_BIT(msg_info)       (msg_info & 0x0100) /* Priority */
 282 #define L2TP_VERSION(msg_info)       (msg_info & 0x000f) /* Version of l2tp */
 283 #define MANDATORY_BIT(msg_info)      (msg_info & 0x8000) /* Mandatory = 1 */
 284 #define HIDDEN_BIT(msg_info)         (msg_info & 0x4000) /* Hidden = 1 */
 285 #define AVP_LENGTH(msg_info)         (msg_info & 0x03ff) /* AVP Length */
 286 #define FRAMING_SYNC(msg_info)       (msg_info & 0x0001) /* SYNC Framing Type */
 287 #define FRAMING_ASYNC(msg_info)      (msg_info & 0x0002) /* ASYNC Framing Type */
 288 #define BEARER_DIGITAL(msg_info)     (msg_info & 0x0001) /* Digital Bearer Type */
 289 #define BEARER_ANALOG(msg_info)      (msg_info & 0x0002) /* Analog Bearer Type */
 290 #define CIRCUIT_STATUS_BIT(msg_info) (msg_info & 0x0001) /* Circuit Status */
 291 #define CIRCUIT_TYPE_BIT(msg_info)   (msg_info & 0x0001) /* Circuit Condition */
 292
 293 /* DOCSIS DMPT Sub-Layer Header definitions */
 294 #define FLOW_ID_MASK  0x0E
 295
 296 static gint ett_l2tp = -1;
 297 static gint ett_l2tp_ctrl = -1;
 298 static gint ett_l2tp_avp = -1;
 299 static gint ett_l2tp_avp_sub = -1;
 300 static gint ett_l2tp_ale_sub = -1;
 301 static gint ett_l2tp_lcp = -1;
 302 static gint ett_l2tp_l2_spec = -1;
 303 static gint ett_l2tp_csu = -1;
 304 static gint ett_l2tp_ericsson_tcg = -1;
 305 static gint ett_l2tp_ericsson_map = -1;
 306
 307 static expert_field ei_l2tp_incorrect_digest = EI_INIT;
 308 /* Generated from convert_proto_tree_add_text.pl */
 309 static expert_field ei_l2tp_vendor_specific_avp_data = EI_INIT;
 310 static expert_field ei_l2tp_avp_length = EI_INIT;
 311
 312 static const enum_val_t l2tpv3_cookies[] = {
 313     {"detect",  "Detect",              -1},
 314     {"cookie0", "None",                 0},
 315     {"cookie4", "4 Byte Cookie",        4},
 316     {"cookie8", "8 Byte Cookie",        8},
 317     {NULL, NULL, 0}
 318 };
 319
 320 #define L2TPv3_COOKIE_DEFAULT       0
 321 #define L2TPv3_PROTOCOL_DEFAULT     L2TPv3_PROTOCOL_CHDLC
 322
 323 #define L2TPv3_L2_SPECIFIC_NONE         0
 324 #define L2TPv3_L2_SPECIFIC_DEFAULT      1
 325 #define L2TPv3_L2_SPECIFIC_ATM          2
 326 #define L2TPv3_L2_SPECIFIC_LAPD         3
 327 #define L2TPv3_L2_SPECIFIC_DOCSIS_DMPT  4
 328 #define L2TPv3_L2_SPECIFIC_MAX          (L2TPv3_L2_SPECIFIC_DOCSIS_DMPT + 1)
 329
 330 static const enum_val_t l2tpv3_l2_specifics[] = {
 331     {"detect",  "Detect",               -1},
 332     {"none",    "None",                 L2TPv3_L2_SPECIFIC_NONE},
 333     {"default", "Default L2-Specific",  L2TPv3_L2_SPECIFIC_DEFAULT},
 334     {"atm",     "ATM-Specific",         L2TPv3_L2_SPECIFIC_ATM},
 335     {"lapd",    "LAPD-Specific",        L2TPv3_L2_SPECIFIC_LAPD},
 336     {"dmpt",    "DOCSIS DMPT-Specific", L2TPv3_L2_SPECIFIC_DOCSIS_DMPT},
 337     {NULL, NULL, 0}
 338 };
 339
 340 static gint l2tpv3_cookie = -1;
 341 static gint l2tpv3_l2_specific = -1;
 342
 343 #define MESSAGE_TYPE_SCCRQ         1
 344 #define MESSAGE_TYPE_SCCRP         2
 345 #define MESSAGE_TYPE_SCCCN         3
 346 #define MESSAGE_TYPE_StopCCN       4
 347 #define MESSAGE_TYPE_Reserved_5    5
 348 #define MESSAGE_TYPE_HELLO         6
 349 #define MESSAGE_TYPE_OCRQ          7
 350 #define MESSAGE_TYPE_OCRP          8
 351 #define MESSAGE_TYPE_OCCN          9
 352 #define MESSAGE_TYPE_ICRQ         10
 353 #define MESSAGE_TYPE_ICRP         11
 354 #define MESSAGE_TYPE_ICCN         12
 355 #define MESSAGE_TYPE_Reserved_13  13
 356 #define MESSAGE_TYPE_CDN          14
 357 #define MESSAGE_TYPE_WEN          15
 358 #define MESSAGE_TYPE_SLI          16
 359 #define MESSAGE_TYPE_MDMST        17
 360 #define MESSAGE_TYPE_SRRQ         18
 361 #define MESSAGE_TYPE_SRRP         19
 362 #define MESSAGE_TYPE_ACK          20
 363 #define MESSAGE_TYPE_FSQ          21
 364 #define MESSAGE_TYPE_FSR          22
 365 #define MESSAGE_TYPE_MSRQ         23
 366 #define MESSAGE_TYPE_MSRP         24
 367 #define MESSAGE_TYPE_MSE          25
 368 #define MESSAGE_TYPE_MSI          26
 369 #define MESSAGE_TYPE_MSEN         27
 370 #define MESSAGE_TYPE_CSUN         28
 371 #define MESSAGE_TYPE_CSURQ        29
 372
 373 static const value_string message_type_vals[] = {
 374     { MESSAGE_TYPE_SCCRQ,       "Start_Control_Request" },
 375     { MESSAGE_TYPE_SCCRP,       "Start_Control_Reply" },
 376     { MESSAGE_TYPE_SCCCN,       "Start_Control_Connected" },
 377     { MESSAGE_TYPE_StopCCN,     "Stop_Control_Notification" },
 378     { MESSAGE_TYPE_Reserved_5,  "Reserved" },
 379     { MESSAGE_TYPE_HELLO,       "Hello" },
 380     { MESSAGE_TYPE_OCRQ,        "Outgoing_Call_Request" },
 381     { MESSAGE_TYPE_OCRP,        "Outgoing_Call_Reply" },
 382     { MESSAGE_TYPE_OCCN,        "Outgoing_Call_Connected" },
 383     { MESSAGE_TYPE_ICRQ,        "Incoming_Call_Request" },
 384     { MESSAGE_TYPE_ICRP,        "Incoming_Call_Reply" },
 385     { MESSAGE_TYPE_ICCN,        "Incoming_Call_Connected" },
 386     { MESSAGE_TYPE_Reserved_13, "Reserved" },
 387     { MESSAGE_TYPE_CDN,         "Call_Disconnect_Notification" },
 388     { MESSAGE_TYPE_WEN,         "WAN_Error_Notify" },
 389     { MESSAGE_TYPE_SLI,         "Set_Link_Info" },
 390     { MESSAGE_TYPE_MDMST,       "Modem_Status" },
 391     { MESSAGE_TYPE_SRRQ,        "Service_Relay_Request_Msg" },
 392     { MESSAGE_TYPE_SRRP,        "Service_Relay_Reply_Message" },
 393     { MESSAGE_TYPE_ACK,         "Explicit_Acknowledgement" },
 394     /* Fail Over Extensions - RFC4951 */
 395     { MESSAGE_TYPE_FSQ,         "Failover_Session_Query_Message" },
 396     { MESSAGE_TYPE_FSR,         "Failover_Session_Response_Message" },
 397     /* Multicast Management - RFC4045 */
 398     { MESSAGE_TYPE_MSRQ,        "Multicast-Session-Request" },
 399     { MESSAGE_TYPE_MSRP,        "Multicast-Session-Response" },
 400     { MESSAGE_TYPE_MSE,         "Multicast-Session-Establishment" },
 401     { MESSAGE_TYPE_MSI,         "Multicast-Session-Information" },
 402     { MESSAGE_TYPE_MSEN,        "Multicast-Session-End-Notify" },
 403     { MESSAGE_TYPE_CSUN,        "Connect-Speed-Update-Notification" },
 404     { MESSAGE_TYPE_CSURQ,       "Connect-Speed-Update-Request" },
 405     { 0,                        NULL },
 406 };
 407 static value_string_ext message_type_vals_ext = VALUE_STRING_EXT_INIT(message_type_vals);
 408
 409 static const value_string l2tp_message_type_short_str_vals[] = {
 410     { MESSAGE_TYPE_SCCRQ,       "SCCRQ" },
 411     { MESSAGE_TYPE_SCCRP,       "SCCRP" },
 412     { MESSAGE_TYPE_SCCCN,       "SCCCN" },
 413     { MESSAGE_TYPE_StopCCN,     "StopCCN" },
 414     { 5,                        "Reserved"},
 415     { MESSAGE_TYPE_HELLO,       "Hello" },
 416     { MESSAGE_TYPE_OCRQ,        "OCRQ" },
 417     { MESSAGE_TYPE_OCRP,        "OCRP" },
 418     { MESSAGE_TYPE_OCCN,        "OCCN" },
 419     { MESSAGE_TYPE_ICRQ,        "ICRQ" },
 420     { MESSAGE_TYPE_ICRP,        "ICRP" },
 421     { MESSAGE_TYPE_ICCN,        "ICCN" },
 422     { 13,                       "Reserved"},
 423     { MESSAGE_TYPE_CDN,         "CDN" },
 424     { MESSAGE_TYPE_WEN,         "WEN" },
 425     { MESSAGE_TYPE_SLI,         "SLI" },
 426     { MESSAGE_TYPE_MDMST,       "MDMST" },
 427     { MESSAGE_TYPE_SRRQ,        "SRRQ" },
 428     { MESSAGE_TYPE_SRRP,        "SRRP" },
 429     { MESSAGE_TYPE_ACK,         "ACK" },
 430     /* Fail Over Extensions - RFC4951 */
 431     { MESSAGE_TYPE_FSQ,         "FSQ" },
 432     { MESSAGE_TYPE_FSR,         "FSR" },
 433     /* Multicast Management - RFC4045 */
 434     { MESSAGE_TYPE_MSRQ,        "MSRQ" },
 435     { MESSAGE_TYPE_MSRP,        "MSRP" },
 436     { MESSAGE_TYPE_MSE,         "MSE" },
 437     { MESSAGE_TYPE_MSI,         "MSI" },
 438     { MESSAGE_TYPE_MSEN,        "MSEN" },
 439     { MESSAGE_TYPE_CSUN,        "CSUN" },
 440     { MESSAGE_TYPE_CSURQ,       "CSURQ" },
 441     { 0,                        NULL },
 442 };
 443 static value_string_ext l2tp_message_type_short_str_vals_ext = VALUE_STRING_EXT_INIT(l2tp_message_type_short_str_vals);
 444
 445
 446 static const char *control_msg = "Control Message";
 447 static const char *data_msg    = "Data    Message";
 448 static const value_string l2tp_type_vals[] = {
 449     { 0, "Data Message" },
 450     { 1, "Control Message" },
 451     { 0, NULL },
 452 };
 453
 454 static const value_string cause_code_direction_vals[] = {
 455     { 0, "global error" },
 456     { 1, "at peer" },
 457     { 2, "at local" },
 458     { 0, NULL },
 459 };
 460
 461 static const true_false_string l2tp_length_bit_truth =
 462     { "Length field is present", "Length field is not present" };
 463
 464 static const true_false_string l2tp_seq_bit_truth =
 465     { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 466
 467 static const true_false_string l2tp_offset_bit_truth =
 468     { "Offset Size field is present", "Offset size field is not present" };
 469
 470 static const true_false_string l2tp_priority_truth =
 471     { "This data message has priority", "No priority" };
 472
 473 static const value_string authen_type_vals[] = {
 474     { 0, "Reserved" },
 475     { 1, "Textual username/password exchange" },
 476     { 2, "PPP CHAP" },
 477     { 3, "PPP PAP" },
 478     { 4, "No Authentication" },
 479     { 5, "Microsoft CHAP Version 1" },
 480     { 6, "Reserved" },
 481     { 7, "EAP" },
 482     { 0, NULL }
 483 };
 484
 485 static const value_string data_sequencing_vals[] = {
 486     { 0, "No incoming data packets require sequencing" },
 487     { 1, "Only non-IP data packets require sequencing" },
 488     { 2, "All incoming data packets require sequencing" },
 489     { 0, NULL }
 490 };
 491
 492 static const value_string l2_sublayer_vals[] = {
 493     { 0, "No L2-Specific Sublayer" },
 494     { 1, "Default L2-Specific Sublayer present" },
 495     { 2, "ATM-Specific Sublayer present" },
 496     { 3, "MPT-Specific Sublayer" },
 497     { 4, "PSP-Specific Sublayer" },
 498     { 0, NULL }
 499 };
 500
 501 /* Result Code values for the StopCCN message */
 502 static const value_string result_code_stopccn_vals[] = {
 503     { 0, "Reserved", },
 504     { 1, "General request to clear control connection", },
 505     { 2, "General error, Error Code indicates the problem", },
 506     { 3, "Control connection already exists", },
 507     { 4, "Requester is not authorized to establish a control connection", },
 508     { 5, "The protocol version of the requester is not supported", },
 509     { 6, "Requester is being shut down", },
 510     { 7, "Finite state machine error or timeout", },
 511     { 8, "Control connection due to mismatching CCDS value", }, /* [RFC3308] */
 512     { 0, NULL }
 513 };
 514
 515 /* Result Code values for the CDN message */
 516 static const value_string result_code_cdn_vals[] = {
 517     {  0, "Reserved", },
 518     {  1, "Session disconnected due to loss of carrier or circuit disconnect", },
 519     {  2, "Session disconnected for the reason indicated in Error Code", },
 520     {  3, "Session disconnected for administrative reasons", },
 521     {  4, "Appropriate facilities unavailable (temporary condition)", },
 522     {  5, "Appropriate facilities unavailable (permanent condition)", },
 523     {  6, "Invalid destination", },
 524     {  7, "Call failed due to no carrier detected", },
 525     {  8, "Call failed due to detection of a busy signal", },
 526     {  9, "Call failed due to lack of a dial tone", },
 527     { 10, "Call was not established within time allotted by LAC", },
 528     { 11, "Call was connected but no appropriate framing was detected", },
 529     { 12, "Disconnecting call due to mismatching SDS value", },
 530     { 13, "Session not established due to losing tie breaker", },
 531     { 14, "Session not established due to unsupported PW type", },
 532     { 15, "Session not established, sequencing required without valid L2-Specific Sublayer", },
 533     { 16, "Finite state machine error or timeout", },
 534     { 17, "FR PVC was deleted permanently (no longer provisioned) ", },         /* [RFC4591] */
 535     { 18, "FR PVC has been INACTIVE for an extended period of time", },         /* [RFC4591] */
 536     { 19, "Mismatched FR Header Length", },                                     /* [RFC4591] */
 537     { 20, "HDLC Link was deleted permanently (no longer provisioned)", },       /* [RFC4349] */
 538     { 21, "HDLC Link has been INACTIVE for an extended period of time", },      /* [RFC4349] */
 539     { 22, "Session not established due to other LCCE can not support the OAM Cell Emulation", },    /* [RFC4454] */
 540     { 23, "Mismatching interface MTU", },                                       /* [RFC4667] */
 541     { 24, "Attempt to connect to non-existent forwarder", },                    /* [RFC4667] */
 542     { 25, "Attempt to connect to unauthorized forwarder", },                    /* [RFC4667] */
 543     { 26, "Loop Detected", },                                                   /* [draft-ietf-l2tpext-tunnel-switching-06.txt] */
 544     { 27, "Attachment Circuit bound to different PE", },                        /* [RFC6074]  */
 545     { 28, "Attachment Circuit bound to different remote Attachment Circuit", }, /* [RFC6074]  */
 546     { 29, "Unassigned", },
 547     { 30, "Return code to indicate connection was refused because of TDM PW parameters. The error code indicates the problem.", }, /* [RFC5611]  */
 548     { 31, "Sequencing not supported", },                                        /* [RFC6073]  */
 549     { 0, NULL }
 550 };
 551 static value_string_ext result_code_cdn_vals_ext = VALUE_STRING_EXT_INIT(result_code_cdn_vals);
 552
 553
 554 static const value_string error_code_vals[] = {
 555     { 0, "No General Error", },
 556     { 1, "No control connection exists yet for this pair of LCCEs", },
 557     { 2, "Length is wrong", },
 558     { 3, "One of the field values was out of range", },
 559     { 4, "Insufficient resources to handle this operation now", },
 560     { 5, "Invalid Session ID", },
 561     { 6, "A generic vendor-specific error occurred", },
 562     { 7, "Try another", },
 563     { 8, "Receipt of an unknown AVP with the M bit set", },
 564     { 9, "Try another directed", },
 565     { 10, "Next hop unreachable", },
 566     { 11, "Next hop busy", },
 567     { 12, "TSA busy", },
 568     { 0, NULL }
 569 };
 570
 571 #define  CONTROL_MESSAGE               0
 572 #define  RESULT_ERROR_CODE             1
 573 #define  PROTOCOL_VERSION              2
 574 #define  FRAMING_CAPABILITIES          3
 575 #define  BEARER_CAPABILITIES           4
 576 #define  TIE_BREAKER                   5
 577 #define  FIRMWARE_REVISION             6
 578 #define  HOST_NAME                     7
 579 #define  VENDOR_NAME                   8
 580 #define  ASSIGNED_TUNNEL_ID            9
 581 #define  RECEIVE_WINDOW_SIZE          10
 582 #define  CHALLENGE                    11
 583 #define  CAUSE_CODE                   12
 584 #define  CHALLENGE_RESPONSE           13
 585 #define  ASSIGNED_SESSION             14
 586 #define  CALL_SERIAL_NUMBER           15
 587 #define  MINIMUM_BPS                  16
 588 #define  MAXIMUM_BPS                  17
 589 #define  BEARER_TYPE                  18
 590 #define  FRAMING_TYPE                 19
 591 #define  CALLED_NUMBER                21
 592 #define  CALLING_NUMBER               22
 593 #define  SUB_ADDRESS                  23
 594 #define  TX_CONNECT_SPEED             24
 595 #define  PHYSICAL_CHANNEL             25
 596 #define  INITIAL_RECEIVED_LCP_CONFREQ 26
 597 #define  LAST_SENT_LCP_CONFREQ        27
 598 #define  LAST_RECEIVED_LCP_CONFREQ    28
 599 #define  PROXY_AUTHEN_TYPE            29
 600 #define  PROXY_AUTHEN_NAME            30
 601 #define  PROXY_AUTHEN_CHALLENGE       31
 602 #define  PROXY_AUTHEN_ID              32
 603 #define  PROXY_AUTHEN_RESPONSE        33
 604 #define  CALL_STATUS_AVPS             34
 605 #define  ACCM                         35
 606 #define  RANDOM_VECTOR                36
 607 #define  PRIVATE_GROUP_ID             37
 608 #define  RX_CONNECT_SPEED             38
 609 #define  SEQUENCING_REQUIRED          39
 610 #define  PPP_DISCONNECT_CAUSE_CODE    46    /* RFC 3145 */
 611 #define  EXTENDED_VENDOR_ID           58
 612 #define  MESSAGE_DIGEST               59
 613 #define  ROUTER_ID                    60
 614 #define  ASSIGNED_CONTROL_CONN_ID     61
 615 #define  PW_CAPABILITY_LIST           62
 616 #define  LOCAL_SESSION_ID             63
 617 #define  REMOTE_SESSION_ID            64
 618 #define  ASSIGNED_COOKIE              65
 619 #define  REMOTE_END_ID                66
 620 #define  PW_TYPE                      68
 621 #define  L2_SPECIFIC_SUBLAYER         69
 622 #define  DATA_SEQUENCING              70
 623 #define  CIRCUIT_STATUS               71
 624 #define  PREFERRED_LANGUAGE           72
 625 #define  CTL_MSG_AUTH_NONCE           73
 626 #define  TX_CONNECT_SPEED_V3          74
 627 #define  RX_CONNECT_SPEED_V3          75
 628 #define  CONNECT_SPEED_UPDATE         97
 629
 630 /* http://www.iana.org/assignments/l2tp-parameters/l2tp-parameters.xhtml */
 631 #define NUM_AVP_TYPES                 102
 632 static const value_string avp_type_vals[] = {
 633     { CONTROL_MESSAGE,              "Control Message" },
 634     { RESULT_ERROR_CODE,            "Result-Error Code" },
 635     { PROTOCOL_VERSION,             "Protocol Version" },
 636     { FRAMING_CAPABILITIES,         "Framing Capabilities" },
 637     { BEARER_CAPABILITIES,          "Bearer Capabilities" },
 638     { TIE_BREAKER,                  "Tie Breaker" },
 639     { FIRMWARE_REVISION,            "Firmware Revision" },
 640     { HOST_NAME,                    "Host Name" },
 641     { VENDOR_NAME,                  "Vendor Name" },
 642     { ASSIGNED_TUNNEL_ID,           "Assigned Tunnel ID" },
 643     { RECEIVE_WINDOW_SIZE,          "Receive Window Size" },
 644     { CHALLENGE,                    "Challenge" },
 645     { CAUSE_CODE,                   "Cause Code" },
 646     { CHALLENGE_RESPONSE,           "Challenge Response" },
 647     { ASSIGNED_SESSION,             "Assigned Session" },
 648     { CALL_SERIAL_NUMBER,           "Call Serial Number" },
 649     { MINIMUM_BPS,                  "Minimum BPS" },
 650     { MAXIMUM_BPS,                  "Maximum BPS" },
 651     { BEARER_TYPE,                  "Bearer Type" },
 652     { FRAMING_TYPE,                 "Framing Type" },
 653     { 20,                           "Reserved" },
 654     { CALLED_NUMBER,                "Called Number" },
 655     { CALLING_NUMBER,               "Calling Number" },
 656     { SUB_ADDRESS,                  "Sub-Address" },
 657     { TX_CONNECT_SPEED,             "Connect Speed" },
 658     { PHYSICAL_CHANNEL,             "Physical Channel" },
 659     { INITIAL_RECEIVED_LCP_CONFREQ, "Initial Received LCP CONFREQ" },
 660     { LAST_SENT_LCP_CONFREQ,        "Last Sent LCP CONFREQ" },
 661     { LAST_RECEIVED_LCP_CONFREQ,    "Last Received LCP CONFREQ" },
 662     { PROXY_AUTHEN_TYPE,            "Proxy Authen Type" },
 663     { PROXY_AUTHEN_NAME,            "Proxy Authen Name" },
 664     { PROXY_AUTHEN_CHALLENGE,       "Proxy Authen Challenge" },
 665     { PROXY_AUTHEN_ID,              "Proxy Authen ID" },
 666     { PROXY_AUTHEN_RESPONSE,        "Proxy Authen Response" },
 667     { CALL_STATUS_AVPS,             "Call status AVPs" },
 668     { ACCM,                         "ACCM" },
 669     { RANDOM_VECTOR,                "Random Vector" },
 670     { PRIVATE_GROUP_ID,             "Private group ID" },
 671     { RX_CONNECT_SPEED,             "RxConnect Speed" },
 672     { SEQUENCING_REQUIRED,          "Sequencing Required" },
 673     { PPP_DISCONNECT_CAUSE_CODE,    "PPP Disconnect Cause Code" },
 674     { EXTENDED_VENDOR_ID,           "Extended Vendor ID" },
 675     { MESSAGE_DIGEST,               "Message Digest" },
 676     { ROUTER_ID,                    "Router ID" },
 677     { ASSIGNED_CONTROL_CONN_ID,     "Assigned Control Connection ID" },
 678     { PW_CAPABILITY_LIST,           "Pseudowire Capability List" },
 679     { LOCAL_SESSION_ID,             "Local Session ID" },
 680     { REMOTE_SESSION_ID,            "Remote Session ID" },
 681     { ASSIGNED_COOKIE,              "Assigned Cookie" },
 682     { REMOTE_END_ID,                "Remote End ID" },
 683     { PW_TYPE,                      "Pseudowire Type" },
 684     { L2_SPECIFIC_SUBLAYER,         "Layer2 Specific Sublayer" },
 685     { DATA_SEQUENCING,              "Data Sequencing" },
 686     { CIRCUIT_STATUS,               "Circuit Status" },
 687     { PREFERRED_LANGUAGE,           "Preferred Language" },
 688     { CTL_MSG_AUTH_NONCE,           "Control Message Authentication Nonce" },
 689     { TX_CONNECT_SPEED_V3,          "Tx Connect Speed Version 3" },
 690     { RX_CONNECT_SPEED_V3,          "Rx Connect Speed Version 3" },
 691     { 76,                           "Failover Capability" },                            /*[RFC4951] */
 692     { 77,                           "Tunnel Recovery" },                                /*[RFC4951] */
 693     { 78,                           "Suggested Control Sequence" },                     /*[RFC4951] */
 694     { 79,                           "Failover Session State" },                         /*[RFC4951] */
 695     { 80,                           "Multicast Capability" },                           /*[RFC4045] */
 696     { 81,                           "New Outgoing Sessions" },                          /*[RFC4045] */
 697     { 82,                           "New Outgoing Sessions Acknowledgement" },          /*[RFC4045] */
 698     { 83,                           "Withdraw Outgoing Sessions" },                     /*[RFC4045] */
 699     { 84,                           "Multicast Packets Priority" },                     /*[RFC4045] */
 700     { 85,                           "Frame-Relay Header Length" },                      /*[RFC4591] */
 701     { 86,                           "ATM Maximum Concatenated Cells" },                 /*[RFC4454] */
 702     { 87,                           "OAM Emulation Required" },                         /*[RFC4454] */
 703     { 88,                           "ATM Alarm Status" },                               /*[RFC4454] */
 704     /*        Also, see ATM Alarm Status AVP Values below */
 705     { 89,                           "Attachment Group Identifier" },                    /*[RFC4667] */
 706     { 90,                           "Local End Identifier" },                           /*[RFC4667] */
 707     { 91,                           "Interface Maximum Transmission Unit" },            /*[RFC4667] */
 708     { 92,                           "FCS Retention" },                                  /*[RFC4720] */
 709     { 93,                           "Tunnel Switching Aggregator ID" },                 /*[draft-ietf-l2tpext-tunnel-switching-06.txt] */
 710     { 94,                           "Maximum Receive Unit (MRU)" },                     /*[RFC4623] */
 711     { 95,                           "Maximum Reassembled Receive Unit (MRRU)" },        /*[RFC4623] */
 712     { 96,                           "VCCV Capability" },                                /*[RFC5085] */
 713     { CONNECT_SPEED_UPDATE,         "Connect Speed Update" },                           /*[RFC5515] */
 714     { 98,                           "Connect Speed Update Enable" },                    /*[RFC5515] */
 715     { 99,                           "TDM Pseudowire" },                                 /*[RFC5611] */
 716     { 100,                          "RTP AVP" },                                        /*[RFC5611] */
 717     { 101,                          "PW Switching Point" },                             /*[RFC6073] */
 718     { 0,                         NULL }
 719 };
 720
 721 static value_string_ext avp_type_vals_ext = VALUE_STRING_EXT_INIT(avp_type_vals);
 722
 723 #define CISCO_ACK                        0
 724 #define CISCO_ASSIGNED_CONNECTION_ID     1
 725 #define CISCO_PW_CAPABILITY_LIST         2
 726 #define CISCO_LOCAL_SESSION_ID           3
 727 #define CISCO_REMOTE_SESSION_ID          4
 728 #define CISCO_ASSIGNED_COOKIE            5
 729 #define CISCO_REMOTE_END_ID              6
 730 #define CISCO_PW_TYPE                    7
 731 #define CISCO_CIRCUIT_STATUS             8
 732 #define CISCO_SESSION_TIE_BREAKER        9
 733 #define CISCO_DRAFT_AVP_VERSION         10
 734 #define CISCO_MESSAGE_DIGEST            12
 735 #define CISCO_AUTH_NONCE                13
 736 #define CISCO_INTERFACE_MTU             14
 737
 738 static const value_string cisco_avp_type_vals[] = {
 739     { CISCO_ACK,                      "Cisco ACK" },
 740     { CISCO_ASSIGNED_CONNECTION_ID,   "Assigned Connection ID" },
 741     { CISCO_PW_CAPABILITY_LIST,       "Pseudowire Capabilities List" },
 742     { CISCO_LOCAL_SESSION_ID,         "Local Session ID" },
 743     { CISCO_REMOTE_SESSION_ID,        "Remote Session ID" },
 744     { CISCO_ASSIGNED_COOKIE,          "Assigned Cookie" },
 745     { CISCO_REMOTE_END_ID,            "Remote End ID" },
 746     { CISCO_PW_TYPE,                  "Pseudowire Type" },
 747     { CISCO_CIRCUIT_STATUS,           "Circuit Status" },
 748     { CISCO_SESSION_TIE_BREAKER,      "Session Tie Breaker" },
 749     { CISCO_DRAFT_AVP_VERSION,        "Draft AVP Version" },
 750     { CISCO_MESSAGE_DIGEST,           "Message Digest" },
 751     { CISCO_AUTH_NONCE,               "Control Message Authentication Nonce" },
 752     { CISCO_INTERFACE_MTU,            "Interface MTU" },
 753     { 0,                              NULL }
 754 };
 755
 756 #define ERICSSON_MSG_TYPE               0
 757 #define ERICSSON_TRANSPORT_CONFIG       1
 758 #define ERICSSON_PACKET_LOSS            2
 759 #define ERICSSON_PROTO_VERSION          3
 760 #define ERICSSON_CONN_TYPE              4
 761 #define ERICSSON_CRC_ENABLED            5
 762 #define ERICSSON_STN_NAME               6
 763 #define ERICSSON_ABIS_LOWER_MODE        7
 764 #define ERICSSON_TEI_TO_SC_MAP          8
 765 #define ERICSSON_CHAN_STATUS_LIST       9
 766 #define ERICSSON_EXT_PROTO_VERSION      10
 767 #define ERICSSON_CHAN_STATUS_LIST2      11
 768
 769 static const value_string ericsson_avp_type_vals[] = {
 770     { ERICSSON_MSG_TYPE,              "Message Type" },
 771     { ERICSSON_TRANSPORT_CONFIG,      "Transport Configuration" },
 772     { ERICSSON_PACKET_LOSS,           "Packet Loss" },
 773     { ERICSSON_PROTO_VERSION,         "Protocol Version" },
 774     { ERICSSON_CONN_TYPE,             "Connection Type" },
 775     { ERICSSON_STN_NAME,              "STN Name" },
 776     { ERICSSON_CRC_ENABLED,           "CRC32 Enabled" },
 777     { ERICSSON_ABIS_LOWER_MODE,       "Abis Lower Mode" },
 778     { ERICSSON_TEI_TO_SC_MAP,         "TEI to SC Map" },
 779     { ERICSSON_CHAN_STATUS_LIST,      "Channel Status List" },
 780     { ERICSSON_EXT_PROTO_VERSION,     "Extended Protoocl Version" },
 781     { ERICSSON_CHAN_STATUS_LIST2,     "Channel Status List 2" },
 782     { 0,                              NULL }
 783 };
 784
 785 static const value_string ericsson_msg_type_vals[] = {
 786     { 0,   "Transport Configuration Notification" },
 787     { 1,   "Performance Notification" },
 788     { 2,   "Transport Configuration Request" },
 789     { 3,   "Transport Configuration Response" },
 790     { 4,   "Abis Lower Transport Config Request" },
 791     { 5,   "Abis Lower Transport Config Response" },
 792     { 6,   "Local Connect Channel Status Notification" },
 793     { 0,   NULL }
 794 };
 795
 796 static const value_string ericsson_short_msg_type_vals[] = {
 797     { 0,   "TCN" },
 798     { 1,   "PN" },
 799     { 2,   "TCRQ" },
 800     { 3,   "TCRP" },
 801     { 4,   "ALTCRQ" },
 802     { 5,   "ALTCRP" },
 803     { 6,   "LCCSN" },
 804     { 0,   NULL }
 805 };
 806
 807 static const value_string ericsson_conn_type_vals[] = {
 808     { 0,   "Primary" },
 809     { 1,   "Secondary" },
 810     { 0,   NULL }
 811 };
 812
 813 static const value_string ericsson_abis_lower_mode_vals[] = {
 814     { 0,   "Single Timeslot" },
 815     { 1,   "Super Channel" },
 816     { 0,   NULL }
 817 };
 818
 819 #define BROADBAND_AGENT_CIRCUIT_ID                    1
 820 #define BROADBAND_AGENT_REMOTE_ID                     2
 821 #define BROADBAND_ACTUAL_DR_UP                      129
 822 #define BROADBAND_ACTUAL_DR_DOWN                    130
 823 #define BROADBAND_MINIMUM_DR_UP                     131
 824 #define BROADBAND_MINIMUM_DR_DOWN                   132
 825 #define BROADBAND_ATTAINABLE_DR_UP                  133
 826 #define BROADBAND_ATTAINABLE_DR_DOWN                134
 827 #define BROADBAND_MAXIMUM_DR_UP                     135
 828 #define BROADBAND_MAXIMUM_DR_DOWN                   136
 829 #define BROADBAND_MINIMUM_DR_UP_LOW_POWER           137
 830 #define BROADBAND_MINIMUM_DR_DOWN_LOW_POWER         138
 831 #define BROADBAND_MAXIMUM_INTERLEAVING_DELAY_UP     139
 832 #define BROADBAND_ACTUAL_INTERLEAVING_DELAY_UP      140
 833 #define BROADBAND_MAXIMUM_INTERLEAVING_DELAY_DOWN   141
 834 #define BROADBAND_ACTUAL_INTERLEAVING_DELAY_DOWN    142
 835 #define BROADBAND_ACCESS_LOOP_ENCAPSULATION         144
 836 #define BROADBAND_ANCP_ACCESS_LINE_TYPE             145
 837 #define BROADBAND_IWF_SESSION                       254
 838
 839 static const value_string broadband_avp_type_vals[] = {
 840     { BROADBAND_AGENT_CIRCUIT_ID,                 "Agent-Circuit-Id" },
 841     { BROADBAND_AGENT_REMOTE_ID,                  "Agent-Remote-Id" },
 842     { BROADBAND_ACTUAL_DR_UP,                     "Actual-Data-Rate-Upstream" },
 843     { BROADBAND_ACTUAL_DR_DOWN,                   "Actual-Data-Rate-Downstream" },
 844     { BROADBAND_MINIMUM_DR_UP,                    "Minimum-Data-Rate-Upstream" },
 845     { BROADBAND_MINIMUM_DR_DOWN,                  "Minimum-Data-Rate-Downstream" },
 846     { BROADBAND_ATTAINABLE_DR_UP,                 "Attainable-Data-Rate-Upstream" },
 847     { BROADBAND_ATTAINABLE_DR_DOWN,               "Attainable-Data-Rate-Downstream" },
 848     { BROADBAND_MAXIMUM_DR_UP,                    "Maximum-Data-Rate-Upstream" },
 849     { BROADBAND_MAXIMUM_DR_DOWN,                  "Maximum-Data-Rate-Downstream" },
 850     { BROADBAND_MINIMUM_DR_UP_LOW_POWER,          "Minimum-Data-Rate-Upstream-Low-Power" },
 851     { BROADBAND_MINIMUM_DR_DOWN_LOW_POWER,        "Minimum-Data-Rate-Downstream-Low-Power" },
 852     { BROADBAND_MAXIMUM_INTERLEAVING_DELAY_UP,    "Maximum-Interleaving-Delay-Upstream" },
 853     { BROADBAND_ACTUAL_INTERLEAVING_DELAY_UP,     "Actual-Interleaving-Delay-Upstream" },
 854     { BROADBAND_MAXIMUM_INTERLEAVING_DELAY_DOWN,  "Maximum-Interleaving-Delay-Downstream" },
 855     { BROADBAND_ACTUAL_INTERLEAVING_DELAY_DOWN,   "Actual-Interleaving-Delay-Downstream" },
 856     { BROADBAND_ACCESS_LOOP_ENCAPSULATION,        "Access-Loop-Encapsulation" },
 857     { BROADBAND_ANCP_ACCESS_LINE_TYPE,            "ANCP Access Line Type" },
 858     { BROADBAND_IWF_SESSION,                      "IWF-Session" },
 859     { 0,                                          NULL }
 860 };
 861
 862 static const value_string cablelabs_avp_type_vals[] = {
 863     /* 7.5.2 DEPI Specific AVPs */
 864     { 0,   "Reserved" },
 865     { 1,   "DEPI Result Code" },
 866     { 2,   "DEPI Resource Allocation Request" },
 867     { 3,   "DEPI Resource Allocation Reply" },
 868     { 4,   "DEPI Local MTU" },
 869     { 5,   "DOCSIS SYNC Control" },
 870     { 6,   "EQAM Capability Bits" },
 871     { 7,   "DEPI Remote MTU" },
 872     { 8,   "DEPI Local UDP Port" },
 873     { 9,   "DPR Session Type" },
 874     { 10,  "DPR Session Status" },
 875     /* 7.5.3 QAM Channel PHY AVPs */
 876     { 100, "Downstream QAM Channel TSID Group" },
 877     { 101, "Downstream QAM Channel Frequency" },
 878     { 102, "Downstream QAM Channel Power" },
 879     { 103, "Downstream QAM Channel Modulation" },
 880     { 104, "Downstream QAM Channel J.83 Annex" },
 881     { 105, "Downstream QAM Channel Symbol Rate" },
 882     { 106, "Downstream QAM Channel Interleave Depth" },
 883     { 107, "Downstream QAM Channel RF Block Muting53" },
 884     /* 7.5.4 DEPI Redundancy Capabilities AVPs */
 885     { 200, "DEPI Redundancy Capabilities" },
 886     { 0,                              NULL }
 887 };
 888
 889 static const value_string l2tp_cablel_modulation_vals[] = {
 890     { 0,   "64-QAM" },
 891     { 1,   "128-QAM" },
 892     { 0,        NULL }
 893 };
 894
 895 static const value_string pw_types_vals[] = {
 896     { 0x0001,  "Frame Relay DLCI" },
 897     { 0x0002,  "ATM AAL5 SDU VCC transport" },
 898     { 0x0003,  "ATM Cell transparent Port Mode" },
 899     { 0x0004,  "Ethernet VLAN" },
 900     { 0x0005,  "Ethernet" },
 901     { 0x0006,  "HDLC" },
 902     { 0x0007,  "PPP" },
 903     { 0x0009,  "ATM Cell transport VCC Mode" },
 904     { 0x000A,  "ATM Cell transport VPC Mode" },
 905     { 0x000B,  "IP Transport" },
 906     { 0x000C,  "MPEG-TS Payload Type (MPTPW)" },
 907     { 0x000D,  "Packet Streaming Protocol (PSPPW)" },
 908     /* 0x000E-0x0010 Unassigned */
 909     { 0x0011,  "Structure-agnostic E1 circuit" },       /* [RFC5611] */
 910     { 0x0012,  "Structure-agnostic T1 (DS1) circuit" }, /* [RFC5611]   */
 911     { 0x0013,  "Structure-agnostic E3 circuit" },       /* [RFC5611]   */
 912     { 0x0014,  "Structure-agnostic T3 (DS3) circuit" }, /* [RFC5611]   */
 913     { 0x0015,  "CESoPSN basic mode" },                  /* [RFC5611]   */
 914     { 0x0016,  "Unassigned" },
 915     { 0x0017,  "CESoPSN TDM with CAS" },                /* [RFC5611]  */
 916
 917     { 0,  NULL },
 918 };
 919
 920 static const value_string ale_datalink_types_vals[] = {
 921     { 0x00,  "ATM AAL5" },
 922     { 0x01,  "Ethernet" },
 923     { 0,     NULL },
 924 };
 925
 926 static const value_string ale_enc1_types_vals[] = {
 927     { 0x00,  "NA - Not Available" },
 928     { 0x01,  "Untagged Ethernet" },
 929     { 0x02,  "Single-Tagged Ethernet" },
 930     { 0,     NULL },
 931 };
 932
 933 static const value_string ale_enc2_types_vals[] = {
 934     { 0x00,  "NA - Not Available" },
 935     { 0x01,  "PPPoA LLC" },
 936     { 0x02,  "PPPoA Null" },
 937     { 0x03,  "IP over ATM (IPoA) LLC" },
 938     { 0x04,  "IPoA Null" },
 939     { 0x05,  "Ethernet over AAL5 LLC with Frame Check Sequence (FCS)" },
 940     { 0x06,  "Ethernet over AAL5 LLC without FCS" },
 941     { 0x07,  "Ethernet over AAL5 Null with FCS" },
 942     { 0x08,  "Ethernet over AAL5 Null without FCS" },
 943     { 0,     NULL },
 944 };
 945
 946 static const value_string ancp_types_vals[] = {
 947     { 0x01,  "ADSL1" },
 948     { 0x02,  "ADSL2" },
 949     { 0x03,  "ADSL2+" },
 950     { 0x04,  "VDSL1" },
 951     { 0x05,  "VDSL2" },
 952     { 0x06,  "SDSL" },
 953     { 0x07,  "UNKNOWN" },
 954     { 0,     NULL },
 955 };
 956
 957 static const value_string iwf_types_vals[] = {
 958     { 0x00,  "IWF not performed" },
 959     { 0x01,  "IWF performed" },
 960     { 0,     NULL },
 961 };
 962
 963 static const val64_string unique_indeterminable_or_no_link[] = {
 964     { 0, "indeterminable or no physical p2p link" },
 965     { 0, NULL },
 966 };
 967
 968 static const true_false_string tfs_new_existing = { "New", "Existing" };
 969
 970 static dissector_handle_t ppp_hdlc_handle;
 971 static dissector_handle_t ppp_lcp_options_handle;
 972
 973 static dissector_handle_t atm_oam_handle;
 974 static dissector_handle_t llc_handle;
 975
 976 static dissector_handle_t l2tp_udp_handle;
 977 static dissector_handle_t l2tp_ip_handle;
 978
 979 #define L2TP_HMAC_MD5  0
 980 #define L2TP_HMAC_SHA1 1
 981
 982 typedef struct l2tpv3_conversation {
 983     address               lcce1;
 984     guint16               lcce1_port;
 985     address               lcce2;
 986     guint16               lcce2_port;
 987     port_type             pt;
 988     struct l2tpv3_tunnel *tunnel;
 989 } l2tpv3_conversation_t;
 990
 991 typedef struct l2tpv3_tunnel {
 992     l2tpv3_conversation_t *conv;
 993
 994     address  lcce1;
 995     guint32  lcce1_id;
 996     guint8  *lcce1_nonce;
 997     gint     lcce1_nonce_len;
 998
 999     address  lcce2;
1000     guint32  lcce2_id;
1001     guint8  *lcce2_nonce;
1002     gint     lcce2_nonce_len;
1003
1004     gchar   *shared_key_secret;
1005     guint8   shared_key[HASH_MD5_LENGTH];
1006
1007     GSList  *sessions;
1008 } l2tpv3_tunnel_t;
1009
1010 typedef struct lcce_settings {
1011     guint32 id;
1012     gint    cookie_len;
1013     gint    l2_specific;
1014 } lcce_settings_t;
1015
1016 typedef struct l2tpv3_session {
1017     lcce_settings_t lcce1;
1018     lcce_settings_t lcce2;
1019
1020     gint    pw_type;
1021 } l2tpv3_session_t;
1022
1023 static const gchar* shared_secret = "";
1024
1025 static GSList *list_heads = NULL;
1026
1027 static void update_shared_key(l2tpv3_tunnel_t *tunnel)
1028 {
1029     const gchar *secret = "";
1030
1031     /* There is at least one nonce in the packet, so we can do authentication,
1032        otherwise it's just a plain digest without nonces. */
1033     if (tunnel->lcce1_nonce != NULL || tunnel->lcce2_nonce != NULL) {
1034         secret = shared_secret;
1035     }
1036
1037     /* If there's no shared key in the conversation context, or the secret has been changed */
1038     if (tunnel->shared_key_secret == NULL || strcmp(secret, tunnel->shared_key_secret) != 0) {
1039         /* For secret specification, see RFC 3931 pg 37 */
1040         guint8 data = 2;
1041         if (ws_hmac_buffer(GCRY_MD_MD5, tunnel->shared_key, &data, 1, secret, strlen(secret))) {
1042             return;
1043         }
1044         tunnel->shared_key_secret = wmem_strdup(wmem_file_scope(), secret);
1045     }
1046 }
1047
1048 static void md5_hmac_digest(l2tpv3_tunnel_t *tunnel,
1049                             tvbuff_t *tvb,
1050                             int length,
1051                             int idx,
1052                             int avp_len,
1053                             int msg_type,
1054                             packet_info *pinfo,
1055                             guint8 digest[20])
1056 {
1057     guint8 zero[HASH_MD5_LENGTH] = { 0 };
1058     gcry_md_hd_t hmac_handle;
1059     int remainder;
1060     int offset = 0;
1061
1062     if (tunnel->conv->pt == PT_NONE) /* IP encapsulated L2TPv3 */
1063         offset = 4;
1064
1065     if (gcry_md_open(&hmac_handle, GCRY_MD_MD5, GCRY_MD_FLAG_HMAC)) {
1066         return;
1067     }
1068     if (gcry_md_setkey(hmac_handle, tunnel->shared_key, HASH_MD5_LENGTH)) {
1069         gcry_md_close(hmac_handle);
1070         return;
1071     }
1072
1073     if (msg_type != MESSAGE_TYPE_SCCRQ) {
1074         if (tunnel->lcce1_nonce != NULL && tunnel->lcce2_nonce != NULL) {
1075             if (addresses_equal(&tunnel->lcce1, &pinfo->src)) {
1076                 gcry_md_write(hmac_handle, tunnel->lcce1_nonce, tunnel->lcce1_nonce_len);
1077                 gcry_md_write(hmac_handle, tunnel->lcce2_nonce, tunnel->lcce2_nonce_len);
1078             } else {
1079                 gcry_md_write(hmac_handle, tunnel->lcce2_nonce, tunnel->lcce2_nonce_len);
1080                 gcry_md_write(hmac_handle, tunnel->lcce1_nonce, tunnel->lcce1_nonce_len);
1081             }
1082         }
1083     }
1084
1085     gcry_md_write(hmac_handle, tvb_get_ptr(tvb, offset, idx + 1 - offset), idx + 1 - offset);
1086     /* Message digest is calculated with an empty message digest field */
1087     gcry_md_write(hmac_handle, zero, avp_len - 1);
1088     remainder = length - (idx + avp_len);
1089     gcry_md_write(hmac_handle, tvb_get_ptr(tvb, idx + avp_len, remainder), remainder);
1090     memcpy(digest, gcry_md_read(hmac_handle, 0), HASH_MD5_LENGTH);
1091     gcry_md_close(hmac_handle);
1092 }
1093
1094 static void sha1_hmac_digest(l2tpv3_tunnel_t *tunnel,
1095                              tvbuff_t *tvb,
1096                              int length,
1097                              int idx,
1098                              int avp_len,
1099                              int msg_type,
1100                              packet_info *pinfo,
1101                              guint8 digest[20])
1102 {
1103     guint8 zero[HASH_SHA1_LENGTH] = { 0 };
1104     gcry_md_hd_t hmac_handle;
1105     int remainder;
1106     int offset = 0;
1107
1108     if (tunnel->conv->pt == PT_NONE) /* IP encapsulated L2TPv3 */
1109         offset = 4;
1110
1111     if (gcry_md_open(&hmac_handle, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC)) {
1112         return;
1113     }
1114     if (gcry_md_setkey(hmac_handle, tunnel->shared_key, HASH_MD5_LENGTH)) {
1115         gcry_md_close(hmac_handle);
1116         return;
1117     }
1118
1119     if (msg_type != MESSAGE_TYPE_SCCRQ) {
1120         if (tunnel->lcce1_nonce != NULL && tunnel->lcce2_nonce != NULL) {
1121             if (addresses_equal(&tunnel->lcce1, &pinfo->src)) {
1122                 gcry_md_write(hmac_handle, tunnel->lcce1_nonce, tunnel->lcce1_nonce_len);
1123                 gcry_md_write(hmac_handle, tunnel->lcce2_nonce, tunnel->lcce2_nonce_len);
1124             } else {
1125                 gcry_md_write(hmac_handle, tunnel->lcce2_nonce, tunnel->lcce2_nonce_len);
1126                 gcry_md_write(hmac_handle, tunnel->lcce1_nonce, tunnel->lcce1_nonce_len);
1127             }
1128         }
1129     }
1130
1131     gcry_md_write(hmac_handle, tvb_get_ptr(tvb, offset, idx + 1 - offset), idx + 1 - offset);
1132     /* Message digest is calculated with an empty message digest field */
1133     gcry_md_write(hmac_handle, zero, avp_len - 1);
1134     remainder = length - (idx + avp_len);
1135     gcry_md_write(hmac_handle, tvb_get_ptr(tvb, idx + avp_len, remainder), remainder);
1136     memcpy(digest, gcry_md_read(hmac_handle, 0), HASH_SHA1_LENGTH);
1137     gcry_md_close(hmac_handle);
1138 }
1139
1140 static int check_control_digest(l2tpv3_tunnel_t *tunnel,
1141                                 tvbuff_t *tvb,
1142                                 int length,
1143                                 int idx,
1144                                 int avp_len,
1145                                 int msg_type,
1146                                 packet_info *pinfo)
1147 {
1148     guint8 digest[HASH_SHA1_LENGTH];
1149
1150     if (!tunnel)
1151         return 1;
1152
1153     update_shared_key(tunnel);
1154
1155     switch (tvb_get_guint8(tvb, idx)) {
1156         case L2TP_HMAC_MD5:
1157             if ((avp_len - 1) != HASH_MD5_LENGTH)
1158                 return -1;
1159             md5_hmac_digest(tunnel, tvb, length, idx, avp_len, msg_type, pinfo, digest);
1160             break;
1161         case L2TP_HMAC_SHA1:
1162             if ((avp_len - 1) != HASH_SHA1_LENGTH)
1163                 return -1;
1164             sha1_hmac_digest(tunnel, tvb, length, idx, avp_len, msg_type, pinfo, digest);
1165             break;
1166         default:
1167             return 1;
1168             break;
1169     }
1170
1171     return tvb_memeql(tvb, idx + 1, digest, avp_len - 1);
1172 }
1173
1174 static void store_cma_nonce(l2tpv3_tunnel_t *tunnel,
1175                             tvbuff_t *tvb,
1176                             int offset,
1177                             int length,
1178                             int msg_type)
1179 {
1180     guint8 *nonce = NULL;
1181
1182     if (!tunnel)
1183         return;
1184
1185     switch (msg_type) {
1186         case MESSAGE_TYPE_SCCRQ:
1187             if (!tunnel->lcce1_nonce) {
1188                 tunnel->lcce1_nonce = (guint8 *)wmem_alloc(wmem_file_scope(), length);
1189                 tunnel->lcce1_nonce_len = length;
1190                 nonce = tunnel->lcce1_nonce;
1191             }
1192             break;
1193         case MESSAGE_TYPE_SCCRP:
1194             if (!tunnel->lcce2_nonce) {
1195                 tunnel->lcce2_nonce = (guint8 *)wmem_alloc(wmem_file_scope(), length);
1196                 tunnel->lcce2_nonce_len = length;
1197                 nonce = tunnel->lcce2_nonce;
1198             }
1199             break;
1200         default:
1201             break;
1202     }
1203
1204     if (nonce)
1205         tvb_memcpy(tvb, (void *)nonce, offset, length);
1206
1207     return;
1208 }
1209
1210 static void store_ccid(l2tpv3_tunnel_t *tunnel,
1211                        tvbuff_t *tvb,
1212                        int offset,
1213                        int msg_type)
1214 {
1215     if (!tunnel)
1216         return;
1217
1218     switch (msg_type) {
1219         case MESSAGE_TYPE_SCCRQ:
1220             tunnel->lcce1_id = tvb_get_ntohl(tvb, offset);
1221             break;
1222         case MESSAGE_TYPE_SCCRP:
1223             tunnel->lcce2_id = tvb_get_ntohl(tvb, offset);
1224             break;
1225         default:
1226             break;
1227     }
1228
1229     return;
1230 }
1231
1232 static l2tpv3_session_t *find_session(l2tpv3_tunnel_t *tunnel,
1233                                       guint32 lcce1_id,
1234                                       guint32 lcce2_id)
1235 {
1236     l2tpv3_session_t *session = NULL;
1237     GSList *iterator;
1238
1239     iterator = tunnel->sessions;
1240     while (iterator) {
1241         session = (l2tpv3_session_t *)iterator->data;
1242
1243         if ((session->lcce1.id == lcce1_id) ||
1244             (session->lcce2.id == lcce2_id)) {
1245                 return session;
1246         }
1247
1248         iterator = g_slist_next(iterator);
1249     }
1250
1251     return NULL;
1252 }
1253
1254 static void init_session(l2tpv3_session_t *session)
1255 {
1256     session->lcce1.cookie_len = session->lcce2.cookie_len = -1;
1257     session->lcce1.l2_specific = session->lcce2.l2_specific = -1;
1258     session->pw_type = -1;
1259 }
1260
1261 static l2tpv3_session_t *alloc_session(void)
1262 {
1263     l2tpv3_session_t *session = wmem_new0(wmem_packet_scope(), l2tpv3_session_t);
1264     init_session(session);
1265
1266     return session;
1267 }
1268
1269 static l2tpv3_session_t *store_lsession_id(l2tpv3_session_t *_session,
1270                                          tvbuff_t *tvb,
1271                                          int offset,
1272                                          int msg_type)
1273 {
1274     l2tpv3_session_t *session = _session;
1275
1276     switch (msg_type) {
1277         case MESSAGE_TYPE_ICRQ:
1278         case MESSAGE_TYPE_OCRQ:
1279         case MESSAGE_TYPE_ICRP:
1280         case MESSAGE_TYPE_OCRP:
1281             break;
1282         default:
1283             return session;
1284     }
1285
1286     if (session == NULL)
1287         session = alloc_session();
1288
1289     switch (msg_type) {
1290         case MESSAGE_TYPE_ICRQ:
1291         case MESSAGE_TYPE_OCRQ:
1292             session->lcce1.id = tvb_get_ntohl(tvb, offset);
1293             break;
1294         case MESSAGE_TYPE_ICRP:
1295         case MESSAGE_TYPE_OCRP:
1296             session->lcce2.id = tvb_get_ntohl(tvb, offset);
1297             break;
1298     }
1299
1300     return session;
1301 }
1302
1303 static l2tpv3_session_t *store_rsession_id(l2tpv3_session_t *_session,
1304                                          tvbuff_t *tvb,
1305                                          int offset,
1306                                          int msg_type)
1307 {
1308     l2tpv3_session_t *session = _session;
1309
1310     switch (msg_type) {
1311         case MESSAGE_TYPE_ICRP:
1312         case MESSAGE_TYPE_OCRP:
1313             break;
1314         default:
1315             return session;
1316     }
1317
1318     if (session == NULL)
1319         session = alloc_session();
1320
1321     session->lcce1.id = tvb_get_ntohl(tvb, offset);
1322
1323     return session;
1324 }
1325
1326 static l2tpv3_session_t *store_cookie_len(l2tpv3_session_t *_session,
1327                                         int len,
1328                                         int msg_type)
1329 {
1330     l2tpv3_session_t *session = _session;
1331
1332     switch (msg_type) {
1333         case MESSAGE_TYPE_ICRQ:
1334         case MESSAGE_TYPE_OCRQ:
1335         case MESSAGE_TYPE_ICRP:
1336         case MESSAGE_TYPE_OCRP:
1337             break;
1338         default:
1339             return session;
1340     }
1341
1342     if (session == NULL)
1343         session = alloc_session();
1344
1345     switch (msg_type) {
1346         case MESSAGE_TYPE_ICRQ:
1347         case MESSAGE_TYPE_OCRQ:
1348             session->lcce1.cookie_len = len;
1349             break;
1350         case MESSAGE_TYPE_ICRP:
1351         case MESSAGE_TYPE_OCRP:
1352             session->lcce2.cookie_len = len;
1353             break;
1354     }
1355
1356     return session;
1357 }
1358
1359 static l2tpv3_session_t *store_pw_type(l2tpv3_session_t *_session,
1360                                      tvbuff_t *tvb,
1361                                      int offset,
1362                                      int msg_type)
1363 {
1364     l2tpv3_session_t *session = _session;
1365     gint result = -1;
1366     guint16 pw_type;
1367
1368     switch (msg_type) {
1369         case MESSAGE_TYPE_ICRQ:
1370         case MESSAGE_TYPE_OCRQ:
1371             break;
1372         default:
1373             return session;
1374     }
1375
1376     if (session == NULL)
1377         session = alloc_session();
1378
1379     pw_type = tvb_get_ntohs(tvb, offset);
1380     switch (pw_type) {
1381         case 0x0007:
1382             result = L2TPv3_PROTOCOL_PPP; break;
1383         case 0x0005:
1384             result = L2TPv3_PROTOCOL_ETH; break;
1385         case 0x0006:
1386             result = L2TPv3_PROTOCOL_CHDLC; break;
1387         case 0x0002:
1388             result = L2TPv3_PROTOCOL_AAL5; break;
1389         case 0x0001:
1390             result = L2TPv3_PROTOCOL_FR; break;
1391         default:
1392             break;
1393     }
1394
1395     session->pw_type = result;
1396
1397     return session;
1398 }
1399
1400 static l2tpv3_session_t *store_l2_sublayer(l2tpv3_session_t *_session,
1401                                            tvbuff_t *tvb,
1402                                            int offset,
1403                                            int msg_type)
1404 {
1405     l2tpv3_session_t *session = _session;
1406     gint result = l2tpv3_l2_specific;
1407     guint16 l2_sublayer;
1408
1409     switch (msg_type) {
1410         case MESSAGE_TYPE_ICRQ:
1411         case MESSAGE_TYPE_OCRQ:
1412         case MESSAGE_TYPE_ICCN:
1413         case MESSAGE_TYPE_OCCN:
1414         case MESSAGE_TYPE_ICRP:
1415         case MESSAGE_TYPE_OCRP:
1416             break;
1417         default:
1418             return session;
1419     }
1420
1421     if (session == NULL)
1422         session = alloc_session();
1423
1424     l2_sublayer = tvb_get_ntohs(tvb, offset);
1425     switch (l2_sublayer) {
1426        case 0x0000:
1427            result = L2TPv3_L2_SPECIFIC_NONE; break;
1428        case 0x0001:
1429            result = L2TPv3_L2_SPECIFIC_DEFAULT; break;
1430        case 0x0002:
1431            result = L2TPv3_L2_SPECIFIC_ATM; break;
1432        case 0x0003:
1433            result = L2TPv3_L2_SPECIFIC_DOCSIS_DMPT; break;
1434        default:
1435            break;
1436     }
1437
1438     switch (msg_type) {
1439         case MESSAGE_TYPE_ICRQ:
1440         case MESSAGE_TYPE_OCRQ:
1441         case MESSAGE_TYPE_ICCN:
1442         case MESSAGE_TYPE_OCCN:
1443             session->lcce1.l2_specific = result;
1444         /* FALL THROUGH */
1445         case MESSAGE_TYPE_ICRP:
1446         case MESSAGE_TYPE_OCRP:
1447             session->lcce2.l2_specific = result;
1448             break;
1449     }
1450
1451     return session;
1452 }
1453
1454 static void update_session(l2tpv3_tunnel_t *tunnel, l2tpv3_session_t *session)
1455 {
1456     l2tpv3_session_t *existing = NULL;
1457
1458     if (tunnel == NULL || session == NULL)
1459         return;
1460
1461     if (session->lcce1.id == 0 && session->lcce2.id == 0)
1462         return;
1463
1464     existing = find_session(tunnel, session->lcce1.id, session->lcce2.id);
1465     if (!existing) {
1466         existing = wmem_new0(wmem_file_scope(), l2tpv3_session_t);
1467         init_session(existing);
1468     }
1469
1470     if (session->lcce1.id != 0)
1471         existing->lcce1.id = session->lcce1.id;
1472
1473     if (session->lcce2.id != 0)
1474         existing->lcce2.id = session->lcce2.id;
1475
1476     if (session->lcce1.cookie_len != -1)
1477         existing->lcce1.cookie_len = session->lcce1.cookie_len;
1478
1479     if (session->lcce2.cookie_len != -1)
1480         existing->lcce2.cookie_len = session->lcce2.cookie_len;
1481
1482     if (session->lcce1.l2_specific != -1)
1483         existing->lcce1.l2_specific = session->lcce1.l2_specific;
1484
1485     if (session->lcce2.l2_specific != -1)
1486         existing->lcce2.l2_specific = session->lcce2.l2_specific;
1487
1488     if (session->pw_type != -1)
1489         existing->pw_type = session->pw_type;
1490
1491     if (tunnel->sessions == NULL) {
1492         tunnel->sessions = g_slist_append(tunnel->sessions, existing);
1493         list_heads = g_slist_append(list_heads, tunnel->sessions);
1494     } else {
1495         tunnel->sessions = g_slist_append(tunnel->sessions, existing);
1496     }
1497 }
1498
1499 static void l2tp_prompt(packet_info *pinfo _U_, gchar* result)
1500 {
1501     g_snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Decode L2TPv3 packet type 0x%04x as",
1502         GPOINTER_TO_UINT(p_get_proto_data(pinfo->pool, pinfo, proto_l2tp, 0)));
1503 }
1504
1505 static gpointer l2tp_value(packet_info *pinfo _U_)
1506 {
1507     return p_get_proto_data(pinfo->pool, pinfo, proto_l2tp, 0);
1508 }
1509
1510 /*
1511  * Dissect CISCO AVP:s
1512  */
1513 static int dissect_l2tp_cisco_avps(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guint32 ccid) {
1514
1515     int offset = 0;
1516     int         avp_type;
1517     guint32     avp_vendor_id;
1518     guint16     avp_len;
1519     guint16     ver_len_hidden;
1520     proto_tree *l2tp_avp_tree, *l2tp_avp_tree_sub;
1521
1522     ver_len_hidden  = tvb_get_ntohs(tvb, offset);
1523     avp_len         = AVP_LENGTH(ver_len_hidden);
1524     avp_vendor_id   = tvb_get_ntohs(tvb, offset + 2);
1525     avp_type        = tvb_get_ntohs(tvb, offset + 4);
1526
1527     l2tp_avp_tree =  proto_tree_add_subtree_format(tree, tvb, offset,
1528                               avp_len, ett_l2tp_avp, NULL, "Vendor %s (%u): %s AVP",
1529                               enterprises_lookup(avp_vendor_id, "Unknown"), avp_vendor_id,
1530                               val_to_str(avp_type, cisco_avp_type_vals, "Unknown (%u)"));
1531
1532     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_mandatory, tvb, offset, 2, ENC_BIG_ENDIAN);
1533     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hidden, tvb, offset, 2, ENC_BIG_ENDIAN);
1534     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_length, tvb, offset, 2, ENC_BIG_ENDIAN);
1535
1536     if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
1537         offset += avp_len;
1538         return offset;
1539     }
1540
1541     offset += 2;
1542     avp_len -= 2;
1543
1544     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1545     offset += 2;
1546     avp_len -= 2;
1547
1548     proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_cisco_avp_type, tvb, offset, 2, avp_type);
1549     offset += 2;
1550     avp_len -= 2;
1551
1552     switch (avp_type) {
1553     case CISCO_ACK:
1554         /* process_l2tpv3_control does not set COL_INFO for vendor messages */
1555         col_add_fstr(pinfo->cinfo, COL_INFO, "%s - Cisco ACK (tunnel id=%u)", control_msg, ccid);
1556         break;
1557
1558     case CISCO_ASSIGNED_CONNECTION_ID:
1559         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_assigned_control_connection_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1560         break;
1561
1562     case CISCO_PW_CAPABILITY_LIST:
1563         l2tp_avp_tree_sub = proto_tree_add_subtree(l2tp_avp_tree, tvb, offset, avp_len,
1564                                     ett_l2tp_avp_sub, NULL, "Pseudowire Capabilities List");
1565         while (avp_len >= 2) {
1566             proto_tree_add_item(l2tp_avp_tree_sub, hf_l2tp_cisco_pw_type, tvb, offset, 2, ENC_BIG_ENDIAN);
1567             offset += 2;
1568             avp_len -= 2;
1569         }
1570         break;
1571
1572     case CISCO_LOCAL_SESSION_ID:
1573         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_local_session_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1574         break;
1575     case CISCO_REMOTE_SESSION_ID:
1576         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_remote_session_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1577         break;
1578     case CISCO_ASSIGNED_COOKIE:
1579         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_assigned_cookie, tvb, offset, avp_len, ENC_NA);
1580         break;
1581     case CISCO_REMOTE_END_ID:
1582         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_remote_end_id, tvb, offset, avp_len, ENC_NA|ENC_ASCII);
1583         break;
1584     case CISCO_PW_TYPE:
1585         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_pseudowire_type, tvb, offset, 2, ENC_BIG_ENDIAN);
1586         break;
1587     case CISCO_CIRCUIT_STATUS:
1588         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_circuit_status, tvb, offset, 2, ENC_BIG_ENDIAN);
1589         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_circuit_type, tvb, offset, 2, ENC_BIG_ENDIAN);
1590         break;
1591     case CISCO_SESSION_TIE_BREAKER:
1592         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_tie_breaker,
1593                             tvb, offset, 8, ENC_BIG_ENDIAN);
1594         break;
1595     case CISCO_DRAFT_AVP_VERSION:
1596         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_draft_avp_version, tvb, offset, 2, ENC_BIG_ENDIAN);
1597         break;
1598     case CISCO_MESSAGE_DIGEST:
1599         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_message_digest, tvb, offset, avp_len, ENC_NA);
1600         break;
1601     case CISCO_AUTH_NONCE:
1602         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_nonce, tvb, offset, avp_len, ENC_NA);
1603         break;
1604     case CISCO_INTERFACE_MTU:
1605         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cisco_interface_mtu, tvb, offset, avp_len, ENC_BIG_ENDIAN);
1606         break;
1607
1608     default:
1609         proto_tree_add_expert(l2tp_avp_tree, pinfo, &ei_l2tp_vendor_specific_avp_data, tvb, offset, avp_len);
1610         break;
1611     }
1612     offset += avp_len;
1613
1614     return offset;
1615 }
1616
1617 /*
1618  * Dissect Broadband Forums AVP:s
1619  */
1620 static int dissect_l2tp_broadband_avps(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree) {
1621
1622     int offset = 0;
1623     int         avp_type;
1624     guint32     avp_vendor_id;
1625     guint16     avp_len;
1626     guint16     ver_len_hidden;
1627     proto_tree *l2tp_avp_tree, *l2tp_avp_ale_tree;
1628     proto_item *ta;
1629
1630     ver_len_hidden  = tvb_get_ntohs(tvb, offset);
1631     avp_len         = AVP_LENGTH(ver_len_hidden);
1632     avp_vendor_id   = tvb_get_ntohs(tvb, offset + 2);
1633     avp_type        = tvb_get_ntohs(tvb, offset + 4);
1634
1635     l2tp_avp_tree =  proto_tree_add_subtree_format(tree, tvb, offset,
1636                               avp_len, ett_l2tp_avp, NULL, "Vendor %s (%u): %s AVP",
1637                               enterprises_lookup(avp_vendor_id, "Unknown"), avp_vendor_id,
1638                               val_to_str(avp_type, broadband_avp_type_vals, "Unknown (%u)"));
1639
1640     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_mandatory, tvb, offset, 2, ENC_BIG_ENDIAN);
1641     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hidden, tvb, offset, 2, ENC_BIG_ENDIAN);
1642     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_length, tvb, offset, 2, ENC_BIG_ENDIAN);
1643
1644     if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
1645         offset += avp_len;
1646         return offset;
1647     }
1648
1649     offset += 2;
1650     avp_len -= 2;
1651
1652     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1653     offset += 2;
1654     avp_len -= 2;
1655
1656     proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_broadband_avp_type, tvb, offset, 2, avp_type);
1657     offset += 2;
1658     avp_len -= 2;
1659
1660     switch (avp_type) {
1661
1662     case BROADBAND_AGENT_CIRCUIT_ID:
1663         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_agent_circuit_id, tvb, offset, avp_len, ENC_UTF_8|ENC_NA);
1664         break;
1665
1666     case BROADBAND_AGENT_REMOTE_ID:
1667         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_agent_remote_id, tvb, offset, avp_len, ENC_UTF_8|ENC_NA);
1668         break;
1669
1670     case BROADBAND_ACTUAL_DR_UP:
1671         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_actual_dr_up, tvb, offset, 8, ENC_BIG_ENDIAN);
1672         break;
1673
1674     case BROADBAND_ACTUAL_DR_DOWN:
1675         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_actual_dr_down, tvb, offset, 8, ENC_BIG_ENDIAN);
1676         break;
1677
1678     case BROADBAND_MINIMUM_DR_UP:
1679         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_minimum_dr_up, tvb, offset, 8, ENC_BIG_ENDIAN);
1680         break;
1681
1682     case BROADBAND_MINIMUM_DR_DOWN:
1683         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_minimum_dr_down, tvb, offset, 8, ENC_BIG_ENDIAN);
1684         break;
1685
1686     case BROADBAND_ATTAINABLE_DR_UP:
1687         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_attainable_dr_up, tvb, offset, 8, ENC_BIG_ENDIAN);
1688         break;
1689
1690     case BROADBAND_ATTAINABLE_DR_DOWN:
1691         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_attainable_dr_down, tvb, offset, 8, ENC_BIG_ENDIAN);
1692         break;
1693
1694     case BROADBAND_MAXIMUM_DR_UP:
1695         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_maximum_dr_up, tvb, offset, 8, ENC_BIG_ENDIAN);
1696         break;
1697
1698     case BROADBAND_MAXIMUM_DR_DOWN:
1699         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_maximum_dr_down, tvb, offset, 8, ENC_BIG_ENDIAN);
1700         break;
1701
1702     case BROADBAND_MINIMUM_DR_UP_LOW_POWER:
1703         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_minimum_dr_up_low_power, tvb, offset, 8, ENC_BIG_ENDIAN);
1704         break;
1705
1706     case BROADBAND_MINIMUM_DR_DOWN_LOW_POWER:
1707         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_minimum_dr_down_low_power, tvb, offset, 8, ENC_BIG_ENDIAN);
1708         break;
1709
1710     case BROADBAND_MAXIMUM_INTERLEAVING_DELAY_UP:
1711         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_maximum_interleaving_delay_up, tvb, offset, 4, ENC_BIG_ENDIAN);
1712         break;
1713
1714     case BROADBAND_ACTUAL_INTERLEAVING_DELAY_UP:
1715         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_actual_interleaving_delay_up, tvb, offset, 4, ENC_BIG_ENDIAN);
1716         break;
1717
1718     case BROADBAND_MAXIMUM_INTERLEAVING_DELAY_DOWN:
1719         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_maximum_interleaving_delay_down, tvb, offset, 4, ENC_BIG_ENDIAN);
1720         break;
1721
1722     case BROADBAND_ACTUAL_INTERLEAVING_DELAY_DOWN:
1723         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_actual_interleaving_delay_down, tvb, offset, 4, ENC_BIG_ENDIAN);
1724         break;
1725
1726     case BROADBAND_ACCESS_LOOP_ENCAPSULATION:
1727         {
1728         ta = proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_access_loop_encapsulation, tvb, offset, avp_len, ENC_NA);
1729         l2tp_avp_ale_tree = proto_item_add_subtree(ta, ett_l2tp_ale_sub);
1730         proto_tree_add_item(l2tp_avp_ale_tree, hf_l2tp_broadband_access_loop_encapsulation_data_link, tvb, offset, 1, ENC_BIG_ENDIAN);
1731         proto_tree_add_item(l2tp_avp_ale_tree, hf_l2tp_broadband_access_loop_encapsulation_enc1, tvb, offset+1, 1, ENC_BIG_ENDIAN);
1732         proto_tree_add_item(l2tp_avp_ale_tree, hf_l2tp_broadband_access_loop_encapsulation_enc2, tvb, offset+2, 1, ENC_BIG_ENDIAN);
1733         }
1734         break;
1735
1736     case BROADBAND_ANCP_ACCESS_LINE_TYPE:
1737         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_ancp_access_line_type, tvb, offset, avp_len, ENC_BIG_ENDIAN);
1738         break;
1739
1740     case BROADBAND_IWF_SESSION:
1741         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_broadband_iwf_session, tvb, offset, avp_len, ENC_BIG_ENDIAN);
1742         break;
1743
1744     default:
1745         proto_tree_add_expert(l2tp_avp_tree, pinfo, &ei_l2tp_vendor_specific_avp_data, tvb, offset, avp_len);
1746         break;
1747     }
1748     offset += avp_len;
1749
1750     return offset;
1751 }
1752
1753 /*
1754  * Dissect Ericsson AVP:s
1755  */
1756
1757 /* Dissect a single variable-length Ericsson Transport Configuration Group */
1758 static int dissect_l2tp_ericsson_transp_cfg(tvbuff_t *tvb, proto_tree *parent_tree)
1759 {
1760     int offset = 0;
1761     guint32 i, num_sapis;
1762     proto_tree *tree;
1763
1764     while (tvb_reported_length_remaining(tvb, offset) >= 8) {
1765         tree = proto_tree_add_subtree_format(parent_tree, tvb, 0, -1, ett_l2tp_ericsson_tcg,
1766                                              NULL, "Transport Config Bundling Group");
1767         proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_group_id, tvb, offset++, 1, ENC_NA);
1768         proto_tree_add_item_ret_uint(tree, hf_l2tp_ericsson_tcg_num_sapis, tvb, offset++, 1, ENC_NA, &num_sapis);
1769         for (i = 0; i < num_sapis; i++) {
1770             proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_sapi, tvb, offset++, 1, ENC_NA);
1771         }
1772         proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_ip, tvb, offset, 4, ENC_NA);
1773         offset += 4;
1774         proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_dscp, tvb, offset++, 1, ENC_NA);
1775         proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_crc32_enable, tvb, offset++, 1, ENC_NA);
1776         proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_bundling_tout, tvb, offset++, 1, ENC_NA);
1777         proto_tree_add_item(tree, hf_l2tp_ericsson_tcg_bundling_max_pkt, tvb, offset, 2, ENC_BIG_ENDIAN);
1778         offset += 2;
1779     }
1780
1781     return offset;
1782 }
1783
1784 /* Dissect a single 3-byte Ericsson TEI-to-SC Map */
1785 static int dissect_l2tp_ericsson_tei_sc_map(tvbuff_t *tvb, proto_tree *parent_tree)
1786 {
1787     int i = 0, offset = 0;
1788     proto_tree *tree;
1789
1790     while (tvb_reported_length_remaining(tvb, offset) >= 3) {
1791         tree = proto_tree_add_subtree_format(parent_tree, tvb, offset, 3, ett_l2tp_ericsson_map,
1792                                              NULL, "Transport Config Bundling Group %u", i);
1793         proto_tree_add_item(tree, hf_l2tp_ericsson_map_tei_low, tvb, offset++, 1, ENC_NA);
1794         proto_tree_add_item(tree, hf_l2tp_ericsson_map_tei_high, tvb, offset++, 1, ENC_NA);
1795         proto_tree_add_item(tree, hf_l2tp_ericsson_map_sc, tvb, offset++, 1, ENC_NA);
1796         i++;
1797     }
1798     return offset;
1799 }
1800
1801 static int dissect_l2tp_ericsson_avps(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guint32 ccid)
1802 {
1803     int offset = 0;
1804     int         avp_type;
1805     guint32     avp_vendor_id;
1806     guint16     avp_len;
1807     guint16     ver_len_hidden;
1808     guint32     msg_type;
1809     proto_tree *l2tp_avp_tree;
1810     tvbuff_t   *tcg_tvb;
1811
1812     ver_len_hidden  = tvb_get_ntohs(tvb, offset);
1813     avp_len         = AVP_LENGTH(ver_len_hidden);
1814     avp_vendor_id   = tvb_get_ntohs(tvb, offset + 2);
1815     avp_type        = tvb_get_ntohs(tvb, offset + 4);
1816
1817     l2tp_avp_tree =  proto_tree_add_subtree_format(tree, tvb, offset,
1818                               avp_len, ett_l2tp_avp, NULL, "Vendor %s (%u): %s AVP",
1819                               enterprises_lookup(avp_vendor_id, "Unknown"), avp_vendor_id,
1820                               val_to_str(avp_type, ericsson_avp_type_vals, "Unknown (%u)"));
1821
1822     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_mandatory, tvb, offset, 2, ENC_BIG_ENDIAN);
1823     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hidden, tvb, offset, 2, ENC_BIG_ENDIAN);
1824     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_length, tvb, offset, 2, ENC_BIG_ENDIAN);
1825
1826     if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
1827         offset += avp_len;
1828         return offset;
1829     }
1830
1831     offset += 2;
1832     avp_len -= 2;
1833
1834     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1835     offset += 2;
1836     avp_len -= 2;
1837
1838     proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_ericsson_avp_type, tvb, offset, 2, avp_type);
1839     offset += 2;
1840     avp_len -= 2;
1841
1842     ccid++;
1843
1844     switch (avp_type) {
1845     case ERICSSON_MSG_TYPE:
1846         proto_tree_add_item_ret_uint(l2tp_avp_tree, hf_l2tp_ericsson_msg_type, tvb, offset, 2, ENC_BIG_ENDIAN, &msg_type);
1847         col_add_fstr(pinfo->cinfo, COL_INFO, "%s - %s", control_msg, val_to_str(msg_type, ericsson_short_msg_type_vals, "Unknown (0x%x)"));
1848         break;
1849     case ERICSSON_PROTO_VERSION:
1850         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_ver_pref, tvb, offset, 4, ENC_BIG_ENDIAN);
1851         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_ver_2, tvb, offset+4, 4, ENC_BIG_ENDIAN);
1852         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_ver_3, tvb, offset+8, 4, ENC_BIG_ENDIAN);
1853         break;
1854     case ERICSSON_CONN_TYPE:
1855         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_conn_type, tvb, offset, 1, ENC_NA);
1856         break;
1857     case ERICSSON_STN_NAME:
1858         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_stn_name, tvb, offset, avp_len, ENC_ASCII|ENC_NA);
1859         break;
1860     case ERICSSON_CRC_ENABLED:
1861         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_crc32_enable, tvb, offset, avp_len, ENC_NA);
1862         break;
1863     case ERICSSON_ABIS_LOWER_MODE:
1864         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_abis_lower_mode, tvb, offset, 1, ENC_NA);
1865         break;
1866     case ERICSSON_TRANSPORT_CONFIG:
1867         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_tc_overl_thresh, tvb, offset, 2, ENC_BIG_ENDIAN);
1868         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_tc_num_groups, tvb, offset+2, 1, ENC_NA);
1869         /* FIXME: iterate over multiple groups */
1870         tcg_tvb = tvb_new_subset_length(tvb, offset+3, avp_len-3);
1871         dissect_l2tp_ericsson_transp_cfg(tcg_tvb, l2tp_avp_tree);
1872         break;
1873     case ERICSSON_TEI_TO_SC_MAP:
1874         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_ericsson_tc_num_maps, tvb, offset++, 1, ENC_NA);
1875         tcg_tvb = tvb_new_subset_length(tvb, offset, avp_len);
1876         offset += dissect_l2tp_ericsson_tei_sc_map(tcg_tvb, l2tp_avp_tree);
1877         break;
1878
1879     default:
1880         proto_tree_add_expert(l2tp_avp_tree, pinfo, &ei_l2tp_vendor_specific_avp_data, tvb, offset, avp_len);
1881         break;
1882     }
1883     offset += avp_len;
1884
1885     return offset;
1886 }
1887
1888 /*
1889  * Ref: http://www.cablelabs.com/specifications/CM-SP-DEPI-I08-100611.pdf
1890  */
1891 static int
1892 dissect_l2tp_vnd_cablelabs_avps(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1893 {
1894     int offset = 0;
1895     int         avp_type;
1896     guint32     avp_vendor_id;
1897     guint32     avp_len;
1898     guint16     ver_len_hidden;
1899     proto_tree *l2tp_avp_tree;
1900
1901     ver_len_hidden  = tvb_get_ntohs(tvb, offset);
1902     avp_len         = AVP_LENGTH(ver_len_hidden);
1903     avp_vendor_id   = tvb_get_ntohs(tvb, offset + 2);
1904     avp_type        = tvb_get_ntohs(tvb, offset + 4);
1905
1906     l2tp_avp_tree =  proto_tree_add_subtree_format(tree, tvb, offset,
1907                               avp_len, ett_l2tp_avp, NULL, "Vendor %s (%u): %s AVP",
1908                               enterprises_lookup(avp_vendor_id, "Unknown"), avp_vendor_id,
1909                               val_to_str(avp_type, cablelabs_avp_type_vals, "Unknown (%u)"));
1910
1911     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_mandatory, tvb, offset, 2, ENC_BIG_ENDIAN);
1912     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hidden, tvb, offset, 2, ENC_BIG_ENDIAN);
1913     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_length, tvb, offset, 2, ENC_BIG_ENDIAN);
1914
1915     if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
1916         offset += avp_len;
1917         return offset;
1918     }
1919
1920     offset += 2;
1921     avp_len -= 2;
1922
1923     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1924     offset += 2;
1925     avp_len -= 2;
1926
1927     proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_cablelabs_avp_type, tvb, offset, 2, avp_type);
1928     offset += 2;
1929     avp_len -= 2;
1930
1931     switch (avp_type) {
1932     case 101:
1933         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_l_bit, tvb, offset, 2, ENC_BIG_ENDIAN);
1934         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_tsid_group_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1935         offset+=2;
1936         avp_len-=2;
1937         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_frequency, tvb, offset, 4, ENC_BIG_ENDIAN);
1938         avp_len -= 4;
1939         offset+=4;
1940         break;
1941     case 103:
1942         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_l_bit, tvb, offset, 2, ENC_BIG_ENDIAN);
1943         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_tsid_group_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1944         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_modulation, tvb, offset, 2, ENC_BIG_ENDIAN);
1945         offset+=2;
1946         avp_len-=2;
1947         break;
1948     case 105:
1949         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_l_bit, tvb, offset, 2, ENC_BIG_ENDIAN);
1950         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_tsid_group_id, tvb, offset, 2, ENC_BIG_ENDIAN);
1951         offset+=2;
1952         avp_len-=2;
1953         while(avp_len > 0){
1954             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_m, tvb, offset, 2, ENC_BIG_ENDIAN);
1955             offset+=2;
1956             avp_len-=2;
1957             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_cablel_avp_n, tvb, offset, 2, ENC_BIG_ENDIAN);
1958             offset+=2;
1959             avp_len-=2;
1960         }
1961         break;
1962     default:
1963         proto_tree_add_expert(l2tp_avp_tree, pinfo, &ei_l2tp_vendor_specific_avp_data, tvb, offset, avp_len);
1964         break;
1965     }
1966     offset += avp_len;
1967
1968     return offset;
1969 }
1970
1971
1972 /*
1973  * Processes AVPs for Control Messages all versions and transports
1974  */
1975 static void process_control_avps(tvbuff_t *tvb,
1976                                  packet_info *pinfo,
1977                                  proto_tree *l2tp_tree,
1978                                  int idx,
1979                                  int length,
1980                                  guint32 ccid,
1981                                  l2tpv3_tunnel_t *tunnel)
1982 {
1983     proto_tree *l2tp_lcp_avp_tree, *l2tp_avp_tree = NULL, *l2tp_avp_tree_sub, *l2tp_avp_csu_tree;
1984     proto_item *te, *tc;
1985
1986     int                msg_type  = 0;
1987     gboolean           isStopCcn = FALSE;
1988     int                avp_type;
1989     guint32            avp_vendor_id;
1990     guint16            avp_len;
1991     guint16            ver_len_hidden;
1992     tvbuff_t          *next_tvb, *avp_tvb;
1993     int                digest_idx = 0;
1994     guint16            digest_avp_len = 0;
1995     proto_item        *digest_item = NULL;
1996     l2tp_cntrl_data_t *l2tp_cntrl_data = wmem_new0(wmem_packet_scope(), l2tp_cntrl_data_t);
1997
1998     l2tpv3_session_t *session = NULL;
1999
2000     l2tp_cntrl_data->ccid = ccid;
2001
2002     while (idx < length) {    /* Process AVP's */
2003         ver_len_hidden  = tvb_get_ntohs(tvb, idx);
2004         avp_len         = AVP_LENGTH(ver_len_hidden);
2005         avp_vendor_id   = tvb_get_ntohs(tvb, idx + 2);
2006         avp_type        = tvb_get_ntohs(tvb, idx + 4);
2007
2008         if (avp_len < 6) {
2009             proto_tree_add_expert_format(l2tp_avp_tree ? l2tp_avp_tree : l2tp_tree, pinfo, &ei_l2tp_avp_length, tvb, idx, 2, "AVP length must be >= 6, got %u", avp_len);
2010             return;
2011         }
2012
2013         if (avp_vendor_id != VENDOR_IETF) {
2014
2015             avp_tvb = tvb_new_subset_length(tvb, idx, avp_len);
2016
2017             if (avp_vendor_id == VENDOR_CISCO) {      /* Vendor-Specific AVP */
2018
2019                 dissect_l2tp_cisco_avps(avp_tvb, pinfo, l2tp_tree, ccid);
2020                 idx += avp_len;
2021                 continue;
2022
2023             } else if (avp_vendor_id == VENDOR_BROADBAND_FORUM) {      /* Vendor-Specific AVP */
2024
2025                 dissect_l2tp_broadband_avps(avp_tvb, pinfo, l2tp_tree);
2026                 idx += avp_len;
2027                 continue;
2028
2029             } else if (avp_vendor_id == VENDOR_ERICSSON) {      /* Vendor-Specific AVP */
2030
2031                 dissect_l2tp_ericsson_avps(avp_tvb, pinfo, l2tp_tree, ccid);
2032                 idx += avp_len;
2033                 continue;
2034
2035             } else {
2036                 /* Vendor-Specific AVP */
2037                 if (!dissector_try_uint_new(l2tp_vendor_avp_dissector_table, avp_vendor_id, avp_tvb, pinfo, l2tp_tree, FALSE, l2tp_cntrl_data)){
2038                     l2tp_avp_tree =  proto_tree_add_subtree_format(l2tp_tree, tvb, idx,
2039                                           avp_len, ett_l2tp_avp, NULL, "Vendor %s (%u) AVP Type %u",
2040                                           enterprises_lookup(avp_vendor_id, "Unknown"), avp_vendor_id,
2041                                           avp_type);
2042
2043                     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_mandatory, tvb, idx, 2, ENC_BIG_ENDIAN);
2044                     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hidden, tvb, idx, 2, ENC_BIG_ENDIAN);
2045                     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_length, tvb, idx, 2, ENC_BIG_ENDIAN);
2046
2047                     if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
2048                         idx += avp_len;
2049                         continue;
2050                     }
2051                     idx += 2;
2052                     proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id, tvb, idx, 2, ENC_BIG_ENDIAN);
2053                     idx += 2;
2054
2055                     proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type, tvb, idx, 2, avp_type);
2056                     idx += 2;
2057                     proto_tree_add_expert(l2tp_avp_tree, pinfo, &ei_l2tp_vendor_specific_avp_data, tvb, idx, avp_len-6);
2058                     avp_len-=6;
2059                 }
2060                 idx += avp_len;
2061                 continue;
2062             }
2063         }
2064
2065         /* IETF AVP:s */
2066         l2tp_avp_tree =  proto_tree_add_subtree_format(l2tp_tree, tvb, idx,
2067                                   avp_len, ett_l2tp_avp, NULL, "%s AVP",
2068                                   val_to_str_ext(avp_type, &avp_type_vals_ext, "Unknown (%u)"));
2069
2070         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_mandatory, tvb, idx, 2, ENC_BIG_ENDIAN);
2071         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hidden, tvb, idx, 2, ENC_BIG_ENDIAN);
2072         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_length, tvb, idx, 2, ENC_BIG_ENDIAN);
2073
2074         if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
2075             idx += avp_len;
2076             continue;
2077         }
2078
2079         idx += 2;
2080         avp_len -= 2;
2081
2082         /* Special Case for handling Extended Vendor Id */
2083         if (avp_type == EXTENDED_VENDOR_ID) {
2084             idx += 2;
2085             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
2086                                 tvb, idx, 4, ENC_BIG_ENDIAN);
2087
2088
2089             idx += 4;
2090             continue;
2091         }
2092         else {
2093             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
2094                                 tvb, idx, 2, ENC_BIG_ENDIAN);
2095             idx += 2;
2096             avp_len -= 2;
2097         }
2098
2099         proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
2100                             tvb, idx, 2, avp_type);
2101         idx += 2;
2102         avp_len -= 2;
2103
2104         switch (avp_type) {
2105
2106         case CONTROL_MESSAGE:
2107             msg_type = tvb_get_ntohs(tvb, idx);
2108             l2tp_cntrl_data->msg_type = msg_type;
2109             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_message_type,
2110                                 tvb, idx, 2, ENC_BIG_ENDIAN);
2111
2112             if (msg_type == MESSAGE_TYPE_StopCCN) {
2113                 isStopCcn = TRUE;
2114             }
2115             break;
2116
2117         case RESULT_ERROR_CODE:
2118             if (avp_len < 2)
2119                 break;
2120             if (isStopCcn) {
2121                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_stop_ccn_result_code, tvb, idx, 2, ENC_BIG_ENDIAN);
2122             }
2123             else {
2124                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_result_code, tvb, idx, 2, ENC_BIG_ENDIAN);
2125             }
2126             idx += 2;
2127             avp_len -= 2;
2128
2129             if (avp_len < 2)
2130                 break;
2131             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_error_code, tvb, idx, 2, ENC_BIG_ENDIAN);
2132             idx += 2;
2133             avp_len -= 2;
2134
2135             if (avp_len == 0)
2136                 break;
2137             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_error_message, tvb, idx, avp_len, ENC_ASCII|ENC_NA);
2138             break;
2139
2140         case PROTOCOL_VERSION:
2141             if (avp_len < 1)
2142                 break;
2143             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_protocol_version, tvb, idx, 1, ENC_BIG_ENDIAN);
2144             idx += 1;
2145             avp_len -= 1;
2146
2147             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_protocol_revision, tvb, idx, 1, ENC_BIG_ENDIAN);
2148             break;
2149
2150         case FRAMING_CAPABILITIES:
2151             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_async_framing_supported, tvb, idx, 4, ENC_BIG_ENDIAN);
2152             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_sync_framing_supported, tvb, idx, 4, ENC_BIG_ENDIAN);
2153             break;
2154
2155         case BEARER_CAPABILITIES:
2156             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_analog_access_supported, tvb, idx, 4, ENC_BIG_ENDIAN);
2157             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_digital_access_supported, tvb, idx, 4, ENC_BIG_ENDIAN);
2158             break;
2159
2160         case TIE_BREAKER:
2161             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker, tvb, idx, 8, ENC_BIG_ENDIAN);
2162             break;
2163
2164         case FIRMWARE_REVISION:
2165             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_firmware_revision, tvb, idx, 2, ENC_BIG_ENDIAN);
2166             break;
2167
2168         case HOST_NAME:
2169             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_host_name, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2170             break;
2171
2172         case VENDOR_NAME:
2173             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_name, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2174             break;
2175
2176         case ASSIGNED_TUNNEL_ID:
2177             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_assigned_tunnel_id, tvb, idx, 2, ENC_BIG_ENDIAN);
2178             break;
2179
2180         case RECEIVE_WINDOW_SIZE:
2181             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_receive_window_size, tvb, idx, 2, ENC_BIG_ENDIAN);
2182             break;
2183
2184         case CHALLENGE:
2185             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_chap_challenge, tvb, idx, avp_len, ENC_NA);
2186             break;
2187
2188         case CAUSE_CODE:
2189             /*
2190              * XXX - export stuff from the Q.931 dissector
2191              * to dissect the cause code and cause message,
2192              * and use it.
2193              */
2194             if (avp_len < 2)
2195                 break;
2196             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_cause_code, tvb, idx, 2, ENC_BIG_ENDIAN);
2197             idx += 2;
2198             avp_len -= 2;
2199
2200             if (avp_len < 1)
2201                 break;
2202             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_cause_msg, tvb, idx, 1, ENC_BIG_ENDIAN);
2203             idx += 1;
2204             avp_len -= 1;
2205
2206             if (avp_len == 0)
2207                 break;
2208             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_advisory_msg, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2209             break;
2210
2211         case CHALLENGE_RESPONSE:
2212             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_chap_challenge_response, tvb, idx, 16, ENC_NA);
2213             break;
2214
2215         case ASSIGNED_SESSION:
2216             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_assigned_session_id, tvb, idx, 2, ENC_BIG_ENDIAN);
2217             break;
2218
2219         case CALL_SERIAL_NUMBER:
2220             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_call_serial_number, tvb, idx, 4, ENC_BIG_ENDIAN);
2221             break;
2222
2223         case MINIMUM_BPS:
2224             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_minimum_bps, tvb, idx, 4, ENC_BIG_ENDIAN);
2225             break;
2226
2227         case MAXIMUM_BPS:
2228             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_maximum_bps, tvb, idx, 4, ENC_BIG_ENDIAN);
2229             break;
2230
2231         case BEARER_TYPE:
2232             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_analog_bearer_type, tvb, idx, 4, ENC_BIG_ENDIAN);
2233             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_digital_bearer_type, tvb, idx, 4, ENC_BIG_ENDIAN);
2234             break;
2235
2236         case FRAMING_TYPE:
2237             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_async_framing_type, tvb, idx, 4, ENC_BIG_ENDIAN);
2238             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_sync_framing_type, tvb, idx, 4, ENC_BIG_ENDIAN);
2239             break;
2240
2241         case CALLED_NUMBER:
2242             if (avp_len == 0)
2243                 break;
2244             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_called_number,
2245                                 tvb, idx, avp_len, ENC_ASCII|ENC_NA);
2246             break;
2247
2248         case CALLING_NUMBER:
2249             if (avp_len == 0)
2250                 break;
2251             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_calling_number,
2252                                 tvb, idx, avp_len, ENC_ASCII|ENC_NA);
2253             break;
2254
2255         case SUB_ADDRESS:
2256             if (avp_len == 0)
2257                 break;
2258             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_sub_address, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2259             break;
2260
2261         case TX_CONNECT_SPEED:
2262             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_connect_speed, tvb, idx, 4, ENC_BIG_ENDIAN);
2263             break;
2264
2265         case PHYSICAL_CHANNEL:
2266             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_physical_channel, tvb, idx, 4, ENC_BIG_ENDIAN);
2267             break;
2268
2269         case INITIAL_RECEIVED_LCP_CONFREQ:
2270             te = proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_initial_received_lcp_confreq, tvb, idx, avp_len, ENC_NA);
2271             l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
2272             next_tvb = tvb_new_subset_length(tvb, idx, avp_len);
2273             call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
2274             break;
2275
2276         case LAST_SENT_LCP_CONFREQ:
2277             te = proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_last_sent_lcp_confreq, tvb, idx, avp_len, ENC_NA);
2278             l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
2279             next_tvb = tvb_new_subset_length(tvb, idx, avp_len);
2280             call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
2281             break;
2282
2283         case LAST_RECEIVED_LCP_CONFREQ:
2284             te = proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_last_received_lcp_confreq, tvb, idx, avp_len, ENC_NA);
2285             l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
2286             next_tvb = tvb_new_subset_length(tvb, idx, avp_len);
2287             call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
2288             break;
2289
2290         case PROXY_AUTHEN_TYPE:
2291             msg_type = tvb_get_ntohs(tvb, idx);
2292             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_proxy_authen_type, tvb, idx, 2, ENC_BIG_ENDIAN);
2293             break;
2294
2295         case PROXY_AUTHEN_NAME:
2296             if (avp_len == 0)
2297                 break;
2298             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_proxy_authen_name, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2299             break;
2300
2301         case PROXY_AUTHEN_CHALLENGE:
2302             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_proxy_authen_challenge, tvb, idx, avp_len, ENC_NA);
2303             break;
2304
2305         case PROXY_AUTHEN_ID:
2306             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_proxy_authen_id, tvb, idx + 1, 1, ENC_BIG_ENDIAN);
2307             break;
2308
2309         case PROXY_AUTHEN_RESPONSE:
2310             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_proxy_authen_response, tvb, idx, avp_len, ENC_NA);
2311             break;
2312
2313         case CALL_STATUS_AVPS:
2314             if (avp_len < 2)
2315                 break;
2316             idx += 2;
2317             avp_len -= 2;
2318
2319             if (avp_len < 4)
2320                 break;
2321             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_crc_errors, tvb, idx, 4, ENC_BIG_ENDIAN);
2322             idx += 4;
2323             avp_len -= 4;
2324
2325             if (avp_len < 4)
2326                 break;
2327             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_framing_errors, tvb, idx, 4, ENC_BIG_ENDIAN);
2328             idx += 4;
2329             avp_len -= 4;
2330
2331             if (avp_len < 4)
2332                 break;
2333             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_hardware_overruns, tvb, idx, 4, ENC_BIG_ENDIAN);
2334             idx += 4;
2335             avp_len -= 4;
2336
2337             if (avp_len < 4)
2338                 break;
2339             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_buffer_overruns, tvb, idx, 4, ENC_BIG_ENDIAN);
2340             idx += 4;
2341             avp_len -= 4;
2342
2343             if (avp_len < 4)
2344                 break;
2345             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_time_out_errors, tvb, idx, 4, ENC_BIG_ENDIAN);
2346             idx += 4;
2347             avp_len -= 4;
2348
2349             if (avp_len < 4)
2350                 break;
2351             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_alignment_errors, tvb, idx, 4, ENC_BIG_ENDIAN);
2352             idx += 4;
2353             avp_len -= 4;
2354             break;
2355
2356         case ACCM:
2357             if (avp_len < 2)
2358                 break;
2359             idx += 2;
2360             avp_len -= 2;
2361
2362             if (avp_len < 4)
2363                 break;
2364             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_send_accm, tvb, idx, 4, ENC_BIG_ENDIAN);
2365             idx += 4;
2366             avp_len -= 4;
2367
2368             if (avp_len < 4)
2369                 break;
2370             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_receive_accm, tvb, idx, 4, ENC_BIG_ENDIAN);
2371             idx += 4;
2372             avp_len -= 4;
2373             break;
2374
2375         case RANDOM_VECTOR:
2376             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_random_vector, tvb, idx, avp_len, ENC_NA);
2377             break;
2378
2379         case PRIVATE_GROUP_ID:
2380             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_private_group_id, tvb, idx, avp_len, ENC_NA);
2381             break;
2382
2383         case RX_CONNECT_SPEED:
2384             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_rx_connect_speed, tvb, idx, 4, ENC_BIG_ENDIAN);
2385             break;
2386
2387         case PPP_DISCONNECT_CAUSE_CODE:
2388             if (avp_len < 2)
2389                 break;
2390             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_disconnect_code, tvb, idx, 2, ENC_BIG_ENDIAN);
2391             idx += 2;
2392             avp_len -= 2;
2393
2394             if (avp_len < 2)
2395                 break;
2396             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_control_protocol_number, tvb, idx, 2, ENC_BIG_ENDIAN);
2397             idx += 2;
2398             avp_len -= 2;
2399
2400             if (avp_len < 1)
2401                 break;
2402             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_cause_code_direction, tvb, idx, 1, ENC_BIG_ENDIAN);
2403             idx += 1;
2404             avp_len -= 1;
2405
2406             if (avp_len == 0)
2407                 break;
2408             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_cause_code_message, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2409             break;
2410
2411         case MESSAGE_DIGEST:
2412         {
2413             digest_idx = idx;
2414             digest_avp_len = avp_len;
2415             digest_item = proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_message_digest, tvb, idx, avp_len, ENC_NA);
2416             break;
2417         }
2418         case ROUTER_ID:
2419             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_router_id, tvb, idx, 4, ENC_BIG_ENDIAN);
2420             break;
2421         case ASSIGNED_CONTROL_CONN_ID:
2422             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_assigned_control_conn_id,
2423                                 tvb, idx, 4, ENC_BIG_ENDIAN);
2424             store_ccid(tunnel, tvb, idx, msg_type);
2425             break;
2426         case PW_CAPABILITY_LIST:
2427             l2tp_avp_tree_sub = proto_tree_add_subtree(l2tp_avp_tree, tvb, idx, avp_len,
2428                                      ett_l2tp_avp_sub, NULL, "Pseudowire Capabilities List");
2429
2430             while (avp_len >= 2) {
2431                 proto_tree_add_item(l2tp_avp_tree_sub, hf_l2tp_avp_pw_type, tvb, idx, 2, ENC_BIG_ENDIAN);
2432                 idx += 2;
2433                 avp_len -= 2;
2434             }
2435             break;
2436         case LOCAL_SESSION_ID:
2437             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_local_session_id,
2438                                 tvb, idx, 4, ENC_BIG_ENDIAN);
2439             col_append_fstr(pinfo->cinfo,COL_INFO, ", LSID: %2u",
2440                           tvb_get_ntohl(tvb, idx));
2441             session = store_lsession_id(session, tvb, idx, msg_type);
2442             break;
2443         case REMOTE_SESSION_ID:
2444             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_remote_session_id,
2445                                 tvb, idx, 4, ENC_BIG_ENDIAN);
2446             col_append_fstr(pinfo->cinfo,COL_INFO, ", RSID: %2u",
2447                             tvb_get_ntohl(tvb, idx));
2448             session = store_rsession_id(session, tvb, idx, msg_type);
2449             break;
2450         case ASSIGNED_COOKIE:
2451             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_assigned_cookie, tvb, idx, avp_len, ENC_NA);
2452             session = store_cookie_len(session, avp_len, msg_type);
2453             break;
2454         case REMOTE_END_ID:
2455             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_remote_end_id, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2456             break;
2457         case PW_TYPE:
2458             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_pseudowire_type, tvb, idx, 2, ENC_BIG_ENDIAN);
2459             session = store_pw_type(session, tvb, idx, msg_type);
2460             break;
2461         case L2_SPECIFIC_SUBLAYER:
2462             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_layer2_specific_sublayer, tvb, idx, 2, ENC_BIG_ENDIAN);
2463             session = store_l2_sublayer(session, tvb, idx, msg_type);
2464             break;
2465         case DATA_SEQUENCING:
2466             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_data_sequencing, tvb, idx, 2, ENC_BIG_ENDIAN);
2467             break;
2468         case CIRCUIT_STATUS:
2469             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_circuit_status, tvb, idx, 2, ENC_BIG_ENDIAN);
2470             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_circuit_type, tvb, idx, 2, ENC_BIG_ENDIAN);
2471             break;
2472         case PREFERRED_LANGUAGE:
2473             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_preferred_language, tvb, idx, avp_len, ENC_NA|ENC_ASCII);
2474             break;
2475         case CTL_MSG_AUTH_NONCE:
2476             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_nonce, tvb, idx, avp_len, ENC_NA);
2477             store_cma_nonce(tunnel, tvb, idx, avp_len, msg_type);
2478             break;
2479         case TX_CONNECT_SPEED_V3:
2480             if (avp_len < 8)
2481                 break;
2482
2483             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_tx_connect_speed_v3, tvb, idx, 8, ENC_BIG_ENDIAN);
2484             break;
2485         case RX_CONNECT_SPEED_V3:
2486             if (avp_len < 8)
2487                 break;
2488
2489             proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_rx_connect_speed_v3, tvb, idx, 8, ENC_BIG_ENDIAN);
2490             break;
2491         case CONNECT_SPEED_UPDATE:
2492         {
2493             tc = proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_csu, tvb, idx, avp_len, ENC_NA);
2494             l2tp_avp_csu_tree = proto_item_add_subtree(tc, ett_l2tp_csu);
2495             if (avp_len == 12) {
2496                 /* L2TPv2 */
2497                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_res, tvb, idx, 2, ENC_BIG_ENDIAN);
2498                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_remote_session_id_v2, tvb, idx+2, 2, ENC_BIG_ENDIAN);
2499                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_current_tx_speed_v2, tvb, idx+4, 4, ENC_BIG_ENDIAN);
2500                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_current_rx_speed_v2, tvb, idx+8, 4, ENC_BIG_ENDIAN);
2501             }
2502             else if (avp_len == 20) {
2503                 /* L2TPv3 */
2504                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_remote_session_id_v3, tvb, idx, 4, ENC_BIG_ENDIAN);
2505                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_current_tx_speed_v3, tvb, idx+4, 8, ENC_BIG_ENDIAN);
2506                 proto_tree_add_item(l2tp_avp_csu_tree, hf_l2tp_avp_csu_current_rx_speed_v3, tvb, idx+12, 8, ENC_BIG_ENDIAN);
2507             }
2508             break;
2509         }
2510
2511         default:
2512             if(avp_len>0)
2513                 proto_tree_add_expert(l2tp_avp_tree, pinfo, &ei_l2tp_vendor_specific_avp_data, tvb, idx, avp_len);
2514             break;
2515         }
2516
2517         idx += avp_len;
2518     }
2519
2520     /* SCCRQ digest can only be calculated once we know whether nonces are being used */
2521     if (digest_avp_len) {
2522         if (check_control_digest(tunnel, tvb, length, digest_idx, digest_avp_len, msg_type, pinfo) < 0)
2523             expert_add_info(pinfo, digest_item, &ei_l2tp_incorrect_digest);
2524     }
2525
2526     update_session(tunnel, session);
2527 }
2528
2529 /*
2530  * Processes Data Messages for v3 IP and UDP, starting from the  Session ID
2531  * (common to IP and UDP). Dissects the L2TPv3 Session header, the (optional)
2532  * L2-Specific sublayer and calls the appropriate dissector for the payload.
2533  */
2534 static void
2535 process_l2tpv3_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
2536                     proto_tree *l2tp_tree, proto_item *l2tp_item, int *pIdx,
2537                     l2tpv3_tunnel_t *tunnel)
2538 {
2539     int         idx         = *pIdx;
2540     int         sid;
2541     guint32      oam_cell   = 0;
2542     proto_tree *l2_specific = NULL;
2543     proto_item *ti          = NULL;
2544     tvbuff_t   *next_tvb;
2545     gint        cookie_len  = l2tpv3_cookie;
2546     gint        l2_spec     = l2tpv3_l2_specific;
2547     gint        pw_type     = -1;
2548
2549     lcce_settings_t  *lcce      = NULL;
2550     l2tpv3_session_t *session   = NULL;
2551
2552     /* Get Session ID */
2553     sid = tvb_get_ntohl(tvb, idx);
2554     idx += 4;
2555
2556     if (tunnel) {
2557         if (addresses_equal(&tunnel->lcce1, &pinfo->dst)) {
2558             session = find_session(tunnel, sid, 0);
2559             if (session)
2560                 lcce = &session->lcce1;
2561         } else {
2562             session = find_session(tunnel, 0, sid);
2563             if (session)
2564                 lcce = &session->lcce2;
2565         }
2566     }
2567
2568     if (lcce) {
2569         if (l2_spec == -1)
2570             l2_spec = lcce->l2_specific;
2571         if (cookie_len == -1)
2572             cookie_len = lcce->cookie_len;
2573         if (pw_type == -1)
2574             pw_type = session->pw_type;
2575     }
2576
2577     if (l2_spec == -1)
2578         l2_spec = L2TPv3_L2_SPECIFIC_NONE;
2579
2580     if (pw_type == -1)
2581         pw_type = L2TPv3_PROTOCOL_DEFAULT;
2582
2583     if (cookie_len == -1)
2584         cookie_len = L2TPv3_COOKIE_DEFAULT;
2585
2586     col_add_fstr(pinfo->cinfo,COL_INFO,
2587                     "%s            (session id=%u)",
2588                     data_msg, sid);
2589
2590     if (tree) {
2591         proto_tree_add_item(l2tp_tree, hf_l2tp_sid, tvb, idx-4, 4, ENC_BIG_ENDIAN);
2592         proto_item_set_len(l2tp_item, idx);
2593         if (!(tvb_offset_exists(tvb, idx)))
2594             return;
2595         if (cookie_len != 0)
2596             proto_tree_add_item(l2tp_tree, hf_l2tp_cookie, tvb, idx, cookie_len, ENC_NA);
2597     }
2598
2599     switch(l2_spec){
2600     case L2TPv3_L2_SPECIFIC_DEFAULT:
2601         if (tree) {
2602             ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_def,
2603                                      tvb, idx + cookie_len, 4, ENC_NA);
2604             l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
2605
2606             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb, idx + cookie_len,
2607                                 1, ENC_BIG_ENDIAN);
2608             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
2609                                 idx + cookie_len + 1, 3, ENC_BIG_ENDIAN);
2610         }
2611         next_tvb = tvb_new_subset_remaining(tvb, idx + cookie_len + 4);
2612         break;
2613     case L2TPv3_L2_SPECIFIC_DOCSIS_DMPT:
2614         if (tree) {
2615             ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_docsis_dmpt,
2616                                      tvb, idx + cookie_len, 4, ENC_NA);
2617             l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
2618
2619             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_v, tvb,
2620                                 idx + cookie_len,1, ENC_BIG_ENDIAN);
2621
2622             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb,
2623                                 idx + cookie_len,1, ENC_BIG_ENDIAN);
2624
2625             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_h, tvb,
2626                                 idx + cookie_len,1, ENC_BIG_ENDIAN);
2627
2628             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_flow_id, tvb,
2629                                 idx + cookie_len,1, ENC_BIG_ENDIAN);
2630
2631             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
2632                                 idx + cookie_len + 2,2, ENC_BIG_ENDIAN);
2633         }
2634         next_tvb = tvb_new_subset_remaining(tvb, idx + cookie_len + 4);
2635         break;
2636     case L2TPv3_L2_SPECIFIC_ATM:
2637         if (tree) {
2638             ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_atm,
2639                                      tvb, idx + cookie_len, 4, ENC_NA);
2640             l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
2641
2642             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb, idx + cookie_len,
2643                                 1, ENC_BIG_ENDIAN);
2644             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_t, tvb, idx + cookie_len,
2645                                 1, ENC_BIG_ENDIAN);
2646             /*
2647              * As per RFC 4454, the T bit specifies whether
2648              * we're transporting an OAM cell or an AAL5 frame.
2649              */
2650             oam_cell = tvb_get_guint8(tvb, idx + cookie_len) & 0x08;
2651             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_g, tvb, idx + cookie_len,
2652                                 1, ENC_BIG_ENDIAN);
2653             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_c, tvb, idx + cookie_len,
2654                                 1, ENC_BIG_ENDIAN);
2655             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_u, tvb, idx + cookie_len,
2656                                 1, ENC_BIG_ENDIAN);
2657             proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
2658                                 idx + cookie_len + 1, 3, ENC_BIG_ENDIAN);
2659         }
2660         next_tvb = tvb_new_subset_remaining(tvb, idx + cookie_len + 4);
2661         break;
2662     case L2TPv3_L2_SPECIFIC_LAPD:
2663         if (tree)
2664             proto_tree_add_item(tree, hf_l2tp_lapd_info, tvb, idx + cookie_len + 4, 3, ENC_NA);
2665         next_tvb = tvb_new_subset_remaining(tvb, idx + cookie_len+4+3);
2666         break;
2667     case L2TPv3_L2_SPECIFIC_NONE:
2668     default:
2669         next_tvb = tvb_new_subset_remaining(tvb, idx + cookie_len);
2670         break;
2671     }
2672
2673     p_add_proto_data(pinfo->pool, pinfo, proto_l2tp, 0, GUINT_TO_POINTER((guint)pw_type));
2674
2675     if (!dissector_try_uint_new(pw_type_table, pw_type, next_tvb, pinfo, tree, FALSE, GUINT_TO_POINTER(oam_cell)))
2676     {
2677         call_data_dissector(next_tvb, pinfo, tree);
2678     }
2679 }
2680
2681 static const int * l2tp_control_fields[] = {
2682     &hf_l2tp_type,
2683     &hf_l2tp_length_bit,
2684     &hf_l2tp_seq_bit,
2685     &hf_l2tp_version,
2686     NULL
2687 };
2688
2689 /*
2690  * Processes v3 data message over UDP, to then call process_l2tpv3_data
2691  * from the common part (Session ID)
2692  */
2693 static void
2694 process_l2tpv3_data_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
2695                         l2tpv3_conversation_t *l2tp_conv)
2696 {
2697     proto_tree *l2tp_tree, *ctrl_tree;
2698     proto_item *l2tp_item;
2699     int idx = 4;  /* skip to sid */
2700     int sid;
2701
2702     sid = tvb_get_ntohl(tvb, idx);
2703
2704     l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, ENC_NA);
2705     l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
2706
2707     if (tree) {
2708         proto_item_append_text(l2tp_item, " version 3");
2709
2710         ctrl_tree = proto_tree_add_subtree_format(l2tp_tree, tvb, 0, 2,
2711                                  ett_l2tp_ctrl, NULL, "Packet Type: %s Session Id=%u",
2712                                  data_msg, sid);
2713         proto_tree_add_bitmask_list(ctrl_tree, tvb, 0, 2, l2tp_control_fields, ENC_BIG_ENDIAN);
2714
2715         /* Data in v3 over UDP has this reserved */
2716         proto_tree_add_item(l2tp_tree, hf_l2tp_res, tvb, 2, 2, ENC_BIG_ENDIAN);
2717     }
2718
2719     /* Call process_l2tpv3_data from Session ID (offset in idx of 4) */
2720     process_l2tpv3_data(tvb, pinfo, tree, l2tp_tree, l2tp_item, &idx, l2tp_conv->tunnel);
2721 }
2722
2723 /*
2724  * Processes v3 data message over IP, to then call process_l2tpv3_data
2725  * from the common part (Session ID)
2726  */
2727 static void
2728 process_l2tpv3_data_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
2729                        l2tpv3_conversation_t *l2tp_conv)
2730 {
2731     proto_tree *l2tp_tree;
2732     proto_item *l2tp_item;
2733
2734     int idx = 0;
2735     int sid;
2736
2737     sid = tvb_get_ntohl(tvb, idx);
2738
2739     l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, ENC_NA);
2740     l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
2741     proto_item_append_text(l2tp_item, " version 3");
2742
2743     proto_tree_add_uint_format(l2tp_tree, hf_l2tp_session_id, tvb, 0, 4, sid, "Packet Type: %s Session Id=%u", data_msg, sid);
2744
2745     /* Call process_l2tpv3_data from Session ID (offset in idx of 0) */
2746     process_l2tpv3_data(tvb, pinfo, tree, l2tp_tree, l2tp_item, &idx, l2tp_conv->tunnel);
2747 }
2748
2749 /*
2750  * Processes v3 Control Message over IP, that carries NULL Session ID
2751  * to then call process_control_avps after dissecting the control.
2752  */
2753 static void
2754 process_l2tpv3_control(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int baseIdx,
2755                        l2tpv3_conversation_t *l2tp_conv)
2756 {
2757     proto_tree *l2tp_tree = NULL, *ctrl_tree;
2758     proto_item *l2tp_item = NULL;
2759
2760     int     idx     = baseIdx;
2761     int     tmp_idx;
2762     guint16 length  = 0;        /* Length field */
2763     guint32 ccid    = 0;        /* Control Connection ID */
2764     guint16 vendor_id = 0;
2765     guint16 avp_type;
2766     guint16 msg_type;
2767     guint16 control = 0;
2768
2769     l2tpv3_tunnel_t *tunnel = NULL;
2770     l2tpv3_tunnel_t tmp_tunnel;
2771
2772     control = tvb_get_ntohs(tvb, idx);
2773     idx += 2;                       /* skip ahead */
2774     if (LENGTH_BIT(control)) {      /* length field included ? */
2775         length = tvb_get_ntohs(tvb, idx);
2776         idx += 2;
2777     }
2778
2779     /* Get Control Channel ID */
2780     ccid = tvb_get_ntohl(tvb, idx);
2781     idx += 4;
2782
2783     tmp_idx = idx;
2784
2785     if ((LENGTH_BIT(control))&&(length==12))                /* ZLB Message */
2786         col_add_fstr(pinfo->cinfo, COL_INFO,
2787                         "%s - ZLB      (tunnel id=%u)",
2788                         control_msg , ccid);
2789     else
2790     {
2791         if (SEQUENCE_BIT(control)) {
2792             tmp_idx += 4;
2793         }
2794
2795         tmp_idx+=2;
2796
2797         vendor_id = tvb_get_ntohs(tvb, tmp_idx);
2798         tmp_idx+=2;
2799
2800         avp_type = tvb_get_ntohs(tvb, tmp_idx);
2801         tmp_idx += 2;
2802
2803         /* If it's a vendor AVP let the vendor AVP dissector fill in the info column */
2804         if ( vendor_id == VENDOR_IETF ) {
2805             if (avp_type == CONTROL_MESSAGE) {
2806                 /* We print message type */
2807                 msg_type = tvb_get_ntohs(tvb, tmp_idx);
2808                 col_add_fstr(pinfo->cinfo, COL_INFO,
2809                                 "%s - %s (tunnel id=%u)",
2810                                 control_msg ,
2811                                 val_to_str_ext(msg_type, &l2tp_message_type_short_str_vals_ext, "Unknown (%u)"),
2812                                 ccid);
2813             }
2814             else {
2815                 /*
2816                     * This is not a control message.
2817                     * We never pass here except in case of bad l2tp packet!
2818                     */
2819                 col_add_fstr(pinfo->cinfo, COL_INFO,
2820                                 "%s (tunnel id=%u)",
2821                                 control_msg,  ccid);
2822             }
2823         }
2824     }
2825
2826     if (LENGTH_BIT(control)) {
2827         /*
2828          * Set the length of this tvbuff to be no longer than the length
2829          * in the header.
2830          *
2831          * XXX - complain if that length is longer than the length of
2832          * the tvbuff?  Have "set_actual_length()" return a Boolean
2833          * and have its callers check the result?
2834          */
2835         set_actual_length(tvb, length+baseIdx);
2836     }
2837
2838     if (tree) {
2839         l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, ENC_NA);
2840         l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
2841         proto_item_append_text(l2tp_item, " version 3");
2842
2843         if (baseIdx) {
2844             proto_tree_add_item(l2tp_tree, hf_l2tp_sid, tvb, 0, 4, ENC_BIG_ENDIAN);
2845         }
2846         ctrl_tree = proto_tree_add_subtree_format(l2tp_tree, tvb, baseIdx, 2,
2847                                  ett_l2tp_ctrl, NULL, "Packet Type: %s Control Connection Id=%u",
2848                                  (CONTROL_BIT(control) ? control_msg : data_msg), ccid);
2849         proto_tree_add_bitmask_list(ctrl_tree, tvb, baseIdx, 2, l2tp_control_fields, ENC_BIG_ENDIAN);
2850     }
2851     idx = baseIdx + 2;
2852     if (LENGTH_BIT(control)) {
2853         proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, idx, 2, ENC_BIG_ENDIAN);
2854         idx += 2;
2855     }
2856
2857     proto_tree_add_item(l2tp_tree, hf_l2tp_ccid, tvb, idx, 4, ENC_BIG_ENDIAN);
2858     idx += 4;
2859
2860     if (SEQUENCE_BIT(control)) {
2861         proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, idx, 2, ENC_BIG_ENDIAN);
2862         idx += 2;
2863         proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, idx, 2, ENC_BIG_ENDIAN);
2864         idx += 2;
2865
2866     }
2867
2868     if (tree && (LENGTH_BIT(control))&&(length==12)) {
2869         proto_tree_add_item(l2tp_tree, hf_l2tp_zero_length_body_message, tvb, 0, 0, ENC_NA);
2870     } else {
2871         avp_type = tvb_get_ntohs(tvb, idx + 4);
2872         if (avp_type == CONTROL_MESSAGE) {
2873
2874             msg_type = tvb_get_ntohs(tvb, idx + 6);
2875             if (msg_type == MESSAGE_TYPE_SCCRQ) {
2876                 tunnel = &tmp_tunnel;
2877                 memset(tunnel, 0, sizeof(l2tpv3_tunnel_t));
2878                 tunnel->conv = l2tp_conv;
2879                 copy_address_wmem(wmem_file_scope(), &tunnel->lcce1, &pinfo->src);
2880                 copy_address_wmem(wmem_file_scope(), &tunnel->lcce2, &pinfo->dst);
2881             }
2882         }
2883     }
2884
2885     if (!LENGTH_BIT(control)) {
2886         return;
2887     }
2888
2889     if (tunnel == NULL) {
2890         tunnel = l2tp_conv->tunnel;
2891     }
2892
2893     process_control_avps(tvb, pinfo, l2tp_tree, idx, length+baseIdx, ccid, tunnel);
2894
2895     if (tunnel == &tmp_tunnel && l2tp_conv->tunnel == NULL) {
2896         l2tp_conv->tunnel = wmem_new0(wmem_file_scope(), l2tpv3_tunnel_t);
2897         memcpy(l2tp_conv->tunnel, &tmp_tunnel, sizeof(l2tpv3_tunnel_t));
2898     }
2899 }
2900
2901 /*
2902  * Dissector for L2TP over UDP. For v2, calls process_control_avps for
2903  * control messages, or the ppp dissector based on the control bit.
2904  * For v3, calls either process_l2tpv3_control or process_l2tpv3_data_udp
2905  * based on the control bit.
2906  */
2907 static int
2908 dissect_l2tp_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
2909 {
2910     proto_tree *l2tp_tree, *ctrl_tree;
2911     proto_item *l2tp_item;
2912     int         idx       = 0;
2913     int         tmp_idx;
2914     guint16     length    = 0;  /* Length field */
2915     guint16     tid;            /* Tunnel ID */
2916     guint16     cid;            /* Call ID */
2917     guint16     offset_size;    /* Offset size */
2918     guint16     avp_type;
2919     guint16     msg_type;
2920     guint16     control;
2921     tvbuff_t   *next_tvb;
2922     conversation_t *conv = NULL;
2923     l2tpv3_conversation_t *l2tp_conv = NULL;
2924
2925     /*
2926      * Don't accept packets that aren't for an L2TP version we know,
2927      * as they might not be L2TP packets even though they happen
2928      * to be coming from or going to the L2TP port.
2929      */
2930     if (tvb_captured_length(tvb) < 2)
2931         return 0;       /* not enough information to check */
2932     control = tvb_get_ntohs(tvb, 0);
2933     switch (L2TP_VERSION(control)) {
2934
2935     case 2:
2936     case 3:
2937         break;
2938
2939     default:
2940         return 0;
2941     }
2942
2943     conv = find_conversation(pinfo->num, &pinfo->src, &pinfo->dst, PT_UDP,
2944                          pinfo->srcport, pinfo->destport, NO_PORT_B);
2945
2946     if (conv == NULL) {
2947         conv = find_conversation(pinfo->num, &pinfo->src, &pinfo->dst, PT_UDP,
2948                              pinfo->srcport, pinfo->destport, 0);
2949     }
2950
2951     if ((conv == NULL) || (conversation_get_dissector(conv, pinfo->num) != l2tp_udp_handle)) {
2952         conv = conversation_new(pinfo->num, &pinfo->src, &pinfo->dst, PT_UDP,
2953                         pinfo->srcport, 0, NO_PORT2);
2954         conversation_set_dissector(conv, l2tp_udp_handle);
2955     }
2956
2957     col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TP");
2958     col_clear(pinfo->cinfo, COL_INFO);
2959
2960     switch (L2TP_VERSION(control)) {
2961
2962     case 2:
2963         break;
2964
2965     case 3:
2966         l2tp_conv = (l2tpv3_conversation_t *)conversation_get_proto_data(conv, proto_l2tp);
2967         if (!l2tp_conv) {
2968             l2tp_conv = wmem_new0(wmem_file_scope(), l2tpv3_conversation_t);
2969             l2tp_conv->pt = PT_UDP;
2970             conversation_add_proto_data(conv, proto_l2tp, (void *)l2tp_conv);
2971         }
2972
2973         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TPv3");
2974         if (CONTROL_BIT(control)) {
2975             /* Call to process l2tp v3 control message */
2976             process_l2tpv3_control(tvb, pinfo, tree, 0, l2tp_conv);
2977         }
2978         else {
2979             /* Call to process l2tp v3 data message */
2980             process_l2tpv3_data_udp(tvb, pinfo, tree, l2tp_conv);
2981         }
2982         return tvb_reported_length(tvb);
2983     }
2984
2985     if (LENGTH_BIT(control)) {              /* length field included ? */
2986         idx += 2;                       /* skip ahead */
2987         length = tvb_get_ntohs(tvb, idx);
2988     }
2989
2990     /* collect the tunnel id & call id */
2991     idx += 2;
2992     tid = tvb_get_ntohs(tvb, idx);
2993     idx += 2;
2994     cid = tvb_get_ntohs(tvb, idx);
2995
2996     if (CONTROL_BIT(control)) {
2997         /* CONTROL MESSAGE */
2998         tmp_idx = idx;
2999
3000         if ((LENGTH_BIT(control))&&(length==12))        /* ZLB Message */
3001             col_add_fstr(pinfo->cinfo, COL_INFO,
3002                             "%s - ZLB      (tunnel id=%d, session id=%u)",
3003                             control_msg, tid, cid);
3004         else
3005         {
3006             if (SEQUENCE_BIT(control)) {
3007                 tmp_idx += 4;
3008             }
3009
3010             tmp_idx+=4;
3011
3012             avp_type = tvb_get_ntohs(tvb, (tmp_idx+=2));
3013
3014             if (avp_type == CONTROL_MESSAGE) {
3015                 /* We print message type */
3016                 msg_type = tvb_get_ntohs(tvb, tmp_idx+2);
3017                 col_add_fstr(pinfo->cinfo, COL_INFO,
3018                                 "%s - %s (tunnel id=%u, session id=%u)",
3019                                 control_msg,
3020                                 val_to_str_ext(msg_type, &l2tp_message_type_short_str_vals_ext, "Unknown (%u)"),
3021                                 tid, cid);
3022             }
3023             else
3024             {
3025                 /*
3026                     * This is not a control message.
3027                     * We never pass here except in case of bad l2tp packet!
3028                     */
3029                 col_add_fstr(pinfo->cinfo, COL_INFO,
3030                                 "%s (tunnel id=%u, session id=%u)",
3031                                 control_msg, tid, cid);
3032
3033             }
3034         }
3035     }
3036     else {
3037         /* DATA Message */
3038         col_add_fstr(pinfo->cinfo, COL_INFO,
3039                         "%s            (tunnel id=%u, session id=%u)",
3040                         data_msg, tid, cid);
3041     }
3042
3043     if (LENGTH_BIT(control)) {
3044         /*
3045          * Set the length of this tvbuff to be no longer than the length
3046          * in the header.
3047          *
3048          * XXX - complain if that length is longer than the length of
3049          * the tvbuff?  Have "set_actual_length()" return a Boolean
3050          * and have its callers check the result?
3051          */
3052         set_actual_length(tvb, length);
3053     }
3054
3055     l2tp_item = proto_tree_add_item(tree,proto_l2tp, tvb, 0, -1, ENC_NA);
3056     l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
3057
3058     if (tree) {
3059         static const int * control_fields[] = {
3060             &hf_l2tp_type,
3061             &hf_l2tp_length_bit,
3062             &hf_l2tp_seq_bit,
3063             &hf_l2tp_offset_bit,
3064             &hf_l2tp_priority,
3065             &hf_l2tp_version,
3066             NULL
3067         };
3068
3069         ctrl_tree = proto_tree_add_subtree_format(l2tp_tree, tvb, 0, 2, ett_l2tp_ctrl, NULL,
3070                                  "Packet Type: %s Tunnel Id=%d Session Id=%d",
3071                                  (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
3072
3073         proto_tree_add_bitmask_list(ctrl_tree, tvb, 0, 2, control_fields, ENC_BIG_ENDIAN);
3074     }
3075     idx = 2;
3076     if (LENGTH_BIT(control)) {
3077         if (tree) {
3078             proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, idx, 2, ENC_BIG_ENDIAN);
3079         }
3080         idx += 2;
3081     }
3082
3083     if (tree) {
3084         proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, idx, 2, ENC_BIG_ENDIAN);
3085     }
3086     idx += 2;
3087     if (tree) {
3088         proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, idx, 2, ENC_BIG_ENDIAN);
3089     }
3090     idx += 2;
3091
3092     if (SEQUENCE_BIT(control)) {
3093         if (tree) {
3094             proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, idx, 2, ENC_BIG_ENDIAN);
3095         }
3096         idx += 2;
3097         if (tree) {
3098             proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, idx, 2, ENC_BIG_ENDIAN);
3099         }
3100         idx += 2;
3101     }
3102     if (OFFSET_BIT(control)) {
3103         offset_size = tvb_get_ntohs(tvb, idx);
3104         if (tree) {
3105             proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, idx, 2,
3106                                 offset_size);
3107         }
3108         idx += 2;
3109         if (offset_size != 0) {
3110             if (tree) {
3111                 proto_tree_add_item(l2tp_tree, hf_l2tp_offset_padding, tvb, idx, offset_size, ENC_NA);
3112             }
3113             idx += offset_size;
3114         }
3115     }
3116
3117     if (tree && (LENGTH_BIT(control))&&(length==12)) {
3118         proto_tree_add_item(l2tp_tree, hf_l2tp_zero_length_body_message, tvb, 0, 0, ENC_NA);
3119     }
3120
3121     if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
3122         if (tree)
3123             proto_item_set_len(l2tp_item, idx);
3124         /* If we have data, signified by having a length bit, dissect it */
3125         if (tvb_offset_exists(tvb, idx)) {
3126             next_tvb = tvb_new_subset_remaining(tvb, idx);
3127             call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
3128         }
3129         return tvb_reported_length(tvb);
3130     }
3131
3132     if (LENGTH_BIT(control))
3133         process_control_avps(tvb, pinfo, l2tp_tree, idx, length, -1, NULL);
3134
3135     return tvb_reported_length(tvb);
3136 }
3137
3138
3139 /*
3140  * Only L2TPv3 runs directly over IP, and dissect_l2tp_ip starts dissecting
3141  * those packets to call either process_l2tpv3_control for Control Messages
3142  * or process_l2tpv3_data_ip for Data Messages over IP, based on the
3143  * Session ID
3144  */
3145 static int
3146 dissect_l2tp_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
3147 {
3148     int     idx = 0;
3149     guint32 sid;                /* Session ID */
3150
3151     conversation_t *conv = NULL;
3152     l2tpv3_conversation_t *l2tp_conv = NULL;
3153
3154     conv = find_or_create_conversation(pinfo);
3155
3156     l2tp_conv = (l2tpv3_conversation_t *)conversation_get_proto_data(conv, proto_l2tp);
3157     if (!l2tp_conv) {
3158         l2tp_conv = wmem_new0(wmem_file_scope(), l2tpv3_conversation_t);
3159         l2tp_conv->pt = PT_NONE;
3160         conversation_add_proto_data(conv, proto_l2tp, (void *)l2tp_conv);
3161     }
3162
3163     /* Only L2TPv3 runs directly over IP */
3164     col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TPv3");
3165
3166     col_clear(pinfo->cinfo, COL_INFO);
3167
3168     sid = tvb_get_ntohl(tvb, idx);
3169     if (sid == 0) {
3170         /* This is control message */
3171         /* Call to process l2tp v3 control message */
3172         process_l2tpv3_control(tvb, pinfo, tree, 4, l2tp_conv);
3173     }
3174     else {
3175         /* Call to process l2tp v3 data message */
3176         process_l2tpv3_data_ip(tvb, pinfo, tree, l2tp_conv);
3177     }
3178
3179     return tvb_captured_length(tvb);
3180 }
3181
3182 static int dissect_atm_oam_llc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
3183 {
3184     guint32      oam_cell   = GPOINTER_TO_UINT(data);
3185
3186     if (oam_cell) {
3187         call_dissector(atm_oam_handle, tvb, pinfo, tree);
3188     } else {
3189         call_dissector(llc_handle, tvb, pinfo, tree);
3190     }
3191
3192     return tvb_captured_length(tvb);
3193 }
3194
3195 static void l2tp_cleanup(void)
3196 {
3197     GSList *iterator = list_heads;
3198
3199     while (iterator) {
3200         g_slist_free((GSList *)iterator->data);
3201         iterator = g_slist_next(iterator);
3202     }
3203
3204     if (list_heads != NULL) {
3205         g_slist_free(list_heads);
3206         list_heads = NULL;
3207     }
3208 }
3209
3210 /* registration with the filtering engine */
3211 void
3212 proto_register_l2tp(void)
3213 {
3214     static hf_register_info hf[] = {
3215         { &hf_l2tp_type,
3216           { "Type", "l2tp.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
3217             "Type bit", HFILL }},
3218
3219         { &hf_l2tp_length_bit,
3220           { "Length Bit", "l2tp.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
3221             NULL, HFILL }},
3222
3223         { &hf_l2tp_seq_bit,
3224           { "Sequence Bit", "l2tp.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
3225             NULL, HFILL }},
3226
3227         { &hf_l2tp_offset_bit,
3228           { "Offset bit", "l2tp.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
3229             NULL, HFILL }},
3230
3231         { &hf_l2tp_priority,
3232           { "Priority", "l2tp.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
3233             "Priority bit", HFILL }},
3234
3235         { &hf_l2tp_version,
3236           { "Version", "l2tp.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
3237             NULL, HFILL }},
3238
3239         { &hf_l2tp_length,
3240           { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
3241             NULL, HFILL }},
3242
3243         { &hf_l2tp_tunnel,
3244           { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
3245             NULL, HFILL }},
3246
3247         { &hf_l2tp_session,
3248           { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
3249             NULL, HFILL }},
3250
3251         { &hf_l2tp_Ns,
3252           { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
3253             NULL, HFILL }},
3254
3255         { &hf_l2tp_Nr,
3256           { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
3257             NULL, HFILL }},
3258
3259         { &hf_l2tp_offset,
3260           { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
3261             "Number of octets past the L2TP header at which the payload data starts.", HFILL }},
3262
3263         { &hf_l2tp_avp_mandatory,
3264           { "Mandatory", "l2tp.avp.mandatory", FT_BOOLEAN, 16, NULL, 0x8000,
3265             NULL, HFILL }},
3266
3267         { &hf_l2tp_avp_hidden,
3268           { "Hidden", "l2tp.avp.hidden", FT_BOOLEAN, 16, NULL, 0x4000,
3269             NULL, HFILL }},
3270
3271         { &hf_l2tp_avp_length,
3272           { "Length", "l2tp.avp.length", FT_UINT16, BASE_DEC, NULL, 0x03ff,
3273             NULL, HFILL }},
3274
3275         { &hf_l2tp_avp_vendor_id,
3276           { "Vendor ID", "l2tp.avp.vendor_id", FT_UINT16, BASE_ENTERPRISES, STRINGS_ENTERPRISES, 0,
3277             "AVP Vendor ID", HFILL }},
3278
3279         { &hf_l2tp_avp_type,
3280           { "AVP Type", "l2tp.avp.type", FT_UINT16, BASE_DEC|BASE_EXT_STRING, &avp_type_vals_ext, 0,
3281             NULL, HFILL }},
3282
3283         { &hf_l2tp_tie_breaker,
3284           { "Tie Breaker", "l2tp.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
3285             NULL, HFILL }},
3286
3287         { &hf_l2tp_sid,
3288           { "Session ID","l2tp.sid", FT_UINT32, BASE_DEC, NULL, 0x0,
3289             NULL, HFILL }},
3290
3291         { &hf_l2tp_ccid,
3292           { "Control Connection ID","l2tp.ccid", FT_UINT32, BASE_DEC, NULL, 0x0,
3293             NULL, HFILL }},
3294
3295         { &hf_l2tp_res,
3296           { "Reserved","l2tp.res", FT_UINT16, BASE_HEX, NULL, 0x0,
3297             NULL, HFILL }},
3298
3299         { &hf_l2tp_cookie,
3300           { "Cookie","l2tp.cookie", FT_BYTES, BASE_NONE, NULL, 0x0,
3301             NULL, HFILL }},
3302
3303         { &hf_l2tp_l2_spec_def,
3304           { "Default L2-Specific Sublayer","l2tp.l2_spec_def", FT_NONE, BASE_NONE, NULL, 0x0,
3305             NULL, HFILL }},
3306
3307         { &hf_l2tp_l2_spec_atm,
3308           { "ATM-Specific Sublayer","l2tp.l2_spec_atm", FT_NONE, BASE_NONE, NULL, 0x0,
3309             NULL, HFILL }},
3310
3311         { &hf_l2tp_l2_spec_docsis_dmpt,
3312           { "DOCSIS DMPT - Specific Sublayer","l2tp.l2_spec_docsis_dmpt", FT_NONE, BASE_NONE, NULL, 0x0,
3313             NULL, HFILL }},
3314
3315         { &hf_l2tp_l2_spec_v,
3316           { "V-bit","l2tp.l2_spec_v", FT_BOOLEAN, 8, NULL, 0x80,
3317             "VCCV Bit", HFILL }},
3318
3319         { &hf_l2tp_l2_spec_s,
3320           { "S-bit","l2tp.l2_spec_s", FT_BOOLEAN, 8, NULL, 0x40,
3321             "Sequence Bit", HFILL }},
3322
3323         { &hf_l2tp_l2_spec_h,
3324           { "H-bits","l2tp.l2_spec_h", FT_UINT8, BASE_HEX, NULL, 0x30,
3325             "Extended Header Bits", HFILL }},
3326
3327         { &hf_l2tp_l2_spec_t,
3328           { "T-bit","l2tp.l2_spec_t", FT_BOOLEAN, 8, NULL, 0x08,
3329             "Transport Type Bit", HFILL }},
3330
3331         { &hf_l2tp_l2_spec_g,
3332           { "G-bit","l2tp.l2_spec_g", FT_BOOLEAN, 8, NULL, 0x04,
3333             "EFCI Bit", HFILL }},
3334
3335         { &hf_l2tp_l2_spec_c,
3336           { "C-bit","l2tp.l2_spec_c", FT_BOOLEAN, 8, NULL, 0x02,
3337             "CLP Bit", HFILL }},
3338
3339         { &hf_l2tp_l2_spec_u,
3340           { "U-bit","l2tp.l2_spec_u", FT_BOOLEAN, 8, NULL, 0x01,
3341             "C/R Bit", HFILL }},
3342
3343         { &hf_l2tp_l2_spec_flow_id,
3344           { "Flow ID","l2tp.l2_spec_flow_id", FT_UINT8, BASE_HEX, NULL, FLOW_ID_MASK,
3345             NULL, HFILL }},
3346
3347         { &hf_l2tp_l2_spec_sequence,
3348           { "Sequence Number","l2tp.l2_spec_sequence", FT_UINT24, BASE_DEC, NULL, 0x0,
3349             NULL, HFILL }},
3350
3351         { &hf_l2tp_cisco_avp_type,
3352           { "Type", "l2tp.avp.ciscotype", FT_UINT16, BASE_DEC, VALS(cisco_avp_type_vals), 0,
3353             "AVP Type", HFILL }},
3354
3355         { &hf_l2tp_ericsson_avp_type,
3356           { "Type", "l2tp.avp.ericssontype", FT_UINT16, BASE_DEC, VALS(ericsson_avp_type_vals), 0,
3357             "AVP Type", HFILL }},
3358
3359         { &hf_l2tp_broadband_avp_type,
3360           { "Type", "l2tp.avp.broadbandtype", FT_UINT16, BASE_DEC, VALS(broadband_avp_type_vals), 0,
3361             "AVP Type", HFILL }},
3362
3363         { &hf_l2tp_cablelabs_avp_type,
3364           { "Type", "l2tp.avp.cablelabstype", FT_UINT16, BASE_DEC, VALS(cablelabs_avp_type_vals), 0,
3365             "AVP Type", HFILL }},
3366
3367         { &hf_l2tp_avp_message_type,
3368           { "Message Type", "l2tp.avp.message_type", FT_UINT16, BASE_DEC|BASE_EXT_STRING, &message_type_vals_ext, 0,
3369             NULL, HFILL }},
3370
3371         { &hf_l2tp_avp_assigned_tunnel_id,
3372           { "Assigned Tunnel ID", "l2tp.avp.assigned_tunnel_id", FT_UINT16, BASE_DEC, NULL, 0,
3373             NULL, HFILL }},
3374
3375         { &hf_l2tp_avp_assigned_control_conn_id,
3376           { "Assigned Control Connection ID", "l2tp.avp.assigned_control_conn_id", FT_UINT32, BASE_DEC, NULL, 0,
3377             NULL, HFILL }},
3378
3379         { &hf_l2tp_avp_assigned_session_id,
3380           { "Assigned Session ID", "l2tp.avp.assigned_session_id", FT_UINT16, BASE_DEC, NULL, 0,
3381             NULL, HFILL }},
3382
3383         { &hf_l2tp_avp_remote_session_id,
3384           { "Remote Session ID", "l2tp.avp.remote_session_id", FT_UINT32, BASE_DEC, NULL, 0,
3385             NULL, HFILL }},
3386
3387         { &hf_l2tp_avp_local_session_id,
3388           { "Local Session ID", "l2tp.avp.local_session_id", FT_UINT32, BASE_DEC, NULL, 0,
3389             NULL, HFILL }},
3390
3391         { &hf_l2tp_avp_called_number,
3392           { "Called Number", "l2tp.avp.called_number", FT_STRING, BASE_NONE, NULL, 0,
3393             NULL, HFILL }},
3394
3395         { &hf_l2tp_avp_calling_number,
3396           { "Calling Number", "l2tp.avp.calling_number", FT_STRING, BASE_NONE, NULL, 0,
3397             NULL, HFILL }},
3398
3399         { &hf_l2tp_cisco_tie_breaker,
3400           { "Tie Breaker", "l2tp.cisco.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
3401             NULL, HFILL }},
3402
3403         { &hf_l2tp_cablel_avp_l_bit,
3404           { "L(lock bit)", "l2tp.cablel.l_bit", FT_BOOLEAN, 16, NULL, 0x8000,
3405             NULL, HFILL }},
3406
3407         { &hf_l2tp_cablel_avp_tsid_group_id,
3408           { "TSID Group ID", "l2tp.cablel.tsid_group_id", FT_UINT16, BASE_DEC, NULL, 0x7f00,
3409             NULL, HFILL }},
3410
3411         { &hf_l2tp_cablel_avp_frequency,
3412           { "Frequency", "l2tp.cablel.frequency", FT_UINT32, BASE_DEC, NULL, 0,
3413             NULL, HFILL }},
3414
3415         { &hf_l2tp_cablel_avp_modulation,
3416           { "Modulation", "l2tp.cablel.modulation", FT_UINT16, BASE_DEC, VALS(l2tp_cablel_modulation_vals), 0x000f,
3417             NULL, HFILL }},
3418
3419         { &hf_l2tp_cablel_avp_m,
3420           { "M", "l2tp.cablel.m", FT_UINT16, BASE_DEC, NULL, 0x0,
3421             NULL, HFILL }},
3422
3423         { &hf_l2tp_cablel_avp_n,
3424           { "N", "l2tp.cablel.n", FT_UINT16, BASE_DEC, NULL, 0x0,
3425             NULL, HFILL }},
3426
3427         { &hf_l2tp_broadband_agent_circuit_id,
3428           { "Agent Circuit ID", "l2tp.broadband.agent_circuit_id", FT_STRING, BASE_NONE, NULL, 0x0,
3429             NULL, HFILL }},
3430
3431         { &hf_l2tp_broadband_agent_remote_id,
3432           { "Agent Remote ID", "l2tp.broadband.agent_remote_id", FT_STRING, BASE_NONE, NULL, 0x0,
3433             NULL, HFILL }},
3434
3435         { &hf_l2tp_broadband_actual_dr_up,
3436           { "Actual Data Rate Upstream", "l2tp.broadband.actual_dr_up", FT_UINT64, BASE_DEC, NULL, 0x0,
3437             "Actual Data Rate Upstream in bits per seconds", HFILL }},
3438
3439         { &hf_l2tp_broadband_actual_dr_down,
3440           { "Actual Data Rate Downstream", "l2tp.broadband.actual_dr_down", FT_UINT64, BASE_DEC, NULL, 0x0,
3441             "Actual Data Rate Downstream in bits per seconds", HFILL }},
3442
3443         { &hf_l2tp_broadband_minimum_dr_up,
3444           { "Minimum Data Rate Upstream", "l2tp.broadband.minimum_dr_up", FT_UINT64, BASE_DEC, NULL, 0x0,
3445             "Minimum Data Rate Upstream in bits per seconds", HFILL }},
3446
3447         { &hf_l2tp_broadband_minimum_dr_down,
3448           { "Minimum Data Rate Downstream", "l2tp.broadband.minimum_dr_down", FT_UINT64, BASE_DEC, NULL, 0x0,
3449             "Minimum Data Rate Downstream in bits per seconds", HFILL }},
3450
3451         { &hf_l2tp_broadband_attainable_dr_up,
3452           { "Attainable Data Rate Upstream", "l2tp.broadband.attainable_dr_up", FT_UINT64, BASE_DEC, NULL, 0x0,
3453             "Attainable Data Rate Upstream in bits per seconds", HFILL }},
3454
3455         { &hf_l2tp_broadband_attainable_dr_down,
3456           { "Attainable Data Rate Downstream", "l2tp.broadband.attainable_dr_down", FT_UINT64, BASE_DEC, NULL, 0x0,
3457             "Attainable Data Rate Downstream in bits per seconds", HFILL }},
3458
3459         { &hf_l2tp_broadband_maximum_dr_up,
3460           { "Maximum Data Rate Upstream", "l2tp.broadband.maximum_dr_up", FT_UINT64, BASE_DEC, NULL, 0x0,
3461             "Maximum Data Rate Upstream in bits per seconds", HFILL }},
3462
3463         { &hf_l2tp_broadband_maximum_dr_down,
3464           { "Maximum Data Rate Downstream", "l2tp.broadband.maximum_dr_down", FT_UINT64, BASE_DEC, NULL, 0x0,
3465             "Maximum Data Rate Downstream in bits per seconds", HFILL }},
3466
3467         { &hf_l2tp_broadband_minimum_dr_up_low_power,
3468           { "Minimum Data Rate Upstream Low-Power", "l2tp.broadband.minimum_dr_up_low_power", FT_UINT64, BASE_DEC, NULL, 0x0,
3469             "Minimum Data Rate Upstream Low-Power in bits per seconds", HFILL }},
3470
3471         { &hf_l2tp_broadband_minimum_dr_down_low_power,
3472           { "Minimum Data Rate Downstream Low-Power", "l2tp.broadband.minimum_dr_down_low_power", FT_UINT64, BASE_DEC, NULL, 0x0,
3473             "Minimum Data Rate Downstream Low-Power in bits per seconds", HFILL }},
3474
3475         { &hf_l2tp_broadband_maximum_interleaving_delay_up,
3476           { "Maximum Interleaving Dalay Upstream", "l2tp.broadband.maximum_interleaving_delay_up", FT_UINT32, BASE_DEC, NULL, 0x0,
3477             "Maximum Interleaving Dalay Upstream in ms", HFILL }},
3478
3479         { &hf_l2tp_broadband_actual_interleaving_delay_up,
3480           { "Actual Interleaving Dalay Upstream", "l2tp.broadband.actual_interleaving_delay_up", FT_UINT32, BASE_DEC, NULL, 0x0,
3481             "Actual Interleaving Dalay Upstream in ms", HFILL }},
3482
3483         { &hf_l2tp_broadband_maximum_interleaving_delay_down,
3484           { "Maximum Interleaving Dalay Downstream", "l2tp.broadband.maximum_interleaving_delay_down", FT_UINT32, BASE_DEC, NULL, 0x0,
3485             "Maximum Interleaving Dalay Downstream in ms", HFILL }},
3486
3487         { &hf_l2tp_broadband_actual_interleaving_delay_down,
3488           { "Actual Interleaving Dalay Downstream", "l2tp.broadband.actual_interleaving_delay_down", FT_UINT32, BASE_DEC, NULL, 0x0,
3489             "Actual Interleaving Dalay Downstream in ms", HFILL }},
3490
3491         { &hf_l2tp_broadband_access_loop_encapsulation,
3492           { "Access Loop Encapsulation", "l2tp.broadband.access_loop_encapsulation", FT_NONE, BASE_NONE, NULL, 0x0,
3493             NULL, HFILL }},
3494
3495         { &hf_l2tp_broadband_access_loop_encapsulation_data_link,
3496           { "Data Link", "l2tp.broadband.access_loop_encapsulation.data_link", FT_UINT8, BASE_HEX, VALS(ale_datalink_types_vals), 0x0,
3497             NULL, HFILL }},
3498
3499         { &hf_l2tp_broadband_access_loop_encapsulation_enc1,
3500           { "Encaps 1", "l2tp.broadband.access_loop_encapsulation.enc1", FT_UINT8, BASE_HEX, VALS(ale_enc1_types_vals), 0x0,
3501             NULL, HFILL }},
3502
3503         { &hf_l2tp_broadband_access_loop_encapsulation_enc2,
3504           { "Encaps 2", "l2tp.broadband.access_loop_encapsulation.enc2", FT_UINT8, BASE_HEX, VALS(ale_enc2_types_vals), 0x0,
3505             NULL, HFILL }},
3506
3507         { &hf_l2tp_broadband_ancp_access_line_type,
3508           { "ANCP Access Line Type", "l2tp.broadband.ancp_access_line_type", FT_UINT32, BASE_HEX, VALS(ancp_types_vals), 0x0,
3509             NULL, HFILL }},
3510
3511         { &hf_l2tp_broadband_iwf_session,
3512           { "IWF Session", "l2tp.broadband.iwf_session", FT_UINT32, BASE_HEX, VALS(iwf_types_vals), 0x0,
3513             NULL, HFILL }},
3514
3515         { &hf_l2tp_avp_csu,
3516           { "Connect Speed Update","l2tp.avp.csu", FT_NONE, BASE_NONE, NULL, 0x0,
3517              NULL, HFILL }},
3518
3519         { &hf_l2tp_avp_csu_res,
3520           { "Reserved", "l2tp.avp.csu.res", FT_UINT16, BASE_HEX, NULL, 0x0,
3521             NULL, HFILL }},
3522
3523         { &hf_l2tp_avp_csu_remote_session_id_v2,
3524           { "Remote Session ID", "l2tp.avp.csu.res", FT_UINT16, BASE_DEC_HEX, NULL, 0x0,
3525             NULL, HFILL }},
3526
3527         { &hf_l2tp_avp_csu_current_tx_speed_v2,
3528           { "Current TX Connect Speed", "l2tp.avp.csu.current_tx_speed", FT_UINT32, BASE_DEC, NULL, 0x0,
3529             "Current TX Connect Speed in bps", HFILL }},
3530
3531         { &hf_l2tp_avp_csu_current_rx_speed_v2,
3532           { "Current RX Connect Speed", "l2tp.avp.csu.current_rx_speed", FT_UINT32, BASE_DEC, NULL, 0x0,
3533             "Current RX Connect Speed in bps", HFILL }},
3534
3535         { &hf_l2tp_avp_csu_remote_session_id_v3,
3536           { "Remote Session ID", "l2tp.avp.csu.res", FT_UINT32, BASE_DEC_HEX, NULL, 0x0,
3537             NULL, HFILL }},
3538
3539         { &hf_l2tp_avp_csu_current_tx_speed_v3,
3540           { "Current TX Connect Speed", "l2tp.avp.csu.current_tx_speed64", FT_UINT64, BASE_DEC, NULL, 0x0,
3541             "Current TX Connect Speed in bps", HFILL }},
3542
3543         { &hf_l2tp_avp_csu_current_rx_speed_v3,
3544           { "Current RX Connect Speed", "l2tp.avp.csu.current_rx_speed64", FT_UINT64, BASE_DEC, NULL, 0x0,
3545             "Current RX Connect Speed in bps", HFILL }},
3546
3547         { &hf_l2tp_ericsson_msg_type,
3548           { "Ericsson Message Type", "l2tp.ericsson.msg_type", FT_UINT16, BASE_DEC, VALS(ericsson_msg_type_vals), 0x0,
3549             NULL, HFILL }},
3550
3551         { &hf_l2tp_ericsson_conn_type,
3552           { "Connection Type", "l2tp.ericsson.conn_type", FT_UINT8, BASE_DEC, VALS(ericsson_conn_type_vals), 0x0,
3553             NULL, HFILL }},
3554
3555         { &hf_l2tp_ericsson_stn_name,
3556           { "STN Name", "l2tp.ericsson.stn_name", FT_STRING, BASE_NONE, NULL, 0x0,
3557             NULL, HFILL }},
3558
3559         { &hf_l2tp_ericsson_crc32_enable,
3560           { "CRC32 Enabled", "l2tp.ericsson.crc32_enable", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
3561             NULL, HFILL }},
3562
3563         { &hf_l2tp_ericsson_abis_lower_mode,
3564           { "Abis Lower Type", "l2tp.ericsson.abis_lower_mode", FT_UINT8, BASE_DEC, VALS(ericsson_abis_lower_mode_vals), 0x0,
3565             NULL, HFILL }},
3566
3567         { &hf_l2tp_ericsson_tc_overl_thresh,
3568           { "Overload Threshold in 0.1%", "l2tp.ericsson.overload_thresh", FT_UINT16, BASE_DEC, NULL, 0x0,
3569             NULL, HFILL }},
3570
3571         { &hf_l2tp_ericsson_tc_num_groups,
3572           { "Number of Transport Config Groups", "l2tp.ericsson.tc_num_groups", FT_UINT8, BASE_DEC, NULL, 0x0,
3573             NULL, HFILL }},
3574
3575         { &hf_l2tp_ericsson_tcg_group_id,
3576           { "Transport Config Group ID", "l2tp.ericsson.tc_group_id", FT_UINT8, BASE_DEC, NULL, 0x0,
3577             NULL, HFILL }},
3578
3579         { &hf_l2tp_ericsson_tcg_num_sapis,
3580           { "Number of SAPIs in Transport Group", "l2tp.ericsson.tc_num_sapi", FT_UINT8, BASE_DEC, NULL, 0x0,
3581             NULL, HFILL }},
3582
3583         { &hf_l2tp_ericsson_tcg_sapi,
3584           { "TCG SAPI", "l2tp.ericsson.tcg_sapi", FT_UINT8, BASE_DEC, NULL, 0x0,
3585             NULL, HFILL }},
3586
3587         { &hf_l2tp_ericsson_tcg_ip,
3588           { "TCG IP Address", "l2tp.ericsson.tcg_ip", FT_IPv4, BASE_NONE, NULL, 0x0,
3589             NULL, HFILL }},
3590
3591         { &hf_l2tp_ericsson_tcg_dscp,
3592           { "TCG DSCP", "l2tp.ericsson.tcg_dscp", FT_UINT8, BASE_HEX, NULL, 0x0,
3593             NULL, HFILL }},
3594
3595         { &hf_l2tp_ericsson_tcg_crc32_enable,
3596           { "CRC32 Enabled", "l2tp.ericsson.crc32_en", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
3597             NULL, HFILL }},
3598
3599         { &hf_l2tp_ericsson_tcg_bundling_tout,
3600           { "TCG Bundling Timeout (ms)", "l2tp.ericsson.gcg.bundle_tout", FT_UINT8, BASE_DEC, NULL, 0x0,
3601             NULL, HFILL }},
3602
3603         { &hf_l2tp_ericsson_tcg_bundling_max_pkt,
3604           { "TCG Bundling Max Packet Size", "l2tp.ericsson.tcg.bundle_max_pkt", FT_UINT16, BASE_DEC, NULL, 0x0,
3605             NULL, HFILL }},
3606
3607         { &hf_l2tp_ericsson_tc_num_maps,
3608           { "Number of TEI-SC Maps", "l2tp.ericsson.num_maps", FT_UINT8, BASE_DEC, NULL, 0x0,
3609             NULL, HFILL }},
3610
3611         { &hf_l2tp_ericsson_map_tei_low,
3612           { "TEI Range Lowest Value", "l2tp.ericsson.map_tei_low", FT_UINT8, BASE_DEC, NULL, 0x0,
3613             NULL, HFILL }},
3614
3615         { &hf_l2tp_ericsson_map_tei_high,
3616           { "TEI Range Highest Value", "l2tp.ericsson.map_tei_high", FT_UINT8, BASE_DEC, NULL, 0x0,
3617             NULL, HFILL }},
3618
3619         { &hf_l2tp_ericsson_map_sc,
3620           { "Super Channel", "l2tp.ericsson.map_ssc", FT_UINT8, BASE_DEC, NULL, 0x0,
3621             NULL, HFILL }},
3622
3623         { &hf_l2tp_ericsson_ver_pref,
3624           { "Preferred/Chosen Version", "l2tp.ericsson.ver_pref", FT_UINT32, BASE_DEC, NULL, 0x0,
3625             NULL, HFILL }},
3626
3627         { &hf_l2tp_ericsson_ver_2,
3628           { "Version (2)", "l2tp.ericsson.ver_2", FT_UINT32, BASE_DEC, NULL, 0x0,
3629             NULL, HFILL }},
3630
3631         { &hf_l2tp_ericsson_ver_3,
3632           { "Version (3)", "l2tp.ericsson.ver_3", FT_UINT32, BASE_DEC, NULL, 0x0,
3633             NULL, HFILL }},
3634
3635       /* Generated from convert_proto_tree_add_text.pl */
3636       { &hf_l2tp_cisco_assigned_control_connection_id, { "Assigned Control Connection ID", "l2tp.cisco.assigned_control_connection_id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3637       { &hf_l2tp_cisco_pw_type, { "PW Type", "l2tp.cisco.pw_type", FT_UINT16, BASE_DEC, VALS(pw_types_vals), 0x0, NULL, HFILL }},
3638       { &hf_l2tp_cisco_local_session_id, { "Local Session ID", "l2tp.cisco.local_session_id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3639       { &hf_l2tp_cisco_remote_session_id, { "Remote Session ID", "l2tp.cisco.remote_session_id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3640       { &hf_l2tp_cisco_assigned_cookie, { "Assigned Cookie", "l2tp.cisco.assigned_cookie", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3641       { &hf_l2tp_cisco_remote_end_id, { "Remote End ID", "l2tp.cisco.remote_end_id", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3642       { &hf_l2tp_cisco_pseudowire_type, { "Pseudowire Type", "l2tp.cisco.pseudowire_type", FT_UINT16, BASE_DEC, VALS(pw_types_vals), 0x0, NULL, HFILL }},
3643       { &hf_l2tp_cisco_circuit_status, { "Circuit Status", "l2tp.cisco.circuit_status", FT_BOOLEAN, 16, TFS(&tfs_up_down), 0x0001, NULL, HFILL }},
3644       { &hf_l2tp_cisco_circuit_type, { "Circuit Type", "l2tp.cisco.circuit_type", FT_BOOLEAN, 16, TFS(&tfs_new_existing), 0x0001, NULL, HFILL }},
3645       { &hf_l2tp_cisco_draft_avp_version, { "Draft AVP Version", "l2tp.cisco.draft_avp_version", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3646       { &hf_l2tp_cisco_message_digest, { "Message Digest", "l2tp.cisco.message_digest", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3647       { &hf_l2tp_cisco_nonce, { "Nonce", "l2tp.cisco.nonce", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3648       { &hf_l2tp_cisco_interface_mtu, { "Interface MTU", "l2tp.cisco.interface_mtu", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3649       { &hf_l2tp_stop_ccn_result_code, { "Result code", "l2tp.result_code", FT_UINT16, BASE_DEC, VALS(result_code_stopccn_vals), 0x0, NULL, HFILL }},
3650       { &hf_l2tp_result_code, { "Result code", "l2tp.result_code", FT_UINT16, BASE_DEC|BASE_EXT_STRING, &result_code_cdn_vals_ext, 0x0, NULL, HFILL }},
3651       { &hf_l2tp_avp_error_code, { "Error code", "l2tp.avp.error_code", FT_UINT16, BASE_DEC, VALS(error_code_vals), 0x0, NULL, HFILL }},
3652       { &hf_l2tp_avp_error_message, { "Error Message", "l2tp.avp.error_message", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3653       { &hf_l2tp_avp_protocol_version, { "Version", "l2tp.avp.protocol_version", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3654       { &hf_l2tp_avp_protocol_revision, { "Revision", "l2tp.avp.protocol_revision", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3655       { &hf_l2tp_avp_async_framing_supported, { "Async Framing Supported", "l2tp.avp.async_framing_supported", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0002, NULL, HFILL }},
3656       { &hf_l2tp_avp_sync_framing_supported, { "Sync Framing Supported", "l2tp.avp.sync_framing_supported", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0001, NULL, HFILL }},
3657       { &hf_l2tp_avp_analog_access_supported, { "Analog Access Supported", "l2tp.avp.analog_access_supported", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0002, NULL, HFILL }},
3658       { &hf_l2tp_avp_digital_access_supported, { "Digital Access Supported", "l2tp.avp.digital_access_supported", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0001, NULL, HFILL }},
3659       { &hf_l2tp_avp_firmware_revision, { "Firmware Revision", "l2tp.avp.firmware_revision", FT_UINT16, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
3660       { &hf_l2tp_avp_host_name, { "Host Name", "l2tp.avp.host_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3661       { &hf_l2tp_avp_vendor_name, { "Vendor Name", "l2tp.avp.vendor_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3662       { &hf_l2tp_avp_receive_window_size, { "Receive Window Size", "l2tp.avp.receive_window_size", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3663       { &hf_l2tp_avp_chap_challenge, { "CHAP Challenge", "l2tp.avp.chap_challenge", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3664       { &hf_l2tp_avp_cause_code, { "Cause Code", "l2tp.avp.cause_code", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3665       { &hf_l2tp_avp_cause_msg, { "Cause Msg", "l2tp.avp.cause_msg", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3666       { &hf_l2tp_avp_advisory_msg, { "Advisory Msg", "l2tp.avp.advisory_msg", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3667       { &hf_l2tp_avp_chap_challenge_response, { "CHAP Challenge Response", "l2tp.avp.chap_challenge_response", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3668       { &hf_l2tp_avp_call_serial_number, { "Call Serial Number", "l2tp.avp.call_serial_number", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3669       { &hf_l2tp_avp_minimum_bps, { "Minimum BPS", "l2tp.avp.minimum_bps", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3670       { &hf_l2tp_avp_maximum_bps, { "Maximum BPS", "l2tp.avp.maximum_bps", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3671       { &hf_l2tp_avp_analog_bearer_type, { "Analog Bearer Type", "l2tp.avp.analog_bearer_type", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0002, NULL, HFILL }},
3672       { &hf_l2tp_avp_digital_bearer_type, { "Digital Bearer Type", "l2tp.avp.digital_bearer_type", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0001, NULL, HFILL }},
3673       { &hf_l2tp_avp_async_framing_type, { "Async Framing Type", "l2tp.avp.async_framing_type", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0002, NULL, HFILL }},
3674       { &hf_l2tp_avp_sync_framing_type, { "Sync Framing Type", "l2tp.avp.sync_framing_type", FT_BOOLEAN, 32, TFS(&tfs_true_false), 0x0001, NULL, HFILL }},
3675       { &hf_l2tp_avp_sub_address, { "Sub-Address", "l2tp.avp.sub_address", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3676       { &hf_l2tp_avp_connect_speed, { "Connect Speed", "l2tp.avp.connect_speed", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3677       { &hf_l2tp_avp_physical_channel, { "Physical Channel", "l2tp.avp.physical_channel", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3678       { &hf_l2tp_avp_initial_received_lcp_confreq, { "Initial Received LCP CONFREQ", "l2tp.avp.initial_received_lcp_confreq", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3679       { &hf_l2tp_avp_last_sent_lcp_confreq, { "Last Sent LCP CONFREQ", "l2tp.avp.last_sent_lcp_confreq", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3680       { &hf_l2tp_avp_last_received_lcp_confreq, { "Last Received LCP CONFREQ", "l2tp.avp.last_received_lcp_confreq", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3681       { &hf_l2tp_avp_proxy_authen_type, { "Proxy Authen Type", "l2tp.avp.proxy_authen_type", FT_UINT16, BASE_DEC, VALS(authen_type_vals), 0x0, NULL, HFILL }},
3682       { &hf_l2tp_avp_proxy_authen_name, { "Proxy Authen Name", "l2tp.avp.proxy_authen_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3683       { &hf_l2tp_avp_proxy_authen_challenge, { "Proxy Authen Challenge", "l2tp.avp.proxy_authen_challenge", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3684       { &hf_l2tp_avp_proxy_authen_id, { "Proxy Authen ID", "l2tp.avp.proxy_authen_id", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3685       { &hf_l2tp_avp_proxy_authen_response, { "Proxy Authen Response", "l2tp.avp.proxy_authen_response", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3686       { &hf_l2tp_avp_crc_errors, { "CRC Errors", "l2tp.avp.crc_errors", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3687       { &hf_l2tp_avp_framing_errors, { "Framing Errors", "l2tp.avp.framing_errors", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3688       { &hf_l2tp_avp_hardware_overruns, { "Hardware Overruns", "l2tp.avp.hardware_overruns", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3689       { &hf_l2tp_avp_buffer_overruns, { "Buffer Overruns", "l2tp.avp.buffer_overruns", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3690       { &hf_l2tp_avp_time_out_errors, { "Time-out Errors", "l2tp.avp.time_out_errors", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3691       { &hf_l2tp_avp_alignment_errors, { "Alignment Errors", "l2tp.avp.alignment_errors", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3692       { &hf_l2tp_avp_send_accm, { "Send ACCM", "l2tp.avp.send_accm", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3693       { &hf_l2tp_avp_receive_accm, { "Receive ACCM", "l2tp.avp.receive_accm", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3694       { &hf_l2tp_avp_random_vector, { "Random Vector", "l2tp.avp.random_vector", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3695       { &hf_l2tp_avp_private_group_id, { "Private Group ID", "l2tp.avp.private_group_id", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3696       { &hf_l2tp_avp_rx_connect_speed, { "Rx Connect Speed", "l2tp.avp.rx_connect_speed", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3697       { &hf_l2tp_avp_disconnect_code, { "Disconnect Code", "l2tp.avp.disconnect_code", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3698       { &hf_l2tp_avp_control_protocol_number, { "Control Protocol Number", "l2tp.avp.control_protocol_number", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3699       { &hf_l2tp_avp_cause_code_direction, { "Direction", "l2tp.avp.cause_code_direction", FT_UINT8, BASE_DEC, VALS(cause_code_direction_vals), 0x0, NULL, HFILL }},
3700       { &hf_l2tp_avp_cause_code_message, { "Message", "l2tp.avp.cause_code_message", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3701       { &hf_l2tp_avp_message_digest, { "Message Digest", "l2tp.avp.message_digest", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3702       { &hf_l2tp_avp_router_id, { "Router ID", "l2tp.avp.router_id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3703       { &hf_l2tp_avp_pw_type, { "PW Type", "l2tp.avp.pw_type", FT_UINT16, BASE_DEC, VALS(pw_types_vals), 0x0, NULL, HFILL }},
3704       { &hf_l2tp_avp_assigned_cookie, { "Assigned Cookie", "l2tp.avp.assigned_cookie", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3705       { &hf_l2tp_avp_remote_end_id, { "Remote End ID", "l2tp.avp.remote_end_id", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3706       { &hf_l2tp_avp_pseudowire_type, { "Pseudowire Type", "l2tp.avp.pseudowire_type", FT_UINT16, BASE_DEC, VALS(pw_types_vals), 0x0, NULL, HFILL }},
3707       { &hf_l2tp_avp_layer2_specific_sublayer, { "Layer2 Specific Sublayer", "l2tp.avp.layer2_specific_sublayer", FT_UINT16, BASE_DEC, VALS(l2_sublayer_vals), 0x0, NULL, HFILL }},
3708       { &hf_l2tp_avp_data_sequencing, { "Data Sequencing", "l2tp.avp.data_sequencing", FT_UINT16, BASE_DEC, VALS(data_sequencing_vals), 0x0, NULL, HFILL }},
3709       { &hf_l2tp_avp_circuit_status, { "Circuit Status", "l2tp.avp.circuit_status", FT_BOOLEAN, 16, TFS(&tfs_up_down), 0x0001, NULL, HFILL }},
3710       { &hf_l2tp_avp_circuit_type, { "Circuit Type", "l2tp.avp.circuit_type", FT_BOOLEAN, 16, TFS(&tfs_new_existing), 0x0002, NULL, HFILL }},
3711       { &hf_l2tp_avp_preferred_language, { "Preferred Language", "l2tp.avp.preferred_language", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3712       { &hf_l2tp_avp_nonce, { "Nonce", "l2tp.avp.nonce", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3713       { &hf_l2tp_avp_tx_connect_speed_v3, { "Tx Connect Speed v3", "l2tp.avp.tx_connect_speed_v3", FT_UINT64, BASE_HEX|BASE_VAL64_STRING|BASE_SPECIAL_VALS, VALS64(unique_indeterminable_or_no_link), 0x0, NULL, HFILL }},
3714       { &hf_l2tp_avp_rx_connect_speed_v3, { "Rx Connect Speed v3", "l2tp.avp.rx_connect_speed_v3", FT_UINT64, BASE_HEX|BASE_VAL64_STRING|BASE_SPECIAL_VALS, VALS64(unique_indeterminable_or_no_link), 0x0, NULL, HFILL }},
3715       { &hf_l2tp_lapd_info, { "LAPD info", "l2tp.lapd_info", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3716       { &hf_l2tp_session_id, { "Packet Type", "l2tp.session_id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3717       { &hf_l2tp_zero_length_body_message, { "Zero Length Body message", "l2tp.zero_length_body_message", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3718       { &hf_l2tp_offset_padding, { "Offset Padding", "l2tp.offset_padding", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3719     };
3720
3721     static gint *ett[] = {
3722         &ett_l2tp,
3723         &ett_l2tp_ctrl,
3724         &ett_l2tp_avp,
3725         &ett_l2tp_avp_sub,
3726         &ett_l2tp_ale_sub,
3727         &ett_l2tp_l2_spec,
3728         &ett_l2tp_lcp,
3729         &ett_l2tp_csu,
3730         &ett_l2tp_ericsson_tcg,
3731         &ett_l2tp_ericsson_map,
3732     };
3733
3734     static ei_register_info ei[] = {
3735         { &ei_l2tp_incorrect_digest, { "l2tp.incorrect_digest", PI_CHECKSUM, PI_WARN, "Incorrect Digest", EXPFILL }},
3736         /* Generated from convert_proto_tree_add_text.pl */
3737         { &ei_l2tp_vendor_specific_avp_data, { "l2tp.vendor_specific_avp_data", PI_UNDECODED, PI_WARN, "Vendor-Specific AVP data", EXPFILL }},
3738         { &ei_l2tp_avp_length, { "l2tp.avp_length.bad", PI_MALFORMED, PI_ERROR, "Bad AVP length", EXPFILL }},
3739     };
3740
3741     module_t *l2tp_module;
3742     expert_module_t* expert_l2tp;
3743
3744     /* Decode As handling */
3745     static build_valid_func l2tp_da_build_value[1] = {l2tp_value};
3746     static decode_as_value_t l2tp_da_values = {l2tp_prompt, 1, l2tp_da_build_value};
3747     static decode_as_t l2tp_da = {"l2tp", "L2TPv3 payload", "l2tp.pw_type", 1, 0, &l2tp_da_values, NULL, NULL,
3748                                     decode_as_default_populate_list, decode_as_default_reset, decode_as_default_change, NULL};
3749
3750     proto_l2tp = proto_register_protocol(
3751         "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
3752     proto_register_field_array(proto_l2tp, hf, array_length(hf));
3753     proto_register_subtree_array(ett, array_length(ett));
3754     expert_l2tp = expert_register_protocol(proto_l2tp);
3755     expert_register_field_array(expert_l2tp, ei, array_length(ei));
3756
3757     l2tp_vendor_avp_dissector_table = register_dissector_table("l2tp.vendor_avp", "L2TP vendor AVP dissector table", proto_l2tp, FT_UINT32, BASE_DEC);
3758     pw_type_table = register_dissector_table("l2tp.pw_type", "L2TPv3 payload type", proto_l2tp, FT_UINT32, BASE_DEC);
3759
3760     l2tp_module = prefs_register_protocol(proto_l2tp, NULL);
3761
3762     prefs_register_enum_preference(l2tp_module,
3763                                    "cookie_size",
3764                                    "L2TPv3 Cookie Size",
3765                                    "L2TPv3 Cookie Size",
3766                                    &l2tpv3_cookie,
3767                                    l2tpv3_cookies,
3768                                    FALSE);
3769
3770     prefs_register_enum_preference(l2tp_module,
3771                                    "l2_specific",
3772                                    "L2TPv3 L2-Specific Sublayer",
3773                                    "L2TPv3 L2-Specific Sublayer",
3774                                    &l2tpv3_l2_specific,
3775                                    l2tpv3_l2_specifics,
3776                                    FALSE);
3777
3778     prefs_register_obsolete_preference(l2tp_module, "protocol");
3779
3780     prefs_register_string_preference(l2tp_module,"shared_secret","Shared Secret",
3781                                    "Shared secret used for control message digest authentication",
3782                                    &shared_secret);
3783
3784     register_cleanup_routine(l2tp_cleanup);
3785     register_decode_as(&l2tp_da);
3786 }
3787
3788 void
3789 proto_reg_handoff_l2tp(void)
3790 {
3791     dissector_handle_t atm_oam_llc_handle;
3792
3793     l2tp_udp_handle = create_dissector_handle(dissect_l2tp_udp, proto_l2tp);
3794     dissector_add_uint_with_preference("udp.port", UDP_PORT_L2TP, l2tp_udp_handle);
3795
3796     l2tp_ip_handle = create_dissector_handle(dissect_l2tp_ip, proto_l2tp);
3797     dissector_add_uint("ip.proto", IP_PROTO_L2TP, l2tp_ip_handle);
3798
3799     /*
3800      * Get a handle for the PPP-in-HDLC-like-framing dissector.
3801      */
3802     ppp_hdlc_handle = find_dissector_add_dependency("ppp_hdlc", proto_l2tp);
3803     ppp_lcp_options_handle = find_dissector_add_dependency("ppp_lcp_options", proto_l2tp);
3804
3805     /* Register vendor AVP dissector(s)*/
3806     dissector_add_uint("l2tp.vendor_avp", VENDOR_CABLELABS, create_dissector_handle(dissect_l2tp_vnd_cablelabs_avps, proto_l2tp));
3807
3808
3809     /*
3810      * Get a handle for the dissectors used in v3.
3811      */
3812     atm_oam_handle        = find_dissector_add_dependency("atm_oam_cell", proto_l2tp);
3813     llc_handle            = find_dissector_add_dependency("llc", proto_l2tp);
3814
3815     atm_oam_llc_handle = create_dissector_handle( dissect_atm_oam_llc, proto_l2tp );
3816     dissector_add_uint("l2tp.pw_type", L2TPv3_PROTOCOL_AAL5, atm_oam_llc_handle);
3817 }
3818
3819 /*
3820  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
3821  *
3822  * Local variables:
3823  * c-basic-offset: 4
3824  * tab-width: 8
3825  * indent-tabs-mode: nil
3826  * End:
3827  *
3828  * vi: set shiftwidth=4 tabstop=8 expandtab:
3829  * :indentSize=4:tabSize=8:noTabs=true:
3830  */